@torrent-tv/proxy 2.83.4 → 2.83.5

package/services/piece-store/piece-disk-store.js

@@ -83,6 +83,17 @@ export class PieceDiskStore {
   /** Where the live readers stand, from whoever holds that fact. @type {() => number[]} */
   #readHeads;
 
+  /**
+   * Said whenever this tier stops holding a piece, whatever the reason.
+   *
+   * It states THIS tier's own fact and nothing more — not whether the bytes can
+   * still be had elsewhere, which this class has no way of knowing. Whoever
+   * listens decides what the loss means.
+   *
+   * @type {(index: number) => void}
+   */
+  #onForgotten;
+
   /**
    * @param {object} params
    * @param {string} params.directory - Where this torrent's pieces live.
@@ -95,12 +106,21 @@ export class PieceDiskStore {
    *   means nobody has said yet, and nothing is evicted until somebody does.
    * @param {() => number} [params.now]
    */
-  constructor({ directory, name, chunkLength, allowanceBytes = null, now = Date.now, readHeads = () => [] }) {
+  constructor({
+    directory,
+    name,
+    chunkLength,
+    allowanceBytes = null,
+    now = Date.now,
+    readHeads = () => [],
+    onForgotten = () => undefined
+  }) {
     this.#directory = path.join(directory, name);
     this.#chunkLength = chunkLength;
     this.#allowanceBytes = Number.isFinite(allowanceBytes) && allowanceBytes >= 0 ? allowanceBytes : null;
     this.#now = now;
     this.#readHeads = typeof readHeads === "function" ? readHeads : () => [];
+    this.#onForgotten = typeof onForgotten === "function" ? onForgotten : () => undefined;
     this.#adoptWhatIsAlreadyHere();
   }
 
@@ -345,6 +365,9 @@ export class PieceDiskStore {
         }
       });
     this.#removing.set(index, removal);
+    // SAID AFTER THE FACT IS TRUE, so a listener that asks this tier whether it
+    // holds the piece is told the same thing this method has just made so.
+    this.#onForgotten(index);
   }
 
   /**

package/services/piece-store/shared-piece-store.js

@@ -321,6 +321,11 @@ export class SharedPieceStore {
     admittedWithoutSlot: 0,
     evictedOnRevise: 0,
     spillFailures: 0,
+    // Claims withdrawn: pieces this store stopped being able to produce at all,
+    // and said so. It is the figure that says whether the bargain the eviction
+    // states — "a seek back re-downloads it" — is being honoured, and before
+    // 2026-09-12 it was not honoured once, because nothing was ever said.
+    withdrawn: 0,
     // Whether the store is doing its job or being asked to hold more than it
     // has room for. An eviction that had to take a piece a reader declared it
     // wants is the second, and it comes back from disk moments later
@@ -413,6 +418,31 @@ export class SharedPieceStore {
    */
   #isElsewhere = null;
 
