@torrent-tv/proxy 2.89.19 → 2.90.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.89.19",
+  "version": "2.90.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {
@@ -54,6 +54,6 @@
     "@biomejs/biome": "^2.5.7"
   },
   "overrides": {
-    "utp-native": "npm:@torrent-tv/utp-native@2.5.3-ttv.8"
+    "utp-native": "npm:@torrent-tv/utp-native@2.5.3-ttv.9"
   }
 }

package/services/encode/output/cut-grid.js

@@ -105,3 +105,38 @@ export function computeCutGrid({ useKeyframeGrid, durationSeconds, segDur, keyfr
   // all, and an even one serves better than a table with a single entry.
   return boundaries.length >= 2 ? { boundaries, sourceTimes } : uniform();
 }
+
+/**
+ * Whether an output is cut at times we hand the muxer, rather than at a
+ * duration the muxer chooses for itself.
+ *
+ * One answer for the command a run is given and for the serving of what it
+ * made, because both follow from it: given times mean the `segment` muxer,
+ * which writes each piece self-contained under a working name and says when it
+ * has closed it; without them the `hls` muxer names its pieces itself and
+ * writes one init file beside them.
+ *
+ * Every grid is handed over, the even one included. The `hls` muxer finishes
+ * the piece it has open whenever it ends — on our SIGTERM, and when its input
+ * stops — and gives that piece its served name, so a piece shorter than its
+ * span became servable with nothing to say so. Field 2026-09-27, on the
+ * `segment` muxer before its own guard existed: a run stopped while it wrote
+ * #111 left 0.37 s of a 4.2 s piece, the browser appended it, counted the
+ * fragment as loaded and went on to the next one, and the picture stood at
+ * 463.3 s while the player fetched 515.7 s and beyond.
+ *
+ * What is left without times is an output with no grid at all, which has no
+ * duration to cut.
+ *
+ * @param {{ segmentFormat?: { explicitTimesMuxerArgs?: () => string[] | null } | null,
+ *   timeline?: { published?: number[], boundaries?: number[] } | null }} output
+ * @returns {boolean}
+ */
+export function cutsAtGivenTimes(output) {
+  if (!output?.segmentFormat?.explicitTimesMuxerArgs?.()) {
+    return false;
+  }
+  const published = output.timeline?.published;
+  const grid = Array.isArray(published) && published.length > 0 ? published : output.timeline?.boundaries;
+  return Array.isArray(grid) && grid.length >= 2;
+}

package/services/encode/output/index.js

@@ -1,5 +1,6 @@
 export { OutputSpec, VideoOutput, AudioOutput, CutGrid, isOutputName } from "./OutputSpec.js";
 export { PLAYLIST_FILE_NAME } from "./playlists.js";
+export { cutsAtGivenTimes } from "./cut-grid.js";
 
 // FFmpeg may close a segment this far before its requested cut. Both the
 // command and coverage validation use this existing muxer configuration.

package/services/encode/run-command.js

@@ -17,7 +17,7 @@
 
 import { PLAYLIST_FILE_NAME } from "./output/playlists.js";
 import { AUDIO_TRANSCODE_KBPS } from "./args.js";
-import { SEGMENT_CUT_TIME_DELTA_SECONDS } from "./output/index.js";
+import { cutsAtGivenTimes, SEGMENT_CUT_TIME_DELTA_SECONDS } from "./output/index.js";
 
