fix(audio): cancel stream downloads at teardown so quit can't freeze

rodio decodes inside the CoreAudio render callback, and StreamDownload::read
blocks on a condvar only writer progress or "stream done" can wake. When a
live stream goes quiet (e.g. a daily broadcast ending), stream-download's
reconnect loop retries forever without signalling, the callback wedges in
read, and AudioPlayer teardown then hangs dropping the device sink
(AudioOutputUnitStop waits on the callback) — freezing the app on quit until
force-quit, which orphans the yt-dlp/ffmpeg children.

AudioPlayer now keeps the download's CancellationToken (HTTP and process
inputs) and cancels it in a custom Drop before fields drop: stream-download
kills the child pipeline and signals stream done, waking any wedged reader.
This also reliably reaps yt-dlp/ffmpeg on every track transition and quit.
New ignored test reproduces the stall (ffmpeg emits 6s of audio then stalls
without EOF) and guards the fix.

Companion fixes for deleting the currently-playing history row mid-play:
record_playback_time treats the missing row as a no-op instead of erroring
(kills the "Record not found" warning smeared over the TUI), and starring
always materializes the row first instead of crashing on NotFound.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: program247365

Cargo.lock

@@ -36,6 +36,9 @@ rodio = { version = "0.22", default-features = false, features = ["playback", "m
 souvlaki = { version = "0.8", default-features = false, features = ["use_zbus"] }
 structopt = "0.3.21"
 tokio = { version = "1", features = ["rt-multi-thread"] }
+# Already in the tree transitively via stream-download; the direct dep is only
+# for CancellationToken, used to cancel stream downloads at player teardown.
+tokio-util = "0.7"
 # Spotify playback. `librespot-playback` has default-features off on purpose:
 # it keeps the bundled (older) rodio audio backend out of the tree so there is
 # only one rodio. We feed librespot's decoded PCM through our own custom Sink

Cargo.toml

@@ -262,3 +262,32 @@
   metadata, vortex animation. v0.13.1: [l] Loop added to the footer menu, shown
   only where the key is live (playlist track, not solo-looping).
 - Both releases: tag → CI arm64 binary → tap formula updated automatically.
+
+## 2026-07-09: Fixed the quit-freeze on stalled live streams (the "deleted the playing row" force-quit)
+- Diagnosed the reported freeze: deleting the currently-playing history row was
+  incidental. Root cause: rodio decodes inside the CoreAudio render callback, and
+  `StreamDownload::read` blocks on a Condvar that only writer progress or
+  "stream done" wakes. When a live stream goes quiet (e.g. the daily Claude FM
+  broadcast ending), stream-download's reconnect loop retries forever without
+  signalling, the callback wedges in `read`, and `AudioPlayer` teardown then
+  hangs in `_device` drop (AudioOutputUnitStop waits on the callback) — right
+  between the two quit warnings, matching the frozen screenshot. Force quit then
+  orphaned yt-dlp/ffmpeg (found still alive, PPID 1).
+- Fix: `AudioPlayer` now keeps the download's `CancellationToken` (HTTP and
+  process inputs) and cancels it in a custom `Drop` before fields drop.
+  stream-download's cancelled path kills the child pipeline and signals stream
+  done, waking any wedged reader. Also fixes child-process cleanup on every
+  teardown. New ignored test `drop_does_not_hang_on_stalled_process_stream`
+  (ffmpeg emits 6s of sine then stalls without EOF) reproduced the hang, passes
+  with the fix.
+- Companion fixes for the delete-current-row scenario: `record_playback_time`
+  treats a missing row as a no-op (respect the delete; kills the "Record not
+  found" warning smeared over the TUI), and `s`/star always `ensure_track_row`
+  first so starring after a mid-play delete materializes instead of crashing.
+- Verified: cargo test green (80 + 2), stalled-stream test passes in ~9s,
+  real-world e2e (live lofi stream, quit during playback) exits in ~2s with zero
+  leftover yt-dlp/ffmpeg. Note: fix is unreleased — needs `make release-patch`
+  to reach the Homebrew-installed binary Kevin actually runs.
+- TUI e2e gotcha for next time: grep the pty log for UI strings fails — ratatui
+  writes cells with escape codes between characters; use the terminal title
+  (emitted as one OSC string) as the playback-state signal instead.

