ipx 1.1.0, ipx-directory 1.1.0, ipx-web 1.0.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/skills/ipx-prod-check/SKILL.md

@@ -1,14 +1,25 @@
 ---
 name: ipx-prod-check
-description: Look for problems in production ipx (the iPX container on Tower) from its logs in Loki and its traces in Tempo, and file what is found as Gitea issues. Use when asked to check on production, look for issues or errors in ipx, see why something is slow or failing in production, review the logs, or investigate a report about the live site.
+description: Look for problems in production ipx (the ipx-web, iPX and ipx-directory containers on Tower, Tower itself and the monitoring that watches them) from their logs in Loki, their traces in Tempo and the metrics in Prometheus, and file what is found as Gitea issues. Use when asked to check on production, look for issues or errors in ipx, see why something is slow or failing in production, review the logs, or investigate a report about the live site.
 ---
 
 # Checking production ipx
 
-Production logs one JSON object a line (`IPX_LOG_FORMAT=json`), which Alloy ships to Loki under
+Production is three containers in the Arcane project `ipx` on Tower
-`{container="iPX"}`, and sends traces to Tempo tagged
+(`/mnt/fast/arcane/projects/ipx/compose.yaml`), one request passing through them in this order:
-`resource.deployment.environment.name="production"`. Anything without that tag is a daemon run by
+
-hand, not production. Loki and Tempo publish no query port, so use the script beside this file:
+| container | what | logs, in Loki | traces, in Tempo | metrics, in Prometheus |
+|---|---|---|---|---|
+| `ipx-web` | Caddy: serves the page, passes `/api` and `/media` to ipx (#203). Port 8099, the LAN and the tunnel | `{container="ipx-web"}`, JSON: a line a request (`http.log.access`), its own errors | service `ipx-web`: a span a request, passing `traceparent` on to ipx (#213) | none |
+| `iPX` | the daemon: API, scans, downloads, DeadAir | `{container="iPX"}`, JSON (`IPX_LOG_FORMAT=json`) | service `ipx`; passes `traceparent` to the directory | `job="ipx"`, its `/metrics` |
+| `ipx-directory` | the directory of public podcasts, `directory.ipxreader.app` (#204, #214) | `{container="ipx-directory"}`, JSON (`DIRECTORY_LOG_FORMAT=json`) | service `ipx-directory`: a span a request, joining ipx's trace when ipx called; a trace a refresher round (#213) | none |
+
+Under them, Tower itself: `job="node"` (the node exporter: load, CPU, memory, disks). The Grafana
+dashboard `iPX` draws all of it in that order (`grafana/dashboard.py`). A trace without the
+production tag (`resource.deployment.environment.name="production"`, on all three) is a daemon run
+by hand, not production. Since #213 a request is one trace across the services it touched: a
+Directory page is ipx-web, then ipx, then the directory, so start from the trace, not the logs. Alloy ships the logs; Loki, Tempo and
+Prometheus publish no query port to this machine, so use the script beside this file:
 
 ```sh
 Q=.claude/skills/ipx-prod-check/query.py
@@ -16,11 +27,28 @@ $Q logs    '<LogQL>'           [since]   # lines, newest first (500 at most)
 $Q metric  '<LogQL metric>'    [since]   # $range becomes `since`
 $Q traces  '<TraceQL>'         [since]   # slowest first
 $Q trace   <trace id>                    # one trace as a tree, with its log lines
+$Q prom    '<PromQL>'          [since]   # Prometheus, now; $range becomes `since`
 ```
 
-`since` is `1h`, `24h`, `7d`. Default to `24h`; widen it to see whether something is new.
+`since` is `30m`, `1h`, `24h`, `7d`. Default to `24h`; widen it to see whether something is new.
+"Since the last deploy" is since that container started (each deploys on its own):
 
-## What the log carries
+```sh
+for c in iPX ipx-web ipx-directory; do S=$(docker inspect $c -f '{{.State.StartedAt}}'); echo "$c $(( ($(date +%s) - $(date -d "$S" +%s)) / 60 + 1 ))m"; done
+```
+
+Start every check by seeing that all three run, since Loki cannot see a container that is not:
+
+```sh
+docker ps -a --filter name=iPX --filter name=ipx-web --filter name=ipx-directory --format '{{.Names}} {{.Status}}'
+```
+
+All three should be `Up`, with no recent restart; they have no Docker healthcheck (#218). Then work through ipx (the checks below), the page, the
+directory, Tower and the monitoring itself, in that order.
+
+## ipx
+
+### What the log carries
 
 Every line has `timestamp`, `level`, `message` and `target`; lines inside a span have `span` (the
 innermost: `{"name":"feed","feed":"x"}`). Loki's `| json` flattens it to `span_name`, `span_feed`.
@@ -35,12 +63,16 @@ lines had no trace id, the access log's time was `ms`, and each event was logged
 | `ipx::scan` | `ev` and the event's own: `feed`, `new`, `downloaded`, `failed`, `bytes`, `msg`, `url`, `feeds`, `reason`, `from`, `to`; on a failure `error.type` and, from an HTTP error, `http.response.status_code` | the daemon's events, one line each, in words; warnings are feed and download failures |
 | `ipx::io` | `ev`, `feeds`, `pending`, `downloaded` on the `status` reply | commands arriving (`-> {...}`) and the healthcheck's answer |
 | `ipx` | message, sometimes fields | start-up, shutdown, account and config messages |
+| `ipx::client` | `ev`, `user`, `feed`, `enclosure`, `deadair`; `msg`, `src`, `line` on an error; `ms` on a timing | what the page reports from the browser (#190): `page_error`, `rejection` and `player_error` as warnings; `play_start` (ms from play to sound) and `stall` (ms waiting mid-play) as info. Lines carry the trace of the action in the page: its API requests send `traceparent`, one trace id per tap or key |
 
 Events (`ev`): `feed_start`, `feed_done` (new, downloaded, failed, torrents), `feed_skip` (not due,
 routine), `feed_error` (msg), `feed_moved` (from, to: a permanent redirect followed, the address
 updated), `download_done` (bytes), `download_error` (msg, url),
 `torrent_deferred`, `reaped`, `scan_done` (feeds checked), `reap_done`, `status` (feeds, pending,
-downloaded: the healthcheck's, every 30s), `error` (msg).
+downloaded: the healthcheck's, every 30s), `deadair_done` (feed, enclosure, `saved_s` at the
+default pause), `error` (msg). DeadAir also logs `DeadAir found the silences` (`cuts`, `saved_s`,
+`took_ms`) under `ipx::deadair`, and warns `DeadAir could not read a file` when ffmpeg fails on
+one, which it then passes over until the next restart.
 
 `error.type` is the HTTP status (`404`, `503`) or one of `dns`, `redirect_loop`, `timeout`, `tls`,
 `not_a_feed`, `site_message`, `connect`, `parse`, `other`; Loki's `| json` names it `error_type`.
@@ -49,7 +81,38 @@ Filter on the text before `| json` where you can (`|= "\"ev\":\"feed_error\""`):
 cheaper than parsing every line. Lines before 2026-09-29 14:00 UTC are text, not JSON, and
 `| json | __error__=""` drops them.
 
-## The checks
+### What Prometheus carries
+
+The daemon's own state between requests, which no log line or trace holds (#194): ipx serves
+`/metrics` on `[web] metrics_bind` (production: `192.168.1.130:9187`, LAN only), on a thread and
+port of its own, from memory alone, and Prometheus scrapes it every 15 s as `job="ipx"`. Kept
+from 2026-10-11 15:15 UTC. All gauges:
+
+| metric | what |
+|---|---|
+| `ipx_db_connections{state="in_use"\|"idle"}`, `ipx_db_connections_max` | the database pool: in use reaching the max means requests and scans wait for a connection |
+| `ipx_worker_queue` | commands waiting for the sequential worker (scans, downloads, adds) |
+| `ipx_event_listeners` | open pages and socket clients on the live-update stream |
+| `ipx_torrent_slots_free` | of 2 |
+| `ipx_deadair_playing` | episodes being played through DeadAir's playlist |
+| `ipx_runtime_workers`, `ipx_runtime_tasks`, `ipx_runtime_queue` | tokio: threads, live tasks, tasks waiting for a thread |
+| `ipx_process_resident_bytes`, `ipx_process_open_fds` | memory and open files and sockets; mimalloc gives back what is freed, so memory follows use and a rise that never comes down is a leak (#224) |
+| `ipx_feed_fetches_total`, `ipx_feed_bytes_total` | counters: feeds fetched (304s included) and the bytes of their bodies, read whole, so what scans allocate |
+| `ipx_uptime_seconds`, `ipx_build_info{version}` | since the daemon started; what runs |
+| `ipx_worker_busy`, `ipx_worker_job_seconds{kind}` | the worker's job now (`scan`, `reap`, `download`, `status`, `reload`) and for how long; the healthcheck passes while it is stuck |
+| `ipx_jobs_total{kind}`, `ipx_job_seconds_total{kind}` | counters: jobs finished, and their seconds all told |
+| `ipx_last_scan_age_seconds` | since a scan last finished; absent until one has since starting |
+| `ipx_http_requests_in_flight`, `ipx_scan_feeds_fetching`, `ipx_downloads_active` | work in progress |
+| `ipx_download_bytes_total` | counter; `rate()` is the download speed |
+| `ipx_event_queue`, `ipx_events_missed_total` | live updates unread by some listener; counter of those dropped for one that fell behind |
+| `ipx_deadair_backlog`, `ipx_deadair_busy_seconds` | files of shows with DeadAir on not yet looked at (episodes everyone heard through stay counted); how long it has been on its file |
+| `ipx_feed_retries` | feeds waiting to retry a failed name lookup |
+| `ipx_art_cache_bytes`, `ipx_art_cache_limit_bytes` | artwork kept, as of the last sweep, and the most kept: kept sits at the limit by design |
+| `ipx_art_evicted_total`, `ipx_art_requests_total{result="hit"\|"miss"}` | counters: images the sweep threw out to stay under the limit, and artwork served from disk or fetched from the publisher; many evicted at every sweep with a falling hit rate means the limit is too small |
+| `directory_process_resident_bytes`, `directory_process_open_fds`, `directory_feed_fetches_total`, `directory_feed_bytes_total`, `directory_uptime_seconds`, `directory_build_info` | the directory's, `job="ipx-directory"`, from its `metrics_bind` (production `192.168.1.130:9188`, LAN only) |
+| `ipx_feeds`, `ipx_downloads_pending`, `ipx_files_downloaded` | the library, as the healthcheck last counted it (every 30 s) |
+
+### The checks
 
 Run these, then read the lines behind whatever stands out. Most of the time is in the reading:
 a count says something happened, the lines and traces say why.
@@ -92,7 +155,7 @@ a count says something happened, the lines and traces say why.
    `feeds` above 0; none at all for over 10 minutes means the worker is stuck. And `pending` is
    the real queue (#113): files a scan will download on its own. Back-catalogue files are
    `held`, listed but not counted, so it is usually 0 or a handful.
-5. **Slow and failed traces.**
+5. **Slow and failed traces.** All three services' (filter by `resource.service.name` for one).
    ```
    $Q traces '{resource.deployment.environment.name="production" && duration > 5s}'
    $Q traces '{resource.deployment.environment.name="production" && status = error}'
@@ -103,13 +166,189 @@ a count says something happened, the lines and traces say why.
    A web request over a second is worth a look; the trace shows whether the time is in the
    handler or a scan it waited on.
 
-Also check the container itself, since Loki cannot see a daemon that is not running:
+   Steps are `step` spans named by `of` (#187): an item list's `entries_in`, `sanitize`,
+   `deadair`, `count_in`; the feed list's `catalogue`, `feed_list` and its queries; a `reap`'s
+   `missing_files`, `prune_abandoned_failures`, `reap_candidates`, `clean_directory` (once a day
+   since #193, so a reap is about a second), `trim_artwork`, with what it removed on the `reap`
+   span. DeadAir's work on a file is a `deadair` trace (feed, enclosure, cuts) with `probe`,
+   `silencedetect`, `frame_bytes`, `store_plans`: seconds each, more is a file ffmpeg struggles
+   with. A trace with no name in `$Q traces` started in the page (#190, #192): its root is the tap
+   in the browser, which sends no span, so it holds the requests that tap made (API calls, the
+   playlist and audio of a play, position saves, the page's own report) side by side.
+
+6. **The daemon's state, from Prometheus.** Pressure and leaks that requests and traces only
+   hint at.
+   ```
+   $Q prom 'up{job="ipx"}'
+   $Q prom 'max(max_over_time(ipx_db_connections{job="ipx",state="in_use"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_db_connections_max{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_worker_queue{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_runtime_queue{job="ipx"}[$range]))' 24h
+   $Q prom 'max(resets(ipx_uptime_seconds{job="ipx"}[$range]))' 24h
+   $Q prom 'ipx_process_resident_bytes{job="ipx"} - ipx_process_resident_bytes{job="ipx"} offset $range' 24h
+   $Q prom 'ipx_process_open_fds{job="ipx"} - ipx_process_open_fds{job="ipx"} offset $range' 24h
+   $Q prom 'ipx_runtime_tasks{job="ipx"} - ipx_runtime_tasks{job="ipx"} offset $range' 24h
+   $Q prom 'max(max_over_time(ipx_worker_job_seconds{job="ipx"}[$range])) by (kind)' 24h
+   $Q prom 'max(max_over_time(ipx_last_scan_age_seconds{job="ipx"}[$range]))' 24h
+   $Q prom 'sum by (kind) (increase(ipx_job_seconds_total{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_http_requests_in_flight{job="ipx"}[$range]))' 24h
+   $Q prom 'sum(increase(ipx_events_missed_total{job="ipx"}[$range]))' 24h
+   $Q prom 'max(max_over_time(ipx_deadair_busy_seconds{job="ipx"}[$range]))' 24h
+   ```
+   `up` 0 means Prometheus cannot reach the port: the container is down or `metrics_bind` is
+   unset. Connections in use at the pool's max (20 on Postgres) means something is waiting for
+   one: find the slow requests or scan of that time in check 3 and 5. A worker queue that only
+   grows means downloads are not keeping up, or the worker is stuck on one job. A runtime queue
+   above 0 for more than a scrape or two means every thread is busy: something is blocking a
+   thread or burning one. Memory, open files or tasks only climbing across a day with no restart
+   is a leak (a file or socket not closed, a task never ending); a step after a deploy is not. A
+   reset of the uptime is a restart: match it with a deploy, or it is a crash (check 4).
+
+   The worker: one job over 30 minutes (`ipx_worker_job_seconds`), or a scan last finished over
+   15 minutes ago, is the worker stuck, which the healthcheck does not notice; its trace and the
+   log lines of that time say on what. A kind whose share of `ipx_job_seconds_total` jumps is
+   where the worker's time went (reap was most of it until #193). Web requests in flight near
+   the pool's max mean the pool is what they wait on. Live updates missed mean a page showed stale
+   counts until reloaded. DeadAir over a minute on one file is a file ffmpeg chokes on.
+
+7. **What the page saw.** The browser's own errors and timings, which no server line shows.
+   ```
+   $Q metric 'sum by (ev, msg) (count_over_time({container="iPX"} |= "\"target\":\"ipx::client\"" | json | __error__="" | level="WARN" [$range]))' 7d
+   $Q logs '{container="iPX"} |= "\"target\":\"ipx::client\"" | json | ev=~"play_start|stall" | line_format "{{.timestamp}} {{.user}} {{.ev}} {{.ms}}ms deadair={{.deadair}} {{.feed}}"' 24h
+   ```
+   A `player_error` is playback that failed in front of someone: `hls.js: ...` is DeadAir's
+   playlist (its trace has the playlist and audio requests), `media error 4` a file the browser
+   cannot play. A `page_error` or `rejection` is a bug in the page; `src` and `line` point into
+   the minified `app.js`, so match the message to `web/src`. `play_start` over 2000 ms, or a
+   `stall`, is worth a trace: was it the server, Cloudflare, or the network.
+
+`docker logs --since 10m iPX 2>&1 | tail -5` shows the newest lines when Loki is behind.
+
+## ipx-web, the page
+
+Caddy logs one JSON line a request (#210), logger `http.log.access.log0`: Loki's `| json` gives
+`request_uri`, `request_method`, `request_remote_ip`, `status`, `duration` (seconds, not ms), `size`.
+The request's headers and a `?token=` are filtered out before it is written. Requests from
+`127.0.0.1` are local checks; leave them out. `/api` and `/media` pass on to ipx and
+are in ipx's own access log too, with ipx's time; Caddy's `duration` for them adds the hop.
 
 ```sh
-docker ps --filter name=iPX --format '{{.Status}}'
+W='{container="ipx-web"} |= "http.log.access" | json | __error__="" | request_remote_ip != "127.0.0.1"'
-docker logs --since 10m iPX 2>&1 | tail -5
+$Q metric "sum by (status) (count_over_time($W [\$range]))"
+$Q metric "sum by (request_uri) (count_over_time($W | status >= 500 [\$range]))"
+$Q metric "topk(10, quantile_over_time(0.95, $W | request_uri !~ \"/(api|media)/.*\" | unwrap duration [\$range]) by (request_uri))"
+$Q logs '{container="ipx-web"} | json | __error__="" | level=~"warn|error" | msg !~ "admin endpoint disabled|automatic HTTPS is completely disabled|HTTP/[23] skipped.*|exiting; byeee.*"'
 ```
 
+A 502 is ipx not answering Caddy: a restart (match the deploy) or ipx down; Caddy's error line
+names it (`dial tcp ...:8099: connect: connection refused`). The page itself (`/`, `/admin`)
+waits on `/api/page-check` before it is sent, so a slow page is usually a slow page-check: look it
+up in ipx's access log. 401 and 303 on `/` are people signed out being sent to `/login`, not a
+problem. Caddy's own notices at each start (no admin endpoint, no HTTPS or HTTP/3, its goodbye on
+SIGTERM) are by design and filtered out above.
+
+Each access line carries the request's `traceID` (`| json` gives `traceID`): give it to `$Q trace`
+to see where the time went, Caddy's span with ipx's inside it. A slow page with ipx's span short is
+Caddy or the network; a long one is ipx.
+
+```sh
+$Q traces '{resource.service.name="ipx-web" && duration > 2s}'
+$Q traces '{resource.service.name="ipx-web" && status = error}'
+```
+
+Who reaches it: `request_remote_ip` is `192.168.64.1` for the tunnel and anything else on Tower
+(Docker's gateway), `192.168.1.130` for Tower itself, a LAN address for the LAN. Caddy passes
+Cloudflare Access's headers on only from `192.168.64.1` (`TUNNEL_PEER`), and ipx trusts them only
+from Caddy, with a valid signed token. Testing sign-in from Tower proves nothing about the tunnel
+(#209): send it from a container on another network.
+
+## ipx-directory
+
+It logs a line a request (`target` `ipx_directory::http`: `method`, `path`, `status`,
+`duration_ms`, `token`, the token's name and never the token), a line a snapshot (`message`
+`snapshot`: `instance`, `accepted`, `refused_private`, `refused_blocked`, `refused_invalid`), a
+line a refresher round (`feeds checked`: `checked`), a line a failed feed check (`feed check
+failed`: `feed`, the directory's id, and `error`), the admin's actions (`feed removed and
+blocked`, `feed unblocked`, `snapshot dropped`, each with `by`), and `config read again` when its
+token file changes. It has no metrics. Its traces (#213): a span a request (`http`), a child of
+ipx's when ipx called with a `traceparent`, and a trace a refresher round (`refresh`, `feeds`)
+with a `feed` span for each check. Its log lines carry no trace id; find the trace by time or by
+the feed.
+
+```sh
+$Q traces '{resource.service.name="ipx-directory" && duration > 2s}'
+$Q traces '{resource.service.name="ipx-directory" && name="feed" && duration > 10s}'
+$Q traces '{resource.service.name="ipx" && name="directory_share"}'
+```
+
+A slow Directory page in ipx is usually its `http` span in the directory: the trace says whether.
+A refresher round far over a minute is one publisher's feed holding it, the slow `feed` span.
+
+```sh
+D='{container="ipx-directory"} | json | __error__=""'
+$Q metric "sum by (status, token) (count_over_time({container=\"ipx-directory\"} |= \"ipx_directory::http\" | json | __error__=\"\" [\$range]))"
+$Q metric "topk(5, max_over_time({container=\"ipx-directory\"} |= \"ipx_directory::http\" | json | __error__=\"\" | unwrap duration_ms [\$range]) by (path))"
+$Q logs "$D | level=~\"WARN|ERROR\""
+$Q logs "$D | message=\"snapshot\"" 7d
+$Q metric "sum(count_over_time($D | message=\"snapshot\" [\$range])) by (instance)"
+$Q metric "sum by (feed, error) (count_over_time($D | message=\"feed check failed\" [\$range]))" 7d
+$Q metric "sum(sum_over_time($D | message=\"feeds checked\" | unwrap checked [\$range]))" 24h
+```
+
+Expect a snapshot from each server when what it shares changes and every half hour, so about 48 a
+day each; one every half minute is ipx resending what has not changed (#211, fixed). A burst of
+401s with an empty `token` is someone without a token trying the public address, expected now and
+then; a steady stream is worth an issue, since Cloudflare can rate-limit it. A snapshot whose
+`refused_private` is not 0 means an ipx server tried to send a feed that looks private: find which
+in that server's log, since the directory refuses it but the sender should not have sent it. Many
+`feed check failed` lines for one feed are the publisher's, not the directory's. Each feed is
+checked every six hours, 25 at a time, so `feeds checked` over a day should be about four times
+the feeds listed; none for over six hours means the refresher is stuck. `could not store a feed
+check` or `could not read which feeds are due` is its database (`ipx_directory` on the
+`databases` project's Postgres). A config that does not load (`config changed but does not
+load`) keeps the old tokens: worth fixing before someone's new token is needed.
+
+## Tower
+
+The three share Tower with everything else, so a slow or failing ipx can be the host. The node
+exporter (`job="node"`) has the history; twelve threads.
+
+```sh
+$Q prom 'max_over_time(node_load1{job="node"}[$range])' 24h
+$Q prom 'min_over_time(node_memory_MemAvailable_bytes{job="node"}[$range]) / 1e9' 24h
+$Q prom 'sum by (mode) (rate(node_cpu_seconds_total{job="node", mode=~"user|system|iowait"}[$range]))' 1h
+$Q prom 'max by (device) (rate(node_disk_io_time_seconds_total{job="node", device=~"nvme.*|md.*"}[$range]))' 1h
+```
+
+For when, step back with `offset`: `max_over_time(node_load1[10m] offset 60m)`. Load far above
+twelve with little CPU busy is processes waiting, on a disk or on the user shares: on 2026-10-12
+debug builds linking through `/mnt/user` (shfs, FUSE) took load to 248 with mostly system time and
+stalled everything on the shares, ipx's downloads included. Available memory near nothing makes
+it worse. Disk busy near 100% on `nvme1n1` is `/mnt/fast`, appdata and Postgres's data; on `md*`
+the array behind `/mnt/user`, the downloads. Say what was running at the time if you can tell
+(`docker stats --no-stream`); a host problem is the user's, not an ipx issue, unless ipx caused it.
+
+## The monitoring itself
+
+A quiet dashboard can be a dead exporter. Check what Prometheus scrapes and that each
+container's lines are reaching Loki:
+
+```sh
+curl -s http://192.168.1.130:9090/api/v1/targets | python3 -c 'import json,sys
+for t in json.load(sys.stdin)["data"]["activeTargets"]: print(t["health"], t["labels"]["job"], t["scrapeUrl"], t.get("lastError","")[:80])'
+for c in iPX ipx-web ipx-directory; do echo "$c $($Q metric "sum(count_over_time({container=\"$c\"} [1h]))" 1h | tail -1)"; done
+docker ps -a --filter label=com.docker.compose.project=monitoring --format '{{.Names}} {{.Status}}'
+```
+
+`ipx` and `node` should be `up`. Every monitoring container should be running; after Docker
+restarts, one can be left `Exited (255)` though its policy is `unless-stopped` (Prometheus, on
+2026-10-12, when Docker lost its exit during an overload): `docker start` it and say so. blocky
+and nut on 192.168.2.21 are another machine, not ipx's; leave them. A container with no lines in
+an hour while it runs means Alloy is not shipping it; Alloy can take a few minutes to pick up a
+container after a deploy.
+
+## Rules
+
 `docker logs` and `docker exec iPX ipx ...` are fine. Do not query production's Postgres
 directly: ask the user if a question needs the database.
 
@@ -130,12 +369,14 @@ Put in each issue what would let someone pick it up cold: the LogQL or TraceQL t
 trace id, the first time it was seen and how often. A publisher's dead feed is worth one issue
 saying so (the user may want to unsubscribe or find its new address); a single 503 is not.
 
-Finish with a short report to the user: what is healthy, what is wrong (with the issue numbers),
+Finish with a short report to the user, a line for each of ipx-web, ipx, the directory, Tower and
-and anything you could not tell from logs and traces alone. Do not fix things unless asked; the
+the monitoring: what is healthy, what is wrong (with the issue numbers), and anything you could
+not tell from logs, traces and metrics alone. Do not fix things unless asked; the
 check is for finding them.
 
 ## When the checks come back empty
 
-Check that there is data before concluding all is well: `$Q metric 'sum(count_over_time({container="iPX"} [1h]))' 1h`
+Check that there is data before concluding all is well (the monitoring section's per-container
-should be in the hundreds or more. Nothing at all means Alloy is not shipping (it can take a few
+count): iPX should have hundreds of lines an hour or more, ipx-web at least its healthchecks'
-minutes to pick up a container after a deploy), or the container is down.
+120, ipx-directory a few dozen. Nothing at all means Alloy is not shipping it, or the container
+is down.

.claude/skills/ipx-prod-check/query.py

@@ -1,10 +1,11 @@
 #!/usr/bin/env python3
-"""Ask production's Loki or Tempo a question, from anywhere that can run docker on Tower.
+"""Ask production's Loki, Tempo or Prometheus a question, from anywhere that can run docker on Tower.
 
     query.py logs    '<LogQL log query>'    [since]   lines, newest first
     query.py metric  '<LogQL metric query>' [since]   one value per series; $range is `since`
     query.py traces  '<TraceQL query>'      [since]   matching traces, slowest first
     query.py trace   <trace id>                       one trace's spans, as a tree
+    query.py prom    '<PromQL query>'       [since]   one value per series, now; $range is `since`
 
 `since` is 1h, 24h, 7d and the like (default 24h). Loki and Tempo publish no query port on the
 host, so each call runs a throwaway alpine container on the monitoring project's network.
@@ -53,8 +54,18 @@ def main():
         traces = sorted(r.get("traces", []), key=lambda t: -t.get("durationMs", 0))
         for t in traces:
             when = time.strftime("%m-%d %H:%M:%S", time.gmtime(int(t["startTimeUnixNano"]) / 1e9))
-            print(f"{t.get('durationMs', 0):>8}ms  {when}Z  {t['traceID']}  {t.get('rootTraceName', '')}")
+            # No root name: its root span is a tap in the page, which the browser never sends.
+            name = t.get("rootTraceName") or "(from the page)"
+            print(f"{t.get('durationMs', 0):>8}ms  {when}Z  {t['traceID']}  {name}")
         print(f"-- {len(traces)} trace(s)", file=sys.stderr)
+    elif kind == "prom":
+        # ipx's /metrics (#194), scraped as job ipx; through the network like the others.
+        r = fetch(f"http://prometheus:9090/api/v1/query?query={enc(q.replace('$range', since))}&time={now}")
+        rows = sorted(r["data"]["result"], key=lambda s: -float(s["value"][1]))
+        for s in rows:
+            labels = {k: v for k, v in s["metric"].items() if k not in ("job", "instance")}
+            print(f"{float(s['value'][1]):>14g}  {json.dumps(labels) if labels else ''}")
+        print(f"-- {len(rows)} series", file=sys.stderr)
     elif kind == "trace":
         r = fetch(f"http://tempo:3200/api/traces/{q}")
         spans = [sp for b in r.get("batches", r.get("resourceSpans", []))

.gitignore

@@ -6,3 +6,4 @@
 
 .claude/settings.local.json
 __pycache__/
+site/dist/

CLAUDE.md

@@ -7,18 +7,22 @@ made here.
 ## Where things are
 
 Production is the `iPX` container on Tower (192.168.1.130), the `ipx` service of the
-Arcane project `content`: `/mnt/fast/arcane/projects/content/compose.yaml`. That file is what runs;
+Arcane project `ipx`: `/mnt/fast/arcane/projects/ipx/compose.yaml`. That file is what runs, and
-`docker-compose.yml` in this repo is a copy, and editing it changes nothing in production.
+the containers of the split (#207) join it there. `docker-compose.yml` in this repo is a sample for
+others, ipx alone on SQLite; editing it changes nothing in production. Until 2026-10-12 ipx was a
+service of the `content` project, beside audiobookshelf, immich and Plex (#208).
 
 | | Host | In the container |
 |---|---|---|
 | Image | `192.168.1.130:5000/ipx:latest` | |
 | Config | `/mnt/fast/appdata/ipx/config.toml`: bind address, token, trusted proxies, torrent, paths. The feeds and server settings are in the database | `/config/config.toml` |
-| Database | Postgres 18, database `ipodderx`, login `ipodderx`, on the `postgres` container of the Arcane project `databases` (`192.168.1.130:5433`). The URL is in `ipx.env` beside the compose file (`/mnt/fast/arcane/projects/content/ipx.env`, mode 600), passed to the container as `IPX_DATABASE_URL`. A relative `env_file`: Arcane runs compose in its own container, where `/mnt/fast/appdata` does not exist | |
+| Database | Postgres 18, database `ipodderx`, login `ipodderx`, on the `postgres` container of the Arcane project `databases` (`192.168.1.130:5433`). The URL is in `ipx.env` beside the compose file (`/mnt/fast/arcane/projects/ipx/ipx.env`, mode 600), passed to the container as `IPX_DATABASE_URL`. A relative `env_file`: Arcane runs compose in its own container, where `/mnt/fast/appdata` does not exist | |
 | Old database | `/mnt/user/ipx/state.db`, SQLite, used until the move to Postgres on 2026-09-18 and kept for rollback | `/data/state.db` |
 | Downloads | `/mnt/user/ipx/downloads` | `/downloads` |
-| Web UI | `192.168.1.130:8099`, also `ipodderx.sdf1.net` via a Cloudflare tunnel | `0.0.0.0:8099` |
+| Directory | `ipx-directory` in the same project, `192.168.1.130:8100`, public at `directory.ipxreader.app` through the tunnel with no Access in front: its pages are anyone's to browse, read only (#215), and its API (`/v1`) takes a token for everything. Until 2026-10-12 it was `ipx-dir.sdf1.net` (#214). Config `/mnt/fast/appdata/ipx-directory/directory.toml` (token hashes; Tower's own token in `tower.token` beside it, and entered in ipx's Admin, Directory, which keeps it in the database's `settings`), database `ipx_directory` on the same Postgres, URL in `directory.env` beside the compose file. See [docs/directory.md](docs/directory.md) | `/config/directory.toml` |
-| Sign-in via the tunnel | Cloudflare Access app `ipodderx`, with Authentik as its identity provider; see [docs/sso.md](docs/sso.md) | trusts `Cf-Access-Authenticated-User-Email` from `192.168.16.1`, the `content_default` gateway, and only with a valid `Cf-Access-Jwt-Assertion` (`access_team`, `access_aud`) |
+| Home page | `ipxreader.app` (and `www`): a static page from `site/`, on the Cloudflare Pages project `ipxreader`, not on Tower. See below | |
+| Web UI | `ipx-web` (Caddy) in the same project, at `192.168.1.130:8099`, also `ipodderx.sdf1.net` via a Cloudflare tunnel. It serves the page and passes `/api` and `/media` to ipx, whose own port is published nowhere; its address on `ipx_default` is pinned to `192.168.64.10` (#203) | ipx `0.0.0.0:8099`, Caddy `:8080` |
+| Sign-in via the tunnel | Cloudflare Access app `ipodderx`, with Authentik as its identity provider; see [docs/sso.md](docs/sso.md) | Caddy passes `Cf-Access-*` only from `192.168.64.1`, the `ipx_default` gateway cloudflared arrives from (`TUNNEL_PEER`; the subnet is pinned in the compose file); ipx trusts them only from Caddy, `192.168.64.10`, and only with a valid `Cf-Access-Jwt-Assertion` (`access_team`, `access_aud`) |
 
 Work to do lives in the Gitea issues at https://git.sdf1.net/rays/ipx/issues, not in a
 `TODO.md`. `/src/tea` is logged in: `/src/tea issues list --login git.sdf1.net --repo rays/ipx`.
@@ -47,33 +51,65 @@ Deploying a change is: build and push the image, then pull it and recreate the c
 
 ```sh
 docker buildx build --tag 192.168.1.130:5000/ipx:latest . --push
-docker compose -f /mnt/fast/arcane/projects/content/compose.yaml pull ipx
+docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml pull ipx
-docker compose -f /mnt/fast/arcane/projects/content/compose.yaml up -d ipx
+docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml up -d ipx
 docker logs --tail 20 iPX
 ```
 
-**Name the service.** A bare `up -d` recreates every container in `content`, beets and immich
+The directory is the same, with its own image:
-included. Run `pull` before `up`, because `up` reuses whatever `latest` the host already has.
+
+```sh
+docker buildx build -f Dockerfile.directory --tag 192.168.1.130:5000/ipx-directory:latest . --push
+docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml pull ipx-directory
+docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml up -d ipx-directory
+```
+
+And the page, `ipx-web`, the same again; a change to `web/` alone needs only this one:
+
+```sh
+docker buildx build -f Dockerfile.web --tag 192.168.1.130:5000/ipx-web:latest . --push
+docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml pull ipx-web
+docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml up -d ipx-web
+```
+
+The home page (`site/`, #216) is not on Tower. `sh site/build.sh` puts it in `site/dist` with the
+typeface, logo and icon from `web/`, and it goes to the Cloudflare Pages project `ipxreader` by
+direct upload, since there is no wrangler login here: hash each file as wrangler does (BLAKE3 of
+its base64 contents plus its extension, the first 32 hex digits, with the `blake3-wasm` package),
+ask the project for an upload token (`GET .../pages/projects/ipxreader/upload-token`), send the
+files to `/pages/assets/upload` with that token, then create a deployment
+(`POST .../pages/projects/ipxreader/deployments`) with the manifest of paths and hashes and
+`_headers`. Its screenshots (`site/shots`) come from a scratch iPX on public feeds, never
+production's, which would show whose subscriptions are whose.
+
+Testing sign-in from Tower itself proves nothing about the tunnel: Tower's own requests reach the
+published port as `192.168.1.130`, and Caddy rightly strips their `Cf-Access-*`. Send them from a
+container on another network, as cloudflared's are (#209).
+
+**Name the service.** A bare `up -d` recreates every container in the project, which once the
+split lands means the frontend and directory too. Run `pull` before `up`, because `up` reuses whatever `latest` the host already has.
 
 **A build that fails with `429 Too Many Requests` on a base image** is Docker Hub rate-limiting
-this host. There is no Docker Hub login here, and the build asks about `debian:bookworm-slim` and
+this host. There is no Docker Hub login here, and the build asks about `debian:trixie-slim` and
-`rust:1-slim-bookworm` every time unless they are already stored locally. Pull them from Google's
+`rust:1-slim-trixie` every time unless they are already stored locally. Pull them from Google's
 mirror and tag them; the build then uses the local copies without asking Docker Hub:
 
 ```sh
-docker pull mirror.gcr.io/library/debian:bookworm-slim
+docker pull mirror.gcr.io/library/debian:trixie-slim
-docker tag mirror.gcr.io/library/debian:bookworm-slim debian:bookworm-slim
+docker tag mirror.gcr.io/library/debian:trixie-slim debian:trixie-slim
-docker pull mirror.gcr.io/library/rust:1-slim-bookworm
+docker pull mirror.gcr.io/library/rust:1-slim-trixie
-docker tag mirror.gcr.io/library/rust:1-slim-bookworm rust:1-slim-bookworm
+docker tag mirror.gcr.io/library/rust:1-slim-trixie rust:1-slim-trixie
 ```
 
 Run those again now and then, or the local copies go stale.
 
-The healthcheck runs `ipx status` against the control socket, so `(healthy)` in `docker ps` means
+The containers have no Docker healthcheck (#218): Docker runs one with `exec`, which on Tower
-the daemon answers there and can read its database, not just that the web port is up. The socket
+fails whenever root is logged out, because elogind removes `/run/user/0`, where containerd puts
-answers `status` itself instead of queuing it behind the worker's current job, so a long scan or
+each exec's state. Whether ipx is well is Prometheus's question (`up`, the worker's job and time)
-download does not fail the check; it also means a worker stuck on one job would still pass. The
+and `ipx status` against the control socket, which says the daemon answers and can read its
-container restarts on its own after a reboot.
+database. The socket answers `status` itself instead of queuing it behind the worker's current
+job, so a worker stuck on one job still answers it. The containers restart on their own after a
+reboot.
 
 Before the container, ipx ran by hand in code-server, with its files in `/config/.config/ipx/` and
 `/config/.local/share/ipx/`. Those are still there and the container does not read them. If you run
@@ -87,13 +123,23 @@ running the command and kills the session (exit 144), which has happened more th
 There are three pages: the app (`web/index.html`), the admin page (`web/admin.html`, sent to
 admins only) and sign-in (`web/login.html`). The app and admin pages share one stylesheet,
 `web/app.css`, and their script is TypeScript in `web/src/`; `web/build.mjs` lists which files
-make up each page's script. `build.rs` runs
+make up each page's script. The page is its own image, **`ipx-web`** (#203): `web/build.mjs` uses
-`web/build.mjs`, which uses swc to strip the types and minify the script into `app.js` (and
+swc to strip the types and minify each script (`app.js`, `admin.js`, `login.js`), minifies the
-`login.js`), and minifies the page, and the results are `include_str!`d into the binary. The page
+pages, and puts them with the icons and typeface in `web/dist`, which Caddy serves
-loads its script as `/app.js?v=<hash of its contents>`, and `/app.css` the same way: the page is
+(`web/Caddyfile`, `Dockerfile.web`), passing `/api` and `/media` to ipx on the same origin. ipx
-served `no-cache` and the script and stylesheet `immutable`, so a browser keeps them until a
+serves no page. The page loads its script as `/app.js?v=<hash of its contents>`, and `/app.css`
-deploy changes them and their names. So **every page change needs a
+and `/boot.js` the same way: the page is served `no-cache` and those `immutable`, so a browser
-rebuild** before it is visible, and building needs node and `npm ci` run once.
+keeps them until a deploy changes them and their names. So **every page change needs ipx-web
+rebuilt and deployed**, not ipx, and building needs node and `npm ci` run once.
+
+Caddy asks ipx before it serves a page (`forward_auth`): `/api/page-check` sends a browser that is
+not signed in to `/login` and anyone but an admin away from `/admin` (and refuses them
+`/admin.js`); `/api/login-check` sends someone Cloudflare Access vouches for past the form; a page
+asked for with `?token=` goes to `/api/signin`, which sets the cookie. The page is the same file
+for everyone, so what ipx used to write into it per person is the page's own job now:
+`web/boot.js`, in `<head>`, puts the theme from its cookie and an admin's link from the last visit
+on the page before the first frame, and `/api/me` brings the rest (version, the account's old
+theme).
 
 The files in `web/src` are not modules. They are one script split up, concatenated in the order
 `web/build.mjs` lists them, sharing one top-level scope as the single inline script did; a new
@@ -155,8 +201,7 @@ seeking through files, a flood of wrong passwords. Things about them:
   127.0.0.1, as production trusts Cloudflare Access's; only the sign-in test uses a password.
 * Each threshold is a budget well above what the request takes now: it is there to catch a query
   that has started asking once per feed, or writers queueing on a lock, not a slow minute.
-* `ipx status`, the Docker healthcheck, runs every second throughout, and a run fails if one takes
+* `ipx status` runs every second throughout, and a run fails if one takes 5s.
-  the healthcheck's 5s.
 * One at a time: `node tests/load/run.js signin`. All four take about six minutes.
 * The daemon is on **SQLite** unless `--postgres`, which puts it in `IPX_TEST_DATABASE_URL`, in
   a schema of its own (`ipx_load`) dropped and made again each run. That URL, in `/src/.envrc`, is
@@ -203,7 +248,7 @@ Non-trivial logic leaves one runnable check behind. Pure functions (`merge_polic
 * `/api/settings` answering `200` does **not** mean the daemon is well — the web server is a
   different task. `ipx status` checks the control socket and the database; to see the worker
   getting through its jobs, watch for `scan complete` in the log.
-* **The database goes through SeaORM, and the entities in `src/entity.rs` are the schema.**
+* **The database goes through SeaORM, and the entities in `crates/ipx/src/entity.rs` are the schema.**
   `Db::open` creates any missing table or index from them (`create_missing`), on every `ipx`
   command, the healthcheck's `ipx status` included, so it must never write when nothing is
   missing: SeaORM's experimental schema sync dropped and remade an index on every open, the
@@ -221,19 +266,55 @@ Comments explain **why**, not what. If a line looks odd, the comment says what w
 it. No emoji, no exclamation marks, no "obviously". Prose in the UI and docs is plain English and
 addressed to the person using it.
 
-Every change gets one line under `## [Unreleased]` in [CHANGELOG.md](CHANGELOG.md), in its
+Every change gets one line under `## [Unreleased]` in the changelog of the service it changes, in
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/) group: Added, Changed, Deprecated,
+its [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) group: Added, Changed, Deprecated,
-Removed, Fixed or Security. Say it the way someone using ipx would notice it. When there is more to
+Removed, Fixed or Security. One changelog a service: [crates/ipx/CHANGELOG.md](crates/ipx/CHANGELOG.md)
+(the daemon and its API; until 0.12.0 everything), [web/CHANGELOG.md](web/CHANGELOG.md) (the page
+and ipx-web) and [crates/directory/CHANGELOG.md](crates/directory/CHANGELOG.md) (ipx-directory). A
+change to more than one gets a line in each, each saying what that service does differently. The
+monitoring (the Grafana dashboard, the prod-check skill) and the repository's own tooling are not
+a service anyone uses and get no line. Say it the way someone using ipx would notice it. When there is more to
 say, such as what was wrong before or what it cost to find out, it goes in the commit message's
 body, where `git log` and `git blame` find it beside the change. (There was a long-form
 `docs/history.md` until 0.7.0; it grew too large to be useful and was removed. It is in git.)
 
-Cutting a release: rename `[Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD` and open a new empty
+Each service has its own version and is released on its own, when its changelog has something to
-`[Unreleased]` above it, set `version` in `Cargo.toml` to `X.Y.Z` (dropping `-dev`), tag the commit
+release:
-`vX.Y.Z`, and update the compare links at the bottom of the changelog. Then, in the next commit,
+
-set `version` to the next patch with `-dev` (after 0.9.0, `0.9.1-dev`), so a build between releases says so
+| service | version in | changelog | tag |
-in the logo's tooltip instead of claiming to be the last release. The release that follows can
+|---|---|---|---|
-still be a minor or major one; `-dev` only says the work comes after `X.Y.Z`.
+| ipx | `crates/ipx/Cargo.toml` | `crates/ipx/CHANGELOG.md` | `vX.Y.Z`, as every release before the split |
+| ipx-directory | `crates/directory/Cargo.toml` | `crates/directory/CHANGELOG.md` | `directory-vX.Y.Z` |
+| ipx-web, the page | `package.json` | `web/CHANGELOG.md` | `web-vX.Y.Z` |
+
+`crates/feed` is a library the two Rust services build in, not released (`0.0.0`); a change to it
+is a line in the changelog of each service it changes. The page shows ipx's version and its own in
+the logo's tooltip; the directory logs its own at start; each binary answers `--version`.
+
+Cutting a release of one: first read its `[Unreleased]` against its last release, not line by
+line, and rewrite it as what changed between the two. Lines go in as the work happens, so they
+record the way there: a feature added and then reworked in the same release is one line saying
+what it is now, under Added; something added and taken out again before the release, or a fix for
+a bug no release ever had, is not there at all; and "instead of" and "no longer" compare with the
+last release, not with last week. Issue numbers stay, all of them, on the line that survives. Then
+rename `[Unreleased]` to `## [X.Y.Z] - YYYY-MM-DD` and open a new empty `[Unreleased]` above it,
+set the service's version to `X.Y.Z` (dropping `-dev`), tag the commit with the service's tag, and
+update the compare links at the bottom of its changelog. Push the commit and the tag, build and
+deploy the service's image, then `sh scripts/release.sh ipx|directory|web` makes the Gitea
+release: that version's changelog section as its notes, and a tarball of what the image runs (the
+binary, or the page's files with the Caddyfile) attached, checked to be that version. Then, in the
+next commit, set its version
+to the next patch with `-dev` (after 0.9.0, `0.9.1-dev`), so a build between releases says so
+instead of claiming to be the last release. The release that follows can still be a minor or major
+one; `-dev` only says the work comes after `X.Y.Z`. A service never released is at `0.1.0-dev`,
+working towards its first release, `0.1.0`.
+
+**Traces first, logs second.** Anything that does work (a service, a handler, a job, a call to
+another service) gets spans, and passes `traceparent` on to whatever it calls, so one trace in
+Tempo follows a request or a job across ipx-web, ipx and the directory. A trace shows where the
+time went and what called what; a log line only that something happened. Log what a trace cannot
+carry: events worth counting on the dashboard, warnings and errors. A new service or route without
+traces is not finished.
 
 Deliberate simplifications get a `ponytail:` comment naming the ceiling and the upgrade path, e.g.
 `// ponytail: global connection mutex, move to a pool if feed count makes it contend`.

Cargo.lock

@@ -1820,7 +1820,7 @@ checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "ipx"
-version = "0.10.2"
+version = "1.1.0"
 dependencies = [
  "ammonia",
  "anyhow",
@@ -1830,11 +1830,11 @@ dependencies = [
  "chrono",
  "clap",
  "futures-util",
+ "ipx-directory",
+ "ipx-feed",
  "jsonwebtoken",
  "librqbit",
  "opentelemetry",
- "opentelemetry-otlp",
- "opentelemetry_sdk",
  "opml",
  "percent-encoding",
  "quick-xml 0.42.0",
@@ -1854,6 +1854,51 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "ipx-directory"
+version = "1.1.0"
+dependencies = [
+ "ammonia",
+ "anyhow",
+ "axum",
+ "clap",
+ "ipx-feed",
+ "mimalloc",
+ "opentelemetry",
+ "opentelemetry-otlp",
+ "opentelemetry_sdk",
+ "percent-encoding",
+ "reqwest",
+ "sea-orm",
+ "serde",
+ "serde_json",
+ "sha2 0.10.9",
+ "tokio",
+ "toml",
+ "tower",
+ "tracing",
+ "tracing-opentelemetry",
+ "tracing-subscriber",
+ "url",
+]
+
+[[package]]
+name = "ipx-feed"
+version = "0.0.0"
+dependencies = [
+ "anyhow",
+ "atom_syndication",
+ "chrono",
+ "opml",
+ "quick-xml 0.42.0",
+ "reqwest",
+ "rss",
+ "serde_json",
+ "tokio",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
@@ -2058,6 +2103,15 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "libmimalloc-sys"
+version = "0.1.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a45a52f43e1c16f667ccfe4dd8c85b7f7c204fd5e3bf46c5b0db9a5c3c0b8e9"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "libredox"
 version = "0.1.23"
@@ -2497,6 +2551,15 @@ dependencies = [
  "rapidhash",
 ]
 
+[[package]]
+name = "mimalloc"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d4139bb28d14ad1facf21d5eb8825051b326e172d216b39f6d31df53cc97862"
+dependencies = [
+ "libmimalloc-sys",
+]
+
 [[package]]
 name = "mime"
 version = "0.3.17"

Cargo.toml

@@ -1,9 +1,15 @@
-[package]
+[workspace]
-name = "ipx"
+members = ["crates/ipx", "crates/feed", "crates/directory"]
-version = "0.10.2"
+resolver = "3"
+
+# Each service has its own version, in its own Cargo.toml (ipx, ipx-directory) or package.json
+# (the page), released and tagged on its own; see CLAUDE.md.
+[workspace.package]
 edition = "2024"
 
-[dependencies]
+[workspace.dependencies]
+ipx-feed = { path = "crates/feed" }
+ipx-directory = { path = "crates/directory" }
 ammonia = "4.1.4"
 anyhow = "1.0.104"
 argon2 = "0.6.0"
@@ -18,6 +24,7 @@ opentelemetry = { version = "0.33", default-features = false, features = ["trace
 opentelemetry-otlp = { version = "0.33", default-features = false, features = ["trace", "http-proto", "reqwest-blocking-client"] }
 opentelemetry_sdk = { version = "0.33", default-features = false, features = ["trace"] }
 opml = "1.1.6"
+mimalloc = "0.1.52"
 percent-encoding = "2.3.2"
 quick-xml = { version = "0.42.0", features = ["escape-html"] }
 reqwest = { version = "0.13.5", default-features = false, features = ["rustls", "http2", "gzip", "stream", "json", "charset", "system-proxy"] }
@@ -26,7 +33,7 @@ sea-orm = { version = "2.0.3", default-features = false, features = ["sqlx-sqlit
 serde = { version = "1.0.229", features = ["derive"] }
 serde_json = "1.0.151"
 sha2 = "0.10.9"
-tokio = { version = "1.53.1", features = ["rt-multi-thread", "macros", "fs", "io-util", "net", "sync", "time", "signal"] }
+tokio = { version = "1.53.1", features = ["rt-multi-thread", "macros", "fs", "io-util", "net", "sync", "time", "signal", "process"] }
 toml = "1.1.5"
 tower = { version = "0.5.3", features = ["util"] }
 tower-http = { version = "0.7.1", features = ["fs"] }

Dockerfile

@@ -1,31 +1,35 @@
 # Build. rusqlite is bundled (compiles SQLite from source) and librqbit needs a C
 # toolchain, so the builder needs cc. TLS is rustls throughout, so no OpenSSL headers.
-# build.rs builds the web pages from TypeScript with swc, which needs node.
+# The pages are ipx-web's (Dockerfile.web), so no node here (#203).
-FROM rust:1-slim-bookworm AS build
+FROM rust:1-slim-trixie AS build
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        build-essential nodejs npm \
+        build-essential \
     && rm -rf /var/lib/apt/lists/*
 WORKDIR /src
 
-# swc only: Playwright and TypeScript are for testing and type-checking, not for building.
+# Dependencies first, so editing the source does not rebuild librqbit every time: each crate of
-COPY package.json package-lock.json ./
+# the workspace as an empty stub, its manifest real.
-RUN npm ci --omit=dev
-
-# Dependencies first, so editing the source does not rebuild librqbit every time.
 COPY Cargo.toml Cargo.lock ./
-RUN mkdir src && echo 'fn main(){}' > src/main.rs \
+COPY crates/ipx/Cargo.toml crates/ipx/
-    && cargo build --release --locked \
+COPY crates/feed/Cargo.toml crates/feed/
-    && rm -rf src
+COPY crates/directory/Cargo.toml crates/directory/
+RUN mkdir -p crates/ipx/src crates/feed/src crates/directory/src \
+    && echo 'fn main(){}' > crates/ipx/src/main.rs && touch crates/feed/src/lib.rs \
+    && echo 'fn main(){}' > crates/directory/src/main.rs && touch crates/directory/src/lib.rs \
+    && cargo build --release --locked -p ipx \
+    && rm -rf crates/ipx/src crates/feed/src crates/directory/src
 
-COPY build.rs ./
+COPY crates ./crates
-COPY src ./src
+# ipx builds the directory crate in, whose public pages serve these (#215).
-COPY web ./web
+COPY web/logo.svg web/logo-dark.svg web/favicon.png ./web/
 # cargo skips a rebuild if mtimes look untouched; make sure it does not.
-RUN touch src/main.rs && cargo build --release --locked
+RUN touch crates/ipx/src/main.rs crates/feed/src/lib.rs && cargo build --release --locked -p ipx
 
-FROM debian:bookworm-slim
+FROM debian:trixie-slim
+# ffmpeg is DeadAir's (#171): it finds the silences and copies the frames kept. Debian's adds
+# about 480 MB, once: the layer stays cached until the base image changes.
 RUN apt-get update && apt-get install -y --no-install-recommends \
-        ca-certificates gosu \
+        ca-certificates gosu ffmpeg \
     && rm -rf /var/lib/apt/lists/*
 COPY --from=build /src/target/release/ipx /usr/local/bin/ipx
 COPY docker-entrypoint.sh /usr/local/bin/

Dockerfile.directory

@@ -0,0 +1,25 @@
+# ipx-directory (#204). Built from the repo's root: docker buildx build -f Dockerfile.directory .
+# No node here: only ipx's own build runs web/build.mjs.
+FROM rust:1-slim-trixie AS build
+# SQLite is compiled from source for sqlx, which needs a C toolchain.
+RUN apt-get update && apt-get install -y --no-install-recommends build-essential \
+    && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+# Every member of the workspace, since cargo reads them all to build one.
+# ponytail: no dependency layer, so each build compiles sea-orm again; add the stub trick from
+# the main Dockerfile if builds get slow enough to matter.
+COPY Cargo.toml Cargo.lock ./
+COPY crates ./crates
+# The logo and icon the public pages serve (#215), compiled into the binary.
+COPY web/logo.svg web/logo-dark.svg web/favicon.png ./web/
+RUN cargo build --release --locked -p ipx-directory
+
+FROM debian:trixie-slim
+RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+COPY --from=build /src/target/release/ipx-directory /usr/local/bin/ipx-directory
+ENV DIRECTORY_CONFIG=/config/directory.toml
+# Unraid's nobody:users. It writes nothing to disk: the database is elsewhere.
+USER 99:100
+EXPOSE 8100
+CMD ["ipx-directory"]

Dockerfile.web

@@ -0,0 +1,13 @@
+# ipx-web (#203): the frontend, built from web/ and served by Caddy, which passes the API to ipx.
+# Built from the repo's root: docker buildx build -f Dockerfile.web .
+FROM node:22-slim AS build
+WORKDIR /src
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev
+COPY web ./web
+RUN node web/build.mjs /dist
+
+FROM caddy:2
+COPY web/Caddyfile /etc/caddy/Caddyfile
+COPY --from=build /dist /srv
+EXPOSE 8080

README.md

@@ -31,11 +31,13 @@ With Docker:
 
 ```sh
 docker build -t ipx .
+docker build -f Dockerfile.web -t ipx-web .
 docker compose up -d
 ```
 
-`docker-compose.yml` is set up for the author's own server. Point its `image` and its three volumes
+`docker-compose.yml` is a sample: ipx, with its database in SQLite and its three volumes
-(`/config`, `/data` and `/downloads`) at yours first. The UI is on port 8099. BitTorrent uses 6881
+(`/config`, `/data` and `/downloads`) in folders beside the file, and ipx-web, the page, served by
+Caddy in front of it. Change them to suit. The UI is on port 8099. BitTorrent uses 6881
 over TCP and UDP. Files are written as `PUID`/`PGID`, 99:100 by default.
 
 From source:
@@ -62,7 +64,7 @@ The UI is plain HTTP, so put TLS in front of it if it is reachable from outside
 | [docs/users.md](docs/users.md) | Accounts, and what several people share |
 | [docs/sso.md](docs/sso.md) | Signing in through Cloudflare Zero Trust or Authentik |
 | [docs/architecture.md](docs/architecture.md) | How it works: modules, schema, control socket, HTTP API |
-| [CHANGELOG.md](CHANGELOG.md) | What changed, by release |
+| [crates/ipx/CHANGELOG.md](crates/ipx/CHANGELOG.md), [web/CHANGELOG.md](web/CHANGELOG.md), [crates/directory/CHANGELOG.md](crates/directory/CHANGELOG.md) | What changed, by release, for ipx, the page and the directory |
 | [CLAUDE.md](CLAUDE.md) | Notes for working on the code, including how production is deployed |
 
 ## Tests

build.rs

@@ -1,14 +0,0 @@
-//! Builds web/index.html and web/login.html from their TypeScript (web/build.mjs) into OUT_DIR,
-//! where src/web.rs include_str!s them. Needs node and `npm ci` run first.
-use std::process::Command;
-
-fn main() {
-    println!("cargo:rerun-if-changed=web");
-    println!("cargo:rerun-if-changed=package-lock.json");
-    let out = std::env::var("OUT_DIR").unwrap();
-    let status = Command::new("node")
-        .args(["web/build.mjs", &out])
-        .status()
-        .expect("building the web pages needs node on PATH (and `npm ci` run once)");
-    assert!(status.success(), "web/build.mjs failed; run `node web/build.mjs` to see why");
-}

crates/directory/CHANGELOG.md

@@ -0,0 +1,39 @@
+# Changelog: ipx-directory
+
+The directory of public podcasts that ipx servers share (docs/directory.md). ipx's changelog is
+[crates/ipx/CHANGELOG.md](../ipx/CHANGELOG.md), the page's [web/CHANGELOG.md](../../web/CHANGELOG.md).
+
+Its version is in `crates/directory/Cargo.toml`, and a release is tagged `directory-vX.Y.Z`.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.1.0] - 2026-10-13
+
+### Added
+
+- With `metrics_bind` set, the directory serves Prometheus metrics on a port of its own: memory, open files, and the feeds it has fetched and their bytes. A feed check's trace says how large the feed was (#224).
+
+### Changed
+
+- The directory uses mimalloc instead of glibc's allocator, so it gives back memory it has freed instead of holding over a gigabyte while idle (#224).
+- The example in docs/directory.md has no healthcheck; `ipx-directory health` is still there to run by hand (#218).
+
+### Security
+
+- A feed check's trace keeps the feed's address without its query or password (#225).
+
+## [1.0.0] - 2026-10-12
+
+### Added
+
+- Anyone can browse the directory in a web browser, read only: the most subscribed, categories, every feed A to Z, a search by name, and each feed's page with its latest items and its address to copy into any podcast app (#215).
+- `GET /v1/instances` lists the servers holding a snapshot, with their feeds and subscribers, for an admin token (#206).
+- `ipx-directory`, a directory of public podcasts that ipx servers share: each sends the public feeds its people subscribe to, and any server with a token browses them, each feed listed once it has been read. Tokens are in its config file, each read-only, read-write or admin, and revoked one at a time (#204, #205).
+- Traces: a span a request, joining the trace of the ipx server that called, and a trace a refresher round with a span a feed (#213).
+
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/directory-v1.1.0...main
+[1.1.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.0.0...directory-v1.1.0
+[1.0.0]: https://git.sdf1.net/rays/ipx/releases/tag/directory-v1.0.0

crates/directory/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "ipx-directory"
+version = "1.1.0"
+edition.workspace = true
+
+[[bin]]
+name = "ipx-directory"
+path = "src/main.rs"
+
+[dependencies]
+ammonia.workspace = true
+anyhow.workspace = true
+axum.workspace = true
+clap.workspace = true
+ipx-feed.workspace = true
+opentelemetry.workspace = true
+opentelemetry-otlp.workspace = true
+opentelemetry_sdk.workspace = true
+mimalloc.workspace = true
+percent-encoding.workspace = true
+reqwest.workspace = true
+sea-orm.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+tokio.workspace = true
+toml.workspace = true
+tracing.workspace = true
+tracing-opentelemetry.workspace = true
+tracing-subscriber.workspace = true
+url.workspace = true
+
+[dev-dependencies]
+tower.workspace = true

crates/directory/src/config.rs

@@ -0,0 +1,176 @@
+//! The directory's config file: where it listens, where its database is, and the tokens it
+//! accepts. Tokens are only ever changed here, never over the API, so whoever can edit this
+//! file decides who gets in (#204).
+
+use anyhow::{Context, Result, bail};
+use serde::Deserialize;
+use std::path::Path;
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Config {
+    #[serde(default = "default_bind")]
+    pub bind: String,
+    /// The environment variable holding the database URL, so the file holds no secret.
+    #[serde(default = "default_database_url_env")]
+    pub database_url_env: String,
+    /// Where to serve /metrics for Prometheus (#224), apart from `bind`, which the tunnel
+    /// publishes: `0.0.0.0:9188`. Empty serves none.
+    #[serde(default)]
+    pub metrics_bind: String,
+    #[serde(default)]
+    pub tokens: Vec<TokenCfg>,
+}
+
+fn default_bind() -> String {
+    "0.0.0.0:8100".into()
+}
+
+fn default_database_url_env() -> String {
+    "DIRECTORY_DATABASE_URL".into()
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct TokenCfg {
+    /// Who holds it: what its snapshot is filed under and what the log says, never the token.
+    pub name: String,
+    /// No default: a token whose access is missing or misspelled is refused when the file is
+    /// read, rather than given some access nobody chose.
+    pub access: Access,
+    /// The token's SHA-256, in hex: what `ipx-directory token new` prints. The file holds no
+    /// token, so adding or revoking one is an edit here and nothing else.
+    pub token_sha256: String,
+}
+
+/// What a token may do, each level including the one before.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Deserialize, serde::Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Access {
+    /// Browse.
+    Ro,
+    /// Browse and send snapshots.
+    Rw,
+    /// All that, and remove, block and refresh feeds and drop an instance's snapshot.
+    Rwa,
+}
+
+/// A token as the server checks it.
+#[derive(Debug, Clone)]
+pub struct Token {
+    pub name: String,
+    pub access: Access,
+    /// SHA-256 of the token, lower-case hex.
+    pub sha256: String,
+}
+
+impl Config {
+    pub fn load(path: &Path) -> Result<Self> {
+        let text = std::fs::read_to_string(path).with_context(|| format!("reading {}", path.display()))?;
+        Self::parse(&text).with_context(|| format!("in {}", path.display()))
+    }
+
+    pub fn parse(text: &str) -> Result<Self> {
+        let cfg: Config = toml::from_str(text)?;
+        let mut seen = std::collections::HashSet::new();
+        for t in &cfg.tokens {
+            if t.name.trim().is_empty() {
+                bail!("a token has an empty name");
+            }
+            // Snapshots are filed by name: two instances under one name would overwrite each other.
+            if !seen.insert(t.name.as_str()) {
+                bail!("two tokens are named {:?}", t.name);
+            }
+        }
+        Ok(cfg)
+    }
+
+    /// The tokens as the server checks them. A hash that is not 64 hex digits, or the same
+    /// hash under two names, is an error: which name a request is would be ambiguous.
+    pub fn tokens(&self) -> Result<Vec<Token>> {
+        let mut seen = std::collections::HashSet::new();
+        self.tokens
+            .iter()
+            .map(|t| {
+                let sha256 = t.token_sha256.trim().to_ascii_lowercase();
+                if sha256.len() != 64 || !sha256.bytes().all(|b| b.is_ascii_hexdigit()) {
+                    bail!("token {:?}: token_sha256 is not a SHA-256 in hex", t.name);
+                }
+                if !seen.insert(sha256.clone()) {
+                    bail!("token {:?} is the same token as another", t.name);
+                }
+                Ok(Token { name: t.name.clone(), access: t.access, sha256 })
+            })
+            .collect()
+    }
+}
+
+/// A token's SHA-256 in hex, as the config file holds it.
+pub fn hash(token: &str) -> String {
+    use sha2::Digest;
+    sha2::Sha256::digest(token.trim().as_bytes()).iter().map(|b| format!("{b:02x}")).collect()
+}
+
+/// Equal without saying, by how long it took, how much of the guess was right.
+pub fn same_secret(a: &str, b: &str) -> bool {
+    let (a, b) = (a.as_bytes(), b.as_bytes());
+    a.len() == b.len() && a.iter().zip(b).fold(0u8, |acc, (x, y)| acc | (x ^ y)) == 0
+}
+
+/// A new token: `ipxd_` and 256 random bits, the prefix so one found in a log says what it is.
+pub fn new_token() -> String {
+    use std::io::Read;
+    let mut bytes = [0u8; 32];
+    // Falling back to the clock would make a guessable token. Better to fail.
+    std::fs::File::open("/dev/urandom")
+        .and_then(|mut f| f.read_exact(&mut bytes))
+        .expect("no source of randomness for a token");
+    format!("ipxd_{}", bytes.iter().map(|b| format!("{b:02x}")).collect::<String>())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const GOOD: &str = r#"
+        [[tokens]]
+        name = "tower"
+        access = "rwa"
+        token_sha256 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+
+        [[tokens]]
+        name = "friend"
+        access = "ro"
+        token_sha256 = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+    "#;
+
+    #[test]
+    fn tokens_carry_their_access_and_take_their_value_from_the_environment() {
+        let cfg = Config::parse(GOOD).unwrap();
+        assert_eq!(cfg.bind, "0.0.0.0:8100");
+        let t = cfg.tokens().unwrap();
+        assert_eq!((t[0].name.as_str(), t[0].access, t[0].sha256.as_str()), ("tower", Access::Rwa, "a".repeat(64).as_str()));
+        assert_eq!(t[1].access, Access::Ro);
+        assert!(Access::Ro < Access::Rw && Access::Rw < Access::Rwa);
+    }
+
+    #[test]
+    fn a_missing_or_misspelled_access_a_reused_name_or_a_bad_hash_is_refused() {
+        let h = "a".repeat(64);
+        assert!(Config::parse(&format!("[[tokens]]\nname = \"a\"\ntoken_sha256 = \"{h}\"")).is_err());
+        assert!(Config::parse(&format!("[[tokens]]\nname = \"a\"\naccess = \"admin\"\ntoken_sha256 = \"{h}\"")).is_err());
+        assert!(Config::parse(&GOOD.replace("\"friend\"", "\"tower\"")).is_err());
+        assert!(Config::parse(&GOOD.replace(&"b".repeat(64), "xyz")).unwrap().tokens().is_err());
+        assert!(Config::parse(&GOOD.replace(&"b".repeat(64), &h)).unwrap().tokens().is_err());
+    }
+
+    #[test]
+    fn secrets_compare_whole() {
+        assert!(same_secret("abc", "abc"));
+        assert!(!same_secret("abc", "abd"));
+        assert!(!same_secret("abc", "abcd"));
+        let t = new_token();
+        assert!(t.starts_with("ipxd_") && t.len() == 69 && t != new_token());
+        assert_eq!(hash("abc"), "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad");
+    }
+}

