sailkick-boat 0.27.0 → 0.29.0

package/README.md

@@ -188,6 +188,21 @@ POST /plugins/sailkick-boat/cache/clear?prefix=tiles/seamap        # nuke one ti
 when clearing — the default keep already does. A hand-typed `find` clear should add
 `! -name history` alongside `! -name tiles ! -name terrain`.)
 
+**A pinned file that was cached wrong stays wrong.** Tiles have no expiry, which is the
+whole point — but it means a bug in the *transport* outlives its fix. The pre-0.23.9
+client stored still-gzipped bytes as if they were the payload (core `http` hands back the
+compressed stream where `fetch` decoded it), and Cesium read the gzip header as a vertex
+count: `Invalid typed array length: 11239580910`. Fixing the transport fixed new fetches
+and nothing else: 2,391 terrain tiles and 188 vector tiles kept throwing for weeks after,
+because nothing ever re-examined a stored file.
+
+So a cache HIT is now checked — two bytes of a buffer already read. A file that claims to
+be quantized-mesh or protobuf and begins `1f 8b` is dropped and re-fetched (`REPAIRED`);
+if the upstream is unreachable the request FAILS rather than serving the poison again,
+because a renderer handed a gzip header errors hard while a missing tile simply falls back
+to its parent. Content that is legitimately gzip — a `.gz` asset, a gzip content-type — is
+left alone: that is a payload, not an encoding.
+
 ## Offline map coverage — global base seed + region prefetch
 On-demand caching only holds what you browsed. To make a usable map exist offline
 *everywhere*, the plugin seeds a worldwide low-zoom base on start and lets you warm a
@@ -712,15 +727,44 @@ cloud, in-memory ring on a DB-less edge*. The boat is a third case — an edge t
 serves the app's history endpoints from its **own** live data:
 ```
 GET /api/history/series?window=3600s&every=30s -> { series: { sog|heading|tws|… : [[tMs,val],…] } }
+GET /api/history/series?…&stats=1&chans=sog,aws -> { series: {…}, bands: { sog: [[t,min,max],…] } }
 GET /api/history/track?window=3600s&every=10s  -> { track: [{ t, lat, lon }, …] }
 GET /api/history/track?from=<epochMs>&to=<epochMs>   (absolute range; ISO also accepted)
 ```
+**Gusts: `stats=1` adds true min/max bands under the mean.** A mean line hides the thing
+you actually want to see — the app measured an hour of real sailing at 20 s buckets where
+the mean spanned 4.8 kt and the true envelope spanned 8.3 kt, with 1.87 kt of spread
+hidden inside an average bucket. That spread only exists if it is *recorded*: the ring
+polls BoatState every second into a per-channel `{sum, cnt, lo, hi}` accumulator and emits
+one row per sample interval carrying the mean plus the true extremes seen inside it. It
+used to snapshot instead, throwing away 14 of every 15 readings before anything could ask
+a question about them — no later bucketing, on the boat or in the browser, can bring those
+back.
+
+A useful side-effect: the auto-coarsening that keeps the ring under `MAX_SAMPLES` is no
+longer lossy. Only the *emit* rate coarsens, never the poll, so a 30-day passage emitting
+every ~52 s still carries the true min/max within each 52 s.
+
+**Compass channels never get a band** — `twd`, `twa`, `awa`, `cog`, `heading`, `wptBrg`.
+The mean of 359° and 1° is 180°, the exact opposite of the truth, so those carry a
+last-reading snapshot and no band, ever. It is the one error here that would look entirely
+plausible on screen, so the tests pin it.
+
+`chans=sog,aws` narrows the answer to the channels actually plotted; `bands` appears only
+when `stats=1` was asked *and* the provider produced them, so every client degrades to the
+plain line. `series` is unchanged with or without either param.
+
 Both endpoints take **either** a trailing `window`, **or** an absolute `from`/`to` —
 which is what the app sends whenever the view is scrolled back in time (the historic
 trail, and a Trends flyout on a past period). The response echoes the `from`/`to` it
 actually served. Before 0.24.0 the boat parsed only `window`, so a request for a past
 hour came back `200` with the **most recent** hour: the historic trail silently showed
-live data. `every` thins a long track and always keeps the first and newest fix.
+live data. `every` thins a long track and always keeps the first and newest fix; on
+`series` it re-buckets (means weighted by the sample count behind each row, extremes as
+min-of-mins), labelling each bucket at its **end** to match the cloud's
+`aggregateWindow(timeSrc: "_stop")` — label them at the start and the two providers plot
+half a bucket apart on the same screen. It is floored so one answer stays under ~3k
+points, as the cloud route does.
 
