@torrent-tv/proxy 2.89.20 → 2.91.0

package/bin/cli.js

@@ -559,6 +559,8 @@ try {
     proxyId: clientId,
     token,
     proxyPort: actualPort,
+    name: clientName,
+    baseUrl: directBaseUrl,
     onSignal(sessionId, signal) {
       webRtcManager?.handleSignal(sessionId, signal);
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.89.20",
+  "version": "2.91.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {
@@ -54,6 +54,6 @@
     "@biomejs/biome": "^2.5.7"
   },
   "overrides": {
-    "utp-native": "npm:@torrent-tv/utp-native@2.5.3-ttv.8"
+    "utp-native": "npm:@torrent-tv/utp-native@2.5.3-ttv.9"
   }
 }

package/services/storage/memory-report.js

@@ -382,6 +382,25 @@ export function readingIsWorthWriting({
   return Math.abs(watchedBytes - lastWrittenBytes) >= changeBytes;
 }
 
+/**
+ * Array-buffer memory that no torrent store accounts for.
+ *
+ * The heap is not the only thing a snapshot explains: every `ArrayBuffer` is in
+ * it, with the size of its backing store and who holds it. On 2026-10-01 the
+ * torrent worker reached 4.3 GB of array buffers while its stores had committed
+ * 40 MB, the kernel killed the process twice, and no snapshot existed, because
+ * the only trigger watched a heap that stood at 300 MB. Pieces the stores hold
+ * are expected; what is above them is the question.
+ *
+ * @param {number} arrayBuffers - The isolate's own `arrayBuffers` figure.
+ * @param {{ committedBytes?: number }[]} stores
+ * @returns {number}
+ */
+export function unaccountedBufferBytes(arrayBuffers, stores = []) {
+  const committed = stores.reduce((sum, store) => sum + (Number(store?.committedBytes) || 0), 0);
+  return Math.max(0, (Number(arrayBuffers) || 0) - committed);
+}
+
 /**
  * Report memory on a timer until stopped.
  *
@@ -408,6 +427,9 @@ export function readingIsWorthWriting({
  * @param {number} [options.snapshotFloorBytes]
  * @param {number} [options.snapshotGrowthBytes]
  * @param {number} [options.keepSnapshots] - Newest to keep; zero keeps all.
+ * @param {number} [options.bufferSnapshotFloorBytes] - Array buffers above what
+ *   the stores hold that earn a snapshot of their own; zero never takes one.
+ * @param {number} [options.bufferSnapshotGrowthBytes]
  * @param {() => string} [options.readExtra] - Figures to append to the line,
  *   read at the same instant as the memory itself.
  * @returns {{ stop: () => void }}
@@ -426,9 +448,12 @@ export function startMemoryReport({
   mayKeep = null,
   snapshotFloorBytes = 500 * 1024 * 1024,
   snapshotGrowthBytes = 100 * 1024 * 1024,
-  keepSnapshots = 0
+  keepSnapshots = 0,
+  bufferSnapshotFloorBytes = 0,
+  bufferSnapshotGrowthBytes = 500 * 1024 * 1024
 }) {
   let highWater = 0;
+  let bufferHighWater = 0;
   /** @type {Record<string, number>} */
   let lastWritten = {};
   let lastWrittenAt = 0;
@@ -556,6 +581,17 @@ export function startMemoryReport({
         highWater = heapWatched;
         await takeSnapshot(heapWatched, "a new high-water of the heap");
       }
+      // The same for array buffers, which a snapshot names as well as it names
+      // the heap: each one is in it with its size and its holder.
+      const unaccounted = unaccountedBufferBytes(processMemory.arrayBuffers, stores);
+      if (
+        bufferSnapshotFloorBytes > 0 &&
+        unaccounted > bufferSnapshotFloorBytes &&
+        unaccounted > bufferHighWater + bufferSnapshotGrowthBytes
+      ) {
+        bufferHighWater = unaccounted;
+        await takeSnapshot(unaccounted, "a new high-water of array buffers no torrent store accounts for");
+      }
       // Under `write` by construction: `anonymousBytes` is only read when the
       // line is, and at one reading a second an unconditional warning would be
       // a line a second for as long as the process stayed large.

