@torrent-tv/proxy 2.83.4 → 2.83.6

package/services/orchestrators/EncodeOrchestrator.js

@@ -33,6 +33,20 @@ import { contentionPenalty } from "../encode/contention.js";
 import { waits } from "../priority/WaitLedger.js";
 import { SegmentDemand } from "../encode/SegmentDemand.js";
 
+/**
+ * How long nothing is placed on an output whose input has just gone, and the
+ * ceiling that doubling reaches.
+ *
+ * Both are chosen, and are named here as chosen rather than dressed as
+ * measurements: what they bound is not how long the data takes to come back —
+ * that is the swarm's business and nobody here can know it — but how often it
+ * is worth asking. They replace the same two figures, with the same values,
+ * that lived in the session manager and governed only the dead run's own retry
+ * while the plan placed fresh runs beside it every half second.
+ */
+const INPUT_QUIET_BASE_MS = 2_000;
+const INPUT_QUIET_MAX_MS = 15_000;
+
 export class EncodeOrchestrator {
   /** Output address to what has been made of it. @type {Map<string, CoverageMap>} */
   #coverage = new Map();
@@ -47,6 +61,21 @@ export class EncodeOrchestrator {
   /** How runs have ended, by cause. @type {Map<string, number>} */
   #endings = new Map();
 
+  /**
+   * How many times in a row an output's run has died because its input was not
+   * there. Cleared only by a run that PRODUCED something, which is the only
+   * proof that the input can be read — see `#noteInputAvailability`.
+   *
+   * @type {Map<string, number>}
+   */
+  #inputLostAttempts = new Map();
+
+  /** Output address to the time before which nothing is placed on it. @type {Map<string, number>} */
+  #quietUntil = new Map();
+
+  /** The wake-up per output, so a quiet output is reconsidered. @type {Map<string, NodeJS.Timeout>} */
+  #quietTimers = new Map();
+
   /** The last state said out loud, so an unchanged state is not repeated. */
   #lastDescribed = "";
 
@@ -97,6 +126,7 @@ export class EncodeOrchestrator {
     refetchSecPerFilmSecond = () => 0,
     startingSpeedFor = () => 0,
     segmentStore = null,
+    planSoon = null,
     logger,
     now
   }) {
@@ -124,6 +154,9 @@ export class EncodeOrchestrator {
     this.segmentSeconds = segmentSeconds;
     this.logger = logger;
     this.now = typeof now === "function" ? now : Date.now;
+    // Asked for, not commanded: this class decides, and something else owns the
+    // loop that calls it. Absent in a test, where the clock is the test's own.
+    this.planSoon = typeof planSoon === "function" ? planSoon : () => undefined;
   }
 
   /**
@@ -275,6 +308,14 @@ export class EncodeOrchestrator {
    */
   notePriorityMap(address, zones) {
     this.demand.state(address, zones);
+    // NOBODY IS COMING HERE, so what was remembered about this output's input
+    // is about nobody. Kept, those three entries would stay for the life of the
+    // process, and the wait they describe would greet whoever opens this output
+    // next — a viewer arriving is new information, and one attempt for them is
+    // right whatever the last one met.
+    if (!Array.isArray(zones) || zones.length === 0) {
+      this.#forgetInputState(address);
+    }
   }
 
