@torrent-tv/proxy 2.79.0 → 2.80.0

package/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 2.80.0
+
+- **Fix**: The reading of usrsctp's own state is OFF unless `--usrsctp-state` is given, and its deadline is counted by a separate process. On 2026-09-05 a delivery probe declared a wedge that lasted half a second and cleared itself; the reading it triggered attached gdb to this process, which stops every one of its eighty threads for as long as it is attached. The log ended mid-second, `/healthz` stopped answering, and the viewer waited a minute and was told the proxy had sent no video. The fifteen-second guard could not fire — it was a timer inside the process gdb had stopped — and killing gdb left the main thread deadlocked for good, so only restarting the addon recovered it. A means of diagnosis may not stop the product: this one attaches to a live process and is triggered by a verdict with a known history of false positives, so it is switched on deliberately while somebody is watching, and `timeout` counts its seconds from outside.
+
 ## 2.79.0
 
 - **Fix**: Starting an encoder no longer stops another one. The line that did it looked for a live run whose own start was not below the new one's and killed it — a rule left from when a session held exactly one run and "the previous one" meant "the only one". Once a session could hold several, it began killing runs the plan had decided to keep: 294 stops for that reason in eight minutes of field 2026-09-05, against four starts a viewer had asked for. Who is stopped is decided in one place now, and starting is not it.

package/bin/cli.js

@@ -85,6 +85,10 @@ program
   .option("--no-transcode-audio", "Disable optional HLS AAC audio transcoding")
   .option("--no-port-mapping", "Disable automatic UPnP/NAT-PMP port mapping")
   .option("--delivery-sink", "Serve /api/delivery-sink, a torrent-free byte stream for delivery testing")
+  .option(
+    "--usrsctp-state",
+    "Read usrsctp's association state with gdb when a wedge is declared. OFF by default: gdb attaches to THIS process and stops every thread of it while it works."
+  )
   .option("--max-disk-bytes <bytes>", "Cap total downloaded torrent data (0 = disabled; default min(10GB, half free disk))")
   .option("--memory-bytes <bytes>", "Per-torrent budget for pieces kept in memory before spilling to disk (default 512MB)")
   .option("--ffmpeg-bin <path>", "Path to ffmpeg binary")
@@ -345,7 +349,22 @@ try {
   // declared (roadmap item 11) — no source rebuild, the module ships
   // unstripped. A host without gdb just never gets a reading, the same way a
   // host without tcpdump never gets a packet capture.
-  usrsctpStateReader = createUsrsctpStateReader({ log: (message) => logger.info(message) });
+  // OFF UNLESS ASKED FOR, and the reason is a field incident rather than
+  // caution. On 2026-09-05 a delivery probe declared a wedge that lasted half a
+  // second and cleared itself; the reading it triggered attached gdb to this
+  // process, which stopped all eighty of its threads. The log ended mid-second,
+  // /healthz stopped answering, and the viewer waited a minute and was told the
+  // proxy had sent no video. The fifteen-second guard could not fire — it is a
+  // timer inside the process gdb had stopped — and killing gdb left the main
+  // thread deadlocked for good, so only restarting the addon recovered it.
+  //
+  // A means of diagnosis may not stop the product. This one attaches to a live
+  // process and is triggered by a verdict with a known history of false
+  // positives, so it is a thing to switch on deliberately while watching, not
+  // something that arms itself.
+  usrsctpStateReader = options.usrsctpState === true
+    ? createUsrsctpStateReader({ log: (message) => logger.info(message) })
+    : null;
 
   // What this process holds, once a minute. The kernel killed the proxy on
   // 2026-08-28 at 2.4 GB resident and the log had never said a word about

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.79.0",
+  "version": "2.80.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/usrsctp-state.js

