@torrent-tv/proxy 2.9.113 → 2.9.115

package/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 2.9.114
+
+- **Fix**: A seek leaked a pinned piece, and enough of them destroyed the torrent. A piece is pinned before its fragment is handed to the reader and released by whoever received it — but a consumer that ABANDONS the read never gets the chance, and a seek abandons it every time: the encoder is killed, the response is torn down, the loop is left between two fragments. Field 2026-08-06, one seek was enough: the store answered `Every resident piece is pinned; no slot can be freed`, and it answered it to the WebTorrent client, which closed the store and destroyed the torrent — after which every read failed with `File 0 not found`, the session went terminal, and the segment the viewer was waiting for returned an instant error. The pin of a fragment still in the consumer's hands is now dropped by the reader itself on every exit, abandonment included. Covered by a test that abandons a read mid-fragment and checks the store has nothing pinned.
+- **Chore**: The look-ahead reports that ffmpeg's position and the segments on disk disagree on the EDGES of that state — once when they part company, once when they meet again, with how long it lasted. It was printed per call of a function that runs on every segment request, which after a seek meant three hundred times a minute; a rate limit would only have hidden that the line was in the wrong place, and it could not have said how long the disagreement went on.
+
 ## 2.9.113
 
 - **New**: The transport's own counters are written to the log for as long as a channel is open, not only when its send queue backs up. The queue was the wrong thing to watch: field 2026-08-06, a 9.26 MB segment was accepted by the transport with `maxBuffered=0 bufferedAtEnd=0` and reported as sent at 274 Mbit/s, and it never arrived — after which everything the proxy sent vanished the same way while requests kept arriving in the other direction. With nothing ever queued the existing watcher never woke, so the one question that decides the cause — did those bytes leave the machine — had no answer in the log. Every five seconds it now records bytes sent and received by the transport itself, the queue depth, the round-trip time, and the path in use. The browser records the matching figures on the same cadence (server 0.8.110), so a recurrence is settled by subtracting one line from the other rather than by reasoning.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.9.113",
+  "version": "2.9.115",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/hls-session-manager.js

@@ -1844,12 +1844,29 @@ export class HlsSessionManager {
     }
     // Worth knowing when the two disagree wildly — it is the only trace of
     // whatever made ffmpeg report a position it had not reached.
+    // Reported on its EDGES, because it is a state and not a stream: it starts
+    // when the two figures part company and ends when they meet again, however
+    // often this function happens to run. Printing it per call meant printing
+    // it at the rate of segment requests — three hundred times a minute after
+    // one seek — and a limit of one a minute would only have hidden that the
+    // line was in the wrong place. Two lines per occurrence also say how long
+    // it lasted, which no sampled version could.
     const claimed = Number(session.progress?.processedSeconds);
-    if (Number.isFinite(claimed) && Math.abs(claimed - encodedTo) > LOOKAHEAD_PAUSE_SECONDS) {
+    const disagrees =
+      Number.isFinite(claimed) && Math.abs(claimed - encodedTo) > LOOKAHEAD_PAUSE_SECONDS;
+    if (disagrees && !session.lookAheadDisagreementSince) {
+      session.lookAheadDisagreementSince = Date.now();
       logger.info(
         `transcode ${session.id} ffmpeg claims ${Math.round(claimed)}s processed ` +
           `but has produced through ${Math.round(encodedTo)}s (segment #${producedThrough})`
       );
+    } else if (!disagrees && session.lookAheadDisagreementSince) {
+      const lastedMs = Date.now() - session.lookAheadDisagreementSince;
+      session.lookAheadDisagreementSince = 0;
+      logger.info(
+        `transcode ${session.id} ffmpeg's position and the segments on disk agree again ` +
+          `after ${(lastedMs / 1000).toFixed(1)}s (produced through ${Math.round(encodedTo)}s)`
+      );
     }
     // Where the viewer is. Before the first segment request, the position the
     // run started at — so a session nobody has read from yet is bounded too.

package/services/torrent-worker/piece-reader.js

@@ -315,6 +315,13 @@ export async function* readFragments({
   let window = null;
   /** @type {{ from: number, to: number } | null} */
   let criticalMark = null;
+  /**
+   * Drops the pin of the fragment currently in the consumer's hands, if it
+   * still holds one. See where it is assigned.
+   *
+   * @type {(() => void) | null}
+   */
+  let releaseHeldPin = null;
   /**
    * The rest of the file, claimed at the lowest priority so it is fetched with
    * whatever capacity the near window does not need. Null whenever it must not
@@ -507,6 +514,21 @@ export async function* readFragments({
       }
 
       let releasedThisPiece = false;
+      // Remembered so the generator can drop it itself. The pin is taken here
+      // and the consumer is expected to release it — but a consumer that
+      // ABANDONS the iterator never gets the chance, and a seek abandons it
+      // every time: the encoder is killed, the response is torn down, and the
+      // loop is left between two fragments. Field 2026-08-06: after one seek
+      // every slot in the store was pinned, the store answered
+      // `Every resident piece is pinned; no slot can be freed` — to the
+      // WebTorrent client, which closed the store and destroyed the torrent —
+      // and the session died with `File 0 not found`.
+      releaseHeldPin = () => {
+        if (!releasedThisPiece) {
+          releasedThisPiece = true;
+          store.unpin(pieceIndex);
+        }
+      };
       yield {
         pieceIndex,
         offset: located.offset + fromWithinPiece,
@@ -519,8 +541,17 @@ export async function* readFragments({
           store.unpin(pieceIndex);
         }
       };
+      // Handed back, and released by the consumer or not at all — either way
+      // this reader no longer owes anything for it.
+      releaseHeldPin = null;
     }
   } finally {
+    // A fragment handed out and never released is a slot lost for the life of
+    // the process. Reached on every exit, including the consumer walking away.
+    if (releaseHeldPin) {
+      releaseHeldPin();
+      releaseHeldPin = null;
+    }
     // Reached on completion, on cancellation, on a throw, and when the consumer
     // stops iterating — a window left behind would keep the swarm fetching for
     // a reader that no longer exists.

package/test/read-window.test.js

@@ -245,3 +245,34 @@ test("criticality marks the window being waited for, not the whole range", async
     await fs.rm(directory, { recursive: true, force: true });
   }
 });
+
+test("a reader that is abandoned mid-fragment does not keep the piece pinned", async () => {
+  // The pin is taken before the fragment is handed out and released by the
+  // consumer — but a seek abandons the iterator between two fragments, and the
+  // consumer never gets the chance. Field 2026-08-06: after one seek every slot
+  // in the store was pinned, the store answered `Every resident piece is
+  // pinned; no slot can be freed` to the WebTorrent client, which closed the
+  // store and destroyed the torrent.
+  const { torrent, store, directory } = await recordingTorrent({ pieceCount: 40 });
+  try {
+    const iterator = readFragments({
+      torrent,
+      fileIndex: 0,
+      start: 0,
+      end: 40 * PIECE - 1,
+      cancellation: { isCancelled: () => false },
+      windowBytes: WINDOW_PIECES * PIECE
+    });
+    await iterator.next(); // held, deliberately NOT released
+    await iterator.return(); // what a seek does
+
+    assert.equal(
+      store.stats().pinned,
+      0,
+      "the abandoned fragment's piece is still pinned; slots leak one per seek"
+    );
+  } finally {
+    store.destroy(() => undefined);
+    await fs.rm(directory, { recursive: true, force: true });
+  }
+});