@torrent-tv/proxy 2.71.1 → 2.72.1

package/services/torrent-worker/subtitle-cues.js

@@ -18,8 +18,11 @@
  */
 
 import { readSubtitlePlan, harvestCluster } from "../container-index/matroska-subtitles.js";
-import { decodeSubtitleSample, readMp4SubtitlePlan } from "../container-index/mp4-subtitles.js";
+import { readMp4SubtitlePlan } from "../container-index/mp4-subtitles.js";
 import { iterateElements } from "../container-index/ebml-reader.js";
+import { MatroskaContainer } from "../container/MatroskaContainer.js";
+import { Mp4Container } from "../container/Mp4Container.js";
+import { finalizeCues } from "../subtitle-convert.js";
 import { detectLanguage } from "../language-detect.js";
 import { logger } from "../../utils/logger.js";
 
@@ -358,7 +361,8 @@ async function walkFor(torrent, fileIndex, state, plan, track, trackNumber) {
         continue;
       }
       harvested.add(sample.offset);
-      const text = decodeSubtitleSample(bytes, track.codecId);
+      // The MP4 has framed this cue and is the one that unframes it.
+      const text = Mp4Container.cueTextOf(bytes, track.codecId);
       if (text) {
         cues.push({
           startSeconds: sample.startSeconds,
@@ -424,9 +428,18 @@ async function walkFor(torrent, fileIndex, state, plan, track, trackNumber) {
         state.cues.set(candidate.trackNumber, into);
       }
       let found = false;
-      for (const cue of harvestCluster(bytes, candidate.trackNumber, plan.secondsPerTick)) {
-        cue.seq = nextSeq(state, candidate.trackNumber);
-        into.push(cue);
+      for (const block of harvestCluster(bytes, candidate.trackNumber, plan.secondsPerTick)) {
+        // The block's bytes become this track's text HERE, where the container
+        // that framed them is known. A cue kept in its framed form and unframed
+        // later cannot be unframed at all: nothing downstream knows which
+        // container it came out of, and guessing from the field count is what
+        // showed the dialogue row's own fields to the viewer.
+        into.push({
+          startSeconds: block.startSeconds,
+          endSeconds: block.endSeconds,
+          text: MatroskaContainer.cueTextOf(block.payload, candidate.codecId),
+          seq: nextSeq(state, candidate.trackNumber)
+        });
         found = true;
       }
       if (found) {
@@ -515,54 +528,6 @@ export async function warmSubtitleCues(torrent, fileIndex, sourceKey) {
   return fresh;
 }
 
-/**
- * Resolve a cue's end time and strip codec-specific formatting, turning a raw
- * block-derived cue into text a player can show directly. The same step
- * `routes/api/subtitles/get.js` applies when building WebVTT for a pull —
- * factored out here so a pushed cue and a pulled one read identically.
- *
- * A cue with no duration — a SimpleBlock, which subtitles rarely use — is
- * given the time until the next one IN THIS LIST, and the last such cue a few
- * seconds. Not an invention about the film: it is what a player does with an
- * open-ended cue, made explicit so every consumer agrees on it.
- *
- * @param {{ startSeconds: number, endSeconds: number | null, text: string }[]} cues
- * @param {string} codecId
- * @returns {{ startSeconds: number, endSeconds: number, text: string }[]}
- */
-export function finalizeCues(cues, codecId) {
-  const isAss = codecId === "S_TEXT/ASS" || codecId === "S_TEXT/SSA";
-  const result = [];
-  cues.forEach((cue, index) => {
-    const next = cues[index + 1];
-    const endSeconds = cue.endSeconds ?? (next ? next.startSeconds : cue.startSeconds + 4);
-    const text = isAss ? assDialogueToText(cue.text) : cue.text.trim();
-    if (!text) {
-      return;
-    }
-    result.push({ startSeconds: cue.startSeconds, endSeconds, text });
-  });
-  return result;
-}
-
-/**
- * The visible text of an ASS dialogue row.
- *
- * A block carries the fields after `Dialogue:` without their header — nine of
- * them, then the text, which itself holds override groups in braces.
- *
- * @param {string} raw
- * @returns {string}
- */
-function assDialogueToText(raw) {
-  const fields = raw.split(",");
-  const text = fields.length > 9 ? fields.slice(9).join(",") : raw;
-  return text
-    .replace(/\{[^}]*\}/g, "")
-    .replace(/\\N/gi, "\n")
-    .trim();
-}
-
 /**
  * The text subtitle tracks of a file, for the menu the viewer sees.
  *

