@torrent-tv/proxy 2.36.1 → 2.37.0

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## 2.37.0
+
+- **Fix**: The segment the viewer seeks TO is no longer refused as stale. A seek bumps the wait epoch so requests made for the position being LEFT stop being held, and the epoch alone cannot tell those apart from the request for the position just arrived at — hls.js asks for it within milliseconds of the seek, and it raced the bump. Measured 2026-08-18: a seek to 1061.0 s, `segment-00101` answered 503 twice within 80 ms, the player never asked for it again, and instead re-fetched `a/0/segment-00103` and `a/0/segment-00104` **737 and 736 times over 149 seconds** — about half a gigabyte of the same two segments — while the picture stood at `t=1061.0s readyState=1` until the session ended. A held request is now released only when its segment lies behind where the viewer now is, or so far ahead that the running encode will not reach it; anything between is what the viewer is waiting for and is held.
+- **New**: The log survives the container. `--log-file <path>` writes every line to a file as well as the console, appending across restarts and rotating at 32 MB with one previous turn kept. The console is the container's stdout, and the container is exactly what does not survive a crash: thirteen SIGSEGVs on 2026-08-18 each had the watchdog recreate it, taking every line before the crash away, and a deploy of ours destroyed the evidence for two field reports the same day. Opt-in and named by the caller, so nothing here assumes Home Assistant — the addon points it at `/data`.
+- **New**: A refusal says what it refused. `[hold] <segment> refused: the viewer is at <position>s and this is not the segment there`, and a request kept across a seek says so too. The old line said only "superseded", which is why the freeze above took a day to explain.
+
+## 2.36.2
+
+- **Fix**: A live session no longer answers 404 to the master playlist it has just published. The browser is handed `master.m3u8` when the session is created, and which rungs are worth OFFERING is recomputed every five seconds — so on 2026-08-18 a five-rung offer became a one-rung offer **192 ms** after creation (the session's own encoder started, charging the contention penalty of 2.35.0, and the first supply reading raised the bar of 2.36.0 from 1.00x to 1.06x), `buildMasterPlaylist` returned null for having fewer than two rungs, and the master answered 404. hls.js treats that as fatal and unrecoverable, so nothing played at all. The master now lists what CAN be spliced onto this session's cut grid — a fact about the source, settled once — while the live judgement stays where it belongs, in `offeredHeights` and in every progress report, which is what the viewer's menu already follows. The variant routes honour the published set too, so a quality switch can no longer meet a 404 on a rung the master named.
+- **Fix**: Peer discovery no longer starves behind name resolution. Node resolves host names on the libuv thread pool, which holds four threads by default; a torrent announces to every tracker in its file at once, so four names resolve and the rest queue — and a tracker that no longer exists holds its thread for the resolver's full ten-second timeout while every announce behind it blows its own fifteen-second deadline. Measured inside the addon container: the ten trackers of one film took **7.58 s** to resolve as a burst and **27-42 ms** each with a larger pool. That film has 517 seeders on a tracker that answers in 50 ms, and it spent eleven minutes with **zero peers** while four other torrents in the same process were fine — they were the ones whose live trackers happened to fall in the first four. The pool is now stated before anything can create it (`services/thread-pool.js`, imported first by the entry point), and a deployment that states its own size is left alone.
+
 ## 2.36.1
 
 - **Fix**: The cut list of a copied picture is built from the picture's own keyframes, and no longer from every entry in the container's table. A Matroska CuePoint belongs to the track named inside it, and RFC 9559 leaves the muxer free to index whichever tracks it likes — both field files index their subtitles as well. Measured over the swarm on 2026-08-18, reading only the head and the table: `Minions.and.Monsters.1080p.mkv` has **2778 video entries, one every 2.002 s, and 4669 more across four subtitle tracks**; `Moana.2.2024.720p.BluRay … MegaPeer.mkv` has **1055 video entries and 5007 across five**. Read without the track, the extra times entered the cut list as though they were keyframes; ffmpeg can only cut a copied picture at a real keyframe at or after the time it is given, so each such cut landed at the next one instead — which is exactly the disagreement the field measured, and why it was always positive: 2.002 s on the first file (its own keyframe spacing), a median of 6.3 s and a worst case of 21 s on the second. The reader now takes the first video track's number from Tracks — already inside the head it fetches, with one short extra read only for a file that keeps Tracks elsewhere — and keeps the entries of that track. Nothing else about the two-read approach changes, and a session costs nothing more. With the fix the same two files read 2778 and 1055 times, all of them keyframes. When the filter leaves NOTHING — a table whose entries name a track number Tracks never declares — the unfiltered table is used rather than no table: that case is this reader failing to recognise the file, and answering with nothing would put an even grid on a copied picture, which is the failure it exists to prevent.

package/bin/cli.js

@@ -8,6 +8,11 @@
  * automatically on reconnect so the server's in-memory store stays consistent.
  */
 
+// FIRST, and it must stay first: it sets how many blocking calls this process
+// can have in flight, and a module's imports are evaluated before its body, so
+// anything imported above it would get the default pool. See the file itself
+// for the measurement that made it necessary.
+import "../services/thread-pool.js";
 import { Command } from "commander";
 import crypto from "node:crypto";
 import { spawnSync } from "node:child_process";
@@ -22,7 +27,7 @@ import { collectHealthMetrics } from "../services/health-collector.js";
 import { createPortMapper } from "../services/port-mapper.js";
 import { classifyNat } from "../services/nat-classifier.js";
 import { DEFAULT_SEGMENT_FORMAT_ID, SEGMENT_FORMAT_IDS } from "../services/segment-formats/index.js";
-import { logger } from "../utils/logger.js";
+import { logToFile, logger } from "../utils/logger.js";
 
 const require = createRequire(import.meta.url);
 const { version: PROXY_VERSION } = require("../package.json");
@@ -80,6 +85,10 @@ program
     "--state-dir <path>",
     "Where to keep what this host has measured about itself (default: beside the installed proxy)"
   )
+  .option(
+    "--log-file <path>",
+    "Also write the log to this file, so a crash or an update does not take it with them"
+  )
   .option(
     "--segment-format <format>",
     `HLS output container: ${SEGMENT_FORMAT_IDS.join(" | ")}`,
@@ -267,6 +276,7 @@ async function shutdown(signal) {
 }
 
 try {
+  logToFile(options.logFile);
   if (transcodeAudio) {
     assertFfmpegAvailability();
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.36.1",
+  "version": "2.37.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/routes/transcode/session-file/get.js