+  /**
+   * Said when this store can no longer produce a piece AT ALL — not resident,
+   * not on disk, and not inside a file held whole.
+   *
+   * **Why it has to exist.** This store holds the bytes, so it owns the fact
+   * "this proxy has piece N". Something else kept a second copy of that fact —
+   * the torrent's own completion bitfield — and nothing reconciled them: the
+   * disk tier drops a piece behind every read head, correctly, and the bitfield
+   * goes on saying the piece is verified. A read then concludes the piece is
+   * had, asks for it, is told it is absent, and fails; and it is never
+   * re-downloaded either, because the library does not fetch what it believes
+   * it already owns. Field 2026-09-12: a film played 80 seconds, the encoder
+   * ran on to 725 s, `forgetBehind` dropped some 565 spilled pieces including
+   * piece 0, the encoder restarted and re-opened its input at byte 0, and
+   * `/stream` answered `0 of 2363497962 bytes: Piece 0 is verified but absent
+   * from the store` for 92 minutes while the browser retried one segment.
+   *
+   * So the bitfield becomes a projection of this fact, maintained by this
+   * announcement. This store does not know what a torrent is, who listens, or
+   * what they do about it — the same shape as `readPieceElsewhere` above.
+   *
+   * @type {((what: object) => void) | null}
+   */
+  #onPieceGone = null;
+
   /** Whether the last revision had to exceed the machine's share. */
   #beyondTheMachine = false;
   /**
@@ -477,6 +507,9 @@ export class SharedPieceStore {
     this.#isElsewhere = typeof options.isPieceElsewhere === "function"
       ? options.isPieceElsewhere
       : null;
+    this.#onPieceGone = typeof options.onPieceGone === "function"
+      ? options.onPieceGone
+      : null;
     // Plain data the layer above needs to answer those two, and which this
     // store is handed anyway: where each file of the torrent begins and how
     // long the whole of it is.
@@ -496,7 +529,12 @@ export class SharedPieceStore {
       allowanceBytes: null,
       // Where the live readers stand, so what goes first is decided by them and
       // not by which piece happened to be touched longest ago.
-      readHeads: () => this.#lru.readHeads()
+      readHeads: () => this.#lru.readHeads(),
+      // EVERY WAY A PIECE LEAVES THE DISK COMES THROUGH HERE — behind the read
+      // heads, over the allowance, dropped as a duplicate, or forgotten while a
+      // spill finished. One listener instead of a list of call sites to
+      // remember, which is what let the announcement be missed at three of them.
+      onForgotten: (index) => this.#announceGoneIfNowhere(index)
     });
     liveStores.add(this);
   }
@@ -1131,6 +1169,38 @@ export class SharedPieceStore {
       : null;
   }
 
+  /**
+   * Say a piece has gone, but only once it has gone from everywhere.
+   *
+   * The disk tier announces its own loss, which is not the same statement: a
+   * piece dropped as a duplicate of a file held whole has not been lost at all,
+   * and one still resident is about to be spilled again rather than gone. Only
+   * the third case — neither tier, no whole file — is a withdrawal of the claim
+   * that this proxy has those bytes.
+   *
+   * Nothing is said while the store is closing: the torrent it belongs to is
+   * being torn down, and a claim withdrawn against a dying torrent reaches
+   * either a destroyed object or, worse, one that has already been added back.
+   *
+   * @param {number} index
+   * @returns {void}
+   */
+  #announceGoneIfNowhere(index) {
+    if (this.#closed || this.#onPieceGone === null) {
+      return;
+    }
+    if (this.#buffers.has(index) || this.#disk.has(index) || this.isInWholeFiles(index)) {
+      return;
+    }
+    this.#counters.withdrawn += 1;
+    try {
+      this.#onPieceGone({ index, files: this.#files, name: this.#name });
+    } catch {
+      // silent-ok: whoever listens is diagnosing or bookkeeping, and a listener
+      // that throws must not be what fails an eviction the store needs to make.
+    }
+  }
+
   /**
    * Whether a spilled piece is now a duplicate of bytes held elsewhere.
    *

package/services/torrent-pool.js

@@ -18,6 +18,7 @@ import { logger } from "../utils/logger.js";
 import { SharedPieceStore, findSharedStore } from "./piece-store/shared-piece-store.js";
 import { Urgency, urgencyName } from "./demand/index.js";
 import { demandFor, forgetTorrent, reconcileAll, hasUnmetDemand } from "./download/registry.js";
+import { withdrawClaim } from "./download/withdraw-claim.js";
 import { isAtAWatchingViewer, isBehindEverybody, isNobodyComingNow } from "./priority/PriorityMap.js";
 import { deriveSourceKey } from "./torrent-source-key.js";
 
@@ -1098,6 +1099,79 @@ export class TorrentPool {
     this.#storeExtras = extras && typeof extras === "object" ? extras : {};
   }
 