package/services/tracks/TextSubtitleTrack.js

@@ -7,6 +7,7 @@
  */
 
 import { SubtitleTrack } from "./SubtitleTrack.js";
+import { markupKindOf, plainCueText } from "./subtitle-markup.js";
 
 const TEXT_CODECS_MATROSKA = new Set(["S_TEXT/UTF8", "S_TEXT/ASS", "S_TEXT/SSA", "S_TEXT/WEBVTT"]);
 const TEXT_FORMATS_MP4 = new Set(["tx3g", "text", "wvtt"]);
@@ -21,6 +22,23 @@ export class TextSubtitleTrack extends SubtitleTrack {
     return true;
   }
 
+  /** Which markup this track's cue text carries — see `subtitle-markup.js`. */
+  get markupKind() {
+    return markupKindOf(this.textCodec);
+  }
+
+  /**
+   * The visible text of one of this track's cues.
+   *
+   * @param {string} textField - The cue's text field, already out of its
+   *   container's framing. This method knows the codec and not the container,
+   *   which is why it cannot be handed a whole dialogue row.
+   * @returns {string}
+   */
+  plainText(textField) {
+    return plainCueText(textField, this.textCodec);
+  }
+
   static isTextCodec(codecId) {
     return TEXT_CODECS_MATROSKA.has(codecId) || TEXT_FORMATS_MP4.has(codecId);
   }

package/services/tracks/index.js

@@ -4,6 +4,7 @@ export { AudioTrack } from "./AudioTrack.js";
 export { SubtitleTrack } from "./SubtitleTrack.js";
 export { TextSubtitleTrack, TEXT_CODECS_MATROSKA, TEXT_FORMATS_MP4 } from "./TextSubtitleTrack.js";
 export { ImageSubtitleTrack } from "./ImageSubtitleTrack.js";
+export { MarkupKind, markupKindOf, plainCueText } from "./subtitle-markup.js";
 // There is deliberately no class for a track that lives in a file of its own.
 // `<name>.mka` is a Matroska container holding an `AudioTrack`, and
 // `MatroskaContainer` reads it exactly as it reads the picture's — so "external"