@@ -1,180 +1,201 @@
-import { logger } from "../../../utils/logger.js";
-
-/**
- * How long a request for a not-yet-produced file is held before answering with
- * a retryable 503.
- *
- * MEASUREMENT MODE (2026-08-02): deliberately far above any plausible player
- * deadline, so OUR limit never fires first. Whatever ends the wait is then the
- * player's own behaviour — which is exactly what we need to observe. The
- * `[hold]` log line at the call site records, per request, whether the segment
- * arrived, whether we gave up, or whether the CLIENT aborted, and after how
- * long.
- *
- * The previous value (2 s) was chosen to dodge a reported iOS AVPlayer ~3.5 s
- * response-header deadline. That deadline never appears in our own logs (no
- * -12889 across six hours of production logs), and every reference project
- * holds rather than refusing: Jellyfin and hls-vod-too hold unbounded,
- * hls-media-server holds 10 s. The early refusal is what made the player probe
- * scattered positions, which then steered the encoder off target. Choose the
- * final value from what this measurement shows, not from a number read
- * elsewhere.
- */
-const SEGMENT_WAIT_MS = 60_000;
-
-/**
- * Serve HLS playlist and segment files from an active transcode session.
- *
- * Briefly waits for the requested file to appear, then answers with a
- * retryable 503 rather than holding the connection, so clients — in
- * particular iOS's native HLS player — never hit their own response
- * deadline while a segment is still being produced.
- *
- * GET /transcode/:sessionId/:fileName
- *
- * @param {import("fastify").FastifyRequest} req
- * @param {import("fastify").FastifyReply} reply
- * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager }} deps
- * @returns {Promise<void>}
- */
-export async function handleTranscodeSessionFileGet(req, reply, { hlsSessionManager }) {
-  const sessionId = typeof req.params.sessionId === "string" ? req.params.sessionId : "";
-  const fileName = typeof req.params.fileName === "string" ? req.params.fileName : "";
-  return serveSessionFile(req, reply, { hlsSessionManager, sessionId, fileName });
-}
-
-/**
- * Serve one playlist or segment from a named session.
- *
- * Split from the route above because the variant route
- * (`/transcode/:sessionId/v/:height/:fileName`) serves the same files from
- * another session of the same family, and must hold, log and answer them
- * identically — a switch of quality must not go through a different code path
- * from the stream it switches away from.
- *
- * @param {import("fastify").FastifyRequest} req
- * @param {import("fastify").FastifyReply} reply
- * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager, sessionId: string, fileName: string }} params
- * @returns {Promise<void>}
- */
-export async function serveSessionFile(req, reply, { hlsSessionManager, sessionId, fileName }) {
-  // Hold the request only briefly, then answer "retry" instead of waiting for
-  // the segment. iOS's native HLS player (AVPlayer) enforces a hard ~3.5 s
-  // deadline on RESPONSE HEADERS and raises -12889 ("No response for media
-  // file") when it passes — it then cancels in-flight requests, probes
-  // neighbouring positions and can restart the stream from the beginning. That
-  // is exactly the post-seek "player thrashing" seen in the field, because a
-  // seek restarts ffmpeg and the first segment then takes far longer than 3.5 s
-  // to appear. Holding the connection for 30 s (as this did) guaranteed the
-  // timeout on every seek. A short hold keeps the fast path intact (a ready or
-  // nearly-ready segment is still served on the first request) while a slow one
-  // gets a prompt retryable answer, which resets the player's own deadline.
-  // hls.js is unaffected: it consumes the 503 through its retry policy, whose
-  // budget the client widens to match (see hls-player.js fragLoadPolicy).
-  // Instrumented wait. `clientAborted` flips when the player drops the
-  // connection while we are still holding it — the single most informative
-  // signal about its real patience, and observable only from this side.
-  const holdStartedAt = Date.now();
-  let clientAborted = false;
-  const onClientAbort = () => { clientAborted = true; };
-  req.raw.on("close", onClientAbort);
-
-  const result = await waitForSessionFile(hlsSessionManager, sessionId, fileName, SEGMENT_WAIT_MS);
-
-  req.raw.off("close", onClientAbort);
-  const heldMs = Date.now() - holdStartedAt;
-  if (result.isPlaylist !== true) {
-    const outcome = clientAborted
-      ? "client-aborted"
-      : result.kind === "ok" ? "served" : result.kind;
-    logger.info(`[hold] ${fileName} ${outcome} after ${heldMs}ms`);
-  }
-
-  if (result.kind === "not-found") {
-    return reply.code(404).send({ error: "Transcode session file was not found." });
-  }
-  if (result.kind === "superseded") {
-    // The viewer moved while this was being held. Answer at once so the player
-    // can ask for where it is now; `Retry-After: 0` because there is nothing to
-    // wait for — this segment is simply no longer the one being watched.
-    reply.header("Retry-After", "0");
-    return reply.code(503).send({ error: "Superseded by a seek." });
-  }
-  if (result.kind === "warming-up") {
-    // The segment is still being produced (e.g. just after a seek-restart).
-    // Return a retryable 503 — never 202, which hls.js cannot consume as a
-    // media segment — so the player retries the fetch shortly.
-    reply.header("Retry-After", "1");
-    // `Retry-After` tells the player to re-request THIS segment after a short
-    // pause. Without it a bare 503 reads as "nothing here", and the player goes
-    // looking elsewhere: because our synthetic VOD playlist lists every segment
-    // of the file, it believes they all exist and SCANS them (field log: one
-    // user seek produced probes at #617, #717, #732…). That scan is what used
-    // to steer the encoder off the real target. Whether iOS's native player
-    // honours the hint is not guaranteed — its behaviour is closed — but this
-    // is the standard, correct way to say "wait, don't look elsewhere", and
-    // hls.js already retries the same fragment regardless.