   /**
@@ -366,6 +407,19 @@ export class EncodeOrchestrator {
         });
       }
     }
+    // ITS INPUT WAS NOT THERE A MOMENT AGO, so nothing is placed yet. The sweep
+    // above still runs — a claim left by a dead run must be released whatever
+    // the reason — and only the placing waits. This is the one thing that makes
+    // the delay bind: it used to be timed against the dead run, which the plan
+    // does not consult, so a fresh run went to the same place as fast as ffmpeg
+    // could fail there.
+    //
+    // AND ONLY WHILE NOTHING IS PRODUCING THERE. A run still alive on this
+    // output is proof the input can be read, whatever a run beside it met, so
+    // the wait must not silence an output that is working.
+    if (this.#isQuiet(address) && this.runsOn(address).every((run) => !run.isAlive)) {
+      return;
+    }
     // ONE MAP, NOT ONE WINDOW PER VIEWER PER ZONE.
     //
     // Two viewers a few seconds apart state stretches that overlap, and the plan
@@ -696,6 +750,115 @@ export class EncodeOrchestrator {
       this.#runs.set(ended.address, remaining);
     }
     this.#endings.set(ended.ending, (this.#endings.get(ended.ending) ?? 0) + 1);
+    this.#noteInputAvailability(ended);
+  }
+
+  /**
+   * Remember, per output, that its input was not there — and until when nothing
+   * is to be placed on it.
+   *
+   * **Why the plan has to hold this.** A run whose input has gone is not alive,
+   * so the plan sees the stretch it held as free and places another run there at
+   * once — and the next one dies the same way, because nothing about the state
+   * has changed. There WAS a delay for exactly this, doubling from 2 s to 15 s,
+   * and it governed only the dead run's own retry while the plan went on placing
+   * fresh ones beside it. The comment beside that timer predicted this in as
+   * many words and the code did not prevent it. Field 2026-09-12: 2432 ffmpeg
+   * starts in 23 minutes, one every 0.57 s, for 61 minutes, against a delay that
+   * had long since reached its 15 s cap.
+   *
+   * So the delay lives where the decision is taken. It is not a cure for the
+   * input being away — that is the store's claim being withdrawn and the piece
+   * being fetched again — it is what stops one absent input from costing a
+   * thousand processes and a quarter of a million log lines while it is away.
+   *
+   * @param {{ address: string, ending: string }} ended
+   * @returns {void}
+   */
+  #noteInputAvailability(ended) {
+    if (ended.ending !== ENCODE_EXIT.INPUT_LOST) {
+      // CLEARED ONLY BY PROOF THAT THE INPUT WAS THERE, which is a segment
+      // having come out of it. Any other ending was nearly the rule here and is
+      // wrong: at the moment of failure several runs end at once, and one of
+      // them ending `gone` or `stopped` without producing a thing says nothing
+      // about the input — it would have lifted the wait the one beside it had
+      // just set, which is the storm again with an extra step.
+      const produced =
+        ended.firstOutputMs !== null && ended.firstOutputMs !== undefined
+          ? true
+          : Number.isFinite(ended.reached) && Number.isFinite(ended.from) && ended.reached >= ended.from;
+      if (produced) {
+        this.#inputLostAttempts.delete(ended.address);
+        this.#quietUntil.delete(ended.address);
+      }
+      return;
+    }
+    const attempts = (this.#inputLostAttempts.get(ended.address) ?? 0) + 1;
+    this.#inputLostAttempts.set(ended.address, attempts);
+    const delayMs = Math.min(
+      INPUT_QUIET_MAX_MS,
+      INPUT_QUIET_BASE_MS * 2 ** Math.min(attempts - 1, 6)
+    );
+    this.#quietUntil.set(ended.address, this.now() + delayMs);
+    this.logger.info(
+      `encode-plan on ${ended.address}: its input was not there (attempt ${attempts}) — ` +
+      `placing nothing for ${Math.round(delayMs / 1000)}s`
+    );
+    // THE WAKE-UP, because a plan that refuses to act needs something to ask it
+    // again: nothing about the state changes while the data is away, so no event
+    // would arrive to reconsider it.
+    const timer = setTimeout(() => {
+      this.#quietTimers.delete(ended.address);
+      this.planSoon();
+    }, delayMs);
+    timer.unref?.();
+    const previous = this.#quietTimers.get(ended.address);
+    if (previous) {
+      clearTimeout(previous);
+    }
+    this.#quietTimers.set(ended.address, timer);
+  }
+
+  /**
+   * Whether this output is still waiting before anything may be placed on it.
+   *
+   * A boolean rather than the milliseconds left: the figure had one reader and
+   * that reader only asked whether it was above zero, so it was a number
+   * computed and thrown away. How long the wait is was said when it began.
+   *
+   * @param {string} address
+   * @returns {boolean}
+   */
+  #isQuiet(address) {
+    const until = this.#quietUntil.get(address);
+    if (!Number.isFinite(until)) {
+      return false;
+    }
+    if (until - this.now() <= 0) {
+      this.#quietUntil.delete(address);
+      return false;
+    }
+    return true;
+  }
+
+  /**
+   * Forget everything remembered about an output nobody is producing for.
+   *
+   * Three maps are keyed by address, and an output that goes away leaves an
+   * entry in each for the life of the process. Small, and exactly the shape of
+   * accumulation this layer was built to remove from the session.
+   *
+   * @param {string} address
+   * @returns {void}
+   */
+  #forgetInputState(address) {
+    this.#inputLostAttempts.delete(address);
+    this.#quietUntil.delete(address);
+    const timer = this.#quietTimers.get(address);
+    if (timer) {
+      clearTimeout(timer);
+      this.#quietTimers.delete(address);
+    }
   }
 