 /**
  * What ffmpeg's own CLI subtracts from an input seek, and therefore what has to
@@ -364,15 +364,26 @@ export function buildRunCommand({
   // the first requested cut. It is never published over another run's output.
   const inputIndex = !transcodeVideo && !audioOnly && explicitTimes && safeIndex > 0
     ? safeIndex - 1 : safeIndex;
-  // A COPY is cut by this list whatever grid it ended up on. Even when no
-  // keyframe index could be read and the boundaries are a plain grid, saying
-  // them outright is what keeps the playlist and the muxer agreeing — ffmpeg
-  // moves each cut forward to the first real keyframe, and serving reads back
-  // where the piece truly begins. Requiring a keyframe grid here dropped a
-  // copy with no index onto the `hls` muxer, which takes no cut list and
-  // writes no self-contained pieces, so nothing could read a true start and
-  // segments were stamped with times the file does not have — the 4.17 s
-  // speech-against-subtitles drift, back again.
+  // EVERY OUTPUT WITH A GRID is cut by this list, whatever the grid is and
+  // whether the picture is copied or re-encoded (`cutsAtGivenTimes`).
+  //
+  // A copy needs it even when no keyframe index could be read and the
+  // boundaries are a plain grid: saying them outright is what keeps the
+  // playlist and the muxer agreeing — ffmpeg moves each cut forward to the
+  // first real keyframe, and serving reads back where the piece truly begins.
+  // Requiring a keyframe grid here dropped a copy with no index onto the `hls`
+  // muxer, which takes no cut list and writes no self-contained pieces, so
+  // nothing could read a true start and segments were stamped with times the
+  // file does not have — the 4.17 s speech-against-subtitles drift, back again.
+  //
+  // A re-encode on the even grid needs it for the proof of a closed piece. The
+  // `hls` muxer finishes the piece it has open whenever it ends, on our SIGTERM
+  // and when its input stops, and renames it to the served name itself, so a
+  // stopped run left a piece shorter than its span where any request could
+  // take it. Measured 2026-10-05 with ffmpeg 8.1.2 on the addon host, a
+  // 4 s piece stopped 3 s in stayed as `segment-00001.mp4` with 3.04 s in it.
+  // Through the `segment` muxer the piece is published only on the encoder's
+  // word and only after its media is shown to reach its cut.
   //
   // Cut on the grid the PLAYER WAS GIVEN, not on the corrected one. A player
   // places a fragment by the playlist it holds, and that text was written
@@ -387,7 +398,7 @@ export function buildRunCommand({
   // created later inherits the corrected table and PUBLISHES it, so its own
   // playlist and its own cuts agree from the start. What they may not do is
   // move the cuts of a session whose playlist is already being read.
-  const gridCutTimes = explicitTimes && (!transcodeVideo || timeline.cutGrid === "keyframe")
+  const gridCutTimes = cutsAtGivenTimes({ segmentFormat, timeline })
     ? segmentCutTimesFrom(publishedGridFor(timeline), inputIndex)
     : null;
   // Cut times are stated on the grid, for both branches.
@@ -721,9 +732,10 @@ export function buildRunCommand({
       // into the same directory — and the name arrives on the channel above the
       // instant ffmpeg closes it, which is what turns it into the served one.
       //
-      // The other branch needs none of this: the HLS muxer writes through a
-      // temporary name of its own (`+temp_file`), so its files appear under
-      // their final name whole.
+      // The other branch cannot do this: the HLS muxer writes through a
+      // temporary name of its own (`+temp_file`) and renames each file itself,
+      // including the one it was writing when it ended. It is left for the runs
+      // that have no cut list at all.
       //
       // TAGGED WITH THE STRETCH IT WAS GIVEN, which names the run without any
       // counter to keep: intervals never overlap, so two live runs of one output

package/services/server/OutputLifecycle.js

@@ -8,7 +8,7 @@
  */
 
 import { logger } from "../../utils/logger.js";
-import { isOutputName } from "../encode/output/index.js";
+import { isOutputName, PLAYLIST_FILE_NAME } from "../encode/output/index.js";
 import { IDLE_KEEP_MS } from "../storage/keep.js";
 /**
  * How long produced segments are kept after the last request for them.
@@ -273,7 +273,12 @@ export class OutputLifecycle {
   adoptSegmentsLeftBehind() {
     // Which container the segments are in is stated by the key itself; a key
     // that cannot say is a directory that goes (`encode/output-key-format.js`).
-    return this.#host.segmentStore.adoptWhatSurvived((key) => this.#host.segmentFormatOfKey(key));
+    // The `hls` muxer writes its own list, under the playlist's name, beside the
+    // pieces it named itself; none of those pieces is proven whole.
+    return this.#host.segmentStore.adoptWhatSurvived(
+      (key) => this.#host.segmentFormatOfKey(key),
+      { selfNamedListFileName: PLAYLIST_FILE_NAME }
+    );
   }
 
   /**

package/services/server/SegmentServing.js

@@ -13,7 +13,7 @@ import { access, readFile, stat, unlink } from "node:fs/promises";
 import { Readable } from "node:stream";
 import path from "node:path";
 import { logger } from "../../utils/logger.js";
-import { isOutputName, PLAYLIST_FILE_NAME } from "../encode/output/index.js";
+import { cutsAtGivenTimes, isOutputName, PLAYLIST_FILE_NAME } from "../encode/output/index.js";
 // The index of variants. Served from the same route as the media playlist, so
 // it needs no path of its own.
 export const MASTER_PLAYLIST_FILE_NAME = "master.m3u8";
@@ -50,25 +50,6 @@ function isSafeFileName(fileName, segmentFormat) {
     segmentFormat.isSegmentFileName(fileName)
   );
 }
-/**
- * Whether this output is cut at times we hand the muxer, rather than at a
- * duration it chooses for itself.
- *
- * A property of the output and not of a run: the cut grid and the branch decide
- * it, so every run of one output answers alike. It decides how a segment is
- * judged finished — see getFileStream.
- *
- * @param {object} session
- * @returns {boolean}
- */
-function cutsAtGivenTimes(session) {
-  const explicit = session?.segmentFormat?.explicitTimesMuxerArgs?.() ?? null;
-  if (!explicit) {
-    return false;
-  }
-  return !session.spec.transcodesVideo || session.timeline?.cutGrid === "keyframe";
-}
-
 export class SegmentServing {
   /** Serving state keyed by the output object it belongs to. */
   #states = new WeakMap();
@@ -275,14 +256,12 @@ export class SegmentServing {
       return this.#holdForProduction(session, fileName, isPlaylist, options);
     }
     try {
-      // Existing is not the same as finished. The `hls` muxer wrote each
-      // segment to a temporary name and renamed it once complete, so a file
-      // appearing WAS a finished segment. The `segment` muxer has no such
-      // option: the file appears when writing begins. Serving it then hands the
-      // player a truncated segment, which it rejects and then simply stops —
-      // observed as playback dying a few seconds in with the encoder still
-      // running happily ahead. A segment is finished once the NEXT one has been
-      // started, or once the run producing it has ended.
+      // Existing is not the same as finished. The `hls` muxer writes each
+      // segment to a temporary name and renames it when it ends the segment —
+      // at its cut, but also on SIGTERM and when its input stops, so a file
+      // appearing there proves only that the muxer let go of it. Every output
+      // with a grid is therefore cut by the `segment` muxer, whose file appears
+      // when writing begins and is served only once it is published below.
       if (!isPlaylist && cutsAtGivenTimes(session)) {
         // WHAT PROVES A PIECE IS WHOLE is the encoder's own word for it: it
         // names each file on a channel of its own the moment it closes it, and