package/services/torrent/destroyed-torrents.js

@@ -0,0 +1,48 @@
+/**
+ * @file Torrents this process has destroyed and the collector has not taken
+ * back yet.
+ *
+ * Destroying a torrent ends its swarm; it frees nothing while anything still
+ * refers to the object. On 2026-10-04 a torrent worker held 595 destroyed
+ * copies of one film, kept by the listeners of uTP connections whose close
+ * never came back and by idle timers left running for an hour, and the only
+ * sign of it was memory growing at 17 MB a minute. The heap snapshot that named
+ * it was taken by luck. This says it every time the worker reports memory.
+ *
+ * The count is the collector's own answer, so it lags: a figure that returns
+ * towards zero is ordinary, one that only grows is a reference that was not let
+ * go.
+ */
+
+let destroyedTotal = 0;
+let notCollected = 0;
+
+/** @type {WeakSet<object>} */
+const counted = new WeakSet();
+
+const collected = new FinalizationRegistry(() => {
+  notCollected -= 1;
+});
+
+/**
+ * Say that a torrent has been destroyed. Counted once however often it is said.
+ *
+ * @param {object} torrent
+ * @returns {void}
+ */
+export function noteTorrentDestroyed(torrent) {
+  if (!torrent || typeof torrent !== "object" || counted.has(torrent)) {
+    return;
+  }
+  counted.add(torrent);
+  destroyedTotal += 1;
+  notCollected += 1;
+  collected.register(torrent, null);
+}
+
+/**
+ * @returns {{ total: number, notCollected: number }}
+ */
+export function destroyedTorrents() {
+  return { total: destroyedTotal, notCollected };
+}

package/services/torrent/torrent-pool.js

@@ -21,6 +21,7 @@ import { demandFor, forgetTorrent, reconcileAll, hasUnmetDemand } from "./downlo
 import { withdrawClaim } from "./download/withdraw-claim.js";
 import { isAtAWatchingViewer, isBehindEverybody, isNobodyComingNow } from "../viewer/PriorityMap.js";
 import { deriveSourceKey } from "../../utils/torrent-source-key.js";
+import { noteTorrentDestroyed } from "./destroyed-torrents.js";
 
 /** How a window stated from the priority map names itself. */
 const MAP_CLAIMANT = "priority-map";
@@ -1683,6 +1684,10 @@ export class TorrentPool {
       logger.warn(`torrent-pool: [${label()}] warning: ${formatWarning(warning)}`);
     });
 
+    // Counted from here until the collector takes it, which is the only way a
+    // destroyed torrent that something still holds can be seen at all.
+    torrent.once("close", () => noteTorrentDestroyed(torrent));
+
     // A TORRENT THAT DIED WITHOUT US ASKING LEAVES ITS RECORD BEHIND, and the
     // record goes on answering. Field 2026-09-11: the store refused a block,
     // the client destroyed the torrent, and for the rest of the process every
@@ -1862,8 +1867,7 @@ export class TorrentPool {
                   this.torrents.delete(otherKey);
                 }
               }
-              this.#lastAccess.delete(existing);
-              this.#readPositionByTorrent.delete(existing);
+              this.#forgetBookkeeping(existing);
               this.client.remove(existing, { destroyStore: true }, () => {
                 const addedReplacement = this.client.add(torrentId, {
                   store: this.#pieceStore,
@@ -2083,8 +2087,7 @@ export class TorrentPool {
       return;
     }
     forgetTorrent(torrent);
-    this.#lastAccess.delete(torrent);
-    this.#readPositionByTorrent.delete(torrent);
+    this.#forgetBookkeeping(torrent);
     const name = typeof torrent.name === "string" ? torrent.name : "(unknown)";
     logger.warn(
       `torrent-pool: forgot "${name}" [${String(torrent.infoHash ?? "?").slice(0, 8)}] — ` +
@@ -2107,6 +2110,26 @@ export class TorrentPool {
     this.#removeTorrent(torrent, reason);
   }
 
+  /**
+   * Drop everything this pool keeps per torrent, for one that is going.
+   *
+   * Every one of these holds the torrent strongly, and the idle timer above all:
+   * left running, it kept each removed torrent — its pieces, its wires, the
+   * whole object — for the hour it was set for, then fired on the corpse and
+   * logged a second removal. Field 2026-10-04: 184 such removals of a torrent
+   * already gone, and 595 destroyed copies of it alive in one heap.
+   *
+   * @param {import("webtorrent").Torrent} torrent
+   * @returns {void}
+   */
+  #forgetBookkeeping(torrent) {
+    this.#cancelIdleRemoval(torrent);
+    this.#lastAccess.delete(torrent);
+    this.#readPositionByTorrent.delete(torrent);
+    this.#stallSince.delete(torrent);
+    this.#stallReportedAt.delete(torrent);
+  }
+
   #removeTorrent(torrent, reason = "unknown") {
     // Everything anybody stated for this torrent goes with it.
     forgetTorrent(torrent);
@@ -2126,8 +2149,7 @@ export class TorrentPool {
         break;
       }
     }
-    this.#lastAccess.delete(torrent);
-    this.#readPositionByTorrent.delete(torrent);
+    this.#forgetBookkeeping(torrent);
     logger.warn(`torrent-pool: removing torrent "${name}" [${infoHash}] reason=${reason} stated=${stated} downloaded=${hasData}B caller=${caller}`);
     try {
       torrent.destroy({ destroyStore: true }, () => {

