@torrent-tv/proxy 2.80.18 → 2.81.0

package/services/encode/run-command.js

@@ -703,7 +703,22 @@ export function buildRunCommand({
       "-segment_list_flags",
       "+live",
       ...explicitTimes,
-      segmentFormat.segmentFileNameTemplate()
+      // UNDER A WORKING NAME, not the one it is served as. A piece under its
+      // served name is complete by construction then, whoever else is writing
+      // into the same directory — and the name arrives on the channel above the
+      // instant ffmpeg closes it, which is what turns it into the served one.
+      //
+      // The other branch needs none of this: the HLS muxer writes through a
+      // temporary name of its own (`+temp_file`), so its files appear under
+      // their final name whole.
+      //
+      // TAGGED WITH THE STRETCH IT WAS GIVEN, which names the run without any
+      // counter to keep: intervals never overlap, so two live runs of one output
+      // begin at different numbers by construction. That is what makes clearing
+      // up after a dead run a well-formed question — its unfinished pieces are
+      // the ones carrying its own tag — where before it was answered by taking
+      // the highest SERVED name inside its stretch and judging the bytes.
+      segmentFormat.makingFileNameTemplate(String(safeIndex))
     );
   } else {
     args.push(

package/services/hls-session-manager.js

@@ -8,7 +8,7 @@
  */
 
 import { createReadStream, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
-import { access, readdir, readFile, rm, stat, unlink } from "node:fs/promises";
+import { access, readFile, rm, stat, unlink } from "node:fs/promises";
 import { Readable } from "node:stream";
 import os from "node:os";
 import path from "node:path";
@@ -70,7 +70,6 @@ import { Output, Outputs } from "./output/Output.js";
 import { masterPlaylistText, mediaPlaylistText, segmentIndexForTime } from "./output/playlists.js";
 import { SourceFiles, sourceDecodeCharacteristics } from "./source/SourceFile.js";
 import { ProducedIndex } from "./produced-index.js";
-import { discardOpenPiece } from "./encode/open-piece.js";
 import { SegmentStore } from "./encode/SegmentStore.js";
 import { EncodeCost } from "./quality/EncodeCost.js";
 import {
@@ -89,11 +88,13 @@ import {
 // — did not move when the code did.
 export { ffmpegSeconds, onKeyframeGridFor, seekLandingOffsetFor, segmentCutTimesFrom };
 import { viewersOf } from "./viewer/Viewer.js";
+import { viewerSegmentsOn } from "./viewer/positions.js";
 import { Viewers } from "./viewer/Viewers.js";
 import { LiveOutputs } from "./output/LiveOutputs.js";
 import { variantHeightsFor } from "./output/ladder.js";
 import { EncodeOrchestrator } from "./orchestrators/EncodeOrchestrator.js";
 import { readDiskFree } from "./memory-report.js";
+import { wireDiskSpace } from "./disk/wire.js";
 
