fix(windows): release FFmpeg memory and capture native crashes

Co-authored-by: xunguangzlj-cloud <[email protected]>

.github/workflows/test.yml

@@ -134,6 +134,9 @@ jobs:
         if: runner.os == 'macOS'
         with:
           flutter-version: ${{ env.FLUTTER_VERSION }}
+      - name: Test Windows FFmpeg memory and stream lifecycle
+        if: runner.os == 'Windows'
+        run: go test -v -count=1 -timeout 180s ./pkg/download/engine/ffmpeg ./pkg/download/engine/inject/stream ./pkg/download/engine
       - name: Install Linux WebView dependencies
         if: runner.os == 'Linux'
         run: |

internal/fetcher/fetcher.go

@@ -46,6 +46,10 @@ type Uploader interface {
 	WaitUpload() error
 }
 
+type DownloadCounter interface {
+	ReceivedBytes() int64
+}
+
 // FetcherMeta defines the meta information of a fetcher.
 type FetcherMeta struct {
 	Req  *base.Request  `json:"req"`

internal/protocol/bt/download_test.go

@@ -290,6 +290,82 @@ func TestBTDownloadSelectedFiles(t *testing.T) {
 	if f.Meta().Res.Size != 48*1024 {
 		t.Fatal("selected resource size is incorrect")
 	}
+	if downloaded := f.Progress().TotalDownloaded(); downloaded != 48*1024 || f.ReceivedBytes() <= downloaded {
+		t.Fatalf("selected progress = %d, received traffic = %d; want 48 KiB of progress and traffic across the shared piece", downloaded, f.ReceivedBytes())
+	}
+}
+
+func TestBTProgressOnlyCountsVerifiedFileBytes(t *testing.T) {
+	const fileSize = 56 * 1024
+	fixture := makeBTFixtureWithPieceSize(t, map[string][]byte{
+		"a.bin": btPayload(fileSize, "verified-a"),
+		"b.bin": btPayload(fileSize, "verified-b"),
+	}, 16*1024, false, true, 64*1024)
+	f := btDownloadFetcher(t, nil)
+	btResolve(t, f, fixture.Magnet)
+	dir := t.TempDir()
+	f.Meta().Opts = &base.Options{Path: dir}
+	btStart(t, f)
+	deadline := time.Now().Add(8 * time.Second)
+	for f.torrent.Files()[0].BytesCompleted() == 0 && time.Now().Before(deadline) {
+		time.Sleep(10 * time.Millisecond)
+	}
+	btPause(t, f)
+	if f.torrent.Files()[0].BytesCompleted() == 0 || f.torrent.Piece(0).State().Complete {
+		t.Fatal("expected some received bytes in a piece that is still incomplete")
+	}
+	if f.ReceivedBytes() == 0 {
+		t.Fatal("received traffic must be visible before a piece is verified")
+	}
+	if progress := f.Progress(); len(progress) != 2 || progress[0] != 0 {
+		t.Errorf("progress before the first file's piece is verified = %v, want zero for the first file", progress)
+	}
+	fixture.Limiter.SetLimit(rate.Inf)
+	btStart(t, f)
+	btAwaitDone(t, f)
+	fixture.AssertFiles(t, dir)
+	progress := f.Progress()
+	if len(progress) != 2 || progress[0] != fileSize || progress[1] != fileSize {
+		t.Fatalf("verified progress at completion = %v, want %d for each file", progress, fileSize)
+	}
+}
+
+func TestBTUploadedBytesSamplesLiveTraffic(t *testing.T) {
+	payload := btPayload(48*1024, "upload-counter")
+	fixture := newBTFixture(t, map[string][]byte{"": payload}, 0)
+	const saved = 1024
+	f := &Fetcher{
+		torrent:       fixture.Torrent,
+		data:          &fetcherData{SeedBytes: saved},
+		seedBaseBytes: saved,
+	}
+	f.torrentReady.Store(true)
+	f.torrentUpload.Store(true)
+
+	cfg := torrent.TestingConfig(t)
+	cfg.DataDir = t.TempDir()
+	cfg.DisableTrackers = true
+	cfg.DisableUTP = true
+	cfg.DisableIPv6 = true
+	peer, err := torrent.NewClient(cfg)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { peer.Close() })
+	download, _, err := peer.AddTorrentSpec(torrent.TorrentSpecFromMetaInfo(fixture.MetaInfo))
+	if err != nil {
+		t.Fatal(err)
+	}
+	download.AddPeers([]torrent.PeerInfo{{Addr: fixture.Seeder.ListenAddrs()[0]}})
+	download.DownloadAll()
+	select {
+	case <-download.Complete().On():
+	case <-time.After(10 * time.Second):
+		t.Fatal("loopback peer did not complete")
+	}
+	if got, want := f.UploadedBytes(), int64(saved+len(payload)); got != want {
+		t.Fatalf("uploaded bytes = %d, want %d including the saved bytes", got, want)
+	}
 }
 
 func TestBTPauseAndResume(t *testing.T) {

internal/protocol/bt/fetcher.go

@@ -10,6 +10,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"sort"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -42,9 +43,10 @@ type Fetcher struct {
 	ctl    *controller.Controller
 	config *config
 
-	torrent *torrent.Torrent
-	meta    *fetcher.FetcherMeta
-	data    *fetcherData
+	torrent       *torrent.Torrent
+	meta          *fetcher.FetcherMeta
+	data          *fetcherData
+	seedBaseBytes int64
 
 	torrentReady    atomic.Bool
 	torrentUpload   atomic.Bool
@@ -463,14 +465,46 @@ func (f *Fetcher) Progress() fetcher.Progress {
 	if !f.torrentReady.Load() {
 		return append(fetcher.Progress(nil), f.data.Progress...)
 	}
+	pieceSize := f.torrent.Info().PieceLength
+	var offset int64
+	var verified []verifiedByteRange
+	for _, run := range f.torrent.PieceStateRuns() {
+		end := offset + int64(run.Length)*pieceSize
+		if pieceVerified(run.PieceState) {
+			verified = append(verified, verifiedByteRange{start: offset, end: end})
+		}
+		offset = end
+	}
+	files := f.torrent.Files()
 	for i := range f.data.Progress {
 		selectIndex := f.meta.Opts.SelectFiles[i]
-		file := f.torrent.Files()[selectIndex]
-		f.data.Progress[i] = file.BytesCompleted()
+		file := files[selectIndex]
+		f.data.Progress[i] = verifiedFileBytes(verified, file.Offset(), file.Length())
 	}
 	return append(fetcher.Progress(nil), f.data.Progress...)
 }
 
+type verifiedByteRange struct {
+	start, end int64
+}
+
+func verifiedFileBytes(verified []verifiedByteRange, offset, length int64) int64 {
+	first := sort.Search(len(verified), func(i int) bool { return verified[i].end > offset })
+	fileEnd := offset + length
+	var completed int64
+	for _, run := range verified[first:] {
+		if run.start >= fileEnd {
+			break
+		}
+		completed += min(fileEnd, run.end) - max(offset, run.start)
+	}
+	return completed
+}
+
+func pieceVerified(state torrent.PieceState) bool {
+	return state.Ok && state.Complete && !state.Hashing && !state.QueuedForHash
+}
+
 func (f *Fetcher) Wait() error {
 	f.mu.Lock()
 	var closed <-chan struct{}
@@ -587,7 +621,7 @@ func (f *Fetcher) isDoneLocked() bool {
 		file := f.torrent.Files()[index]
 		for i := file.BeginPieceIndex(); i < file.EndPieceIndex(); i++ {
 			state := f.torrent.Piece(i).State()
-			if !state.Ok || !state.Complete || state.Hashing || state.QueuedForHash {
+			if !pieceVerified(state) {
 				return false
 			}
 		}
@@ -685,11 +719,13 @@ func (f *Fetcher) Upload() (err error) {
 }
 
 func (f *Fetcher) doUpload(fromUpload bool) {
+	f.mu.Lock()
 	if !f.torrentUpload.CompareAndSwap(false, true) {
+		f.mu.Unlock()
 		return
 	}
-	f.mu.Lock()
-	initialBytes, initialTime := f.data.SeedBytes, f.data.SeedTime
+	f.seedBaseBytes = f.data.SeedBytes
+	initialTime := f.data.SeedTime
 	torrentClosed := f.torrent.Closed()
 	f.mu.Unlock()
 	var doneTime int64
@@ -707,8 +743,7 @@ func (f *Fetcher) doUpload(fromUpload bool) {
 				f.mu.Unlock()
 				continue
 			}
-			stats := f.torrentStats()
-			f.data.SeedBytes = initialBytes + stats.BytesWrittenData.Int64()
+			f.refreshSeedBytesLocked()
 			if !fromUpload && !f.isDoneLocked() {
 				f.mu.Unlock()
 				continue
@@ -741,9 +776,27 @@ func (f *Fetcher) torrentStats() torrent.TorrentStats {
 func (f *Fetcher) UploadedBytes() int64 {
 	f.mu.Lock()
 	defer f.mu.Unlock()
+	if f.torrentReady.Load() && f.torrentUpload.Load() {
+		f.refreshSeedBytesLocked()
+	}
 	return f.data.SeedBytes
 }
 
