@torrent-tv/proxy 2.89.8 → 2.89.10

package/AGENTS.md

@@ -344,15 +344,20 @@ job in the `production` environment:
 
 1. writes the version into `package.json`/`package-lock.json` and renames
    `## Unreleased` to it, commits `chore(release): <version>` and tags it;
-2. publishes `@torrent-tv/proxy` to npm with provenance;
+2. publishes `@torrent-tv/proxy` to npm with provenance, through npm trusted
+   publishing (the workflow's OIDC token; no npm token is stored);
 3. pushes the tag and the commit and creates the GitHub release;
-4. pushes `fix(proxy)`/`feat(proxy): install proxy <version>` to
+4. waits until npm serves the version — npm accepts a publication before it
+   serves it, 6.5 minutes for 2.89.8 — then pushes
+   `fix(proxy)`/`feat(proxy): install proxy <version>` to
    `torrent-tv/ha-addon` (`PROXY_VERSION` and the add-on changelog), whose own
    workflow builds the add-on image and releases the add-on.
 
 So the order proxy → add-on is kept by construction. A release can also be
-started by hand from the Actions tab with an explicit `patch` or `minor` step.
-Updating the add-on on the Home Assistant host is still done there.
+started by hand from the Actions tab with an explicit `patch` or `minor` step;
+it still needs an entry under `## Unreleased`. Re-running a failed release job
+is safe: once the tag exists, publication is skipped and only what is missing
+is done. Updating the add-on on the Home Assistant host is still done there.
 
 `.github/workflows/dependencies.yml` updates dependencies daily within the
 ranges, runs the same checks and pushes to `main`.

package/CHANGELOG.md

@@ -1,3 +1,12 @@
+## 2.89.10
+
+- **Fix**: An audio track warm-up that is still being made answers `503` with `warming: true`. That answer means the track and how it is produced are recorded for the viewer; a `503` without it is a preparation that failed and recorded nothing. Until now the two were the same status, so a page restating its soundtrack after a reconnect could not tell whether the proxy had kept it.
+
+## 2.89.9
+
+- **Fix**: The delivery probe judges a connection by how old the newest probe the browser has seen is, not by how long that probe took to arrive. The time it took is fixed once it has arrived, so on the wedge of 2026-09-28 it stayed 9 ms for a whole minute while the browser saw nothing after probe 1464, and every line read `flowing`; on idle healthy connections its 3 ms allowance left out the browser's own handling of the message, and `association-stopped` was printed for connections that delivered every probe. The age's allowance now also counts the probe interval, which `probeWedgeIsCertain` already counted. A real wedge is now named within about a second and reaches the packet witness.
+- **Fix**: A viewer named on two connections at once stays until the last of them closes. The page raises a second connection before it lets go of one that stopped delivering, and may then close the second instead; the proxy kept only the newest connection per viewer, so closing that trial connection released a viewer still watching through the old one, and their subtitle pushes went to a closed channel. Pushes now go to the newest connection that still carries the viewer.
+
 ## 2.89.8
 
 - **Chore**: Update dependencies: @fastify/cors 11.2.0 → 11.3.0, @fastify/helmet 13.0.2 → 13.1.1, @fastify/static 10.1.2 → 10.1.5, parse-torrent 11.0.23 → 11.0.24, werift 0.24.2 → 0.24.4, ws 8.21.1 → 8.22.0, @biomejs/biome 2.5.7 → 2.5.15; 78 package(s) changed in the lock file, 15 removed; 1 known vulnerability resolved.

package/docs/browser-proxy-contract.md

@@ -94,7 +94,7 @@ soundtracks the viewer can choose from.
 | `POST /api/transcode-sessions/:id/fragment-far` | Diagnostic fragment and buffer positions; does not change encoding. Best effort, success `204`. |
 | `POST /api/transcode-sessions/:id/release` | `{ consumerId, reason }` releases this viewer's session assignment. |
 | `GET /transcode/:id/:fileName` | HLS playlist, init, or media segment. A file that is still being produced is answered with retryable `503`, not `202`. |
-| `GET /transcode/:id/v/:height/warm` and `/transcode/:id/a/:track/warm` | Prepare the requested video height or audio track at a position. `204` means ready. Audio warm-up `404` means the proxy does not support this operation for that session. Audio warm-up takes an optional `transcode=0\|1`: whether the browser cannot play THAT track's codec as it is. The proxy decides the track's mode by the rule used when a file is opened; without the parameter it assumes the browser needs what it needed for its current track. |
+| `GET /transcode/:id/v/:height/warm` and `/transcode/:id/a/:track/warm` | Prepare the requested video height or audio track at a position. `204` means ready. Audio warm-up `404` means the proxy does not support this operation for that session. Audio warm-up takes an optional `transcode=0\|1`: whether the browser cannot play THAT track's codec as it is. The proxy decides the track's mode by the rule used when a file is opened; without the parameter it assumes the browser needs what it needed for its current track. Audio warm-up `503` with `{ warming: true }` means the track and its mode are recorded for this viewer and its segment is still being made; any other `503`, and `500`, recorded nothing. |
 | `GET /stream?sourceKey=…&fileIndex=N` | Direct file bytes with HTTP range support. |
 