   /**

package/services/piece-store/piece-disk-store.js

@@ -83,6 +83,17 @@ export class PieceDiskStore {
   /** Where the live readers stand, from whoever holds that fact. @type {() => number[]} */
   #readHeads;
 
+  /**
+   * Said whenever this tier stops holding a piece, whatever the reason.
+   *
+   * It states THIS tier's own fact and nothing more — not whether the bytes can
+   * still be had elsewhere, which this class has no way of knowing. Whoever
+   * listens decides what the loss means.
+   *
+   * @type {(index: number) => void}
+   */
+  #onForgotten;
+
   /**
    * @param {object} params
    * @param {string} params.directory - Where this torrent's pieces live.
@@ -95,12 +106,21 @@ export class PieceDiskStore {
    *   means nobody has said yet, and nothing is evicted until somebody does.
    * @param {() => number} [params.now]
    */
-  constructor({ directory, name, chunkLength, allowanceBytes = null, now = Date.now, readHeads = () => [] }) {
+  constructor({
+    directory,
+    name,
+    chunkLength,
+    allowanceBytes = null,
+    now = Date.now,
+    readHeads = () => [],
+    onForgotten = () => undefined
+  }) {
     this.#directory = path.join(directory, name);
     this.#chunkLength = chunkLength;
     this.#allowanceBytes = Number.isFinite(allowanceBytes) && allowanceBytes >= 0 ? allowanceBytes : null;
     this.#now = now;
     this.#readHeads = typeof readHeads === "function" ? readHeads : () => [];
+    this.#onForgotten = typeof onForgotten === "function" ? onForgotten : () => undefined;
     this.#adoptWhatIsAlreadyHere();
   }
 
@@ -345,6 +365,9 @@ export class PieceDiskStore {
         }
       });
     this.#removing.set(index, removal);
+    // SAID AFTER THE FACT IS TRUE, so a listener that asks this tier whether it
+    // holds the piece is told the same thing this method has just made so.
+    this.#onForgotten(index);
   }
 
   /**

package/services/piece-store/shared-piece-store.js

@@ -321,6 +321,11 @@ export class SharedPieceStore {
     admittedWithoutSlot: 0,
     evictedOnRevise: 0,
     spillFailures: 0,
+    // Claims withdrawn: pieces this store stopped being able to produce at all,
+    // and said so. It is the figure that says whether the bargain the eviction
+    // states — "a seek back re-downloads it" — is being honoured, and before
+    // 2026-09-12 it was not honoured once, because nothing was ever said.
+    withdrawn: 0,
     // Whether the store is doing its job or being asked to hold more than it
     // has room for. An eviction that had to take a piece a reader declared it
     // wants is the second, and it comes back from disk moments later
@@ -413,6 +418,31 @@ export class SharedPieceStore {
    */
   #isElsewhere = null;
 
