Release 0.12.0

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/ipx-prod-check/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ipx-prod-check
-description: Look for problems in production ipx (the iPX container on Tower) from its logs in Loki and its traces in Tempo, and file what is found as Gitea issues. Use when asked to check on production, look for issues or errors in ipx, see why something is slow or failing in production, review the logs, or investigate a report about the live site.
+description: Look for problems in production ipx (the iPX container on Tower) from its logs in Loki, its traces in Tempo and its metrics in Prometheus, and file what is found as Gitea issues. Use when asked to check on production, look for issues or errors in ipx, see why something is slow or failing in production, review the logs, or investigate a report about the live site.
 ---
 
 # Checking production ipx
@@ -16,9 +16,15 @@ $Q logs    '<LogQL>'           [since]   # lines, newest first (500 at most)
 $Q metric  '<LogQL metric>'    [since]   # $range becomes `since`
 $Q traces  '<TraceQL>'         [since]   # slowest first
 $Q trace   <trace id>                    # one trace as a tree, with its log lines
+$Q prom    '<PromQL>'          [since]   # Prometheus, now; $range becomes `since`
 ```
 
-`since` is `1h`, `24h`, `7d`. Default to `24h`; widen it to see whether something is new.
+`since` is `30m`, `1h`, `24h`, `7d`. Default to `24h`; widen it to see whether something is new.
+"Since the last deploy" is since the container started:
+
+```sh
+S=$(docker inspect iPX -f '{{.State.StartedAt}}'); echo $(( ($(date +%s) - $(date -d "$S" +%s)) / 60 + 1 ))m
+```
 
 ## What the log carries
 
@@ -35,12 +41,16 @@ lines had no trace id, the access log's time was `ms`, and each event was logged
 | `ipx::scan` | `ev` and the event's own: `feed`, `new`, `downloaded`, `failed`, `bytes`, `msg`, `url`, `feeds`, `reason`, `from`, `to`; on a failure `error.type` and, from an HTTP error, `http.response.status_code` | the daemon's events, one line each, in words; warnings are feed and download failures |
 | `ipx::io` | `ev`, `feeds`, `pending`, `downloaded` on the `status` reply | commands arriving (`-> {...}`) and the healthcheck's answer |
 | `ipx` | message, sometimes fields | start-up, shutdown, account and config messages |
+| `ipx::client` | `ev`, `user`, `feed`, `enclosure`, `deadair`; `msg`, `src`, `line` on an error; `ms` on a timing | what the page reports from the browser (#190): `page_error`, `rejection` and `player_error` as warnings; `play_start` (ms from play to sound) and `stall` (ms waiting mid-play) as info. Lines carry the trace of the action in the page: its API requests send `traceparent`, one trace id per tap or key |
 
 Events (`ev`): `feed_start`, `feed_done` (new, downloaded, failed, torrents), `feed_skip` (not due,
 routine), `feed_error` (msg), `feed_moved` (from, to: a permanent redirect followed, the address
 updated), `download_done` (bytes), `download_error` (msg, url),
 `torrent_deferred`, `reaped`, `scan_done` (feeds checked), `reap_done`, `status` (feeds, pending,
-downloaded: the healthcheck's, every 30s), `error` (msg).
+downloaded: the healthcheck's, every 30s), `deadair_done` (feed, enclosure, `saved_s` at the
+default pause), `error` (msg). DeadAir also logs `DeadAir found the silences` (`cuts`, `saved_s`,
+`took_ms`) under `ipx::deadair`, and warns `DeadAir could not read a file` when ffmpeg fails on
+one, which it then passes over until the next restart.
 
 `error.type` is the HTTP status (`404`, `503`) or one of `dns`, `redirect_loop`, `timeout`, `tls`,
 `not_a_feed`, `site_message`, `connect`, `parse`, `other`; Loki's `| json` names it `error_type`.
@@ -49,6 +59,35 @@ Filter on the text before `| json` where you can (`|= "\"ev\":\"feed_error\""`):
 cheaper than parsing every line. Lines before 2026-09-29 14:00 UTC are text, not JSON, and
 `| json | __error__=""` drops them.
 
+## What Prometheus carries
+
+The daemon's own state between requests, which no log line or trace holds (#194): ipx serves
+`/metrics` on `[web] metrics_bind` (production: `192.168.1.130:9187`, LAN only), on a thread and
+port of its own, from memory alone, and Prometheus scrapes it every 15 s as `job="ipx"`. Kept
+from 2026-10-11 15:15 UTC. All gauges:
+
+| metric | what |
+|---|---|
+| `ipx_db_connections{state="in_use"\|"idle"}`, `ipx_db_connections_max` | the database pool: in use reaching the max means requests and scans wait for a connection |
+| `ipx_worker_queue` | commands waiting for the sequential worker (scans, downloads, adds) |
+| `ipx_event_listeners` | open pages and socket clients on the live-update stream |
+| `ipx_torrent_slots_free` | of 2 |
+| `ipx_deadair_playing` | episodes being played through DeadAir's playlist |
+| `ipx_runtime_workers`, `ipx_runtime_tasks`, `ipx_runtime_queue` | tokio: threads, live tasks, tasks waiting for a thread |
+| `ipx_process_resident_bytes`, `ipx_process_open_fds` | memory and open files and sockets |
+| `ipx_uptime_seconds`, `ipx_build_info{version}` | since the daemon started; what runs |
+| `ipx_worker_busy`, `ipx_worker_job_seconds{kind}` | the worker's job now (`scan`, `reap`, `download`, `status`, `reload`) and for how long; the healthcheck passes while it is stuck |
+| `ipx_jobs_total{kind}`, `ipx_job_seconds_total{kind}` | counters: jobs finished, and their seconds all told |
+| `ipx_last_scan_age_seconds` | since a scan last finished; absent until one has since starting |
+| `ipx_http_requests_in_flight`, `ipx_scan_feeds_fetching`, `ipx_downloads_active` | work in progress |
+| `ipx_download_bytes_total` | counter; `rate()` is the download speed |
+| `ipx_event_queue`, `ipx_events_missed_total` | live updates unread by some listener; counter of those dropped for one that fell behind |
+| `ipx_deadair_backlog`, `ipx_deadair_busy_seconds` | files of shows with DeadAir on not yet looked at (episodes everyone heard through stay counted); how long it has been on its file |
+| `ipx_feed_retries` | feeds waiting to retry a failed name lookup |
+| `ipx_art_cache_bytes`, `ipx_art_cache_limit_bytes` | artwork kept, as of the last sweep, and the most kept: kept sits at the limit by design |
+| `ipx_art_evicted_total`, `ipx_art_requests_total{result="hit"\|"miss"}` | counters: images the sweep threw out to stay under the limit, and artwork served from disk or fetched from the publisher; many evicted at every sweep with a falling hit rate means the limit is too small |
+| `ipx_feeds`, `ipx_downloads_pending`, `ipx_files_downloaded` | the library, as the healthcheck last counted it (every 30 s) |
+
 ## The checks
 
 Run these, then read the lines behind whatever stands out. Most of the time is in the reading:
@@ -103,6 +142,62 @@ a count says something happened, the lines and traces say why.
    A web request over a second is worth a look; the trace shows whether the time is in the
    handler or a scan it waited on.
 
+   Steps are `step` spans named by `of` (#187): an item list's `entries_in`, `sanitize`,
+   `deadair`, `count_in`; the feed list's `catalogue`, `feed_list` and its queries; a `reap`'s
+   `missing_files`, `prune_abandoned_failures`, `reap_candidates`, `clean_directory` (once a day
+   since #193, so a reap is about a second), `trim_artwork`, with what it removed on the `reap`
+   span. DeadAir's work on a file is a `deadair` trace (feed, enclosure, cuts) with `probe`,
+   `silencedetect`, `frame_bytes`, `store_plans`: seconds each, more is a file ffmpeg struggles
+   with. A trace with no name in `$Q traces` started in the page (#190, #192): its root is the tap
+   in the browser, which sends no span, so it holds the requests that tap made (API calls, the
+   playlist and audio of a play, position saves, the page's own report) side by side.
+
+6. **The daemon's state, from Prometheus.** Pressure and leaks that requests and traces only
+   hint at.
+   ```
+   $Q prom 'up{job="ipx"}'
+   $Q prom 'max(max_over_time(ipx_db_connections{job="ipx",state="in_use"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_db_connections_max{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_worker_queue{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_runtime_queue{job="ipx"}[$range]))' 24h
+   $Q prom 'max(resets(ipx_uptime_seconds{job="ipx"}[$range]))' 24h
+   $Q prom 'ipx_process_resident_bytes{job="ipx"} - ipx_process_resident_bytes{job="ipx"} offset $range' 24h
+   $Q prom 'ipx_process_open_fds{job="ipx"} - ipx_process_open_fds{job="ipx"} offset $range' 24h
+   $Q prom 'ipx_runtime_tasks{job="ipx"} - ipx_runtime_tasks{job="ipx"} offset $range' 24h
+   $Q prom 'max(max_over_time(ipx_worker_job_seconds{job="ipx"}[$range])) by (kind)' 24h
+   $Q prom 'max(max_over_time(ipx_last_scan_age_seconds{job="ipx"}[$range]))' 24h
+   $Q prom 'sum by (kind) (increase(ipx_job_seconds_total{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_http_requests_in_flight{job="ipx"}[$range]))' 24h
+   $Q prom 'sum(increase(ipx_events_missed_total{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_deadair_busy_seconds{job="ipx"}[$range]))' 24h
+   ```
+   `up` 0 means Prometheus cannot reach the port: the container is down or `metrics_bind` is
+   unset. Connections in use at the pool's max (20 on Postgres) means something is waiting for
+   one: find the slow requests or scan of that time in check 3 and 5. A worker queue that only
+   grows means downloads are not keeping up, or the worker is stuck on one job. A runtime queue
+   above 0 for more than a scrape or two means every thread is busy: something is blocking a
+   thread or burning one. Memory, open files or tasks only climbing across a day with no restart
+   is a leak (a file or socket not closed, a task never ending); a step after a deploy is not. A
+   reset of the uptime is a restart: match it with a deploy, or it is a crash (check 4).
+
+   The worker: one job over 30 minutes (`ipx_worker_job_seconds`), or a scan last finished over
+   15 minutes ago, is the worker stuck, which the healthcheck does not notice; its trace and the
+   log lines of that time say on what. A kind whose share of `ipx_job_seconds_total` jumps is
+   where the worker's time went (reap was most of it until #193). Web requests in flight near
+   the pool's max mean the pool is what they wait on. Live updates missed mean a page showed stale
+   counts until reloaded. DeadAir over a minute on one file is a file ffmpeg chokes on.
+
+7. **What the page saw.** The browser's own errors and timings, which no server line shows.
+   ```
+   $Q metric 'sum by (ev, msg) (count_over_time({container="iPX"} |= "\"target\":\"ipx::client\"" | json | __error__="" | level="WARN" [$range]))' 7d
+   $Q logs '{container="iPX"} |= "\"target\":\"ipx::client\"" | json | ev=~"play_start|stall" | line_format "{{.timestamp}} {{.user}} {{.ev}} {{.ms}}ms deadair={{.deadair}} {{.feed}}"' 24h
+   ```
+   A `player_error` is playback that failed in front of someone: `hls.js: ...` is DeadAir's
+   playlist (its trace has the playlist and audio requests), `media error 4` a file the browser
+   cannot play. A `page_error` or `rejection` is a bug in the page; `src` and `line` point into
+   the minified `app.js`, so match the message to `web/src`. `play_start` over 2000 ms, or a
+   `stall`, is worth a trace: was it the server, Cloudflare, or the network.
+
 Also check the container itself, since Loki cannot see a daemon that is not running:
 
 ```sh

.claude/skills/ipx-prod-check/query.py

@@ -1,10 +1,11 @@
 #!/usr/bin/env python3
-"""Ask production's Loki or Tempo a question, from anywhere that can run docker on Tower.
+"""Ask production's Loki, Tempo or Prometheus a question, from anywhere that can run docker on Tower.
 
     query.py logs    '<LogQL log query>'    [since]   lines, newest first
     query.py metric  '<LogQL metric query>' [since]   one value per series; $range is `since`
     query.py traces  '<TraceQL query>'      [since]   matching traces, slowest first
     query.py trace   <trace id>                       one trace's spans, as a tree
+    query.py prom    '<PromQL query>'       [since]   one value per series, now; $range is `since`
 
 `since` is 1h, 24h, 7d and the like (default 24h). Loki and Tempo publish no query port on the
 host, so each call runs a throwaway alpine container on the monitoring project's network.
@@ -53,8 +54,18 @@ def main():
         traces = sorted(r.get("traces", []), key=lambda t: -t.get("durationMs", 0))
         for t in traces:
             when = time.strftime("%m-%d %H:%M:%S", time.gmtime(int(t["startTimeUnixNano"]) / 1e9))
-            print(f"{t.get('durationMs', 0):>8}ms  {when}Z  {t['traceID']}  {t.get('rootTraceName', '')}")
+            # No root name: its root span is a tap in the page, which the browser never sends.
+            name = t.get("rootTraceName") or "(from the page)"
+            print(f"{t.get('durationMs', 0):>8}ms  {when}Z  {t['traceID']}  {name}")
         print(f"-- {len(traces)} trace(s)", file=sys.stderr)
+    elif kind == "prom":
+        # ipx's /metrics (#194), scraped as job ipx; through the network like the others.
+        r = fetch(f"http://prometheus:9090/api/v1/query?query={enc(q.replace('$range', since))}&time={now}")
+        rows = sorted(r["data"]["result"], key=lambda s: -float(s["value"][1]))
+        for s in rows:
+            labels = {k: v for k, v in s["metric"].items() if k not in ("job", "instance")}
+            print(f"{float(s['value'][1]):>14g}  {json.dumps(labels) if labels else ''}")
+        print(f"-- {len(rows)} series", file=sys.stderr)
     elif kind == "trace":
         r = fetch(f"http://tempo:3200/api/traces/{q}")
         spans = [sp for b in r.get("batches", r.get("resourceSpans", []))

CHANGELOG.md

@@ -7,12 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.12.0] - 2026-10-11
+
 ### Added
 
-- DeadAir: turn it on for a show in its settings, or with the button beside the speed while it plays, and its episodes play with long silences shortened, so podcasts finish sooner without sounding sped up. Your place carries over when you turn it on or off, each episode says how much shorter it is, and Settings shows the time it has saved you. It is off for every show until you turn it on (#171, #172).
+- With `[web] metrics_bind` set, ipx serves Prometheus metrics on a port and thread of their own: the database pool, the worker's job and queue, jobs done and their time, scans, downloads and requests in progress, download speed, live-update listeners and missed updates, DeadAir's backlog, the artwork cache's fill, hit rate and evictions, memory, open files and the library's counts. The iPX dashboard graphs them in a Daemon row (#194, #195, #198, #199).
+- The page reports its errors, the player's, how long play takes to start and how long it stalls to the server's log, and the requests one tap sets off share a trace, the playlist, audio and saved place of what it played included (#190, #192).
+- Saving an episode from a show with DeadAir on saves it without its dead air, at your breathing room (#186).
+- Choose the pause DeadAir leaves where it cuts a silence, from 0.2 to 0.5 seconds, for each show in its settings, as its breathing room, on a slider from brisk to relaxed. It is 0.3 seconds unless you change it, up from 0.2, which made speech sound rushed (#182, #183).
+
+### Changed
+
+- DeadAir no longer makes a shortened copy of each episode. It plays the original with its long silences left out, ready a few seconds after the download, with no gap where a silence was cut and no extra disk space; the copies already made are removed (#179, #181, #196).
+- DeadAir is in the same box as a show's download settings, below them, and stays there when automatic downloads are off (#185).
+- The container is built on Debian 13 (trixie) instead of 12, so DeadAir uses ffmpeg 7.1 instead of 5.1 (#177).
+- On Postgres, ipx keeps up to 20 connections to the database instead of 10, for the bursts of a page load asking for many covers at once (#200).
+- Traces of the disk sweep, episode lists and DeadAir's work on each file show each step, and the sweep's trace says what it removed (#187).
 
 ### Fixed
 
+- All Subscriptions, and every item list, comes up faster, most of all the first time after a quiet spell: it took half a second to two (#188).
+- Checking for new episodes no longer waits up to 12 seconds each time on a clear-out of dead feeds from the Directory, which now runs once a day (#193).
+- A page left open no longer misses updates after a check for new episodes: the note that each feed not due was skipped, one per feed, filled the queue they share (#197).
+
+### Security
+
+- Cloudflare no longer keeps a copy of the audio you play, which it served to anyone it let in without checking they subscribe (#189).
+
+## [0.11.0] - 2026-10-09
+
+### Added
+
+- DeadAir: turn it on for a show in its settings, or with the button beside the speed while it plays, and its episodes play with long silences shortened, so podcasts finish sooner without sounding sped up. Your place carries over when you turn it on or off, each episode says how much shorter it is ("Cutting dead air…" until it is done), and Settings shows the time it has saved you. It is off for every show until you turn it on (#171, #172, #173, #174, #176).
+
+### Fixed
+
+- A downloaded file's play, save, share and delete buttons stay on one row in the Files pane, instead of delete wrapping underneath (#175).
 - Cover art up to 20 MB is shown, instead of nothing for anything over 5 MB, as for five of the Glass Cannon Network's feeds.
 - Seeking in an episode while many people listen answers in about 10 ms instead of 40, and files stream about four times as fast: each connection now sends what is ready without waiting for the browser to acknowledge the last part.
 - Artwork that could not be fetched is not fetched again for an hour, instead of on every page load, and the server's log says which image it was and why.
@@ -28,7 +58,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - The feed list's traces show each of its database queries, so it can be told where its time goes.
 - Saving a feed's settings asks the database for your subscription once, not twice.
 - `ipx add` and Add feed in the page add a feed the same way, through one piece of code.
-- Glass's top bar is solid on a phone, in the colour its glass showed, so the strip above it on an iPhone can match it.
 - A pinned item or feed's pin button is filled with the theme's accent, in the reader, on the feed's page and in the toolbar, so pinned no longer looks like not pinned.
 - A feed's page in the Directory says how many people here subscribe only when someone does, without "Nobody here subscribes yet".
 
@@ -36,10 +65,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - The unread counts catch up when you come back to the page: an item read on another device, or while the phone app was in the background, no longer stays counted as unread until a reload.
 - A feed set to download 0 of its newest items downloads all of them, the whole back catalogue, as the server's 0 does; it downloaded nothing.
-- The feed list loads faster: it counts the items and files of your own feeds, not of every feed on the server.
+- The feed list loads faster: it counts the items and files of your own feeds, not of every feed on the server, and asks for a group's title once, not once for every feed in it.
 - Downloading or deleting a file the server no longer has answers "not found" instead of a server error.
 - A feed's page in the Directory, and subscribing from it, no longer wait while the whole Directory is put together to check that the one feed is in it.
-- The feed list, and each live update of it, no longer asks the database for a group's title once for every feed in the group.
 - An episode that came as a torrent of several files plays its largest file, and can be deleted, by hand or to free space, instead of staying on disk for good.
 - Removing an account takes the feeds only that person read off the server, as unsubscribing does, instead of leaving them downloading every new episode for no one.
 - Freeing disk space counts only the people who subscribe to a feed: an episode is no longer taken as heard by everyone because someone who has since unsubscribed heard it, and their pins no longer keep files for good.
@@ -48,7 +76,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Changes to the feed list made at the same moment, such as two people adding feeds, or a feed added while the server settings change, no longer undo one another.
 - A download that stops partway is given up after two minutes without data, instead of holding up every scan and download until a restart.
 - On a phone, the closed feed list no longer shades the left edge of the page with its shadow.
-- On an iPhone, the top bar's colour runs all the way up behind the status bar and the Dynamic Island, with no band of another colour above it.
+- On an iPhone, the top bar's colour runs all the way up behind the status bar and the Dynamic Island, with no band of another colour above it. In Glass the bar is solid on a phone, in the colour its glass showed.
 - A feed's buttons stay on one row on a narrow phone, and the reader's buttons stay together instead of breaking across lines under a long feed name.
 - A moment's DNS failure no longer marks a feed as failing for a day or calls it gone: iPX tries it again in ten minutes. One failed lookup one morning left 205 podcasts unread, uncategorised and labelled gone until the next day. A name that does not resolve is said to be maybe gone, and only once it has been failing a day, on its Directory page as on its own.
 
@@ -91,10 +119,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- The Directory is laid out as Apple's is. It opens on the ten most subscribed feeds, ranked, and the categories as tiles showing some of their shows' covers. A category opens a page of its own with its most subscribed feeds, its subcategories (Tech News under News, Video Games under Leisure) and its feeds; See all lists every one. This replaces the grid of every feed under rows of category buttons.
-- The most subscribed feeds are the Directory's first section instead of a place of their own: Popular is gone from the feed list, and so is its key, g p.
+- The Directory is laid out as Apple's is. It opens on the ten most subscribed feeds, ranked, and the categories as tiles showing some of their shows' covers. A category opens a page of its own with its most subscribed feeds, its subcategories (Tech News under News, Video Games under Leisure) and its feeds; See all lists every one, A to Z, Z to A or by most subscribers. This replaces the grid of every feed under rows of category buttons, and Popular, which is gone from the feed list with its key, g p.
 - A pinned item in a list wears the same disc as a pinned feed, in the theme's accent, instead of a plain solid pin.
-- The Directory can be sorted by name, A to Z or Z to A, or by most subscribers. It still opens A to Z.
 - An item published without a title shows its opening words, in plain text rather than bold, instead of "(untitled)"; one with no text either shows its file's name, or its show and date. Opened, it starts with its text.
 - A feed that has moved for good (a permanent redirect) is followed to its new address, which iPX then reads from, and says so in the log as `feed_moved`. A temporary redirect changes nothing.
 - The daemon sleeps until the next feed is due, at most ten minutes, instead of looking every minute; refreshing or adding a feed still wakes it at once.
@@ -122,43 +148,41 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- `IPX_LOG_FORMAT=json` logs one JSON object a line, with a request's method, route, status and time
-  and a scan's or download's details as fields, for Loki and the like.
+- `IPX_LOG_FORMAT=json` logs one JSON object a line, for Loki and the like: a request's method,
+  route, status and `duration_ms`, a scan's or download's details, a failure's kind in `error.type`
+  (and its HTTP status in `http.response.status_code`), and each line's `trace_id` and `span_id`.
 - A Grafana dashboard for iPX, from its log in Loki and its traces in Tempo (`grafana/dashboard.py`).
 - With `OTEL_EXPORTER_OTLP_ENDPOINT` set, the daemon sends traces of its scans, downloads and web
-  requests to a collector such as Tempo.
-- A feed that has no artwork of its own shows its website's icon instead.
+  requests to a collector such as Tempo; a scan's shows the time each feed spends fetching, on its
+  artwork and in the database.
+- A feed with no artwork of its own, or whose artwork is missing, shows its website's icon, or the
+  site's `/favicon.ico`, and follows the site when it changes. It is asked for again only when the
+  artwork changes or you refresh the feed.
 - The refresh button turns while its feed is being checked, and the check-every-feed buttons
   while any of yours is.
-- Adding a website's address subscribes to the feed that site links, instead of failing on every scan.
+- Adding a website's address, with or without `https://`, subscribes to the feed that site links.
+  An address is checked before it is added, and anything that is neither a feed nor a page linking
+  one is refused with the reason, instead of being added and failing on every check.
 - `/api/status` gives the number of feeds, items waiting to download and files downloaded, and
   the version, for a dashboard such as Homepage.
 
 ### Changed
 
 - The start-up line about the web UI being reachable off the machine says what guards it, and is a warning only when there is no Cloudflare Access in front of it.
-- The feed list updates just the feed that changed, as a scan checks it or you read an item, instead of reloading the whole list.
+- The feed list updates just the feed that changed, as a scan checks it or you read an item, instead of reloading the whole list every minute.
 - A scan fetches several feeds at once, so a refresh no longer waits on every site in turn.
-- An open page reloads the feed list only when a scan has checked something, not every minute.
-- Adding an address checks it first: a feed is added, a web page adds the feed it links, and anything else is refused with the reason, instead of being added and failing on every check.
 - A feed that was failing when its last subscriber left is forgotten, rather than kept with its error for good. One that worked, or has files on disk, is kept as before.
 - A feed that keeps failing is checked less and less often, waiting as long as it has been failing, up to once a day; it goes back to its schedule as soon as it works. Refreshing it still checks it at once.
-- A scan's trace shows the time a feed spends on its artwork and in the database after the fetch.
-- The JSON log carries each line's `trace_id` and `span_id`, logs each scan event once instead of
-  twice, names a failure's kind in `error.type` (and its HTTP status in
-  `http.response.status_code`), and calls a request's time `duration_ms` instead of `ms`.
 - `ipx list` shows each feed's id on a line of its own, labelled, under its title.
 - Each browser keeps its own theme, so a phone and a desktop can differ. A browser that has not
   chosen one yet starts from the theme your account had.
 - The Modern theme takes its colours from the new logo: its navy, the blue of its bars and the
   orange of its needle.
-- The logo follows the page: the dark version in a dark theme, the light one in a light theme.
-- The browser tab's icon follows the page's light or dark mode too.
-- On a phone, the top bar leaves out the logo, giving its room to the search box.
-- Between releases, the version on the logo says so: 0.9.1-dev, not 0.9.0.
-- The logo's needle is a brighter, redder orange that stands apart from the blue bars.
 - The logo is in the top bar beside the add-feed button, in place of the name at the top of the
-  feed list. Hovering it shows iPX's version.
+  feed list, and left out on a phone, for the search box. It follows the page, dark in a dark theme
+  and light in a light one, as the browser tab's icon does, and hovering it shows iPX's version,
+  which says so between releases: 0.9.1-dev, not 0.9.0.
+- The logo's needle is a brighter, redder orange that stands apart from the blue bars.
 