 ### Playback readiness forecast

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@torrent-tv/proxy",
-  "version": "2.89.8",
+  "version": "2.89.10",
   "description": "Torrent proxy client that exposes webseed-like HTTP stream endpoint.",
   "license": "GPL-3.0-or-later",
   "repository": {

package/routes/transcode/audio-warm/get.js

@@ -90,6 +90,12 @@ export async function handleTranscodeAudioWarmGet(req, reply, { renditions, serv
   }
   // Still being produced. The caller may switch anyway — it will wait where it
   // would have waited before — or ask again.
+  //
+  // `warming: true` says the track and how it is produced ARE recorded for this
+  // viewer — `prepareAudioTrack` records them before the wait — which the
+  // status alone cannot say: the 503 above is a preparation that recorded
+  // nothing. A page restating its soundtrack after a reconnect needs to know
+  // which of the two it got.
   reply.header("Retry-After", "1");
-  return reply.code(503).send({ error: "The audio track is still warming up." });
+  return reply.code(503).send({ error: "The audio track is still warming up.", warming: true });
 }

package/services/transport/data-channel-handler.js

@@ -688,30 +688,71 @@ export function createDataChannelHandler({
   sendChunkBytes = 0
 }) {
   /**
-   * Who is on each connection, by WebRTC session id.
+   * Who is on each connection, by WebRTC session id, and the channel each of
+   * them named themselves on — null once that channel has closed.
    *
    * One connection carries one page, and a page holds one name per film it has
    * open — so this is normally one id, and more than one only where a page has
    * opened more than one.
    *
-   * @type {Map<string, Set<string>>}
+   * ONE PERSON MAY BE ON TWO CONNECTIONS AT ONCE, and this is the only record of
+   * it. The page raises a second connection before it lets go of the first
+   * when the first stops delivering, and it may then keep the first and close
+   * the second (it delivered again) or the reverse. The relation used to be
+   * held twice — this map and a second one naming each viewer's NEWEST
+   * connection — and the second could only point at one: a viewer named on a
+   * trial connection that was then closed was released while still watching
+   * through the old one. Both questions below are asked of this map instead.
+   *
+   * @type {Map<string, Map<string, DataChannel | null>>}
    */
   const viewersOnConnection = new Map();
+
   /**
-   * The newest connection currently carrying each viewer's identity.
+   * The connections a viewer is still named on, oldest first.
    *
-   * A reconnect can open its channels before the old connection finishes
-   * closing. The old connection must not release a viewer who has already
-   * identified themselves on the replacement.
+   * @param {string} consumerId
+   * @returns {string[]}
+   */
+  function connectionsCarrying(consumerId) {
+    const carrying = [];
+    for (const [sessionId, viewers] of viewersOnConnection) {
+      if (viewers.has(consumerId)) {
+        carrying.push(sessionId);
+      }
+    }
+    return carrying;
+  }
+
+  /**
+   * The channel a viewer can be reached on right now: the one they named
+   * themselves on, on the newest connection that still carries them with that
+   * channel open.
+   *
+   * The transport knows a NAME and nothing else about a viewer: what it means,
+   * who holds it and what they are watching are somebody else's facts. Keeping
+   * only "this name is reachable here" is what lets a subscription made once
+   * outlive the channel it was made on — a reconnect, and a rotation done on
+   * purpose, both just add a connection to the map.
    *
-   * @type {Map<string, string>}
+   * @param {string} consumerId
+   * @returns {DataChannel | null}
    */
-  const connectionOfViewer = new Map();
+  function channelOfViewer(consumerId) {
+    let reachable = null;
+    for (const viewers of viewersOnConnection.values()) {
+      const channel = viewers.get(consumerId);
+      if (channel) {
+        reachable = channel;
+      }
+    }
+    return reachable;
+  }
 
   /**
-   * Everyone on this connection has gone, because the connection has.
+   * This connection has gone, and with it everyone it was the last to carry.
    *
-   * Said once per connection: a second call after the set is emptied must not
+   * Said once per connection: a second call after the entry is removed must not
    * announce departures a second time, and the two detectors below — the close
    * event and the transport's own counters — can both fire for one death.
    *
@@ -725,11 +766,15 @@ export function createDataChannelHandler({
     if (!viewers || viewers.size === 0) {
       return;
     }
-    for (const consumerId of viewers) {
-      if (connectionOfViewer.get(consumerId) !== sessionId) {
+    for (const consumerId of viewers.keys()) {
+      const still = connectionsCarrying(consumerId);
+      if (still.length > 0) {
+        onLog?.(
+          `[dc] Session ${sessionId.slice(0, 8)}: viewer ${consumerId} stays — still on ` +
+            `${still.map((id) => id.slice(0, 8)).join(", ")} (${because})`
+        );
         continue;
       }
-      connectionOfViewer.delete(consumerId);
       onLog?.(`[dc] Session ${sessionId.slice(0, 8)}: viewer ${consumerId} left — ${because}`);
       try {
         onViewerGone(consumerId, because);
@@ -738,30 +783,20 @@ export function createDataChannelHandler({
       }
     }
   }
-  /**
-   * The channel each viewer is reachable on right now, by the name the far end
-   * presented when it opened.
-   *
-   * The transport knows a NAME and nothing else about a viewer: what it means,
-   * who holds it and what they are watching are somebody else's facts. Keeping
-   * only "this name is reachable here" is what lets a subscription made once
-   * outlive the channel it was made on — a reconnect, and a rotation done on
-   * purpose, both just rewrite this entry.
-   *
-   * @type {Map<string, DataChannel>}
-   */
-  const channelOfViewer = new Map();
 