@@ -17,9 +17,14 @@
  * only as long as someone remembers to copy it back after a container is
  * recreated.
  *
- * `gdb` attaching with ptrace pauses every thread of the process for the
- * duration of the read — one `getsockopt` call, measured at a fraction of a
- * second in the manual procedure this automates.
+ * **THIS STOPS THE PRODUCT WHILE IT WORKS, so it is off unless asked for.**
+ * `gdb` attaches with ptrace and pauses every thread of this process for as
+ * long as it is attached. The manual procedure this automates took a fraction
+ * of a second; on 2026-09-05 the automatic one held the proxy for four minutes
+ * and the viewer was told the proxy had sent no video. Two things follow, and
+ * both are in the code below: the deadline is counted by a separate process,
+ * because a timer inside a stopped process never fires; and `--usrsctp-state`
+ * has to be given for any of this to happen at all.
  */
 
 import { spawn } from "node:child_process";
@@ -91,9 +96,29 @@ export function createUsrsctpStateReader({
             resolve();
           };
           try {
+            // THE DEADLINE IS SET OUTSIDE THE PROCESS THAT IS BEING STOPPED.
+            //
+            // gdb attaches with ptrace and stops every thread of this process
+            // while it works — including whichever one would have counted the
+            // seconds. The guard below used to be a `setTimeout` here, and on
+            // 2026-09-05 it did not fire: gdb held the proxy for four minutes,
+            // the log ended mid-second and the viewer was told the proxy had
+            // sent no video. `timeout` is a separate process and keeps counting
+            // whatever happens to this one.
             child = spawnProcess(
-              "gdb",
-              ["-q", "-batch", "-p", String(pid), "-x", scriptPath],
+              "timeout",
+              [
+                "-s",
+                "KILL",
+                String(Math.ceil(GDB_TIMEOUT_MS / 1000)),
+                "gdb",
+                "-q",
+                "-batch",
+                "-p",
+                String(pid),
+                "-x",
+                scriptPath
+              ],
               { stdio: ["ignore", "pipe", "pipe"] }
             );
           } catch (error) {
@@ -112,13 +137,17 @@ export function createUsrsctpStateReader({
             finish();
           });
           child.on("close", finish);
+          // A second guard, for the case where `timeout` itself is not on the
+          // host: it can only fire while this process is running, which is
+          // exactly what cannot be relied on here, so it is a backstop and not
+          // the deadline.
           const killer = setTimeout(() => {
             try {
               child.kill("SIGKILL");
             } catch {
               // already gone
             }
-          }, GDB_TIMEOUT_MS);
+          }, GDB_TIMEOUT_MS * 2);
           if (typeof killer.unref === "function") {
             killer.unref();
           }

package/test/usrsctp-state.test.js

@@ -62,7 +62,7 @@ async function waitFor(check) {
   }
 }
 
-test("gdb is invoked attached to this process with the bundled script", async () => {
+test("the deadline is counted outside the process gdb stops", async () => {
   const { spawnProcess, calls } = makeSpawn("state=8 rwnd=95890\n");
   const lines = [];
   const reader = createUsrsctpStateReader({
@@ -74,7 +74,23 @@ test("gdb is invoked attached to this process with the bundled script", async ()
   assert.equal(started, true);
   await waitFor(() => lines.length > 0);
   assert.equal(calls.length, 1);
-  assert.deepEqual(calls[0].args, ["-q", "-batch", "-p", "4242", "-x", SCTPSTATE_SCRIPT_PATH]);
+  // `timeout` is a separate process, so it keeps counting while gdb holds every
+  // thread of this one. A `setTimeout` here cannot fire — measured in the field
+  // on 2026-09-05, where gdb held the proxy for four minutes and the guard set
+  // for fifteen seconds never ran.
+  assert.equal(calls[0].command, "timeout");
+  assert.deepEqual(calls[0].args, [
+    "-s",
+    "KILL",
+    "15",
+    "gdb",
+    "-q",
+    "-batch",
+    "-p",
+    "4242",
+    "-x",
+    SCTPSTATE_SCRIPT_PATH
+  ]);
   assert.match(lines[0], /state=8 rwnd=95890/);
   assert.match(lines[0], /test wedge/);
 });