 ### Removed
 
@@ -168,28 +192,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Adding a site without `https://`, such as `cnn.com`, works; it failed on every check.
 - A limit on new downloads per check means a show's newest episodes: with it set to 3, ipx no longer works back through the show's history three at a time. Set to 0, it still takes the whole back catalogue.
 - With no limit on new downloads per check (`max_new_per_check = 0`), downloads work on Postgres; they failed.
 - Checking a feed with a long history is much quicker: items already stored are no longer written again on every check.
-- A scan no longer asks a feed's website for its icon every time; it asks again when the artwork changes or you refresh the feed.
 - The feed list loads several times faster: it was asking the database six questions per feed.
 - Artwork a feed offers only over plain http shows on the https site too.
 - A failing feed is easy to spot in any theme: a mark on its artwork, what is wrong in place of
   its counts, and its artwork greyed out once it has failed for a day.
-- A feed whose own artwork is missing shows its website's icon instead of nothing.
 - The log has no terminal colour codes when it is not going to a terminal, as in `docker logs`.
-- A feed whose website names an icon that is missing shows the site's `/favicon.ico` instead of
-  no artwork.
-- A website's icon standing in for a feed's artwork follows the site when it changes, and a
-  feed that drops its own artwork gets the site's instead. Refreshing a feed checks again.
 - The read button shows whether an item is read, as the pin beside it shows whether it is
   pinned: a tick when read, an envelope when not. It used to show the opposite.
 - In Directory and Popular, Subscribe is a plus again, not the tick that marks a feed you have.
 - A feed's refresh button looks like the buttons beside it, instead of standing out filled in.
 - Refreshing reads your feeds in full, instead of only asking each one whether it changed, so
   a feed that has not changed is still read again.
-- A web page with some non-ASCII characters no longer hides the feed it links, or crashes looking for it.
 - Pulling the item list down to check for new items shows a spinner for a couple of seconds, and
   a second pull meanwhile does nothing, instead of no sign at all that the check started.
 - Settings no longer lists the server's download folder, which only an admin can change, on
@@ -229,14 +245,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Opened from the home screen on an iPhone, the top bar, the reader's back button and the top
   of the feed list keep clear of the Dynamic Island and the status bar instead of sitting under
   them.
-- Swiping to the next or previous item takes a longer swipe, a quarter of the screen, so a
-  diagonal scroll no longer jumps ahead by accident. The item follows your finger and slides
-  across as it changes.
-- Swiping between items on a phone no longer shows the item list through the reader. The next
-  or previous item sits beside the one you are reading and comes across with it, the end of the
-  list says so, and swiping right from the first item draws the reader off the list, dimmed
-  until it is uncovered. A swipe from the screen's left edge stays with the page, rather than
-  Safari taking it as Back.
+- Swiping between items on a phone takes a quarter of the screen, so a diagonal scroll no longer
+  jumps ahead by accident, and no longer shows the item list through the reader: the next or
+  previous item sits beside the one you are reading and comes across with it, following your
+  finger, the end of the list says so, and swiping right from the first item draws the reader off
+  the list, dimmed until it is uncovered. A swipe from the screen's left edge stays with the page,
+  rather than Safari taking it as Back.
 
 ## [0.8.4] - 2026-09-19
 
@@ -343,6 +357,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Touch gestures: pull the item list down from its top to check the feed for new items, and
   swipe the item you are reading left for the next one and right for the one before, or back
   to the list from the first.
+- A favicon: the logo, squared up, also at /favicon.ico for browsers that ask there on their own,
+  and on white for an iPhone's home screen.
 
 ### Changed
 
@@ -357,17 +373,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - On a phone, an item's files, with play and delete, sit above its show notes rather than below
   them, where long notes left them looking missing.
 - On a phone, an item with no files goes straight to its text, without a box saying "No files".
-- The page is served minified, about a quarter smaller. Its script is now TypeScript in
-  `web/src`, type-checked, and built with swc; building ipx needs node.
-- The script is its own file, `/app.js`, rather than inside the page. Your browser keeps it
-  between visits and fetches it again only when an update changes it.
+- The page is served minified, about a quarter smaller, with its script in a file of its own,
+  `/app.js`, which your browser keeps between visits and fetches again only when an update changes
+  it. The script is TypeScript in `web/src`, type-checked and built with swc; building ipx needs
+  node.
 
 ### Fixed
 
 - Switching tabs straight after marking everything read no longer shows the previous tab's
   items: of two lists asked for at once, only the later one is shown.
-- ipx has a favicon: the logo, squared up, also at /favicon.ico for browsers that ask there on
-  their own, and on white for an iPhone's home screen.
 - The file icon of an item not yet downloaded sits level with the rest of its row, instead of
   higher than a downloaded one's.
 - Images in posts from sites that refuse images to other sites' pages, such as Jeff Geerling's,
@@ -378,8 +392,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   unread dot back until the next refresh.
 - On the Unread tab, the item you were reading leaves the list as soon as you move to the next
   one, rather than a few read items lingering until a refresh cleared them.
-- The Log button no longer shows for a moment on every load for anyone but an admin; the server
-  leaves it out of their page.
 - An image or link in a post given relative to the post, such as The Observation Deck's, now
   points at the post's site rather than at ipx, and shows.
 
@@ -449,10 +461,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   connection", now shows that message and is flagged as the publisher's problem, instead of two
   parser errors about reaching the end of input.
 
-### Removed
-
-- An unused icon glyph (`minus`) left over from before Unsubscribe settled on `circleMinus`.
-
 ### Fixed
 
 - Add a feed opened over Directory or Popular now shows its Popular list instead of staying on
@@ -621,13 +629,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A Classic theme after the 2004 Mac app, beside Dark and Light: brushed-metal toolbar, Aqua
   blue selection, red unread badges, a striped table and Lucida Grande. The theme button steps
   through all three and remembers the choice.
-- A toolbar across the top, after the original iPodderX: add and unsubscribe, play, mark read
-  and keep for the selected item, scan, a search box for what is showing, and Settings and Log.
+- A toolbar across the top, after the original iPodderX: add, unsubscribe and scan; play, mark
+  read and keep for the selected item, showing its state; a search box for what is showing; and
+  Settings and Log.
 - Directory, Popular and All Subscriptions at the top of the feed list, opening in the main pane.
   Directory lists every feed anyone here subscribes to, A to Z (`GET /api/directory`). All
   Subscriptions lists every item from every feed you subscribe to (`GET /api/entries`).
 - Items show as a table (unread, kept, title, feed, file, size, published) with a Files pane beside
-  it, and a status bar with the totals.
+  it, and a status bar with the totals. A file's type is an icon (audio, video, image, PDF, torrent,
+  other), green once it is downloaded and red when the download failed, with the details in its
+  tooltip; its size is in KB for small files instead of "0 MB".
 - Mark everything read from All Subscriptions, across every feed you subscribe to
   (`POST /api/read-all`). It asks first. All Subscriptions can also check every feed from its header.
 - Click a column heading in the item table to sort by it (kept, title, feed, file type, size,
@@ -642,28 +653,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   items show without pressing Scan.
 - A file deleted to save space, or by hand, looks as if it was never downloaded: no "reaped"
   label, just the Download button. The retention summary says "deleted", not "reaped".
-- Buttons are icons, with the words in their tooltips: the Files pane (save, delete, view,
-  download), an item's own buttons (mark read, keep, open the original), the feed header (scan,
-  download latest, mark all read, settings, unsubscribe), and the Settings, feed settings and
-  Download latest dialogs (save, download, cancel). The icons are Font Awesome Free, embedded as
-  SVG: only the ones used, no font to download, and nothing fetched from anyone else. They
-  replace font characters such as ⟳ ⤓ ↗, which came out thin and tiny and differed from font to
-  font. Keep is a flag everywhere, as it was in the original, and mark unread is an envelope.
-- One meaning per icon. Minus unsubscribes, x closes or cancels, plus adds or subscribes, and a
-  dialog's confirm button carries the icon of what it does. The feed header's unsubscribe was an x
-  and read as closing the page. The remaining word buttons are icons too:
-  - Log, Add feed, Users, Unsubscribe and OPML.
-  - Popular's Subscribe, Copy and Sign out.
-  - The Subscribed label in Popular, the Directory and Add feed, which is now a green check.
-  - The player's back, play, forward and close, which were font characters, and the folder arrow.
-- The toolbar's read and keep buttons show the selected item's state, with the same icons as the
-  item's own buttons. Play, read and keep sit together, and Scan sits with add and unsubscribe.
+- Buttons are icons, with the words in their tooltips, one meaning per icon: minus unsubscribes,
+  x closes or cancels, plus adds or subscribes, a dialog's confirm button carries the icon of what
+  it does, Keep is a flag, as it was in the original, mark unread is an envelope, and Subscribed is
+  a green check. The icons are Font Awesome Free, embedded as SVG: only the ones used, no font to
+  download, and nothing fetched from anyone else. They replace words and font characters such as
+  ⟳ ⤓ ↗, which came out thin and tiny and differed from font to font, and the feed header's x for
+  unsubscribe, which read as closing the page.
 - An OPML subscription's page has the same header as a feed's, with its buttons in the same places.
-- The item table's size has its own column, apart from the file's type, and shows KB for small
-  files instead of "0 MB". The Item heading is now Title.
-- A file's type is an icon (audio, video, image, PDF, torrent, other), green once it is
-  downloaded and red when the download failed, with the details in its tooltip. One icon per
-  row keeps the column lined up. The DOWNLOADED and PENDING labels are gone.
 
 ### Fixed
 
@@ -714,11 +711,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Importing another account's OPML export subscribed nobody and reported "Imported 0 feed(s)".
-  Feeds it added had no subscriber, so they were never scanned.
 - Importing something that is not OPML answered `500`. It is now `400` "that is not an OPML file",
   refused before anything changes.
-- Starring stopped protecting a file from the quota and age sweeps once read state became per-user.
 
 ### Security
 
@@ -732,7 +726,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Web UI served by the daemon: plain HTML and JS compiled into the binary, with feeds, items,
-  filters, search, sanitised show notes and live progress over SSE.
+  filters, search, sanitised show notes and live progress over SSE. Opening an item marks it
+  read; playing it marks it read only at the end or past 90%.
 - Player bar with resume, speed, keyboard shortcuts and lock-screen controls.
 - Three-pane layout: feeds beside, items above, and the selected item's text and files below.
 - Phone layout.
@@ -740,7 +735,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   trusted proxy header for Cloudflare Zero Trust or Authentik (`docs/sso.md`).
 - Subscribing to an OPML: it is re-read every scan and its feeds show as a folder. A feed dropped
   from it is removed unless it has downloads.
-- Scheduling: a global interval with per-feed overrides (`every 30m`, `4h`, `1d`, `2w`).
+- Scheduling: a global interval with per-feed overrides (`every 30m`, `4h`, `1d`, `2w`), set by an
+  admin, as are the global settings.
 - `[general] media_types`, default audio and video, and `max_new_per_check`, default 3.
 - Every enclosure of an item, a View link for files that are not audio or video, and per-item
   artwork.
@@ -753,33 +749,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Global settings and scan schedules are admin-only. The per-feed schedule picker is gone.
 - Feeds from an OPML live in the database, not `config.toml`.
-- Opening an item marks it read. Playing it marks it read only at the end or past 90%.
-- "Episodes" became "items", since half the library is text.
-- A burst of scan events causes one refresh, not one per feed.
-- All is the default filter. OPML import and export, Settings and Log moved out of the header.
 - Torrents run detached, two at a time.
 
 ### Fixed
 
-- Download fetched the next queued episodes instead of the one clicked.
-- Pressing play made an item vanish from the Unread list.
-- Clearing a folder, schedule or cap from the UI did nothing.
 - The daemon ignored SIGTERM until the current download finished.
-- A missing function stopped the page script and left the whole UI dead.
-- One download painted progress on every pending row.
 - A torrent could freeze scanning for up to an hour.
-- Downloading from an OPML feed failed with "belongs to unsubscribed feed".
-- Image enclosures were downloaded, counted as episodes and given a play button.
+- Image enclosures were downloaded as episodes.
 - A feed whose entries had been deleted stayed empty, because the server kept answering `304`.
 - An item with several enclosures kept only the last.
-- OPML folders rendered open by default.
-- Mark read in the text pane recursed until the stack overflowed.
-- The Unread, Downloaded and Flagged filters answered `500` without a search term.
-- An OPML subscription always showed 0 unread.
-- Folder names kept doubled spaces where separators were stripped.
-- Sidebar rows had four different left edges.
 
 ### Security
 
@@ -803,7 +782,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Torrent enclosures through librqbit, seeding to a ratio or a time, with a stall timeout.
 - `ipx import` and `ipx export` for OPML, and systemd units in `contrib/`.
 
-[unreleased]: https://git.sdf1.net/rays/ipx/compare/v0.10.3...main
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/v0.12.0...main
+[0.12.0]: https://git.sdf1.net/rays/ipx/compare/v0.11.0...v0.12.0
+[0.11.0]: https://git.sdf1.net/rays/ipx/compare/v0.10.3...v0.11.0
 [0.10.3]: https://git.sdf1.net/rays/ipx/compare/v0.10.2...v0.10.3
 [0.10.2]: https://git.sdf1.net/rays/ipx/compare/v0.10.1...v0.10.2
 [0.10.1]: https://git.sdf1.net/rays/ipx/compare/v0.10.0...v0.10.1

CLAUDE.md

@@ -56,15 +56,15 @@ docker logs --tail 20 iPX
 included. Run `pull` before `up`, because `up` reuses whatever `latest` the host already has.
 
 **A build that fails with `429 Too Many Requests` on a base image** is Docker Hub rate-limiting
-this host. There is no Docker Hub login here, and the build asks about `debian:bookworm-slim` and
-`rust:1-slim-bookworm` every time unless they are already stored locally. Pull them from Google's
+this host. There is no Docker Hub login here, and the build asks about `debian:trixie-slim` and
+`rust:1-slim-trixie` every time unless they are already stored locally. Pull them from Google's
 mirror and tag them; the build then uses the local copies without asking Docker Hub:
 
 ```sh
-docker pull mirror.gcr.io/library/debian:bookworm-slim
-docker tag mirror.gcr.io/library/debian:bookworm-slim debian:bookworm-slim
-docker pull mirror.gcr.io/library/rust:1-slim-bookworm
-docker tag mirror.gcr.io/library/rust:1-slim-bookworm rust:1-slim-bookworm
+docker pull mirror.gcr.io/library/debian:trixie-slim
+docker tag mirror.gcr.io/library/debian:trixie-slim debian:trixie-slim
+docker pull mirror.gcr.io/library/rust:1-slim-trixie
+docker tag mirror.gcr.io/library/rust:1-slim-trixie rust:1-slim-trixie
 ```
 
 Run those again now and then, or the local copies go stale.
@@ -228,8 +228,13 @@ say, such as what was wrong before or what it cost to find out, it goes in the c
 body, where `git log` and `git blame` find it beside the change. (There was a long-form
 `docs/history.md` until 0.7.0; it grew too large to be useful and was removed. It is in git.)
 
-Cutting a release: rename `[Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD` and open a new empty
-`[Unreleased]` above it, set `version` in `Cargo.toml` to `X.Y.Z` (dropping `-dev`), tag the commit
+Cutting a release: first read `[Unreleased]` against the last release, not line by line, and rewrite
+it as what changed between the two. Lines go in as the work happens, so they record the way there:
+a feature added and then reworked in the same release is one line saying what it is now, under
+Added; something added and taken out again before the release, or a fix for a bug no release ever
+had, is not there at all; and "instead of" and "no longer" compare with the last release, not with
+last week. Issue numbers stay, all of them, on the line that survives. Then rename `[Unreleased]` to
+`## [X.Y.Z] - YYYY-MM-DD` and open a new empty `[Unreleased]` above it, set `version` in `Cargo.toml` to `X.Y.Z` (dropping `-dev`), tag the commit
 `vX.Y.Z`, and update the compare links at the bottom of the changelog. Then, in the next commit,
 set `version` to the next patch with `-dev` (after 0.9.0, `0.9.1-dev`), so a build between releases says so
 in the logo's tooltip instead of claiming to be the last release. The release that follows can

Cargo.lock

@@ -1820,7 +1820,7 @@ checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "ipx"
-version = "0.10.4-dev"
+version = "0.12.0"
 dependencies = [
  "ammonia",
  "anyhow",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ipx"
-version = "0.10.4-dev"
+version = "0.12.0"
 edition = "2024"
 
 [dependencies]

Dockerfile

@@ -1,7 +1,7 @@
 # Build. rusqlite is bundled (compiles SQLite from source) and librqbit needs a C
 # toolchain, so the builder needs cc. TLS is rustls throughout, so no OpenSSL headers.
 # build.rs builds the web pages from TypeScript with swc, which needs node.
-FROM rust:1-slim-bookworm AS build
+FROM rust:1-slim-trixie AS build
 RUN apt-get update && apt-get install -y --no-install-recommends \
         build-essential nodejs npm \
     && rm -rf /var/lib/apt/lists/*
@@ -23,7 +23,7 @@ COPY web ./web
 # cargo skips a rebuild if mtimes look untouched; make sure it does not.
 RUN touch src/main.rs && cargo build --release --locked
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
 # ffmpeg is DeadAir's (#171): it finds the silences and copies the frames kept. Debian's adds
 # about 480 MB, once: the layer stays cached until the base image changes.
 RUN apt-get update && apt-get install -y --no-install-recommends \

docker-compose.yml

@@ -19,6 +19,7 @@ services:
       - ipx.env   # relative: Arcane resolves it inside its own container
     ports:
       - "8099:8099"          # web UI
+      - "192.168.1.130:9187:9187"  # /metrics for Prometheus, LAN only (ipx#194)
       - "6881:6881/tcp"      # BitTorrent peers
       - "6881:6881/udp"      # DHT
     volumes:

