@torrent-tv/proxy 2.9.111 → 2.9.113

package/CHANGELOG.md

@@ -1,3 +1,11 @@
+## 2.9.113
+
+- **New**: The transport's own counters are written to the log for as long as a channel is open, not only when its send queue backs up. The queue was the wrong thing to watch: field 2026-08-06, a 9.26 MB segment was accepted by the transport with `maxBuffered=0 bufferedAtEnd=0` and reported as sent at 274 Mbit/s, and it never arrived — after which everything the proxy sent vanished the same way while requests kept arriving in the other direction. With nothing ever queued the existing watcher never woke, so the one question that decides the cause — did those bytes leave the machine — had no answer in the log. Every five seconds it now records bytes sent and received by the transport itself, the queue depth, the round-trip time, and the path in use. The browser records the matching figures on the same cadence (server 0.8.110), so a recurrence is settled by subtracting one line from the other rather than by reasoning.
+
+## 2.9.112
+
+- **New**: A session whose data went away now waits for it to come back instead of dying. Losing the input is not the session failing — the torrent can be added again and the pieces downloaded again — but a run that died that way marked the session terminal, and every request for the playlist answered 500 from then on, although the swarm was right there and the data would have returned in seconds. Such a run is now retried at the position the viewer is waiting at, backing off from 2 s to at most 15 s so a source that is genuinely unavailable costs a process every few seconds rather than continuously, and the requests being held are simply held: nothing is broken and there is nothing for the viewer to retry. The circuit breaker stays for what it was built for — a target that truly cannot be encoded — and no longer condemns a session that merely lost its data. Which of the two happened is decided by the message, tested against the exact ones the field produced.
+
 ## 2.9.111
 
 - **Fix**: The film being watched could be deleted mid-seek. A torrent's data is protected only by a claim that READS take, and a seek leaves a gap with no read at all — the old encoder is dead, the new one has not started. The thirty-second disk sweep met that gap on 2026-08-06: with the cap exceeded it evicted "the idle torrent" that a viewer was in the middle of, deleted six gigabytes, and the new encoder found nothing to read. The session's own thirty minutes never governed the data underneath it, because the pool was never told a session existed. A session now holds its source for as long as it lives, and lets go when it is disposed.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.9.111",
+  "version": "2.9.113",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/data-channel-handler.js

@@ -107,8 +107,42 @@ function makeSendQueueWatcher({ log, getTransportSnapshot }) {
     let lowestSinceDrain = Number.POSITIVE_INFINITY;
     let stuckSince = 0;
     let previous = null;
+    // Independent of the queue: the transport's own counters, sampled for as
+    // long as the channel is open. The queue was the wrong thing to watch —
+    // field 2026-08-06, a 9.26 MB segment was accepted by the transport with
+    // `maxBuffered=0 bufferedAtEnd=0`, reported as sent at 274 Mbit/s, and
+    // never arrived; everything the proxy sent from that moment on was lost the
+    // same way while requests kept coming the other direction. With nothing
+    // queued this watcher never woke, so the one question that matters — did
+    // those bytes leave the machine — has no answer in the log. It does now.
+    let heartbeatPrevious = null;
+    let heartbeatAt = 0;
 
     const timer = setInterval(() => {
+      const sampledAt = Date.now();
+      if (sampledAt - heartbeatAt >= TRANSPORT_HEARTBEAT_MS) {
+        heartbeatAt = sampledAt;
+        const snapshot = getTransportSnapshot?.(sessionId) ?? null;
+        if (snapshot) {
+          const sent = heartbeatPrevious ? snapshot.bytesSent - heartbeatPrevious.bytesSent : null;
+          const received = heartbeatPrevious
+            ? snapshot.bytesReceived - heartbeatPrevious.bytesReceived
+            : null;
+          heartbeatPrevious = snapshot;
+          let depth = 0;
+          try {
+            depth = typeof channel.bufferedAmount === "function" ? channel.bufferedAmount() : 0;
+          } catch {
+            depth = -1;
+          }
+          log(
+            `[dc-transport] ${tag} "${label}" sent=${snapshot.bytesSent}` +
+            `${sent === null ? "" : ` (+${sent})`} received=${snapshot.bytesReceived}` +
+            `${received === null ? "" : ` (+${received})`} queued=${depth}B ` +
+            `rtt=${snapshot.rtt}ms pc=${snapshot.state} ice=${snapshot.iceState} pair=${snapshot.pair}`
+          );
+        }
+      }
       let queued = 0;
       try {
         queued = typeof channel.bufferedAmount === "function" ? channel.bufferedAmount() : 0;
@@ -630,6 +664,10 @@ const PARTIAL_REQUEST_TTL_MS = 60_000;
 // well under a second on the LAN — and short enough that a stuck channel is
 // named while the viewer is still looking at it.
 const SEND_QUEUE_SAMPLE_MS = 1_000;
+// How often the transport's own counters are written to the log, whatever the
+// send queue is doing. Frequent enough to place a loss within a few seconds,
+// sparse enough that a two-hour film costs a few hundred lines.
+const TRANSPORT_HEARTBEAT_MS = 5_000;
 const SEND_QUEUE_STUCK_MS = 5_000;
 const DC_BUFFER_HIGH_WATER = 8 * 1024 * 1024;
 /** Resume sending once the channel buffer drains to this many bytes. */

