@torrent-tv/proxy 2.45.0 → 2.47.0

package/CHANGELOG.md

@@ -1,3 +1,13 @@
+## 2.47.0
+
+- **Fix**: The tunnel is replaced before anything upstream ends it, so a viewer no longer arrives to find no proxy. Something between the proxy and the server closes the socket after exactly **100 min 15 s** — measured across a day of logs 2026-08-20, three intervals of 100:15 wherever a restart did not reset the clock, `code=1006` each time, and with the 30 s keepalive running throughout, so it is a lifetime cap and not an idle timeout. Reconnecting afterwards takes five seconds during which this proxy does not exist as far as the registry is concerned. The connection is now replaced at ninety minutes and the replacement takes over FIRST: the new socket registers itself, the server atomically supersedes the old one, and only then does the old one close — so there is no instant with nothing registered. A socket that finds itself superseded says so rather than reporting the tunnel as down, and an abrupt close nobody asked for still reconnects as before. Pinned by a test against a real WebSocket server.
+
+## 2.46.0
+
+- **New**: The cost of DECODING is measured per codec family, not once on H.264. A video that has to be re-encoded is by definition one the browser could not play — HEVC, 10-bit — so the one model the host had was fitted on the codec it is least often asked about, and those decode dearer per pixel on the same box. There are now sets for HEVC 8-bit and HEVC Main 10 beside the H.264 one (`assets/calibration/`, four clips each: two sizes at two bitrates, the smallest grid that keeps the axes independent and still leaves a spare), the source's own codec and bit depth choose the constants, and a family with no set of its own is priced as H.264 — said in the log rather than left to be inferred. Measured on a desktop 2026-08-20, the same 1080p picture at ~5.8 Mbit/s: 7.7x as 8-bit HEVC against 6.3x as 10-bit, which is why ten bits is its own family and not a multiplier. AV1 has no set yet; the release survey of 2026-07-10 found it rare where HEVC was 18 %.
+- **New**: The video's bit depth is read from the probe (`parseFfmpegBitDepth`), and it travels with the source's pixel and bit rates because it decides which measurement of this host applies.
+- **Chore**: When the H.264 clips do not fit, the line now says which families did. Measured on a fast desktop the same day, the H.264 readings stopped being ordered — 1080p at 9.35 Mbit/s costing 0.0307 s/s against 720p at 9.94 costing 0.0472, which is not a thing a decoder does — so a failure there is a measurement problem and not a missing file, and the two have to be tellable apart.
+
 ## 2.45.0
 
 - **Fix**: A run is cut where the PLAYER was told the cuts are. There are two boundary tables — the live one, corrected as produced segments reveal where the file's cuts truly are, and the one the playlist text was written from — and a player places every fragment by the text it holds, which never changes. The cut list handed to ffmpeg came from the live table, so every correction moved the run away from the timeline the player is reading: measured 2026-08-20 on `Minions.and.Monsters.1080p.mkv`, 119 of 125 produced segments arrived a uniform 2.002 s before the times their playlist named, against the 0.5 s hls.js bridges, and a fragment that does not land is fetched again — on 2026-08-17 two of them 1908 times each. A seek is resolved on the same table for the same reason: the time being resolved came out of that playlist. The corrections keep their purpose, which is to describe the FILE — a variant created later inherits the corrected table and publishes it, so its own playlist and its own cuts agree from the start — but they may no longer move the cuts of a session already being read.

package/assets/calibration/NOTICE.md

@@ -58,6 +58,43 @@ ffmpeg's own output rather than from this table. Two rules hold, though:
 - **the axes stay independent** — every size at both bitrates. Dropping one cell
   reintroduces the collinearity that produced the zeros above.
 