docs/configuration.md

@@ -103,6 +103,7 @@ access_aud        = ""                    # the Access application's AUD tag
 auto_create_users = true
 sign_out_url      = ""                    # e.g. "/cdn-cgi/access/logout"
 session_days      = 30
+metrics_bind      = ""                    # e.g. "0.0.0.0:9187"; empty serves no metrics
 ```
 
 * **`token`** — the shared secret, which signs in as the **admin**. `?token=…` sets a cookie, so
@@ -119,6 +120,9 @@ session_days      = 30
   `/cdn-cgi/access/logout` behind Cloudflare Access. Empty sends them to the sign-in page, where
   the proxy signs them straight back in.
 * **`session_days`** — sign a session out after this long without a request.
+* **`metrics_bind`** — where to serve `/metrics` for Prometheus: database connections in use, the
+  worker's queue, the runtime's tasks, memory and open files. It has a thread and a port of its own
+  and no sign-in, so publish it to the LAN only. Empty, the default, serves none.
 
 It is plain HTTP. On a LAN bind everything crosses the network in the clear — and a feed URL can
 itself carry a credential. Put TLS in front of it if that matters.

grafana/dashboard.py

@@ -2,15 +2,17 @@
 
     python3 grafana/dashboard.py > /mnt/fast/arcane/projects/monitoring/grafana-provisioning/dashboards/ipx.json
 
-Grafana reads that file on its own within a minute; edits made in Grafana are refused. The panels
-read the fields of ipx's JSON log (IPX_LOG_FORMAT=json): renaming a field in web.rs access_log or
-ipc.rs log_event has to be matched here. `dashboard.py queries` prints each
+Grafana reads that file on its own within a minute; edits made in Grafana are refused. The
+Daemon row reads ipx's /metrics from Prometheus (job ipx, #194); the rest read the fields of
+ipx's JSON log (IPX_LOG_FORMAT=json): renaming a field in web.rs access_log or ipc.rs log_event
+has to be matched here. `dashboard.py queries` prints each
 query, to try against Loki.
 """
 import json, sys
 
 LOKI = {"type": "loki", "uid": "${loki}"}
 TEMPO = {"type": "tempo", "uid": "${tempo}"}
+PROM = {"type": "prometheus", "uid": "${prometheus}"}
 SEL = '{container="iPX"}'
 # ipx logs one JSON object a line (IPX_LOG_FORMAT=json). Each scan and download event carries its
 # fields (ev, feed, new, bytes, msg, error.type, ...); each request its method, path, route, status
@@ -50,6 +52,14 @@ def loki(expr, ref="A", legend=None, instant=False, kind=None):
     return t
 
 
+def prom(expr, ref="A", legend=None):
+    # ipx's /metrics (#194), scraped by Prometheus as job ipx.
+    t = {"refId": ref, "datasource": PROM, "expr": expr}
+    if legend:
+        t["legendFormat"] = legend
+    return t
+
+
 def row(title):
     global y, pid
     pid += 1
@@ -135,6 +145,67 @@ table("Busiest routes", [loki(f'topk(15, sum by (method, route) (count_over_time
       12, rename={"method": "Method", "route": "Route", "Value": "Requests"}, sort=[{"displayName": "Requests", "desc": True}])
 y += 8
 
+# ---- Daemon, from Prometheus: what the daemon holds between requests (#194)
+row("Daemon")
+# Open connections stay open, idle, for ten minutes after a burst, so open at the max is not
+# pressure; drawn as a line of its own it read as the pool maxing out (#199).
+ts("Database connections", [prom('max(max_over_time(ipx_db_connections{job="ipx", state="in_use"}[$__interval]))', legend="in use"),
+                            prom('sum(ipx_db_connections{job="ipx"})', ref="B", legend="open"),
+                            prom('max(ipx_db_connections_max{job="ipx"})', ref="C", legend="most the pool opens")],
+   0, w=8, desc="In use reaching the most the pool opens means requests and scans are waiting for a connection. "
+                "Open connections stay open, idle, for ten minutes after a burst.")["fieldConfig"]["overrides"] = [
+    {"matcher": {"id": "byName", "options": "open"},
+     "properties": [{"id": "custom.lineStyle", "value": {"fill": "dash", "dash": [4, 4]}},
+                    {"id": "custom.fillOpacity", "value": 0}, {"id": "color", "value": {"mode": "fixed", "fixedColor": "#8e8e8e"}}]}]
+ts("Waiting", [prom('ipx_worker_queue{job="ipx"}', legend="commands for the worker"),
+               prom('ipx_runtime_queue{job="ipx"}', ref="B", legend="tasks for a thread"),
+               prom('ipx_downloads_pending{job="ipx"}', ref="C", legend="downloads")],
+   8, w=8, desc="Scans and downloads run one at a time; a queue that only grows means the worker is stuck.")
+ts("Listeners and tasks", [prom('ipx_event_listeners{job="ipx"}', legend="live-update listeners"),
+                           prom('ipx_runtime_tasks{job="ipx"}', ref="B", legend="runtime tasks"),
+                           prom('ipx_deadair_playing{job="ipx"}', ref="C", legend="playing through DeadAir")],
+   16, w=8)
+y += 8
+ts("Memory", [prom('ipx_process_resident_bytes{job="ipx"}', legend="resident")], 0, w=12, unit="bytes")
+ts("Open files and sockets", [prom('ipx_process_open_fds{job="ipx"}', legend="open")], 12, w=12)
+y += 8
+# Jobs and queues (#195)
+ts("Worker", [prom('max by (kind) (ipx_worker_job_seconds{job="ipx"})', legend="on a {{kind}} for"),
+              prom('max(ipx_last_scan_age_seconds{job="ipx"})', ref="B", legend="since the last scan finished")],
+   0, w=8, unit="s", desc="A job's time that only climbs, or no scan for over 10 minutes, means the worker is stuck; the healthcheck still passes.")
+ts("Jobs done", [prom('sum by (kind) (increase(ipx_jobs_total{job="ipx"}[$__rate_interval]))', legend="{{kind}}")],
+   8, w=8, bars=True, stack=True)
+ts("Time on jobs", [prom('sum by (kind) (increase(ipx_job_seconds_total{job="ipx"}[$__rate_interval]))', legend="{{kind}}")],
+   16, w=8, unit="s", bars=True, stack=True, desc="Seconds the worker spent on each kind of job in each interval.")
+y += 8
+ts("In flight", [prom('max(ipx_http_requests_in_flight{job="ipx"})', legend="web requests"),
+                 prom('max(ipx_scan_feeds_fetching{job="ipx"})', ref="B", legend="feeds fetching"),
+                 prom('max(ipx_downloads_active{job="ipx"})', ref="C", legend="downloads"),
+                 prom('2 - max(ipx_torrent_slots_free{job="ipx"})', ref="D", legend="torrents")],
+   0, w=8)
+ts("Download speed", [prom('sum(rate(ipx_download_bytes_total{job="ipx"}[$__rate_interval]))', legend="downloading")],
+   8, w=8, unit="Bps")
+ts("Backlogs", [prom('max(ipx_deadair_backlog{job="ipx"})', legend="DeadAir to look at"),
+                prom('max(ipx_feed_retries{job="ipx"})', ref="B", legend="feeds to retry a lookup"),
+                prom('max(ipx_event_queue{job="ipx"})', ref="C", legend="live updates unread"),
+                prom('sum(increase(ipx_events_missed_total{job="ipx"}[$__rate_interval]))', ref="D", legend="live updates missed")],
+   16, w=8)
+y += 8
+ts("DeadAir on a file", [prom('max(ipx_deadair_busy_seconds{job="ipx"})', legend="for")], 0, w=12, unit="s",
+   desc="How long DeadAir has been on the file it is analysing; a few seconds each.")
+ts("Artwork", [prom('max(ipx_art_cache_bytes{job="ipx"}) / max(ipx_art_cache_limit_bytes{job="ipx"})', legend="full"),
+               prom('sum(increase(ipx_art_requests_total{job="ipx", result="hit"}[$__rate_interval])) / '
+                    'sum(increase(ipx_art_requests_total{job="ipx"}[$__rate_interval]))', ref="B", legend="hit rate"),
+               prom('sum(increase(ipx_art_evicted_total{job="ipx"}[$__rate_interval]))', ref="C", legend="images evicted")],
+   12, w=12, unit="percentunit",
+   desc="Full sits near 100% once the cache has filled, since each sweep trims it to fit. Hit rate is the share served from disk: "
+        "the rest was fetched from the publisher. Evicted, on the right, is images each sweep threw out to stay under the "
+        "limit: many at every sweep, with a falling hit rate, means the limit is too small.")["fieldConfig"]["overrides"] = [
+    {"matcher": {"id": "byName", "options": "images evicted"},
+     "properties": [{"id": "unit", "value": "short"}, {"id": "custom.axisPlacement", "value": "right"},
+                    {"id": "custom.drawStyle", "value": "bars"}, {"id": "custom.fillOpacity", "value": 60}]}]
+y += 8
+
 # ---- Traces
 row("Traces")
 for x, title, q in [(0, "Recent traces", TRACES + "}"),
@@ -162,6 +233,7 @@ dash = {
     "templating": {"list": [
         {"name": "loki", "label": "Logs", "type": "datasource", "query": "loki", "current": {}, "hide": 0},
         {"name": "tempo", "label": "Traces", "type": "datasource", "query": "tempo", "current": {}, "hide": 0},
+        {"name": "prometheus", "label": "Metrics", "type": "datasource", "query": "prometheus", "current": {}, "hide": 0},
     ]},
     "links": [{"title": "iPX", "type": "link", "url": "https://ipodderx.sdf1.net", "targetBlank": True}],
     "panels": panels,

package-lock.json

@@ -7,7 +7,8 @@
       "name": "ipx-web",
       "dependencies": {
         "@swc/core": "^1.16.2",
-        "@swc/html": "^1.16.2"
+        "@swc/html": "^1.16.2",
+        "hls.js": "1.6.19"
       },
       "devDependencies": {
         "@playwright/test": "^1.56.0",
@@ -871,6 +872,12 @@
         "node": ">=16.20.0"
       }
     },
+    "node_modules/hls.js": {
+      "version": "1.6.19",
+      "resolved": "https://registry.npmjs.org/hls.js/-/hls.js-1.6.19.tgz",
+      "integrity": "sha512-A//aZeaAgM5rgUCbTURD4gkfyw5Uag2/4Jky7CfDOukL/DN+P5DjbgK2BYteyP3/KnCkPfkGVkbLxQG2T0AbUQ==",
+      "license": "Apache-2.0"
+    },
     "node_modules/playwright": {
       "version": "1.63.0",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.63.0.tgz",

package.json

@@ -16,6 +16,7 @@
   },
   "dependencies": {
     "@swc/core": "^1.16.2",
-    "@swc/html": "^1.16.2"
+    "@swc/html": "^1.16.2",
+    "hls.js": "1.6.19"
   }
 }

src/art.rs

@@ -97,6 +97,8 @@ pub fn trim(dir: &Path, limit: u64) -> usize {
             gone += 1;
         }
     }
+    crate::metrics::STATS.art_cache_bytes.store(total, std::sync::atomic::Ordering::Relaxed);
+    crate::metrics::STATS.art_evicted.fetch_add(gone as u64, std::sync::atomic::Ordering::Relaxed);
     gone
 }
 

src/config.rs

@@ -97,6 +97,9 @@ pub struct Web {
     pub sign_out_url: String,
     /// Sign a session out after this long without a request.
     pub session_days: i64,
+    /// Where to serve /metrics for Prometheus (#194), on a thread of its own, without sign-in:
+    /// `0.0.0.0:9187`. Empty serves none.
+    pub metrics_bind: String,
 }
 
 impl Default for Web {
@@ -112,6 +115,7 @@ impl Default for Web {
             auto_create_users: true,
             sign_out_url: String::new(),
             session_days: 30,
+            metrics_bind: String::new(),
         }
     }
 }

src/db.rs

@@ -60,7 +60,7 @@ async fn create_missing(orm: &sea_orm::DatabaseConnection) -> Result<()> {
         schema.create_table_from_entity(blocklists::Entity),
         schema.create_table_from_entity(hidden::Entity),
         schema.create_table_from_entity(api_tokens::Entity),
-        schema.create_table_from_entity(deadair::Entity),
+        schema.create_table_from_entity(deadair_plans::Entity),
         schema.create_table_from_entity(deadair_prefs::Entity),
         schema.create_table_from_entity(deadair_saved::Entity),
     ] {
@@ -73,6 +73,10 @@ async fn create_missing(orm: &sea_orm::DatabaseConnection) -> Result<()> {
         // (#165). Also what the healthcheck's count and the Downloaded filter look for.
         "CREATE INDEX IF NOT EXISTS enclosures_on_disk ON enclosures (feed_id, guid) WHERE path IS NOT NULL",
         "CREATE UNIQUE INDEX IF NOT EXISTS users_name_lower ON users (lower(name))",
+        // Every key and date an item list sorts by, so `entries_where` pages from the index alone
+        // and visits the table only for the rows it shows. Sorting All Subscriptions from the
+        // table read all 13,700 of its rows, show notes and all, half a second to two cold (#188).
+        "CREATE INDEX IF NOT EXISTS entries_by_time ON entries (feed_id, guid, published, first_seen)",
     ] {
         orm.execute_unprepared(sql).await.with_context(|| sql.to_owned())?;
     }
@@ -91,6 +95,10 @@ async fn create_missing(orm: &sea_orm::DatabaseConnection) -> Result<()> {
             orm.execute_unprepared(sql).await.with_context(|| sql.to_owned())?;
         }
     }
+    if orm.execute_unprepared("SELECT pause_ms FROM deadair_prefs LIMIT 0").await.is_err() {
+        let sql = "ALTER TABLE deadair_prefs ADD COLUMN pause_ms BIGINT";
+        orm.execute_unprepared(sql).await.with_context(|| sql.to_owned())?;
+    }
     Ok(())
 }
 
@@ -106,6 +114,24 @@ pub fn location() -> String {
 /// The Postgres connection option that keeps notices from being sent at all; see `connect`.
 const QUIET: &str = "options=-c%20client_min_messages%3Dwarning";
 
+impl Db {
+    /// The connection pool as it stands, for /metrics (#194): connections open, those of them
+    /// idle, and the most it will open.
+    pub fn pool(&self) -> (u32, usize, u32) {
+        use sea_orm::DbBackend;
+        match self.orm.get_database_backend() {
+            DbBackend::Postgres => {
+                let p = self.orm.get_postgres_connection_pool();
+                (p.size(), p.num_idle(), p.options().get_max_connections())
+            }
+            _ => {
+                let p = self.orm.get_sqlite_connection_pool();
+                (p.size(), p.num_idle(), p.options().get_max_connections())
+            }
+        }
+    }
+}
+
 /// A URL fit for a log or an error: the password taken out.
 fn redact(url: &str) -> String {
     match (url.find("://"), url.rfind('@')) {
@@ -143,10 +169,9 @@ async fn connect(location: &str) -> Result<sea_orm::DatabaseConnection> {
     // line for it at 50 requests a second (#136). In WAL readers run beside the one writer. Each
     // transaction here writes first, so it takes the write lock or waits out the busy timeout for
     // it; SQLite refuses at once only a transaction that read a snapshot a write has since moved
-    // past. Postgres keeps sqlx's ten.
-    if !is_postgres(location) {
-        opts.max_connections(8);
-    }
+    // past. Postgres gets twenty, where sqlx's ten filled in bursts: a page load asks for dozens
+    // of covers at once, each with a lookup (#200). The server allows 100, shared with other apps.
+    opts.max_connections(if is_postgres(location) { 20 } else { 8 });
     sea_orm::Database::connect(opts)
         .await
         .with_context(|| format!("opening {}", redact(location)))
@@ -202,6 +227,7 @@ impl From<enclosures::Model> for EncRow {
         EncRow {
             id: e.id,
             deadair: None,
+            deadair_pending: false,
             feed_id: e.feed_id,
             guid: e.guid,
             url: e.url,
@@ -1184,6 +1210,10 @@ pub struct EncRow {
     /// (`deadair::for_reader`). None from the database.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub deadair: Option<i64>,
+    /// DeadAir is on for this person's show and the copy is still being made: the page says to
+    /// wait rather than leave them guessing (`deadair::for_reader`).
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub deadair_pending: bool,
     pub feed_id: String,
     pub guid: String,
     pub url: String,
@@ -1233,16 +1263,19 @@ impl Db {
     ) -> Result<Vec<EntryRow>> {
         let mut a = Args::default();
         let from = entries_from(&mut a, user_id, feed_id, filter, search, guid);
+        // The page's keys first, then its rows: the sort then needs only `entries_by_time`, not
+        // every item's row, and the show notes are read for the page alone (#188).
+        let (limit, offset) = (a.p(limit), a.p(offset));
+        let user = a.p(user_id);
         let sql = format!(
             "SELECT e.guid, e.feed_id, e.title, e.link, e.published, e.description,
                     coalesce(s.read, false) AS read, coalesce(s.flagged, false) AS flagged, e.image,
                     coalesce(s.duration, e.duration) AS duration,
                     e.episode, e.season, coalesce(s.position, 0) AS position
-             {from}
-             ORDER BY {order}
-             LIMIT {} OFFSET {}",
-            a.p(limit),
-            a.p(offset)
+             FROM (SELECT e.feed_id, e.guid {from} ORDER BY {order} LIMIT {limit} OFFSET {offset}) p
+             JOIN entries e ON e.feed_id = p.feed_id AND e.guid = p.guid
+             LEFT JOIN entry_state s ON s.user_id = {user} AND s.feed_id = e.feed_id AND s.guid = e.guid
+             ORDER BY {order}"
         );
         let mut rows = self
             .rows(&sql, a.0)
@@ -2248,28 +2281,21 @@ pub struct DeadAirTodo {
     pub path: String,
 }
 
-/// An enclosure's DeadAir copy: where it is, what it left out, and how much that came to.
-#[derive(Debug, Clone)]
-pub struct Copy {
-    pub enclosure_id: i64,
-    pub path: String,
-    pub cuts: Vec<crate::deadair::Cut>,
-    pub saved_ms: i64,
-}
-
 impl Db {
-    /// DeadAir settings as (person, feed, wanted), everyone's or one person's. An empty feed is
-    /// the switch beside the speed.
-    pub async fn deadair_prefs(&self, user_id: Option<i64>) -> Result<Vec<(i64, String, bool)>> {
+    /// DeadAir settings as (person, feed, wanted, pause in ms), everyone's or one person's. An
+    /// empty feed is the switch beside the speed.
+    pub async fn deadair_prefs(&self, user_id: Option<i64>) -> Result<Vec<(i64, String, bool, Option<i64>)>> {
         let mut a = Args::default();
         let only = match user_id {
             Some(u) => format!("WHERE user_id = {}", a.p(u)),
             None => String::new(),
         };
-        self.rows(&format!("SELECT user_id, feed_id, wanted FROM deadair_prefs {only}"), a.0)
+        self.rows(&format!("SELECT user_id, feed_id, wanted, pause_ms FROM deadair_prefs {only}"), a.0)
             .await?
             .iter()
-            .map(|r| Ok((r.try_get("", "user_id")?, r.try_get("", "feed_id")?, r.try_get("", "wanted")?)))
+            .map(|r| {
+                Ok((r.try_get("", "user_id")?, r.try_get("", "feed_id")?, r.try_get("", "wanted")?, r.try_get("", "pause_ms")?))
+            })
             .collect()
     }
 
@@ -2292,11 +2318,22 @@ impl Db {
         Ok(())
     }
 
-    /// Files on disk with no copy made since they were downloaded, oldest first.
+    /// Sets the pause DeadAir leaves in a feed for someone (#182). Only beside a setting of the
+    /// switch: inserting one here would turn a feed's group's DeadAir off for it.
+    pub async fn set_deadair_pause(&self, user_id: i64, feed_id: &str, pause_ms: i64) -> Result<()> {
+        self.exec(
+            "UPDATE deadair_prefs SET pause_ms = $1 WHERE user_id = $2 AND feed_id = $3",
+            vec![pause_ms.into(), user_id.into(), feed_id.into()],
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// Files on disk DeadAir has not looked at since they were downloaded, oldest first.
     pub async fn deadair_todo(&self) -> Result<Vec<DeadAirTodo>> {
         self.rows(
             "SELECT e.id, e.feed_id, e.guid, e.path FROM enclosures e
-               LEFT JOIN deadair d ON d.enclosure_id = e.id
+               LEFT JOIN deadair_plans d ON d.enclosure_id = e.id
               WHERE e.path IS NOT NULL AND e.state = 'done'
                 AND (d.enclosure_id IS NULL OR d.made_at < coalesce(e.downloaded_at, 0))
               ORDER BY e.id",
@@ -2330,10 +2367,15 @@ impl Db {
         Ok(!self.rows(&sql, a.0).await?.is_empty())
     }
 
-    /// Who has an item marked read, which playing it to the end or past 90% does.
-    pub async fn readers(&self, feed_id: &str, guid: &str) -> Result<Vec<i64>> {
+    /// Who has heard an episode through: their place at 90% of its length or past it, where the
+    /// page calls it played. Not the read mark, which opening an item sets too: going by it,
+    /// DeadAir passed over every episode opened before it was played (#173).
+    pub async fn finished(&self, feed_id: &str, guid: &str) -> Result<Vec<i64>> {
         self.rows(
-            "SELECT user_id FROM entry_state WHERE feed_id = $1 AND guid = $2 AND read",
+            "SELECT s.user_id FROM entry_state s
+               JOIN entries e ON e.feed_id = s.feed_id AND e.guid = s.guid
+              WHERE s.feed_id = $1 AND s.guid = $2 AND coalesce(s.duration, e.duration, 0) > 0
+                AND s.position * 10 >= coalesce(s.duration, e.duration) * 9",
             vec![feed_id.into(), guid.into()],
         )
         .await?
@@ -2342,43 +2384,40 @@ impl Db {
         .collect()
     }
 
-    /// Records the copy made of an enclosure, or with no path that it has none.
-    pub async fn store_deadair(&self, enclosure_id: i64, path: Option<&str>, cuts: &str, saved_ms: i64) -> Result<()> {
+    /// Records what DeadAir found in an enclosure: its plans as JSON, `{}` for none.
+    pub async fn store_plans(&self, enclosure_id: i64, plans: &str) -> Result<()> {
         self.exec(
-            "INSERT INTO deadair (enclosure_id, path, cuts, saved_ms, made_at) VALUES ($1, $2, $3, $4, $5)
-             ON CONFLICT (enclosure_id) DO UPDATE SET path = excluded.path, cuts = excluded.cuts,
-                 saved_ms = excluded.saved_ms, made_at = excluded.made_at",
-            vec![enclosure_id.into(), path.map(str::to_owned).into(), cuts.into(), saved_ms.into(), now().into()],
+            "INSERT INTO deadair_plans (enclosure_id, plans, made_at) VALUES ($1, $2, $3)
+             ON CONFLICT (enclosure_id) DO UPDATE SET plans = excluded.plans, made_at = excluded.made_at",
+            vec![enclosure_id.into(), plans.into(), now().into()],
         )
         .await?;
         Ok(())
     }
 
-    /// The copies there are of these enclosures, made since each was last downloaded.
-    pub async fn copies(&self, enclosure_ids: &[i64]) -> Result<Vec<Copy>> {
+    /// DeadAir's plans for these enclosures, by pause, for each one it has looked at since it
+    /// was last downloaded and is still on disk. Empty for a file it does not apply to; missing
+    /// for one it has yet to look at.
+    pub async fn plans(
+        &self,
+        enclosure_ids: &[i64],
+    ) -> Result<std::collections::HashMap<i64, std::collections::BTreeMap<i64, crate::deadair::Plan>>> {
         if enclosure_ids.is_empty() {
-            return Ok(vec![]);
+            return Ok(Default::default());
         }
         let mut a = Args::default();
         let ids: Vec<String> = enclosure_ids.iter().map(|&i| a.p(i)).collect();
         let sql = format!(
-            "SELECT d.enclosure_id, d.path, d.cuts, d.saved_ms FROM deadair d
-               JOIN enclosures e ON e.id = d.enclosure_id
-              WHERE d.enclosure_id IN ({}) AND d.path IS NOT NULL AND e.path IS NOT NULL
-                AND d.made_at >= coalesce(e.downloaded_at, 0)",
+            "SELECT d.enclosure_id, d.plans FROM deadair_plans d JOIN enclosures e ON e.id = d.enclosure_id
+              WHERE d.enclosure_id IN ({}) AND e.path IS NOT NULL AND d.made_at >= coalesce(e.downloaded_at, 0)",
             ids.join(", ")
         );
         self.rows(&sql, a.0)
             .await?
             .iter()
             .map(|r| {
-                let cuts: String = r.try_get("", "cuts")?;
-                Ok(Copy {
-                    enclosure_id: r.try_get("", "enclosure_id")?,
-                    path: r.try_get("", "path")?,
-                    cuts: serde_json::from_str(&cuts).context("reading DeadAir's cuts")?,
-                    saved_ms: r.try_get("", "saved_ms")?,
-                })
+                let plans: String = r.try_get("", "plans")?;
+                Ok((r.try_get("", "enclosure_id")?, serde_json::from_str(&plans).context("reading DeadAir's plans")?))
             })
             .collect()
     }
@@ -2434,13 +2473,17 @@ mod tests {
     use super::*;
 
     #[tokio::test]
-    async fn deadair_copies_are_made_once_per_download_and_counted_once_per_episode() {
+    async fn deadair_looks_at_a_file_once_per_download_and_counts_an_episode_once() {
         let db = Db::memory().await.unwrap();
         let u = db.create_user("dee", None, false).await.unwrap();
         db.set_deadair(u, "f", Some(true)).await.unwrap();
         db.set_deadair(u, "g", Some(false)).await.unwrap();
         db.set_deadair(u, "g", None).await.unwrap();
-        assert_eq!(db.deadair_prefs(Some(u)).await.unwrap(), vec![(u, "f".to_string(), true)]);
+        assert_eq!(db.deadair_prefs(Some(u)).await.unwrap(), vec![(u, "f".to_string(), true, None)]);
+        db.set_deadair_pause(u, "f", 500).await.unwrap();
+        // Only beside a setting of the switch: a row of its own would turn DeadAir off for "g".
+        db.set_deadair_pause(u, "g", 400).await.unwrap();
+        assert_eq!(db.deadair_prefs(Some(u)).await.unwrap(), vec![(u, "f".to_string(), true, Some(500))]);
         for sql in [
             "INSERT INTO enclosures (id, feed_id, guid, url, path, state, downloaded_at)
              VALUES (1, 'f', 'g', 'http://x/a.mp3', '/x/a.mp3', 'done', 100)",
@@ -2452,25 +2495,28 @@ mod tests {
         let todo = db.deadair_todo().await.unwrap();
         assert_eq!(todo.iter().map(|t| t.id).collect::<Vec<_>>(), [1], "only a file on disk");
 
-        db.store_deadair(1, Some("/x/a.deadair.mp3"), "[[1000,3000]]", 2000).await.unwrap();
+        db.store_plans(1, r#"{"300": {"cuts": [[1000,3000]], "pieces": [[0,10,1.0]]}}"#).await.unwrap();
         assert!(db.deadair_todo().await.unwrap().is_empty());
-        let c = db.copies(&[1, 2]).await.unwrap();
-        assert_eq!((c.len(), c[0].cuts.as_slice(), c[0].saved_ms), (1, &[crate::deadair::Cut(1000, 3000)][..], 2000));
-        // Downloaded again since: the copy is stale until made again.
+        let p = db.plans(&[1, 2]).await.unwrap();
+        assert_eq!((p.len(), p[&1][&300].cuts.as_slice(), p[&1][&300].saved_ms()), (1, &[crate::deadair::Cut(1000, 3000)][..], 2000));
+        // Downloaded again since: looked at again before it plays shortened.
         db.orm.execute_unprepared(&format!("UPDATE enclosures SET downloaded_at = {} WHERE id = 1", now() + 60)).await.unwrap();
         assert_eq!(db.deadair_todo().await.unwrap().len(), 1);
-        assert!(db.copies(&[1]).await.unwrap().is_empty());
+        assert!(db.plans(&[1]).await.unwrap().is_empty());
 
         assert!(!db.subscribed_any(&[u], "f").await.unwrap());
         db.subscribe(u, "f").await.unwrap();
         assert!(db.subscribed_any(&[u], "f").await.unwrap());
-        assert!(db.readers("f", "g").await.unwrap().is_empty());
+        // Opened, which marks it read, and not played: not finished (#173).
         db.set_entry_flag(u, "f", "g", EntryFlag::Read, true).await.unwrap();
-        assert_eq!(db.readers("f", "g").await.unwrap(), [u]);
+        assert!(db.finished("f", "g").await.unwrap().is_empty());
 
