pmtiles-swarm 0.91.0 → 0.94.0

package/CHANGELOG.md

@@ -7,6 +7,66 @@
 ### 🐞 Bug fixes
 - _...Add new stuff here..._
 
+## 0.94.0
+### 🐞 Bug fixes
+- **Saving settings rewrote a proxy list nobody had touched.** A trusted-proxy list may be stored as
+  a string — `"loopback, 10.0.0.0/8"` is what the documentation shows — and the box rendered that as
+  one line while reading it back as an array. The two never compared equal, so the field was sent on
+  every Save whether or not anybody had looked at it, and before the previous release that rewrite
+  was the thing that stopped the node from starting. Opening the settings page and pressing Save was
+  enough to do it.
+
+  The box now shows one entry per line whichever way the config wrote them, and records what a save
+  will read back rather than what the config holds — so an untouched field is untouched.
+
+## 0.93.0
+### 🐞 Bug fixes
+- **A trusted-proxy list typed with commas stopped the node from starting.** The settings field
+  split what was typed on newlines only, so one line reading `172.16.1.2, 172.16.1.3` was saved as
+  an array holding both addresses in one string. Express splits a comma list when it is handed a
+  bare string and never inside an array, so proxy-addr was given `172.16.1.2, 172.16.1.3` as a
+  single address and threw -- while the app was being built, before the listener binds. The node
+  would not start, could not be reached, and could not be corrected from the console that had
+  written the value; on the node that found this it was 155 restarts.
+
+  Three things were wrong and all three are fixed. The field now splits on commas as well as
+  newlines. Every shape the setting can be written in -- a string, an array, commas, spaces,
+  newlines -- is flattened to what Express wants. And an entry that is not an address is ignored
+  and logged rather than thrown: this setting is not worth a node that will not boot, and trusting
+  nobody is the safe end of being wrong about it.
+
+- **A failed restore took the whole node down, console included.** Handing the library back to the
+  engine at startup already tolerates a failure per archive; the call coming apart as a whole was
+  unguarded, and it happens before the listener binds — so under `Restart=always` the result is a
+  crash loop with no console to look at and no way to see why. It is now reported and the node
+  starts anyway, where every archive shows as **not loaded** until it is fixed.
+
+- **Nothing tested that the node starts at all.** Every other test builds the pieces `src/index.js`
+  wires together and never runs the wiring, so an import cycle or a step that throws before the
+  listener binds was a failure only a real start could find. There is now a boot test that runs the
+  entry point the way the service does and asks it for a page.
+
+## 0.92.0
+### 🐞 Bug fixes
+- **A stack's TileJSON published the addresses its sources are read from.** A URL source is named by
+  its URL and an S3 source by its bucket and key, and the document naming them is served to anybody
+  who can load the map — while the archives at the other end are read with credentials nobody else
+  has. The sources are gone from it entirely, which was the right answer anyway: they are the
+  ingredients of one endpoint, not a list for a client to join, and listing them invited fetching
+  those instead of the tiles. What is left is a count and a `revision` fingerprint covering the
+  recipe and what every source resolved to — the one thing the list was good for, in twenty bytes
+  rather than tens of kilobytes. The document for a 459-source stack is now 336 bytes.
+
+- **Signing in threw away the view you asked for.** A link to `#stacks` on a guarded node asked for a
+  password and then showed the archives, with the address still reading `#stacks` — which is what
+  made it look broken rather than like a redirect. Both ways into the console now land where the
+  address says.
+
+- **An archive the engine has no record of was drawn as 0%.** That is a different fact from "none of
+  it is here", and it is the more alarming one to get wrong: a library the engine failed to take back
+  after a restart read as a library that had lost its data. The row now says **not loaded**, and says
+  where the reason is logged and that nothing on disk has been touched.
+
 ## 0.91.0
 ### ✨ Features and improvements
 - **A source at a URL can be added by hand, not only imported.** **Add source → an address you

package/docs/configuration.md

@@ -82,8 +82,17 @@ Takes effect on the next request; no restart. See
 ### `trustProxy`
 
