@torrent-tv/proxy 2.86.0 → 2.87.1

package/services/{files → storage/files}/CompletedFiles.js

@@ -55,6 +55,26 @@ export class CompletedFiles {
   /** Assemblies in flight, so two passes cannot write one file at once. @type {Set<string>} */
   #writing = new Set();
 
+  /**
+   * What this store may hold, handed to it by the owner of the disk.
+   *
+   * It had NO BOUND AT ALL until 2026-09-14 — a 2.8 GB film kept whole on a
+   * host whose disk is often a 32 GB card, with nothing to say when to stop.
+   * The torrent pool's own "disk cap" did not cover it either: that counted
+   * WebTorrent's downloaded bitfield, so a piece held purely in MEMORY told
+   * against a ceiling called disk, and the bytes here told against nothing.
+   *
+   * Null until the owner has divided anything, and null does not license
+   * growth: it is what a store that has not yet been told looks like, and the
+   * first revision is a minute away.
+   *
+   * @type {number | null}
+   */
+  #allowanceBytes = null;
+
+  /** When each held file was last asked for. @type {Map<string, number>} */
+  #lastRead = new Map();
+
   /**
    * @param {object} params
    * @param {string} params.root - Where whole files live. Outside any torrent's
@@ -100,7 +120,97 @@ export class CompletedFiles {
    * @returns {{ path: string, length: number, name: string } | null}
    */
   find(infoHash, fileIndex) {
-    return this.#held.get(this.#keyOf(infoHash, fileIndex)) ?? null;
+    const key = this.#keyOf(infoHash, fileIndex);
+    const file = this.#held.get(key) ?? null;
+    if (file) {
+      // WHEN IT WAS LAST WANTED, which is the order it leaves in. A whole file
+      // nobody has asked for in the longest is the one whose loss costs least:
+      // it can be downloaded again, and a read of it falls back to the pieces.
+      this.#lastRead.set(key, Date.now());
+    }
+    return file;
+  }
+
+  /**
+   * Say how much disk these files may take between them.
+   *
+   * Over the share, the longest-unread whole file goes — never one being
+   * written, and never the one just asked for. Losing a whole file is not
+   * losing data: the torrent can fetch it again, and until it does the read
+   * falls back to the pieces, which is what `piece-from-whole-file` exists for.
+   *
+   * @param {number} bytes
+   * @returns {{ bytes: number, removed: number }} What is held after, and how
+   *   many files went.
+   */
+  async allow(bytes) {
+    this.#allowanceBytes = Number.isFinite(bytes) && bytes >= 0 ? bytes : null;
+    let removed = 0;
+    if (this.#allowanceBytes === null) {
+      return { bytes: this.bytes, removed };
+    }
+    while (this.bytes > this.#allowanceBytes) {
+      const victim = this.#longestUnread();
+      if (!victim) {
+        break;
+      }
+      await this.#remove(victim);
+      removed += 1;
+    }
+    return { bytes: this.bytes, removed };
+  }
+
+  /**
+   * Whether there is room for a file of this size.
+   *
+   * Asked BEFORE one is assembled, because assembling it and then removing it
+   * is the same bytes written for nothing.
+   *
+   * @param {number} length
+   * @returns {boolean}
+   */
+  hasRoomFor(length) {
+    if (this.#allowanceBytes === null) {
+      return true;
+    }
+    return this.bytes + Math.max(0, Number(length) || 0) <= this.#allowanceBytes;
+  }
+
+  /**
+   * The key of the whole file nobody has wanted for longest, or null.
+   *
+   * @returns {string | null}
+   */
+  #longestUnread() {
+    let oldest = null;
+    let oldestAt = Number.POSITIVE_INFINITY;
+    for (const key of this.#held.keys()) {
+      if (this.#writing.has(key)) {
+        continue;
+      }
+      const at = this.#lastRead.get(key) ?? 0;
+      if (at < oldestAt) {
+        oldest = key;
+        oldestAt = at;
+      }
+    }
+    return oldest;
+  }
+
+  /**
+   * Take one whole file off the disk.
+   *
+   * @param {string} key
+   * @returns {Promise<void>}
+   */
+  async #remove(key) {
+    const file = this.#held.get(key);
+    this.#held.delete(key);
+    this.#lastRead.delete(key);
+    if (!file) {
+      return;
+    }
+    await fs.rm(file.path, REMOVAL).catch(() => undefined);
   }
 