 Same JSON the cloud returns, so the browser can't tell the difference — but it
 works **offline** with the boat's own data. Only when no telemetry source is

package/lib/history/index.js

@@ -26,6 +26,10 @@ const wrap180 = (d) => { const x = wrap360(d); return x > 180 ? x - 360 : x }
 
 // Parse a duration like "1h" / "30m" / "600s" / "3600" → seconds, clamped.
 // Ported from the app's server/routes/history.js so limits match exactly.
+// One response has to stay drawable and sendable over a satellite link; the cloud route
+// uses the same ceiling.
+const MAX_POINTS = 3000
+
 function dur (s, def, min, max) {
   if (s == null) return def
   const m = String(s).trim().match(/^(\d+)\s*([smh]?)$/)
@@ -127,12 +131,24 @@ function createHistory (app, options) {
     if (!available()) return sendJson(res, 503, { ok: false, code: 'history-unavailable', message: 'history not available' })
     const q = query(req.url)
     const windowSec = dur(q.get('window'), 3600, 60, 86400)
-    const everySec = dur(q.get('every'), 30, 5, 600)
     const abs = absRange(q)
+    // Floor the bucket so one answer stays drawable. An absolute range can be a month
+    // wide, and at the default 30 s that is 86,400 points down a link that may be
+    // Starlink on a bad night — the cloud route floors it the same way, so both providers
+    // return the same shape for the same request.
+    const spanSec = abs ? Math.max(1, Math.round((abs.toMs - abs.fromMs) / 1000)) : windowSec
+    const everySec = Math.max(dur(q.get('every'), 30, 5, 600), Math.ceil(spanSec / MAX_POINTS))
+    // Both additive and both ignorable, so a client that knows nothing of them is served
+    // exactly what it was served before. `stats=1` asks for the true per-bucket min/max
+    // under the mean — the gusts, which a mean line hides: on an hour of real sailing the
+    // mean spanned 4.8 kt where the true envelope spanned 8.3 kt. `chans=sog,aws` narrows
+    // the answer to what is actually plotted.
+    const stats = /^(1|true|yes)$/i.test(String(q.get('stats') || ''))
+    const chans = String(q.get('chans') || '').split(',').map((c) => c.trim()).filter(Boolean)
     try {
-      const r = await provider.getSeries({ windowSec, everySec, ...(abs || {}), signal: abortOnClose(res) })
+      const r = await provider.getSeries({ windowSec, everySec, stats, chans, ...(abs || {}), signal: abortOnClose(res) })
       if (!r.ok) return sendJson(res, r.status || 502, { ok: false, code: 'history-error', message: r.message })
-      sendJson(res, 200, {
+      const body = {
         ok: true,
         windowSec,
         everySec,
@@ -140,7 +156,11 @@ function createHistory (app, options) {
         from: abs ? abs.fromMs : Date.now() - windowSec * 1000,
         to: abs ? abs.toMs : Date.now(),
         series: r.series
-      })
+      }
+      // Only when asked AND produced: a client that sent stats=1 must still degrade to
+      // the plain line rather than wait for a key that never comes.
+      if (stats && r.bands) body.bands = r.bands
+      sendJson(res, 200, body)
     } catch (e) {
       sendJson(res, 502, { ok: false, code: 'history-error', message: e.message })
     }