 Takes anything Express accepts: `true`, a hop count, or a subnet list such as
-`"loopback, 10.0.0.0/8"`. Off by default, because trusting these headers from an
-untrusted client lets it claim any protocol or address it likes.
+`"loopback, 10.0.0.0/8"`. A list may be written as one string or as an array,
+and either may separate its entries with commas, spaces or newlines — all four
+shapes mean the same thing here. Off by default, because trusting these headers
+from an untrusted client lets it claim any protocol or address it likes.
+
+An entry that is not an address, a subnet, or one of `loopback`, `linklocal`
+and `uniquelocal` is **ignored and logged**, and a value that cannot be read at
+all leaves the node trusting nobody. Deliberately not fatal: Express compiles
+this the moment it is set, which is before the listener binds, so a value it
+refuses used to be a node that would not start, could not be reached, and could
+not be corrected from the console that wrote it.
 
 Set it when a proxy terminates TLS, or the TileJSON will advertise `http://` tile
 URLs that browsers block as mixed content. Setting `publicUrl` instead sidesteps

package/docs/tile-stacks.md

@@ -60,6 +60,7 @@ of its parts.
 - [Syncing a stack to another node](#syncing-a-stack-to-another-node)
 - [What the offline merge got wrong](#what-the-offline-merge-got-wrong)
 - [The stack editor](#the-stack-editor)
+- [Merging vector sources](#merging-vector-sources)
 - [Staging](#staging)
 - [Open questions](#open-questions)
 
@@ -541,21 +542,42 @@ Derived from the resolved sources rather than from any one archive:
 - `attribution` — every source's, concatenated.
 - `tiles` — `/stacks/<id>/{z}/{x}/{y}.<ext>`.
 
-Plus a non-standard `stack` block naming what it resolved to, mirroring the
-`latest` block on `/latest/<category>/tiles.json`, so a consumer can tell one
-resolution from the next:
+Plus a non-standard `stack` block, mirroring the `latest` block on
+`/latest/<category>/tiles.json`, so a consumer can tell one resolution from the
+next:
 
 ```jsonc
 "stack": {
   "id": "planet-terrain",
-  "revision": 7,
-  "sources": [
-    { "category": "gebco", "infohash": "a074186d…", "name": "GEBCO_2026_…" },
-    { "category": "planet-bathymetry", "infohash": "…", "name": "…" }
-  ]
+  "space": "elevation",
+  "sources": 2,
+  "revision": "9f2c1a77b3e04d16"
 }
 ```
 
+`revision` covers the recipe and what every source resolved to, so it moves
+when a category resolves to a new build — which is the whole reason the block
+exists.
+
+### The sources themselves are not in it
+
+They were once, and it was wrong twice over.
+
+A stack's sources are not a client's to join. They are the ingredients of one
+endpoint, and this document exists to point at that endpoint: a map reads
+`tiles`, not the archives behind it. Listing them invites somebody to fetch
+those instead, which is the one thing a stack is there to stop them having to
+do.
+
+And a source may be an **address**. A URL, or a bucket and a key, published in
+a document that is served to anybody who can load the map — while the archive
+at the other end of it is read with credentials nobody else has. The tiles are
+public on purpose; where they come from is not.
+
+What is left says the same thing the list said, in twenty bytes rather than
+tens of kilobytes: how many sources there are, and a fingerprint that moves
+when any of them does.
+
 ## When a source will not answer
 
 A cache-mode source with no reachable peers, a category that resolves to an
@@ -2199,6 +2221,135 @@ Debounced, and it should not follow the map past the stack's `maxzoom`: above
 that the client overzooms and there is nothing new to see, but the tiles are
 still requested and still composited.
 
