fix(deploy): roll transmission back to 4.0.6 + µTP-off + wedge watchdog (0-B/s degradation)

[beveradb]

Problem

transmission-daemon 4.1.3 degrades into a global 0-B/s state after a short uptime: it stays connected to peers (Availability 100%) but transfers nothing on all torrents until restarted, silently breaking every RED/OPS download. First seen 2026-08-07 at a 16-day uptime; recurred 2026-08-21 at only ~1.5 days.

A karaoke job (Regina Spektor – Blue Lips, gen 44622ffa) failed with Torrent download stalled for 600s ... at 77.14%. Diagnosed live on the box: the torrent sat "Downloading" at 77%, 36 peers, 0 B/s; the whole daemon had moved 51 MB in 42h. The exact same torrent + file downloaded in ~110s once the daemon was restarted — proving the wedge (not rare-torrent unavailability; the "77.14%" was just the album-wide wanted-set completion from keep_seeding).

Root cause: the 4.1.0 transport rewrite (preferred-transport / µTP) + its regression stack (upstream #8748, #8658, #8999). 4.1.3 is the newest release (no 4.1.4 → no forward fix); #8308 was fixed by downgrading to 4.0.5 — direct precedent.

Changes (all in deploy/provision.sh)

• Roll transmission back to 4.0.6 (newest 4.0.x, predates the rewrite, RED-whitelisted, RPC/metainfo identical → no flacfetch code change). Build fixes for Debian 13: add libdeflate/natpmp/miniupnpc-dev (4.0.6 doesn't vendor them) and apply upstream's miniupnpc-2.2.8 compat patch (febfe49ca / #6907) so port-forwarding-upnp.cc compiles. Fail hard on a real patch failure; tolerate already-applied. Remove stale /usr/local/bin copies that shadow /usr/bin in PATH.
• settings.json mitigations (version-independent defence-in-depth): utp-enabled=false (highest-value lever for the read-loop wedge; seeds speak TCP), dht/pex/lpd=false (private torrents ignore them), peer-limit-per-torrent 50→30, cache-size-mb 16. Raise LimitNOFILE 1024→131072 via a systemd drop-in.
• Hourly wedge-watchdog replacing the daily restart. The old guard had two fatal flaws: a 5-day threshold (degradation hit at 1.5d) and "skip if any torrent is Downloading" — but a wedged download sits in "Downloading" forever, so it deferred the very restart that cures it. New logic restarts when torrents want data yet aggregate rate ≈0 (Sum-line, sampled twice 20s apart so a live transfer is never interrupted), with a 3h cooldown to avoid restart loops, plus a preventive idle recycle past 48h.

Validation (applied + verified live on the box)

• 4.0.6 running, 272 torrents intact, RED tracker announce succeeds (no whitelist rejection), downloads transfer at 1.55 MB/s with µTP off, fd limit 131072, watchdog correctly no-ops on a healthy daemon.
• Blue Lips job recovered end-to-end (now in_review).

Notes

Reviewed locally with CodeRabbit (findings addressed: patch hunk header + fail-hard, watchdog cooldown).

@coderabbitai ignore

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	43.53% <ø> (-7.17%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.