crates/directory/src/lib.rs

@@ -0,0 +1,562 @@
+//! ipx's directory service (#204): a catalogue of public podcasts and blogs that ipx servers
+//! share. It holds metadata only, never a file: each server still fetches its own feeds. ipx
+//! servers send which public feeds their people subscribe to, the directory fetches each
+//! feed's title, artwork, description and latest items on a slow schedule, and any server
+//! holding a token can browse it.
+//!
+//! The types here are the wire format, shared with ipx, which asks the directory on its
+//! people's behalf.
+
+pub mod config;
+pub mod metrics;
+pub mod otel;
+mod site;
+pub mod store;
+
+use std::sync::{Arc, RwLock};
+use std::time::{Duration, Instant};
+
+use axum::extract::{Path, Query, Request, State};
+use axum::http::{StatusCode, header};
+use axum::middleware::Next;
+use axum::response::{IntoResponse, Response};
+use axum::routing::{delete, get, post};
+use axum::{Extension, Json, Router};
+use serde::{Deserialize, Serialize};
+
+use config::{Access, Token};
+use store::{Refreshed, Store};
+
+/// A feed as the directory lists it.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Listing {
+    /// The first 64 bits of the SHA-256 of its normalised address (`store::feed_id`).
+    pub id: String,
+    pub url: String,
+    pub title: Option<String>,
+    pub image: Option<String>,
+    /// Apple's category and the subcategory within it, from the feed's own iTunes category.
+    pub category: Option<String>,
+    pub subcategory: Option<String>,
+    /// Any audio or video in its latest items.
+    pub podcast: bool,
+    /// Summed over every instance's latest snapshot.
+    pub subscribers: i64,
+}
+
+/// One feed's page: what it says it is, and its latest items.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct FeedPage {
+    #[serde(flatten)]
+    pub listing: Listing,
+    /// The feed's own text, HTML as often as not, as it was sent: whoever shows it sanitizes it.
+    pub description: Option<String>,
+    /// Why its last check failed, in words, when it did.
+    pub failing: Option<String>,
+    pub items: Vec<Item>,
+}
+
+/// One of a feed's latest items: what it is, never its files.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Item {
+    pub guid: String,
+    pub title: Option<String>,
+    pub link: Option<String>,
+    pub published: Option<i64>,
+    pub duration: Option<i64>,
+    /// As the feed sent it, unsanitized.
+    pub description: Option<String>,
+}
+
+/// One feed in a snapshot: its address, and how many people on the sending server subscribe.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SnapshotEntry {
+    pub url: String,
+    pub subscribers: i64,
+    /// The category the sending server's admin gave a feed that names none itself: used only
+    /// while the feed names none.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub category: Option<String>,
+}
+
+#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
+pub struct SnapshotResult {
+    pub accepted: usize,
+    /// Addresses that look like they carry a subscriber's own access.
+    pub refused_private: usize,
+    /// Feeds an admin removed from the directory.
+    pub refused_blocked: usize,
+    /// Not an http(s) address.
+    pub refused_invalid: usize,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Me {
+    pub name: String,
+    pub access: Access,
+}
+
+/// A token whose snapshot the directory holds: how many feeds it gave, and how many people.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Instance {
+    pub name: String,
+    pub feeds: i64,
+    pub subscribers: i64,
+}
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Blocked {
+    pub id: String,
+    pub url: Option<String>,
+    pub title: Option<String>,
+    pub at: i64,
+}
+
+/// The most a snapshot may list: far more than one server's subscriptions, few enough that one
+/// request cannot hold the database for long.
+pub const MAX_SNAPSHOT: usize = 20_000;
+
+/// How often each feed is fetched again. Metadata changes slowly, and every server subscribed
+/// to a feed fetches it itself anyway.
+pub const REFRESH_EVERY: i64 = 6 * 3600;
+
+pub struct Directory {
+    pub store: Store,
+    tokens: RwLock<Vec<Token>>,
+    client: reqwest::Client,
+    /// Wakes the refresher, so a feed a snapshot brings in is fetched now, not in a minute.
+    wake: tokio::sync::Notify,
+}
+
+pub type Shared = Arc<Directory>;
+
+impl Directory {
+    pub fn new(store: Store, tokens: Vec<Token>) -> Result<Shared, reqwest::Error> {
+        // No redirects: ipx_feed::fetch follows them itself, so it sees each hop.
+        let client = reqwest::Client::builder()
+            .redirect(reqwest::redirect::Policy::none())
+            .user_agent(concat!("ipx-directory/", env!("CARGO_PKG_VERSION")))
+            .build()?;
+        Ok(Arc::new(Self { store, tokens: RwLock::new(tokens), client, wake: tokio::sync::Notify::new() }))
+    }
+
+    /// Takes the tokens of a config file read again, and drops the snapshots of any that went.
+    pub async fn set_tokens(&self, tokens: Vec<Token>) -> anyhow::Result<u64> {
+        let names: Vec<String> = tokens.iter().map(|t| t.name.clone()).collect();
+        *self.tokens.write().unwrap() = tokens;
+        self.store.keep_instances(&names).await
+    }
+
+    fn caller(&self, presented: &str) -> Option<Me> {
+        let h = config::hash(presented);
+        // Every token compared, whether or not one matched, so timing says nothing either way.
+        self.tokens
+            .read()
+            .unwrap()
+            .iter()
+            .fold(None, |found, t| if config::same_secret(&t.sha256, &h) { Some(Me { name: t.name.clone(), access: t.access }) } else { found })
+    }
+
+    /// Fetches one feed and stores what it found.
+    pub async fn refresh(&self, due: &store::Due) -> anyhow::Result<()> {
+        let got = match ipx_feed::fetch(&self.client, &due.url, None, due.etag.as_deref(), due.last_modified.as_deref()).await {
+            Ok((ipx_feed::Fetched::NotModified, _)) => Refreshed::NotModified,
+            Ok((ipx_feed::Fetched::Body { bytes, etag, last_modified }, _)) => {
+                if ipx_feed::is_opml(&bytes) {
+                    // ipx sends the feeds inside an OPML, never the OPML.
+                    Refreshed::Failed("an OPML list, not a feed".into())
+                } else {
+                    match ipx_feed::parse(&bytes) {
+                        Ok(parsed) => Refreshed::Feed { parsed, etag, last_modified },
+                        Err(e) => Refreshed::Failed(format!("{e:#}")),
+                    }
+                }
+            }
+            Err(e) => Refreshed::Failed(format!("{e:#}")),
+        };
+        if let Refreshed::Failed(e) = &got {
+            tracing::info!(feed = %due.id, error = %e, "feed check failed");
+        }
+        // ponytail: a feed that moved for good is still asked for at its old address, which
+        // redirects; follow the move when a feed's id can change without losing its counts.
+        self.store.save(&due.id, got).await
+    }
+}
+
+/// Fetches whatever is due, a few at a time, forever.
+pub async fn refresher(dir: Shared) {
+    loop {
+        match dir.store.due(REFRESH_EVERY, 25).await {
+            Ok(due) => {
+                if !due.is_empty() {
+                    // A round is a trace, each feed's check a span in it (#213).
+                    let round = tracing::info_span!("refresh", feeds = due.len());
+                    tracing::Instrument::instrument(
+                        async {
+                            for d in &due {
+                                let check = tracing::info_span!("feed", feed = %d.id);
+                                if let Err(e) = tracing::Instrument::instrument(dir.refresh(d), check).await {
+                                    tracing::warn!(feed = %d.id, error = %format!("{e:#}"), "could not store a feed check");
+                                }
+                            }
+                            // One line a round, for the dashboard's refresher panel (#210); failures have their own.
+                            tracing::info!(checked = due.len(), "feeds checked");
+                        },
+                        round,
+                    )
+                    .await;
+                    continue;
+                }
+            }
+            Err(e) => tracing::warn!(error = %format!("{e:#}"), "could not read which feeds are due"),
+        }
+        tokio::select! {
+            _ = tokio::time::sleep(Duration::from_secs(60)) => {}
+            _ = dir.wake.notified() => {}
+        }
+    }
+}
+
+/// Reads the config file again whenever it changes, checked each minute. A file that fails to
+/// load leaves the tokens as they were, so a typo locks nobody out.
+pub async fn reloader(dir: Shared, path: std::path::PathBuf) {
+    let mtime = |p: &std::path::Path| std::fs::metadata(p).and_then(|m| m.modified()).ok();
+    let mut last = mtime(&path);
+    loop {
+        tokio::time::sleep(Duration::from_secs(60)).await;
+        let now = mtime(&path);
+        if now == last {
+            continue;
+        }
+        last = now;
+        match config::Config::load(&path).and_then(|c| c.tokens()) {
+            Ok(tokens) => {
+                let n = tokens.len();
+                match dir.set_tokens(tokens).await {
+                    Ok(dropped) => tracing::info!(tokens = n, dropped, "config read again"),
+                    Err(e) => tracing::warn!(error = %format!("{e:#}"), "config read again, but old snapshots could not be dropped"),
+                }
+            }
+            Err(e) => tracing::warn!(error = %format!("{e:#}"), "config changed but does not load; keeping the tokens as they were"),
+        }
+    }
+}
+
+pub fn router(dir: Shared) -> Router {
+    let v1 = Router::new()
+        .route("/v1/me", get(me))
+        .route("/v1/feeds", get(list))
+        .route("/v1/popular", get(popular))
+        .route("/v1/feeds/{id}", get(feed).delete(remove))
+        .route("/v1/feeds/{id}/refresh", post(refresh))
+        .route("/v1/snapshot", post(snapshot))
+        .route("/v1/blocked", get(blocked))
+        .route("/v1/blocked/{id}", delete(unblock))
+        .route("/v1/instances", get(instances))
+        .route("/v1/instances/{name}", delete(drop_instance))
+        .layer(axum::middleware::from_fn_with_state(dir.clone(), authenticate));
+    Router::new()
+        .route("/healthz", get(healthz))
+        .merge(v1)
+        // Anyone may browse, no token, read only (#215).
+        .merge(site::router())
+        .layer(axum::middleware::from_fn(access_log))
+        .with_state(dir)
+}
+
+struct ApiError(StatusCode, String);
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        (self.0, Json(serde_json::json!({ "error": self.1 }))).into_response()
+    }
+}
+
+impl From<anyhow::Error> for ApiError {
+    fn from(e: anyhow::Error) -> Self {
+        tracing::error!(error = %format!("{e:#}"), "request failed");
+        ApiError(StatusCode::INTERNAL_SERVER_ERROR, "something went wrong; the directory's log says what".into())
+    }
+}
+
+/// Who made the request, for the access log, set by `authenticate`.
+#[derive(Clone)]
+struct Who(String);
+
+/// One line a request, with the token's name and never the token: what the Grafana panels read.
+async fn access_log(req: Request, next: Next) -> Response {
+    let (method, path) = (req.method().clone(), req.uri().path().to_owned());
+    let start = Instant::now();
+    // A span for each request but the healthcheck's, a child of the caller's when it sent a
+    // traceparent, as ipx does on its calls here (#213).
+    let span = if path == "/healthz" {
+        tracing::Span::none()
+    } else {
+        tracing::info_span!(
+            "http",
+            otel.name = %format!("{method} {path}"),
+            http.request.method = %method,
+            url.path = %path,
+            http.response.status_code = tracing::field::Empty,
+        )
+    };
+    if let Some(parent) = otel::remote_parent(req.headers(), None) {
+        use tracing_opentelemetry::OpenTelemetrySpanExt;
+        let _ = span.set_parent(parent);
+    }
+    let resp = tracing::Instrument::instrument(next.run(req), span.clone()).await;
+    span.record("http.response.status_code", resp.status().as_u16());
+    let _in = span.enter();
+    let who = resp.extensions().get::<Who>().map_or("", |w| w.0.as_str()).to_owned();
+    let status = resp.status().as_u16();
+    if path != "/healthz" {
+        tracing::info!(
+            target: "ipx_directory::http",
+            method = %method, path = %path, status, duration_ms = start.elapsed().as_millis() as u64, token = %who,
+            "{method} {path} -> {status}"
+        );
+    }
+    resp
+}
+
+async fn authenticate(State(dir): State<Shared>, mut req: Request, next: Next) -> Response {
+    let presented = req
+        .headers()
+        .get(header::AUTHORIZATION)
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "))
+        .map(str::trim)
+        .filter(|t| !t.is_empty());
+    let Some(me) = presented.and_then(|t| dir.caller(t)) else {
+        return ApiError(StatusCode::UNAUTHORIZED, "a valid token is needed: Authorization: Bearer <token>".into()).into_response();
+    };
+    let who = Who(me.name.clone());
+    req.extensions_mut().insert(me);
+    let mut resp = next.run(req).await;
+    resp.extensions_mut().insert(who);
+    resp
+}
+
+fn need(me: &Me, access: Access) -> Result<(), ApiError> {
+    if me.access >= access {
+        Ok(())
+    } else {
+        let what = match access {
+            Access::Ro => "browse",
+            Access::Rw => "send snapshots",
+            Access::Rwa => "administer the directory",
+        };
+        Err(ApiError(StatusCode::FORBIDDEN, format!("this token may not {what}")))
+    }
+}
+
+async fn healthz(State(dir): State<Shared>) -> Result<&'static str, ApiError> {
+    dir.store.ping().await?;
+    Ok("ok")
+}
+
+async fn me(Extension(me): Extension<Me>) -> Json<Me> {
+    Json(me)
+}
+
+async fn list(State(dir): State<Shared>) -> Result<Json<Vec<Listing>>, ApiError> {
+    Ok(Json(dir.store.list().await?))
+}
+
+#[derive(Deserialize)]
+struct Limit {
+    limit: Option<u64>,
+}
+
+async fn popular(State(dir): State<Shared>, Query(q): Query<Limit>) -> Result<Json<Vec<Listing>>, ApiError> {
+    Ok(Json(dir.store.popular(q.limit.unwrap_or(10).clamp(1, 100)).await?))
+}
+
+async fn feed(State(dir): State<Shared>, Path(id): Path<String>) -> Result<Json<FeedPage>, ApiError> {
+    dir.store.feed(&id).await?.map(Json).ok_or_else(|| ApiError(StatusCode::NOT_FOUND, format!("{id:?} is not in the directory")))
+}
+
+async fn snapshot(
+    State(dir): State<Shared>,
+    Extension(me): Extension<Me>,
+    Json(entries): Json<Vec<SnapshotEntry>>,
+) -> Result<Json<SnapshotResult>, ApiError> {
+    need(&me, Access::Rw)?;
+    if entries.len() > MAX_SNAPSHOT {
+        return Err(ApiError(StatusCode::PAYLOAD_TOO_LARGE, format!("a snapshot lists at most {MAX_SNAPSHOT} feeds")));
+    }
+    let r = dir.store.snapshot(&me.name, &entries).await?;
+    dir.wake.notify_one();
+    tracing::info!(
+        instance = %me.name, accepted = r.accepted, refused_private = r.refused_private,
+        refused_blocked = r.refused_blocked, refused_invalid = r.refused_invalid, "snapshot"
+    );
+    Ok(Json(r))
+}
+
+async fn remove(State(dir): State<Shared>, Extension(me): Extension<Me>, Path(id): Path<String>) -> Result<StatusCode, ApiError> {
+    need(&me, Access::Rwa)?;
+    dir.store.block(&id).await?;
+    tracing::info!(feed = %id, by = %me.name, "feed removed and blocked");
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn blocked(State(dir): State<Shared>, Extension(me): Extension<Me>) -> Result<Json<Vec<Blocked>>, ApiError> {
+    need(&me, Access::Rwa)?;
+    Ok(Json(dir.store.blocked().await?))
+}
+
+async fn unblock(State(dir): State<Shared>, Extension(me): Extension<Me>, Path(id): Path<String>) -> Result<StatusCode, ApiError> {
+    need(&me, Access::Rwa)?;
+    if !dir.store.unblock(&id).await? {
+        return Err(ApiError(StatusCode::NOT_FOUND, format!("{id:?} is not blocked")));
+    }
+    tracing::info!(feed = %id, by = %me.name, "feed unblocked");
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn instances(State(dir): State<Shared>, Extension(me): Extension<Me>) -> Result<Json<Vec<Instance>>, ApiError> {
+    need(&me, Access::Rwa)?;
+    Ok(Json(dir.store.instances().await?))
+}
+
+async fn drop_instance(State(dir): State<Shared>, Extension(me): Extension<Me>, Path(name): Path<String>) -> Result<StatusCode, ApiError> {
+    need(&me, Access::Rwa)?;
+    let n = dir.store.drop_instance(&name).await?;
+    tracing::info!(instance = %name, feeds = n, by = %me.name, "snapshot dropped");
+    Ok(StatusCode::NO_CONTENT)
+}
+
+async fn refresh(State(dir): State<Shared>, Extension(me): Extension<Me>, Path(id): Path<String>) -> Result<Json<FeedPage>, ApiError> {
+    need(&me, Access::Rwa)?;
+    let due = dir.store.due_one(&id).await?.ok_or_else(|| ApiError(StatusCode::NOT_FOUND, format!("{id:?} is not in the directory")))?;
+    dir.refresh(&due).await?;
+    feed(State(dir), Path(id)).await
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use axum::body::Body;
+    use tower::ServiceExt;
+
+    async fn app() -> (Router, Shared) {
+        let tokens = ["ro", "rw", "rwa"]
+            .iter()
+            .map(|n| Token {
+                name: format!("{n}-token"),
+                access: serde_json::from_value(serde_json::json!(n)).unwrap(),
+                sha256: config::hash(&format!("secret-{n}")),
+            })
+            .collect();
+        let dir = Directory::new(Store::scratch().await, tokens).unwrap();
+        (router(dir.clone()), dir)
+    }
+
+    async fn call(app: &Router, method: &str, path: &str, token: Option<&str>, body: Option<serde_json::Value>) -> (u16, serde_json::Value) {
+        let mut req = axum::http::Request::builder().method(method).uri(path);
+        if let Some(t) = token {
+            req = req.header("authorization", format!("Bearer secret-{t}"));
+        }
+        let req = match body {
+            Some(b) => req.header("content-type", "application/json").body(Body::from(b.to_string())),
+            None => req.body(Body::empty()),
+        }
+        .unwrap();
+        let resp = app.clone().oneshot(req).await.unwrap();
+        let status = resp.status().as_u16();
+        let bytes = axum::body::to_bytes(resp.into_body(), 1 << 20).await.unwrap();
+        (status, serde_json::from_slice(&bytes).unwrap_or(serde_json::Value::Null))
+    }
+
+    async fn get_page(app: &Router, path: &str) -> (u16, String, Option<String>) {
+        let req = axum::http::Request::builder().uri(path).body(Body::empty()).unwrap();
+        let resp = app.clone().oneshot(req).await.unwrap();
+        let status = resp.status().as_u16();
+        let csp = resp.headers().get("content-security-policy").map(|v| v.to_str().unwrap().to_owned());
+        let bytes = axum::body::to_bytes(resp.into_body(), 1 << 22).await.unwrap();
+        (status, String::from_utf8(bytes.to_vec()).unwrap(), csp)
+    }
+
+    #[tokio::test]
+    async fn anyone_browses_the_pages_and_the_api_still_needs_a_token() {
+        let (app, dir) = app().await;
+        let snap = serde_json::json!([{ "url": "https://x.test/a.xml", "subscribers": 3 }]);
+        call(&app, "POST", "/v1/snapshot", Some("rw"), Some(snap)).await;
+        store::tests::fetch_all(&dir.store).await;
+        let id = dir.store.list().await.unwrap()[0].id.clone();
+
+        let (s, home, csp) = get_page(&app, "/").await;
+        assert_eq!(s, 200);
+        assert!(csp.unwrap().contains("script-src 'self'"));
+        assert!(home.contains("Most subscribed") && home.contains(&format!("/feed/{id}")), "{home}");
+        assert!(get_page(&app, "/all").await.1.contains("3 people subscribe"));
+        let (s, page, _) = get_page(&app, &format!("/feed/{id}")).await;
+        assert_eq!(s, 200);
+        // Its address, to subscribe to anywhere.
+        assert!(page.contains("value=\"https://x.test/a.xml\""), "{page}");
+        assert!(!page.contains("<script>"), "the publisher's HTML is text here");
+        assert_eq!(get_page(&app, "/feed/nope").await.0, 404);
+        assert_eq!(get_page(&app, "/category/Nothing").await.0, 404);
+        assert_eq!(get_page(&app, "/search?q=").await.0, 303);
+        assert_eq!(get_page(&app, "/site.js").await.0, 200);
+        // Reading the pages takes no token; the API still does.
+        assert_eq!(call(&app, "GET", "/v1/feeds", None, None).await.0, 401);
+        assert_eq!(call(&app, "DELETE", &format!("/v1/feeds/{id}"), None, None).await.0, 401);
+        assert_eq!(call(&app, "DELETE", &format!("/feed/{id}"), None, None).await.0, 405);
+    }
+
+    #[tokio::test]
+    async fn each_access_level_does_what_it_may_and_no_more() {
+        let (app, dir) = app().await;
+        let snap = serde_json::json!([{ "url": "https://x.test/a.xml", "subscribers": 2, "category": "Comedy" }]);
+
+        assert_eq!(call(&app, "GET", "/v1/feeds", None, None).await.0, 401);
+        assert_eq!(call(&app, "GET", "/v1/feeds", Some("wrong"), None).await.0, 401);
+        assert_eq!(call(&app, "GET", "/healthz", None, None).await.0, 200);
+
+        let (s, me) = call(&app, "GET", "/v1/me", Some("ro"), None).await;
+        assert_eq!((s, me["name"].as_str(), me["access"].as_str()), (200, Some("ro-token"), Some("ro")));
+        assert_eq!(call(&app, "POST", "/v1/snapshot", Some("ro"), Some(snap.clone())).await.0, 403);
+
+        let (s, r) = call(&app, "POST", "/v1/snapshot", Some("rw"), Some(snap.clone())).await;
+        assert_eq!((s, r["accepted"].as_u64()), (200, Some(1)));
+        store::tests::fetch_all(&dir.store).await;
+        let (_, list) = call(&app, "GET", "/v1/feeds", Some("ro"), None).await;
+        let id = list[0]["id"].as_str().unwrap().to_owned();
+        assert_eq!(list[0]["subscribers"], 2);
+        assert_ne!(list[0]["category"], "Comedy", "the feed's own category wins over the sender's");
+        assert_eq!(call(&app, "GET", &format!("/v1/feeds/{id}"), Some("ro"), None).await.0, 200);
+        assert_eq!(call(&app, "GET", "/v1/feeds/nope", Some("ro"), None).await.0, 404);
+        assert_eq!(call(&app, "GET", "/v1/popular?limit=5", Some("ro"), None).await.1[0]["id"], id.as_str());
+
+        for (m, p) in [("DELETE", format!("/v1/feeds/{id}")), ("GET", "/v1/blocked".into()), ("DELETE", "/v1/instances/rw-token".into())] {
+            assert_eq!(call(&app, m, &p, Some("rw"), None).await.0, 403, "{m} {p}");
+        }
+        assert_eq!(call(&app, "DELETE", &format!("/v1/feeds/{id}"), Some("rwa"), None).await.0, 204);
+        assert_eq!(call(&app, "GET", "/v1/blocked", Some("rwa"), None).await.1[0]["id"], id.as_str());
+        assert_eq!(call(&app, "POST", "/v1/snapshot", Some("rw"), Some(snap.clone())).await.1["refused_blocked"], 1);
+        assert_eq!(call(&app, "DELETE", &format!("/v1/blocked/{id}"), Some("rwa"), None).await.0, 204);
+        assert_eq!(call(&app, "DELETE", &format!("/v1/blocked/{id}"), Some("rwa"), None).await.0, 404);
+        call(&app, "POST", "/v1/snapshot", Some("rw"), Some(snap)).await;
+        assert_eq!(call(&app, "DELETE", "/v1/instances/rw-token", Some("rwa"), None).await.0, 204);
+        assert_eq!(call(&app, "GET", "/v1/feeds", Some("ro"), None).await.1, serde_json::json!([]));
+    }
+
+    #[tokio::test]
+    async fn a_revoked_token_loses_its_access_and_its_counts() {
+        let dir = Directory::new(Store::scratch().await, vec![]).unwrap();
+        let t = |n: &str| Token { name: n.into(), access: Access::Rw, sha256: config::hash(&format!("secret-{n}")) };
+        dir.set_tokens(vec![t("a"), t("b")]).await.unwrap();
+        let app = router(dir.clone());
+        let snap = serde_json::json!([{ "url": "https://x.test/a.xml", "subscribers": 1 }]);
+        call(&app, "POST", "/v1/snapshot", Some("a"), Some(snap.clone())).await;
+        call(&app, "POST", "/v1/snapshot", Some("b"), Some(snap)).await;
+        store::tests::fetch_all(&dir.store).await;
+        assert_eq!(call(&app, "GET", "/v1/feeds", Some("a"), None).await.1[0]["subscribers"], 2);
+
+        dir.set_tokens(vec![t("a")]).await.unwrap();
+        assert_eq!(call(&app, "GET", "/v1/feeds", Some("b"), None).await.0, 401);
+        assert_eq!(call(&app, "GET", "/v1/feeds", Some("a"), None).await.1[0]["subscribers"], 1);
+    }
+}

crates/directory/src/main.rs

@@ -0,0 +1,122 @@
+//! `ipx-directory`: serve the directory, make a token, or check that a running one answers.
+
+use anyhow::{Context, Result};
+use clap::{Parser, Subcommand};
+use ipx_directory::{Directory, config, store::Store};
+use tracing_subscriber::prelude::*;
+
+#[derive(Parser)]
+#[command(version, about = "ipx's directory of public podcasts")]
+struct Cli {
+    /// The config file: where to listen, the database, and the tokens it accepts. Otherwise
+    /// DIRECTORY_CONFIG, or else /config/directory.toml.
+    #[arg(long)]
+    config: Option<std::path::PathBuf>,
+    #[command(subcommand)]
+    cmd: Option<Cmd>,
+}
+
+#[derive(Subcommand)]
+enum Cmd {
+    /// Serve the directory (the default).
+    Serve,
+    /// Make a token, and print it with the lines that let it in.
+    Token {
+        #[command(subcommand)]
+        cmd: TokenCmd,
+    },
+    /// Check that the directory on this machine answers and can read its database.
+    Health,
+}
+
+#[derive(Subcommand)]
+enum TokenCmd {
+    New {
+        /// Who it is for, as the log and their snapshot will name them.
+        name: String,
+        #[arg(long, value_parser = ["ro", "rw", "rwa"])]
+        access: String,
+    },
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let cli = Cli::parse();
+    let config_path = cli
+        .config
+        .or_else(|| std::env::var_os("DIRECTORY_CONFIG").map(Into::into))
+        .unwrap_or_else(|| "/config/directory.toml".into());
+    match cli.cmd.unwrap_or(Cmd::Serve) {
+        Cmd::Serve => serve(&config_path).await,
+        Cmd::Token { cmd: TokenCmd::New { name, access } } => {
+            let token = config::new_token();
+            println!("A token for {name}, to give them; it is not kept anywhere:\n\n    {token}\n");
+            println!("To let it in, add this to {}:\n", config_path.display());
+            println!("[[tokens]]\nname = {name:?}\naccess = {access:?}\ntoken_sha256 = {:?}", config::hash(&token));
+            println!("\nThe directory reads the file again within a minute. Delete the entry to revoke it.");
+            Ok(())
+        }
+        Cmd::Health => {
+            let cfg = config::Config::load(&config_path)?;
+            let port = cfg.bind.rsplit(':').next().unwrap_or("8100");
+            let resp = reqwest::Client::new()
+                .get(format!("http://127.0.0.1:{port}/healthz"))
+                .timeout(std::time::Duration::from_secs(4))
+                .send()
+                .await
+                .context("the directory does not answer")?;
+            anyhow::ensure!(resp.status().is_success(), "the directory answers {}", resp.status());
+            Ok(())
+        }
+    }
+}
+
+async fn serve(path: &std::path::Path) -> Result<()> {
+    // One JSON object a line for Loki when DIRECTORY_LOG_FORMAT=json, as ipx does; text otherwise.
+    let json = std::env::var("DIRECTORY_LOG_FORMAT").is_ok_and(|f| f.eq_ignore_ascii_case("json"));
+    let filter = || tracing_subscriber::EnvFilter::try_from_env("DIRECTORY_LOG").unwrap_or_else(|_| "ipx_directory=info".into());
+    // Traces to Tempo when OTEL_EXPORTER_OTLP_ENDPOINT is set, joining ipx's (#213).
+    let otel = ipx_directory::otel::provider("ipx-directory")?;
+    tracing_subscriber::registry()
+        .with((!json).then(|| tracing_subscriber::fmt::layer().with_writer(std::io::stderr).with_filter(filter())))
+        .with(json.then(|| tracing_subscriber::fmt::layer().json().flatten_event(true).with_writer(std::io::stderr).with_filter(filter())))
+        .with(otel.as_ref().map(|p| {
+            use opentelemetry::trace::TracerProvider;
+            tracing_opentelemetry::layer().with_tracer(p.tracer("ipx-directory")).with_filter(tracing_subscriber::EnvFilter::new("ipx_directory=info,ipx_feed=info"))
+        }))
+        .init();
+
+    let cfg = config::Config::load(path)?;
+    let tokens = cfg.tokens()?;
+    let url = std::env::var(&cfg.database_url_env)
+        .ok()
+        .filter(|u| !u.trim().is_empty())
+        .with_context(|| format!("{} is not set: the directory needs a database URL", cfg.database_url_env))?;
+    let store = Store::open(&url).await.context("opening the database")?;
+    let dir = Directory::new(store, vec![])?;
+    let dropped = dir.set_tokens(tokens).await?;
+
+    let listener = tokio::net::TcpListener::bind(&cfg.bind).await.with_context(|| format!("listening on {}", cfg.bind))?;
+    tracing::info!(version = env!("CARGO_PKG_VERSION"), bind = %cfg.bind, tokens = cfg.tokens.len(), dropped, "directory started");
+    if !cfg.metrics_bind.is_empty() {
+        let metrics = tokio::net::TcpListener::bind(&cfg.metrics_bind).await.with_context(|| format!("listening for metrics on {}", cfg.metrics_bind))?;
+        tracing::info!(bind = %cfg.metrics_bind, "serving metrics for Prometheus at /metrics");
+        tokio::spawn(ipx_directory::metrics::serve(metrics));
+    }
+    tokio::spawn(ipx_directory::refresher(dir.clone()));
+    tokio::spawn(ipx_directory::reloader(dir.clone(), path.to_owned()));
+    axum::serve(listener, ipx_directory::router(dir))
+        .with_graceful_shutdown(async {
+            let mut term = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate()).expect("SIGTERM handler");
+            tokio::select! {
+                _ = term.recv() => {}
+                _ = tokio::signal::ctrl_c() => {}
+            }
+        })
+        .await?;
+    // The batch exporter holds the last few seconds of spans; without this they are lost.
+    if let Some(p) = otel {
+        let _ = p.shutdown();
+    }
+    Ok(())
+}

crates/directory/src/metrics.rs

@@ -0,0 +1,67 @@
+//! Memory, for ipx and the directory both (#224), and the directory's own /metrics.
+//!
+//! mimalloc is the allocator of every binary that builds this crate in, ipx included: with
+//! glibc's, ipx kept the 500-850 MB a night of scans had needed until it restarted, and the
+//! directory sat at 1.25 GiB doing nothing, each thread's arena holding what it had freed.
+//! mimalloc gives freed pages back, so resident memory follows what is in use: a spike that
+//! does not come down again is a leak. Not jemalloc, whose upstream was archived in 2025.
+
+use std::sync::atomic::Ordering::Relaxed;
+
+#[global_allocator]
+static ALLOC: mimalloc::MiMalloc = mimalloc::MiMalloc;
+
+/// The process's resident memory in bytes and its open files, from /proc; None elsewhere.
+pub fn process() -> (Option<f64>, Option<f64>) {
+    let rss = std::fs::read_to_string("/proc/self/status").ok().and_then(|s| {
+        let kb = s.lines().find_map(|l| l.strip_prefix("VmRSS:"))?.trim().strip_suffix("kB")?.trim().parse::<f64>().ok()?;
+        Some(kb * 1024.0)
+    });
+    let fds = std::fs::read_dir("/proc/self/fd").ok().map(|d| d.count() as f64);
+    (rss, fds)
+}
+
+/// The directory's /metrics, in Prometheus's text format: memory, open files, and the feeds it
+/// has fetched. Nothing from the database, so a scrape costs nothing and answers while it is down.
+fn render(started: std::time::Instant) -> String {
+    let mut out = String::new();
+    let mut gauge = |name: &str, kind: &str, help: &str, labels: &str, v: f64| {
+        out.push_str(&format!("# HELP {name} {help}\n# TYPE {name} {kind}\n{name}{labels} {v}\n"));
+    };
+    let (rss, fds) = process();
+    if let Some(v) = rss {
+        gauge("directory_process_resident_bytes", "gauge", "Memory the process holds.", "", v);
+    }
+    if let Some(v) = fds {
+        gauge("directory_process_open_fds", "gauge", "Files and sockets the process has open.", "", v);
+    }
+    gauge("directory_feed_fetches_total", "counter", "Feeds fetched, answered 304 included.", "", ipx_feed::FETCHES.load(Relaxed) as f64);
+    gauge("directory_feed_bytes_total", "counter", "Bytes of feed bodies fetched.", "", ipx_feed::FETCHED_BYTES.load(Relaxed) as f64);
+    gauge("directory_uptime_seconds", "gauge", "Seconds since the directory started.", "", started.elapsed().as_secs() as f64);
+    gauge("directory_build_info", "gauge", "The version running, as a label.", &format!("{{version=\"{}\"}}", env!("CARGO_PKG_VERSION")), 1.0);
+    out
+}
+
+/// Serves /metrics on a listener of its own: the public port is behind the tunnel with no
+/// Access in front, and these are for the LAN.
+pub async fn serve(listener: tokio::net::TcpListener) {
+    let started = std::time::Instant::now();
+    let app = axum::Router::new().route(
+        "/metrics",
+        axum::routing::get(move || async move {
+            ([(axum::http::header::CONTENT_TYPE, "text/plain; version=0.0.4")], render(started))
+        }),
+    );
+    if let Err(e) = axum::serve(listener, app).await {
+        tracing::error!(error = %e, "metrics stopped");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn metrics_say_memory_and_feeds() {
+        let text = super::render(std::time::Instant::now());
+        assert!(text.contains("directory_process_resident_bytes ") && text.contains("directory_feed_bytes_total "), "{text}");
+    }
+}

crates/directory/src/otel.rs

@@ -0,0 +1,83 @@
+//! Traces, for ipx and the directory both (#213): the exporter, and W3C `traceparent` in from a
+//! caller and out to a callee, so one trace follows a request from the browser through ipx-web
+//! and ipx into the directory.
+
+/// Traces over OTLP, to Tempo for one, when OTEL_EXPORTER_OTLP_ENDPOINT names a collector
+/// (`http://host:4318`: the exporter speaks OTLP over HTTP and adds `/v1/traces`). The exporter
+/// reads that and the other `OTEL_` variables itself.
+pub fn provider(service: &'static str) -> anyhow::Result<Option<opentelemetry_sdk::trace::SdkTracerProvider>> {
+    if std::env::var("OTEL_EXPORTER_OTLP_ENDPOINT").unwrap_or_default().is_empty() {
+        return Ok(None);
+    }
+    let exporter = opentelemetry_otlp::SpanExporter::builder().with_http().build()?;
+    let resource = opentelemetry_sdk::Resource::builder().with_service_name(service).build();
+    Ok(Some(
+        opentelemetry_sdk::trace::SdkTracerProvider::builder()
+            .with_batch_exporter(exporter)
+            .with_resource(resource)
+            .build(),
+    ))
+}
+
+/// The trace a request from the page belongs to, from its `traceparent` (#190), so the requests
+/// one action sets off are one trace. None for a missing or malformed one. In the query where no
+/// header can be set: a position saved by sendBeacon, and the playlist Safari's player fetches
+/// itself (#192).
+pub fn remote_parent(headers: &axum::http::HeaderMap, query: Option<&str>) -> Option<opentelemetry::Context> {
+    use opentelemetry::trace::{SpanContext, SpanId, TraceContextExt, TraceFlags, TraceId, TraceState};
+    let v = match headers.get("traceparent") {
+        Some(h) => h.to_str().ok()?,
+        None => query?.split('&').find_map(|kv| kv.strip_prefix("traceparent="))?,
+    };
+    let mut parts = v.split('-');
+    let (version, trace, span) = (parts.next()?, parts.next()?, parts.next()?);
+    if version != "00" || trace.len() != 32 || span.len() != 16 {
+        return None;
+    }
+    let sc = SpanContext::new(
+        TraceId::from_hex(trace).ok()?,
+        SpanId::from_hex(span).ok()?,
+        TraceFlags::SAMPLED,
+        true,
+        TraceState::default(),
+    );
+    sc.is_valid().then(|| opentelemetry::Context::new().with_remote_span_context(sc))
+}
+
+/// The current span as a `traceparent`, for a request to another service, so its spans join
+/// this trace. None outside a traced span.
+pub fn traceparent() -> Option<String> {
+    use opentelemetry::trace::TraceContextExt;
+    use tracing_opentelemetry::OpenTelemetrySpanExt;
+    let cx = tracing::Span::current().context();
+    let sc = cx.span().span_context().clone();
+    sc.is_valid().then(|| format!("00-{}-{}-{:02x}", sc.trace_id(), sc.span_id(), sc.trace_flags().to_u8()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_requests_trace_is_the_pages_from_its_traceparent() {
+        use opentelemetry::trace::TraceContextExt;
+        let with = |v: &str| {
+            let mut h = axum::http::HeaderMap::new();
+            h.insert("traceparent", v.parse().unwrap());
+            remote_parent(&h, None)
+        };
+        let cx = with("00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01").expect("parsed");
+        assert_eq!(cx.span().span_context().trace_id().to_string(), "4bf92f3577b34da6a3ce929d0e0e4736");
+        assert!(cx.span().span_context().is_remote());
+        // Anything else from the browser starts a trace of its own.
+        for bad in ["", "00-xyz-00f067aa0ba902b7-01", "01-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
+                    "00-00000000000000000000000000000000-00f067aa0ba902b7-01", "00-4bf92f3577b34da6a3ce929d0e0e4736"] {
+            assert!(with(bad).is_none(), "{bad}");
+        }
+        assert!(remote_parent(&axum::http::HeaderMap::new(), None).is_none());
+        // From the query, where a beacon or Safari's player cannot send a header (#192).
+        let q = remote_parent(&axum::http::HeaderMap::new(), Some("x=1&traceparent=00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01"));
+        assert_eq!(q.unwrap().span().span_context().trace_id().to_string(), "4bf92f3577b34da6a3ce929d0e0e4736");
+        assert!(remote_parent(&axum::http::HeaderMap::new(), Some("traceparent=nonsense")).is_none());
+    }
+}

crates/directory/src/site.css

@@ -0,0 +1,67 @@
+/* The directory's pages (#215), in iPX's palette: the logo's navy, sky blue and needle orange,
+   dark or light as the system is. */
+:root{--bg:#eef5fb;--panel:#fff;--panel2:#e4eff9;--line:#c6d9ea;--fg:#10233a;--dim:#46596e;--faint:#56697e;--accent:#2f6aa0;--accent2:#c43e00;--ink:#fff}
+@media (prefers-color-scheme:dark){:root{--bg:#0a1726;--panel:#0f1f31;--panel2:#15283d;--line:#264060;--fg:#f3f7fb;--dim:#a3b6ca;--faint:#8a9fb5;--accent:#8fc2ea;--accent2:#ff6a1a;--ink:#0a1726}}
+*{box-sizing:border-box}
+html{-webkit-text-size-adjust:100%}
+body{margin:0;background:var(--bg);color:var(--fg);font:15px/1.5 system-ui,-apple-system,"Segoe UI",Roboto,sans-serif}
+a{color:var(--accent);text-decoration:none}
+a:hover{text-decoration:underline}
+a:focus-visible,button:focus-visible,input:focus-visible{outline:2px solid var(--accent);outline-offset:2px}
+header{display:flex;align-items:center;gap:16px;padding:12px 20px;background:var(--panel);border-bottom:1px solid var(--line);position:sticky;top:0;z-index:1}
+.brand{display:flex;align-items:center;gap:10px;color:var(--fg);font-weight:700;font-size:17px;white-space:nowrap}
+.brand img{border-radius:8px;display:block}
+header form{margin-left:auto;flex:0 1 320px}
+input{font:inherit;color:var(--fg);background:var(--bg);border:1px solid var(--line);border-radius:10px;padding:8px 12px;width:100%}
+main{max-width:1100px;margin:0 auto;padding:20px 20px 40px}
+footer{max-width:1100px;margin:0 auto;padding:16px 20px 32px;color:var(--faint);font-size:13px;border-top:1px solid var(--line)}
+h2{font-size:22px;margin:20px 0 12px}
+h3{font-size:17px;margin:28px 0 8px}
+.hint,.count{color:var(--dim)}
+.back{margin:0;color:var(--faint);font-size:14px}
+.more{font-weight:600}
+.art{position:relative;display:block;aspect-ratio:1;border-radius:10px;overflow:hidden;background:var(--panel2);flex:none}
+.art i{position:absolute;inset:0;display:grid;place-items:center;font-style:normal;font-weight:700;color:var(--accent);font-size:28px}
+.art img{position:absolute;inset:0;width:100%;height:100%;object-fit:cover}
+.art.sm{width:48px;border-radius:8px}.art.sm i{font-size:16px}
+.art.lg{width:180px;border-radius:14px}.art.lg i{font-size:48px}
+.chart{list-style:none;margin:0;padding:0;display:grid;grid-template-columns:repeat(auto-fill,minmax(min(320px,100%),1fr));gap:4px 24px}
+/* A grid item is as wide as its content unless told otherwise, and a long title then runs off the page. */
+.chart li,.tile{min-width:0}
+.chart a{display:flex;align-items:center;gap:12px;padding:8px;border-radius:10px;color:var(--fg)}
+.chart a:hover{background:var(--panel);text-decoration:none}
+.no{width:22px;text-align:right;color:var(--faint);font-variant-numeric:tabular-nums;flex:none}
+.txt{display:flex;flex-direction:column;min-width:0}
+.txt b,.tile b{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+small{color:var(--dim);font-size:13px}
+.cats{display:grid;grid-template-columns:repeat(auto-fill,minmax(180px,1fr));gap:12px}
+.cat{display:flex;flex-direction:column;gap:2px;padding:14px 16px;border-radius:12px;background:var(--panel);border:1px solid var(--line);color:var(--fg)}
+.cat:hover{border-color:var(--accent);text-decoration:none}
+.tabs,.pills{display:flex;gap:6px;flex-wrap:wrap;margin:0 0 12px}
+.tabs a,.pills a{padding:6px 14px;border-radius:999px;background:var(--panel);border:1px solid var(--line);color:var(--fg);font-size:14px}
+.tabs a[aria-current],.pills a[aria-current]{background:var(--accent);border-color:var(--accent);color:var(--ink)}
+.pills a[aria-current] small{color:inherit}
+.tiles{display:grid;grid-template-columns:repeat(auto-fill,minmax(150px,1fr));gap:18px 14px}
+.tile{display:flex;flex-direction:column;gap:4px;min-width:0;color:var(--fg)}
+.tile:hover{text-decoration:none}.tile:hover b{text-decoration:underline}
+.show{display:flex;gap:24px;align-items:flex-end;margin-top:8px}
+.meta{display:flex;flex-direction:column;gap:6px;min-width:0;flex:1}
+.meta h2{margin:0;font-size:28px;line-height:1.15;overflow-wrap:anywhere}
+.sub{margin:0;color:var(--dim)}
+.addr{display:flex;flex-direction:column;gap:4px;margin-top:8px;max-width:560px}
+.addr label{font-size:13px;color:var(--faint)}
+.addr .row{display:flex;gap:8px}
+.addr input{font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:13px}
+button{font:inherit;font-weight:600;padding:8px 16px;border-radius:10px;border:0;background:var(--accent);color:var(--ink);cursor:pointer}
+.about{color:var(--dim);max-width:72ch;margin:20px 0 0}
+.failing{color:var(--accent2)}
+article{padding:12px 0;border-bottom:1px solid var(--line);max-width:80ch}
+article p{margin:4px 0;color:var(--dim)}
+@media (max-width:600px){
+  header{padding:10px 16px;gap:10px}
+  .brand span,.brand{font-size:15px}
+  main{padding:16px}
+  .show{flex-direction:column;align-items:flex-start;gap:14px}
+  .art.lg{width:140px}
+  .tiles{grid-template-columns:repeat(auto-fill,minmax(104px,1fr));gap:14px 10px}
+}

crates/directory/src/site.js

@@ -0,0 +1,10 @@
+// The one thing the directory's pages script (#215): Copy puts a feed's address on the clipboard.
+// Without it, the address is in a field of its own to select by hand.
+document.addEventListener('click', ev => {
+  const b = ev.target.closest('[data-copy]');
+  if (!b || !navigator.clipboard) return;
+  navigator.clipboard.writeText(b.dataset.copy).then(() => {
+    b.textContent = 'Copied';
+    setTimeout(() => { b.textContent = 'Copy'; }, 1500);
+  });
+});

crates/directory/src/site.rs

@@ -0,0 +1,348 @@
+//! The directory in a web browser (#215): anyone may browse it, no token, read only. The most
+//! subscribed and the categories, every feed A to Z, a search by name, and a page per feed with
+//! its address to subscribe to in any podcast app. Rendered here from the store, as plain HTML:
+//! no build step, and nothing the API does not already hold.
+//!
+//! A feed's description and items are the publisher's HTML, unsanitized in the store; they are
+//! shown as text, tags stripped, and an item's link only when it is http(s).
+
+use std::collections::BTreeMap;
+use std::fmt::Write;
+
+use axum::extract::{Path, Query, State};
+use axum::http::{HeaderValue, StatusCode, header};
+use axum::response::{IntoResponse, Response};
+use axum::routing::get;
+use axum::Router;
+
+use crate::{Listing, Shared};
+
+pub fn router() -> Router<Shared> {
+    Router::new()
+        .route("/", get(home))
+        .route("/all", get(all))
+        .route("/search", get(search))
+        .route("/category/{name}", get(category))
+        .route("/feed/{id}", get(feed))
+        .route("/site.css", get(|| asset("text/css; charset=utf-8", include_bytes!("site.css"))))
+        .route("/site.js", get(|| asset("text/javascript; charset=utf-8", include_bytes!("site.js"))))
+        .route("/logo.svg", get(|| asset("image/svg+xml", include_bytes!("../../../web/logo.svg"))))
+        .route("/logo-dark.svg", get(|| asset("image/svg+xml", include_bytes!("../../../web/logo-dark.svg"))))
+        .route("/favicon.png", get(|| asset("image/png", include_bytes!("../../../web/favicon.png"))))
+}
+
+/// Its own script and stylesheet only; covers come from their publishers.
+const CSP: &str = "default-src 'none'; img-src https: http: data:; style-src 'self'; script-src 'self'; \
+                   base-uri 'none'; form-action 'self'; frame-ancestors 'none'";
+
+async fn asset(kind: &'static str, body: &'static [u8]) -> Response {
+    ([(header::CONTENT_TYPE, kind), (header::CACHE_CONTROL, "public, max-age=86400")], body).into_response()
+}
+
+#[derive(serde::Deserialize, Default)]
+struct Filter {
+    /// `podcasts` or `blogs`; anything else is both.
+    kind: Option<String>,
+    sub: Option<String>,
+    q: Option<String>,
+}
+
+impl Filter {
+    fn keep(&self, l: &Listing) -> bool {
+        match self.kind.as_deref() {
+            Some("podcasts") => l.podcast,
+            Some("blogs") => !l.podcast,
+            _ => true,
+        }
+    }
+}
+
+async fn home(State(dir): State<Shared>) -> Response {
+    let all = match dir.store.list().await {
+        Ok(a) => a,
+        Err(e) => return failed(e),
+    };
+    let mut top = all.clone();
+    top.sort_by(|a, b| b.subscribers.cmp(&a.subscribers).then_with(|| name(a).to_lowercase().cmp(&name(b).to_lowercase())));
+    top.truncate(10);
+    let mut cats: BTreeMap<&str, Vec<&Listing>> = BTreeMap::new();
+    for l in &all {
+        cats.entry(l.category.as_deref().unwrap_or("Other")).or_default().push(l);
+    }
+    let mut b = String::new();
+    if all.is_empty() {
+        b.push_str("<p class=hint>Nothing is listed yet. A feed appears once a server has shared it and the directory has read it.</p>");
+    } else {
+        b.push_str("<h2>Most subscribed</h2><ol class=chart>");
+        for (i, l) in top.iter().enumerate() {
+            let _ = write!(b, "<li><a href=\"/feed/{}\"><span class=no>{}</span>{}<span class=txt><b>{}</b><small>{}</small></span></a></li>",
+                esc(&l.id), i + 1, art(l, "art sm"), esc(name(l)), subscribers(l.subscribers));
+        }
+        b.push_str("</ol><h2>Categories</h2><div class=cats>");
+        for (c, ls) in &cats {
+            let _ = write!(b, "<a class=cat href=\"/category/{}\"><b>{}</b><small>{}</small></a>", seg(c), esc(c), ls.len());
+        }
+        let _ = write!(b, "</div><p><a class=more href=\"/all\">All {} feeds, A to Z</a></p>", all.len());
+    }
+    page("iPX Directory", None, &b)
+}
+
+async fn all(State(dir): State<Shared>, Query(f): Query<Filter>) -> Response {
+    listed(&dir, "All feeds", "/all", &f, |_| true).await
+}
+
+async fn search(State(dir): State<Shared>, Query(f): Query<Filter>) -> Response {
+    let q = f.q.clone().unwrap_or_default().trim().to_lowercase();
+    if q.is_empty() {
+        return redirect("/all");
+    }
+    let title = format!("Results for \u{201c}{}\u{201d}", f.q.as_deref().unwrap_or("").trim());
+    listed(&dir, &title, "/search", &f, move |l| name(l).to_lowercase().contains(&q)).await
+}
+
+async fn category(State(dir): State<Shared>, Path(c): Path<String>, Query(f): Query<Filter>) -> Response {
+    let here = format!("/category/{}", seg(&c));
+    let cat = c.clone();
+    listed(&dir, &c, &here, &f, move |l| l.category.as_deref().unwrap_or("Other") == cat).await
+}
+
+/// A page of tiles: those `pick` takes, of the kind and subcategory asked for, A to Z.
+async fn listed(dir: &Shared, title: &str, here: &str, f: &Filter, pick: impl Fn(&Listing) -> bool) -> Response {
+    let mut ls: Vec<Listing> = match dir.store.list().await {
+        Ok(a) => a.into_iter().filter(|l| pick(l)).collect(),
+        Err(e) => return failed(e),
+    };
+    if ls.is_empty() && here.starts_with("/category/") {
+        return not_found("That category has nothing in it.");
+    }
+    let subs: BTreeMap<String, usize> = ls.iter().filter_map(|l| l.subcategory.clone()).fold(BTreeMap::new(), |mut m, s| {
+        *m.entry(s).or_default() += 1;
+        m
+    });
+    ls.retain(|l| f.keep(l) && f.sub.as_ref().is_none_or(|s| l.subcategory.as_ref() == Some(s)));
+    ls.sort_by_key(|l| name(l).to_lowercase());
+
+    // The query a link keeps, with one of its keys changed.
+    let link = |kind: Option<&str>, sub: Option<&str>| {
+        let mut q = url::form_urlencoded::Serializer::new(String::new());
+        if let Some(v) = f.q.as_deref() {
+            q.append_pair("q", v);
+        }
+        if let Some(v) = kind {
+            q.append_pair("kind", v);
+        }
+        if let Some(v) = sub {
+            q.append_pair("sub", v);
+        }
+        let q = q.finish();
+        if q.is_empty() { here.to_owned() } else { format!("{here}?{q}") }
+    };
+    let mut b = String::new();
+    let _ = write!(b, "<p class=back><a href=\"/\">Directory</a></p><h2>{}</h2><nav class=tabs aria-label=Kind>", esc(title));
+    for (k, label) in [(None, "All"), (Some("podcasts"), "Podcasts"), (Some("blogs"), "Blogs")] {
+        let on = f.kind.as_deref() == k;
+        let _ = write!(b, "<a href=\"{}\"{}>{label}</a>", esc(&link(k, f.sub.as_deref())), if on { " aria-current=page" } else { "" });
+    }
+    b.push_str("</nav>");
+    if !subs.is_empty() {
+        b.push_str("<nav class=pills aria-label=Subcategory>");
+        let _ = write!(b, "<a href=\"{}\"{}>All</a>", esc(&link(f.kind.as_deref(), None)), if f.sub.is_none() { " aria-current=page" } else { "" });
+        for (s, n) in &subs {
+            let on = f.sub.as_deref() == Some(s.as_str());
+            let _ = write!(b, "<a href=\"{}\"{}>{} <small>{n}</small></a>", esc(&link(f.kind.as_deref(), Some(s))), if on { " aria-current=page" } else { "" }, esc(s));
+        }
+        b.push_str("</nav>");
+    }
+    if ls.is_empty() {
+        b.push_str("<p class=hint>Nothing here.</p>");
+    } else {
+        let _ = write!(b, "<p class=count>{}</p><div class=tiles>", plural(ls.len(), "feed"));
+        for l in &ls {
+            let _ = write!(b, "<a class=tile href=\"/feed/{}\">{}<b>{}</b><small>{}</small></a>", esc(&l.id), art(l, "art"), esc(name(l)), subscribers(l.subscribers));
+        }
+        b.push_str("</div>");
+    }
+    page(title, None, &b)
+}
+
+async fn feed(State(dir): State<Shared>, Path(id): Path<String>) -> Response {
+    let p = match dir.store.feed(&id).await {
+        Ok(Some(p)) => p,
+        Ok(None) => return not_found("That feed is not in the directory."),
+        Err(e) => return failed(e),
+    };
+    let l = &p.listing;
+    let mut b = String::new();
+    b.push_str("<p class=back><a href=\"/\">Directory</a>");
+    if let Some(c) = &l.category {
+        let _ = write!(b, " <span aria-hidden=true>/</span> <a href=\"/category/{}\">{}</a>", seg(c), esc(c));
+    }
+    let _ = write!(b, "</p><div class=show>{}<div class=meta><h2>{}</h2><p class=sub>{}{}</p>", art(l, "art lg"), esc(name(l)),
+        subscribers(l.subscribers), l.subcategory.as_deref().map(|s| format!(" &middot; {}", esc(s))).unwrap_or_default());
+    let _ = write!(b, "<div class=addr><label for=addr>Feed address</label><span class=row><input id=addr readonly value=\"{}\" spellcheck=false>\
+        <button type=button data-copy=\"{}\">Copy</button></span><small>Paste it into any podcast app or feed reader to subscribe.</small></div></div></div>",
+        esc(&l.url), esc(&l.url));
+    if let Some(d) = p.description.as_deref().map(text).filter(|d| !d.is_empty() && d != name(l)) {
+        let _ = write!(b, "<p class=about>{}</p>", esc(&d));
+    }
+    if let Some(why) = &p.failing {
+        let _ = write!(b, "<p class=failing>{}</p>", esc(why));
+    }
+    let _ = write!(b, "<h3>{}</h3>", if l.podcast { "Latest episodes" } else { "Latest posts" });
+    if p.items.is_empty() {
+        b.push_str("<p class=hint>Nothing read from it yet. The directory checks each feed every six hours.</p>");
+    }
+    for e in &p.items {
+        let title = e.title.as_deref().map(text).filter(|t| !t.is_empty()).unwrap_or_else(|| "Untitled".into());
+        let head = match e.link.as_deref().filter(|u| u.starts_with("https://") || u.starts_with("http://")) {
+            Some(u) => format!("<a href=\"{}\" rel=\"noopener nofollow\">{}</a>", esc(u), esc(&title)),
+            None => esc(&title),
+        };
+        let blurb: String = e.description.as_deref().map(text).unwrap_or_default().chars().take(400).collect();
+        let when = [e.published.map(date), e.duration.filter(|d| *d > 0).map(clock)].into_iter().flatten().collect::<Vec<_>>().join(" &middot; ");
+        let _ = write!(b, "<article><b>{head}</b>{}{}</article>",
+            if blurb.is_empty() { String::new() } else { format!("<p>{}</p>", esc(&blurb)) },
+            if when.is_empty() { String::new() } else { format!("<small>{when}</small>") });
+    }
+    page(name(l), Some(&text(p.description.as_deref().unwrap_or(""))), &b)
+}
+
+fn page(title: &str, description: Option<&str>, body: &str) -> Response {
+    let full = if title == "iPX Directory" { title.to_owned() } else { format!("{title} | iPX Directory") };
+    let desc = description.filter(|d| !d.is_empty()).map(|d| d.chars().take(200).collect::<String>())
+        .unwrap_or_else(|| "Public podcasts and blogs that iPX servers share.".into());
+    let html = format!(
+        "<!doctype html><html lang=en><head><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\">\
+         <title>{}</title><meta name=description content=\"{}\"><meta name=color-scheme content=\"light dark\">\
+         <link rel=icon href=/favicon.png><link rel=stylesheet href=/site.css><script src=/site.js defer></script></head>\
+         <body><header><a class=brand href=\"/\"><picture><source srcset=/logo-dark.svg media=\"(prefers-color-scheme: dark)\">\
+         <img src=/logo.svg alt=\"\" width=32 height=32></picture>iPX Directory</a>\
+         <form action=/search role=search><input type=search name=q placeholder=\"Find a feed\" aria-label=\"Find a feed by name\"></form></header>\
+         <main>{body}</main><footer>Public podcasts and blogs that iPX servers share, and how many people on them subscribe. \
+         Read only: to change what is here, an iPX server shares its public feeds.</footer></body></html>",
+        esc(&full),
+        esc(&desc),
+    );
+    let mut r = html.into_response();
+    let h = r.headers_mut();
+    h.insert(header::CONTENT_TYPE, HeaderValue::from_static("text/html; charset=utf-8"));
+    h.insert(header::CACHE_CONTROL, HeaderValue::from_static("public, max-age=300"));
+    h.insert(header::CONTENT_SECURITY_POLICY, HeaderValue::from_static(CSP));
+    h.insert("x-content-type-options", HeaderValue::from_static("nosniff"));
+    h.insert("referrer-policy", HeaderValue::from_static("no-referrer"));
+    r
+}
+
+fn not_found(why: &str) -> Response {
+    let mut r = page("Not found", None, &format!("<p class=back><a href=\"/\">Directory</a></p><h2>Not found</h2><p class=hint>{}</p>", esc(why)));
+    *r.status_mut() = StatusCode::NOT_FOUND;
+    r
+}
+
+fn failed(e: anyhow::Error) -> Response {
+    tracing::error!(error = %format!("{e:#}"), "a directory page failed");
+    let mut r = page("Unavailable", None, "<h2>Unavailable</h2><p class=hint>The directory could not read its list just now. Try again in a minute.</p>");
+    *r.status_mut() = StatusCode::SERVICE_UNAVAILABLE;
+    r
+}
+
+fn redirect(to: &'static str) -> Response {
+    (StatusCode::SEE_OTHER, [(header::LOCATION, to)]).into_response()
+}
+
+/// A cover from its publisher, over the feed's initials, which show where it has none or it fails.
+fn art(l: &Listing, class: &str) -> String {
+    // The first letter of each of the first two words that have one: `<antirez>` is A, not nothing.
+    let initials: String = name(l).split_whitespace().filter_map(|w| w.chars().find(|c| c.is_alphanumeric())).take(2).collect();
+    let img = l.image.as_deref().filter(|u| u.starts_with("https://") || u.starts_with("http://"))
+        .map(|u| format!("<img src=\"{}\" alt=\"\" loading=lazy referrerpolicy=no-referrer>", esc(u)))
+        .unwrap_or_default();
+    format!("<span class=\"{class}\" aria-hidden=true><i>{}</i>{img}</span>", esc(&initials.to_uppercase()))
+}
+
+fn name(l: &Listing) -> &str {
+    l.title.as_deref().filter(|t| !t.trim().is_empty()).unwrap_or(&l.id)
+}
+
+fn subscribers(n: i64) -> String {
+    match n {
+        0 => "Listed, no subscribers yet".into(),
+        1 => "1 person subscribes".into(),
+        n => format!("{n} people subscribe"),
+    }
+}
+
+fn plural(n: usize, word: &str) -> String {
+    format!("{n} {word}{}", if n == 1 { "" } else { "s" })
+}
+
+/// `12 Oct 2026`, from a Unix time, with no date library: the civil-from-days algorithm.
+fn date(t: i64) -> String {
+    let z = t.div_euclid(86_400) + 719_468;
+    let era = z.div_euclid(146_097);
+    let doe = z - era * 146_097;
+    let yoe = (doe - doe / 1460 + doe / 36_524 - doe / 146_096) / 365;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = yoe + era * 400 + i64::from(m <= 2);
+    const MONTHS: [&str; 12] = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+    format!("{d} {} {y}", MONTHS[(m - 1) as usize])
+}
+
+fn clock(secs: i64) -> String {
+    let (h, m) = (secs / 3600, secs % 3600 / 60);
+    if h > 0 { format!("{h} h {m} min") } else { format!("{} min", m.max(1)) }
+}
+
+/// The publisher's HTML as plain text: tags gone, entities read, whitespace collapsed. Escaped
+/// again where it is shown.
+fn text(html: &str) -> String {
+    // A space where each tag was, or two paragraphs run together: "drives.For over".
+    let stripped = ammonia::Builder::empty().clean(&html.replace('<', " <")).to_string();
+    let decoded = stripped.replace("&lt;", "<").replace("&gt;", ">").replace("&quot;", "\"").replace("&#39;", "'").replace("&nbsp;", " ").replace("&amp;", "&");
+    decoded.split_whitespace().collect::<Vec<_>>().join(" ")
+}
+
+fn esc(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for c in s.chars() {
+        match c {
+            '&' => out.push_str("&amp;"),
+            '<' => out.push_str("&lt;"),
+            '>' => out.push_str("&gt;"),
+            '"' => out.push_str("&quot;"),
+            '\'' => out.push_str("&#39;"),
+            c => out.push(c),
+        }
+    }
+    out
+}
+
+/// A category as a path segment.
+fn seg(s: &str) -> String {
+    percent_encoding::utf8_percent_encode(s, percent_encoding::NON_ALPHANUMERIC).to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_publishers_html_becomes_text_and_is_escaped_where_shown() {
+        assert_eq!(text("<p>Tom &amp; Jerry <script>alert(1)</script><b>live</b></p>"), "Tom & Jerry live");
+        assert_eq!(text("<p>One.</p><p>Two.</p>"), "One. Two.");
+        assert_eq!(esc(&text("a &lt;b&gt; c")), "a &lt;b&gt; c");
+        assert_eq!(esc("\"><img onerror=x>"), "&quot;&gt;&lt;img onerror=x&gt;");
+    }
+
+    #[test]
+    fn dates_and_lengths_read_as_people_write_them() {
+        assert_eq!(date(0), "1 Jan 1970");
+        assert_eq!(date(1_791_820_800), "12 Oct 2026");
+        assert_eq!(date(951_782_400), "29 Feb 2000");
+        assert_eq!(clock(59), "1 min");
+        assert_eq!(clock(3_725), "1 h 2 min");
+    }
+}