package/services/storage/memory-report.js

@@ -382,6 +382,25 @@ export function readingIsWorthWriting({
   return Math.abs(watchedBytes - lastWrittenBytes) >= changeBytes;
 }
 
+/**
+ * Array-buffer memory that no torrent store accounts for.
+ *
+ * The heap is not the only thing a snapshot explains: every `ArrayBuffer` is in
+ * it, with the size of its backing store and who holds it. On 2026-10-01 the
+ * torrent worker reached 4.3 GB of array buffers while its stores had committed
+ * 40 MB, the kernel killed the process twice, and no snapshot existed, because
+ * the only trigger watched a heap that stood at 300 MB. Pieces the stores hold
+ * are expected; what is above them is the question.
+ *
+ * @param {number} arrayBuffers - The isolate's own `arrayBuffers` figure.
+ * @param {{ committedBytes?: number }[]} stores
+ * @returns {number}
+ */
+export function unaccountedBufferBytes(arrayBuffers, stores = []) {
+  const committed = stores.reduce((sum, store) => sum + (Number(store?.committedBytes) || 0), 0);
+  return Math.max(0, (Number(arrayBuffers) || 0) - committed);
+}
+
 /**
  * Report memory on a timer until stopped.
  *
@@ -408,6 +427,9 @@ export function readingIsWorthWriting({
  * @param {number} [options.snapshotFloorBytes]
  * @param {number} [options.snapshotGrowthBytes]
  * @param {number} [options.keepSnapshots] - Newest to keep; zero keeps all.
+ * @param {number} [options.bufferSnapshotFloorBytes] - Array buffers above what
+ *   the stores hold that earn a snapshot of their own; zero never takes one.
+ * @param {number} [options.bufferSnapshotGrowthBytes]
  * @param {() => string} [options.readExtra] - Figures to append to the line,
  *   read at the same instant as the memory itself.
  * @returns {{ stop: () => void }}
@@ -426,9 +448,12 @@ export function startMemoryReport({
   mayKeep = null,
   snapshotFloorBytes = 500 * 1024 * 1024,
   snapshotGrowthBytes = 100 * 1024 * 1024,
-  keepSnapshots = 0
+  keepSnapshots = 0,
+  bufferSnapshotFloorBytes = 0,
+  bufferSnapshotGrowthBytes = 500 * 1024 * 1024
 }) {
   let highWater = 0;
+  let bufferHighWater = 0;
   /** @type {Record<string, number>} */
   let lastWritten = {};
   let lastWrittenAt = 0;
@@ -556,6 +581,17 @@ export function startMemoryReport({
         highWater = heapWatched;
         await takeSnapshot(heapWatched, "a new high-water of the heap");
       }
+      // The same for array buffers, which a snapshot names as well as it names
+      // the heap: each one is in it with its size and its holder.
+      const unaccounted = unaccountedBufferBytes(processMemory.arrayBuffers, stores);
+      if (
+        bufferSnapshotFloorBytes > 0 &&
+        unaccounted > bufferSnapshotFloorBytes &&
+        unaccounted > bufferHighWater + bufferSnapshotGrowthBytes
+      ) {
+        bufferHighWater = unaccounted;
+        await takeSnapshot(unaccounted, "a new high-water of array buffers no torrent store accounts for");
+      }
       // Under `write` by construction: `anonymousBytes` is only read when the
       // line is, and at one reading a second an unconditional warning would be
       // a line a second for as long as the process stayed large.