-    reply.header("Retry-After", "1");
-    return reply.code(503).send({ error: "Transcode segment is still being produced." });
-  }
-  if (result.kind === "failed") {
-    return reply.code(500).send({ error: result.message });
-  }
-
-  if (result.isPlaylist) {
-    reply.header("Cache-Control", "no-store");
-  } else {
-    reply.header("Cache-Control", "public, max-age=60");
-  }
-  reply.header("Content-Type", result.contentType);
-  return reply.send(result.stream);
-}
-
-/**
- * Poll `hlsSessionManager.getFileStream()` until the file is available,
- * the session fails, or the timeout elapses.
- *
- * @param {import("../../../services/hls-session-manager.js").HlsSessionManager} hlsSessionManager
- * @param {string} sessionId
- * @param {string} fileName
- * @param {number} timeoutMs
- * @returns {Promise<Awaited<ReturnType<import("../../../services/hls-session-manager.js").HlsSessionManager["getFileStream"]>>>}
- */
-export async function waitForSessionFile(hlsSessionManager, sessionId, fileName, timeoutMs) {
-  const startedAt = Date.now();
-  // One sequence number for THIS request, reused by every poll below, so the
-  // session can tell a newly-arrived request apart from an old one polling
-  // again — see HlsSessionManager#ensureEncodingFor for the encoder ping-pong
-  // this prevents when one seek-bar scrub fires several segment requests.
-  const requestSeq = hlsSessionManager.nextRequestSeq(sessionId);
-  // The viewer's position when this request was made. A seek makes every held
-  // request stale — it asks for a segment nobody is going to watch — and hls.js
-  // keeps only ONE fragment load outstanding, so holding on blocks the request
-  // the player actually needs now. Measured: 57 s of a 58 s backward seek was
-  // this wait, and the segment the viewer wanted took 15 ms once it was asked
-  // for.
-  const seekEpoch = hlsSessionManager.seekEpoch(sessionId);
-  while (Date.now() - startedAt < timeoutMs) {
-    const result = await hlsSessionManager.getFileStream(sessionId, fileName, { requestSeq });
-    if (result.kind !== "warming-up") {
-      return result;
-    }
-    if (hlsSessionManager.seekEpoch(sessionId) !== seekEpoch) {
-      return { kind: "superseded" };
-    }
-    await delay(300);
-  }
-  return { kind: "warming-up" };
-}
-
-/**
- * Resolve after a given number of milliseconds.
- *
- * @param {number} ms
- * @returns {Promise<void>}
- */
-function delay(ms) {
-  return new Promise((resolve) => {
-    setTimeout(resolve, ms);
-  });
-}
+import { logger } from "../../../utils/logger.js";
+
+/**
+ * How long a request for a not-yet-produced file is held before answering with
+ * a retryable 503.
+ *
+ * MEASUREMENT MODE (2026-08-02): deliberately far above any plausible player
+ * deadline, so OUR limit never fires first. Whatever ends the wait is then the
+ * player's own behaviour — which is exactly what we need to observe. The
+ * `[hold]` log line at the call site records, per request, whether the segment
+ * arrived, whether we gave up, or whether the CLIENT aborted, and after how
+ * long.
+ *
+ * The previous value (2 s) was chosen to dodge a reported iOS AVPlayer ~3.5 s
+ * response-header deadline. That deadline never appears in our own logs (no
+ * -12889 across six hours of production logs), and every reference project
+ * holds rather than refusing: Jellyfin and hls-vod-too hold unbounded,
+ * hls-media-server holds 10 s. The early refusal is what made the player probe
+ * scattered positions, which then steered the encoder off target. Choose the
+ * final value from what this measurement shows, not from a number read
+ * elsewhere.
+ */
+const SEGMENT_WAIT_MS = 60_000;
+
+/**
+ * Serve HLS playlist and segment files from an active transcode session.
+ *
+ * Briefly waits for the requested file to appear, then answers with a
+ * retryable 503 rather than holding the connection, so clients — in
+ * particular iOS's native HLS player — never hit their own response
+ * deadline while a segment is still being produced.
+ *
+ * GET /transcode/:sessionId/:fileName
+ *
+ * @param {import("fastify").FastifyRequest} req
+ * @param {import("fastify").FastifyReply} reply
+ * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager }} deps
+ * @returns {Promise<void>}
+ */
+export async function handleTranscodeSessionFileGet(req, reply, { hlsSessionManager }) {
+  const sessionId = typeof req.params.sessionId === "string" ? req.params.sessionId : "";
+  const fileName = typeof req.params.fileName === "string" ? req.params.fileName : "";
+  return serveSessionFile(req, reply, { hlsSessionManager, sessionId, fileName });
+}
+
+/**
+ * Serve one playlist or segment from a named session.
+ *
+ * Split from the route above because the variant route
+ * (`/transcode/:sessionId/v/:height/:fileName`) serves the same files from
+ * another session of the same family, and must hold, log and answer them
+ * identically — a switch of quality must not go through a different code path
+ * from the stream it switches away from.
+ *
+ * @param {import("fastify").FastifyRequest} req
+ * @param {import("fastify").FastifyReply} reply
+ * @param {{ hlsSessionManager: import("../../../services/hls-session-manager.js").HlsSessionManager, sessionId: string, fileName: string }} params
+ * @returns {Promise<void>}
+ */
+export async function serveSessionFile(req, reply, { hlsSessionManager, sessionId, fileName }) {
+  // Hold the request only briefly, then answer "retry" instead of waiting for
+  // the segment. iOS's native HLS player (AVPlayer) enforces a hard ~3.5 s
+  // deadline on RESPONSE HEADERS and raises -12889 ("No response for media
+  // file") when it passes — it then cancels in-flight requests, probes
+  // neighbouring positions and can restart the stream from the beginning. That
+  // is exactly the post-seek "player thrashing" seen in the field, because a
+  // seek restarts ffmpeg and the first segment then takes far longer than 3.5 s
+  // to appear. Holding the connection for 30 s (as this did) guaranteed the
+  // timeout on every seek. A short hold keeps the fast path intact (a ready or
+  // nearly-ready segment is still served on the first request) while a slow one