+func (f *Fetcher) refreshSeedBytesLocked() {
+	stats := f.torrentStats()
+	f.data.SeedBytes = max(f.data.SeedBytes, f.seedBaseBytes+stats.BytesWrittenData.Int64())
+}
+
+func (f *Fetcher) ReceivedBytes() int64 {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if !f.torrentReady.Load() {
+		return 0
+	}
+	stats := f.torrentStats()
+	return stats.BytesReadUsefulData.Int64()
+}
+
 func (f *Fetcher) WaitUpload() (err error) {
 	<-f.uploadDoneCh
 	return nil

internal/protocol/bt/fixture_test.go

@@ -46,6 +46,11 @@ func newBTHybridFixture(t testing.TB, payload []byte) *btFixture {
 }
 
 func makeBTFixture(t testing.TB, files map[string][]byte, bytesPerSecond int, v2, private bool) *btFixture {
+	t.Helper()
+	return makeBTFixtureWithPieceSize(t, files, bytesPerSecond, v2, private, 16*1024)
+}
+
+func makeBTFixtureWithPieceSize(t testing.TB, files map[string][]byte, bytesPerSecond int, v2, private bool, pieceSize int64) *btFixture {
 	t.Helper()
 	source := t.TempDir()
 	name := "payload.bin"
@@ -64,7 +69,7 @@ func makeBTFixture(t testing.TB, files map[string][]byte, bytesPerSecond int, v2
 		}
 		expected[filepath.Join(name, filepath.FromSlash(path))] = append([]byte(nil), data...)
 	}
-	info := metainfo.Info{PieceLength: 16 * 1024}
+	info := metainfo.Info{PieceLength: pieceSize}
 	if err := info.BuildFromFilePath(root); err != nil {
 		t.Fatal(err)
 	}

internal/protocol/http/fetcher.go

@@ -418,16 +418,6 @@ func (f *Fetcher) updateMaxConnTime(d time.Duration) {
 }
 
 func (f *Fetcher) Resolve(req *base.Request) error {
-	return f.ResolveContext(context.Background(), req)
-}
-
-// ResolveContext cancels the initial request while waiting for headers. Once
-// Resolve has returned, the retained response belongs to the fetcher and its
-// existing Pause/Close lifecycle controls the body and prefetch.
-func (f *Fetcher) ResolveContext(ctx context.Context, req *base.Request) error {
-	if err := ctx.Err(); err != nil {
-		return err
-	}
 	if err := base.ParseReqExtra[fhttp.ReqExtra](req); err != nil {
 		return err
 	}
@@ -439,8 +429,6 @@ func (f *Fetcher) ResolveContext(ctx context.Context, req *base.Request) error {
 	// This allows the response to be reused for downloading (important for one-time URLs)
 	// The body outlives Resolve, so the read timeout gets its own cancel func.
 	reqCtx, reqCancel := context.WithCancel(context.Background())
-	stopCancel := context.AfterFunc(ctx, reqCancel)
-	defer stopCancel()
 	httpReq, err := f.buildRequest(reqCtx, req)
 	if err != nil {
 		reqCancel()

pkg/api/resolve_release_test.go

@@ -1,36 +0,0 @@
-package api
-
-import (
-	"net/http"
-	"path/filepath"
-	"testing"
-
-	"github.com/GopeedLab/gopeed/pkg/base"
-	"github.com/GopeedLab/gopeed/pkg/download"
-	restmodel "github.com/GopeedLab/gopeed/pkg/rest/model"
-)
-
-func TestCancelledTorrentPreviewCanBeResolvedAgain(t *testing.T) {
-	d := download.NewDownloader(&download.DownloaderConfig{StorageDir: t.TempDir(), TempDir: t.TempDir()})
-	if err := d.Setup(); err != nil {
-		t.Fatal(err)
-	}
-	defer d.Close()
-	service, err := NewService(d)
-	if err != nil {
-		t.Fatal(err)
-	}
-	path, err := filepath.Abs("../../internal/protocol/bt/testdata/test.torrent")
-	if err != nil {
-		t.Fatal(err)
-	}
-	req := &restmodel.ResolveTask{Req: &base.Request{URL: path}}
-	first := serviceTestRequest[*download.ResolveResult](t, service, http.MethodPost, "/api/v1/resolve", req)
-	serviceTestRequest[any](t, service, http.MethodDelete, "/api/v1/resolve/"+first.ID, nil)
-	// Release is idempotent, including an old window disposing after Create.
-	serviceTestRequest[any](t, service, http.MethodDelete, "/api/v1/resolve/"+first.ID, nil)
-	second := serviceTestRequest[*download.ResolveResult](t, service, http.MethodPost, "/api/v1/resolve", req)
-	if second.Res.Hash != first.Res.Hash {
-		t.Fatalf("different torrent after release: %v", second)
-	}
-}

pkg/api/service.go

@@ -51,7 +51,6 @@ func NewService(downloader *download.Downloader) (*Service, error) {
 	service.routes = []RouteSpec{
 		newRoute(http.MethodGet, "/api/v1/info", service.info),
 		newRoute(http.MethodPost, "/api/v1/resolve", service.resolve),
-		newRoute(http.MethodDelete, "/api/v1/resolve/{id}", service.releaseResolve),
 		newRoute(http.MethodPost, "/api/v1/tasks", service.createTask),
 		newRoute(http.MethodPost, "/api/v1/tasks/batch", service.createTaskBatch),
 		newRoute(http.MethodPatch, "/api/v1/tasks/{id}", service.patchTask),
@@ -144,20 +143,13 @@ func (s *Service) resolve(ctx *Context) *Response {
 	if response := decodeRequest(ctx.Body, &request); response != nil {
 		return response
 	}
-	result, err := s.Downloader.ResolveWithID(request.ID, request.Req)
+	result, err := s.Downloader.Resolve(request.Req)
 	if err != nil {
 		return newErrorResponse(err.Error())
 	}
 	return newOKResponse(result)
 }
 
-func (s *Service) releaseResolve(ctx *Context) *Response {
-	if err := s.Downloader.ReleaseResolve(ctx.PathParam("id")); err != nil {
-		return newErrorResponse(err.Error())
-	}
-	return newOKResponse(nil)
-}
-
 func (s *Service) createTask(ctx *Context) *Response {
 	var request restmodel.CreateTask
 	if response := decodeRequest(ctx.Body, &request); response != nil {

pkg/download/crash_log_test.go

@@ -0,0 +1,26 @@
+package download
+
+import (
+	"os"
+	"path/filepath"
+	"runtime/debug"
+	"testing"
+)
+
+func TestLogPanicPreservesPreviousCrash(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "crash.log")
+	const previous = "previous crash traceback\n"
+	if err := os.WriteFile(path, []byte(previous), 0600); err != nil {
+		t.Fatal(err)
+	}
+	logPanic(dir)
+	t.Cleanup(func() { _ = debug.SetCrashOutput(nil, debug.CrashOptions{}) })
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(data) != previous {
+		t.Fatalf("previous crash was overwritten: %q", data)
+	}
+}

pkg/download/downloader.go

@@ -116,7 +116,6 @@ type Downloader struct {
 
 	cfg            *DownloaderConfig
 	fetcherCache   map[string]fetcher.Fetcher
-	resolveStates  map[string]*resolveState
 	storage        Storage
 	tasks          []*Task
 	waitTasks      []*Task
@@ -154,7 +153,6 @@ func NewDownloader(cfg *DownloaderConfig) *Downloader {
 		cancelBackground: cancelBackground,
 		cfg:              cfg,
 		fetcherCache:     make(map[string]fetcher.Fetcher),
-		resolveStates:    make(map[string]*resolveState),
 		waitTasks:        make([]*Task, 0),
 		groups:           make(map[string]*TaskGroup),
 		creatingGroups:   make(map[string]struct{}),
@@ -347,7 +345,12 @@ func (d *Downloader) Setup() error {
 						}
 
 						current := task.fetcher.Progress().TotalDownloaded()
-						delta := current - task.Progress.Downloaded
+						delta := max(0, current-task.Progress.Downloaded)
+						if counter, ok := task.fetcher.(fetcher.DownloadCounter); ok && task.Status == base.DownloadStatusRunning {
+							received := counter.ReceivedBytes()
+							delta = received - task.receivedBytes
+							task.receivedBytes = received
+						}
 						if task.Meta != nil && task.Meta.Req != nil {
 							if producer := d.blob.Production(task.Meta.Req.URL); producer != nil {
 								downloaded, received := producer.Progress()
@@ -355,19 +358,20 @@ func (d *Downloader) Setup() error {
 									task.producer = producer
 									task.producerReceived = 0
 									task.speedArr = nil
+									task.downloadSampledAt = time.Time{}
 								}
 								current = downloaded
 								delta = max(0, received-task.producerReceived)
 								task.producerReceived = received
 							}
 						}
-						tick := float64(d.cfg.RefreshInterval) / 1000
 						downloadDataChanged := false
 						uploading := task.Uploading
 						if task.Status == base.DownloadStatusRunning {
 							downloadDataChanged = current != task.Progress.Downloaded
 							task.Progress.Used = task.timer.Used()
-							task.Progress.Speed = task.updateSpeed(max(0, delta), tick)
+							elapsed := sampleSeconds(&task.downloadSampledAt, time.Now())
+							task.Progress.Speed = task.updateSpeed(delta, elapsed)
 							task.Progress.Downloaded = current
 						}
 
@@ -376,7 +380,8 @@ func (d *Downloader) Setup() error {
 							uploader := task.fetcher.(fetcher.Uploader)
 							currentUploaded := uploader.UploadedBytes()
 							uploadDataChanged = currentUploaded != task.Progress.Uploaded
-							task.Progress.UploadSpeed = task.updateUploadSpeed(currentUploaded-task.Progress.Uploaded, tick)
+							elapsed := sampleSeconds(&task.uploadSampledAt, time.Now())
+							task.Progress.UploadSpeed = task.updateUploadSpeed(currentUploaded-task.Progress.Uploaded, elapsed)
 							task.Progress.Uploaded = currentUploaded
 						}
 						task.statusLock.Unlock()
@@ -561,156 +566,42 @@ func ensureResourceRequestRawURLs(parentReq *base.Request, res *base.Resource) {
 	}
 }
 