   /**
-   * Forget every name that was reachable on this channel.
+   * This channel has closed: nobody can be reached on it any more. Who is on
+   * the connection does not change — that ends with the connection.
    *
    * @param {DataChannel} channel
    * @returns {void}
    */
   function forgetChannel(channel) {
-    for (const [consumerId, on] of channelOfViewer) {
-      if (on === channel) {
-        channelOfViewer.delete(consumerId);
+    for (const viewers of viewersOnConnection.values()) {
+      for (const [consumerId, on] of viewers) {
+        if (on === channel) {
+          viewers.set(consumerId, null);
+        }
       }
     }
   }
@@ -795,7 +830,7 @@ export function createDataChannelHandler({
     });
     let sent = 0;
     for (const consumerId of names) {
-      const channel = channelOfViewer.get(consumerId);
+      const channel = channelOfViewer(consumerId);
       if (!channel) {
         // Subscribed but not reachable this instant — between connections, or
         // rotating. Nothing is dropped: they are still subscribed, and the walk
@@ -1011,12 +1046,10 @@ export function createDataChannelHandler({
       // one person two the first time that happened, each with their own
       // position.
       if (message.type === "viewer" && typeof message.consumerId === "string" && message.consumerId) {
-        const known = viewersOnConnection.get(sessionId) ?? new Set();
+        const known = viewersOnConnection.get(sessionId) ?? new Map();
         const isNew = !known.has(message.consumerId);
-        known.add(message.consumerId);
+        known.set(message.consumerId, channel);
         viewersOnConnection.set(sessionId, known);
-        connectionOfViewer.set(message.consumerId, sessionId);
-        channelOfViewer.set(message.consumerId, channel);
         if (isNew) {
           log(`[dc] Session ${tag}: viewer ${message.consumerId} is on this connection`);
         }

package/services/transport/delivery-probe.js

@@ -84,6 +84,8 @@ export const PROBE_INTERVAL_MS = 500;
  * 15 instead of 11, and the gap of 12 is then what it was — a browser whose
  * timers are frozen, not an association that stopped.
  *
+ * The fifth term is the probe interval itself — see {@link allowedWaitMs}.
+ *
  * @param {{ queuedBytes: number, bytesPerSecond: number, rttMs: number, echoIntervalMs?: number, peerLoopLagMs?: number, intervalMs?: number }} state
  * @returns {number | null} Probes that may legitimately be outstanding, or null
  *   when no rate has been measured yet and nothing can be said.
@@ -100,11 +102,15 @@ export function allowedGap({
     return null;
   }
   // At least one: a probe sent and not yet echoed is the ordinary state.
-  return Math.max(1, Math.ceil(allowedWaitMs({ queuedBytes, bytesPerSecond, rttMs, echoIntervalMs, peerLoopLagMs }) / intervalMs));
+  return Math.max(
+    1,
+    Math.ceil(allowedWaitMs({ queuedBytes, bytesPerSecond, rttMs, echoIntervalMs, peerLoopLagMs, intervalMs }) / intervalMs)
+  );
 }
 
 /**
- * How long a probe may legitimately take to be reported back, in milliseconds.
+ * How old the newest probe the peer has reported may legitimately be, in
+ * milliseconds.
  *
  * THE QUANTITY {@link allowedGap} COMPUTES AND THEN THROWS AWAY by dividing it
  * into probes. Probes are the wrong unit and always were: the same probe goes
@@ -114,20 +120,38 @@ export function allowedGap({
  * and the honest measure of that is the age of the newest probe the peer has
  * seen, which this is compared against.
  *
- * Four terms, every one measured: the queue's own drain time at the rate this
- * connection is achieving, the crossing, the peer's reporting cadence, and how
- * late the peer's event loop is running.
+ * Five terms, every one measured or stated: the queue's own drain time at the
+ * rate this connection is achieving, the crossing both ways, the peer's
+ * reporting cadence, how late the peer's event loop is running, and the probe
+ * interval. The last is there because probes are discrete: a report composed
+ * just before probe N+1 arrives names N, which by then is one interval older
+ * than the newest probe sent. {@link probeWedgeIsCertain} has always counted
+ * it; this allowance left it out, so on an idle connection whose crossing is a
+ * few milliseconds the age crossed the allowance on ordinary ticks.
  *
  * @param {{ queuedBytes: number, bytesPerSecond: number, rttMs: number,
- *   echoIntervalMs?: number, peerLoopLagMs?: number }} state
+ *   echoIntervalMs?: number, peerLoopLagMs?: number, intervalMs?: number }} state
  * @returns {number}
  */
-export function allowedWaitMs({ queuedBytes, bytesPerSecond, rttMs, echoIntervalMs = 0, peerLoopLagMs = 0 }) {
+export function allowedWaitMs({
+  queuedBytes,
+  bytesPerSecond,
+  rttMs,
+  echoIntervalMs = 0,
+  peerLoopLagMs = 0,
+  intervalMs = PROBE_INTERVAL_MS
+}) {
   if (!(bytesPerSecond > 0)) {
     return 0;
   }
   const drainMs = (Math.max(queuedBytes, 0) / bytesPerSecond) * 1000;
-  return drainMs + Math.max(rttMs, 0) + Math.max(echoIntervalMs, 0) + Math.max(peerLoopLagMs, 0);
+  return (
+    drainMs +
+    Math.max(rttMs, 0) +
+    Math.max(echoIntervalMs, 0) +
+    Math.max(peerLoopLagMs, 0) +
+    Math.max(intervalMs, 0)
+  );
 }
 