         assert_eq!(db.entry_duration(u, "f", "g").await.unwrap(), Some(600));
         db.set_position(u, "f", "g", 10, Some(590)).await.unwrap();
         assert_eq!(db.entry_duration(u, "f", "g").await.unwrap(), Some(590), "what the player measured");
+        assert!(db.finished("f", "g").await.unwrap().is_empty());
+        db.set_position(u, "f", "g", 540, Some(590)).await.unwrap();
+        assert_eq!(db.finished("f", "g").await.unwrap(), [u], "past 90%");
 
         assert_eq!(db.deadair_total(u).await.unwrap(), 0);
         db.count_deadair(u, "f", "g", 2000).await.unwrap();
@@ -2570,6 +2616,10 @@ mod tests {
         assert_eq!(order("type", "asc").await.first().map(String::as_str), Some("n"));
         db.exec_for_test("DELETE FROM entries WHERE guid = 'n';").await.unwrap();
         assert_eq!(order("published", "desc").await, ["c", "b", "a"]);
+        // A page from the middle: the keys are paged before the rows are read (#188).
+        let page: Vec<String> = db.entries_in(1, None, Filter::All, None, 1, 1, &order_sql("published", "desc")).await
+            .unwrap().into_iter().map(|e| e.guid).collect();
+        assert_eq!(page, ["b"]);
         db.set_entry_flag(1, "f", "a", EntryFlag::Flagged, true).await.unwrap();
         assert_eq!(order("kept", "desc").await[0], "a");
         // A pin does not lift an item above the others in any other sort (#36).

src/deadair.rs

@@ -1,20 +1,27 @@
-//! DeadAir (issue #171): podcasts play from a copy with their long silences shortened, so they
-//! finish sooner without sounding sped up.
+//! DeadAir (issue #171): podcasts play with their long silences shortened, so they finish
+//! sooner without sounding sped up.
 //!
-//! The copy is the original's own frames with the silent ones left out, copied by ffmpeg with
-//! nothing re-encoded: about 10 s an hour of audio on one core, finding the silences included.
-//! It is made in the background, one file at a time, for files in feeds someone has DeadAir on
-//! for, and kept beside the original (`copy_path`) until `download::remove` takes both.
+//! Nothing is copied (#181). DeadAir finds a file's silences once, in the background, and keeps a
+//! `Plan` for each pause length a person can choose (#182): the frames kept, as byte ranges of
+//! the original. The player gets an HLS playlist of those ranges (`playlist`), which Safari plays
+//! itself and other browsers through hls.js, with no gap at the cuts. Seeking past each silence
+//! instead left about 1.3 s of nothing at every one (#178); a copy made with ffmpeg cost as much
+//! disk again as the original and could only have one pause length.
 //!
-//! Positions stay in the original's time. What the copy left out is stored as `Cut`s of the
+//! Positions stay in the original's time. What a plan leaves out is stored as `Cut`s of the
 //! original's time, and the server converts both ways (`to_copy`, `to_original`): the iOS and
 //! Android apps save positions themselves, from their own player, so converting in the page
 //! would miss them.
 
-use std::collections::HashMap;
-use std::path::{Path, PathBuf};
+use std::collections::{BTreeMap, HashMap};
+use std::fmt::Write as _;
+use std::path::Path;
 use std::sync::Arc;
 
+use tracing::Instrument;
+
+use crate::db::step;
+
 use anyhow::{Context, Result, bail};
 use serde::{Deserialize, Serialize};
 
@@ -24,31 +31,80 @@ use crate::Ctx;
 /// issue used. A podcast's room tone sits well below it and speech well above.
 const THRESHOLD: &str = "-38dB";
 const MIN_SILENCE: f64 = 0.35;
-/// Kept at each end of a silence, so the frames on both sides of a cut are silent. Decoding
+/// The pauses a person can have DeadAir leave where it cuts a silence, in ms (#182). Half of it
+/// is kept at each end of the silence, so the frames on both sides of a cut are silent. Decoding
 /// blends a frame with the one before it, and an MP3 frame can begin in the bytes of the frame
 /// before (the bit reservoir): the first frame after a cut decodes against the wrong neighbour,
 /// which nobody hears between two silent frames and everyone hears at the start of a word.
-const KEEP: f64 = 0.1;
-/// ffmpeg takes the frames to drop as one argument, and Linux refuses an argument over 128 KiB.
-// shortcut: a file with more silences than this keeps only its longest; about 9 hours of
-// conversation at the rate measured. Pass the list some other way if a feed ever gets there.
-const MAX_CUTS: usize = 4000;
+pub const PAUSES: [i64; 4] = [200, 300, 400, 500];
+/// 0.2 s, the first DeadAir's, made speech sound rushed.
+pub const DEFAULT_PAUSE: i64 = 300;
+/// The longest piece of a playlist, in seconds: about what HLS players expect, so a long stretch
+/// of talk is not one request for megabytes.
+const MAX_PIECE: f64 = 10.0;
 /// How long the maker waits when there is nothing to do: a download or a feed turned on is
 /// picked up this long after, at most.
 const IDLE: std::time::Duration = std::time::Duration::from_secs(120);
 
-/// A span of the original, in milliseconds, that the copy leaves out.
+/// A span of the original, in milliseconds, that DeadAir leaves out.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
 pub struct Cut(pub i64, pub i64);
 
-/// Where the copy of `original` goes: beside it, `name.deadair.mp3` for `name.mp3`.
-pub fn copy_path(original: &Path) -> PathBuf {
-    let stem = original.file_stem().map(|s| s.to_string_lossy()).unwrap_or_default();
-    let name = match original.extension() {
-        Some(ext) => format!("{stem}.deadair.{}", ext.to_string_lossy()),
-        None => format!("{stem}.deadair"),
-    };
-    original.with_file_name(name)
+/// What one pause length leaves of a file: what it cuts, and what it keeps as pieces of the
+/// original, (byte offset, bytes, seconds).
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct Plan {
+    pub cuts: Vec<Cut>,
+    pub pieces: Vec<(u64, u64, f64)>,
+}
+
+impl Plan {
+    pub fn saved_ms(&self) -> i64 {
+        saved(&self.cuts)
+    }
+}
+
+/// The length of the ID3v2 tag a file starts with, 0 if it has none.
+pub fn id3_len(head: &[u8]) -> u64 {
+    if head.len() < 10 || &head[..3] != b"ID3" {
+        return 0;
+    }
+    // Seven bits a byte, so no byte of the size looks like the start of a frame.
+    let size = head[6..10].iter().fold(0u64, |n, b| n << 7 | u64::from(b & 0x7f));
+    let footer = if head[5] & 0x10 != 0 { 10 } else { 0 };
+    10 + size + footer
+}
+
+/// A file as `plan` plays it, to save (#186): its ID3 tag, so the title and artwork come too, then
+/// the pieces one after another. MP3 and ADTS frames each stand alone, so that is a file any
+/// player plays. Read as it is sent and never stored, as the playlist is: (its length, its bytes).
+pub async fn kept(
+    path: &Path,
+    plan: &Plan,
+) -> std::io::Result<(u64, impl futures_util::Stream<Item = std::io::Result<axum::body::Bytes>> + use<>)> {
+    use tokio::io::{AsyncReadExt, AsyncSeekExt};
+    let mut file = tokio::fs::File::open(path).await?;
+    let mut head = [0u8; 10];
+    let n = file.read(&mut head).await?;
+    // Only up to the first frame kept: past the tag can be the Xing frame, which gives the
+    // original's length.
+    let first = plan.pieces.first().map_or(0, |p| p.0);
+    let tag = id3_len(&head[..n]).min(first);
+    let ranges: std::collections::VecDeque<(u64, u64)> =
+        std::iter::once((0, tag)).chain(plan.pieces.iter().map(|&(o, n, _)| (o, n))).filter(|r| r.1 > 0).collect();
+    let len = ranges.iter().map(|r| r.1).sum();
+    let body = futures_util::stream::try_unfold((file, ranges), |(mut f, mut left)| async move {
+        let Some((off, n)) = left.pop_front() else { return Ok(None) };
+        let mut buf = vec![0; n.min(1 << 16) as usize];
+        f.seek(std::io::SeekFrom::Start(off)).await?;
+        f.read_exact(&mut buf).await?;
+        let got = buf.len() as u64;
+        if got < n {
+            left.push_front((off + got, n - got));
+        }
+        Ok(Some((axum::body::Bytes::from(buf), (f, left))))
+    });
+    Ok((len, body))
 }
 
 /// The silences silencedetect reported, as (start, end) seconds. One still open at the end of
@@ -75,29 +131,69 @@ fn after(line: &str, key: &str) -> Option<f64> {
 
 /// Which frames to drop for these silences, as inclusive ranges of frame numbers, and the same
 /// as `Cut`s. Frame `n` plays from `first + n * frame` seconds. Only frames wholly inside a
-/// silence, `KEEP` in from each end, go.
-pub fn plan(silences: &[(f64, f64)], first: f64, frame: f64) -> (Vec<(u64, u64)>, Vec<Cut>) {
-    let mut spans: Vec<(u64, u64)> = silences
+/// silence, `keep` seconds in from each end, go.
+pub fn plan(silences: &[(f64, f64)], first: f64, frame: f64, keep: f64) -> (Vec<(u64, u64)>, Vec<Cut>) {
+    let spans: Vec<(u64, u64)> = silences
         .iter()
         .filter(|(s, e)| e - s >= MIN_SILENCE)
         .filter_map(|&(s, e)| {
-            let a = ((s + KEEP - first) / frame).ceil().max(0.0) as u64;
-            let b = ((e - KEEP - first) / frame).floor() as i64 - 1;
+            let a = ((s + keep - first) / frame).ceil().max(0.0) as u64;
+            let b = ((e - keep - first) / frame).floor() as i64 - 1;
             (b >= a as i64).then_some((a, b as u64))
         })
         .collect();
-    if spans.len() > MAX_CUTS {
-        spans.sort_by_key(|&(a, b)| std::cmp::Reverse(b - a));
-        spans.truncate(MAX_CUTS);
-        spans.sort();
-    }
     let ms = |n: u64| ((first + n as f64 * frame) * 1000.0).round() as i64;
     let cuts = spans.iter().map(|&(a, b)| Cut(ms(a), ms(b + 1))).collect();
     (spans, cuts)
 }
 
-/// A time in the original, in ms, as the same moment in the copy. A time inside a cut is where
-/// the cut was made.
+/// The frames kept, as pieces of the file: runs of frames lying end to end in it, none past
+/// `MAX_PIECE`. `frames` is each frame's (byte offset, bytes); `drop` is from `plan`.
+pub fn pieces(frames: &[(u64, u64)], drop: &[(u64, u64)], frame: f64) -> Vec<(u64, u64, f64)> {
+    let most = ((MAX_PIECE / frame).floor() as usize).max(1);
+    let mut out = Vec::new();
+    let push = |out: &mut Vec<(u64, u64, f64)>, (first, n): (usize, usize)| {
+        let (start, (pos, size)) = (frames[first].0, frames[first + n - 1]);
+        out.push((start, pos + size - start, n as f64 * frame));
+    };
+    let mut drops = drop.iter().peekable();
+    let mut run: Option<(usize, usize)> = None;
+    for (n, &(pos, _)) in frames.iter().enumerate() {
+        while drops.peek().is_some_and(|&&(_, b)| (b as usize) < n) {
+            drops.next();
+        }
+        let dropped = drops.peek().is_some_and(|&&(a, _)| a as usize <= n);
+        // Something between two frames (an ID3 tag partway through) ends a piece too.
+        let joins = !dropped
+            && run.is_some_and(|(f, c)| c < most && frames[f + c - 1].0 + frames[f + c - 1].1 == pos);
+        if !joins && let Some(r) = run.take() {
+            push(&mut out, r);
+        }
+        if !dropped {
+            run = Some(run.map_or((n, 1), |(f, c)| (f, c + 1)));
+        }
+    }
+    if let Some(r) = run {
+        push(&mut out, r);
+    }
+    out
+}
+
+/// The HLS playlist for a plan: each piece a byte range of `uri`, the original.
+pub fn playlist(plan: &Plan, uri: &str) -> String {
+    let longest = plan.pieces.iter().map(|p| p.2).fold(0.0, f64::max);
+    let mut s = format!(
+        "#EXTM3U\n#EXT-X-VERSION:4\n#EXT-X-TARGETDURATION:{}\n#EXT-X-PLAYLIST-TYPE:VOD\n#EXT-X-MEDIA-SEQUENCE:0\n",
+        longest.ceil() as u64
+    );
+    for &(off, len, secs) in &plan.pieces {
+        let _ = write!(s, "#EXTINF:{secs:.6},\n#EXT-X-BYTERANGE:{len}@{off}\n{uri}\n");
+    }
+    s + "#EXT-X-ENDLIST\n"
+}
+
+/// A time in the original, in ms, as the same moment in the shortened version. A time inside a
+/// cut is where the cut was made.
 pub fn to_copy(cuts: &[Cut], ms: i64) -> i64 {
     let mut out = ms;
     for &Cut(s, e) in cuts {
@@ -113,7 +209,7 @@ pub fn to_copy(cuts: &[Cut], ms: i64) -> i64 {
     out
 }
 
-/// A time in the copy, in ms, as the same moment in the original.
+/// A time in the shortened version, in ms, as the same moment in the original.
 pub fn to_original(cuts: &[Cut], ms: i64) -> i64 {
     let mut out = ms;
     for &Cut(s, e) in cuts {
@@ -130,24 +226,29 @@ pub fn saved(cuts: &[Cut]) -> i64 {
     cuts.iter().map(|Cut(s, e)| e - s).sum()
 }
 
-/// Whether someone with these settings plays a feed from its copies. Off for every feed until
-/// they turn it on for that one, or for the group it came in (an OPML or a Patreon creator),
-/// which a feed of the group can still say otherwise to.
+/// Whether someone with these settings plays a feed shortened. Off for every feed until they
+/// turn it on for that one, or for the group it came in (an OPML or a Patreon creator), which a
+/// feed of the group can still say otherwise to.
 pub fn wants(prefs: &HashMap<String, bool>, feed: &str, group: Option<&str>) -> bool {
     prefs.get(feed).or_else(|| group.and_then(|g| prefs.get(g))).copied().unwrap_or(false)
 }
 
 /// The settings of each person with DeadAir on for something, and each managed feed's group,
-/// which is what `wants` needs.
+/// which is what `wants` and `pause` need.
 pub struct Wanting {
     pub people: HashMap<i64, HashMap<String, bool>>,
+    pub pauses: HashMap<(i64, String), i64>,
     pub groups: HashMap<String, String>,
 }
 
 impl Wanting {
     pub async fn load(ctx: &Ctx, only: Option<i64>) -> Result<Self> {
         let mut people: HashMap<i64, HashMap<String, bool>> = HashMap::new();
-        for (user, feed, wanted) in ctx.db.deadair_prefs(only).await? {
+        let mut pauses = HashMap::new();
+        for (user, feed, wanted, pause) in ctx.db.deadair_prefs(only).await? {
+            if let Some(p) = pause {
+                pauses.insert((user, feed.clone()), p);
+            }
             people.entry(user).or_default().insert(feed, wanted);
         }
         people.retain(|_, p| p.values().any(|&w| w));
@@ -156,7 +257,7 @@ impl Wanting {
         } else {
             ctx.db.managed_feeds().await?.into_iter().map(|m| (m.id, m.group_id)).collect()
         };
-        Ok(Self { people, groups })
+        Ok(Self { people, pauses, groups })
     }
 
     pub fn wants(&self, user: i64, feed: &str) -> bool {
@@ -164,18 +265,44 @@ impl Wanting {
             .get(&user)
             .is_some_and(|p| wants(p, feed, self.groups.get(feed).map(String::as_str)))
     }
+
+    /// The pause this person has DeadAir leave in a feed: the feed's, else its group's.
+    pub fn pause(&self, user: i64, feed: &str) -> i64 {
+        let group = self.groups.get(feed);
+        self.pauses
+            .get(&(user, feed.to_owned()))
+            .or_else(|| group.and_then(|g| self.pauses.get(&(user, g.clone()))))
+            .copied()
+            .unwrap_or(DEFAULT_PAUSE)
+    }
 }
 
-/// What each person is playing from a copy, by (person, feed, guid): set when `/media` serves
-/// them a copy and cleared when it serves the original, so a saved position is converted from
-/// the clock it was measured in, whether the page saved it or a native app did.
-// shortcut: in memory, so a restart forgets it. A position saved before the player next asks
-// for more of the copy is then taken as the original's, which resumes a little early, never late.
-pub type Playing = Arc<std::sync::Mutex<HashMap<(i64, String, String), Arc<crate::db::Copy>>>>;
+/// The plan someone plays a file with: their pause's, for a file in a feed they have DeadAir on
+/// for, once its silences are found. None if it cuts nothing.
+fn chosen(wanting: &Wanting, user: i64, feed: &str, plans: &BTreeMap<i64, Plan>) -> Option<Plan> {
+    if !wanting.wants(user, feed) {
+        return None;
+    }
+    plans.get(&wanting.pause(user, feed)).filter(|p| !p.cuts.is_empty()).cloned()
+}
 
-/// Puts a page of entries in the clock of what this person will play: for each file with a
-/// copy they play, `deadair` is the seconds it saves, and the entry's position and length are
-/// the copy's. The page plays `/media/{id}/deadair` for a file that has it.
+/// What each person is playing shortened, by (person, feed, guid): set when they are handed the
+/// playlist and cleared when `/media` serves them the original, so a saved position is converted
+/// from the clock it was measured in, whether the page saved it or a native app did.
+// shortcut: in memory, so a restart forgets it. A position saved before the player next asks
+// for the playlist is then taken as the original's, which resumes a little early, never late.
+pub type Playing = Arc<std::sync::Mutex<HashMap<(i64, String, String), Arc<Plan>>>>;
+
+/// The plan for one file as this person would play it, for the playlist route.
+pub async fn plan_for(ctx: &Ctx, user: i64, feed: &str, enclosure: i64) -> Result<Option<Plan>> {
+    let wanting = Wanting::load(ctx, Some(user)).await?;
+    let plans = ctx.db.plans(&[enclosure]).await?;
+    Ok(plans.get(&enclosure).and_then(|p| chosen(&wanting, user, feed, p)))
+}
+
+/// Puts a page of entries in the clock of what this person will play: for each file they play
+/// shortened, `deadair` is the seconds it saves, and the entry's position and length are the
+/// shortened version's. The page plays `/media/{id}/deadair.m3u8` for a file that has it.
 pub async fn for_reader(ctx: &Ctx, user: i64, rows: &mut [crate::db::EntryRow]) -> Result<()> {
     let wanting = Wanting::load(ctx, Some(user)).await?;
     if wanting.people.is_empty() {
@@ -186,17 +313,19 @@ pub async fn for_reader(ctx: &Ctx, user: i64, rows: &mut [crate::db::EntryRow])
         .filter(|r| wanting.wants(user, &r.feed_id))
         .flat_map(|r| r.enclosures.iter().filter(|e| e.path.is_some()).map(|e| e.id))
         .collect();
-    let copies: HashMap<i64, crate::db::Copy> =
-        ctx.db.copies(&ids).await?.into_iter().map(|c| (c.enclosure_id, c)).collect();
+    let plans = ctx.db.plans(&ids).await?;
     for r in rows.iter_mut() {
+        // Heard through already: the maker passes it over, so nothing is coming.
+        let finished = r.duration.is_some_and(|d| d > 0 && r.position * 10 >= d * 9);
         let mut converted = false;
         for e in &mut r.enclosures {
-            let Some(c) = copies.get(&e.id) else { continue };
-            e.deadair = Some(c.saved_ms / 1000);
-            // One position an item, however many files: the first with a copy sets the clock.
+            e.deadair_pending = ids.contains(&e.id) && e.state == "done" && !plans.contains_key(&e.id) && !finished;
+            let Some(p) = plans.get(&e.id).and_then(|p| chosen(&wanting, user, &r.feed_id, p)) else { continue };
+            e.deadair = Some(p.saved_ms() / 1000);
+            // One position an item, however many files: the first played shortened sets the clock.
             if !std::mem::replace(&mut converted, true) {
-                r.position = to_copy(&c.cuts, r.position * 1000) / 1000;
-                r.duration = r.duration.map(|d| to_copy(&c.cuts, d * 1000) / 1000);
+                r.position = to_copy(&p.cuts, r.position * 1000) / 1000;
+                r.duration = r.duration.map(|d| to_copy(&p.cuts, d * 1000) / 1000);
             }
         }
     }
@@ -204,8 +333,8 @@ pub async fn for_reader(ctx: &Ctx, user: i64, rows: &mut [crate::db::EntryRow])
 }
 
 /// A position and length a player saved, in the clock of what it was playing, as the
-/// original's. Past 75% of a copy, the episode also counts towards the time DeadAir has saved
-/// this person.
+/// original's. Past 75% of the shortened version, the episode also counts towards the time
+/// DeadAir has saved this person.
 pub async fn on_save(
     ctx: &Ctx,
     playing: &Playing,
@@ -215,9 +344,9 @@ pub async fn on_save(
     secs: i64,
     duration: Option<i64>,
 ) -> Result<(i64, Option<i64>)> {
-    let copy = playing.lock().unwrap().get(&(user, feed.to_owned(), guid.to_owned())).cloned();
-    let Some(c) = copy else { return Ok((secs, duration)) };
-    let original = |s: i64| to_original(&c.cuts, s * 1000) / 1000;
+    let plan = playing.lock().unwrap().get(&(user, feed.to_owned(), guid.to_owned())).cloned();
+    let Some(p) = plan else { return Ok((secs, duration)) };
+    let original = |s: i64| to_original(&p.cuts, s * 1000) / 1000;
     let (secs, duration) = (original(secs), duration.map(original));
     let len = match duration {
         Some(d) => Some(d),
@@ -227,28 +356,31 @@ pub async fn on_save(
         && len > 0
         && secs * 4 >= len * 3
     {
-        ctx.db.count_deadair(user, feed, guid, c.saved_ms).await?;
+        ctx.db.count_deadair(user, feed, guid, p.saved_ms()).await?;
     }
     Ok((secs, duration))
 }
 
-/// Makes copies until stopped: the next one anyone wants, or a wait of `IDLE` when there is
-/// none.
+/// Finds silences until stopped: in the next file anyone wants shortened, or a wait of `IDLE`
+/// when there is none.
 pub async fn run(ctx: Arc<Ctx>, mut stop: tokio::sync::watch::Receiver<bool>) {
     if !have_ffmpeg().await {
-        tracing::warn!("ffmpeg is not installed, so DeadAir makes no copies");
+        tracing::warn!("ffmpeg is not installed, so DeadAir shortens nothing");
         return;
     }
+    // Files ffmpeg failed on, passed over until the next start. Not stored: a failure recorded
+    // as the file having nothing to cut was never tried again, even once a fix was deployed (#174).
+    let mut failed = std::collections::HashSet::new();
     loop {
         // Dropping the pass on a signal kills the ffmpeg it is running (`kill_on_drop`).
-        let made = tokio::select! {
+        let done = tokio::select! {
             _ = stop.changed() => return,
-            made = next(&ctx) => made,
+            done = next(&ctx, &mut failed) => done,
         };
-        match made {
+        match done {
             Ok(true) => continue,
             Ok(false) => {}
-            Err(e) => tracing::warn!(error = %format!("{e:#}"), "DeadAir could not make a copy"),
+            Err(e) => tracing::warn!(error = %format!("{e:#}"), "DeadAir could not read a file"),
         }
         tokio::select! {
             _ = stop.changed() => return,
@@ -267,95 +399,121 @@ async fn have_ffmpeg() -> bool {
         .is_ok_and(|s| s.success())
 }
 
-/// Makes one copy someone wants, if there is one to make. A file everyone who would play the
-/// copy has already finished gets none: finished episodes are rarely played again.
+/// Plans one file someone wants shortened, if there is one. A file everyone who would play it
+/// shortened has already heard through gets none: finished episodes are rarely played again.
 // shortcut: those stay on the list and are looked at again each pass, one query each; record
 // them as passed over if a large library makes the pass slow.
-async fn next(ctx: &Ctx) -> Result<bool> {
+async fn next(ctx: &Ctx, failed: &mut std::collections::HashSet<i64>) -> Result<bool> {
     // Nobody with DeadAir on for anything, which is most passes: nothing more to ask the database.
+    use std::sync::atomic::Ordering::Relaxed;
+    let st = &crate::metrics::STATS;
     let wanting = Wanting::load(ctx, None).await?;
     if wanting.people.is_empty() {
+        st.deadair_backlog.store(0, Relaxed);
         return Ok(false);
     }
-    for t in ctx.db.deadair_todo().await? {
+    let todo = ctx.db.deadair_todo().await?;
+    // For /metrics (#195): files of feeds someone has DeadAir on, from memory, without the
+    // per-file subscription and finished checks below.
+    let wanted = |t: &crate::db::DeadAirTodo| !failed.contains(&t.id) && wanting.people.keys().any(|&u| wanting.wants(u, &t.feed_id));
+    st.deadair_backlog.store(todo.iter().filter(|t| wanted(t)).count() as i64, Relaxed);
+    for t in todo {
+        if failed.contains(&t.id) {
+            continue;
+        }
         let users: Vec<i64> =
             wanting.people.keys().copied().filter(|&u| wanting.wants(u, &t.feed_id)).collect();
         if users.is_empty() || !ctx.db.subscribed_any(&users, &t.feed_id).await? {
             continue;
         }
-        let readers = ctx.db.readers(&t.feed_id, &t.guid).await?;
-        if users.iter().all(|u| readers.contains(u)) {
+        let finished = ctx.db.finished(&t.feed_id, &t.guid).await?;
+        if users.iter().all(|u| finished.contains(u)) {
             continue;
         }
         let src = crate::download::playable(Path::new(&t.path));
         let started = std::time::Instant::now();
-        let made = make(&src).await;
-        let (path, cuts) = match made {
-            Ok(Some((path, cuts))) => (Some(path.display().to_string()), cuts),
-            Ok(None) => (None, vec![]),
+        // A trace of its own for each file looked at, not for the passes that find nothing to do,
+        // which are most of them.
+        let span = tracing::info_span!("deadair", feed = t.feed_id, enclosure = t.id, cuts = tracing::field::Empty);
+        st.deadair_busy_since.store(crate::db::now(), Relaxed);
+        let analysed = analyse(&src).instrument(span.clone()).await;
+        st.deadair_busy_since.store(0, Relaxed);
+        let plans = match analysed {
+            Ok(p) => p.unwrap_or_default(),
             Err(e) => {
-                // Recorded as having none, so a file ffmpeg cannot read is not tried every pass.
-                tracing::warn!(path = %src.display(), error = %format!("{e:#}"), "DeadAir could not make a copy");
-                (None, vec![])
+                tracing::warn!(path = %src.display(), error = %format!("{e:#}"), "DeadAir could not read a file");
+                failed.insert(t.id);
+                return Ok(true);
             }
         };
-        let saved_ms = saved(&cuts);
-        ctx.db.store_deadair(t.id, path.as_deref(), &serde_json::to_string(&cuts)?, saved_ms).await?;
+        ctx.db.store_plans(t.id, &serde_json::to_string(&plans)?).instrument(span.in_scope(|| step("store_plans"))).await?;
+        let usual = plans.get(&DEFAULT_PAUSE);
+        span.record("cuts", usual.map_or(0, |p| p.cuts.len()));
+        let saved_ms = usual.map_or(0, Plan::saved_ms);
+        ctx.out.emit(crate::ipc::Event::DeadairDone { feed: t.feed_id.clone(), enclosure: t.id, saved_s: saved_ms / 1000 });
+        // The event says it too (ev="deadair_done"); this line has how long it took and how many cuts.
         tracing::info!(
-            ev = "deadair",
             feed = t.feed_id,
             path = %src.display(),
-            cuts = cuts.len(),
+            cuts = usual.map_or(0, |p| p.cuts.len()),
             saved_s = saved_ms / 1000,
             took_ms = started.elapsed().as_millis() as u64,
-            "DeadAir copy made"