crates/directory/src/store.rs

@@ -0,0 +1,593 @@
+//! The directory's database: the feeds instances have sent, what each instance sent, and what
+//! an admin has blocked. SQL written by hand, as ipx's is, so it runs on SQLite (tests) and
+//! Postgres (production) both: `$1` parameters, `ON CONFLICT`, booleans as themselves.
+
+use anyhow::Result;
+use sea_orm::{ConnectionTrait, DatabaseConnection, Statement, TransactionTrait, Value};
+
+use crate::{Blocked, FeedPage, Instance, Item, Listing, SnapshotEntry, SnapshotResult};
+
+/// A feed's items as its page shows them, and as many as ipx's own Directory page showed.
+pub const ITEMS: usize = 20;
+
+/// How long a feed's failure goes unexplained: a site down for an hour is not called gone (ipx#143).
+const FLAG_AFTER_SECS: i64 = 24 * 3600;
+
+pub struct Store {
+    db: DatabaseConnection,
+}
+
+/// What the refresher needs to ask for a feed again.
+pub struct Due {
+    pub id: String,
+    pub url: String,
+    pub etag: Option<String>,
+    pub last_modified: Option<String>,
+}
+
+/// What a fetch found, to be stored.
+pub enum Refreshed {
+    NotModified,
+    Feed {
+        parsed: ipx_feed::ParsedFeed,
+        etag: Option<String>,
+        last_modified: Option<String>,
+    },
+    Failed(String),
+}
+
+pub fn now() -> i64 {
+    std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH).map_or(0, |d| d.as_secs() as i64)
+}
+
+/// The address as every instance would write it: scheme and host lower-cased, a default port
+/// and a fragment dropped. None for anything that is not http(s).
+pub fn normalise(url: &str) -> Option<String> {
+    let mut u = url::Url::parse(url.trim()).ok()?;
+    if !matches!(u.scheme(), "http" | "https") || u.host_str().is_none() {
+        return None;
+    }
+    u.set_fragment(None);
+    Some(u.to_string())
+}
+
+/// A feed's id: the first 64 bits of its normalised address's SHA-256, so every instance, and
+/// anyone else, arrives at the same id for the same feed without asking.
+pub fn feed_id(normalised: &str) -> String {
+    use sha2::Digest;
+    sha2::Sha256::digest(normalised.as_bytes())[..8].iter().map(|b| format!("{b:02x}")).collect()
+}
+
+const SCHEMA: &[&str] = &[
+    "CREATE TABLE IF NOT EXISTS feeds (
+        id TEXT PRIMARY KEY,
+        url TEXT NOT NULL UNIQUE,
+        title TEXT,
+        image TEXT,
+        category TEXT,
+        subcategory TEXT,
+        description TEXT,
+        podcast BOOLEAN NOT NULL DEFAULT false,
+        items TEXT,
+        etag TEXT,
+        last_modified TEXT,
+        checked_at BIGINT,
+        last_error TEXT,
+        error_since BIGINT
+    )",
+    "CREATE TABLE IF NOT EXISTS snapshots (
+        instance TEXT NOT NULL,
+        feed_id TEXT NOT NULL,
+        subscribers BIGINT NOT NULL,
+        category TEXT,
+        subcategory TEXT,
+        PRIMARY KEY (instance, feed_id)
+    )",
+    "CREATE INDEX IF NOT EXISTS snapshots_feed ON snapshots (feed_id)",
+    "CREATE TABLE IF NOT EXISTS blocked (
+        id TEXT PRIMARY KEY,
+        url TEXT,
+        title TEXT,
+        at BIGINT NOT NULL
+    )",
+];
+
+impl Store {
+    /// A database of its own for a test: a fresh schema on IPX_TEST_DATABASE_URL's Postgres when
+    /// that is set, as ipx's tests do, or else SQLite in memory.
+    #[cfg(test)]
+    pub async fn scratch() -> Self {
+        static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
+        let Some(url) = std::env::var("IPX_TEST_DATABASE_URL").ok().filter(|u| !u.is_empty()) else {
+            return Self::open("sqlite::memory:").await.unwrap();
+        };
+        let (pid, n) = (std::process::id(), N.fetch_add(1, std::sync::atomic::Ordering::Relaxed));
+        // A bare connection: Store::open would make the tables in the public schema, and the
+        // tests running at once raced each other doing it.
+        let admin = Self { db: sea_orm::Database::connect(url.as_str()).await.unwrap() };
+        // Schemas an earlier run left behind: anything of ours not made by this process.
+        let old = admin
+            .rows(&format!(r"SELECT nspname FROM pg_namespace WHERE nspname LIKE 'ipxd\_%' AND nspname NOT LIKE 'ipxd\_{pid}\_%'"), vec![])
+            .await
+            .unwrap();
+        for r in old {
+            let name: String = r.try_get_by_index(0).unwrap();
+            admin.db.execute_unprepared(&format!("DROP SCHEMA IF EXISTS {name} CASCADE")).await.unwrap();
+        }
+        let schema = format!("ipxd_{pid}_{n}");
+        admin.db.execute_unprepared(&format!("CREATE SCHEMA {schema}")).await.unwrap();
+        let sep = if url.contains('?') { '&' } else { '?' };
+        Self::open(&format!("{url}{sep}options=-c%20search_path%3D{schema}%20-c%20client_min_messages%3Dwarning")).await.unwrap()
+    }
+
+    pub async fn open(url: &str) -> Result<Self> {
+        let mut url = url.to_owned();
+        if url.starts_with("postgres") && !url.contains("options=") {
+            // Postgres sends a notice for every CREATE ... IF NOT EXISTS on something that exists;
+            // asking for none keeps them out of the log, as ipx's connections do.
+            let sep = if url.contains('?') { '&' } else { '?' };
+            url = format!("{url}{sep}options=-c%20client_min_messages%3Dwarning");
+        }
+        let mut opts = sea_orm::ConnectOptions::new(url.clone());
+        opts.sqlx_logging(false);
+        // An in-memory SQLite database is one per connection: a pool of them would be several.
+        if url.contains(":memory:") {
+            opts.max_connections(1);
+        }
+        let db = sea_orm::Database::connect(opts).await?;
+        for sql in SCHEMA {
+            db.execute_unprepared(sql).await?;
+        }
+        // Added after the first deploy: a database made before has the table without them.
+        if db.execute_unprepared("SELECT category FROM snapshots WHERE false").await.is_err() {
+            db.execute_unprepared("ALTER TABLE snapshots ADD COLUMN category TEXT").await?;
+            db.execute_unprepared("ALTER TABLE snapshots ADD COLUMN subcategory TEXT").await?;
+        }
+        Ok(Self { db })
+    }
+
+    fn stmt(&self, sql: &str, values: Vec<Value>) -> Statement {
+        Statement::from_sql_and_values(self.db.get_database_backend(), sql, values)
+    }
+
+    async fn exec(&self, sql: &str, values: Vec<Value>) -> Result<u64> {
+        Ok(self.db.execute_raw(self.stmt(sql, values)).await?.rows_affected())
+    }
+
+    async fn rows(&self, sql: &str, values: Vec<Value>) -> Result<Vec<sea_orm::QueryResult>> {
+        Ok(self.db.query_all_raw(self.stmt(sql, values)).await?)
+    }
+
+    pub async fn ping(&self) -> Result<()> {
+        self.rows("SELECT 1", vec![]).await?;
+        Ok(())
+    }
+
+    /// Replaces everything `instance` sent before with `entries`. A private-looking address or a
+    /// blocked feed is left out and counted; the rest are added to the feeds, new ones to be
+    /// fetched by the refresher. Feeds no instance sends any more go.
+    pub async fn snapshot(&self, instance: &str, entries: &[SnapshotEntry]) -> Result<SnapshotResult> {
+        let blocked: std::collections::HashSet<String> =
+            self.rows("SELECT id FROM blocked", vec![]).await?.iter().map(|r| r.try_get("", "id")).collect::<Result<_, _>>()?;
+        let mut result = SnapshotResult::default();
+        let mut keep = std::collections::BTreeMap::new();
+        for e in entries {
+            let Some(url) = normalise(&e.url) else {
+                result.refused_invalid += 1;
+                continue;
+            };
+            // Checked here as well as by the sender: one instance's miss must not publish
+            // someone's paid feed to every other.
+            if ipx_feed::url_looks_private(&url) {
+                result.refused_private += 1;
+                continue;
+            }
+            let id = feed_id(&url);
+            if blocked.contains(&id) {
+                result.refused_blocked += 1;
+                continue;
+            }
+            // The same feed twice in one snapshot counts once, at its larger number.
+            let n = e.subscribers.max(0);
+            let path = e.category.as_deref().map(str::trim).filter(|c| !c.is_empty()).map(ipx_feed::category_path);
+            let slot = keep.entry(id).or_insert((url, n, path.clone()));
+            slot.1 = slot.1.max(n);
+            if slot.2.is_none() {
+                slot.2 = path;
+            }
+        }
+        result.accepted = keep.len();
+
+        let tx = self.db.begin().await?;
+        let backend = tx.get_database_backend();
+        let run = |sql: &str, values: Vec<Value>| Statement::from_sql_and_values(backend, sql, values);
+        tx.execute_raw(run("DELETE FROM snapshots WHERE instance = $1", vec![instance.into()])).await?;
+        for (id, (url, n, path)) in &keep {
+            tx.execute_raw(run(
+                "INSERT INTO feeds (id, url) VALUES ($1, $2) ON CONFLICT (id) DO NOTHING",
+                vec![id.clone().into(), url.clone().into()],
+            ))
+            .await?;
+            tx.execute_raw(run(
+                "INSERT INTO snapshots (instance, feed_id, subscribers, category, subcategory) VALUES ($1, $2, $3, $4, $5)",
+                vec![
+                    instance.into(),
+                    id.clone().into(),
+                    (*n).into(),
+                    path.as_ref().map(|p| p.0.clone()).into(),
+                    path.as_ref().and_then(|p| p.1.clone()).into(),
+                ],
+            ))
+            .await?;
+        }
+        tx.execute_raw(run("DELETE FROM feeds WHERE id NOT IN (SELECT feed_id FROM snapshots)", vec![])).await?;
+        tx.commit().await?;
+        Ok(result)
+    }
+
+    /// Drops the snapshots of every instance not in `names`: a token taken out of the config
+    /// file takes its counts with it.
+    pub async fn keep_instances(&self, names: &[String]) -> Result<u64> {
+        let mut dropped = 0;
+        let present: Vec<String> = self
+            .rows("SELECT DISTINCT instance FROM snapshots", vec![])
+            .await?
+            .iter()
+            .map(|r| r.try_get("", "instance"))
+            .collect::<Result<_, _>>()?;
+        for name in present.iter().filter(|n| !names.contains(n)) {
+            dropped += self.drop_instance(name).await?;
+        }
+        Ok(dropped)
+    }
+
+    /// Drops what one instance sent; how many feeds it had.
+    pub async fn drop_instance(&self, name: &str) -> Result<u64> {
+        let n = self.exec("DELETE FROM snapshots WHERE instance = $1", vec![name.into()]).await?;
+        self.exec("DELETE FROM feeds WHERE id NOT IN (SELECT feed_id FROM snapshots)", vec![]).await?;
+        Ok(n)
+    }
+
+    // The feed's own category, or else one a sending server's admin gave it.
+    // Only feeds read as a feed at least once (`items` set): never an OPML a server sent before it
+    // knew it was one, nor an address that has never worked.
+    const LISTING: &str = "SELECT f.id, f.url, f.title, f.image,
+            CASE WHEN f.category IS NULL THEN max(s.category) ELSE f.category END AS category,
+            CASE WHEN f.category IS NULL THEN max(s.subcategory) ELSE f.subcategory END AS subcategory,
+            f.podcast, CAST(sum(s.subscribers) AS BIGINT) AS subscribers
+         FROM feeds f JOIN snapshots s ON s.feed_id = f.id WHERE f.items IS NOT NULL";
+
+    fn listing(r: &sea_orm::QueryResult) -> Result<Listing> {
+        Ok(Listing {
+            id: r.try_get("", "id")?,
+            url: r.try_get("", "url")?,
+            title: r.try_get("", "title")?,
+            image: r.try_get("", "image")?,
+            category: r.try_get("", "category")?,
+            subcategory: r.try_get("", "subcategory")?,
+            podcast: r.try_get("", "podcast")?,
+            subscribers: r.try_get("", "subscribers")?,
+        })
+    }
+
+    /// Every feed, A to Z by title (one not fetched yet has none and sorts by its address).
+    ///
+    /// ponytail: the whole list in one answer, as ipx's own Directory was; page it when it
+    /// grows past a few thousand feeds.
+    pub async fn list(&self) -> Result<Vec<Listing>> {
+        let sql = format!("{} GROUP BY f.id ORDER BY lower(coalesce(f.title, f.url)), f.id", Self::LISTING);
+        self.rows(&sql, vec![]).await?.iter().map(Self::listing).collect()
+    }
+
+    /// The most subscribed, most first.
+    pub async fn popular(&self, limit: u64) -> Result<Vec<Listing>> {
+        let sql = format!(
+            "{} GROUP BY f.id ORDER BY sum(s.subscribers) DESC, lower(coalesce(f.title, f.url)), f.id LIMIT $1",
+            Self::LISTING
+        );
+        self.rows(&sql, vec![(limit as i64).into()]).await?.iter().map(Self::listing).collect()
+    }
+
+    /// One feed with its description and latest items.
+    pub async fn feed(&self, id: &str) -> Result<Option<FeedPage>> {
+        let sql = format!("{} AND f.id = $1 GROUP BY f.id", Self::LISTING);
+        let Some(r) = self.rows(&sql, vec![id.into()]).await?.into_iter().next() else { return Ok(None) };
+        let listing = Self::listing(&r)?;
+        let r = self
+            .rows("SELECT description, items, last_error, error_since FROM feeds WHERE id = $1", vec![id.into()])
+            .await?
+            .into_iter()
+            .next()
+            .ok_or_else(|| anyhow::anyhow!("feed {id} went while it was read"))?;
+        let items: Option<String> = r.try_get("", "items")?;
+        let last_error: Option<String> = r.try_get("", "last_error")?;
+        let error_since: Option<i64> = r.try_get("", "error_since")?;
+        Ok(Some(FeedPage {
+            listing,
+            description: r.try_get("", "description")?,
+            failing: last_error.map(|e| failure_words(&e, now() - error_since.unwrap_or_else(now))),
+            items: items.and_then(|i| serde_json::from_str(&i).ok()).unwrap_or_default(),
+        }))
+    }
+
+    /// Removes a feed and blocks it, so no snapshot brings it back. False when it was neither
+    /// listed nor blocked already.
+    pub async fn block(&self, id: &str) -> Result<bool> {
+        let r = self.rows("SELECT url, title FROM feeds WHERE id = $1", vec![id.into()]).await?.into_iter().next();
+        let (url, title): (Option<String>, Option<String>) = match &r {
+            Some(r) => (r.try_get("", "url")?, r.try_get("", "title")?),
+            None => (None, None),
+        };
+        let added = self
+            .exec(
+                "INSERT INTO blocked (id, url, title, at) VALUES ($1, $2, $3, $4) ON CONFLICT (id) DO NOTHING",
+                vec![id.into(), url.into(), title.into(), now().into()],
+            )
+            .await?;
+        self.exec("DELETE FROM snapshots WHERE feed_id = $1", vec![id.into()]).await?;
+        let removed = self.exec("DELETE FROM feeds WHERE id = $1", vec![id.into()]).await?;
+        Ok(added + removed > 0)
+    }
+
+    /// Unblocks a feed; it comes back with the next snapshot that has it.
+    pub async fn unblock(&self, id: &str) -> Result<bool> {
+        Ok(self.exec("DELETE FROM blocked WHERE id = $1", vec![id.into()]).await? > 0)
+    }
+
+    pub async fn instances(&self) -> Result<Vec<Instance>> {
+        // Postgres sums a BIGINT as NUMERIC, which does not read as an i64.
+        self.rows(
+            "SELECT instance, count(*) AS feeds, CAST(sum(subscribers) AS BIGINT) AS subscribers
+             FROM snapshots GROUP BY instance ORDER BY instance",
+            vec![],
+        )
+        .await?
+        .iter()
+        .map(|r| Ok(Instance { name: r.try_get("", "instance")?, feeds: r.try_get("", "feeds")?, subscribers: r.try_get("", "subscribers")? }))
+        .collect()
+    }
+
+    pub async fn blocked(&self) -> Result<Vec<Blocked>> {
+        self.rows("SELECT id, url, title, at FROM blocked ORDER BY at DESC, id", vec![])
+            .await?
+            .iter()
+            .map(|r| Ok(Blocked { id: r.try_get("", "id")?, url: r.try_get("", "url")?, title: r.try_get("", "title")?, at: r.try_get("", "at")? }))
+            .collect()
+    }
+
+    /// Feeds never fetched, then those fetched longest ago, older than `every` seconds.
+    pub async fn due(&self, every: i64, limit: u64) -> Result<Vec<Due>> {
+        self.rows(
+            "SELECT id, url, etag, last_modified FROM feeds
+             WHERE checked_at IS NULL OR checked_at < $1
+             ORDER BY coalesce(checked_at, 0), id LIMIT $2",
+            vec![(now() - every).into(), (limit as i64).into()],
+        )
+        .await?
+        .iter()
+        .map(|r| {
+            Ok(Due {
+                id: r.try_get("", "id")?,
+                url: r.try_get("", "url")?,
+                etag: r.try_get("", "etag")?,
+                last_modified: r.try_get("", "last_modified")?,
+            })
+        })
+        .collect()
+    }
+
+    pub async fn due_one(&self, id: &str) -> Result<Option<Due>> {
+        Ok(self
+            .rows("SELECT id, url, etag, last_modified FROM feeds WHERE id = $1", vec![id.into()])
+            .await?
+            .first()
+            .map(|r| -> Result<Due> {
+                Ok(Due {
+                    id: r.try_get("", "id")?,
+                    url: r.try_get("", "url")?,
+                    etag: r.try_get("", "etag")?,
+                    last_modified: r.try_get("", "last_modified")?,
+                })
+            })
+            .transpose()?)
+    }
+
+    pub async fn save(&self, id: &str, got: Refreshed) -> Result<()> {
+        let t = now();
+        match got {
+            Refreshed::NotModified => {
+                self.exec("UPDATE feeds SET checked_at = $1, last_error = NULL, error_since = NULL WHERE id = $2", vec![t.into(), id.into()]).await?;
+            }
+            Refreshed::Failed(err) => {
+                self.exec(
+                    "UPDATE feeds SET checked_at = $1, last_error = $2, error_since = coalesce(error_since, $1) WHERE id = $3",
+                    vec![t.into(), err.into(), id.into()],
+                )
+                .await?;
+            }
+            Refreshed::Feed { parsed, etag, last_modified } => {
+                let path = parsed.category.as_deref().map(ipx_feed::category_path);
+                let podcast = parsed.entries.iter().flat_map(|e| &e.enclosures).any(|e| {
+                    e.mime.as_deref().is_some_and(|m| m.starts_with("audio/") || m.starts_with("video/"))
+                });
+                let mut entries = parsed.entries;
+                entries.sort_by_key(|e| std::cmp::Reverse(e.published));
+                // What an item is, never its files: their addresses are where a key would be.
+                let items: Vec<Item> = entries
+                    .into_iter()
+                    .take(ITEMS)
+                    .map(|e| Item { guid: e.guid, title: e.title, link: e.link, published: e.published, duration: e.duration, description: e.description })
+                    .collect();
+                self.exec(
+                    "UPDATE feeds SET title = $1, image = $2, category = $3, subcategory = $4, description = $5,
+                        podcast = $6, items = $7, etag = $8, last_modified = $9, checked_at = $10,
+                        last_error = NULL, error_since = NULL
+                     WHERE id = $11",
+                    vec![
+                        parsed.title.into(),
+                        parsed.image.into(),
+                        path.as_ref().map(|p| p.0.clone()).into(),
+                        path.and_then(|p| p.1).into(),
+                        parsed.description.into(),
+                        podcast.into(),
+                        serde_json::to_string(&items)?.into(),
+                        etag.into(),
+                        last_modified.into(),
+                        t.into(),
+                        id.into(),
+                    ],
+                )
+                .await?;
+            }
+        }
+        Ok(())
+    }
+}
+
+/// A feed's last error as its page says it: explained once it has been failing a day, or else
+/// only that the check failed. Never the error itself, which is for the log.
+fn failure_words(err: &str, failing_for: i64) -> String {
+    Some(err)
+        .filter(|_| failing_for >= FLAG_AFTER_SECS)
+        .and_then(ipx_feed::explain_failure)
+        .map_or_else(|| "Its last check failed.".to_owned(), |f| f.reason.to_owned())
+}
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use super::*;
+
+    /// Reads the fixture feed as every feed waiting to be fetched, as the refresher would.
+    pub(crate) async fn fetch_all(s: &Store) {
+        for d in s.due(0, 100).await.unwrap() {
+            let parsed = ipx_feed::parse(include_bytes!("../../../tests/data/rss2.xml")).unwrap();
+            s.save(&d.id, Refreshed::Feed { parsed, etag: None, last_modified: None }).await.unwrap();
+        }
+    }
+
+    fn e(url: &str, n: i64) -> SnapshotEntry {
+        SnapshotEntry { url: url.into(), subscribers: n, category: None }
+    }
+
+    #[test]
+    fn a_failure_is_explained_after_a_day_and_never_names_its_address() {
+        let nothing = "the feed's address answered with nothing at all";
+        assert_eq!(failure_words(nothing, FLAG_AFTER_SECS), "This address answers with nothing; the site may be gone.");
+        // Not before it has been failing a day, as on the feed's own page in ipx (#143).
+        assert_eq!(failure_words(nothing, 3600), "Its last check failed.");
+        let raw = "error sending request for url (http://daily-quests.com/comic/?feed=atom): connection closed";
+        assert_eq!(failure_words(raw, FLAG_AFTER_SECS), "Its last check failed.");
+    }
+
+    #[test]
+    fn every_instance_writes_one_feed_the_same_way() {
+        let a = normalise("HTTPS://Example.COM:443/feed.xml#top").unwrap();
+        assert_eq!(a, "https://example.com/feed.xml");
+        assert_eq!(feed_id(&a), feed_id(&normalise("https://example.com/feed.xml").unwrap()));
+        assert_eq!(feed_id(&a).len(), 16);
+        assert!(normalise("ftp://example.com/x").is_none());
+        assert!(normalise("not a url").is_none());
+    }
+
+    #[tokio::test]
+    async fn snapshots_replace_what_an_instance_sent_and_add_up_across_instances() {
+        let s = Store::scratch().await;
+        let r = s
+            .snapshot("a", &[e("https://x.test/a.xml", 3), e("https://x.test/b.xml", 1), e("https://x.test/a.xml", 5)])
+            .await
+            .unwrap();
+        assert_eq!(r.accepted, 2);
+        s.snapshot("b", &[e("https://x.test/a.xml", 2)]).await.unwrap();
+        // Nothing is listed until it has been read as a feed.
+        assert!(s.list().await.unwrap().is_empty());
+        fetch_all(&s).await;
+        let pop = s.popular(10).await.unwrap();
+        assert_eq!((pop[0].url.as_str(), pop[0].subscribers), ("https://x.test/a.xml", 7));
+        assert_eq!(pop[1].subscribers, 1);
+
+        // a no longer has b.xml: nobody does, so it goes.
+        s.snapshot("a", &[e("https://x.test/a.xml", 1)]).await.unwrap();
+        let all = s.list().await.unwrap();
+        assert_eq!(all.len(), 1);
+        assert_eq!(all[0].subscribers, 3);
+
+        let i = s.instances().await.unwrap();
+        assert_eq!(i.iter().map(|i| (i.name.as_str(), i.feeds, i.subscribers)).collect::<Vec<_>>(), [("a", 1, 1), ("b", 1, 2)]);
+
+        // A token taken out of the config file takes its counts.
+        s.keep_instances(&["b".into()]).await.unwrap();
+        assert_eq!(s.list().await.unwrap()[0].subscribers, 2);
+        s.drop_instance("b").await.unwrap();
+        assert!(s.list().await.unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn private_looking_addresses_and_blocked_feeds_are_refused() {
+        let s = Store::scratch().await;
+        let r = s
+            .snapshot(
+                "a",
+                &[
+                    e("https://feeds.supercast.com/feeds/abc123", 1),
+                    e("https://x.test/feed?token=secret", 1),
+                    e("https://user:pass@x.test/feed", 1),
+                    e("https://www.patreon.com/rss/show?auth=k", 1),
+                    e("mailto:x@y", 1),
+                    e("https://x.test/public.xml", 1),
+                ],
+            )
+            .await
+            .unwrap();
+        assert_eq!((r.accepted, r.refused_private, r.refused_invalid), (1, 4, 1));
+        fetch_all(&s).await;
+
+        let id = s.list().await.unwrap()[0].id.clone();
+        assert!(s.block(&id).await.unwrap());
+        assert!(s.list().await.unwrap().is_empty());
+        let r = s.snapshot("a", &[e("https://x.test/public.xml", 1)]).await.unwrap();
+        assert_eq!((r.accepted, r.refused_blocked), (0, 1));
+        assert_eq!(s.blocked().await.unwrap()[0].url.as_deref(), Some("https://x.test/public.xml"));
+        assert!(s.unblock(&id).await.unwrap());
+        assert_eq!(s.snapshot("a", &[e("https://x.test/public.xml", 1)]).await.unwrap().accepted, 1);
+    }
+
+    #[tokio::test]
+    async fn a_feed_naming_no_category_takes_the_one_a_server_gave_it() {
+        let s = Store::scratch().await;
+        let entry = |c: Option<&str>| SnapshotEntry { url: "https://x.test/blog.xml".into(), subscribers: 1, category: c.map(Into::into) };
+        s.snapshot("a", &[entry(Some("Visual Arts"))]).await.unwrap();
+        let d = s.due(0, 10).await.unwrap().remove(0);
+        let mut parsed = ipx_feed::parse(include_bytes!("../../../tests/data/rss2.xml")).unwrap();
+        parsed.category = None;
+        s.save(&d.id, Refreshed::Feed { parsed, etag: None, last_modified: None }).await.unwrap();
+        let l = s.list().await.unwrap().remove(0);
+        assert_eq!((l.category.as_deref(), l.subcategory.as_deref()), (Some("Arts"), Some("Visual Arts")));
+        s.snapshot("a", &[entry(None)]).await.unwrap();
+        assert_eq!(s.list().await.unwrap()[0].category, None);
+    }
+
+    #[tokio::test]
+    async fn a_fetched_feed_shows_its_metadata_and_newest_items_but_no_files() {
+        let s = Store::scratch().await;
+        s.snapshot("a", &[e("https://x.test/feed.xml", 1)]).await.unwrap();
+        let due = s.due(3600, 10).await.unwrap();
+        assert_eq!(due.len(), 1);
+        let parsed = ipx_feed::parse(include_bytes!("../../../tests/data/rss2.xml")).unwrap();
+        let title = parsed.title.clone();
+        s.save(&due[0].id, Refreshed::Feed { parsed, etag: Some("e".into()), last_modified: None }).await.unwrap();
+        assert!(s.due(3600, 10).await.unwrap().is_empty());
+        let page = s.feed(&due[0].id).await.unwrap().unwrap();
+        assert_eq!(page.listing.title, title);
+        assert!(page.listing.podcast);
+        assert!(!page.items.is_empty() && page.items.len() <= ITEMS);
+        assert!(page.items.windows(2).all(|w| w[0].published >= w[1].published));
+        assert!(page.failing.is_none());
+        let json = serde_json::to_string(&page).unwrap();
+        assert!(!json.contains(".mp3"), "an item's file must not be in its page: {json}");
+
+        s.save(&due[0].id, Refreshed::Failed("HTTP 404 Not Found".into())).await.unwrap();
+        let page = s.feed(&due[0].id).await.unwrap().unwrap();
+        assert_eq!(page.failing.as_deref(), Some("Its last check failed."));
+        assert_eq!(page.listing.title, title, "a failure keeps what was found before");
+    }
+}

crates/feed/Cargo.toml

@@ -0,0 +1,20 @@
+[package]
+name = "ipx-feed"
+version = "0.0.0"
+publish = false
+edition.workspace = true
+
+[dependencies]
+anyhow.workspace = true
+atom_syndication.workspace = true
+chrono.workspace = true
+opml.workspace = true
+quick-xml.workspace = true
+reqwest.workspace = true
+rss.workspace = true
+serde_json.workspace = true
+tracing.workspace = true
+url.workspace = true
+
+[dev-dependencies]
+tokio.workspace = true

crates/feed/src/lib.rs

@@ -1,11 +1,10 @@
-//! Feed fetching and parsing. Replaces FeedData.__getFeed / __getEntries.
+//! Feed fetching and parsing, shared by ipx and the directory (#202). Replaces
+//! FeedData.__getFeed / __getEntries.
 
 use anyhow::{Context, Result, anyhow};
 use reqwest::StatusCode;
 use reqwest::header::{ETAG, IF_MODIFIED_SINCE, IF_NONE_MATCH, LAST_MODIFIED};
 
-use crate::config::Feed as FeedCfg;
-
 #[derive(Debug, Default)]
 pub struct ParsedFeed {
     pub title: Option<String>,
@@ -62,19 +61,44 @@ pub enum Fetched {
 /// downloads, which are not, have no such limit.
 pub const FEED_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(30);
 
+/// Feeds fetched and the bytes of their bodies, since the process started, for /metrics to set
+/// beside memory (#224): a body is read whole, so a night of large feeds is a night of large
+/// allocations.
+pub static FETCHES: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+pub static FETCHED_BYTES: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+
 /// Conditional GET, following redirects itself: `client` must follow none (`feed_client`), so
 /// each hop is seen. The second value is where the feed now is when every hop said so for good
 /// (301 or 308): a publisher that moved its feed, which the catalogue should follow rather
 /// than be redirected on every read. A temporary redirect (302, 307) moves nothing.
 /// `system-proxy` reads http_proxy/https_proxy.
-#[tracing::instrument(skip_all, fields(url = %cfg.url))]
+/// `auth` is a username and password, sent only to the feed's own host.
+/// An address as a trace may keep it: without its query or user and password, where a private
+/// feed carries its credential (Patreon's `?auth=`), which Tempo kept for anyone reading it (#225).
+/// shortcut: a token in the path (`/feed/<token>.xml`) stays; strip paths too if a feed does that.
+pub fn redact(url: &str) -> String {
+    match url::Url::parse(url) {
+        Ok(mut u) => {
+            u.set_query(None);
+            u.set_fragment(None);
+            let _ = u.set_username("");
+            let _ = u.set_password(None);
+            u.to_string()
+        }
+        // Not an address ipx could fetch; keep what comes before anything that could be a query.
+        Err(_) => url.split(['?', '#', '@']).next().unwrap_or_default().to_owned(),
+    }
+}
+
+#[tracing::instrument(skip_all, fields(url = %redact(feed_url), http.response.body.size))]
 pub async fn fetch(
     client: &reqwest::Client,
-    cfg: &FeedCfg,
+    feed_url: &str,
+    auth: Option<(&str, Option<String>)>,
     etag: Option<&str>,
     last_modified: Option<&str>,
 ) -> Result<(Fetched, Option<String>)> {
-    let start = reqwest::Url::parse(&cfg.url).context("the feed's address")?;
+    let start = reqwest::Url::parse(feed_url).context("the feed's address")?;
     let mut url = start.clone();
     let mut permanent = true;
     for _ in 0..10 {
@@ -86,10 +110,10 @@ pub async fn fetch(
             req = req.header(IF_MODIFIED_SINCE, lm);
         }
         // The feed's own host only: a redirect elsewhere must not be handed the password.
-        if let Some(user) = &cfg.username
+        if let Some((user, password)) = &auth
             && url.host_str() == start.host_str()
         {
-            req = req.basic_auth(user, cfg.password());
+            req = req.basic_auth(user, password.as_deref());
         }
 
         let resp = req.send().await.context("connecting")?;
@@ -105,6 +129,7 @@ pub async fn fetch(
             continue;
         }
         let moved = (permanent && url != start).then(|| url.to_string());
+        FETCHES.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
         if status == StatusCode::NOT_MODIFIED {
             return Ok((Fetched::NotModified, moved));
         }
@@ -118,6 +143,8 @@ pub async fn fetch(
         let etag = header(ETAG);
         let last_modified = header(LAST_MODIFIED);
         let bytes = resp.bytes().await.context("reading body")?.to_vec();
+        tracing::Span::current().record("http.response.body.size", bytes.len());
+        FETCHED_BYTES.fetch_add(bytes.len() as u64, std::sync::atomic::Ordering::Relaxed);
         return Ok((Fetched::Body { bytes, etag, last_modified }, moved));
     }
     // Worded as reqwest worded it, which failure_kind reads as a redirect loop.
@@ -196,15 +223,25 @@ pub fn explain_failure(msg: &str) -> Option<Failure> {
     if low.contains("http 402") {
         return Some(Failure { reason: "The feed now needs a paid plan.", new_url: None });
     }
-    if low.contains("dns error")
+    // Only a name that does not exist. A lookup that failed for the moment says nothing about the
-        || low.contains("failed to lookup address")
+    // site, and NPR's and Megaphone's feeds were labelled gone after a DNS outage (#143).
-        || low.contains("no address associated")
+    if !is_temporary_lookup_failure(msg)
+        && (low.contains("dns error") || low.contains("failed to lookup address") || low.contains("no address associated"))
     {
-        return Some(Failure { reason: "This address no longer resolves; the site is gone.", new_url: None });
+        return Some(Failure { reason: "This address no longer resolves; the site may be gone.", new_url: None });
     }
     None
 }
 
+/// A host that could not be looked up for the moment -- the resolver's EAI_AGAIN, glibc's
+/// "Temporary failure in name resolution", musl's "Try again" -- as against a name that does
+/// not exist ("Name or service not known"). It says the network was not answering, not that the
+/// feed is gone (#143).
+pub fn is_temporary_lookup_failure(msg: &str) -> bool {
+    let low = msg.to_ascii_lowercase();
+    low.contains("dns error") && (low.contains("temporary failure in name resolution") || low.contains("try again"))
+}
+
 /// True when a body is an OPML document rather than a feed.
 ///
 /// The original matched on the URL ending in ".opml" (iPXClass.py:34), which misses an
@@ -221,10 +258,21 @@ pub fn parse_opml(bytes: &[u8]) -> Result<Vec<(String, String)>> {
     let doc = opml::OPML::from_str(&text)
         .map_err(|e| anyhow!("that does not parse as OPML: {e}"))?;
     let mut out = vec![];
-    crate::collect_outlines(&doc.body.outlines, &mut out);
+    collect_outlines(&doc.body.outlines, &mut out);
     Ok(out)
 }
 
+/// OPML nests feeds inside folder outlines, so this walks the whole tree.
+pub fn collect_outlines(outlines: &[opml::Outline], out: &mut Vec<(String, String)>) {
+    for o in outlines {
+        if let Some(url) = &o.xml_url {
+            let title = o.title.clone().unwrap_or_else(|| o.text.clone());
+            out.push((title, url.clone()));
+        }
+        collect_outlines(&o.outlines, out);
+    }
+}
+
 /// The <head><title> of an OPML document.
 pub fn opml_title(bytes: &[u8]) -> Option<String> {
     let text = String::from_utf8_lossy(bytes);
@@ -342,6 +390,7 @@ fn parse_patreon_shows(json: &[u8]) -> Result<(Option<String>, Vec<(String, Stri
 }
 
 /// RSS first, then Atom -- the same split the original made on `parsedFeed.version`.
+#[tracing::instrument(skip_all, fields(bytes = bytes.len()))]
 pub fn parse(bytes: &[u8]) -> Result<ParsedFeed> {
     match rss::Channel::read_from(bytes) {
         Ok(ch) => Ok(from_rss(ch, bytes)),
@@ -1111,8 +1160,60 @@ fn picked(answer: &serde_json::Value) -> Result<String> {
         .ok_or_else(|| anyhow!("no category in the answer: {answer}"))
 }
 
+/// An address that carries a subscriber's own access: a paid-feed host, credentials in the URL,
+/// or a key in the query. ipx leaves such a feed out of anything others see, and the directory
+/// refuses one sent to it (#202).
+///
+/// ponytail: a heuristic. A key hidden in the path of a host not in `PAID_HOSTS` gets
+/// through; a per-feed private flag is the upgrade (#205).
+pub fn url_looks_private(feed_url: &str) -> bool {
+    let Ok(u) = url::Url::parse(feed_url) else { return true };
+    // Paid-feed services put the subscriber's key in the path as often as in the query, and a
+    // long path segment alone proves nothing (acast's public show ids look the same). So a
+    // feed from one of them is private whatever its URL looks like. Supercast is why this
+    // exists: `feeds.supercast.com/feeds/<key>` reached the directory before it did.
+    let host = u.host_str().unwrap_or("");
+    PAID_HOSTS.iter().any(|h| host == *h || host.ends_with(&format!(".{h}")))
+        || !u.username().is_empty()
+        || u.password().is_some()
+        || u.query_pairs().any(|(k, _)| {
+            let k = k.to_ascii_lowercase();
+            ["auth", "token", "key", "secret", "pass", "sig", "session", "user", "uid"]
+                .iter()
+                .any(|w| k.contains(w))
+        })
+}
+
+/// Services whose feeds are always one subscriber's own.
+const PAID_HOSTS: &[&str] =
+    &["patreon.com", "supercast.com", "supportingcast.fm", "glow.fm", "memberful.com"];
+
 #[cfg(test)]
 mod tests {
+    #[test]
+    fn redact_drops_what_carries_a_credential() {
+        assert_eq!(super::redact("https://www.patreon.com/rss/x?auth=SECRET&show=1"), "https://www.patreon.com/rss/x");
+        assert_eq!(super::redact("https://me:pw@example.com/feed.xml#top"), "https://example.com/feed.xml");
+        assert_eq!(super::redact("https://example.com/feed.xml"), "https://example.com/feed.xml");
+        assert_eq!(super::redact("not a url?token=SECRET"), "not a url");
+    }
+
+    #[test]
+    fn an_address_carrying_someones_access_looks_private() {
+        let private = super::url_looks_private;
+        assert!(!private("https://feeds.twit.tv/twit.xml"));
+        // Patreon's shape: the key is a query parameter.
+        assert!(private("https://www.patreon.com/rss/x?auth=abc123&show=2073588"));
+        assert!(private("https://example.com/rss?api_key=abc"));
+        // Paid-feed services put the key in the path; the host gives them away.
+        assert!(private("https://feeds.supercast.com/feeds/abcdefghijklmnopqrstuvwx"));
+        assert!(private("https://someshow.supportingcast.fm/content/abc123.rss"));
+        // A long path segment alone is not a key: acast's public show ids look the same.
+        assert!(!private("https://feeds.acast.com/public/shows/0123456789abcdef01234567"));
+        assert!(private("https://ray:hunter2@example.com/rss"));
+        assert!(private("not a url"), "unparseable is not safe to list");
+    }
+
     /// A server answering by path: /old moves for good to /new, /tmp for now, /chain for good
     /// to /tmp, /new is the feed.
     async fn redirecting_server() -> String {
@@ -1147,9 +1248,9 @@ mod tests {
         let base = redirecting_server().await;
         let client = reqwest::Client::builder().redirect(reqwest::redirect::Policy::none()).build().unwrap();
         let get = |path: &str| {
-            let cfg: crate::config::Feed = serde_json::from_value(serde_json::json!({ "url": format!("{base}{path}") })).unwrap();
+            let url = format!("{base}{path}");
             let client = client.clone();
-            async move { super::fetch(&client, &cfg, None, None).await }
+            async move { super::fetch(&client, &url, None, None, None).await }
         };
         let (got, moved) = get("/old").await.unwrap();
         assert!(matches!(got, super::Fetched::Body { .. }));
@@ -1165,7 +1266,7 @@ mod tests {
 
     #[test]
     fn parses_rss_with_itunes_extensions() {
-        let bytes = include_bytes!("../tests/data/rss2.xml");
+        let bytes = include_bytes!("../../../tests/data/rss2.xml");
         let feed = parse(bytes).unwrap();
 
         assert_eq!(feed.title.as_deref(), Some("Test Cast"));
@@ -1317,8 +1418,13 @@ mod tests {
             explain_failure("the feed's address answered with nothing at all").unwrap().reason,
             "This address answers with nothing; the site may be gone."
         );
-        let dns = explain_failure("connecting: dns error: failed to lookup address information").unwrap();
+        let dns = explain_failure("connecting: dns error: failed to lookup address information: Name or service not known").unwrap();
-        assert_eq!(dns.reason, "This address no longer resolves; the site is gone.");
+        assert_eq!(dns.reason, "This address no longer resolves; the site may be gone.");
+        // A lookup that failed for the moment is not a site gone (#143).
+        let blip = "connecting: dns error: failed to lookup address information: Temporary failure in name resolution";
+        assert!(is_temporary_lookup_failure(blip));
+        assert!(explain_failure(blip).is_none());
+        assert!(!is_temporary_lookup_failure("connecting: dns error: failed to lookup address information: Name or service not known"));
         let moved = explain_failure("got a web page, not a feed; it links https://x/feed as its feed").unwrap();
         assert_eq!(moved.new_url.as_deref(), Some("https://x/feed"));
         assert!(explain_failure("got a web page, not a feed").unwrap().new_url.is_none());
@@ -1366,7 +1472,7 @@ mod tests {
 
     #[test]
     fn parses_atom_enclosure_links() {
-        let bytes = include_bytes!("../tests/data/atom.xml");
+        let bytes = include_bytes!("../../../tests/data/atom.xml");
         let feed = parse(bytes).unwrap();
 
         assert_eq!(feed.title.as_deref(), Some("Atom Cast"));
@@ -1464,8 +1570,8 @@ mod tests {
         assert_eq!(feeds[0], ("Alpha".into(), "https://a.example/rss".into()));
 
         // A feed must never be mistaken for a subscription list.
-        assert!(!is_opml(include_bytes!("../tests/data/rss2.xml")));
+        assert!(!is_opml(include_bytes!("../../../tests/data/rss2.xml")));
-        assert!(!is_opml(include_bytes!("../tests/data/atom.xml")));
+        assert!(!is_opml(include_bytes!("../../../tests/data/atom.xml")));
     }
 
     #[test]

crates/ipx/CHANGELOG.md

@@ -1,12 +1,120 @@
-# Changelog
+# Changelog: ipx
 
-All notable changes to this project will be documented in this file.
+The daemon: the API, scans, downloads, DeadAir and the database. The page has its own changelog,
+[web/CHANGELOG.md](../../web/CHANGELOG.md), and the directory service its own,
+[crates/directory/CHANGELOG.md](../directory/CHANGELOG.md). Until 0.12.0 this was the changelog of
+all of ipx, the page included; they were split with the services (#207).
+
+Its version is in `crates/ipx/Cargo.toml`, and a release is tagged `vX.Y.Z`.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-10-13
+
+### Added
+
+- `/metrics` counts the feeds fetched and the bytes of their bodies (`ipx_feed_fetches_total`, `ipx_feed_bytes_total`), and a feed's trace says how large its body was (#224).
+
+### Changed
+
+- ipx uses mimalloc instead of glibc's allocator, which gives freed memory back to the system: with glibc's, the memory a night of scans needed stayed held until a restart (#224).
+- `docker-compose.yml` has no healthchecks: Docker runs them with exec, which can fail on the host while ipx is well. The library's counts in `/metrics` are kept every 30 s by the daemon itself (#218).
+
+### Security
+
+- Traces no longer keep a feed's or file's address with its query or password, where private feeds carry their credentials, such as Patreon's `auth` (#225).
+
+## [1.0.0] - 2026-10-12
+
+### Added
+
+- With a directory token that may administer it, ipx's admins remove a feed from the directory (blocking it) or check it now, list and unblock what is blocked, and list and drop the servers sharing (#206).
+- ipx passes its trace on when it calls the directory, so a Directory page is one trace from the browser to the directory (#213).
+
+### Changed
+
+- The Directory comes from a directory service that iPX servers share, set up in Admin, Directory with its address and this server's token, instead of only this server's feeds. Sharing this server's public feeds with it is a setting, never a private one, and subscriber counts are every sharing server's. ipx sends the directory its feeds when they change, and every half hour (#205, #211).
+- A feed can be marked private, which keeps it out of the directory. A feed with a login, or whose address carries a key, is private already (#205).
+- ipx serves no page: the page is ipx-web's, which passes the API on to ipx, and ipx is built without node (#203).
+- `docker-compose.yml` is a sample to start from, ipx alone on SQLite with its folders beside the file, instead of a copy of the author's server (#208).
+- The source is a Cargo workspace: the daemon in `crates/ipx`, feed fetching and parsing in `crates/feed`. `cargo build --release` still makes `target/release/ipx` (#202).
+
+## [0.12.0] - 2026-10-11
+
+### Added
+
+- With `[web] metrics_bind` set, ipx serves Prometheus metrics on a port and thread of their own: the database pool, the worker's job and queue, jobs done and their time, scans, downloads and requests in progress, download speed, live-update listeners and missed updates, DeadAir's backlog, the artwork cache's fill, hit rate and evictions, memory, open files and the library's counts. (#194, #195, #198, #199).
+- The page reports its errors, the player's, how long play takes to start and how long it stalls to the server's log, and the requests one tap sets off share a trace, the playlist, audio and saved place of what it played included (#190, #192).
+- Saving an episode from a show with DeadAir on saves it without its dead air, at your breathing room (#186).
+- Choose the pause DeadAir leaves where it cuts a silence, from 0.2 to 0.5 seconds, for each show in its settings, as its breathing room, on a slider from brisk to relaxed. It is 0.3 seconds unless you change it, up from 0.2, which made speech sound rushed (#182, #183).
+
+### Changed
+
+- DeadAir no longer makes a shortened copy of each episode. It plays the original with its long silences left out, ready a few seconds after the download, with no gap where a silence was cut and no extra disk space; the copies already made are removed (#179, #181, #196).
+- DeadAir is in the same box as a show's download settings, below them, and stays there when automatic downloads are off (#185).
+- The container is built on Debian 13 (trixie) instead of 12, so DeadAir uses ffmpeg 7.1 instead of 5.1 (#177).
+- On Postgres, ipx keeps up to 20 connections to the database instead of 10, for the bursts of a page load asking for many covers at once (#200).
+- Traces of the disk sweep, episode lists and DeadAir's work on each file show each step, and the sweep's trace says what it removed (#187).
+
+### Fixed
+
+- All Subscriptions, and every item list, comes up faster, most of all the first time after a quiet spell: it took half a second to two (#188).
+- Checking for new episodes no longer waits up to 12 seconds each time on a clear-out of dead feeds from the Directory, which now runs once a day (#193).
+- A page left open no longer misses updates after a check for new episodes: the note that each feed not due was skipped, one per feed, filled the queue they share (#197).
+
+### Security
+
+- Cloudflare no longer keeps a copy of the audio you play, which it served to anyone it let in without checking they subscribe (#189).
+
+## [0.11.0] - 2026-10-09
+
+### Added
+
+- DeadAir: turn it on for a show in its settings, or with the button beside the speed while it plays, and its episodes play with long silences shortened, so podcasts finish sooner without sounding sped up. Your place carries over when you turn it on or off, each episode says how much shorter it is ("Cutting dead air…" until it is done), and Settings shows the time it has saved you. It is off for every show until you turn it on (#171, #172, #173, #174, #176).
+
+### Fixed
+
+- A downloaded file's play, save, share and delete buttons stay on one row in the Files pane, instead of delete wrapping underneath (#175).
+- Cover art up to 20 MB is shown, instead of nothing for anything over 5 MB, as for five of the Glass Cannon Network's feeds.
+- Seeking in an episode while many people listen answers in about 10 ms instead of 40, and files stream about four times as fast: each connection now sends what is ready without waiting for the browser to acknowledge the last part.
+- Artwork that could not be fetched is not fetched again for an hour, instead of on every page load, and the server's log says which image it was and why.
+
+## [0.10.3] - 2026-10-09
+
+### Changed
+
+- Swiping past the last item shows the theme's accent colour, without the words "No more items".
+- An empty list and the reader with nothing picked say nothing, instead of "Nothing here yet — try Scan now." and "Pick an item to read it."; a search that finds nothing still says so.
+- In Settings, the API tokens sit in a box of their own.
+- A feed's settings are redesigned: downloading on its own is a switch with what depends on it beneath, how many is Default, Newest or All shown on a strip of the show's own episodes, words to pick or hide are chips, the feed's address is at the top with a copy button, and Save is always in reach. Its folder and Directory category are no longer in it.
+- The feed list's traces show each of its database queries, so it can be told where its time goes.
+- Saving a feed's settings asks the database for your subscription once, not twice.
+- `ipx add` and Add feed in the page add a feed the same way, through one piece of code.
+- A pinned item or feed's pin button is filled with the theme's accent, in the reader, on the feed's page and in the toolbar, so pinned no longer looks like not pinned.
+- A feed's page in the Directory says how many people here subscribe only when someone does, without "Nobody here subscribes yet".
+
+### Fixed
+
+- The unread counts catch up when you come back to the page: an item read on another device, or while the phone app was in the background, no longer stays counted as unread until a reload.
+- A feed set to download 0 of its newest items downloads all of them, the whole back catalogue, as the server's 0 does; it downloaded nothing.
+- The feed list loads faster: it counts the items and files of your own feeds, not of every feed on the server, and asks for a group's title once, not once for every feed in it.
+- Downloading or deleting a file the server no longer has answers "not found" instead of a server error.
+- A feed's page in the Directory, and subscribing from it, no longer wait while the whole Directory is put together to check that the one feed is in it.
+- An episode that came as a torrent of several files plays its largest file, and can be deleted, by hand or to free space, instead of staying on disk for good.
+- Removing an account takes the feeds only that person read off the server, as unsubscribing does, instead of leaving them downloading every new episode for no one.
+- Freeing disk space counts only the people who subscribe to a feed: an episode is no longer taken as heard by everyone because someone who has since unsubscribed heard it, and their pins no longer keep files for good.
+- An episode whose file turns out to be a torrent shows as downloaded once it is, instead of being fetched again on every check of its feed, and no longer holds up the checking of other feeds while it downloads and seeds.
+- Downloading the latest 65 to 100 items of a feed queues them at once, instead of hanging until most had downloaded and holding up adding feeds and Refresh meanwhile.
+- Changes to the feed list made at the same moment, such as two people adding feeds, or a feed added while the server settings change, no longer undo one another.
+- A download that stops partway is given up after two minutes without data, instead of holding up every scan and download until a restart.
+- On a phone, the closed feed list no longer shades the left edge of the page with its shadow.
+- On an iPhone, the top bar's colour runs all the way up behind the status bar and the Dynamic Island, with no band of another colour above it. In Glass the bar is solid on a phone, in the colour its glass showed.
+- A feed's buttons stay on one row on a narrow phone, and the reader's buttons stay together instead of breaking across lines under a long feed name.
+- A moment's DNS failure no longer marks a feed as failing for a day or calls it gone: iPX tries it again in ten minutes. One failed lookup one morning left 205 podcasts unread, uncategorised and labelled gone until the next day. A name that does not resolve is said to be maybe gone, and only once it has been failing a day, on its Directory page as on its own.
+
 ## [0.10.2] - 2026-10-05
 
 ### Fixed
@@ -46,10 +154,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- The Directory is laid out as Apple's is. It opens on the ten most subscribed feeds, ranked, and the categories as tiles showing some of their shows' covers. A category opens a page of its own with its most subscribed feeds, its subcategories (Tech News under News, Video Games under Leisure) and its feeds; See all lists every one. This replaces the grid of every feed under rows of category buttons.
+- The Directory is laid out as Apple's is. It opens on the ten most subscribed feeds, ranked, and the categories as tiles showing some of their shows' covers. A category opens a page of its own with its most subscribed feeds, its subcategories (Tech News under News, Video Games under Leisure) and its feeds; See all lists every one, A to Z, Z to A or by most subscribers. This replaces the grid of every feed under rows of category buttons, and Popular, which is gone from the feed list with its key, g p.
-- The most subscribed feeds are the Directory's first section instead of a place of their own: Popular is gone from the feed list, and so is its key, g p.
 - A pinned item in a list wears the same disc as a pinned feed, in the theme's accent, instead of a plain solid pin.
-- The Directory can be sorted by name, A to Z or Z to A, or by most subscribers. It still opens A to Z.
 - An item published without a title shows its opening words, in plain text rather than bold, instead of "(untitled)"; one with no text either shows its file's name, or its show and date. Opened, it starts with its text.
 - A feed that has moved for good (a permanent redirect) is followed to its new address, which iPX then reads from, and says so in the log as `feed_moved`. A temporary redirect changes nothing.
 - The daemon sleeps until the next feed is due, at most ten minutes, instead of looking every minute; refreshing or adding a feed still wakes it at once.
@@ -77,43 +183,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- `IPX_LOG_FORMAT=json` logs one JSON object a line, with a request's method, route, status and time
+- `IPX_LOG_FORMAT=json` logs one JSON object a line, for Loki and the like: a request's method,
-  and a scan's or download's details as fields, for Loki and the like.
+  route, status and `duration_ms`, a scan's or download's details, a failure's kind in `error.type`
-- A Grafana dashboard for iPX, from its log in Loki and its traces in Tempo (`grafana/dashboard.py`).
+  (and its HTTP status in `http.response.status_code`), and each line's `trace_id` and `span_id`.
 - With `OTEL_EXPORTER_OTLP_ENDPOINT` set, the daemon sends traces of its scans, downloads and web
-  requests to a collector such as Tempo.
+  requests to a collector such as Tempo; a scan's shows the time each feed spends fetching, on its
-- A feed that has no artwork of its own shows its website's icon instead.
+  artwork and in the database.
+- A feed with no artwork of its own, or whose artwork is missing, shows its website's icon, or the
+  site's `/favicon.ico`, and follows the site when it changes. It is asked for again only when the
+  artwork changes or you refresh the feed.
 - The refresh button turns while its feed is being checked, and the check-every-feed buttons
   while any of yours is.
-- Adding a website's address subscribes to the feed that site links, instead of failing on every scan.
+- Adding a website's address, with or without `https://`, subscribes to the feed that site links.
+  An address is checked before it is added, and anything that is neither a feed nor a page linking
+  one is refused with the reason, instead of being added and failing on every check.
 - `/api/status` gives the number of feeds, items waiting to download and files downloaded, and
   the version, for a dashboard such as Homepage.
 
 ### Changed
 
 - The start-up line about the web UI being reachable off the machine says what guards it, and is a warning only when there is no Cloudflare Access in front of it.
-- The feed list updates just the feed that changed, as a scan checks it or you read an item, instead of reloading the whole list.
+- The feed list updates just the feed that changed, as a scan checks it or you read an item, instead of reloading the whole list every minute.
 - A scan fetches several feeds at once, so a refresh no longer waits on every site in turn.
-- An open page reloads the feed list only when a scan has checked something, not every minute.
-- Adding an address checks it first: a feed is added, a web page adds the feed it links, and anything else is refused with the reason, instead of being added and failing on every check.
 - A feed that was failing when its last subscriber left is forgotten, rather than kept with its error for good. One that worked, or has files on disk, is kept as before.
 - A feed that keeps failing is checked less and less often, waiting as long as it has been failing, up to once a day; it goes back to its schedule as soon as it works. Refreshing it still checks it at once.
-- A scan's trace shows the time a feed spends on its artwork and in the database after the fetch.
-- The JSON log carries each line's `trace_id` and `span_id`, logs each scan event once instead of
-  twice, names a failure's kind in `error.type` (and its HTTP status in
-  `http.response.status_code`), and calls a request's time `duration_ms` instead of `ms`.
 - `ipx list` shows each feed's id on a line of its own, labelled, under its title.
 - Each browser keeps its own theme, so a phone and a desktop can differ. A browser that has not
   chosen one yet starts from the theme your account had.
 - The Modern theme takes its colours from the new logo: its navy, the blue of its bars and the
   orange of its needle.
-- The logo follows the page: the dark version in a dark theme, the light one in a light theme.
-- The browser tab's icon follows the page's light or dark mode too.
-- On a phone, the top bar leaves out the logo, giving its room to the search box.
-- Between releases, the version on the logo says so: 0.9.1-dev, not 0.9.0.
-- The logo's needle is a brighter, redder orange that stands apart from the blue bars.
 - The logo is in the top bar beside the add-feed button, in place of the name at the top of the
-  feed list. Hovering it shows iPX's version.
+  feed list, and left out on a phone, for the search box. It follows the page, dark in a dark theme
+  and light in a light one, as the browser tab's icon does, and hovering it shows iPX's version,
+  which says so between releases: 0.9.1-dev, not 0.9.0.
+- The logo's needle is a brighter, redder orange that stands apart from the blue bars.
 
 ### Removed
 
@@ -123,28 +226,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Adding a site without `https://`, such as `cnn.com`, works; it failed on every check.
 - A limit on new downloads per check means a show's newest episodes: with it set to 3, ipx no longer works back through the show's history three at a time. Set to 0, it still takes the whole back catalogue.
 - With no limit on new downloads per check (`max_new_per_check = 0`), downloads work on Postgres; they failed.
 - Checking a feed with a long history is much quicker: items already stored are no longer written again on every check.
-- A scan no longer asks a feed's website for its icon every time; it asks again when the artwork changes or you refresh the feed.
 - The feed list loads several times faster: it was asking the database six questions per feed.
 - Artwork a feed offers only over plain http shows on the https site too.
 - A failing feed is easy to spot in any theme: a mark on its artwork, what is wrong in place of
   its counts, and its artwork greyed out once it has failed for a day.
-- A feed whose own artwork is missing shows its website's icon instead of nothing.
 - The log has no terminal colour codes when it is not going to a terminal, as in `docker logs`.
-- A feed whose website names an icon that is missing shows the site's `/favicon.ico` instead of
-  no artwork.
-- A website's icon standing in for a feed's artwork follows the site when it changes, and a
-  feed that drops its own artwork gets the site's instead. Refreshing a feed checks again.
 - The read button shows whether an item is read, as the pin beside it shows whether it is
   pinned: a tick when read, an envelope when not. It used to show the opposite.
 - In Directory and Popular, Subscribe is a plus again, not the tick that marks a feed you have.
 - A feed's refresh button looks like the buttons beside it, instead of standing out filled in.
 - Refreshing reads your feeds in full, instead of only asking each one whether it changed, so
   a feed that has not changed is still read again.
-- A web page with some non-ASCII characters no longer hides the feed it links, or crashes looking for it.
 - Pulling the item list down to check for new items shows a spinner for a couple of seconds, and
   a second pull meanwhile does nothing, instead of no sign at all that the check started.
 - Settings no longer lists the server's download folder, which only an admin can change, on
@@ -184,14 +279,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Opened from the home screen on an iPhone, the top bar, the reader's back button and the top
   of the feed list keep clear of the Dynamic Island and the status bar instead of sitting under
   them.
-- Swiping to the next or previous item takes a longer swipe, a quarter of the screen, so a
+- Swiping between items on a phone takes a quarter of the screen, so a diagonal scroll no longer
-  diagonal scroll no longer jumps ahead by accident. The item follows your finger and slides
+  jumps ahead by accident, and no longer shows the item list through the reader: the next or
-  across as it changes.
+  previous item sits beside the one you are reading and comes across with it, following your
-- Swiping between items on a phone no longer shows the item list through the reader. The next
+  finger, the end of the list says so, and swiping right from the first item draws the reader off
-  or previous item sits beside the one you are reading and comes across with it, the end of the
+  the list, dimmed until it is uncovered. A swipe from the screen's left edge stays with the page,
-  list says so, and swiping right from the first item draws the reader off the list, dimmed
+  rather than Safari taking it as Back.
-  until it is uncovered. A swipe from the screen's left edge stays with the page, rather than
-  Safari taking it as Back.
 
 ## [0.8.4] - 2026-09-19
 
@@ -298,6 +391,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Touch gestures: pull the item list down from its top to check the feed for new items, and
   swipe the item you are reading left for the next one and right for the one before, or back
   to the list from the first.
+- A favicon: the logo, squared up, also at /favicon.ico for browsers that ask there on their own,
+  and on white for an iPhone's home screen.
 
 ### Changed
 
@@ -312,17 +407,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - On a phone, an item's files, with play and delete, sit above its show notes rather than below
   them, where long notes left them looking missing.
 - On a phone, an item with no files goes straight to its text, without a box saying "No files".
-- The page is served minified, about a quarter smaller. Its script is now TypeScript in
+- The page is served minified, about a quarter smaller, with its script in a file of its own,
-  `web/src`, type-checked, and built with swc; building ipx needs node.
+  `/app.js`, which your browser keeps between visits and fetches again only when an update changes
-- The script is its own file, `/app.js`, rather than inside the page. Your browser keeps it
+  it. The script is TypeScript in `web/src`, type-checked and built with swc; building ipx needs
-  between visits and fetches it again only when an update changes it.
+  node.
 
 ### Fixed
 
 - Switching tabs straight after marking everything read no longer shows the previous tab's
   items: of two lists asked for at once, only the later one is shown.
-- ipx has a favicon: the logo, squared up, also at /favicon.ico for browsers that ask there on
-  their own, and on white for an iPhone's home screen.
 - The file icon of an item not yet downloaded sits level with the rest of its row, instead of
   higher than a downloaded one's.
 - Images in posts from sites that refuse images to other sites' pages, such as Jeff Geerling's,
@@ -333,8 +426,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   unread dot back until the next refresh.
 - On the Unread tab, the item you were reading leaves the list as soon as you move to the next
   one, rather than a few read items lingering until a refresh cleared them.
-- The Log button no longer shows for a moment on every load for anyone but an admin; the server
-  leaves it out of their page.
 - An image or link in a post given relative to the post, such as The Observation Deck's, now
   points at the post's site rather than at ipx, and shows.
 
@@ -404,10 +495,6 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   connection", now shows that message and is flagged as the publisher's problem, instead of two
   parser errors about reaching the end of input.
 
-### Removed
-
-- An unused icon glyph (`minus`) left over from before Unsubscribe settled on `circleMinus`.
-
 ### Fixed
 
 - Add a feed opened over Directory or Popular now shows its Popular list instead of staying on
@@ -576,13 +663,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - A Classic theme after the 2004 Mac app, beside Dark and Light: brushed-metal toolbar, Aqua
   blue selection, red unread badges, a striped table and Lucida Grande. The theme button steps
   through all three and remembers the choice.
-- A toolbar across the top, after the original iPodderX: add and unsubscribe, play, mark read
+- A toolbar across the top, after the original iPodderX: add, unsubscribe and scan; play, mark
-  and keep for the selected item, scan, a search box for what is showing, and Settings and Log.
+  read and keep for the selected item, showing its state; a search box for what is showing; and
+  Settings and Log.
 - Directory, Popular and All Subscriptions at the top of the feed list, opening in the main pane.
   Directory lists every feed anyone here subscribes to, A to Z (`GET /api/directory`). All
   Subscriptions lists every item from every feed you subscribe to (`GET /api/entries`).
 - Items show as a table (unread, kept, title, feed, file, size, published) with a Files pane beside
-  it, and a status bar with the totals.
+  it, and a status bar with the totals. A file's type is an icon (audio, video, image, PDF, torrent,
+  other), green once it is downloaded and red when the download failed, with the details in its
+  tooltip; its size is in KB for small files instead of "0 MB".
 - Mark everything read from All Subscriptions, across every feed you subscribe to
   (`POST /api/read-all`). It asks first. All Subscriptions can also check every feed from its header.
 - Click a column heading in the item table to sort by it (kept, title, feed, file type, size,
@@ -597,28 +687,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   items show without pressing Scan.
 - A file deleted to save space, or by hand, looks as if it was never downloaded: no "reaped"
   label, just the Download button. The retention summary says "deleted", not "reaped".
-- Buttons are icons, with the words in their tooltips: the Files pane (save, delete, view,
+- Buttons are icons, with the words in their tooltips, one meaning per icon: minus unsubscribes,
-  download), an item's own buttons (mark read, keep, open the original), the feed header (scan,
+  x closes or cancels, plus adds or subscribes, a dialog's confirm button carries the icon of what
-  download latest, mark all read, settings, unsubscribe), and the Settings, feed settings and
+  it does, Keep is a flag, as it was in the original, mark unread is an envelope, and Subscribed is
-  Download latest dialogs (save, download, cancel). The icons are Font Awesome Free, embedded as
+  a green check. The icons are Font Awesome Free, embedded as SVG: only the ones used, no font to
-  SVG: only the ones used, no font to download, and nothing fetched from anyone else. They
+  download, and nothing fetched from anyone else. They replace words and font characters such as
-  replace font characters such as ⟳ ⤓ ↗, which came out thin and tiny and differed from font to
+  ⟳ ⤓ ↗, which came out thin and tiny and differed from font to font, and the feed header's x for
-  font. Keep is a flag everywhere, as it was in the original, and mark unread is an envelope.
+  unsubscribe, which read as closing the page.
-- One meaning per icon. Minus unsubscribes, x closes or cancels, plus adds or subscribes, and a
-  dialog's confirm button carries the icon of what it does. The feed header's unsubscribe was an x
-  and read as closing the page. The remaining word buttons are icons too:
-  - Log, Add feed, Users, Unsubscribe and OPML.
-  - Popular's Subscribe, Copy and Sign out.
-  - The Subscribed label in Popular, the Directory and Add feed, which is now a green check.
-  - The player's back, play, forward and close, which were font characters, and the folder arrow.
-- The toolbar's read and keep buttons show the selected item's state, with the same icons as the
-  item's own buttons. Play, read and keep sit together, and Scan sits with add and unsubscribe.
 - An OPML subscription's page has the same header as a feed's, with its buttons in the same places.
-- The item table's size has its own column, apart from the file's type, and shows KB for small
-  files instead of "0 MB". The Item heading is now Title.
-- A file's type is an icon (audio, video, image, PDF, torrent, other), green once it is
-  downloaded and red when the download failed, with the details in its tooltip. One icon per
-  row keeps the column lined up. The DOWNLOADED and PENDING labels are gone.
 
 ### Fixed
 
@@ -669,11 +745,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Importing another account's OPML export subscribed nobody and reported "Imported 0 feed(s)".
-  Feeds it added had no subscriber, so they were never scanned.
 - Importing something that is not OPML answered `500`. It is now `400` "that is not an OPML file",
   refused before anything changes.
-- Starring stopped protecting a file from the quota and age sweeps once read state became per-user.
 
 ### Security
 
@@ -687,7 +760,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Web UI served by the daemon: plain HTML and JS compiled into the binary, with feeds, items,
-  filters, search, sanitised show notes and live progress over SSE.
+  filters, search, sanitised show notes and live progress over SSE. Opening an item marks it
+  read; playing it marks it read only at the end or past 90%.
 - Player bar with resume, speed, keyboard shortcuts and lock-screen controls.
 - Three-pane layout: feeds beside, items above, and the selected item's text and files below.
 - Phone layout.
@@ -695,7 +769,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   trusted proxy header for Cloudflare Zero Trust or Authentik (`docs/sso.md`).
 - Subscribing to an OPML: it is re-read every scan and its feeds show as a folder. A feed dropped
   from it is removed unless it has downloads.
-- Scheduling: a global interval with per-feed overrides (`every 30m`, `4h`, `1d`, `2w`).
+- Scheduling: a global interval with per-feed overrides (`every 30m`, `4h`, `1d`, `2w`), set by an
+  admin, as are the global settings.
 - `[general] media_types`, default audio and video, and `max_new_per_check`, default 3.
 - Every enclosure of an item, a View link for files that are not audio or video, and per-item
   artwork.
@@ -708,33 +783,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Global settings and scan schedules are admin-only. The per-feed schedule picker is gone.
 - Feeds from an OPML live in the database, not `config.toml`.
-- Opening an item marks it read. Playing it marks it read only at the end or past 90%.
-- "Episodes" became "items", since half the library is text.
-- A burst of scan events causes one refresh, not one per feed.
-- All is the default filter. OPML import and export, Settings and Log moved out of the header.
 - Torrents run detached, two at a time.
 
 ### Fixed
 
-- Download fetched the next queued episodes instead of the one clicked.
-- Pressing play made an item vanish from the Unread list.
-- Clearing a folder, schedule or cap from the UI did nothing.
 - The daemon ignored SIGTERM until the current download finished.
-- A missing function stopped the page script and left the whole UI dead.
-- One download painted progress on every pending row.
 - A torrent could freeze scanning for up to an hour.
-- Downloading from an OPML feed failed with "belongs to unsubscribed feed".
+- Image enclosures were downloaded as episodes.
-- Image enclosures were downloaded, counted as episodes and given a play button.
 - A feed whose entries had been deleted stayed empty, because the server kept answering `304`.
 - An item with several enclosures kept only the last.
-- OPML folders rendered open by default.
-- Mark read in the text pane recursed until the stack overflowed.
-- The Unread, Downloaded and Flagged filters answered `500` without a search term.
-- An OPML subscription always showed 0 unread.
-- Folder names kept doubled spaces where separators were stripped.
-- Sidebar rows had four different left edges.
 
 ### Security
 
@@ -758,7 +816,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Torrent enclosures through librqbit, seeding to a ratio or a time, with a stall timeout.
 - `ipx import` and `ipx export` for OPML, and systemd units in `contrib/`.
 
-[unreleased]: https://git.sdf1.net/rays/ipx/compare/v0.10.2...main
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/v1.1.0...main
+[1.1.0]: https://git.sdf1.net/rays/ipx/compare/v1.0.0...v1.1.0
+[1.0.0]: https://git.sdf1.net/rays/ipx/compare/v0.12.0...v1.0.0
+[0.12.0]: https://git.sdf1.net/rays/ipx/compare/v0.11.0...v0.12.0
+[0.11.0]: https://git.sdf1.net/rays/ipx/compare/v0.10.3...v0.11.0
+[0.10.3]: https://git.sdf1.net/rays/ipx/compare/v0.10.2...v0.10.3
 [0.10.2]: https://git.sdf1.net/rays/ipx/compare/v0.10.1...v0.10.2
 [0.10.1]: https://git.sdf1.net/rays/ipx/compare/v0.10.0...v0.10.1
 [0.10.0]: https://git.sdf1.net/rays/ipx/compare/v0.9.1...v0.10.0

crates/ipx/Cargo.toml

@@ -0,0 +1,36 @@
+[package]
+name = "ipx"
+version = "1.1.0"
+edition.workspace = true
+
+[dependencies]
+ipx-feed.workspace = true
+ipx-directory.workspace = true
+ammonia.workspace = true
+anyhow.workspace = true
+argon2.workspace = true
+atom_syndication.workspace = true
+axum.workspace = true
+chrono.workspace = true
+clap.workspace = true
+futures-util.workspace = true
+jsonwebtoken.workspace = true
+librqbit.workspace = true
+opentelemetry.workspace = true
+opml.workspace = true
+percent-encoding.workspace = true
+quick-xml.workspace = true
+reqwest.workspace = true
+rss.workspace = true
+sea-orm.workspace = true
+serde.workspace = true
+serde_json.workspace = true
+sha2.workspace = true
+tokio.workspace = true
+toml.workspace = true
+tower.workspace = true
+tower-http.workspace = true
+tracing.workspace = true
+tracing-opentelemetry.workspace = true
+tracing-subscriber.workspace = true
+url.workspace = true

crates/ipx/src/access.rs

@@ -137,7 +137,7 @@ mod tests {
     const AUD: &str = "aud-tag";
 
     fn jwks() -> JwkSet {
-        serde_json::from_str(include_str!("../tests/data/access-test.jwks.json")).unwrap()
+        serde_json::from_str(include_str!("../../../tests/data/access-test.jwks.json")).unwrap()
     }
 
     fn token(key: &[u8], alg: Algorithm, claims: serde_json::Value) -> String {
@@ -155,8 +155,8 @@ mod tests {
         })
     }
 
-    const SIGNER: &[u8] = include_bytes!("../tests/data/access-test.der");
+    const SIGNER: &[u8] = include_bytes!("../../../tests/data/access-test.der");
-    const FORGER: &[u8] = include_bytes!("../tests/data/access-forger.der");
+    const FORGER: &[u8] = include_bytes!("../../../tests/data/access-forger.der");
 
     async fn check(keys: &Keys, t: &str) -> Option<String> {
         keys.verify_with(TEAM, AUD, t, || async { Ok(jwks()) }).await

crates/ipx/src/art.rs

@@ -2,6 +2,9 @@
 //! of each publisher's server for every visit, and still there when a publisher is not.
 
 use std::path::{Path, PathBuf};
+use std::collections::HashMap;
+use std::sync::{LazyLock, Mutex};
+use std::time::{Duration, Instant};
 
 pub fn dir() -> PathBuf {
     crate::config::data_dir().join("art")
@@ -38,6 +41,36 @@ pub fn write(file: &Path, kind: &str, body: &[u8]) -> std::io::Result<()> {
     std::fs::rename(&tmp, file)
 }
 
+/// How long an address that could not be fetched is answered from memory before it is tried again.
+const RETRY: Duration = Duration::from_secs(60 * 60);
+
+/// Addresses that could not be fetched lately, and why. Without it a page shown again fetched
+/// them again: five covers too big to keep were downloaded from Patreon on every load (#169).
+// ponytail: in memory, and an entry goes only when it is asked for after RETRY. It holds at most
+// one per artwork address a feed or item names; move it to disk or prune it on trim if that grows.
+static FAILED: LazyLock<Mutex<HashMap<String, (Instant, String)>>> = LazyLock::new(Default::default);
+
+/// Why `url` could not be fetched, if it failed less than an hour ago.
+pub fn failed(url: &str) -> Option<String> {
+    failed_as_of(url, Instant::now())
+}
+
+fn failed_as_of(url: &str, now: Instant) -> Option<String> {
+    let mut map = FAILED.lock().unwrap_or_else(|e| e.into_inner());
+    match map.get(url) {
+        Some((at, why)) if now.duration_since(*at) < RETRY => Some(why.clone()),
+        Some(_) => {
+            map.remove(url);
+            None
+        }
+        None => None,
+    }
+}
+
+pub fn fail(url: &str, why: &str) {
+    FAILED.lock().unwrap_or_else(|e| e.into_inner()).insert(url.to_owned(), (Instant::now(), why.to_owned()));
+}
+
 /// Removes the least recently used images until what is kept fits in `limit` bytes; 0 empties it.
 /// Returns how many went.
 pub fn trim(dir: &Path, limit: u64) -> usize {
@@ -64,6 +97,8 @@ pub fn trim(dir: &Path, limit: u64) -> usize {
             gone += 1;
         }
     }
+    crate::metrics::STATS.art_cache_bytes.store(total, std::sync::atomic::Ordering::Relaxed);
+    crate::metrics::STATS.art_evicted.fetch_add(gone as u64, std::sync::atomic::Ordering::Relaxed);
     gone
 }
 
@@ -89,4 +124,15 @@ mod tests {
         assert_eq!(trim(&d, 0), 2);
         let _ = std::fs::remove_dir_all(&d);
     }
+
+    #[test]
+    fn a_failure_is_remembered_for_an_hour() {
+        let u = "https://example.com/a-failure-is-remembered.png";
+        assert_eq!(failed(u), None);
+        fail(u, "larger than 5 MB");
+        assert_eq!(failed(u).as_deref(), Some("larger than 5 MB"));
+        assert_eq!(failed_as_of(u, Instant::now() + RETRY), None);
+        // Asked for after the hour, it is forgotten, not just ignored.
+        assert_eq!(failed(u), None);
+    }
 }

crates/ipx/src/config.rs

@@ -42,6 +42,14 @@ pub struct General {
     /// How much artwork iPX keeps on disk, in MB, so the page loads it from iPX rather than from
     /// every publisher; the least recently shown goes first. 0 keeps none.
     pub art_cache_mb: u64,
+    /// The directory service the Directory shows (#205), as `https://directory.ipxreader.app`. Empty
+    /// for none: then the Directory says so, and feeds are added by their address.
+    pub directory_url: String,
+    /// The token the directory gave this server. Never sent to the page: it says only whether
+    /// one is set.
+    pub directory_token: String,
+    /// Send the directory the public feeds people here subscribe to, and how many of them do.
+    pub directory_share: bool,
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Deserialize, Serialize)]
@@ -97,6 +105,9 @@ pub struct Web {
     pub sign_out_url: String,
     /// Sign a session out after this long without a request.
     pub session_days: i64,
+    /// Where to serve /metrics for Prometheus (#194), on a thread of its own, without sign-in:
+    /// `0.0.0.0:9187`. Empty serves none.
+    pub metrics_bind: String,
 }
 
 impl Default for Web {
@@ -112,6 +123,7 @@ impl Default for Web {
             auto_create_users: true,
             sign_out_url: String::new(),
             session_days: 30,
+            metrics_bind: String::new(),
         }
     }
 }
@@ -170,6 +182,10 @@ pub struct Feed {
     /// in the catalogue when the last one leaves, where anyone else's feed is dropped.
     #[serde(default, skip_serializing_if = "std::ops::Not::not")]
     pub listed: bool,
+    /// Never sent to the directory (#205), whatever its address looks like: someone's own
+    /// access to a paid show that `feed::url_looks_private` does not recognise.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub private: bool,
 }
 
 fn yes() -> bool {
@@ -188,6 +204,9 @@ impl Default for General {
             max_new_per_check: 3,
             media_types: vec!["audio".into(), "video".into()],
             art_cache_mb: 500,
+            directory_url: String::new(),
+            directory_token: String::new(),
+            directory_share: false,
         }
     }
 }
@@ -269,6 +288,11 @@ impl Feed {
         }
         self.password.clone()
     }
+
+    /// What `feed::fetch` sends the feed's host: a username, and its password if there is one.
+    pub fn auth(&self) -> Option<(&str, Option<String>)> {
+        self.username.as_deref().map(|u| (u, self.password()))
+    }
 }
 
 impl Config {
@@ -301,6 +325,12 @@ pub struct Stored {
     /// Settings saved before it existed have none: they get the default.
     #[serde(default = "art_cache_mb")]
     pub art_cache_mb: u64,
+    #[serde(default)]
+    pub directory_url: String,
+    #[serde(default)]
+    pub directory_token: String,
+    #[serde(default)]
+    pub directory_share: bool,
 }
 
 fn art_cache_mb() -> u64 {
@@ -308,8 +338,17 @@ fn art_cache_mb() -> u64 {
 }
 
 /// `[general]` keys that live in the database once it holds the configuration.
-const STORED_KEYS: [&str; 6] =
+const STORED_KEYS: [&str; 9] = [
-    ["schedule", "max_total_gb", "max_age_days", "max_new_per_check", "media_types", "art_cache_mb"];
+    "schedule",
+    "max_total_gb",
+    "max_age_days",
+    "max_new_per_check",
+    "media_types",
+    "art_cache_mb",
+    "directory_url",
+    "directory_token",
+    "directory_share",
+];
 
 impl Stored {
     pub fn of(cfg: &Config) -> Self {
@@ -321,6 +360,9 @@ impl Stored {
             max_new_per_check: g.max_new_per_check,
             media_types: g.media_types.clone(),
             art_cache_mb: g.art_cache_mb,
+            directory_url: g.directory_url.clone(),
+            directory_token: g.directory_token.clone(),
+            directory_share: g.directory_share,
         }
     }
 
@@ -332,6 +374,9 @@ impl Stored {
         g.max_new_per_check = self.max_new_per_check;
         g.media_types = self.media_types;
         g.art_cache_mb = self.art_cache_mb;
+        g.directory_url = self.directory_url;
+        g.directory_token = self.directory_token;
+        g.directory_share = self.directory_share;
     }
 }
 
@@ -608,7 +653,7 @@ mod tests {
         taken.insert("the-daily".to_string(), Feed {
             url: "u".into(), folder: None, group: None, media_types: None, schedule: None, keywords: vec![], allow_explicit: false,
             auto_download: true, max_new_per_check: None, username: None,
-            password: None, password_env: None, category: None, listed: false,
+            password: None, password_env: None, category: None, listed: false, private: false,
         });
         assert_eq!(unique_slug("The Daily", &taken), "the-daily-2");
     }
@@ -630,6 +675,7 @@ mod tests {
             password_env: None,
             category: None,
             listed: false,
+            private: false,
         };
         assert_eq!(f.password().as_deref(), Some("literal"));
 

crates/ipx/src/db.rs

@@ -2,7 +2,7 @@
 //! per-feed .ipxd plists, history.dat and qmcache.dat.
 
 use anyhow::{Context, Result};
-use crate::entity::{api_tokens, blocklists, catalogue, enclosures, entries, feeds, hidden, sessions, settings, subscriptions, users};
+use crate::entity::{api_tokens, blocklists, catalogue, deadair_prefs, enclosures, entries, feeds, hidden, sessions, settings, subscriptions, users};
 use sea_orm::sea_query::{Expr, Func};
 use sea_orm::{
     ActiveModelTrait, ColumnTrait, ConnectionTrait, EntityTrait, PaginatorTrait, QueryFilter, QueryOrder, Set,
@@ -60,12 +60,23 @@ async fn create_missing(orm: &sea_orm::DatabaseConnection) -> Result<()> {
         schema.create_table_from_entity(blocklists::Entity),
         schema.create_table_from_entity(hidden::Entity),
         schema.create_table_from_entity(api_tokens::Entity),
+        schema.create_table_from_entity(deadair_plans::Entity),
+        schema.create_table_from_entity(deadair_prefs::Entity),
+        schema.create_table_from_entity(deadair_saved::Entity),
     ] {
         orm.execute(table.if_not_exists()).await.context("creating the schema")?;
     }
     for sql in [
         "CREATE INDEX IF NOT EXISTS enclosures_entry ON enclosures (feed_id, guid)",
+        // The few rows with a file on disk, 15 of the server's many thousand: counting a person's
+        // files through enclosures_entry read every file row of their feeds, 58 ms a feed list
+        // (#165). Also what the healthcheck's count and the Downloaded filter look for.
+        "CREATE INDEX IF NOT EXISTS enclosures_on_disk ON enclosures (feed_id, guid) WHERE path IS NOT NULL",
         "CREATE UNIQUE INDEX IF NOT EXISTS users_name_lower ON users (lower(name))",
+        // Every key and date an item list sorts by, so `entries_where` pages from the index alone
+        // and visits the table only for the rows it shows. Sorting All Subscriptions from the
+        // table read all 13,700 of its rows, show notes and all, half a second to two cold (#188).
+        "CREATE INDEX IF NOT EXISTS entries_by_time ON entries (feed_id, guid, published, first_seen)",
     ] {
         orm.execute_unprepared(sql).await.with_context(|| sql.to_owned())?;
     }
@@ -84,6 +95,10 @@ async fn create_missing(orm: &sea_orm::DatabaseConnection) -> Result<()> {
             orm.execute_unprepared(sql).await.with_context(|| sql.to_owned())?;
         }
     }
+    if orm.execute_unprepared("SELECT pause_ms FROM deadair_prefs LIMIT 0").await.is_err() {
+        let sql = "ALTER TABLE deadair_prefs ADD COLUMN pause_ms BIGINT";
+        orm.execute_unprepared(sql).await.with_context(|| sql.to_owned())?;
+    }
     Ok(())
 }
 
@@ -99,6 +114,24 @@ pub fn location() -> String {
 /// The Postgres connection option that keeps notices from being sent at all; see `connect`.
 const QUIET: &str = "options=-c%20client_min_messages%3Dwarning";
 
