@torrent-tv/proxy 2.84.0 → 2.85.1

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 2.85.1
+
+- **Chore**: NOTHING IS ADDED TO THE SESSION MANAGER, and 2.85.0 added a delegation and an import to it. Both are gone, and what they were there for went with them: taking in a viewer's report is the VIEWER layer's own operation now (`services/viewer/report-intake.js`), the route calls it directly with the live sessions and the registry of viewers, and the manager has no method for it at all. Which output a viewer has on screen moved out with it (`services/viewer/active-output.js`) — it is a question about a person, not about an encoder, and eight call sites now ask it outward.
+- **Chore**: HOW LONG A LINK READING DESCRIBES A LINK is answered by the reading, once (`Viewer.linkReading`). It was a constant in the session manager consulted in four places, and three of those were conditions over a figure that had already passed that very filter — unreachable by construction. Nothing nulls a stale reading any more either: expiry is answered when it is read, so the write that existed only to make a later read correct is gone, and a viewer who has simply stopped reporting is untouched.
+- **Chore**: The session manager is 103 lines shorter for it, and gained one import and eight calls outward.
+
+## 2.85.0
+
+- **Fix**: A VIEWER WHO HAS SAID NOTHING IS NOT ASSUMED TO BE WATCHING. `playing` started true on a viewer this proxy had never heard from, and the position is carried forward by the clock at that rate — so a page whose tab was hidden for 145 seconds, while it deliberately held start-up until it was shown, was placed **145.979 s** into a film it had not begun. Field 2026-09-14: that is the exact `-ss` the soundtrack's encoder was given, the browser was asking for segment #0, the map ranked #0 last of a hundred (`p1:#0..#13`), and the request was held 60 145 ms and answered 503. The moment the viewer left and the invented clock stopped, the plan asked for exactly the segment they had been asking for all along. A statement about somebody else's machine is theirs to make: until they make it the rate is zero.
+- **Fix**: THE POSITION IS BOUNDED BY WHAT THE VIEWER SAID THEY HELD — `position(now) = stated + rate × min(now − statedAt, held)`. Nobody can play past the end of what they have; a viewer who said "thirty seconds" and has said nothing for two minutes has played at most thirty of them. The bound binds only where the clock has outrun the cushion (a report lost, or a viewer starving) and there it under-states, which is the direction that costs an encoder rather than a viewer. In the field session above the cushion was 0.0 s throughout, so this alone would have held that viewer at zero whatever the rate said.
+- **Fix**: THREE STATES, NOT TWO. A picture that is not advancing was stopped either by the viewer — who then consumes nothing and can wait — or by us having delivered nothing, and that viewer is the most urgent there is. One boolean held two of the three and read the second as the first, so a viewer frozen for want of a segment counted as somebody who had chosen to stop and nothing of theirs fell due. `waiting` is stated beside `playing`, a viewer arrives waiting, and the priority map's upper band is for those watching OR waiting. A page one release behind states only `playing`, and its two states are told apart by the quantity it does state: stopped while holding film is a pause, stopped holding nothing is starvation.
+- **Fix**: A LINK MEASUREMENT IS NO LONGER THE TICKET FOR A VIEWER'S OWN REPORT. The same condition stood in three places — the page, this route, and the session manager — and a page measures its link from completed transfers, so a page that has not been delivered a segment has no figure at all. Field 2026-09-14: one transfer completed in the whole session, the median needs two, and every report the page tried to send — the pauses, the starvation, the tab going hidden — was dropped. The link figure is one field now, kept only when it is a measurement.
+- **Fix**: The second presence detector threw instead of working. `makeSendQueueWatcher` called `connectionGone`, a function of the factory that is not in its scope, so the watch that exists because `onClosed` does not always come raised a `ReferenceError` inside its own timer and left the viewer registered for the life of the process.
+- **New**: `GET /api/link-probe?bytes=N` — bytes a browser can time its link with before any film has been chosen. Bounded at 2 MiB, which is 336 Mbit/s inside the browser's minimum measurable transfer and twenty-eight times the top rung this product offers. Not `delivery-sink`, which is the load stand's and answers any size asked for.
+- **New**: A refusal says WHY, in the viewer's terms and not only in this proxy's log: the 503 for a segment that is not ready carries a `reason`, and where the priority map is working further along the film it says so. The reason existed sixty seconds before the failure of 2026-09-14 and travelled nowhere.