package/services/torrent/worker/held-objects.js

@@ -0,0 +1,55 @@
+/**
+ * @file What the torrent thread holds beyond the bytes it accounts for: live
+ * and destroyed torrents, and the uTP sockets and connections behind them.
+ *
+ * These are the objects the heap snapshot of 2026-10-04 found holding the
+ * growth: 957 uTP sockets whose close never completed, 2101 of their 128 KB
+ * read buffers, and through their listeners 595 torrents destroyed long
+ * before. None of it was in any figure this proxy printed. Read on the same
+ * line as the memory, so the count and the mass are the same instant.
+ */
+
+import { createRequire } from "node:module";
+
+const require = createRequire(import.meta.url);
+
+/**
+ * The uTP module's own count of what it holds open, or null where the module is
+ * not built or is a version that does not count.
+ *
+ * Required by name, which resolves to the same copy WebTorrent loads: the image
+ * removes every nested copy and refuses to build if one survives.
+ *
+ * @returns {{ sockets: number, connections: number, closing: number } | null}
+ */
+export function readUtpOpenCount() {
+  try {
+    const utp = require("utp-native");
+    return typeof utp?.openCount === "function" ? utp.openCount() : null;
+  } catch {
+    // silent-ok: no uTP on this host means TCP peers only, and nothing to count.
+    return null;
+  }
+}
+
+/**
+ * One clause for the memory line.
+ *
+ * @param {object} held
+ * @param {number} held.liveTorrents - Torrents the client has now.
+ * @param {{ total: number, notCollected: number }} held.destroyed
+ * @param {{ sockets: number, connections: number, closing: number } | null} held.utp
+ * @returns {string}
+ */
+export function describeHeldObjects({ liveTorrents, destroyed, utp }) {
+  const torrents =
+    `torrents ${liveTorrents} live, ${destroyed.notCollected} destroyed and not collected ` +
+    `(${destroyed.total} destroyed in all)`;
+  if (!utp) {
+    return torrents;
+  }
+  return (
+    `${torrents}; uTP ${utp.sockets} socket(s), ${utp.connections} connection(s), ` +
+    `${utp.closing} destroyed and still closing`
+  );
+}

package/services/torrent/worker/whole-file-stats.js

@@ -0,0 +1,46 @@
+/**
+ * @file The download figures of a file that is held whole on disk.
+ *
+ * Once every file of a torrent is a file, the torrent is removed: it has
+ * nothing left to fetch. The figures a viewer's page polls for still have an
+ * answer, and it is known without the torrent — everything is here and nothing
+ * is arriving. Asking the torrent for them instead brought it back: on
+ * 2026-10-04 a film watched from its whole file was removed and added again
+ * 671 times in two hours, once for every poll after each removal, and every
+ * copy it left behind stayed in memory.
+ */
+
+/**
+ * The same shape `TorrentPool.getFileStats` answers with, for a whole file.
+ *
+ * @param {number} length - Bytes in the file.
+ * @returns {object}
+ */
+export function wholeFileStats(length) {
+  const fileLength = Number.isFinite(length) && length > 0 ? length : 0;
+  return {
+    numPeers: 0,
+    downloadSpeed: 0,
+    uploadSpeed: 0,
+    connectedPeers: 0,
+    deliveringPeers: 0,
+    knownPeers: null,
+    queuedPeers: null,
+    trackerSeeders: null,
+    trackerLeechers: null,
+    trackersAnswered: 0,
+    secondsToFirstPeer: null,
+    secondsWaitingForFirstPeer: null,
+    fileProgress: 1,
+    fileDownloaded: fileLength,
+    fileLength,
+    residence: fileLength > 0 ? [{ start: 0, end: fileLength, location: "whole-file" }] : [],
+    resumeNeededBytes: null,
+    resumeDownloadedBytes: null,
+    resumeAnchorByteStart: null,
+    headerBytes: null,
+    headerDownloadedBytes: null,
+    // Nothing is delivered by a swarm, so there is no supply to describe.
+    supply: null
+  };
+}