package/services/tracks/subtitle-markup.js

@@ -0,0 +1,104 @@
+/**
+ * @file The markup a subtitle codec puts INSIDE the text of one cue, and how to
+ * take it off. One axis of variation, and only one.
+ *
+ * Nothing here knows which container the text came out of. That is the other
+ * axis and it belongs to `container/`: how a cue's bytes are framed is stated by
+ * the CONTAINER's specification, not by the subtitle format's. Matroska
+ * reorders an ASS dialogue row and drops its two timing fields
+ * (`matroska.org/technical/subtitles.html`); a `.ass` file states its own field
+ * order in the `Format:` line of `[Events]`; an MP4 carries each cue as a sample
+ * with a length prefix. Every one of those is a fact about the container.
+ *
+ * What IS a fact about ASS, wherever it is stored: override groups in braces,
+ * `\N` and `\n` for a line break, `\h` for a hard space. That is this file.
+ *
+ * The two were mixed in one function until 2.72.1, which is what broke English
+ * subtitles on an embedded ASS track: the function counted commas to guess
+ * which framing it had been handed, expected ten fields — the shape of a row in
+ * a FILE — and a Matroska block carries nine. Every field of the row was then
+ * shown to the viewer as if it were dialogue. A function that has to guess the
+ * shape of its input is being called by someone who knew and did not say.
+ */
+
+/** How a cue's text is marked up, once the container's framing is off. */
+export const MarkupKind = {
+  /** Sub Station Alpha and its advanced form: `{\pos(…)}`, `\N`, `\h`. */
+  ASS: "ass",
+  /** Nothing to strip: the text is what is shown. */
+  NONE: "none"
+};
+
+/**
+ * Which markup a codec's cue text carries.
+ *
+ * The keys are every name this proxy has for a text subtitle codec: Matroska
+ * CodecIDs (RFC 9559 §5.1.4.1.28 and the codec mappings beside it), MP4 sample
+ * entry types (ISO/IEC 14496-12 §12.6, plus Apple's `tx3g`), and the file
+ * extensions a subtitle shipped beside the film uses. They are listed together
+ * because the ANSWER is the same for all of them — ASS is ASS whether it sits
+ * in a Matroska block, in a file, or nowhere yet — and keeping three tables
+ * would mean three places to forget.
+ *
+ * @type {Map<string, string>}
+ */
+const MARKUP_BY_CODEC = new Map([
+  ["S_TEXT/ASS", MarkupKind.ASS],
+  ["S_TEXT/SSA", MarkupKind.ASS],
+  [".ass", MarkupKind.ASS],
+  [".ssa", MarkupKind.ASS],
+  ["S_TEXT/UTF8", MarkupKind.NONE],
+  ["S_TEXT/WEBVTT", MarkupKind.NONE],
+  [".srt", MarkupKind.NONE],
+  [".vtt", MarkupKind.NONE],
+  [".webvtt", MarkupKind.NONE],
+  ["tx3g", MarkupKind.NONE],
+  ["text", MarkupKind.NONE],
+  ["wvtt", MarkupKind.NONE]
+]);
+
+/**
+ * The markup kind of a codec, by any of its names.
+ *
+ * An unknown codec is answered `NONE` rather than refused: the text is then
+ * shown as it is, which is wrong only in so far as some markup stays visible,
+ * where a refusal would show nothing at all.
+ *
+ * @param {string} codecId - Matroska CodecID, MP4 sample entry type, or a file
+ *   extension including the dot. Case is ignored for extensions, which arrive
+ *   from file names, and kept for the others, which are spelled by a spec.
+ * @returns {string} One of {@link MarkupKind}.
+ */
+export function markupKindOf(codecId) {
+  const name = String(codecId ?? "");
+  return MARKUP_BY_CODEC.get(name) ?? MARKUP_BY_CODEC.get(name.toLowerCase()) ?? MarkupKind.NONE;
+}
+
+/**
+ * The visible text of one cue: its markup taken off, nothing else touched.
+ *
+ * @param {string} text - The cue's text FIELD, already out of the container's
+ *   framing. Handing a whole dialogue row to this is the mistake described at
+ *   the top of this file.
+ * @param {string} codecId
+ * @returns {string} Possibly empty — a cue whose text is only a drawing command
+ *   or a positioning group has nothing to show, and the caller drops it.
+ */
+export function plainCueText(text, codecId) {
+  const raw = String(text ?? "");
+  if (markupKindOf(codecId) !== MarkupKind.ASS) {
+    return raw.trim();
+  }
+  return raw
+    // An override group. Any brace content is a directive, never dialogue:
+    // drawing commands, karaoke timing, positioning, font changes.
+    .replace(/\{[^}]*\}/g, "")
+    // Both breaks reach a player as a break. ASS distinguishes them — `\N` is
+    // always a break, `\n` only where the style does not wrap — and a WebVTT
+    // cue has no way to express the difference, so it takes the break.
+    .replace(/\\N/g, "\n")
+    .replace(/\\n/g, "\n")
+    // A space the renderer may not collapse.
+    .replace(/\\h/g, " ")
+    .trim();
+}

package/services/tunnel-client.js

@@ -34,6 +34,12 @@ import { WebSocket } from "ws";
  *   Called each time the WebSocket connection becomes open (including reconnects).
  *   Use to re-register the proxy so the server's in-memory store stays consistent
  *   after server restarts.
+ * @property {(mediaInfo: object) => { copy: number[], transcode: number[] } | null} [onCanServeRequest]
+ *   Called when the server asks whether this host could sustain a file it has
+ *   been DESCRIBED — height, rate, bitrate, codec — rather than one it holds.
+ *   Answered from this host's startup benchmarks alone: no torrent is added, no
+ *   bytes are fetched and ffmpeg is not run, so it costs milliseconds and can
+ *   be asked of every proxy in the pool at once.
  * @property {() => HealthMetrics} [onHealthRequest]
  *   Called when the server sends a `health-request` message.  The return value is
  *   sent back as `health-response` and used by the server to score this proxy.
@@ -117,6 +123,7 @@ export function createTunnelClient({
   onSignal,
   onConnect,
   onHealthRequest,
+  onCanServeRequest,
   onLog,
   connectionLifetimeMs = CONNECTION_LIFETIME_MS
 }) {
@@ -221,6 +228,26 @@ export function createTunnelClient({
         return;
       }
 
