@torrent-tv/proxy 2.9.110 → 2.9.111

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.9.111
+
+- **Fix**: The film being watched could be deleted mid-seek. A torrent's data is protected only by a claim that READS take, and a seek leaves a gap with no read at all — the old encoder is dead, the new one has not started. The thirty-second disk sweep met that gap on 2026-08-06: with the cap exceeded it evicted "the idle torrent" that a viewer was in the middle of, deleted six gigabytes, and the new encoder found nothing to read. The session's own thirty minutes never governed the data underneath it, because the pool was never told a session existed. A session now holds its source for as long as it lives, and lets go when it is disposed.
+- **Fix**: The encoder is no longer suspended on ffmpeg's word alone. How far it has run ahead was taken from the position ffmpeg reports for itself, and that is not evidence: field 2026-08-06, it claimed 6012 s processed at `speed=1.18e+03x` on a file one percent downloaded with exactly one segment on disk. The limiter believed it, suspended the encoder twelve seconds into the session, and segment #1 — which nobody was now producing — was held for 45.7 s until the viewer gave up and seeked. It is now measured by the segments that exist, which is what the viewer can actually be served, and a wide disagreement between the two is logged, since that is the only trace of whatever made ffmpeg report a position it had not reached.
+
 ## 2.9.110
 
 - **Fix**: A torrent the pool had destroyed was still being handed to readers, which killed every later session for that source. The torrent thread remembers each source as a promise and only ever forgot one when the ADD failed — but the pool destroys a torrent that has gone unread for a quarter of an hour, and under disk pressure, clearing its own map and knowing nothing about this one. The promise then resolved to a corpse: a destroyed torrent keeps its object and loses its files. Nothing noticed, because by then everything else answers from cache — measured 2026-08-06 on two sessions in a row, the plan came back in 23 ms and the session was created in 2 ms, so no step waited for metadata, and ffmpeg's first read died 130 ms in with `File 0 not found in torrent:…`; every request for the playlist then answered 500 until the viewer gave up. Both sessions were from a phone on a cellular link, which is what made it look like a connectivity problem — ICE had in fact connected in 0.84 s over reflexive addresses and both data channels were open. A handle that cannot be read from is now replaced rather than returned: the source is added again, using the recipe the thread now keeps for exactly this. Covered by tests.

package/package.json

@@ -1,12 +1,15 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.9.110",
+  "version": "2.9.111",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {
     "access": "public"
   },
   "type": "module",
+  "engines": {
+    "node": ">=24 <25"
+  },
   "bin": {
     "torrent-tv-proxy": "./bin/cli.js"
   },

package/routes/api/transcode-sessions/post.js

@@ -5,7 +5,7 @@
  *
  * @param {import("fastify").FastifyRequest} req
  * @param {import("fastify").FastifyReply} reply
- * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager }} deps
+ * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager, sourceRegistry: object, torrentPool: object }} deps
  * @returns {Promise<void>}
  */
 
@@ -25,7 +25,41 @@ function getPayload(body) {
   return {};
 }
 
-export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager }) {
+/**
+ * Claim the source's file so the pool cannot clean it up under a live session.
+ *
+ * Asynchronous underneath — the torrent lives on another thread — but the
+ * caller needs a release function immediately, so the claim is chased and the
+ * release waits for it.
+ *
+ * @param {{ sourceRegistry: object, torrentPool: object, sourceKey: string, fileIndex: number }} params
+ * @returns {() => void}
+ */
+function holdSource({ sourceRegistry, torrentPool, sourceKey, fileIndex }) {
+  let release = null;
+  let releasedEarly = false;
+  const record = sourceRegistry?.get?.(sourceKey);
+  if (!record) {
+    return () => {};
+  }
+  void Promise.resolve(torrentPool.getTorrent(record.sourceType, record.source))
+    .then((torrent) => {
+      release = torrentPool.acquireFile(torrent, fileIndex);
+      if (releasedEarly) {
+        release();
+      }
+    })
+    .catch(() => {});
+  return () => {
+    releasedEarly = true;
+    if (typeof release === "function") {
+      release();
+      release = null;
+    }
+  };
+}
+
+export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager, sourceRegistry, torrentPool }) {
   const payload = getPayload(req.body);
   const sourceKey = typeof payload.sourceKey === "string" ? payload.sourceKey.trim() : "";
   const fileIndex = Number(payload.fileIndex);
@@ -68,7 +102,12 @@ export async function handleApiTranscodeSessionsPost(req, reply, { hlsSessionMan
           : 0,
       audioTrackIndex:
         Number.isInteger(audioTrackIndex) && audioTrackIndex > 0 ? audioTrackIndex : 0,
-      segmentFormatId
+      segmentFormatId,
+      // Hold the torrent for as long as this session lives. Reads take a claim
+      // only while they run, and a seek leaves a gap with no read at all — the
+      // disk sweep caught that gap on 2026-08-06 and deleted the film being
+      // watched.
+      acquireSource: () => holdSource({ sourceRegistry, torrentPool, sourceKey, fileIndex })
     });
     return reply.send({
       sessionId: session.id,