package/services/torrent/worker/whole-sources.js

@@ -0,0 +1,77 @@
+/**
+ * @file Which files and sources are held whole on disk, asked by the torrent
+ * thread before it brings a torrent back.
+ *
+ * A torrent whose every file is a file has nothing to fetch, so it is removed;
+ * anything that names the source again rebuilt it from its recipe. That is
+ * right for a read the files cannot answer, and it was wrong for everything
+ * else. The page polls the download figures and the viewers state a priority
+ * map for as long as the film plays, and each of those rebuilt the torrent
+ * only to be told nothing was missing; ten seconds later the sweep removed it
+ * again. Field 2026-10-04: 671 removals in two hours of one viewer watching one
+ * whole file, and every copy left behind in memory.
+ *
+ * So the rule is stated once, here: a file held whole does not bring its
+ * torrent back to be steered or measured, and a source held whole is described
+ * by what was written down when its torrent went. The torrent is used if it
+ * exists.
+ */
+
+/**
+ * What the torrent thread says about a source when it is opened.
+ *
+ * @typedef {object} SourceDescription
+ * @property {string} infoHash
+ * @property {string} name
+ * @property {number} pieceLength
+ * @property {{ index: number, name: string, path: string, length: number }[]} files
+ */
+
+/**
+ * @param {object} params
+ * @param {(infoHash: string, fileIndex: number) => ({ length: number } | null)} params.find
+ *   The whole file kept for this infohash and index, or null.
+ * @returns {{
+ *   fileOf: (sourceKey: string, fileIndex: number) => ({ length: number } | null),
+ *   remember: (sourceKey: string, description: SourceDescription) => void,
+ *   isWhole: (sourceKey: string) => boolean,
+ *   describe: (sourceKey: string) => (SourceDescription | null)
+ * }}
+ */
+export function createWholeSources({ find }) {
+  /** @type {Map<string, SourceDescription>} */
+  const descriptions = new Map();
+
+  const infoHashOf = (sourceKey) => {
+    const key = String(sourceKey ?? "");
+    return key.startsWith("torrent:") ? key.slice("torrent:".length).toLowerCase() : null;
+  };
+
+  const fileOf = (sourceKey, fileIndex) => {
+    const infoHash = infoHashOf(sourceKey);
+    if (infoHash === null || !Number.isInteger(fileIndex) || fileIndex < 0) {
+      return null;
+    }
+    return find(infoHash, fileIndex) ?? null;
+  };
+
+  // Asked again each time rather than remembered as a verdict: a whole file can
+  // be removed for space, and then the torrent has work again.
+  const isWhole = (sourceKey) => {
+    const files = descriptions.get(String(sourceKey))?.files ?? [];
+    return files.length > 0 && files.every((file) => fileOf(sourceKey, file.index) !== null);
+  };
+
+  return {
+    fileOf,
+    remember(sourceKey, description) {
+      if (infoHashOf(sourceKey) !== null && Array.isArray(description?.files) && description.files.length > 0) {
+        descriptions.set(String(sourceKey), description);
+      }
+    },
+    isWhole,
+    describe(sourceKey) {
+      return isWhole(sourceKey) ? descriptions.get(String(sourceKey)) : null;
+    }
+  };
+}

package/services/torrent/worker/worker.js

@@ -35,6 +35,10 @@ import { CompletedFiles, completedFilesRoot } from "../../storage/files/Complete
 import { pieceFromWholeFiles, pieceIsInWholeFiles } from "../../storage/files/piece-from-whole-file.js";
 import { Command, Event } from "./protocol.js";
 import { filesInUse } from "./files-in-use.js";
+import { createWholeSources } from "./whole-sources.js";
+import { wholeFileStats } from "./whole-file-stats.js";
+import { describeHeldObjects, readUtpOpenCount } from "./held-objects.js";
+import { destroyedTorrents } from "../destroyed-torrents.js";
 import { startMemoryReport, WORKER_MEMORY_SAMPLE_MS } from "../../storage/memory-report.js";
 import { forwardLogsTo, logger } from "../../../utils/logger.js";
 
@@ -153,6 +157,22 @@ async function knownTorrent(sourceKey) {
   return isUsableTorrentHandle(torrent) ? torrent : null;
 }
 