-Codecs other than H.264 (HEVC, AV1, 10-bit) decode dearer per pixel, and the
-model fitted here does not describe them. Covering them means a set per codec
-family and constants chosen by the source's own codec — roadmap item 3(b).
+## One set per codec family
+
+A video that has to be RE-ENCODED is by definition one the browser could not
+play, which is to say HEVC, 10-bit or AV1 — so the model was fitted on the one
+codec it is least often asked about. There is now a set per family, and the
+source's own codec chooses the constants.
+
+| file | codec | resolution | bitrate |
+|---|---|---|---|
+| `cal-hevc-1080-hi.mp4` | HEVC Main, 8-bit | 1920×1080 | 5.78 Mbit/s |
+| `cal-hevc-1080-lo.mp4` | HEVC Main, 8-bit | 1920×1080 | 0.52 Mbit/s |
+| `cal-hevc-480-hi.mp4` | HEVC Main, 8-bit | 854×480 | 7.76 Mbit/s |
+| `cal-hevc-480-lo.mp4` | HEVC Main, 8-bit | 854×480 | 0.74 Mbit/s |
+| `cal-hevc10-1080-hi.mp4` | HEVC Main 10 | 1920×1080 | 5.82 Mbit/s |
+| `cal-hevc10-1080-lo.mp4` | HEVC Main 10 | 1920×1080 | 0.52 Mbit/s |
+| `cal-hevc10-480-hi.mp4` | HEVC Main 10 | 854×480 | 6.95 Mbit/s |
+| `cal-hevc10-480-lo.mp4` | HEVC Main 10 | 854×480 | 0.68 Mbit/s |
+
+Four per family, not six: two sizes at two bitrates is the smallest grid that
+keeps the axes independent and still leaves one spare measurement, and every
+clip costs the startup about two seconds. They are one second long rather than
+two — the benchmark loops the clip and measures a slope over about a second of
+decoding, so length beyond that buys nothing and only makes the package larger.
+
+They were cut from `cal-h264-1080-hi.mp4` rather than from the 4K master, which
+is not in this repository. Re-encoding an already-compressed picture softens its
+grain slightly; what is being measured is the cost of decoding the new
+bitstream, and the grain that survives is the same material in every set, which
+is what makes the families comparable to each other.
+
+10-bit is its own family rather than a multiplier on the 8-bit one. Wider
+samples mean wider arithmetic, and how much that costs is a property of the
+machine — which is the thing being measured. Measured on a desktop 2026-08-20,
+1080p at ~5.8 Mbit/s: 7.7x as 8-bit HEVC and 6.3x as 10-bit, so it is a real
+difference and not a rounding.
+
+AV1 has no set yet. The release survey of 2026-07-10 found it rare where HEVC
+was 18 %, so it is priced as H.264 until it is worth the startup seconds — and
+the log says which families were measured and which are falling back, rather
+than leaving it to be inferred.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.45.0",
+  "version": "2.47.0",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/services/decode-cost-fit.js

@@ -315,17 +315,49 @@ function invert(matrix) {
   return work.map((row) => row.slice(size));
 }
 
+/**
+ * Which measured family prices a source of this codec and depth.
+ *
+ * The families are the ones there are clips for. Anything else is priced as
+ * H.264 — not because it decodes like H.264, but because that is the only
+ * measurement of this host there is, and saying so in one place beats each
+ * caller inventing its own fallback.
+ *
+ * 10-bit is its own family rather than a multiplier on the 8-bit one: the
+ * samples are wider, the arithmetic is wider, and how much that costs is a
+ * property of the machine, which is what is being measured.
+ *
+ * @param {{ codec?: string | null, bitDepth?: number | null }} source
+ * @returns {string}
+ */
+export function decodeFamilyOf(source) {
+  const codec = typeof source?.codec === "string" ? source.codec.trim().toLowerCase() : "";
+  const depth = Number(source?.bitDepth);
+  const tenBit = Number.isFinite(depth) && depth >= 10;
+  if (codec === "hevc" || codec === "h265" || codec === "x265") {
+    return tenBit ? "hevc10" : "hevc";
+  }
+  return "h264";
+}
+
 /**
  * What a model prices one source at.
  *
- * @param {DecodeCostModel} model
- * @param {{ megapixelsPerSecond: number, megabitsPerSecond: number }} source
+ * The model may carry a set of per-family fits (`families`) alongside the H.264
+ * terms it also spreads at the top level, which is what a caller that knows
+ * nothing about codecs still reads. When the source names a codec and that
+ * family was measured, its own constants are used.
+ *
+ * @param {DecodeCostModel & { families?: Record<string, DecodeCostModel> }} model
+ * @param {{ megapixelsPerSecond: number, megabitsPerSecond: number, codec?: string | null, bitDepth?: number | null }} source
  * @returns {number} Seconds of work per second of content.
  */
 export function decodeCostOf(model, source) {
+  const family = decodeFamilyOf(source);
+  const terms = model?.families?.[family] ?? model;
   return (
-    model.pixelTerm * source.megapixelsPerSecond +
-    model.bitrateTerm * source.megabitsPerSecond +
-    model.constantTerm
+    terms.pixelTerm * source.megapixelsPerSecond +
+    terms.bitrateTerm * source.megabitsPerSecond +
+    terms.constantTerm
   );
 }