+  /**
+   * Everything a store of this pool is built with, in ONE place.
+   *
+   * It was assembled at both `client.add` sites — the ordinary one and the one
+   * that replaces a torrent the client no longer has — and a store built by the
+   * second was missing whatever the first had gained. That is how a store came
+   * to exist without the whole-file reader it needs, and it is why this is a
+   * method rather than a literal.
+   *
+   * @returns {object}
+   */
+  #storeOptions() {
+    return {
+      memoryBytes: this.#memoryBytes,
+      ...this.#storeExtras,
+      // WIRED BY THE POOL ITSELF, not handed in: withdrawing the claim needs
+      // only a torrent, and this class is the one that owns them. Last, so a
+      // caller's extras cannot displace the one thing that keeps the library's
+      // completion bitfield in step with the bytes.
+      onPieceGone: (what) => this.withdrawPieceClaim(what)
+    };
+  }
+
+  /**
+   * Withdraw the claim that this proxy has a piece, because the store that held
+   * it no longer can produce it.
+   *
+   * **Whose job this is.** The store owns the bytes and therefore owns the fact;
+   * the library keeps a second copy of that fact in its completion bitfield, and
+   * this pool is the only thing here that owns a torrent, so reconciling the two
+   * is this class's and nothing else's. The store announces and does not know
+   * who listens.
+   *
+   * **What it costs.** The piece is re-created as incomplete, so the next read
+   * that wants it waits for a download instead of failing. Field 2026-09-12,
+   * which is what this is for: 565 spilled pieces were dropped behind the read
+   * heads — correctly, they were behind every reader — the bitfield went on
+   * saying they were verified, the encoder restarted and re-opened its input at
+   * byte 0, and `Piece 0 is verified but absent from the store` then answered
+   * every read for 92 minutes. Nothing re-downloaded it, because the library
+   * does not fetch what it believes it owns.
+   *
+   * **What it deliberately does not do.** `_markUnverified` would also re-select
+   * the piece, and does not here: every torrent is added with `deselect: true`,
+   * which sets the library's own `_startAsDeselected` and makes it skip that
+   * call. The download set has one owner — `SwarmSelection`, from the priority
+   * map — and a piece withdrawn here is fetched again when a read states it,
+   * which is the same statement every other piece waits on.
+   *
+   * @param {object} what
+   * @param {number} what.index
+   * @param {object[]} what.files - The store's own, from which the torrent that
+   *   owns them is found; the store has no idea what a torrent is.
+   * @returns {void}
+   */
+  withdrawPieceClaim({ index, files }) {
+    const outcome = withdrawClaim({
+      index,
+      files,
+      warn: (line) => logger.warn(`torrent-pool: ${line}`)
+    });
+    if (outcome === "withdrawn") {
+      this.#claimsWithdrawn += 1;
+    }
+  }
+
+  /** How many claims this pool has withdrawn, over its whole life. */
+  #claimsWithdrawn = 0;
+
+  get claimsWithdrawn() {
+    return this.#claimsWithdrawn;
+  }
+
   constructor({ maxDiskBytes, memoryBytes, dhtBootstrap } = {}) {
     this.#memoryBytes = Number.isFinite(memoryBytes) && memoryBytes > 0 ? memoryBytes : undefined;
 
@@ -1842,7 +1916,7 @@ export class TorrentPool {
                 const addedReplacement = this.client.add(torrentId, {
                   store: SharedPieceStore,
                   storeCacheSlots: 0,
-                  storeOpts: { memoryBytes: this.#memoryBytes, ...this.#storeExtras },
+                  storeOpts: this.#storeOptions(),
                   deselect: true
                 }, (replacement) => {
                   this.torrents.set(key, replacement);
@@ -1875,7 +1949,7 @@ export class TorrentPool {
       const added = this.client.add(torrentId, {
         store: SharedPieceStore,
         storeCacheSlots: 0,
-        storeOpts: { memoryBytes: this.#memoryBytes, ...this.#storeExtras },
+        storeOpts: this.#storeOptions(),
         // Nothing is fetched until somebody says they want it. WebTorrent's own
         // default is `this.select(0, this.pieces.length - 1)` — the whole
         // torrent — and this proxy used to undo that afterwards by deselecting

package/services/torrent-worker/piece-reader.js

@@ -734,6 +734,10 @@ export async function* readFragments({
     }
   };
 