+## Merging vector sources
+
+**Not built.** This is the design, written down before anything is started so
+that the hard part is on record rather than discovered halfway through it.
+
+Most of the machinery is indifferent to what a tile contains. Source
+resolution, per-source `minzoom`, `maxzoom` and `bounds`, painting order,
+nested stacks, the cache, the ETag, `unionOfTileIds` and the bake all treat a
+tile as an opaque thing, and the byte-for-byte passthrough already serves a
+vector archive today. What a vector space adds is a merge, and the merge is
+where the analogy with the two pixel spaces breaks.
+
+### What has no vector analogue
+
+`opacity`, `blend`, `feather`, `featherMetres`, `gaussianBlurSigma`,
+`output.encoding`, `output.tileSize`, `maskValues`, `maskRange` and
+`maskColors`. Every one of them is an operation on a pixel, and there are no
+pixels. A recipe naming any of them under a vector space should be **refused by
+validation**, not accepted and ignored: a stack that says `feather: 50` and
+draws a hard edge is a worse answer than one that will not save.
+
+The idea of a mask survives in three other forms — clip to a **shape**, keep or
+drop whole **layers** by name, and filter **features** by a property. Those
+three are the vector mask, and none of them is a mask in the sense the
+elevation space means.
+
+### Overlap is the whole problem
+
+The pixel spaces work because the unit is a pixel, every source has one
+everywhere, and "the topmost covered source wins" is a complete rule. Vector's
+unit is a feature. Two sources that both carry a `water` layer over the same
+ground hold **two polygons of the same lake**, and emitting both overwrites
+neither. The tile carries both, the style draws both, and it shows as doubled
+outlines, darker semi-transparent fills, duplicated labels, and z-fighting
+between them.
+
+So the first thing a vector space has to define is what winning means. Three
+answers, and the third is not a default:
+
+**Per-layer replacement.** For each layer _name_, the topmost source carrying it
+supplies it whole, and the same-named layer of every source below is dropped for
+that tile. No geometry work at all: read the layer list, choose, re-emit. It is
+the right answer for a base plus an overlay of layers the base does not have —
+an OSM base under your own `buildings`, or under contours generated from the
+terrain these stacks already merge — and it is correct for a base plus a patch
+wherever the tile falls wholly inside the patch.
+
+**Clip and union.** Each source is clipped to its own coverage, and the source
+below is additionally clipped _against_ the coverage of the one above it, so the
+two cannot both carry the same lake. This is the true counterpart of the pixel
+merge, and the only thing that works on a tile the boundary of a patch runs
+through. A **rectangle** clip in tile coordinates is cheap and exact —
+Sutherland-Hodgman for polygons, Liang-Barsky for lines — and a rectangle is
+what an imported file list states for every patch in it. An arbitrary
+**cutline** is a different matter and wants a real polygon-clipping library.
+
+**Renaming.** The patch's `water` becomes `patch_water`, and the style decides
+what to do with it. No conflict and no geometry work, at the cost of a style
+that has to know. Worth having as a way out; not worth having as the rule.
+
+The recommendation is per-layer replacement as the default, rectangle clipping
+for the base-and-patch case, and a **recipe warning** wherever two sources carry
+the same layer with no clip between them: _sources 0 and 1 both provide `water`,
+and tiles where they meet will carry both_. Silent doubling is the failure that
+gets found six months later by somebody squinting at a coastline.
+
+### A seam cannot be feathered
+
+Where two sources disagree geometrically at a boundary, a road jogs and a
+coastline steps, and there is nothing to fade. [Feathering a
+seam](#feathering-a-seam) works because a pixel can be a mixture of two values.
+A feature cannot be a mixture of two features.
+
+Vector merging is therefore clean only where the sources were cut to agree — the
+same condition that makes a provider's raster patches merge cleanly, minus the
+fade that hides the cases where it is not quite true. That belongs in the
+console rather than on the map.
+
+### Overzooming a parent
+
+Possible, and needed: a base to z12 under a patch to z14 has to climb the base
+at z13, exactly as [resampling from a parent](#resampling-from-a-parent-tile)
+does for pixels. Scale the parent's coordinates by the zoom difference, subtract
+the quadrant's offset, clip to the extent plus the buffer. Exact for geometry,
+and it invents nothing: the generalisation and the label placement were chosen
+for the parent's zoom, so an overzoomed tile is thinner than a real one at that
+zoom and looks it.
+
+### Extent, buffer and schema
+
+Sources at different **extents** — 4096 and 512 are both common — have to be
+normalised to one before anything is combined. A power-of-two ratio is exact;
+anything else quantises coordinates.
+
+**Buffers** have to be re-clipped after any coordinate change, or features leak
+past the edge of the tile and draw twice at the join.
+
+**Schemas** are the quiet one. Two sources whose `water` layers use `class` and
+`kind` merge into a layer the style half understands, and nothing in the merge
+can reconcile them. Worth comparing key sets on the first merged tile and
+reporting the disagreement as a problem on the stack, the way an unresolved
+source is reported.
+
+**Feature ids** collide across sources. Renumbering settles the collision and
+breaks any client-side feature state keyed on them, so it is a choice to make
+out loud rather than a detail to settle inside the encoder.
+
+### The libraries
+
+`@mapbox/vector-tile` and `pbf` to read, `vt-pbf` to write. Small, pure
+JavaScript, and ordinary dependencies rather than a probe: the optional
+treatment [the codec gets](#the-codec-problem) exists because a native build
+genuinely fails to install on some platforms, and none of that applies here.
+
+Not written here either, unlike the PMTiles writer and the S3 signer. A protobuf
+round-trip has more edge cases than either — geometry command encoding, unknown
+value types, key and value pools shared across features — and getting one wrong
+produces a tile that parses and is subtly wrong.
+
+### Staging, when it is started
+
+1. **Layer operations only.** `space: "vector"`, with keep, drop and rename by
+   layer name, over the per-source zoom and bounds skipping that already exists.
+   Covers base-plus-overlay, and needs no geometry code whatsoever.
+2. **Overzoom and rectangle clipping.** Covers base-plus-patch, which is the
+   shape [importing a list of URLs](#importing-a-list-of-urls) makes easy to
+   build.
+3. **Cutline clipping and property filters.**
+
 ## Staging
 