+- **New**: `peerWaiting=` on the delivery-probe line — how many requests the far end says it is still waiting for. The browser has sent it twice a second since the probe echo was built and nothing read it. Evidence, not a verdict: the receiver declares its own transport lost, because it knows first — on 2026-09-06 it said so sixteen minutes before this end did.
+- **Chore**: Taking in a viewer's report leaves the session manager for `services/viewer/report-intake.js`, and `Viewer.deadlineAt` is deleted — nothing consumed it, and when a second of film falls due is the priority map's answer. The manager is 18 lines shorter.
+- **New**: `test/viewer-states.test.js` — twelve checks over the three states, the bound, the cold open of 2026-09-14 with its own 146 seconds, and a report carrying no link measurement. `test/link-probe.test.js` covers this end of the probe; how big an ask has to be is checked where that function lives, in the page's own repository.
+
 ## 2.84.0
 
 - **Fix**: WHERE A VIEWER IS HAS ONE WRITER AND IS A FUNCTION OF TIME. It had two: a seek wrote `position.seeked`, a segment request overwrote `position.seconds`, and the reading preferred whichever was set — so the two took turns and the priority map jumped backwards and forwards several times a second. Field 2026-09-13, one output over one second: `p100:#9..#10`, `p100:#18..#20`, `p100:#16..#18`, `p100:#18..#20`, with the second viewer stopped dead at 1673.6 s throughout. Encoder placement follows the map, as it must, so the machine spent six minutes on **77 starts and 141 stops against one normal end**, produced almost nothing, and both browsers sat frozen with empty buffers while the swarm delivered 3 MB/s from 129 peers. A segment request now says only that the viewer is still here; where they are is what they state, and between statements it is carried forward by the clock at the rate the film moves — `position(now) = stated + (playing ? 1 : 0) × (now − statedAt)`. Continuous and monotone by construction, so nothing derived from it can dither.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.84.0",
+  "version": "2.85.1",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "publishConfig": {

package/routes/api/link-probe/get.js

@@ -0,0 +1,51 @@
+/**
+ * @file `GET /api/link-probe?bytes=N` — bytes to measure the link with.
+ *
+ * WHY THIS EXISTS. A viewer's link is measured from completed transfers, and
+ * the only transfers that counted were segments of the film. So the figure came
+ * into being after playback had begun — after the quality offer had been made,
+ * and after the start-up decisions that want it. Worse, the page's report of
+ * its OWN facts was skipped when there was no figure, so at a cold open — the
+ * moment where where-the-viewer-is matters most — the page said nothing at all
+ * (2026-09-14).
+ *
+ * There is nothing to wait for: a proxy can send bytes the moment its channel
+ * is up, which is when the page opens rather than when a film is chosen.
+ *
+ * NOT `delivery-sink`, which is the load stand's and answers any size asked
+ * for. This is part of the product, always on, and bounded — the browser's own
+ * sizing stops at 2 MiB and this refuses more, so a caller cannot turn it into
+ * a way of drawing a proxy owner's uplink.
+ *
+ * The body is zeros. What is being measured is the wire, and zeros cross it at
+ * the same speed as anything else; producing them costs one allocation.
+ */
+
+/**
+ * The most this route will send for one ask.
+ *
+ * The figure is only ever used to decide what a link can carry, and the most
+ * anything this product offers is a 1080p rung at around 12 Mbit/s. Two
+ * mebibytes inside the browser's minimum measurable transfer (50 ms) is
+ * 336 Mbit/s, twenty-eight times that rung: a link too fast to time at this
+ * size is beyond anything a decision here distinguishes.
+ */
+export const MAX_LINK_PROBE_BYTES = 2 * 1024 * 1024;
+
+/**
+ * @param {import("fastify").FastifyRequest} req
+ * @param {import("fastify").FastifyReply} reply
+ * @returns {Promise<void>}
+ */
+export async function handleApiLinkProbeGet(req, reply) {
+  const asked = Number(/** @type {{ bytes?: string }} */ (req.query)?.bytes);
+  if (!Number.isFinite(asked) || asked <= 0) {
+    return reply.code(400).send({ error: "bytes (>0) is required." });
+  }
+  const bytes = Math.min(Math.floor(asked), MAX_LINK_PROBE_BYTES);
+  return reply
+    .code(200)
+    .header("Content-Type", "application/octet-stream")
+    .header("Cache-Control", "no-store")
+    .send(Buffer.alloc(bytes));
+}

package/routes/api/transcode-sessions/net-report/post.js

@@ -1,64 +1,94 @@
-/**
- * Accept a viewer link report for a transcode session (adaptive bitrate).