+impl Db {
+    /// The connection pool as it stands, for /metrics (#194): connections open, those of them
+    /// idle, and the most it will open.
+    pub fn pool(&self) -> (u32, usize, u32) {
+        use sea_orm::DbBackend;
+        match self.orm.get_database_backend() {
+            DbBackend::Postgres => {
+                let p = self.orm.get_postgres_connection_pool();
+                (p.size(), p.num_idle(), p.options().get_max_connections())
+            }
+            _ => {
+                let p = self.orm.get_sqlite_connection_pool();
+                (p.size(), p.num_idle(), p.options().get_max_connections())
+            }
+        }
+    }
+}
+
 /// A URL fit for a log or an error: the password taken out.
 fn redact(url: &str) -> String {
     match (url.find("://"), url.rfind('@')) {
@@ -136,10 +169,9 @@ async fn connect(location: &str) -> Result<sea_orm::DatabaseConnection> {
     // line for it at 50 requests a second (#136). In WAL readers run beside the one writer. Each
     // transaction here writes first, so it takes the write lock or waits out the busy timeout for
     // it; SQLite refuses at once only a transaction that read a snapshot a write has since moved
-    // past. Postgres keeps sqlx's ten.
+    // past. Postgres gets twenty, where sqlx's ten filled in bursts: a page load asks for dozens
-    if !is_postgres(location) {
+    // of covers at once, each with a lookup (#200). The server allows 100, shared with other apps.
-        opts.max_connections(8);
+    opts.max_connections(if is_postgres(location) { 20 } else { 8 });
-    }
     sea_orm::Database::connect(opts)
         .await
         .with_context(|| format!("opening {}", redact(location)))
@@ -194,6 +226,8 @@ impl From<enclosures::Model> for EncRow {
     fn from(e: enclosures::Model) -> Self {
         EncRow {
             id: e.id,
+            deadair: None,
+            deadair_pending: false,
             feed_id: e.feed_id,
             guid: e.guid,
             url: e.url,
@@ -295,6 +329,13 @@ impl Db {
     /// A SQLite file of its own (two connections to one ":memory:" would be two databases); or,
     /// with IPX_TEST_DATABASE_URL set, a Postgres schema of its own on that database, so the
     /// same tests prove the SQL on both.
+    /// Runs a statement as it is, for a test outside this module setting up what it needs.
+    #[cfg(test)]
+    pub async fn sql(&self, sql: &str) -> Result<()> {
+        self.orm.execute_unprepared(sql).await?;
+        Ok(())
+    }
+
     #[cfg(test)]
     pub async fn memory() -> Result<Self> {
         static N: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
@@ -390,26 +431,35 @@ impl Db {
     ) -> Result<std::collections::HashMap<String, FeedListing>> {
         use std::collections::HashMap;
         let one = || sea_orm::Value::from(only.map(str::to_owned));
-        let counts = |sql: &'static str, args: Vec<sea_orm::Value>| async move {
+        // A step a query: the feed list's trace was 290 ms with nothing under it.
-            self.rows(sql, args)
+        let counts = |of: &'static str, sql: &'static str, args: Vec<sea_orm::Value>| async move {
+            tracing::Instrument::instrument(self.rows(sql, args), step(of))
                 .await?
                 .iter()
                 .map(|r| Ok((r.try_get::<String>("", "feed_id")?, r.try_get::<i64>("", "n")?)))
                 .collect::<Result<HashMap<_, _>>>()
         };
+        // Of this person's feeds only, as the unread count is: counting every item of every feed on
+        // the server, 1534 feeds for someone reading 146, was 184-316 ms, 70% of the feed list's
+        // time (#165). The Directory reads this for every feed's title and artwork, not a count.
         let entries = counts(
-            "SELECT feed_id, count(*) AS n FROM entries
+            "entries",
-              WHERE (CAST($1 AS TEXT) IS NULL OR feed_id = $1) GROUP BY feed_id",
+            "SELECT e.feed_id, count(*) AS n FROM entries e
-            vec![one()],
+               JOIN subscriptions sub ON sub.user_id = $1 AND sub.feed_id = e.feed_id
+              WHERE (CAST($2 AS TEXT) IS NULL OR e.feed_id = $2) GROUP BY e.feed_id",
+            vec![user_id.into(), one()],
         )
         .await?;
         let downloaded = counts(
-            "SELECT feed_id, count(*) AS n FROM enclosures
+            "downloaded",
-              WHERE path IS NOT NULL AND (CAST($1 AS TEXT) IS NULL OR feed_id = $1) GROUP BY feed_id",
+            "SELECT x.feed_id, count(*) AS n FROM enclosures x
-            vec![one()],
+               JOIN subscriptions sub ON sub.user_id = $1 AND sub.feed_id = x.feed_id
+              WHERE x.path IS NOT NULL AND (CAST($2 AS TEXT) IS NULL OR x.feed_id = $2) GROUP BY x.feed_id",
+            vec![user_id.into(), one()],
         )
         .await?;
         let unread = counts(
+            "unread",
             "SELECT e.feed_id, count(*) AS n FROM entries e
                JOIN subscriptions sub ON sub.user_id = $1 AND sub.feed_id = e.feed_id
                LEFT JOIN entry_state s
@@ -422,10 +472,11 @@ impl Db {
             vec![user_id.into(), one()],
         )
         .await?;
-        let mut blocked: HashMap<String, Vec<String>> = blocklists::Entity::find()
+        let mut blocked: HashMap<String, Vec<String>> = tracing::Instrument::instrument(
-            .filter(blocklists::Column::UserId.eq(user_id))
+            blocklists::Entity::find().filter(blocklists::Column::UserId.eq(user_id)).all(&self.orm),
-            .all(&self.orm)
+            step("blocked"),
-            .await?
+        )
+        .await?
             .into_iter()
             .map(|b| (b.feed_id, keywords(Some(b.words)).unwrap_or_default()))
             .collect();
@@ -433,8 +484,7 @@ impl Db {
         if let Some(id) = only {
             rows = rows.filter(feeds::Column::Id.eq(id));
         }
-        Ok(rows
+        Ok(tracing::Instrument::instrument(rows.all(&self.orm), step("feeds"))
-            .all(&self.orm)
             .await?
             .into_iter()
             .map(|f| {
@@ -782,7 +832,9 @@ impl Db {
     /// One file serves every subscriber, so both tests are about all of them: **anyone**
     /// starring it keeps it, and it only counts as read when **everyone** subscribed has
     /// read it. A file whose feed nobody subscribes to has no one left to keep it, so it
-    /// sorts with the read ones.
+    /// sorts with the read ones. Only the marks of people who subscribe count: unsubscribing
+    /// leaves yours behind, and counted, a reader who had left made an episode someone had not
+    /// played look finished, and a pin of theirs kept a file for good (#156).
     ///
     /// (The Python intended `read = 1 AND flagged = 0` but never achieved it -- a missing
     /// plistlib import and an `EntreiesData` typo meant the filter always threw.)
@@ -796,13 +848,15 @@ impl Db {
              LEFT JOIN (SELECT feed_id, count(*) AS n FROM subscriptions GROUP BY feed_id) subs
                     ON subs.feed_id = e.feed_id
              -- Someone an item is hidden from is as done with it as someone who read it.
-             LEFT JOIN (SELECT feed_id, guid, count(*) AS n
+             LEFT JOIN (SELECT done.feed_id, done.guid, count(*) AS n
                           FROM (SELECT user_id, feed_id, guid FROM entry_state WHERE read
                                 UNION SELECT user_id, feed_id, guid FROM hidden) done
-                         GROUP BY feed_id, guid) readers
+                          JOIN subscriptions u ON u.user_id = done.user_id AND u.feed_id = done.feed_id
+                         GROUP BY done.feed_id, done.guid) readers
                     ON readers.feed_id = e.feed_id AND readers.guid = e.guid
              WHERE e.path IS NOT NULL
                AND NOT EXISTS (SELECT 1 FROM entry_state s
+                                 JOIN subscriptions u ON u.user_id = s.user_id AND u.feed_id = s.feed_id
                                 WHERE s.feed_id = e.feed_id AND s.guid = e.guid AND s.flagged)
              ORDER BY 6 DESC, coalesce(e.downloaded_at, 0) ASC, e.id ASC",
             vec![],
@@ -941,9 +995,10 @@ impl Db {
                       SELECT 1 FROM enclosures e
                       WHERE e.feed_id = entries.feed_id AND e.guid = entries.guid
                         AND e.path IS NOT NULL)
-                    -- Starred by anyone keeps it, the same rule the reaper follows.
+                    -- Starred by anyone subscribed keeps it, the same rule the reaper follows.
                     AND NOT EXISTS (
                       SELECT 1 FROM entry_state s
+                        JOIN subscriptions u ON u.user_id = s.user_id AND u.feed_id = s.feed_id
                       WHERE s.feed_id = entries.feed_id AND s.guid = entries.guid
                         AND s.flagged)",
                 vec![older_than.into()],
@@ -1032,12 +1087,22 @@ impl Args {
 /// The FROM and WHERE that `entries_in` and `count_in` share: whose read state, which feeds
 /// (one, or every feed the person subscribes to), the filter, and a case-insensitive search of
 /// title and description.
-fn entries_from(a: &mut Args, user_id: i64, feed_id: Option<&str>, filter: Filter, search: Option<&str>) -> String {
+fn entries_from(
+    a: &mut Args,
+    user_id: i64,
+    feed_id: Option<&str>,
+    filter: Filter,
+    search: Option<&str>,
+    guid: Option<&str>,
+) -> String {
     let user = a.p(user_id);
-    let scope = match feed_id {
+    let mut scope = match feed_id {
         Some(f) => format!("e.feed_id = {}", a.p(f)),
         None => format!("e.feed_id IN (SELECT feed_id FROM subscriptions WHERE user_id = {user})"),
     };
+    if let Some(g) = guid {
+        scope = format!("{scope} AND e.guid = {}", a.p(g));
+    }
     let search = match search.map(|q| q.trim().to_lowercase()).filter(|q| !q.is_empty()) {
         Some(q) => {
             let like = a.p(format!("%{q}%"));
@@ -1141,6 +1206,14 @@ impl Filter {
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct EncRow {
     pub id: i64,
+    /// Seconds DeadAir's copy of this file saves, when the person asking plays it from one
+    /// (`deadair::for_reader`). None from the database.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub deadair: Option<i64>,
+    /// DeadAir is on for this person's show and the copy is still being made: the page says to
+    /// wait rather than leave them guessing (`deadair::for_reader`).
+    #[serde(skip_serializing_if = "std::ops::Not::not")]
+    pub deadair_pending: bool,
     pub feed_id: String,
     pub guid: String,
     pub url: String,
@@ -1165,19 +1238,44 @@ impl Db {
         offset: i64,
         limit: i64,
         order: &str,
+    ) -> Result<Vec<EntryRow>> {
+        self.entries_where(user_id, feed_id, filter, search, None, offset, limit, order).await
+    }
+
+    /// One entry as `entries_in` gives it: what the player asks for again when the clock it
+    /// plays in changes (DeadAir, #171).
+    pub async fn entry(&self, user_id: i64, feed_id: &str, guid: &str) -> Result<Option<EntryRow>> {
+        let order = order_sql("published", "desc");
+        Ok(self.entries_where(user_id, Some(feed_id), Filter::All, None, Some(guid), 0, 1, &order).await?.pop())
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn entries_where(
+        &self,
+        user_id: i64,
+        feed_id: Option<&str>,
+        filter: Filter,
+        search: Option<&str>,
+        guid: Option<&str>,
+        offset: i64,
+        limit: i64,
+        order: &str,
     ) -> Result<Vec<EntryRow>> {
         let mut a = Args::default();
-        let from = entries_from(&mut a, user_id, feed_id, filter, search);
+        let from = entries_from(&mut a, user_id, feed_id, filter, search, guid);
+        // The page's keys first, then its rows: the sort then needs only `entries_by_time`, not
+        // every item's row, and the show notes are read for the page alone (#188).
+        let (limit, offset) = (a.p(limit), a.p(offset));
+        let user = a.p(user_id);
         let sql = format!(
             "SELECT e.guid, e.feed_id, e.title, e.link, e.published, e.description,
                     coalesce(s.read, false) AS read, coalesce(s.flagged, false) AS flagged, e.image,
                     coalesce(s.duration, e.duration) AS duration,
                     e.episode, e.season, coalesce(s.position, 0) AS position
-             {from}
+             FROM (SELECT e.feed_id, e.guid {from} ORDER BY {order} LIMIT {limit} OFFSET {offset}) p
-             ORDER BY {order}
+             JOIN entries e ON e.feed_id = p.feed_id AND e.guid = p.guid
-             LIMIT {} OFFSET {}",
+             LEFT JOIN entry_state s ON s.user_id = {user} AND s.feed_id = e.feed_id AND s.guid = e.guid
-            a.p(limit),
+             ORDER BY {order}"
-            a.p(offset)
         );
         let mut rows = self
             .rows(&sql, a.0)
@@ -1230,7 +1328,7 @@ impl Db {
         search: Option<&str>,
     ) -> Result<i64> {
         let mut a = Args::default();
-        let sql = format!("SELECT count(*) AS n {}", entries_from(&mut a, user_id, feed_id, filter, search));
+        let sql = format!("SELECT count(*) AS n {}", entries_from(&mut a, user_id, feed_id, filter, search, None));
         let r = self.rows(&sql, a.0).await?;
         Ok(r.first().context("count(*) always returns a row")?.try_get("", "n")?)
     }
@@ -2168,6 +2266,200 @@ pub enum EntryFlag {
     Flagged,
 }
 
+/// A span for one step of a request or a scan, and none outside one: the healthcheck and the page's
+/// live updates run the same code, and every call there would be a trace of its own.
+pub fn step(of: &'static str) -> tracing::Span {
+    if tracing::Span::current().is_none() { tracing::Span::none() } else { tracing::info_span!("step", of) }
+}
+
+/// A file on disk with no DeadAir copy made since it was downloaded (issue #171).
+#[derive(Debug, Clone)]
+pub struct DeadAirTodo {
+    pub id: i64,
+    pub feed_id: String,
+    pub guid: String,
+    pub path: String,
+}
+
+impl Db {
+    /// DeadAir settings as (person, feed, wanted, pause in ms), everyone's or one person's. An
+    /// empty feed is the switch beside the speed.
+    pub async fn deadair_prefs(&self, user_id: Option<i64>) -> Result<Vec<(i64, String, bool, Option<i64>)>> {
+        let mut a = Args::default();
+        let only = match user_id {
+            Some(u) => format!("WHERE user_id = {}", a.p(u)),
+            None => String::new(),
+        };
+        self.rows(&format!("SELECT user_id, feed_id, wanted, pause_ms FROM deadair_prefs {only}"), a.0)
+            .await?
+            .iter()
+            .map(|r| {
+                Ok((r.try_get("", "user_id")?, r.try_get("", "feed_id")?, r.try_get("", "wanted")?, r.try_get("", "pause_ms")?))
+            })
+            .collect()
+    }
+
+    /// Sets one DeadAir setting, or with None takes it away: for a feed, that is following the
+    /// switch (or the feed's group) again.
+    pub async fn set_deadair(&self, user_id: i64, feed_id: &str, wanted: Option<bool>) -> Result<()> {
+        match wanted {
+            None => {
+                deadair_prefs::Entity::delete_by_id((user_id, feed_id.to_owned())).exec(&self.orm).await?;
+            }
+            Some(w) => {
+                self.exec(
+                    "INSERT INTO deadair_prefs (user_id, feed_id, wanted) VALUES ($1, $2, $3)
+                     ON CONFLICT (user_id, feed_id) DO UPDATE SET wanted = excluded.wanted",
+                    vec![user_id.into(), feed_id.into(), w.into()],
+                )
+                .await?;
+            }
+        }
+        Ok(())
+    }
+
+    /// Sets the pause DeadAir leaves in a feed for someone (#182). Only beside a setting of the
+    /// switch: inserting one here would turn a feed's group's DeadAir off for it.
+    pub async fn set_deadair_pause(&self, user_id: i64, feed_id: &str, pause_ms: i64) -> Result<()> {
+        self.exec(
+            "UPDATE deadair_prefs SET pause_ms = $1 WHERE user_id = $2 AND feed_id = $3",
+            vec![pause_ms.into(), user_id.into(), feed_id.into()],
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// Files on disk DeadAir has not looked at since they were downloaded, oldest first.
+    pub async fn deadair_todo(&self) -> Result<Vec<DeadAirTodo>> {
+        self.rows(
+            "SELECT e.id, e.feed_id, e.guid, e.path FROM enclosures e
+               LEFT JOIN deadair_plans d ON d.enclosure_id = e.id
+              WHERE e.path IS NOT NULL AND e.state = 'done'
+                AND (d.enclosure_id IS NULL OR d.made_at < coalesce(e.downloaded_at, 0))
+              ORDER BY e.id",
+            vec![],
+        )
+        .await?
+        .iter()
+        .map(|r| {
+            Ok(DeadAirTodo {
+                id: r.try_get("", "id")?,
+                feed_id: r.try_get("", "feed_id")?,
+                guid: r.try_get("", "guid")?,
+                path: r.try_get("", "path")?,
+            })
+        })
+        .collect()
+    }
+
+    /// Whether any of these people subscribes to the feed.
+    pub async fn subscribed_any(&self, users: &[i64], feed_id: &str) -> Result<bool> {
+        if users.is_empty() {
+            return Ok(false);
+        }
+        let mut a = Args::default();
+        let feed = a.p(feed_id);
+        let ids: Vec<String> = users.iter().map(|&u| a.p(u)).collect();
+        let sql = format!(
+            "SELECT 1 AS one FROM subscriptions WHERE feed_id = {feed} AND user_id IN ({}) LIMIT 1",
+            ids.join(", ")
+        );
+        Ok(!self.rows(&sql, a.0).await?.is_empty())
+    }
+
+    /// Who has heard an episode through: their place at 90% of its length or past it, where the
+    /// page calls it played. Not the read mark, which opening an item sets too: going by it,
+    /// DeadAir passed over every episode opened before it was played (#173).
+    pub async fn finished(&self, feed_id: &str, guid: &str) -> Result<Vec<i64>> {
+        self.rows(
+            "SELECT s.user_id FROM entry_state s
+               JOIN entries e ON e.feed_id = s.feed_id AND e.guid = s.guid
+              WHERE s.feed_id = $1 AND s.guid = $2 AND coalesce(s.duration, e.duration, 0) > 0
+                AND s.position * 10 >= coalesce(s.duration, e.duration) * 9",
+            vec![feed_id.into(), guid.into()],
+        )
+        .await?
+        .iter()
+        .map(|r| Ok(r.try_get("", "user_id")?))
+        .collect()
+    }
+
+    /// Records what DeadAir found in an enclosure: its plans as JSON, `{}` for none.
+    pub async fn store_plans(&self, enclosure_id: i64, plans: &str) -> Result<()> {
+        self.exec(
+            "INSERT INTO deadair_plans (enclosure_id, plans, made_at) VALUES ($1, $2, $3)
+             ON CONFLICT (enclosure_id) DO UPDATE SET plans = excluded.plans, made_at = excluded.made_at",
+            vec![enclosure_id.into(), plans.into(), now().into()],
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// DeadAir's plans for these enclosures, by pause, for each one it has looked at since it
+    /// was last downloaded and is still on disk. Empty for a file it does not apply to; missing
+    /// for one it has yet to look at.
+    pub async fn plans(
+        &self,
+        enclosure_ids: &[i64],
+    ) -> Result<std::collections::HashMap<i64, std::collections::BTreeMap<i64, crate::deadair::Plan>>> {
+        if enclosure_ids.is_empty() {
+            return Ok(Default::default());
+        }
+        let mut a = Args::default();
+        let ids: Vec<String> = enclosure_ids.iter().map(|&i| a.p(i)).collect();
+        let sql = format!(
+            "SELECT d.enclosure_id, d.plans FROM deadair_plans d JOIN enclosures e ON e.id = d.enclosure_id
+              WHERE d.enclosure_id IN ({}) AND e.path IS NOT NULL AND d.made_at >= coalesce(e.downloaded_at, 0)",
+            ids.join(", ")
+        );
+        self.rows(&sql, a.0)
+            .await?
+            .iter()
+            .map(|r| {
+                let plans: String = r.try_get("", "plans")?;
+                Ok((r.try_get("", "enclosure_id")?, serde_json::from_str(&plans).context("reading DeadAir's plans")?))
+            })
+            .collect()
+    }
+
+    /// Counts an episode towards the time DeadAir has saved someone, once however often it is
+    /// played.
+    pub async fn count_deadair(&self, user_id: i64, feed_id: &str, guid: &str, saved_ms: i64) -> Result<()> {
+        self.exec(
+            "INSERT INTO deadair_saved (user_id, feed_id, guid, saved_ms, at) VALUES ($1, $2, $3, $4, $5)
+             ON CONFLICT (user_id, feed_id, guid) DO NOTHING",
+            vec![user_id.into(), feed_id.into(), guid.into(), saved_ms.into(), now().into()],
+        )
+        .await?;
+        Ok(())
+    }
+
+    /// An episode's length as someone's player measured it, else as its feed gives it.
+    pub async fn entry_duration(&self, user_id: i64, feed_id: &str, guid: &str) -> Result<Option<i64>> {
+        let rows = self
+            .rows(
+                "SELECT coalesce(s.duration, e.duration) AS duration FROM entries e
+                   LEFT JOIN entry_state s ON s.user_id = $1 AND s.feed_id = e.feed_id AND s.guid = e.guid
+                  WHERE e.feed_id = $2 AND e.guid = $3",
+                vec![user_id.into(), feed_id.into(), guid.into()],
+            )
+            .await?;
+        Ok(rows.first().map(|r| r.try_get::<Option<i64>>("", "duration")).transpose()?.flatten())
+    }
+
+    /// The time DeadAir has saved someone, in ms.
+    pub async fn deadair_total(&self, user_id: i64) -> Result<i64> {
+        let rows = self
+            .rows(
+                "SELECT CAST(coalesce(sum(saved_ms), 0) AS BIGINT) AS total FROM deadair_saved WHERE user_id = $1",
+                vec![user_id.into()],
+            )
+            .await?;
+        // Cast: Postgres sums bigints as NUMERIC, which does not read as an i64.
+        Ok(rows.first().map(|r| r.try_get::<i64>("", "total")).transpose()?.unwrap_or(0))
+    }
+}
+
 /// Unix seconds. Everything time-shaped in the DB is stored this way.
 pub fn now() -> i64 {
     std::time::SystemTime::now()
@@ -2180,6 +2472,58 @@ pub fn now() -> i64 {
 mod tests {
     use super::*;
 
+    #[tokio::test]
+    async fn deadair_looks_at_a_file_once_per_download_and_counts_an_episode_once() {
+        let db = Db::memory().await.unwrap();
+        let u = db.create_user("dee", None, false).await.unwrap();
+        db.set_deadair(u, "f", Some(true)).await.unwrap();
+        db.set_deadair(u, "g", Some(false)).await.unwrap();
+        db.set_deadair(u, "g", None).await.unwrap();
+        assert_eq!(db.deadair_prefs(Some(u)).await.unwrap(), vec![(u, "f".to_string(), true, None)]);
+        db.set_deadair_pause(u, "f", 500).await.unwrap();
+        // Only beside a setting of the switch: a row of its own would turn DeadAir off for "g".
+        db.set_deadair_pause(u, "g", 400).await.unwrap();
+        assert_eq!(db.deadair_prefs(Some(u)).await.unwrap(), vec![(u, "f".to_string(), true, Some(500))]);
+        for sql in [
+            "INSERT INTO enclosures (id, feed_id, guid, url, path, state, downloaded_at)
+             VALUES (1, 'f', 'g', 'http://x/a.mp3', '/x/a.mp3', 'done', 100)",
+            "INSERT INTO enclosures (id, feed_id, guid, url, path, state) VALUES (2, 'f', 'h', 'http://x/b.mp3', NULL, 'reaped')",
+            "INSERT INTO entries (feed_id, guid, first_seen, duration) VALUES ('f', 'g', 1, 600)",
+        ] {
+            db.orm.execute_unprepared(sql).await.unwrap();
+        }
+        let todo = db.deadair_todo().await.unwrap();
+        assert_eq!(todo.iter().map(|t| t.id).collect::<Vec<_>>(), [1], "only a file on disk");
+
+        db.store_plans(1, r#"{"300": {"cuts": [[1000,3000]], "pieces": [[0,10,1.0]]}}"#).await.unwrap();
+        assert!(db.deadair_todo().await.unwrap().is_empty());
+        let p = db.plans(&[1, 2]).await.unwrap();
+        assert_eq!((p.len(), p[&1][&300].cuts.as_slice(), p[&1][&300].saved_ms()), (1, &[crate::deadair::Cut(1000, 3000)][..], 2000));
+        // Downloaded again since: looked at again before it plays shortened.
+        db.orm.execute_unprepared(&format!("UPDATE enclosures SET downloaded_at = {} WHERE id = 1", now() + 60)).await.unwrap();
+        assert_eq!(db.deadair_todo().await.unwrap().len(), 1);
+        assert!(db.plans(&[1]).await.unwrap().is_empty());
+
+        assert!(!db.subscribed_any(&[u], "f").await.unwrap());
+        db.subscribe(u, "f").await.unwrap();
+        assert!(db.subscribed_any(&[u], "f").await.unwrap());
+        // Opened, which marks it read, and not played: not finished (#173).
+        db.set_entry_flag(u, "f", "g", EntryFlag::Read, true).await.unwrap();
+        assert!(db.finished("f", "g").await.unwrap().is_empty());
+
+        assert_eq!(db.entry_duration(u, "f", "g").await.unwrap(), Some(600));
+        db.set_position(u, "f", "g", 10, Some(590)).await.unwrap();
+        assert_eq!(db.entry_duration(u, "f", "g").await.unwrap(), Some(590), "what the player measured");
+        assert!(db.finished("f", "g").await.unwrap().is_empty());
+        db.set_position(u, "f", "g", 540, Some(590)).await.unwrap();
+        assert_eq!(db.finished("f", "g").await.unwrap(), [u], "past 90%");
+
+        assert_eq!(db.deadair_total(u).await.unwrap(), 0);
+        db.count_deadair(u, "f", "g", 2000).await.unwrap();
+        db.count_deadair(u, "f", "g", 2000).await.unwrap();
+        assert_eq!(db.deadair_total(u).await.unwrap(), 2000, "a replay counts once");
+    }
+
     #[tokio::test]
     async fn a_read_does_not_wait_for_a_write_in_progress() {
         use sea_orm::TransactionTrait;
@@ -2272,6 +2616,10 @@ mod tests {
         assert_eq!(order("type", "asc").await.first().map(String::as_str), Some("n"));
         db.exec_for_test("DELETE FROM entries WHERE guid = 'n';").await.unwrap();
         assert_eq!(order("published", "desc").await, ["c", "b", "a"]);
+        // A page from the middle: the keys are paged before the rows are read (#188).
+        let page: Vec<String> = db.entries_in(1, None, Filter::All, None, 1, 1, &order_sql("published", "desc")).await
+            .unwrap().into_iter().map(|e| e.guid).collect();
+        assert_eq!(page, ["b"]);
         db.set_entry_flag(1, "f", "a", EntryFlag::Flagged, true).await.unwrap();
         assert_eq!(order("kept", "desc").await[0], "a");
         // A pin does not lift an item above the others in any other sort (#36).
@@ -2286,9 +2634,9 @@ mod tests {
         let db = Db::memory().await.unwrap();
         db.exec_for_test(
             "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',true),(2,'sam',false);
-             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f'),(1,'g'),(2,'f');
+             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f'),(1,'g'),(2,'f'),(2,'h');
-             INSERT INTO feeds (id, url, title, ttl_mins) VALUES ('f','u','F',30),('g','v','G',null);
+             INSERT INTO feeds (id, url, title, ttl_mins) VALUES ('f','u','F',30),('g','v','G',null),('h','w','H',null);
-             INSERT INTO entries (feed_id, guid, first_seen) VALUES ('f','a',0),('f','b',0),('f','c',0),('g','d',0);
+             INSERT INTO entries (feed_id, guid, first_seen) VALUES ('f','a',0),('f','b',0),('f','c',0),('g','d',0),('h','e',0);
              INSERT INTO entry_state (user_id, feed_id, guid, read) VALUES (1,'f','a',true),(2,'f','b',true);
              INSERT INTO hidden (user_id, feed_id, guid) VALUES (1,'f','c');
              INSERT INTO enclosures (id, feed_id, guid, url, path, state) VALUES
@@ -2309,6 +2657,8 @@ mod tests {
             assert_eq!(one.ttl_mins, db.http_state(id).await.unwrap().ttl_mins, "{id}");
         }
         assert_eq!((list["f"].unread, list["g"].unread), (1, 1)); // a read, c hidden; sam's read is sam's
+        // Only sam reads h: still listed, for its title, but its items are not counted for ray (#165).
+        assert_eq!((list["h"].summary.title.as_deref(), list["h"].summary.entries), (Some("H"), 0));
     }
 
     #[tokio::test]

crates/ipx/src/deadair.rs

@@ -0,0 +1,755 @@
+//! DeadAir (issue #171): podcasts play with their long silences shortened, so they finish
+//! sooner without sounding sped up.
+//!
+//! Nothing is copied (#181). DeadAir finds a file's silences once, in the background, and keeps a
+//! `Plan` for each pause length a person can choose (#182): the frames kept, as byte ranges of
+//! the original. The player gets an HLS playlist of those ranges (`playlist`), which Safari plays
+//! itself and other browsers through hls.js, with no gap at the cuts. Seeking past each silence
+//! instead left about 1.3 s of nothing at every one (#178); a copy made with ffmpeg cost as much
+//! disk again as the original and could only have one pause length.
+//!
+//! Positions stay in the original's time. What a plan leaves out is stored as `Cut`s of the
+//! original's time, and the server converts both ways (`to_copy`, `to_original`): the iOS and
+//! Android apps save positions themselves, from their own player, so converting in the page
+//! would miss them.
+
+use std::collections::{BTreeMap, HashMap};
+use std::fmt::Write as _;
+use std::path::Path;
+use std::sync::Arc;
+
+use tracing::Instrument;
+
+use crate::db::step;
+
+use anyhow::{Context, Result, bail};
+use serde::{Deserialize, Serialize};
+
+use crate::Ctx;
+
+/// Quieter than this for longer than `MIN_SILENCE` is a silence: what the measurements on the
+/// issue used. A podcast's room tone sits well below it and speech well above.
+const THRESHOLD: &str = "-38dB";
+const MIN_SILENCE: f64 = 0.35;
+/// The pauses a person can have DeadAir leave where it cuts a silence, in ms (#182). Half of it
+/// is kept at each end of the silence, so the frames on both sides of a cut are silent. Decoding
+/// blends a frame with the one before it, and an MP3 frame can begin in the bytes of the frame
+/// before (the bit reservoir): the first frame after a cut decodes against the wrong neighbour,
+/// which nobody hears between two silent frames and everyone hears at the start of a word.
+pub const PAUSES: [i64; 4] = [200, 300, 400, 500];
+/// 0.2 s, the first DeadAir's, made speech sound rushed.
+pub const DEFAULT_PAUSE: i64 = 300;
+/// The longest piece of a playlist, in seconds: about what HLS players expect, so a long stretch
+/// of talk is not one request for megabytes.
+const MAX_PIECE: f64 = 10.0;
+/// How long the maker waits when there is nothing to do: a download or a feed turned on is
+/// picked up this long after, at most.
+const IDLE: std::time::Duration = std::time::Duration::from_secs(120);
+
+/// A span of the original, in milliseconds, that DeadAir leaves out.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Cut(pub i64, pub i64);
+
+/// What one pause length leaves of a file: what it cuts, and what it keeps as pieces of the
+/// original, (byte offset, bytes, seconds).
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct Plan {
+    pub cuts: Vec<Cut>,
+    pub pieces: Vec<(u64, u64, f64)>,
+}
+
+impl Plan {
+    pub fn saved_ms(&self) -> i64 {
+        saved(&self.cuts)
+    }
+}
+
+/// The length of the ID3v2 tag a file starts with, 0 if it has none.
+pub fn id3_len(head: &[u8]) -> u64 {
+    if head.len() < 10 || &head[..3] != b"ID3" {
+        return 0;
+    }
+    // Seven bits a byte, so no byte of the size looks like the start of a frame.
+    let size = head[6..10].iter().fold(0u64, |n, b| n << 7 | u64::from(b & 0x7f));
+    let footer = if head[5] & 0x10 != 0 { 10 } else { 0 };
+    10 + size + footer
+}
+
+/// A file as `plan` plays it, to save (#186): its ID3 tag, so the title and artwork come too, then
+/// the pieces one after another. MP3 and ADTS frames each stand alone, so that is a file any
+/// player plays. Read as it is sent and never stored, as the playlist is: (its length, its bytes).
+pub async fn kept(
+    path: &Path,
+    plan: &Plan,
+) -> std::io::Result<(u64, impl futures_util::Stream<Item = std::io::Result<axum::body::Bytes>> + use<>)> {
+    use tokio::io::{AsyncReadExt, AsyncSeekExt};
+    let mut file = tokio::fs::File::open(path).await?;
+    let mut head = [0u8; 10];
+    let n = file.read(&mut head).await?;
+    // Only up to the first frame kept: past the tag can be the Xing frame, which gives the
+    // original's length.
+    let first = plan.pieces.first().map_or(0, |p| p.0);
+    let tag = id3_len(&head[..n]).min(first);
+    let ranges: std::collections::VecDeque<(u64, u64)> =
+        std::iter::once((0, tag)).chain(plan.pieces.iter().map(|&(o, n, _)| (o, n))).filter(|r| r.1 > 0).collect();
+    let len = ranges.iter().map(|r| r.1).sum();
+    let body = futures_util::stream::try_unfold((file, ranges), |(mut f, mut left)| async move {
+        let Some((off, n)) = left.pop_front() else { return Ok(None) };
+        let mut buf = vec![0; n.min(1 << 16) as usize];
+        f.seek(std::io::SeekFrom::Start(off)).await?;
+        f.read_exact(&mut buf).await?;
+        let got = buf.len() as u64;
+        if got < n {
+            left.push_front((off + got, n - got));
+        }
+        Ok(Some((axum::body::Bytes::from(buf), (f, left))))
+    });
+    Ok((len, body))
+}
+
+/// The silences silencedetect reported, as (start, end) seconds. One still open at the end of
+/// the file has no end and is left alone.
+pub fn parse_silences(log: &str) -> Vec<(f64, f64)> {
+    let mut out = Vec::new();
+    let mut start = None;
+    for line in log.lines() {
+        if let Some(v) = after(line, "silence_start: ") {
+            start = Some(v);
+        } else if let Some(v) = after(line, "silence_end: ")
+            && let Some(s) = start.take()
+        {
+            out.push((s, v));
+        }
+    }
+    out
+}
+
+fn after(line: &str, key: &str) -> Option<f64> {
+    let rest = &line[line.find(key)? + key.len()..];
+    rest.split_whitespace().next()?.parse().ok()
+}
+
+/// Which frames to drop for these silences, as inclusive ranges of frame numbers, and the same
+/// as `Cut`s. Frame `n` plays from `first + n * frame` seconds. Only frames wholly inside a
+/// silence, `keep` seconds in from each end, go.
+pub fn plan(silences: &[(f64, f64)], first: f64, frame: f64, keep: f64) -> (Vec<(u64, u64)>, Vec<Cut>) {
+    let spans: Vec<(u64, u64)> = silences
+        .iter()
+        .filter(|(s, e)| e - s >= MIN_SILENCE)
+        .filter_map(|&(s, e)| {
+            let a = ((s + keep - first) / frame).ceil().max(0.0) as u64;
+            let b = ((e - keep - first) / frame).floor() as i64 - 1;
+            (b >= a as i64).then_some((a, b as u64))
+        })
+        .collect();
+    let ms = |n: u64| ((first + n as f64 * frame) * 1000.0).round() as i64;
+    let cuts = spans.iter().map(|&(a, b)| Cut(ms(a), ms(b + 1))).collect();
+    (spans, cuts)
+}
+
+/// The frames kept, as pieces of the file: runs of frames lying end to end in it, none past
+/// `MAX_PIECE`. `frames` is each frame's (byte offset, bytes); `drop` is from `plan`.
+pub fn pieces(frames: &[(u64, u64)], drop: &[(u64, u64)], frame: f64) -> Vec<(u64, u64, f64)> {
+    let most = ((MAX_PIECE / frame).floor() as usize).max(1);
+    let mut out = Vec::new();
+    let push = |out: &mut Vec<(u64, u64, f64)>, (first, n): (usize, usize)| {
+        let (start, (pos, size)) = (frames[first].0, frames[first + n - 1]);
+        out.push((start, pos + size - start, n as f64 * frame));
+    };
+    let mut drops = drop.iter().peekable();
+    let mut run: Option<(usize, usize)> = None;
+    for (n, &(pos, _)) in frames.iter().enumerate() {
+        while drops.peek().is_some_and(|&&(_, b)| (b as usize) < n) {
+            drops.next();
+        }
+        let dropped = drops.peek().is_some_and(|&&(a, _)| a as usize <= n);
+        // Something between two frames (an ID3 tag partway through) ends a piece too.
+        let joins = !dropped
+            && run.is_some_and(|(f, c)| c < most && frames[f + c - 1].0 + frames[f + c - 1].1 == pos);
+        if !joins && let Some(r) = run.take() {
+            push(&mut out, r);
+        }
+        if !dropped {
+            run = Some(run.map_or((n, 1), |(f, c)| (f, c + 1)));
+        }
+    }
+    if let Some(r) = run {
+        push(&mut out, r);
+    }
+    out
+}
+
+/// The HLS playlist for a plan: each piece a byte range of `uri`, the original.
+pub fn playlist(plan: &Plan, uri: &str) -> String {
+    let longest = plan.pieces.iter().map(|p| p.2).fold(0.0, f64::max);
+    let mut s = format!(
+        "#EXTM3U\n#EXT-X-VERSION:4\n#EXT-X-TARGETDURATION:{}\n#EXT-X-PLAYLIST-TYPE:VOD\n#EXT-X-MEDIA-SEQUENCE:0\n",
+        longest.ceil() as u64
+    );
+    for &(off, len, secs) in &plan.pieces {
+        let _ = write!(s, "#EXTINF:{secs:.6},\n#EXT-X-BYTERANGE:{len}@{off}\n{uri}\n");
+    }
+    s + "#EXT-X-ENDLIST\n"
+}
+
+/// A time in the original, in ms, as the same moment in the shortened version. A time inside a
+/// cut is where the cut was made.
+pub fn to_copy(cuts: &[Cut], ms: i64) -> i64 {
+    let mut out = ms;
+    for &Cut(s, e) in cuts {
+        if ms >= e {
+            out -= e - s;
+        } else {
+            if ms > s {
+                out -= ms - s;
+            }
+            break;
+        }
+    }
+    out
+}
+
+/// A time in the shortened version, in ms, as the same moment in the original.
+pub fn to_original(cuts: &[Cut], ms: i64) -> i64 {
+    let mut out = ms;
+    for &Cut(s, e) in cuts {
+        if out >= s {
+            out += e - s;
+        } else {
+            break;
+        }
+    }
+    out
+}
+
+pub fn saved(cuts: &[Cut]) -> i64 {
+    cuts.iter().map(|Cut(s, e)| e - s).sum()
+}
+
+/// Whether someone with these settings plays a feed shortened. Off for every feed until they
+/// turn it on for that one, or for the group it came in (an OPML or a Patreon creator), which a
+/// feed of the group can still say otherwise to.
+pub fn wants(prefs: &HashMap<String, bool>, feed: &str, group: Option<&str>) -> bool {
+    prefs.get(feed).or_else(|| group.and_then(|g| prefs.get(g))).copied().unwrap_or(false)
+}
+
+/// The settings of each person with DeadAir on for something, and each managed feed's group,
+/// which is what `wants` and `pause` need.
+pub struct Wanting {
+    pub people: HashMap<i64, HashMap<String, bool>>,
+    pub pauses: HashMap<(i64, String), i64>,
+    pub groups: HashMap<String, String>,
+}
+
+impl Wanting {
+    pub async fn load(ctx: &Ctx, only: Option<i64>) -> Result<Self> {
+        let mut people: HashMap<i64, HashMap<String, bool>> = HashMap::new();
+        let mut pauses = HashMap::new();
+        for (user, feed, wanted, pause) in ctx.db.deadair_prefs(only).await? {
+            if let Some(p) = pause {
+                pauses.insert((user, feed.clone()), p);
+            }
+            people.entry(user).or_default().insert(feed, wanted);
+        }
+        people.retain(|_, p| p.values().any(|&w| w));
+        let groups = if people.is_empty() {
+            HashMap::new()
+        } else {
+            ctx.db.managed_feeds().await?.into_iter().map(|m| (m.id, m.group_id)).collect()
+        };
+        Ok(Self { people, pauses, groups })
+    }
+
+    pub fn wants(&self, user: i64, feed: &str) -> bool {
+        self.people
+            .get(&user)
+            .is_some_and(|p| wants(p, feed, self.groups.get(feed).map(String::as_str)))
+    }
+
+    /// The pause this person has DeadAir leave in a feed: the feed's, else its group's.
+    pub fn pause(&self, user: i64, feed: &str) -> i64 {
+        let group = self.groups.get(feed);
+        self.pauses
+            .get(&(user, feed.to_owned()))
+            .or_else(|| group.and_then(|g| self.pauses.get(&(user, g.clone()))))
+            .copied()
+            .unwrap_or(DEFAULT_PAUSE)
+    }
+}
+
+/// The plan someone plays a file with: their pause's, for a file in a feed they have DeadAir on
+/// for, once its silences are found. None if it cuts nothing.
+fn chosen(wanting: &Wanting, user: i64, feed: &str, plans: &BTreeMap<i64, Plan>) -> Option<Plan> {
+    if !wanting.wants(user, feed) {
+        return None;
+    }
+    plans.get(&wanting.pause(user, feed)).filter(|p| !p.cuts.is_empty()).cloned()
+}
+
+/// What each person is playing shortened, by (person, feed, guid): set when they are handed the
+/// playlist and cleared when `/media` serves them the original, so a saved position is converted
+/// from the clock it was measured in, whether the page saved it or a native app did.
+// shortcut: in memory, so a restart forgets it. A position saved before the player next asks
+// for the playlist is then taken as the original's, which resumes a little early, never late.
+pub type Playing = Arc<std::sync::Mutex<HashMap<(i64, String, String), Arc<Plan>>>>;
+
+/// The plan for one file as this person would play it, for the playlist route.
+pub async fn plan_for(ctx: &Ctx, user: i64, feed: &str, enclosure: i64) -> Result<Option<Plan>> {
+    let wanting = Wanting::load(ctx, Some(user)).await?;
+    let plans = ctx.db.plans(&[enclosure]).await?;
+    Ok(plans.get(&enclosure).and_then(|p| chosen(&wanting, user, feed, p)))
+}
+
+/// Puts a page of entries in the clock of what this person will play: for each file they play
+/// shortened, `deadair` is the seconds it saves, and the entry's position and length are the
+/// shortened version's. The page plays `/media/{id}/deadair.m3u8` for a file that has it.
+pub async fn for_reader(ctx: &Ctx, user: i64, rows: &mut [crate::db::EntryRow]) -> Result<()> {
+    let wanting = Wanting::load(ctx, Some(user)).await?;
+    if wanting.people.is_empty() {
+        return Ok(());
+    }
+    let ids: Vec<i64> = rows
+        .iter()
+        .filter(|r| wanting.wants(user, &r.feed_id))
+        .flat_map(|r| r.enclosures.iter().filter(|e| e.path.is_some()).map(|e| e.id))
+        .collect();
+    let plans = ctx.db.plans(&ids).await?;
+    for r in rows.iter_mut() {
+        // Heard through already: the maker passes it over, so nothing is coming.
+        let finished = r.duration.is_some_and(|d| d > 0 && r.position * 10 >= d * 9);
+        let mut converted = false;
+        for e in &mut r.enclosures {
+            e.deadair_pending = ids.contains(&e.id) && e.state == "done" && !plans.contains_key(&e.id) && !finished;
+            let Some(p) = plans.get(&e.id).and_then(|p| chosen(&wanting, user, &r.feed_id, p)) else { continue };
+            e.deadair = Some(p.saved_ms() / 1000);
+            // One position an item, however many files: the first played shortened sets the clock.
+            if !std::mem::replace(&mut converted, true) {
+                r.position = to_copy(&p.cuts, r.position * 1000) / 1000;
+                r.duration = r.duration.map(|d| to_copy(&p.cuts, d * 1000) / 1000);
+            }
+        }
+    }
+    Ok(())
+}
+
+/// A position and length a player saved, in the clock of what it was playing, as the
+/// original's. Past 75% of the shortened version, the episode also counts towards the time
+/// DeadAir has saved this person.
+pub async fn on_save(
+    ctx: &Ctx,
+    playing: &Playing,
+    user: i64,
+    feed: &str,
+    guid: &str,
+    secs: i64,
+    duration: Option<i64>,
+) -> Result<(i64, Option<i64>)> {
+    let plan = playing.lock().unwrap().get(&(user, feed.to_owned(), guid.to_owned())).cloned();
+    let Some(p) = plan else { return Ok((secs, duration)) };
+    let original = |s: i64| to_original(&p.cuts, s * 1000) / 1000;
+    let (secs, duration) = (original(secs), duration.map(original));
+    let len = match duration {
+        Some(d) => Some(d),
+        None => ctx.db.entry_duration(user, feed, guid).await?,
+    };
+    if let Some(len) = len
+        && len > 0
+        && secs * 4 >= len * 3
+    {
+        ctx.db.count_deadair(user, feed, guid, p.saved_ms()).await?;
+    }
+    Ok((secs, duration))
+}
+
+/// Finds silences until stopped: in the next file anyone wants shortened, or a wait of `IDLE`
+/// when there is none.
+pub async fn run(ctx: Arc<Ctx>, mut stop: tokio::sync::watch::Receiver<bool>) {
+    if !have_ffmpeg().await {
+        tracing::warn!("ffmpeg is not installed, so DeadAir shortens nothing");
+        return;
+    }
+    // Files ffmpeg failed on, passed over until the next start. Not stored: a failure recorded
+    // as the file having nothing to cut was never tried again, even once a fix was deployed (#174).
+    let mut failed = std::collections::HashSet::new();
+    loop {
+        // Dropping the pass on a signal kills the ffmpeg it is running (`kill_on_drop`).
+        let done = tokio::select! {
+            _ = stop.changed() => return,
+            done = next(&ctx, &mut failed) => done,
+        };
+        match done {
+            Ok(true) => continue,
+            Ok(false) => {}
+            Err(e) => tracing::warn!(error = %format!("{e:#}"), "DeadAir could not read a file"),
+        }
+        tokio::select! {
+            _ = stop.changed() => return,
+            _ = ctx.deadair.notified() => {}
+            _ = tokio::time::sleep(IDLE) => {}
+        }
+    }
+}
+
+async fn have_ffmpeg() -> bool {
+    tokio::process::Command::new("ffmpeg")
+        .arg("-version")
+        .stdout(std::process::Stdio::null())
+        .status()
+        .await
+        .is_ok_and(|s| s.success())
+}
+
+/// Plans one file someone wants shortened, if there is one. A file everyone who would play it
+/// shortened has already heard through gets none: finished episodes are rarely played again.
+// shortcut: those stay on the list and are looked at again each pass, one query each; record
+// them as passed over if a large library makes the pass slow.
+async fn next(ctx: &Ctx, failed: &mut std::collections::HashSet<i64>) -> Result<bool> {
+    // Nobody with DeadAir on for anything, which is most passes: nothing more to ask the database.
+    use std::sync::atomic::Ordering::Relaxed;
+    let st = &crate::metrics::STATS;
+    let wanting = Wanting::load(ctx, None).await?;
+    if wanting.people.is_empty() {
+        st.deadair_backlog.store(0, Relaxed);
+        return Ok(false);
+    }
+    let todo = ctx.db.deadair_todo().await?;
+    // For /metrics (#195): files of feeds someone has DeadAir on, from memory, without the
+    // per-file subscription and finished checks below.
+    let wanted = |t: &crate::db::DeadAirTodo| !failed.contains(&t.id) && wanting.people.keys().any(|&u| wanting.wants(u, &t.feed_id));
+    st.deadair_backlog.store(todo.iter().filter(|t| wanted(t)).count() as i64, Relaxed);
+    for t in todo {
+        if failed.contains(&t.id) {
+            continue;
+        }
+        let users: Vec<i64> =
+            wanting.people.keys().copied().filter(|&u| wanting.wants(u, &t.feed_id)).collect();
+        if users.is_empty() || !ctx.db.subscribed_any(&users, &t.feed_id).await? {
+            continue;
+        }
+        let finished = ctx.db.finished(&t.feed_id, &t.guid).await?;
+        if users.iter().all(|u| finished.contains(u)) {
+            continue;
+        }
+        let src = crate::download::playable(Path::new(&t.path));
+        let started = std::time::Instant::now();
+        // A trace of its own for each file looked at, not for the passes that find nothing to do,
+        // which are most of them.
+        let span = tracing::info_span!("deadair", feed = t.feed_id, enclosure = t.id, cuts = tracing::field::Empty);
+        st.deadair_busy_since.store(crate::db::now(), Relaxed);
+        let analysed = analyse(&src).instrument(span.clone()).await;
+        st.deadair_busy_since.store(0, Relaxed);
+        let plans = match analysed {
+            Ok(p) => p.unwrap_or_default(),
+            Err(e) => {
+                tracing::warn!(path = %src.display(), error = %format!("{e:#}"), "DeadAir could not read a file");
+                failed.insert(t.id);
+                return Ok(true);
+            }
+        };
+        ctx.db.store_plans(t.id, &serde_json::to_string(&plans)?).instrument(span.in_scope(|| step("store_plans"))).await?;
+        let usual = plans.get(&DEFAULT_PAUSE);
+        span.record("cuts", usual.map_or(0, |p| p.cuts.len()));
+        let saved_ms = usual.map_or(0, Plan::saved_ms);
+        ctx.out.emit(crate::ipc::Event::DeadairDone { feed: t.feed_id.clone(), enclosure: t.id, saved_s: saved_ms / 1000 });
+        // The event says it too (ev="deadair_done"); this line has how long it took and how many cuts.
+        tracing::info!(
+            feed = t.feed_id,
+            path = %src.display(),
+            cuts = usual.map_or(0, |p| p.cuts.len()),
+            saved_s = saved_ms / 1000,
+            took_ms = started.elapsed().as_millis() as u64,
+            "DeadAir found the silences"
+        );
+        return Ok(true);
+    }
+    Ok(false)
+}
+
+/// A plan for each of `PAUSES`, for one file. None for a file DeadAir does not apply to: video,
+/// anything but MP3 or AAC on its own (ADTS; AAC in MP4 has no byte ranges a playlist can
+/// use), or one with no silence long enough to cut.
+pub async fn analyse(src: &Path) -> Result<Option<BTreeMap<i64, Plan>>> {
+    let Some((first, frame)) = probe(src).instrument(step("probe")).await? else { return Ok(None) };
+    let path = src.display().to_string();
+    let log = ffmpeg(&[
+        "-hide_banner", "-nostats", "-i", &path, "-map", "0:a:0",
+        "-af", &format!("silencedetect=n={THRESHOLD}:d={MIN_SILENCE}"), "-f", "null", "-",
+    ])
+    .instrument(step("silencedetect"))
+    .await
+    .context("finding the silences")?;
+    let silences = parse_silences(&log);
+    let frames = frame_bytes(&path).instrument(step("frame_bytes")).await?;
+    let plans: BTreeMap<i64, Plan> = PAUSES
+        .iter()
+        .map(|&pause| {
+            let (drop, cuts) = plan(&silences, first, frame, pause as f64 / 2000.0);
+            (pause, Plan { cuts, pieces: pieces(&frames, &drop, frame) })
+        })
+        .collect();
+    Ok(plans.values().any(|p| !p.cuts.is_empty()).then_some(plans))
+}
+
+/// Where each audio frame is in the file, as (byte offset, bytes), in order.
+async fn frame_bytes(path: &str) -> Result<Vec<(u64, u64)>> {
+    let out = run_out("ffprobe", &[
+        "-v", "error", "-select_streams", "a:0", "-show_entries", "packet=pos,size", "-of", "compact=p=0", path,
+    ])
+    .await?;
+    // ffprobe writes the fields in its own order, not the order asked for: by name, then.
+    out.lines()
+        .map(|l| {
+            let field = |k: &str| {
+                l.split('|').find_map(|f| f.strip_prefix(k)?.strip_prefix('=')?.parse::<u64>().ok())
+            };
+            field("pos").zip(field("size")).with_context(|| format!("reading ffprobe's frame: {l}"))
+        })
+        .collect()
+}
+
+/// When the first audio frame starts and how long each lasts, in seconds, for a file DeadAir
+/// can shorten; None for one it cannot. A cover picture in an MP3 is not video.
+async fn probe(src: &Path) -> Result<Option<(f64, f64)>> {
+    let path = src.display().to_string();
+    let out = run_out("ffprobe", &[
+        "-v", "error", "-show_entries",
+        "format=format_name:stream=codec_type,codec_name:stream_disposition=attached_pic", "-of", "json", &path,
+    ])
+    .await?;
+    let v: serde_json::Value = serde_json::from_str(&out).context("reading ffprobe")?;
+    let streams = v["streams"].as_array().cloned().unwrap_or_default();
+    let video = streams
+        .iter()
+        .any(|s| s["codec_type"] == "video" && s["disposition"]["attached_pic"] != 1);
+    let audio = streams.iter().find(|s| s["codec_type"] == "audio");
+    let format = v["format"]["format_name"].as_str().unwrap_or("");
+    let plain = |codec: &str| format == codec && audio.is_some_and(|a| a["codec_name"] == codec);
+    if video || !(plain("mp3") || plain("aac")) {
+        return Ok(None);
+    }
+    let out = run_out("ffprobe", &[
+        "-v", "error", "-select_streams", "a:0", "-show_entries", "packet=pts_time,duration_time",
+        "-read_intervals", "%+#1", "-of", "csv=p=0", &path,
+    ])
+    .await?;
+    let mut f = out.trim().split(',').map(|x| x.trim().parse::<f64>());
+    match (f.next(), f.next()) {
+        (Some(Ok(first)), Some(Ok(frame))) if frame > 0.0 => Ok(Some((first, frame))),
+        _ => bail!("no audio frame in {path}"),
+    }
+}
+
+/// Runs ffmpeg and gives back what it wrote to stderr, where silencedetect reports.
+async fn ffmpeg(args: &[&str]) -> Result<String> {
+    let out = command("ffmpeg").args(["-nostdin", "-threads", "1"]).args(args).output().await?;
+    let log = String::from_utf8_lossy(&out.stderr).into_owned();
+    if !out.status.success() {
+        bail!("ffmpeg failed: {}", log.lines().rev().take(3).collect::<Vec<_>>().join(" / "));
+    }
+    Ok(log)
+}
+
+async fn run_out(prog: &str, args: &[&str]) -> Result<String> {
+    let out = command(prog).args(args).output().await.with_context(|| format!("running {prog}"))?;
+    if !out.status.success() {
+        bail!("{prog} failed: {}", String::from_utf8_lossy(&out.stderr).trim());
+    }
+    Ok(String::from_utf8_lossy(&out.stdout).into_owned())
+}
+
+fn command(prog: &str) -> tokio::process::Command {
+    let mut c = tokio::process::Command::new(prog);
+    c.kill_on_drop(true).stdin(std::process::Stdio::null());
+    c
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn silences_are_read_from_the_log_and_an_open_one_is_left() {
+        let log = "[silencedetect @ 0x1] silence_start: 1\n\
+                   [silencedetect @ 0x1] silence_end: 3.00002 | silence_duration: 2.00002\n\
+                   [silencedetect @ 0x1] silence_start: 10.5\n";
+        assert_eq!(parse_silences(log), vec![(1.0, 3.00002)]);
+    }
+
+    #[test]
+    fn cuts_leave_silent_frames_either_side_and_skip_short_silences() {
+        // MP3 frames, 26.122 ms; one silence of 2 s, one too short to touch; a 0.3 s pause.
+        let frame = 1152.0 / 44100.0;
+        let (frames, cuts) = plan(&[(1.0, 3.0), (5.0, 5.3)], 0.0, frame, 0.15);
+        assert_eq!(frames, vec![(45, 108)]);
+        let Cut(s, e) = cuts[0];
+        assert!(s >= 1150 && e <= 2850, "{cuts:?}");
+        assert!(s - 1150 < 27 && 2850 - e < 27, "no more than a frame kept beyond half the pause: {cuts:?}");
+        // AAC starts a frame early, for the encoder's priming.
+        let (frames, _) = plan(&[(1.0, 3.0)], -0.02322, 1024.0 / 44100.0, 0.15);
+        assert_eq!(frames, vec![(51, 122)]);
+        // A silence the margins use up entirely is left alone.
+        assert!(plan(&[(1.0, 1.35)], 0.0, frame, 0.15).0.is_empty());
+        // A longer pause cuts less of the same silence.
+        assert!(saved(&plan(&[(1.0, 3.0)], 0.0, frame, 0.25).1) < saved(&cuts));
+    }
+
+    #[test]
+    fn pieces_are_the_frames_kept_end_to_end_and_never_too_long() {
+        // 1000 frames of 100 bytes after a 50-byte tag, an ID3 tag of 7 bytes before frame 600.
+        let frames: Vec<(u64, u64)> =
+            (0..1000u64).map(|n| (50 + n * 100 + if n >= 600 { 7 } else { 0 }, 100)).collect();
+        let frame = 0.026;
+        let p = pieces(&frames, &[(100, 199), (900, 999)], frame);
+        let at: Vec<u64> = p.iter().map(|x| x.0).collect();
+        // 0-99; 200-583 and 584-599, split at 384 frames (10 s); 600-899 after the tag.
+        assert_eq!(at, [50, 20_050, 58_450, 60_057]);
+        assert_eq!(p[0], (50, 10_000, 100.0 * frame));
+        assert_eq!(p[2].1, 1600, "frames 584-599");
+        assert!(p.iter().all(|x| x.2 <= MAX_PIECE));
+        let kept: u64 = p.iter().map(|x| x.1).sum();
+        assert_eq!(kept, 800 * 100, "every kept frame once, the tag in none");
+    }
+
+    #[test]
+    fn the_playlist_lists_each_piece_as_a_range_of_the_original() {
+        let plan = Plan { cuts: vec![Cut(1000, 2000)], pieces: vec![(50, 400, 1.0), (500, 4000, 9.5)] };
+        assert_eq!(
+            playlist(&plan, "deadair.mp3"),
+            "#EXTM3U\n#EXT-X-VERSION:4\n#EXT-X-TARGETDURATION:10\n#EXT-X-PLAYLIST-TYPE:VOD\n#EXT-X-MEDIA-SEQUENCE:0\n\
+             #EXTINF:1.000000,\n#EXT-X-BYTERANGE:400@50\ndeadair.mp3\n\
+             #EXTINF:9.500000,\n#EXT-X-BYTERANGE:4000@500\ndeadair.mp3\n#EXT-X-ENDLIST\n"
+        );
+    }
+
+    #[test]
+    fn positions_convert_both_ways() {
+        let cuts = [Cut(10_000, 20_000), Cut(30_000, 35_000)];
+        assert_eq!(to_copy(&cuts, 5_000), 5_000);
+        assert_eq!(to_copy(&cuts, 15_000), 10_000, "inside a cut is where it was made");
+        assert_eq!(to_copy(&cuts, 25_000), 15_000);
+        assert_eq!(to_copy(&cuts, 40_000), 25_000);
+        for t in [0, 5_000, 10_000, 15_000, 19_999, 20_000, 25_000, 40_000] {
+            let back = to_original(&cuts, to_copy(&cuts, t));
+            // A time inside a cut comes back as the cut's end: the shortened version has nothing between.
+            let expect = if (10_000..20_000).contains(&t) { 20_000 } else { t };
+            assert_eq!(back, expect, "{t}");
+        }
+        assert_eq!(saved(&cuts), 15_000);
+    }
+
+    #[test]
+    fn off_for_every_feed_until_turned_on_for_it_or_its_group() {
+        let p = |v: &[(&str, bool)]| v.iter().map(|(k, w)| (k.to_string(), *w)).collect::<HashMap<_, _>>();
+        assert!(!wants(&p(&[]), "a", None), "off until turned on for the feed");
+        assert!(!wants(&p(&[("b", true)]), "a", None), "another feed's says nothing of this one");
+        assert!(wants(&p(&[("a", true)]), "a", None));
+        assert!(wants(&p(&[("g", true)]), "a", Some("g")), "on for its group");
+        assert!(!wants(&p(&[("g", true), ("a", false)]), "a", Some("g")), "kept out of its group's");
+    }
+
+    #[test]
+    fn the_pause_is_the_feeds_then_its_groups_then_the_default() {
+        let w = Wanting {
+            people: HashMap::new(),
+            pauses: [((1, "a".to_string()), 500), ((1, "g".to_string()), 400)].into(),
+            groups: [("b".to_string(), "g".to_string())].into(),
+        };
+        assert_eq!(w.pause(1, "a"), 500);
+        assert_eq!(w.pause(1, "b"), 400, "its group's");
+        assert_eq!(w.pause(1, "c"), DEFAULT_PAUSE);
+        assert_eq!(w.pause(2, "a"), DEFAULT_PAUSE, "someone else's says nothing of yours");
+    }
+
+    #[test]
+    fn id3_len_reads_the_tags_size() {
+        assert_eq!(id3_len(b"ID3\x04\x00\x00\x00\x00\x02\x01xx"), 10 + 257);
+        assert_eq!(id3_len(b"ID3\x04\x00\x10\x00\x00\x02\x01"), 10 + 257 + 10, "with a footer");
+        assert_eq!(id3_len(b"\xff\xfb\x90\x00\x00\x00\x00\x00\x00\x00"), 0);
+        assert_eq!(id3_len(b"ID3"), 0);
+    }
+
+    /// The whole of it, on a clip ffmpeg makes: a second of tone, two of silence, and so on,
+    /// played back through its playlist by ffmpeg's own HLS reader. Skipped where ffmpeg is not
+    /// installed.
+    #[tokio::test]
+    async fn the_playlist_of_a_file_is_shorter_by_what_was_cut_and_plays() {
+        if !have_ffmpeg().await {
+            eprintln!("no ffmpeg; skipped");
+            return;
+        }
+        let dir = std::env::temp_dir().join(format!("ipx-deadair-{}", std::process::id()));
+        std::fs::create_dir_all(&dir).unwrap();
+        for (ext, codec) in [("mp3", "libmp3lame"), ("aac", "aac"), ("m4a", "aac")] {
+            let src = dir.join(format!("t.{ext}"));
+            ffmpeg(&[
+                "-v", "error", "-y", "-f", "lavfi", "-i",
+                "aevalsrc='if(lt(mod(t,3),1),0.5*sin(2*PI*440*t),0)':d=12:s=44100",
+                "-c:a", codec, &src.display().to_string(),
+            ])
+            .await
+            .unwrap();
+            let plans = analyse(&src).await.unwrap();
+            if ext == "m4a" {
+                assert!(plans.is_none(), "AAC in MP4 has no byte ranges to play");
+                continue;
+            }
+            let plans = plans.expect("plans");
+            assert_eq!(plans.keys().copied().collect::<Vec<_>>(), PAUSES);
+            let p = &plans[&DEFAULT_PAUSE];
+            assert_eq!(p.cuts.len(), 4, "{ext}: {:?}", p.cuts);
+            // About 1.7 s from each of the four 2 s silences, and less for a longer pause.
+            let cut = p.saved_ms();
+            assert!((6_500..6_900).contains(&cut), "{ext}: {cut}");
+            assert!(plans[&500].saved_ms() < cut && cut < plans[&200].saved_ms());
+            let list = dir.join(format!("{ext}.m3u8"));
+            std::fs::write(&list, playlist(p, &format!("t.{ext}"))).unwrap();
+            // Its frames added up: a raw AAC file's duration is only guessed from its bitrate.
+            let len = |p: &Path| {
+                let p = p.display().to_string();
+                async move {
+                    run_out("ffprobe", &["-v", "error", "-select_streams", "a:0", "-show_entries", "packet=duration_time", "-of", "csv=p=0", &p])
+                        .await
+                        .unwrap()
+                        .lines()
+                        .filter_map(|l| l.trim().trim_end_matches(',').parse::<f64>().ok())
+                        .sum::<f64>()
+                }
+            };
+            let short = len(&src).await - len(&list).await;
+            assert!((short * 1000.0 - cut as f64).abs() < 100.0, "{ext}: {short} s shorter, {cut} ms cut");
+            // Decodes without a complaint.
+            assert!(ffmpeg(&["-v", "error", "-i", &list.display().to_string(), "-f", "null", "-"]).await.unwrap().is_empty());
+            // Saved as a file of its own (#186): as long as the playlist, and it plays.
+            let (n, body) = kept(&src, p).await.unwrap();
+            let parts: Vec<_> = futures_util::TryStreamExt::try_collect(body).await.unwrap();
+            let bytes = parts.concat();
+            assert_eq!(bytes.len() as u64, n);
+            if ext == "mp3" {
+                assert!(bytes.starts_with(b"ID3"), "the original's tag comes too");
+            }
+            let saved = dir.join(format!("saved.{ext}"));
+            std::fs::write(&saved, &bytes).unwrap();
+            assert!((len(&saved).await - len(&list).await).abs() < 0.05, "{ext}");
+            assert!(ffmpeg(&["-v", "error", "-i", &saved.display().to_string(), "-f", "null", "-"]).await.unwrap().is_empty());
+        }
+        std::fs::remove_dir_all(&dir).unwrap();
+    }
+}
+
+/// A real episode, for trying the cut on something other than a test tone:
+/// `IPX_DEADAIR_FILE=/path/ep.mp3 cargo test real_file -- --ignored --nocapture`. Each pause's
+/// playlist is left beside it, `ep.mp3.300.m3u8`, to listen to.
+#[cfg(test)]
+#[tokio::test]
+#[ignore]
+async fn real_file() {
+    let src = std::path::PathBuf::from(std::env::var("IPX_DEADAIR_FILE").expect("IPX_DEADAIR_FILE"));
+    let t = std::time::Instant::now();
+    let plans = analyse(&src).await.unwrap().expect("plans");
+    eprintln!("analysed in {:.1?}", t.elapsed());
+    let name = src.file_name().unwrap().to_string_lossy().into_owned();
+    for (pause, p) in &plans {
+        std::fs::write(src.with_file_name(format!("{name}.{pause}.m3u8")), playlist(p, &name)).unwrap();
+        eprintln!("{pause} ms: {} cuts, {:.1} min saved, {} pieces", p.cuts.len(), p.saved_ms() as f64 / 60_000.0, p.pieces.len());
+    }
+}