 1. ~~**Recipe and resolution.**~~ Done. `data/stacks.json`, load and validate,
@@ -2230,10 +2381,11 @@ handling whatsoever.
 
 ## Open questions
 
-- **Vector tiles.** Merging MVT layers from two archives is a real want and a
-  completely different operation — decode protobuf, merge layer by layer,
-  re-encode, with feature ID collisions to settle. It should be its own feature
-  and should not be smuggled in under `space`.
+- **Vector tiles.** Designed rather than open now: see [merging vector
+  sources](#merging-vector-sources). It is its own space and its own merge,
+  and what stays open is whether the overlap rule proposed there — layer
+  replacement by default, clipping for a patch — holds up against a real
+  pair of archives.
 - **Does the recipe travel?** A stack is a small JSON document and the feed
   already distributes documents. Publishing recipes so a subscriber gets the
   stack along with its sources is attractive, and raises an obvious question

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pmtiles-swarm",
-  "version": "0.91.0",
+  "version": "0.94.0",
   "description": "BitTorrent distribution for PMTiles map archives: create torrents, watch folders, publish and subscribe to RSS feeds, and seed through qBittorrent or an embedded client",
   "type": "module",
   "main": "src/index.js",

package/src/api.js

@@ -22,7 +22,12 @@ import {
 import { mutableMagnet, trackersFromMagnet } from './mutable.js';
 import { guessKind } from './library.js';
 import { QBittorrentEngine } from './engines/qbittorrent.js';
-import { RESTART_REQUIRED, redactConfig, saveConfig } from './config.js';
+import {
+  RESTART_REQUIRED,
+  redactConfig,
+  saveConfig,
+  trustProxyFor,
+} from './config.js';
 import { freeSpace, listLocations } from './locations.js';
 import { restart, restartMode } from './restart.js';
 import { parseFeed, renderFeed } from './feed.js';
@@ -50,15 +55,7 @@ import {
   stackCoverage,
   stackEtag,
 } from './stacks.js';
-
-/**
- * How many sources a stack's TileJSON names before it starts counting.
- *
- * Generous for a hand-written recipe -- those run to a handful -- and a hard
- * stop for one imported from a provider's index, where the list is hundreds
- * long and every entry is an address no client reads.
- */
-const TILEJSON_SOURCE_LIMIT = 25;
+import { bakeRevision } from './bake.js';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 
@@ -268,7 +265,26 @@ export function createApp({
   // the TileJSON advertises http:// tile URLs. A browser that loaded the map
   // over https then blocks every one of them as mixed content, which looks
   // like an empty map rather than like a configuration mistake.
-  if (config.trustProxy) app.set('trust proxy', config.trustProxy);
+  //
+  // Normalised first, and then guarded anyway. Express compiles this value
+  // the moment it is set, which is before the listener binds -- so a value it
+  // cannot compile is not a setting that fails to apply, it is a node that
+  // will not start, cannot be reached, and cannot be corrected from the
+  // console that wrote it. Nothing about which addresses to trust is worth
+  // that: an unparseable one is reported and the node comes up trusting
+  // nobody, which is the safe end of being wrong.
+  const trustProxy = trustProxyFor(config.trustProxy);
+  if (trustProxy !== false) {
+    try {
+      app.set('trust proxy', trustProxy);
+    } catch (error) {
+      console.error(
+        `[config] trustProxy could not be applied (${error.message}). ` +
+          'X-Forwarded-* headers are being ignored; the node is starting ' +
+          'anyway so this can be corrected from Settings.',
+      );
+    }
+  }
   app.use(express.json({ limit: '1mb' }));
 