-// resolveState owns a Fetcher until Create transfers it to a task.
-// State transitions are protected by fetcherMapLock; closeOnce serializes cleanup.
-type contextResolver interface {
-	ResolveContext(context.Context, *base.Request) error
-}
-
-type resolveState struct {
-	ctx       context.Context
-	cancel    context.CancelFunc
-	fetcher   fetcher.Fetcher
-	cancelled bool
-	resolved  bool
-	claimed   bool
-	closeOnce sync.Once
-	closeErr  error
-}
-
-func (s *resolveState) close(f fetcher.Fetcher) error {
-	if f == nil {
-		return nil
+func (d *Downloader) Resolve(req *base.Request) (rr *ResolveResult, err error) {
+	rrId, err := gonanoid.New()
+	if err != nil {
+		return
 	}
-	s.closeOnce.Do(func() { s.closeErr = f.Close() })
-	return s.closeErr
-}
-
-func (d *Downloader) Resolve(req *base.Request) (*ResolveResult, error) {
-	return d.ResolveWithID("", req)
-}
-
-// ResolveWithID lets a preview cancel before metadata is available. Clients
-// that do not supply an ID retain the server-generated resource ID behavior.
-func (d *Downloader) ResolveWithID(id string, req *base.Request) (rr *ResolveResult, err error) {
-	if id == "" {
-		id, err = gonanoid.New()
-		if err != nil {
-			return nil, err
-		}
-	}
-	if req == nil {
-		return nil, errors.New("resolve request is required")
-	}
-	resolveCtx, cancel := context.WithCancel(d.backgroundCtx)
-	defer cancel()
-	state := &resolveState{ctx: resolveCtx, cancel: cancel}
-	d.fetcherMapLock.Lock()
-	if d.closed.Load() {
-		d.fetcherMapLock.Unlock()
-		return nil, errors.New("downloader is closed")
-	}
-	if d.resolveStates[id] != nil || d.fetcherCache[id] != nil {
-		d.fetcherMapLock.Unlock()
-		return nil, errors.New("resource id is already in use")
-	}
-	d.resolveStates[id] = state
-	d.fetcherMapLock.Unlock()
-	defer func() {
-		if err != nil || state.fetcher == nil {
-			d.fetcherMapLock.Lock()
-			if d.resolveStates[id] == state {
-				delete(d.resolveStates, id)
-			}
-			d.fetcherMapLock.Unlock()
-			_ = state.close(state.fetcher)
-		}
-	}()
 	ensureRequestRawURL(req)
+
 	res, err := d.triggerOnResolve(req)
 	if err != nil {
-		return nil, err
+		return
 	}
 	if res != nil && len(res.Files) > 0 {
-		return &ResolveResult{Res: res, SuggestedDownloadDir: d.suggestedDownloadDir(res)}, nil
-	}
-	f, err := d.buildFetcher(req.URL)
-	if err != nil {
-		return nil, err
-	}
-	d.fetcherMapLock.Lock()
-	state.fetcher = f
-	cancelled := state.cancelled || d.closed.Load()
-	d.fetcherMapLock.Unlock()
-	if cancelled {
-		return nil, errors.New("resource resolution cancelled")
-	}
-	if resolver, ok := f.(contextResolver); ok {
-		err = resolver.ResolveContext(state.ctx, req)
-	} else {
-		err = f.Resolve(req)
-	}
-	if err != nil {
-		return nil, err
-	}
-	d.fetcherMapLock.Lock()
-	defer d.fetcherMapLock.Unlock()
-	if state.cancelled || d.closed.Load() {
-		return nil, errors.New("resource resolution cancelled")
-	}
-	state.resolved = true
-	d.fetcherCache[id] = f
-	return &ResolveResult{ID: id, Res: f.Meta().Res, SuggestedDownloadDir: d.suggestedDownloadDir(f.Meta().Res)}, nil
-}
-
-// ReleaseResolve is idempotent. A resource already transferred to a task is
-// never closed by a late preview cancellation.
-func (d *Downloader) ReleaseResolve(id string) error {
-	d.fetcherMapLock.Lock()
-	state := d.resolveStates[id]
-	f := d.fetcherCache[id]
-	delete(d.fetcherCache, id)
-	delete(d.resolveStates, id)
-	if state != nil {
-		state.cancelled = true
-		state.cancel()
-		if state.claimed {
-			f = nil
-		} else {
-			f = state.fetcher
-			if _, cancellable := f.(contextResolver); cancellable && !state.resolved {
-				// Resolve owns unpublished response/prefetch state. Its context
-				// cancels the request; the returning resolver closes it once
-				// publication has stopped, including a racing response.
-				f = nil
-			}
+		rr = &ResolveResult{
+			Res:                  res,
+			SuggestedDownloadDir: d.suggestedDownloadDir(res),
 		}
+		return
 	}
-	d.fetcherMapLock.Unlock()
-	if state != nil {
-		return state.close(f)
-	}
-	if f != nil {
-		return f.Close()
-	}
-	return nil
-}
 
-func (d *Downloader) closeResolvedResources() {
+	fetcher, err := d.buildFetcher(req.URL)
+	if err != nil {
+		return
+	}
+	err = fetcher.Resolve(req)
+	if err != nil {
+		return
+	}
 	d.fetcherMapLock.Lock()
-	ids := make(map[string]struct{}, len(d.resolveStates)+len(d.fetcherCache))
-	for id := range d.resolveStates {
-		ids[id] = struct{}{}
-	}
-	for id := range d.fetcherCache {
-		ids[id] = struct{}{}
-	}
+	d.fetcherCache[rrId] = fetcher
 	d.fetcherMapLock.Unlock()
-	for id := range ids {
-		if err := d.ReleaseResolve(id); err != nil {
-			d.Logger.Warn().Err(err).Msg("close resolved resource failed")
-		}
+	rr = &ResolveResult{
+		ID:                   rrId,
+		Res:                  fetcher.Meta().Res,
+		SuggestedDownloadDir: d.suggestedDownloadDir(fetcher.Meta().Res),
 	}
+	return
 }
 
 func (d *Downloader) notifyRunning() {
@@ -984,34 +875,18 @@ func (d *Downloader) CreateWithOptions(rrId string, opts *base.Options) (string,
 func (d *Downloader) createResolved(rrId string, opts *base.Options, groupID string) (taskId string, err error) {
 	d.fetcherMapLock.Lock()
 	fetcher, ok := d.fetcherCache[rrId]
-	state := d.resolveStates[rrId]
-	if ok && state != nil {
-		state.claimed = true
-	}
 	delete(d.fetcherCache, rrId)
 	d.fetcherMapLock.Unlock()
 	if !ok {
 		return "", errors.New("invalid resource id")
 	}
-	// Failed creation returns ownership to the preview unless it was cancelled.
+	// Only one creator may use a resolved fetcher. Failed creation makes it
+	// available again; a persisted task consumes it even if starting fails.
 	defer func() {
-		d.fetcherMapLock.Lock()
-		cancelled := d.closed.Load() || (state != nil && state.cancelled)
-		if taskId == "" && !cancelled {
+		if taskId == "" {
+			d.fetcherMapLock.Lock()
 			d.fetcherCache[rrId] = fetcher
-			if state != nil {
-				state.claimed = false
-			}
-		} else if d.resolveStates[rrId] == state {
-			delete(d.resolveStates, rrId)
-		}
-		d.fetcherMapLock.Unlock()
-		if taskId == "" && cancelled {
-			if state != nil {
-				_ = state.close(fetcher)
-			} else {
-				_ = fetcher.Close()
-			}
+			d.fetcherMapLock.Unlock()
 		}
 	}()
 	if opts == nil {
@@ -1694,7 +1569,6 @@ func (d *Downloader) Close() error {
 		return nil
 	}
 	d.cancelBackground()
-	d.closeResolvedResources()
 	d.waitForExtensionGit()
 	if d.protocolJobs != nil {
 		d.protocolJobs.close()
@@ -2586,6 +2460,8 @@ func (d *Downloader) doStart(task *Task) (err error) {
 			return nil
 		}
 		task.Progress.Speed = 0
+		task.speedArr = nil
+		task.downloadSampledAt = time.Time{}
 		task.timer.Start()
 		task.statusLock.Unlock()
 		if err := task.fetcher.Start(); err != nil {
@@ -2783,11 +2659,12 @@ func logPanic(logDir string) {
 	if err := util.CreateDirIfNotExist(logDir); err != nil {
 		return
 	}
-	f, err := os.Create(filepath.Join(logDir, "crash.log"))
+	f, err := os.OpenFile(filepath.Join(logDir, "crash.log"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
 	if err != nil {
 		return
 	}
-	debug.SetCrashOutput(f, debug.CrashOptions{})
+	defer f.Close() // SetCrashOutput duplicates the descriptor.
+	_ = debug.SetCrashOutput(f, debug.CrashOptions{})
 }
 
 func (d *Downloader) assignFetcherManager(task *Task) error {
@@ -3194,8 +3071,10 @@ func initTask(task *Task) {
 	task.lock = &sync.Mutex{}
 	task.statsLock = &sync.Mutex{}
 	task.blobRefLock = &sync.Mutex{}
-	task.speedArr = make([]int64, 0)
-	task.uploadSpeedArr = make([]int64, 0)
+	task.speedArr = nil
+	task.uploadSpeedArr = nil
+	task.downloadSampledAt = time.Time{}
+	task.uploadSampledAt = time.Time{}
 }
 
 func (d *Downloader) releaseBlobTask(task *Task) {

pkg/download/engine/ffmpeg/README.md

@@ -174,3 +174,12 @@ compilation memory, host buffers and JS allocations are additional to the
 linear-memory limit. Playback support depends on the selected codecs, not just
 the `.mp4` suffix. Platform execution and performance must be tested on target
 devices, especially mobile/32-bit devices.
+
+On 64-bit Windows, instance linear memory uses a reserved virtual address range with
+pages committed as it grows. Module completion, errors and cancellation release
+this range directly through `VirtualFree`, rather than waiting for Go's garbage
+collector to reclaim large buffers. Growing an instance preserves its address
+without copying the previous buffer. The 512 MiB limit is unchanged; reservation
+does not commit that entire amount. Shared compilation remains resident after
+the first merge, so process memory is not expected to return exactly to the
+pre-FFmpeg baseline. This does not diagnose unrelated idle memory growth.