crates/ipx/src/directory.rs

@@ -0,0 +1,293 @@
+//! The Directory, from the directory service (#205): ipx asks it on its people's behalf, so the
+//! page never talks to it and never sees its token, and sends it the public feeds people here
+//! subscribe to when an admin has turned sharing on.
+
+use std::collections::{HashMap, HashSet};
+
+use ipx_directory::{FeedPage, Listing, Me, SnapshotEntry, SnapshotResult};
+use serde::de::DeserializeOwned;
+
+use crate::{Ctx, Sub, config, feed};
+
+/// How often the snapshot goes when nothing has woken the sender sooner.
+const SHARE_EVERY: std::time::Duration = std::time::Duration::from_secs(30 * 60);
+
+/// What went wrong asking the directory, in words for an admin.
+#[derive(Debug)]
+pub enum DirError {
+    /// No address, or no token, in the settings.
+    NotConfigured,
+    /// It answered, refusing: 401 is a token it does not know, 403 one without the access asked for.
+    Refused(u16, String),
+    /// It did not answer, or not with what was asked for.
+    Unreachable(String),
+}
+
+impl std::fmt::Display for DirError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            DirError::NotConfigured => write!(f, "No directory is set up on this server. An admin sets one in Admin, Directory."),
+            DirError::Refused(401, _) => write!(f, "The directory does not accept this server's token. It may have been revoked."),
+            DirError::Refused(403, msg) => write!(f, "The directory refused: {msg}."),
+            DirError::Refused(404, _) => write!(f, "That is not in the directory."),
+            DirError::Refused(code, msg) => write!(f, "The directory answered {code}: {msg}"),
+            DirError::Unreachable(e) => write!(f, "The directory could not be reached: {e}"),
+        }
+    }
+}
+
+/// When the snapshot last went, and what came of it, for the admin page.
+#[derive(Debug, Clone, serde::Serialize)]
+pub struct Shared {
+    pub at: i64,
+    #[serde(flatten)]
+    pub result: Option<SnapshotResult>,
+    pub error: Option<String>,
+}
+
+fn target(cfg: &config::Config) -> Option<(String, String)> {
+    let url = cfg.general.directory_url.trim().trim_end_matches('/');
+    let token = cfg.general.directory_token.trim();
+    (!url.is_empty() && !token.is_empty()).then(|| (url.to_owned(), token.to_owned()))
+}
+
+pub fn configured(cfg: &config::Config) -> bool {
+    target(cfg).is_some()
+}
+
+async fn call<T: DeserializeOwned>(ctx: &Ctx, method: reqwest::Method, path: &str, body: Option<&[SnapshotEntry]>) -> Result<T, DirError> {
+    let (base, token) = target(&ctx.cfg()).ok_or(DirError::NotConfigured)?;
+    let mut req = ctx.client.request(method, format!("{base}{path}")).bearer_auth(token).timeout(std::time::Duration::from_secs(20));
+    // The directory's spans join this request's trace (#213).
+    if let Some(tp) = ipx_directory::otel::traceparent() {
+        req = req.header("traceparent", tp);
+    }
+    if let Some(b) = body {
+        req = req.json(b);
+    }
+    let resp = req.send().await.map_err(|e| DirError::Unreachable(format!("{e:#}")))?;
+    let status = resp.status();
+    if !status.is_success() {
+        let msg = resp.json::<serde_json::Value>().await.ok().and_then(|v| v["error"].as_str().map(str::to_owned)).unwrap_or_default();
+        return Err(DirError::Refused(status.as_u16(), msg));
+    }
+    // A removal or an unblock answers 204, with nothing to read: that reads as null, which is ().
+    let body = resp.bytes().await.map_err(|e| DirError::Unreachable(format!("{e:#}")))?;
+    serde_json::from_slice(if body.is_empty() { b"null" } else { &body }).map_err(|e| DirError::Unreachable(format!("its answer did not read: {e:#}")))
+}
+
+fn seg(s: &str) -> percent_encoding::PercentEncode<'_> {
+    percent_encoding::utf8_percent_encode(s, percent_encoding::NON_ALPHANUMERIC)
+}
+
+pub async fn me(ctx: &Ctx) -> Result<Me, DirError> {
+    call(ctx, reqwest::Method::GET, "/v1/me", None).await
+}
+
+pub async fn feeds(ctx: &Ctx) -> Result<Vec<Listing>, DirError> {
+    call(ctx, reqwest::Method::GET, "/v1/feeds", None).await
+}
+
+pub async fn popular(ctx: &Ctx) -> Result<Vec<Listing>, DirError> {
+    call(ctx, reqwest::Method::GET, "/v1/popular?limit=10", None).await
+}
+
+pub async fn page(ctx: &Ctx, id: &str) -> Result<FeedPage, DirError> {
+    call(ctx, reqwest::Method::GET, &format!("/v1/feeds/{}", seg(id)), None).await
+}
+
+// Administering the directory (#206): each needs an rwa token, which the directory checks.
+
+/// Removes a feed and blocks it, so no snapshot brings it back.
+pub async fn remove(ctx: &Ctx, id: &str) -> Result<(), DirError> {
+    call(ctx, reqwest::Method::DELETE, &format!("/v1/feeds/{}", seg(id)), None).await
+}
+
+pub async fn refresh(ctx: &Ctx, id: &str) -> Result<serde::de::IgnoredAny, DirError> {
+    call(ctx, reqwest::Method::POST, &format!("/v1/feeds/{}/refresh", seg(id)), None).await
+}
+
+pub async fn blocked(ctx: &Ctx) -> Result<Vec<ipx_directory::Blocked>, DirError> {
+    call(ctx, reqwest::Method::GET, "/v1/blocked", None).await
+}
+
+pub async fn unblock(ctx: &Ctx, id: &str) -> Result<(), DirError> {
+    call(ctx, reqwest::Method::DELETE, &format!("/v1/blocked/{}", seg(id)), None).await
+}
+
+pub async fn instances(ctx: &Ctx) -> Result<Vec<ipx_directory::Instance>, DirError> {
+    call(ctx, reqwest::Method::GET, "/v1/instances", None).await
+}
+
+/// Drops one server's snapshot, and its counts with it. It comes back with that server's next
+/// one: to keep a server out, revoke its token.
+pub async fn drop_instance(ctx: &Ctx, name: &str) -> Result<(), DirError> {
+    call(ctx, reqwest::Method::DELETE, &format!("/v1/instances/{}", seg(name)), None).await
+}
+
+/// Has the snapshot sent again now, changed or not.
+pub fn resend_now(ctx: &Ctx) {
+    ctx.directory_resend.store(true, std::sync::atomic::Ordering::Relaxed);
+    ctx.directory_wake.notify_one();
+}
+
+/// Whether this server's token may administer the directory.
+pub async fn can_admin(ctx: &Ctx) -> bool {
+    me(ctx).await.is_ok_and(|m| m.access == ipx_directory::config::Access::Rwa)
+}
+
+/// Whether a feed is someone's own: marked private, given a username or password, or at an
+/// address that carries a key (`feed::url_looks_private`).
+pub fn looks_private(feed: &config::Feed) -> bool {
+    feed.private
+        || feed.username.is_some()
+        || feed.password.is_some()
+        || feed.password_env.is_some()
+        || feed::url_looks_private(&feed.url)
+}
+
+/// What the snapshot lists: every feed in the catalogue, with how many people here subscribe,
+/// except an OPML or a Patreon creator itself, which is sent as the feeds in it, and anything
+/// private, a feed inside a private OPML included. An OPML not read yet is not known to be one
+/// and goes too; the directory lists only what it has read as a feed.
+pub fn snapshot_entries(catalogue: &[Sub], counts: &HashMap<String, i64>) -> Vec<SnapshotEntry> {
+    let by_id: HashMap<&str, &config::Feed> = catalogue.iter().map(|s| (s.id.as_str(), &s.cfg)).collect();
+    let is_group: HashSet<&str> = catalogue.iter().filter_map(|s| s.cfg.group.as_deref()).collect();
+    catalogue
+        .iter()
+        .filter(|s| {
+            !is_group.contains(s.id.as_str())
+                && !feed::is_patreon_creator(&s.cfg.url)
+                && !looks_private(&s.cfg)
+                && !s.cfg.group.as_deref().and_then(|g| by_id.get(g)).is_some_and(|f| looks_private(f))
+        })
+        .map(|s| SnapshotEntry {
+            url: s.cfg.url.clone(),
+            subscribers: counts.get(&s.id).copied().unwrap_or(0),
+            category: s.cfg.category.clone(),
+        })
+        .collect()
+}
+
+/// Sends the snapshot now.
+async fn snapshot(ctx: &Ctx) -> Result<Vec<SnapshotEntry>, DirError> {
+    let catalogue = crate::subscriptions(ctx).await.map_err(|e| DirError::Unreachable(format!("{e:#}")))?;
+    let counts = ctx.db.subscriber_counts().await.map_err(|e| DirError::Unreachable(format!("{e:#}")))?;
+    Ok(snapshot_entries(&catalogue, &counts))
+}
+
+pub async fn share(ctx: &Ctx, entries: &[SnapshotEntry]) -> Result<SnapshotResult, DirError> {
+    let r: SnapshotResult = call(ctx, reqwest::Method::POST, "/v1/snapshot", Some(entries)).await?;
+    if r.refused_private > 0 {
+        // The directory caught what this side should have: worth knowing which check differs.
+        tracing::warn!(refused = r.refused_private, "the directory refused feeds as private that ipx sent");
+    }
+    Ok(r)
+}
+
+/// Sends the snapshot every half hour while sharing is on, and at once when the settings change.
+pub async fn run(ctx: std::sync::Arc<Ctx>, mut stop: tokio::sync::watch::Receiver<bool>) {
+    // What went last, where, and when: a scan wakes this every half minute or so, and the same
+    // 1,500 feeds went each time, the directory rewriting its rows for nothing (#211).
+    let mut last: Option<(Vec<u8>, std::time::Instant)> = None;
+    loop {
+        let cfg = ctx.cfg();
+        if cfg.general.directory_share && configured(&cfg) {
+            let got = match snapshot(&ctx).await {
+                Ok(entries) => {
+                    let key = serde_json::to_vec(&(target(&cfg), &entries)).unwrap_or_default();
+                    let forced = ctx.directory_resend.swap(false, std::sync::atomic::Ordering::Relaxed);
+                    if forced || resend(last.as_ref(), &key) {
+                        let span = tracing::info_span!(target: "ipx::directory", "directory_share", feeds = entries.len());
+                        let got = tracing::Instrument::instrument(share(&ctx, &entries), span).await;
+                        if got.is_ok() {
+                            last = Some((key, std::time::Instant::now()));
+                        }
+                        Some(got)
+                    } else {
+                        None
+                    }
+                }
+                Err(e) => Some(Err(e)),
+            };
+            if let Some(got) = got {
+                match &got {
+                    Ok(r) => tracing::info!(accepted = r.accepted, refused_private = r.refused_private, refused_blocked = r.refused_blocked, "shared with the directory"),
+                    Err(e) => tracing::warn!(error = %e, "could not share with the directory"),
+                }
+                let (result, error) = match got {
+                    Ok(r) => (Some(r), None),
+                    Err(e) => (None, Some(e.to_string())),
+                };
+                *ctx.directory_shared.lock().unwrap() = Some(Shared { at: crate::db::now(), result, error });
+            }
+        }
+        tokio::select! {
+            _ = tokio::time::sleep(SHARE_EVERY) => {}
+            _ = ctx.directory_wake.notified() => {}
+            _ = stop.changed() => return,
+        }
+    }
+}
+
+/// Whether to send the snapshot `key` stands for: one that changed, or went to another directory
+/// or with another token, goes now; the same again only once SHARE_EVERY has passed, so a
+/// directory that lost it, or dropped this server's counts, has it back within the half hour.
+fn resend(last: Option<&(Vec<u8>, std::time::Instant)>, key: &[u8]) -> bool {
+    last.is_none_or(|(k, at)| k != key || at.elapsed() >= SHARE_EVERY)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sub(id: &str, url: &str, edit: impl FnOnce(&mut config::Feed)) -> Sub {
+        let mut cfg: config::Feed = serde_json::from_value(serde_json::json!({ "url": url })).unwrap();
+        edit(&mut cfg);
+        Sub { id: id.into(), cfg, managed: false }
+    }
+
+    #[test]
+    fn the_snapshot_holds_public_feeds_and_never_a_private_one() {
+        let catalogue = vec![
+            sub("public", "https://example.com/feed.xml", |_| {}),
+            sub("marked", "https://example.com/mine.xml", |f| f.private = true),
+            sub("password", "https://example.com/locked.xml", |f| f.username = Some("me".into())),
+            sub("paid", "https://feeds.supercast.com/feeds/abc", |_| {}),
+            sub("keyed", "https://example.com/feed?key=k", |_| {}),
+            // An OPML: sent as the feeds in it, never itself.
+            sub("list", "https://example.com/list.opml", |_| {}),
+            sub("in-list", "https://example.com/a.xml", |f| f.group = Some("list".into())),
+            // Inside a private OPML: as private as the OPML.
+            sub("secret-list", "https://example.com/l.opml?token=t", |_| {}),
+            sub("in-secret", "https://example.com/b.xml", |f| f.group = Some("secret-list".into())),
+        ];
+        let counts = HashMap::from([("public".to_string(), 3), ("marked".to_string(), 1)]);
+        let got = snapshot_entries(&catalogue, &counts);
+        let urls: Vec<(&str, i64)> = got.iter().map(|e| (e.url.as_str(), e.subscribers)).collect();
+        assert_eq!(urls, [("https://example.com/feed.xml", 3), ("https://example.com/a.xml", 0)]);
+        let patreon = vec![sub("creator", "https://www.patreon.com/c/someone", |_| {})];
+        assert!(snapshot_entries(&patreon, &counts).is_empty(), "a Patreon creator goes as its shows");
+    }
+
+    #[test]
+    fn nothing_is_asked_without_an_address_and_a_token() {
+        let mut cfg = config::Config::default();
+        assert!(!configured(&cfg));
+        cfg.general.directory_url = "https://ipx-dir.example/".into();
+        assert!(!configured(&cfg));
+        cfg.general.directory_token = "t".into();
+        assert_eq!(target(&cfg), Some(("https://ipx-dir.example".into(), "t".into())));
+    }
+
+    #[test]
+    fn the_same_snapshot_is_not_sent_again_within_the_half_hour() {
+        let now = std::time::Instant::now();
+        assert!(resend(None, b"a"));
+        assert!(!resend(Some(&(b"a".to_vec(), now)), b"a"));
+        assert!(resend(Some(&(b"a".to_vec(), now)), b"b"));
+        if let Some(long_ago) = now.checked_sub(SHARE_EVERY) {
+            assert!(resend(Some(&(b"a".to_vec(), long_ago)), b"a"));
+        }
+    }
+}

crates/ipx/src/download.rs

@@ -172,10 +172,12 @@ pub async fn download(
         .with_context(|| format!("creating {}", tmp.display()))?;
     let mut done: u64 = 0;
     let mut stream = resp.bytes_stream();
+    let _active = crate::metrics::busy(&crate::metrics::STATS.downloads_active);
     while let Some(chunk) = stream.next().await {
         let chunk = chunk.context("reading body")?;
         file.write_all(&chunk).await?;
         done += chunk.len() as u64;
+        crate::metrics::STATS.download_bytes.fetch_add(chunk.len() as u64, std::sync::atomic::Ordering::Relaxed);
         on_progress(done, total);
     }
     file.flush().await?;
@@ -207,6 +209,36 @@ pub async fn place(d: &Downloaded, dir: &Path) -> Result<PathBuf> {
     Ok(dest)
 }
 
+/// Deletes what an enclosure's path names: a file, or the folder a torrent of several files came
+/// down as. `remove_file` refused the folder, so the reaper warned on every pass and freed nothing,
+/// and Delete failed (#158).
+pub fn remove(path: &Path) -> std::io::Result<()> {
+    if path.is_dir() {
+        return std::fs::remove_dir_all(path);
+    }
+    std::fs::remove_file(path)
+}
+
+/// The file to play for an enclosure's path: the path itself, or for a torrent of several files,
+/// the largest file in its folder, which is the episode (#158).
+pub fn playable(path: &Path) -> PathBuf {
+    fn largest(dir: &Path, best: &mut Option<(u64, PathBuf)>) {
+        let Ok(entries) = std::fs::read_dir(dir) else { return };
+        for e in entries.flatten() {
+            match e.metadata() {
+                Ok(m) if m.is_dir() => largest(&e.path(), best),
+                Ok(m) if best.as_ref().is_none_or(|(n, _)| m.len() > *n) => *best = Some((m.len(), e.path())),
+                _ => {}
+            }
+        }
+    }
+    let mut best = None;
+    if path.is_dir() {
+        largest(path, &mut best);
+    }
+    best.map_or_else(|| path.to_owned(), |(_, p)| p)
+}
+
 /// Advertised as a torrent, before spending any bandwidth on it.
 pub fn looks_like_torrent(url: &str, mime: Option<&str>) -> bool {
     mime.is_some_and(|m| m.to_ascii_lowercase().contains("torrent"))
@@ -406,7 +438,7 @@ mod tests {
         let mut f = crate::config::Feed {
             url: "u".into(), folder: Some("Subscriptions/Some | Show".into()), group: None, media_types: None,
             schedule: None, keywords: vec![], allow_explicit: false, auto_download: true,
-            max_new_per_check: None, username: None, password: None, password_env: None, category: None, listed: false,
+            max_new_per_check: None, username: None, password: None, password_env: None, category: None, listed: false, private: false,
         };
         assert_eq!(folder_for(&cfg, "id", &f, None), "Subscriptions/Some - Show");
 
@@ -415,6 +447,20 @@ mod tests {
         assert_eq!(folder_for(&cfg, "id", &f, None), "etc/Show");
     }
 
+    #[test]
+    fn a_torrent_folder_plays_its_largest_file_and_deletes_whole() {
+        let d = std::env::temp_dir().join(format!("ipx-torrent-test-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(d.join("show/extras")).unwrap();
+        std::fs::write(d.join("show/cover.jpg"), [0; 10]).unwrap();
+        std::fs::write(d.join("show/extras/episode.mp3"), [0; 100]).unwrap();
+        assert_eq!(playable(&d.join("show")), d.join("show/extras/episode.mp3"));
+        assert_eq!(playable(&d.join("show/cover.jpg")), d.join("show/cover.jpg"), "a file is itself");
+        remove(&d.join("show")).unwrap();
+        assert!(!d.join("show").exists());
+        let _ = std::fs::remove_dir_all(&d);
+    }
+
     #[test]
     fn keyword_matching_is_or_across_keywords_and_and_within_one() {
         let kws = vec!["deep dive".to_string(), "interview".to_string()];

crates/ipx/src/entity.rs

@@ -354,3 +354,67 @@ pub mod settings {
 
     impl ActiveModelBehavior for ActiveModel {}
 }
+
+/// What DeadAir found in an enclosure (#181): `plans` is a `deadair::Plan` for each pause length,
+/// as JSON keyed by the pause in ms, and `{}` for a file it does not apply to (video, not MP3 or
+/// AAC, nothing to cut), so that one is looked at once and not every pass.
+pub mod deadair_plans {
+    use sea_orm::entity::prelude::*;
+
+    #[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
+    #[sea_orm(table_name = "deadair_plans")]
+    pub struct Model {
+        #[sea_orm(primary_key, auto_increment = false)]
+        pub enclosure_id: i64,
+        #[sea_orm(column_type = "Text")]
+        pub plans: String,
+        /// Against the enclosure's `downloaded_at`: a file downloaded again is looked at again.
+        pub made_at: i64,
+    }
+
+    #[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+    pub enum Relation {}
+
+    impl ActiveModelBehavior for ActiveModel {}
+}
+
+/// Who has DeadAir on, for which feeds: it is off for every feed until someone turns it on for
+/// that one or its group, and `wanted` false keeps one feed of a group out of the group's.
+pub mod deadair_prefs {
+    use sea_orm::entity::prelude::*;
+
+    #[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
+    #[sea_orm(table_name = "deadair_prefs")]
+    pub struct Model {
+        #[sea_orm(primary_key, auto_increment = false)]
+        pub user_id: i64,
+        #[sea_orm(primary_key, auto_increment = false, column_type = "Text")]
+        pub feed_id: String,
+        pub wanted: bool,
+        /// The pause DeadAir leaves where it cuts a silence, in ms (#182); NULL for the usual.
+        pub pause_ms: Option<i64>,
+    }
+
+    owned_by_user!();
+}
+
+/// The time DeadAir has saved someone: one row per episode they got 75% through on a copy, so
+/// replaying it never counts twice. Their total is the sum.
+pub mod deadair_saved {
+    use sea_orm::entity::prelude::*;
+
+    #[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
+    #[sea_orm(table_name = "deadair_saved")]
+    pub struct Model {
+        #[sea_orm(primary_key, auto_increment = false)]
+        pub user_id: i64,
+        #[sea_orm(primary_key, auto_increment = false, column_type = "Text")]
+        pub feed_id: String,
+        #[sea_orm(primary_key, auto_increment = false, column_type = "Text")]
+        pub guid: String,
+        pub saved_ms: i64,
+        pub at: i64,
+    }
+
+    owned_by_user!();
+}

crates/ipx/src/ipc.rs

@@ -32,6 +32,8 @@ pub enum Event {
     DownloadDone { feed: String, enclosure: i64, url: String, path: String, bytes: u64 },
     DownloadError { feed: String, enclosure: i64, url: String, msg: String },
     TorrentDeferred { feed: String, url: String },
+    /// DeadAir finished a file's copy (#171), so a page showing it as in progress can stop.
+    DeadairDone { feed: String, enclosure: i64, saved_s: i64 },
     Reaped { path: String, bytes: u64 },
     /// Terminal: a client that asked for work stops reading here.
     ScanDone { feeds: usize },
@@ -79,6 +81,7 @@ impl Event {
             // Noise in a terminal; a UI still gets them on the socket.
             Event::FeedStart { feed } => format!("{feed}: checking"),
             Event::TorrentDeferred { feed, .. } => format!("{feed}: torrent deferred"),
+            Event::DeadairDone { feed, saved_s, .. } => format!("{feed}: DeadAir found the silences, {saved_s} s shorter"),
             Event::ScanDone { feeds } => format!("scan complete, {feeds} feed(s)"),
         })
     }
@@ -141,7 +144,12 @@ impl Emitter {
         // line per feed per tick for "not due yet" would push everything worth reading
         // out of the buffer within a few minutes.
         log_event(&e, self.tx.is_some());
-        if let Some(tx) = &self.tx {
+        // A feed not due changes nothing a listener shows, and a scan has one for nearly every
+        // feed: 1,500 at once overflowed the channel's 1,024 for a page slow to read (#197).
+        let routine = matches!(&e, Event::FeedSkip { reason, .. } if reason.starts_with("not due"));
+        if let Some(tx) = &self.tx
+            && !routine
+        {
             // An error here only means nobody is listening yet.
             let _ = tx.send(e.clone());
         }
@@ -190,7 +198,7 @@ fn log_event(e: &Event, wire: bool) {
             )
         };
     }
-    // The healthcheck's answer, every 30s: a reply on the socket rather than work done, so it
+    // `ipx status`'s answer: a reply on the socket rather than work done, so it
     // stays with the rest of the conversation, and the Scans tab stays about scans.
     if matches!(e, Event::Status { .. }) {
         return line!(info, "ipx::io", format!("<- {json}"));
@@ -359,6 +367,17 @@ pub async fn proxy(path: &Path, cmd: &Command) -> Result<()> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_feed_not_due_stays_off_the_live_updates() {
+        let (tx, mut rx) = broadcast::channel(4);
+        let out = Emitter::socket(tx, false);
+        for i in 0..10 {
+            out.emit(Event::FeedSkip { feed: format!("f{i}"), reason: "not due for 5m".into() });
+        }
+        out.emit(Event::FeedSkip { feed: "g".into(), reason: "not modified".into() });
+        assert!(matches!(rx.try_recv(), Ok(Event::FeedSkip { feed, .. }) if feed == "g"), "nothing missed");
+    }
+
     #[test]
     fn a_feed_that_moved_says_so_on_the_wire_and_in_words() {
         let e = Event::FeedMoved { feed: "x".into(), from: "http://a/f".into(), to: "https://a/f".into() };

crates/ipx/src/main.rs

@@ -3,11 +3,15 @@ mod art;
 mod auth;
 mod config;
 mod db;
+mod deadair;
+mod directory;
 mod entity;
 mod download;
-mod feed;
+// The crate root's import, so `crate::feed` reaches it from every module as before.
+use ipx_feed as feed;
 mod ipc;
 mod logbuf;
+mod metrics;
 mod retention;
 mod torrent;
 mod web;
@@ -141,25 +145,102 @@ pub struct Ctx {
     /// stops every feed scan, every HTTP download and every status command behind it.
     /// A one-shot CLI run keeps them inline, or the process would exit mid-download.
     pub detach_torrents: bool,
+    /// Feeds whose host could not be looked up for the moment, and when to try them again: a
+    /// failure that says nothing about the feed, kept off it and out of the database (#143).
+    /// Forgotten on a restart, which only makes the retry sooner.
+    pub retry: std::sync::Mutex<std::collections::HashMap<String, i64>>,
+    /// Held from taking a copy of the config to storing it (`edit_cfg`). Each change stores the
+    /// whole catalogue from its copy, and two at once stored over each other: a feed added while
+    /// another add spent a minute fetching was gone once that one stored (#153).
+    // ponytail: this process only. `ipx add`, `rm` and `import` write from a process of their
+    // own, and a change in flight here can still store over theirs; take the copy from the
+    // database rather than memory if that ever happens.
+    pub cfg_write: tokio::sync::Mutex<()>,
+    /// Wakes DeadAir's maker when a show is turned on, so its copies start at once instead of
+    /// at the next pass (#171).
+    pub deadair: tokio::sync::Notify,
+    /// When the Directory was last cleared of dead feeds (`clean_directory`), 0 for not since
+    /// starting.
+    pub directory_cleaned: std::sync::atomic::AtomicI64,
+    /// Sends the snapshot to the directory now, as when its settings change (#205).
+    pub directory_wake: tokio::sync::Notify,
+    /// When the snapshot last went and what came of it, for the admin page.
+    pub directory_shared: std::sync::Mutex<Option<directory::Shared>>,
+    /// Send the snapshot even if it has not changed: after an unblock or a dropped snapshot the
+    /// directory needs it again, though nothing here differs (#206).
+    pub directory_resend: std::sync::atomic::AtomicBool,
 }
 
+/// A copy of the config to change, holding off every other change until `store_cfg` keeps it.
+pub struct CfgEdit<'a> {
+    cfg: config::Config,
+    _held: tokio::sync::MutexGuard<'a, ()>,
+}
+
+impl std::ops::Deref for CfgEdit<'_> {
+    type Target = config::Config;
+    fn deref(&self) -> &config::Config {
+        &self.cfg
+    }
+}
+
+impl std::ops::DerefMut for CfgEdit<'_> {
+    fn deref_mut(&mut self) -> &mut config::Config {
+        &mut self.cfg
+    }
+}
+
+/// How soon a feed whose host could not be looked up is tried again (#143).
+const RETRY_LOOKUP_SECS: i64 = 600;
+
 impl Ctx {
+    /// When a feed is next due, taking a lookup retry into account: not before it.
+    fn due(&self, cfg: &config::Config, feed: &config::Feed, id: &str, state: &db::HttpState, subscribed: bool) -> Option<i64> {
+        let at = due_at(cfg, feed, state, subscribed);
+        match self.retry.lock().unwrap().get(id) {
+            Some(&retry) => Some(at.unwrap_or(0).max(retry)),
+            None => at,
+        }
+    }
+
+    /// A scan's failure, recorded on the feed, unless it was only a moment's failure to look its
+    /// host up: on 2026-10-05 a DNS outage on Tower failed 204 feeds in a minute with
+    /// "Temporary failure in name resolution", and each, read once a day and backed off as a
+    /// failing feed, sat a day failing, unread and labelled gone (#143). Tried again in minutes
+    /// instead, with nothing on the feed to say it failed.
+    async fn feed_failed(&self, id: &str, url: &str, msg: &str) -> Result<()> {
+        if feed::is_temporary_lookup_failure(msg) {
+            self.retry.lock().unwrap().insert(id.to_owned(), db::now() + RETRY_LOOKUP_SECS);
+            return Ok(());
+        }
+        self.db.set_feed_error(id, url, msg).await
+    }
+
     pub fn cfg(&self) -> std::sync::Arc<config::Config> {
         self.cfg.read().unwrap().clone()
     }
 
-    /// Re-reads config.toml into the live snapshot.
+    /// The config as it stands, to change and then keep with `store_cfg`; any other change waits
+    /// until then.
+    pub async fn edit_cfg(&self) -> CfgEdit<'_> {
+        let held = self.cfg_write.lock().await;
+        CfgEdit { cfg: (*self.cfg()).clone(), _held: held }
+    }
+
     /// Keeps a changed catalogue or server settings: in the database, and for everything running
     /// here from now on. What config.toml's save and reload did, before the database held them.
-    pub async fn store_cfg(&self, cfg: config::Config) -> Result<()> {
+    pub async fn store_cfg(&self, edit: CfgEdit<'_>) -> Result<()> {
-        self.db.store_config(&cfg).await?;
+        self.db.store_config(&edit.cfg).await?;
-        self.set_cfg(cfg);
+        self.set_cfg(edit.cfg);
         Ok(())
     }
 
     fn set_cfg(&self, cfg: config::Config) {
         *self.cfg.write().unwrap() = std::sync::Arc::new(cfg);
         tracing::info!("config reloaded");
+        // A feed added, removed, made private or given a category, or the directory's own
+        // settings changed: the directory hears of it now, not at the next half hour (#205).
+        self.directory_wake.notify_one();
     }
 
     async fn torrents(&self) -> Result<&torrent::Torrents> {
@@ -173,10 +254,10 @@ impl Ctx {
 #[tokio::main]
 async fn main() -> Result<()> {
     let cli = Cli::parse();
-    // The daemon only: `ipx status` runs every half minute as the healthcheck, and a trace
+    // The daemon only: a trace for every `ipx status` a script runs would bury the ones worth
-    // for each would bury the ones worth looking at.
+    // looking at.
     let otel = match cli.command {
-        Command::Daemon { .. } => otel_provider()?,
+        Command::Daemon { .. } => ipx_directory::otel::provider("ipx")?,
         _ => None,
     };
     // Everything goes to stderr as before, and is mirrored into a ring the UI can read.
@@ -218,7 +299,7 @@ async fn main() -> Result<()> {
                 use opentelemetry::trace::TracerProvider;
                 tracing_opentelemetry::layer()
                     .with_tracer(p.tracer("ipx"))
-                    .with_filter(tracing_subscriber::EnvFilter::new("ipx=info"))
+                    .with_filter(tracing_subscriber::EnvFilter::new("ipx=info,ipx_feed=info"))
             }))
             .init();
     }
@@ -255,7 +336,10 @@ async fn main() -> Result<()> {
     let is_daemon = matches!(cli.command, Command::Daemon { .. });
     // These write the catalogue from a process of their own, which a running daemon, holding its
     // own copy, would write over at its next change (#120).
-    let changes_catalogue = matches!(cli.command, Command::Add { .. } | Command::Rm { .. } | Command::Import { .. });
+    let changes_catalogue = matches!(
+        cli.command,
+        Command::Add { .. } | Command::Rm { .. } | Command::Import { .. } | Command::User { cmd: UserCmd::Rm { .. } }
+    );
     let (events, _) = broadcast::channel(1024);
     let ctx = Arc::new(Ctx {
         cfg: std::sync::RwLock::new(std::sync::Arc::new(cfg)),
@@ -264,6 +348,9 @@ async fn main() -> Result<()> {
             .user_agent(concat!("ipx/", env!("CARGO_PKG_VERSION")))
             // Connecting only, so it bounds a download's start, not a long download (#108).
             .connect_timeout(std::time::Duration::from_secs(10))
+            // Two minutes without a byte is a stalled download, however long it is: unbounded, one
+            // held the worker, and every scan behind it, for good, while the daemon read healthy (#152).
+            .read_timeout(std::time::Duration::from_secs(120))
             .build()?,
         feed_client: reqwest::Client::builder()
             .user_agent(concat!("ipx/", env!("CARGO_PKG_VERSION")))
@@ -275,6 +362,13 @@ async fn main() -> Result<()> {
         torrent_slots: Arc::new(tokio::sync::Semaphore::new(2)),
         config_path: config_path.clone(),
         detach_torrents: is_daemon,
+        retry: Default::default(),
+        cfg_write: Default::default(),
+        directory_cleaned: Default::default(),
+        deadair: Default::default(),
+        directory_wake: Default::default(),
+        directory_shared: Default::default(),
+        directory_resend: Default::default(),
     });
 
     let result = match cli.command {
@@ -334,23 +428,6 @@ where
     }
 }
 
-/// Traces over OTLP, to Tempo for one, when OTEL_EXPORTER_OTLP_ENDPOINT names a collector
-/// (`http://host:4318`: the exporter speaks OTLP over HTTP and adds `/v1/traces`). The exporter
-/// reads that and the other `OTEL_` variables itself.
-fn otel_provider() -> Result<Option<opentelemetry_sdk::trace::SdkTracerProvider>> {
-    if std::env::var("OTEL_EXPORTER_OTLP_ENDPOINT").unwrap_or_default().is_empty() {
-        return Ok(None);
-    }
-    let exporter = opentelemetry_otlp::SpanExporter::builder().with_http().build()?;
-    let resource = opentelemetry_sdk::Resource::builder().with_service_name("ipx").build();
-    Ok(Some(
-        opentelemetry_sdk::trace::SdkTracerProvider::builder()
-            .with_batch_exporter(exporter)
-            .with_resource(resource)
-            .build(),
-    ))
-}
-
 /// Accounts. Passwords come in on stdin so they never reach a shell history or a `ps`
 /// listing.
 async fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
@@ -441,7 +518,7 @@ async fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
                 .db
                 .user_by_name(&name).await?
                 .ok_or_else(|| anyhow::anyhow!("no such account: {name}"))?;
-            ctx.db.delete_user(user.id).await?;
+            remove_user(ctx, user.id).await?;
             println!("removed {name}");
             Ok(())
         }
@@ -449,11 +526,21 @@ async fn user_cmd(ctx: &Arc<Ctx>, cmd: UserCmd) -> Result<()> {
 }
 
 async fn run(ctx: &Arc<Ctx>, cmd: Cmd) -> Result<()> {
+    // What the worker is on, for /metrics: the healthcheck answers while it is stuck (#195).
+    let _job = metrics::STATS.job(match &cmd {
+        Cmd::Fetch { .. } => "scan",
+        Cmd::Reap { .. } => "reap",
+        Cmd::Download { .. } => "download",
+        Cmd::Status => "status",
+        Cmd::Reload => "reload",
+    });
     match cmd {
         Cmd::Fetch { feed, force, feeds } => {
             // Make room before pulling more down, as the original did per download.
             reap(ctx, false, false).await?;
-            fetch(ctx, feed.as_deref(), force, &feeds).await
+            fetch(ctx, feed.as_deref(), force, &feeds).await?;
+            metrics::STATS.last_scan_done.store(db::now(), std::sync::atomic::Ordering::Relaxed);
+            Ok(())
         }
         Cmd::Reap { dry_run } => reap(ctx, dry_run, true).await,
         Cmd::Download { enclosure } => download_one(ctx, enclosure).await,
@@ -469,6 +556,7 @@ async fn run(ctx: &Arc<Ctx>, cmd: Cmd) -> Result<()> {
 /// memory, for a daemon told another ipx changed them (#120); config.toml, read again, for where
 /// things are and who gets in.
 async fn reload(ctx: &Ctx) -> Result<()> {
+    let _held = ctx.cfg_write.lock().await;
     let cfg = assemble_config(&ctx.db, config::Config::load(&ctx.config_path)?, &ctx.config_path).await?;
     ctx.set_cfg(cfg);
     Ok(())
@@ -480,6 +568,12 @@ pub(crate) async fn status(ctx: &Ctx) -> Event {
     match ctx.db.counts().await {
         Ok((pending, downloaded)) => {
             let feeds = subscriptions(ctx).await.map(|s| s.len()).unwrap_or(0);
+            // Kept for /metrics, which asks the database nothing (#195); the daemon counts every 30 s.
+            use std::sync::atomic::Ordering::Relaxed;
+            let st = &metrics::STATS;
+            st.feeds.store(feeds as i64, Relaxed);
+            st.pending.store(pending as i64, Relaxed);
+            st.downloaded.store(downloaded as i64, Relaxed);
             Event::Status { feeds, pending, downloaded }
         }
         Err(e) => Event::Error { msg: format!("{e:#}") },
@@ -527,7 +621,10 @@ async fn daemon(
         Err(e) => tracing::warn!(error = %format!("{e:#}"), "could not retire feeds whose OPML is no longer in config"),
     }
 
-    let (tx_cmd, mut rx_cmd) = mpsc::channel::<Cmd>(64);
+    // Room for any one request's commands: a web request waits inside itself for a free place,
+    // and Download latest sends up to 100. With 64 the rest waited on downloads an hour long, and
+    // every other request that queues work waited behind them (#154).
+    let (tx_cmd, mut rx_cmd) = mpsc::channel::<Cmd>(1024);
 
     let web = start_web(&ctx, &config_path, web_addr, &tx_cmd, &events).await?;
     // status and reload are answered by the socket itself; everything else waits its turn in the
@@ -562,6 +659,25 @@ async fn daemon(
         shutdown().await;
         let _ = tx_stop.send(true);
     });
+    // Off the worker: the first pass over a library is hours of ffmpeg, and scans and downloads
+    // must not wait behind it.
+    tokio::spawn(deadair::run(ctx.clone(), rx_stop.clone()));
+    tokio::spawn(directory::run(ctx.clone(), rx_stop.clone()));
+    // The library's counts for /metrics. The Docker healthcheck asked for them every 30 s until
+    // it was removed: Docker runs it with exec, which failed on Tower whenever root was logged
+    // out (#218).
+    {
+        let (ctx, mut stop) = (ctx.clone(), rx_stop.clone());
+        tokio::spawn(async move {
+            let mut every = tokio::time::interval(std::time::Duration::from_secs(30));
+            loop {
+                tokio::select! {
+                    _ = every.tick() => { status(&ctx).await; }
+                    _ = stop.changed() => break,
+                }
+            }
+        });
+    }
 
     // Runs one job, abandoning it if a signal arrives. Returns false to end the loop.
     async fn until_stopped(
@@ -687,11 +803,25 @@ async fn start_web(
         let (access, ctx, team) = (access.clone(), ctx.clone(), team.to_owned());
         tokio::spawn(async move { access.prefetch(&ctx.client, &team).await });
     }
+    let playing = deadair::Playing::default();
+    if !cfg.web.metrics_bind.is_empty() {
+        let sources = metrics::Sources {
+            ctx: ctx.clone(),
+            cmds: cmds.clone(),
+            events: events.clone(),
+            playing: playing.clone(),
+            runtime: tokio::runtime::Handle::current(),
+            started: std::time::Instant::now(),
+        };
+        let at = metrics::spawn(&cfg.web.metrics_bind, sources)?;
+        tracing::info!(%at, "serving metrics for Prometheus at /metrics");
+    }
     let state = web::WebState {
         ctx: ctx.clone(),
         cmds: cmds.clone(),
         events: events.clone(),
         access,
+        playing,
     };
     Ok(Some(tokio::spawn(async move {
         if let Err(e) = web::serve(state, &bind).await {
@@ -721,38 +851,54 @@ async fn add(
     category: Option<String>,
     list: bool,
 ) -> Result<()> {
-    let mut cfg = (*ctx.cfg()).clone();
+    let url = feed::find_feed(&ctx.client, &feed::expand_input(url)).await?;
-    let url = &feed::find_feed(&ctx.client, &feed::expand_input(url)).await?;
+    let (id, existed) = add_to_catalogue(ctx, &url, folder, keywords).await?;
-    // Includes feeds derived from an OPML, or the same show could be added twice.
+    // Listing a feed the catalogue already has, or giving it a category, is the point of asking
-    if let Some(existing) = subscriptions(ctx).await?.iter().find(|s| feed::same_feed(&s.cfg.url, url)) {
+    // again: it changes those, and nothing else. A feed an OPML lists has no entry to change.
-        // Listing a feed the catalogue already has, or giving it a category, is the point of
+    if list || category.is_some() {
-        // asking again: it changes those, and nothing else.
+        let mut cfg = ctx.edit_cfg().await;
-        if let Some(f) = cfg.feeds.get_mut(&existing.id)
+        if let Some(f) = cfg.feeds.get_mut(&id) {
-            && (list || category.is_some())
-        {
             f.listed |= list;
             if category.is_some() {
                 f.category = category;
             }
             ctx.store_cfg(cfg).await?;
-            println!("{} is already in the catalogue; updated its Directory listing", existing.id);
+            if existed {
-            return Ok(());
+                println!("{id} is already in the catalogue; updated its Directory listing");
+                return Ok(());
+            }
         }
-        anyhow::bail!("already subscribed as {:?}", existing.id);
     }
-    let id = add_one(ctx, &mut cfg, url, folder, keywords).await?;
+    if existed {
-    if let Some(f) = cfg.feeds.get_mut(&id) {
+        anyhow::bail!("already subscribed as {id:?}");
-        f.category = category;
-        f.listed = list;
     }
-    ctx.store_cfg(cfg).await?;
     println!("added {id}{}", if list { ", listed in the Directory" } else { "" });
     Ok(())
 }
 
+/// Adds the feed at `url` to the catalogue unless it is there already, a feed an OPML lists
+/// included, so one show is never added twice: its id, and whether it was there. For `ipx add`
+/// and the page's Add feed alike, which were the same steps written twice (#161); each finds the
+/// feed first, to say its own way why an address is not one.
+pub async fn add_to_catalogue(
+    ctx: &Ctx,
+    url: &str,
+    folder: Option<String>,
+    keywords: Vec<String>,
+) -> Result<(String, bool)> {
+    // Taken before the duplicate check, so two people adding the same feed at once add it once.
+    let mut cfg = ctx.edit_cfg().await;
+    if let Some(existing) = subscriptions(ctx).await?.into_iter().find(|s| feed::same_feed(&s.cfg.url, url)) {
+        return Ok((existing.id, true));
+    }
+    let id = add_one(ctx, &mut cfg, url, folder, keywords).await?;
+    ctx.store_cfg(cfg).await?;
+    Ok((id, false))
+}
+
 /// Returns the new feed id. Adding checks the address is a feed first (`feed::find_feed`); this
 /// still names one it cannot read from its URL rather than failing.
-pub async fn add_one(
+async fn add_one(
     ctx: &Ctx,
     cfg: &mut config::Config,
     url: &str,
@@ -774,9 +920,10 @@ pub async fn add_one(
         password_env: None,
         category: None,
         listed: false,
+        private: false,
     };
 
-    let title = match feed::fetch(&ctx.feed_client, &probe, None, None).await.map(|(got, _)| got) {
+    let title = match feed::fetch(&ctx.feed_client, &probe.url, None, None, None).await.map(|(got, _)| got) {
         // An OPML subscription is named from its own <head><title>, not by trying to
         // parse it as a feed and falling back to the hostname.
         Ok(feed::Fetched::Body { bytes, .. }) if feed::is_opml(&bytes) => {
@@ -819,7 +966,7 @@ fn url_stem(url: &str) -> String {
 }
 
 async fn rm(ctx: &Ctx, feed: &str) -> Result<()> {
-    let mut cfg = (*ctx.cfg()).clone();
+    let mut cfg = ctx.edit_cfg().await;
     if cfg.feeds.remove(feed).is_none() {
         // Derived from an OPML: drop it here, though the subscription will list it again
         // on the next read unless the OPML itself goes.
@@ -867,10 +1014,10 @@ pub async fn subscribe_opml(
     user_id: i64,
 ) -> Result<(usize, usize)> {
     let mut found = vec![];
-    collect_outlines(&doc.body.outlines, &mut found);
+    feed::collect_outlines(&doc.body.outlines, &mut found);
 
+    let mut cfg = ctx.edit_cfg().await;
     let known = subscriptions(ctx).await?;
-    let mut cfg = (*ctx.cfg()).clone();
     let mut ids = vec![];
     let mut grew = false;
     for (title, url) in found {
@@ -901,6 +1048,7 @@ pub async fn subscribe_opml(
                         password_env: None,
                         category: None,
                         listed: false,
+                        private: false,
                     },
                 );
                 grew = true;
@@ -925,17 +1073,6 @@ pub async fn subscribe_opml(
     Ok((added, had))
 }
 
-/// OPML nests feeds inside folder outlines, so this walks the whole tree.
-pub fn collect_outlines(outlines: &[opml::Outline], out: &mut Vec<(String, String)>) {
-    for o in outlines {
-        if let Some(url) = &o.xml_url {
-            let title = o.title.clone().unwrap_or_else(|| o.text.clone());
-            out.push((title, url.clone()));
-        }
-        collect_outlines(&o.outlines, out);
-    }
-}
-
 /// The configuration ipx runs with: config.toml for where things are and who may sign in, the
 /// database for the feeds and the server settings (issue #18). The first time a database holds
 /// neither, it takes them from config.toml, which is then cut down to the rest, the original kept
@@ -1020,11 +1157,18 @@ async fn clean_directory(ctx: &Ctx) -> Result<()> {
     const DEAD: i64 = 30 * 86_400;
     const QUIET: i64 = 365 * 86_400;
     let now = db::now();
+    // Once a day, for feeds dead a month or quiet a year: before every scan, its query took 1 to
+    // 12 s every few minutes, and the scans and downloads waited behind it (#193).
+    use std::sync::atomic::Ordering::Relaxed;
+    if now - ctx.directory_cleaned.load(Relaxed) < 86_400 {
+        return Ok(());
+    }
+    ctx.directory_cleaned.store(now, Relaxed);
     let stale = ctx.db.stale_unsubscribed(now - DEAD, now - QUIET).await?;
     if stale.is_empty() {
         return Ok(());
     }
-    let mut cfg = (*ctx.cfg()).clone();
+    let mut cfg = ctx.edit_cfg().await;
     if stale.iter().fold(false, |any, id| cfg.feeds.remove(id).is_some() || any) {
         ctx.store_cfg(cfg).await?;
     }
@@ -1039,12 +1183,16 @@ async fn clean_directory(ctx: &Ctx) -> Result<()> {
 /// `standalone` false means this is the sweep that runs before a scan: it reports what it
 /// deleted, but must not emit the terminal ReapDone, or a client waiting on its `fetch`
 /// would stop reading before the scan had even started.
-#[tracing::instrument(name = "reap", skip_all, fields(dry_run = dry_run))]
+#[tracing::instrument(name = "reap", skip_all, fields(dry_run = dry_run, files = tracing::field::Empty, bytes = tracing::field::Empty, entries = tracing::field::Empty))]
 async fn reap(ctx: &Ctx, dry_run: bool, standalone: bool) -> Result<()> {
     let r = retention::run(&ctx.cfg(), &ctx.db, dry_run).await?;
+    let span = tracing::Span::current();
+    span.record("files", r.aged_out.len() + r.over_quota.len());
+    span.record("bytes", r.bytes_freed);
+    span.record("entries", r.entries_pruned);
     if !dry_run {
-        clean_directory(ctx).await?;
+        tracing::Instrument::instrument(clean_directory(ctx), db::step("clean_directory")).await?;
-        let gone = art::trim(&art::dir(), ctx.cfg().general.art_cache_mb * 1_048_576);
+        let gone = db::step("trim_artwork").in_scope(|| art::trim(&art::dir(), ctx.cfg().general.art_cache_mb * 1_048_576));
         if gone > 0 {
             tracing::debug!(gone, "trimmed the artwork kept on disk");
         }
@@ -1093,7 +1241,7 @@ async fn fetch(ctx: &Arc<Ctx>, only: Option<&str>, force: bool, scope: &[String]
             state.last_modified = None;
         }
 
-        if !force && let Some(at) = due_at(&cfg, &sub.cfg, &state, subscribed.contains_key(id)) {
+        if !force && let Some(at) = ctx.due(&cfg, &sub.cfg, id, &state, subscribed.contains_key(id)) {
             if at > db::now() {
                 ctx.out.emit(Event::FeedSkip {
                     feed: id.clone(),
@@ -1120,7 +1268,8 @@ async fn fetch(ctx: &Arc<Ctx>, only: Option<&str>, force: bool, scope: &[String]
                     if !early {
                         return None;
                     }
-                    Some(feed::fetch(&client, &feed_cfg, etag.as_deref(), modified.as_deref()).await)
+                    let _fetching = metrics::busy(&metrics::STATS.feeds_fetching);
+                    Some(feed::fetch(&client, &feed_cfg.url, feed_cfg.auth(), etag.as_deref(), modified.as_deref()).await)
                 },
                 tracing::Span::current(),
             ))
@@ -1165,7 +1314,7 @@ async fn fetch(ctx: &Arc<Ctx>, only: Option<&str>, force: bool, scope: &[String]
                 // One bad feed must not end the scan.
                 let msg = format!("{e:#}");
                 ctx.out.emit(Event::FeedError { feed: id.clone(), msg: msg.clone() });
-                ctx.db.set_feed_error(id, &feed_cfg.url, &msg).await?;
+                ctx.feed_failed(id, &feed_cfg.url, &msg).await?;
             }
         }
     }
@@ -1191,12 +1340,14 @@ async fn fetch(ctx: &Arc<Ctx>, only: Option<&str>, force: bool, scope: &[String]
                 Err(e) => {
                     let msg = format!("{e:#}");
                     ctx.out.emit(Event::FeedError { feed: id.clone(), msg: msg.clone() });
-                    ctx.db.set_feed_error(id, &feed_cfg.url, &msg).await?;
+                    ctx.feed_failed(id, &feed_cfg.url, &msg).await?;
                 }
             }
         }
     }
     ctx.out.emit(Event::ScanDone { feeds: scanned });
+    // What people subscribe to may have changed, and new feeds have titles now: share it.
+    ctx.directory_wake.notify_one();
     Ok(())
 }
 
@@ -1221,6 +1372,9 @@ pub async fn subscriptions(ctx: &Ctx) -> Result<Vec<Sub>> {
         .map(|(id, f)| Sub { id: id.clone(), cfg: f.clone(), managed: false })
         .collect();
 
+    // A group's title, once a group: asked for each feed in it, three queries a feed, it was about
+    // 96 for The Glass Cannon Network's 32 shows on every feed list, live update and scan (#159).
+    let mut group_titles = std::collections::HashMap::<String, String>::new();
     for m in ctx.db.managed_feeds().await? {
         if cfg.feeds.contains_key(&m.id) {
             continue; // promoted to config at some point; that entry wins
@@ -1234,7 +1388,13 @@ pub async fn subscriptions(ctx: &Ctx) -> Result<Vec<Sub>> {
         }
         let base = match parent.and_then(|p| p.folder.clone()) {
             Some(folder) => folder,
-            None => ctx.db.feed_summary(&m.group_id).await.ok().and_then(|s| s.title).unwrap_or_else(|| m.group_id.clone()),
+            None => {
+                if !group_titles.contains_key(&m.group_id) {
+                    let title = ctx.db.feed_summary(&m.group_id).await.ok().and_then(|s| s.title);
+                    group_titles.insert(m.group_id.clone(), title.unwrap_or_else(|| m.group_id.clone()));
+                }
+                group_titles[&m.group_id].clone()
+            }
         };
         let title = m.title.clone().unwrap_or_else(|| m.id.clone());
         out.push(Sub {
@@ -1254,6 +1414,7 @@ pub async fn subscriptions(ctx: &Ctx) -> Result<Vec<Sub>> {
                 password_env: parent.and_then(|p| p.password_env.clone()),
                 category: None,
                 listed: false,
+                private: false,
             },
             managed: true,
         });
@@ -1262,6 +1423,50 @@ pub async fn subscriptions(ctx: &Ctx) -> Result<Vec<Sub>> {
     Ok(out)
 }
 
+/// Takes a feed off one person's list, and the feeds in it if it is a group. Everyone else's
+/// lists are left alone.
+pub async fn leave(ctx: &Ctx, user_id: i64, id: &str) -> Result<()> {
+    ctx.db.unsubscribe(user_id, id).await?;
+    for child in subscriptions(ctx).await?.iter().filter(|s| s.cfg.group.as_deref() == Some(id)) {
+        ctx.db.unsubscribe(user_id, &child.id).await?;
+    }
+    if ctx.db.subscriber_counts().await?.contains_key(id) {
+        return Ok(());
+    }
+
+    // Nobody is left: the feed stops being scanned. Its files and history stay, so if
+    // someone subscribes again they do not pull the back catalogue a second time. A feed an
+    // admin listed stays in the Directory, for the next person.
+    let mut cfg = ctx.edit_cfg().await;
+    if cfg.feeds.get(id).is_some_and(|f| f.listed) {
+        return Ok(());
+    }
+    if cfg.feeds.remove(id).is_none() {
+        // A derived feed: forget it here, though the OPML will list it again on the next
+        // read unless you unsubscribe from the OPML itself.
+        return ctx.db.drop_managed(id).await;
+    }
+    ctx.store_cfg(cfg).await?;
+    retire_group(ctx, id).await
+}
+
+/// Removes an account, leaving each of its feeds first as unsubscribing does. The foreign keys
+/// took the subscriptions with the account, but not the feed: one only they read stayed in the
+/// catalogue with nobody subscribed, downloading every new episode for no one (#157).
+pub async fn remove_user(ctx: &Ctx, user_id: i64) -> Result<()> {
+    let catalogue = subscriptions(ctx).await?;
+    let mine: std::collections::HashSet<String> =
+        ctx.db.subscriptions_for(user_id).await?.into_iter().map(|s| s.feed_id).collect();
+    for id in &mine {
+        // A feed in a group of theirs goes with the group.
+        let in_theirs = catalogue.iter().any(|s| &s.id == id && s.cfg.group.as_ref().is_some_and(|g| mine.contains(g)));
+        if !in_theirs {
+            leave(ctx, user_id, id).await?;
+        }
+    }
+    ctx.db.delete_user(user_id).await
+}
+
 /// Retires every feed derived from `parent_id`, now that nothing subscribes to the OPML or
 /// Patreon feed that listed them: the same rule `sync_group` applies to one the list drops --
 /// removed if nothing was downloaded, orphaned and kept otherwise. Called once the parent
@@ -1329,7 +1534,9 @@ async fn until_next_scan(ctx: &Ctx) -> std::time::Duration {
                 .iter()
                 // A feed with no row yet has never been checked: due now.
                 .map(|s| {
-                    states.get(&s.id).and_then(|st| due_at(&cfg, &s.cfg, st, subscribed.contains_key(&s.id))).unwrap_or(0)
+                    let never = db::HttpState::default();
+                    let state = states.get(&s.id).unwrap_or(&never);
+                    ctx.due(&cfg, &s.cfg, &s.id, state, subscribed.contains_key(&s.id)).unwrap_or(0)
                 })
                 .min(),
         )
@@ -1406,7 +1613,7 @@ async fn follow_move(ctx: &Ctx, id: &str, to: &str) -> Result<()> {
         tracing::info!(feed = id, to, "the feed moved to an address another feed already has; leaving it");
         return Ok(());
     }
-    let mut cfg = (*ctx.cfg()).clone();
+    let mut cfg = ctx.edit_cfg().await;
     let Some(f) = cfg.feeds.get_mut(id) else { return Ok(()) };
     let from = std::mem::replace(&mut f.url, to.to_owned());
     ctx.store_cfg(cfg).await?;
@@ -1455,7 +1662,7 @@ async fn scan_one(
 
     let (mut fetched, moved) = match prefetched {
         Some(got) => got?,
-        None => feed::fetch(&ctx.feed_client, feed_cfg, state.etag.as_deref(), state.last_modified.as_deref()).await?,
+        None => feed::fetch(&ctx.feed_client, &feed_cfg.url, feed_cfg.auth(), state.etag.as_deref(), state.last_modified.as_deref()).await?,
     };
     if let Some(to) = moved {
         follow_move(ctx, id, &to).await?;
@@ -1470,7 +1677,7 @@ async fn scan_one(
     if matches!(fetched, feed::Fetched::NotModified) && (stored.entries == 0 || stored.image.is_none()) {
         tracing::info!(feed = id, "not modified, but nothing stored; refetching without the validator");
         ctx.db.clear_validators(id).await?;
-        fetched = feed::fetch(&ctx.feed_client, feed_cfg, None, None).await?.0;
+        fetched = feed::fetch(&ctx.feed_client, &feed_cfg.url, feed_cfg.auth(), None, None).await?.0;
     }
 
     let (bytes, etag, last_modified) = match fetched {
@@ -1573,7 +1780,7 @@ async fn scan_one(
     {
         match feed::classify(&ctx.client, &key, &parsed).await {
             Ok(category) => {
-                let mut cfg = (*ctx.cfg()).clone();
+                let mut cfg = ctx.edit_cfg().await;
                 if let Some(f) = cfg.feeds.get_mut(id).filter(|f| f.category.is_none()) {
                     tracing::info!(feed = id, category = %category, "categorised");
                     f.category = Some(category);
@@ -1689,7 +1896,8 @@ async fn scan_one(
                 continue;
             }
             match fetch_one(ctx, id, item.id, feed_cfg, &item.url, &dest_dir).await {
-                Ok((path, bytes)) => {
+                Ok(None) => scan.torrents += 1,
+                Ok(Some((path, bytes))) => {
                     ctx.out.emit(Event::DownloadDone {
                         feed: id.to_string(),
                         enclosure: item.id,
@@ -1887,7 +2095,12 @@ async fn policy_for(ctx: &Ctx, id: &str, feed_cfg: &config::Feed) -> Result<Poli
 }
 
 fn merge_policy(subs: &[db::Sub], feed_cfg: &config::Feed, global: usize) -> Policy {
-    let cap = |n: Option<usize>| n.unwrap_or(if global == 0 { usize::MAX } else { global });
+    // 0 is every item, the whole back catalogue, wherever it is set: the server's default, a
+    // feed's or one person's. Only the server's was; a feed set to 0 downloaded nothing (#166).
+    let cap = |n: Option<usize>| match n.unwrap_or(global) {
+        0 => usize::MAX,
+        n => n,
+    };
 
     if subs.is_empty() {
         return Policy {
@@ -1924,7 +2137,9 @@ fn merge_policy(subs: &[db::Sub], feed_cfg: &config::Feed, global: usize) -> Pol
     policy
 }
 
-#[tracing::instrument(name = "download", skip_all, fields(feed = feed_id, enclosure = enclosure, url = url))]
+/// Downloads one file and records it. None when it turned out to be a torrent, handed off to run
+/// on its own, which records it when it finishes.
+#[tracing::instrument(name = "download", skip_all, fields(feed = feed_id, enclosure = enclosure, url = %feed::redact(url)))]
 async fn fetch_one(
     ctx: &Arc<Ctx>,
     feed_id: &str,
@@ -1932,7 +2147,7 @@ async fn fetch_one(
     feed_cfg: &config::Feed,
     url: &str,
     dest_dir: &std::path::Path,
-) -> Result<(PathBuf, u64)> {
+) -> Result<Option<(PathBuf, u64)>> {
     // Throttled to whole percents, as the original's lastDLStepSize guard did.
     let mut last_pct = -1i64;
     let name = download::filename_for(url, None);
@@ -1963,12 +2178,22 @@ async fn fetch_one(
             ctx.db.mark_enclosure(url, "skipped", Some("torrents disabled")).await?;
             anyhow::bail!("body is a torrent and torrents are disabled");
         }
-        return torrent_one(ctx, feed_id, enclosure, url, dest_dir).await;
+        // As one advertised as a torrent goes: off the worker where it can be, and recorded either
+        // way. Run here and never recorded, it stayed pending, and every scan of its feed ran it
+        // again, on the worker, for up to the stall limit and the seeding time (#155).
+        if ctx.detach_torrents {
+            ctx.db.mark_enclosure(url, "downloading", None).await?;
+            spawn_torrent(ctx, feed_id.to_owned(), enclosure, url.to_owned(), dest_dir.to_owned());
+            return Ok(None);
+        }
+        let (path, bytes) = torrent_one(ctx, feed_id, enclosure, url, dest_dir).await?;
+        ctx.db.mark_downloaded(url, &path, bytes).await?;
+        return Ok(Some((path, bytes)));
     }
 
     let path = download::place(&got, dest_dir).await?;
     ctx.db.mark_downloaded(url, &path, got.bytes).await?;
-    Ok((path, got.bytes))
+    Ok(Some((path, got.bytes)))
 }
 
 /// Runs a torrent off the command worker, so feed scans and HTTP downloads keep moving
@@ -2042,14 +2267,15 @@ async fn download_one(ctx: &Arc<Ctx>, id: i64) -> Result<()> {
         if !cfg.torrent.enabled {
             Err(anyhow::anyhow!("torrents are disabled"))
         } else {
-            torrent_one(ctx, &enc.feed_id, enc.id, &enc.url, &dest_dir).await
+            torrent_one(ctx, &enc.feed_id, enc.id, &enc.url, &dest_dir).await.map(Some)
         }
     } else {
         fetch_one(ctx, &enc.feed_id, enc.id, feed_cfg, &enc.url, &dest_dir).await
     };
 
     match result {
-        Ok((path, bytes)) => {
+        Ok(None) => {} // A torrent after all, running on its own.
+        Ok(Some((path, bytes))) => {
             ctx.db.mark_downloaded(&enc.url, &path, bytes).await?;
             ctx.out.emit(Event::DownloadDone {
                 feed: enc.feed_id.clone(),
@@ -2218,6 +2444,7 @@ mod tests {
             password_env: None,
             category: None,
             listed: false,
+            private: false,
         }
     }
 
@@ -2251,6 +2478,11 @@ mod tests {
         assert!(!p.wanted(&["python"], &[]));
         assert_eq!(p.budget, 9);
 
+        // 0 is the whole back catalogue, set for the server, for the feed or by one person (#166).
+        assert_eq!(merge_policy(&[], &feed(), 0).budget, usize::MAX);
+        assert_eq!(merge_policy(&[], &config::Feed { max_new_per_check: Some(0), ..feed() }, 3).budget, usize::MAX);
+        assert_eq!(merge_policy(&[sub(None, None, Some(0)), sub(None, None, Some(2))], &feed(), 3).budget, usize::MAX);
+
         // One person taking everything removes the filter for the shared copy.
         let p = merge_policy(&[sub(Some(&["rust"]), None, None), sub(Some(&[]), None, None)], &feed(), 3);
         assert!(p.wanted(&["python"], &[]));
@@ -2283,9 +2515,190 @@ mod tests {
             torrent_slots: Arc::new(tokio::sync::Semaphore::new(2)),
             config_path: PathBuf::new(),
             detach_torrents: false,
+            retry: Default::default(),
+            cfg_write: Default::default(),
+            deadair: Default::default(),
+            directory_wake: Default::default(),
+            directory_shared: Default::default(),
+            directory_resend: Default::default(),
+            directory_cleaned: Default::default(),
         }
     }
 
+    #[tokio::test]
+    async fn metrics_answer_from_a_thread_of_their_own() {
+        let ctx = Arc::new(test_ctx(config::Config::default()).await);
+        let (cmds, _rx) = mpsc::channel(8);
+        let (events, _) = broadcast::channel(8);
+        let sources = metrics::Sources {
+            ctx: ctx.clone(),
+            cmds,
+            events,
+            playing: Default::default(),
+            runtime: tokio::runtime::Handle::current(),
+            started: std::time::Instant::now(),
+        };
+        let at = metrics::spawn("127.0.0.1:0", sources).unwrap();
+        let text = ctx.client.get(format!("http://{at}/metrics")).send().await.unwrap().text().await.unwrap();
+        // Every sample a name, optional labels and a number, as Prometheus parses them (#194).
+        for line in text.lines().filter(|l| !l.starts_with('#')) {
+            let (name, value) = line.rsplit_once(' ').unwrap();
+            assert!(name.starts_with("ipx_") && value.parse::<f64>().is_ok(), "{line}");
+        }
+        for name in ["ipx_db_connections{state=\"in_use\"}", "ipx_db_connections_max", "ipx_worker_queue", "ipx_runtime_tasks"] {
+            assert!(text.contains(name), "{name}");
+        }
+        assert!(metrics::spawn(&at.to_string(), metrics::Sources {
+            ctx: ctx.clone(), cmds: mpsc::channel(1).0, events: broadcast::channel(1).0, playing: Default::default(),
+            runtime: tokio::runtime::Handle::current(), started: std::time::Instant::now(),
+        }).is_err(), "a port already taken is an error at start");
+    }
+
+    #[tokio::test]
+    async fn dead_feeds_leave_the_directory_once_a_day_not_before_every_scan() {
+        let ctx = test_ctx(config::Config::default()).await;
+        let dead = |id: &str| format!("INSERT INTO feeds (id, url, error_since, managed) VALUES ('{id}', 'u-{id}', 100, false)");
+        let listed = async || ctx.db.feed_urls().await.unwrap().into_iter().map(|(id, _)| id).collect::<Vec<_>>();
+        ctx.db.sql(&dead("a")).await.unwrap();
+        clean_directory(&ctx).await.unwrap();
+        assert!(listed().await.is_empty(), "the first pass since starting looks");
+        ctx.db.sql(&dead("b")).await.unwrap();
+        clean_directory(&ctx).await.unwrap();
+        assert_eq!(listed().await, ["b"], "not again the same day (#193)");
+        ctx.directory_cleaned.store(db::now() - 86_401, std::sync::atomic::Ordering::Relaxed);
+        clean_directory(&ctx).await.unwrap();
+        assert!(listed().await.is_empty(), "a day on, it looks again");
+    }
+
+    #[tokio::test]
+    async fn a_removed_account_takes_the_feeds_only_it_read_with_it() {
+        let ctx = test_ctx(config::Config::default()).await;
+        let mut cfg = ctx.edit_cfg().await;
+        for id in ["only-theirs", "shared", "listed"] {
+            cfg.feeds.insert(id.into(), config::Feed { listed: id == "listed", ..feed() });
+        }
+        ctx.store_cfg(cfg).await.unwrap();
+        let gone = ctx.db.create_user("gone", None, false).await.unwrap();
+        let stays = ctx.db.create_user("stays", None, true).await.unwrap();
+        for id in ["only-theirs", "shared", "listed"] {
+            ctx.db.subscribe(gone, id).await.unwrap();
+        }
+        ctx.db.subscribe(stays, "shared").await.unwrap();
+
+        remove_user(&ctx, gone).await.unwrap();
+        assert!(ctx.db.user_by_id(gone).await.unwrap().is_none());
+        // Nobody reads it now: out of the catalogue, not downloading for no one (#157).
+        assert_eq!(ctx.cfg().feeds.keys().collect::<Vec<_>>(), ["listed", "shared"]);
+        assert!(ctx.db.subscription(stays, "shared").await.unwrap().is_some());
+    }
+
+    #[tokio::test]
+    async fn deadair_hands_out_each_persons_clock_and_saves_in_the_originals() {
+        let ctx = test_ctx(config::Config::default()).await;
+        let db = &ctx.db;
+        let u = db.create_user("dee", None, false).await.unwrap();
+        db.subscribe(u, "f").await.unwrap();
+        for sql in [
+            "INSERT INTO entries (feed_id, guid, first_seen, duration) VALUES ('f', 'g', 1, 600)",
+            "INSERT INTO enclosures (id, feed_id, guid, url, path, state, downloaded_at)
+             VALUES (7, 'f', 'g', 'http://x/a.mp3', '/x/a.mp3', 'done', 100)",
+        ] {
+            db.sql(sql).await.unwrap();
+        }
+        // Two minutes cut at the usual pause, both before the place saved; 40 s at the longest.
+        let plans = r#"{"300": {"cuts": [[60000,120000],[200000,260000]], "pieces": []},
+                        "500": {"cuts": [[60000,100000]], "pieces": []}}"#;
+        db.store_plans(7, plans).await.unwrap();
+        db.set_position(u, "f", "g", 300, None).await.unwrap();
+        let order = db::order_sql("published", "desc");
+        let page = || {
+            let (order, ctx) = (order.clone(), &ctx);
+            async move {
+                let mut rows = ctx.db.entries_in(u, Some("f"), db::Filter::All, None, 0, 10, &order).await.unwrap();
+                deadair::for_reader(ctx, u, &mut rows).await.unwrap();
+                rows.remove(0)
+            }
+        };
+        let off = page().await;
+        assert_eq!((off.position, off.enclosures[0].deadair), (300, None), "off until turned on for the feed");
+        assert!(!off.enclosures[0].deadair_pending);
+
+        db.set_deadair(u, "f", Some(true)).await.unwrap();
+        db.sql("DELETE FROM deadair_plans").await.unwrap();
+        let waiting = page().await;
+        assert!(waiting.enclosures[0].deadair_pending, "on, and its silences not found yet");
+        db.store_plans(7, plans).await.unwrap();
+        let on = page().await;
+        assert!(!on.enclosures[0].deadair_pending);
+        assert_eq!((on.position, on.duration, on.enclosures[0].deadair), (180, Some(480), Some(120)));
+        // A longer pause of their own: their clock, and the playlist, are that plan's (#182).
+        db.set_deadair_pause(u, "f", 500).await.unwrap();
+        let long = page().await;
+        assert_eq!((long.position, long.duration, long.enclosures[0].deadair), (260, Some(560), Some(40)));
+        assert_eq!(deadair::plan_for(&ctx, u, "f", 7).await.unwrap().unwrap().saved_ms(), 40_000);
+        db.set_deadair_pause(u, "f", 300).await.unwrap();
+
+        // Saved from the playlist at 3:20 of its 8:00: 5:20 of the original's 10:00, short of 75%.
+        let playing = deadair::Playing::default();
+        let plan = deadair::plan_for(&ctx, u, "f", 7).await.unwrap().unwrap();
+        playing.lock().unwrap().insert((u, "f".into(), "g".into()), Arc::new(plan));
+        let saved = deadair::on_save(&ctx, &playing, u, "f", "g", 200, Some(480)).await.unwrap();
+        assert_eq!(saved, (320, Some(600)));
+        assert_eq!(db.deadair_total(u).await.unwrap(), 0);
+        // Past 75% (6:00 of the playlist is 8:00 of the original), counted once.
+        for _ in 0..2 {
+            deadair::on_save(&ctx, &playing, u, "f", "g", 360, None).await.unwrap();
+        }
+        assert_eq!(db.deadair_total(u).await.unwrap(), 120_000);
+        // Playing the original again: saved as it is.
+        playing.lock().unwrap().clear();
+        assert_eq!(deadair::on_save(&ctx, &playing, u, "f", "g", 200, Some(600)).await.unwrap(), (200, Some(600)));
+        // Turned off again: the original's clock, and no playlist.
+        db.set_deadair(u, "f", Some(false)).await.unwrap();
+        assert_eq!(page().await.enclosures[0].deadair, None);
+        assert!(deadair::plan_for(&ctx, u, "f", 7).await.unwrap().is_none());
+    }
+
+    #[tokio::test]
+    async fn two_changes_to_the_catalogue_at_once_both_keep() {
+        let ctx = Arc::new(test_ctx(config::Config::default()).await);
+        // A slow change, as adding a feed is while it fetches, and a quick one made meanwhile.
+        let slow = {
+            let ctx = ctx.clone();
+            tokio::spawn(async move {
+                let mut cfg = ctx.edit_cfg().await;
+                tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+                cfg.feeds.insert("a".into(), feed());
+                ctx.store_cfg(cfg).await.unwrap();
+            })
+        };
+        tokio::time::sleep(std::time::Duration::from_millis(10)).await;
+        let mut cfg = ctx.edit_cfg().await;
+        cfg.feeds.insert("b".into(), feed());
+        ctx.store_cfg(cfg).await.unwrap();
+        slow.await.unwrap();
+        assert_eq!(ctx.cfg().feeds.keys().collect::<Vec<_>>(), ["a", "b"], "neither stored over the other (#153)");
+        let (_, stored) = ctx.db.stored_config().await.unwrap().unwrap();
+        assert_eq!(stored.keys().collect::<Vec<_>>(), ["a", "b"]);
+    }
+
+    #[tokio::test]
+    async fn a_moments_lookup_failure_is_tried_again_soon_and_not_held_against_the_feed() {
+        let ctx = test_ctx(config::Config::default()).await;
+        let blip = "connecting: dns error: failed to lookup address information: Temporary failure in name resolution";
+        ctx.feed_failed("npr", "https://feeds.npr.org/x", blip).await.unwrap();
+        // Nothing on the feed: no error, no run of failures to back off from or call it gone by.
+        let s = ctx.db.feed_summary("npr").await.unwrap();
+        assert!(s.last_error.is_none() && s.error_since.is_none(), "{:?}", s.last_error);
+        // Due again in minutes, though a feed nobody subscribes to is otherwise read once a day.
+        let state = db::HttpState { last_checked: Some(db::now() - 2 * 86_400), ..Default::default() };
+        let due = ctx.due(&config::Config::default(), &feed(), "npr", &state, false).unwrap();
+        assert!((due - db::now() - RETRY_LOOKUP_SECS).abs() <= 2, "{due}");
+        // A real failure is the feed's.
+        ctx.feed_failed("gone", "https://x/feed", "HTTP 404 Not Found").await.unwrap();
+        assert_eq!(ctx.db.feed_summary("gone").await.unwrap().last_error.as_deref(), Some("HTTP 404 Not Found"));
+    }
+
     #[tokio::test]
     async fn a_reload_takes_the_catalogue_another_ipx_wrote() {
         let with = |id: &str| {