package/services/storage/segment-store/SegmentStore.js

@@ -403,6 +403,74 @@ export class SegmentStore {
     return removed;
   }
 
+  /**
+   * Remove the pieces a muxer that names its own pieces left in a directory,
+   * and the list it named them in.
+   *
+   * Asked only of what a previous life of the process left. The `hls` muxer
+   * renames the piece it has open when it ends, so a stopped run leaves a
+   * piece shorter than its span under the served name — the shape of field
+   * 2026-09-27, where #111 held 0.37 s of 4.2 s, the browser appended it and
+   * never asked for that stretch again. The list cannot say which piece is the
+   * short one, so every piece it names goes and is made again.
+   *
+   * @param {string} key
+   * @param {string} dir
+   * @param {{ isSegmentFileName?: (name: string) => boolean, initFileName?: string | null }} format
+   * @param {string | null} listFileName
+   * @returns {number} How many pieces were removed.
+   */
+  #sweepSelfNamed(key, dir, format, listFileName) {
+    if (!listFileName) {
+      return 0;
+    }
+    const listPath = path.join(dir, listFileName);
+    let text;
+    try {
+      text = readFileSync(listPath, "utf8");
+    } catch {
+      return 0;
+    }
+    let removed = 0;
+    for (const line of text.split(/\r?\n/)) {
+      const name = line.trim();
+      if (name.length === 0 || name.startsWith("#") || !format?.isSegmentFileName?.(name)) {
+        continue;
+      }
+      const piecePath = path.join(dir, name);
+      if (!existsSync(piecePath)) {
+        continue;
+      }
+      try {
+        rmSync(piecePath, { force: true });
+        removed += 1;
+      } catch {
+        // Then it stays, and is served as it was before this sweep existed.
+      }
+    }
+    // The list goes with the pieces it named, and so does the init file the
+    // same muxer wrote beside them: nothing else writes one into this
+    // directory, and a piece cut by the list carries its own header.
+    for (const leftover of [listFileName, format?.initFileName]) {
+      if (!leftover) {
+        continue;
+      }
+      try {
+        rmSync(path.join(dir, leftover), { force: true });
+      } catch {
+        // It names or describes pieces that are gone; reading it again removes nothing.
+      }
+    }
+    if (removed > 0) {
+      this.#held.delete(key);
+      this.#logger.info(
+        `segment-store removed ${removed} piece(s) of ${path.basename(dir)} that the hls muxer ` +
+        "named itself: nothing proves they reach their cut"
+      );
+    }
+    return removed;
+  }
+
   /**
    * The encoder has closed a piece: give it the name it is served under.
    *
@@ -564,10 +632,11 @@ export class SegmentStore {
    * muxer writes under a working name and reports the closure on a channel of
    * its own (`publish`); the `hls` muxer writes through a temporary name of its
    * own (`+temp_file`) and reports nothing, so the file simply appears under the
-   * name it is served as. That branch is taken by every re-encoded output on the
-   * even grid — the ordinary quality step — and for those `waitFor` could only
-   * end on its deadline: the segment was on disk and the request that wanted it
-   * went on waiting, up to a full minute, and was then answered 503.
+   * name it is served as. That branch was then taken by every re-encoded output
+   * on the even grid — the ordinary quality step — and for those `waitFor` could
+   * only end on its deadline: the segment was on disk and the request that
+   * wanted it went on waiting, up to a full minute, and was then answered 503.
+   * It is now taken only by a run given no cut list.
    *
    * So the store watches what it owns. The rename into place moves the
    * directory's modification time, the kernel says so, and both branches reach
@@ -1243,9 +1312,12 @@ export class SegmentStore {
    * @param {(key: string) => object | null} formatFor - How to read the file
    *   names of an output, given its key. Null when this proxy cannot serve that
    *   output at all, and then the directory goes.
+   * @param {{ selfNamedListFileName?: string | null }} [writers] - The list a
+   *   muxer that names its own pieces writes beside them. Every piece in it was
+   *   given its served name by that muxer and not by a closure we were told of.
    * @returns {{ adopted: number, dropped: number, unprovenRemoved: number }}
    */
-  adoptWhatSurvived(formatFor) {
+  adoptWhatSurvived(formatFor, { selfNamedListFileName = null } = {}) {
     const swept = this.sweep();
     let adopted = 0;
     let dropped = 0;
@@ -1266,15 +1338,21 @@ export class SegmentStore {
         continue;
       }
       this.#formats.set(entry.key, format);
-      // EVERY SEGMENT FOUND IS COMPLETE, because a piece is given its served
-      // name only once the encoder has said it is closed. So there is nothing to
-      // prove here and nothing to un-prove: what the directory holds under
-      // served names is what a killed process finished.
+      // A SEGMENT GIVEN ITS SERVED NAME BY US IS COMPLETE, because we give it
+      // only once the encoder has said it is closed and its media reaches its
+      // cut. So there is nothing to prove here and nothing to un-prove: what
+      // the directory holds under those names is what a killed process
+      // finished.
       //
       // What it may also hold is pieces it was in the middle of, under their
       // working names, and those are swept — the file a run was writing when the
       // kernel took the process is exactly this.
       unprovenRemoved += this.#sweepUnfinished(entry.key, entry.dir, format);
+      // And pieces the `hls` muxer renamed itself. It renames the piece it has
+      // open whenever it ends, on SIGTERM and when its input stops, so nothing
+      // says any of them reaches its cut; an earlier version cut every
+      // re-encode on the even grid that way. The muxer's own list names them.
+      unprovenRemoved += this.#sweepSelfNamed(entry.key, entry.dir, format, selfNamedListFileName);
       adopted += 1;
       this.#logger.info(
         `segment-store adopted ${path.basename(entry.dir)}: ${this.provenNumbers(entry.key).length} ` +