pkg/download/engine/ffmpeg/memory.go

@@ -0,0 +1,32 @@
+package ffmpeg
+
+import (
+	"context"
+	"sync"
+
+	"github.com/tetratelabs/wazero/experimental"
+)
+
+// The runtime does not always invoke Free when a module's start function traps.
+// Keep host ownership until execution returns, including failed instantiation.
+func withOwnedMemory(ctx context.Context, allocator experimental.MemoryAllocator) (context.Context, func()) {
+	var memories []*ownedLinearMemory
+	ctx = experimental.WithMemoryAllocator(ctx, experimental.MemoryAllocatorFunc(
+		func(cap, max uint64) experimental.LinearMemory {
+			memory := &ownedLinearMemory{LinearMemory: allocator.Allocate(cap, max)}
+			memories = append(memories, memory)
+			return memory
+		}))
+	return ctx, func() {
+		for _, memory := range memories {
+			memory.Free()
+		}
+	}
+}
+
+type ownedLinearMemory struct {
+	experimental.LinearMemory
+	once sync.Once
+}
+
+func (m *ownedLinearMemory) Free() { m.once.Do(m.LinearMemory.Free) }

pkg/download/engine/ffmpeg/memory_other.go

@@ -0,0 +1,7 @@
+//go:build !windows || (!amd64 && !arm64)
+
+package ffmpeg
+
+import "context"
+
+func withLinearMemory(ctx context.Context) (context.Context, func()) { return ctx, func() {} }

pkg/download/engine/ffmpeg/memory_test.go

@@ -0,0 +1,88 @@
+package ffmpeg
+
+import (
+	"context"
+	"encoding/hex"
+	"testing"
+	"time"
+
+	"github.com/tetratelabs/wazero"
+	"github.com/tetratelabs/wazero/experimental"
+)
+
+// Verify the pinned runtime's allocator lifecycle on every development host:
+// host-owned buffers must not be released before execution ends, or retained
+// after failed instantiation, traps or cancellation.
+func TestLinearMemoryModuleLifecycle(t *testing.T) {
+	testLinearMemoryModuleLifecycle(t, func(_, _ uint64) experimental.LinearMemory {
+		return &testLinearMemory{}
+	})
+}
+
+type testLinearMemory struct{ buffer []byte }
+
+func (m *testLinearMemory) Reallocate(size uint64) []byte {
+	m.buffer = append(m.buffer, make([]byte, int(size)-len(m.buffer))...)
+	return m.buffer
+}
+func (m *testLinearMemory) Free() { m.buffer = nil }
+
+type trackedLinearMemory struct {
+	experimental.LinearMemory
+	freeCount int
+}
+
+func (m *trackedLinearMemory) Free() {
+	m.freeCount++
+	m.LinearMemory.Free()
+}
+
+func testLinearMemoryModuleLifecycle(t *testing.T, allocate experimental.MemoryAllocatorFunc) {
+	t.Helper()
+	for _, tt := range []struct {
+		name string
+		// A module with one memory (min=1/max=2 pages), optionally a start
+		// function that traps or loops until its context is cancelled.
+		wasm    string
+		wantErr bool
+	}{
+		{"close", "0061736d01000000050401010102", false},
+		{"trap", "0061736d01000000010401600000030201000504010101020801000a05010300000b", true},
+		{"cancel", "0061736d01000000010401600000030201000504010101020801000a0901070003400c000b0b", true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+			defer cancel()
+			var memory *trackedLinearMemory
+			ctx, release := withOwnedMemory(ctx, experimental.MemoryAllocatorFunc(
+				func(_, max uint64) experimental.LinearMemory {
+					memory = &trackedLinearMemory{LinearMemory: allocate(0, max)}
+					return memory
+				}))
+			defer release()
+			rt := wazero.NewRuntimeWithConfig(ctx, wazero.NewRuntimeConfig().WithCloseOnContextDone(true))
+			defer rt.Close(context.Background())
+			binary, err := hex.DecodeString(tt.wasm)
+			if err != nil {
+				t.Fatal(err)
+			}
+			module, err := rt.Instantiate(ctx, binary)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("instantiate: %v", err)
+			}
+			if !tt.wantErr {
+				if memory == nil || memory.freeCount != 0 {
+					t.Fatal("module did not allocate native memory")
+				}
+				if err := module.Close(ctx); err != nil {
+					t.Fatal(err)
+				}
+			}
+			release()
+			release()
+			if memory == nil || memory.freeCount != 1 {
+				t.Fatal("host did not release memory exactly once")
+			}
+		})
+	}
+}

pkg/download/engine/ffmpeg/memory_windows.go

@@ -0,0 +1,70 @@
+//go:build windows && (amd64 || arm64)
+
+package ffmpeg
+
+import (
+	"context"
+	"fmt"
+	"unsafe"
+
+	"github.com/tetratelabs/wazero/experimental"
+	"golang.org/x/sys/windows"
+)
+
+// Keep large, short-lived WASM buffers out of the Go heap. Closing a module
+// releases its committed pages immediately, without waiting for GC/scavenging.
+func withLinearMemory(ctx context.Context) (context.Context, func()) {
+	return withOwnedMemory(ctx, experimental.MemoryAllocatorFunc(
+		func(_, max uint64) experimental.LinearMemory {
+			return &windowsLinearMemory{max: max}
+		}))
+}
+
+// Reserve the address range once, committing zero-filled pages on demand. This
+// avoids both copying the previous buffer and temporarily retaining two large
+// Go allocations when memory.grow runs. The backing address never changes.
+type windowsLinearMemory struct {
+	address uintptr
+	max     uint64
+	size    uint64
+	freed   bool
+}
+
+func (m *windowsLinearMemory) Reallocate(size uint64) []byte {
+	if m.freed || size > m.max || m.max > uint64(^uint(0)>>1) {
+		return nil
+	}
+	if size == 0 {
+		return []byte{}
+	}
+	if m.address == 0 {
+		address, err := windows.VirtualAlloc(0, uintptr(m.max), windows.MEM_RESERVE, windows.PAGE_READWRITE)
+		if err != nil {
+			panic(fmt.Errorf("ffmpeg: reserve WASM memory: %w", err))
+		}
+		m.address = address
+	}
+	if size > m.size {
+		_, err := windows.VirtualAlloc(m.address, uintptr(size), windows.MEM_COMMIT, windows.PAGE_READWRITE)
+		if err != nil {
+			if m.size == 0 {
+				// Instantiation cannot proceed without the minimum memory. Wazero
+				// has not taken ownership yet, so release the reservation here.
+				m.Free()
+				panic(fmt.Errorf("ffmpeg: commit WASM memory: %w", err))
+			}
+			return nil // memory.grow reports failure to the guest.
+		}
+		m.size = size
+	}
+	return unsafe.Slice((*byte)(unsafe.Pointer(m.address)), int(size))
+}
+
+func (m *windowsLinearMemory) Free() {
+	if m.address != 0 {
+		_ = windows.VirtualFree(m.address, 0, windows.MEM_RELEASE)
+		m.address = 0
+	}
+	m.size = 0
+	m.freed = true
+}

pkg/download/engine/ffmpeg/memory_windows_test.go

@@ -0,0 +1,54 @@
+//go:build windows && (amd64 || arm64)
+
+package ffmpeg
+
+import (
+	"testing"
+	"unsafe"
+
+	"github.com/tetratelabs/wazero/experimental"
+	"golang.org/x/sys/windows"
+)
+
+func TestWindowsLinearMemoryGrowthAndRelease(t *testing.T) {
+	const page = 65536
+	m := &windowsLinearMemory{max: 4 * page}
+	defer m.Free()
+	first := m.Reallocate(page)
+	if len(first) != page {
+		t.Fatalf("initial allocation: %d", len(first))
+	}
+	first[0], first[page-1] = 17, 29
+	address := m.address
+	grown := m.Reallocate(3 * page)
+	if unsafe.SliceData(first) != unsafe.SliceData(grown) || grown[0] != 17 || grown[page-1] != 29 {
+		t.Fatal("growing memory moved or lost existing bytes")
+	}
+	for _, b := range grown[page:] {
+		if b != 0 {
+			t.Fatal("newly committed memory is not zero-filled")
+		}
+	}
+	if m.Reallocate(5*page) != nil || m.address != address || m.size != 3*page {
+		t.Fatal("failed growth changed the existing allocation")
+	}
+	m.Free()
+	m.Free()
+	if m.address != 0 || m.Reallocate(page) != nil {
+		t.Fatal("freed memory can still be used")
+	}
+	var info windows.MemoryBasicInformation
+	if err := windows.VirtualQuery(address, &info, unsafe.Sizeof(info)); err != nil {
+		t.Fatal(err)
+	}
+	const memFree = 0x10000 // MEMORY_BASIC_INFORMATION.State: MEM_FREE.
+	if info.State != memFree {
+		t.Fatalf("pages remain reserved after Free: state=%x", info.State)
+	}
+}
+
+func TestWindowsLinearMemoryModuleLifecycle(t *testing.T) {
+	testLinearMemoryModuleLifecycle(t, func(_, max uint64) experimental.LinearMemory {
+		return &windowsLinearMemory{max: max}
+	})
+}

pkg/download/engine/ffmpeg/runtime.go

@@ -151,7 +151,9 @@ func RunAcquired(ctx context.Context, video, audio Input, out io.Writer, format
 	files := &inputFS{files: map[string]Input{"video": video, "audio": audio}}
 	fsconfig := wazero.NewFSConfig().(sysfs.FSConfig).WithSysFSMount(files, "/inputs")
 	logs := &tailLog{}
-	rc, err := wasm.Run(ctx, shared.runtime, shared.module, wasm.Args{
+	runCtx, freeMemory := withLinearMemory(ctx)
+	defer freeMemory()
+	rc, err := wasm.Run(runCtx, shared.runtime, shared.module, wasm.Args{
 		Name: "ffmpeg", Args: args, Stdout: out, Stderr: logs,
 		Config: func(c wazero.ModuleConfig) wazero.ModuleConfig { return c.WithFSConfig(fsconfig) },
 	})

pkg/download/model.go

@@ -75,20 +75,23 @@ type Task struct {
 	producer         production.Source
 	producerReceived int64
 