package/server.js

@@ -198,7 +198,7 @@ export async function startProxyServer({ host, port, transcodeAudio, ffmpegBin,
     handleStreamGet(req, reply, { sourceRegistry, torrentPool })
   );
   app.post("/api/transcode-sessions", async (req, reply) =>
-    handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager })
+    handleApiTranscodeSessionsPost(req, reply, { hlsSessionManager, sourceRegistry, torrentPool })
   );
   app.post("/api/transcode-sessions/:sessionId/release", async (req, reply) =>
     handleApiTranscodeSessionReleasePost(req, reply, { hlsSessionManager })

package/services/hls-session-manager.js

@@ -935,7 +935,12 @@ export class HlsSessionManager {
     startPositionSeconds = 0,
     audioTrackIndex = 0,
     manualQuality = false,
-    segmentFormatId = ""
+    segmentFormatId = "",
+    // Called once for a session that is actually created, and expected to
+    // return a function that lets the source go. It is what keeps the torrent's
+    // data alive for as long as a viewer has a session on it — see
+    // disposeSession.
+    acquireSource = null
   }) {
     if (!this.enabled) {
       const error = new Error("Audio transcoding is disabled on this proxy.");
@@ -1318,6 +1323,13 @@ export class HlsSessionManager {
         lastLoggedAt: 0
       }
     };
+    if (typeof acquireSource === "function") {
+      try {
+        session.releaseSource = acquireSource();
+      } catch {
+        session.releaseSource = null;
+      }
+    }
     this.sessionsById.set(sessionId, session);
     this.sessionIdBySource.set(sourceMapKey, sessionId);
 
@@ -1780,10 +1792,31 @@ export class HlsSessionManager {
     if (!session || session.state === "disposed" || !session.ffmpeg) {
       return;
     }
-    const encodedTo = Number(session.progress?.processedSeconds);
+    // How far the encoder has got, measured by what EXISTS. ffmpeg's own
+    // report of its timeline position is not evidence: field 2026-08-06, it
+    // claimed 6012 s at `speed=1.18e+03x` on a file that was one percent
+    // downloaded and had produced exactly one segment. The limiter believed it,
+    // suspended the encoder twelve seconds into the session, and segment #1 —
+    // which nobody was now making — was held for 45.7 s until the viewer gave
+    // up and seeked. A segment on disk is something the viewer can be served;
+    // a number from ffmpeg is not.
+    const producedThrough = this.#latestProducedSegment(session);
+    if (producedThrough === null) {
+      return;
+    }
+    const encodedTo = this.#segmentStartTime(session, producedThrough + 1);
     if (!Number.isFinite(encodedTo)) {
       return;
     }
+    // Worth knowing when the two disagree wildly — it is the only trace of
+    // whatever made ffmpeg report a position it had not reached.
+    const claimed = Number(session.progress?.processedSeconds);
+    if (Number.isFinite(claimed) && Math.abs(claimed - encodedTo) > LOOKAHEAD_PAUSE_SECONDS) {
+      logger.info(
+        `transcode ${session.id} ffmpeg claims ${Math.round(claimed)}s processed ` +
+          `but has produced through ${Math.round(encodedTo)}s (segment #${producedThrough})`
+      );
+    }
     // Where the viewer is. Before the first segment request, the position the
     // run started at — so a session nobody has read from yet is bounded too.
     const viewerAt = Number.isInteger(session.lastRequestedSegment)
@@ -3206,6 +3239,23 @@ export class HlsSessionManager {
     this.sessionsById.delete(sessionId);
     this.sessionIdBySource.delete(session.sourceMapKey);
 
+    // Let go of the source. While a session exists its torrent must survive
+    // both cleanups the pool runs, and until now neither knew about it: the
+    // only claim on a file is taken by a READ, and during a seek there is no
+    // read at all — the old encoder is dead and the new one has not started.
+    // Field 2026-08-06, that window met the thirty-second disk sweep and the
+    // film being watched was evicted mid-seek, six gigabytes deleted, after
+    // which the new encoder had nothing to read. The session's own thirty
+    // minutes governed the session, never the data under it.
+    if (typeof session.releaseSource === "function") {
+      try {
+        session.releaseSource();
+      } catch {
+        // Best effort — a session must always finish being disposed.
+      }
+      session.releaseSource = null;
+    }
+
     // Clear any pending seek-settle timer so it cannot fire and restart a
     // disposed session.
     if (session.seekSettleTimer) {