+      // Could this host serve a file it is only told ABOUT? Asked when the
+      // proxy a viewer landed on has refused the file, so the browser can be
+      // sent somewhere that will work instead of being shown an error. The
+      // description travels because the refusing proxy has already probed the
+      // file: the expensive half is done once, and every other proxy answers
+      // by arithmetic.
+      if (message.type === "can-serve-request") {
+        let offer = null;
+        try {
+          offer = typeof onCanServeRequest === "function"
+            ? onCanServeRequest(message.mediaInfo ?? {})
+            : null;
+        } catch {
+          // silent-ok: an unanswerable question is answered "no", which is what
+          // a null offer means to the caller.
+        }
+        send({ type: "can-serve-response", requestId: message.requestId, offer });
+        return;
+      }
+
       // Health check: server requests current metrics for proxy scoring.
       if (message.type === "health-request") {
         const metrics = typeof onHealthRequest === "function" ? onHealthRequest() : {};

package/test/health-metrics.test.js

@@ -0,0 +1,37 @@
+/**
+ * @file What a proxy says about itself, and what the pool scores it on.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import os from "node:os";
+
+import { availableMemoryBytes, collectHealthMetrics } from "../services/health-collector.js";
+
+test("free memory is what could be given out, not what is idle this instant", () => {
+  const available = availableMemoryBytes();
+  assert.ok(Number.isFinite(available) && available > 0);
+
+  // On Linux this reads the kernel's own `MemAvailable`, and it is at least
+  // `os.freemem()` by construction: the kernel keeps free memory low on purpose
+  // and fills the rest with cache, which it hands back the moment anything
+  // asks. The old reading was `os.freemem()`, so a host with 4 GB of cache and
+  // 200 MB genuinely free reported itself nearly full while it had 4.2 GB to
+  // give — and that figure weighs 0.4 of every proxy's score.
+  if (os.platform() === "linux") {
+    assert.ok(
+      available >= os.freemem(),
+      `MemAvailable ${available} is below freemem ${os.freemem()}, which cannot be`
+    );
+  }
+});
+
+test("the health report is three bounded numbers", () => {
+  const metrics = collectHealthMetrics();
+  assert.ok(metrics.cpuLoad >= 0);
+  assert.ok(metrics.memFree > 0 && metrics.memFree <= 1);
+  assert.ok(Number.isInteger(metrics.uptime) && metrics.uptime >= 0);
+  // Three decimals, so a value that has not really moved does not produce a
+  // different message on every poll.
+  assert.equal(metrics.memFree, Math.round(metrics.memFree * 1000) / 1000);
+});

package/test/piece-store-eviction.test.js

@@ -154,10 +154,15 @@ test("the store says why it spills: what is asked of it, what it had to take, ho
       asked.demand.unionPieces > asked.demand.capacity,
       "a reader asking for more than the store holds is arithmetic, not a policy fault"
     );
-    assert.ok(
-      asked.evictedProtected > 0,
-      "every eviction here had to take a piece the reader had declared"
-    );
+    // And it no longer has to take a declared piece to make room. The reader
+    // asked for ten pieces of a store that holds four, and the arrivals that
+    // will be wanted LATER than what is already resident are written straight
+    // to disk instead of displacing what will be wanted sooner. Before
+    // 2026-09-02 every one of them displaced something and was read back
+    // moments later: 233 evictions against 119 completed writes in a minute.
+    assert.equal(asked.evictedProtected, 0, "a nearer piece was pushed out for a further one");
+    assert.equal(asked.spills, 0, "nothing had to be written out to make room on admission");
+    assert.ok(asked.admittedToDisk > 0, "the further arrivals were supposed to go to disk");
 