package/services/hls-session-manager.js

@@ -36,6 +36,33 @@ import {
 } from "./ffmpeg-banner.js";
 import { resolveSegmentFormat, SEGMENT_FORMAT_IDS } from "./segment-formats/index.js";
 
+/**
+ * Whether an encoder run died because its INPUT went away, rather than because
+ * of anything about the encode itself.
+ *
+ * These are the messages the read path and ffmpeg's HTTP client produce when
+ * the torrent is gone, being re-added, or has no data for the range yet — all
+ * of them temporary by nature: the source can be added again and the pieces
+ * fetched again.
+ *
+ * @param {string} message
+ * @returns {boolean}
+ */
+export function isInputUnavailable(message) {
+  const text = typeof message === "string" ? message : "";
+  return (
+    /Error reading HTTP response/i.test(text) ||
+    /not found in (?:magnet|torrent):/i.test(text) ||
+    /Unknown source/i.test(text) ||
+    /is gone and cannot be re-added/i.test(text) ||
+    /Read error at pos/i.test(text) ||
+    /Server returned 5\d\d/i.test(text) ||
+    /Input\/output error/i.test(text) ||
+    /Connection reset by peer/i.test(text) ||
+    /End of file/i.test(text)
+  );
+}
+
 const PLAYLIST_FILE_NAME = "index.m3u8";
 const CLEANUP_INTERVAL_MS = 30_000;
 const DEFAULT_SEGMENT_DURATION_SEC = 4;
@@ -130,6 +157,13 @@ const SEEK_FAST_FAIL_MS = 2_000;
 // for whatever residual case still fails — not a second competing "fix" that
 // blindly retries the identical command hoping for a different result.
 const MAX_SEEK_FAILURES = 3;
+// A run that lost its INPUT is retried rather than condemned: the torrent can
+// be added again and the pieces downloaded again, so the data being gone is a
+// wait, not a verdict. Backed off so a source that is truly unavailable costs a
+// process every few seconds rather than continuously, and never given up on —
+// the session's own idle TTL is what ends it if the viewer leaves.
+const INPUT_RETRY_BASE_MS = 2_000;
+const INPUT_RETRY_MAX_MS = 15_000;
 // Idle TTL: a session is disposed this long after the last segment/playlist
 // access. Long enough that a viewer who pauses, backgrounds the tab, or briefly
 // turns the phone off can resume WITHOUT a cold ffmpeg restart (the warm session
@@ -2506,6 +2540,45 @@ export class HlsSessionManager {
         session.seekFailureTarget = -1;
         session.seekFailureCount = 0;
       }
+      // Losing the INPUT is not the session failing — it is the data not being
+      // there YET. The torrent can be re-added and re-downloaded, so the
+      // honest answer to the viewer is "still working", not an error screen.
+      // Field 2026-08-06: a torrent evicted mid-seek took the film with it, the
+      // run died on `File 0 not found`, the session went terminal and answered
+      // 500 to every request from then on — although the swarm was there and
+      // the data would have come back in seconds. The circuit breaker below
+      // stays for what it was built for, a target that genuinely cannot be
+      // encoded; it must not condemn a session whose data merely went away.
+      if (isInputUnavailable(session.lastError)) {
+        session.state = "recovering";
+        // On the wire it is simply "not ready yet" — a state the browser has
+        // always known how to wait through. Only the proxy needs the
+        // distinction between waiting for data and having given up.
+        session.progress.state = "starting";
+        session.progress.updatedAt = Date.now();
+        session.inputRetryCount = (session.inputRetryCount ?? 0) + 1;
+        const delayMs = Math.min(
+          INPUT_RETRY_MAX_MS,
+          INPUT_RETRY_BASE_MS * 2 ** Math.min(session.inputRetryCount - 1, 6)
+        );
+        logger.warn(
+          `transcode ${session.id} ${session.runLabel ?? "run#?"} lost its input ` +
+            `(${session.lastError}); retrying in ${Math.round(delayMs / 1000)}s ` +
+            `(attempt ${session.inputRetryCount})`
+        );
+        session.inputRetryTimer = setTimeout(() => {
+          session.inputRetryTimer = null;
+          if (session.state !== "recovering") {
+            return;
+          }
+          const at = Number.isInteger(session.lastRequestedSegment)
+            ? session.lastRequestedSegment
+            : (session.encodeStartIndex ?? 0);
+          this.#startEncodeRun(session, at).catch(() => {});
+        }, delayMs);
+        session.inputRetryTimer.unref?.();
+        return;
+      }
       session.state = "failed";
       session.progress.state = "failed";
       session.progress.updatedAt = Date.now();
@@ -2949,6 +3022,12 @@ export class HlsSessionManager {
     if (!session || !isSafeFileName(fileName, session.segmentFormat)) {
       return { kind: "not-found" };
     }
+    if (session.state === "recovering") {
+      // The data went away and is being fetched again. Holding the request is
+      // the truthful answer: nothing is broken and there is nothing for the
+      // viewer to retry.
+      return { kind: "warming-up" };
+    }
     if (session.state === "failed") {
       return {
         kind: "failed",
@@ -3064,6 +3143,9 @@ export class HlsSessionManager {
       // — the time from session-create entry to a playable first segment.
       if (!isPlaylist && !session.firstSegmentLogged) {
         session.firstSegmentLogged = true;
+        // Data is flowing again, so the next loss starts its backoff afresh
+        // rather than inheriting the delay of the last one.
+        session.inputRetryCount = 0;
         this.#rememberFirstSegmentLatency(Date.now() - session.createEntryMs);
         logger.info(
           `cold-start ${sessionId.slice(0, 8)}: first-segment ready +${Date.now() - session.createEntryMs}ms`
@@ -3262,6 +3344,10 @@ export class HlsSessionManager {
       clearTimeout(session.seekSettleTimer);
       session.seekSettleTimer = null;
     }
+    if (session.inputRetryTimer) {
+      clearTimeout(session.inputRetryTimer);
+      session.inputRetryTimer = null;
+    }
 