+            "DeadAir found the silences"
         );
         return Ok(true);
     }
     Ok(false)
 }
 
-/// Makes the copy of one file. None for a file it does not apply to: video, anything but MP3
-/// and AAC, or one with no silence long enough to cut.
-pub async fn make(src: &Path) -> Result<Option<(PathBuf, Vec<Cut>)>> {
-    let Some((first, frame)) = probe(src).await? else { return Ok(None) };
+/// A plan for each of `PAUSES`, for one file. None for a file DeadAir does not apply to: video,
+/// anything but MP3 or AAC on its own (ADTS; AAC in MP4 has no byte ranges a playlist can
+/// use), or one with no silence long enough to cut.
+pub async fn analyse(src: &Path) -> Result<Option<BTreeMap<i64, Plan>>> {
+    let Some((first, frame)) = probe(src).instrument(step("probe")).await? else { return Ok(None) };
+    let path = src.display().to_string();
     let log = ffmpeg(&[
-        "-hide_banner", "-nostats", "-i", &src.display().to_string(), "-map", "0:a:0",
+        "-hide_banner", "-nostats", "-i", &path, "-map", "0:a:0",
         "-af", &format!("silencedetect=n={THRESHOLD}:d={MIN_SILENCE}"), "-f", "null", "-",
     ])
+    .instrument(step("silencedetect"))
     .await
     .context("finding the silences")?;
-    let (frames, cuts) = plan(&parse_silences(&log), first, frame);
-    if cuts.is_empty() {
-        return Ok(None);
-    }
-    let drop: Vec<String> = frames.iter().map(|(a, b)| format!("between(n\\,{a}\\,{b})")).collect();
-    let dst = copy_path(src);
-    // Written under another name and moved into place, so a copy cut short by a restart is
-    // never served.
-    let tmp = dst.with_file_name(format!(
-        "{}.part.{}",
-        dst.file_stem().unwrap_or_default().to_string_lossy(),
-        dst.extension().unwrap_or_default().to_string_lossy()
-    ));
-    ffmpeg(&[
-        "-v", "error", "-y", "-i", &src.display().to_string(), "-map", "0:a:0", "-c", "copy",
-        "-bsf:a", &format!("noise=drop='{}',setts=ts=N*DURATION", drop.join("+")),
-        &tmp.display().to_string(),
+    let silences = parse_silences(&log);
+    let frames = frame_bytes(&path).instrument(step("frame_bytes")).await?;
+    let plans: BTreeMap<i64, Plan> = PAUSES
+        .iter()
+        .map(|&pause| {
+            let (drop, cuts) = plan(&silences, first, frame, pause as f64 / 2000.0);
+            (pause, Plan { cuts, pieces: pieces(&frames, &drop, frame) })
+        })
+        .collect();
+    Ok(plans.values().any(|p| !p.cuts.is_empty()).then_some(plans))
+}
+
+/// Where each audio frame is in the file, as (byte offset, bytes), in order.
+async fn frame_bytes(path: &str) -> Result<Vec<(u64, u64)>> {
+    let out = run_out("ffprobe", &[
+        "-v", "error", "-select_streams", "a:0", "-show_entries", "packet=pos,size", "-of", "compact=p=0", path,
     ])
-    .await
-    .context("copying the frames kept")?;
-    tokio::fs::rename(&tmp, &dst).await.with_context(|| format!("moving into {}", dst.display()))?;
-    Ok(Some((dst, cuts)))
+    .await?;
+    // ffprobe writes the fields in its own order, not the order asked for: by name, then.
+    out.lines()
+        .map(|l| {
+            let field = |k: &str| {
+                l.split('|').find_map(|f| f.strip_prefix(k)?.strip_prefix('=')?.parse::<u64>().ok())
+            };
+            field("pos").zip(field("size")).with_context(|| format!("reading ffprobe's frame: {l}"))
+        })
+        .collect()
 }
 
 /// When the first audio frame starts and how long each lasts, in seconds, for a file DeadAir
-/// can copy; None for one it cannot. A cover picture in an MP3 is not video.
+/// can shorten; None for one it cannot. A cover picture in an MP3 is not video.
 async fn probe(src: &Path) -> Result<Option<(f64, f64)>> {
     let path = src.display().to_string();
     let out = run_out("ffprobe", &[
-        "-v", "error", "-show_entries", "stream=codec_type,codec_name:stream_disposition=attached_pic",
-        "-of", "json", &path,
+        "-v", "error", "-show_entries",
+        "format=format_name:stream=codec_type,codec_name:stream_disposition=attached_pic", "-of", "json", &path,
     ])
     .await?;
     let v: serde_json::Value = serde_json::from_str(&out).context("reading ffprobe")?;
@@ -364,7 +522,9 @@ async fn probe(src: &Path) -> Result<Option<(f64, f64)>> {
         .iter()
         .any(|s| s["codec_type"] == "video" && s["disposition"]["attached_pic"] != 1);
     let audio = streams.iter().find(|s| s["codec_type"] == "audio");
-    if video || !audio.is_some_and(|a| a["codec_name"] == "mp3" || a["codec_name"] == "aac") {
+    let format = v["format"]["format_name"].as_str().unwrap_or("");
+    let plain = |codec: &str| format == codec && audio.is_some_and(|a| a["codec_name"] == codec);
+    if video || !(plain("mp3") || plain("aac")) {
         return Ok(None);
     }
     let out = run_out("ffprobe", &[
@@ -417,18 +577,48 @@ mod tests {
 
     #[test]
     fn cuts_leave_silent_frames_either_side_and_skip_short_silences() {
-        // MP3 frames, 26.122 ms; one silence of 2 s, one too short to touch.
+        // MP3 frames, 26.122 ms; one silence of 2 s, one too short to touch; a 0.3 s pause.
         let frame = 1152.0 / 44100.0;
-        let (frames, cuts) = plan(&[(1.0, 3.0), (5.0, 5.3)], 0.0, frame);
-        assert_eq!(frames, vec![(43, 110)]);
+        let (frames, cuts) = plan(&[(1.0, 3.0), (5.0, 5.3)], 0.0, frame, 0.15);
+        assert_eq!(frames, vec![(45, 108)]);
         let Cut(s, e) = cuts[0];
-        assert!(s >= 1100 && e <= 2900, "{cuts:?}");
-        assert!(s - 1100 < 27 && 2900 - e < 27, "no more than a frame kept beyond KEEP: {cuts:?}");
-        // AAC in MP4 starts a frame early, for the encoder's priming.
-        let (frames, _) = plan(&[(1.0, 3.0)], -0.02322, 1024.0 / 44100.0);
-        assert_eq!(frames, vec![(49, 124)]);
+        assert!(s >= 1150 && e <= 2850, "{cuts:?}");
+        assert!(s - 1150 < 27 && 2850 - e < 27, "no more than a frame kept beyond half the pause: {cuts:?}");
+        // AAC starts a frame early, for the encoder's priming.
+        let (frames, _) = plan(&[(1.0, 3.0)], -0.02322, 1024.0 / 44100.0, 0.15);
+        assert_eq!(frames, vec![(51, 122)]);
         // A silence the margins use up entirely is left alone.
-        assert!(plan(&[(1.0, 1.21)], 0.0, frame).0.is_empty());
+        assert!(plan(&[(1.0, 1.35)], 0.0, frame, 0.15).0.is_empty());
+        // A longer pause cuts less of the same silence.
+        assert!(saved(&plan(&[(1.0, 3.0)], 0.0, frame, 0.25).1) < saved(&cuts));
+    }
+
+    #[test]
+    fn pieces_are_the_frames_kept_end_to_end_and_never_too_long() {
+        // 1000 frames of 100 bytes after a 50-byte tag, an ID3 tag of 7 bytes before frame 600.
+        let frames: Vec<(u64, u64)> =
+            (0..1000u64).map(|n| (50 + n * 100 + if n >= 600 { 7 } else { 0 }, 100)).collect();
+        let frame = 0.026;
+        let p = pieces(&frames, &[(100, 199), (900, 999)], frame);
+        let at: Vec<u64> = p.iter().map(|x| x.0).collect();
+        // 0-99; 200-583 and 584-599, split at 384 frames (10 s); 600-899 after the tag.
+        assert_eq!(at, [50, 20_050, 58_450, 60_057]);
+        assert_eq!(p[0], (50, 10_000, 100.0 * frame));
+        assert_eq!(p[2].1, 1600, "frames 584-599");
+        assert!(p.iter().all(|x| x.2 <= MAX_PIECE));
+        let kept: u64 = p.iter().map(|x| x.1).sum();
+        assert_eq!(kept, 800 * 100, "every kept frame once, the tag in none");
+    }
+
+    #[test]
+    fn the_playlist_lists_each_piece_as_a_range_of_the_original() {
+        let plan = Plan { cuts: vec![Cut(1000, 2000)], pieces: vec![(50, 400, 1.0), (500, 4000, 9.5)] };
+        assert_eq!(
+            playlist(&plan, "deadair.mp3"),
+            "#EXTM3U\n#EXT-X-VERSION:4\n#EXT-X-TARGETDURATION:10\n#EXT-X-PLAYLIST-TYPE:VOD\n#EXT-X-MEDIA-SEQUENCE:0\n\
+             #EXTINF:1.000000,\n#EXT-X-BYTERANGE:400@50\ndeadair.mp3\n\
+             #EXTINF:9.500000,\n#EXT-X-BYTERANGE:4000@500\ndeadair.mp3\n#EXT-X-ENDLIST\n"
+        );
     }
 
     #[test]
@@ -440,7 +630,7 @@ mod tests {
         assert_eq!(to_copy(&cuts, 40_000), 25_000);
         for t in [0, 5_000, 10_000, 15_000, 19_999, 20_000, 25_000, 40_000] {
             let back = to_original(&cuts, to_copy(&cuts, t));
-            // A time inside a cut comes back as the cut's end: the copy has nothing between.
+            // A time inside a cut comes back as the cut's end: the shortened version has nothing between.
             let expect = if (10_000..20_000).contains(&t) { 20_000 } else { t };
             assert_eq!(back, expect, "{t}");
         }
@@ -458,21 +648,38 @@ mod tests {
     }
 
     #[test]
-    fn the_copy_sits_beside_the_original() {
-        assert_eq!(copy_path(Path::new("/d/show/ep 1.mp3")), Path::new("/d/show/ep 1.deadair.mp3"));
+    fn the_pause_is_the_feeds_then_its_groups_then_the_default() {
+        let w = Wanting {
+            people: HashMap::new(),
+            pauses: [((1, "a".to_string()), 500), ((1, "g".to_string()), 400)].into(),
+            groups: [("b".to_string(), "g".to_string())].into(),
+        };
+        assert_eq!(w.pause(1, "a"), 500);
+        assert_eq!(w.pause(1, "b"), 400, "its group's");
+        assert_eq!(w.pause(1, "c"), DEFAULT_PAUSE);
+        assert_eq!(w.pause(2, "a"), DEFAULT_PAUSE, "someone else's says nothing of yours");
     }
 
-    /// The whole of it, on a clip ffmpeg makes: a second of tone, two of silence, and so on.
-    /// Skipped where ffmpeg is not installed.
+    #[test]
+    fn id3_len_reads_the_tags_size() {
+        assert_eq!(id3_len(b"ID3\x04\x00\x00\x00\x00\x02\x01xx"), 10 + 257);
+        assert_eq!(id3_len(b"ID3\x04\x00\x10\x00\x00\x02\x01"), 10 + 257 + 10, "with a footer");
+        assert_eq!(id3_len(b"\xff\xfb\x90\x00\x00\x00\x00\x00\x00\x00"), 0);
+        assert_eq!(id3_len(b"ID3"), 0);
+    }
+
+    /// The whole of it, on a clip ffmpeg makes: a second of tone, two of silence, and so on,
+    /// played back through its playlist by ffmpeg's own HLS reader. Skipped where ffmpeg is not
+    /// installed.
     #[tokio::test]
-    async fn a_copy_is_shorter_by_what_was_cut_and_plays() {
+    async fn the_playlist_of_a_file_is_shorter_by_what_was_cut_and_plays() {
         if !have_ffmpeg().await {
             eprintln!("no ffmpeg; skipped");
             return;
         }
         let dir = std::env::temp_dir().join(format!("ipx-deadair-{}", std::process::id()));
         std::fs::create_dir_all(&dir).unwrap();
-        for (ext, codec) in [("mp3", "libmp3lame"), ("m4a", "aac")] {
+        for (ext, codec) in [("mp3", "libmp3lame"), ("aac", "aac"), ("m4a", "aac")] {
             let src = dir.join(format!("t.{ext}"));
             ffmpeg(&[
                 "-v", "error", "-y", "-f", "lavfi", "-i",
@@ -481,40 +688,68 @@ mod tests {
             ])
             .await
             .unwrap();
-            let (dst, cuts) = make(&src).await.unwrap().expect("a copy");
-            assert_eq!(cuts.len(), 4, "{ext}: {cuts:?}");
-            // About 1.8 s from each of the four 2 s silences.
-            let cut = saved(&cuts);
-            assert!((7_000..7_300).contains(&cut), "{ext}: {cut}");
+            let plans = analyse(&src).await.unwrap();
+            if ext == "m4a" {
+                assert!(plans.is_none(), "AAC in MP4 has no byte ranges to play");
+                continue;
+            }
+            let plans = plans.expect("plans");
+            assert_eq!(plans.keys().copied().collect::<Vec<_>>(), PAUSES);
+            let p = &plans[&DEFAULT_PAUSE];
+            assert_eq!(p.cuts.len(), 4, "{ext}: {:?}", p.cuts);
+            // About 1.7 s from each of the four 2 s silences, and less for a longer pause.
+            let cut = p.saved_ms();
+            assert!((6_500..6_900).contains(&cut), "{ext}: {cut}");
+            assert!(plans[&500].saved_ms() < cut && cut < plans[&200].saved_ms());
+            let list = dir.join(format!("{ext}.m3u8"));
+            std::fs::write(&list, playlist(p, &format!("t.{ext}"))).unwrap();
+            // Its frames added up: a raw AAC file's duration is only guessed from its bitrate.
             let len = |p: &Path| {
                 let p = p.display().to_string();
                 async move {
-                    run_out("ffprobe", &["-v", "error", "-show_entries", "format=duration", "-of", "csv=p=0", &p])
+                    run_out("ffprobe", &["-v", "error", "-select_streams", "a:0", "-show_entries", "packet=duration_time", "-of", "csv=p=0", &p])
                         .await
                         .unwrap()
-                        .trim()
-                        .parse::<f64>()
-                        .unwrap()
+                        .lines()
+                        .filter_map(|l| l.trim().trim_end_matches(',').parse::<f64>().ok())
+                        .sum::<f64>()
                 }
             };
-            let short = len(&src).await - len(&dst).await;
+            let short = len(&src).await - len(&list).await;
             assert!((short * 1000.0 - cut as f64).abs() < 100.0, "{ext}: {short} s shorter, {cut} ms cut");
             // Decodes without a complaint.
-            assert!(ffmpeg(&["-v", "error", "-i", &dst.display().to_string(), "-f", "null", "-"]).await.unwrap().is_empty());
+            assert!(ffmpeg(&["-v", "error", "-i", &list.display().to_string(), "-f", "null", "-"]).await.unwrap().is_empty());
+            // Saved as a file of its own (#186): as long as the playlist, and it plays.
+            let (n, body) = kept(&src, p).await.unwrap();
+            let parts: Vec<_> = futures_util::TryStreamExt::try_collect(body).await.unwrap();
+            let bytes = parts.concat();
+            assert_eq!(bytes.len() as u64, n);
+            if ext == "mp3" {
+                assert!(bytes.starts_with(b"ID3"), "the original's tag comes too");
+            }
+            let saved = dir.join(format!("saved.{ext}"));
+            std::fs::write(&saved, &bytes).unwrap();
+            assert!((len(&saved).await - len(&list).await).abs() < 0.05, "{ext}");
+            assert!(ffmpeg(&["-v", "error", "-i", &saved.display().to_string(), "-f", "null", "-"]).await.unwrap().is_empty());
         }
         std::fs::remove_dir_all(&dir).unwrap();
     }
 }
 
 /// A real episode, for trying the cut on something other than a test tone:
-/// `IPX_DEADAIR_FILE=/path/ep.mp3 cargo test real_file -- --ignored --nocapture`. The copy is left
-/// beside it to listen to.
+/// `IPX_DEADAIR_FILE=/path/ep.mp3 cargo test real_file -- --ignored --nocapture`. Each pause's
+/// playlist is left beside it, `ep.mp3.300.m3u8`, to listen to.
 #[cfg(test)]
 #[tokio::test]
 #[ignore]
 async fn real_file() {
-    let src = PathBuf::from(std::env::var("IPX_DEADAIR_FILE").expect("IPX_DEADAIR_FILE"));
+    let src = std::path::PathBuf::from(std::env::var("IPX_DEADAIR_FILE").expect("IPX_DEADAIR_FILE"));
     let t = std::time::Instant::now();
-    let (dst, cuts) = make(&src).await.unwrap().expect("a copy");
-    eprintln!("{} cuts, {:.1} min saved, {:.1?} -> {}", cuts.len(), saved(&cuts) as f64 / 60_000.0, t.elapsed(), dst.display());
+    let plans = analyse(&src).await.unwrap().expect("plans");
+    eprintln!("analysed in {:.1?}", t.elapsed());
+    let name = src.file_name().unwrap().to_string_lossy().into_owned();
+    for (pause, p) in &plans {
+        std::fs::write(src.with_file_name(format!("{name}.{pause}.m3u8")), playlist(p, &name)).unwrap();
+        eprintln!("{pause} ms: {} cuts, {:.1} min saved, {} pieces", p.cuts.len(), p.saved_ms() as f64 / 60_000.0, p.pieces.len());
+    }
 }

src/download.rs

@@ -172,10 +172,12 @@ pub async fn download(
         .with_context(|| format!("creating {}", tmp.display()))?;
     let mut done: u64 = 0;
     let mut stream = resp.bytes_stream();
+    let _active = crate::metrics::busy(&crate::metrics::STATS.downloads_active);
     while let Some(chunk) = stream.next().await {
         let chunk = chunk.context("reading body")?;
         file.write_all(&chunk).await?;
         done += chunk.len() as u64;
+        crate::metrics::STATS.download_bytes.fetch_add(chunk.len() as u64, std::sync::atomic::Ordering::Relaxed);
         on_progress(done, total);
     }
     file.flush().await?;
@@ -214,8 +216,6 @@ pub fn remove(path: &Path) -> std::io::Result<()> {
     if path.is_dir() {
         return std::fs::remove_dir_all(path);
     }
-    // Its DeadAir copy goes with it, if it has one; it is no use without the original (#171).
-    let _ = std::fs::remove_file(crate::deadair::copy_path(path));
     std::fs::remove_file(path)
 }
 

src/entity.rs

@@ -355,24 +355,20 @@ pub mod settings {
     impl ActiveModelBehavior for ActiveModel {}
 }
 
-/// DeadAir's copy of an enclosure: the same file with long silences shortened (issue #171).
-/// `cuts` is what the copy leaves out, as `[[start_ms, end_ms], ...]` of the original's time,
-/// which is what converts positions between the two. `path` is NULL for a file that cannot have
-/// one (video, or not MP3 or AAC), so it is looked at once and not every pass.
-pub mod deadair {
+/// What DeadAir found in an enclosure (#181): `plans` is a `deadair::Plan` for each pause length,
+/// as JSON keyed by the pause in ms, and `{}` for a file it does not apply to (video, not MP3 or
+/// AAC, nothing to cut), so that one is looked at once and not every pass.
+pub mod deadair_plans {
     use sea_orm::entity::prelude::*;
 
     #[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
-    #[sea_orm(table_name = "deadair")]
+    #[sea_orm(table_name = "deadair_plans")]
     pub struct Model {
         #[sea_orm(primary_key, auto_increment = false)]
         pub enclosure_id: i64,
-        #[sea_orm(column_type = "Text", nullable)]
-        pub path: Option<String>,
         #[sea_orm(column_type = "Text")]
-        pub cuts: String,
-        pub saved_ms: i64,
-        /// Against the enclosure's `downloaded_at`: a file downloaded again needs its copy again.
+        pub plans: String,
+        /// Against the enclosure's `downloaded_at`: a file downloaded again is looked at again.
         pub made_at: i64,
     }
 
@@ -395,6 +391,8 @@ pub mod deadair_prefs {
         #[sea_orm(primary_key, auto_increment = false, column_type = "Text")]
         pub feed_id: String,
         pub wanted: bool,
+        /// The pause DeadAir leaves where it cuts a silence, in ms (#182); NULL for the usual.
+        pub pause_ms: Option<i64>,
     }
 
     owned_by_user!();

src/ipc.rs

@@ -32,6 +32,8 @@ pub enum Event {
     DownloadDone { feed: String, enclosure: i64, url: String, path: String, bytes: u64 },
     DownloadError { feed: String, enclosure: i64, url: String, msg: String },
     TorrentDeferred { feed: String, url: String },
+    /// DeadAir finished a file's copy (#171), so a page showing it as in progress can stop.
+    DeadairDone { feed: String, enclosure: i64, saved_s: i64 },
     Reaped { path: String, bytes: u64 },
     /// Terminal: a client that asked for work stops reading here.
     ScanDone { feeds: usize },
@@ -79,6 +81,7 @@ impl Event {
             // Noise in a terminal; a UI still gets them on the socket.
             Event::FeedStart { feed } => format!("{feed}: checking"),
             Event::TorrentDeferred { feed, .. } => format!("{feed}: torrent deferred"),
+            Event::DeadairDone { feed, saved_s, .. } => format!("{feed}: DeadAir found the silences, {saved_s} s shorter"),
             Event::ScanDone { feeds } => format!("scan complete, {feeds} feed(s)"),
         })
     }
@@ -141,7 +144,12 @@ impl Emitter {
         // line per feed per tick for "not due yet" would push everything worth reading
         // out of the buffer within a few minutes.
         log_event(&e, self.tx.is_some());
-        if let Some(tx) = &self.tx {
+        // A feed not due changes nothing a listener shows, and a scan has one for nearly every
+        // feed: 1,500 at once overflowed the channel's 1,024 for a page slow to read (#197).
+        let routine = matches!(&e, Event::FeedSkip { reason, .. } if reason.starts_with("not due"));
+        if let Some(tx) = &self.tx
+            && !routine
+        {
             // An error here only means nobody is listening yet.
             let _ = tx.send(e.clone());
         }
@@ -359,6 +367,17 @@ pub async fn proxy(path: &Path, cmd: &Command) -> Result<()> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_feed_not_due_stays_off_the_live_updates() {
+        let (tx, mut rx) = broadcast::channel(4);
+        let out = Emitter::socket(tx, false);
+        for i in 0..10 {
+            out.emit(Event::FeedSkip { feed: format!("f{i}"), reason: "not due for 5m".into() });
+        }
+        out.emit(Event::FeedSkip { feed: "g".into(), reason: "not modified".into() });
+        assert!(matches!(rx.try_recv(), Ok(Event::FeedSkip { feed, .. }) if feed == "g"), "nothing missed");
+    }
+
     #[test]
     fn a_feed_that_moved_says_so_on_the_wire_and_in_words() {
         let e = Event::FeedMoved { feed: "x".into(), from: "http://a/f".into(), to: "https://a/f".into() };

src/main.rs

@@ -9,6 +9,7 @@ mod download;
 mod feed;
 mod ipc;
 mod logbuf;
+mod metrics;
 mod retention;
 mod torrent;
 mod web;
@@ -156,6 +157,9 @@ pub struct Ctx {
     /// Wakes DeadAir's maker when a show is turned on, so its copies start at once instead of
     /// at the next pass (#171).
     pub deadair: tokio::sync::Notify,
+    /// When the Directory was last cleared of dead feeds (`clean_directory`), 0 for not since
+    /// starting.
+    pub directory_cleaned: std::sync::atomic::AtomicI64,
 }
 
 /// A copy of the config to change, holding off every other change until `store_cfg` keeps it.
@@ -348,6 +352,7 @@ async fn main() -> Result<()> {
         detach_torrents: is_daemon,
         retry: Default::default(),
         cfg_write: Default::default(),
+        directory_cleaned: Default::default(),
         deadair: Default::default(),
     });
 
@@ -523,11 +528,21 @@ async fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
 }
 
 async fn run(ctx: &Arc<Ctx>, cmd: Cmd) -> Result<()> {
+    // What the worker is on, for /metrics: the healthcheck answers while it is stuck (#195).
+    let _job = metrics::STATS.job(match &cmd {
+        Cmd::Fetch { .. } => "scan",
+        Cmd::Reap { .. } => "reap",
+        Cmd::Download { .. } => "download",
+        Cmd::Status => "status",
+        Cmd::Reload => "reload",
+    });
     match cmd {
         Cmd::Fetch { feed, force, feeds } => {
             // Make room before pulling more down, as the original did per download.
             reap(ctx, false, false).await?;
-            fetch(ctx, feed.as_deref(), force, &feeds).await
+            fetch(ctx, feed.as_deref(), force, &feeds).await?;
+            metrics::STATS.last_scan_done.store(db::now(), std::sync::atomic::Ordering::Relaxed);
+            Ok(())
         }
         Cmd::Reap { dry_run } => reap(ctx, dry_run, true).await,
         Cmd::Download { enclosure } => download_one(ctx, enclosure).await,
@@ -555,6 +570,12 @@ pub(crate) async fn status(ctx: &Ctx) -> Event {
     match ctx.db.counts().await {
         Ok((pending, downloaded)) => {
             let feeds = subscriptions(ctx).await.map(|s| s.len()).unwrap_or(0);
+            // Kept for /metrics, which asks the database nothing (#195): the healthcheck asks this every 30 s.
+            use std::sync::atomic::Ordering::Relaxed;
+            let st = &metrics::STATS;
+            st.feeds.store(feeds as i64, Relaxed);
+            st.pending.store(pending as i64, Relaxed);
+            st.downloaded.store(downloaded as i64, Relaxed);
             Event::Status { feeds, pending, downloaded }
         }
         Err(e) => Event::Error { msg: format!("{e:#}") },
@@ -768,12 +789,25 @@ async fn start_web(
         let (access, ctx, team) = (access.clone(), ctx.clone(), team.to_owned());
         tokio::spawn(async move { access.prefetch(&ctx.client, &team).await });
     }
+    let playing = deadair::Playing::default();
+    if !cfg.web.metrics_bind.is_empty() {
+        let sources = metrics::Sources {
+            ctx: ctx.clone(),
+            cmds: cmds.clone(),
+            events: events.clone(),
+            playing: playing.clone(),
+            runtime: tokio::runtime::Handle::current(),
+            started: std::time::Instant::now(),
+        };
+        let at = metrics::spawn(&cfg.web.metrics_bind, sources)?;
+        tracing::info!(%at, "serving metrics for Prometheus at /metrics");
+    }
     let state = web::WebState {
         ctx: ctx.clone(),
         cmds: cmds.clone(),
         events: events.clone(),
         access,
-        playing: Default::default(),
+        playing,
     };
     Ok(Some(tokio::spawn(async move {
         if let Err(e) = web::serve(state, &bind).await {
@@ -1118,6 +1152,13 @@ async fn clean_directory(ctx: &Ctx) -> Result<()> {
     const DEAD: i64 = 30 * 86_400;
     const QUIET: i64 = 365 * 86_400;
     let now = db::now();
+    // Once a day, for feeds dead a month or quiet a year: before every scan, its query took 1 to
+    // 12 s every few minutes, and the scans and downloads waited behind it (#193).
+    use std::sync::atomic::Ordering::Relaxed;
+    if now - ctx.directory_cleaned.load(Relaxed) < 86_400 {
+        return Ok(());
+    }
+    ctx.directory_cleaned.store(now, Relaxed);
     let stale = ctx.db.stale_unsubscribed(now - DEAD, now - QUIET).await?;
     if stale.is_empty() {
         return Ok(());
@@ -1137,12 +1178,16 @@ async fn clean_directory(ctx: &Ctx) -> Result<()> {
 /// `standalone` false means this is the sweep that runs before a scan: it reports what it
 /// deleted, but must not emit the terminal ReapDone, or a client waiting on its `fetch`
 /// would stop reading before the scan had even started.
-#[tracing::instrument(name = "reap", skip_all, fields(dry_run = dry_run))]
+#[tracing::instrument(name = "reap", skip_all, fields(dry_run = dry_run, files = tracing::field::Empty, bytes = tracing::field::Empty, entries = tracing::field::Empty))]
 async fn reap(ctx: &Ctx, dry_run: bool, standalone: bool) -> Result<()> {
     let r = retention::run(&ctx.cfg(), &ctx.db, dry_run).await?;
+    let span = tracing::Span::current();
+    span.record("files", r.aged_out.len() + r.over_quota.len());
+    span.record("bytes", r.bytes_freed);
+    span.record("entries", r.entries_pruned);
     if !dry_run {
-        clean_directory(ctx).await?;
-        let gone = art::trim(&art::dir(), ctx.cfg().general.art_cache_mb * 1_048_576);
+        tracing::Instrument::instrument(clean_directory(ctx), db::step("clean_directory")).await?;
+        let gone = db::step("trim_artwork").in_scope(|| art::trim(&art::dir(), ctx.cfg().general.art_cache_mb * 1_048_576));
         if gone > 0 {