package/services/torrent/destroyed-torrents.js

@@ -0,0 +1,48 @@
+/**
+ * @file Torrents this process has destroyed and the collector has not taken
+ * back yet.
+ *
+ * Destroying a torrent ends its swarm; it frees nothing while anything still
+ * refers to the object. On 2026-10-04 a torrent worker held 595 destroyed
+ * copies of one film, kept by the listeners of uTP connections whose close
+ * never came back and by idle timers left running for an hour, and the only
+ * sign of it was memory growing at 17 MB a minute. The heap snapshot that named
+ * it was taken by luck. This says it every time the worker reports memory.
+ *
+ * The count is the collector's own answer, so it lags: a figure that returns
+ * towards zero is ordinary, one that only grows is a reference that was not let
+ * go.
+ */
+
+let destroyedTotal = 0;
+let notCollected = 0;
+
+/** @type {WeakSet<object>} */
+const counted = new WeakSet();
+
+const collected = new FinalizationRegistry(() => {
+  notCollected -= 1;
+});
+
+/**
+ * Say that a torrent has been destroyed. Counted once however often it is said.
+ *
+ * @param {object} torrent
+ * @returns {void}
+ */
+export function noteTorrentDestroyed(torrent) {
+  if (!torrent || typeof torrent !== "object" || counted.has(torrent)) {
+    return;
+  }
+  counted.add(torrent);
+  destroyedTotal += 1;
+  notCollected += 1;
+  collected.register(torrent, null);
+}
+
+/**
+ * @returns {{ total: number, notCollected: number }}
+ */
+export function destroyedTorrents() {
+  return { total: destroyedTotal, notCollected };
+}

package/services/torrent/torrent-pool.js

@@ -21,6 +21,7 @@ import { demandFor, forgetTorrent, reconcileAll, hasUnmetDemand } from "./downlo
 import { withdrawClaim } from "./download/withdraw-claim.js";
 import { isAtAWatchingViewer, isBehindEverybody, isNobodyComingNow } from "../viewer/PriorityMap.js";
 import { deriveSourceKey } from "../../utils/torrent-source-key.js";
+import { noteTorrentDestroyed } from "./destroyed-torrents.js";
 
 /** How a window stated from the priority map names itself. */
 const MAP_CLAIMANT = "priority-map";
@@ -1683,6 +1684,10 @@ export class TorrentPool {
       logger.warn(`torrent-pool: [${label()}] warning: ${formatWarning(warning)}`);
     });
 
+    // Counted from here until the collector takes it, which is the only way a
+    // destroyed torrent that something still holds can be seen at all.
+    torrent.once("close", () => noteTorrentDestroyed(torrent));
+
     // A TORRENT THAT DIED WITHOUT US ASKING LEAVES ITS RECORD BEHIND, and the
     // record goes on answering. Field 2026-09-11: the store refused a block,
     // the client destroyed the torrent, and for the rest of the process every
@@ -1862,8 +1867,7 @@ export class TorrentPool {
                   this.torrents.delete(otherKey);
                 }
               }
-              this.#lastAccess.delete(existing);
-              this.#readPositionByTorrent.delete(existing);
+              this.#forgetBookkeeping(existing);
               this.client.remove(existing, { destroyStore: true }, () => {
                 const addedReplacement = this.client.add(torrentId, {
                   store: this.#pieceStore,
@@ -2083,8 +2087,7 @@ export class TorrentPool {
       return;
     }
     forgetTorrent(torrent);
-    this.#lastAccess.delete(torrent);
-    this.#readPositionByTorrent.delete(torrent);
+    this.#forgetBookkeeping(torrent);
     const name = typeof torrent.name === "string" ? torrent.name : "(unknown)";
     logger.warn(
       `torrent-pool: forgot "${name}" [${String(torrent.infoHash ?? "?").slice(0, 8)}] — ` +
@@ -2107,6 +2110,26 @@ export class TorrentPool {
     this.#removeTorrent(torrent, reason);
   }
 
+  /**
+   * Drop everything this pool keeps per torrent, for one that is going.
+   *
+   * Every one of these holds the torrent strongly, and the idle timer above all:
+   * left running, it kept each removed torrent — its pieces, its wires, the
+   * whole object — for the hour it was set for, then fired on the corpse and
+   * logged a second removal. Field 2026-10-04: 184 such removals of a torrent
+   * already gone, and 595 destroyed copies of it alive in one heap.
+   *
+   * @param {import("webtorrent").Torrent} torrent
+   * @returns {void}
+   */
+  #forgetBookkeeping(torrent) {
+    this.#cancelIdleRemoval(torrent);
+    this.#lastAccess.delete(torrent);
+    this.#readPositionByTorrent.delete(torrent);
+    this.#stallSince.delete(torrent);
+    this.#stallReportedAt.delete(torrent);
+  }
+
   #removeTorrent(torrent, reason = "unknown") {
     // Everything anybody stated for this torrent goes with it.
     forgetTorrent(torrent);
@@ -2126,8 +2149,7 @@ export class TorrentPool {
         break;
       }
     }
-    this.#lastAccess.delete(torrent);
-    this.#readPositionByTorrent.delete(torrent);
+    this.#forgetBookkeeping(torrent);
     logger.warn(`torrent-pool: removing torrent "${name}" [${infoHash}] reason=${reason} stated=${stated} downloaded=${hasData}B caller=${caller}`);
     try {
       torrent.destroy({ destroyStore: true }, () => {