+  // gets a prompt retryable answer, which resets the player's own deadline.
+  // hls.js is unaffected: it consumes the 503 through its retry policy, whose
+  // budget the client widens to match (see hls-player.js fragLoadPolicy).
+  // Instrumented wait. `clientAborted` flips when the player drops the
+  // connection while we are still holding it — the single most informative
+  // signal about its real patience, and observable only from this side.
+  const holdStartedAt = Date.now();
+  let clientAborted = false;
+  const onClientAbort = () => { clientAborted = true; };
+  req.raw.on("close", onClientAbort);
+
+  const result = await waitForSessionFile(hlsSessionManager, sessionId, fileName, SEGMENT_WAIT_MS);
+
+  req.raw.off("close", onClientAbort);
+  const heldMs = Date.now() - holdStartedAt;
+  if (result.isPlaylist !== true) {
+    const outcome = clientAborted
+      ? "client-aborted"
+      : result.kind === "ok" ? "served" : result.kind;
+    logger.info(`[hold] ${fileName} ${outcome} after ${heldMs}ms`);
+  }
+
+  if (result.kind === "not-found") {
+    return reply.code(404).send({ error: "Transcode session file was not found." });
+  }
+  if (result.kind === "superseded") {
+    // The viewer moved while this was being held, and this segment is not the
+    // one they moved TO — that case is kept and waited out, see
+    // `waitForSessionFile`. Answer at once so the player can ask for where it
+    // is now; `Retry-After: 0` because there is nothing to wait for.
+    //
+    // Named in the log, because a refusal that says only "superseded" is what
+    // made the 2026-08-18 freeze take a day to explain: the player was refused
+    // the segment at its own seek target and nothing recorded which segment or
+    // where the viewer was.
+    logger.info(
+      `[hold] ${fileName} refused: the viewer is at ` +
+      `${hlsSessionManager.viewerPositionOf(sessionId).toFixed(1)}s and this is not the segment there`
+    );
+    reply.header("Retry-After", "0");
+    return reply.code(503).send({ error: "Superseded by a seek." });
+  }
+  if (result.kind === "warming-up") {
+    // The segment is still being produced (e.g. just after a seek-restart).
+    // Return a retryable 503 — never 202, which hls.js cannot consume as a
+    // media segment — so the player retries the fetch shortly.
+    reply.header("Retry-After", "1");
+    // `Retry-After` tells the player to re-request THIS segment after a short
+    // pause. Without it a bare 503 reads as "nothing here", and the player goes
+    // looking elsewhere: because our synthetic VOD playlist lists every segment
+    // of the file, it believes they all exist and SCANS them (field log: one
+    // user seek produced probes at #617, #717, #732…). That scan is what used
+    // to steer the encoder off the real target. Whether iOS's native player
+    // honours the hint is not guaranteed — its behaviour is closed — but this
+    // is the standard, correct way to say "wait, don't look elsewhere", and
+    // hls.js already retries the same fragment regardless.
+    reply.header("Retry-After", "1");
+    return reply.code(503).send({ error: "Transcode segment is still being produced." });
+  }
+  if (result.kind === "failed") {
+    return reply.code(500).send({ error: result.message });
+  }
+
+  if (result.isPlaylist) {
+    reply.header("Cache-Control", "no-store");
+  } else {
+    reply.header("Cache-Control", "public, max-age=60");
+  }
+  reply.header("Content-Type", result.contentType);
+  return reply.send(result.stream);
+}
+
+/**
+ * Poll `hlsSessionManager.getFileStream()` until the file is available,
+ * the session fails, or the timeout elapses.
+ *
+ * @param {import("../../../services/hls-session-manager.js").HlsSessionManager} hlsSessionManager
+ * @param {string} sessionId
+ * @param {string} fileName
+ * @param {number} timeoutMs
+ * @returns {Promise<Awaited<ReturnType<import("../../../services/hls-session-manager.js").HlsSessionManager["getFileStream"]>>>}
+ */
+export async function waitForSessionFile(hlsSessionManager, sessionId, fileName, timeoutMs) {
+  const startedAt = Date.now();
+  // One sequence number for THIS request, reused by every poll below, so the
+  // session can tell a newly-arrived request apart from an old one polling
+  // again — see HlsSessionManager#ensureEncodingFor for the encoder ping-pong
+  // this prevents when one seek-bar scrub fires several segment requests.
+  const requestSeq = hlsSessionManager.nextRequestSeq(sessionId);
+  // The viewer's position when this request was made. A seek makes every held
+  // request stale — it asks for a segment nobody is going to watch — and hls.js
+  // keeps only ONE fragment load outstanding, so holding on blocks the request
+  // the player actually needs now. Measured: 57 s of a 58 s backward seek was
+  // this wait, and the segment the viewer wanted took 15 ms once it was asked
+  // for.
+  let seekEpoch = hlsSessionManager.seekEpoch(sessionId);
+  while (Date.now() - startedAt < timeoutMs) {
+    const result = await hlsSessionManager.getFileStream(sessionId, fileName, { requestSeq });
+    if (result.kind !== "warming-up") {
+      return result;
+    }
+    if (hlsSessionManager.seekEpoch(sessionId) !== seekEpoch) {
+      // A seek moved the epoch. Whether THIS request is stale depends on which
+      // segment it asks for: the one the viewer has just landed on races the
+      // seek notification and would otherwise be refused at the exact moment it
+      // is needed — measured 2026-08-18, two 503s within 80 ms on the segment
+      // at the seek target, after which the player never asked for it again.
+      if (!hlsSessionManager.requestStillWanted(sessionId, fileName)) {
+        return { kind: "superseded" };
+      }
+      logger.info(
+        `[hold] ${fileName} kept across a seek: it is the segment the viewer now needs`
+      );
+      seekEpoch = hlsSessionManager.seekEpoch(sessionId);
+    }
+    await delay(300);
+  }
+  return { kind: "warming-up" };
+}
+
+/**
+ * Resolve after a given number of milliseconds.
+ *
+ * @param {number} ms
+ * @returns {Promise<void>}
+ */
+function delay(ms) {
+  return new Promise((resolve) => {
+    setTimeout(resolve, ms);
+  });
+}