+/**
+ * The torrent for one file, but never one rebuilt for a file held whole.
+ *
+ * For the questions that steer or measure a download: a file held whole has no
+ * download, and rebuilding its torrent to be told so is what made the torrent
+ * come back after every removal (see `whole-sources.js`). The torrent is still
+ * used while it exists.
+ *
+ * @param {string} sourceKey
+ * @param {number} fileIndex
+ * @returns {Promise<import("webtorrent").Torrent | null>}
+ */
+async function torrentUnlessWhole(sourceKey, fileIndex) {
+  return wholeSources.fileOf(sourceKey, fileIndex) ? knownTorrent(sourceKey) : requireTorrent(sourceKey);
+}
+
 async function requireTorrent(sourceKey) {
   const pending = torrentsByKey.get(sourceKey);
   if (!pending) {
@@ -350,7 +370,18 @@ async function runCommand(command, params, id) {
           }
         });
       }
-      const torrent = await pending;
+      // A torrent removed because it was downloaded whole is answered for by
+      // what was written down when it went: a destroyed torrent keeps its object
+      // and empties its `files`, so it would hand a viewer opening the film an
+      // empty list, and rebuilding it here would bring it back on every stream
+      // and stats request, which all come through this command. Any other
+      // destroyed torrent is rebuilt, because its files still need it.
+      const added = await pending;
+      const described = isUsableTorrentHandle(added) ? null : wholeSources.describe(params.sourceKey);
+      if (described) {
+        return described;
+      }
+      const torrent = isUsableTorrentHandle(added) ? added : await requireTorrent(params.sourceKey);
       return {
         infoHash: torrent.infoHash,
         name: torrent.name,
@@ -369,6 +400,10 @@ async function runCommand(command, params, id) {
     }
 
     case Command.LIST_FILES: {
+      const described = (await knownTorrent(params.sourceKey)) ? null : wholeSources.describe(params.sourceKey);
+      if (described) {
+        return described.files;
+      }
       const torrent = await requireTorrent(params.sourceKey);
       return (torrent.files ?? []).map((file, index) => ({
         index,
@@ -419,19 +454,24 @@ async function runCommand(command, params, id) {
 
 
     case Command.FILL_FILE: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
       return {
-        started: fillFileInBackground(torrent, params.fileIndex, params.sourceKey)
+        started: torrent ? fillFileInBackground(torrent, params.fileIndex, params.sourceKey) : false
       };
     }
 
     case Command.FILL_TORRENT: {
-      const torrent = await requireTorrent(params.sourceKey);
-      return { started: pool.fillTorrentAsCapacityAllows(torrent) };
+      const torrent = wholeSources.isWhole(params.sourceKey)
+        ? await knownTorrent(params.sourceKey)
+        : await requireTorrent(params.sourceKey);
+      return { started: torrent ? pool.fillTorrentAsCapacityAllows(torrent) : false };
     }
 
     case Command.WARM_POSITION: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (!torrent) {
+        return { started: false };
+      }
       return {
         started: await warmResumePosition(
           torrent,
@@ -451,7 +491,10 @@ async function runCommand(command, params, id) {
 
 
     case Command.FILE_STATS: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (!torrent) {
+        return wholeFileStats(wholeSources.fileOf(params.sourceKey, params.fileIndex)?.length ?? 0);
+      }
       const stats = pool.getFileStats(torrent, params.fileIndex, {
         resumeAnchorByteStart: params.resumeAnchorByteStart ?? null
       });
@@ -475,9 +518,10 @@ async function runCommand(command, params, id) {
       // handle from its recipe, so asking that way would re-add a torrent in
       // order to be told that nothing is wanted of it.
       const zones = Array.isArray(params.zones) ? params.zones : [];
+      // Nor may one for a file held whole, which has nothing left to fetch.
       const torrent = zones.length === 0
         ? await knownTorrent(params.sourceKey)
-        : await requireTorrent(params.sourceKey);
+        : await torrentUnlessWhole(params.sourceKey, params.fileIndex);
       if (torrent) {
         pool.applyPriorityMap(torrent, params.fileIndex, zones, params.durationSeconds);
       }
@@ -485,16 +529,18 @@ async function runCommand(command, params, id) {
     }
 
     case Command.PRIORITIZE: {
-      const torrent = await requireTorrent(params.sourceKey);
-      pool.prioritizeByteRange(torrent, params.fileIndex, params.byteStart, params.windowBytes, {
-        wholeFileRead: params.wholeFileRead === true
-      });
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (torrent) {
+        pool.prioritizeByteRange(torrent, params.fileIndex, params.byteStart, params.windowBytes, {
+          wholeFileRead: params.wholeFileRead === true
+        });
+      }
       return true;
     }
 
     case Command.PREFETCH_EDGES: {
-      const torrent = await requireTorrent(params.sourceKey);
-      return pool.prefetchFileEdges(torrent, params.fileIndex, params.options ?? {});
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      return torrent ? pool.prefetchFileEdges(torrent, params.fileIndex, params.options ?? {}) : undefined;
     }
 
     case Command.READ_RANGE: {
@@ -520,7 +566,11 @@ async function runCommand(command, params, id) {
     }
 
     case Command.HELD_RANGES: {
-      const torrent = await requireTorrent(params.sourceKey);
+      const torrent = await torrentUnlessWhole(params.sourceKey, params.fileIndex);
+      if (!torrent) {
+        const length = wholeSources.fileOf(params.sourceKey, params.fileIndex)?.length ?? 0;
+        return { ranges: length > 0 ? [[0, length - 1]] : [] };
+      }
       return { ranges: heldRangesOf(torrent, params.fileIndex) };
     }
 