     // Read back the pieces that were spilled: each one comes home, and the
     // store says how long it had been away.
@@ -167,12 +172,17 @@ test("the store says why it spills: what is asked of it, what it had to take, ho
     }
 
     const after = store.stats();
-    assert.ok(after.revivalAgeSamples > 0, "pieces came back and their age was recorded");
-    assert.equal(typeof after.revivalAgeMedianMs, "number");
-    assert.ok(
-      after.revivedWithinFiveSeconds > 0,
-      "a piece wanted again seconds after it left should not have left"
-    );
+    // Reading them back does evict, and that is ordinary: a piece brought into
+    // memory has to displace one. What the change of 2026-09-02 removed is the
+    // eviction on ADMISSION — `asked.spills` above is zero, where before it all
+    // six arrivals displaced a nearer piece and were read back moments later.
+    assert.ok(after.fromDisk > 0, "the pieces that went to disk were read back from it");
+    assert.ok(after.revivals > 0, "reading one back brings it into memory");
+    // No age to report, and that is right rather than missing: an age measures
+    // how long an EVICTED piece stayed away, and these were never resident —
+    // they were written on arrival and read back once.
+    assert.equal(after.revivalAgeSamples, 0);
+    assert.equal(after.revivalAgeMedianMs, null);
 
     store.releaseProtection("video");
     assert.equal(store.stats().demand.readers, 0, "a reader that ends stops being counted");
@@ -401,3 +411,81 @@ test("the allowance is never cut below one reader's whole window", async () => {
     await fs.rm(directory, { recursive: true, force: true });
   }
 });
+
+test("the pool stays the size it is allowed to be, however many pieces pass through it", async () => {
+  // The field failure of 2026-09-02, and the case none of the earlier checks
+  // covered: an allowance far smaller than the number of pieces in flight.
+  // Both paths that register a piece look first and then await — `put` for a
+  // slot, a revival for the disk — and in that gap another caller can register
+  // the same index. Overwriting the entry dropped the previous block without
+  // returning it, so the pool's count climbed past its ceiling for ever and it
+  // degenerated into a fresh block per piece. A store holding THREE pieces
+  // reported 812 MB committed against 68 MB allowed, 739 blocks allocated and
+  // 676 still alive, and the process was killed at 4.37 GB.
+  const capacity = 4;
+  const { store, directory } = await makeStore(capacity);
+  try {
+    // Concurrent, because that is what produces the race: several peers deliver
+    // pieces of one torrent at the same time.
+    for (let round = 0; round < 6; round += 1) {
+      await Promise.all(
+        Array.from({ length: 16 }, (unused, index) => put(store, index, pieceOf(index)))
+      );
+      // And read them back, which revives from disk and races registration the
+      // other way about.
+      await Promise.all([0, 3, 7, 11, 15].map((index) => get(store, index)));
+    }
+
+    const stats = store.stats();
+    assert.equal(stats.blocksBeyondCeiling, 0, "the pool grew past what it is allowed to hold");
+    assert.ok(
+      stats.blocksAllocated <= capacity + stats.blocksFree,
+      `pool of ${stats.blocksAllocated} blocks for ${capacity} slots and ${stats.blocksFree} spare`
+    );
+    assert.equal(stats.committedBytes, stats.blocksAllocated * PIECE);
+
+    // Every piece still reads back as itself: a block returned to the pool
+    // twice, or reused while somebody held it, shows up here as wrong bytes.
+    for (let index = 0; index < 16; index += 1) {
+      const bytes = await get(store, index);
+      assert.ok(bytes.equals(pieceOf(index)), `piece ${index} came back changed`);
+    }
+  } finally {
+    store.destroy(() => undefined);
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});
+
+test("a piece wanted later than the one it would displace goes to disk instead", async () => {
+  const capacity = 4;
+  const { store, directory } = await makeStore(capacity);
+  try {
+    // A reader is at the start of the file and the store is full of what it
+    // wants. Its window is pieces 0-3.
+    store.protectRange("video", 0, 3);
+    for (let index = 0; index < capacity; index += 1) {
+      await put(store, index, pieceOf(index));
+    }
+    const before = store.stats().admittedToDisk;
+
+    // A piece arrives from far ahead. It IS inside a window in the field case —
+    // six readers covered the whole file — but it lies further from every read
+    // head than the piece the store would have to evict for it. Admitting it
+    // would write out the nearer piece and read that one back sooner.
+    store.protectRange("far", 90, 99);
+    await put(store, 95, pieceOf(95));
+
+    assert.ok(
+      store.stats().admittedToDisk > before,
+      "the further piece was admitted to memory and the nearer one written out"
+    );
+    // And it still reads back as itself, from the disk it was put on.
+    assert.ok((await get(store, 95)).equals(pieceOf(95)));
+    for (let index = 0; index < capacity; index += 1) {
+      assert.ok((await get(store, index)).equals(pieceOf(index)), `piece ${index} was lost`);
+    }
+  } finally {
+    store.destroy(() => undefined);
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});