+  // How many times THIS piece has been asked for again after the store
+  // withdrew it. Reset once a piece is in hand, so the allowance is per piece.
+  let withdrawnRetries = 0;
+
   try {
     for (let pieceIndex = firstPiece; pieceIndex <= lastPiece; pieceIndex += 1) {
       if (cancellation.isCancelled()) {
@@ -986,8 +990,33 @@ export async function* readFragments({
 
       if (!located) {
         store.unpin(pieceIndex);
-        throw new Error(`Piece ${pieceIndex} is verified but absent from the store.`);
+        // THE CLAIM HAS JUST BEEN WITHDRAWN, so this is a wait and not a
+        // failure. The store drops a piece behind every read head, and a read
+        // that re-opens an input at byte 0 — which is every encoder restart —
+        // asks for exactly those pieces. Until 2026-09-12 this threw, ffmpeg
+        // read the empty body as the end of the file, and the encoder died and
+        // was restarted into the same emptiness: field, `Piece 0 is verified
+        // but absent from the store` answered every read for 92 minutes while
+        // the viewer looked at a still picture.
+        //
+        // Going back one step re-runs this piece's whole path rather than a
+        // shortened copy of it: the bitfield now says the piece is missing, so
+        // the block above declares it, steers it onto the fastest holders and
+        // waits for it, exactly as it does for a piece that was never here.
+        // Once per piece — a second emptiness means the bytes are not coming
+        // and the caller must hear so.
+        if (withdrawnRetries === 0) {
+          withdrawnRetries += 1;
+          pieceIndex -= 1;
+          continue;
+        }
+        throw new Error(
+          `Piece ${pieceIndex} was withdrawn from the store and did not come back.`
+        );
       }
+      // Counted per piece: a long read may legitimately meet this more than
+      // once, and each piece is entitled to its own second chance.
+      withdrawnRetries = 0;
 
       let releasedThisPiece = false;
       // Remembered so the generator can drop it itself. The pin is taken here

package/services/torrent-worker/worker.js

@@ -708,7 +708,7 @@ setInterval(() => {
       `${stats.fromMemory}/${stats.fromDisk}/${stats.spills}/${stats.revivals}/` +
       `${stats.blockedByPins}/${stats.evictedOnRevise}/${stats.spillFailures}/` +
       `${stats.evictedProtected}/${stats.demand?.unionPieces ?? 0}/${stats.admittedToDisk}/` +
-      `${stats.blocksAllocated}/${stats.blocksFree}/${stats.blocksReleased}`;
+      `${stats.blocksAllocated}/${stats.blocksFree}/${stats.blocksReleased}/${stats.withdrawn}`;
     if (lastReported.get(stats.name) === signature) {
       continue;
     }
@@ -729,6 +729,13 @@ setInterval(() => {
       (stats.admittedWithoutSlot > 0 ? ` to-disk-for-want-of-memory=${stats.admittedWithoutSlot}` : "") +
       (stats.stillMs > 1000 ? ` nothing-moved-for=${Math.round(stats.stillMs / 1000)}s` : "") +
       (stats.evictedOnRevise > 0 ? ` evictedOnRevise=${stats.evictedOnRevise}` : "") +
+      // How many pieces this store stopped being able to produce and said so,
+      // which is what makes the eviction's own bargain checkable: every one of
+      // these is a piece the torrent has been told to fetch again if it is ever
+      // wanted. A session where this climbs while reads keep succeeding is the
+      // bargain working; before 2026-09-12 the figure did not exist and the
+      // claim was never withdrawn at all.
+      (stats.withdrawn > 0 ? ` withdrawn=${stats.withdrawn}` : "") +
       (stats.spillFailures > 0 ? ` spill-failures=${stats.spillFailures}` : "") +
       (stats.outstanding > 0 ? ` outstanding=${stats.outstanding}` : "")
     );