crates/ipx/src/metrics.rs

@@ -0,0 +1,297 @@
+//! Prometheus metrics for what logs and traces cannot show: the daemon's own state between
+//! requests, such as how many database connections are in use (#194). Served on a port and a
+//! thread of their own, with a runtime of their own, and made only of what is already in memory:
+//! a scrape neither waits for the web server's threads or the database, whose pool running dry
+//! is one of the things it is there to show, nor holds anything up itself. No sign-in, as
+//! Prometheus exporters have none: checking a token is a database lookup. Written out by hand:
+//! the text format is a few lines, and a client library would be a dependency for them.
+
+use std::fmt::Write as _;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicI64, AtomicU64, Ordering::Relaxed};
+
+/// What the daemon counts as it works, for /metrics to read without asking anything (#195).
+/// Global: the web layer, the worker, downloads, artwork and DeadAir each add to it, and a handle
+/// threaded through all of them was more code than the counts.
+pub static STATS: Stats = Stats::new();
+
+pub struct Stats {
+    pub http_in_flight: AtomicI64,
+    /// Live updates dropped for a page or socket client that fell behind the broadcast.
+    pub events_missed: AtomicU64,
+    pub downloads_active: AtomicI64,
+    pub download_bytes: AtomicU64,
+    /// Feeds a scan is fetching at this moment, up to its AHEAD.
+    pub feeds_fetching: AtomicI64,
+    /// When a scan last finished, Unix seconds; 0 for not since starting.
+    pub last_scan_done: AtomicI64,
+    /// Files someone wants shortened that DeadAir has not looked at, as of its last pass.
+    pub deadair_backlog: AtomicI64,
+    /// When DeadAir started on the file it is on, Unix seconds; 0 when it is on none.
+    pub deadair_busy_since: AtomicI64,
+    pub art_cache_bytes: AtomicU64,
+    /// Images the sweep threw out to keep under the limit: kept bytes sit at the limit by design,
+    /// so this is what says whether the limit is too small.
+    pub art_evicted: AtomicU64,
+    /// Artwork served from disk, and fetched from the publisher because it was not there.
+    pub art_hits: AtomicU64,
+    pub art_misses: AtomicU64,
+    /// The library as the daemon last counted it, every 30 s; -1 until it has.
+    pub feeds: AtomicI64,
+    pub pending: AtomicI64,
+    pub downloaded: AtomicI64,
+    /// The worker's job now, and since when.
+    job: std::sync::Mutex<Option<(&'static str, std::time::Instant)>>,
+    /// Jobs finished, by kind: how many, and their seconds all told.
+    jobs: std::sync::Mutex<std::collections::BTreeMap<&'static str, (u64, f64)>>,
+}
+
+impl Stats {
+    pub const fn new() -> Self {
+        Self {
+            http_in_flight: AtomicI64::new(0),
+            events_missed: AtomicU64::new(0),
+            downloads_active: AtomicI64::new(0),
+            download_bytes: AtomicU64::new(0),
+            feeds_fetching: AtomicI64::new(0),
+            last_scan_done: AtomicI64::new(0),
+            deadair_backlog: AtomicI64::new(0),
+            deadair_busy_since: AtomicI64::new(0),
+            art_cache_bytes: AtomicU64::new(0),
+            art_evicted: AtomicU64::new(0),
+            art_hits: AtomicU64::new(0),
+            art_misses: AtomicU64::new(0),
+            feeds: AtomicI64::new(-1),
+            pending: AtomicI64::new(-1),
+            downloaded: AtomicI64::new(-1),
+            job: std::sync::Mutex::new(None),
+            jobs: std::sync::Mutex::new(std::collections::BTreeMap::new()),
+        }
+    }
+
+    /// Marks the worker as on a job of `kind` until what it returns is dropped, however the job
+    /// ends: finished, failed or stopped.
+    pub fn job(&'static self, kind: &'static str) -> Job {
+        *self.job.lock().unwrap() = Some((kind, std::time::Instant::now()));
+        Job(self)
+    }
+}
+
+pub struct Job(&'static Stats);
+
+impl Drop for Job {
+    fn drop(&mut self) {
+        if let Some((kind, since)) = self.0.job.lock().unwrap().take() {
+            let mut jobs = self.0.jobs.lock().unwrap();
+            let e = jobs.entry(kind).or_default();
+            e.0 += 1;
+            e.1 += since.elapsed().as_secs_f64();
+        }
+    }
+}
+
+/// Counts one more of something in progress until dropped, however it ends.
+pub struct Busy(&'static AtomicI64);
+
+pub fn busy(gauge: &'static AtomicI64) -> Busy {
+    gauge.fetch_add(1, Relaxed);
+    Busy(gauge)
+}
+
+impl Drop for Busy {
+    fn drop(&mut self) {
+        self.0.fetch_sub(1, Relaxed);
+    }
+}
+
+/// What the metrics are read from.
+pub struct Sources {
+    pub ctx: Arc<crate::Ctx>,
+    pub cmds: tokio::sync::mpsc::Sender<crate::ipc::Command>,
+    pub events: tokio::sync::broadcast::Sender<crate::ipc::Event>,
+    pub playing: crate::deadair::Playing,
+    /// The daemon's runtime, not the metrics thread's own.
+    pub runtime: tokio::runtime::Handle,
+    pub started: std::time::Instant,
+}
+
+/// Starts serving /metrics on `bind`, on a thread of its own, and says where.
+pub fn spawn(bind: &str, s: Sources) -> anyhow::Result<std::net::SocketAddr> {
+    use anyhow::Context as _;
+    // Bound here, so a port already taken is the daemon's error at start, not a thread's later.
+    let listener = std::net::TcpListener::bind(bind).with_context(|| format!("binding metrics to {bind}"))?;
+    listener.set_nonblocking(true)?;
+    let addr = listener.local_addr()?;
+    let s = Arc::new(s);
+    std::thread::Builder::new().name("metrics".into()).spawn(move || {
+        let rt = match tokio::runtime::Builder::new_current_thread().enable_all().build() {
+            Ok(rt) => rt,
+            Err(e) => return tracing::error!(error = %e, "metrics could not start"),
+        };
+        rt.block_on(async move {
+            let app = axum::Router::new().route(
+                "/metrics",
+                axum::routing::get(move || {
+                    let s = s.clone();
+                    async move { ([(axum::http::header::CONTENT_TYPE, "text/plain; version=0.0.4")], render(&s)) }
+                }),
+            );
+            match tokio::net::TcpListener::from_std(listener) {
+                Ok(l) => {
+                    if let Err(e) = axum::serve(l, app).await {
+                        tracing::error!(error = %e, "metrics stopped");
+                    }
+                }
+                Err(e) => tracing::error!(error = %e, "metrics could not listen"),
+            }
+        });
+    })?;
+    Ok(addr)
+}
+
+/// Every metric, from memory alone.
+pub fn render(s: &Sources) -> String {
+    let mut out = String::new();
+    let (open, idle, max) = s.ctx.db.pool();
+    gauge(&mut out, "ipx_db_connections", "Database connections open, in use or idle.",
+        &[("state=\"in_use\"", open as f64 - idle as f64), ("state=\"idle\"", idle as f64)]);
+    gauge(&mut out, "ipx_db_connections_max", "The most database connections the pool opens.", &[("", max as f64)]);
+    gauge(&mut out, "ipx_worker_queue", "Commands waiting for the worker: scans, downloads and the like.",
+        &[("", (s.cmds.max_capacity() - s.cmds.capacity()) as f64)]);
+    gauge(&mut out, "ipx_event_listeners", "Open pages and socket clients listening for live updates.",
+        &[("", s.events.receiver_count() as f64)]);
+    gauge(&mut out, "ipx_torrent_slots_free", "Torrents that could start now.",
+        &[("", s.ctx.torrent_slots.available_permits() as f64)]);
+    gauge(&mut out, "ipx_deadair_playing", "Episodes someone is playing through DeadAir's playlist.",
+        &[("", s.playing.lock().map_or(0, |p| p.len()) as f64)]);
+    work(&mut out, &STATS, s.events.len(), s.ctx.retry.lock().map_or(0, |r| r.len()), s.ctx.cfg().general.art_cache_mb * 1_048_576);
+    let rt = s.runtime.metrics();
+    gauge(&mut out, "ipx_runtime_workers", "The async runtime's worker threads.", &[("", rt.num_workers() as f64)]);
+    gauge(&mut out, "ipx_runtime_tasks", "Tasks alive in the async runtime.", &[("", rt.num_alive_tasks() as f64)]);
+    gauge(&mut out, "ipx_runtime_queue", "Tasks waiting in the runtime's global queue.", &[("", rt.global_queue_depth() as f64)]);
+    let (rss, fds) = ipx_directory::metrics::process();
+    if let Some(v) = rss {
+        gauge(&mut out, "ipx_process_resident_bytes", "Memory the process holds.", &[("", v)]);
+    }
+    if let Some(v) = fds {
+        gauge(&mut out, "ipx_process_open_fds", "Files and sockets the process has open.", &[("", v)]);
+    }
+    counter(&mut out, "ipx_feed_fetches_total", "Feeds fetched, answered 304 included.", &[("", ipx_feed::FETCHES.load(Relaxed) as f64)]);
+    counter(&mut out, "ipx_feed_bytes_total", "Bytes of feed bodies fetched.", &[("", ipx_feed::FETCHED_BYTES.load(Relaxed) as f64)]);
+    gauge(&mut out, "ipx_uptime_seconds", "Seconds since the daemon started.", &[("", s.started.elapsed().as_secs() as f64)]);
+    let version = format!("version=\"{}\"", env!("CARGO_PKG_VERSION"));
+    gauge(&mut out, "ipx_build_info", "The version running, as a label.", &[(&version, 1.0)]);
+    out
+}
+
+/// The work in progress and done, from `STATS`: jobs, queues and what is in flight (#195).
+fn work(out: &mut String, st: &Stats, event_queue: usize, retries: usize, art_limit: u64) {
+    let now = crate::db::now();
+    let job = *st.job.lock().unwrap();
+    gauge(out, "ipx_worker_busy", "1 while the worker is on a job.", &[("", job.is_some() as u8 as f64)]);
+    if let Some((kind, since)) = job {
+        let label = format!("kind=\"{kind}\"");
+        gauge(out, "ipx_worker_job_seconds", "How long the worker has been on its job, by the job's kind.",
+            &[(&label, since.elapsed().as_secs_f64())]);
+    }
+    let jobs = st.jobs.lock().unwrap().clone();
+    let labels: Vec<String> = jobs.keys().map(|k| format!("kind=\"{k}\"")).collect();
+    let pairs = |f: fn(&(u64, f64)) -> f64| labels.iter().zip(jobs.values()).map(|(l, v)| (l.as_str(), f(v))).collect::<Vec<_>>();
+    counter(out, "ipx_jobs_total", "Jobs the worker has finished, by kind.", &pairs(|v| v.0 as f64));
+    counter(out, "ipx_job_seconds_total", "Seconds the worker has spent on jobs, by kind.", &pairs(|v| v.1));
+    let last = st.last_scan_done.load(Relaxed);
+    if last > 0 {
+        gauge(out, "ipx_last_scan_age_seconds", "Seconds since a scan last finished.", &[("", (now - last) as f64)]);
+    }
+    gauge(out, "ipx_http_requests_in_flight", "Web requests being answered.", &[("", st.http_in_flight.load(Relaxed) as f64)]);
+    gauge(out, "ipx_scan_feeds_fetching", "Feeds a scan is fetching at once.", &[("", st.feeds_fetching.load(Relaxed) as f64)]);
+    gauge(out, "ipx_downloads_active", "Files downloading now.", &[("", st.downloads_active.load(Relaxed) as f64)]);
+    counter(out, "ipx_download_bytes_total", "Bytes downloaded since the daemon started.", &[("", st.download_bytes.load(Relaxed) as f64)]);
+    gauge(out, "ipx_event_queue", "Live updates sent and not yet read by every listener.", &[("", event_queue as f64)]);
+    counter(out, "ipx_events_missed_total", "Live updates dropped for a listener that fell behind.", &[("", st.events_missed.load(Relaxed) as f64)]);
+    gauge(out, "ipx_deadair_backlog", "Files of shows someone has DeadAir on that it has not looked at, those already heard through included.", &[("", st.deadair_backlog.load(Relaxed) as f64)]);
+    let since = st.deadair_busy_since.load(Relaxed);
+    gauge(out, "ipx_deadair_busy_seconds", "How long DeadAir has been on its file; 0 when on none.",
+        &[("", if since > 0 { (now - since) as f64 } else { 0.0 })]);
+    gauge(out, "ipx_feed_retries", "Feeds waiting to try a failed name lookup again.", &[("", retries as f64)]);
+    gauge(out, "ipx_art_cache_bytes", "Artwork kept on disk, as of the last sweep.", &[("", st.art_cache_bytes.load(Relaxed) as f64)]);
+    gauge(out, "ipx_art_cache_limit_bytes", "The most artwork kept.", &[("", art_limit as f64)]);
+    counter(out, "ipx_art_evicted_total", "Images thrown out to keep the artwork under its limit.", &[("", st.art_evicted.load(Relaxed) as f64)]);
+    counter(out, "ipx_art_requests_total", "Artwork asked for: served from disk, or fetched from the publisher.",
+        &[("result=\"hit\"", st.art_hits.load(Relaxed) as f64), ("result=\"miss\"", st.art_misses.load(Relaxed) as f64)]);
+    for (name, help, v) in [
+        ("ipx_feeds", "Feeds in the catalogue, as last counted.", &st.feeds),
+        ("ipx_downloads_pending", "Files a scan will download on its own, as last counted.", &st.pending),
+        ("ipx_files_downloaded", "Files on disk, as last counted.", &st.downloaded),
+    ] {
+        let v = v.load(Relaxed);
+        if v >= 0 {
+            gauge(out, name, help, &[("", v as f64)]);
+        }
+    }
+}
+
+/// A counter, which only goes up while the daemon runs, in Prometheus's text format.
+pub fn counter(out: &mut String, name: &str, help: &str, samples: &[(&str, f64)]) {
+    write(out, "counter", name, help, samples);
+}
+
+/// One gauge in Prometheus's text format: its help, its type, and a line for each set of labels
+/// (`state="idle"`, or "" for none).
+pub fn gauge(out: &mut String, name: &str, help: &str, samples: &[(&str, f64)]) {
+    write(out, "gauge", name, help, samples);
+}
+
+fn write(out: &mut String, kind: &str, name: &str, help: &str, samples: &[(&str, f64)]) {
+    let _ = writeln!(out, "# HELP {name} {help}\n# TYPE {name} {kind}");
+    for (labels, value) in samples {
+        let labels = if labels.is_empty() { String::new() } else { format!("{{{labels}}}") };
+        let _ = writeln!(out, "{name}{labels} {value}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn gauges_are_written_as_prometheus_reads_them() {
+        let mut out = String::new();
+        gauge(&mut out, "ipx_db_connections", "Connections.", &[("state=\"idle\"", 3.0), ("state=\"in_use\"", 1.0)]);
+        gauge(&mut out, "ipx_feeds", "Feeds.", &[("", 1535.0)]);
+        assert_eq!(
+            out,
+            "# HELP ipx_db_connections Connections.\n# TYPE ipx_db_connections gauge\n\
+             ipx_db_connections{state=\"idle\"} 3\nipx_db_connections{state=\"in_use\"} 1\n\
+             # HELP ipx_feeds Feeds.\n# TYPE ipx_feeds gauge\nipx_feeds 1535\n"
+        );
+    }
+
+    #[test]
+    fn jobs_and_work_in_progress_are_counted_however_they_end() {
+        static T: Stats = Stats::new();
+        {
+            let _j = T.job("scan");
+            let _b = busy(&T.downloads_active);
+            assert_eq!(T.downloads_active.load(Relaxed), 1);
+            let mut out = String::new();
+            work(&mut out, &T, 0, 0, 0);
+            assert!(out.contains("ipx_worker_busy 1\n") && out.contains("ipx_worker_job_seconds{kind=\"scan\"}"), "{out}");
+        }
+        // Dropped, as an error or a stop drops them: nothing left in progress, one scan done.
+        assert_eq!(T.downloads_active.load(Relaxed), 0);
+        let mut out = String::new();
+        work(&mut out, &T, 3, 1, 10);
+        assert!(out.contains("ipx_worker_busy 0\n") && !out.contains("ipx_worker_job_seconds"), "{out}");
+        assert!(out.contains("ipx_jobs_total{kind=\"scan\"} 1\n") && out.contains("# TYPE ipx_jobs_total counter"), "{out}");
+        assert!(out.contains("ipx_event_queue 3\n") && out.contains("ipx_feed_retries 1\n"));
+        // The library's counts are left out until the daemon has counted it.
+        assert!(!out.contains("ipx_feeds "));
+    }
+
+    #[test]
+    fn the_process_reads_its_memory_and_files_on_linux() {
+        let (rss, fds) = ipx_directory::metrics::process();
+        assert!(rss.unwrap() > 0.0 && fds.unwrap() > 0.0);
+    }
+}

crates/ipx/src/retention.rs

@@ -1,9 +1,10 @@
 //! Disk quota and age sweeps. Replaces iPXQuotaManager.py ("SmartSpace").
 
 use anyhow::Result;
+use tracing::Instrument;
 
 use crate::config::Config;
-use crate::db::{Candidate, Db, now};
+use crate::db::{Candidate, Db, now, step};
 
 /// Headroom kept below the quota, as getToQuota()'s `1048576 * 50` did.
 pub const PAD_BYTES: u64 = 50 * 1024 * 1024;
@@ -49,7 +50,8 @@ pub async fn run(cfg: &Config, db: &Db, dry_run: bool) -> Result<Report> {
     let mut report = Report::default();
 
     // Someone may have deleted a file by hand; the row must stop claiming it exists.
-    for (id, path) in db.missing_files().await? {
+    // Each step is a span of the reap's trace, so a slow one says which part was slow.
+    for (id, path) in db.missing_files().instrument(step("missing_files")).await? {
         if !dry_run {
             db.mark_reaped(id).await?;
         }
@@ -57,20 +59,20 @@ pub async fn run(cfg: &Config, db: &Db, dry_run: bool) -> Result<Report> {
         report.reconciled += 1;
     }
 
-    for id in db.prune_abandoned_failures().await? {
+    for id in db.prune_abandoned_failures().instrument(step("prune_abandoned_failures")).await? {
         tracing::info!(feed = id, "forgot a failing feed nobody subscribes to");
     }
 
-    let candidates = db.reap_candidates().await?;
+    let candidates = db.reap_candidates().instrument(step("reap_candidates")).await?;
 
     if cfg.general.max_age_days > 0 {
         let cutoff = now() - (cfg.general.max_age_days * 86_400) as i64;
         report.aged_out = aged(&candidates, cutoff);
         for c in &report.aged_out {
-            report.bytes_freed += remove(db, c, dry_run).await?;
+            report.bytes_freed += remove(db, c, dry_run).instrument(step("remove_aged")).await?;
         }
         if !dry_run {
-            report.entries_pruned = db.prune_entries(cutoff).await?;
+            report.entries_pruned = db.prune_entries(cutoff).instrument(step("prune_entries")).await?;
         }
     }
 
@@ -85,7 +87,7 @@ pub async fn run(cfg: &Config, db: &Db, dry_run: bool) -> Result<Report> {
         let total: u64 = remaining.iter().map(|c| c.bytes.max(0) as u64).sum();
         report.over_quota = pick(&remaining, total, limit);
         for c in &report.over_quota {
-            report.bytes_freed += remove(db, c, dry_run).await?;
+            report.bytes_freed += remove(db, c, dry_run).instrument(step("remove_over_quota")).await?;
         }
     }
 
@@ -96,9 +98,13 @@ async fn remove(db: &Db, c: &Candidate, dry_run: bool) -> Result<u64> {
     if dry_run {
         return Ok(c.bytes.max(0) as u64);
     }
-    let size = std::fs::metadata(&c.path).map(|m| m.len()).unwrap_or(c.bytes.max(0) as u64);
+    // A torrent's folder measures as a directory entry, not what is in it: the recorded size then.
+    let size = std::fs::metadata(&c.path)
+        .ok()
+        .filter(|m| m.is_file())
+        .map_or(c.bytes.max(0) as u64, |m| m.len());
     // Missing is fine: the point is that it is gone.
-    if let Err(e) = std::fs::remove_file(&c.path)
+    if let Err(e) = crate::download::remove(std::path::Path::new(&c.path))
         && e.kind() != std::io::ErrorKind::NotFound
     {
         tracing::warn!(path = c.path, error = %e, "could not delete");
@@ -189,11 +195,36 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn the_marks_of_someone_who_left_count_for_nothing() {
+        // ray and sam subscribe; left read one episode and pinned the others before unsubscribing.
+        let db = Db::memory().await.unwrap();
+        db.exec_for_test(
+            "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',true),(2,'sam',false),(3,'left',false);
+             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f'),(2,'f');
+             INSERT INTO entries (feed_id, guid, first_seen) VALUES
+                ('f', 'heard', 0), ('f', 'pinned', 0), ('f', 'old', 0);
+             INSERT INTO entry_state (user_id, feed_id, guid, read, flagged) VALUES
+                (3, 'f', 'heard', true, false),
+                (1, 'f', 'heard', true, false),
+                (3, 'f', 'pinned', false, true),
+                (3, 'f', 'old', false, true);
+             INSERT INTO enclosures (id, feed_id, guid, url, path, bytes_done, state, downloaded_at) VALUES
+                (1, 'f', 'heard',  'u1', '/tmp/heard',  10, 'done', 10),
+                (2, 'f', 'pinned', 'u2', '/tmp/pinned', 10, 'done', 20);",
+        ).await
+        .unwrap();
+        let got: Vec<(i64, bool)> = db.reap_candidates().await.unwrap().iter().map(|c| (c.id, c.read)).collect();
+        assert_eq!(got, vec![(1, false), (2, false)], "sam has not heard it, and nobody here pinned it (#156)");
+        assert_eq!(db.prune_entries(500).await.unwrap(), 1, "the old item goes, a leaver's pin or not");
+    }
+
     #[tokio::test]
     async fn prune_keeps_entries_that_still_have_a_file() {
         let db = Db::memory().await.unwrap();
         db.exec_for_test(
             "INSERT INTO users (id, name, is_admin) VALUES (1,'ray',true);
+             INSERT INTO subscriptions (user_id, feed_id) VALUES (1,'f');
              INSERT INTO entry_state (user_id, feed_id, guid, flagged) VALUES (1,'f','flagged',true);
              INSERT INTO entries (feed_id, guid, first_seen) VALUES
                 ('f', 'has-file', 100),

docker-compose.yml

@@ -1,33 +1,43 @@
+# A sample: ipx with its database in SQLite, and ipx-web, the page, in front of it. Build both
+# images first (`docker build -t ipx .` and `docker build -f Dockerfile.web -t ipx-web .`), then
+# `docker compose up -d`, and sign in at http://<host>:8099 as admin / ipodderx.
+# docs/configuration.md has the rest, Postgres included.
 services:
   ipx:
-    image: 192.168.1.130:5000/ipx:latest
+    image: ipx
-    container_name: iPX
+    container_name: ipx
     restart: unless-stopped
     environment:
+      # Who owns the files it writes. 99:100 is Unraid's nobody:users.
       PUID: "99"
       PGID: "100"
-      TZ: "America/Toronto"
+      TZ: "UTC"
-      IPX_LOG: "ipx=info"
+      # For Postgres instead of SQLite:
-      # One JSON object a line, which Loki (through Alloy) and the Grafana dashboard read.
+      # IPX_DATABASE_URL: "postgres://ipx:password@db-host:5432/ipx"
-      IPX_LOG_FORMAT: "json"
+    # No web port of its own: ipx-web is the way in, and passes the API on to it.
-      # Traces to Tempo, in the monitoring project; ipx sends none without it.
-      OTEL_EXPORTER_OTLP_ENDPOINT: "http://192.168.1.130:4318"
-      # What the dashboard filters on, so a daemon run by hand for testing stays out of it.
-      OTEL_RESOURCE_ATTRIBUTES: "deployment.environment.name=production"
-    # IPX_DATABASE_URL=postgres://... to use Postgres; without it, /data/state.db (SQLite).
-    env_file:
-      - ipx.env   # relative: Arcane resolves it inside its own container
     ports:
-      - "8099:8099"          # web UI
       - "6881:6881/tcp"      # BitTorrent peers
       - "6881:6881/udp"      # DHT
     volumes:
-      - /mnt/fast/appdata/ipx:/config     # config.toml, and the web token
+      - ./config:/config         # config.toml, written on first start
-      - /mnt/user/ipx/:/data         # state.db
+      - ./data:/data             # state.db
-      - /mnt/user/ipx/downloads:/downloads
+      - ./downloads:/downloads
-    healthcheck:
+
-      test: ["CMD", "ipx", "status"]
+  ipx-web:
-      interval: 30s
+    image: ipx-web
-      timeout: 5s
+    container_name: ipx-web
-      retries: 3
+    restart: unless-stopped
-      start_period: 10s
+    environment:
+      IPX_UPSTREAM: "ipx:8099"
+      # Behind Cloudflare Access only: where cloudflared's requests come from, the one address
+      # whose Cf-Access-* headers are passed on. docs/sso.md says how to find it.
+      # TUNNEL_PEER: "192.168.64.1"
+      # Traces to an OpenTelemetry collector, a span for each request, continued into ipx:
+      # WEB_TRACING: "on"
+      # OTEL_EXPORTER_OTLP_ENDPOINT: "http://collector:4318"
+      # OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
+      # OTEL_SERVICE_NAME: "ipx-web"
+    ports:
+      - "8099:8080"          # the web UI
+    depends_on:
+      - ipx

docs/architecture.md

@@ -1,34 +1,61 @@
 # How it works
 
-One binary, `ipx`. `ipx daemon` runs three things in one process: a scheduler, a Unix-socket
+Three services, each a container of its own with its own version and changelog (#207):
-control server, and the web UI. Everything else is a CLI that either does the work itself or hands
+
-it to a running daemon.
+| Service | What it is | Source | Image |
+|---|---|---|---|
+| ipx-web | Caddy: serves the page, a static site built from `web/`, and passes `/api` and `/media` to ipx on the same address. It asks ipx before it serves the app or the admin page (`/api/page-check`) | `web/`, `web/Caddyfile` | `Dockerfile.web` |
+| ipx | The daemon and CLI, one binary. `ipx daemon` runs a scheduler, a Unix-socket control server and the HTTP API in one process; everything else is a CLI that either does the work itself or hands it to a running daemon | `crates/ipx` | `Dockerfile` |
+| ipx-directory | The directory of public podcasts that ipx servers share. ipx asks it on its people's behalf; the page never talks to it ([directory.md](directory.md)) | `crates/directory` | `Dockerfile.directory` |
+
+The Rust source is a Cargo workspace (#202); `crates/feed` (`ipx-feed`) fetches and parses feeds
+for both Rust services. Versions: ipx's in `crates/ipx/Cargo.toml`, the directory's in
+`crates/directory/Cargo.toml`, the page's in `package.json`; CLAUDE.md has the release steps.
+
+## Traces and logs
+
+A request is one trace (#213). The page starts one for each tap and sends `traceparent` with its
+requests (#190); Caddy's span continues it and passes it on to ipx; ipx's request span, its steps
+and its calls to the directory follow, and the directory's request span joins it. Scans,
+downloads, DeadAir's work, shares with the directory and the directory's refresher rounds are
+traces of their own. All three log one JSON object a line, for Loki; ipx's lines carry their trace
+id, and Caddy's request lines theirs. ipx also serves Prometheus metrics (`[web] metrics_bind`,
+#194). The exporter and the `traceparent` handling both Rust services use are in
+`crates/directory/src/otel.rs`.
 
 ## Modules
 
 | File | Responsibility | What it replaced in the Python |
 |---|---|---|
-| `src/main.rs` | CLI, dispatch, scan loop, download policy | `iPXAgent.py` |
+| `crates/ipx/src/main.rs` | CLI, dispatch, scan loop, download policy | `iPXAgent.py` |
-| `src/config.rs` | TOML load/save, `General`/`Feed`/`Web`, intervals, slugs | `iPXSettings.py`, `feeds.plist` |
+| `crates/ipx/src/config.rs` | TOML load/save, `General`/`Feed`/`Web`, intervals, slugs | `iPXSettings.py`, `feeds.plist` |
-| `src/db.rs` | Every query, through SeaORM; creates missing tables | `.ipxd` plists, `history.dat`, `qmcache.dat` |
+| `crates/ipx/src/db.rs` | Every query, through SeaORM; creates missing tables | `.ipxd` plists, `history.dat`, `qmcache.dat` |
-| `src/entity.rs` | The tables, as SeaORM entities: the schema | — |
+| `crates/ipx/src/entity.rs` | The tables, as SeaORM entities: the schema | — |
-| `src/feed.rs` | Conditional GET, RSS/Atom/OPML parsing | `FeedData.__getFeed/__getEntries` |
+| `crates/feed/src/lib.rs` | Conditional GET, RSS/Atom/OPML parsing, `url_looks_private` | `FeedData.__getFeed/__getEntries` |
-| `src/download.rs` | Streaming download, naming, type sniffing, placement | `iPXDownloader.getFile` |
+| `crates/ipx/src/download.rs` | Streaming download, naming, type sniffing, placement | `iPXDownloader.getFile` |
-| `src/torrent.rs` | librqbit session, seeding limits, stall abort | vendored BitTorrent 4.2.1 |
+| `crates/ipx/src/torrent.rs` | librqbit session, seeding limits, stall abort | vendored BitTorrent 4.2.1 |
-| `src/retention.rs` | Quota and age sweeps | `iPXQuotaManager.py` |
+| `crates/ipx/src/retention.rs` | Quota and age sweeps | `iPXQuotaManager.py` |
-| `src/ipc.rs` | Event and command types, the socket server | `printMSG` on stdout |
+| `crates/ipx/src/ipc.rs` | Event and command types, the socket server | `printMSG` on stdout |
-| `src/auth.rs` | Argon2id hashing, session tokens, header names | — |
+| `crates/ipx/src/auth.rs` | Argon2id hashing, session tokens, header names | — |
-| `src/web.rs` | axum: HTTP API, auth, SSE, media streaming | — |
+| `crates/ipx/src/web.rs` | axum: HTTP API, auth, SSE, media streaming | — |
-| `src/logbuf.rs` | Ring buffer behind the UI's Log view | — |
+| `crates/ipx/src/logbuf.rs` | Ring buffer behind the UI's Log view | — |
+| `crates/ipx/src/directory.rs` | Asking the directory service, and sharing this server's public feeds with it | — |
+| `crates/ipx/src/metrics.rs` | `/metrics` for Prometheus | — |
+| `crates/directory/src/lib.rs` | The directory's HTTP API, its token check, the refresher | — |
+| `crates/directory/src/store.rs` | The directory's database: feeds, snapshots, blocked | — |
+| `crates/directory/src/config.rs` | The directory's config file: its tokens and their access | — |
+| `crates/directory/src/otel.rs` | Traces for both Rust services: the exporter, `traceparent` in and out | — |
 | `web/index.html` | The app's markup | — |
 | `web/admin.html` | The admin page's markup: server settings, accounts, the log. Sent to admins only | — |
 | `web/app.css` | The stylesheet both pages share | — |
 | `web/src/*.ts` | The page's script, one scope split across files, type-checked by `npx tsc` | — |
-| `web/build.mjs` | swc: strips the types into `app.js`/`login.js`, named in the page by a hash of their contents, and minifies | — |
+| `web/build.mjs` | swc: strips the types into `app.js`/`admin.js`/`login.js`, named in the page by a hash of their contents, minifies, and writes the static site to `web/dist` | — |
-| `build.rs` | Runs `web/build.mjs` into `OUT_DIR`, where `web.rs` `include_str!`s the result | — |
+| `web/boot.js` | In `<head>`: the theme from its cookie, and an admin's link, before the first frame | — |
+| `web/Caddyfile` | `ipx-web`: serves `web/dist`, asks ipx before serving a page, passes `/api` and `/media` to ipx | — |
 
-The page is compiled in, so **editing `web/index.html` or `web/src` needs a rebuild**, and a
+The page is a separate image, `ipx-web` (`Dockerfile.web`, #203), so **editing `web/` needs
-build needs node and `npm ci` run once.
+ipx-web rebuilt**, not ipx, and building it needs node and `npm ci` run once. ipx serves the API
+and the files, and no page.
 
 ## A scan
 
@@ -70,7 +97,7 @@ entry_state    user_id, feed_id, guid, read, flagged, position
 Read state is `entry_state` alone. `entries` had `read`, `flagged` and `position` columns from
 before accounts; two bugs came from queries still reading them, and they were dropped in 0.5.
 
-Schema changes: the tables are the entities in `src/entity.rs`, and `Db::open` creates whatever
+Schema changes: the tables are the entities in `crates/ipx/src/entity.rs`, and `Db::open` creates whatever
 table or index a database is missing from them (`db::create_missing`), with `IF NOT EXISTS`. It
 never alters a table that exists, so a new column on one needs its own `ALTER` in
 `create_missing`, looked for first and run only when it is missing, as `feeds.description`'s is,
@@ -120,8 +147,8 @@ else a `401`. A feed's items and files (its entries, `download-latest`, `/api/en
 
 | Route | |
 |---|---|
-| `GET /` | the app |
+| `GET /api/page-check`, `GET /api/login-check`, `GET /api/signin` | for Caddy (#203): whether the visitor may have the page in `X-Forwarded-Uri` (`204`), or where to send them; signing in with `?token=` |
-| `GET /login`, `POST /api/login`, `POST /api/logout`, `GET /api/me` | sign-in |
+| `POST /api/login`, `POST /api/logout`, `GET /api/me` | sign-in; `/api/me` also gives the version and the account's theme from before |
 | `GET /api/feeds`, `POST /api/feeds` | your subscriptions; subscribe |
 | `PATCH /api/feeds/{id}`, `DELETE /api/feeds/{id}` | your settings or (admin) the feed's; unsubscribe |
 | `GET /api/feeds/{id}/entries` | paged, filtered, searchable, sortable (`sort` = kept, title, feed, type, size or published; `dir` = asc or desc) |
@@ -132,9 +159,12 @@ else a `401`. A feed's items and files (its entries, `download-latest`, `/api/en
 | `POST /api/enclosures/{id}/download`, `DELETE /api/enclosures/{id}` | `?force=true` overrides the shared-file warning |
 | `POST /api/fetch` | |
 | `GET /api/opml`, `POST /api/opml` | export your subscriptions; subscribe to every feed in an OPML |
-| `GET /api/directory/{id}` | a listed feed's description, why its last check failed when it did (in words, never its error, which can name its address), and latest twenty items, for its page before you subscribe: title, link, date, length and text, never a file or its address, and only for a feed the directory lists |
+| `GET /api/directory/{id}` | a feed's page from the directory service (#205), by the directory's id: its description and latest twenty items, sanitized here, and why its last check failed, in words; never a file or its address |
-| `GET /api/popular`, `GET /api/directory`, `POST /api/popular/{id}` | the ten most subscribed feeds, and every listable feed A to Z, with an OPML's feeds in place of the OPML and everyone counted (id, title, art, count, whether it is yours, the feed's iTunes category, whether it carries audio or video; never a URL, never a private feed); subscribe by id |
+| `GET /api/popular`, `GET /api/directory`, `POST /api/popular/{id}` | the directory service's ten most subscribed and every feed it lists, A to Z, asked by ipx with its token (directory id, title, art, subscribers across every sharing server, whether it is yours and its id here, category, whether it carries audio or video; never a URL); subscribe by the directory's id, which takes the feed's address from the directory. `503` with no directory set up |
-| `GET /api/settings`, `PATCH /api/settings` | admin-only to write |
+| `DELETE /api/directory/{id}`, `POST /api/directory/{id}/refresh` | admin-only, and the directory refuses unless this server's token is `rwa` (#206): remove and block a feed; check it now. `GET /api/directory/{id}` says `can_admin` when both hold |
+| `GET /api/directory-admin`, `DELETE /api/directory-blocked/{id}`, `DELETE /api/directory-instances/{name}` | admin-only, `rwa` (#206): the servers sharing (name, feeds, subscribers) and the blocked feeds (id, title, when; never the address, often why it was blocked); unblock; drop a server's snapshot. Unblocking or dropping sends this server's snapshot again at once |
+| `GET /api/directory-status` | admin-only: the name and access the directory gives this server's token, or why it refused, and how the last snapshot went |
+| `GET /api/settings`, `PATCH /api/settings` | admin-only to write. The directory's token is written, never read back: `directory_token_set` says whether there is one |
 | `GET /api/users`, `POST /api/users`, `PATCH /api/users/{id}`, `DELETE /api/users/{id}` | admin-only; the only admin cannot be demoted or removed |
 | `GET /api/events` | SSE, the same broadcast the socket carries |
 | `GET /api/logs` | admin-only; the ring buffer, with a sequence cursor |

docs/cli.md

@@ -13,12 +13,12 @@ processes must never download the same thing. `--local` forces the work to happe
 | `ipx list` | Subscriptions and their state |
 | `ipx status` | Counts: feeds, pending, downloaded |
 | `ipx fetch [FEED] [--force]` | Scan everything, or one feed. `--force` ignores the TTL |
-| `ipx add <url> [--folder X] [--keywords a,b] [--list] [--category C]` | Subscribe; the id comes from the feed title. `--list` puts it in the Directory for anyone to subscribe to instead, and keeps it there when its last subscriber leaves; `--category` files it under one of the Directory's categories. Run for a feed already in the catalogue, these list it or set its category |
+| `ipx add <url> [--folder X] [--keywords a,b] [--list] [--category C]` | Subscribe; the id comes from the feed title. `--list` subscribes no one but keeps it in the catalogue, and so in what this server shares with the directory, when its last subscriber leaves; `--category` is the category the directory files it under when the feed names none. Run for a feed already in the catalogue, these list it or set its category |
 | `ipx rm <feed>` | Unsubscribe; downloads and history are kept |
 | `ipx import <file.opml>` / `ipx export <file.opml>` | Move subscriptions in or out. Import subscribes the first admin, as the shared web token does; in the web UI it subscribes whoever is signed in |
 | `ipx reap [--dry-run]` | Run retention now |
 | `ipx user <add\|list\|passwd\|rm>` | Accounts for the web UI |
-| `ipx daemon [--web ADDR]` | Scheduler, control socket and web UI |
+| `ipx daemon [--web ADDR]` | Scheduler, control socket and the HTTP API (the page is ipx-web's) |
 
 `add`, `rm` and `import` change the catalogue in a process of their own. With a daemon running they
 then tell it to read the catalogue again; without that it kept its own copy and wrote it back at
@@ -71,7 +71,7 @@ stops the next scan fetching it again.
 ## The daemon
 
 ```sh
-ipx daemon                     # scheduler + socket + web UI
+ipx daemon                     # scheduler + socket + HTTP API
 ipx daemon --web 0.0.0.0:8099  # override the configured bind for one run
 ```
 

docs/configuration.md

@@ -54,7 +54,8 @@ database as described above; `download_dir`, `socket` and `organize` stay in con
 * **`schedule`** — how often feeds are re-checked. A feed's own `<ttl>` still wins when it asks to
   be polled *less* often, and a per-feed `schedule` overrides both. A feed that keeps failing
   waits as long as it has been failing before the next try, up to a day, and is back on schedule
-  after its first success. Admin-only from the UI.
+  after its first success. A moment's failure to look its host up does not count: the network, not
+  the feed, failed, and it is tried again in ten minutes. Admin-only from the UI.
 * **`organize`** — `feed` files downloads under the feed's folder; `date` under `YYYY-MM-DD`.
 * **`max_total_gb`** — the reaper deletes to get back under this, oldest first, keeping a 50 MB
   pad. Kept items are never deleted, and a file only counts as read once every subscriber has
@@ -102,6 +103,7 @@ access_aud        = ""                    # the Access application's AUD tag
 auto_create_users = true
 sign_out_url      = ""                    # e.g. "/cdn-cgi/access/logout"
 session_days      = 30
+metrics_bind      = ""                    # e.g. "0.0.0.0:9187"; empty serves no metrics
 ```
 
 * **`token`** — the shared secret, which signs in as the **admin**. `?token=…` sets a cookie, so
@@ -118,6 +120,9 @@ session_days      = 30
   `/cdn-cgi/access/logout` behind Cloudflare Access. Empty sends them to the sign-in page, where
   the proxy signs them straight back in.
 * **`session_days`** — sign a session out after this long without a request.
+* **`metrics_bind`** — where to serve `/metrics` for Prometheus: database connections in use, the
+  worker's queue, the runtime's tasks, memory and open files. It has a thread and a port of its own
+  and no sign-in, so publish it to the LAN only. Empty, the default, serves none.
 
 It is plain HTTP. On a LAN bind everything crosses the network in the clear — and a feed URL can
 itself carry a credential. Put TLS in front of it if that matters.
@@ -135,7 +140,7 @@ folder             = "Accidental Tech Podcast"   # default: the feed title
 schedule           = "every 6h"                  # overrides [general] for this feed
 media_types        = ["audio"]                   # overrides [general] for this feed
 category           = "Technology"                # the Directory's, if the feed names none
-listed             = true                        # in the Directory with no subscribers
+listed             = true                        # shared with the directory with no subscribers
 username           = "ray"                       # HTTP basic auth
 password_env       = "IPX_ATP_PASS"              # preferred over a literal `password`
 ```
@@ -145,9 +150,14 @@ With more than one account, **`keywords`, `auto_download`, `allow_explicit` and
 config.toml are the fallback for a feed nobody has claimed. The keys above describe the feed itself
 and are the same for everyone. See [users.md](users.md).
 
-**The Directory** lists every feed in the catalogue, whether or not anyone subscribes to it yet.
+**The Directory** is the directory service's ([directory.md](directory.md)), which an admin sets
-To put one there for others to find, `ipx add --list --category News <url>`: it subscribes no one,
+up in Admin, Directory: its address, this server's token and whether to share. They are server
-and a listed feed stays when its last subscriber leaves, where another is dropped. A feed nobody
+settings, kept in the database (`directory_url`, `directory_token`, `directory_share`), not here.
+With sharing on, this server sends it every feed in the catalogue that is not private, with how
+many people here subscribe, and the `category` above for a feed that names none. To offer one with
+nobody subscribed, `ipx add --list --category News <url>`: it subscribes no one, and a listed feed
+stays in the catalogue, and so in what is shared, when its last subscriber leaves, where another
+is dropped. A feed nobody
 subscribes to is checked once a day. One that is dead (failing for 30 days) or quiet (nothing
 new in a year), with nobody subscribed and no file on disk, is removed from the catalogue.
 
@@ -167,3 +177,17 @@ and they are re-derived on every scan. Editing one in the UI promotes it to a ca
 | `IPX_UI_LOG` | What the in-process log buffer captures for the UI's Log view |
 | `OTEL_EXPORTER_OTLP_ENDPOINT` | An OTLP/HTTP collector, such as Tempo at `http://host:4318`: the daemon sends it traces of scans, downloads and web requests. The other `OTEL_EXPORTER_OTLP_*` variables apply too |
 | `http_proxy` / `https_proxy` | Honoured for feed and enclosure fetches |
+
+## ipx-web
+
+The page's container reads only its environment (`web/Caddyfile`):
+
+| Variable | Effect |
+|---|---|
+| `IPX_UPSTREAM` | Where ipx is, `host:port`; `ipx:8099` by default |
+| `WEB_BIND` | Where to listen; `:8080` by default |
+| `WEB_ROOT` | The built page; `/srv` in the image |
+| `TUNNEL_PEER` | The one address whose `Cf-Access-*` headers are passed on to ipx: where cloudflared's requests come from. Unset passes none. See [sso.md](sso.md) |
+| `WEB_TRACING` | `on` sends a span for each request to the collector the `OTEL_*` variables name (`OTEL_EXPORTER_OTLP_ENDPOINT`, `OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf`, `OTEL_SERVICE_NAME`), continuing the page's trace into ipx. Off by default |
+
+ipx-directory's settings are in [directory.md](directory.md).

docs/directory.md

@@ -0,0 +1,147 @@
+# The directory
+
+`ipx-directory` is a catalogue of public podcasts and blogs that ipx servers share (#204). An ipx
+server sends it the public feeds its people subscribe to, and how many of them do. The directory
+fetches each feed's title, artwork, category, description and latest twenty items every six hours,
+and any server holding a token can browse it. It never downloads a file, and it never stores
+one's address: every ipx server still fetches its own feeds.
+
+This server's is at `https://directory.ipxreader.app` (until 2026-10-12 `ipx-dir.sdf1.net`, #214), the `ipx-directory` service of the Arcane project
+`ipx`, with its database `ipx_directory` on the `databases` project's Postgres.
+
+## In ipx
+
+An admin sets it up in **Admin, Directory**: the directory's address, the token its operator gave
+this server, and whether to share. ipx asks the directory on its people's behalf, so the page never
+talks to it and never sees the token or a feed's address. With no directory set up, the Directory
+says so and feeds are added by their address.
+
+ipx keeps the address and token with its other server settings, in its database (`settings`,
+`directory_url` and `directory_token`), not in config.toml. The token is written, never shown
+again: the tab says it is set and offers to clear it. To replace one, make a new token on the
+directory, paste it over the old, then delete the old token's entry from the directory's config.
+
+With sharing on, ipx sends its snapshot when what it would send has changed (checked after every
+scan, and whenever the catalogue or these settings change), and every half hour regardless (#211): each feed checked at least once, with how many people here subscribe,
+and the category an admin gave a feed that names none. It never sends an OPML or a Patreon creator
+itself (their feeds go instead), or a private feed. A feed's settings have a **Private** switch for
+a paid feed iPX does not recognise by its address; anyone subscribed may turn it on, and only an
+admin off.
+
+When this server's token is `rwa`, its admins administer the directory from iPX (#206). A feed's
+page in the Directory has **Check now** and **Remove from the directory**, which blocks it so no
+server's snapshot brings it back. Admin, Directory lists the **Servers** sharing, by token name,
+with how many feeds and subscribers each gave, and **Blocked**, by title, with Unblock. Dropping a
+server's snapshot takes its feeds and counts out until it next shares; to keep a server out,
+revoke its token. An admin's own subscriptions open as their feeds, not as Directory pages, so
+removing one of those is done by marking it private, or from another admin's account.
+
+## In a web browser
+
+Anyone may browse it at its address, no token and no sign-in (#215): the most subscribed, the
+categories, every feed A to Z, a search by name, and a page for each feed with its description,
+its latest items and its address, with a Copy button, to subscribe to in any podcast app or feed
+reader. The pages only read: nothing in them changes the directory. They are rendered by the
+directory itself from what the API serves, with the publisher's HTML shown as text, an item's link
+only when it is http(s), and a Content-Security-Policy that allows the site's own script and
+stylesheet and the covers, which load from their publishers. `/v1` is the API and still needs a
+token for everything.
+
+## Tokens
+
+Everything but `/healthz` needs a token, sent as `Authorization: Bearer <token>`. Each one has a
+name and one of three levels of access:
+
+| | browse | send snapshots | remove, block, refresh feeds; drop a server's snapshot |
+|---|---|---|---|
+| `ro` | yes | | |
+| `rw` | yes | yes | |
+| `rwa` | yes | yes | yes |
+
+Tokens are in the config file and nowhere else, and no level of access can make or revoke one
+over the API. To make one:
+
+```sh
+docker exec ipx-directory ipx-directory token new <name> --access ro|rw|rwa
+```
+
+It prints the token, to give to whoever it is for, and the lines to add to the config file. The file
+holds the token's SHA-256, never the token. The directory reads the file again within a minute of
+a change, so adding a token and revoking one (deleting its entry) need no restart. A revoked token
+also takes the counts its server sent. A file that does not load (a misspelled `access`, two tokens
+with one name) leaves the tokens as they were, and the log says why.
+
+## The config file
+
+`/config/directory.toml` in the container (`DIRECTORY_CONFIG`, or `--config`), on Tower
+`/mnt/fast/appdata/ipx-directory/directory.toml`:
+
+```toml
+bind = "0.0.0.0:8100"
+# Prometheus metrics, on a port of their own and not the one the tunnel publishes. Empty, or
+# left out, serves none.
+metrics_bind = "0.0.0.0:9188"
+# The environment variable holding the database URL: postgres://... or sqlite://...
+database_url_env = "DIRECTORY_DATABASE_URL"
+
+[[tokens]]
+name = "tower"
+access = "rwa"
+token_sha256 = "…"
+```
+
+`DIRECTORY_LOG_FORMAT=json` logs one JSON object a line, for Loki, as ipx's `IPX_LOG_FORMAT` does.
+Each request is a line with its `method`, `path`, `status`, `duration_ms` and the `token`'s name.
+
+With `OTEL_EXPORTER_OTLP_ENDPOINT` set (`http://host:4318`, OTLP over HTTP), it sends traces: a
+span a request, a child of the caller's when the request carries a `traceparent`, as ipx's do, and
+a trace a refresher round with a span a feed (#213). `OTEL_RESOURCE_ATTRIBUTES` tags them, as
+production does with `deployment.environment.name=production`. Its version is in
+`crates/directory/Cargo.toml`, logged at start and answered by `ipx-directory --version`; its
+changelog is `crates/directory/CHANGELOG.md`.
+
+## Running one
+
+```yaml
+services:
+  ipx-directory:
+    image: ipx-directory          # docker build -f Dockerfile.directory -t ipx-directory .
+    restart: unless-stopped
+    environment:
+      DIRECTORY_DATABASE_URL: "postgres://ipx_directory:password@db-host:5432/ipx_directory"
+    ports:
+      - "8100:8100"
+    volumes:
+      - ./directory:/config:ro    # directory.toml
+```
+
+## What it will not hold
+
+A private feed is never meant to reach it. ipx leaves out a feed marked private, one with a
+username or password, and one whose address `ipx_feed::url_looks_private` catches: a paid-feed
+host, or a key in the query. The directory checks every address it is sent with the same function
+and refuses what it catches, so one server's miss does not publish someone's paid feed to every
+other. What both miss, an `rwa` token can remove: `DELETE /v1/feeds/{id}` removes the feed and
+blocks it, so no snapshot brings it back.
+
+## API
+
+| Route | Access | |
+|---|---|---|
+| `GET /healthz` | none | `ok` when it can read its database |
+| `GET /v1/me` | ro | the token's `name` and `access` |
+| `GET /v1/feeds` | ro | every feed A to Z: `id`, `url`, `title`, `image`, `category`, `subcategory`, `podcast`, `subscribers` |
+| `GET /v1/popular?limit=10` | ro | the most subscribed, at most 100 |
+| `GET /v1/feeds/{id}` | ro | one feed, with `description`, `failing` (why its last check failed, in words) and its latest twenty `items` (`guid`, `title`, `link`, `published`, `duration`, `description`), never their files |
+| `POST /v1/snapshot` | rw | `[{"url", "subscribers"}]`, at most 20,000: replaces everything this token sent before; answers what it `accepted` and how many it refused as private, blocked or invalid |
+| `DELETE /v1/feeds/{id}` | rwa | remove and block |
+| `GET /v1/blocked`, `DELETE /v1/blocked/{id}` | rwa | what is blocked; unblock |
+| `GET /v1/instances` | rwa | each token holding a snapshot: its `name`, `feeds` and `subscribers` |
+| `DELETE /v1/instances/{name}` | rwa | drop one token's snapshot, its counts with it |
+| `POST /v1/feeds/{id}/refresh` | rwa | fetch the feed now, answering with its page |
+
+A feed's `id` is the first 64 bits of the SHA-256 of its address, normalised (scheme and host in
+lower case, no default port or fragment), so every server arrives at the same id. `subscribers`
+is the sum over every token's latest snapshot. A feed is listed once the directory has read it as
+a feed, so an OPML or an address that never worked is not, and goes when no snapshot has it any more. Descriptions
+are the feed's own HTML, unsanitized: whoever shows them sanitizes them, as ipx does.

docs/sso.md

@@ -18,7 +18,7 @@ real setup and pointed at the wrong address.
 ```
 browser ─► Cloudflare Access, app "ipodderx" ─── sign in ───► Authentik (OpenID Connect)
         ─► tunnel "rays-unraid" (the cloudflared container on Tower)
-        ─► http://192.168.1.130:8099 ─► ipx
+        ─► http://192.168.1.130:8099, ipx-web (Caddy) ─► ipx
 ```
 
 Authentik is not in the request path. It is the identity provider Cloudflare Access asks. Access
@@ -38,7 +38,7 @@ request it forwards through the tunnel, and ipx signs that person in.
 enabled = true
 bind = "0.0.0.0:8099"
 trusted_header = "Cf-Access-Authenticated-User-Email"
-trusted_proxies = ["127.0.0.1", "::1", "192.168.16.1"]
+trusted_proxies = ["127.0.0.1", "::1", "192.168.64.10"]   # ipx-web; see "Behind ipx-web"
 access_team = "rays-sdf1.cloudflareaccess.com"
 access_aud = "8bfe73dfbc8c548d1cb5dc11c6db6887bcaf4f5144840396f83a620a140e1c4f"
 auto_create_users = true
@@ -50,7 +50,7 @@ The last two turn on the token check described under [Verifying Cloudflare's tok
 on since 2026-09-19. Both can be read without the dashboard: a request to the site while signed
 out is sent to `https://<team domain>/cdn-cgi/access/login/ipodderx.sdf1.net?kid=<AUD tag>&...`.
 
-Restart ipx after editing it: `docker compose -f /mnt/fast/arcane/projects/content/compose.yaml
+Restart ipx after editing it: `docker compose -f /mnt/fast/arcane/projects/ipx/compose.yaml
 restart ipx`.
 
 ### What was missing
@@ -65,22 +65,34 @@ Cloudflare and Authentik were already right. Three things on the ipx side were n
    `rays@sdf1.net`. With `auto_create_users` on, the first visit would have made a second, empty
    account. `ipx user rename rays rays@sdf1.net` fixed that without losing anything.
 
-### The address to trust, and why it is 192.168.16.1
+### The address to trust, and why it is 192.168.64.1
 
-`cloudflared` runs in its own container and reaches ipx through the host's published port. Docker
+`cloudflared` runs in its own container and reaches ipx-web (before #203, ipx) through the host's published port. Docker
 (iptables firewall backend) masquerades traffic between its bridge networks, so the tunnel's
-requests arrive from the **gateway of ipx's own network**, `content_default`:
+requests arrive from the **gateway of ipx's own network**, `ipx_default`:
 
 ```sh
-docker network inspect content_default -f '{{range .IPAM.Config}}{{.Gateway}}{{end}}'
+docker network inspect ipx_default -f '{{range .IPAM.Config}}{{.Gateway}}{{end}}'
 ```
 
 That was measured, not assumed. ipx does not log where a request came from, so the addresses were
 read from the kernel's connection table inside the container while the site was open. (`/proc/net/tcp`
 lists them in hex.)
 
-If the `content` project's network is ever recreated, its gateway can change. Check it again, and
+The `ipx` project's compose file pins that network's subnet to `192.168.64.0/20`, so its gateway
-update `trusted_proxies` to match.
+stays `192.168.64.1` when the network is recreated. It was `192.168.16.1`, `content_default`'s, while
+ipx was part of the `content` project. If the subnet is ever changed, update `TUNNEL_PEER` in the
+compose file to match (before #203, `trusted_proxies`).
+
+### Behind ipx-web (#203)
+
+With the page served by `ipx-web` (Caddy), cloudflared reaches Caddy instead, still through the
+host's port 8099, so its requests still arrive from `192.168.64.1`, at Caddy now. Caddy passes the
+`Cf-Access-*` headers on only from that address (`TUNNEL_PEER`) and strips them from everyone else,
+the boundary `trusted_proxies` drew before. ipx then sees every request come from Caddy, so
+`trusted_proxies` names Caddy's address on `ipx_default`, pinned in the compose file
+(`192.168.64.10`), instead of the gateway. The token check is unchanged: a header Caddy passes on
+still needs a valid `Cf-Access-Jwt-Assertion`.
 
 ### Names
 
@@ -173,10 +185,12 @@ itself, with a **Proxy Provider** and an **outpost** that adds `X-authentik-user
 
 ## How this is secured
 
-**The header is only believed from `trusted_proxies`.** Every other source is ignored, and the
+**The header is only passed on from `TUNNEL_PEER`, and only believed from `trusted_proxies`.**
-request falls through to a session cookie or the shared token. That is the whole security boundary.
+Caddy strips `Cf-Access-*` from every request that does not come from `TUNNEL_PEER`, and ipx
+ignores the header from anyone but Caddy, its one trusted proxy; such a request falls through to a
+session cookie or the shared token. That is the whole security boundary.
 
-With the tunnel reaching ipx through the host's port, `192.168.16.1` means **any container on Tower
+With the tunnel reaching ipx-web through the host's port, `192.168.64.1` means **any container on Tower
 that connects to `192.168.1.130:8099`**, not only `cloudflared`. Machines on the LAN, and Tower
 itself, arrive under their own addresses and cannot set the header; the checks above show both
 sides. Never list a LAN address or range: anyone there could then send

docs/users.md

@@ -70,8 +70,10 @@ list with their own read state. Unsubscribing removes it from their list alone;
 subscriber leaves does the feed stop being scanned, and even then its files and history stay, so
 re-subscribing does not pull the back catalogue again.
 
-**Directory** sits at the top of the feed list, above your own feeds. It opens on the ten feeds
+**Directory** sits at the top of the feed list, above your own feeds. It shows the directory
-with the most subscribers on this server, you included, ranked, then the categories, each a tile
+service an admin has set up ([directory.md](directory.md)), which iPX servers share, and says so
+when there is none. It opens on the ten feeds with the most subscribers on every server sharing
+with it, you included, ranked, then the categories, each a tile
 showing a few of its shows' covers. A category has a page of its own: its most subscribed feeds,
 then all of them as a grid of cover art, with its subcategories along the top (Tech News under
 News, Video Games under Leisure) and a choice of order. See all lists every feed, and the search
@@ -81,7 +83,7 @@ Blogs (the rest). A show's category is the one it gives itself in iTunes, or for
 none, one an admin or iPX picked for it. Your own feeds are marked Subscribed.
 It shows a title, artwork and a count, never a URL or who reads it. An OPML subscription is listed
 as the feeds inside it, one by one, and never the OPML itself, so you can take just the shows you
-want. Anything that looks private is left out: a login configured for the feed, credentials in its URL,
+want. Anything private is left out: a feed someone marked Private in its settings, a login configured for the feed, credentials in its URL,
 or a key such as `auth=` or `token=` in the query, or a feed from a paid-feed service such as
 Patreon or Supercast, which put the key in the path, and any feed inside an OPML that looks private
 itself. Those are someone's paid subscriptions, and listing them would let anyone here read what
@@ -99,7 +101,7 @@ removed there, so there is always someone who can manage the rest.
 ## Admin
 
 The first account is an admin. An admin can change global settings (scanning interval, quota,
-retention, media types, download folder), a feed's URL, folder and schedule, and who has an account
+retention, media types, download folder, the directory), a feed's URL, folder and schedule, and who has an account
 and who else is an admin, and read the log, which names everyone's feeds and sign-ins. Everyone else
 gets the Settings and Log buttons hidden and a `403` if they ask anyway.
 

grafana/dashboard.py

@@ -1,16 +1,21 @@
-"""The iPX dashboard in Grafana, from Loki (the container's log, shipped by Alloy) and Tempo.
+"""The iPX dashboard in Grafana: the three containers of the Arcane project ipx (ipx, ipx-web,
+ipx-directory) and Tower under them, from Prometheus, Loki (their logs, shipped by Alloy) and Tempo.
 
     python3 grafana/dashboard.py > /mnt/fast/arcane/projects/monitoring/grafana-provisioning/dashboards/ipx.json
 
-Grafana reads that file on its own within a minute; edits made in Grafana are refused. The panels
+Grafana reads that file on its own within a minute; edits made in Grafana are refused. Rows go
-read the fields of ipx's JSON log (IPX_LOG_FORMAT=json): renaming a field in web.rs access_log or
+top-down as a request does: an overview, Tower, then each container (ipx-web, ipx's API, its
-ipc.rs log_event has to be matched here. `dashboard.py queries` prints each
+worker and its process, the directory), then traces and logs. Prometheus scrapes ipx's /metrics
-query, to try against Loki.
+(job ipx, #194) and Tower's node exporter (job node); nothing scrapes the containers themselves,
+so ipx-web and the directory are read from their logs. The log panels read fields: ipx's
+(web.rs access_log, ipc.rs log_event), the directory's and Caddy's; renaming one has to be
+matched here. `dashboard.py queries` prints each Loki query, to try against Loki.
 """
 import json, sys
 
 LOKI = {"type": "loki", "uid": "${loki}"}
 TEMPO = {"type": "tempo", "uid": "${tempo}"}
+PROM = {"type": "prometheus", "uid": "${prometheus}"}
 SEL = '{container="iPX"}'
 # ipx logs one JSON object a line (IPX_LOG_FORMAT=json). Each scan and download event carries its
 # fields (ev, feed, new, bytes, msg, error.type, ...); each request its method, path, route, status
@@ -20,11 +25,22 @@ EV = SEL + ' |= "\\"ev\\":\\"" | json | __error__="" | ev != ""'
 HTTP = SEL + ' |= "\\"target\\":\\"ipx::http\\"" | json | __error__="" | path != "/api/events"'
 BAD = SEL + ' | json | __error__="" | level =~ "WARN|ERROR"'
 TEXT = ' | line_format "{{.level}} {{.target}}: {{.message}}"'
-TRACES = '{resource.service.name="ipx" && resource.deployment.environment.name="production"'
+# Every production span: ipx-web's, ipx's and the directory's, one trace from the page to the
-
+# directory where a request goes that far (#213). A daemon run by hand has no such tag.
-
+TRACES = '{resource.deployment.environment.name="production"'
-def status(field):
+# The directory's JSON log (#204): a line a request (method, path, status, duration_ms, token), a
-    return f'max(max_over_time({EV} | ev = "status" | unwrap {field} [10m]))'
+# line a snapshot (instance, accepted, refused_*), a line a refresher round (checked) and one a
+# failed feed check (feed, error).
+DIR = '{container="ipx-directory"} | json | __error__=""'
+DIR_HTTP = '{container="ipx-directory"} |= "ipx_directory::http" | json | __error__=""'
+# ipx-web's Caddy access log (#203, #210): request.uri, status, duration in seconds. The page and
+# its files only: /api and /media are ipx's, and in its own log already.
+WEB = ('{container="ipx-web"} |= "http.log.access" | json | __error__=""'
+       ' | request_uri !~ "/(api|media)/.*" | request_remote_ip != "127.0.0.1"')  # not its healthcheck
+# Less what Caddy says at every start, by design: no admin endpoint, and no HTTPS or HTTP/3
+# behind the tunnel; and its goodbye on a restart.
+OTHERS_BAD = ('{container=~"ipx-web|ipx-directory"} | json | __error__="" | level =~ "(?i)warn|error"'
+              ' | msg !~ "admin endpoint disabled|automatic HTTPS is completely disabled|HTTP/[23] skipped.*|exiting; byeee.*"')
 
 
 QUERIES = {}
@@ -50,6 +66,14 @@ def loki(expr, ref="A", legend=None, instant=False, kind=None):
     return t
 
 
+def prom(expr, ref="A", legend=None):
+    # ipx's /metrics (#194), scraped by Prometheus as job ipx.
+    t = {"refId": ref, "datasource": PROM, "expr": expr}
+    if legend:
+        t["legendFormat"] = legend
+    return t
+
+
 def row(title):
     global y, pid
     pid += 1
@@ -58,9 +82,10 @@ def row(title):
     y += 1
 
 
-def stat(title, expr, x, unit="short", color="blue", thresholds=None, desc=None):
+def stat(title, target, x, unit="short", color="blue", thresholds=None, desc=None):
+    """target: loki(..., instant=True) or prom(...)."""
     steps = thresholds or [{"color": color, "value": None}]
-    return panel("stat", title, 4, 4, x, [loki(expr, instant=True)], description=desc or "",
+    return panel("stat", title, 4, 4, x, [target], description=desc or "",
                  fieldConfig={"defaults": {"unit": unit, "color": {"mode": "thresholds"},
                                            "thresholds": {"mode": "absolute", "steps": steps}}, "overrides": []},
                  options={"reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": False},
@@ -87,41 +112,78 @@ def table(title, targets, x, w=12, h=8, rename=None, sort=None, desc=""):
                  fieldConfig={"defaults": {}, "overrides": []})
 
 
-# ---- Now
+GOOD_BAD = [{"color": "green", "value": None}, {"color": "orange", "value": 1}]
-row("Now")
+# Caddy's line for each request, what kind it is by its address.
-stat("Feeds", status("feeds"), 0, desc="From the healthcheck's status answer, every 30 seconds.")
+WEB_ALL = ('{container="ipx-web"} |= "http.log.access" | json | __error__="" | request_remote_ip != "127.0.0.1"'
-stat("Waiting to download", status("pending"), 4)
+           ' | label_format kind=`{{ if hasPrefix "/api/" .request_uri }}API{{ else if hasPrefix "/media/" .request_uri }}'
-stat("Downloaded", status("downloaded"), 8, color="green")
+           'media{{ else }}page and files{{ end }}`')
-stat("Feed failures", f'sum(count_over_time({EV} | ev="feed_error" [$__range])) or vector(0)', 12,
+LOG_OPTS = {"showTime": True, "wrapLogMessage": True, "sortOrder": "Descending", "enableLogDetails": True}
-     thresholds=[{"color": "green", "value": None}, {"color": "orange", "value": 1}],
+
-     desc="Failed feed checks in the time range.")
+
-stat("Download failures", f'sum(count_over_time({EV} | ev="download_error" [$__range])) or vector(0)', 16,
+def bar_overrides(*names):
-     thresholds=[{"color": "green", "value": None}, {"color": "orange", "value": 1}])
+    return [{"matcher": {"id": "byName", "options": n},
-stat("Warnings and errors", f'sum(count_over_time({BAD} [$__range])) or vector(0)', 20,
+             "properties": [{"id": "unit", "value": "short"}, {"id": "custom.axisPlacement", "value": "right"},
-     thresholds=[{"color": "green", "value": None}, {"color": "orange", "value": 1}, {"color": "red", "value": 50}])
+                            {"id": "custom.drawStyle", "value": "bars"}, {"id": "custom.fillOpacity", "value": 60}]}
+            for n in names]
+
+
+# ---- Overview: is each part up, and is anything wrong
+row("Overview")
+stat("ipx", prom('max(up{job="ipx"})'), 0, thresholds=[{"color": "red", "value": None}, {"color": "green", "value": 1}],
+     desc="Prometheus reaching ipx's /metrics: 1 is up. Its healthcheck asks the daemon and the database too.")["fieldConfig"]["defaults"]["mappings"] = [
+    {"type": "value", "options": {"0": {"text": "down"}, "1": {"text": "up"}}}]
+stat("Feeds", prom('max(ipx_feeds{job="ipx"})'), 4)
+stat("Waiting to download", prom('max(ipx_downloads_pending{job="ipx"})'), 8)
+stat("Since the last scan", prom('max(ipx_last_scan_age_seconds{job="ipx"})'), 12, unit="s",
+     thresholds=[{"color": "green", "value": None}, {"color": "orange", "value": 600}, {"color": "red", "value": 1800}],
+     desc="Over ten minutes means the worker may be stuck; the healthcheck still passes.")
+stat("Page and API errors", loki(f'sum(count_over_time({WEB_ALL} | status >= 500 [$__range])) or vector(0)', instant=True), 16,
+     thresholds=GOOD_BAD, desc="Answers of 500 and up from ipx-web, for the page or passed on from ipx: 502 is ipx not answering.")
+stat("Warnings and errors", loki(f'sum(count_over_time({BAD} [$__range])) + sum(count_over_time({OTHERS_BAD} [$__range])) or vector(0)', instant=True), 20,
+     thresholds=[{"color": "green", "value": None}, {"color": "orange", "value": 1}, {"color": "red", "value": 50}],
+     desc="All three containers, in the time range.")
+y += 4
+stat("Feed failures", loki(f'sum(count_over_time({EV} | ev="feed_error" [$__range])) or vector(0)', instant=True), 0,
+     thresholds=GOOD_BAD, desc="Failed feed checks in the time range.")
+stat("Download failures", loki(f'sum(count_over_time({EV} | ev="download_error" [$__range])) or vector(0)', instant=True), 4,
+     thresholds=GOOD_BAD)
+stat("Downloaded", prom('max(ipx_files_downloaded{job="ipx"})'), 8, color="green")
+stat("ipx running for", prom('max(ipx_uptime_seconds{job="ipx"})'), 12, unit="s")
+stat("Directory: feeds shared", loki('sum(max by (instance) (max_over_time(' + DIR + ' | message="snapshot" | unwrap accepted [6h])))', instant=True), 16,
+     desc="The feeds each server's latest snapshot gave, added up.")
+stat("Directory: refused as private", loki(f'sum(sum_over_time({DIR} | message="snapshot" | unwrap refused_private [$__range])) or vector(0)', instant=True), 20,
+     thresholds=[{"color": "green", "value": None}, {"color": "red", "value": 1}],
+     desc="Feeds a server sent that the directory caught as private. Not 0 means a server's own check missed one.")
 y += 4
 
-# ---- Scans
+# ---- Tower: the host all three run on, from the node exporter
-row("Scans and downloads")
+row("Tower")
-ts("New items found", [loki(f'sum(sum_over_time({EV} | ev="feed_done" | unwrap new [$__interval]))', legend="new items")],
+ts("Load", [prom('node_load1{job="node"}', legend="1 minute"), prom('node_load15{job="node"}', ref="B", legend="15 minutes")],
-   0, bars=True)
+   0, w=8, desc="Twelve threads. Load far above that with little CPU used is processes waiting on a disk or the user shares (shfs).")
-ts("Downloads", [loki(f'sum(count_over_time({EV} | ev="download_done" [$__interval]))', legend="saved"),
+ts("CPU", [prom('sum by (mode) (rate(node_cpu_seconds_total{job="node", mode=~"user|system|iowait"}[$__rate_interval]))', legend="{{mode}}")],
-                 loki(f'sum(count_over_time({EV} | ev="download_error" [$__interval]))', ref="B", legend="failed")],
+   8, w=8, stack=True, desc="Cores busy, by kind. Much system time with little user time is the kernel, often FUSE (shfs).")
-   12, bars=True)
+ts("Memory available", [prom('node_memory_MemAvailable_bytes{job="node"}', legend="available")], 16, w=8, unit="bytes")
 y += 8
-ts("Bytes downloaded", [loki(f'sum(sum_over_time({EV} | ev="download_done" | unwrap bytes [$__interval]))', legend="bytes")],
+ts("Disk busy", [prom('rate(node_disk_io_time_seconds_total{job="node", device=~"nvme.*|md.*"}[$__rate_interval])', legend="{{device}}")],
-   0, unit="bytes", bars=True)
+   0, w=12, unit="percentunit", desc="nvme1n1 is /mnt/fast (appdata, Postgres's data); md* are the array's disks behind /mnt/user (downloads).")
-ts("Feeds checked per scan", [loki(f'sum(sum_over_time({EV} | ev="scan_done" | unwrap feeds [$__interval]))', legend="feeds checked")],
+ts("Network", [prom('sum(rate(node_network_receive_bytes_total{job="node", device!~"lo|veth.*|docker.*|br-.*"}[$__rate_interval]))', legend="in"),
-   12, bars=True, desc="Feeds that were due and fetched; the rest were skipped as not due.")
+               prom('sum(rate(node_network_transmit_bytes_total{job="node", device!~"lo|veth.*|docker.*|br-.*"}[$__rate_interval]))', ref="B", legend="out")],
-y += 8
+   12, w=12, unit="Bps")
-table("Failing feeds", [loki(f'sum by (feed, msg) (count_over_time({EV} | ev="feed_error" [$__range]))', instant=True)],
-      0, rename={"feed": "Feed", "msg": "Error", "Value": "Failures"}, sort=[{"displayName": "Failures", "desc": True}])
-table("Failed downloads", [loki(f'sum by (feed, msg) (count_over_time({EV} | ev="download_error" [$__range]))', instant=True)],
-      12, rename={"feed": "Feed", "msg": "Error", "Value": "Failures"}, sort=[{"displayName": "Failures", "desc": True}])
 y += 8
 