 /**
  * Whether an encoder run died because its INPUT went away, rather than because
@@ -425,10 +426,6 @@ const TRUE_START_MEMORY = 200;
 // twice. It runs on the restart path and a session an hour in has thousands of
 // segments; the figure is for a comparison, not an inventory.
 const BACKWARD_RESTART_SCAN_SEGMENTS = 300;
-// Grace period to wait for the PREVIOUS ffmpeg process to exit (per signal
-// escalation step: SIGTERM, then SIGKILL) before spawning its replacement into
-// the same session directory. See #startEncodeRun.
-const ENCODE_RUN_TERMINATE_GRACE_MS = 2_000;
 // A seek-restart run that exits this fast never did real work — it failed at
 // the seek/open step itself (container demux error, bad audio frame boundary,
 // etc.), not mid-stream. Used to tell a genuine seek failure apart from a
@@ -478,18 +475,6 @@ const DEFAULT_SESSION_TTL_MS = 30 * 60 * 1000;
  * there for the life of the process.
  */
 const SEGMENT_STORE_IDLE_MS = 6 * 60 * 60 * 1000;
-/**
- * The share of FREE disk the produced segments may take.
- *
- * A share of what is free NOW, re-read on every sweep, for the same reason the
- * piece store re-derives its memory allowance every minute: a machine that
- * fills up after this proxy started would otherwise go on spending an allowance
- * taken when it was empty. A Home Assistant install often runs from a 32 GB
- * card carrying everything else in the house.
- */
-const SEGMENT_STORE_FREE_SHARE = 0.25;
-/** What the store may hold where the free space cannot be read at all. */
-const SEGMENT_STORE_FALLBACK_BYTES = 2 * 1024 * 1024 * 1024;
 const DEFAULT_STARTUP_WAIT_MS = 5_000;
 // Realtime budget — runtime downswitch (software encoder only). Periodically
 // check each active software-transcode session's ffmpeg `speed`; when it stays
@@ -1609,6 +1594,13 @@ export class HlsSessionManager {
       void this.cleanupExpired();
     }, CLEANUP_INTERVAL_MS);
     this.cleanupTimer.unref();
+    // One owner of the disk, and the list of what takes it lives with the owner.
+    this.diskSpace = wireDiskSpace({
+      segmentStore: this.segmentStore,
+      torrentPool: this.torrentPool,
+      readFree: readDiskFree,
+      logger
+    });
     // Realtime-budget monitor: only meaningful for the software encoder with a
     // benchmark (the only path that can pick/step resolution). Cheap no-op scan
     // otherwise.
@@ -5535,7 +5527,10 @@ export class HlsSessionManager {
       inputUnavailable: (message) => isInputUnavailable(message),
       onProgress: (report) => this.#noteRunProgress(session, run, report),
       indexOfName: (name) => session.segmentFormat.segmentIndexFromName(name),
-      onClosed: (name) => this.segmentStore.markClosed(session.outputKey ?? "", session.segmentFormat.segmentIndexFromName(name)),
+      // Why this encoder exists, recorded with its argument list. It used to be
+      // handed to a separate `start` call; there is no separate call now.
+      because,
+      onClosed: (name) => this.segmentStore.publish(session.outputKey ?? "", name, session.segmentFormat),
       onEnded: (ended) => this.noteRunEnded(session, run, ended)
     });
     session.runs.add(run);
@@ -5548,8 +5543,6 @@ export class HlsSessionManager {
     // premature downscale.
     session.budgetSlowSince = 0;
 
-    run.start(because);
-
     logger.info(
       `transcode ${session.id} encode-run #${safeIndex}..#${runEnd} from segment #${safeIndex} ` +
       `(+${Date.now() - restartEnteredAt}ms since the restart was asked for) ` +
@@ -7692,31 +7685,15 @@ export class HlsSessionManager {
     // disposed. A run that had already finished or failed is not among them,
     // which is what keeps a stop from erasing how it actually ended.
     for (const run of running) {
-      const ffmpeg = run.process;
-      // The stretch it was given, read now rather than when the process finally
-      // exits: by then the session may have started another run with another
-      // stretch, and the piece to discard belongs to this one.
-      const stoppedSpan = {
-        from: Number.isInteger(run.from) ? run.from : 0,
-        to: Number.isInteger(run.to) ? run.to : -1
-      };
       // The run resumes itself if it was suspended — a stopped process does not
       // act on SIGTERM until it is continued — records the cause, and answers
       // its own exit. Nothing here has to null a field so that the exit is read
       // correctly, because there is no shared field left to misread.
       run.stop(reason);
-      // The session outlives its runs — a stopped rung keeps serving what it
-      // made — so the piece this one had open must not be left looking like one
-      // of them. Not awaited: the caller's own work does not depend on it, and
-      // the wait is for a process that has already been told to go.
-      // WHAT THE RUN ITSELF NAMED, which is the only thing that can say a piece
-      // is whole — a piece cut short still decodes. Written 2026-09-06 and never
-      // passed from here, so the clearing-up ran with nothing proven and fell
-      // back to bounding itself by the run's declared stretch alone.
-      const provenName = typeof run.provenName === "string" ? run.provenName : null;
-      void waitForChildExit(ffmpeg, ENCODE_RUN_TERMINATE_GRACE_MS).then(() =>
-        this.#discardUnfinishedPiece(session, session.dirPath, stoppedSpan, provenName)
-      );
+      // Nothing is cleared up from here. What this run left open is under its
+      // own working name, and the encoding layer removes it when the run's
+      // ending reaches it — one place, and it needs neither the stretch nor the
+      // init bytes this method used to fetch to judge a file by its contents.
     }
     logger.info(`transcode ${session.id} ${running.length} encoder(s) stopped: ${reason}`);
   }
@@ -9589,63 +9566,6 @@ export class HlsSessionManager {
     return this.#producedIndex(session).pathOf(fileName);
   }
 