package/services/hls-session-manager.js

@@ -2065,7 +2065,7 @@ export class HlsSessionManager {
     // flip the arrangement under a stream that is playing.
     session.audioSeparate = inheritedAudioSeparate === null
       ? audioRenditions === true &&
-        this.#variantHeights(session).length >= 2 &&
+        this.#splicableHeights(session).length >= 2 &&
         this.#audioRenditionsOf(session).length > 0
       : inheritedAudioSeparate === true;
 
@@ -5379,6 +5379,42 @@ export class HlsSessionManager {
     return session.variantHeight;
   }
 
+  /**
+   * The heights this file's variants CAN be spliced at — a fact about the
+   * source and the cut grid, settled once and never moved.
+   *
+   * Separate from {@link #variantHeights}, which answers a different question:
+   * which of them are worth OFFERING to the viewer right now, on a machine
+   * whose load moves every five seconds. Both were the same list until
+   * 2026-08-18, and that is what broke playback outright: the browser is told
+   * at session creation that a master playlist exists, and 192 ms later — after
+   * the session's own encoder had started and the first supply reading had
+   * arrived — the live list had fallen from five rungs to one, `buildMaster
+   * Playlist` returned null for having fewer than two, and the master answered
+   * 404 to the very session that had just published it. hls.js treats that as
+   * fatal and unrecoverable, so nothing played at all (session `4ef731d8`,
+   * "Moana (2016).mkv", 17:43:01).
+   *
+   * A live figure may decide what to offer. It may not decide whether a
+   * published document exists.
+   *
+   * @param {HlsSession} session
+   * @returns {number[]} Largest first.
+   */
+  #splicableHeights(session) {
+    const owner = this.#baseOf(session);
+    if (Array.isArray(owner.splicableHeights)) {
+      return owner.splicableHeights;
+    }
+    const heights = new Set(variantHeightsFor(Number(owner.sourceHeight) || 0));
+    const own = this.variantHeightOf(owner);
+    if (own > 0) {
+      heights.add(own);
+    }
+    owner.splicableHeights = [...heights].sort((left, right) => right - left);
+    return owner.splicableHeights;
+  }
+
   /**
    * The heights this session's file is offered at, largest first.
    *
@@ -6540,8 +6576,11 @@ export class HlsSessionManager {
       return null;
     }
     // Only the heights the master offers. Anything else is a made-up request,
-    // and honouring it would let a client start encoder runs at will.
-    if (!this.#variantHeights(base).includes(height)) {
+    // and honouring it would let a client start encoder runs at will. The
+    // MASTER's list, not the live one: a rung is published for the session's
+    // whole life, and refusing what we published is how a quality switch became
+    // a 404 storm across every level.
+    if (!this.#splicableHeights(base).includes(height)) {
       return null;
     }
     if (height === this.variantHeightOf(base)) {
@@ -6690,7 +6729,7 @@ export class HlsSessionManager {
     if (!isPlaylist && !isInit && !isSegment) {
       return { sessionId: null };
     }
-    if (!this.#variantHeights(base).includes(height)) {
+    if (!this.#splicableHeights(base).includes(height)) {
       return { sessionId: null };
     }
     // Answered from the base, and no encoder is started for it. Every variant of
@@ -6945,7 +6984,11 @@ export class HlsSessionManager {
       return null;
     }
     const sourceHeight = Number(session.sourceHeight) || 0;
-    const rungs = this.#variantHeights(session);
+    // What CAN be spliced, not what is worth offering this second. The live
+    // judgement travels in `offeredHeights` and in every progress report, which
+    // is what the viewer's menu follows; letting it decide the master's
+    // existence made a live session answer 404 to its own published address.
+    const rungs = this.#splicableHeights(session);
     if (rungs.length < 2) {
       return null;
     }
@@ -7223,6 +7266,59 @@ export class HlsSessionManager {
     return session?.waitEpoch ?? 0;
   }
 
+  /**
+   * Where the viewer of this session is, in seconds.
+   *
+   * Exists so a refusal can name it. A log line that says only "superseded"
+   * cannot be read afterwards: it does not say what was refused or against what
+   * position, which is exactly what the 2026-08-18 investigation lacked.
+   *
+   * @param {string} sessionId
+   * @returns {number} Zero when the session is gone or nothing has been reported.
+   */
+  viewerPositionOf(sessionId) {
+    const session = isSafeSessionId(sessionId) ? this.sessionsById.get(sessionId) : null;
+    const position = Number(session?.viewerPositionSeconds);
+    return Number.isFinite(position) ? position : 0;
+  }
+
+  /**
+   * Whether a held request is for a segment the viewer STILL needs.
+   *
+   * The epoch alone says a seek happened; it cannot say whether this particular
+   * request was made for the position left behind or for the one just arrived
+   * at. That distinction is the whole of the failure measured 2026-08-18: the
+   * viewer seeked to 1061.0 s, the request for `segment-00101` — the segment AT
+   * that position — raced the seek notification, the epoch moved underneath it,
+   * and it was answered 503 twice within 80 ms. The player then hunted at
+   * sn=105-107, never came back to 101, and looped two audio segments 1473
+   * times over 149 s while the picture stood still.
+   *
+   * A request is stale when its segment lies behind where the viewer now is, or
+   * so far ahead that the running encode will not reach it. Anything between is
+   * exactly what the viewer is waiting for, and holding it is the point.
+   *
+   * @param {string} sessionId
+   * @param {string} fileName
+   * @returns {boolean} True when the request should keep waiting.
+   */
+  requestStillWanted(sessionId, fileName) {
+    const session = isSafeSessionId(sessionId) ? this.sessionsById.get(sessionId) : null;
+    if (!session) {
+      return false;
+    }
+    const index = session.segmentFormat?.segmentIndexFromName?.(fileName) ?? -1;
+    if (!(index >= 0)) {
+      return true; // a playlist or an init segment belongs to no position
+    }
+    const position = Number(session.viewerPositionSeconds);
+    if (!Number.isFinite(position)) {
+      return true; // nothing said where the viewer is; refusing would be a guess
+    }
+    const at = this.#segmentIndexForTime(session, position);
+    return index >= at && index <= at + MAX_LOOKAHEAD_SEGMENTS;
+  }
+
   /**
    * Open a read stream for an HLS segment or playlist file from a session.
    *

package/services/thread-pool.js

@@ -0,0 +1,30 @@
+/**
+ * @file How many blocking calls this process can have in flight — set before
+ * anything makes one.
+ *
+ * Node resolves host names with `getaddrinfo`, which runs on the libuv thread
+ * pool, and that pool holds FOUR threads by default. A torrent announces to
+ * every tracker in its file at once — ten or thirteen of them — so four names
+ * are resolved and the rest queue; a tracker that no longer exists holds its
+ * thread for the resolver's full ten-second timeout, and every announce behind
+ * it blows its own fifteen-second deadline.
+ *
+ * Measured inside the addon container on 2026-08-18, resolving the ten trackers
+ * of one film: as a burst on the default pool, two names answered in 30-40 ms
+ * and the other seven took **7.58 s**; with a larger pool every live name
+ * answered in **27-42 ms**. The film itself had 517 seeders on a tracker that
+ * answers in 50 ms, and spent eleven minutes with zero peers, because every
+ * announce — UDP and HTTP alike — timed out waiting for a name.
+ *
+ * Sized to hold several torrents' announce lists at once, since the same pool
+ * also serves this process's file reads. Idle threads cost memory and nothing
+ * else, and a deployment that states its own size is left alone.
+ *
+ * Imported FIRST by the entry point, because a module's imports are evaluated
+ * before its body: written as a statement in `cli.js` this would run after
+ * every other import had already had its chance to create the pool.
+ */
+
+if (!process.env.UV_THREADPOOL_SIZE) {
+  process.env.UV_THREADPOOL_SIZE = "64";
+}

package/test/decode-cost.test.js

@@ -288,7 +288,7 @@ test("the source's decode figures come off the probe, or not at all", () => {
   assert.equal(sourceDecodeCharacteristics(null), null);
 });
 