+  /**
+   * Said when this store can no longer produce a piece AT ALL — not resident,
+   * not on disk, and not inside a file held whole.
+   *
+   * **Why it has to exist.** This store holds the bytes, so it owns the fact
+   * "this proxy has piece N". Something else kept a second copy of that fact —
+   * the torrent's own completion bitfield — and nothing reconciled them: the
+   * disk tier drops a piece behind every read head, correctly, and the bitfield
+   * goes on saying the piece is verified. A read then concludes the piece is
+   * had, asks for it, is told it is absent, and fails; and it is never
+   * re-downloaded either, because the library does not fetch what it believes
+   * it already owns. Field 2026-09-12: a film played 80 seconds, the encoder
+   * ran on to 725 s, `forgetBehind` dropped some 565 spilled pieces including
+   * piece 0, the encoder restarted and re-opened its input at byte 0, and
+   * `/stream` answered `0 of 2363497962 bytes: Piece 0 is verified but absent
+   * from the store` for 92 minutes while the browser retried one segment.
+   *
+   * So the bitfield becomes a projection of this fact, maintained by this
+   * announcement. This store does not know what a torrent is, who listens, or
+   * what they do about it — the same shape as `readPieceElsewhere` above.
+   *
+   * @type {((what: object) => void) | null}
+   */
+  #onPieceGone = null;
+
   /** Whether the last revision had to exceed the machine's share. */
   #beyondTheMachine = false;
   /**
@@ -477,6 +507,9 @@ export class SharedPieceStore {
     this.#isElsewhere = typeof options.isPieceElsewhere === "function"
       ? options.isPieceElsewhere
       : null;
+    this.#onPieceGone = typeof options.onPieceGone === "function"
+      ? options.onPieceGone
+      : null;
     // Plain data the layer above needs to answer those two, and which this
     // store is handed anyway: where each file of the torrent begins and how
     // long the whole of it is.
@@ -496,7 +529,12 @@ export class SharedPieceStore {
       allowanceBytes: null,
       // Where the live readers stand, so what goes first is decided by them and
       // not by which piece happened to be touched longest ago.
-      readHeads: () => this.#lru.readHeads()
+      readHeads: () => this.#lru.readHeads(),
+      // EVERY WAY A PIECE LEAVES THE DISK COMES THROUGH HERE — behind the read
+      // heads, over the allowance, dropped as a duplicate, or forgotten while a
+      // spill finished. One listener instead of a list of call sites to
+      // remember, which is what let the announcement be missed at three of them.
+      onForgotten: (index) => this.#announceGoneIfNowhere(index)
     });
     liveStores.add(this);
   }
@@ -1131,6 +1169,38 @@ export class SharedPieceStore {
       : null;
   }
 
+  /**
+   * Say a piece has gone, but only once it has gone from everywhere.
+   *
+   * The disk tier announces its own loss, which is not the same statement: a
+   * piece dropped as a duplicate of a file held whole has not been lost at all,
+   * and one still resident is about to be spilled again rather than gone. Only
+   * the third case — neither tier, no whole file — is a withdrawal of the claim
+   * that this proxy has those bytes.
+   *
+   * Nothing is said while the store is closing: the torrent it belongs to is
+   * being torn down, and a claim withdrawn against a dying torrent reaches
+   * either a destroyed object or, worse, one that has already been added back.
+   *
+   * @param {number} index
+   * @returns {void}
+   */
+  #announceGoneIfNowhere(index) {
+    if (this.#closed || this.#onPieceGone === null) {
+      return;
+    }
+    if (this.#buffers.has(index) || this.#disk.has(index) || this.isInWholeFiles(index)) {
+      return;
+    }
+    this.#counters.withdrawn += 1;
+    try {
+      this.#onPieceGone({ index, files: this.#files, name: this.#name });
+    } catch {
+      // silent-ok: whoever listens is diagnosing or bookkeeping, and a listener
+      // that throws must not be what fails an eviction the store needs to make.
+    }
+  }
+
   /**
    * Whether a spilled piece is now a duplicate of bytes held elsewhere.
    *

package/services/torrent-pool.js

@@ -18,6 +18,7 @@ import { logger } from "../utils/logger.js";
 import { SharedPieceStore, findSharedStore } from "./piece-store/shared-piece-store.js";
 import { Urgency, urgencyName } from "./demand/index.js";
 import { demandFor, forgetTorrent, reconcileAll, hasUnmetDemand } from "./download/registry.js";
+import { withdrawClaim } from "./download/withdraw-claim.js";
 import { isAtAWatchingViewer, isBehindEverybody, isNobodyComingNow } from "./priority/PriorityMap.js";
 import { deriveSourceKey } from "./torrent-source-key.js";
 