-  /**
-   * Throw away the piece a run was in the middle of when it ended.
-   *
-   * The `segment` muxer creates its output file when it opens it and writes
-   * into it until the next cut, so at any instant exactly one file in a run's
-   * directory is unfinished: the highest-numbered one. A run that reaches the
-   * end of its work closes that file properly and it is a good piece; a run
-   * killed for a seek does not — measured 2026-09-03, ffmpeg exited 19 ms after
-   * SIGTERM and left `segment-00025.mp4` at zero bytes.
-   *
-   * Leaving it is what created the deadlock this method exists to prevent: an
-   * empty file has a name like any other, so it closed the only hole in the
-   * numbering and the look-ahead kept the encoder stopped for having "produced"
-   * it. Removing it at the moment the run ends means the question never has to
-   * be asked again by anyone.
-   *
-   * A piece is removed only when it is unusable. A run that finished its last
-   * file — the ordinary end of a file, or a stop that arrived between two cuts
-   * — has nothing wrong with it, and deleting good output would cost the work
-   * of making it twice.
-   *
-   * @param {HlsSession} session
-   * @param {string | null | undefined} runDirPath
-   * @returns {Promise<void>}
-   */
-  async #discardUnfinishedPiece(session, runDirPath, within = null, provenName = null) {
-    const canJudgeTracks =
-      typeof session.segmentFormat?.hasEveryTrack === "function" &&
-      session.initBytes &&
-      session.initBytes.length > 0;
-    const removed = await discardOpenPiece(
-      runDirPath,
-      session.segmentFormat,
-      within,
-      canJudgeTracks
-        ? (raw) => {
-          const bytes = cutsAtGivenTimes(session) && session.segmentFormat.stripInit
-            ? session.segmentFormat.stripInit(raw)
-            : raw;
-          return session.segmentFormat.hasEveryTrack(bytes, session.initBytes);
-        }
-        : null,
-      provenName
-    );
-    if (removed !== null) {
-      // Removed on purpose, so the index must not go on answering with it.
-      this.#producedIndex(session).invalidate();
-      logger.info(
-        `transcode ${session.id} discarded segment #${removed}: ` +
-          "the run ended while it was open, so it holds no usable piece"
-      );
-    }
-  }
-
-
-
-
   #holdForProduction(session, fileName, isPlaylist, options) {
     /** @type {{ address: string, rank: number, topRank: number } | null} */
     let ranked = null;
@@ -9745,32 +9665,22 @@ export class HlsSessionManager {
     // The segments outlive every session on them, so what they cost is decided
     // here rather than by anybody's departure: how long ago each output was
     // last read, and how much room the disk has for the lot.
+    // The room is the disk owner's to divide; this asks what the share is now.
+    await this.diskSpace.revise();
     this.segmentStore.enforce({
       idleMs: SEGMENT_STORE_IDLE_MS,
-      maxBytes: await this.#segmentStoreAllowance()
+      maxBytes: this.diskSpace.segmentBytes(),
+      viewersAt: (key) =>
+        viewerSegmentsOn({
+          sessions: this.sessionsById.values(),
+          outputKey: key,
+          segmentAt: (session, seconds) => this.#segmentIndexForTime(session, seconds),
+          now: Date.now(),
+          staleAfterMs: this.presenceStaleAfterMs()
+        })
     });
   }
 