package/services/ffmpeg-banner.js

@@ -165,3 +165,48 @@ export function parseFfmpegHdr(stderrText) {
   // the reliable HDR signal.
   return /\b(smpte2084|arib-std-b67|arib_std_b67)\b/i.test(videoLine[0]);
 }
+
+/**
+ * How many bits per sample the video carries, from the pixel format ffmpeg
+ * prints on its `Video:` line.
+ *
+ * This is a decode-cost input, not a colour one: a 10-bit stream holds wider
+ * samples and is decoded with wider arithmetic, and how much that costs is a
+ * property of the machine. It is therefore its own calibration family rather
+ * than a multiplier on the 8-bit one.
+ *
+ * ffmpeg names the depth in the format itself — `yuv420p10le`, `yuv420p12le`,
+ * `p010le` — and omits it at 8 bits (`yuv420p`, `nv12`). An unreadable line
+ * gives null, and the caller then prices the source as 8-bit, which is what
+ * every source was priced as before this existed.
+ *
+ * @param {string} stderrText
+ * @returns {number | null}
+ */
+export function parseFfmpegBitDepth(stderrText) {
+  if (typeof stderrText !== "string" || stderrText.length === 0) {
+    return null;
+  }
+  const videoLine = stderrText.match(/Video:[^\n]*/i);
+  if (!videoLine) {
+    return null;
+  }
+  // The pixel format is the token after the codec and its tag, and the depth
+  // rides on its name. `p010`/`p016` are the two that state it without a `p`
+  // separator, and they are 10 and 16 bits.
+  const named = videoLine[0].match(/\byuv[a-z0-9]*?p(\d{1,2})(?:le|be)\b/i);
+  if (named) {
+    const depth = Number(named[1]);
+    return Number.isFinite(depth) && depth >= 8 ? depth : null;
+  }
+  if (/\bp010(?:le|be)?\b/i.test(videoLine[0])) {
+    return 10;
+  }
+  if (/\bp016(?:le|be)?\b/i.test(videoLine[0])) {
+    return 16;
+  }
+  if (/\byuv[a-z0-9]*p\b|\bnv12\b|\bnv21\b|\bgbrp\b/i.test(videoLine[0])) {
+    return 8;
+  }
+  return null;
+}

package/services/hls-session-manager.js

@@ -180,8 +180,13 @@ export function variantHeightsFor(sourceHeight) {
  * Returns null when the probe did not report enough — the budget then prices
  * the encoder alone rather than inventing a figure.
  *
- * @param {{ width: number | null, height: number | null, fps: number | null, bitrateKbps: number | null }} mediaInfo
- * @returns {{ megapixelsPerSecond: number, megabitsPerSecond: number } | null}
+ * The codec and bit depth travel with the rates because they decide WHICH
+ * measurement of this host applies: the model is fitted per codec family, and a
+ * video that has to be re-encoded is by definition one the browser could not
+ * play — HEVC, 10-bit — which is exactly where H.264 constants are wrong.
+ *
+ * @param {{ width: number | null, height: number | null, fps: number | null, bitrateKbps: number | null, codec?: string | null, bitDepth?: number | null }} mediaInfo
+ * @returns {{ megapixelsPerSecond: number, megabitsPerSecond: number, codec: string, bitDepth: number | null } | null}
  */
 export function sourceDecodeCharacteristics(mediaInfo) {
   const width = Number(mediaInfo?.width);
@@ -191,9 +196,12 @@ export function sourceDecodeCharacteristics(mediaInfo) {
   if (!(width > 0) || !(height > 0) || !(fps > 0) || !(kbps > 0)) {
     return null;
   }
+  const depth = Number(mediaInfo?.bitDepth);
   return {
     megapixelsPerSecond: (width * height * fps) / 1e6,
-    megabitsPerSecond: kbps / 1000
+    megabitsPerSecond: kbps / 1000,
+    codec: typeof mediaInfo?.codec === "string" ? mediaInfo.codec : "",
+    bitDepth: Number.isFinite(depth) && depth > 0 ? depth : null
   };
 }
 

package/services/hwaccel.js

@@ -683,14 +683,41 @@ export async function detectTonemapSupport({ ffmpegBin, logger }) {
 // optimistic. Six points leave three spare, so the fit has a residual, and a
 // term the data does not determine can be refused instead of published as a
 // zero that looks measured. See `assets/calibration/NOTICE.md`.
-const CALIBRATION_CLIPS = [
-  "cal-h264-1080-hi.mp4",
-  "cal-h264-1080-lo.mp4",
-  "cal-h264-720-hi.mp4",
-  "cal-h264-720-lo.mp4",
-  "cal-h264-480-hi.mp4",
-  "cal-h264-480-lo.mp4"
-];
+//
+// One set PER CODEC FAMILY, because a family is what the model describes. The
+// fit used to be H.264 only, while a video that has to be RE-ENCODED is by
+// definition one the browser could not play — which is to say HEVC, 10-bit or
+// AV1 — and those decode dearer per pixel on the same box. Pricing them with
+// H.264 constants is the one case the model is always asked about and was never
+// measured on.
+//
+// A family that has no set of its own is priced with H.264's, which is what
+// happened to every family before this; the line says so rather than implying
+// it. AV1 has no set yet: the survey of 2026-07-10 found it rare where HEVC was
+// 18 % of releases, so it waits for the same treatment.
+const CALIBRATION_SETS = {
+  h264: [
+    "cal-h264-1080-hi.mp4",
+    "cal-h264-1080-lo.mp4",
+    "cal-h264-720-hi.mp4",
+    "cal-h264-720-lo.mp4",
+    "cal-h264-480-hi.mp4",
+    "cal-h264-480-lo.mp4"
+  ],
+  hevc: [
+    "cal-hevc-1080-hi.mp4",
+    "cal-hevc-1080-lo.mp4",
+    "cal-hevc-480-hi.mp4",
+    "cal-hevc-480-lo.mp4"
+  ],
+  hevc10: [
+    "cal-hevc10-1080-hi.mp4",
+    "cal-hevc10-1080-lo.mp4",
+    "cal-hevc10-480-hi.mp4",
+    "cal-hevc10-480-lo.mp4"
+  ]
+};
+const CALIBRATION_CLIPS = CALIBRATION_SETS.h264;
 const CALIBRATION_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "assets", "calibration");
 // How wide the measured window must be before the slope is trusted, and how
 // long to wait for it at most. A second of decoding is thousands of frames on a
@@ -833,13 +860,54 @@ export async function benchmarkContention({ ffmpegBin, logger, clipsDir = CALIBR
 