package/lib/history/ring.js

@@ -6,15 +6,28 @@
 // series/track contract as the InfluxDB provider; TWS/TWD are derived from apparent
 // wind + boat motion (as the ribbon does), STW is simply absent.
 //
+// Each emitted row carries, per linear channel, the MEAN over the interval plus the true
+// min/max seen inside it (`lo`/`hi`) and the sample count behind the mean (`n`) — see the
+// two-clocks note in the constructor. Compass channels carry a last-reading snapshot and
+// none of the three, because a bearing has no arithmetic mean.
+//
 // Persistence (optional, `persistFile`): a JSONL APPEND-LOG so the ring survives
-// restarts and can cover a long passage cheaply. Each sample is appended as one
-// line (~160 B); the file is compacted (atomic rewrite to the current window) only
-// rarely — on start, once appends exceed the ring length, and on destroy — so write
-// load is per-sample, decoupled from window size (< ~1 GB over a 30-day passage vs
-// ~600 GB for a full-rewrite-every-2min snapshot). To keep RAM/disk bounded at any
-// window, the sample rate auto-coarsens so the ring never exceeds ~MAX_SAMPLES rows
-// (24 h → 15 s, 30 d → ~52 s). All fs is guarded — a missing/corrupt file just means
-// an empty start; appends + compactions are serialized so they can't interleave.
+// restarts and can cover a long passage cheaply. Each row is appended as one line; the
+// file is compacted (atomic rewrite to the current window) only rarely — on start, once
+// appends exceed the ring length, and on destroy — so write load is per-sample,
+// decoupled from window size. Measured on a fully-populated row (every channel present):
+// 307 B before the bands, 844 B with them, i.e. 2.7x. A 30-day passage is ~49.8k rows
+// (the emit rate auto-coarsens to ~52 s, see below), so ~40 MB of appends plus ~2x that
+// again in compaction rewrites — against ~600 GB for a full-rewrite-every-2min snapshot,
+// and still nothing on a boat SSD.
+//
+// To keep RAM/disk bounded at any window, the EMIT rate auto-coarsens so the ring never
+// exceeds ~MAX_SAMPLES rows (24 h → 15 s, 30 d → ~52 s). That coarsening used to throw
+// readings away; it no longer does. Only the emit rate coarsens, never the poll, so a
+// 30-day passage still carries the true min/max within each ~52 s bucket.
+//
+// All fs is guarded — a missing/corrupt file just means an empty start; appends +
+// compactions are serialized so they can't interleave.
 
 const fs = require('fs')
 const fsp = fs.promises
@@ -43,7 +56,18 @@ const CHANNELS = [
   // drawn over it.
   'perf'
 ]
+// The channels whose values WRAP. A compass bearing cannot be averaged or min/max'd
+// arithmetically — the mean of 359° and 1° is 180°, the exact opposite of the truth — so
+// these keep a plain snapshot of the LAST reading in the interval and never carry a band.
+// Everything else is linear and gets both. Same split as the app's ring provider; a
+// mistake here would look entirely plausible on screen, which is why the test pins it.
+const WRAPPED = new Set(['twd', 'twa', 'awa', 'cog', 'heading', 'wptBrg'])
+
 const wrap360 = (d) => ((d % 360) + 360) % 360
+// Stored values are rounded to 3 decimals. Rows now carry a mean plus two extremes per
+// channel, so full float noise ("6.430000000000001") would inflate every persisted line
+// for precision no instrument has and no chart can draw.
+const round3 = (v) => (Number.isFinite(v) ? Math.round(v * 1000) / 1000 : v)
 const MAX_SAMPLES = 50000
 