-	fetcherManager fetcher.FetcherManager
-	fetcher        fetcher.Fetcher
-	timer          *util.Timer
-	statusLock     *sync.Mutex
-	lock           *sync.Mutex
-	statsLock      *sync.Mutex
-	statsLoaded    bool
-	stats          *fetcher.Stats
-	statsSnapshot  json.RawMessage
-	blobRefLock    *sync.Mutex
-	blobURL        string
-	runGeneration  uint64
-	speedArr       []int64
-	uploadSpeedArr []int64
+	fetcherManager    fetcher.FetcherManager
+	fetcher           fetcher.Fetcher
+	timer             *util.Timer
+	statusLock        *sync.Mutex
+	lock              *sync.Mutex
+	statsLock         *sync.Mutex
+	statsLoaded       bool
+	stats             *fetcher.Stats
+	statsSnapshot     json.RawMessage
+	blobRefLock       *sync.Mutex
+	blobURL           string
+	runGeneration     uint64
+	speedArr          []speedSample
+	uploadSpeedArr    []speedSample
+	downloadSampledAt time.Time
+	uploadSampledAt   time.Time
+	receivedBytes     int64
 }
 
 // TaskRuntimeStatus is the lightweight, frequently refreshed view of a task.
@@ -195,7 +198,21 @@ func (t *Task) updateUploadSpeed(downloaded int64, usedTime float64) int64 {
 	return calcSpeed(&t.uploadSpeedArr, downloaded, usedTime)
 }
 
-func calcSpeed(speedArr *[]int64, downloaded int64, usedTime float64) int64 {
+type speedSample struct {
+	bytes   int64
+	seconds float64
+}
+
+func sampleSeconds(lastSample *time.Time, now time.Time) float64 {
+	previous := *lastSample
+	*lastSample = now
+	if previous.IsZero() {
+		return 0
+	}
+	return now.Sub(previous).Seconds()
+}
+
+func calcSpeed(speedArr *[]speedSample, downloaded int64, usedTime float64) int64 {
 	if usedTime <= 0 {
 		return 0
 	}
@@ -204,18 +221,18 @@ func calcSpeed(speedArr *[]int64, downloaded int64, usedTime float64) int64 {
 		return 0
 	}
 
-	*speedArr = append(*speedArr, downloaded)
-	// Record last 5 seconds of download speed to calculate the average speed
-	if len(*speedArr) > int(5.0/usedTime) {
-		*speedArr = (*speedArr)[1:]
-	}
-
+	*speedArr = append(*speedArr, speedSample{bytes: downloaded, seconds: usedTime})
 	var total int64
-	for _, v := range *speedArr {
-		total += v
+	var elapsed float64
+	first := len(*speedArr)
+	for first > 0 && elapsed < 5 {
+		first--
+		sample := (*speedArr)[first]
+		total += sample.bytes
+		elapsed += sample.seconds
 	}
-
-	return int64(float64(total) / float64(len(*speedArr)) / usedTime)
+	*speedArr = (*speedArr)[first:]
+	return int64(float64(total) / elapsed)
 }
 
 type TaskFilter struct {

pkg/download/model_test.go

@@ -1,9 +1,32 @@
 package download
 
-import "testing"
+import (
+	"testing"
+	"time"
+)
+
+func TestTransferSpeedWithUnevenSamples(t *testing.T) {
+	var task Task
+	for _, sample := range []struct {
+		bytes   int64
+		seconds float64
+	}{
+		{1000, 1},
+		{2000, 2},
+		{4000, 4},
+		{6000, 6},
+	} {
+		if got := task.updateSpeed(sample.bytes, sample.seconds); got != 1000 {
+			t.Errorf("download speed after %v seconds = %d, want 1000", sample.seconds, got)
+		}
+		if got := task.updateUploadSpeed(sample.bytes, sample.seconds); got != 1000 {
+			t.Errorf("upload speed after %v seconds = %d, want 1000", sample.seconds, got)
+		}
+	}
+}
 
 func TestCalcSpeedResetOnRollback(t *testing.T) {
-	speedArr := []int64{1024, 2048, 4096}
+	speedArr := []speedSample{{1024, 1}, {2048, 1}, {4096, 1}}
 
 	if got := calcSpeed(&speedArr, -512, 1); got != 0 {
 		t.Fatalf("calcSpeed() = %d, want 0 after rollback", got)
@@ -16,3 +39,17 @@ func TestCalcSpeedResetOnRollback(t *testing.T) {
 		t.Fatalf("calcSpeed() = %d, want 1024 after reset", got)
 	}
 }
+
+func TestSampleSecondsUsesThePreviousSuccessfulSample(t *testing.T) {
+	start := time.Now()
+	var last time.Time
+	if got := sampleSeconds(&last, start); got != 0 {
+		t.Fatalf("first sample elapsed = %v, want 0", got)
+	}
+	if got := sampleSeconds(&last, start.Add(1500*time.Millisecond)); got != 1.5 {
+		t.Fatalf("elapsed after a delayed sample = %v, want 1.5", got)
+	}
+	if got := sampleSeconds(&last, start.Add(2*time.Second)); got != 0.5 {
+		t.Fatalf("elapsed after the next sample = %v, want 0.5", got)
+	}
+}

pkg/download/resolve_lifecycle_test.go

@@ -1,224 +0,0 @@
-package download
-
-import (
-	"errors"
-	"fmt"
-	"github.com/GopeedLab/gopeed/internal/fetcher"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"github.com/GopeedLab/gopeed/pkg/base"
-)
-
-func TestReleaseResolveCancelsPendingHTTPHeaders(t *testing.T) {
-	entered := make(chan struct{})
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { close(entered); <-r.Context().Done() }))
-	defer server.Close()
-	d := NewDownloader(&DownloaderConfig{Storage: NewMemStorage(), StorageDir: t.TempDir(), TempDir: t.TempDir()})
-	if err := d.Setup(); err != nil {
-		t.Fatal(err)
-	}
-	defer d.Close()
-	done := make(chan error, 1)
-	go func() {
-		_, err := d.ResolveWithID("pending-http", &base.Request{URL: server.URL + "/file"})
-		done <- err
-	}()
-	select {
-	case <-entered:
-	case <-time.After(time.Second):
-		t.Fatal("request did not start")
-	}
-	if err := d.ReleaseResolve("pending-http"); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case err := <-done:
-		if err == nil {
-			t.Fatal("cancelled Resolve succeeded")
-		}
-	case <-time.After(300 * time.Millisecond):
-		server.CloseClientConnections()
-		t.Fatal("ReleaseResolve did not cancel the request waiting for headers")
-	}
-	if len(d.fetcherCache) != 0 || len(d.resolveStates) != 0 {
-		t.Fatal("cancelled operation retained resources")
-	}
-}
-func TestReleaseResolveAfterCreateDoesNotCloseTask(t *testing.T) {
-	d := NewDownloader(&DownloaderConfig{Storage: NewMemStorage(), StorageDir: t.TempDir(), TempDir: t.TempDir(), FetchManagers: nil})
-	if err := d.Setup(); err != nil {
-		t.Fatal(err)
-	}
-	defer d.Close()
-	d.cfg.MaxRunning = 0
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok")) }))
-	defer server.Close()
-	rr, err := d.Resolve(&base.Request{URL: server.URL})
-	if err != nil {
-		t.Fatal(err)
-	}
-	id, err := d.CreateWithOptions(rr.ID, &base.Options{Path: t.TempDir()})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := d.ReleaseResolve(rr.ID); err != nil {
-		t.Fatal(err)
-	}
-	task := d.GetTask(id)
-	if task == nil {
-		t.Fatal("late release removed task")
-	}
-	if err := d.doStart(task); err != nil {
-		t.Fatal(err)
-	}
-	waitForTaskStatus(t, d, id, base.DownloadStatusDone, 3*time.Second)
-}
-func TestResolveRejectsClosedDownloader(t *testing.T) {
-	d := NewDownloader(&DownloaderConfig{StorageDir: t.TempDir(), TempDir: t.TempDir()})
-	if err := d.Setup(); err != nil {
-		t.Fatal(err)
-	}
-	d.Close()
-	if _, err := d.ResolveWithID("closed", &base.Request{URL: "http://127.0.0.1/"}); err == nil {
-		t.Fatalf("closed downloader accepted Resolve: %v", err)
-	}
-}
-
-func TestReleaseResolveCancelsPendingMagnetMetadata(t *testing.T) {
-	d := NewDownloader(&DownloaderConfig{Storage: NewMemStorage(), StorageDir: t.TempDir(), TempDir: t.TempDir()})
-	if err := d.Setup(); err != nil {
-		t.Fatal(err)
-	}
-	defer d.Close()
-	done := make(chan error, 1)
-	go func() {
-		_, err := d.ResolveWithID("pending-magnet", &base.Request{URL: "magnet:?xt=urn:btih:0123456789abcdef0123456789abcdef01234567"})
-		done <- err
-	}()
-	deadline := time.Now().Add(2 * time.Second)
-	for {
-		d.fetcherMapLock.Lock()
-		state := d.resolveStates["pending-magnet"]
-		ready := state != nil && state.fetcher != nil
-		d.fetcherMapLock.Unlock()
-		if ready {
-			break
-		}
-		if time.Now().After(deadline) {
-			t.Fatal("magnet resolve did not start")
-		}
-		time.Sleep(time.Millisecond)
-	}
-	if err := d.ReleaseResolve("pending-magnet"); err != nil {
-		t.Fatal(err)
-	}
-	select {
-	case err := <-done:
-		if err == nil {
-			t.Fatal("cancelled magnet Resolve succeeded")
-		}
-	case <-time.After(time.Second):
-		t.Fatal("cancelled magnet remained in metadata wait")
-	}
-	if len(d.fetcherCache) != 0 || len(d.resolveStates) != 0 {
-		t.Fatal("cancelled magnet retained its resource")
-	}
-}
-func TestCloseDrainsResolvedPreviewCache(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok")) }))
-	defer server.Close()
-	d := NewDownloader(&DownloaderConfig{Storage: NewMemStorage(), StorageDir: t.TempDir(), TempDir: t.TempDir()})
-	if err := d.Setup(); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := d.Resolve(&base.Request{URL: server.URL}); err != nil {
-		t.Fatal(err)
-	}
-	if err := d.Close(); err != nil {
-		t.Fatal(err)
-	}
-	if len(d.fetcherCache) != 0 || len(d.resolveStates) != 0 {
-		t.Fatal("shutdown retained preview resources")
-	}
-}
-
-type cancelledCreationFetcher struct {
-	fetcher.Fetcher
-	entered chan struct{}
-	release chan struct{}
-	err     error
-}
-
-func (f *cancelledCreationFetcher) Patch(*base.Request, *base.Options) error {
-	close(f.entered)
-	<-f.release
-	return f.err
-}
-func TestReleaseResolveDuringCreationTransfersOrClosesOwnership(t *testing.T) {
-	for _, fail := range []bool{false, true} {
-		t.Run(fmt.Sprintf("fail=%v", fail), func(t *testing.T) {
-			d := NewDownloader(&DownloaderConfig{StorageDir: t.TempDir(), TempDir: t.TempDir()})
-			if err := d.Setup(); err != nil {
-				t.Fatal(err)
-			}
-			defer d.Close()
-			d.cfg.MaxRunning = 0
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.Write([]byte("ok")) }))
-			defer server.Close()
-			rr, err := d.Resolve(&base.Request{URL: server.URL})
-			if err != nil {
-				t.Fatal(err)
-			}
-			f := &cancelledCreationFetcher{Fetcher: d.fetcherCache[rr.ID], entered: make(chan struct{}), release: make(chan struct{})}
-			if fail {
-				f.err = errors.New("creation failed")
-			}
-			d.fetcherMapLock.Lock()
-			d.fetcherCache[rr.ID] = f
-			d.fetcherMapLock.Unlock()
-			done := make(chan struct{})
-			var id string
-			var createErr error
-			go func() {
-				defer close(done)
-				id, createErr = d.CreateWithOptions(rr.ID, &base.Options{Path: t.TempDir(), Size: 2})
-			}()
-			select {
-			case <-f.entered:
-			case <-time.After(time.Second):
-				t.Fatal("creation did not claim resource")
-			}
-			if err := d.ReleaseResolve(rr.ID); err != nil {
-				t.Fatal(err)
-			}
-			close(f.release)
-			select {
-			case <-done:
-			case <-time.After(time.Second):
-				t.Fatal("creation did not return")
-			}
-			if len(d.fetcherCache) != 0 || len(d.resolveStates) != 0 {
-				t.Fatal("cancelled creation returned ownership to preview cache")
-			}
-			if fail {
-				if createErr == nil {
-					t.Fatal("expected creation failure")
-				}
-				return
-			}
-			if createErr != nil {
-				t.Fatal(createErr)
-			}
-			// The protocol manager persists its concrete Fetcher type.
-			task := d.GetTask(id)
-			task.fetcher = f.Fetcher
-			if err := d.doStart(task); err != nil {
-				t.Fatal(err)
-			}
-			waitForTaskStatus(t, d, id, base.DownloadStatusDone, 3*time.Second)
-		})
-	}
-}