-# ---- Web
+# ---- ipx-web: Caddy, the way in. Serves the page itself, passes /api and /media to ipx
-row("Web")
+row("ipx-web")
+ts("Requests by kind", [loki(f'sum by (kind) (count_over_time({WEB_ALL} [$__interval]))', legend="{{kind}}")],
+   0, w=8, bars=True, stack=True, desc="Everything through Caddy, from the LAN and the tunnel. The API and media go on to ipx.")
+ts("Page and files by status", [loki(f'sum by (status) (count_over_time({WEB} [$__interval]))', legend="{{status}}")],
+   8, w=8, bars=True, stack=True, desc="What Caddy served itself. A page answered 401 or 403 is ipx refusing it in /api/page-check.")
+ts("Page response time", [loki(f'quantile_over_time(0.95, {WEB} | unwrap duration [$__interval]) by ()', legend="95th percentile"),
+                          loki(f'max_over_time({WEB} | unwrap duration [$__interval]) by ()', ref="B", legend="slowest")],
+   16, w=8, unit="s", desc="A page waits on ipx's /api/page-check before it is sent.")
+y += 8
+
+# ---- ipx: the API it answers behind ipx-web
+row("ipx: API")
 ts("Requests by status", [loki(f'sum by (status) (count_over_time({HTTP} [$__interval]))', legend="{{status}}")],
    0, bars=True, stack=True, desc="The event stream the page keeps open is left out.")
 ts("Response time", [loki(f'quantile_over_time(0.5, {HTTP} | unwrap duration_ms [$__interval]) by ()', legend="median"),
@@ -130,31 +192,139 @@ ts("Response time", [loki(f'quantile_over_time(0.5, {HTTP} | unwrap duration_ms
    12, unit="ms")
 y += 8
 table("Slowest routes", [loki(f'topk(15, avg_over_time({HTTP} | route != "" | unwrap duration_ms [$__range]) by (method, route))', instant=True)],
-      0, rename={"method": "Method", "route": "Route", "Value": "Average ms"}, sort=[{"displayName": "Average ms", "desc": True}])
+      0, w=8, rename={"method": "Method", "route": "Route", "Value": "Average ms"}, sort=[{"displayName": "Average ms", "desc": True}])
 table("Busiest routes", [loki(f'topk(15, sum by (method, route) (count_over_time({HTTP} | route != "" [$__range])))', instant=True)],
-      12, rename={"method": "Method", "route": "Route", "Value": "Requests"}, sort=[{"displayName": "Requests", "desc": True}])
+      8, w=8, rename={"method": "Method", "route": "Route", "Value": "Requests"}, sort=[{"displayName": "Requests", "desc": True}])
+ts("Open connections", [prom('max(ipx_http_requests_in_flight{job="ipx"})', legend="requests in flight"),
+                        prom('max(ipx_event_listeners{job="ipx"})', ref="B", legend="live-update listeners"),
+                        prom('max(ipx_event_queue{job="ipx"})', ref="C", legend="live updates unread"),
+                        prom('sum(increase(ipx_events_missed_total{job="ipx"}[$__rate_interval]))', ref="D", legend="live updates missed")],
+   16, w=8, desc="Each open page holds one live-update listener. Missed updates mean a page fell behind and reloads its lists.")
 y += 8
 
-# ---- Traces
+# ---- ipx: the worker, one job at a time: scans, downloads, DeadAir
+row("ipx: worker")
+ts("Worker", [prom('max by (kind) (ipx_worker_job_seconds{job="ipx"})', legend="on a {{kind}} for"),
+              prom('max(ipx_last_scan_age_seconds{job="ipx"})', ref="B", legend="since the last scan finished")],
+   0, w=8, unit="s", desc="A job's time that only climbs, or no scan for over 10 minutes, means the worker is stuck; the healthcheck still passes.")
+ts("Jobs done", [prom('sum by (kind) (increase(ipx_jobs_total{job="ipx"}[$__rate_interval]))', legend="{{kind}}")],
+   8, w=8, bars=True, stack=True)
+ts("Time on jobs", [prom('sum by (kind) (increase(ipx_job_seconds_total{job="ipx"}[$__rate_interval]))', legend="{{kind}}")],
+   16, w=8, unit="s", bars=True, stack=True, desc="Seconds the worker spent on each kind of job in each interval.")
+y += 8
+ts("Waiting", [prom('ipx_worker_queue{job="ipx"}', legend="commands for the worker"),
+               prom('ipx_downloads_pending{job="ipx"}', ref="B", legend="downloads"),
+               prom('max(ipx_feed_retries{job="ipx"})', ref="C", legend="feeds to retry a lookup"),
+               prom('max(ipx_deadair_backlog{job="ipx"})', ref="D", legend="files for DeadAir")],
+   0, w=8, desc="A queue that only grows means the worker is stuck or behind.")
+ts("Feeds checked and new items", [loki(f'sum(sum_over_time({EV} | ev="scan_done" | unwrap feeds [$__interval]))', legend="feeds checked"),
+                                   loki(f'sum(sum_over_time({EV} | ev="feed_done" | unwrap new [$__interval]))', ref="B", legend="new items")],
+   8, w=8, bars=True, desc="Feeds that were due and fetched; the rest were skipped as not due.")
+ts("Downloads", [loki(f'sum(count_over_time({EV} | ev="download_done" [$__interval]))', legend="saved"),
+                 loki(f'sum(count_over_time({EV} | ev="download_error" [$__interval]))', ref="B", legend="failed"),
+                 prom('max(ipx_downloads_active{job="ipx"})', ref="C", legend="at once"),
+                 prom('2 - max(ipx_torrent_slots_free{job="ipx"})', ref="D", legend="torrents")],
+   16, w=8, bars=True)
+y += 8
+ts("Download speed", [prom('sum(rate(ipx_download_bytes_total{job="ipx"}[$__rate_interval]))', legend="downloading")],
+   0, w=8, unit="Bps")
+ts("Feeds fetching at once", [prom('max(ipx_scan_feeds_fetching{job="ipx"})', legend="fetching")], 8, w=8)
+ts("DeadAir on a file", [prom('max(ipx_deadair_busy_seconds{job="ipx"})', legend="for"),
+                         prom('max(ipx_deadair_playing{job="ipx"})', ref="B", legend="playing through DeadAir")],
+   16, w=8, unit="s", desc="How long DeadAir has been on the file it is analysing; a few seconds each.")["fieldConfig"]["overrides"] = [
+    {"matcher": {"id": "byName", "options": "playing through DeadAir"},
+     "properties": [{"id": "unit", "value": "short"}, {"id": "custom.axisPlacement", "value": "right"}]}]
+y += 8
+table("Failing feeds", [loki(f'sum by (feed, msg) (count_over_time({EV} | ev="feed_error" [$__range]))', instant=True)],
+      0, rename={"feed": "Feed", "msg": "Error", "Value": "Failures"}, sort=[{"displayName": "Failures", "desc": True}])
+table("Failed downloads", [loki(f'sum by (feed, msg) (count_over_time({EV} | ev="download_error" [$__range]))', instant=True)],
+      12, rename={"feed": "Feed", "msg": "Error", "Value": "Failures"}, sort=[{"displayName": "Failures", "desc": True}])
+y += 8
+
+# ---- ipx: the process, what it holds between requests and jobs (#194)
+row("ipx: process")
+# Open connections stay open, idle, for ten minutes after a burst, so open at the max is not
+# pressure; drawn as a line of its own it read as the pool maxing out (#199).
+ts("Database connections", [prom('max(max_over_time(ipx_db_connections{job="ipx", state="in_use"}[$__interval]))', legend="in use"),
+                            prom('sum(ipx_db_connections{job="ipx"})', ref="B", legend="open"),
+                            prom('max(ipx_db_connections_max{job="ipx"})', ref="C", legend="most the pool opens")],
+   0, w=8, desc="In use reaching the most the pool opens means requests and scans are waiting for a connection. "
+                "Open connections stay open, idle, for ten minutes after a burst.")["fieldConfig"]["overrides"] = [
+    {"matcher": {"id": "byName", "options": "open"},
+     "properties": [{"id": "custom.lineStyle", "value": {"fill": "dash", "dash": [4, 4]}},
+                    {"id": "custom.fillOpacity", "value": 0}, {"id": "color", "value": {"mode": "fixed", "fixedColor": "#8e8e8e"}}]}]
+ts("Memory", [prom('ipx_process_resident_bytes{job="ipx"}', legend="resident")], 8, w=8, unit="bytes")
+ts("Open files and sockets", [prom('ipx_process_open_fds{job="ipx"}', legend="open")], 16, w=8)
+y += 8
+ts("Runtime", [prom('ipx_runtime_tasks{job="ipx"}', legend="tasks"),
+               prom('ipx_runtime_queue{job="ipx"}', ref="B", legend="tasks waiting for a thread"),
+               prom('ipx_runtime_workers{job="ipx"}', ref="C", legend="threads")],
+   0, w=12, desc="Tasks waiting for a thread for long means something is blocking the runtime.")
+ts("Artwork", [prom('max(ipx_art_cache_bytes{job="ipx"}) / max(ipx_art_cache_limit_bytes{job="ipx"})', legend="full"),
+               prom('sum(increase(ipx_art_requests_total{job="ipx", result="hit"}[$__rate_interval])) / '
+                    'sum(increase(ipx_art_requests_total{job="ipx"}[$__rate_interval]))', ref="B", legend="hit rate"),
+               prom('sum(increase(ipx_art_evicted_total{job="ipx"}[$__rate_interval]))', ref="C", legend="images evicted")],
+   12, w=12, unit="percentunit",
+   desc="Full sits near 100% once the cache has filled, since each sweep trims it to fit. Hit rate is the share served from disk: "
+        "the rest was fetched from the publisher. Evicted, on the right, is images each sweep threw out to stay under the "
+        "limit: many at every sweep, with a falling hit rate, means the limit is too small.")["fieldConfig"]["overrides"] = bar_overrides("images evicted")
+y += 8
+
+# ---- ipx-directory: public at directory.ipxreader.app, shared by ipx servers (#204)
+row("ipx-directory")
+stat("Snapshots", loki(f'sum(count_over_time({DIR} | message="snapshot" [$__range])) or vector(0)', instant=True), 0,
+     desc="ipx sends one when what it shares changes, and every half hour (#211).")
+stat("Feed checks", loki(f'sum(sum_over_time({DIR} | message="feeds checked" | unwrap checked [$__range])) or vector(0)', instant=True), 4,
+     desc="Each feed every six hours, 25 at a time.")
+stat("Failed feed checks", loki(f'sum(count_over_time({DIR} | message="feed check failed" [$__range])) or vector(0)', instant=True), 8,
+     thresholds=GOOD_BAD, desc="Mostly the publishers': a feed gone or moved.")
+stat("Requests", loki(f'sum(count_over_time({DIR_HTTP} [$__range])) or vector(0)', instant=True), 12)
+stat("Requests refused", loki(f'sum(count_over_time({DIR_HTTP} | status =~ "401|403" [$__range])) or vector(0)', instant=True), 16,
+     thresholds=[{"color": "green", "value": None}, {"color": "orange", "value": 100}],
+     desc="Without a token, or with one that has not the access asked for. Now and then is someone trying a public address.")
+stat("Slowest request", loki(f'max(max_over_time({DIR_HTTP} | unwrap duration_ms [$__range])) or vector(0)', instant=True), 20, unit="ms")
+y += 4
+ts("Requests by token", [loki(f'sum by (status, token) (count_over_time({DIR_HTTP} [$__interval]))', legend="{{status}} {{token}}")],
+   0, bars=True, stack=True)
+ts("Feed checks over time", [loki(f'sum(sum_over_time({DIR} | message="feeds checked" | unwrap checked [$__interval]))', legend="checked"),
+                             loki(f'sum(count_over_time({DIR} | message="feed check failed" [$__interval]))', ref="B", legend="failed")],
+   12, bars=True, desc="A burst follows a snapshot with new feeds.")
+y += 8
+table("Failing feeds in the directory", [loki(f'sum by (feed, error) (count_over_time({DIR} | message="feed check failed" [$__range]))', instant=True)],
+      0, rename={"feed": "Feed id", "error": "Error", "Value": "Failures"}, sort=[{"displayName": "Failures", "desc": True}])
+table("Snapshots by server", [loki(f'sum by (instance) (count_over_time({DIR} | message="snapshot" [$__range]))', instant=True)],
+      12, rename={"instance": "Token", "Value": "Snapshots"}, sort=[{"displayName": "Snapshots", "desc": True}])
+y += 8
+# The directory's own /metrics, on a port apart from the tunnel's (#224).
+ts("Directory memory", [prom('directory_process_resident_bytes{job="ipx-directory"}', legend="resident")], 0, unit="bytes",
+   desc="mimalloc gives back what is freed, so this follows what is in use: a rise that never comes down is a leak.")
+ts("Feed bytes fetched", [prom('rate(ipx_feed_bytes_total{job="ipx"}[$__rate_interval])', legend="ipx"),
+                          prom('rate(directory_feed_bytes_total{job="ipx-directory"}[$__rate_interval])', ref="B", legend="directory")],
+   12, unit="Bps", desc="Feeds are read whole, so this is what scans and checks allocate; set it beside memory.")
+y += 8
+
+# ---- Traces: all three send them to Tempo (#213)
 row("Traces")
-for x, title, q in [(0, "Recent traces", TRACES + "}"),
+for x, title, q in [(0, "Recent", TRACES + "}"),
-                    (12, "Slow traces (over 2s)", TRACES + " && duration > 2s}")]:
+                    (8, "Slow (over 2s)", TRACES + " && duration > 2s}"),
-    panel("table", title, 12, 10, x,
+                    (16, "Failed", TRACES + " && status = error}")]:
+    panel("table", title, 8, 10, x,
           [{"refId": "A", "datasource": TEMPO, "queryType": "traceql", "query": q, "limit": 50,
             "tableType": "traces"}],
           fieldConfig={"defaults": {}, "overrides": []})
 y += 10
 
-# ---- Log
+# ---- Logs
-row("Log")
+row("Logs")
-panel("logs", "Warnings and errors", 24, 10, 0, [loki(BAD + TEXT)],
+panel("logs", "ipx: warnings and errors", 12, 10, 0, [loki(BAD + TEXT)], options=LOG_OPTS)
-      options={"showTime": True, "wrapLogMessage": True, "sortOrder": "Descending", "enableLogDetails": True})
+panel("logs", "ipx-web and ipx-directory: warnings and errors", 12, 10, 12,
+      [loki(OTHERS_BAD + ' | line_format "{{.container}} {{.level}}: {{.message}}{{.msg}}"')], options=LOG_OPTS)
 y += 10
-panel("logs", "Log", 24, 12, 0,
+panel("logs", "ipx log", 24, 12, 0,
       [loki(SEL + ' | json | __error__="" | path != "/api/events" | ev != "feed_skip" | ev != "status"'
             ' | message != "-> {\\"cmd\\":\\"status\\"}"' + TEXT)],
-      description="Without the event stream's requests, not-due skips and healthcheck status calls.",
+      description="Without the event stream's requests, not-due skips and healthcheck status calls.", options=LOG_OPTS)
-      options={"showTime": True, "wrapLogMessage": True, "sortOrder": "Descending", "enableLogDetails": True})
+y += 12
 
 dash = {
     "uid": "ipx", "title": "iPX", "tags": ["ipx"], "timezone": "browser", "schemaVersion": 39,
@@ -162,6 +332,7 @@ dash = {
     "templating": {"list": [
         {"name": "loki", "label": "Logs", "type": "datasource", "query": "loki", "current": {}, "hide": 0},
         {"name": "tempo", "label": "Traces", "type": "datasource", "query": "tempo", "current": {}, "hide": 0},
+        {"name": "prometheus", "label": "Metrics", "type": "datasource", "query": "prometheus", "current": {}, "hide": 0},
     ]},
     "links": [{"title": "iPX", "type": "link", "url": "https://ipodderx.sdf1.net", "targetBlank": True}],
     "panels": panels,

package-lock.json

@@ -7,7 +7,8 @@
       "name": "ipx-web",
       "dependencies": {
         "@swc/core": "^1.16.2",
-        "@swc/html": "^1.16.2"
+        "@swc/html": "^1.16.2",
+        "hls.js": "1.6.19"
       },
       "devDependencies": {
         "@playwright/test": "^1.56.0",
@@ -871,6 +872,12 @@
         "node": ">=16.20.0"
       }
     },
+    "node_modules/hls.js": {
+      "version": "1.6.19",
+      "resolved": "https://registry.npmjs.org/hls.js/-/hls.js-1.6.19.tgz",
+      "integrity": "sha512-A//aZeaAgM5rgUCbTURD4gkfyw5Uag2/4Jky7CfDOukL/DN+P5DjbgK2BYteyP3/KnCkPfkGVkbLxQG2T0AbUQ==",
+      "license": "Apache-2.0"
+    },
     "node_modules/playwright": {
       "version": "1.63.0",
       "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.63.0.tgz",

package.json

@@ -1,5 +1,6 @@
 {
   "name": "ipx-web",
+  "version": "1.0.1",
   "private": true,
   "description": "Builds the ipx web pages from web/src (web/build.mjs, run by build.rs) and tests them. The Rust tests cover the server.",
   "scripts": {
@@ -16,6 +17,7 @@
   },
   "dependencies": {
     "@swc/core": "^1.16.2",
-    "@swc/html": "^1.16.2"
+    "@swc/html": "^1.16.2",
+    "hls.js": "1.6.19"
   }
 }

playwright.config.js

@@ -26,10 +26,29 @@ module.exports = defineConfig({
       reuseExistingServer: false,
       stdout: 'ignore',
     },
+    {
+      // The directory the Directory shows (#205), on SQLite in the scratch directory.
+      command: `cargo build -q -p ipx-directory && exec ./target/debug/ipx-directory --config ${setup.root}/directory.toml`,
+      url: `${setup.DIRECTORY}/healthz`,
+      reuseExistingServer: false,
+      timeout: 180_000,
+      stdout: 'ignore',
+      env: { DIRECTORY_DATABASE_URL: `sqlite://${setup.root}/directory.db?mode=rwc` },
+    },
+    {
+      // The frontend as production serves it (#203): built from web/, served by Caddy on the
+      // suite's port, the API passed to the daemon behind it.
+      command: `node web/build.mjs ${setup.root}/web && exec caddy run --config web/Caddyfile --adapter caddyfile`,
+      url: 'http://127.0.0.1:8791/favicon.png',
+      reuseExistingServer: false,
+      timeout: 60_000,
+      stdout: 'ignore',
+      env: { WEB_BIND: '127.0.0.1:8791', WEB_ROOT: `${setup.root}/web`, IPX_UPSTREAM: '127.0.0.1:8796', HOME: setup.root, XDG_DATA_HOME: setup.root, XDG_CONFIG_HOME: setup.root },
+    },
     {
       // Build first so the tests always run against current source.
       command: 'cargo build -q && exec ./target/debug/ipx daemon',
-      port: 8791,
+      port: 8796,
       reuseExistingServer: false,
       timeout: 180_000,
       stdout: 'pipe',

scripts/release.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+# Publish a Gitea release for one service's tag, with a tarball taken from the image that was
+# deployed, so what is attached is what runs on Tower. Run after the release commit is tagged,
+# pushed and its image built and pushed:  sh scripts/release.sh ipx|directory|web
+set -eu
+cd "$(dirname "$0")/.."
+
+case "${1:-}" in
+ipx)       name=ipx;           ver=$(sed -n 's/^version = "\(.*\)"/\1/p' crates/ipx/Cargo.toml | head -1)
+           tag=v$ver;          log=crates/ipx/CHANGELOG.md;       from=/usr/local/bin/ipx ;;
+directory) name=ipx-directory; ver=$(sed -n 's/^version = "\(.*\)"/\1/p' crates/directory/Cargo.toml | head -1)
+           tag=directory-v$ver; log=crates/directory/CHANGELOG.md; from=/usr/local/bin/ipx-directory ;;
+web)       name=ipx-web;       ver=$(node -p 'require("./package.json").version')
+           tag=web-v$ver;      log=web/CHANGELOG.md;              from=/srv ;;
+*) echo "usage: $0 ipx|directory|web" >&2; exit 2 ;;
+esac
+
+case "$ver" in *-dev) echo "$name is at $ver: release it first" >&2; exit 1 ;; esac
+git fetch -q --tags origin
+git merge-base --is-ancestor "$tag" origin/main || { echo "$tag is not on origin/main" >&2; exit 1; }
+
+out=$(mktemp -d); trap 'rm -rf "$out"' EXIT
+dir=$out/$name-$ver; mkdir "$dir"
+image=192.168.1.130:5000/$name:latest
+c=$(docker create "$image"); trap 'docker rm -f "$c" >/dev/null; rm -rf "$out"' EXIT
+if [ "$name" = ipx-web ]; then
+	docker cp -q "$c:$from/." "$dir/"
+	cp web/Caddyfile "$dir/"
+	# latest may be a later build than the tag: the page carries its version, so check it.
+	grep -qF "$ver" "$dir"/app.js || { echo "$image is not ipx-web $ver" >&2; exit 1; }
+	arch=any
+else
+	docker cp -q "$c:$from" "$dir/"
+	"$dir/$name" --version | grep -qF " $ver" || { echo "$image is not $name $ver" >&2; exit 1; }
+	arch=linux-$(uname -m)
+fi
+cp LICENSE README.md "$dir/"; cp "$log" "$dir/CHANGELOG.md"
+tarball=$out/$name-$ver-$arch.tar.gz
+tar -C "$out" -czf "$tarball" "$name-$ver"
+
+# The notes are this version's section of the changelog, without its heading.
+awk -v h="## [$ver]" 'index($0, h) == 1 {p = 1; next} p && /^## \[/ {exit} p' "$log" > "$out/notes.md"
+[ -s "$out/notes.md" ] || { echo "no [$ver] section in $log" >&2; exit 1; }
+
+timeout 120 /src/tea releases create --login git.sdf1.net --repo rays/ipx --tag "$tag" \
+	--title "$name $ver" --note-file "$out/notes.md" --asset "$tarball" < /dev/null

site/_headers

@@ -0,0 +1,7 @@
+# Cloudflare Web Analytics, which Pages adds to the page, is the one script it runs (#216).
+/*
+  Content-Security-Policy: default-src 'none'; img-src 'self'; style-src 'self'; font-src 'self'; script-src https://static.cloudflareinsights.com; connect-src 'self' https://cloudflareinsights.com; base-uri 'none'; form-action 'none'; frame-ancestors 'none'
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+/fonts/*
+  Cache-Control: public, max-age=31536000, immutable

site/api.mjs

@@ -0,0 +1,655 @@
+// The API reference's content: each service's endpoints, grouped, and the types they take and
+// give, as the handlers in crates/ipx/src/web.rs and crates/directory/src/lib.rs have them. A
+// change to a route or a field there wants its line here; gen.mjs turns this into pages.
+// Types are written as Rust writes them, the way docs.rs shows a signature; a name in TYPES links
+// to its page.
+
+const U = 'http://<your server>:8099';
+const D = 'https://directory.ipxreader.app';
+const ipxCurl = (m, p, body) =>
+  `curl${m === 'GET' ? '' : ` -X ${m}`} -H "Authorization: Bearer ipx_…"${body ? ` \\\n  -H "Content-Type: application/json" -d '${body}'` : ''} \\\n  "${U}${p}"`;
+const dirCurl = (m, p, body) =>
+  `curl${m === 'GET' ? '' : ` -X ${m}`} -H "Authorization: Bearer <token>"${body ? ` \\\n  -H "Content-Type: application/json" -d '${body}'` : ''} \\\n  "${D}${p}"`;
+
+const NOT_SUBSCRIBED = ['404 Not Found', 'You do not subscribe to the feed, or it does not exist. A feed someone else reads is not yours to see.'];
+const NOT_ADMIN = ['403 Forbidden', 'You are not an admin.'];
+const NO_DIRECTORY = ['503 Service Unavailable', 'No directory is set up on this server.'];
+
+export const ipx = {
+  name: 'ipx',
+  root: '/docs/api/ipx',
+  changelog: 'crates/ipx/CHANGELOG.md',
+  intro: `<p>The HTTP API of an iPX server: everything the page does, a script can do. Every request
+    and answer is JSON unless an item says otherwise. The page is served by ipx-web, which passes
+    <code>/api</code> and <code>/media</code> on to ipx at the same address, so a script talks to
+    the address people open in a browser.</p>
+    <h2 id="auth">Signing in</h2>
+    <p>Send an API token, made in Settings under API tokens or with <a href="${'/docs/api/ipx/auth/post-tokens'}"><code>POST /api/tokens</code></a>:</p>
+    <pre><code>Authorization: Bearer ipx_…</code></pre>
+    <p>A token acts as the person who made it, and is an admin only if they are. A browser signs in
+    with <a href="/docs/api/ipx/auth/post-login"><code>POST /api/login</code></a> instead and is
+    given a cookie. Behind Cloudflare Access, Access stops a request with no Access sign-in before
+    iPX sees it: send an Access service token's <code>CF-Access-Client-Id</code> and
+    <code>CF-Access-Client-Secret</code> beside the API token.</p>
+    <h2 id="errors">Errors</h2>
+    <p>A request that fails answers with its status and a sentence saying why, as plain text:
+    <code>401</code> not signed in, <code>403</code> an admin's to do, <code>404</code> not there or
+    not yours, <code>400</code> a request that cannot be done as asked, <code>409</code> a conflict
+    the answer explains.</p>
+    <h2 id="ids">Ids</h2>
+    <p>A feed's id is a short name made from its title, such as <code>99-invisible</code>, and
+    appears in the page's address when the feed is open. An episode is its feed's id and its
+    <code>guid</code>, the guid URL-encoded in a path. A file (an enclosure) has a number. Times are
+    Unix seconds.</p>`,
+  groups: [
+    {
+      id: 'auth', name: 'auth', title: 'Signing in and tokens',
+      summary: 'Who you are, signing in and out, and API tokens.',
+      items: [
+        {
+          method: 'POST', path: '/api/login', slug: 'post-login', access: 'none',
+          summary: 'Sign in with a name and password, for a session cookie.',
+          doc: '<p>Answers who signed in and sets the session cookie, which lasts <code>session_days</code> from the last request. A script is better off with an API token, which needs no password kept.</p>',
+          body: 'Credentials', returns: 'Me',
+          errors: [['401 Unauthorized', 'The name or password is wrong.']],
+          example: `curl -c cookies -H "Content-Type: application/json" \\\n  -d '{"name":"sam","password":"…"}' "${U}/api/login"`,
+        },
+        {
+          method: 'POST', path: '/api/logout', slug: 'post-logout',
+          summary: 'Sign out: end the session and clear its cookies.',
+          returns: '204 No Content',
+        },
+        {
+          method: 'GET', path: '/api/me', slug: 'get-me',
+          summary: 'Who you are, your words that hide items, and the server’s version.',
+          returns: 'Me',
+          example: ipxCurl('GET', '/api/me'),
+        },
+        {
+          method: 'PATCH', path: '/api/me', slug: 'patch-me',
+          summary: 'Change the words that hide an item in every feed you read.',
+          body: 'MePatch', returns: '204 No Content',
+          errors: [['400 Bad Request', 'More than 500 words, or one over 200 characters.']],
+          example: ipxCurl('PATCH', '/api/me', '{"blocked":["sponsor","ad read"]}'),
+        },
+        {
+          method: 'GET', path: '/api/tokens', slug: 'get-tokens',
+          summary: 'Your API tokens: names and when each was made and last used, never the token.',
+          returns: 'Vec<Token>',
+        },
+        {
+          method: 'POST', path: '/api/tokens', slug: 'post-tokens',
+          summary: 'Make an API token that acts as you.',
+          doc: '<p>The answer is the only time the token is shown: only its SHA-256 is kept.</p>',
+          body: 'NewToken', returns: 'NewTokenMade',
+          errors: [['400 Bad Request', 'No name.']],
+          example: ipxCurl('POST', '/api/tokens', '{"name":"my script"}'),
+        },
+        {
+          method: 'DELETE', path: '/api/tokens/{id}', slug: 'delete-token',
+          summary: 'Revoke one of your API tokens.',
+          pathParams: [['id', 'i64', 'The token’s id, from <code>GET /api/tokens</code>.']],
+          returns: '204 No Content',
+          errors: [['404 Not Found', 'No token of yours has that id.']],
+        },
+      ],
+    },
+    {
+      id: 'feeds', name: 'feeds', title: 'Feeds',
+      summary: 'Your subscriptions: list, subscribe, change, unsubscribe, check, OPML.',
+      items: [
+        {
+          method: 'GET', path: '/api/feeds', slug: 'get-feeds',
+          summary: 'Your subscriptions, each with its counts and your settings for it.',
+          returns: 'Vec<FeedRow>',
+          example: ipxCurl('GET', '/api/feeds'),
+        },
+        {
+          method: 'POST', path: '/api/feeds', slug: 'post-feeds',
+          summary: 'Subscribe to a feed, by its address or a site that links one.',
+          doc: '<p>A feed someone else on the server already has costs nothing to add: it is fetched once and each file is kept once. An OPML address subscribes to the list, kept in step as a folder.</p>',
+          body: 'NewFeed', returns: 'Added',
+          errors: [['400 Bad Request', 'The address is not a feed and links none; the answer says what was found.']],
+          example: ipxCurl('POST', '/api/feeds', '{"url":"https://feeds.99percentinvisible.org/99percentinvisible"}'),
+        },
+        {
+          method: 'PATCH', path: '/api/feeds/{id}', slug: 'patch-feed',
+          summary: 'Change your settings for a feed, or (an admin) the feed’s own.',
+          doc: '<p>Send only the fields to change. Which episodes you want, whether to download them, how many at a time, DeadAir and pinning are yours, and change for nobody else. The feed’s address, folder, schedule and category, and marking it shareable again, are the same for everyone and an admin’s to change.</p>',
+          pathParams: [['id', 'String', 'The feed’s id.']],
+          body: 'FeedPatch', returns: '204 No Content',
+          errors: [['400 Bad Request', 'A value out of range, such as a DeadAir pause that is not 200, 300, 400 or 500.'], ['403 Forbidden', 'A field only an admin may change.'], NOT_SUBSCRIBED],
+          example: ipxCurl('PATCH', '/api/feeds/99-invisible', '{"keywords":["mini-stories"],"pinned":true}'),
+        },
+        {
+          method: 'DELETE', path: '/api/feeds/{id}', slug: 'delete-feed',
+          summary: 'Unsubscribe. The files stay for anyone else who reads the feed.',
+          pathParams: [['id', 'String', 'The feed’s id.']],
+          returns: '204 No Content', errors: [NOT_SUBSCRIBED],
+        },
+        {
+          method: 'POST', path: '/api/feeds/{id}/read-all', slug: 'post-read-all',
+          summary: 'Mark every episode of a feed read, and of every feed in it for an OPML list.',
+          pathParams: [['id', 'String', 'The feed’s id.']],
+          returns: 'Marked',
+        },
+        {
+          method: 'POST', path: '/api/feeds/{id}/download-latest', slug: 'post-download-latest',
+          summary: 'Download a feed’s newest episodes that are not downloaded yet.',
+          pathParams: [['id', 'String', 'The feed’s id.']],
+          body: 'HowMany', returns: 'Queued', errors: [NOT_SUBSCRIBED],
+          example: ipxCurl('POST', '/api/feeds/99-invisible/download-latest', '{"count":3}'),
+        },
+        {
+          method: 'POST', path: '/api/fetch', slug: 'post-fetch',
+          summary: 'Check one feed, or all of yours, for new episodes now.',
+          doc: '<p>The check runs in the background; <a href="/docs/api/ipx/server/get-events"><code>GET /api/events</code></a> shows it as it goes.</p>',
+          body: 'FetchBody', returns: '202 Accepted',
+          example: ipxCurl('POST', '/api/fetch', '{"feed":"99-invisible","force":true}'),
+        },
+        {
+          method: 'GET', path: '/api/opml', slug: 'get-opml',
+          summary: 'Your subscriptions as an OPML file, for another podcast app.',
+          returns: 'OPML (text/x-opml)',
+        },
+        {
+          method: 'POST', path: '/api/opml', slug: 'post-opml',
+          summary: 'Subscribe to every feed in an OPML file.',
+          body: 'OpmlBody', returns: 'Imported',
+          errors: [['400 Bad Request', 'Not OPML.']],
+        },
+      ],
+    },
+    {
+      id: 'entries', name: 'entries', title: 'Episodes',
+      summary: 'Episodes and posts: list, search, mark read or kept, save where you are.',
+      items: [
+        {
+          method: 'GET', path: '/api/feeds/{id}/entries', slug: 'get-feed-entries',
+          summary: 'A page of one feed’s episodes, newest first unless sorted.',
+          pathParams: [['id', 'String', 'The feed’s id.']],
+          query: 'Page', returns: 'EntryPage', errors: [NOT_SUBSCRIBED],
+          example: ipxCurl('GET', '/api/feeds/99-invisible/entries?filter=unread&limit=10'),
+        },
+        {
+          method: 'GET', path: '/api/entries', slug: 'get-entries',
+          summary: 'The same, across every feed you subscribe to.',
+          query: 'Page', returns: 'EntryPage',
+          example: ipxCurl('GET', '/api/entries?q=bridges&sort=published&dir=desc'),
+        },
+        {
+          method: 'GET', path: '/api/entries/{feed}/{guid}', slug: 'get-entry',
+          summary: 'One episode.',
+          pathParams: [['feed', 'String', 'The feed’s id.'], ['guid', 'String', 'The episode’s guid, URL-encoded.']],
+          returns: 'EntryRow', errors: [NOT_SUBSCRIBED],
+        },
+        {
+          method: 'POST', path: '/api/entries/{feed}/{guid}/flags', slug: 'post-flags',
+          summary: 'Mark an episode read or unread, kept or not.',
+          doc: '<p>Answers with the feed’s row, its counts changed, so a list can redraw one line.</p>',
+          pathParams: [['feed', 'String', 'The feed’s id.'], ['guid', 'String', 'The episode’s guid, URL-encoded.']],
+          body: 'Flags', returns: 'Option<FeedRow>', errors: [NOT_SUBSCRIBED],
+          example: ipxCurl('POST', '/api/entries/99-invisible/{guid}/flags', '{"read":true}'),
+        },
+        {
+          method: 'POST', path: '/api/entries/{feed}/{guid}/position', slug: 'post-position',
+          summary: 'Save where you are in an episode, for every device you listen on.',
+          pathParams: [['feed', 'String', 'The feed’s id.'], ['guid', 'String', 'The episode’s guid, URL-encoded.']],
+          body: 'Position', returns: '204 No Content', errors: [NOT_SUBSCRIBED],
+          example: ipxCurl('POST', '/api/entries/99-invisible/{guid}/position', '{"secs":1234}'),
+        },
+        {
+          method: 'POST', path: '/api/read-all', slug: 'post-read-all-mine',
+          summary: 'Mark every episode of every feed you subscribe to read.',
+          returns: 'Marked',
+        },
+      ],
+    },
+    {
+      id: 'files', name: 'files', title: 'Files',
+      summary: 'Downloading, deleting and playing an episode’s file.',
+      items: [
+        {
+          method: 'POST', path: '/api/enclosures/{id}/download', slug: 'post-download',
+          summary: 'Download a file now.',
+          pathParams: [['id', 'i64', 'The file’s id, an <code>EncRow</code>’s <code>id</code>.']],
+          returns: '202 Accepted, or 204 No Content when it is already here', errors: [NOT_SUBSCRIBED],
+        },
+        {
+          method: 'DELETE', path: '/api/enclosures/{id}', slug: 'delete-file',
+          summary: 'Delete a downloaded file. It is not downloaded again.',
+          doc: '<p>There is one copy of each file, so deleting it deletes it for everyone. If someone else has kept the episode or not played it yet, the first try is refused with who: send it again with <code>?force=true</code> to delete it anyway.</p>',
+          pathParams: [['id', 'i64', 'The file’s id.']],
+          query: 'Force', returns: '204 No Content',
+          errors: [['409 Conflict', 'Someone else still wants it; the answer says who. Send <code>force=true</code> to go ahead.'], NOT_SUBSCRIBED],
+        },
+        {
+          method: 'GET', path: '/media/{id}', slug: 'get-media',
+          summary: 'The file itself, with <code>Range</code> requests, so a player can seek.',
+          pathParams: [['id', 'i64', 'The file’s id.']],
+          returns: 'The file, with its own Content-Type', errors: [NOT_SUBSCRIBED],
+        },
+        {
+          method: 'GET', path: '/media/{id}/deadair.m3u8', slug: 'get-deadair',
+          summary: 'The episode with its long silences shortened by DeadAir, as an HLS playlist.',
+          doc: '<p>Only once DeadAir has looked at the file: an <code>EncRow</code> with <code>deadair</code> set says how many seconds it saves. <code>/media/{id}/deadair</code> gives the shortened episode as one file to save.</p>',
+          pathParams: [['id', 'i64', 'The file’s id.']],
+          returns: 'An HLS playlist (application/vnd.apple.mpegurl)', errors: [NOT_SUBSCRIBED],
+        },
+      ],
+    },
+    {
+      id: 'directory', name: 'directory', title: 'The directory, through iPX',
+      summary: 'Browse the directory and subscribe from it; iPX asks it on your behalf.',
+      items: [
+        {
+          method: 'GET', path: '/api/popular', slug: 'get-popular',
+          summary: 'The directory’s ten most subscribed feeds.',
+          returns: 'Vec<PopularRow>', errors: [NO_DIRECTORY],
+        },
+        {
+          method: 'GET', path: '/api/directory', slug: 'get-directory',
+          summary: 'Every feed the directory lists, A to Z.',
+          returns: 'Vec<PopularRow>', errors: [NO_DIRECTORY],
+        },
+        {
+          method: 'GET', path: '/api/directory/{id}', slug: 'get-listed',
+          summary: 'A feed’s page in the directory: what it says it is and its latest items.',
+          pathParams: [['id', 'String', 'The directory’s id for the feed.']],
+          returns: 'Listed', errors: [['404 Not Found', 'Not in the directory.'], NO_DIRECTORY],
+        },
+        {
+          method: 'POST', path: '/api/popular/{id}', slug: 'post-popular',
+          summary: 'Subscribe to a feed from the directory, by the directory’s id.',
+          pathParams: [['id', 'String', 'The directory’s id for the feed.']],
+          returns: 'Subscribed', errors: [['400 Bad Request', 'Not in the directory.'], NO_DIRECTORY],
+        },
+      ],
+    },
+    {
+      id: 'server', name: 'server', title: 'The server',
+      summary: 'Its counts and version, and live updates.',
+      items: [
+        {
+          method: 'GET', path: '/api/status', slug: 'get-status',
+          summary: 'How many feeds, files waiting and files downloaded, and the version.',
+          doc: '<p>The numbers <code>ipx status</code> prints, for a dashboard.</p>',
+          returns: 'Status', example: ipxCurl('GET', '/api/status'),
+        },
+        {
+          method: 'GET', path: '/api/events', slug: 'get-events',
+          summary: 'A live stream of checks and downloads as they happen (server-sent events).',
+          doc: '<p>Each message’s data is one JSON <a href="/docs/api/ipx/types/Event"><code>Event</code></a>. Every event of a check reaches everyone; a feed’s new row (<code>feed_row</code>) only those who subscribe to it.</p>',
+          returns: 'text/event-stream of Event',
+          example: `curl -N -H "Authorization: Bearer ipx_…" "${U}/api/events"\ndata: {"ev":"feed_start","feed":"99-invisible"}\ndata: {"ev":"feed_done","feed":"99-invisible","new":1,"downloaded":1,"failed":0,"torrents":0}`,
+        },
+      ],
+    },
+    {
+      id: 'admin', name: 'admin', title: 'Admin',
+      summary: 'Server settings, accounts, the log and the directory’s administration. Admins only.',
+      items: [
+        {
+          method: 'GET', path: '/api/settings', slug: 'get-settings', access: 'signed in',
+          summary: 'The server’s settings. Anyone signed in may read them.',
+          returns: 'Settings',
+        },
+        {
+          method: 'PATCH', path: '/api/settings', slug: 'patch-settings', access: 'admin',
+          summary: 'Change the server’s settings. They take effect at once.',
+          body: 'SettingsPatch', returns: '204 No Content',
+          errors: [['400 Bad Request', 'A value that does not parse, such as a schedule.'], NOT_ADMIN],
+          example: ipxCurl('PATCH', '/api/settings', '{"schedule":"every 2h","max_total_gb":200}'),
+        },
+        {
+          method: 'GET', path: '/api/users', slug: 'get-users', access: 'admin',
+          summary: 'Every account.', returns: 'Vec<UserRow>', errors: [NOT_ADMIN],
+        },
+        {
+          method: 'POST', path: '/api/users', slug: 'post-users', access: 'admin',
+          summary: 'Add an account.',
+          doc: '<p>With no password, the account signs in only through single sign-on.</p>',
+          body: 'NewUser', returns: '201 Created',
+          errors: [['400 Bad Request', 'No name, or one that exists already.'], NOT_ADMIN],
+          example: ipxCurl('POST', '/api/users', '{"name":"sam","password":"…"}'),
+        },
+        {
+          method: 'PATCH', path: '/api/users/{id}', slug: 'patch-user', access: 'admin',
+          summary: 'Make an account an admin, or not.',
+          pathParams: [['id', 'i64', 'The account’s id.']],
+          body: 'UserPatch', returns: '204 No Content',
+          errors: [['400 Bad Request', 'No such account, or the only admin, who cannot stop being one.'], NOT_ADMIN],
+        },
+        {
+          method: 'DELETE', path: '/api/users/{id}', slug: 'delete-user', access: 'admin',
+          summary: 'Remove an account, with its subscriptions and read state. Files stay.',
+          pathParams: [['id', 'i64', 'The account’s id.']],
+          returns: '204 No Content',
+          errors: [['400 Bad Request', 'No such account, or the only admin, who cannot be removed.'], NOT_ADMIN],
+        },
+        {
+          method: 'GET', path: '/api/logs', slug: 'get-logs', access: 'admin',
+          summary: 'The newest lines of the server’s log, or those after a given one.',
+          query: 'LogQuery', returns: 'LogPage', errors: [NOT_ADMIN],
+        },
+        {
+          method: 'GET', path: '/api/directory-status', slug: 'get-directory-status', access: 'admin',
+          summary: 'Who the directory takes this server’s token to be, and how the last share went.',
+          returns: 'DirectoryStatus', errors: [NOT_ADMIN],
+        },
+        {
+          method: 'DELETE', path: '/api/directory/{id}', slug: 'delete-listed', access: 'admin',
+          summary: 'Remove a feed from the directory and keep it out.',
+          doc: '<p>Only when this server’s directory token is <code>rwa</code>; the directory refuses otherwise.</p>',
+          pathParams: [['id', 'String', 'The directory’s id for the feed.']],
+          returns: '204 No Content', errors: [NOT_ADMIN, NO_DIRECTORY],
+        },
+        {
+          method: 'POST', path: '/api/directory/{id}/refresh', slug: 'post-listed-refresh', access: 'admin',
+          summary: 'Have the directory check a feed now. Needs an <code>rwa</code> token.',
+          pathParams: [['id', 'String', 'The directory’s id for the feed.']],
+          returns: '204 No Content', errors: [NOT_ADMIN, NO_DIRECTORY],
+        },
+        {
+          method: 'GET', path: '/api/directory-admin', slug: 'get-directory-admin', access: 'admin',
+          summary: 'The servers sharing with the directory, and the feeds it keeps out. Needs <code>rwa</code>.',
+          returns: 'DirectoryAdmin', errors: [NOT_ADMIN, NO_DIRECTORY],
+        },
+        {
+          method: 'DELETE', path: '/api/directory-blocked/{id}', slug: 'delete-directory-blocked', access: 'admin',
+          summary: 'Let a feed the directory keeps out back in. Needs <code>rwa</code>.',
+          pathParams: [['id', 'String', 'The directory’s id for the feed.']],
+          returns: '204 No Content', errors: [NOT_ADMIN, NO_DIRECTORY],
+        },
+        {
+          method: 'DELETE', path: '/api/directory-instances/{name}', slug: 'delete-directory-instance', access: 'admin',
+          summary: 'Drop a server’s share from the directory until it next shares. Needs <code>rwa</code>.',
+          pathParams: [['name', 'String', 'The server’s token name.']],
+          returns: '204 No Content', errors: [NOT_ADMIN, NO_DIRECTORY],
+        },
+      ],
+    },
+  ],
+  types: [
+    { name: 'Credentials', doc: 'A name and password.', fields: [['name', 'String', ''], ['password', 'String', '']] },
+    { name: 'Me', doc: 'Who is signed in.', fields: [
+      ['name', 'String', 'The account’s name, often an email address.'],
+      ['admin', 'bool', ''],
+      ['blocked', 'Vec<String>', 'Words that hide an item in every feed you read. <code>GET /api/me</code> only, as are the fields below.'],
+      ['sign_out', 'Option<String>', 'Where signing out should go, for someone single sign-on signed in.'],
+      ['deadair_saved', 'i64', 'Seconds DeadAir has saved you, all told.'],
+      ['version', 'String', 'ipx’s version.'],
+    ] },
+    { name: 'MePatch', doc: 'What <code>PATCH /api/me</code> changes.', fields: [['blocked', 'Option<Vec<String>>', 'Replaces the list.']] },
+    { name: 'Token', doc: 'An API token, as listed.', fields: [['id', 'i64', ''], ['name', 'String', ''], ['created', 'i64', ''], ['last_used', 'Option<i64>', '']] },
+    { name: 'NewToken', doc: 'A token to make.', fields: [['name', 'String', 'What it is for, to know it by when revoking it.']] },
+    { name: 'NewTokenMade', doc: 'A token just made: the only time it is shown.', fields: [['id', 'i64', ''], ['name', 'String', ''], ['token', 'String', 'Begins <code>ipx_</code>. Send it as <code>Authorization: Bearer</code>.']] },
+    { name: 'FeedRow', doc: 'A feed as you see it: the feed, your settings for it and its counts for you.', fields: [
+      ['id', 'String', ''], ['url', 'String', ''], ['title', 'Option<String>', ''], ['image', 'Option<String>', ''],
+      ['folder', 'Option<String>', ''],
+      ['category', 'Option<String>', 'The directory category an admin gave it.'],
+      ['feed_category', 'Option<String>', 'The one the feed names itself, which wins.'],
+      ['keywords', 'Vec<String>', 'Your words: with any, only episodes that mention one are downloaded.'],
+      ['blocked', 'Vec<String>', 'Your words that hide an episode of this feed.'],
+      ['deadair', 'bool', 'Played with its silences shortened.'],
+      ['deadair_pause', 'i64', 'The pause DeadAir leaves where it cuts, in milliseconds.'],
+      ['allow_explicit', 'bool', ''], ['auto_download', 'bool', ''],
+      ['max_new_per_check', 'Option<usize>', 'Your own limit, or none for the server’s.'],
+      ['group', 'Option<String>', 'The OPML list it came from.'],
+      ['orphaned', 'bool', 'In a list that no longer has it, kept for its downloads.'],
+      ['managed', 'bool', ''],
+      ['schedule', 'Option<String>', 'Its own schedule, such as <code>every 2h</code>.'],
+      ['schedule_mins', 'Option<u64>', 'The same in minutes.'],
+      ['every_mins', 'u64', 'How often it is checked, all things considered.'],
+      ['last_checked', 'Option<i64>', ''], ['next_check', 'Option<i64>', ''],
+      ['last_error', 'Option<String>', ''],
+      ['failing', 'Option<FailingRow>', 'Set once an error has held for a day.'],
+      ['entries', 'i64', ''], ['downloaded', 'i64', ''], ['unread', 'i64', ''],
+      ['subscribers', 'i64', 'People on this server, you included.'],
+      ['pinned', 'bool', 'At the top of your list.'],
+      ['private', 'bool', 'Kept out of the directory.'],
+      ['private_by_address', 'bool', 'Private whatever it is marked: a login, or a key in its address.'],
+    ] },
+    { name: 'FailingRow', doc: 'Why a feed has been failing.', fields: [['reason', 'String', 'In words.'], ['new_url', 'Option<String>', 'Where it seems to have moved.']] },
+    { name: 'NewFeed', doc: 'A feed to subscribe to.', fields: [
+      ['url', 'String', 'A feed’s address, an OPML list’s, or a site’s page that links its feed.'],
+      ['folder', 'Option<String>', ''],
+      ['keywords', 'Vec<String>', 'Download only episodes that mention one. Empty for all.'],
+      ['allow_explicit', 'bool', 'Download explicit episodes too. False if left out.'],
+    ] },
+    { name: 'Added', doc: 'A feed subscribed to.', fields: [['id', 'String', 'Its id here.'], ['existing', 'bool', 'You subscribed to it already.']] },
+    { name: 'FeedPatch', doc: 'What <code>PATCH /api/feeds/{id}</code> changes. Leave out what stays; <code>null</code> clears a field that can be cleared.', fields: [
+      ['keywords', 'Option<Vec<String>>', 'Yours.'], ['blocked', 'Option<Vec<String>>', 'Yours.'],
+      ['allow_explicit', 'Option<bool>', 'Yours.'], ['auto_download', 'Option<bool>', 'Yours.'],
+      ['max_new_per_check', 'Option<Option<usize>>', 'Yours; <code>null</code> for the server’s.'],
+      ['pinned', 'Option<bool>', 'Yours.'],
+      ['deadair', 'Option<Option<bool>>', 'Yours; <code>null</code> follows its OPML list’s.'],
+      ['deadair_pause', 'Option<i64>', 'Yours: 200, 300, 400 or 500.'],
+      ['private', 'Option<bool>', 'Anyone subscribed may mark it private; only an admin unmarks it.'],
+      ['url', 'Option<String>', 'Admin.'], ['schedule', 'Option<Option<String>>', 'Admin.'],
+      ['folder', 'Option<Option<String>>', 'Admin.'], ['category', 'Option<Option<String>>', 'Admin.'],
+    ] },
+    { name: 'Marked', doc: '', fields: [['marked', 'i64', 'How many episodes were marked.']] },
+    { name: 'HowMany', doc: '', fields: [['count', 'i64', 'From 1 to 100; 5 if left out.']] },
+    { name: 'Queued', doc: '', fields: [['queued', 'usize', 'How many files were queued.']] },
+    { name: 'FetchBody', doc: 'What to check.', fields: [['feed', 'Option<String>', 'One feed; all of yours if left out.'], ['force', 'bool', 'Check even if it is not due.']] },
+    { name: 'OpmlBody', doc: '', fields: [['xml', 'String', 'The OPML file’s text.']] },
+    { name: 'Imported', doc: '', fields: [['added', 'usize', ''], ['already', 'usize', 'Feeds you had.']] },
+    { name: 'Page', doc: 'Which episodes, as query parameters.', fields: [
+      ['offset', 'i64', '0 if left out.'], ['limit', 'i64', '50 if left out.'],
+      ['filter', 'Option<String>', '<code>unread</code>, <code>downloaded</code> or <code>flagged</code> (kept).'],
+      ['q', 'Option<String>', 'Words to look for in titles and show notes.'],
+      ['sort', 'Option<String>', '<code>published</code>, <code>title</code>, <code>feed</code>, <code>type</code>, <code>size</code> or <code>kept</code>. Newest first if left out.'],
+      ['dir', 'Option<String>', '<code>asc</code> or <code>desc</code>.'],
+    ] },
+    { name: 'EntryPage', doc: 'A page of episodes.', fields: [['total', 'i64', 'How many match, over every page.'], ['entries', 'Vec<EntryRow>', '']] },
+    { name: 'EntryRow', doc: 'An episode or post, with your state for it.', fields: [
+      ['guid', 'String', ''], ['feed_id', 'String', ''], ['title', 'Option<String>', ''], ['link', 'Option<String>', ''],
+      ['published', 'Option<i64>', ''],
+      ['description', 'Option<String>', 'Show notes, HTML, already sanitized.'],
+      ['read', 'bool', ''], ['flagged', 'bool', 'Kept: its file is never cleared to save space.'],
+      ['image', 'Option<String>', ''], ['duration', 'Option<i64>', 'Seconds.'],
+      ['episode', 'Option<i64>', ''], ['season', 'Option<i64>', ''],
+      ['position', 'i64', 'Where you are in it, in seconds.'],
+      ['enclosures', 'Vec<EncRow>', 'Its files.'],
+    ] },
+    { name: 'EncRow', doc: 'An episode’s file.', fields: [
+      ['id', 'i64', 'What <code>/media/{id}</code> and the file routes take.'],
+      ['feed_id', 'String', ''], ['guid', 'String', ''], ['url', 'String', 'Where the publisher has it.'],
+      ['mime', 'Option<String>', ''], ['length', 'Option<i64>', 'Bytes.'],
+      ['path', 'Option<String>', 'Where it is on the server, once downloaded.'],
+      ['state', 'String', '<code>pending</code> (a check will download it), <code>held</code> (back catalogue, downloaded on request), <code>downloading</code>, <code>done</code>, <code>skipped</code> (a filter or a failure) or <code>reaped</code> (deleted).'],
+      ['last_error', 'Option<String>', ''],
+      ['deadair', 'Option<i64>', 'Seconds DeadAir saves, when you play it shortened. Absent otherwise.'],
+      ['deadair_pending', 'bool', 'DeadAir is still working on it. Absent when false.'],
+    ] },
+    { name: 'Flags', doc: '', fields: [['read', 'Option<bool>', ''], ['flagged', 'Option<bool>', 'Kept.']] },
+    { name: 'Position', doc: '', fields: [['secs', 'i64', 'Seconds in.'], ['duration', 'Option<i64>', 'The length the player measured, for an episode whose feed gives none.']] },
+    { name: 'Force', doc: 'A query parameter.', fields: [['force', 'bool', 'Delete it even though someone else wants it.']] },
+    { name: 'PopularRow', doc: 'A feed in the directory. Never its address: subscribe by its id.', fields: [
+      ['id', 'String', 'The directory’s id for it.'], ['title', 'Option<String>', ''], ['image', 'Option<String>', ''],
+      ['subscribers', 'i64', 'On every server sharing with the directory.'],
+      ['subscribed', 'bool', 'Yours already.'], ['feed', 'Option<String>', 'Its id here, when it is yours.'],
+      ['category', 'Option<String>', ''], ['subcategory', 'Option<String>', ''],
+      ['podcast', 'bool', 'Has audio or video.'],
+    ] },
+    { name: 'Listed', doc: 'A feed’s page in the directory.', fields: [
+      ['description', 'Option<String>', 'What it says it is, sanitized.'],
+      ['failing', 'Option<String>', 'Why its last check failed, when it did.'],
+      ['items', 'Vec<ListedItem>', 'Its latest twenty.'],
+      ['can_admin', 'bool', 'You may remove or refresh it.'],
+    ] },
+    { name: 'ListedItem', doc: '', fields: [['guid', 'String', ''], ['title', 'Option<String>', ''], ['link', 'Option<String>', ''], ['published', 'Option<i64>', ''], ['duration', 'Option<i64>', ''], ['description', 'Option<String>', 'Sanitized.']] },
+    { name: 'Subscribed', doc: '', fields: [['id', 'String', 'The feed’s id here.']] },
+    { name: 'Status', doc: '', fields: [['feeds', 'usize', ''], ['pending', 'usize', 'Files a check will download.'], ['downloaded', 'usize', ''], ['version', 'String', '']] },
+    { name: 'Event', doc: 'One live update. <code>ev</code> says which, and the rest depends on it.', fields: [
+      ['feed_start', '{ feed }', 'A feed is being checked.'],
+      ['feed_skip', '{ feed }', 'Not due.'],
+      ['feed_done', '{ feed, new, downloaded, failed, torrents }', ''],
+      ['feed_error', '{ feed, msg }', ''],
+      ['feed_row', '{ row: FeedRow }', 'A feed you subscribe to changed.'],
+      ['progress', '{ feed, enclosure, file, done, total }', 'Bytes of a download, in whole percents.'],
+      ['download_done', '{ feed, enclosure, path, bytes }', ''],
+      ['download_error', '{ feed, enclosure, msg, url }', ''],
+      ['deadair_done', '{ feed, enclosure, saved_s }', 'DeadAir finished a file.'],
+      ['scan_done', '{ feeds }', 'A check finished; how many feeds it looked at.'],
+    ] },
+    { name: 'Settings', doc: 'The server’s settings.', fields: [
+      ['schedule', 'String', 'How often feeds are checked, such as <code>every 60m</code>.'], ['every_mins', 'u64', 'The same in minutes.'],
+      ['max_new_per_check', 'usize', 'The newest episodes a check downloads, a feed.'],
+      ['media_types', 'Vec<String>', 'What is downloaded, such as <code>audio</code>, <code>video</code>.'],
+      ['download_dir', 'String', ''], ['max_total_gb', 'f64', 'Disk to use; 0 for no limit.'],
+      ['max_age_days', 'u64', '0 for no limit.'], ['art_cache_mb', 'u64', 'Artwork kept.'],
+      ['directory_url', 'String', ''], ['directory_token_set', 'bool', 'The token itself is never sent back.'],
+      ['directory_share', 'bool', ''],
+    ] },
+    { name: 'SettingsPatch', doc: 'What <code>PATCH /api/settings</code> changes. Leave out what stays.', fields: [
+      ['schedule', 'Option<String>', ''], ['max_new_per_check', 'Option<usize>', ''], ['media_types', 'Option<Vec<String>>', ''],
+      ['max_total_gb', 'Option<f64>', ''], ['max_age_days', 'Option<u64>', ''], ['art_cache_mb', 'Option<u64>', ''],
+      ['directory_url', 'Option<String>', 'Empty for no directory.'], ['directory_token', 'Option<String>', 'Replaces it; empty clears it.'],
+      ['directory_share', 'Option<bool>', ''],
+    ] },
+    { name: 'UserRow', doc: 'An account.', fields: [['id', 'i64', ''], ['name', 'String', ''], ['admin', 'bool', ''], ['password', 'bool', 'Has one; without, it signs in only by single sign-on.'], ['created', 'Option<i64>', ''], ['last_login', 'Option<i64>', '']] },
+    { name: 'NewUser', doc: '', fields: [['name', 'String', 'No commas, semicolons or line breaks.'], ['password', 'String', 'Empty for single sign-on only.'], ['admin', 'bool', '']] },
+    { name: 'UserPatch', doc: '', fields: [['admin', 'bool', '']] },
+    { name: 'LogQuery', doc: 'Query parameters.', fields: [['after', 'u64', 'The last <code>seq</code> you have; 0 for the newest lines.'], ['limit', 'usize', '200 if left out.']] },
+    { name: 'LogPage', doc: '', fields: [['lines', 'Vec<LogLine>', ''], ['latest', 'u64', 'The newest <code>seq</code>, to ask after next time.']] },
+    { name: 'LogLine', doc: '', fields: [['seq', 'u64', ''], ['ts', 'i64', ''], ['level', 'String', ''], ['target', 'String', ''], ['msg', 'String', '']] },
+    { name: 'DirectoryStatus', doc: '', fields: [
+      ['configured', 'bool', 'An address and token are set.'], ['name', 'Option<String>', 'The token’s name, as the directory knows it.'],
+      ['access', 'Option<String>', '<code>ro</code>, <code>rw</code> or <code>rwa</code>.'], ['error', 'Option<String>', 'Why the directory would not say.'],
+      ['shared', 'Option<SnapshotResult>', 'How the last share went.'],
+    ] },
+    { name: 'DirectoryAdmin', doc: '', fields: [['instances', 'Vec<Instance>', 'Servers sharing.'], ['blocked', 'Vec<BlockedRow>', '']] },
+    { name: 'BlockedRow', doc: 'A feed the directory keeps out. Never its address.', fields: [['id', 'String', ''], ['title', 'Option<String>', ''], ['at', 'i64', 'When.']] },
+    { name: 'Instance', doc: 'A server sharing with the directory.', fields: [['name', 'String', 'Its token’s name.'], ['feeds', 'i64', ''], ['subscribers', 'i64', '']] },
+    { name: 'SnapshotResult', doc: 'What the directory made of a share.', fields: [['accepted', 'usize', ''], ['refused_private', 'usize', 'Addresses that look like someone’s paid access.'], ['refused_blocked', 'usize', ''], ['refused_invalid', 'usize', 'Not http(s).']] },
+  ],
+};
+
+export const directory = {
+  name: 'ipx_directory',
+  label: 'ipx-directory',
+  root: '/docs/api/directory',
+  changelog: 'crates/directory/CHANGELOG.md',
+  intro: `<p>The HTTP API of the directory of public podcasts that iPX servers share, at
+    <code>${D}/v1</code>. Its pages at <a href="${D}">${D.replace('https://', '')}</a> are anyone’s
+    to browse; the API needs a token for everything.</p>
+    <h2 id="auth">Tokens</h2>
+    <pre><code>Authorization: Bearer &lt;token&gt;</code></pre>
+    <p>A token has a name and one of three levels of access: <code>ro</code> reads,
+    <code>rw</code> also shares, and <code>rwa</code> also removes and blocks feeds and drops a
+    server’s share. Tokens are given out by whoever runs the directory, and none can be made or
+    revoked over the API.</p>
+    <h2 id="errors">Errors</h2>
+    <p>A request that fails answers with its status and <code>{"error": "…"}</code>:
+    <code>401</code> no token or an unknown one, <code>403</code> a token without the access,
+    <code>404</code> not listed.</p>
+    <h2 id="ids">Ids</h2>
+    <p>A feed’s <code>id</code> is the first 16 hex digits of the SHA-256 of its address with the
+    scheme and host in lower case and no default port or fragment, so every server arrives at the
+    same one. Descriptions are the publisher’s own HTML, unsanitized: sanitize them before you
+    show them.</p>`,
+  groups: [
+    {
+      id: 'feeds', name: 'feeds', title: 'Feeds',
+      summary: 'What the directory lists.',
+      items: [
+        {
+          method: 'GET', path: '/v1/me', slug: 'get-me', access: 'ro',
+          summary: 'The token’s name and access.', returns: 'Me', example: dirCurl('GET', '/v1/me'),
+        },
+        {
+          method: 'GET', path: '/v1/feeds', slug: 'get-feeds', access: 'ro',
+          summary: 'Every feed listed, A to Z.', returns: 'Vec<Listing>', example: dirCurl('GET', '/v1/feeds'),
+        },
+        {
+          method: 'GET', path: '/v1/popular', slug: 'get-popular', access: 'ro',
+          summary: 'The most subscribed feeds.', query: 'Limit', returns: 'Vec<Listing>',
+          example: dirCurl('GET', '/v1/popular?limit=5'),
+        },
+        {
+          method: 'GET', path: '/v1/feeds/{id}', slug: 'get-feed', access: 'ro',
+          summary: 'One feed, with its description and latest twenty items.',
+          pathParams: [['id', 'String', 'The feed’s id.']],
+          returns: 'FeedPage', errors: [['404 Not Found', 'Not listed.']],
+        },
+        {
+          method: 'GET', path: '/healthz', slug: 'get-healthz', access: 'none',
+          summary: '<code>ok</code> when the directory can read its database.', returns: 'text/plain',
+        },
+      ],
+    },
+    {
+      id: 'share', name: 'share', title: 'Sharing',
+      summary: 'A server telling the directory what its people follow.',
+      items: [
+        {
+          method: 'POST', path: '/v1/snapshot', slug: 'post-snapshot', access: 'rw',
+          summary: 'Share: every public feed this server’s people follow, and how many follow each.',
+          doc: '<p>Replaces everything this token shared before, so send the whole list each time. At most 20,000 feeds. Addresses that look private (a login, a key in the query, a paid-feed host) are refused and counted, never stored. A feed is listed once the directory has read it as one.</p>',
+          body: 'Vec<SnapshotEntry>', returns: 'SnapshotResult',
+          errors: [['413 Payload Too Large', 'More than 20,000 feeds.']],
+          example: dirCurl('POST', '/v1/snapshot', '[{"url":"https://feeds.99percentinvisible.org/99percentinvisible","subscribers":3}]'),
+        },
+      ],
+    },
+    {
+      id: 'admin', name: 'admin', title: 'Administering it',
+      summary: 'Removing and blocking feeds, and the servers sharing. <code>rwa</code> tokens only.',
+      items: [
+        {
+          method: 'DELETE', path: '/v1/feeds/{id}', slug: 'delete-feed', access: 'rwa',
+          summary: 'Remove a feed and block it, so no server’s share brings it back.',
+          pathParams: [['id', 'String', 'The feed’s id.']], returns: '204 No Content',
+        },
+        {
+          method: 'POST', path: '/v1/feeds/{id}/refresh', slug: 'post-refresh', access: 'rwa',
+          summary: 'Check a feed now, answering with its page.',
+          pathParams: [['id', 'String', 'The feed’s id.']], returns: 'FeedPage',
+        },
+        {
+          method: 'GET', path: '/v1/blocked', slug: 'get-blocked', access: 'rwa',
+          summary: 'The feeds kept out.', returns: 'Vec<Blocked>',
+        },
+        {
+          method: 'DELETE', path: '/v1/blocked/{id}', slug: 'delete-blocked', access: 'rwa',
+          summary: 'Let a blocked feed back in.',
+          pathParams: [['id', 'String', 'The feed’s id.']], returns: '204 No Content',
+        },
+        {
+          method: 'GET', path: '/v1/instances', slug: 'get-instances', access: 'rwa',
+          summary: 'Each token holding a share, with how many feeds and subscribers it gave.',
+          returns: 'Vec<Instance>',
+        },
+        {
+          method: 'DELETE', path: '/v1/instances/{name}', slug: 'delete-instance', access: 'rwa',
+          summary: 'Drop one token’s share, its counts with it, until it next shares.',
+          doc: '<p>To keep a server out for good, revoke its token instead.</p>',
+          pathParams: [['name', 'String', 'The token’s name.']], returns: '204 No Content',
+        },
+      ],
+    },
+  ],
+  types: [
+    { name: 'Me', doc: 'A token, as the directory knows it.', fields: [['name', 'String', ''], ['access', 'Access', '']] },
+    { name: 'Access', doc: 'A token’s access: <code>"ro"</code>, <code>"rw"</code> or <code>"rwa"</code>.', fields: [] },
+    { name: 'Limit', doc: 'A query parameter.', fields: [['limit', 'Option<u64>', 'From 1 to 100; 10 if left out.']] },
+    { name: 'Listing', doc: 'A feed listed.', fields: [
+      ['id', 'String', ''], ['url', 'String', 'Its address, to subscribe to anywhere.'], ['title', 'Option<String>', ''], ['image', 'Option<String>', ''],
+      ['category', 'Option<String>', 'Apple’s category, from the feed’s own.'], ['subcategory', 'Option<String>', ''],
+      ['podcast', 'bool', 'Audio or video in its latest items.'],
+      ['subscribers', 'i64', 'Summed over every server’s latest share.'],
+    ] },
+    { name: 'FeedPage', doc: 'A feed’s page: every field of <a href="/docs/api/directory/types/Listing"><code>Listing</code></a>, and these.', fields: [
+      ['description', 'Option<String>', 'The feed’s own HTML, unsanitized.'],
+      ['failing', 'Option<String>', 'Why its last check failed, in words.'],
+      ['items', 'Vec<Item>', 'Its latest twenty.'],
+    ] },
+    { name: 'Item', doc: 'An episode or post. Never its file.', fields: [['guid', 'String', ''], ['title', 'Option<String>', ''], ['link', 'Option<String>', ''], ['published', 'Option<i64>', 'Unix seconds.'], ['duration', 'Option<i64>', 'Seconds.'], ['description', 'Option<String>', 'Unsanitized.']] },
+    { name: 'SnapshotEntry', doc: 'One feed in a share.', fields: [['url', 'String', ''], ['subscribers', 'i64', ''], ['category', 'Option<String>', 'A category for a feed that names none itself.']] },
+    { name: 'SnapshotResult', doc: 'What the directory made of a share.', fields: [['accepted', 'usize', ''], ['refused_private', 'usize', ''], ['refused_blocked', 'usize', ''], ['refused_invalid', 'usize', 'Not http(s).']] },
+    { name: 'Blocked', doc: '', fields: [['id', 'String', ''], ['url', 'Option<String>', ''], ['title', 'Option<String>', ''], ['at', 'i64', 'When.']] },
+    { name: 'Instance', doc: '', fields: [['name', 'String', 'The token’s name.'], ['feeds', 'i64', ''], ['subscribers', 'i64', '']] },
+  ],
+};

site/build.sh

@@ -0,0 +1,14 @@
+#!/bin/sh
+# ipxreader.app: the page and its stylesheet, and the typeface, logo and icon from web/, into
+# site/dist, which Cloudflare Pages serves.
+set -e
+here=$(dirname "$0")
+rm -rf "$here/dist"
+mkdir -p "$here/dist/fonts"
+cp "$here/index.html" "$here/site.css" "$here/wave.svg" "$here/gitea.svg" "$here/_headers" "$here/dist/"
+# The reader's own typeface, the same file ipx-web serves.
+cp "$here/../web/InterVariable.woff2" "$here/dist/fonts/inter.woff2"
+cp "$here/../web/logo.svg" "$here/../web/favicon.png" "$here/dist/"
+cp -r "$here/shots" "$here/dist/"
+# The docs: the guides and the API references, generated (#223).
+node "$here/gen.mjs"

site/docs.mjs

@@ -0,0 +1,24 @@
+// The guides: a page each, from site/guides, with the docs' front page written here (#223).
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const read = name => fs.readFileSync(path.join(here, 'guides', name), 'utf8');
+
+const front = `<h1>Docs</h1>
+<p class="lede">How to run iPX on your own server, and how to talk to it and to the directory from a program of your own.</p>
+<dl class="cards">
+  <div><dt><a href="/docs/install">Install ipx and ipx-web</a></dt><dd>Build the two containers, start them, sign in and add people.</dd></div>
+  <div><dt><a href="/docs/cli">The command line</a></dt><dd>The <code>ipx</code> commands, and the control socket a program on the same machine can use.</dd></div>
+  <div><dt><a href="/docs/directory">The directory</a></dt><dd>Browsing it, connecting your iPX to it, and running one of your own.</dd></div>
+  <div><dt><a href="/docs/api/ipx/">ipx API reference</a></dt><dd>Every endpoint of an iPX server, what it takes and what it gives.</dd></div>
+  <div><dt><a href="/docs/api/directory/">ipx-directory API reference</a></dt><dd>The directory's API, for reading what it lists and sharing with it.</dd></div>
+</dl>`;
+
+export const guides = [
+  { href: '/docs/', file: 'docs/index.html', name: 'Overview', title: 'iPX docs', description: 'How to run iPX on your own server, and how to use its API and the directory’s.', body: front },
+  { href: '/docs/install', file: 'docs/install.html', name: 'Install', title: 'Install ipx and ipx-web - iPX docs', description: 'Run iPX and its page on your own server with Docker.', body: read('install.html') },
+  { href: '/docs/cli', file: 'docs/cli.html', name: 'Command line', title: 'The command line - iPX docs', description: 'The ipx commands, and its control socket.', body: read('cli.html') },
+  { href: '/docs/directory', file: 'docs/directory.html', name: 'Directory', title: 'The directory - iPX docs', description: 'Browse the directory, connect your iPX to it, or run your own.', body: read('directory.html') },
+];