@@ -619,7 +669,14 @@ startMemoryReport({
   // thread still refers to or buffers the collector has not reached yet. On
   // separate timers the two were up to a minute apart and could not be
   // compared at all (roadmap item 2).
-  readExtra: describePieceBuffers,
+  readExtra: () => [
+    describePieceBuffers(),
+    describeHeldObjects({
+      liveTorrents: pool.client?.torrents?.length ?? 0,
+      destroyed: destroyedTorrents(),
+      utp: readUtpOpenCount()
+    })
+  ].filter(Boolean).join("; "),
   scope: "thread",
   label: "torrent worker",
   intervalMs: WORKER_MEMORY_SAMPLE_MS,
@@ -628,6 +685,13 @@ startMemoryReport({
   snapshotDir: workerData?.stateDir || undefined,
   snapshotFloorBytes: 400 * 1024 * 1024,
   snapshotGrowthBytes: 400 * 1024 * 1024,
+  // CHOSEN, not derived: no healthy session has recorded this figure yet, so
+  // there is no measured normal to stand above. It is set well below the
+  // 2.1-4.3 GB the worker held in the minutes before the kills of 2026-10-01,
+  // while the machine still has room to write a snapshot. The line prints what the
+  // stores hold beside it, which is what a derived floor will come from.
+  bufferSnapshotFloorBytes: 500 * 1024 * 1024,
+  bufferSnapshotGrowthBytes: 500 * 1024 * 1024,
   keepSnapshots: 3
 });
 
@@ -880,6 +944,7 @@ setInterval(() => {
  * thread writes them, the main thread serves them without asking anybody.
  */
 const completedFiles = new CompletedFiles({ root: completedFilesRoot() });
+const wholeSources = createWholeSources({ find: (infoHash, fileIndex) => completedFiles.find(infoHash, fileIndex) });
 
 /**
  * Which torrent a set of files belongs to.
@@ -1047,6 +1112,12 @@ async function keepWholeFiles() {
       // checked against what the torrent says. Re-hashing a gigabyte and a
       // half to learn what we wrote down is a minute of a viewer's time for
       // nothing.
+      wholeSources.remember(sourceKey, {
+        infoHash: torrent.infoHash,
+        name: torrent.name,
+        pieceLength: Number(torrent.pieceLength) || 0,
+        files: torrent.files.map((file, index) => ({ index, name: file.name, path: file.path, length: file.length }))
+      });
       pool.remove(torrent, "downloaded-whole");
       pool.addWholeSource(sourceKey);
     }

package/services/transport/tunnel-client.js

@@ -9,6 +9,13 @@
  *
  * The tunnel reconnects automatically with a fixed back-off after any
  * unexpected close.
+ *
+ * A server being replaced by a release asks its proxies to move
+ * (`server-moving`). The proxy then opens a second connection, which reaches the
+ * new server, and keeps the old one until the old server closes it. While both
+ * are open each reply goes over the connection its request arrived on: a
+ * browser that signalled through the old server is answered there, because the
+ * new one does not know that browser.
  */
 
 import { WebSocket } from "ws";
@@ -27,6 +34,11 @@ import { WebSocket } from "ws";
  *   Auth token sent as the `x-proxy-id` / `x-proxy-token` headers during the WS handshake.
  * @property {number}  proxyPort
  *   Local port the proxy's Fastify server is listening on.
+ * @property {string}  [name]
+ *   Display name, sent with every connection so that whichever server instance
+ *   the connection reaches knows it without a separate registration request.
+ * @property {string}  [baseUrl]
+ *   Advertised direct URL, sent with every connection for the same reason.
  * @property {(sessionId: string, signal: WebRtcSignal) => void} [onSignal]
  *   Called when the server forwards a WebRTC signal (SDP offer or ICE candidate)
  *   from a browser to this proxy.  `sessionId` scopes the signal to a P2P session.
@@ -120,6 +132,8 @@ export function createTunnelClient({
   proxyId,
   token,
   proxyPort,
+  name = "",
+  baseUrl = "",
   onSignal,
   onConnect,
   onHealthRequest,
@@ -141,6 +155,21 @@ export function createTunnelClient({
    */
   let renewalTimer = null;
   let stopped = false;
+  /**
+   * Every connection that is open now. Usually one; two while a renewal or a
+   * move to a new server is under way.
+   *
+   * @type {Set<WebSocket>}
+   */
+  const openConnections = new Set();
+  /**
+   * The connection each browser session signalled through. The proxy's answer
+   * and its ICE candidates go back the same way, because only the server
+   * instance that holds that browser's signalling socket can deliver them.
+   *
+   * @type {Map<string, WebSocket>}
+   */
+  const signalRoutes = new Map();
 