   // Tiles, TileJSON and the feed stay public — serving them is the point.
@@ -3800,34 +3816,27 @@ export function createApp({
         minzoom: coverage.minzoom,
         maxzoom: coverage.maxzoom,
         bounds: coverage.bounds,
-        // Names what it resolved to, so a consumer can tell one resolution
-        // from the next without diffing tile URLs — the same reason the
-        // `/latest/` document carries a `latest` block.
+        // Says that it resolved, and whether the resolution has moved, so a
+        // consumer can tell one from the next without diffing tile URLs --
+        // the same reason the `/latest/` document carries a `latest` block.
+        //
+        // A count and a fingerprint rather than the sources themselves. They
+        // were listed here once, and it was wrong twice over. A stack's
+        // sources are not a client's to join: they are the ingredients of one
+        // endpoint, and a document listing them invites somebody to fetch
+        // those instead of the tiles. And a source may be an address -- a URL,
+        // or a bucket and a key -- which this document has no business
+        // publishing: the tiles are public where the archives behind them are
+        // read with credentials nobody else has.
         //
-        // Capped. A stack imported from a provider's file index has hundreds
-        // of sources — Mapterhorn's is 458 — and listing every one puts tens
-        // of kilobytes of addresses in a document every map load fetches, to
-        // say something no client does anything with. What the block is for is
-        // telling one resolution from the next, and what moves between
-        // resolutions is the infohashes, so those are what it keeps.
+        // The fingerprint covers the recipe and what every source resolved
+        // to, so it moves when a category resolves to a new build. That was
+        // the only thing the list was good for.
         stack: {
           id: resolved.stack.id,
           space: resolved.stack.space ?? 'elevation',
-          sources: resolved.sources
-            .slice(0, TILEJSON_SOURCE_LIMIT)
-            .map((source) => ({
-              name: source.name,
-              infohash: source.entry?.infoHash ?? null,
-              archive: source.entry?.name ?? null,
-            })),
-          // Said rather than silently truncated: a consumer comparing two of
-          // these has to know it is looking at part of a list.
-          ...(resolved.sources.length > TILEJSON_SOURCE_LIMIT
-            ? {
-                more: resolved.sources.length - TILEJSON_SOURCE_LIMIT,
-                total: resolved.sources.length,
-              }
-            : {}),
+          sources: resolved.sources.length,
+          revision: bakeRevision(resolved),
         },
       };
       // A stack says how its tiles are encoded, so a style pointing at it does

package/src/config.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs/promises';
+import net from 'node:net';
 import { hashPassword } from './auth.js';
 import path from 'node:path';
 