     this.#resumeEncoder(session, "session disposed");
     if (session.ffmpeg && !session.ffmpeg.killed) {

package/test/input-unavailable.test.js

@@ -0,0 +1,48 @@
+/**
+ * @file Telling "the data is not here yet" from "this cannot be encoded".
+ *
+ * A run that dies because its input went away used to condemn the whole
+ * session: state `failed`, and every request for the playlist answered 500
+ * from then on. But the torrent can be added again and the pieces downloaded
+ * again, so the data being gone is a wait, not a verdict — measured 2026-08-06,
+ * a torrent evicted mid-seek killed a session whose swarm was right there and
+ * whose data would have come back in seconds.
+ *
+ * The classification is what decides which of the two happened, so it is tested
+ * on the exact messages the field produced.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { isInputUnavailable } from "../services/hls-session-manager.js";
+
+test("the messages the field produced when data went away are all temporary", () => {
+  for (const message of [
+    "[http @ 0x7f99b19f00] Error reading HTTP response: End of file",
+    "File 0 not found in torrent:17c46f5c36b94865858bfeaa412693c097328a50.",
+    "File 5 not found in magnet:8d3b6c2e74df473e3649521f927ae33b20cd9e67.",
+    "Unknown source 9711bbde2debdcd0d1fbd8cf88d68fd9612e5d31.",
+    "[in#0/matroska,webm @ 0x7f9005f340] Read error at pos. 138556 (0x21d3c)",
+    "Server returned 503 Service Unavailable",
+    "Input/output error"
+  ]) {
+    assert.equal(isInputUnavailable(message), true, `should be retried: ${message}`);
+  }
+});
+
+test("a real encoding failure is not mistaken for one", () => {
+  for (const message of [
+    "Cannot write moov atom before AC3 packets. Set the delay_moov flag to fix this.",
+    "Could not write header (incorrect codec parameters ?): Invalid argument",
+    "Unknown encoder 'h264_v4l2m2m'",
+    "ffmpeg exited with code 1"
+  ]) {
+    assert.equal(isInputUnavailable(message), false, `should stay terminal: ${message}`);
+  }
+});
+
+test("nothing at all is not a reason to retry for ever", () => {
+  assert.equal(isInputUnavailable(""), false);
+  assert.equal(isInputUnavailable(undefined), false);
+  assert.equal(isInputUnavailable(null), false);
+});