             tracing::debug!(gone, "trimmed the artwork kept on disk");
         }
@@ -1218,6 +1263,7 @@ async fn fetch(ctx: &Arc<Ctx>, only: Option<&str>, force: bool, scope: &[String]
                     if !early {
                         return None;
                     }
+                    let _fetching = metrics::busy(&metrics::STATS.feeds_fetching);
                     Some(feed::fetch(&client, &feed_cfg, etag.as_deref(), modified.as_deref()).await)
                 },
                 tracing::Span::current(),
@@ -2463,9 +2509,55 @@ mod tests {
             retry: Default::default(),
             cfg_write: Default::default(),
             deadair: Default::default(),
+            directory_cleaned: Default::default(),
         }
     }
 
+    #[tokio::test]
+    async fn metrics_answer_from_a_thread_of_their_own() {
+        let ctx = Arc::new(test_ctx(config::Config::default()).await);
+        let (cmds, _rx) = mpsc::channel(8);
+        let (events, _) = broadcast::channel(8);
+        let sources = metrics::Sources {
+            ctx: ctx.clone(),
+            cmds,
+            events,
+            playing: Default::default(),
+            runtime: tokio::runtime::Handle::current(),
+            started: std::time::Instant::now(),
+        };
+        let at = metrics::spawn("127.0.0.1:0", sources).unwrap();
+        let text = ctx.client.get(format!("http://{at}/metrics")).send().await.unwrap().text().await.unwrap();
+        // Every sample a name, optional labels and a number, as Prometheus parses them (#194).
+        for line in text.lines().filter(|l| !l.starts_with('#')) {
+            let (name, value) = line.rsplit_once(' ').unwrap();
+            assert!(name.starts_with("ipx_") && value.parse::<f64>().is_ok(), "{line}");
+        }
+        for name in ["ipx_db_connections{state=\"in_use\"}", "ipx_db_connections_max", "ipx_worker_queue", "ipx_runtime_tasks"] {
+            assert!(text.contains(name), "{name}");
+        }
+        assert!(metrics::spawn(&at.to_string(), metrics::Sources {
+            ctx: ctx.clone(), cmds: mpsc::channel(1).0, events: broadcast::channel(1).0, playing: Default::default(),
+            runtime: tokio::runtime::Handle::current(), started: std::time::Instant::now(),
+        }).is_err(), "a port already taken is an error at start");
+    }
+
+    #[tokio::test]
+    async fn dead_feeds_leave_the_directory_once_a_day_not_before_every_scan() {
+        let ctx = test_ctx(config::Config::default()).await;
+        let dead = |id: &str| format!("INSERT INTO feeds (id, url, error_since, managed) VALUES ('{id}', 'u-{id}', 100, false)");
+        let listed = async || ctx.db.feed_urls().await.unwrap().into_iter().map(|(id, _)| id).collect::<Vec<_>>();
+        ctx.db.sql(&dead("a")).await.unwrap();
+        clean_directory(&ctx).await.unwrap();
+        assert!(listed().await.is_empty(), "the first pass since starting looks");
+        ctx.db.sql(&dead("b")).await.unwrap();
+        clean_directory(&ctx).await.unwrap();
+        assert_eq!(listed().await, ["b"], "not again the same day (#193)");
+        ctx.directory_cleaned.store(db::now() - 86_401, std::sync::atomic::Ordering::Relaxed);
+        clean_directory(&ctx).await.unwrap();
+        assert!(listed().await.is_empty(), "a day on, it looks again");
+    }
+
     #[tokio::test]
     async fn a_removed_account_takes_the_feeds_only_it_read_with_it() {
         let ctx = test_ctx(config::Config::default()).await;
@@ -2489,7 +2581,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn deadair_hands_out_the_copys_clock_and_saves_in_the_originals() {
+    async fn deadair_hands_out_each_persons_clock_and_saves_in_the_originals() {
         let ctx = test_ctx(config::Config::default()).await;
         let db = &ctx.db;
         let u = db.create_user("dee", None, false).await.unwrap();
@@ -2501,8 +2593,10 @@ mod tests {
         ] {
             db.sql(sql).await.unwrap();
         }
-        // Two minutes cut, both before the place saved.
-        db.store_deadair(7, Some("/x/a.deadair.mp3"), "[[60000,120000],[200000,260000]]", 120_000).await.unwrap();
+        // Two minutes cut at the usual pause, both before the place saved; 40 s at the longest.
+        let plans = r#"{"300": {"cuts": [[60000,120000],[200000,260000]], "pieces": []},
+                        "500": {"cuts": [[60000,100000]], "pieces": []}}"#;
+        db.store_plans(7, plans).await.unwrap();
         db.set_position(u, "f", "g", 300, None).await.unwrap();
         let order = db::order_sql("published", "desc");
         let page = || {
@@ -2515,19 +2609,31 @@ mod tests {
         };
         let off = page().await;
         assert_eq!((off.position, off.enclosures[0].deadair), (300, None), "off until turned on for the feed");
+        assert!(!off.enclosures[0].deadair_pending);
 
         db.set_deadair(u, "f", Some(true)).await.unwrap();
+        db.sql("DELETE FROM deadair_plans").await.unwrap();
+        let waiting = page().await;
+        assert!(waiting.enclosures[0].deadair_pending, "on, and its silences not found yet");
+        db.store_plans(7, plans).await.unwrap();
         let on = page().await;
+        assert!(!on.enclosures[0].deadair_pending);
         assert_eq!((on.position, on.duration, on.enclosures[0].deadair), (180, Some(480), Some(120)));
+        // A longer pause of their own: their clock, and the playlist, are that plan's (#182).
+        db.set_deadair_pause(u, "f", 500).await.unwrap();
+        let long = page().await;
+        assert_eq!((long.position, long.duration, long.enclosures[0].deadair), (260, Some(560), Some(40)));
+        assert_eq!(deadair::plan_for(&ctx, u, "f", 7).await.unwrap().unwrap().saved_ms(), 40_000);
+        db.set_deadair_pause(u, "f", 300).await.unwrap();
 
-        // Saved from the copy at 3:20 of its 8:00: 5:20 of the original's 10:00, short of 75%.
+        // Saved from the playlist at 3:20 of its 8:00: 5:20 of the original's 10:00, short of 75%.
         let playing = deadair::Playing::default();
-        let copy = db.copies(&[7]).await.unwrap().remove(0);
-        playing.lock().unwrap().insert((u, "f".into(), "g".into()), Arc::new(copy));
+        let plan = deadair::plan_for(&ctx, u, "f", 7).await.unwrap().unwrap();
+        playing.lock().unwrap().insert((u, "f".into(), "g".into()), Arc::new(plan));
         let saved = deadair::on_save(&ctx, &playing, u, "f", "g", 200, Some(480)).await.unwrap();
         assert_eq!(saved, (320, Some(600)));
         assert_eq!(db.deadair_total(u).await.unwrap(), 0);
-        // Past 75% (6:00 of the copy is 8:00 of the original), counted once.
+        // Past 75% (6:00 of the playlist is 8:00 of the original), counted once.
         for _ in 0..2 {
             deadair::on_save(&ctx, &playing, u, "f", "g", 360, None).await.unwrap();
         }
@@ -2535,10 +2641,10 @@ mod tests {
         // Playing the original again: saved as it is.
         playing.lock().unwrap().clear();
         assert_eq!(deadair::on_save(&ctx, &playing, u, "f", "g", 200, Some(600)).await.unwrap(), (200, Some(600)));
-
-        // Turned off again: the original's clock.
+        // Turned off again: the original's clock, and no playlist.
         db.set_deadair(u, "f", Some(false)).await.unwrap();
         assert_eq!(page().await.enclosures[0].deadair, None);
+        assert!(deadair::plan_for(&ctx, u, "f", 7).await.unwrap().is_none());
     }
 
     #[tokio::test]

src/metrics.rs

@@ -0,0 +1,305 @@
+//! Prometheus metrics for what logs and traces cannot show: the daemon's own state between
+//! requests, such as how many database connections are in use (#194). Served on a port and a
+//! thread of their own, with a runtime of their own, and made only of what is already in memory:
+//! a scrape neither waits for the web server's threads or the database, whose pool running dry
+//! is one of the things it is there to show, nor holds anything up itself. No sign-in, as
+//! Prometheus exporters have none: checking a token is a database lookup. Written out by hand:
+//! the text format is a few lines, and a client library would be a dependency for them.
+
+use std::fmt::Write as _;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicI64, AtomicU64, Ordering::Relaxed};
+
+/// What the daemon counts as it works, for /metrics to read without asking anything (#195).
+/// Global: the web layer, the worker, downloads, artwork and DeadAir each add to it, and a handle
+/// threaded through all of them was more code than the counts.
+pub static STATS: Stats = Stats::new();
+
+pub struct Stats {
+    pub http_in_flight: AtomicI64,
+    /// Live updates dropped for a page or socket client that fell behind the broadcast.
+    pub events_missed: AtomicU64,
+    pub downloads_active: AtomicI64,
+    pub download_bytes: AtomicU64,
+    /// Feeds a scan is fetching at this moment, up to its AHEAD.
+    pub feeds_fetching: AtomicI64,
+    /// When a scan last finished, Unix seconds; 0 for not since starting.
+    pub last_scan_done: AtomicI64,
+    /// Files someone wants shortened that DeadAir has not looked at, as of its last pass.
+    pub deadair_backlog: AtomicI64,
+    /// When DeadAir started on the file it is on, Unix seconds; 0 when it is on none.
+    pub deadair_busy_since: AtomicI64,
+    pub art_cache_bytes: AtomicU64,
+    /// Images the sweep threw out to keep under the limit: kept bytes sit at the limit by design,
+    /// so this is what says whether the limit is too small.
+    pub art_evicted: AtomicU64,
+    /// Artwork served from disk, and fetched from the publisher because it was not there.
+    pub art_hits: AtomicU64,
+    pub art_misses: AtomicU64,
+    /// The library as the healthcheck last counted it, every 30 s; -1 until it has.
+    pub feeds: AtomicI64,
+    pub pending: AtomicI64,
+    pub downloaded: AtomicI64,
+    /// The worker's job now, and since when.
+    job: std::sync::Mutex<Option<(&'static str, std::time::Instant)>>,
+    /// Jobs finished, by kind: how many, and their seconds all told.
+    jobs: std::sync::Mutex<std::collections::BTreeMap<&'static str, (u64, f64)>>,
+}
+
+impl Stats {
+    pub const fn new() -> Self {
+        Self {
+            http_in_flight: AtomicI64::new(0),
+            events_missed: AtomicU64::new(0),
+            downloads_active: AtomicI64::new(0),
+            download_bytes: AtomicU64::new(0),
+            feeds_fetching: AtomicI64::new(0),
+            last_scan_done: AtomicI64::new(0),
+            deadair_backlog: AtomicI64::new(0),
+            deadair_busy_since: AtomicI64::new(0),
+            art_cache_bytes: AtomicU64::new(0),
+            art_evicted: AtomicU64::new(0),
+            art_hits: AtomicU64::new(0),
+            art_misses: AtomicU64::new(0),
+            feeds: AtomicI64::new(-1),
+            pending: AtomicI64::new(-1),
+            downloaded: AtomicI64::new(-1),
+            job: std::sync::Mutex::new(None),
+            jobs: std::sync::Mutex::new(std::collections::BTreeMap::new()),
+        }
+    }
+
+    /// Marks the worker as on a job of `kind` until what it returns is dropped, however the job
+    /// ends: finished, failed or stopped.
+    pub fn job(&'static self, kind: &'static str) -> Job {
+        *self.job.lock().unwrap() = Some((kind, std::time::Instant::now()));
+        Job(self)
+    }
+}
+
+pub struct Job(&'static Stats);
+
+impl Drop for Job {
+    fn drop(&mut self) {
+        if let Some((kind, since)) = self.0.job.lock().unwrap().take() {
+            let mut jobs = self.0.jobs.lock().unwrap();
+            let e = jobs.entry(kind).or_default();
+            e.0 += 1;
+            e.1 += since.elapsed().as_secs_f64();
+        }
+    }
+}
+
+/// Counts one more of something in progress until dropped, however it ends.
+pub struct Busy(&'static AtomicI64);
+
+pub fn busy(gauge: &'static AtomicI64) -> Busy {
+    gauge.fetch_add(1, Relaxed);
+    Busy(gauge)
+}
+
+impl Drop for Busy {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Relaxed);
+    }
+}
+
+/// What the metrics are read from.
+pub struct Sources {
+    pub ctx: Arc<crate::Ctx>,
+    pub cmds: tokio::sync::mpsc::Sender<crate::ipc::Command>,
+    pub events: tokio::sync::broadcast::Sender<crate::ipc::Event>,
+    pub playing: crate::deadair::Playing,
+    /// The daemon's runtime, not the metrics thread's own.
+    pub runtime: tokio::runtime::Handle,
+    pub started: std::time::Instant,
+}
+
+/// Starts serving /metrics on `bind`, on a thread of its own, and says where.
+pub fn spawn(bind: &str, s: Sources) -> anyhow::Result<std::net::SocketAddr> {
+    use anyhow::Context as _;
+    // Bound here, so a port already taken is the daemon's error at start, not a thread's later.
+    let listener = std::net::TcpListener::bind(bind).with_context(|| format!("binding metrics to {bind}"))?;
+    listener.set_nonblocking(true)?;
+    let addr = listener.local_addr()?;
+    let s = Arc::new(s);
+    std::thread::Builder::new().name("metrics".into()).spawn(move || {
+        let rt = match tokio::runtime::Builder::new_current_thread().enable_all().build() {
+            Ok(rt) => rt,
+            Err(e) => return tracing::error!(error = %e, "metrics could not start"),
+        };
+        rt.block_on(async move {
+            let app = axum::Router::new().route(
+                "/metrics",
+                axum::routing::get(move || {
+                    let s = s.clone();
+                    async move { ([(axum::http::header::CONTENT_TYPE, "text/plain; version=0.0.4")], render(&s)) }
+                }),
+            );
+            match tokio::net::TcpListener::from_std(listener) {
+                Ok(l) => {
+                    if let Err(e) = axum::serve(l, app).await {
+                        tracing::error!(error = %e, "metrics stopped");
+                    }
+                }
+                Err(e) => tracing::error!(error = %e, "metrics could not listen"),
+            }
+        });
+    })?;
+    Ok(addr)
+}
+
+/// Every metric, from memory alone.
+pub fn render(s: &Sources) -> String {
+    let mut out = String::new();
+    let (open, idle, max) = s.ctx.db.pool();
+    gauge(&mut out, "ipx_db_connections", "Database connections open, in use or idle.",
+        &[("state=\"in_use\"", open as f64 - idle as f64), ("state=\"idle\"", idle as f64)]);
+    gauge(&mut out, "ipx_db_connections_max", "The most database connections the pool opens.", &[("", max as f64)]);
+    gauge(&mut out, "ipx_worker_queue", "Commands waiting for the worker: scans, downloads and the like.",
+        &[("", (s.cmds.max_capacity() - s.cmds.capacity()) as f64)]);
+    gauge(&mut out, "ipx_event_listeners", "Open pages and socket clients listening for live updates.",
+        &[("", s.events.receiver_count() as f64)]);
+    gauge(&mut out, "ipx_torrent_slots_free", "Torrents that could start now.",
+        &[("", s.ctx.torrent_slots.available_permits() as f64)]);
+    gauge(&mut out, "ipx_deadair_playing", "Episodes someone is playing through DeadAir's playlist.",
+        &[("", s.playing.lock().map_or(0, |p| p.len()) as f64)]);
+    work(&mut out, &STATS, s.events.len(), s.ctx.retry.lock().map_or(0, |r| r.len()), s.ctx.cfg().general.art_cache_mb * 1_048_576);
+    let rt = s.runtime.metrics();
+    gauge(&mut out, "ipx_runtime_workers", "The async runtime's worker threads.", &[("", rt.num_workers() as f64)]);
+    gauge(&mut out, "ipx_runtime_tasks", "Tasks alive in the async runtime.", &[("", rt.num_alive_tasks() as f64)]);
+    gauge(&mut out, "ipx_runtime_queue", "Tasks waiting in the runtime's global queue.", &[("", rt.global_queue_depth() as f64)]);
+    let (rss, fds) = process();
+    if let Some(v) = rss {
+        gauge(&mut out, "ipx_process_resident_bytes", "Memory the process holds.", &[("", v)]);
+    }
+    if let Some(v) = fds {
+        gauge(&mut out, "ipx_process_open_fds", "Files and sockets the process has open.", &[("", v)]);
+    }
+    gauge(&mut out, "ipx_uptime_seconds", "Seconds since the daemon started.", &[("", s.started.elapsed().as_secs() as f64)]);
+    let version = format!("version=\"{}\"", env!("CARGO_PKG_VERSION"));
+    gauge(&mut out, "ipx_build_info", "The version running, as a label.", &[(&version, 1.0)]);
+    out
+}
+
+/// The work in progress and done, from `STATS`: jobs, queues and what is in flight (#195).
+fn work(out: &mut String, st: &Stats, event_queue: usize, retries: usize, art_limit: u64) {
+    let now = crate::db::now();
+    let job = *st.job.lock().unwrap();
+    gauge(out, "ipx_worker_busy", "1 while the worker is on a job.", &[("", job.is_some() as u8 as f64)]);
+    if let Some((kind, since)) = job {
+        let label = format!("kind=\"{kind}\"");
+        gauge(out, "ipx_worker_job_seconds", "How long the worker has been on its job, by the job's kind.",
+            &[(&label, since.elapsed().as_secs_f64())]);
+    }
+    let jobs = st.jobs.lock().unwrap().clone();
+    let labels: Vec<String> = jobs.keys().map(|k| format!("kind=\"{k}\"")).collect();
+    let pairs = |f: fn(&(u64, f64)) -> f64| labels.iter().zip(jobs.values()).map(|(l, v)| (l.as_str(), f(v))).collect::<Vec<_>>();
+    counter(out, "ipx_jobs_total", "Jobs the worker has finished, by kind.", &pairs(|v| v.0 as f64));
+    counter(out, "ipx_job_seconds_total", "Seconds the worker has spent on jobs, by kind.", &pairs(|v| v.1));
+    let last = st.last_scan_done.load(Relaxed);
+    if last > 0 {
+        gauge(out, "ipx_last_scan_age_seconds", "Seconds since a scan last finished.", &[("", (now - last) as f64)]);
+    }
+    gauge(out, "ipx_http_requests_in_flight", "Web requests being answered.", &[("", st.http_in_flight.load(Relaxed) as f64)]);
+    gauge(out, "ipx_scan_feeds_fetching", "Feeds a scan is fetching at once.", &[("", st.feeds_fetching.load(Relaxed) as f64)]);
+    gauge(out, "ipx_downloads_active", "Files downloading now.", &[("", st.downloads_active.load(Relaxed) as f64)]);
+    counter(out, "ipx_download_bytes_total", "Bytes downloaded since the daemon started.", &[("", st.download_bytes.load(Relaxed) as f64)]);
+    gauge(out, "ipx_event_queue", "Live updates sent and not yet read by every listener.", &[("", event_queue as f64)]);
+    counter(out, "ipx_events_missed_total", "Live updates dropped for a listener that fell behind.", &[("", st.events_missed.load(Relaxed) as f64)]);
+    gauge(out, "ipx_deadair_backlog", "Files of shows someone has DeadAir on that it has not looked at, those already heard through included.", &[("", st.deadair_backlog.load(Relaxed) as f64)]);
+    let since = st.deadair_busy_since.load(Relaxed);
+    gauge(out, "ipx_deadair_busy_seconds", "How long DeadAir has been on its file; 0 when on none.",
+        &[("", if since > 0 { (now - since) as f64 } else { 0.0 })]);
+    gauge(out, "ipx_feed_retries", "Feeds waiting to try a failed name lookup again.", &[("", retries as f64)]);
+    gauge(out, "ipx_art_cache_bytes", "Artwork kept on disk, as of the last sweep.", &[("", st.art_cache_bytes.load(Relaxed) as f64)]);
+    gauge(out, "ipx_art_cache_limit_bytes", "The most artwork kept.", &[("", art_limit as f64)]);
+    counter(out, "ipx_art_evicted_total", "Images thrown out to keep the artwork under its limit.", &[("", st.art_evicted.load(Relaxed) as f64)]);
+    counter(out, "ipx_art_requests_total", "Artwork asked for: served from disk, or fetched from the publisher.",
+        &[("result=\"hit\"", st.art_hits.load(Relaxed) as f64), ("result=\"miss\"", st.art_misses.load(Relaxed) as f64)]);
+    for (name, help, v) in [
+        ("ipx_feeds", "Feeds in the catalogue, as the healthcheck last counted.", &st.feeds),
+        ("ipx_downloads_pending", "Files a scan will download on its own, as the healthcheck last counted.", &st.pending),
+        ("ipx_files_downloaded", "Files on disk, as the healthcheck last counted.", &st.downloaded),
+    ] {
+        let v = v.load(Relaxed);
+        if v >= 0 {
+            gauge(out, name, help, &[("", v as f64)]);
+        }
+    }
+}
+
+/// A counter, which only goes up while the daemon runs, in Prometheus's text format.
+pub fn counter(out: &mut String, name: &str, help: &str, samples: &[(&str, f64)]) {
+    write(out, "counter", name, help, samples);
+}
+
+/// One gauge in Prometheus's text format: its help, its type, and a line for each set of labels
+/// (`state="idle"`, or "" for none).
+pub fn gauge(out: &mut String, name: &str, help: &str, samples: &[(&str, f64)]) {
+    write(out, "gauge", name, help, samples);
+}
+
+fn write(out: &mut String, kind: &str, name: &str, help: &str, samples: &[(&str, f64)]) {
+    let _ = writeln!(out, "# HELP {name} {help}\n# TYPE {name} {kind}");
+    for (labels, value) in samples {
+        let labels = if labels.is_empty() { String::new() } else { format!("{{{labels}}}") };
+        let _ = writeln!(out, "{name}{labels} {value}");
+    }
+}
+
+/// The process's resident memory in bytes and its open files, from /proc; None elsewhere.
+pub fn process() -> (Option<f64>, Option<f64>) {
+    let rss = std::fs::read_to_string("/proc/self/status").ok().and_then(|s| {
+        let kb = s.lines().find_map(|l| l.strip_prefix("VmRSS:"))?.trim().strip_suffix("kB")?.trim().parse::<f64>().ok()?;
+        Some(kb * 1024.0)
+    });
+    let fds = std::fs::read_dir("/proc/self/fd").ok().map(|d| d.count() as f64);
+    (rss, fds)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn gauges_are_written_as_prometheus_reads_them() {
+        let mut out = String::new();
+        gauge(&mut out, "ipx_db_connections", "Connections.", &[("state=\"idle\"", 3.0), ("state=\"in_use\"", 1.0)]);
+        gauge(&mut out, "ipx_feeds", "Feeds.", &[("", 1535.0)]);
+        assert_eq!(
+            out,
+            "# HELP ipx_db_connections Connections.\n# TYPE ipx_db_connections gauge\n\
+             ipx_db_connections{state=\"idle\"} 3\nipx_db_connections{state=\"in_use\"} 1\n\
+             # HELP ipx_feeds Feeds.\n# TYPE ipx_feeds gauge\nipx_feeds 1535\n"
+        );
+    }
+
+    #[test]
+    fn jobs_and_work_in_progress_are_counted_however_they_end() {
+        static T: Stats = Stats::new();
+        {
+            let _j = T.job("scan");
+            let _b = busy(&T.downloads_active);
+            assert_eq!(T.downloads_active.load(Relaxed), 1);
+            let mut out = String::new();
+            work(&mut out, &T, 0, 0, 0);
+            assert!(out.contains("ipx_worker_busy 1\n") && out.contains("ipx_worker_job_seconds{kind=\"scan\"}"), "{out}");
+        }
+        // Dropped, as an error or a stop drops them: nothing left in progress, one scan done.
+        assert_eq!(T.downloads_active.load(Relaxed), 0);
+        let mut out = String::new();
+        work(&mut out, &T, 3, 1, 10);
+        assert!(out.contains("ipx_worker_busy 0\n") && !out.contains("ipx_worker_job_seconds"), "{out}");
+        assert!(out.contains("ipx_jobs_total{kind=\"scan\"} 1\n") && out.contains("# TYPE ipx_jobs_total counter"), "{out}");
+        assert!(out.contains("ipx_event_queue 3\n") && out.contains("ipx_feed_retries 1\n"));
+        // The library's counts are left out until the healthcheck has counted it.
+        assert!(!out.contains("ipx_feeds "));
+    }
+
+    #[test]
+    fn the_process_reads_its_memory_and_files_on_linux() {
+        let (rss, fds) = process();
+        assert!(rss.unwrap() > 0.0 && fds.unwrap() > 0.0);
+    }
+}

src/retention.rs

@@ -1,9 +1,10 @@
 //! Disk quota and age sweeps. Replaces iPXQuotaManager.py ("SmartSpace").
 
 use anyhow::Result;
+use tracing::Instrument;
 
 use crate::config::Config;
-use crate::db::{Candidate, Db, now};
+use crate::db::{Candidate, Db, now, step};
 
 /// Headroom kept below the quota, as getToQuota()'s `1048576 * 50` did.
 pub const PAD_BYTES: u64 = 50 * 1024 * 1024;
@@ -49,7 +50,8 @@ pub async fn run(cfg: &Config, db: &Db, dry_run: bool) -> Result<Report> {
     let mut report = Report::default();
 
     // Someone may have deleted a file by hand; the row must stop claiming it exists.
-    for (id, path) in db.missing_files().await? {
+    // Each step is a span of the reap's trace, so a slow one says which part was slow.
+    for (id, path) in db.missing_files().instrument(step("missing_files")).await? {
         if !dry_run {
             db.mark_reaped(id).await?;
         }
@@ -57,24 +59,20 @@ pub async fn run(cfg: &Config, db: &Db, dry_run: bool) -> Result<Report> {
         report.reconciled += 1;
     }
 
-    for id in db.prune_abandoned_failures().await? {
+    for id in db.prune_abandoned_failures().instrument(step("prune_abandoned_failures")).await? {
         tracing::info!(feed = id, "forgot a failing feed nobody subscribes to");
     }
 
-    let mut candidates = db.reap_candidates().await?;
-    // A file's DeadAir copy is on the disk too, and goes when it goes (#171).
-    for c in &mut candidates {
-        c.bytes += copy_bytes(&c.path) as i64;
-    }
+    let candidates = db.reap_candidates().instrument(step("reap_candidates")).await?;
 
     if cfg.general.max_age_days > 0 {
         let cutoff = now() - (cfg.general.max_age_days * 86_400) as i64;
         report.aged_out = aged(&candidates, cutoff);
         for c in &report.aged_out {
-            report.bytes_freed += remove(db, c, dry_run).await?;
+            report.bytes_freed += remove(db, c, dry_run).instrument(step("remove_aged")).await?;
         }
         if !dry_run {
-            report.entries_pruned = db.prune_entries(cutoff).await?;
+            report.entries_pruned = db.prune_entries(cutoff).instrument(step("prune_entries")).await?;
         }
     }
 
@@ -89,7 +87,7 @@ pub async fn run(cfg: &Config, db: &Db, dry_run: bool) -> Result<Report> {
         let total: u64 = remaining.iter().map(|c| c.bytes.max(0) as u64).sum();
         report.over_quota = pick(&remaining, total, limit);
         for c in &report.over_quota {
-            report.bytes_freed += remove(db, c, dry_run).await?;
+            report.bytes_freed += remove(db, c, dry_run).instrument(step("remove_over_quota")).await?;
         }
     }
 
@@ -104,7 +102,7 @@ async fn remove(db: &Db, c: &Candidate, dry_run: bool) -> Result<u64> {
     let size = std::fs::metadata(&c.path)
         .ok()
         .filter(|m| m.is_file())
-        .map_or(c.bytes.max(0) as u64, |m| m.len() + copy_bytes(&c.path));
+        .map_or(c.bytes.max(0) as u64, |m| m.len());
     // Missing is fine: the point is that it is gone.
     if let Err(e) = crate::download::remove(std::path::Path::new(&c.path))
         && e.kind() != std::io::ErrorKind::NotFound
@@ -116,10 +114,6 @@ async fn remove(db: &Db, c: &Candidate, dry_run: bool) -> Result<u64> {
     Ok(size)
 }
 
-fn copy_bytes(path: &str) -> u64 {
-    std::fs::metadata(crate::deadair::copy_path(std::path::Path::new(path))).map_or(0, |m| m.len())
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;