@@ -10,6 +11,79 @@ import path from 'node:path';
  * Every setting is documented in docs/configuration.md. Comments here say only
  * what a value is; why it is what it is belongs in the document.
  */
+/** What proxy-addr accepts as a name for a group of addresses. */
+const TRUST_KEYWORDS = new Set(['loopback', 'linklocal', 'uniquelocal']);
+
+/**
+ * Whether one entry of a trust list is something proxy-addr can compile.
+ * @param {string} entry - One address, subnet or keyword.
+ * @returns {boolean} - True if it is usable.
+ */
+function isTrustEntry(entry) {
+  if (TRUST_KEYWORDS.has(entry)) return true;
+  const [address, mask, ...rest] = entry.split('/');
+  if (rest.length > 0) return false;
+  if (!net.isIP(address)) return false;
+  if (mask === undefined) return true;
+  if (net.isIP(mask)) return true;
+  const bits = Number(mask);
+  if (!Number.isInteger(bits) || bits < 0) return false;
+  return bits <= (net.isIP(address) === 6 ? 128 : 32);
+}
+
+/**
+ * What to hand Express as `trust proxy`, from what the config says.
+ *
+ * Express takes four different things here and means something different by
+ * each, and it splits a comma-separated list only when it is handed a bare
+ * string -- never inside an array. So `["10.0.0.1, 10.0.0.2"]`, which is what
+ * a settings field split on newlines alone produces from one line with a
+ * comma in it, reaches proxy-addr as a single address, and proxy-addr throws.
+ *
+ * That throw happened while the app was being built, before the listener
+ * bound: a node that could not start, could not be reached, and could not be
+ * corrected from the console that wrote the value. So every shape is
+ * flattened here, and anything left that is not an address is dropped with a
+ * warning rather than carried into Express.
+ * @param {boolean|number|string|string[]} value - `config.trustProxy`.
+ * @returns {boolean|number|string[]} - Something Express can compile.
+ */
+export function trustProxyFor(value) {
+  if (
+    value === true ||
+    value === false ||
+    value === undefined ||
+    value === null
+  ) {
+    return value === true;
+  }
+  if (typeof value === 'number') return Number.isFinite(value) ? value : false;
+
+  const entries = (Array.isArray(value) ? value : [value])
+    .flatMap((one) => String(one).split(/[\s,]+/))
+    .map((one) => one.trim())
+    .filter(Boolean);
+  if (!entries.length) return false;
+
+  // A lone number is a hop count, and a lone `true` trusts everybody. Both
+  // are things somebody may type into a field that mostly takes addresses.
+  if (entries.length === 1) {
+    if (entries[0] === 'true') return true;
+    if (entries[0] === 'false') return false;
+    if (!Number.isNaN(Number(entries[0]))) return Number(entries[0]);
+  }
+
+  const usable = entries.filter((entry) => isTrustEntry(entry));
+  for (const entry of entries) {
+    if (usable.includes(entry)) continue;
+    console.warn(
+      `[config] trustProxy: ignoring "${entry}", which is not an address, ` +
+        'a subnet, or one of loopback, linklocal, uniquelocal.',
+    );
+  }
+  return usable.length ? usable : false;
+}
+
 const DEFAULTS = {
   port: 8090,
   host: '0.0.0.0',

package/src/index.js

@@ -339,11 +339,28 @@ PMTILES_SWARM_PUBLIC_URL
 
   const catalogued = catalog.list().length;
   if (catalogued > 0) {
-    const { restored, failed } = await library.restore();
-    console.log(
-      `[restore] ${restored} of ${catalogued} archives handed back to the engine` +
-        (failed > 0 ? ` (${failed} could not be)` : ''),
-    );
+    // Reported, never fatal. Restore already tolerates a failure per archive;
+    // what this catches is the whole call coming apart -- and the node it
+    // takes down with it is the one that could have said so. Under
+    // `Restart=always` that is a crash loop with no console to look at, which
+    // is a worse failure than a library that is not being seeded: the console
+    // marks an archive the engine has no record of as `not loaded`, so a node
+    // that comes up says exactly what went wrong here.
+    try {
+      const { restored, failed } = await library.restore();
+      console.log(
+        `[restore] ${restored} of ${catalogued} archives handed back to the engine` +
+          (failed > 0 ? ` (${failed} could not be)` : ''),
+      );
+    } catch (error) {
+      console.error(
+        `[restore] could not hand the library back to the engine: ` +
+          `${error.stack ?? error.message}
+` +
+          '[restore] the node is starting anyway; every archive will show as ' +
+          'not loaded until this is fixed and it is restarted.',
+      );
+    }
   }
 