- * The browser measures its own data-channel throughput per segment fetch and
- * posts a rolling median + its buffered seconds; the session manager's budget
- * loop uses the latest report as the link-deficit downshift trigger.
- *
- * POST /api/transcode-sessions/:sessionId/net-report
- * Body: { linkMbps: number, bufferedAheadSec: number,
- *         consumerId?: string, positionSeconds?: number }
- *
- * `consumerId` and `positionSeconds` say WHO is reporting and WHERE they are.
- * A copied picture is one session shared by every viewer of it, so without them
- * the proxy could only act on whichever viewer reported last. Both are
- * optional: a browser that sends neither is treated exactly as before.
- *
- * Best-effort telemetry: invalid body → 400, unknown session → 404, ok → 204.
- *
- * @param {import("fastify").FastifyRequest} req
- * @param {import("fastify").FastifyReply} reply
- * @param {{ hlsSessionManager: import("../../../../services/hls-session-manager.js").HlsSessionManager }} deps
- * @returns {Promise<void>}
- */
-export async function handleApiTranscodeSessionNetReportPost(req, reply, { hlsSessionManager }) {
-  const sessionId = typeof req.params.sessionId === "string" ? req.params.sessionId : "";
-  const body = req.body && typeof req.body === "object" && !Array.isArray(req.body) ? req.body : {};
-  const linkMbps = Number(body.linkMbps);
-  const bufferedAheadSec = Number(body.bufferedAheadSec);
-  if (!sessionId || !Number.isFinite(linkMbps) || linkMbps <= 0 || !Number.isFinite(bufferedAheadSec) || bufferedAheadSec < 0) {
-    return reply.code(400).send({ error: "linkMbps (>0) and bufferedAheadSec (>=0) are required." });
-  }
-
-  // Neither is required, and neither can make a report invalid: they are what
-  // the proxy uses to tell the viewers of one session apart, and a report
-  // without them is still a truthful reading of somebody's link.
-  const consumerId = typeof body.consumerId === "string" ? body.consumerId.trim() : "";
-  // Whether the picture is moving. Absent from a page that does not say, and
-  // then the viewer counts as playing, which is what every page meant before it
-  // could say otherwise.
-  const playing = typeof body.playing === "boolean" ? body.playing : undefined;
-  // Whether the page is on screen, and whether the picture was pulled out of
-  // it. A hidden tab has its timers throttled, so it asks for nothing and looks
-  // exactly like a viewer holding a full cushion; picture-in-picture is the case
-  // that makes the distinction necessary, because there the tab is hidden and
-  // the viewer is watching. Absent from a page that does not say, and then the
-  // viewer is on screen, as every page meant before it could say otherwise.
-  const onScreen = typeof body.onScreen === "boolean" ? body.onScreen : undefined;
-  const inPictureInPicture =
-    typeof body.inPictureInPicture === "boolean" ? body.inPictureInPicture : undefined;
-  const positionSeconds = Number(body.positionSeconds);
-  const recorded = hlsSessionManager.recordNetReport(sessionId, {
-    linkMbps,
-    bufferedAheadSec,
-    consumerId,
-    playing,
-    onScreen,
-    inPictureInPicture,
-    positionSeconds:
-      Number.isFinite(positionSeconds) && positionSeconds >= 0 ? positionSeconds : undefined
-  });
-  if (!recorded) {
-    return reply.code(404).send({ error: "Transcode session was not found." });
-  }
-  return reply.code(204).send();
-}
+import { recordViewerReport } from "../../../../services/viewer/report-intake.js";
+
+/**
+ * Accept a viewer link report for a transcode session (adaptive bitrate).
+ * The browser measures its own data-channel throughput per segment fetch and
+ * posts a rolling median + its buffered seconds; the session manager's budget
+ * loop uses the latest report as the link-deficit downshift trigger.
+ *
+ * POST /api/transcode-sessions/:sessionId/net-report
+ * Body: { linkMbps: number, bufferedAheadSec: number,
+ *         consumerId?: string, positionSeconds?: number }
+ *
+ * `consumerId` and `positionSeconds` say WHO is reporting and WHERE they are.