 // True wind (TWS kt, TWD ° the wind blows FROM).
@@ -71,10 +95,10 @@ function trueWind (s) {
 }
 
 class RingHistoryProvider {
-  constructor ({ source, perfSource, sampleSec, windowSec, persistFile } = {}) {
+  constructor ({ source, perfSource, sampleSec, pollSec, windowSec, persistFile } = {}) {
     this._source = source
     this._perfSource = perfSource || null
-    this._ring = [] // [{ t, ...CHANNELS, lat, lon }]
+    this._ring = [] // [{ t, ...CHANNELS, lo:{}, hi:{}, n:{}, lat, lon }]
     const win = windowSec || 3600
     this._windowMs = win * 1000
     this._persistFile = persistFile || null
@@ -83,45 +107,112 @@ class RingHistoryProvider {
     // auto-coarsen so the ring is bounded (~MAX_SAMPLES rows) regardless of window
     const stepSec = Math.max(sampleSec || 15, Math.ceil(win / MAX_SAMPLES))
     this._stepSec = stepSec
+    // TWO CLOCKS. This used to SNAPSHOT BoatState once per stepSec and store point values,
+    // which threw away 14 of every 15 readings BEFORE anything could ask a question about
+    // them: the gusts were gone before a chart ever saw the data, and no amount of later
+    // bucketing could bring them back. Now the state is POLLED at pollSec (~1 s, the rate
+    // the boat publishes) into a per-channel sum/count/min/max accumulator, and one row is
+    // EMITTED every stepSec carrying the mean plus the true extremes seen inside it.
+    //
+    // Ring length and emit rate are unchanged, so every existing budget still holds — and
+    // MAX_SAMPLES coarsening stops being lossy: a 30-day passage emitting every ~52 s
+    // still carries the true min/max within each 52 s, because the poll never coarsened.
+    this._pollSec = Math.min(stepSec, Math.max(0.2, pollSec || 1))
+    this._resetAcc()
 
     this._load() // seed from disk (survives restart)
     this._compactSync() // rewrite clean + bounded, synchronously (file exists right at start)
-    this._sample() // immediate first sample
-    this._timer = setInterval(() => this._sample(), stepSec * 1000)
+    this._sample() // immediate first row, so a fresh process is not blank for stepSec
+    this._pollTimer = setInterval(() => this._poll(), this._pollSec * 1000)
+    this._timer = setInterval(() => this._emit(), stepSec * 1000)
     if (this._timer.unref) this._timer.unref()
+    if (this._pollTimer.unref) this._pollTimer.unref()
   }
 