 /**
@@ -293,23 +317,24 @@ export function readProbeState(state) {
     const gap = Number.isInteger(seen) ? state.seq - Number(seen) : null;
     const allowance = allowedOf(label);
     // BY TIME WHERE IT IS KNOWN. The count is what the line prints, because it
-    // is what a reader recognises; what decides is a time.
+    // is what a reader recognises; what decides is a time: how old the newest
+    // probe the peer has reported is.
     //
-    // The measured one-way delay first: it is the forward direction itself,
-    // with the two clocks reconciled from the exchange. The age of the newest
-    // reported probe is the fallback, and it is larger than the thing itself by
-    // the peer's reporting cadence and the way back — which is why its own
-    // allowance carries both of those and the one-way allowance carries
-    // neither.
-    const oneWay = timeOf(state.oneWayMs, label);
-    const oneWayAllowed = timeOf(state.allowedOneWayMs, label);
-    const lagMs = oneWay !== null && oneWayAllowed !== null ? oneWay : timeOf(state.behindMs, label);
-    const mayWaitMs = oneWay !== null && oneWayAllowed !== null
-      ? oneWayAllowed
-      : timeOf(state.allowedWaitMs, label);
+    // NOT the one-way delay of that probe, which decided here from 2026-09-11
+    // to 2026-10-04. That delay is fixed the moment the probe arrives, so it
+    // describes a probe that WAS delivered and says nothing about one that was
+    // not: on the wedge of 2026-09-28 it stayed 9 ms for a whole minute while
+    // the peer saw nothing after probe 1464, and every line read `flowing`. Its
+    // allowance — half a round trip on an idle channel — also left out the
+    // peer's own handling of the message, so healthy connections read
+    // `association-stopped` (meta research/stalled-channel-recovery-2026-10-04.md).
+    // The age grows for as long as nothing is delivered, which is what this
+    // verdict exists to see.
+    const lagMs = timeOf(state.behindMs, label);
+    const mayWaitMs = timeOf(state.allowedWaitMs, label);
     const lagText = lagMs === null || mayWaitMs === null
       ? ""
-      : ` ${Math.round(lagMs)}ms of ${Math.round(mayWaitMs)}ms${oneWay !== null ? " one way" : ""}`;
+      : ` ${Math.round(lagMs)}ms of ${Math.round(mayWaitMs)}ms`;
     parts.push(`${label}=${seen ?? "?"}(gap ${gap ?? "?"} of ${allowance ?? "?"}${lagText})`);
     if (allowance === null) {
       continue;
@@ -442,10 +467,8 @@ export function createDeliveryProbe({
     const rttMs = Number(delivery?.rttMs) || 0;
     /** @type {Map<string, number | null>} */
     const allowed = new Map();
-    /** How long each channel's newest unreported probe may legitimately be. */
+    /** How old each channel's newest reported probe may legitimately be. */
     const allowedWait = new Map();
-    /** The same, for the measured one-way time where the clocks are reconciled. */
-    const allowedOneWay = new Map();
     for (const [channel, label] of connection.channels) {
       let queuedBytes = 0;
       try {
@@ -466,21 +489,13 @@ export function createDeliveryProbe({
         bytesPerSecond,
         rttMs,
         echoIntervalMs: connection.echoIntervalMs,
-        peerLoopLagMs: connection.peerLoopLagMs ?? 0
+        peerLoopLagMs: connection.peerLoopLagMs ?? 0,
+        intervalMs
       });
       const heldWait = allowedWait.get(label);
       if (!Number.isFinite(heldWait) || waitMs > heldWait) {
         allowedWait.set(label, waitMs);
       }
-      // What a probe may take ONE WAY: the queue's own drain time and half the
-      // crossing. Neither the peer's reporting cadence nor its loop delay
-      // belongs here — with the clocks reconciled they are no longer in the
-      // measurement they would have to be allowed for.
-      const oneWayAllowed = allowedWaitMs({ queuedBytes, bytesPerSecond, rttMs: rttMs / 2 });
-      const heldOneWay = allowedOneWay.get(label);
-      if (!Number.isFinite(heldOneWay) || oneWayAllowed > heldOneWay) {
-        allowedOneWay.set(label, oneWayAllowed);
-      }
       // Several channels can carry one label only in malformed cases; the
       // larger allowance is the safer of the two.
       const held = allowed.get(label);
@@ -536,11 +551,6 @@ export function createDeliveryProbe({
         })
       ),
       allowedWaitMs: Object.fromEntries(allowedWait.entries()),
-      // The measured forward delay, where the two clocks have been reconciled.
-      // Preferred over the age above because it is the thing itself: the age
-      // also carries the peer's reporting cadence and the way back.
-      oneWayMs: Object.fromEntries(connection.oneWayMs.entries()),
-      allowedOneWayMs: Object.fromEntries(allowedOneWay.entries()),
       // Same arithmetic for the echo's own age: the peer cannot answer sooner
       // than its own cadence allows, nor sooner than its own event loop runs.
       echoStaleMs:
@@ -656,23 +666,6 @@ export function createDeliveryProbe({
           lastSeenAdvanceAt: 0,
           longestHealthySeenGapMs: 0,
           sentAtBySeq: new Map(),
-          // THE TWO CLOCKS, separated by the exchange rather than assumed to
-          // agree. Every report carries when each channel's newest probe
-          // arrived at the peer and when the report itself left; with the time
-          // this proxy stamped into that probe, and the time the report
-          // arrives, that is the four timestamps an offset is computed from.
-          //
-          // The estimate is kept from the report with the SMALLEST round trip
-          // seen, because that is the one that queued the least — and the two
-          // directions here are as unequal as they get, film one way and almost
-          // nothing the other, which is exactly where an offset taken from a
-          // busy moment is wrong by half the difference.
-          /** @type {number | null} */
-          clockOffsetMs: null,
-          /** @type {number} */
-          offsetFromRoundTripMs: Number.POSITIVE_INFINITY,
-          /** How long the newest probe took to reach the peer, by channel. @type {Map<string, number>} */
-          oneWayMs: new Map(),
           probeCaptureStarted: false,
           timer: null
         };
@@ -741,43 +734,6 @@ export function createDeliveryProbe({
           connection.lastSeenAdvanceAt = now;
         }
       }
-      // THE FOUR TIMESTAMPS. `t1` is when this proxy sent the probe the peer
-      // is reporting, `t2` when the peer received it, `t3` when the peer sent
-      // this report, `t4` is now. From them the round trip is
-      // `(t4 - t1) - (t3 - t2)` — the peer's own thinking time removed — and
-      // the difference between the two clocks is `((t2 - t1) + (t3 - t4)) / 2`.
-      //
-      // The offset is kept from the report whose round trip was SMALLEST: that
-      // arithmetic assumes the two directions are equally quick, which here
-      // they are not — film one way, almost nothing the other — and the least
-      // queued sample is the one where the assumption costs least. A fresh
-      // minimum replaces the estimate, so a clock that jumps is followed within
-      // a few reports rather than believed for ever.
-      const peerSentAt = Number(echo?.sentAt);
-      const seenAt = echo?.seenAt;
-      if (Number.isFinite(peerSentAt) && seenAt && typeof seenAt === "object") {
-        for (const [label, peerSawAtRaw] of Object.entries(seenAt)) {
-          const peerSawAt = Number(peerSawAtRaw);
-          const newestSeenNumber = connection.seen.get(label);
-          const weSentAt = Number.isInteger(newestSeenNumber)
-            ? connection.sentAtBySeq.get(newestSeenNumber)
-            : undefined;
-          if (!Number.isFinite(peerSawAt) || !Number.isFinite(weSentAt)) {
-            continue;
-          }
-          const roundTrip = (now - weSentAt) - (peerSentAt - peerSawAt);
-          if (roundTrip >= 0 && roundTrip < connection.offsetFromRoundTripMs) {
-            connection.offsetFromRoundTripMs = roundTrip;
-            connection.clockOffsetMs = ((peerSawAt - weSentAt) + (peerSentAt - now)) / 2;
-          }
-          if (connection.clockOffsetMs !== null) {
-            // What the probe itself took, one way, with the clocks reconciled.
-            // Negative only if the offset is stale, and then it says so rather
-            // than being hidden.
-            connection.oneWayMs.set(label, peerSawAt - weSentAt - connection.clockOffsetMs);
-          }
-        }
-      }
       // What the far end says it has received at the transport level. It is the
       // one figure that separates a backlog from a stopped association, and it
       // arrives on the direction that goes on working through a freeze.