-  /**
-   * How much disk the produced segments may hold.
-   *
-   * A share of what is FREE now rather than a figure fixed at startup, for the
-   * same reason the piece store's memory allowance is re-derived every minute:
-   * a machine that fills up after this proxy started would otherwise go on
-   * spending an allowance taken when it was empty. On a Home Assistant install
-   * that disk is often a 32 GB card carrying everything else the household
-   * runs.
-   *
-   * @returns {Promise<number>}
-   */
-  async #segmentStoreAllowance() {
-    const free = await readDiskFree(this.segmentStore.root);
-    if (!Number.isFinite(free) || free <= 0) {
-      return SEGMENT_STORE_FALLBACK_BYTES;
-    }
-    return Math.max(SEGMENT_STORE_FALLBACK_BYTES, Math.floor(free * SEGMENT_STORE_FREE_SHARE));
-  }
-
   /**
    * Return a progress snapshot for the given session, or `null` if not found.
    * Also refreshes `lastAccessedAt` to prevent the session from expiring.
@@ -10156,14 +10066,7 @@ export class HlsSessionManager {
     for (const sessionId of activeIds) {
       await this.disposeSession(sessionId);
     }
-    const rootDir = path.join(os.tmpdir(), "torrent-tv-hls");
-    try {
-      const dirs = await readdir(rootDir);
-      if (dirs.length === 0) {
-        await rm(rootDir, { recursive: true, force: true });
-      }
-    } catch (_error) {
-      // Best effort cleanup.
-    }
+    // Everything this process owns, root included. See SegmentStore.dropAll.
+    this.segmentStore.dropAll("the proxy is shutting down");
   }
 }

package/services/orchestrators/EncodeOrchestrator.js

@@ -273,11 +273,10 @@ export class EncodeOrchestrator {
    * @param {number} index
    */
   noteProduced(address, index) {
-    // TOLD TO THE AUTHORITY, not only to the map. A piece being closed is a fact
-    // about the disk, and the store is what holds those; told to the map alone
-    // it would survive exactly until the next time the map is brought back into
-    // step, and then be gone with no file to show for it.
-    this.segmentStore?.markClosed(address, index);
+    // Nothing is told to the store: by the time this is called the piece is
+    // ALREADY under its served name, because the rename is what closing it
+    // means. A statement kept beside the disk would be a second owner of one
+    // fact, which is what item 87 removed from the coverage map.
     this.coverageOf(address).markReady(index);
     for (const run of this.runsOn(address)) {
       run.noteProduced(index);
@@ -375,6 +374,23 @@ export class EncodeOrchestrator {
     // when the reason it cuts the budget changes, so asking it three times in
     // one pass is three chances to say a thing that happened once.
     const maxRuns = this.#affordableOn(address, live);
+    // THE TERMS EVERY ARRIVAL IS COMPUTED FROM, named here so the line below can
+    // print them. A decision of this plan is `delay + (index - at) / rate +
+    // madeBetween * refetch` against a deadline, so without the rate and the two
+    // prices no recorded decision can be reproduced — which is what happened
+    // with the one-piece intervals of 2026-09-08: the rate was substituted six
+    // times from the speeds the session reported elsewhere and none of them gave
+    // the answer the plan had given.
+    const costs = this.#costs.seconds();
+    const refetchSecPerFilmSecond = this.refetchSecPerFilmSecond(address);
+    // The best figure this host has: what a run here is doing now, what one was
+    // last measured doing, or what the startup benchmark predicted. The first
+    // two are this output's own; the third exists before either.
+    const speedX = Math.max(
+      live.reduce((best, run) => Math.max(best, run.speedX || 0), 0),
+      this.#lastSpeed.get(address) ?? 0,
+      this.startingSpeedFor(address) || 0
+    );
     const actions = planEncoders({
       coverage,
       windows,
@@ -387,26 +403,19 @@ export class EncodeOrchestrator {
       // What a start and a kill cost, measured from this host's own runs rather
       // than written into the code from one machine's reading. Zero until
       // something has been measured, which is the same convention as the
-      // refetch price below and is stated so the bias is known.
-      ...this.#costs.seconds(),
+      // refetch price and is stated so the bias is known.
+      ...costs,
       // What a second of film costs to fetch again, in seconds of swarm time.
       // Answered by whoever measures the film's own byte rate and the swarm's;
       // zero until they have, which makes driving through look cheaper than it
       // is and is stated here so the bias is known.
-      refetchSecPerFilmSecond: this.refetchSecPerFilmSecond(address),
+      refetchSecPerFilmSecond,
       // How much slower one encoder runs beside others, read off this host's own
       // startup measurement. A pure function over a measured table: beyond what
       // was measured it holds the largest reading rather than continuing a curve
       // nothing observed.
       contentionPenaltyFor: (others) => contentionPenalty(others, this.contentionPenalties).penalty,
-      // The best figure this host has: what a run here is doing now, what one
-      // was last measured doing, or what the startup benchmark predicted. The
-      // first two are this output's own; the third exists before either.
-      speedX: Math.max(
-        live.reduce((best, run) => Math.max(best, run.speedX || 0), 0),
-        this.#lastSpeed.get(address) ?? 0,
-        this.startingSpeedFor(address) || 0
-      )
+      speedX
     });
 