package/test/input-lost-quiets-the-plan.test.js

@@ -0,0 +1,261 @@
+/**
+ * @file An output whose input is away gets no encoders until it may.
+ *
+ * A run whose input has gone is not alive, so the plan reads the stretch it held
+ * as free and places another run there at once — which dies the same way,
+ * because nothing about the state has changed. A delay existed for exactly this,
+ * doubling from 2 s to 15 s, and it was timed against the DEAD RUN, which the
+ * plan never consults. Field 2026-09-12: 2432 ffmpeg starts in 23 minutes, one
+ * every 0.57 s, for 61 minutes, against a delay that had reached its ceiling
+ * long before; the flood also turned the log over twice and destroyed the
+ * record of how the failure began.
+ *
+ * The delay lives beside the decision it governs now, and these check that it
+ * binds.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { EventEmitter } from "node:events";
+import { EncodeRun } from "../services/encode/EncodeRun.js";
+import { ENCODE_EXIT } from "../services/encode/encode-exit.js";
+import { SoftwareEncoder } from "../services/encode/SoftwareEncoder.js";
+import { EncodeOrchestrator } from "../services/orchestrators/EncodeOrchestrator.js";
+
+const PICTURE = "torrent:abc:fmt=fmp4:grid=kf@0:video-only:v=0/copy";
+
+class FakeProcess extends EventEmitter {
+  constructor() {
+    super();
+    this.pid = 1;
+  }
+
+  kill(signal) {
+    this.emit("exit", null, signal);
+  }
+}
+
+/** An orchestrator whose clock the test moves, and a count of what it started. */
+function orchestrator() {
+  const lines = [];
+  let clock = 1_000;
+  let started = 0;
+  let asked = 0;
+  /** @type {EncodeOrchestrator} */
+  let made;
+  /** @type {{ run: EncodeRun, process: FakeProcess }[]} */
+  const runs = [];
+  made = new EncodeOrchestrator({
+    maxRunsFor: () => 1,
+    segmentSeconds: 4,
+    startingSpeedFor: () => 2,
+    refetchSecPerFilmSecond: () => 0.25,
+    now: () => clock,
+    planSoon: () => { asked += 1; },
+    logger: { info: (line) => lines.push(line), warn: (line) => lines.push(line) },
+    makeRun: ({ address, from, to }) => {
+      started += 1;
+      const process_ = new FakeProcess();
+      const run = new EncodeRun({
+        address,
+        encoder: new SoftwareEncoder(),
+        from,
+        to,
+        buildArgs: () => ["-i", "in", "out"],
+        spawn: () => process_,
+        logger: { info: (line) => lines.push(line), warn: (line) => lines.push(line) },
+        now: () => clock,
+        onEnded: (ended) => made.noteEnded(ended)
+      });
+      runs.push({ run, process: process_ });
+      return run;
+    }
+  });
+  made.setSegmentCount(PICTURE, 1000);
+  made.noteStartupCosts({ killCostSec: 0, firstByteWaitSec: 0.12 });
+
+  const wants = () => made.notePriorityMap(PICTURE, [
+    { from: 0, to: 20, priority: 1, withinSeconds: 0 }
+  ]);
+
+  return {
+    made,
+    lines,
+    wants,
+    runs,
+    startedCount: () => started,
+    askedToPlanAgain: () => asked,
+    advance: (ms) => { clock += ms; },
+    /** End the newest run the way a torrent going away ends one. */
+    loseTheInput: () => {
+      const newest = runs[runs.length - 1];
+      made.noteEnded({
+        address: PICTURE,
+        run: newest.run,
+        from: newest.run.from,
+        to: newest.run.to,
+        ending: ENCODE_EXIT.INPUT_LOST,
+        because: "the torrent went away"
+      });
+    }
+  };
+}
+
+test("nothing is placed on an output whose input has just gone", () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+  assert.equal(stand.startedCount(), 1, "one encoder for the one thing wanted");
+
+  stand.loseTheInput();
+  // The plan is asked again by every event there is — a request, a report, a
+  // piece — and in the field that was about twice a second.
+  for (let attempt = 0; attempt < 20; attempt += 1) {
+    stand.made.reconcile();
+  }
+  assert.equal(
+    stand.startedCount(),
+    1,
+    "twenty decisions while the input is away must not be twenty processes"
+  );
+});
+
+test("once the wait is over the plan places again", () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+  stand.loseTheInput();
+  stand.made.reconcile();
+  assert.equal(stand.startedCount(), 1);
+
+  // The first wait is the base delay; anything past it lets the plan act.