package/test/audio-warm-recorded.test.js

@@ -0,0 +1,63 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { handleTranscodeAudioWarmGet } from "../routes/transcode/audio-warm/get.js";
+
+// A page restating its soundtrack after a reconnect has to know whether the
+// proxy RECORDED it. Both answers below are 503; only one of them recorded.
+
+function reply() {
+  return {
+    statusCode: 0,
+    payload: undefined,
+    header() {
+      return this;
+    },
+    code(status) {
+      this.statusCode = status;
+      return this;
+    },
+    send(payload) {
+      this.payload = payload;
+      return this;
+    }
+  };
+}
+
+const request = {
+  params: { sessionId: "base", track: "0" },
+  query: { position: "1641.2", consumer: "viewer-1", transcode: "1" }
+};
+
+test("a track still being made says it was recorded", async () => {
+  let preparedFor = null;
+  const answer = await handleTranscodeAudioWarmGet(request, reply(), {
+    renditions: {
+      prepareAudioTrack: async (...args) => {
+        preparedFor = args;
+        return { sessionId: "rendition", fileName: "segment-00268.mp4" };
+      }
+    },
+    serving: {
+      seekEpoch: () => 0,
+      // Anything but a file or a failure is "not made yet".
+      getFileStream: async () => ({ kind: "superseded" })
+    }
+  });
+  assert.deepEqual(preparedFor, ["base", 0, 1641.2, "viewer-1", false]);
+  assert.equal(answer.statusCode, 503);
+  assert.equal(answer.payload.warming, true);
+});
+
+test("a preparation that failed says nothing was recorded", async () => {
+  const answer = await handleTranscodeAudioWarmGet(request, reply(), {
+    renditions: {
+      prepareAudioTrack: async () => {
+        throw new Error("no encoder");
+      }
+    },
+    serving: {}
+  });
+  assert.equal(answer.statusCode, 503);
+  assert.equal(answer.payload.warming, undefined);
+});