WORKLOG.md

@@ -17,6 +17,7 @@ use stream_download::storage::memory::MemoryStorageProvider;
 use stream_download::storage::temp::TempStorageProvider;
 use stream_download::{Settings, StreamDownload};
 use tokio::runtime::Runtime;
+use tokio_util::sync::CancellationToken;
 
 use crate::playback_input::PlaybackInput;
 use stream_download::http::reqwest::header::{HeaderMap, HeaderName, HeaderValue};
@@ -83,6 +84,11 @@ impl<S: Source> Source for SampleTap<S> {
 pub struct AudioPlayer {
     // Owns the OS audio output; dropping it stops playback, so keep it alive.
     _device: MixerDeviceSink,
+    // Cancels the stream download at teardown (see `Drop` below). Without it a
+    // stalled stream (e.g. a live broadcast that went quiet) leaves the audio
+    // callback blocked inside `StreamDownload::read`, and dropping `_device`
+    // then waits on that callback forever — freezing the whole app on quit.
+    download_cancel: Option<CancellationToken>,
     _download_runtime: Option<Runtime>,
     pub sink: Player,
     pub duration: Option<Duration>,
@@ -123,6 +129,7 @@ impl AudioPlayer {
             });
             return Ok(Self {
                 _device: device,
+                download_cancel: None,
                 _download_runtime: None,
                 sink,
                 duration,
@@ -135,7 +142,7 @@ impl AudioPlayer {
             });
         }
 
-        let (reader, duration, runtime, byte_len) = open_input(&input)?;
+        let (reader, duration, runtime, byte_len, download_cancel) = open_input(&input)?;
         let source = decode_input(reader, byte_len)?;
 
         let sample_rate = source.sample_rate().get();
@@ -164,6 +171,7 @@ impl AudioPlayer {
 
         Ok(Self {
             _device: device,
+            download_cancel,
             _download_runtime: runtime,
             sink,
             duration,
@@ -214,7 +222,7 @@ impl AudioPlayer {
         if !self.refillable || !self.sink.empty() {
             return Ok(false);
         }
-        let (reader, _, _, byte_len) = open_input(&self.input)?;
+        let (reader, _, _, byte_len, _) = open_input(&self.input)?;
         let source = decode_input(reader, byte_len)?;
         let tapped = SampleTap {
             inner: source,
@@ -225,6 +233,19 @@ impl AudioPlayer {
     }
 }
 
+/// Runs before the fields drop. Cancelling the download makes stream-download
+/// kill the yt-dlp/ffmpeg children and signal "stream done", which wakes any
+/// audio callback blocked inside `StreamDownload::read`. Only then can
+/// `_device`'s drop (which waits for the callback to return) complete. The
+/// runtime processing the cancellation is still alive here — fields drop after.
+impl Drop for AudioPlayer {
+    fn drop(&mut self) {
+        if let Some(token) = &self.download_cancel {
+            token.cancel();
+        }
+    }
+}
+
 fn decode_input(
     reader: Box<dyn MediaReader>,
     byte_len: Option<u64>,
@@ -238,9 +259,15 @@ fn decode_input(
     builder.build().wrap_err("failed to decode audio")
 }
 
-fn open_input(
-    input: &PlaybackInput,
-) -> Result<(Box<dyn MediaReader>, Option<Duration>, Option<Runtime>, Option<u64>)> {
+type OpenedInput = (
+    Box<dyn MediaReader>,
+    Option<Duration>,
+    Option<Runtime>,
+    Option<u64>,
+    Option<CancellationToken>,
+);
+
+fn open_input(input: &PlaybackInput) -> Result<OpenedInput> {
     match input {
         PlaybackInput::File(path) => {
             let path_str = path.to_string_lossy();
@@ -252,7 +279,7 @@ fn open_input(
 
             let file = File::open(path).wrap_err("failed to open audio file")?;
             let byte_len = file.metadata().ok().map(|m| m.len());
-            Ok((Box::new(file), duration, None, byte_len))
+            Ok((Box::new(file), duration, None, byte_len, None))
         }
         PlaybackInput::HttpStream { url, headers } => {
             let runtime = tokio::runtime::Builder::new_multi_thread()
@@ -274,7 +301,8 @@ fn open_input(
                         .wrap_err("failed to open HTTP audio stream")
                 })
                 .wrap_err("failed to open HTTP audio stream")?;
-            Ok((Box::new(reader), None, Some(runtime), None))
+            let cancel = reader.cancellation_token();
+            Ok((Box::new(reader), None, Some(runtime), None, Some(cancel)))
         }
         PlaybackInput::ProcessStdout {
             program,
@@ -302,7 +330,8 @@ fn open_input(
                     .wrap_err("failed to open process audio stream")
                 })
                 .wrap_err("failed to open process audio stream")?;
-            Ok((Box::new(reader), None, Some(runtime), None))
+            let cancel = reader.cancellation_token();
+            Ok((Box::new(reader), None, Some(runtime), None, Some(cancel)))
         }
         // Spotify is wired up earlier in `AudioPlayer::new` and never reaches
         // the file/stream reader path.
@@ -399,6 +428,39 @@ mod tests {
         );
     }
 