   // And again if the engine loses its backing process and starts another. A

package/src/web/index.html

@@ -1875,6 +1875,11 @@
         for (const entry of shown) {
           const s = entry.status ?? {};
           const progress = s.progress ?? 0;
+          // The engine has never mentioned this archive. That is not the same
+          // fact as "none of it is here", and drawing it as 0% said the second
+          // -- so a library the engine failed to take back after a restart
+          // read as a library that had lost its data.
+          const known = Boolean(entry.status);
           const mode = entry.mode ?? 'mirror';
           const tr = document.createElement('tr');
           if (entry.infoHash === selected) tr.className = 'on';
@@ -1893,12 +1898,14 @@
             <td>${added(entry.createdAt)}</td>
             <td><span class="pill ${mode}">${mode}</span></td>
             <td>${originCell(entry)}</td>
-            <td>
-              <div class="track">
-                <i class="${progress >= 1 ? 'done' : ''}" style="width:${Math.min(100, progress * 100)}%"></i>
-              </div>
-              <div class="sub">${pct(progress)}</div>
-            </td>
+            <td>${
+              known
+                ? `<div class="track">
+                     <i class="${progress >= 1 ? 'done' : ''}" style="width:${Math.min(100, progress * 100)}%"></i>
+                   </div>
+                   <div class="sub">${pct(progress)}</div>`
+                : `<div class="sub bad" title="The engine has no record of this archive, so nothing here is being seeded or downloaded. It usually means the restore after a restart could not hand it back — the log says why, under [restore]. Nothing has been deleted; the data on disk is untouched.">not loaded</div>`
+            }</td>
             <td title="${peersTitle(s)}">${s.peers ?? 0} / ${s.seeds ?? 0}${swarmSuffix(s)}</td>
             <td>${rate(s.downloadSpeed)}</td>
             <td>${rate(s.uploadSpeed)}</td>
@@ -5572,11 +5579,15 @@ Every piece is hashed against the ` +
               type: 'addresses',
               placeholder: 'off — or one address or subnet per line',
               help:
-                'One per line: 172.16.1.49, or 172.16.1.0/24, or several. A ' +
-                'lone number is read as a hop count instead, and a lone `true` ' +
-                'trusts any caller at all — worth avoiding, since this header ' +
-                'is what decides which address the node believes a request ' +
-                'came from.',
+                'An address or a subnet — <code>172.16.1.49</code>, ' +
+                '<code>172.16.1.0/24</code>, <code>loopback</code> — one ' +
+                'per line, or separated by commas. A lone number is read ' +
+                'as a hop count instead, and a lone <code>true</code> ' +
+                'trusts any caller at all, which is worth avoiding: this ' +
+                'header is what decides which address the node believes a ' +
+                'request came from. Anything that is not an address is ' +
+                'ignored and said so in the log, rather than stopping the ' +
+                'node from starting.',
             },
             {
               key: 'publicIndex',
@@ -6300,7 +6311,14 @@ Every piece is hashed against the ` +
               field.type === 'secret'
                 ? `<input type="password" autocomplete="new-password" data-setting="${field.key}"${locked} data-type="secret" data-initial="&quot;&quot;" value="" placeholder="${escapeHtml(field.placeholder ?? 'unchanged')}" />`
                 : field.type === 'addresses'
-                ? `<textarea data-setting="${field.key}"${locked} data-type="addresses"${initial} rows="3" placeholder="${escapeHtml(field.placeholder ?? '')}">${escapeHtml(Array.isArray(value) ? value.join('\n') : value === undefined || value === null ? '' : String(value))}</textarea>`
+                ? // Its own initial, because this is the one field whose
+                    // box holds a different shape from the config. A
+                    // stored string never compares equal to the array
+                    // the box parses to, so sharing `initial` meant
+                    // every Save rewrote a setting nobody had touched
+                    // -- which is how a value that worked became one
+                    // the node would not start with.
+                    `<textarea data-setting="${field.key}"${locked} data-type="addresses" data-initial="${escapeHtml(JSON.stringify(parseAddresses(addressText(value))))}" rows="3" placeholder="${escapeHtml(field.placeholder ?? '')}">${escapeHtml(addressText(value))}</textarea>`
                 : field.type === 'list'
                 ? `<textarea data-setting="${field.key}"${locked} data-type="list"${initial} rows="${Math.min(8, Math.max(3, (Array.isArray(value) ? value.length : 0) + 1))}" placeholder="${escapeHtml(field.placeholder ?? '')}">${escapeHtml((Array.isArray(value) ? value : []).join('\n'))}</textarea>`
                 : field.type === 'boolean'
@@ -6330,6 +6348,56 @@ Every piece is hashed against the ` +
         return panel;
       }
 