package/test/data-channel-viewer-lifecycle.test.js

@@ -90,3 +90,73 @@ test("a closing connection does not release a viewer already named on its replac
     { consumerId: "viewer-1", reason: "the connection closed" }
   ]);
 });
+
+/**
+ * A page on an old connection that raises a trial connection beside it, the
+ * way it does when the old one stops delivering.
+ */
+function trialBeside(gone) {
+  const handler = createDataChannelHandler({
+    proxyPort: 9090,
+    getTransportSnapshot: () => ({ bytesSent: 0, bytesReceived: 0 }),
+    viewersWantingCues: () => ["viewer-1"],
+    onViewerGone: (consumerId, reason) => gone.push({ consumerId, reason })
+  });
+  const old = { control: new FakeDataChannel("proxy-control"), media: new FakeDataChannel("proxy") };
+  const trial = { control: new FakeDataChannel("proxy-control"), media: new FakeDataChannel("proxy") };
+  handler.handleChannel("old-peer", old.control);
+  handler.handleChannel("old-peer", old.media);
+  old.control.message(JSON.stringify({ type: "viewer", consumerId: "viewer-1" }));
+  handler.handleChannel("trial-peer", trial.control);
+  handler.handleChannel("trial-peer", trial.media);
+  trial.control.message(JSON.stringify({ type: "viewer", consumerId: "viewer-1" }));
+  const cuesOn = (channel) => channel.messages.filter((message) => message.includes("subtitle-cues")).length;
+  const push = () =>
+    handler.publishSubtitleCues({
+      sourceKey: "torrent:abc",
+      fileIndex: 0,
+      trackIndex: 0,
+      cues: [{ start: 1, end: 2, text: "line" }],
+      language: "en",
+      detectedLanguage: null,
+      cursor: 1
+    });
+  return { old, trial, cuesOn, push };
+}
+
+test("closing a trial connection keeps the viewer and their cues on the old one", () => {
+  // The old connection delivered again before the trial was adopted, so the
+  // page closes the trial. The viewer never left.
+  const gone = [];
+  const { old, trial, cuesOn, push } = trialBeside(gone);
+  trial.control.close();
+  trial.media.close();
+  assert.deepEqual(gone, [], "the viewer is still on the old connection");
+  push();
+  assert.equal(cuesOn(old.control), 1, "cues reach the channel the viewer named themselves on");
+  old.control.close();
+  old.media.close();
+  assert.deepEqual(gone, [{ consumerId: "viewer-1", reason: "the connection closed" }]);
+});
+
+test("after a trial connection is adopted, cues go to it and the old one's close releases nobody", () => {
+  const gone = [];
+  const { old, trial, cuesOn, push } = trialBeside(gone);
+  push();
+  assert.equal(cuesOn(trial.control), 1, "the newest connection carrying the viewer is used");
+  assert.equal(cuesOn(old.control), 0);
+  old.control.close();
+  old.media.close();
+  assert.deepEqual(gone, []);
+  push();
+  assert.equal(cuesOn(trial.control), 2);
+});
+
+test("a viewer whose newest channel closed is reached on the older connection", () => {
+  const gone = [];
+  const { old, trial, cuesOn, push } = trialBeside(gone);
+  trial.control.close();
+  push();
+  assert.equal(cuesOn(old.control), 1);
+  assert.deepEqual(gone, [], "the trial connection still has its media channel");
+});