-test("the master playlist drops the rungs the host cannot hold", async (t) => {
+test("the OFFER drops the rungs the host cannot hold, and the master keeps addressing them", async (t) => {
   const dirPath = await mkdtemp(path.join(os.tmpdir(), "decode-cost-"));
   const manager = new HlsSessionManager({
     enabled: true,
@@ -339,15 +339,22 @@ test("the master playlist drops the rungs the host cannot hold", async (t) => {
   };
   manager.sessionsById.set(session.id, session);
 
-  assert.equal(
-    manager.buildMasterPlaylist(session.id),
-    null,
-    "every rung under the copy runs below realtime here, so there is nothing to switch to"
-  );
   assert.deepEqual(
     manager.offeredHeights(session),
     [1080],
-    "and the list the browser is given says the same, since both come from one answer"
+    "every rung under the copy runs below realtime here, so there is nothing to switch to"
+  );
+  // The master is NOT that answer. It says which rungs can be spliced onto this
+  // cut grid, which is a fact about the file, and it has to hold still for the
+  // session's life: the browser is handed its address at creation, and a live
+  // figure that withdrew it left a session answering 404 to itself (field
+  // 2026-08-18, "Moana (2016).mkv" — nothing played at all).
+  const weakMaster = manager.buildMasterPlaylist(session.id);
+  assert.ok(weakMaster, "published once, whatever the host is managing this second");
+  assert.deepEqual(
+    [...weakMaster.matchAll(/^v\/(\d+)\/index\.m3u8$/gm)].map((match) => Number(match[1])),
+    [1080, 720, 540, 480, 360, 240],
+    "the ladder of the source, addressable — the menu the viewer sees is offeredHeights"
   );
 
   // A host with a little more encoder keeps the rungs it can actually hold. A
@@ -355,11 +362,18 @@ test("the master playlist drops the rungs the host cannot hold", async (t) => {
   manager.softwarePresetBenchmark = [{ preset: "ultrafast", pixelsPerSec: 12e6 }];
   const stronger = { ...session, id: "dddddddd-eeee-ffff-0000-111111111111", offeredHeightsCache: undefined };
   manager.sessionsById.set(stronger.id, stronger);
+  assert.deepEqual(
+    manager.offeredHeights(stronger),
+    [1080, 360, 240],
+    "nothing is known about this swarm, so the bar is realtime"
+  );
   const master = manager.buildMasterPlaylist(stronger.id);
-  assert.ok(master, "1080p copied plus the rungs this host can produce");
-  const heights = [...master.matchAll(/^v\/(\d+)\/index\.m3u8$/gm)].map((match) => Number(match[1]));
-  assert.deepEqual(heights, [1080, 360, 240], "nothing is known about this swarm, so the bar is realtime");
-  assert.deepEqual(manager.offeredHeights(stronger), heights);
+  assert.ok(master, "1080p copied plus every rung that can be spliced beside it");
+  assert.deepEqual(
+    [...master.matchAll(/^v\/(\d+)\/index\.m3u8$/gm)].map((match) => Number(match[1])),
+    [1080, 720, 540, 480, 360, 240],
+    "the same published set as before: what the host manages is the offer's business, not the document's"
+  );
 
   // The same host, once the reader has measured what this file's supply
   // demands: waits arriving as they did on the field torrent of 2026-08-17 ask

package/test/quality-variants.test.js

@@ -813,3 +813,49 @@ test("a quality step being warmed is not refused by its own cost", async (t) =>
       "offer by the act of warming it — and its next segment 404s on a stream that is playing"
   );
 });
+
+test("the master survives a live offer that has collapsed to one rung", async (t) => {
+  // The field case of 2026-08-18, in the smallest form that reproduces it: a
+  // host too slow for any re-encoded rung, and a swarm whose interruptions
+  // demand far more than realtime. The live offer then holds only the height an
+  // encoder is already producing — and until this test existed, that made
+  // `buildMasterPlaylist` answer null and the route answer 404 to a session
+  // that had just published the address.
+  const dirPath = await mkdtemp(path.join(os.tmpdir(), "quality-variants-collapse-"));
+  const manager = new HlsSessionManager({
+    enabled: true,
+    ffmpegBin: "ffmpeg",
+    localBindHost: "127.0.0.1",
+    localPort: 9090,
+    // A megapixel a second: every rung below the source costs more than the
+    // machine has.
+    softwarePresetBenchmark: [{ preset: "veryfast", pixelsPerSec: 1_000_000 }],
+    decodeCostModel: { pixelTerm: 0.01, bitrateTerm: 0, constantTerm: 0 }
+  });
+  const base = fakeSession({ id: BASE_ID, encodeHeight: 812, dirPath });
+  base.sourceDecode = { megapixelsPerSecond: 50, megabitsPerSecond: 10 };
+  // What this file's own reader measured: a step must run at eight times
+  // realtime to survive this swarm.
+  base.supplyFigures = { requiredSpeed: 8 };
+  manager.sessionsById.set(BASE_ID, base);
+  t.after(async () => {
+    await manager.disposeAll();
+    await rm(dirPath, { recursive: true, force: true });
+  });
+
+  assert.deepEqual(
+    manager.offeredHeights(base),
+    [812],
+    "the live judgement is unchanged: nothing but the running height is worth offering"
+  );
+
+  const master = manager.buildMasterPlaylist(BASE_ID);
+
+  assert.ok(master, "the master is a published document, not a live figure");
+  const heights = [...master.matchAll(/^v\/(\d+)\/index\.m3u8$/gm)].map((match) => Number(match[1]));
+  assert.deepEqual(
+    heights,
+    [1080, 812, 720, 540, 480, 360, 240],
+    "every rung that can be spliced onto this cut grid stays addressable"
+  );
+});