package/services/torrent/worker/held-objects.js

@@ -0,0 +1,55 @@
+/**
+ * @file What the torrent thread holds beyond the bytes it accounts for: live
+ * and destroyed torrents, and the uTP sockets and connections behind them.
+ *
+ * These are the objects the heap snapshot of 2026-10-04 found holding the
+ * growth: 957 uTP sockets whose close never completed, 2101 of their 128 KB
+ * read buffers, and through their listeners 595 torrents destroyed long
+ * before. None of it was in any figure this proxy printed. Read on the same
+ * line as the memory, so the count and the mass are the same instant.
+ */
+
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+
+/**
+ * The uTP module's own count of what it holds open, or null where the module is
+ * not built or is a version that does not count.
+ *
+ * Required by name, which resolves to the same copy WebTorrent loads: the image
+ * removes every nested copy and refuses to build if one survives.
+ *
+ * @returns {{ sockets: number, connections: number, closing: number } | null}
+ */
+export function readUtpOpenCount() {
+  try {
+    const utp = require("utp-native");
+    return typeof utp?.openCount === "function" ? utp.openCount() : null;
+  } catch {
+    // silent-ok: no uTP on this host means TCP peers only, and nothing to count.
+    return null;
+  }
+}
+
+/**
+ * One clause for the memory line.
+ *
+ * @param {object} held
+ * @param {number} held.liveTorrents - Torrents the client has now.
+ * @param {{ total: number, notCollected: number }} held.destroyed
+ * @param {{ sockets: number, connections: number, closing: number } | null} held.utp
+ * @returns {string}
+ */
+export function describeHeldObjects({ liveTorrents, destroyed, utp }) {
+  const torrents =
+    `torrents ${liveTorrents} live, ${destroyed.notCollected} destroyed and not collected ` +
+    `(${destroyed.total} destroyed in all)`;
+  if (!utp) {
+    return torrents;
+  }
+  return (
+    `${torrents}; uTP ${utp.sockets} socket(s), ${utp.connections} connection(s), ` +
+    `${utp.closing} destroyed and still closing`
+  );
+}

package/services/torrent/worker/whole-file-stats.js

@@ -0,0 +1,46 @@
+/**
+ * @file The download figures of a file that is held whole on disk.
+ *
+ * Once every file of a torrent is a file, the torrent is removed: it has
+ * nothing left to fetch. The figures a viewer's page polls for still have an
+ * answer, and it is known without the torrent — everything is here and nothing
+ * is arriving. Asking the torrent for them instead brought it back: on
+ * 2026-10-04 a film watched from its whole file was removed and added again
+ * 671 times in two hours, once for every poll after each removal, and every
+ * copy it left behind stayed in memory.
+ */
+
+/**
+ * The same shape `TorrentPool.getFileStats` answers with, for a whole file.
+ *
+ * @param {number} length - Bytes in the file.
+ * @returns {object}
+ */
+export function wholeFileStats(length) {
+  const fileLength = Number.isFinite(length) && length > 0 ? length : 0;
+  return {
+    numPeers: 0,
+    downloadSpeed: 0,
+    uploadSpeed: 0,
+    connectedPeers: 0,
+    deliveringPeers: 0,
+    knownPeers: null,
+    queuedPeers: null,
+    trackerSeeders: null,
+    trackerLeechers: null,
+    trackersAnswered: 0,
+    secondsToFirstPeer: null,
+    secondsWaitingForFirstPeer: null,
+    fileProgress: 1,
+    fileDownloaded: fileLength,
+    fileLength,
+    residence: fileLength > 0 ? [{ start: 0, end: fileLength, location: "whole-file" }] : [],
+    resumeNeededBytes: null,
+    resumeDownloadedBytes: null,
+    resumeAnchorByteStart: null,
+    headerBytes: null,
+    headerDownloadedBytes: null,
+    // Nothing is delivered by a swarm, so there is no supply to describe.
+    supply: null
+  };
+}

package/services/torrent/worker/whole-sources.js

@@ -0,0 +1,77 @@
+/**
+ * @file Which files and sources are held whole on disk, asked by the torrent
+ * thread before it brings a torrent back.
+ *
+ * A torrent whose every file is a file has nothing to fetch, so it is removed;
+ * anything that names the source again rebuilt it from its recipe. That is
+ * right for a read the files cannot answer, and it was wrong for everything
+ * else. The page polls the download figures and the viewers state a priority
+ * map for as long as the film plays, and each of those rebuilt the torrent
+ * only to be told nothing was missing; ten seconds later the sweep removed it
+ * again. Field 2026-10-04: 671 removals in two hours of one viewer watching one
+ * whole file, and every copy left behind in memory.
+ *
+ * So the rule is stated once, here: a file held whole does not bring its
+ * torrent back to be steered or measured, and a source held whole is described
+ * by what was written down when its torrent went. The torrent is used if it
+ * exists.
+ */
+
+/**
+ * What the torrent thread says about a source when it is opened.
+ *
+ * @typedef {object} SourceDescription
+ * @property {string} infoHash
+ * @property {string} name
+ * @property {number} pieceLength
+ * @property {{ index: number, name: string, path: string, length: number }[]} files
+ */
+
+/**
+ * @param {object} params
+ * @param {(infoHash: string, fileIndex: number) => ({ length: number } | null)} params.find
+ *   The whole file kept for this infohash and index, or null.
+ * @returns {{
+ *   fileOf: (sourceKey: string, fileIndex: number) => ({ length: number } | null),
+ *   remember: (sourceKey: string, description: SourceDescription) => void,
+ *   isWhole: (sourceKey: string) => boolean,
+ *   describe: (sourceKey: string) => (SourceDescription | null)
+ * }}
+ */
+export function createWholeSources({ find }) {
+  /** @type {Map<string, SourceDescription>} */
+  const descriptions = new Map();
+
+  const infoHashOf = (sourceKey) => {
+    const key = String(sourceKey ?? "");
+    return key.startsWith("torrent:") ? key.slice("torrent:".length).toLowerCase() : null;
+  };
+
+  const fileOf = (sourceKey, fileIndex) => {
+    const infoHash = infoHashOf(sourceKey);
+    if (infoHash === null || !Number.isInteger(fileIndex) || fileIndex < 0) {
+      return null;
+    }
+    return find(infoHash, fileIndex) ?? null;
+  };
+
+  // Asked again each time rather than remembered as a verdict: a whole file can
+  // be removed for space, and then the torrent has work again.
+  const isWhole = (sourceKey) => {
+    const files = descriptions.get(String(sourceKey))?.files ?? [];
+    return files.length > 0 && files.every((file) => fileOf(sourceKey, file.index) !== null);
+  };
+
+  return {
+    fileOf,
+    remember(sourceKey, description) {
+      if (infoHashOf(sourceKey) !== null && Array.isArray(description?.files) && description.files.length > 0) {
+        descriptions.set(String(sourceKey), description);
+      }
+    },
+    isWhole,
+    describe(sourceKey) {
+      return isWhole(sourceKey) ? descriptions.get(String(sourceKey)) : null;
+    }
+  };
+}