   // --- sampling ---
-  _sample () {
-    const s = this._source && this._source.getState && this._source.getState()
-    if (!s) return
+  _resetAcc () {
+    // polls counts readings seen since the last emit. Zero means the telemetry source
+    // gave us nothing at all, and we push no row — a gap is the honest record, where a
+    // row of nulls would be a claim that we looked and the boat had no data.
+    this._acc = { polls: 0, sum: {}, cnt: {}, lo: {}, hi: {}, last: {}, lat: null, lon: null }
+  }
+
+  // BoatState -> the flat channel map this ring records. Kept separate from the
+  // accumulator so poll and emit share one definition of where each channel comes from.
+  _raw (s) {
     const tw = trueWind(s)
-    const num = (v) => (Number.isFinite(v) ? v : null)
-    const row = {
-      t: Date.now(),
-      sog: num(s.sogKt), cog: num(s.cogDeg), heading: num(s.headingDeg),
-      stw: num(s.stwKt),
-      aws: num(s.awsKt), awa: num(s.awaDeg), depth: num(s.depthM),
+    return {
+      sog: s.sogKt, cog: s.cogDeg, heading: s.headingDeg, stw: s.stwKt,
+      aws: s.awsKt, awa: s.awaDeg, depth: s.depthM,
       tws: tw ? tw.tws : null, twd: tw ? tw.twd : null,
       // Everything below arrived in BoatState with v0.18.6 but was never sampled here,
       // so these instrument cells had a live value and an empty history flyout.
-      twa: num(s.twaDeg), vmg: num(s.vmgKt),
-      seaTemp: num(s.seaTempC), airTemp: num(s.airTempC),
-      rpmPort: num(s.rpmPort), rpmStbd: num(s.rpmStbd),
-      // Waypoint channels are legitimately null when no destination is active — num()
-      // maps that to null and CHANNELS omits empty ones, so the flyout stays blank
-      // rather than showing a flat line at zero.
-      wptBrg: num(s.wptBrgDeg), wptDist: num(s.wptDistNm),
-      wptVmg: num(s.wptVmgKt), wptTtg: num(s.wptTtgSec),
-      perf: this._perfSource ? num(this._perfSource.getPerf()) : null,
-      lat: num(s.lat), lon: num(s.lon)
+      twa: s.twaDeg, vmg: s.vmgKt,
+      seaTemp: s.seaTempC, airTemp: s.airTempC,
+      rpmPort: s.rpmPort, rpmStbd: s.rpmStbd,
+      // Waypoint channels are legitimately null when no destination is active — the
+      // accumulator skips non-finite values and CHANNELS omits empty ones, so the flyout
+      // stays blank rather than showing a flat line at zero.
+      wptBrg: s.wptBrgDeg, wptDist: s.wptDistNm,
+      wptVmg: s.wptVmgKt, wptTtg: s.wptTtgSec,
+      perf: this._perfSource ? this._perfSource.getPerf() : null
     }
+  }
+
+  _poll () {
+    const s = this._source && this._source.getState && this._source.getState()
+    if (!s) return
+    const raw = this._raw(s)
+    const a = this._acc
+    a.polls++
+    for (const c of CHANNELS) {
+      const v = raw[c]
+      if (!Number.isFinite(v)) continue
+      a.last[c] = v
+      if (WRAPPED.has(c)) continue // a bearing has no meaningful mean or extreme
+      a.sum[c] = (a.sum[c] || 0) + v
+      a.cnt[c] = (a.cnt[c] || 0) + 1
+      a.lo[c] = Math.min(a.lo[c] == null ? v : a.lo[c], v)
+      a.hi[c] = Math.max(a.hi[c] == null ? v : a.hi[c], v)
+    }
+    if (Number.isFinite(s.lat)) a.lat = s.lat
+    if (Number.isFinite(s.lon)) a.lon = s.lon
+  }
+
+  // One row per stepSec: the mean of everything seen since the last emit, plus the true
+  // extremes (`lo`/`hi`) and the sample count behind each mean (`n`, needed to weight a
+  // later re-bucket). Wrapped channels carry the last reading and appear in none of the
+  // three.
+  _emit () {
+    const a = this._acc
+    if (!a.polls) return
+    const row = { t: Date.now(), lo: {}, hi: {}, n: {} }
+    for (const c of CHANNELS) {
+      if (WRAPPED.has(c)) { row[c] = a.last[c] == null ? null : round3(a.last[c]); continue }
+      const n = a.cnt[c] || 0
+      if (!n) { row[c] = null; continue }
+      row[c] = round3(a.sum[c] / n)
+      row.lo[c] = round3(a.lo[c])
+      row.hi[c] = round3(a.hi[c])
+      row.n[c] = n
+    }
+    row.lat = a.lat == null ? null : a.lat
+    row.lon = a.lon == null ? null : a.lon
+    this._resetAcc()
+
     this._ring.push(row)
     const cutoff = Date.now() - this._windowMs
     while (this._ring.length && this._ring[0].t < cutoff) this._ring.shift()
     this._append(row)
   }
 
+  // One poll + one emit, i.e. the old single-shot behaviour. Used for the first row at
+  // construction and by the tests, which drive the clocks by hand.
+  _sample () {
+    this._poll()
+    this._emit()
+  }
+
   available () { return true }
 
   // A trailing window, or an ABSOLUTE range when the caller passes fromMs/toMs — which
@@ -137,14 +228,67 @@ class RingHistoryProvider {
     return this._ring.filter((r) => r.t >= cutoff)
   }
 