     // A move is the plan taking a running encoder away from where it already
@@ -427,10 +436,21 @@ export class EncodeOrchestrator {
     // exiting, twelve of them normally — and the reasons printed beside them
     // read as moves, so the fault was diagnosed three times as something it was
     // not. An interval is what a run is, and it was the one thing missing.
+    //
+    // AND THE TERMS, for the same reason one step further: an interval says what
+    // was decided and the terms say why. `speed` is what every arrival is
+    // divided by, so a decision recorded without it can be re-read and not
+    // recomputed; `firstByte` and `kill` are what a start and a stop cost here;
+    // `refetch` is what a second of film costs to fetch again. A zero in the
+    // last three is a measurement nobody has taken, not a free operation, and it
+    // is printed so that reading it as free is a choice rather than an accident.
     if (actions.some((action) => action.type !== "keep")) {
       this.logger.info(
         `encode-plan on ${address}: ` +
-        `${actions.map((action) => `${action.type} #${action.from ?? "?"}..#${action.to ?? "?"}`).join(", ")}`
+        `${actions.map((action) => `${action.type} #${action.from ?? "?"}..#${action.to ?? "?"}`).join(", ")}` +
+        ` [speed=${speedX.toFixed(2)}x firstByte=${costs.firstByteWaitSec.toFixed(2)}s ` +
+        `kill=${costs.killCostSec.toFixed(2)}s refetch=${refetchSecPerFilmSecond.toFixed(3)}s/s ` +
+        `maxRuns=${maxRuns} live=${live.length}]`
       );
     }
     if (actions.some((action) => action.type === "move")) {
@@ -547,18 +567,16 @@ export class EncodeOrchestrator {
     const onThisOutput = this.#runs.get(address) ?? [];
     onThisOutput.push(run);
     this.#runs.set(address, onThisOutput);
-    // This run rewrites the stretch it was given, so what was closed inside that
-    // stretch is no longer closed. Without this a number closed by an earlier run
-    // stays servable while a later one is halfway through writing it again.
-    //
-    // Bounded by the run's own end, which is the same number the claim below
-    // carries. Unbounded it unproved the whole film beyond the start of any run,
-    // and readiness is now a projection of what is proven — so a one-segment run
-    // at the beginning would have declared the rest of the output unmade.
-    const runsTo = endOfRun({ from, to });
-    this.segmentStore?.forgetClosed(address, from, runsTo);
-    this.coverageOf(address).claim(run, from, runsTo);
-    run.start(because);
+    // Nothing has to be un-proved when a run takes a stretch that has already
+    // been written. A piece is only ever NAMED as served once it is closed, and
+    // a run writing that number again writes under a working name until it
+    // closes its own — so the file standing there is a complete piece made by
+    // somebody, and serving it is right until the newer one replaces it whole.
+    // The claim comes after the run exists, and that is not a race: everything
+    // between is synchronous, and a process cannot say a word before the next
+    // tick. What it removes is the second act — building a run and starting it
+    // were two steps, and two owners each performed the second one.
+    this.coverageOf(address).claim(run, from, endOfRun({ from, to }));
   }
 
   /**
@@ -654,15 +672,11 @@ export class EncodeOrchestrator {
     this.#costs.note(ended);
     // Exactly one ending is normal — the run reached the end of the stretch it
     // was given and closed its last file. Every other leaves a piece open, and
-    // that file looks finished however the run ended: stopped, ffmpeg writes it
-    // out and names it like any other; killed harder, it leaves the bytes it
-    // had. Either way it decodes and holds less film than its number promises.
-    // So what is kept is what the run PROVED it finished, and nothing beyond.
-    if (ended.ending !== ENCODE_EXIT.COMPLETE && this.segmentStore) {
-      void this.segmentStore
-        .discardOpenPieceOf(ended.address, { from: ended.from, to: ended.to }, null, ended.provenName)
-        .catch(() => {});
-    }
+    // that piece is under this run's OWN working name, so clearing up after it
+    // is a name match: no stretch to search and no bytes to judge. Done for
+    // every ending, the normal one included, since a run that finished cleanly
+    // has nothing under a working name and the sweep then removes nothing.
+    this.segmentStore?.clearUpAfter(ended.address, ended.from);
     this.coverageOf(ended.address).release(ended.run);
     const remaining = this.runsOn(ended.address).filter((run) => run !== ended.run);
     if (remaining.length === 0) {