package/test/piece-store-slow-disk.test.js

@@ -0,0 +1,114 @@
+/**
+ * @file What the allowance has to bound, and why it is not the resident pieces.
+ *
+ * The field failure of 2026-09-02, in one sentence: a piece being written out
+ * leaves the store's own count the moment the eviction begins, while its memory
+ * stays held until the write that reads from it has finished. So every
+ * admission turned one resident block into one block held by the disk and took
+ * a fresh block for the arrival, and the memory in use went UP by one per
+ * admission for as long as the disk was behind.
+ *
+ * It was behind by a factor of two: 233 evictions started against about 119
+ * writes completed in the same minute. The store reported 203 blocks held with
+ * THREE pieces resident and 68 MB allowed, and the kernel killed the process at
+ * 4.37 GB.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { SharedPieceStore } from "../services/piece-store/shared-piece-store.js";
+
+const PIECE = 1024;
+
+/**
+ * A disk that answers only when the test lets it, so writes can be made slower
+ * than arrivals on purpose — which is the whole of the field condition.
+ */
+function heldDisk() {
+  const stored = new Set();
+  /** @type {Array<() => void>} */
+  const waiting = [];
+  return {
+    pending: waiting,
+    get size() {
+      return stored.size;
+    },
+    has: (index) => stored.has(index),
+    forget: (index) => stored.delete(index),
+    write(index) {
+      return new Promise((resolve) => {
+        waiting.push(() => {
+          stored.add(index);
+          resolve();
+        });
+      });
+    },
+    async read(index, target) {
+      target.fill(index % 251);
+      return target.length;
+    },
+    async close() { waiting.length = 0; },
+    async destroy() { stored.clear(); waiting.length = 0; }
+  };
+}
+
+/**
+ * @param {SharedPieceStore} store
+ * @param {number} index
+ * @returns {Promise<void>}
+ */
+const put = (store, index) =>
+  new Promise((resolve, reject) => {
+    store.put(index, Buffer.alloc(PIECE, index % 251), (error) => (error ? reject(error) : resolve()));
+  });
+
+test("memory in use never runs past the allowance while the disk is behind", async () => {
+  const directory = await fs.mkdtemp(path.join(os.tmpdir(), "slow-disk-test-"));
+  const disk = heldDisk();
+  const capacity = 4;
+  const store = new SharedPieceStore(PIECE, {
+    length: PIECE * 200,
+    memoryBytes: PIECE * capacity,
+    path: directory,
+    name: "slow-disk",
+    disk
+  });
+  try {
+    // Fill it, then keep pieces coming while every write stays unfinished.
+    for (let index = 0; index < capacity; index += 1) {
+      await put(store, index);
+    }
+    const arrivals = [];
+    for (let index = capacity; index < capacity + 40; index += 1) {
+      arrivals.push(put(store, index).catch(() => undefined));
+    }
+    // Let them get as far as they can with the disk answering nothing.
+    await new Promise((resolve) => setTimeout(resolve, 200));
+
+    const held = store.stats();
+    // The check the field failure would fail: a store allowed four pieces held
+    // two hundred and three. Blocks held by a pending write count here, because
+    // they are memory whatever the piece count says.
+    assert.ok(
+      held.blocksInUse <= capacity,
+      `${held.blocksInUse} blocks in use with ${capacity} allowed `
+      + `(${held.blocksInFlight} of them held by writes that have not finished)`
+    );
+    assert.ok(held.blocksInFlight > 0, "the disk was supposed to be holding some");
+    assert.ok(held.waitedForDisk > 0, "admission was supposed to wait for the disk, not evict");
+
+    // Let the disk answer: the blocks come back and everything settles.
+    while (disk.pending.length > 0) {
+      disk.pending.shift()?.();
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    }
+    await Promise.all(arrivals);
+    assert.ok(store.stats().blocksInUse <= capacity + 1, "the pool did not settle");
+  } finally {
+    store.destroy(() => undefined);
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});