pkg/rest/api.go

@@ -24,7 +24,7 @@ func Info(w http.ResponseWriter, r *http.Request) {
 func Resolve(w http.ResponseWriter, r *http.Request) {
 	var req model.ResolveTask
 	if ReadJson(r, w, &req) {
-		rr, err := Downloader.ResolveWithID(req.ID, req.Req)
+		rr, err := Downloader.Resolve(req.Req)
 		if err != nil {
 			WriteJson(w, model.NewErrorResult(err.Error()))
 			return

pkg/rest/model/task.go

@@ -3,7 +3,6 @@ package model
 import "github.com/GopeedLab/gopeed/pkg/base"
 
 type ResolveTask struct {
-	ID  string        `json:"id,omitempty"`
 	Req *base.Request `json:"req"`
 }
 

ui/flutter/lib/api/api.dart

@@ -81,9 +81,6 @@ Future<ResolveResult> resolve(ResolveTask resolveTask) {
   );
 }
 
-Future<void> releaseResolve(String id) =>
-    _parse<void>(() => _request('api/v1/resolve/${Uri.encodeComponent(id)}', method: 'DELETE'), null);
-
 Future<String> createTask(CreateTask createTask) {
   return _parse<String>(() => _request('api/v1/tasks', method: 'POST', data: createTask), (data) => data as String);
 }

ui/flutter/lib/api/model/resolve_task.dart

@@ -8,10 +8,7 @@ part 'resolve_task.g.dart';
 class ResolveTask {
   Request? req;
 
-  @JsonKey(includeIfNull: false)
-  String? id;
-
-  ResolveTask({this.req, this.id});
+  ResolveTask({this.req});
 
   factory ResolveTask.fromJson(Map<String, dynamic> json) => _$ResolveTaskFromJson(json);
   Map<String, dynamic> toJson() => _$ResolveTaskToJson(this);

ui/flutter/lib/api/model/resolve_task.g.dart

@@ -10,8 +10,7 @@ ResolveTask _$ResolveTaskFromJson(Map<String, dynamic> json) => ResolveTask(
   req: json['req'] == null
       ? null
       : Request.fromJson(json['req'] as Map<String, dynamic>),
-  id: json['id'] as String?,
 );
 
 Map<String, dynamic> _$ResolveTaskToJson(ResolveTask instance) =>
-    <String, dynamic>{'req': ?instance.req, 'id': ?instance.id};
+    <String, dynamic>{'req': ?instance.req};

ui/flutter/lib/app/application/app_runtime_controller.dart

@@ -53,6 +53,7 @@ class AppRuntimeState {
 class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
   static StartConfig? _defaultStartConfig;
   Future<void> _preferenceWrites = Future<void>.value();
+  bool _analyticsStarted = false;
 
   @override
   Future<AppRuntimeState> build() async {
@@ -73,6 +74,7 @@ class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
       startConfig
         ..apiEnable = true
         ..mcpEnable = config.api.mcpEnable;
+      await _initAnalytics(config);
     } else {
       startConfig
         ..apiEnable = config.api.enable
@@ -253,7 +255,8 @@ class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
   }
 
   Future<void> _initAnalytics(DownloaderConfig config) async {
-    if (!AnalyticsConfig.isConfigured || !config.extra.analyticsEnabled) return;
+    if (_analyticsStarted || !AnalyticsConfig.isConfigured || !config.extra.analyticsEnabled) return;
+    _analyticsStarted = true;
     try {
       final generatedClientId = await Analytics.instance.init(fallbackClientId: config.extra.deviceId);
       if (generatedClientId != null) {
@@ -262,6 +265,7 @@ class AppRuntimeController extends AsyncNotifier<AppRuntimeState> {
       }
       unawaited(Analytics.instance.logAppOpen());
     } catch (error, stackTrace) {
+      _analyticsStarted = false;
       logger.w('GA4 init failed', error, stackTrace);
     }
   }

ui/flutter/lib/app/application/downloader_config_init.dart

@@ -19,7 +19,7 @@ Future<DownloaderConfig> loadDownloaderConfig({
     config = await load();
   } catch (error, stackTrace) {
     onLoadError?.call(error, stackTrace);
-    config = DownloaderConfig();
+    config = DownloaderConfig()..extra.analyticsEnabled = false;
     loaded = false;
   }
   final changed = await initDownloaderConfig(config, defaultDownloadDir: defaultDownloadDir);

ui/flutter/lib/core/capabilities/app_capabilities.dart

@@ -93,10 +93,6 @@ void _bindGopeed(CapabilityRegistry registry, _ConfigStore configStore) {
       (p) => api.getMirrorCandidates(p['provider'] as String, p['url'] as String),
     )
     ..bind(GopeedMethods.resolve, api.resolve)
-    ..bind(GopeedMethods.releaseResolve, (id) async {
-      await api.releaseResolve(id);
-      return const RpcUnit();
-    })
     ..bind(GopeedMethods.createTask, api.createTask)
     ..bind(GopeedMethods.createTaskBatch, api.createTaskBatch)
     ..bind(GopeedMethods.patchTask, (params) async {

ui/flutter/lib/core/capabilities/gopeed_capability.dart

@@ -16,7 +16,6 @@ abstract final class GopeedMethods {
   static const triggerProtocolJob = RpcMethod<Map<String, dynamic>, RpcUnit>('gopeed.protocol.job.trigger');
   static const getMirrorCandidates = RpcMethod<Map<String, dynamic>, List<String>>('gopeed.mirrors.candidates');
   static const resolve = RpcMethod<ResolveTask, ResolveResult>('gopeed.resolve');
-  static const releaseResolve = RpcMethod<String, RpcUnit>('gopeed.releaseResolve');
   static const createTask = RpcMethod<CreateTask, String>('gopeed.task.create');
   static const createTaskBatch = RpcMethod<CreateTaskBatch, CreateTaskBatchResult>('gopeed.task.createBatch');
   static const patchTask = RpcMethod<Map<String, dynamic>, RpcUnit>('gopeed.task.patch');
@@ -51,7 +50,6 @@ class GopeedService {
   Future<List<String>> getMirrorCandidates(String provider, String url) =>
       _invoker.invoke(GopeedMethods.getMirrorCandidates, {'provider': provider, 'url': url});
   Future<ResolveResult> resolve(ResolveTask request) => _invoker.invoke(GopeedMethods.resolve, request);
-  Future<void> releaseResolve(String id) async => _invoker.invoke(GopeedMethods.releaseResolve, id);
 
   Future<String> createTask(CreateTask request) => _invoker.invoke(GopeedMethods.createTask, request);
 

ui/flutter/lib/features/tasks/application/pending_download.dart

@@ -1,5 +1,3 @@
-import 'dart:developer' as developer;
-import 'package:uuid/uuid.dart';
 import 'package:path/path.dart' as path;
 
 import '../../../api/model/create_task_batch.dart';
@@ -18,8 +16,6 @@ class PendingDownload {
   final Request request;
   final Options options;
   ResolveResult? result;
-  String? _resolveID;
-  bool _cancelled = false;
   String? resolveError;
   String? createError;
   final Set<int> selected = {};
@@ -54,16 +50,11 @@ class PendingDownload {
   bool get hasSelection => !created && result != null && selected.isNotEmpty;
 