package/services/piece-store/allowance.js

@@ -0,0 +1,107 @@
+/**
+ * @file How much of a machine's resource the stores may hold between them.
+ *
+ * Written once and used twice, because memory and disk are the same question
+ * asked of two resources: what is free now, plus what we already hold, less
+ * what everything that is not us has recently been seen to need.
+ *
+ * It used to exist only for memory, inside the memory store, keyed on module
+ * state. Disk had no such rule at all — the spill file grew until the machine
+ * did, 14.4 GB in a single viewing on 2026-08-31 — and copying the memory rule
+ * across would have made two rules to keep in step. One rule, two readings.
+ */
+
+/**
+ * How many observations of other processes' demand are kept.
+ *
+ * A window rather than a high-water: a single spike would otherwise stand for
+ * the life of the process and hold the stores down long after whatever caused
+ * it had finished.
+ */
+const OTHER_DEMAND_SAMPLES = 60;
+
+/**
+ * What everything that is not us has recently been seen to need.
+ *
+ * One instance per resource. A fall in what is free that we did not cause is a
+ * measurement of somebody else's demand; a fall we did cause is our own doing
+ * and says nothing about the machine.
+ */
+export class OtherDemand {
+  /** @type {number[]} */
+  #falls = [];
+
+  #lastFreeBytes = 0;
+
+  #lastHeldBytes = 0;
+
+  /**
+   * Take a reading, and answer what to reserve for others.
+   *
+   * @param {number} freeBytes - What the machine says is free now.
+   * @param {number} heldBytes - What the stores hold of this resource now.
+   * @returns {number} The reserve, in bytes.
+   */
+  note(freeBytes, heldBytes) {
+    if (this.#lastFreeBytes > 0) {
+      const fell = this.#lastFreeBytes - freeBytes;
+      const ours = heldBytes - this.#lastHeldBytes;
+      this.#falls.push(Math.max(0, fell - ours));
+      if (this.#falls.length > OTHER_DEMAND_SAMPLES) {
+        this.#falls.shift();
+      }
+    }
+    this.#lastFreeBytes = freeBytes;
+    this.#lastHeldBytes = heldBytes;
+    return this.reserve();
+  }
+
+  /** @returns {number} */
+  reserve() {
+    return this.#falls.length === 0 ? 0 : Math.max(...this.#falls);
+  }
+
+  /** Forget the readings. For tests, which share a module. */
+  forget() {
+    this.#falls = [];
+    this.#lastFreeBytes = 0;
+    this.#lastHeldBytes = 0;
+  }
+}
+
+/**
+ * How much of the resource the stores may hold between them.
+ *
+ * What the machine reports free is what could be taken ON TOP of what is
+ * already held, so the stores' own bytes are added back: the pair is the
+ * ceiling the stores could reach.
+ *
+ * @param {number} freeBytes
+ * @param {number} heldBytes
+ * @param {number} reserveBytes
+ * @returns {number}
+ */
+export function machineAllowanceBytes(freeBytes, heldBytes, reserveBytes) {
+  return Math.max(0, Math.max(freeBytes, 0) + Math.max(heldBytes, 0) - Math.max(reserveBytes, 0));
+}
+
+/**
+ * Divide what the machine allows between the stores, by what each is asking
+ * for.
+ *
+ * When everyone's ask fits, everyone gets it and the machine's limit never
+ * binds. When the asks do not fit, each store is cut in proportion to what it
+ * asked, so a store wanting little is not cut to make room for one wanting
+ * much.
+ *
+ * @param {number[]} wantedBytes - What each store is asking for, in order.
+ * @param {number} allowanceBytes
+ * @returns {number[]} What each store may hold, in the same order.
+ */
+export function divideAllowance(wantedBytes, allowanceBytes) {
+  const total = wantedBytes.reduce((sum, want) => sum + Math.max(0, want), 0);
+  if (total <= allowanceBytes || total === 0) {
+    return wantedBytes.map((want) => Math.max(0, want));
+  }
+  return wantedBytes.map((want) => Math.floor(allowanceBytes * (Math.max(0, want) / total)));
+}