package/test/delivery-probe-field.test.js

@@ -0,0 +1,173 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { createDeliveryProbe, PROBE_INTERVAL_MS } from "../services/transport/delivery-probe.js";
+
+// The probe service run end to end, against channels that only record what is
+// sent and a peer whose echoes this file writes. The shapes are the field's of
+// 2026-09-28 (research/stalled-channel-recovery-2026-10-04.md in meta): two
+// connections on one proxy, one healthy and idle, one wedged.
+
+const LABELS = ["proxy", "proxy-control", "proxy-fast"];
+
+/**
+ * A connection with three channels and a peer that echoes on its own cadence.
+ *
+ * `peer.delivering` decides whether the probes reach the far end; while it is
+ * false the far end goes on echoing — the reverse direction keeps working in a
+ * wedge — but the newest number it has seen stays where it stopped.
+ *
+ * @param {import("node:test").TestContext} t
+ * @param {{ rttMs?: number }} [options]
+ */
+function connection(t, { rttMs = 6 } = {}) {
+  t.mock.timers.enable({ apis: ["setInterval", "Date"], now: 0 });
+  const lines = [];
+  const captures = [];
+  const probe = createDeliveryProbe({
+    log: (line) => lines.push(line),
+    readDelivery: () => ({ bytesPerSecond: 3_000_000, rttMs }),
+    getTransportSnapshot: () => ({ remote: "peer" }),
+    witness: {
+      maybeCapture: (trigger) => {
+        captures.push({ at: Date.now(), trigger });
+        return true;
+      }
+    }
+  });
+  // The far end's own clock and how long a probe takes to become a fact there:
+  // half the crossing, and the page handling the message. The page reports
+  // when it saw each probe and when it sent the report, on its own clock — the
+  // timestamps the verdict used to turn into a one-way delay.
+  const PEER_CLOCK_OFFSET_MS = 37;
+  const HANDLING_MS = 4;
+  const peer = { delivering: true, seen: 0, seenAt: 0, channelBytes: 0, loopLagMs: 0, visibility: "visible" };
+  const channels = LABELS.map((label) => ({
+    label,
+    sendMessage(message) {
+      const { seq, sentAt } = JSON.parse(message);
+      if (peer.delivering && seq > peer.seen) {
+        peer.seen = seq;
+        peer.seenAt = sentAt + rttMs / 2 + HANDLING_MS + PEER_CLOCK_OFFSET_MS;
+      }
+    },
+    bufferedAmount: () => 0
+  }));
+  for (const channel of channels) {
+    probe.attach("s1", "s1", channel.label, channel);
+  }
+  const echo = () =>
+    probe.noteEcho("s1", {
+      type: "probe-echo",
+      seen: Object.fromEntries(LABELS.map((label) => [label, peer.seen])),
+      seenAt: Object.fromEntries(LABELS.map((label) => [label, peer.seenAt])),
+      sentAt: Date.now() + PEER_CLOCK_OFFSET_MS,
+      report: {
+        visibility: peer.visibility,
+        loopLagMs: peer.loopLagMs,
+        transportBytesReceived: peer.channelBytes,
+        channels: Object.fromEntries(LABELS.map((label) => [label, { messages: 0, bytes: peer.channelBytes }])),
+        pending: 0
+      }
+    });
+  t.after(() => probe.dispose());
+  return {
+    peer,
+    lines,
+    captures,
+    /**
+     * Run the clock, echoing every `echoEveryMs` — composed just before the
+     * probe of that instant arrives, which is the latest a healthy report can
+     * be.
+     */
+    run(ms, echoEveryMs = PROBE_INTERVAL_MS) {
+      for (let elapsed = 0; elapsed < ms; elapsed += echoEveryMs) {
+        t.mock.timers.tick(echoEveryMs - 1);
+        echo();
+        t.mock.timers.tick(1);
+      }
+    },
+    verdicts(fromMs = 0) {
+      return lines
+        .filter((line) => line.startsWith("[dc-probe]"))
+        .map((line) => ({ verdict: line.split(" ")[2], at: Date.parse(line.match(/at=(\S+)/)[1]) }))
+        .filter((entry) => entry.at >= fromMs);
+    }
+  };
+}
+
+test("an idle healthy connection is not called stopped (2026-09-28, 35cff221)", (t) => {
+  // rtt 6 ms, every queue empty, nothing but probes crossing. The verdict that
+  // compared a one-way delay of 6-54 ms with an allowance of 3 ms printed
+  // `association-stopped` on this connection every five seconds.
+  const link = connection(t);
+  link.run(60_000);
+  // From the first echo on: before it there is nothing to judge.
+  const named = new Set(link.verdicts(PROBE_INTERVAL_MS).map((entry) => entry.verdict));
+  assert.deepEqual([...named], ["flowing"], `every probe was delivered: ${link.lines.at(-1)}`);
+  assert.equal(link.captures.length, 0);
+});
+
+test("a wedge is called stopped within seconds and reaches the witness (2026-09-28, 10b53a7e)", (t) => {
+  // Probe 1464 was the last the peer saw; echoes went on arriving for the
+  // whole minute. The old verdict read `flowing` on every line.
+  const link = connection(t, { rttMs: 26 });
+  link.run(30_000);
+  const wedgedAt = Date.now();
+  link.peer.delivering = false;
+  link.run(30_000);
+  const after = link.verdicts(wedgedAt);
+  const firstStop = after.find((entry) => entry.verdict === "association-stopped");
+  assert.ok(firstStop, `the wedge must be named: ${link.lines.at(-1)}`);
+  assert.ok(firstStop.at - wedgedAt <= 2_000, `named ${firstStop.at - wedgedAt} ms after the last delivery`);
+  assert.equal(after.at(-1).verdict, "association-stopped", "and it stays named while nothing arrives");
+  assert.equal(link.captures.length, 1, "one capture per wedge");
+  assert.ok(link.captures[0].at - wedgedAt <= 3_000, `captured ${link.captures[0].at - wedgedAt} ms in`);
+});
+
+test("delivery resuming clears the verdict and arms the next capture", (t) => {
+  const link = connection(t);
+  link.run(10_000);
+  link.peer.delivering = false;
+  link.run(10_000);
+  assert.equal(link.captures.length, 1);
+  const resumedAt = Date.now();
+  link.peer.delivering = true;
+  link.run(10_000);
+  assert.equal(link.verdicts(resumedAt).at(-1).verdict, "flowing");
+  link.peer.delivering = false;
+  link.run(10_000);
+  assert.equal(link.captures.length, 2, "a second wedge is a second capture");
+});
+
+test("a hidden tab answering late is read as flowing (field 2026-09-03 loop delays)", (t) => {
+  // A hidden tab echoes about once a second and reports its own event loop as
+  // late — 681 → 1881 ms in the field. Every probe still reaches it.
+  const link = connection(t);
+  link.run(10_000);
+  link.peer.visibility = "hidden";
+  link.peer.loopLagMs = 681;
+  link.run(5_000, 1_000);
+  link.peer.loopLagMs = 1881;
+  const hiddenAt = Date.now();
+  link.run(30_000, 2_000);
+  const named = new Set(link.verdicts(hiddenAt).map((entry) => entry.verdict));
+  assert.deepEqual([...named], ["flowing"], `every probe is delivered: ${link.lines.at(-1)}`);
+});
+
+test("late reports while film is still arriving are read as flowing", (t) => {
+  // A hidden tab reports every three seconds and says beforehand that its loop
+  // is that late; the far end's channel byte counter says film is crossing.
+  const link = connection(t);
+  link.run(10_000);
+  link.peer.visibility = "hidden";
+  link.peer.loopLagMs = 3_000;
+  link.run(1_000);
+  const lateAt = Date.now();
+  for (let index = 0; index < 20; index += 1) {
+    link.peer.channelBytes += 4_000_000;
+    link.run(3_000, 3_000);
+  }
+  const named = new Set(link.verdicts(lateAt).map((entry) => entry.verdict));
+  assert.deepEqual([...named], ["flowing"], `film is arriving: ${link.lines.at(-1)}`);
+});

package/test/delivery-probe.test.js

@@ -90,10 +90,11 @@ test("a channel that has never reported counts as behind, not as unknown", () =>
 