+      /**
+       * The entries an address field holds, however the config wrote them.
+       *
+       * A list may be stored as an array or as one comma-separated string --
+       * Express accepts both, and the documented example is a string. Shown
+       * one per line either way, so that what a save reads back is the list
+       * that was rendered rather than a different shape of the same thing.
+       * @param {null|boolean|number|string|string[]} value - What the config holds.
+       * @returns {string} - The textarea's contents.
+       */
+      const addressText = (value) => {
+        if (value === undefined || value === null) return '';
+        const entries = Array.isArray(value) ? value : [String(value)];
+        return entries
+          .flatMap((entry) => String(entry).split(/[\n,]/))
+          .map((entry) => entry.trim())
+          .filter(Boolean)
+          .join('\n');
+      };
+
+      /**
+       * What an address field means by what it holds.
+       *
+       * Express takes four things here and means something different by each:
+       * `true` trusts any caller, a number is a hop count, and a string or an
+       * array of them names the proxies. What was typed decides which.
+       *
+       * Commas separate as well as newlines. Express splits a comma list only
+       * when it is handed a bare string and never inside an array, so one line
+       * reading `10.0.0.1, 10.0.0.2` was saved as a one-element array holding
+       * both -- which is not an address, and which Express rejects while the
+       * app is being built, before the listener binds. The node then would not
+       * start, and could not be corrected from the console that wrote it.
+       * @param {string} text - What the box holds.
+       * @returns {null|boolean|number|string[]} - What to save.
+       */
+      const parseAddresses = (text) => {
+        const lines = String(text)
+          .split(/[\n,]/)
+          .map((line) => line.trim())
+          .filter(Boolean);
+        if (!lines.length) return null;
+        if (lines.length === 1) {
+          if (lines[0] === 'true') return true;
+          if (lines[0] === 'false') return false;
+          if (!Number.isNaN(Number(lines[0]))) return Number(lines[0]);
+        }
+        return lines;
+      };
+
       /**
        * Collects every schema control into an update, grouped by top-level key.
        *
@@ -6361,22 +6429,8 @@ Every piece is hashed against the ` +
             continue;
           }
           if (type === 'boolean') value = element.checked;
-          else if (type === 'addresses') {
-            // Express takes four things here and means something different by
-            // each: `true` trusts any caller, a number is a hop count, and a
-            // string or an array of them names the proxies. One per line, and
-            // what was typed decides which of the four it is.
-            const lines = String(element.value)
-              .split('\n')
-              .map((line) => line.trim())
-              .filter(Boolean);
-            if (!lines.length) value = null;
-            else if (lines.length === 1 && (lines[0] === 'true' || lines[0] === 'false')) {
-              value = lines[0] === 'true';
-            } else if (lines.length === 1 && !Number.isNaN(Number(lines[0]))) {
-              value = Number(lines[0]);
-            } else value = lines;
-          } else if (type === 'list') {
+          else if (type === 'addresses') value = parseAddresses(element.value);
+          else if (type === 'list') {
             // One per line, which is how a person reads a list of trackers —
             // and empty means an empty list rather than "unset", because a
             // node with no trackers is a real thing to want and JSON would
@@ -7506,6 +7560,22 @@ Every piece is hashed against the ` +
         return TABS.includes(named) ? named : null;
       };
 
+      /**
+       * Lands on the view the address names, once there is a console to land
+       * in.
+       *
+       * Two ways in, and both have to honour it: opening the page already
+       * signed in, and signing in on arrival. Only the first did, so following
+       * a link to `#stacks` on a guarded node asked for a password and then
+       * showed the archives -- the address still saying `#stacks`, which is
+       * the part that makes it read as broken rather than as a redirect.
+       * @returns {void}
+       */
+      const landFromUrl = () => {
+        const named = tabFromUrl();
+        if (named && named !== 'archives') showTab(named);
+      };
+
       // The footer's year, set from the clock rather than typed into a file
       // nobody will remember to edit. The version beside it arrives with the
       // first status, and reads "…" until then.
@@ -9451,6 +9521,7 @@ Every piece is hashed against the ` +
           $('login').hidden = true;
           $('login-pass').value = '';
           refresh();
+          landFromUrl();
         } catch (error) {
           $('login-error').textContent = error.message;
         }
@@ -9476,8 +9547,7 @@ Every piece is hashed against the ` +
         refresh();
         // After the archives have been asked for, so the tab that opens is the
         // one asked for and not the one this happens to start on.
-        const named = tabFromUrl();
-        if (named && named !== 'archives') showTab(named);
+        landFromUrl();
       }
 
       start();