@@ -1066,6 +1067,9 @@ export class TorrentPool {
    */
   #wholeSources = new Set();
 
+  /** How many claims this pool has withdrawn, over its whole life. */
+  #claimsWithdrawn = 0;
+
   /**
    * Say that every file of a source is held whole.
    *
@@ -1098,6 +1102,76 @@ export class TorrentPool {
     this.#storeExtras = extras && typeof extras === "object" ? extras : {};
   }
 
+  /**
+   * Everything a store of this pool is built with, in ONE place.
+   *
+   * It was assembled at both `client.add` sites — the ordinary one and the one
+   * that replaces a torrent the client no longer has — and a store built by the
+   * second was missing whatever the first had gained. That is how a store came
+   * to exist without the whole-file reader it needs, and it is why this is a
+   * method rather than a literal.
+   *
+   * @returns {object}
+   */
+  #storeOptions() {
+    return {
+      memoryBytes: this.#memoryBytes,
+      ...this.#storeExtras,
+      // WIRED BY THE POOL ITSELF, not handed in: withdrawing the claim needs
+      // only a torrent, and this class is the one that owns them. Last, so a
+      // caller's extras cannot displace the one thing that keeps the library's
+      // completion bitfield in step with the bytes.
+      onPieceGone: (what) => this.withdrawPieceClaim(what)
+    };
+  }
+
+  /**
+   * Withdraw the claim that this proxy has a piece, because the store that held
+   * it no longer can produce it.
+   *
+   * **Whose job this is.** The store owns the bytes and therefore owns the fact;
+   * the library keeps a second copy of that fact in its completion bitfield, and
+   * this pool is the only thing here that owns a torrent, so reconciling the two
+   * is this class's and nothing else's. The store announces and does not know
+   * who listens.
+   *
+   * **What it costs.** The piece is re-created as incomplete, so the next read
+   * that wants it waits for a download instead of failing. Field 2026-09-12,
+   * which is what this is for: 565 spilled pieces were dropped behind the read
+   * heads — correctly, they were behind every reader — the bitfield went on
+   * saying they were verified, the encoder restarted and re-opened its input at
+   * byte 0, and `Piece 0 is verified but absent from the store` then answered
+   * every read for 92 minutes. Nothing re-downloaded it, because the library
+   * does not fetch what it believes it owns.
+   *
+   * **What it deliberately does not do.** `_markUnverified` would also re-select
+   * the piece, and does not here: every torrent is added with `deselect: true`,
+   * which sets the library's own `_startAsDeselected` and makes it skip that
+   * call. The download set has one owner — `SwarmSelection`, from the priority
+   * map — and a piece withdrawn here is fetched again when a read states it,
+   * which is the same statement every other piece waits on.
+   *
+   * @param {object} what
+   * @param {number} what.index
+   * @param {object[]} what.files - The store's own, from which the torrent that
+   *   owns them is found; the store has no idea what a torrent is.
+   * @returns {void}
+   */
+  withdrawPieceClaim({ index, files }) {
+    const outcome = withdrawClaim({
+      index,
+      files,
+      warn: (line) => logger.warn(`torrent-pool: ${line}`)
+    });
+    if (outcome === "withdrawn") {
+      this.#claimsWithdrawn += 1;
+    }
+  }
+
+  get claimsWithdrawn() {
+    return this.#claimsWithdrawn;
+  }
+
   constructor({ maxDiskBytes, memoryBytes, dhtBootstrap } = {}) {
     this.#memoryBytes = Number.isFinite(memoryBytes) && memoryBytes > 0 ? memoryBytes : undefined;
 