src/web.rs

@@ -21,6 +21,8 @@ use std::sync::Arc;
 use tokio::sync::{broadcast, mpsc};
 
 use crate::Ctx;
+use crate::db::step;
+use tracing::Instrument;
 use crate::ipc::{Command, Event};
 
 const COOKIE: &str = "ipx_token";
@@ -65,11 +67,14 @@ pub fn router(state: WebState) -> Router {
         .route("/api/users", get(list_users).post(add_user))
         .route("/api/users/{id}", patch(patch_user).delete(remove_user))
         .route("/api/logs", get(logs))
+        .route("/api/client", post(client_event))
         .route("/api/events", get(events))
         .route("/admin", get(admin_page))
         .route("/admin.js", get(admin_js))
         .route("/media/{id}", get(media))
-        .route("/media/{id}/deadair", get(media_deadair))
+        .route("/media/{id}/deadair.m3u8", get(media_deadair))
+        .route("/media/{id}/deadair.mp3", get(media_piece))
+        .route("/media/{id}/deadair", get(media_save))
         .route("/api/art", get(art))
         .layer(middleware::from_fn_with_state(state.clone(), auth))
         // Signing in cannot require being signed in, so these sit outside the auth layer.
@@ -87,6 +92,7 @@ pub fn router(state: WebState) -> Router {
         .route("/app.js", get(app_js))
         .route("/app.css", get(app_css))
         .route("/login.js", get(login_js))
+        .route("/hls.js", get(hls_js))
         .route("/inter.woff2", get(inter))
         .route_layer(middleware::from_fn(name_span))
         .layer(middleware::from_fn(access_log))
@@ -642,6 +648,12 @@ async fn login_js() -> impl IntoResponse {
     script(include_str!(concat!(env!("OUT_DIR"), "/login.js")))
 }
 
+/// hls.js, for browsers that cannot play DeadAir's playlists themselves (#181): the page loads
+/// it only there, by the name build.mjs gives it.
+async fn hls_js() -> impl IntoResponse {
+    script(include_str!(concat!(env!("OUT_DIR"), "/hls.js")))
+}
+
 fn script(js: &'static str) -> impl IntoResponse {
     ([(header::CONTENT_TYPE, "text/javascript; charset=utf-8"), (header::CACHE_CONTROL, SCRIPT_CACHE)], js)
 }
@@ -773,8 +785,10 @@ struct FeedRow {
     keywords: Vec<String>,
     /// Your words that hide an item of this feed, beside your list for every feed.
     blocked: Vec<String>,
-    /// Played from DeadAir's copies: on for this feed or its group, off until you turn it on.
+    /// Played shortened by DeadAir: on for this feed or its group, off until you turn it on.
     deadair: bool,
+    /// The pause DeadAir leaves where it cuts, in ms: this feed's, its group's, or the usual.
+    deadair_pause: i64,
     allow_explicit: bool,
     auto_download: bool,
     max_new_per_check: Option<usize>,
@@ -822,8 +836,6 @@ async fn feeds(
 /// The feed list as this person sees it, or with `only` the one row for that feed: what a live
 /// update sends after the feed changes, so the page redraws a row instead of reloading the list.
 async fn feed_rows(state: &WebState, user: &crate::db::User, only: Option<&str>) -> anyhow::Result<Vec<FeedRow>> {
-    use crate::db::step;
-    use tracing::Instrument;
     let cfg = state.ctx.cfg();
     // Config entries plus the feeds derived from OPML subscriptions -- the catalogue.
     // What comes back is only the part of it this person subscribes to.
@@ -839,8 +851,10 @@ async fn feed_rows(state: &WebState, user: &crate::db::User, only: Option<&str>)
         .collect();
     let counts = state.ctx.db.subscriber_counts().instrument(step("subscriber_counts")).await?;
     let pinned = state.ctx.db.pinned_feeds(user.id).instrument(step("pinned")).await?;
-    let deadair: std::collections::HashMap<String, bool> =
-        state.ctx.db.deadair_prefs(Some(user.id)).await?.into_iter().map(|(_, f, w)| (f, w)).collect();
+    let prefs = state.ctx.db.deadair_prefs(Some(user.id)).await?;
+    let deadair: std::collections::HashMap<&str, bool> = prefs.iter().map(|(_, f, w, _)| (f.as_str(), *w)).collect();
+    let pauses: std::collections::HashMap<&str, i64> =
+        prefs.iter().filter_map(|(_, f, _, p)| Some((f.as_str(), (*p)?))).collect();
     let mut listed = state.ctx.db.feed_list(user.id, only).instrument(step("feed_list")).await?;
     let mut out = Vec::with_capacity(mine.len());
     for sub in subs.iter().filter(|s| only.is_none_or(|o| o == s.id)) {
@@ -865,7 +879,16 @@ async fn feed_rows(state: &WebState, user: &crate::db::User, only: Option<&str>)
                 .or_else(|| up.and_then(|u| u.keywords.clone()))
                 .unwrap_or_else(|| feed.keywords.clone()),
             blocked,
-            deadair: deadair.get(id).or_else(|| feed.group.as_deref().and_then(|g| deadair.get(g))).copied().unwrap_or(false),
+            deadair: deadair
+                .get(id.as_str())
+                .or_else(|| feed.group.as_deref().and_then(|g| deadair.get(g)))
+                .copied()
+                .unwrap_or(false),
+            deadair_pause: pauses
+                .get(id.as_str())
+                .or_else(|| feed.group.as_deref().and_then(|g| pauses.get(g)))
+                .copied()
+                .unwrap_or(crate::deadair::DEFAULT_PAUSE),
             allow_explicit: mine
                 .allow_explicit
                 .or(up.and_then(|u| u.allow_explicit))
@@ -1300,6 +1323,41 @@ mod tests {
         assert_eq!(got, ["kid", "plain"], "the OPML as its feeds; a private feed and its shows never");
     }
 
+    #[test]
+    fn a_requests_trace_is_the_pages_from_its_traceparent() {
+        use opentelemetry::trace::TraceContextExt;
+        let with = |v: &str| {
+            let mut h = HeaderMap::new();
+            h.insert("traceparent", v.parse().unwrap());
+            remote_parent(&h, None)
+        };
+        let cx = with("00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01").expect("parsed");
+        assert_eq!(cx.span().span_context().trace_id().to_string(), "4bf92f3577b34da6a3ce929d0e0e4736");
+        assert!(cx.span().span_context().is_remote());
+        // Anything else from the browser starts a trace of its own.
+        for bad in ["", "00-xyz-00f067aa0ba902b7-01", "01-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
+                    "00-00000000000000000000000000000000-00f067aa0ba902b7-01", "00-4bf92f3577b34da6a3ce929d0e0e4736"] {
+            assert!(with(bad).is_none(), "{bad}");
+        }
+        assert!(remote_parent(&HeaderMap::new(), None).is_none());
+        // From the query, where a beacon or Safari's player cannot send a header (#192).
+        let q = remote_parent(&HeaderMap::new(), Some("x=1&traceparent=00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"));
+        assert_eq!(q.unwrap().span().span_context().trace_id().to_string(), "4bf92f3577b34da6a3ce929d0e0e4736");
+        assert!(remote_parent(&HeaderMap::new(), Some("traceparent=nonsense")).is_none());
+    }
+
+    #[tokio::test]
+    async fn the_page_reports_only_what_it_is_meant_to() {
+        let u = crate::db::User { id: 1, name: "dee".into(), pass_hash: None, is_admin: false, created: None, last_login: None };
+        let e = |ev: &str| ClientEvent {
+            ev: ev.into(), msg: Some("x".repeat(10_000)), src: None, line: None, feed: None, enclosure: None, deadair: None, ms: Some(5),
+        };
+        for ev in ["page_error", "rejection", "player_error", "play_start", "stall"] {
+            assert_eq!(client_event(u.clone(), Json(e(ev))).await, StatusCode::NO_CONTENT, "{ev}");
+        }
+        assert_eq!(client_event(u, Json(e("anything"))).await, StatusCode::BAD_REQUEST);
+    }
+
     #[test]
     fn only_the_last_admin_is_protected() {
         let u = |id, is_admin| crate::db::User {
@@ -1446,16 +1504,20 @@ async fn entry_page(
     let search = page.q.as_deref().map(str::trim).filter(|q| !q.is_empty());
     let db = &state.ctx.db;
     let order = crate::db::order_sql(page.sort.as_deref().unwrap_or("published"), page.dir.as_deref().unwrap_or("desc"));
-    let mut rows =
-        db.entries_in(user_id, feed, filter, search, page.offset, page.limit.clamp(1, 200), &order).await?;
+    let mut rows = db
+        .entries_in(user_id, feed, filter, search, page.offset, page.limit.clamp(1, 200), &order)
+        .instrument(step("entries_in"))
+        .await?;
+    step("sanitize").in_scope(|| {
         let mut sanitizer = feed_sanitizer();
         for row in &mut rows {
             if let Some(d) = &row.description {
                 row.description = Some(clean_description(&mut sanitizer, d, row.link.as_deref()));
             }
         }
-    crate::deadair::for_reader(&state.ctx, user_id, &mut rows).await?;
-    let total = db.count_in(user_id, feed, filter, search).await?;
+    });
+    crate::deadair::for_reader(&state.ctx, user_id, &mut rows).instrument(step("deadair")).await?;
+    let total = db.count_in(user_id, feed, filter, search).instrument(step("count_in")).await?;
     Ok(Json(EntryPage { total, entries: rows }))
 }
 
@@ -1577,10 +1639,12 @@ struct FeedPatch {
     #[serde(default, deserialize_with = "double_option")]
     max_new_per_check: Option<Option<usize>>,
     pinned: Option<bool>,
-    /// True plays the feed from DeadAir's copies, false keeps it out (of its group's too), null
+    /// True plays the feed shortened by DeadAir, false keeps it out (of its group's too), null
     /// follows its group again (#171).
     #[serde(default, deserialize_with = "double_option")]
     deadair: Option<Option<bool>>,
+    /// The pause DeadAir leaves where it cuts, in ms: one of `deadair::PAUSES` (#182).
+    deadair_pause: Option<i64>,
 }
 
 /// A block list as sent: trimmed, blanks and repeats dropped, and bounded, since each word is
@@ -1618,10 +1682,18 @@ async fn patch_feed(
     {
         return Err(ApiError::not_found("you do not subscribe to that feed"));
     }
+    if let Some(p) = body.deadair_pause
+        && !crate::deadair::PAUSES.contains(&p)
+    {
+        return Err(ApiError::bad_request("DeadAir's pause is 200, 300, 400 or 500 ms"));
+    }
     if let Some(wanted) = body.deadair {
         state.ctx.db.set_deadair(user.id, &id, wanted).await?;
         state.ctx.deadair.notify_one();
     }
+    if let Some(p) = body.deadair_pause {
+        state.ctx.db.set_deadair_pause(user.id, &id, p).await?;
+    }
     // What one person wants -- which items, whether to fetch them, how many at a time --
     // is theirs. It goes on their subscription and nobody else sees the change.
     if let Some(mut mine) = state.ctx.db.subscription(user.id, &id).await? {
@@ -1887,7 +1959,10 @@ async fn events(
                     }
                     return Some((futures_util::stream::iter(out), (rx, state, user)));
                 }
-                Err(broadcast::error::RecvError::Lagged(_)) => {}
+                // Counted for /metrics: a page that misses updates shows stale counts (#195).
+                Err(broadcast::error::RecvError::Lagged(n)) => {
+                    crate::metrics::STATS.events_missed.fetch_add(n, std::sync::atomic::Ordering::Relaxed);
+                }
                 Err(broadcast::error::RecvError::Closed) => return None,
             }
         }
@@ -1895,15 +1970,15 @@ async fn events(
     Sse::new(futures_util::StreamExt::flatten(stream)).keep_alive(axum::response::sse::KeepAlive::default())
 }
 
-/// The feed an event changed what the list shows of: its counts, error or last check. Not the
-/// routine skip of a feed not due, dozens a minute that change nothing.
+/// The feed an event changed what the list shows of: its counts, error or last check. The
+/// routine skip of a feed not due never reaches here (`Emitter::emit`).
 fn changed_feed(ev: &Event) -> Option<&str> {
     match ev {
         Event::FeedDone { feed, .. }
         | Event::FeedError { feed, .. }
         | Event::FeedMoved { feed, .. }
         | Event::DownloadDone { feed, .. } => Some(feed),
-        Event::FeedSkip { feed, reason } if !reason.starts_with("not due") => Some(feed),
+        Event::FeedSkip { feed, .. } => Some(feed),
         _ => None,
     }
 }
@@ -1918,9 +1993,73 @@ async fn media(
     serve_media(state, id, user, req, false).await
 }
 
-/// DeadAir's copy of a file (#171), at an address of its own: a player that had part of one
-/// version cached and asked the same address for more would stitch the two together.
-async fn media_deadair(
+/// DeadAir's playlist of a file (#181): the original's frames kept by this person's pause
+/// (#182), as byte ranges of `deadair.mp3` beside it. At an address of its own, so a player that
+/// had part of one version cached never stitches the two together.
+async fn media_deadair(State(state): State<WebState>, Path(id): Path<i64>, user: crate::db::User) -> Response {
+    let Ok(Some(enc)) = state.ctx.db.enclosure(id).await else {
+        return (StatusCode::NOT_FOUND, "no such enclosure").into_response();
+    };
+    if let Err(e) = subscribed(&state, &user, &enc.feed_id).await {
+        return e.into_response();
+    }
+    let plan = match crate::deadair::plan_for(&state.ctx, user.id, &enc.feed_id, id).instrument(step("plan")).await {
+        Ok(Some(p)) => p,
+        Ok(None) => return (StatusCode::NOT_FOUND, "DeadAir has nothing to cut in this file for you").into_response(),
+        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e:#}")).into_response(),
+    };
+    let body = crate::deadair::playlist(&plan, "deadair.mp3");
+    // Which version this person is playing, so the positions their player saves are read in its
+    // clock (`deadair::on_save`).
+    state.playing.lock().unwrap().insert((user.id, enc.feed_id, enc.guid), Arc::new(plan));
+    // Never kept: it changes with the pause they choose.
+    ([(header::CONTENT_TYPE, "application/vnd.apple.mpegurl"), (header::CACHE_CONTROL, "no-store")], body)
+        .into_response()
+}
+
+/// A file without its dead air, to keep (#186): what the save button fetches for someone who
+/// plays it shortened.
+// shortcut: no Range requests, so a save that breaks off starts again; fine for a button that
+// saves, add them if a player is ever pointed here.
+async fn media_save(State(state): State<WebState>, Path(id): Path<i64>, user: crate::db::User) -> Response {
+    let Ok(Some(enc)) = state.ctx.db.enclosure(id).await else {
+        return (StatusCode::NOT_FOUND, "no such enclosure").into_response();
+    };
+    if let Err(e) = subscribed(&state, &user, &enc.feed_id).await {
+        return e.into_response();
+    }
+    let Some(path) = enc.path else {
+        return (StatusCode::NOT_FOUND, "not downloaded").into_response();
+    };
+    let plan = match crate::deadair::plan_for(&state.ctx, user.id, &enc.feed_id, id).instrument(step("plan")).await {
+        Ok(Some(p)) => p,
+        Ok(None) => return (StatusCode::NOT_FOUND, "DeadAir has nothing to cut in this file for you").into_response(),
+        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, format!("{e:#}")).into_response(),
+    };
+    let path = crate::download::playable(std::path::Path::new(&path));
+    let (len, body) = match crate::deadair::kept(&path, &plan).await {
+        Ok(k) => k,
+        Err(e) => return (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response(),
+    };
+    let stem = path.file_stem().map_or("episode".into(), |s| s.to_string_lossy());
+    let ext = path.extension().map_or("mp3".into(), |s| s.to_string_lossy());
+    let name = format!("{stem} (DeadAir).{ext}");
+    let name = percent_encoding::utf8_percent_encode(&name, percent_encoding::NON_ALPHANUMERIC);
+    let kind = if ext.eq_ignore_ascii_case("aac") { "audio/aac" } else { "audio/mpeg" };
+    (
+        [
+            (header::CONTENT_TYPE, kind.to_owned()),
+            (header::CONTENT_LENGTH, len.to_string()),
+            (header::CONTENT_DISPOSITION, format!("attachment; filename*=UTF-8''{name}")),
+            (header::CACHE_CONTROL, "private".to_owned()),
+        ],
+        axum::body::Body::from_stream(body),
+    )
+        .into_response()
+}
+
+/// The original's bytes, for the pieces of DeadAir's playlist.
+async fn media_piece(
     State(state): State<WebState>,
     Path(id): Path<i64>,
     user: crate::db::User,
@@ -1929,30 +2068,28 @@ async fn media_deadair(
     serve_media(state, id, user, req, true).await
 }
 
-async fn serve_media(state: WebState, id: i64, user: crate::db::User, req: Request, copy: bool) -> Response {
+async fn serve_media(state: WebState, id: i64, user: crate::db::User, req: Request, piece: bool) -> Response {
     let Ok(Some(enc)) = state.ctx.db.enclosure(id).await else {
         return (StatusCode::NOT_FOUND, "no such enclosure").into_response();
     };
     if let Err(e) = subscribed(&state, &user, &enc.feed_id).await {
         return e.into_response();
     }
-    let Some(mut path) = enc.path else {
+    let Some(path) = enc.path else {
         return (StatusCode::NOT_FOUND, "not downloaded").into_response();
     };
-    // Which version this person is playing, so the positions their player saves are read in its
-    // clock (`deadair::on_save`).
-    let key = (user.id, enc.feed_id.clone(), enc.guid.clone());
-    if copy {
-        let Some(c) = state.ctx.db.copies(&[id]).await.ok().and_then(|c| c.into_iter().next()) else {
-            return (StatusCode::NOT_FOUND, "no DeadAir copy").into_response();
-        };
-        path = c.path.clone();
-        state.playing.lock().unwrap().insert(key, Arc::new(c));
-    } else {
-        state.playing.lock().unwrap().remove(&key);
+    // The original itself: positions this person's player saves are in its clock again. A piece
+    // of the playlist leaves that as the playlist set it.
+    if !piece {
+        state.playing.lock().unwrap().remove(&(user.id, enc.feed_id.clone(), enc.guid.clone()));
     }
     match ServeFile::new(crate::download::playable(std::path::Path::new(&path))).oneshot(req).await {
-        Ok(r) => r.into_response(),
+        Ok(mut r) => {
+            // Never in a shared cache: Cloudflare kept `deadair.mp3`, by its extension, and served
+            // its copy to anyone Access let in, without the subscriber check above (#189).
+            r.headers_mut().insert(header::CACHE_CONTROL, header::HeaderValue::from_static("private"));
+            r.into_response()
+        }
         Err(e) => (StatusCode::INTERNAL_SERVER_ERROR, e.to_string()).into_response(),
     }
 }
@@ -1978,11 +2115,13 @@ async fn art(State(state): State<WebState>, Query(q): Query<ArtQuery>) -> Respon
     let keep = state.ctx.cfg().general.art_cache_mb > 0;
     let file = crate::art::path(&q.u);
     if keep && let Some((kind, body)) = crate::art::read(&file) {
+        crate::metrics::STATS.art_hits.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         return art_response(kind, body);
     }
     if let Some(why) = crate::art::failed(&q.u) {
         return (StatusCode::BAD_GATEWAY, why).into_response();
     }
+    crate::metrics::STATS.art_misses.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
     let got = async {
         let mut r = state.ctx.client.get(&q.u).timeout(crate::feed::FEED_TIMEOUT).send().await?.error_for_status()?;
         let kind = r.headers().get(header::CONTENT_TYPE).and_then(|v| v.to_str().ok()).unwrap_or("").to_owned();
@@ -2291,6 +2430,65 @@ async fn logs(user: crate::db::User, Query(q): Query<LogQuery>) -> Result<Json<L
     Ok(Json(LogPage { lines, latest }))
 }
 
+/// What the page reports from the browser (#190): its errors and its player's, and how long play
+/// took to start or stalled for. Logged as `ev` lines under `ipx::client`, inside the request's
+/// span, so a line carries the trace of the action that led to it.
+#[derive(Deserialize)]
+struct ClientEvent {
+    ev: String,
+    msg: Option<String>,
+    src: Option<String>,
+    line: Option<u32>,
+    feed: Option<String>,
+    enclosure: Option<i64>,
+    deadair: Option<bool>,
+    ms: Option<u64>,
+}
+
+async fn client_event(user: crate::db::User, Json(e): Json<ClientEvent>) -> StatusCode {
+    // From the browser: only the kinds the page sends, and nothing long enough to fill the log.
+    let cut = |s: &Option<String>| s.as_deref().map(|s| s.chars().take(500).collect::<String>());
+    let (msg, src, feed) = (cut(&e.msg), cut(&e.src), cut(&e.feed));
+    let (ev, line, enclosure, deadair, ms, user) = (e.ev.as_str(), e.line, e.enclosure, e.deadair, e.ms, user.name.as_str());
+    match ev {
+        "page_error" | "rejection" | "player_error" => tracing::warn!(
+            target: "ipx::client", ev, msg, src, line, feed, enclosure, deadair, user,
+            "{user}'s page: {ev}: {}", msg.as_deref().unwrap_or("")
+        ),
+        "play_start" | "stall" => tracing::info!(
+            target: "ipx::client", ev, ms, feed, enclosure, deadair, user,
+            "{user}'s page: {ev} {} ms", ms.unwrap_or(0)
+        ),
+        _ => return StatusCode::BAD_REQUEST,
+    }
+    StatusCode::NO_CONTENT
+}
+
+/// The trace a request from the page belongs to, from its `traceparent` (#190), so the requests
+/// one action sets off are one trace. None for a missing or malformed one. In the query where no
+/// header can be set: a position saved by sendBeacon, and the playlist Safari's player fetches
+/// itself (#192).
+fn remote_parent(headers: &HeaderMap, query: Option<&str>) -> Option<opentelemetry::Context> {
+    use opentelemetry::trace::{SpanContext, SpanId, TraceContextExt, TraceFlags, TraceId, TraceState};
+    let v = match headers.get("traceparent") {
+        Some(h) => h.to_str().ok()?,
+        None => query?.split('&').find_map(|kv| kv.strip_prefix("traceparent="))?,
+    };
+    let mut parts = v.split('-');
+    let (version, trace, span) = (parts.next()?, parts.next()?, parts.next()?);
+    if version != "00" || trace.len() != 32 || span.len() != 16 {
+        return None;
+    }
+    let sc = SpanContext::new(
+        TraceId::from_hex(trace).ok()?,
+        SpanId::from_hex(span).ok()?,
+        TraceFlags::SAMPLED,
+        true,
+        TraceState::default(),
+    );
+    sc.is_valid().then(|| opentelemetry::Context::new().with_remote_span_context(sc))
+}
+
 /// Names a request's trace by its route, `POST /api/entries/{feed_id}/{guid}/flags`, once routing
 /// has found it. Named by the path `access_log` sees, every item's GUID was a trace name of its
 /// own, and nothing grouped. A route layer, because only one runs after routing. Renamed on the
@@ -2330,8 +2528,14 @@ async fn access_log(req: Request, next: Next) -> Response {
             http.response.status_code = tracing::field::Empty,
         )
     };
+    if let Some(parent) = remote_parent(req.headers(), req.uri().query()) {
+        use tracing_opentelemetry::OpenTelemetrySpanExt;
+        let _ = span.set_parent(parent);
+    }
     let started = std::time::Instant::now();
+    let in_flight = crate::metrics::busy(&crate::metrics::STATS.http_in_flight);
     let resp = tracing::Instrument::instrument(next.run(req), span.clone()).await;
+    drop(in_flight);
     span.record("http.response.status_code", resp.status().as_u16());
     if !quiet {
         let duration_ms = started.elapsed().as_millis() as u64;

tests/dom-stub.js

@@ -47,7 +47,7 @@ function makeContext(html, script, { media = false } = {}) {
   };
 
   const ctx = {
-    document, console,
+    document, console, crypto: require("crypto").webcrypto, performance,
     window: { isSecureContext: false, addEventListener(){} },
     localStorage: { getItem: () => null, setItem(){}, removeItem(){} },
     navigator: { clipboard: undefined, sendBeacon(){}, mediaSession: undefined },

tests/ui/app.spec.js

@@ -1429,15 +1429,17 @@ test('a failing feed is marked on its artwork and says why', async ({ page }) =>
 test.describe('touch gestures on a phone', () => {
   test.use({ viewport: { width: 390, height: 844 }, hasTouch: true, isMobile: true });
 
-  // Playwright's touchscreen only taps; a drag goes through the DevTools protocol.
+  // Playwright's touchscreen only taps; a drag goes through the DevTools protocol. Sent all at
+  // once, in order: awaited one by one, a busy machine stretched a drag past the 800 ms a swipe
+  // has, and it was taken for a slow drag and went nowhere (#184).
   async function drag(page, from, to, lift = true) {
     const cdp = await page.context().newCDPSession(page);
-    const steps = 8;
-    await cdp.send('Input.dispatchTouchEvent', { type: 'touchStart', touchPoints: [from] });
+    const steps = 8, touch = (type, touchPoints) => cdp.send('Input.dispatchTouchEvent', { type, touchPoints });
+    const sent = [touch('touchStart', [from])];
     for (let i = 1; i <= steps; i++)
-      await cdp.send('Input.dispatchTouchEvent', { type: 'touchMove', touchPoints: [{
-        x: from.x + (to.x - from.x) * i / steps, y: from.y + (to.y - from.y) * i / steps }] });
-    if (lift) await cdp.send('Input.dispatchTouchEvent', { type: 'touchEnd', touchPoints: [] });
+      sent.push(touch('touchMove', [{ x: from.x + (to.x - from.x) * i / steps, y: from.y + (to.y - from.y) * i / steps }]));
+    if (lift) sent.push(touch('touchEnd', []));
+    await Promise.all(sent);
     return cdp;
   }
 
@@ -1751,7 +1753,7 @@ test('a feed\'s settings say what downloads, take words as chips, and keep what
   await page.keyboard.press('Escape');
 });
 
-test('DeadAir is off until turned on for a show, then plays its shortened copy and switches back', async ({ page }) => {
+test('DeadAir is off until turned on for a show, then plays it shortened, with your pause, and switches back', async ({ page }) => {
   // #171/#172. A show of its own, with real audio, added here and left at the end.
   const { id } = await (await page.request.post('/api/feeds', { data: { url: 'http://127.0.0.1:8792/quiet.xml' } })).json();
   const entry = async () => {
@@ -1761,7 +1763,7 @@ test('DeadAir is off until turned on for a show, then plays its shortened copy a
   await expect.poll(async () => (await entry())?.guid, { timeout: 15_000 }).toBe('quiet-1');
   await page.request.post(`/api/feeds/${encodeURIComponent(id)}/download-latest`, { data: { count: 1 } });
   await expect.poll(async () => !!(await entry())?.enclosures[0]?.path, { timeout: 15_000 }).toBe(true);
-  // Off for a show until someone turns it on: no copy is made.
+  // Off for a show until someone turns it on: nothing is cut.
   expect((await entry()).enclosures[0].deadair).toBeUndefined();
   await page.reload();
 
@@ -1772,16 +1774,49 @@ test('DeadAir is off until turned on for a show, then plays its shortened copy a
   await expect(sw).not.toBeChecked();
   await sw.locator('xpath=..').click();
   await page.locator('#ssave').click();
-  // Made at once, not at the next pass: about 1.8 s off each of four 2 s silences.