   Future<void> resolve(GopeedService service) async {
-    if (_cancelled || result != null || resolving) return;
+    if (result != null || resolving) return;
     resolving = true;
     resolveError = null;
     try {
-      _resolveID = const Uuid().v4();
-      result = await service.resolve(ResolveTask(req: request, id: _resolveID));
-      if (_cancelled) {
-        await _release(service, result!.id);
-        return;
-      }
+      result = await service.resolve(ResolveTask(req: request));
       selected.addAll(List.generate(files.isEmpty ? 1 : files.length, (index) => index));
     } catch (error) {
       resolveError = error.toString();
@@ -72,23 +63,6 @@ class PendingDownload {
     }
   }
 
-  /// Stop an outstanding preview and release any resource it already owns.
-  /// A response arriving after cancellation is released by resolve() as well.
-  Future<void> cancel(GopeedService service) async {
-    if (_cancelled || created) return;
-    _cancelled = true;
-    await _release(service, result?.id.isNotEmpty == true ? result!.id : _resolveID);
-  }
-
-  Future<void> _release(GopeedService service, String? id) async {
-    if (id == null || id.isEmpty) return;
-    try {
-      await service.releaseResolve(id);
-    } catch (error, stack) {
-      developer.log('Failed to release resolved resource', name: 'gopeed.resolve', error: error, stackTrace: stack);
-    }
-  }
-
   List<CreateTaskBatchItem> creationItems() {
     final indexes = selected.toList()..sort();
     if (result!.id.isNotEmpty || files.isEmpty) {

ui/flutter/lib/features/tasks/presentation/widgets/resolve_download_dialog.dart

@@ -1,5 +1,3 @@
-import 'dart:async';
-
 import 'package:shadcn_flutter/shadcn_flutter.dart';
 import 'package:flutter/widgets.dart' as flutter show Flexible;
 
@@ -51,7 +49,6 @@ class _ResolveDownloadsDialogState extends State<_ResolveDownloadsDialog> {
   @override
   void dispose() {
     _cancelled = true;
-    _releasePreviews();
     super.dispose();
   }
 
@@ -67,15 +64,8 @@ class _ResolveDownloadsDialogState extends State<_ResolveDownloadsDialog> {
     }
   }
 
-  void _releasePreviews() {
-    for (final source in widget.sources) {
-      unawaited(source.cancel(widget.service));
-    }
-  }
-
   void _cancel() {
     _cancelled = true;
-    _releasePreviews();
     closeOverlay(context, false);
   }
 

ui/flutter/test/app/application/downloader_config_init_test.dart

@@ -32,8 +32,22 @@ void main() {
       // The in-memory fallback still gets usable defaults.
       expect(config.downloadDir, '/downloads');
       expect(config.categories, hasLength(4));
+      expect(config.extra.analyticsEnabled, isFalse);
     });
 
+    for (final analyticsEnabled in [false, true]) {
+      test('preserves the saved analytics preference ($analyticsEnabled)', () async {
+        final stored = configWith()..extra.analyticsEnabled = analyticsEnabled;
+        final config = await loadDownloaderConfig(
+          load: () async => stored,
+          save: (_) async {},
+          defaultDownloadDir: () async => '/downloads',
+        );
+
+        expect(config.extra.analyticsEnabled, analyticsEnabled);
+      });
+    }
+
     test('skips persist when init changed nothing', () async {
       var saved = 0;
       await loadDownloaderConfig(

ui/flutter/test/features/tasks/presentation/resolve_download_dialog_test.dart

@@ -64,81 +64,6 @@ Future<void> open(
 }
 
 void main() {
-  testWidgets('cancel releases a ready preview resource', (tester) async {
-    final released = <String>[];
-    final registry = CapabilityRegistry(createAppCapabilityCodecs())
-      ..bind(GopeedMethods.resolve, (_) => resolved('ready-rid'))
-      ..bind(const RpcMethod<String, RpcUnit>('gopeed.releaseResolve'), (id) {
-        released.add(id);
-        return const RpcUnit();
-      });
-    await open(tester, [pending('torrent')], registry);
-    await tester.pumpAndSettle();
-    await tester.tap(find.byKey(const ValueKey('resolve-cancel-button')));
-    await tester.pumpAndSettle();
-    expect(released, contains('ready-rid'));
-  });
-
-  testWidgets('cancel releases a late preview result', (tester) async {
-    final response = Completer<ResolveResult>();
-    final released = <String>[];
-    final registry = CapabilityRegistry(createAppCapabilityCodecs())
-      ..bind(GopeedMethods.resolve, (_) => response.future)
-      ..bind(const RpcMethod<String, RpcUnit>('gopeed.releaseResolve'), (id) {
-        released.add(id);
-        return const RpcUnit();
-      });
-    await open(tester, [pending('torrent')], registry);
-    await tester.tap(find.byKey(const ValueKey('resolve-close-button')));
-    await tester.pumpAndSettle();
-    response.complete(resolved('late-rid'));
-    await tester.pumpAndSettle();
-    expect(released, contains('late-rid'));
-  });
-
-  testWidgets('cancel sends the request ID before a preview completes', (tester) async {
-    final response = Completer<ResolveResult>();
-    final released = <String>[];
-    String? requestedID;
-    final registry = CapabilityRegistry(createAppCapabilityCodecs())
-      ..bind(GopeedMethods.resolve, (request) {
-        requestedID = request.id;
-        return response.future;
-      })
-      ..bind(GopeedMethods.releaseResolve, (id) {
-        released.add(id);
-        return const RpcUnit();
-      });
-    await open(tester, [pending('torrent')], registry);
-    await tester.tap(find.byKey(const ValueKey('resolve-close-button')));
-    await tester.pumpAndSettle();
-    expect(requestedID, isNotEmpty);
-    expect(released, contains(requestedID));
-    response.complete(
-      ResolveResult(
-        id: requestedID!,
-        res: Resource(files: [FileInfo(name: 'late.txt')]),
-      ),
-    );
-    await tester.pumpAndSettle();
-    expect(released.where((id) => id == requestedID), hasLength(2));
-  });
-
-  testWidgets('successful creation keeps task-owned resources', (tester) async {
-    final released = <String>[];
-    final registry = CapabilityRegistry(createAppCapabilityCodecs())
-      ..bind(GopeedMethods.resolve, (_) => resolved('task-owned'))
-      ..bind(GopeedMethods.createTaskBatch, (_) => CreateTaskBatchResult(taskIds: ['task']))
-      ..bind(GopeedMethods.releaseResolve, (id) {
-        released.add(id);
-        return const RpcUnit();
-      });
-    await open(tester, [pending('torrent')], registry);
-    await tester.pumpAndSettle();
-    await tester.tap(find.byKey(const ValueKey('resolve-create-button')));
-    await tester.pumpAndSettle();
-    expect(released, isEmpty);
-  });
   for (final width in [390.0, 700.0, 1024.0]) {
     testWidgets('file list fits and exposes ready selections at width $width', (tester) async {
       final registry = CapabilityRegistry(createAppCapabilityCodecs())

ui/flutter/windows/runner/CMakeLists.txt

@@ -7,6 +7,7 @@ project(runner LANGUAGES CXX)
 #
 # Any new source files that you add to the application should be added here.
 add_executable(${BINARY_NAME} WIN32
+  "crash_handler.cpp"
   "flutter_window.cpp"
   "main.cpp"
   "utils.cpp"
@@ -34,6 +35,7 @@ target_compile_definitions(${BINARY_NAME} PRIVATE "NOMINMAX")
 # dependencies here.
 target_link_libraries(${BINARY_NAME} PRIVATE flutter flutter_wrapper_app)
 target_link_libraries(${BINARY_NAME} PRIVATE "dwmapi.lib")
+target_link_libraries(${BINARY_NAME} PRIVATE "dbghelp.lib")
 target_include_directories(${BINARY_NAME} PRIVATE "${CMAKE_SOURCE_DIR}")
 
 # Run the Flutter tool portions of the build. This must not be removed.

ui/flutter/windows/runner/CRASH_DIAGNOSTICS.md

@@ -0,0 +1,31 @@
+# Windows native crash diagnostics
+
+The runner installs diagnostics before starting Flutter and plugins. Files are
+written beside the executable under `storage/logs`, matching Windows app storage:
+
+- `native-crash.log`: UTC timestamp, app version, process/thread, exception code,
+  faulting module/address/offset, and minidump success or the Windows error code.
+- `native-crash.dmp`: the most recent native crash, including thread stacks,
+  loaded modules and unloaded module information.
+- `crash.log`: Go runtime crash output, kept separately from native diagnostics.
+
+Logs are appended and existing dumps survive normal restarts. A subsequent native
+crash replaces the previous dump. Dump generation is best effort, particularly
+for stack exhaustion, heap corruption or unavailable disk space. Process kills
+and fail-fast termination can bypass exception handlers.
+
+The top-level unhandled filter covers native exceptions on process threads. An
+SEH boundary inside the runner's window callback records the original escaping exception
+before Windows wraps a window callback failure as `0xC000041D`. A vectored handler
+also observes that fatal callback status, since it can bypass the unhandled
+filter. All handlers continue exception processing; they do not attempt recovery
+or log ordinary handled first-chance exceptions.
+
+On Windows, verify a release build by exercising tray clicks, Explorer restart,
+system font changes and child-window open/close. In a disposable test build,
+raise an unhandled access violation inside a window callback and on a worker
+thread, then raise `0xC000041D`; check that the log and dump are written and
+survive relaunch. A debugger may intercept these before application handlers.
+Open the dump with WinDbg and matching runner/Flutter/plugin PDBs to locate the
+faulting stack. Minidumps can contain application data; inspect them before
+sharing.