+    #[test]
+    #[ignore = "requires a real audio output device and ffmpeg"]
+    fn drop_does_not_hang_on_stalled_process_stream() {
+        use crate::playback_input::{PlaybackInput, ProcessFormat};
+        use std::time::Duration;
+
+        // Emits ~6s of WAV (past the 256 KB stream prefetch), then stalls
+        // forever without EOF — the shape of a live stream whose upstream
+        // broadcast went quiet.
+        let input = PlaybackInput::process_stdout(
+            "sh",
+            vec![
+                "-c".to_string(),
+                "ffmpeg -v error -f lavfi -i sine=frequency=200:duration=6 -af volume=0.05 -f wav -; sleep 600"
+                    .to_string(),
+            ],
+            ProcessFormat::Wav,
+        );
+        let player = super::AudioPlayer::new(input, false).expect("player should initialize");
+        // Let playback drain the buffered audio so the decoder is blocked
+        // inside the audio callback waiting on the stalled stream.
+        std::thread::sleep(Duration::from_secs(9));
+
+        let (done_tx, done_rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            drop(player);
+            let _ = done_tx.send(());
+        });
+        done_rx
+            .recv_timeout(Duration::from_secs(10))
+            .expect("AudioPlayer drop wedged on a stalled stream");
+    }
+
     #[test]
     fn unknown_length_stream_storage_is_bounded() {
         let (mut reader, mut writer) = stream_storage_with_buffer(4)

src/audio.rs

@@ -764,11 +764,11 @@ fn dispatch_command(
             if let Ok(record) = track_record(track) {
                 let favorite = {
                     let storage = storage.lock().unwrap();
-                    // Playlist tracks have no history row of their own;
-                    // starring one materializes it so there's a row to flip.
-                    if state.is_playlist {
-                        storage.ensure_track_row(&record)?;
-                    }
+                    // The current track may have no history row: playlist
+                    // tracks never get one, and the user can delete the row
+                    // mid-play. Starring is a deliberate act — materialize the
+                    // row so there's one to flip instead of erroring out.
+                    storage.ensure_track_row(&record)?;
                     storage.toggle_favorite(&record.track_key)?
                 };
                 state.is_favorite = favorite;

src/play_loop.rs

@@ -342,10 +342,16 @@ impl Storage {
 
         let mut connection = establish_connection(&self.db_path)?;
         connection.transaction::<_, diesel::result::Error, _>(|conn| {
+            // A missing row means the user deleted it mid-play; respect the
+            // delete rather than erroring (or resurrecting the row).
             let existing_seconds = tracks::played_tracks
                 .filter(tracks::track_key.eq(track_key))
                 .select(tracks::total_play_seconds)
-                .first::<i64>(conn)?;
+                .first::<i64>(conn)
+                .optional()?;
+            let Some(existing_seconds) = existing_seconds else {
+                return Ok(());
+            };
 
             diesel::update(tracks::played_tracks.filter(tracks::track_key.eq(track_key)))
                 .set(tracks::total_play_seconds.eq(existing_seconds + played_seconds))
@@ -839,6 +845,32 @@ mod tests {
             .is_empty());
     }
 
+    #[test]
+    fn playback_time_for_deleted_row_is_a_no_op() {
+        let (_dir, storage) = test_storage();
+        let record = TrackRecord {
+            track_key: "yt:YmQ7jRgf4f0".into(),
+            replay_target: "https://www.youtube.com/watch?v=YmQ7jRgf4f0".into(),
+            title: "Claude FM 06-11".into(),
+            platform: "YouTube".into(),
+            kind: RecordKind::Track,
+        };
+        storage.record_play(&record).unwrap();
+        storage
+            .delete_by_replay_target(&record.replay_target)
+            .unwrap();
+
+        // Deleting the currently-playing row mid-play must not turn the final
+        // play-time write into an error, nor resurrect the deleted row.
+        storage
+            .record_playback_time(&record.track_key, 42)
+            .unwrap();
+        assert!(storage
+            .list_history(HistorySortField::LastPlayed, false)
+            .unwrap()
+            .is_empty());
+    }
+
     #[test]
     fn pull_replica_skips_when_replica_not_newer() {
         let dir = tempdir().unwrap();