   /**
@@ -197,6 +307,11 @@ export class CompletedFiles {
     if (this.#writing.has(key)) {
       return null;
     }
+    if (!this.hasRoomFor(length)) {
+      // Assembling it and then removing it is the same bytes written for
+      // nothing. The pieces still serve the read; this file simply is not kept.
+      return null;
+    }
     this.#writing.add(key);
     const directory = path.join(this.#root, String(infoHash));
     const where = path.join(directory, String(fileIndex));

package/services/{disk → storage}/free.js

@@ -14,6 +14,7 @@
  */
 
 import { statfs } from "node:fs/promises";
+import { statSync } from "node:fs";
 import path from "node:path";
 
 /**
@@ -36,3 +37,35 @@ export async function freeBytesFor(directory) {
   }
   return null;
 }
+
+/**
+ * Which device holds a directory, so claimants on one disk are told apart from
+ * claimants on another.
+ *
+ * A RESOURCE IS WHAT CANNOT BE SUBSTITUTED, and two filesystems are two of
+ * them. Measured on the addon host 2026-09-05: `/tmp`, where the segments and
+ * the spill live, is the overlay (`dev=68`); `/data`, where the evidence lives,
+ * is ext4 on the nvme (`dev=66305`). Dividing one figure between claimants on
+ * both gives each a share of a disk it does not write to.
+ *
+ * The nearest ancestor that exists, for the same reason `freeBytesFor` walks
+ * up: a claimant's own directory is often made later than this is asked.
+ *
+ * @param {string} directory
+ * @returns {string} A name for the resource, stable for the life of the mount.
+ */
+export function deviceOf(directory) {
+  let at = path.resolve(directory);
+  for (let depth = 0; depth < 16; depth += 1) {
+    try {
+      return `disk:${statSync(at).dev}`;
+    } catch {
+      const up = path.dirname(at);
+      if (up === at) {
+        return "disk:unknown";
+      }
+      at = up;
+    }
+  }
+  return "disk:unknown";
+}

package/services/storage/machine-memory.js

@@ -0,0 +1,56 @@
+/**
+ * @file How much of the machine's memory is available, read once.
+ *
+ * It was written THREE TIMES, in three layers, with the same body each time:
+ * `transport/health-collector.js` for the score a proxy publishes to the registry,
+ * `storage/memory-report.js` for the line the process prints every second, and
+ * `storage/piece-store/shared-piece-store.js` for the budget the piece store takes.
+ * One fact, three owners — and the copies had already drifted once: the piece
+ * store was corrected from `os.freemem()` to the kernel's own estimate on
+ * 2026-08-27 and the health collector went on publishing the wrong quantity
+ * until 2026-09-02, so every Linux proxy in the pool understated itself, each
+ * by a different amount according to how much cache it happened to hold.
+ *
+ * It lives in the storage layer because it is a fact about the RESOURCE, and
+ * this layer is the resource's owner: what is free, what we already hold, and
+ * what everything that is not us has been seen to need.
+ *
+ * **Why `MemAvailable` and not `os.freemem()`.** On Linux `freemem` counts only
+ * the pages free at that instant, and the kernel deliberately keeps that number
+ * low by filling the rest with reclaimable cache — so a machine reads as nearly
+ * full while it has gigabytes to give. `MemAvailable` is the kernel's own
+ * estimate of what an allocation could actually obtain. Where there is no
+ * `/proc` — not Linux, or it is unreadable — `freemem` is the best answer there
+ * is, and on those systems it is not misleading.
+ */
+
+import { readFileSync } from "node:fs";
+import os from "node:os";
+
+/**
+ * What the machine could give an allocation right now.
+ *
+ * @returns {{ bytes: number, measured: boolean }} `measured` is false where the
+ *   kernel's own estimate was not available, so a caller that prints the figure
+ *   can say which of the two it is holding.
+ */
+export function availableMemory() {
+  try {
+    const match = /^MemAvailable:\s+(\d+)\s+kB$/m.exec(readFileSync("/proc/meminfo", "utf8"));
+    if (match) {
+      return { bytes: Number(match[1]) * 1024, measured: true };
+    }
+  } catch {
+    // silent-ok: not Linux, or /proc is not readable.
+  }
+  return { bytes: os.freemem(), measured: false };
+}
+
+/**
+ * What the machine could give an allocation right now, as a plain number.
+ *
+ * @returns {number}
+ */
+export function availableMemoryBytes() {
+  return availableMemory().bytes;
+}