package/test/seek-target-not-superseded.test.js

@@ -0,0 +1,106 @@
+/**
+ * @file The segment the viewer just seeked TO must not be refused as stale.
+ *
+ * A seek bumps the wait epoch so that requests made for the position being left
+ * stop being held. The request for the position being ARRIVED at races that
+ * bump: hls.js asks for the new segment within milliseconds, and if the epoch
+ * moves underneath it, the epoch check alone cannot tell the two apart.
+ *
+ * Measured 2026-08-18: the viewer seeked to 1061.0 s, `segment-00101` — the
+ * segment at that very position — was answered 503 twice within 80 ms, the
+ * player never asked for it again, and instead looped `a/0/segment-00103` and
+ * `a/0/segment-00104` 737 and 736 times over 149 seconds while the picture
+ * stood at `t=1061.0s readyState=1`. The session ended without another frame.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { HlsSessionManager } from "../services/hls-session-manager.js";
+import { fmp4Format } from "../services/segment-formats/fmp4.js";
+
+const SESSION_ID = "aaaaaaaa-1111-2222-3333-444444444444";
+const SEGMENT_SECONDS = 10.4;
+const SEEK_TO_SECONDS = 1061;
+const SEGMENT_AT_SEEK = Math.floor(SEEK_TO_SECONDS / SEGMENT_SECONDS);
+
+/**
+ * A session whose viewer has just landed at {@link SEEK_TO_SECONDS}.
+ *
+ * @returns {Promise<{ manager: HlsSessionManager, dirPath: string }>}
+ */
+async function managerAfterSeek() {
+  const dirPath = await mkdtemp(path.join(os.tmpdir(), "seek-target-"));
+  const manager = new HlsSessionManager({
+    enabled: true,
+    ffmpegBin: "ffmpeg",
+    localBindHost: "127.0.0.1",
+    localPort: 9090
+  });
+  manager.sessionsById.set(SESSION_ID, {
+    id: SESSION_ID,
+    dirPath,
+    state: "ready",
+    fileName: "film.mkv",
+    startedAt: Date.now(),
+    lastAccessedAt: Date.now(),
+    consumers: new Set(),
+    segmentFormat: fmp4Format,
+    transcodeVideo: false,
+    useSyntheticPlaylist: true,
+    segmentBoundaries: Array.from({ length: 400 }, (_, index) => index * SEGMENT_SECONDS),
+    segmentCount: 399,
+    encodeStartIndex: SEGMENT_AT_SEEK,
+    waitEpoch: 1,
+    viewerPositionSeconds: SEEK_TO_SECONDS,
+    runState: "PRODUCING"
+  });
+  return { manager, dirPath };
+}
+
+test("the segment at the seek target is still wanted", async () => {
+  const { manager, dirPath } = await managerAfterSeek();
+
+  assert.equal(
+    manager.requestStillWanted(SESSION_ID, `segment-${String(SEGMENT_AT_SEEK).padStart(5, "0")}.mp4`),
+    true,
+    "this is the segment the viewer is waiting for; refusing it is what froze the field session"
+  );
+
+  await rm(dirPath, { recursive: true, force: true });
+});
+
+test("a segment behind the viewer is not wanted any more", async () => {
+  const { manager, dirPath } = await managerAfterSeek();
+
+  assert.equal(
+    manager.requestStillWanted(SESSION_ID, `segment-${String(SEGMENT_AT_SEEK - 3).padStart(5, "0")}.mp4`),
+    false,
+    "a request for the position the viewer left is exactly what the epoch exists to release"
+  );
+
+  await rm(dirPath, { recursive: true, force: true });
+});
+
+test("a segment far beyond what the run will reach is not wanted", async () => {
+  const { manager, dirPath } = await managerAfterSeek();
+
+  assert.equal(
+    manager.requestStillWanted(SESSION_ID, `segment-${String(SEGMENT_AT_SEEK + 200).padStart(5, "0")}.mp4`),
+    false,
+    "nothing will produce it before the viewer moves again"
+  );
+
+  await rm(dirPath, { recursive: true, force: true });
+});
+
+test("a playlist belongs to no position and is never stale", async () => {
+  const { manager, dirPath } = await managerAfterSeek();
+
+  assert.equal(manager.requestStillWanted(SESSION_ID, "index.m3u8"), true);
+  assert.equal(manager.requestStillWanted(SESSION_ID, "init.mp4"), true);
+
+  await rm(dirPath, { recursive: true, force: true });
+});

package/test/segment-hold-supersede.test.js

@@ -51,6 +51,11 @@ test("a seek releases a held segment request instead of running out the hold", a
   const hlsSessionManager = {
     nextRequestSeq: () => 1,
     seekEpoch: () => epoch,
+    // The viewer seeked AWAY from this segment, so it is genuinely stale. A
+    // request for the segment they seeked TO is kept instead — see
+    // `test/seek-target-not-superseded.test.js`.
+    requestStillWanted: () => false,
+    viewerPositionOf: () => 0,
     async getFileStream() {
       polls += 1;
       // The viewer moves while this request is being held.

package/test/thread-pool.test.js

@@ -0,0 +1,53 @@
+/**
+ * @file The blocking-call pool is stated before anything can create it.
+ *
+ * Field 2026-08-18: a film with 517 seeders spent eleven minutes with zero
+ * peers on the addon host. Every announce timed out — UDP and HTTP alike — and
+ * the cause was not the network: resolving that torrent's ten tracker names as
+ * a burst took 7.58 s on the default four-thread pool, against 27-42 ms each
+ * when the pool was larger. A dead tracker holds a thread for the resolver's
+ * whole timeout, and every announce queued behind it misses its own deadline.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+
+test("the pool is set, and left alone when the deployment states its own", async () => {
+  const previous = process.env.UV_THREADPOOL_SIZE;
+  try {
+    process.env.UV_THREADPOOL_SIZE = "";
+    await import(`../services/thread-pool.js?first=${Date.now()}`);
+    assert.equal(
+      Number(process.env.UV_THREADPOOL_SIZE) >= 16,
+      true,
+      "enough threads for a torrent's whole announce list to resolve at once"
+    );
+
+    process.env.UV_THREADPOOL_SIZE = "8";
+    await import(`../services/thread-pool.js?stated=${Date.now()}`);
+    assert.equal(process.env.UV_THREADPOOL_SIZE, "8", "a stated size is the deployment's to choose");
+  } finally {
+    if (previous === undefined) {
+      delete process.env.UV_THREADPOOL_SIZE;
+    } else {
+      process.env.UV_THREADPOOL_SIZE = previous;
+    }
+  }
+});
+
+test("the entry point imports it before anything that could create the pool", async () => {
+  const cli = await readFile(path.join(here, "..", "bin", "cli.js"), "utf8");
+  const imports = [...cli.matchAll(/^import\s.*?from\s+["'](.+?)["'];|^import\s+["'](.+?)["'];/gm)]
+    .map((match) => match[1] ?? match[2]);
+
+  assert.equal(
+    imports[0],
+    "../services/thread-pool.js",
+    "a module's imports run before its body, so this cannot be a statement in cli.js"
+  );
+});