 export async function benchmarkDecodeCost({ ffmpegBin, logger, clipsDir = CALIBRATION_DIR }) {
   const log = logger ?? { info: () => {}, warn: () => {} };
+  const startedAllAt = Date.now();
+  /** @type {Record<string, { pixelTerm: number, bitrateTerm: number, constantTerm: number }>} */
+  const families = {};
+  for (const [family, clips] of Object.entries(CALIBRATION_SETS)) {
+    const fitted = await fitOneFamily({ ffmpegBin, log, clipsDir, family, clips });
+    if (fitted) {
+      families[family] = fitted;
+    }
+  }
+  if (!families.h264) {
+    // H.264 is the family every other one falls back to, so without it there is
+    // no model at all rather than a partial one. Which families DID fit is said
+    // anyway: on a fast host the H.264 clips decode at 20-80x and the readings
+    // stop being ordered — measured 2026-08-20 on a desktop, 1080p at 9.35
+    // Mbit/s costing 0.0307 s/s against 720p at 9.94 costing 0.0472, which is
+    // not a thing a decoder does — so a failure here is a measurement problem
+    // and not a missing file, and the line has to let those be told apart.
+    log.warn(
+      "hwaccel: decode cost unknown — the H.264 clips did not fit" +
+        (Object.keys(families).length > 0
+          ? `, though ${Object.keys(families).join(" and ")} did`
+          : "")
+    );
+    return null;
+  }
+  const missing = Object.keys(CALIBRATION_SETS).filter((family) => !families[family]);
+  log.info(
+    `hwaccel: decode cost measured for ${Object.keys(families).join(", ")}` +
+      (missing.length > 0 ? `; ${missing.join(" and ")} priced as H.264` : "") +
+      ` (in ${((Date.now() - startedAllAt) / 1000).toFixed(1)}s)`
+  );
+  return { families, ...families.h264 };
+}
+
+/**
+ * Fit one codec family's decode cost from its own clips.
+ *
+ * @param {{ ffmpegBin: string, log: { info: Function, warn: Function }, clipsDir: string, family: string, clips: string[] }} params
+ * @returns {Promise<{ pixelTerm: number, bitrateTerm: number, constantTerm: number } | null>}
+ */
+async function fitOneFamily({ ffmpegBin, log, clipsDir, family, clips }) {
   const startedAllAt = Date.now();
   /** @type {Array<{ megapixelsPerSecond: number, megabitsPerSecond: number, costSecondsPerSecond: number }>} */
   const samples = [];
-  for (const clip of CALIBRATION_CLIPS) {
+  for (const clip of clips) {
     const measured = await measureDecodeSlope(ffmpegBin, path.join(clipsDir, clip));
     if (!measured) {
-      log.warn(`hwaccel: decode benchmark "${clip}" failed or said nothing; decode cost unknown`);
+      log.warn(`hwaccel: decode benchmark "${clip}" failed or said nothing; ${family} not measured`);
       return null;
     }
     const cost = 1 / measured.speed;
@@ -856,11 +924,11 @@ export async function benchmarkDecodeCost({ ffmpegBin, logger, clipsDir = CALIBR
   }
   const fitted = fitDecodeCost(samples);
   if (!fitted) {
-    log.warn("hwaccel: decode cost could not be fitted to these measurements; decode cost unknown");
+    log.warn(`hwaccel: ${family} decode cost could not be fitted to these measurements`);
     return null;
   }
   log.info(
-    `hwaccel: decode cost = ${fitted.pixelTerm.toFixed(6)} × Mpx/s + ${fitted.bitrateTerm.toFixed(6)} × Mbit/s ` +
+    `hwaccel: ${family} decode cost = ${fitted.pixelTerm.toFixed(6)} × Mpx/s + ${fitted.bitrateTerm.toFixed(6)} × Mbit/s ` +
       `+ ${fitted.constantTerm.toFixed(4)} s/s (${fitted.shape} from ${fitted.samples} clips, ` +
       `typical disagreement ${fitted.residualRms.toFixed(4)} s/s` +
       // Named rather than implied: a zero in the line above means "not