@@ -1842,7 +1916,7 @@ export class TorrentPool {
                 const addedReplacement = this.client.add(torrentId, {
                   store: SharedPieceStore,
                   storeCacheSlots: 0,
-                  storeOpts: { memoryBytes: this.#memoryBytes, ...this.#storeExtras },
+                  storeOpts: this.#storeOptions(),
                   deselect: true
                 }, (replacement) => {
                   this.torrents.set(key, replacement);
@@ -1875,7 +1949,7 @@ export class TorrentPool {
       const added = this.client.add(torrentId, {
         store: SharedPieceStore,
         storeCacheSlots: 0,
-        storeOpts: { memoryBytes: this.#memoryBytes, ...this.#storeExtras },
+        storeOpts: this.#storeOptions(),
         // Nothing is fetched until somebody says they want it. WebTorrent's own
         // default is `this.select(0, this.pieces.length - 1)` — the whole
         // torrent — and this proxy used to undo that afterwards by deselecting

package/services/torrent-worker/client.js

@@ -17,7 +17,7 @@
 import { Worker } from "node:worker_threads";
 import { Readable } from "node:stream";
 import { fileURLToPath } from "node:url";
-import { logger } from "../../utils/logger.js";
+import { logger, writeAlreadyDecided } from "../../utils/logger.js";
 import { createCaller, createReceiveStream } from "./channel.js";
 import { Command, Event } from "./protocol.js";
 
@@ -218,7 +218,10 @@ export class TorrentWorkerClient {
           this.#fragmentReaders.delete(message.id);
           break;
         case Event.LOG:
-          logger.info(`torrent-worker: ${message.message}`);
+          // Written as it is: the worker holds the same repeat rule and has
+          // already applied it, and deciding again here would be one decision
+          // taken twice on two different histories.
+          writeAlreadyDecided(message.level ?? "info", `torrent-worker: ${message.message}`);
           break;
         case Event.FILE_COMPLETE:
           // Recorded here so the stream route can answer from the file without

package/services/torrent-worker/piece-reader.js

@@ -734,6 +734,10 @@ export async function* readFragments({
     }
   };
 
+  // How many times THIS piece has been asked for again after the store
+  // withdrew it. Reset once a piece is in hand, so the allowance is per piece.
+  let withdrawnRetries = 0;
+
   try {
     for (let pieceIndex = firstPiece; pieceIndex <= lastPiece; pieceIndex += 1) {
       if (cancellation.isCancelled()) {
@@ -986,8 +990,33 @@ export async function* readFragments({
 
       if (!located) {
         store.unpin(pieceIndex);
-        throw new Error(`Piece ${pieceIndex} is verified but absent from the store.`);
+        // THE CLAIM HAS JUST BEEN WITHDRAWN, so this is a wait and not a
+        // failure. The store drops a piece behind every read head, and a read
+        // that re-opens an input at byte 0 — which is every encoder restart —
+        // asks for exactly those pieces. Until 2026-09-12 this threw, ffmpeg
+        // read the empty body as the end of the file, and the encoder died and
+        // was restarted into the same emptiness: field, `Piece 0 is verified
+        // but absent from the store` answered every read for 92 minutes while
+        // the viewer looked at a still picture.
+        //
+        // Going back one step re-runs this piece's whole path rather than a
+        // shortened copy of it: the bitfield now says the piece is missing, so
+        // the block above declares it, steers it onto the fastest holders and
+        // waits for it, exactly as it does for a piece that was never here.
+        // Once per piece — a second emptiness means the bytes are not coming
+        // and the caller must hear so.
+        if (withdrawnRetries === 0) {
+          withdrawnRetries += 1;
+          pieceIndex -= 1;
+          continue;
+        }
+        throw new Error(
+          `Piece ${pieceIndex} was withdrawn from the store and did not come back.`
+        );
       }
+      // Counted per piece: a long read may legitimately meet this more than
+      // once, and each piece is entitled to its own second chance.
+      withdrawnRetries = 0;
 
       let releasedThisPiece = false;
       // Remembered so the generator can drop it itself. The pin is taken here