package/utils/logger.js

@@ -1,13 +1,43 @@
 /**
- * @file Centralised console logger for the proxy process.
+ * @file Centralised logger for the proxy process — to the console always, and
+ * to a file when one is named.
  *
- * All messages are prefixed with `[proxy-client]` and coloured with chalk
- * for consistent, readable terminal output.
+ * All messages are prefixed with `[proxy-client]` and coloured with chalk for
+ * consistent, readable terminal output.
+ *
+ * **Why a file at all.** The console is the container's stdout, and the
+ * container does not survive what we most need to read about. On 2026-08-18 the
+ * proxy died thirteen times with SIGSEGV; each death had Home Assistant's
+ * watchdog RECREATE the container, and every line leading up to the crash went
+ * with it. The same day a deploy of ours destroyed the evidence for two field
+ * reports that were being investigated at the time. A log that disappears
+ * exactly when something goes wrong is not a log, and no amount of care in
+ * choosing what to print compensates for it.
+ *
+ * The file is opt-in and named by the caller (`--log-file`), so nothing here
+ * assumes Home Assistant or any other host: the addon points it at `/data`,
+ * which survives restarts and updates, and a bare npm or Docker run may point
+ * it anywhere or leave it off.
  */
 
+import { createWriteStream, renameSync, statSync } from "node:fs";
 import chalk from "chalk";
 
 const PREFIX = "[proxy-client]";
+/**
+ * When the file is rotated, and how many turns are kept.
+ *
+ * One turn holds a few hours of a busy session at the current rate; two turns
+ * therefore cover a night's worth of restarts, which is the span a morning
+ * report asks about. Bounded because the addon's `/data` is the owner's disk.
+ */
+const MAX_FILE_BYTES = 32 * 1024 * 1024;
+
+/** @type {import("node:fs").WriteStream | null} */
+let fileStream = null;
+/** @type {string} */
+let filePath = "";
+let writtenBytes = 0;
 
 /**
  * Return the current time as a compact ISO-8601 (UTC) string, e.g.
@@ -20,6 +50,61 @@ function ts() {
   return new Date().toISOString().slice(11, 23); // "HH:MM:SS.mmm" (UTC)
 }
 
+/**
+ * Start writing every message to a file as well as the console.
+ *
+ * Appends: a restart must not erase what led up to it, which is the entire
+ * reason this exists. Failures are reported once and then ignored — a proxy
+ * that cannot write its log still has a viewer to serve.
+ *
+ * @param {string} pathToFile - Empty or absent leaves logging console-only.
+ * @returns {void}
+ */
+export function logToFile(pathToFile) {
+  if (typeof pathToFile !== "string" || pathToFile.length === 0) {
+    return;
+  }
+  try {
+    filePath = pathToFile;
+    writtenBytes = statSync(pathToFile, { throwIfNoEntry: false })?.size ?? 0;
+    fileStream = createWriteStream(pathToFile, { flags: "a" });
+    fileStream.on("error", (error) => {
+      fileStream = null;
+      console.warn(chalk.yellow(`${PREFIX} [${ts()}] log file ${pathToFile} stopped: ${error?.message}`));
+    });
+    console.log(chalk.cyan(`${PREFIX} [${ts()}] logging to ${pathToFile} as well as the console`));
+  } catch (error) {
+    fileStream = null;
+    console.warn(chalk.yellow(`${PREFIX} [${ts()}] cannot log to ${pathToFile}: ${error?.message}`));
+  }
+}
+
+/**
+ * Write one line to the file, rotating when it has grown past the cap.
+ *
+ * @param {string} line
+ * @returns {void}
+ */
+function toFile(line) {
+  if (!fileStream) {
+    return;
+  }
+  const text = `${line}\n`;
+  writtenBytes += Buffer.byteLength(text);
+  if (writtenBytes > MAX_FILE_BYTES) {
+    try {
+      fileStream.end();
+      renameSync(filePath, `${filePath}.1`);
+      fileStream = createWriteStream(filePath, { flags: "a" });
+      writtenBytes = Buffer.byteLength(text);
+    } catch {
+      // Rotation failed; keep writing to whatever handle still works rather
+      // than losing the line that prompted it.
+    }
+  }
+  fileStream.write(text);
+}
+
 /**
  * @typedef {Object} ProxyLogger
  * @property {(message: string) => void} info    - Informational message (cyan).
@@ -34,8 +119,24 @@ function ts() {
  * @type {ProxyLogger}
  */
 export const logger = {
-  info:    (message) => console.log(chalk.cyan(`${PREFIX} [${ts()}] ${message}`)),
-  success: (message) => console.log(chalk.green(`${PREFIX} [${ts()}] ${message}`)),
-  warn:    (message) => console.warn(chalk.yellow(`${PREFIX} [${ts()}] ${message}`)),
-  error:   (message) => console.error(chalk.red(`${PREFIX} [${ts()}] ${message}`)),
+  info: (message) => {
+    const line = `${PREFIX} [${ts()}] ${message}`;
+    console.log(chalk.cyan(line));
+    toFile(line);
+  },
+  success: (message) => {
+    const line = `${PREFIX} [${ts()}] ${message}`;
+    console.log(chalk.green(line));
+    toFile(line);
+  },
+  warn: (message) => {
+    const line = `${PREFIX} [${ts()}] ${message}`;
+    console.warn(chalk.yellow(line));
+    toFile(line);
+  },
+  error: (message) => {
+    const line = `${PREFIX} [${ts()}] ${message}`;
+    console.error(chalk.red(line));
+    toFile(line);
+  }
 };