package/services/playback-planner.js

@@ -13,6 +13,7 @@ import {
   parseFfmpegDurationSeconds,
   parseFfmpegStartTimeSeconds,
   parseFfmpegVideoDimensions,
+  parseFfmpegBitDepth,
   parseFfmpegBitrateKbps,
   parseFfmpegVideoFps,
   parseFfmpegHdr
@@ -534,6 +535,11 @@ export function createPlaybackPlanner({
           height: videoHeight,
           fps: parseFfmpegVideoFps(probe.stderr),
           bitrateKbps: parseFfmpegBitrateKbps(probe.stderr),
+          // Which family of the decode measurement prices this source. A video
+          // that has to be re-encoded is one the browser could not play, so it
+          // is usually NOT H.264, and H.264 constants are wrong for it.
+          codec: videoCodec,
+          bitDepth: parseFfmpegBitDepth(probe.stderr),
           // Which file this is, so the offer can be answered from what an
           // encoder has already learned about THIS source rather than from the
           // startup clips — the same correction a live session applies.
@@ -569,7 +575,8 @@ export function createPlaybackPlanner({
           bitrateKbps: parseFfmpegBitrateKbps(probe.stderr),
           fps: parseFfmpegVideoFps(probe.stderr),
           startTime: parseFfmpegStartTimeSeconds(probe.stderr),
-          isHdr: parseFfmpegHdr(probe.stderr)
+          isHdr: parseFfmpegHdr(probe.stderr),
+          bitDepth: parseFfmpegBitDepth(probe.stderr)
         });
         // Warm the file-body start for the transcode session that follows.
         // Fire-and-forget: never delays the plan response.

package/services/tunnel-client.js

@@ -80,6 +80,28 @@ import { WebSocket } from "ws";
 const RECONNECT_DELAY_MS = 5_000;
 /** Send a keepalive ping every 30 s to prevent Cloudflare's idle WebSocket timeout (~100 s). */
 const KEEPALIVE_INTERVAL_MS = 30_000;
+/**
+ * Replace the connection before anything upstream ends it for us.
+ *
+ * Something between this process and the server closes the socket after
+ * exactly **100 min 15 s**, whatever is flowing over it. It is not an idle
+ * timeout — the keepalive above has been running for months — it is a lifetime
+ * cap. Measured across one day of logs (2026-08-20): 01:54:12 → 03:34:27 →
+ * ... the same 100:15 apart wherever a restart did not reset the clock, and
+ * with `code=1006`, an abrupt close with no closing handshake, which is what an
+ * intermediary killing a connection looks like.
+ *
+ * Reconnecting after the fact costs 5 s during which this proxy does not exist
+ * as far as the registry is concerned, and a viewer arriving in that window is
+ * told there is no proxy. So the connection is replaced BEFORE the cap, and the
+ * replacement is seamless: the new socket registers itself with the server,
+ * which atomically supersedes the old one, and only then does the old one
+ * close. There is no moment with nothing registered.
+ *
+ * Ninety minutes leaves ten minutes of margin against a cap that has been
+ * exact, and makes the replacement a quiet event rather than a race.
+ */
+const CONNECTION_LIFETIME_MS = 90 * 60_000;
 
 /**
  * Create and manage the outbound WebSocket tunnel to the registry server.
@@ -87,15 +109,30 @@ const KEEPALIVE_INTERVAL_MS = 30_000;
  * @param {TunnelClientOptions} options
  * @returns {TunnelClient}
  */
-export function createTunnelClient({ serverUrl, proxyId, token, proxyPort, onSignal, onConnect, onHealthRequest, onLog }) {
+export function createTunnelClient({
+  serverUrl,
+  proxyId,
+  token,
+  proxyPort,
+  onSignal,
+  onConnect,
+  onHealthRequest,
+  onLog,
+  connectionLifetimeMs = CONNECTION_LIFETIME_MS
+}) {
   const wsUrl = serverUrl.replace(/^http/, "ws").replace(/\/+$/, "") + "/ws/proxy-tunnel";
 
   /** @type {WebSocket | null} */
   let socket = null;
   /** @type {ReturnType<typeof setTimeout> | null} */
   let reconnectTimer = null;
-  /** @type {ReturnType<typeof setInterval> | null} */
-  let keepaliveTimer = null;
+  /**
+   * The renewal that will replace the live connection before the upstream cap
+   * ends it. Owned by the connection it belongs to, and cancelled with it.
+   *
+   * @type {ReturnType<typeof setTimeout> | null}
+   */
+  let renewalTimer = null;
   let stopped = false;
 
   /**
@@ -122,28 +159,46 @@ export function createTunnelClient({ serverUrl, proxyId, token, proxyPort, onSig
     }
     log(`Connecting tunnel to ${wsUrl}`);
 