   /**
    * Write a message to the log sink if one was provided.
@@ -174,6 +203,14 @@ export function createTunnelClient({
       headers: {
         "x-proxy-id": proxyId,
         "x-proxy-token": token,
+        // Who this proxy is, on the connection itself: a separate registration
+        // request may reach a different server instance during a release.
+        "x-proxy-name": encodeURIComponent(name),
+        "x-proxy-base-url": baseUrl,
+        // This proxy answers on the connection a request arrived on and opens a
+        // new connection when the server says `server-moving`, so the server
+        // may wait for it to arrive at the new instance.
+        "x-proxy-follows-moves": "1",
         "user-agent": "torrent-tv-proxy/1.0"
       }
     });
@@ -182,6 +219,7 @@ export function createTunnelClient({
     socket = connection;
 
     connection.addEventListener("open", () => {
+      openConnections.add(connection);
       log("Tunnel connected.");
       // Start keepalive pings to prevent Cloudflare's idle WebSocket timeout.
       keepaliveTimer = setInterval(() => {
@@ -213,8 +251,19 @@ export function createTunnelClient({
         return;
       }
 
+      // The server is being replaced. A new connection reaches its successor;
+      // this one stays open until the old server has finished with the
+      // browsers it is still signalling for, and then it closes it.
+      if (message.type === "server-moving") {
+        if (connection === socket && !stopped) {
+          log("Tunnel: the server is being replaced; connecting to its successor before this connection closes.");
+          connect();
+        }
+        return;
+      }
+
       if (message.type === "request") {
-        void handleRelayRequest(message).catch((error) => {
+        void handleRelayRequest(message, connection).catch((error) => {
           log(`Tunnel relay error: ${error?.message ?? error}`);
         });
         return;
@@ -223,6 +272,7 @@ export function createTunnelClient({
       // WebRTC signalling: server forwards a signal from a browser session.
       if (message.type === "signal") {
         if (typeof message.sessionId === "string" && message.signal && typeof onSignal === "function") {
+          signalRoutes.set(message.sessionId, connection);
           onSignal(message.sessionId, message.signal);
         }
         return;
@@ -244,7 +294,7 @@ export function createTunnelClient({
           // silent-ok: an unanswerable question is answered "no", which is what
           // a null offer means to the caller.
         }
-        send({ type: "can-serve-response", requestId: message.requestId, offer });
+        send({ type: "can-serve-response", requestId: message.requestId, offer }, connection);
         return;
       }
 
@@ -266,7 +316,7 @@ export function createTunnelClient({
             requestId: message.requestId,
             metrics: answer?.metrics ?? answer ?? {},
             holds: Array.isArray(answer?.holds) ? answer.holds : []
-          });
+          }, connection);
         })();
         return;
       }
@@ -277,6 +327,12 @@ export function createTunnelClient({
         clearInterval(keepaliveTimer);
         keepaliveTimer = null;
       }
+      openConnections.delete(connection);
+      for (const [sessionId, route] of signalRoutes) {
+        if (route === connection) {
+          signalRoutes.delete(sessionId);
+        }
+      }
       // A connection this one replaced. The server closes it as soon as the
       // replacement registers, which is the whole point of renewing early —
       // there is nothing to report and nothing to reconnect, because the tunnel
@@ -285,15 +341,24 @@ export function createTunnelClient({
         log(`Tunnel handed over (code=${event.code}); the replacement is already carrying it.`);
         return;
       }
+      // The newest connection ended while an older one is still open: a move
+      // whose new connection did not get through. The older one goes on
+      // carrying the tunnel until its server closes it, and the move is tried
+      // again meanwhile.
+      const survivor = [...openConnections].at(-1);
+      if (survivor) {
+        socket = survivor;
+        log(`Tunnel connection ended (code=${event.code}) while the previous one is still open; it carries the tunnel, and a new connection is tried in ${RECONNECT_DELAY_MS}ms.`);
+        scheduleReconnect();
+        return;
+      }
       log(`Tunnel disconnected (code=${event.code}). Reconnecting in ${RECONNECT_DELAY_MS}ms...`);
       socket = null;
       if (renewalTimer !== null) {
         clearTimeout(renewalTimer);
         renewalTimer = null;
       }
-      if (!stopped) {
-        reconnectTimer = setTimeout(connect, RECONNECT_DELAY_MS);
-      }
+      scheduleReconnect();
     });
 
     connection.addEventListener("error", (event) => {
@@ -301,14 +366,31 @@ export function createTunnelClient({
     });
   }
 