-  getSeries ({ windowSec, fromMs, toMs } = {}) {
+  // `series` is the mean line, exactly as before. Two additive extras, both ignorable:
+  //   stats -> `bands`, the true per-bucket [t, min, max] under the mean;
+  //   chans -> narrow the answer to the channels actually plotted.
+  //
+  // `everySec` is now HONOURED. It used to be ignored outright, so the history sheet's
+  // 24 h pill got raw sample-rate points whatever the pill said. Rows are re-bucketed
+  // into everySec windows: means weighted by the sample count behind each row, extremes
+  // as min-of-mins / max-of-maxes, wrapped channels taking the last reading. Buckets are
+  // labelled at their END, matching the cloud's aggregateWindow(timeSrc: "_stop") — label
+  // them at the start and the two providers plot half a bucket apart on the same screen.
+  getSeries ({ windowSec, everySec, fromMs, toMs, stats, chans } = {}) {
     const rows = this._window(windowSec, fromMs, toMs)
+    const want = chans && chans.length ? new Set(chans) : null
+    const step = Math.max(0, Math.round(everySec || 0)) * 1000
     const series = {}
+    const bands = {}
     for (const c of CHANNELS) {
-      const pts = rows.filter((r) => r[c] != null).map((r) => [r.t, r[c]])
-      if (pts.length) series[c] = pts
+      if (want && !want.has(c)) continue
+      const wrapped = WRAPPED.has(c)
+      // With no `every`, every row is its own point — which is what this endpoint has
+      // always returned, and the contract says `series` is unchanged with or without the
+      // new params. (Bucketing by r.t instead would merge two rows sharing a millisecond,
+      // which never happens in flight but does when a caller drives the clock by hand.)
+      const buckets = new Map()
+      let seq = 0
+      for (const r of rows) {
+        const v = r[c]
+        if (v == null) continue
+        const key = step ? Math.floor(r.t / step) * step : seq++
+        let b = buckets.get(key)
+        if (!b) buckets.set(key, (b = { t: step ? key + step : r.t, sum: 0, n: 0, lo: Infinity, hi: -Infinity, last: null }))
+        b.last = v
+        if (wrapped) continue
+        // Rows written before v0.29.0 carry no lo/hi/n. Reading them defensively means an
+        // append-log from an older version still loads and simply yields a degenerate
+        // band (the point value itself) rather than an empty chart or a crash.
+        const n = (r.n && r.n[c]) || 1
+        b.sum += v * n
+        b.n += n
+        const lo = (r.lo && r.lo[c] != null) ? r.lo[c] : v
+        const hi = (r.hi && r.hi[c] != null) ? r.hi[c] : v
+        if (lo < b.lo) b.lo = lo
+        if (hi > b.hi) b.hi = hi
+      }
+      const out = [...buckets.values()].sort((a, b) => a.t - b.t)
+      const pts = wrapped
+        ? out.map((b) => [b.t, b.last])
+        : out.filter((b) => b.n > 0).map((b) => [b.t, round3(b.sum / b.n)])
+      if (!pts.length) continue
+      series[c] = pts
+      // No `|| wrapped` here: the bucket loop above never accumulates a wrapped channel,
+      // so `n` stays 0 and the filter below drops it anyway. Keeping the extra condition
+      // would be unreachable code that no test can pin — and an unpinnable guard is the
+      // kind that quietly stops matching the guard it duplicates.
+      if (!stats) continue
+      const band = out
+        .filter((b) => b.n > 0 && Number.isFinite(b.lo) && Number.isFinite(b.hi))
+        .map((b) => [b.t, b.lo, b.hi])
+      if (band.length) bands[c] = band
     }
-    return { ok: true, series }
+    return stats ? { ok: true, series, bands } : { ok: true, series }
   }
 
   getTrack ({ windowSec, fromMs, toMs, everySec } = {}) {
@@ -224,8 +368,9 @@ class RingHistoryProvider {
 
   destroy () {
     clearInterval(this._timer)
+    clearInterval(this._pollTimer)
     this._compact() // final flush of the current ring
   }
 }
 