-    socket = new WebSocket(wsUrl, {
+    // The connection being opened, held separately from `socket` so that a
+    // socket which has been SUPERSEDED can still recognise itself. During a
+    // renewal two exist for a moment, and the old one's close must not be
+    // mistaken for the tunnel going down.
+    const connection = new WebSocket(wsUrl, {
       headers: {
         "x-proxy-id": proxyId,
         "x-proxy-token": token,
         "user-agent": "torrent-tv-proxy/1.0"
       }
     });
+    /** @type {ReturnType<typeof setInterval> | null} */
+    let keepaliveTimer = null;
+    socket = connection;
 
-    socket.addEventListener("open", () => {
+    connection.addEventListener("open", () => {
       log("Tunnel connected.");
       // Start keepalive pings to prevent Cloudflare's idle WebSocket timeout.
       keepaliveTimer = setInterval(() => {
-        if (socket && socket.readyState === WebSocket.OPEN) {
-          send({ type: "ping" });
+        if (connection.readyState === WebSocket.OPEN) {
+          send({ type: "ping" }, connection);
         }
       }, KEEPALIVE_INTERVAL_MS);
+      // And replace this connection before the upstream lifetime cap does.
+      if (renewalTimer !== null) {
+        clearTimeout(renewalTimer);
+      }
+      renewalTimer = setTimeout(() => {
+        if (stopped || socket !== connection) {
+          return;
+        }
+        log("Tunnel renewing before the upstream lifetime cap; the replacement takes over first.");
+        connect();
+      }, connectionLifetimeMs);
       if (typeof onConnect === "function") {
         onConnect();
       }
     });
 
-    socket.addEventListener("message", (event) => {
+    connection.addEventListener("message", (event) => {
       let message;
       try {
         message = JSON.parse(event.data);
@@ -174,19 +229,31 @@ export function createTunnelClient({ serverUrl, proxyId, token, proxyPort, onSig
       }
     });
 
-    socket.addEventListener("close", (event) => {
-      log(`Tunnel disconnected (code=${event.code}). Reconnecting in ${RECONNECT_DELAY_MS}ms...`);
-      socket = null;
+    connection.addEventListener("close", (event) => {
       if (keepaliveTimer !== null) {
         clearInterval(keepaliveTimer);
         keepaliveTimer = null;
       }
+      // A connection this one replaced. The server closes it as soon as the
+      // replacement registers, which is the whole point of renewing early —
+      // there is nothing to report and nothing to reconnect, because the tunnel
+      // never went down.
+      if (socket !== connection) {
+        log(`Tunnel handed over (code=${event.code}); the replacement is already carrying it.`);
+        return;
+      }
+      log(`Tunnel disconnected (code=${event.code}). Reconnecting in ${RECONNECT_DELAY_MS}ms...`);
+      socket = null;
+      if (renewalTimer !== null) {
+        clearTimeout(renewalTimer);
+        renewalTimer = null;
+      }
       if (!stopped) {
         reconnectTimer = setTimeout(connect, RECONNECT_DELAY_MS);
       }
     });
 
-    socket.addEventListener("error", (event) => {
+    connection.addEventListener("error", (event) => {
       log(`Tunnel WebSocket error: ${event.message ?? "unknown"}`);
     });
   }
@@ -255,9 +322,14 @@ export function createTunnelClient({ serverUrl, proxyId, token, proxyPort, onSig
    * @param {object} message
    * @returns {void}
    */
-  function send(message) {
-    if (socket && socket.readyState === WebSocket.OPEN) {
-      socket.send(JSON.stringify(message));
+  function send(message, over = null) {
+    // Everything the proxy has to say goes over the LIVE connection. `over` is
+    // for the one thing that belongs to a particular socket rather than to the
+    // tunnel — its own keepalive — which must not be sent over a replacement
+    // that has already taken over.
+    const target = over ?? socket;
+    if (target && target.readyState === WebSocket.OPEN) {
+      target.send(JSON.stringify(message));
     }
   }
 
@@ -291,9 +363,9 @@ export function createTunnelClient({ serverUrl, proxyId, token, proxyPort, onSig
      */
     disconnect() {
       stopped = true;
-      if (keepaliveTimer !== null) {
-        clearInterval(keepaliveTimer);
-        keepaliveTimer = null;
+      if (renewalTimer !== null) {
+        clearTimeout(renewalTimer);
+        renewalTimer = null;
       }
       if (reconnectTimer != null) {
         clearTimeout(reconnectTimer);