ui/flutter/windows/runner/crash_handler.cpp

@@ -0,0 +1,119 @@
+#include "crash_handler.h"
+
+#include <dbghelp.h>
+#include <strsafe.h>
+
+#include <cstdint>
+#include <cstring>
+#include <filesystem>
+#include <string>
+#include <system_error>
+
+namespace {
+
+HANDLE crash_log = INVALID_HANDLE_VALUE;
+std::wstring dump_path;
+volatile LONG recording = 0;
+LPTOP_LEVEL_EXCEPTION_FILTER previous_filter = nullptr;
+
+void WriteLog(const char* text) {
+  if (crash_log == INVALID_HANDLE_VALUE) return;
+  DWORD written = 0;
+  WriteFile(crash_log, text, static_cast<DWORD>(strlen(text)), &written,
+            nullptr);
+  FlushFileBuffers(crash_log);
+}
+
+LONG WINAPI UnhandledException(EXCEPTION_POINTERS* exception) {
+  RecordNativeCrash(exception);
+  return previous_filter ? previous_filter(exception)
+                         : EXCEPTION_CONTINUE_SEARCH;
+}
+
+LONG CALLBACK FatalCallbackException(EXCEPTION_POINTERS* exception) {
+  // Windows can terminate on this callback exception without invoking the
+  // process's unhandled filter. Ignore ordinary first-chance exceptions (Go,
+  // Dart and plugins may handle those) and observe only this fatal status.
+  if (exception->ExceptionRecord->ExceptionCode == 0xC000041D) {
+    RecordNativeCrash(exception);
+  }
+  return EXCEPTION_CONTINUE_SEARCH;
+}
+
+}  // namespace
+
+LONG RecordNativeCrash(EXCEPTION_POINTERS* exception) {
+  if (!exception || InterlockedCompareExchange(&recording, 1, 0) != 0) {
+    return EXCEPTION_CONTINUE_SEARCH;
+  }
+
+  SYSTEMTIME time;
+  GetSystemTime(&time);
+  const auto* record = exception->ExceptionRecord;
+  HMODULE module = nullptr;
+  wchar_t module_path[MAX_PATH] = L"unknown";
+  GetModuleHandleExW(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS |
+                        GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT,
+                    reinterpret_cast<LPCWSTR>(record->ExceptionAddress),
+                    &module);
+  if (module) GetModuleFileNameW(module, module_path, MAX_PATH);
+
+  char line[2048] = {};
+  StringCchPrintfA(
+      line, ARRAYSIZE(line),
+      "\r\n%04u-%02u-%02uT%02u:%02u:%02uZ Gopeed %s pid=%lu tid=%lu "
+      "exception=0x%08lX address=%p module=%ls offset=0x%llX\r\n",
+      time.wYear, time.wMonth, time.wDay, time.wHour, time.wMinute,
+      time.wSecond, FLUTTER_VERSION, GetCurrentProcessId(), GetCurrentThreadId(),
+      record->ExceptionCode, record->ExceptionAddress, module_path,
+      static_cast<unsigned long long>(
+          reinterpret_cast<uintptr_t>(record->ExceptionAddress) -
+          reinterpret_cast<uintptr_t>(module)));
+  WriteLog(line);
+
+  HANDLE dump = CreateFileW(dump_path.c_str(), GENERIC_WRITE, 0, nullptr,
+                            CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr);
+  if (dump != INVALID_HANDLE_VALUE) {
+    MINIDUMP_EXCEPTION_INFORMATION info = {};
+    info.ThreadId = GetCurrentThreadId();
+    info.ExceptionPointers = exception;
+    info.ClientPointers = FALSE;
+    const BOOL ok = MiniDumpWriteDump(
+        GetCurrentProcess(), GetCurrentProcessId(), dump,
+        static_cast<MINIDUMP_TYPE>(MiniDumpNormal | MiniDumpWithThreadInfo |
+                                   MiniDumpWithUnloadedModules),
+        &info, nullptr, nullptr);
+    const DWORD error = ok ? ERROR_SUCCESS : GetLastError();
+    FlushFileBuffers(dump);
+    CloseHandle(dump);
+    StringCchPrintfA(line, ARRAYSIZE(line), "minidump success=%d error=%lu\r\n",
+                     ok, error);
+    WriteLog(line);
+  } else {
+    StringCchPrintfA(line, ARRAYSIZE(line), "minidump open error=%lu\r\n",
+                     GetLastError());
+    WriteLog(line);
+  }
+
+  // Do not swallow an exception or resume a potentially corrupted process.
+  return EXCEPTION_CONTINUE_SEARCH;
+}
+
+void InstallCrashHandler() {
+  // Match Dart's Windows storage path independently of the working directory.
+  wchar_t executable[32768] = {};
+  const DWORD length = GetModuleFileNameW(nullptr, executable, ARRAYSIZE(executable));
+  if (length == 0 || length >= ARRAYSIZE(executable)) return;
+  const auto directory = std::filesystem::path(executable).parent_path() /
+                         L"storage" / L"logs";
+  std::error_code error;
+  std::filesystem::create_directories(directory, error);
+  if (error) return;
+
+  dump_path = (directory / L"native-crash.dmp").wstring();
+  crash_log = CreateFileW((directory / L"native-crash.log").c_str(),
+                         FILE_APPEND_DATA, FILE_SHARE_READ, nullptr, OPEN_ALWAYS,
+                         FILE_ATTRIBUTE_NORMAL, nullptr);
+  previous_filter = SetUnhandledExceptionFilter(UnhandledException);
+  AddVectoredExceptionHandler(1, FatalCallbackException);
+}

ui/flutter/windows/runner/crash_handler.h

@@ -0,0 +1,12 @@
+#ifndef RUNNER_CRASH_HANDLER_H_
+#define RUNNER_CRASH_HANDLER_H_
+
+#include <windows.h>
+
+// Installs best-effort native diagnostics before Flutter or plugins start.
+void InstallCrashHandler();
+
+// Records the exception and continues normal Windows exception processing.
+LONG RecordNativeCrash(EXCEPTION_POINTERS* exception);
+
+#endif  // RUNNER_CRASH_HANDLER_H_

ui/flutter/windows/runner/flutter_window.cpp

@@ -63,7 +63,9 @@ FlutterWindow::MessageHandler(HWND hwnd, UINT const message,
 
   switch (message) {
     case WM_FONTCHANGE:
-      flutter_controller_->engine()->ReloadSystemFonts();
+      if (flutter_controller_ && flutter_controller_->engine()) {
+        flutter_controller_->engine()->ReloadSystemFonts();
+      }
       break;
   }
 

ui/flutter/windows/runner/main.cpp

@@ -5,6 +5,7 @@
 #include <desktop_multi_window/desktop_multi_window_plugin.h>
 
 #include "app_links/app_links_plugin_c_api.h"
+#include "crash_handler.h"
 #include "flutter_window.h"
 #include "flutter/generated_plugin_registrant.h"
 #include "utils.h"
@@ -43,6 +44,7 @@ bool IsMultiWindowLaunch(const std::vector<std::string>& arguments) {
 
 int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
                       _In_ wchar_t *command_line, _In_ int show_command) {
+  InstallCrashHandler();
   // Attach to console when present (e.g., 'flutter run') or create a
   // new console when running with a debugger.
   if (!::AttachConsole(ATTACH_PARENT_PROCESS) && ::IsDebuggerPresent()) {
@@ -77,11 +79,12 @@ int APIENTRY wWinMain(_In_ HINSTANCE instance, _In_opt_ HINSTANCE prev,
   window.SetQuitOnClose(true);
 
   ::MSG msg;
-  while (::GetMessage(&msg, nullptr, 0, 0)) {
+  BOOL message_result;
+  while ((message_result = ::GetMessage(&msg, nullptr, 0, 0)) > 0) {
     ::TranslateMessage(&msg);
     ::DispatchMessage(&msg);
   }
 
   ::CoUninitialize();
-  return EXIT_SUCCESS;
+  return message_result == -1 ? EXIT_FAILURE : static_cast<int>(msg.wParam);
 }

ui/flutter/windows/runner/win32_window.cpp

@@ -3,6 +3,7 @@
 #include <dwmapi.h>
 #include <flutter_windows.h>
 
+#include "crash_handler.h"
 #include "resource.h"
 
 namespace {
@@ -158,19 +159,26 @@ LRESULT CALLBACK Win32Window::WndProc(HWND const window,
                                       UINT const message,
                                       WPARAM const wparam,
                                       LPARAM const lparam) noexcept {
-  if (message == WM_NCCREATE) {
-    auto window_struct = reinterpret_cast<CREATESTRUCT*>(lparam);
-    SetWindowLongPtr(window, GWLP_USERDATA,
-                     reinterpret_cast<LONG_PTR>(window_struct->lpCreateParams));
+  // Capture inside the callback, before user32 wraps or suppresses an escaping
+  // exception. Keep C++ objects requiring unwinding out of this SEH boundary.
+  __try {
+    if (message == WM_NCCREATE) {
+      auto window_struct = reinterpret_cast<CREATESTRUCT*>(lparam);
+      SetWindowLongPtr(window, GWLP_USERDATA,
+                       reinterpret_cast<LONG_PTR>(window_struct->lpCreateParams));
 
-    auto that = static_cast<Win32Window*>(window_struct->lpCreateParams);
-    EnableFullDpiSupportIfAvailable(window);
-    that->window_handle_ = window;
-  } else if (Win32Window* that = GetThisFromHandle(window)) {
-    return that->MessageHandler(window, message, wparam, lparam);
+      auto that = static_cast<Win32Window*>(window_struct->lpCreateParams);
+      EnableFullDpiSupportIfAvailable(window);
+      that->window_handle_ = window;
+    } else if (Win32Window* that = GetThisFromHandle(window)) {
+      return that->MessageHandler(window, message, wparam, lparam);
+    }
+
+    return DefWindowProc(window, message, wparam, lparam);
+  } __except (RecordNativeCrash(GetExceptionInformation())) {
+    // The filter always continues the exception search; this is unreachable.
+    return 0;
   }
-
-  return DefWindowProc(window, message, wparam, lparam);
 }
 
 LRESULT