package/services/torrent-worker/worker.js

@@ -56,8 +56,12 @@ import { forwardLogsTo, logger } from "../../utils/logger.js";
  * copy of the logger that had no file, and every one of their lines was lost:
  * measured over a whole 49 938-line file, not one of them was in it.
  */
-forwardLogsTo((_level, message) => {
-  parentPort.postMessage({ type: Event.LOG, message });
+forwardLogsTo((level, message) => {
+  // THE LEVEL TRAVELS TOO. It was dropped here, so every line this thread wrote
+  // — a warning about a spill that failed, an error about a torrent that went
+  // away — arrived on the other side as information and was coloured and
+  // recorded as such.
+  parentPort.postMessage({ type: Event.LOG, level, message });
 });
 
 // Imported dynamically, and that is load-bearing: static imports are RESOLVED
@@ -658,6 +662,7 @@ startMemoryReport({
 const STORE_REPORT_INTERVAL_MS = 60_000;
 
 /** Last reported reserve, so an unchanged one stays silent. */
+let lastClaimsWithdrawn = 0;
 let lastReserveBytes = 0;
 
 /** Last reported figures per store, so unchanged ones stay silent. */
@@ -695,6 +700,20 @@ setInterval(() => {
       );
     }
   }
+  // WHAT THE ANNOUNCEMENTS ACTUALLY DID. The stores count every piece they
+  // stopped being able to produce; this counts the ones where the library did
+  // still hold a claim and it was taken back. The GAP between the two is the
+  // reading: announcements far above withdrawals mean the stores are mostly
+  // dropping pieces that were never completed, and a withdrawal count stuck at
+  // zero while announcements climb means the mechanism is not reaching the
+  // torrent at all.
+  if (pool.claimsWithdrawn !== lastClaimsWithdrawn) {
+    lastClaimsWithdrawn = pool.claimsWithdrawn;
+    log(
+      `torrent-pool: ${pool.claimsWithdrawn} piece claim(s) withdrawn — pieces this proxy ` +
+      "had dropped and has now told the swarm it needs again"
+    );
+  }
   const reserveNow = machineReserveBytes();
   if (reserveNow !== reserveBefore || reserveNow !== lastReserveBytes) {
     lastReserveBytes = reserveNow;
@@ -708,7 +727,7 @@ setInterval(() => {
       `${stats.fromMemory}/${stats.fromDisk}/${stats.spills}/${stats.revivals}/` +
       `${stats.blockedByPins}/${stats.evictedOnRevise}/${stats.spillFailures}/` +
       `${stats.evictedProtected}/${stats.demand?.unionPieces ?? 0}/${stats.admittedToDisk}/` +
-      `${stats.blocksAllocated}/${stats.blocksFree}/${stats.blocksReleased}`;
+      `${stats.blocksAllocated}/${stats.blocksFree}/${stats.blocksReleased}/${stats.withdrawn}`;
     if (lastReported.get(stats.name) === signature) {
       continue;
     }
@@ -729,6 +748,13 @@ setInterval(() => {
       (stats.admittedWithoutSlot > 0 ? ` to-disk-for-want-of-memory=${stats.admittedWithoutSlot}` : "") +
       (stats.stillMs > 1000 ? ` nothing-moved-for=${Math.round(stats.stillMs / 1000)}s` : "") +
       (stats.evictedOnRevise > 0 ? ` evictedOnRevise=${stats.evictedOnRevise}` : "") +
+      // How many pieces this store stopped being able to produce and said so,
+      // which is what makes the eviction's own bargain checkable: every one of
+      // these is a piece the torrent has been told to fetch again if it is ever
+      // wanted. A session where this climbs while reads keep succeeding is the
+      // bargain working; before 2026-09-12 the figure did not exist and the
+      // claim was never withdrawn at all.
+      (stats.withdrawn > 0 ? ` withdrawn=${stats.withdrawn}` : "") +
       (stats.spillFailures > 0 ? ` spill-failures=${stats.spillFailures}` : "") +
       (stats.outstanding > 0 ? ` outstanding=${stats.outstanding}` : "")
     );