-module.exports = { RingHistoryProvider, MAX_SAMPLES, CHANNELS }
+module.exports = { RingHistoryProvider, MAX_SAMPLES, CHANNELS, WRAPPED }

package/lib/proxy/cache.js

@@ -43,6 +43,29 @@ async function readFromDisk (file, meta) {
   return { buffer, contentType }
 }
 
+// Gzip bytes stored as if they were the payload. This is what the pre-0.23.9 transport
+// did: core http hands back the still-compressed stream where fetch() decoded it, and the
+// bytes were cached — and tiles are PINNED, so the corruption outlived the fix by weeks.
+// Cesium read the gzip header as a vertex count: "Invalid typed array length:
+// 11239580910". 2,391 terrain tiles and 188 vector tiles on this boat were still poisoned
+// three days after the transport was fixed, because nothing ever re-examines a pinned
+// file.
+//
+// So a HIT is checked, which costs two bytes of a buffer already in hand. A file that
+// claims to be quantized-mesh or protobuf and begins 1f 8b is not that file; it is
+// dropped and re-fetched. Content that is LEGITIMATELY gzip (a .gz asset, or a
+// gzip content-type) is left alone — that is a payload, not an encoding.
+function looksGzipped (buffer) {
+  return buffer && buffer.length >= 2 && buffer[0] === 0x1f && buffer[1] === 0x8b
+}
+function gzipIsThePayload (contentType, reqPath) {
+  const ct = String(contentType || '').toLowerCase()
+  return ct.includes('gzip') || ct.includes('x-gzip') || /\.gz(\?|$)/i.test(String(reqPath || ''))
+}
+function isCorruptOnDisk (r, reqPath) {
+  return looksGzipped(r.buffer) && !gzipIsThePayload(r.contentType, reqPath)
+}
+
 // Fetch from upstream and persist atomically (bytes + content-type sidecar). The
 // rename stamps the file mtime ~now, which is what freshness compares against.
 async function fetchAndStore (url, file, meta, timeoutMs) {
@@ -112,7 +135,18 @@ async function getResource (opts) {
   const stat = await fsp.stat(file).catch(() => null)
   if (stat) {
     const stale = invalidatedAt && stat.mtimeMs < invalidatedAt
-    if (!stale) return serveDisk('HIT')
+    if (!stale) {
+      const hit = await serveDisk('HIT')
+      if (!isCorruptOnDisk(hit, reqPath)) return hit
+      // Left over from the transport that cached compressed bytes. Serving it again would
+      // reproduce the original error for ever, so drop it and fetch a clean copy. If that
+      // fails, FAIL: a renderer given a gzip header errors hard, where a missing tile
+      // simply falls back to its parent.
+      await fsp.unlink(file).catch(() => {})
+      await fsp.unlink(meta).catch(() => {})
+      if (downNow) throw offline('cached copy was corrupt (gzip) and the upstream is down')
+      try { return await tryFetch('REPAIRED') } catch (e) { noteFail(e); throw e }
+    }
     // A newer bake was announced; the on-disk copy predates it.
     if (downNow) return serveDisk('STALE')
     try { return await tryFetch('UPDATED') } catch (e) { noteFail(e); return serveDisk('STALE') }
@@ -149,4 +183,4 @@ async function clearStore ({ storeDir, keep = [], prefix = '' } = {}) {
   return { removed, mode: 'keep', kept: [...keepSet] }
 }
 
-module.exports = { getResource, storePaths, clearStore }
+module.exports = { getResource, storePaths, clearStore, isCorruptOnDisk }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sailkick-boat",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "Run the sailkick app on board with no internet: charts, weather, climatology, trends and AIS all served from the boat itself. With a sailkick account it also syncs your metrics to the cloud in real time. Alpha, invite-only — info@sailkick.io",
   "main": "index.js",
   "scripts": {