package/test/decode-cost.test.js

@@ -17,6 +17,7 @@ import assert from "node:assert/strict";
 import { createRequire } from "node:module";
 import { spawn } from "node:child_process";
 import { mkdtemp, rm } from "node:fs/promises";
+import { decodeCostOf, decodeFamilyOf } from "../services/decode-cost-fit.js";
 import os from "node:os";
 import path from "node:path";
 import {
@@ -282,8 +283,22 @@ test("a banner with no bitrate reads as no bitrate, not as zero", () => {
 test("the source's decode figures come off the probe, or not at all", () => {
   assert.deepEqual(sourceDecodeCharacteristics({ width: 1920, height: 1080, fps: 24, bitrateKbps: 8000 }), {
     megapixelsPerSecond: (1920 * 1080 * 24) / 1e6,
-    megabitsPerSecond: 8
+    megabitsPerSecond: 8,
+    // Which measurement of this host applies. Absent on the probe means absent
+    // here — the caller then prices the source as H.264 8-bit, which is what
+    // every source was priced as before the model was fitted per family.
+    codec: "",
+    bitDepth: null
   });
+  assert.deepEqual(
+    sourceDecodeCharacteristics({ width: 1920, height: 1080, fps: 24, bitrateKbps: 8000, codec: "hevc", bitDepth: 10 }),
+    {
+      megapixelsPerSecond: (1920 * 1080 * 24) / 1e6,
+      megabitsPerSecond: 8,
+      codec: "hevc",
+      bitDepth: 10
+    }
+  );
   assert.equal(sourceDecodeCharacteristics({ width: 1920, height: 1080, fps: 24, bitrateKbps: null }), null);
   assert.equal(sourceDecodeCharacteristics(null), null);
 });
@@ -391,3 +406,52 @@ test("the OFFER drops the rungs the host cannot hold, and the master keeps addre
     "the copied height costs no encoder and stays; nothing re-encoded survives that supply"
   );
 });
+
+test("a source is priced by its own codec family when that family was measured", () => {
+  // A model as the startup benchmark now returns it: H.264 terms at the top
+  // level, for a caller that knows nothing about codecs, and the measured
+  // families beside them.
+  const model = {
+    pixelTerm: 0.006, bitrateTerm: 0.012, constantTerm: 0,
+    families: {
+      h264: { pixelTerm: 0.006, bitrateTerm: 0.012, constantTerm: 0 },
+      hevc: { pixelTerm: 0.011, bitrateTerm: 0.020, constantTerm: 0 },
+      hevc10: { pixelTerm: 0.017, bitrateTerm: 0.026, constantTerm: 0 }
+    }
+  };
+  const rates = { megapixelsPerSecond: 50, megabitsPerSecond: 9 };
+  const asH264 = decodeCostOf(model, { ...rates, codec: "h264", bitDepth: 8 });
+  const asHevc = decodeCostOf(model, { ...rates, codec: "hevc", bitDepth: 8 });
+  const asHevc10 = decodeCostOf(model, { ...rates, codec: "hevc", bitDepth: 10 });
+  assert.equal(Number(asH264.toFixed(4)), 0.408);
+  assert.equal(Number(asHevc.toFixed(4)), 0.73);
+  assert.equal(Number(asHevc10.toFixed(4)), 1.084);
+  // The whole point: the same file costs more as HEVC than as H.264, and more
+  // again at ten bits. A single fit could not say that.
+  assert.ok(asHevc > asH264 && asHevc10 > asHevc);
+});
+
+test("a family with no clips is priced as H.264, and a model with no families still works", () => {
+  const withFamilies = {
+    pixelTerm: 0.006, bitrateTerm: 0.012, constantTerm: 0,
+    families: { h264: { pixelTerm: 0.006, bitrateTerm: 0.012, constantTerm: 0 } }
+  };
+  const rates = { megapixelsPerSecond: 50, megabitsPerSecond: 9 };
+  // AV1 has no set of its own yet.
+  assert.equal(
+    decodeCostOf(withFamilies, { ...rates, codec: "av1", bitDepth: 8 }),
+    decodeCostOf(withFamilies, { ...rates, codec: "h264", bitDepth: 8 })
+  );
+  // And a flat model — every model before this release — is unchanged.
+  const flat = { pixelTerm: 0.006, bitrateTerm: 0.012, constantTerm: 0 };
+  assert.equal(decodeCostOf(flat, { ...rates, codec: "hevc", bitDepth: 10 }), 0.408);
+});
+
+test("the family is chosen by codec and depth, and unknown names fall to H.264", () => {
+  assert.equal(decodeFamilyOf({ codec: "hevc", bitDepth: 8 }), "hevc");
+  assert.equal(decodeFamilyOf({ codec: "HEVC", bitDepth: 10 }), "hevc10");
+  assert.equal(decodeFamilyOf({ codec: "h265", bitDepth: 12 }), "hevc10");
+  assert.equal(decodeFamilyOf({ codec: "h264", bitDepth: 10 }), "h264");
+  assert.equal(decodeFamilyOf({ codec: "vc1", bitDepth: null }), "h264");
+  assert.equal(decodeFamilyOf({}), "h264");
+});