-  await expect.poll(async () => (await entry()).enclosures[0].deadair ?? 0, { timeout: 20_000 }).toBeGreaterThan(5);
-  await page.reload();
-  await page.locator('#feedlist .feed', { hasText: 'Quiet Show' }).first().click();
+  // Found at once, not at the next pass, and the row says so when it is done without a reload:
+  // "Cutting dead air…" until then, then about 1.7 s off each of four 2 s silences.
   const row = page.locator('.ep', { hasText: 'Pauses Between' });
-  await expect(row).toContainText('s shorter');
+  await expect(row).toContainText('s shorter', { timeout: 20_000 });
+  expect((await entry()).enclosures[0].deadair).toBeGreaterThan(5);
+  await expect(row).not.toContainText('Cutting dead air');
 
-  // Played from the copy, with the switch beside the speed pressed.
+  // A longer pause of your own (#182) saves less.
+  const usual = (await entry()).enclosures[0].deadair;
+  await page.locator('#content .acts [data-a="settings"]').click();
+  await expect(page.locator('#sdpause')).toHaveValue('300');
+  await page.locator('#sdpause').fill('500');
+  await page.locator('#ssave').click();
+  await expect.poll(async () => (await entry()).enclosures[0].deadair).toBeLessThan(usual);
+
+  // Saved without its dead air too (#186): smaller than the original, named to say so.
+  const saved = await page.evaluate(async id => {
+    const [d, o, p] = await Promise.all([fetch(`/media/${id}/deadair`), fetch(`/media/${id}`), fetch(`/media/${id}/deadair.mp3`, { headers: { Range: 'bytes=0-99' } })]);
+    return { status: d.status, name: d.headers.get('content-disposition'), size: (await d.arrayBuffer()).byteLength, full: (await o.arrayBuffer()).byteLength,
+      // Kept out of shared caches, or Cloudflare serves its own copy to anyone (#189).
+      caching: [d, o, p].map(r => r.headers.get('cache-control')), piece: p.status };
+  }, (await entry()).enclosures[0].id);
+  expect(saved.status).toBe(200);
+  expect(saved.name).toContain('DeadAir');
+  expect(saved.size).toBeLessThan(saved.full);
+  expect(saved.caching).toEqual(['private', 'private', 'private']);
+  expect(saved.piece).toBe(206);
+
+  // Played through DeadAir's playlist (#181), by hls.js in Chromium, with the switch beside the
+  // speed pressed. The element's own src is then hls.js's blob: address.
+  // How long it took to start goes to the server's log, under the trace of the tap (#190).
+  const started = page.waitForRequest(r => r.url().endsWith('/api/client') && r.postDataJSON()?.ev === 'play_start');
+  const piece = page.waitForRequest(r => r.url().endsWith('/deadair.mp3'));
   await row.locator('[data-a=play]').click();
-  await expect.poll(() => page.evaluate(() => document.querySelector('#audio').getAttribute('src'))).toMatch(/\/deadair$/);
+  await expect.poll(() => page.evaluate(() => player.src)).toMatch(/\/deadair\.m3u8$/);
+  const report = await started;
+  expect(report.postDataJSON()).toMatchObject({ deadair: true });
+  expect(report.postDataJSON().ms).toBeGreaterThan(0);
+  expect(report.headers().traceparent).toMatch(/^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/);
+  // hls.js's own requests carry the same trace as the tap that played them (#192).
+  const traceOf = h => h.traceparent?.split('-')[1];
+  expect(traceOf((await piece).headers())).toBe(traceOf(report.headers()));
+  await expect.poll(() => page.evaluate(() => document.querySelector('#audio').currentTime), { timeout: 15_000 }).toBeGreaterThan(0.5);
   await expect(page.locator('#pdead')).toHaveAttribute('aria-pressed', 'true');
   // Off from the player: the original, from the same place.
   await page.locator('#pdead').click();
@@ -1792,3 +1827,14 @@ test('DeadAir is off until turned on for a show, then plays its shortened copy a
   await page.locator('#pclose').click();
   await page.request.delete(`/api/feeds/${encodeURIComponent(id)}`);
 });
+
+test('a downloaded file\'s buttons sit on one row in the files pane', async ({ page }) => {
+  await page.setViewportSize({ width: 1280, height: 800 });
+  await page.locator('#feedlist .feed', { hasText: 'Test Show' }).first().click();
+  await expect(page.locator('.ep').first()).toBeVisible();
+  await page.evaluate(() => showDetail(S.entries.find(e => e.enclosures.some(x => x.path))));
+  const box = page.locator('#files .encbox').first();
+  await expect(box.locator('.btn')).toHaveCount(4);
+  const tops = await box.locator('.btn').evaluateAll(bs => bs.map(b => Math.round(b.getBoundingClientRect().top)));
+  expect(new Set(tops).size, 'play, save, share and delete wrapped onto two rows').toBe(1);
+});

web/app.css

@@ -806,7 +806,11 @@ body.scan-this .fhead [data-a=scan] .i,body.scan-any .fhead [data-a=scanall] .i,
 #files{grid-area:files;overflow-y:auto;padding:8px 12px;border-left:1px solid var(--line);background:var(--panel)}
 /* Nothing selected, or an item with no files: the list takes the width. */
 #split:has(>#files[hidden]){grid-template-columns:minmax(0,1fr) 0}
-#files .encbox{margin-top:8px}
+/* One row in the narrow pane: four buttons and the size wrapped the last button under the rest.
+   The size gives way first, with an ellipsis. */
+#files .encbox{margin-top:8px;flex-wrap:nowrap;gap:6px;padding:10px}
+#files .encbox .meta{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+#files .encbox .btn.ico{padding:4px 7px;min-width:0;flex:none}
 #files .empty{padding:24px 0}
 .fhd{font-size:12px;color:var(--faint)}
 #grab{grid-area:grab;cursor:row-resize;background:var(--line)}
@@ -1110,7 +1114,28 @@ input[type=range]::-moz-range-thumb{width:12px;height:12px;border:0;border-radiu
 .wcap{margin:0 0 16px;font-size:13px;line-height:1.55;color:var(--dim)}
 .wcap input[type=number]{display:inline-block;width:4.2em;margin:0 2px;padding:1px 4px;font-size:13px;text-align:center;font-variant-numeric:tabular-nums;color:var(--fg)}
 .ffield{display:grid;gap:6px;margin-bottom:14px}
+/* DeadAir's pause: four stops on one scale, a dot at each so it reads as four places to stop. */
+.dpause{display:grid;gap:6px;margin-top:6px}
+.dphead{display:flex;justify-content:space-between;align-items:baseline}
+.dphead output{font-variant-numeric:tabular-nums;font-weight:600}
+.dpslide{--t:22px;position:relative;height:var(--t)}
+.dpslide::before,.dpslide::after{content:'';position:absolute;top:50%;pointer-events:none}
+.dpslide::before{left:0;right:0;height:6px;margin-top:-3px;border-radius:3px;background:var(--raise)}
+.dpslide::after{left:calc(var(--t)/2 - 3px);right:calc(var(--t)/2 - 3px);height:6px;margin-top:-3px;
+  background:radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 0 0/6px 6px no-repeat,
+    radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 33.333% 0/6px 6px no-repeat,
+    radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 66.667% 0/6px 6px no-repeat,
+    radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 100% 0/6px 6px no-repeat}
+.dpslide input[type=range]{position:relative;z-index:1;width:100%;height:var(--t);margin:0;background:transparent}
+.dpslide input[type=range]::-webkit-slider-thumb{width:var(--t);height:var(--t);box-shadow:0 0 0 3px var(--panel),0 1px 4px rgba(0,0,0,.3)}
+.dpslide input[type=range]::-moz-range-thumb{width:var(--t);height:var(--t);box-shadow:0 0 0 3px var(--panel),0 1px 4px rgba(0,0,0,.3)}
+.dpslide input[type=range]:focus-visible{outline:2px solid var(--accent);outline-offset:4px;border-radius:var(--t)}
+.dpends{display:flex;justify-content:space-between;font-size:12.5px;color:var(--dim)}
+.dpause:has(input:disabled){opacity:.45}
+.dpslide input[type=range]:disabled{cursor:default}
 .fdl+.ffield{margin-top:18px}
+/* DeadAir shares the box but not the fold: it applies whether or not this show downloads on its own. */
+.fdead{border-top:1px solid var(--line);padding-top:10px;margin-top:4px}
 .flabel{font-size:14px;font-weight:500}
 .cap{margin:0;font-size:12.5px;line-height:1.45;color:var(--dim)}
 /* Words and phrases as chips: in one comma-separated box, one ran into the next. */
@@ -1346,6 +1371,8 @@ body:has(#player.on) #status{padding-bottom:3px}
   .sw input:checked+i::after{transform:translateX(20px)}
   .seg label{padding:7px 4px;border-radius:8px;font-size:14px}
   .seg label:has(input:checked){box-shadow:0 1px 3px rgba(0,0,0,.22)}
+  .dpslide{--t:28px}
+  .dpends{font-size:14px}
   /* 16px or more, or Safari zooms the page in on it. */
   .wcap input[type=number]{font-size:16px;padding:3px 4px}
   .chips{background:var(--panel2);border-color:var(--edge);border-radius:10px}

web/build.mjs

@@ -30,6 +30,11 @@ const STYLE = 'app.css';
 
 const hash = s => crypto.createHash('sha256').update(s).digest('hex').slice(0, 12);
 
+// hls.js, for browsers that cannot play DeadAir's playlists themselves (#181). Served as it comes,
+// by a name with its hash in it, which the page's script is given in place of __HLS_JS__.
+const HLS = fs.readFileSync(path.join(here, '..', 'node_modules', 'hls.js', 'dist', 'hls.light.min.js'), 'utf8');
+const HLS_URL = `/hls.js?v=${hash(HLS)}`;
+
 /// The shared stylesheet, minified. @swc/html minifies CSS inside a page, so it goes through as
 /// one; the doctype only keeps it from complaining that a fragment has none.
 export function buildStyle({ minify = true } = {}) {
@@ -51,7 +56,8 @@ export function buildStyle({ minify = true } = {}) {
 /// The page and its script, built: { html, js, script }, where script is the file's name.
 export function buildPage(name, { minify = true } = {}) {
   const { script, src: files } = PAGES[name];
-  const src = files.map(f => fs.readFileSync(path.join(here, 'src', f + '.ts'), 'utf8')).join('\n');
+  const src = files.map(f => fs.readFileSync(path.join(here, 'src', f + '.ts'), 'utf8')).join('\n')
+    .replaceAll('__HLS_JS__', HLS_URL);
   const js = swc.transformSync(src, {
     filename: name + '.ts',
     jsc: {
@@ -88,6 +94,7 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
   const out = process.argv[2] || path.join(here, 'dist');
   fs.mkdirSync(out, { recursive: true });
   fs.writeFileSync(path.join(out, STYLE), buildStyle());
+  fs.writeFileSync(path.join(out, 'hls.js'), HLS);
   for (const name of Object.keys(PAGES)) {
     const { html, js, script } = buildPage(name);
     fs.writeFileSync(path.join(out, name), html);

web/src/dialogs.ts

@@ -526,11 +526,16 @@ function settingsModal(f, newUrl?: string){
         <div class="chips" id="skw">${chipsHTML(f.keywords,'skwin')}</div>
         <p class="cap">Any one of these will do, and a phrase needs all its words. Empty takes everything.</p></div>
       ${sw(`<input type="checkbox" role="switch" id="sexp"${f.allow_explicit?' checked':''}>`,'Include explicit items')}
-    </div></div></div></div>
-    <div class="ffield">${sw(`<input type="checkbox" role="switch" id="sdead"${f.deadair?' checked':''}>`,'DeadAir',' lead')}
+    </div></div></div>
+    <div class="ffield fdead">${sw(`<input type="checkbox" role="switch" id="sdead"${f.deadair?' checked':''}>`,'DeadAir',' lead')}
       <p class="cap">Cuts the dead air: long silences in ${isGroup?'these shows':'this show'} shrink to a beat, so
       episodes finish sooner and every voice keeps its own pace. Leave it off for stories whose pauses
-      are part of the telling.</p></div>
+      are part of the telling.</p>
+      <div class="dpause">
+        <div class="dphead"><label class="flabel" for="sdpause">Breathing room</label><output id="sdpauseout" for="sdpause"></output></div>
+        <div class="dpslide"><input type="range" id="sdpause" min="200" max="500" step="100" value="${f.deadair_pause||300}"${f.deadair?'':' disabled'}></div>
+        <div class="dpends" aria-hidden="true"><span>Brisk</span><span>Relaxed</span></div>
+        <p class="cap">The silence kept where a long one is cut. More is easier on the ear; less saves more time.</p></div></div></div>
     ${isGroup?'':`<div class="ffield"><label class="flabel" for="sblockin">Hide items that mention</label>
       <div class="chips" id="sblock">${chipsHTML(f.blocked||[],'sblockin')}</div>
       <p class="cap">Whole words or phrases. Hidden from your list and not downloaded for you, along
@@ -575,6 +580,10 @@ function settingsModal(f, newUrl?: string){
     if(n) n.oninput=()=>{ newest=Math.max(1,Math.floor(Number(n.value))||1); draw(false); };
   };
   for(const r of $$('[name=swin]')) r.onchange=()=>{ mode=r.value; draw(true); };
+  // Breathing room only matters with DeadAir on: greyed out, not hidden, so it can be seen beforehand.
+  $('#sdead').onchange=e=>{ $('#sdpause').disabled=!e.target.checked; };
+  const pause=$('#sdpause'), pauseText=()=>{ const s=`${pause.value/1000} s`; $('#sdpauseout').textContent=s; pause.setAttribute('aria-valuetext',s); };
+  pause.oninput=pauseText; pauseText();
   draw(true);
   // The feed's own newest items, each as tall as it is long, so the strip reads as this show.
   if(!isGroup) api(`/api/feeds/${encodeURIComponent(f.id)}/entries?limit=40`).then(page=>{
@@ -614,7 +623,8 @@ function settingsModal(f, newUrl?: string){
       const patch: Record<string, unknown>={
         keywords:chipWords($('#skw')),
         max_new_per_check:mode==='default'?null:mode==='all'?0:newest,
-        auto_download:$('#sauto').checked, allow_explicit:$('#sexp').checked, deadair:$('#sdead').checked};
+        auto_download:$('#sauto').checked, allow_explicit:$('#sexp').checked, deadair:$('#sdead').checked,
+        deadair_pause:Number($('#sdpause').value)};
       if($('#sblock')) patch.blocked=chipWords($('#sblock'));
       // The address is the same for everyone: an admin's to change, for a feed that moved, and the
       // API refuses it from anyone else. The folder and category are not this dialog's at all.

web/src/events.ts

@@ -35,6 +35,13 @@ function connect(){
       if(bar){ bar.classList.remove('live'); toast('Downloaded '+ev.path.split('/').pop()); }
       refreshEntries();
     }
+    // A copy finished: the episode's "Cutting dead air…" becomes how much shorter it is.
+    else if(ev.ev==='deadair_done'){
+      if(!mine(ev.feed)) return;
+      if(ev.saved_s>0&&document.querySelector('.dapend')) toast(`DeadAir is done: ${shorter(ev.saved_s)}`);
+      refreshEntries();
+      if(S.sel) loadEntries().then(()=>{ const e=cur(); if(e) showDetail(e); }).catch(()=>{});
+    }
     else if(ev.ev==='download_error'){
       const bar=document.querySelector(`.dlbar[data-bar="${ev.enclosure}"]`);
       if(bar) bar.classList.remove('live');

web/src/items.ts

@@ -79,6 +79,7 @@ function epEl(e){
         left&&`<span>${left}</span>`,
         others>0&&`<span>+${others} more file${others===1?'':'s'}</span>`,
         enc&&enc.deadair>0&&`<span title="DeadAir cut its dead air">${shorter(enc.deadair)}</span>`,
+        enc&&enc.deadair_pending&&DEAD_PENDING,
         enc&&enc.last_error&&enc.state==='error'&&`<span style="color:var(--bad)">${esc(enc.last_error)}</span>`,
       ].filter(Boolean).join('<span class="dot"></span>')}</div>
     </div>
@@ -300,7 +301,8 @@ function detailHtml(e){
          themselves would read as a mistake. */ e.title&&e.title.trim() ? `<h3 class="dt">${esc(e.title)}</h3>` : ''}
     <div class="dmeta">
       ${/* Joined, so a missing date or number leaves no stray dot behind. */
-        [f&&esc(f.title||f.id), num, dateOf(e.published), e.duration&&clock(e.duration)]
+        [f&&esc(f.title||f.id), num, dateOf(e.published), e.duration&&clock(e.duration),
+         e.enclosures.some(x=>x.deadair_pending)&&DEAD_PENDING]
         .filter(Boolean).map(s=>`<span>${s}</span>`).join('<span class="dot"></span>')}
       <span class="dacts"><button class="btn ico" data-a="read" title="Mark ${e.read?'unread':'read'}"
         aria-label="Mark ${e.read?'unread':'read'}" aria-pressed="${!!e.read}">${e.read?ICON.check:ICON.unread}</button>
@@ -325,7 +327,9 @@ function encBox(x){
     ? `Delete for everyone (shared with ${f.subscribers-1} other ${f.subscribers===2?'person':'people'} reading this feed)`
     : 'Delete file';
   const delBtn=`<button class="btn ico danger" data-a="del" data-enc="${x.id}" title="${delLabel}" aria-label="${delLabel}">${ICON.trash}</button>`;
-  const saveBtn=`<a class="btn ico" href="/media/${x.id}" download title="Save to this computer" aria-label="Save to this computer">${ICON.save}</a>`;
+  // Played without its dead air, so saved without it too (#186).
+  const saveLabel=x.deadair>0?'Save to this computer, without its dead air':'Save to this computer';
+  const saveBtn=`<a class="btn ico" href="/media/${x.id}${x.deadair>0?'/deadair':''}" download title="${saveLabel}" aria-label="${saveLabel}">${ICON.save}</a>`;
   // The publisher's address, not this server's copy, which only someone signed in here can open.
   const shareBtn=`<button class="btn ico" data-a="share" data-enc="${x.id}" title="Share the file" aria-label="Share the file">${ICON.share}</button>`;
   if(x.path && !isPlayable(x)){

web/src/player.ts

@@ -3,9 +3,39 @@ const audio=$('#audio');
 const player: {guid: string|null, feed: string|null, entry: any, enc?: number, src?: string, moved?: boolean,
   saveAt: number, marked: boolean}={guid:null,feed:null,entry:null,saveAt:0,marked:false};
 
-/// Where a file plays from: DeadAir's copy when the server says this person plays it (#171),
-/// whose times the entry is already given in, else the file itself.
-const mediaSrc=enc=>enc.deadair!=null?`/media/${enc.id}/deadair`:`/media/${enc.id}`;
+/// Where a file plays from: DeadAir's playlist when the server says this person plays it
+/// shortened (#171, #181), whose times the entry is already given in, else the file itself.
+const mediaSrc=enc=>enc.deadair!=null?`/media/${enc.id}/deadair.m3u8`:`/media/${enc.id}`;
+
+/// hls.js, playing DeadAir's playlist where the browser cannot itself. Fetched the first time it
+/// is needed. Only Apple's browsers play it themselves: Chromium says it can ("maybe"), then fails
+/// on the playlist's MP3 ranges with "stream parsing failed", and so plays nothing.
+let hls: any=null;
+function dropHls(){ if(hls){ hls.destroy(); hls=null; } }
+/// Puts a file in the player: null when it is there at once, else a promise to wait on before
+/// playing, while hls.js loads. Safari always takes the first way, where play() has to run within
+/// the tap itself or it is refused.
+function setSrc(url: string): Promise<void>|null{
+  dropHls();
+  const native=navigator.vendor.startsWith('Apple')&&!!audio.canPlayType('application/vnd.apple.mpegurl');
+  // Safari fetches the playlist itself, with no header to carry the tap's trace: in the address
+  // instead (#192). Only the playlist, which is never cached.
+  if(!url.endsWith('.m3u8')){ audio.src=url; return null; }
+  if(native){ audio.src=`${url}?traceparent=${traceparent()}`; return null; }
+  const w=window as any;
+  const ready=w.Hls?Promise.resolve():new Promise<void>((ok,fail)=>{
+    const s=document.createElement('script');
+    s.src='__HLS_JS__'; s.onload=()=>ok(); s.onerror=()=>fail(new Error('the DeadAir player did not load'));
+    document.head.append(s);
+  });
+  return ready.then(()=>{
+    // Its playlist and audio requests join the trace of the tap that played them (#192).
+    hls=new w.Hls({xhrSetup:(xhr: XMLHttpRequest)=>xhr.setRequestHeader('traceparent',traceparent())});
+    hls.on(w.Hls.Events.ERROR,(_,d)=>{ if(d.fatal){ toast('Playback failed: '+d.details,true);
+      report('player_error',{msg:`hls.js: ${d.type} ${d.details}`,feed:player.feed,enclosure:player.enc}); } });
+    hls.loadSource(url); hls.attachMedia(audio);
+  });
+}
 
 // Marked read when an item has actually been listened to -- at the end, or past 90%.
 // NOT on play: doing that made the item vanish from the Unread list the instant
@@ -29,10 +59,11 @@ function play(e,enc=e.enclosures.find(isPlayable)){
   const resuming = player.guid===e.guid && player.enc===enc.id && player.src===mediaSrc(enc);
   // Every play button is a pause button for what is playing, as the player bar's is.
   if(resuming && !audio.paused){ audio.pause(); return; }
+  let wait: Promise<void>|null=null;
   if(!resuming){
     player.guid=e.guid; player.feed=e.feed_id; player.entry=e; player.enc=enc.id; player.moved=false;
     document.body.classList.toggle('has-video', kindOf(enc)==='video');
-    audio.src=player.src=mediaSrc(enc);
+    wait=setSrc(player.src=mediaSrc(enc));
     audio.currentTime=0;
     if(e.position>5) audio.addEventListener('loadedmetadata',()=>{audio.currentTime=e.position},{once:true});
     // Initials, if it comes to that, are the feed's: the episode's read as "SE" beside the feed's art.
@@ -45,7 +76,8 @@ function play(e,enc=e.enclosures.find(isPlayable)){
     player.marked=false;
     paintDead();
   }
-  audio.play().catch(err=>toast('Playback failed: '+err.message,true));
+  const go=()=>audio.play().catch(err=>toast('Playback failed: '+err.message,true));
+  if(wait) wait.then(go,err=>toast('Playback failed: '+err.message,true)); else go();
   renderEntries();
 }
 function mediaSession(e,f){
@@ -84,7 +116,8 @@ function savePos(){
   // cannot tell a finished episode from a started one. NaN before metadata, Infinity on a stream.
   const duration=isFinite(audio.duration)?Math.floor(audio.duration):null;
   navigator.sendBeacon?.(
-    `/api/entries/${encodeURIComponent(player.feed)}/${encodeURIComponent(player.guid)}/position`,
+    // A beacon sends no headers, so the trace goes in the address (#192).
+    `/api/entries/${encodeURIComponent(player.feed)}/${encodeURIComponent(player.guid)}/position?traceparent=${traceparent()}`,
     new Blob([JSON.stringify({secs:Math.floor(audio.currentTime),duration})],{type:'application/json'}));
 }
 audio.addEventListener('pause',savePos);
@@ -110,6 +143,20 @@ function syncPlayButtons(){
 }
 for(const ev of ['play','pause','timeupdate']) audio.addEventListener(ev,syncListening);
 window.addEventListener('beforeunload',savePos);
+
+/// For the server's log (#190): how long play takes to start, how long it stalls for, and what
+/// the browser says when it cannot play a file at all.
+let asked=0, waited=0;
+const playing=()=>({feed:player.feed,enclosure:player.enc,deadair:!!player.src?.endsWith('.m3u8')});
+audio.addEventListener('play',()=>{ asked=performance.now(); });
+audio.addEventListener('waiting',()=>{ if(!asked) waited=performance.now(); });
+audio.addEventListener('playing',()=>{
+  const now=performance.now();
+  if(asked) report('play_start',{ms:Math.round(now-asked),...playing()});
+  else if(waited && now-waited>=500) report('stall',{ms:Math.round(now-waited),...playing()});
+  asked=0; waited=0;
+});
+audio.addEventListener('error',()=>{ if(audio.error) report('player_error',{msg:`media error ${audio.error.code}: ${audio.error.message}`,...playing()}); });
 $('#pplay').onclick=()=>audio.paused?audio.play():audio.pause();
 $('#pback').onclick=()=>audio.currentTime-=15;
 $('#pfwd').onclick=()=>audio.currentTime+=30;
@@ -153,12 +200,12 @@ async function switchVersion(){
   if(!enc||mediaSrc(enc)===player.src) return false;
   const was=!audio.paused;
   player.entry=e; player.src=mediaSrc(enc); player.saveAt=e.position;
-  audio.src=player.src;
+  const wait=setSrc(player.src);
   audio.addEventListener('loadedmetadata',()=>{audio.currentTime=e.position},{once:true});
-  if(was) audio.play().catch(()=>{});
+  if(was) (wait||Promise.resolve()).then(()=>audio.play()).catch(()=>{});
   return true;
 }
-$('#pclose').onclick=()=>{savePos();audio.pause();audio.removeAttribute('src');player.guid=null;$('#player').classList.remove('on');document.body.classList.remove('has-video');renderEntries();
+$('#pclose').onclick=()=>{savePos();audio.pause();dropHls();audio.removeAttribute('src');player.guid=null;$('#player').classList.remove('on');document.body.classList.remove('has-video');renderEntries();
   // Called here, not left to the pause event: closing a player already paused fires none.
   syncListening()};
 (function restore(){

web/src/util.ts

@@ -60,6 +60,9 @@ const EQ='<span class="eq" aria-hidden="true"><i></i><i></i><i></i></span>';
 // The page's own buttons name their icon; this draws it in, ahead of any label they carry.
 for(const b of $$('[data-icon]')) b.insertAdjacentHTML('afterbegin',ICON[b.dataset.icon]);
 
+/// An episode whose DeadAir copy is still being made: it plays as it is until then, and the line
+/// becomes how much shorter it is once the copy is ready (the dead_air event).
+const DEAD_PENDING='<span class="dapend" title="DeadAir is still working on this episode. Until it is done, it plays at its full length.">Cutting dead air…</span>';
 /// What DeadAir took off an episode, as the list says it.
 function shorter(secs){ return secs<60?`${secs} s shorter`:`${Math.round(secs/60)} min shorter`; }
 /// A total of time saved: "3 h 12 min", "12 min", "40 s".
@@ -67,8 +70,30 @@ function spanText(secs){
   const h=Math.floor(secs/3600), m=Math.floor(secs%3600/60);
   return h?`${h} h ${m} min`:m?`${m} min`:`${secs} s`;
 }
+/// One trace for each thing you do (#190): the requests a tap or a key sets off share a trace id,
+/// sent as traceparent, so Tempo shows them together. getRandomValues, not randomUUID, which a
+/// LAN address over plain HTTP does not have.
+let traceId='';
+const hex=(n: number)=>Array.from(crypto.getRandomValues(new Uint8Array(n)),b=>b.toString(16).padStart(2,'0')).join('');
+for(const t of ['pointerdown','keydown']) window.addEventListener(t,()=>{ traceId=hex(16); },{capture:true,passive:true});
+function traceparent(){ return `00-${traceId||=hex(16)}-${hex(8)}-01`; }
+
+/// Something that went wrong, or how long something took, in the browser, for the server's log
+/// (#190). The same thing at most once a minute: a failure in a loop would otherwise send a line
+/// a frame.
+const reported=new Map<string,number>();
+function report(ev: string, o: Record<string,any>={}){
+  const key=ev+(o.msg||''), now=Date.now();
+  if(o.msg==='signed out' || now-(reported.get(key)||0)<60_000) return;
+  reported.set(key,now);
+  fetch('/api/client',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json',traceparent:traceparent()},
+    body:JSON.stringify({ev,...o})}).catch(()=>{});
+}
+window.addEventListener('error',e=>report('page_error',{msg:String(e.message||e.error||'error'),src:e.filename,line:e.lineno}));
+window.addEventListener('unhandledrejection',e=>report('rejection',{msg:String(e.reason?.message||e.reason)}));
+
 async function api(url: string, opts?: RequestInit): Promise<any>{
-  const r = await fetch(url,{headers:{'Content-Type':'application/json'},...opts});
+  const r = await fetch(url,{headers:{'Content-Type':'application/json',traceparent:traceparent()},...opts});
   if(r.status===401){ location.href='/login'; throw new Error('signed out'); }
   if(!r.ok) throw new Error(await r.text().catch(()=>'')||String(r.status));
   return r.status===204?null:r.json().catch(()=>null);