+ * A copied picture is one session shared by every viewer of it, so without them
+ * the proxy could only act on whichever viewer reported last. Both are
+ * optional: a browser that sends neither is treated exactly as before.
+ *
+ * Best-effort telemetry: invalid body → 400, unknown session → 404, ok → 204.
+ *
+ * @param {import("fastify").FastifyRequest} req
+ * @param {import("fastify").FastifyReply} reply
+ * @param {{ sessions: { get: (id: string) => object | undefined }, viewers: object }} deps -
+ *   The live sessions and the registry of viewers. The VIEWER layer takes the
+ *   statement from here; this route's whole job is turning a request into that
+ *   one call and its answer into a status code.
+ * @returns {Promise<void>}
+ */
+export async function handleApiTranscodeSessionNetReportPost(req, reply, { sessions, viewers }) {
+  const sessionId = typeof req.params.sessionId === "string" ? req.params.sessionId : "";
+  const body = req.body && typeof req.body === "object" && !Array.isArray(req.body) ? req.body : {};
+  // WHAT THIS REPORT IS. A statement by one viewer about itself: where the
+  // picture is, how much film it holds, whether it is moving, whether it is
+  // blocked on us, whether the page is on screen — and, when there has been
+  // anything to measure, how fast the link carried it.
+  //
+  // THE LINK FIGURE IS NOT REQUIRED, and requiring it is the fault of
+  // 2026-09-14. A page measures its link from completed transfers, so a page
+  // that has not yet been delivered a segment has no figure; at a cold open
+  // that is every page. Rejected here with 400, the page's own account of
+  // itself never arrived, this proxy filled the silence by assuming the film
+  // was running, and a viewer who had not seen a frame was placed 146 seconds
+  // into it — the soundtrack's encoder went there, and the segment the browser
+  // was actually asking for was ranked last of a hundred and answered 503.
+  const linkMbps = Number(body.linkMbps);
+  const bufferedAheadSec = Number(body.bufferedAheadSec);
+  if (!sessionId || !Number.isFinite(bufferedAheadSec) || bufferedAheadSec < 0) {
+    return reply.code(400).send({ error: "bufferedAheadSec (>=0) is required." });
+  }
+
+  // Neither is required, and neither can make a report invalid: they are what
+  // the proxy uses to tell the viewers of one session apart, and a report
+  // without them is still a truthful reading of somebody's link.
+  const consumerId = typeof body.consumerId === "string" ? body.consumerId.trim() : "";
+  // Whether the picture is moving. Absent from a page that does not say, and
+  // then nothing is assumed: a statement about somebody else's machine is
+  // theirs to make, and assuming it walked a viewer 146 seconds into a film
+  // they had not begun (2026-09-14).
+  const playing = typeof body.playing === "boolean" ? body.playing : undefined;
+  // Whether this viewer is BLOCKED on material we owe them, which is a
+  // different state from having stopped the picture: the first is the most
+  // urgent viewer there is, the second consumes nothing and can wait. One
+  // boolean could not hold three states and read the first as the second.
+  const waiting = typeof body.waiting === "boolean" ? body.waiting : undefined;
+  // Whether the page is on screen, and whether the picture was pulled out of
+  // it. A hidden tab has its timers throttled, so it asks for nothing and looks
+  // exactly like a viewer holding a full cushion; picture-in-picture is the case
+  // that makes the distinction necessary, because there the tab is hidden and
+  // the viewer is watching. Absent from a page that does not say, and then the
+  // viewer is on screen, as every page meant before it could say otherwise.
+  const onScreen = typeof body.onScreen === "boolean" ? body.onScreen : undefined;
+  const inPictureInPicture =
+    typeof body.inPictureInPicture === "boolean" ? body.inPictureInPicture : undefined;
+  const positionSeconds = Number(body.positionSeconds);
+  const recorded = recordViewerReport({
+    sessions,
+    viewers,
+    sessionId,
+    report: {
+      linkMbps: Number.isFinite(linkMbps) && linkMbps > 0 ? linkMbps : undefined,
+      bufferedAheadSec,
+      consumerId,
+      playing,
+      waiting,
+      onScreen,
+      inPictureInPicture,
+      positionSeconds:
+        Number.isFinite(positionSeconds) && positionSeconds >= 0 ? positionSeconds : undefined
+    }
+  });
+  if (!recorded) {
+    return reply.code(404).send({ error: "Transcode session was not found." });
+  }
+  return reply.code(204).send();
+}