 test("the allowance is the queue's own drain time, not a chosen number", () => {
   // 8 MB queued at 8 MB/s is one second of draining; probes go twice a second,
-  // so two of them may legitimately be outstanding, plus the round trip.
+  // so two of them may legitimately be outstanding, plus the one sent after
+  // the peer composed its report, plus the round trip.
   assert.equal(
     allowedGap({ queuedBytes: 8 * 1024 * 1024, bytesPerSecond: 8 * 1024 * 1024, rttMs: 0 }),
-    Math.ceil(1000 / PROBE_INTERVAL_MS)
+    Math.ceil(1000 / PROBE_INTERVAL_MS) + 1
   );
   // An empty queue still allows the one probe that is always in flight.
   assert.equal(allowedGap({ queuedBytes: 0, bytesPerSecond: 8 * 1024 * 1024, rttMs: 0 }), 1);
@@ -132,13 +133,14 @@ test("a burst big enough to explain the lag is not called a stopped association"
 test("the peer's own answering cadence counts toward the allowance", () => {
   // Field case 2026-08-27: queues empty, 3.4 MB/s crossing, tab hidden so the
   // browser echoed about once a second. Without the peer's cadence the
-  // allowance is one probe and every other line read `association-stopped`.
+  // allowance is the probe interval and the crossing — two probes — and every
+  // other line read `association-stopped`.
   const withoutCadence = allowedGap({
     queuedBytes: 0,
     bytesPerSecond: 3.4 * 1024 * 1024,
     rttMs: 9
   });
-  assert.equal(withoutCadence, 1);
+  assert.equal(withoutCadence, 2);
   const withCadence = allowedGap({
     queuedBytes: 0,
     bytesPerSecond: 3.4 * 1024 * 1024,
@@ -227,7 +229,8 @@ test("a frozen tab's own event-loop delay counts toward the allowance", () => {
   // `flowing`. Nothing had stopped: the browser simply could not run the timer
   // that answers a probe.
   // The line printed `gap 12 of 11`; the queue was empty and the round trip
-  // 162 ms, so the cadence term is whatever makes the allowance 11.
+  // 162 ms, so the cadence term is whatever made the allowance 11. The probe
+  // interval, added to the allowance on 2026-10-04, makes the same figures 12.
   const measured = {
     queuedBytes: 0,
     bytesPerSecond: 300,
@@ -236,7 +239,7 @@ test("a frozen tab's own event-loop delay counts toward the allowance", () => {
   };
   const withoutLag = allowedGap(measured);
   const withLag = allowedGap({ ...measured, peerLoopLagMs: 1881 });
-  assert.equal(withoutLag, 11, `the field allowance was 11, not ${withoutLag}`);
+  assert.equal(withoutLag, 12, `11 in the field plus the probe interval, not ${withoutLag}`);
   assert.ok(withLag > 12, `a gap of 12 must fit inside ${withLag}`);
   const allowed = Object.fromEntries(ALL.map((label) => [label, withLag]));
   const { verdict, detail } = readProbeState(
@@ -358,34 +361,20 @@ test("with no send time recorded the count still decides", () => {
   assert.equal(verdict, "association-stopped");
 });
 
-test("the measured one-way time is preferred over the age of the report", () => {
-  // With the clocks reconciled, the proxy knows how long the probe itself took
-  // to reach the peer. The age of the newest reported probe is the same thing
-  // plus the peer's reporting cadence and the way back — so where both are
-  // known, the measurement wins and its allowance carries neither.
+test("a one-way delay of a probe that arrived says nothing about one that did not", () => {
+  // Field 2026-09-28, 10b53a7e: probe 1464 had taken 9 ms, and for the whole
+  // wedge it stayed the newest the peer had seen. A one-way figure in the
+  // state is not read: the age of that probe decides.
   const { verdict } = readProbeState(
     state(
-      { proxy: 40, "proxy-control": 41, "proxy-fast": 42 },
-      {
-        // The age says far behind against its allowance...
-        behindMs: { proxy: 9000, "proxy-control": 9000, "proxy-fast": 9000 },
-        allowedWaitMs: { proxy: 2000, "proxy-control": 2000, "proxy-fast": 2000 },
-        // ...while the probe itself took 300 ms of the 900 its queue may take.
-        oneWayMs: { proxy: 300, "proxy-control": 300, "proxy-fast": 300 },
-        allowedOneWayMs: { proxy: 900, "proxy-control": 900, "proxy-fast": 900 }
-      }
-    )
-  );
-  assert.equal(verdict, "flowing");
-});
-
-test("a one-way time past what the queue can account for is the association", () => {
-  const { verdict } = readProbeState(
-    state(
-      { proxy: 40, "proxy-control": 41, "proxy-fast": 42 },
+      { proxy: 1464, "proxy-control": 1464, "proxy-fast": 1464 },
       {
-        oneWayMs: { proxy: 12_000, "proxy-control": 12_000, "proxy-fast": 12_000 },
-        allowedOneWayMs: { proxy: 900, "proxy-control": 900, "proxy-fast": 900 }
+        seq: 1526,
+        behindMs: { proxy: 30_600, "proxy-control": 30_600, "proxy-fast": 30_600 },
+        allowedWaitMs: { proxy: 1029, "proxy-control": 1029, "proxy-fast": 1029 },
+        oneWayMs: { proxy: 9, "proxy-control": 9, "proxy-fast": 9 },
+        allowedOneWayMs: { proxy: 13, "proxy-control": 13, "proxy-fast": 13 },
+        peerBytesAdvancing: false
       }
     )
   );