package/test/tunnel-renewal.test.js

@@ -0,0 +1,126 @@
+/**
+ * @file The tunnel is replaced before anything upstream ends it, and the
+ * replacement takes over first.
+ *
+ * Something between the proxy and the server closes the socket after exactly
+ * 100 min 15 s whatever is flowing over it — measured across a day of logs on
+ * 2026-08-20, `code=1006` each time, with a 30 s keepalive running throughout,
+ * so it is a lifetime cap and not an idle timeout. Reconnecting afterwards
+ * costs five seconds in which the proxy does not exist as far as the registry
+ * is concerned, and a viewer arriving then is told there is no proxy.
+ *
+ * What is pinned here is the property that removes that window: at no instant
+ * is the server without a registered connection for this proxy.
+ */
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import { WebSocketServer } from "ws";
+
+import { createTunnelClient } from "../services/tunnel-client.js";
+
+/**
+ * A stand-in for the registry's tunnel endpoint, with the one behaviour that
+ * matters here: a new connection for a proxy REPLACES the previous one, which
+ * is what `registerConnection` does in `server/services/proxy-tunnel-server.js`.
+ *
+ * @returns {Promise<{ url: string, close: () => Promise<void>, registered: () => number, opened: () => number, everEmpty: () => boolean }>}
+ */
+async function startRegistry() {
+  const server = new WebSocketServer({ port: 0 });
+  await new Promise((resolve) => { server.on("listening", resolve); });
+  /** @type {import("ws").WebSocket | null} */
+  let current = null;
+  let opened = 0;
+  let everEmpty = false;
+  server.on("connection", (socket) => {
+    opened += 1;
+    const previous = current;
+    current = socket;
+    // The replacement is registered BEFORE the old one is closed, so a reader
+    // of `current` never sees nothing.
+    if (previous && previous.readyState < 2) {
+      previous.close(1000, "replaced");
+    }
+    socket.on("close", () => {
+      if (current === socket) {
+        current = null;
+        everEmpty = true;
+      }
+    });
+  });
+  const { port } = server.address();
+  return {
+    url: `http://127.0.0.1:${port}`,
+    close: () => new Promise((resolve) => { server.close(resolve); }),
+    registered: () => (current && current.readyState === 1 ? 1 : 0),
+    killCurrent: () => { current?.terminate(); },
+    opened: () => opened,
+    everEmpty: () => everEmpty
+  };
+}
+
+test("the connection is replaced before its lifetime runs out, without a gap", async (t) => {
+  const registry = await startRegistry();
+  /** @type {string[]} */
+  const lines = [];
+  const client = createTunnelClient({
+    serverUrl: registry.url,
+    proxyId: "p1",
+    token: "t",
+    proxyPort: 9090,
+    onLog: (line) => lines.push(line),
+    // The real cap is 100 min 15 s and the real renewal is at 90 min; the
+    // ratio is what matters, not the magnitude.
+    connectionLifetimeMs: 150
+  });
+  t.after(async () => {
+    client.disconnect();
+    await registry.close();
+  });
+
+  client.connect();
+  // Long enough for several renewals at 150 ms each.
+  await new Promise((resolve) => { setTimeout(resolve, 700); });
+
+  assert.ok(registry.opened() >= 3, `expected several renewals, saw ${registry.opened()}`);
+  // The property this exists for: the registry was never left with nothing.
+  assert.equal(registry.everEmpty(), false, "the registry lost its connection at some point");
+  assert.equal(registry.registered(), 1);
+  // And the proxy knows the difference between a handover and going down. A
+  // "Reconnecting in" line here would mean it had treated its own renewal as a
+  // failure and waited five seconds before coming back.
+  assert.ok(lines.some((line) => line.includes("Tunnel renewing")), lines.join("\n"));
+  assert.ok(lines.some((line) => line.includes("Tunnel handed over")), lines.join("\n"));
+  assert.equal(lines.filter((line) => line.includes("Reconnecting in")).length, 0, lines.join("\n"));
+});
+
+test("a connection killed from outside is still reconnected", async (t) => {
+  const registry = await startRegistry();
+  /** @type {string[]} */
+  const lines = [];
+  const client = createTunnelClient({
+    serverUrl: registry.url,
+    proxyId: "p2",
+    token: "t",
+    proxyPort: 9090,
+    onLog: (line) => lines.push(line),
+    // Far longer than this test runs, so nothing renews and the only close is
+    // the one forced below — which is what the upstream cap looks like from
+    // here: an abrupt end nobody asked for.
+    connectionLifetimeMs: 60_000
+  });
+  t.after(async () => {
+    client.disconnect();
+    await registry.close();
+  });
+
+  client.connect();
+  await new Promise((resolve) => { setTimeout(resolve, 200); });
+  assert.equal(registry.opened(), 1);
+
+  registry.killCurrent();
+  await new Promise((resolve) => { setTimeout(resolve, 300); });
+  // The renewal must not have taken the ordinary reconnect away with it.
+  assert.ok(lines.some((line) => line.includes("Reconnecting in")), lines.join("\n"));
+});