+  stand.advance(2_001);
+  stand.made.reconcile();
+  assert.equal(stand.startedCount(), 2, "the data may be back, and that is worth one attempt");
+});
+
+test("the wait doubles while the input stays away, and is capped", () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+
+  const waits = [];
+  for (let attempt = 0; attempt < 8; attempt += 1) {
+    stand.loseTheInput();
+    // Find the shortest advance that lets the plan act again, by stepping to
+    // just before and just after the boundary rather than reading a private.
+    let waited = 0;
+    const step = 250;
+    for (;;) {
+      const before = stand.startedCount();
+      stand.made.reconcile();
+      if (stand.startedCount() > before) {
+        break;
+      }
+      stand.advance(step);
+      waited += step;
+      assert.ok(waited < 60_000, "a wait must not be unbounded");
+    }
+    waits.push(waited);
+  }
+
+  for (let at = 1; at < waits.length; at += 1) {
+    assert.ok(
+      waits[at] >= waits[at - 1],
+      `the wait must not shrink while the input stays away: ${JSON.stringify(waits)}`
+    );
+  }
+  assert.ok(
+    waits[waits.length - 1] <= 15_000,
+    `and it must stop growing: ${JSON.stringify(waits)}`
+  );
+  assert.ok(
+    waits[waits.length - 1] > waits[0],
+    `and it must actually have grown: ${JSON.stringify(waits)}`
+  );
+});
+
+test("a wake-up is asked for, because no event arrives while the data is away", async () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+  stand.loseTheInput();
+  // The wake-up runs on the real clock — the orchestrator's injected `now` is
+  // what the DECISION reads, and a timer is not a decision. So this waits for
+  // the condition, with a deadline only as a backstop; a fixed pause here would
+  // measure the machine.
+  const deadline = Date.now() + 10_000;
+  while (stand.askedToPlanAgain() === 0) {
+    if (Date.now() > deadline) {
+      assert.fail("nothing about the state changes while the input is missing, so the plan must be recalled");
+    }
+    await new Promise((resolve) => setTimeout(resolve, 25));
+  }
+  assert.ok(stand.askedToPlanAgain() >= 1);
+});
+
+test("an ending that is not about the input clears the wait", () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+  stand.loseTheInput();
+  stand.made.reconcile();
+  assert.equal(stand.startedCount(), 1, "held back, as it should be");
+
+  stand.advance(2_001);
+  stand.made.reconcile();
+  assert.equal(stand.startedCount(), 2);
+
+  // This one PRODUCED and was then stopped: a segment came out of the input, so
+  // the input was plainly there and the next attempt starts from no delay.
+  const newest = stand.runs[stand.runs.length - 1];
+  stand.made.noteEnded({
+    address: PICTURE,
+    run: newest.run,
+    from: newest.run.from,
+    to: newest.run.to,
+    reached: newest.run.from,
+    firstOutputMs: 120,
+    ending: ENCODE_EXIT.STOPPED,
+    because: "we asked it to"
+  });
+  stand.made.reconcile();
+  assert.equal(stand.startedCount(), 3, "a file that has just produced is not suspect");
+});
+
+test("an ending that produced NOTHING does not lift the wait", () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+  stand.loseTheInput();
+
+  // At the moment of failure several runs end at once. One of them ending
+  // without having made anything proves nothing about the input, and lifting
+  // the wait on it is the storm again with an extra step.
+  const newest = stand.runs[stand.runs.length - 1];
+  stand.made.noteEnded({
+    address: PICTURE,
+    run: newest.run,
+    from: newest.run.from,
+    to: newest.run.to,
+    reached: newest.run.from - 1,
+    firstOutputMs: null,
+    ending: ENCODE_EXIT.GONE,
+    because: "it is no longer running, and it did not say so"
+  });
+  for (let attempt = 0; attempt < 10; attempt += 1) {
+    stand.made.reconcile();
+  }
+  assert.equal(stand.startedCount(), 1, "an ending with nothing produced is no evidence");
+});
+
+test("the wait is said out loud, with the attempt and how long", () => {
+  const stand = orchestrator();
+  stand.wants();
+  stand.made.reconcile();
+  stand.loseTheInput();
+  assert.ok(
+    stand.lines.some((line) => /its input was not there \(attempt 1\)/.test(line)),
+    `the reason nothing is being placed must be readable: ${JSON.stringify(stand.lines.slice(-4))}`
+  );
+});