+  /**
+   * Connect again after a fixed back-off, unless a reconnect is already due.
+   *
+   * @returns {void}
+   */
+  function scheduleReconnect() {
+    if (stopped || reconnectTimer !== null) {
+      return;
+    }
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      connect();
+    }, RECONNECT_DELAY_MS);
+  }
+
   /**
    * Fetch a resource from the local Fastify server and stream the response
    * back to the registry server chunk-by-chunk over the WebSocket.
    *
    * @param {TunnelRelayRequest} relayRequest
+   * @param {WebSocket} over - The connection the request arrived on, which
+   *   the response goes back over.
    * @returns {Promise<void>}
    */
-  async function handleRelayRequest(relayRequest) {
+  async function handleRelayRequest(relayRequest, over) {
     const { requestId, method, path, query, headers: forwardedHeaders, body } = relayRequest;
     const targetUrl = `http://127.0.0.1:${proxyPort}${path}` + (query ? `?${query}` : "");
     const requestHeaders = { ...(forwardedHeaders ?? {}), host: `127.0.0.1:${proxyPort}` };
@@ -322,7 +404,7 @@ export function createTunnelClient({
         redirect: "manual"
       });
     } catch (fetchError) {
-      sendError(requestId, fetchError?.message ?? String(fetchError));
+      sendError(requestId, fetchError?.message ?? String(fetchError), over);
       return;
     }
 
@@ -332,10 +414,10 @@ export function createTunnelClient({
       responseHeaders[headerName] = headerValue;
     }
 
-    send({ type: "response-start", requestId, status: response.status, headers: responseHeaders });
+    send({ type: "response-start", requestId, status: response.status, headers: responseHeaders }, over);
 
     if (!response.body) {
-      send({ type: "response-chunk", requestId, data: "", done: true });
+      send({ type: "response-chunk", requestId, data: "", done: true }, over);
       return;
     }
 
@@ -344,7 +426,7 @@ export function createTunnelClient({
       while (true) {
         const { done, value } = await reader.read();
         if (done) {
-          send({ type: "response-chunk", requestId, data: "", done: true });
+          send({ type: "response-chunk", requestId, data: "", done: true }, over);
           break;
         }
         send({
@@ -352,10 +434,10 @@ export function createTunnelClient({
           requestId,
           data: Buffer.from(value).toString("base64"),
           done: false
-        });
+        }, over);
       }
     } catch {
-      send({ type: "response-chunk", requestId, data: "", done: true });
+      send({ type: "response-chunk", requestId, data: "", done: true }, over);
     }
   }
 
@@ -363,13 +445,15 @@ export function createTunnelClient({
    * Serialise a message to JSON and send it through the WebSocket if open.
    *
    * @param {object} message
+   * @param {WebSocket | null} [over]
    * @returns {void}
    */
   function send(message, over = null) {
-    // Everything the proxy has to say goes over the LIVE connection. `over` is
-    // for the one thing that belongs to a particular socket rather than to the
-    // tunnel — its own keepalive — which must not be sent over a replacement
-    // that has already taken over.
+    // What the proxy says on its own goes over the LIVE connection. `over` is
+    // for what belongs to a particular socket rather than to the tunnel: its
+    // own keepalive, and every reply, which goes back over the connection its
+    // request arrived on — during a move that is the old server, the only one
+    // still waiting for it.
     const target = over ?? socket;
     if (target && target.readyState === WebSocket.OPEN) {
       target.send(JSON.stringify(message));
@@ -381,10 +465,11 @@ export function createTunnelClient({
    *
    * @param {string} requestId
    * @param {string} errorMessage
+   * @param {WebSocket} over - The connection the request arrived on.
    * @returns {void}
    */
-  function sendError(requestId, errorMessage) {
-    send({ type: "response-error", requestId, error: errorMessage });
+  function sendError(requestId, errorMessage, over) {
+    send({ type: "response-error", requestId, error: errorMessage }, over);
   }
 
   return {
@@ -414,6 +499,9 @@ export function createTunnelClient({
         clearTimeout(reconnectTimer);
         reconnectTimer = null;
       }
+      for (const connection of openConnections) {
+        connection.close(1000, "shutdown");
+      }
       if (socket) {
         socket.close(1000, "shutdown");
         socket = null;
@@ -429,7 +517,10 @@ export function createTunnelClient({
      * @returns {void}
      */
     sendSignal(sessionId, signal) {
-      send({ type: "signal", sessionId, signal });
+      // Back over the connection this session signalled through, while it is
+      // open; the server instance at the other end holds that browser.
+      const route = signalRoutes.get(sessionId);
+      send({ type: "signal", sessionId, signal }, route?.readyState === WebSocket.OPEN ? route : null);
     },
 
     /**