package/services/torrent/worker/worker.js

@@ -35,6 +35,10 @@ import { CompletedFiles, completedFilesRoot } from "../../storage/files/Complete
 import { pieceFromWholeFiles, pieceIsInWholeFiles } from "../../storage/files/piece-from-whole-file.js";
 import { Command, Event } from "./protocol.js";
 import { filesInUse } from "./files-in-use.js";
+import { createWholeSources } from "./whole-sources.js";
+import { wholeFileStats } from "./whole-file-stats.js";
+import { describeHeldObjects, readUtpOpenCount } from "./held-objects.js";
+import { destroyedTorrents } from "../destroyed-torrents.js";
 import { startMemoryReport, WORKER_MEMORY_SAMPLE_MS } from "../../storage/memory-report.js";
 import { forwardLogsTo, logger } from "../../../utils/logger.js";
 
@@ -153,6 +157,22 @@ async function knownTorrent(sourceKey) {
   return isUsableTorrentHandle(torrent) ? torrent : null;
 }
 
+/**
+ * The torrent for one file, but never one rebuilt for a file held whole.
+ *
+ * For the questions that steer or measure a download: a file held whole has no
+ * download, and rebuilding its torrent to be told so is what made the torrent
+ * come back after every removal (see `whole-sources.js`). The torrent is still
+ * used while it exists.
+ *
+ * @param {string} sourceKey
+ * @param {number} fileIndex
+ * @returns {Promise<import("webtorrent").Torrent | null>}
+ */
+async function torrentUnlessWhole(sourceKey, fileIndex) {
+  return wholeSources.fileOf(sourceKey, fileIndex) ? knownTorrent(sourceKey) : requireTorrent(sourceKey);
+}
+
 async function requireTorrent(sourceKey) {
   const pending = torrentsByKey.get(sourceKey);
   if (!pending) {
@@ -350,7 +370,18 @@ async function runCommand(command, params, id) {
           }
         });
       }
-      const torrent = await pending;
+      // A torrent removed because it was downloaded whole is answered for by
+      // what was written down when it went: a destroyed torrent keeps its object
+      // and empties its `files`, so it would hand a viewer opening the film an
+      // empty list, and rebuilding it here would bring it back on every stream
+      // and stats request, which all come through this command. Any other
+      // destroyed torrent is rebuilt, because its files still need it.
+      const added = await pending;
+      const described = isUsableTorrentHandle(added) ? null : wholeSources.describe(params.sourceKey);
+      if (described) {
+        return described;
+      }
+      const torrent = isUsableTorrentHandle(added) ? added : await requireTorrent(params.sourceKey);
       return {
         infoHash: torrent.infoHash,
         name: torrent.name,
@@ -369,6 +400,10 @@ async function runCommand(command, params, id) {
     }
 
     case Command.LIST_FILES: {
+      const described = (await knownTorrent(params.sourceKey)) ? null : wholeSources.describe(params.sourceKey);
+      if (described) {
+        return described.files;
+      }
       const torrent = await requireTorrent(params.sourceKey);
       return (torrent.files ?? []).map((file, index) => ({
         index,
@@ -419,19 +454,24 @@ async function runCommand(command, params, id) {
 
 
     case Command.FILL_FILE: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
       return {
-        started: fillFileInBackground(torrent, params.fileIndex, params.sourceKey)
+        started: torrent ? fillFileInBackground(torrent, params.fileIndex, params.sourceKey) : false
       };
     }
 
     case Command.FILL_TORRENT: {
-      const torrent = await requireTorrent(params.sourceKey);
-      return { started: pool.fillTorrentAsCapacityAllows(torrent) };
+      const torrent = wholeSources.isWhole(params.sourceKey)
+        ? await knownTorrent(params.sourceKey)
+        : await requireTorrent(params.sourceKey);
+      return { started: torrent ? pool.fillTorrentAsCapacityAllows(torrent) : false };
     }
 
     case Command.WARM_POSITION: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (!torrent) {
+        return { started: false };
+      }
       return {
         started: await warmResumePosition(
           torrent,
@@ -451,7 +491,10 @@ async function runCommand(command, params, id) {
 
 
     case Command.FILE_STATS: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (!torrent) {
+        return wholeFileStats(wholeSources.fileOf(params.sourceKey, params.fileIndex)?.length ?? 0);
+      }
       const stats = pool.getFileStats(torrent, params.fileIndex, {
         resumeAnchorByteStart: params.resumeAnchorByteStart ?? null
       });
@@ -475,9 +518,10 @@ async function runCommand(command, params, id) {
       // handle from its recipe, so asking that way would re-add a torrent in
       // order to be told that nothing is wanted of it.
       const zones = Array.isArray(params.zones) ? params.zones : [];
+      // Nor may one for a file held whole, which has nothing left to fetch.
       const torrent = zones.length === 0
         ? await knownTorrent(params.sourceKey)
-        : await requireTorrent(params.sourceKey);
+        : await torrentUnlessWhole(params.sourceKey, params.fileIndex);
       if (torrent) {
         pool.applyPriorityMap(torrent, params.fileIndex, zones, params.durationSeconds);
       }
@@ -485,16 +529,18 @@ async function runCommand(command, params, id) {
     }
 
     case Command.PRIORITIZE: {
-      const torrent = await requireTorrent(params.sourceKey);
-      pool.prioritizeByteRange(torrent, params.fileIndex, params.byteStart, params.windowBytes, {
-        wholeFileRead: params.wholeFileRead === true
-      });
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (torrent) {
+        pool.prioritizeByteRange(torrent, params.fileIndex, params.byteStart, params.windowBytes, {
+          wholeFileRead: params.wholeFileRead === true
+        });
+      }
       return true;
     }
 
     case Command.PREFETCH_EDGES: {
-      const torrent = await requireTorrent(params.sourceKey);
-      return pool.prefetchFileEdges(torrent, params.fileIndex, params.options ?? {});
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      return torrent ? pool.prefetchFileEdges(torrent, params.fileIndex, params.options ?? {}) : undefined;
     }
 
     case Command.READ_RANGE: {
@@ -520,7 +566,11 @@ async function runCommand(command, params, id) {
     }
 
     case Command.HELD_RANGES: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (!torrent) {
+        const length = wholeSources.fileOf(params.sourceKey, params.fileIndex)?.length ?? 0;
+        return { ranges: length > 0 ? [[0, length - 1]] : [] };
+      }
       return { ranges: heldRangesOf(torrent, params.fileIndex) };
     }
 
@@ -619,7 +669,14 @@ startMemoryReport({
   // thread still refers to or buffers the collector has not reached yet. On
   // separate timers the two were up to a minute apart and could not be
   // compared at all (roadmap item 2).
-  readExtra: describePieceBuffers,
+  readExtra: () => [
+    describePieceBuffers(),
+    describeHeldObjects({
+      liveTorrents: pool.client?.torrents?.length ?? 0,
+      destroyed: destroyedTorrents(),
+      utp: readUtpOpenCount()
+    })
+  ].filter(Boolean).join("; "),
   scope: "thread",
   label: "torrent worker",
   intervalMs: WORKER_MEMORY_SAMPLE_MS,
@@ -628,6 +685,13 @@ startMemoryReport({
   snapshotDir: workerData?.stateDir || undefined,
   snapshotFloorBytes: 400 * 1024 * 1024,
   snapshotGrowthBytes: 400 * 1024 * 1024,
+  // CHOSEN, not derived: no healthy session has recorded this figure yet, so
+  // there is no measured normal to stand above. It is set well below the
+  // 2.1-4.3 GB the worker held in the minutes before the kills of 2026-10-01,
+  // while the machine still has room to write a snapshot. The line prints what the
+  // stores hold beside it, which is what a derived floor will come from.
+  bufferSnapshotFloorBytes: 500 * 1024 * 1024,
+  bufferSnapshotGrowthBytes: 500 * 1024 * 1024,
   keepSnapshots: 3
 });
 
@@ -880,6 +944,7 @@ setInterval(() => {
  * thread writes them, the main thread serves them without asking anybody.
  */
 const completedFiles = new CompletedFiles({ root: completedFilesRoot() });
+const wholeSources = createWholeSources({ find: (infoHash, fileIndex) => completedFiles.find(infoHash, fileIndex) });
 
 /**
  * Which torrent a set of files belongs to.
@@ -1047,6 +1112,12 @@ async function keepWholeFiles() {
       // checked against what the torrent says. Re-hashing a gigabyte and a
       // half to learn what we wrote down is a minute of a viewer's time for
       // nothing.
+      wholeSources.remember(sourceKey, {
+        infoHash: torrent.infoHash,
+        name: torrent.name,
+        pieceLength: Number(torrent.pieceLength) || 0,
+        files: torrent.files.map((file, index) => ({ index, name: file.name, path: file.path, length: file.length }))
+      });
       pool.remove(torrent, "downloaded-whole");
       pool.addWholeSource(sourceKey);
     }