site/gen.mjs

@@ -0,0 +1,212 @@
+// The docs pages, into site/dist/docs: the guides in docs.mjs, and an API reference for each
+// service from api.mjs, laid out as docs.rs lays out a crate (#223): a root page listing its
+// modules and types, a page a module listing its endpoints, a page an endpoint and a page a type.
+// No script: the site's Content-Security-Policy allows none of its own.
+//
+//   node site/gen.mjs        (site/build.sh runs it)
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ipx, directory } from './api.mjs';
+import { guides } from './docs.mjs';
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const dist = path.join(here, 'dist');
+const SRC = 'https://git.sdf1.net/rays/ipx/src/branch/main';
+
+const esc = s => String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
+
+/// The version a reference documents: its service's last release, from its changelog, not the
+/// -dev version between releases.
+function released(changelog) {
+  const m = fs.readFileSync(path.join(here, '..', changelog), 'utf8').match(/^## \[(\d+\.\d+\.\d+)\]/m);
+  return m ? m[1] : '';
+}
+
+function write(rel, html) {
+  const file = path.join(dist, rel);
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, html);
+}
+
+function shell({ title, description, sidebar, body, current }) {
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(title)}</title>
+<meta name="description" content="${esc(description)}">
+<meta name="color-scheme" content="light">
+<link rel="icon" href="/favicon.png">
+<link rel="preload" href="/fonts/inter.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/site.css">
+</head>
+<body>
+<header class="bar">
+  <a class="home" href="/"><img src="/logo.svg" alt="" width="36" height="36">iPX</a>
+  <nav aria-label="Elsewhere">
+    <a href="/docs/" aria-current="true">Docs</a>
+    <a href="https://directory.ipxreader.app">Directory</a>
+    <a class="src" href="https://git.sdf1.net/rays/ipx" title="Source code on git.sdf1.net"><img src="/gitea.svg" alt="Source code" width="28" height="28"></a>
+  </nav>
+</header>
+<div class="docs">
+<aside class="side">${sidebar}</aside>
+<main class="doc">${body}</main>
+</div>
+<footer>
+  <p>iPX is free and open source under the MIT licence.</p>
+</footer>
+</body>
+</html>
+`;
+}
+
+/* ---------------- the guides ---------------- */
+
+const REFS = [[ipx, 'ipx'], [directory, 'ipx-directory']];
+
+function guideSidebar(cur) {
+  const li = (href, name, on) => `<li><a href="${href}"${on ? ' aria-current="page"' : ''}>${name}</a></li>`;
+  return `<nav aria-label="Docs">
+  <h2 class="side-h">Guides</h2>
+  <ul>${guides.map(g => li(g.href, g.name, g.href === cur)).join('')}</ul>
+  <h2 class="side-h">API reference</h2>
+  <ul>${REFS.map(([r, label]) => li(r.root + '/', label, false)).join('')}</ul>
+</nav>`;
+}
+
+for (const g of guides) {
+  write(g.file, shell({ title: g.title, description: g.description, sidebar: guideSidebar(g.href), body: g.body, current: 'docs' }));
+}
+
+/* ---------------- the references ---------------- */
+
+const METHOD_CLASS = { GET: 'm-get', POST: 'm-post', PATCH: 'm-patch', PUT: 'm-patch', DELETE: 'm-delete' };
+
+function reference(api) {
+  const label = api.label || api.name;
+  const version = released(api.changelog);
+  const typeNames = new Set(api.types.map(t => t.name));
+  const typeHref = n => `${api.root}/types/${n}`;
+  const itemHref = (g, it) => `${api.root}/${g.id}/${it.slug}`;
+  const fnName = it => it.slug.replace(/-/g, '_');
+  // A Rust type, its names that are types of this API linked.
+  const ty = s => esc(s).replace(/\b[A-Z][A-Za-z]+\b/g, n => typeNames.has(n) ? `<a class="t" href="${typeHref(n)}">${n}</a>` : n);
+  const isType = s => /^[A-Z]/.test(s) && /[A-Za-z>]$/.test(s) && !/\s/.test(s.replace(/, /g, ','));
+  const access = it => it.access || 'signed in';
+
+  // Which endpoints mention each type, for its "Used by", as docs.rs lists where a type turns up.
+  const usedBy = new Map();
+  for (const g of api.groups) for (const it of g.items) {
+    for (const s of [it.body, it.query, it.returns].filter(Boolean)) {
+      for (const n of s.match(/\b[A-Z][A-Za-z]+\b/g) || []) if (typeNames.has(n)) {
+        if (!usedBy.has(n)) usedBy.set(n, []);
+        if (!usedBy.get(n).some(([, x]) => x === it)) usedBy.get(n).push([g, it]);
+      }
+    }
+  }
+  // Types inside types: a type used only as a field is reached from the type that holds it.
+  for (const t of api.types) for (const [, ft] of t.fields) {
+    for (const n of ft.match(/\b[A-Z][A-Za-z]+\b/g) || []) if (typeNames.has(n) && n !== t.name) {
+      if (!usedBy.has(n)) usedBy.set(n, []);
+      if (!usedBy.get(n).some(([, x]) => x === t)) usedBy.get(n).push([null, t]);
+    }
+  }
+
+  const crumbs = (...parts) => `<p class="path"><a href="${api.root}/">${esc(api.name)}</a>${parts.map(([h, n]) => `::<a href="${h}">${n}</a>`).join('')}</p>`;
+  const top = `<a class="crate" href="${api.root}/"><img src="/logo.svg" alt="" width="40" height="40"><span><b>${esc(label)}</b>${version ? `<span class="ver">${version}</span>` : ''}</span></a>`;
+  const back = `<p class="side-back"><a href="/docs/">All docs</a></p>`;
+
+  function sidebar({ group, item, type } = {}) {
+    let s = top;
+    if (group) {
+      s += `<h2 class="side-h">Module <a href="${api.root}/${group.id}/">${group.name}</a></h2>
+<ul class="items">${group.items.map(it => `<li><a class="${METHOD_CLASS[it.method]}" href="${itemHref(group, it)}" title="${it.method} ${esc(it.path)}"${it === item ? ' aria-current="page"' : ''}><span class="verb">${it.method}</span> ${fnName(it)}</a></li>`).join('')}</ul>`;
+    }
+    s += `<h2 class="side-h">Modules</h2><ul>${api.groups.map(g => `<li><a href="${api.root}/${g.id}/"${g === group && !item ? ' aria-current="page"' : ''}>${g.name}</a></li>`).join('')}</ul>`;
+    s += `<h2 class="side-h">Types</h2><ul class="types">${api.types.map(t => `<li><a class="t" href="${typeHref(t.name)}"${t === type ? ' aria-current="page"' : ''}>${t.name}</a></li>`).join('')}</ul>`;
+    return `<nav aria-label="${esc(label)} reference">${s}</nav>${back}`;
+  }
+
+  const page = (rel, title, description, side, body) =>
+    write(rel, shell({ title, description, sidebar: side, body, current: 'docs' }));
+
+  // The root: what the crate page shows on docs.rs, its modules and types.
+  page(`${api.root.slice(1)}/index.html`, `${label} API`, `The HTTP API of ${label}, endpoint by endpoint.`, sidebar(),
+    `<h1 class="item"><span class="kind">API</span> <span class="name">${esc(label)}</span>${version ? ` <span class="ver">${version}</span>` : ''}</h1>
+${api.intro}
+<h2 id="modules">Modules</h2>
+<dl class="list">${api.groups.map(g => `<dt><a href="${api.root}/${g.id}/">${g.name}</a></dt><dd>${g.summary}</dd>`).join('')}</dl>
+<h2 id="types">Types</h2>
+<dl class="list">${api.types.map(t => `<dt><a class="t" href="${typeHref(t.name)}">${t.name}</a></dt><dd>${t.doc || ''}</dd>`).join('')}</dl>`);
+
+  for (const g of api.groups) {
+    page(`${api.root.slice(1)}/${g.id}/index.html`, `${api.name}::${g.name}`, g.title, sidebar({ group: g }),
+      `${crumbs()}<h1 class="item"><span class="kind">Module</span> ${esc(api.name)}::<span class="name">${g.name}</span></h1>
+<p>${g.summary}</p>
+<h2 id="endpoints">Endpoints</h2>
+<dl class="list">${g.items.map(it => `<dt><a class="${METHOD_CLASS[it.method]}" href="${itemHref(g, it)}"><span class="verb">${it.method}</span> ${esc(it.path)}</a></dt><dd>${it.summary}</dd>`).join('')}</dl>`);
+
+    for (const it of g.items) {
+      const decl = [
+        `<span class="verb ${METHOD_CLASS[it.method]}">${it.method}</span> ${esc(it.path)}`,
+        it.query && `    query  ${ty(it.query)}`,
+        it.body && `    body   ${ty(it.body)}`,
+        `    -&gt;     ${isType(it.returns) ? ty(it.returns) : esc(it.returns)}`,
+      ].filter(Boolean).join('\n');
+      const fieldsOf = n => api.types.find(t => t.name === n)?.fields || [];
+      const rows = list => `<dl class="fields">${list.map(([n, t, d]) => `<dt id="${it.slug}-${n}"><code>${esc(n)}: ${ty(t)}</code></dt><dd>${d || ''}</dd>`).join('')}</dl>`;
+      let body = `${crumbs([`${api.root}/${g.id}/`, g.name])}
+<h1 class="item"><span class="kind">Endpoint</span> ${esc(api.name)}::${g.name}::<span class="name fn">${fnName(it)}</span><a class="srclink" href="${SRC}/${api.name === 'ipx' ? 'crates/ipx/src/web.rs' : 'crates/directory/src/lib.rs'}">Source</a></h1>
+<pre class="decl"><code>${decl}</code></pre>
+<p class="summary">${it.summary}</p>
+${it.doc || ''}
+<p class="access">Access: <b>${esc(access(it))}</b></p>`;
+      if (it.pathParams) body += `<h2>Path parameters</h2>${rows(it.pathParams)}`;
+      if (it.query) body += `<h2>Query</h2><p>${ty(it.query)}, as query parameters:</p>${rows(fieldsOf(it.query))}`;
+      if (it.body) body += `<h2>Body</h2><p>${ty(it.body)}, as JSON.</p>`;
+      body += `<h2>Returns</h2><p>${isType(it.returns) ? `${ty(it.returns)}, as JSON.` : esc(it.returns)}</p>`;
+      if (it.errors?.length) body += `<h2>Errors</h2><dl class="fields">${it.errors.map(([c, d]) => `<dt><code>${esc(c)}</code></dt><dd>${d}</dd>`).join('')}</dl>`;
+      if (it.example) body += `<h2>Example</h2><pre><code>${esc(it.example)}</code></pre>`;
+      page(`${api.root.slice(1)}/${g.id}/${it.slug}.html`, `${it.method} ${it.path} - ${label}`, it.summary.replace(/<[^>]+>/g, ''), sidebar({ group: g, item: it }), body);
+    }
+  }
+
+  page(`${api.root.slice(1)}/types/index.html`, `${api.name}::types`, `The types ${label}'s API takes and gives.`, sidebar(),
+    `${crumbs()}<h1 class="item"><span class="kind">Module</span> ${esc(api.name)}::<span class="name">types</span></h1>
+<dl class="list">${api.types.map(t => `<dt><a class="t" href="${typeHref(t.name)}">${t.name}</a></dt><dd>${t.doc || ''}</dd>`).join('')}</dl>`);
+
+  for (const t of api.types) {
+    const decl = t.name === 'Event'
+      ? `enum Event {\n${t.fields.map(([n, f]) => `    ${n} ${ty(f)},`).join('\n')}\n}`
+      : t.fields.length
+        ? `struct ${t.name} {\n${t.fields.map(([n, f]) => `    ${n}: ${ty(f)},`).join('\n')}\n}`
+        : `enum ${t.name}`;
+    const uses = usedBy.get(t.name) || [];
+    let body = `${crumbs([`${api.root}/types/`, 'types'])}
+<h1 class="item"><span class="kind">${t.name === 'Event' || !t.fields.length ? 'Enum' : 'Struct'}</span> ${esc(api.name)}::types::<span class="name t">${t.name}</span></h1>
+<pre class="decl"><code>${decl}</code></pre>
+${t.doc ? `<p class="summary">${t.doc}</p>` : ''}`;
+    if (t.fields.length) {
+      body += `<h2>${t.name === 'Event' ? 'Variants' : 'Fields'}</h2><dl class="fields">${t.fields.map(([n, f, d]) =>
+        `<dt id="${n}"><a class="anchor" href="#${n}" aria-label="Link to ${esc(n)}">§</a><code>${esc(n)}${t.name === 'Event' ? ' ' : ': '}${ty(f)}</code></dt><dd>${d || ''}</dd>`).join('')}</dl>`;
+    }
+    if (uses.length) {
+      body += `<h2>Used by</h2><ul class="uses">${uses.map(([g, x]) => g
+        ? `<li><a class="${METHOD_CLASS[x.method]}" href="${itemHref(g, x)}"><span class="verb">${x.method}</span> ${esc(x.path)}</a></li>`
+        : `<li><a class="t" href="${typeHref(x.name)}">${x.name}</a></li>`).join('')}</ul>`;
+    }
+    page(`${api.root.slice(1)}/types/${t.name}.html`, `${t.name} - ${label}`, (t.doc || `${t.name} in ${label}'s API`).replace(/<[^>]+>/g, ''), sidebar({ type: t }), body);
+  }
+
+  // Every link to a type must name one there is: a misspelt type in api.mjs is otherwise a
+  // name in plain text, which looks right and leads nowhere.
+  for (const g of api.groups) for (const it of g.items) for (const s of [it.body, it.query].filter(Boolean)) {
+    for (const n of s.match(/\b[A-Z][A-Za-z]+\b/g)) if (!typeNames.has(n) && !['Vec', 'Option'].includes(n)) throw new Error(`${it.path}: no type ${n}`);
+  }
+}
+
+reference(ipx);
+reference(directory);

site/gitea.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 640 640" width="32" height="32"><path d="m395.9 484.2-126.9-61c-12.5-6-17.9-21.2-11.8-33.8l61-126.9c6-12.5 21.2-17.9 33.8-11.8 17.2 8.3 27.1 13 27.1 13l-.1-109.2 16.7-.1.1 117.1s57.4 24.2 83.1 40.1c3.7 2.3 10.2 6.8 12.9 14.4 2.1 6.1 2 13.1-1 19.3l-61 126.9c-6.2 12.7-21.4 18.1-33.9 12" fill="#fff"/><path d="M622.7 149.8c-4.1-4.1-9.6-4-9.6-4s-117.2 6.6-177.9 8c-13.3.3-26.5.6-39.6.7v117.2c-5.5-2.6-11.1-5.3-16.6-7.9 0-36.4-.1-109.2-.1-109.2-29 .4-89.2-2.2-89.2-2.2s-141.4-7.1-156.8-8.5c-9.8-.6-22.5-2.1-39 1.5-8.7 1.8-33.5 7.4-53.8 26.9C-4.9 212.4 6.6 276.2 8 285.8c1.7 11.7 6.9 44.2 31.7 72.5 45.8 56.1 144.4 54.8 144.4 54.8s12.1 28.9 30.6 55.5c25 33.1 50.7 58.9 75.7 62 63 0 188.9-.1 188.9-.1s12 .1 28.3-10.3c14-8.5 26.5-23.4 26.5-23.4S547 483 565 451.5c5.5-9.7 10.1-19.1 14.1-28 0 0 55.2-117.1 55.2-231.1-1.1-34.5-9.6-40.6-11.6-42.6M125.6 353.9c-25.9-8.5-36.9-18.7-36.9-18.7S69.6 321.8 60 295.4c-16.5-44.2-1.4-71.2-1.4-71.2s8.4-22.5 38.5-30c13.8-3.7 31-3.1 31-3.1s7.1 59.4 15.7 94.2c7.2 29.2 24.8 77.7 24.8 77.7s-26.1-3.1-43-9.1m300.3 107.6s-6.1 14.5-19.6 15.4c-5.8.4-10.3-1.2-10.3-1.2s-.3-.1-5.3-2.1l-112.9-55s-10.9-5.7-12.8-15.6c-2.2-8.1 2.7-18.1 2.7-18.1L322 273s4.8-9.7 12.2-13c.6-.3 2.3-1 4.5-1.5 8.1-2.1 18 2.8 18 2.8L467.4 315s12.6 5.7 15.3 16.2c1.9 7.4-.5 14-1.8 17.2-6.3 15.4-55 113.1-55 113.1" fill="#609926"/><path d="M326.8 380.1c-8.2.1-15.4 5.8-17.3 13.8s2 16.3 9.1 20c7.7 4 17.5 1.8 22.7-5.4 5.1-7.1 4.3-16.9-1.8-23.1l24-49.1c1.5.1 3.7.2 6.2-.5 4.1-.9 7.1-3.6 7.1-3.6 4.2 1.8 8.6 3.8 13.2 6.1 4.8 2.4 9.3 4.9 13.4 7.3.9.5 1.8 1.1 2.8 1.9 1.6 1.3 3.4 3.1 4.7 5.5 1.9 5.5-1.9 14.9-1.9 14.9-2.3 7.6-18.4 40.6-18.4 40.6-8.1-.2-15.3 5-17.7 12.5-2.6 8.1 1.1 17.3 8.9 21.3s17.4 1.7 22.5-5.3c5-6.8 4.6-16.3-1.1-22.6 1.9-3.7 3.7-7.4 5.6-11.3 5-10.4 13.5-30.4 13.5-30.4.9-1.7 5.7-10.3 2.7-21.3-2.5-11.4-12.6-16.7-12.6-16.7-12.2-7.9-29.2-15.2-29.2-15.2s0-4.1-1.1-7.1c-1.1-3.1-2.8-5.1-3.9-6.3 4.7-9.7 9.4-19.3 14.1-29-4.1-2-8.1-4-12.2-6.1-4.8 9.8-9.7 19.7-14.5 29.5-6.7-.1-12.9 3.5-16.1 9.4-3.4 6.3-2.7 14.1 1.9 19.8z" fill="#609926"/></svg>

site/guides/cli.html

@@ -0,0 +1,22 @@
+<h1>The command line</h1>
+    <p>The same <code>ipx</code> program that runs the server is its command line. Run it in the container with <code>docker exec ipx ipx …</code>; when the server is running, it does the work and the command shows what happened.</p>
+    <div class="scroll"><table>
+      <thead><tr><th>Command</th><th>What it does</th></tr></thead>
+      <tbody>
+        <tr><td><code>ipx list</code></td><td>Every podcast and its state</td></tr>
+        <tr><td><code>ipx status</code></td><td>How many podcasts, how many files waiting and downloaded</td></tr>
+        <tr><td><code>ipx fetch [id] [--force]</code></td><td>Check everything that is due, or one podcast; <code>--force</code> checks it even if it is not due</td></tr>
+        <tr><td><code>ipx add &lt;url&gt;</code>, <code>ipx rm &lt;id&gt;</code></td><td>Add a podcast, or take it out</td></tr>
+        <tr><td><code>ipx import &lt;file&gt;</code>, <code>ipx export &lt;file&gt;</code></td><td>OPML in or out</td></tr>
+        <tr><td><code>ipx reap [--dry-run]</code></td><td>Clear old files now, to stay within the space you set</td></tr>
+        <tr><td><code>ipx user add|list|passwd|rm</code></td><td>Accounts</td></tr>
+      </tbody>
+    </table></div>
+    <h2>The control socket</h2>
+    <p>A program on the same machine can also talk to the running server over its control socket, one JSON command a line, and read back one event a line:</p>
+<pre><code>printf '{"cmd":"fetch","force":true}\n' | socat - UNIX-CONNECT:$XDG_RUNTIME_DIR/ipx.sock
+{"ev":"feed_start","feed":"atp"}
+{"ev":"download_done","feed":"atp","enclosure":42,"path":"…","bytes":3000000}
+{"ev":"feed_done","feed":"atp","new":1,"downloaded":1,"failed":0,"torrents":0}
+{"ev":"scan_done","feeds":1}</code></pre>
+    <p>The commands are <code>fetch</code> (optional <code>feed</code>, <code>force</code>), <code>download</code> (<code>enclosure</code>), <code>reap</code> (optional <code>dry_run</code>) and <code>status</code>.</p>

site/guides/directory.html

@@ -0,0 +1,32 @@
+<h1>The directory</h1>
+    <p>The directory gathers the public podcasts that iPX servers' listeners follow, and how many follow each. It never holds a file and never learns who listens.</p>
+
+    <h2>Browsing it</h2>
+    <p>Anyone can browse <a href="https://directory.ipxreader.app">directory.ipxreader.app</a> without signing in: the most followed, the categories, everything A to Z, and a page for each podcast with its latest episodes and its address, to subscribe to in any podcast app.</p>
+
+    <h2>Connecting your iPX</h2>
+    <p>In iPX, an admin opens Admin, Directory and enters the directory's address, <code>https://directory.ipxreader.app</code>, and the token its operator gave your server. Everyone on your server then has the Directory at the top of their list, and subscribes from it in one click.</p>
+    <p>Turn on sharing to add your server's podcasts to it. iPX sends only the podcasts' addresses and how many people on your server follow each, never who. It leaves out anything that looks private: a podcast someone marked Private, one with a login or a key in its address, and paid feeds such as Patreon's.</p>
+
+    <h2>Its API</h2>
+    <p>Anything the pages show, a program can read through the directory's API with a token: see the <a href="/docs/api/directory/">ipx-directory API reference</a>.</p>
+
+    <h2>Running your own</h2>
+    <p>The directory is in the same repository. Build it, give it a database (Postgres or SQLite) and a config file, and make a token for each server that will use it:</p>
+<pre><code>docker build -f Dockerfile.directory -t ipx-directory .</code></pre>
+<pre><code>services:
+  ipx-directory:
+    image: ipx-directory
+    container_name: ipx-directory
+    restart: unless-stopped
+    environment:
+      DIRECTORY_DATABASE_URL: "postgres://ipx_directory:password@db-host:5432/ipx_directory"
+    ports:
+      - "8100:8100"
+    volumes:
+      - ./directory:/config:ro   # directory.toml</code></pre>
+<pre><code># directory/directory.toml
+bind = "0.0.0.0:8100"
+database_url_env = "DIRECTORY_DATABASE_URL"</code></pre>
+<pre><code>docker exec ipx-directory ipx-directory token new my-server --access rw</code></pre>
+    <p>That prints the token, to give to the server, and the lines to add to <code>directory.toml</code>, which keeps only its SHA-256. The directory reads the file again within a minute, so adding or revoking a token needs no restart. It checks each podcast every six hours.</p>

site/guides/install.html

@@ -0,0 +1,67 @@
+<h1>Install ipx and ipx-web</h1>
+<p class="lede">iPX is two containers: <strong>ipx</strong>, which checks your podcasts, downloads them and answers the API, and <strong>ipx-web</strong>, which serves the page and passes the API on to ipx.</p>
+    <p>You need Docker with Compose. There are no published images yet, so you build both from the source:</p>
+<pre><code>git clone https://git.sdf1.net/rays/ipx.git
+cd ipx
+docker build -t ipx .
+docker build -f Dockerfile.web -t ipx-web .</code></pre>
+    <p>The repository has a sample <code>docker-compose.yml</code> that runs both, with the database in SQLite and everything ipx keeps in three folders beside the file:</p>
+<pre><code>services:
+  ipx:
+    image: ipx
+    container_name: ipx
+    restart: unless-stopped
+    environment:
+      PUID: "99"          # who owns the files it writes
+      PGID: "100"
+      TZ: "UTC"
+    ports:
+      - "6881:6881/tcp"   # BitTorrent
+      - "6881:6881/udp"
+    volumes:
+      - ./config:/config  # config.toml, written on first start
+      - ./data:/data      # the database
+      - ./downloads:/downloads
+
+  ipx-web:
+    image: ipx-web
+    container_name: ipx-web
+    restart: unless-stopped
+    environment:
+      IPX_UPSTREAM: "ipx:8099"
+    ports:
+      - "8099:8080"       # the page
+    depends_on:
+      - ipx</code></pre>
+<pre><code>docker compose up -d</code></pre>
+    <p>ipx has no port of its own: everything reaches it through ipx-web, on port 8099. Open <code>http://&lt;your server&gt;:8099</code> and sign in as <strong>admin</strong> with the password <strong>ipodderx</strong>, then change it:</p>
+<pre><code>echo -n 'a good password' | docker exec -i ipx ipx user passwd admin</code></pre>
+    <p>The password is read from what you pipe in, so it stays out of your shell's history.</p>
+
+    <h2>Adding people</h2>
+    <p>An admin adds people in Admin, Accounts, or from the command line:</p>
+<pre><code>echo -n 'their password' | docker exec -i ipx ipx user add sam</code></pre>
+    <p>Each person starts with no podcasts and subscribes to their own. Two people subscribing to the same show cost nothing extra: it is fetched once and each file is kept once.</p>
+
+    <h2>Settings</h2>
+    <p>How often podcasts are checked, how much disk to use, how many new episodes to download and the rest are in Admin on the page, and take effect straight away. <code>/config/config.toml</code> holds only what ipx needs before it can read its database: where downloads go, BitTorrent, and who gets in.</p>
+    <div class="scroll"><table>
+      <thead><tr><th>Environment variable</th><th>What it does</th></tr></thead>
+      <tbody>
+        <tr><td><code>IPX_DATABASE_URL</code></td><td>A <code>postgres://user:password@host:5432/database</code> address, to keep everything in Postgres instead of SQLite</td></tr>
+        <tr><td><code>PUID</code>, <code>PGID</code></td><td>The user and group that own the files ipx writes</td></tr>
+        <tr><td><code>IPX_LOG_FORMAT</code></td><td><code>json</code> logs one JSON object a line, for Loki and the like</td></tr>
+        <tr><td><code>OTEL_EXPORTER_OTLP_ENDPOINT</code></td><td>Sends traces of requests, checks and downloads to an OpenTelemetry collector; set <code>WEB_TRACING=on</code> on ipx-web too</td></tr>
+        <tr><td><code>IPX_UPSTREAM</code></td><td>On ipx-web: where ipx is, <code>ipx:8099</code> by default</td></tr>
+      </tbody>
+    </table></div>
+
+    <h2>Reaching it from outside</h2>
+    <p>The page is plain HTTP. If anyone will reach it from outside your network, put HTTPS in front of it: a reverse proxy you already run, or a Cloudflare tunnel. People can then sign in through Cloudflare Access or Authentik instead of a password; <a href="https://git.sdf1.net/rays/ipx/src/branch/main/docs/sso.md">single sign-on</a> says how.</p>
+
+    <h2>Updating</h2>
+<pre><code>git pull
+docker build -t ipx .
+docker build -f Dockerfile.web -t ipx-web .
+docker compose up -d</code></pre>
+    <p>Your podcasts, accounts and downloads are in the three folders and are kept.</p>

site/index.html

@@ -0,0 +1,139 @@
+<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>iPX</title>
+<meta name="description" content="iPX checks your podcasts, downloads new episodes and gives everyone at home an account of their own, on your own server. The successor to iPodderX, free and open source.">
+<meta name="color-scheme" content="light">
+<link rel="icon" href="/favicon.png">
+<link rel="preload" href="/fonts/inter.woff2" as="font" type="font/woff2" crossorigin>
+<link rel="stylesheet" href="/site.css">
+</head>
+<body>
+<header class="bar">
+  <a class="home" href="/"><img src="/logo.svg" alt="" width="36" height="36">iPX</a>
+  <nav aria-label="Elsewhere">
+    <a href="/docs/">Docs</a>
+    <a href="https://directory.ipxreader.app">Directory</a>
+    <a class="src" href="https://git.sdf1.net/rays/ipx" title="Source code on git.sdf1.net"><img src="/gitea.svg" alt="Source code" width="28" height="28"></a>
+  </nav>
+</header>
+
+<main>
+  <section class="hero">
+    <h1>iPX</h1>
+    <p class="intro">iPX checks your podcasts, downloads new episodes, and gives everyone at home their own account to listen from in the browser. It runs on your own server.</p>
+    <p class="acts">
+      <a class="btn primary" href="https://directory.ipxreader.app">Browse the directory</a>
+    </p>
+  </section>
+
+  <!-- The iPodderX logo is a radio's tuning scale and needle. Here the scale is full size and its
+       stations are shows from the directory; the needle sweeps once and settles. -->
+  <figure class="dial" aria-label="A radio dial tuned across shows in the iPX directory">
+    <div class="scale"><div class="track">
+      <ol class="freq" aria-hidden="true">
+        <li>88</li><li>92</li><li>96</li><li>100</li><li>104</li><li>108</li>
+      </ol>
+      <ul class="stations">
+        <li>99% Invisible</li>
+        <li>Hackaday</li>
+        <li>Clarkesworld</li>
+        <li>Accidental Tech Podcast</li>
+        <li>Daring Fireball</li>
+        <li class="tuned">Ologies</li>
+        <li>Oxide and Friends</li>
+        <li>xkcd</li>
+        <li>The Sporkful</li>
+        <li>Acquired</li>
+        <li>Construction Physics</li>
+        <li>Dwarkesh Podcast</li>
+      </ul>
+      <span class="needle" aria-hidden="true"></span>
+    </div></div>
+  </figure>
+
+  <!-- Each feature beside the part of the app that shows it, cut from a scratch iPX on public
+       podcasts, in a navy frame like the dial's. -->
+  <section class="does" aria-labelledby="does">
+    <h2 id="does">What it does</h2>
+
+    <div class="feature">
+      <div class="say">
+        <h3>An account for everyone at home</h3>
+        <p>Each person has their own shows, sees what they have and have not heard, and picks up where they left off.</p>
+      </div>
+      <figure class="frame"><img src="/shots/feeds.webp" width="290" height="276" loading="lazy"
+        alt="The feed list: Directory, Currently Listening and All Subscriptions, then each show with its cover and how many of its episodes are unread."></figure>
+    </div>
+
+    <div class="feature">
+      <div class="say">
+        <h3>New episodes, ready to play</h3>
+        <p>iPX checks your podcasts through the day and downloads new episodes as they come out. Skip the ones you don't want by keyword, or leave out explicit ones. Old episodes are cleared to stay within the space you give it, but never one someone has pinned.</p>
+      </div>
+      <figure class="frame"><img class="cut" src="/shots/episodes.webp" width="904" height="283" loading="lazy"
+        alt="99% Invisible's episodes in a table with each one's size and date, and the downloaded one's file beside it, ready to play, save, share or delete."></figure>
+    </div>
+
+    <div class="feature">
+      <div class="say">
+        <h3>Pick up where you left off</h3>
+        <p>The player keeps your place in every episode, on every device.</p>
+      </div>
+      <figure class="frame"><img class="cut player" src="/shots/player.webp" width="950" height="80" loading="lazy"
+        alt="The player along the bottom of the page: the episode playing, back and forward, and how far in it is."></figure>
+    </div>
+
+    <!-- DeadAir: talk keeps its length, the quiet between it shrinks to a short pause, and the
+         episode ends sooner. CSS only; the page runs no script of its own. -->
+    <div class="feature">
+      <div class="say">
+        <h3>Cut the dead air</h3>
+        <p>Turn on DeadAir for a show and its long silences shrink to a short pause, so episodes finish sooner without anyone talking faster. You choose how long a pause to leave.</p>
+      </div>
+      <figure class="frame deadair" role="img" aria-label="A waveform whose silent gaps shrink to short pauses, so the episode ends sooner.">
+        <div class="wave" aria-hidden="true">
+          <span class="talk t1"></span><span class="hush"></span>
+          <span class="talk t2"></span><span class="hush"></span>
+          <span class="talk t3"></span><span class="hush"></span>
+          <span class="talk t4"></span><span class="hush"></span>
+          <span class="talk t5"></span><span class="hush"></span>
+          <span class="talk t6"></span>
+        </div>
+      </figure>
+    </div>
+
+    <div class="feature">
+      <div class="say">
+        <h3>See what others listen to</h3>
+        <p>iPX servers can share which podcasts their listeners follow, and the directory gathers them in one place. <a href="https://directory.ipxreader.app">Browse the directory</a> to find something new and subscribe in one click.</p>
+      </div>
+      <figure class="frame"><img class="cut half" src="/shots/directory.webp" width="700" height="133" loading="lazy"
+        alt="The directory's most subscribed shows, each with its cover and how many people subscribe."></figure>
+    </div>
+
+    <dl class="also">
+      <div><dt>BitTorrent too</dt>
+        <dd>Some shows publish their episodes as torrents. iPX downloads them like any other, shares them back for as long as you choose, and a slow one never holds up the rest.</dd></div>
+      <div><dt>Subscribe to a whole list</dt>
+        <dd>Some people publish lists of podcasts they recommend, as OPML. Give iPX a list's address and it keeps a folder of those shows up to date as the list changes. Your own subscriptions move in and out the same way.</dd></div>
+      <div><dt>Sign in your way</dt>
+        <dd>Everyone signs in with a password, or with the single sign-on you already use, Cloudflare Access or Authentik. An admin adds people and decides who else is one.</dd></div>
+      <div><dt>Blogs too</dt>
+        <dd>Any RSS or Atom feed works, so the blogs you read sit beside the shows you listen to, and iPX keeps track of what you have read.</dd></div>
+    </dl>
+  </section>
+
+  <section class="then" aria-labelledby="then">
+    <h2 id="then">Since 2004</h2>
+    <p>iPodderX was one of the first podcatchers, a Mac app by Ray Slakinski and August Trometer, from the year podcasts got their name. iPX is that app rebuilt to run on your own server.</p>
+  </section>
+</main>
+
+<footer>
+  <p>iPX is free and open source under the MIT licence.</p>
+</footer>
+</body>
+</html>

site/site.css

@@ -0,0 +1,192 @@
+/* ipxreader.app. The palette is the iPodderX logo's: the radio's navy body, the sky of its
+   screen, the blue of its tuning scale, and the orange needle, which is the needle alone. The
+   typeface is the reader's own, Inter, the same file (web/InterVariable.woff2). */
+@font-face{font-family:Inter;src:url(/fonts/inter.woff2) format("woff2");font-weight:100 900;font-display:swap}
+:root{
+  --navy:#0c2238;     /* the radio */
+  --ink:#16304a;      /* body text, a step off the navy */
+  --muted:#46607a;
+  --sky:#dff0fb;      /* its screen */
+  --page:#f1f8fd;
+  --scale:#2f6aa0;    /* the tuning scale, and links */
+  --tick:#8fc2ea;     /* the scale on the dark dial */
+  --needle:#ff5500;
+  --rule:#c6d9ea;
+}
+*{box-sizing:border-box}
+html{-webkit-text-size-adjust:100%;scroll-behavior:smooth}
+body{margin:0;background:var(--page);color:var(--ink);font:400 1.0625rem/1.6 Inter,system-ui,sans-serif}
+a{color:var(--scale);text-underline-offset:.18em}
+a:focus-visible,.btn:focus-visible{outline:3px solid var(--scale);outline-offset:3px;border-radius:6px}
+main,.bar,footer{max-width:72rem;margin:0 auto;padding-inline:1.5rem}
+
+.bar{display:flex;align-items:center;justify-content:space-between;padding-block:1.25rem}
+.home{display:flex;align-items:center;gap:.6rem;color:var(--navy);text-decoration:none;font-weight:800;font-size:1.25rem}
+.home img{border-radius:9px;display:block}
+.bar nav{display:flex;gap:1.5rem}
+.bar nav a{color:var(--navy);text-decoration:none;font-weight:600}
+.bar nav a:hover{text-decoration:underline}
+.bar nav{align-items:center}
+.src img{display:block}
+
+.hero{padding-block:3rem 2.5rem;max-width:46rem}
+h1{margin:0;color:var(--navy);font-weight:900;font-size:clamp(6.5rem,24vw,15rem);line-height:.82;letter-spacing:-.065em}
+.intro{margin:1.75rem 0 0;max-width:38rem;color:var(--muted);font-size:1.125rem}
+.acts{display:flex;flex-wrap:wrap;gap:.75rem;margin:2rem 0 0}
+.btn{display:inline-block;padding:.8rem 1.35rem;border:2px solid var(--navy);border-radius:999px;color:var(--navy);text-decoration:none;font-weight:700}
+.btn:hover{background:var(--sky)}
+.btn.primary{background:var(--navy);color:#fff}
+.btn.primary:hover{background:#1a3a5c}
+
+/* The dial: a frequency row, minor and major ticks, stations on two staggered rows as a printed
+   dial has them, and the needle, which points down at the scale and lights the station it stops
+   on rather than crossing its name. --at is where it stops: the tuned station's middle. */
+.dial{margin:1rem 0 0}
+.scale{background:var(--navy);border-radius:1.25rem;overflow:hidden}
+.track{position:relative;--at:45.8%}
+.freq{position:relative;list-style:none;margin:0;padding:1.1rem 4% 0;display:flex;justify-content:space-between;color:var(--tick);font-weight:600;font-size:.95rem;font-variant-numeric:tabular-nums}
+.freq li{width:0;display:flex;justify-content:center}  /* each number centred on its tick */
+.freq::after{content:"";position:absolute;left:4%;right:4%;top:2.6rem;height:1.6rem;
+  background:
+    repeating-linear-gradient(90deg,var(--tick) 0 2px,transparent 2px 20%) 0 0/100% 100%,
+    repeating-linear-gradient(90deg,rgba(143,194,234,.55) 0 1px,transparent 1px 2%) 0 100%/100% 45%;
+  background-repeat:no-repeat}
+.stations{list-style:none;margin:2.6rem 0 0;padding:0 1% 1.6rem;display:grid;grid-template-columns:repeat(12,minmax(0,1fr));align-items:start;
+  color:#cfe3f4;font-weight:550;font-size:.84rem;line-height:1.2;letter-spacing:-.01em;text-align:center}
+.stations li{padding-inline:.15rem}
+.stations li:nth-child(even){margin-top:1.7rem}
+.needle{position:absolute;top:2.35rem;height:2.7rem;left:var(--at);width:3px;margin-left:-1.5px;background:var(--needle);border-radius:2px;
+  box-shadow:0 0 0 1px rgba(12,34,56,.6);animation:tune 2.4s cubic-bezier(.3,.7,.3,1) .4s both}
+.stations .tuned{text-decoration:underline 2px transparent;text-underline-offset:.3em;animation:lit .5s ease-out 2.6s both}
+@keyframes tune{0%{left:3%}68%{left:calc(var(--at) + 7%)}86%{left:calc(var(--at) - 1.4%)}100%{left:var(--at)}}
+@keyframes lit{from{color:#cfe3f4}to{color:#fff;font-weight:800;text-decoration-color:var(--needle)}}
+@media (prefers-reduced-motion:reduce){.needle,.stations .tuned{animation-duration:0s;animation-delay:0s}}
+
+h2{margin:0 0 1.5rem;color:var(--navy);font-weight:800;font-size:clamp(1.75rem,4vw,2.4rem);line-height:1.1;letter-spacing:-.02em}
+.does,.then{padding-block:4rem 0}
+/* Each feature on one row: what it does on the left, beside the part of the app that shows it,
+   framed in the dial's navy at no more than its own size. */
+.feature{display:grid;grid-template-columns:minmax(0,22rem) minmax(0,1fr);gap:clamp(1.5rem,5vw,4rem);align-items:center;padding-block:2.5rem}
+.feature h3{margin:0 0 .5rem;color:var(--navy);font-weight:750;font-size:1.35rem;line-height:1.25}
+.feature p{margin:0;max-width:34rem}
+.frame{margin:0;justify-self:start;max-width:100%;padding:clamp(.6rem,1.6vw,1.1rem);background:var(--navy);border-radius:1.1rem}
+.frame img{display:block;max-width:100%;height:auto;border-radius:.55rem}
+/* DeadAir: the track is the episode's full length; talk keeps its width, each silence lights
+   in the needle's orange and shrinks to a pause, and the end comes in from the right. */
+.frame.deadair{justify-self:stretch;width:100%}
+.wave{display:flex;align-items:center;height:4.5rem;border-radius:.55rem;background:rgba(143,194,234,.08)}
+.talk{height:100%;background:url(/wave.svg) 0 50%/auto 100% repeat-x}
+.talk:first-child{border-radius:.55rem 0 0 .55rem}
+.t1{flex:0 0 14%}.t2{flex:0 0 19%}.t3{flex:0 0 9%}.t4{flex:0 0 16%}.t5{flex:0 0 12%}.t6{flex:0 0 10%}
+.hush{flex:0 0 4%;align-self:stretch;background:linear-gradient(var(--tick),var(--tick)) 50%/100% 2px no-repeat;border-radius:.3rem;animation:hush 7s ease-in-out infinite}
+@keyframes hush{
+  0%,14%{flex-basis:4%;background-color:transparent}
+  24%,30%{flex-basis:4%;background-color:rgba(255,85,0,.35)}
+  48%,86%{flex-basis:.8%;background-color:rgba(255,85,0,.35)}
+  100%{flex-basis:4%;background-color:transparent}}
+@media (prefers-reduced-motion:reduce){.hush{animation:none;flex-basis:.8%;background-color:rgba(255,85,0,.35)}}
+.also{margin:2rem 0 0;display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:2.25rem 3.5rem}
+.also dt{color:var(--navy);font-weight:750;font-size:1.2rem;line-height:1.25}
+.also dd{margin:.45rem 0 0;max-width:34rem}
+
+
+/* Docs (#223): a sidebar and a column, as docs.rs lays out a crate. The sidebar is the dial's
+   sky; an endpoint's name is the scale's blue, a type's green, and each method has its own
+   colour, every one AA on the page. Code to read is dark, as on the home page; a declaration is
+   light, as docs.rs shows one. On a phone the sidebar follows the page instead of leading it. */
+.docs{max-width:72rem;margin:0 auto;padding-inline:1.5rem;display:grid;grid-template-columns:15rem minmax(0,1fr);gap:3rem;align-items:start}
+.docs main.doc{max-width:50rem;margin:0;padding:0}
+.side{position:sticky;top:1rem;max-height:calc(100vh - 2rem);overflow:auto;padding:1rem .75rem;background:var(--sky);border-radius:1rem;font-size:.92rem}
+.side ul{list-style:none;margin:0;padding:0}
+.side li a{display:block;padding:.2rem .5rem;border-radius:.4rem;color:var(--ink);text-decoration:none;overflow-wrap:anywhere}
+.side li a:hover{background:#fff}
+.side a[aria-current=page]{background:#fff;font-weight:700}
+.side-h{margin:1.1rem .5rem .35rem;color:var(--muted);font-size:.78rem;font-weight:700;letter-spacing:.06em;text-transform:uppercase}
+.side-h a{color:inherit}
+.side-back{margin:1rem .5rem 0}
+.crate{display:flex;align-items:center;gap:.6rem;padding:.25rem .5rem;color:var(--navy);text-decoration:none}
+.crate img{border-radius:9px}
+.crate b{display:block;font-size:1.1rem}
+.ver{color:var(--muted);font-size:.85rem;font-weight:500}
+.mono,.items a,.uses a,.list dt,.path,.decl,.fields dt,.item .name{font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+.items a,.uses a{font-size:.82rem}
+.items .verb{display:inline-block;min-width:3.6em}
+.verb{font-weight:700}
+.m-get .verb,.verb.m-get{color:#2f6aa0}
+.m-post .verb,.verb.m-post{color:#1d6b44}
+.m-patch .verb,.verb.m-patch{color:#875400}
+.m-delete .verb,.verb.m-delete{color:#b3261e}
+a.t,.item .name.t{color:#1d6b44}
+
+.doc h1{margin:2rem 0 0;color:var(--navy);font-weight:900;font-size:clamp(2.6rem,8vw,4rem);line-height:1;letter-spacing:-.04em}
+.doc h1.item{margin-top:.25rem;font-size:clamp(1.35rem,4vw,1.85rem);font-weight:500;letter-spacing:-.01em;line-height:1.3;overflow-wrap:anywhere}
+.item .kind{font-family:Inter,system-ui,sans-serif;color:var(--muted)}
+.item .name{font-weight:700;color:var(--scale)}
+.srclink{float:right;margin-left:1rem;font:500 .9rem/2.4 Inter,system-ui,sans-serif}
+.path{margin:2rem 0 0;font-size:.9rem;color:var(--muted)}
+.path a{color:inherit}
+.lede{margin:1.5rem 0 0;color:var(--muted);font-size:1.125rem}
+.doc h2{margin:2.5rem 0 .75rem;padding-bottom:.35rem;border-bottom:1px solid var(--rule);font-size:1.35rem;letter-spacing:-.01em}
+.doc p{margin:.75rem 0}
+.summary{font-size:1.06rem}
+.access{color:var(--muted)}
+.access b{color:var(--ink)}
+.doc code{font:500 .9em/1.5 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace}
+.doc :not(pre)>code{padding:.08em .3em;background:var(--sky);border-radius:.3em;overflow-wrap:anywhere}
+.doc dt>code,.doc a>code{background:none;padding:0}
+.doc pre{margin:1rem 0;padding:1rem 1.15rem;background:var(--navy);color:#e6f1fa;border-radius:.8rem;overflow-x:auto}
+.doc pre code{font-size:.85rem}
+.doc pre.decl{background:#fff;color:var(--ink);border:1px solid var(--rule)}
+.decl a{text-decoration:none}
+.scroll{margin:1rem 0;overflow-x:auto}
+.doc table{width:100%;border-collapse:collapse;font-size:.95rem}
+.doc th,.doc td{padding:.55rem .75rem .55rem 0;border-bottom:1px solid var(--rule);text-align:left;vertical-align:top}
+.doc th{color:var(--navy);font-weight:700}
+.doc td:first-child code{white-space:nowrap}
+/* An item table: the name, and the first line of what it is. */
+.list{display:grid;grid-template-columns:minmax(0,max-content) minmax(0,1fr);gap:.4rem 1.5rem;margin:0}
+.list dt{font-size:.88rem;overflow-wrap:anywhere}
+.list dt a{text-decoration:none}
+.list dt a:hover{text-decoration:underline}
+.list dd{margin:0}
+.fields dt{position:relative;margin-top:1rem;font-size:.92rem;overflow-wrap:anywhere}
+.fields dd{margin:.25rem 0 0 1.5rem}
+.anchor{position:absolute;left:-1.1rem;color:var(--muted);text-decoration:none;opacity:0}
+.fields dt:hover .anchor,.anchor:focus-visible{opacity:1}
+.uses{padding-left:1.25rem}
+.cards{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:1rem;margin:2rem 0 0}
+.cards div{padding:1.1rem 1.25rem;background:#fff;border:1px solid var(--rule);border-radius:1rem}
+.cards dt{font-weight:750;font-size:1.1rem}
+.cards dd{margin:.35rem 0 0;color:var(--muted)}
+.bar nav a[aria-current]{text-decoration:underline;text-decoration-color:var(--needle);text-decoration-thickness:2px}
+@media (max-width:800px){
+  .docs{grid-template-columns:minmax(0,1fr);gap:2rem;padding-inline:1rem}
+  .side{position:static;max-height:none;order:2}
+  .srclink{float:none;display:block;margin:0;line-height:1.8}
+  .list{grid-template-columns:minmax(0,1fr);gap:.15rem}
+  .list dd{margin-bottom:.6rem}
+  .cards{grid-template-columns:minmax(0,1fr)}
+}
+
+footer{margin-top:5rem;padding-block:1.75rem 3rem;border-top:1px solid var(--rule);color:var(--muted);font-size:.95rem}
+footer p{margin:0}
+
+@media (max-width:640px){
+  main,.bar,footer{padding-inline:1rem}
+  .bar nav{gap:1rem}
+  .hero{padding-block:1.5rem 2rem}
+  .feature{grid-template-columns:minmax(0,1fr);gap:1.25rem;padding-block:1.75rem}
+  /* A wide crop at this width is too small to read: its left part, larger. */
+  .frame img.cut{width:100%;aspect-ratio:4/3;object-fit:cover;object-position:0 0}
+  .frame img.cut.player{aspect-ratio:2.4/1}
+  .frame img.cut.half{aspect-ratio:2.6/1}  /* the directory's left column */
+  .also{grid-template-columns:minmax(0,1fr);gap:1.75rem}
+  .dial{margin-inline:-1rem}
+  .scale{border-radius:0}
+  /* Six stations, the tuned one third, rather than twelve too narrow to read. */
+  .track{--at:41.7%}
+  .stations{grid-template-columns:repeat(6,minmax(0,1fr));padding-inline:2%}
+  .stations li:nth-child(-n+3),.stations li:nth-child(n+10){display:none}
+  .stations li:nth-child(even){margin-top:0}
+  .stations li:nth-child(odd){margin-top:1.7rem}
+}

site/wave.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="48" height="64" viewBox="0 0 48 64" fill="#8fc2ea"><rect x="1" y="22" width="3" height="20" rx="1.5"/><rect x="7" y="10" width="3" height="44" rx="1.5"/><rect x="13" y="17" width="3" height="30" rx="1.5"/><rect x="19" y="3" width="3" height="58" rx="1.5"/><rect x="25" y="14" width="3" height="36" rx="1.5"/><rect x="31" y="7" width="3" height="50" rx="1.5"/><rect x="37" y="20" width="3" height="24" rx="1.5"/><rect x="43" y="12" width="3" height="40" rx="1.5"/></svg>

tests/dom-stub.js

@@ -47,7 +47,7 @@ function makeContext(html, script, { media = false } = {}) {
   };
 
   const ctx = {
-    document, console,
+    document, console, crypto: require("crypto").webcrypto, performance,
     window: { isSecureContext: false, addEventListener(){} },
     localStorage: { getItem: () => null, setItem(){}, removeItem(){} },
     navigator: { clipboard: undefined, sendBeacon(){}, mediaSession: undefined },
@@ -66,6 +66,7 @@ function makeContext(html, script, { media = false } = {}) {
     EventSource: function () { this.close = () => {}; },
     MediaMetadata: function () {},
     Blob: function () {},
+    getComputedStyle: () => ({ backgroundColor: '' }),
     setTimeout, clearTimeout, setInterval, clearInterval,
     confirm: () => false, prompt: () => null, alert(){},
     Date, Math, JSON, Object, Array, String, Number, Promise, Error, FormData: function(){},

tests/load/run.js

@@ -8,8 +8,7 @@
 // It builds a release binary (debug Argon2 alone takes a second a sign-in, which would measure
 // the build, not ipx), serves generated feeds from this process, starts a daemon on its own
 // config and data under /tmp/ipx-load, wiped first, seeds listeners, then runs each k6 script.
-// While each runs, `ipx status` -- the Docker healthcheck -- is run every second, and the run
+// While each runs, `ipx status` is run every second, and the run fails if any answer takes 5s.
-// fails if any answer takes as long as the healthcheck's 5s timeout.
 //
 // The daemon is on SQLite unless --postgres, which puts it in IPX_TEST_DATABASE_URL, the
 // database the Rust tests use on Postgres too (ipodderx_test on the server production's is on, in

tests/page-smoke.js

@@ -68,6 +68,18 @@ for (const [name, fn] of drive) {
   }
 }
 
+// A trace is one tap's (#219): the same id while requests keep coming, a new one after a quiet
+// minute, so a refresh hours later is not filed under the last tap.
+if (PAGE === 'index.html') {
+  const id = () => ctx.traceparent().split('-')[1];
+  vm.runInContext('Date.now = (n => () => n)(1e12)', ctx);
+  const first = id();
+  vm.runInContext('Date.now = (n => () => n)(1e12 + 30_000)', ctx);
+  if (id() !== first) { console.error('FAIL: a trace ended 30 s into a tap'); process.exit(1); }
+  vm.runInContext('Date.now = (n => () => n)(1e12 + 120_000)', ctx);
+  if (id() === first) { console.error('FAIL: a trace outlived a quiet minute'); process.exit(1); }
+}
+
 // theme.ts keeps the Settings theme controls in step when Settings is open, and looks before it
 // touches them. The admin page has no Settings, so those are the ones it may ask for and not find.
 const OPTIONAL = new Set(['#stheme', '#smode', '#smodefield']);

tests/ui/app.spec.js

@@ -90,15 +90,19 @@ test('each browser keeps its own theme, in a cookie, not on the account', async
   expect(cookie?.value).toBe('flatremix.light');
   expect(patched, 'nothing sent to the account').toBe(false);
 
-  // This browser: the server reads the cookie and draws the page in it from the first frame.
+  // This browser: boot.js reads the cookie in <head> and draws the page in it from the first
-  const res = await page.reload();
+  // frame, before the app's script has run (#203).
-  expect(await res.text()).toContain('data-theme=flatremix data-choice=light data-mode=light');
+  const firstFrame = () => document.documentElement.dataset;
+  await page.reload({ waitUntil: 'commit' });
+  await page.waitForFunction(() => document.body);
+  expect(await page.evaluate(firstFrame)).toMatchObject({ theme: 'flatremix', choice: 'light', mode: 'light' });
 
   // Another browser, the same account: not this one's theme.
   const other = await browser.newContext();
   const p2 = await other.newPage();
-  const res2 = await p2.goto(`/?token=${TOKEN}`);
+  await p2.goto(`/?token=${TOKEN}`);
-  expect(await res2.text()).not.toContain('data-theme=flatremix');
+  await expect(p2.locator('#feedlist')).toBeVisible();
+  expect((await p2.evaluate(firstFrame)).theme).not.toBe('flatremix');
   await other.close();
 });
 
@@ -157,7 +161,7 @@ test('the three panes are there and the item text lands in the bottom one', asyn
   await page.locator('.feed', { hasText: 'Test Show' }).click();
   await expect(page.locator('#list')).toBeVisible();
   await expect(page.locator('#grab')).toBeVisible();   // the draggable divider
-  await expect(page.locator('#detail')).toContainText('Pick an item');
+  await expect(page.locator('#detail .dt')).toHaveCount(0);  // nothing picked, nothing said
 
   await page.locator('.ep', { hasText: 'First Episode' }).click();
   await expect(page.locator('#detail .dt')).toHaveText('First Episode');
@@ -583,8 +587,9 @@ test('a second person has their own feeds and their own read state', async ({ br
   await expect(page.locator('#modalCard')).toContainText('Subscriptions');
   await expect(page.locator('#modalCard')).toContainText('Only an admin changes this');
   await page.locator('#modalCard .cardx').click();
-  await expect(page.locator('#admin')).toHaveCount(0);
+  // The page is the same for everyone now (#203): the link is there, and hidden from anyone /api/me
-  expect(await (await page.request.get('/')).text()).not.toContain('href=/admin');
+  // does not call an admin.
+  await expect(page.locator('#admin')).toBeHidden();
   // Asking for it anyway goes back to the app, and its script is refused.
   await page.goto('/admin');
   await expect(page).toHaveURL(/:8791\/$/);
@@ -821,7 +826,7 @@ test('ipx import subscribes the admin, and ipx export writes the feeds out', asy
   expect(xml).toContain('http://127.0.0.1:8792/two.xml');
 });
 
-test('the Directory lists what everyone here reads, the most subscribed first, but never a private feed', async ({ browser, page }) => {
+test('the Directory lists what servers share, the most subscribed first, but never a private feed', async ({ browser, page }) => {
   const { execFileSync } = require('child_process');
   const setup = require('./global-setup');
   const env = {
@@ -863,11 +868,15 @@ test('the Directory lists what everyone here reads, the most subscribed first, b
   const top = await (await piper.request.get('/api/popular')).json();
   const names = dir.map(p => (p.title || p.id).toLowerCase());
   expect(names).toEqual([...names].sort());
+  // The directory's ids, not this server's: it names a feed by its address (#205).
   const ids = dir.map(p => p.id);
-  expect(ids).not.toContain('test-subscriptions');
+  const titles = dir.map(p => p.title);
-  expect(ids).toEqual(expect.arrayContaining(['grouped-show', 'aardvark-radio']));
+  const byTitle = t => dir.find(p => p.title === t);
+  expect(titles).not.toContain('Test Subscriptions');
+  expect(titles).toEqual(expect.arrayContaining(['Grouped Show', 'Aardvark Radio']));
   expect(top.every(t => ids.includes(t.id))).toBe(true);
-  expect(ids).not.toContain('paid-show');
+  expect(titles).not.toContain('Paid Show');
+  expect(ids).not.toContain('test-show');
   await expect(chart).toHaveCount(top.length);
   await expect(chart.first().locator('.no')).toHaveText('1');
   await expect(piper.locator('#count')).toContainText(`Directory: ${dir.length} feed`);
@@ -875,8 +884,8 @@ test('the Directory lists what everyone here reads, the most subscribed first, b
   // Then the categories, as tiles, each a page of its own.
   const cat = name => piper.locator('#directory .cat', { hasText: new RegExp(`^${name}\\d`) });
   const tiles = piper.locator('#dtiles .tile');
-  expect(dir.find(p => p.id === 'test-show')).toMatchObject({ podcast: true, category: 'Technology' });
+  expect(byTitle('Test Show')).toMatchObject({ podcast: true, category: 'Technology' });
-  expect(dir.find(p => p.id === 'picture-blog')).toMatchObject({ podcast: false });
+  expect(byTitle('Picture Blog')).toMatchObject({ podcast: false });
   await cat('Technology').click();
   await expect(piper.locator('#directory h2')).toHaveText('Technology');
   await expect(tiles).toHaveCount(dir.filter(p => p.category === 'Technology').length);
@@ -927,7 +936,7 @@ test('the Directory lists what everyone here reads, the most subscribed first, b
   await expect(tiles.filter({ hasText: 'Test Show' })).toBeFocused();
   await expect(tiles).toHaveCount(dir.length);
   // Only a listed feed has one, and it carries no file or its address.
-  const preview = await (await piper.request.get('/api/directory/test-show')).text();
+  const preview = await (await piper.request.get(`/api/directory/${byTitle('Test Show').id}`)).text();
   expect(preview).toContain('First Episode');
   expect(JSON.parse(preview).description).toBe('A fixture feed.');
   expect(preview).not.toContain('.mp3');
@@ -948,17 +957,20 @@ test('the Directory lists what everyone here reads, the most subscribed first, b
   await piper.locator('#addFeed').click();
   await expect(piper.locator('#nurl')).toBeVisible();
   await expect(piper.locator('#modalCard .tile, #modalCard .rank')).toHaveCount(0);
+  // Nor a folder: a feed's folder is its title (#201).
+  await expect(piper.locator('#nfolder')).toHaveCount(0);
   await piper.locator('#modalCard button[title="Cancel"]').click();
 
   const row = async () =>
-    (await (await piper.request.get('/api/directory')).json()).find(p => p.id === 'test-show');
+    (await (await piper.request.get('/api/directory')).json()).find(p => p.title === 'Test Show');
   const before = await row();
-  expect(before.subscribed).toBe(false);
+  expect(before).toMatchObject({ subscribed: false, feed: null });
   await tiles.filter({ hasText: 'Test Show' }).locator('button[title="Subscribe"]').click();
   await expect(piper.locator('#feedlist .feed', { hasText: 'Test Show' })).toBeVisible({ timeout: 20_000 });
 
-  // Everyone counts, you included: it stays listed, marked as yours, with one more subscriber.
+  // Everyone counts, you included: it stays listed, marked as yours by the id it has here, with
-  expect(await row()).toMatchObject({ subscribed: true, subscribers: before.subscribers + 1 });
+  // one more subscriber once this server has shared again.
+  await expect.poll(row, { timeout: 20_000 }).toMatchObject({ subscribed: true, feed: 'test-show', subscribers: before.subscribers + 1 });
   expect((await piper.request.get('/api/feeds/test-show/entries')).status()).toBe(200);
   await piper.locator('#feedlist .place', { hasText: 'Directory' }).click();
   await expect(chart.filter({ hasText: 'Test Show' }).locator('[title^="Subscribed"]')).toBeVisible();
@@ -998,19 +1010,20 @@ test('ipx add and rm while the daemon runs reach it, and its next change keeps t
   const setup = require('./global-setup');
   const env = { ...process.env, IPX_CONFIG: `${setup.root}/config/config.toml`, IPX_DATA_DIR: `${setup.root}/data` };
   const ipx = (...args) => execFileSync('./target/debug/ipx', args, { env, encoding: 'utf8' });
-  const listed = async () => (await page.evaluate(() => api('/api/directory'))).map(p => p.id);
+  // By title: the directory names a feed by its address, not by its id here (#205).
+  const listed = async () => (await page.evaluate(() => api('/api/directory'))).map(p => p.title);
   // A change of the daemon's own: it writes the whole catalogue from the copy it holds, which
   // wrote a removed feed back and dropped an added one when that copy was old.
   const daemonWrites = category => page.evaluate(c =>
     api('/api/feeds/picture-blog', { method: 'PATCH', body: JSON.stringify({ category: c }) }), category);
 
   const id = ipx('add', '--list', 'http://127.0.0.1:8792/cli.xml').match(/^added (\S+?),? /m)[1];
-  await expect.poll(listed).toContain(id);
+  await expect.poll(listed, { timeout: 20_000 }).toContain('Command Line Show');
   await daemonWrites('Comedy');
-  expect(await listed()).toContain(id);
+  await expect.poll(listed, { timeout: 20_000 }).toContain('Command Line Show');
 
   ipx('rm', id);
-  await expect.poll(listed).not.toContain(id);
+  await expect.poll(listed, { timeout: 20_000 }).not.toContain('Command Line Show');
   await daemonWrites(null);
   expect(await listed()).not.toContain(id);
 });
@@ -1297,11 +1310,14 @@ test('an API token acts as its owner until it is revoked', async ({ page, reques
 test('an admin can give a blog its Directory category', async ({ page }) => {
   const patch = (id, category) => page.evaluate(([id, category]) =>
     api(`/api/feeds/${id}`, { method: 'PATCH', body: JSON.stringify({ category }) }), [id, category]);
-  const listed = async id => (await page.evaluate(() => api('/api/directory'))).find(p => p.id === id);
+  // By title: the directory names a feed by its address, not by its id here (#205). It hears of
+  // a category given here with this server's next snapshot, sent as soon as one is saved.
+  const listed = async title => (await page.evaluate(() => api('/api/directory'))).find(p => p.title === title);
 
   await patch('picture-blog', 'Visual Arts');
   // Apple's subcategory, under its category, as the Directory browses them (#118).
-  expect(await listed('picture-blog')).toMatchObject({ podcast: false, category: 'Arts', subcategory: 'Visual Arts' });
+  await expect.poll(() => listed('Picture Blog'), { timeout: 20_000 })
+    .toMatchObject({ podcast: false, category: 'Arts', subcategory: 'Visual Arts' });
   // A category's subcategories are on its own page, as Apple's directory has them.
   const pill = name => page.locator('#directory .pills button', { hasText: new RegExp(`^${name}\\d`) });
   await page.locator('#feedlist .place', { hasText: 'Directory' }).click();
@@ -1312,10 +1328,116 @@ test('an admin can give a blog its Directory category', async ({ page }) => {
   await expect(page.locator('#dtiles .tile')).toHaveCount(1);
   // A feed's own iTunes category wins over one given here.
   await patch('test-show', 'Comedy');
-  expect((await listed('test-show')).category).toBe('Technology');
+  expect((await listed('Test Show')).category).toBe('Technology');
 
   for (const id of ['picture-blog', 'test-show']) await patch(id, null);
-  expect((await listed('picture-blog')).category).toBeNull();
+  await expect.poll(async () => (await listed('Picture Blog')).category, { timeout: 20_000 }).toBeNull();
+});
+
+test('the admin page sets up the directory, and a feed marked private leaves it (#205)', async ({ page }) => {
+  const listed = async () => (await page.evaluate(() => api('/api/directory'))).map(p => p.title);
+  await expect.poll(listed, { timeout: 20_000 }).toContain('Multi Show');
+
+  await page.goto('/admin#directory');
+  await expect(page.locator('#durl')).toHaveValue('http://127.0.0.1:8795');
+  // The token is set and never shown: the field is empty, and says so.
+  await expect(page.locator('#dtoken')).toHaveValue('');
+  await expect(page.locator('#dtoken')).toHaveAttribute('placeholder', /^Set\./);
+  const settings = await page.evaluate(() => api('/api/settings'));
+  expect(settings.directory_token_set).toBe(true);
+  expect(JSON.stringify(settings)).not.toContain('ipxd_');
+  await expect(page.locator('#dstatus')).toContainText('Connected as test, which may browse, share and administer the directory.');
+  await expect(page.locator('#dstatus')).toContainText(/Shared \d+ feeds? at/);
+
+  // A wrong token says so, in words.
+  await page.locator('#dtoken').fill('not-the-token');
+  await page.locator('#dsave').click();
+  await expect(page.locator('#dstatus')).toContainText('does not accept this server');
+  await page.locator('#dtoken').fill(require('./global-setup').DIRECTORY_TOKEN);
+  await page.locator('#dsave').click();
+  await expect(page.locator('#dstatus')).toContainText('Connected as test');
+
+  // Marked private in its settings, a feed is out of the directory with the next snapshot.
+  await page.goto('/');
+  await page.locator('.feed', { hasText: 'Multi Show' }).click();
+  await page.locator('#content .acts [data-a="settings"]').click();
+  const priv = page.locator('#sprivate');
+  await expect(priv).not.toBeChecked();
+  await priv.check({ force: true });
+  await page.locator('#ssave').click();
+  await expect.poll(listed, { timeout: 20_000 }).not.toContain('Multi Show');
+  // Its address shows nothing, so only the mark keeps it out; and an admin can take it off.
+  const row = await page.evaluate(() => api('/api/feeds')).then(fs => fs.find(f => f.id === 'multi-show'));
+  expect(row).toMatchObject({ private: true, private_by_address: false });
+  await page.evaluate(() => api('/api/feeds/multi-show', { method: 'PATCH', body: JSON.stringify({ private: false }) }));
+  await expect.poll(listed, { timeout: 20_000 }).toContain('Multi Show');
+  // A feed whose address carries a key is private whatever it is marked.
+  const paid = await page.evaluate(() => api('/api/feeds')).then(fs => fs.find(f => f.id === 'paid-show'));
+  if (paid) expect(paid.private_by_address).toBe(true);
+});
+
+test('an admin removes a feed from the directory, and unblocks it (#206)', async ({ page, browser }) => {
+  const all = () => page.evaluate(() => api('/api/directory'));
+  const listed = async () => (await all()).map(p => p.title);
+  await expect.poll(listed, { timeout: 20_000 }).toContain('Aardvark Radio');
+  const id = (await all()).find(p => p.title === 'Aardvark Radio').id;
+
+  // Someone who is not an admin is neither offered it nor allowed it.
+  const { execFileSync } = require('child_process');
+  const setup = require('./global-setup');
+  const env = { ...process.env, IPX_CONFIG: `${setup.root}/config/config.toml`, IPX_DATA_DIR: `${setup.root}/data` };
+  try {
+    execFileSync('./target/debug/ipx', ['user', 'add', 'piper'], { input: 'piperpassword', env });
+  } catch (e) {
+    if (!String(e.stderr || e.stdout).includes('already exists')) throw e;
+  }
+  const ctx = await browser.newContext();
+  const piper = await ctx.newPage();
+  await piper.goto('/login');
+  await piper.locator('#name').fill('piper');
+  await piper.locator('#pw').fill('piperpassword');
+  await piper.locator('button[type=submit]').click();
+  await expect(piper.locator('#feedlist')).toBeVisible();
+  expect((await (await piper.request.get(`/api/directory/${id}`)).json()).can_admin).toBe(false);
+  expect((await piper.request.delete(`/api/directory/${id}`)).status()).toBe(403);
+  expect((await piper.request.post(`/api/directory/${id}/refresh`)).status()).toBe(403);
+  expect((await piper.request.get('/api/directory-admin')).status()).toBe(403);
+  expect((await piper.request.delete('/api/directory-instances/test')).status()).toBe(403);
+
+  // Made an admin, and subscribed to none of it, piper opens its page and is offered both. The
+  // admin here subscribes to every fixture, so their tiles open their own feeds instead.
+  const users = await page.evaluate(() => api('/api/users'));
+  const pid = users.find(u => u.name === 'piper').id;
+  const setAdmin = admin => page.evaluate(([id, admin]) => api(`/api/users/${id}`, { method: 'PATCH', body: JSON.stringify({ admin }) }), [pid, admin]);
+  await setAdmin(true);
+  try {
+    await piper.goto('/');
+    await piper.locator('#feedlist .place', { hasText: 'Directory' }).click();
+    await piper.locator('#epSearch').fill('aardvark');
+    await piper.locator('#dtiles .tile', { hasText: 'Aardvark Radio' }).locator('.txt').click();
+    await expect(piper.locator('.show h2')).toHaveText('Aardvark Radio');
+    await piper.locator('.show [data-a="drefresh"]').click();
+    await expect(piper.locator('.toast', { hasText: 'Checked' })).toBeVisible();
+    await expect(piper.locator('.show [data-a="dremove"]')).toHaveCount(1);
+    piper.once('dialog', d => d.accept());
+    await piper.locator('.show [data-a="dremove"]').click();
+    await expect(piper.locator('.show h2')).toHaveCount(0);
+    expect(await listed()).not.toContain('Aardvark Radio');
+  } finally {
+    await setAdmin(false);
+    await ctx.close();
+  }
+
+  // Admin, Directory lists the servers sharing and what is blocked, by title, never its address.
+  await page.goto('/admin#directory');
+  await expect(page.locator('#dadmin .urow[data-name="test"]')).toContainText(/\d+ feeds? · \d+ subscribers?/);
+  const blocked = page.locator('#dadmin .urow[data-id]', { hasText: 'Aardvark Radio' });
+  await expect(blocked).toBeVisible();
+  expect(JSON.stringify(await page.evaluate(() => api('/api/directory-admin')))).not.toMatch(/https?:/);
+  // Unblocked, it is back with the snapshot ipx sends straight away, unchanged as it is.
+  await blocked.locator('[data-a="unblock"]').click();
+  await expect(blocked).toHaveCount(0);
+  await expect.poll(listed, { timeout: 20_000 }).toContain('Aardvark Radio');
 });
 
 test('the pinned heading sits over its pins, and the page is set in Inter', async ({ page }) => {
@@ -1386,6 +1508,8 @@ test('/api/status gives a dashboard the counts, with the shared token as a cooki
   const s = await r.json();
   for (const k of ['feeds', 'pending', 'downloaded']) expect(typeof s[k], k).toBe('number');
   expect(s.version).toMatch(/^\d+\.\d+\.\d+/);
+  // The logo names ipx's version and the page's, each its own (#207).
+  await expect(page.locator('#applogo')).toHaveAttribute('title', new RegExp(`^iPX ${s.version}, page \\d+\\.\\d+\\.\\d+`));
   const none = await page.request.get('/api/status', { headers: { cookie: '' } });
   expect(none.status()).toBe(401);
 });
@@ -1429,15 +1553,17 @@ test('a failing feed is marked on its artwork and says why', async ({ page }) =>
 test.describe('touch gestures on a phone', () => {
   test.use({ viewport: { width: 390, height: 844 }, hasTouch: true, isMobile: true });
 
-  // Playwright's touchscreen only taps; a drag goes through the DevTools protocol.
+  // Playwright's touchscreen only taps; a drag goes through the DevTools protocol. Sent all at
+  // once, in order: awaited one by one, a busy machine stretched a drag past the 800 ms a swipe
+  // has, and it was taken for a slow drag and went nowhere (#184).
   async function drag(page, from, to, lift = true) {
     const cdp = await page.context().newCDPSession(page);
-    const steps = 8;
+    const steps = 8, touch = (type, touchPoints) => cdp.send('Input.dispatchTouchEvent', { type, touchPoints });
-    await cdp.send('Input.dispatchTouchEvent', { type: 'touchStart', touchPoints: [from] });
+    const sent = [touch('touchStart', [from])];
     for (let i = 1; i <= steps; i++)
-      await cdp.send('Input.dispatchTouchEvent', { type: 'touchMove', touchPoints: [{
+      sent.push(touch('touchMove', [{ x: from.x + (to.x - from.x) * i / steps, y: from.y + (to.y - from.y) * i / steps }]));
-        x: from.x + (to.x - from.x) * i / steps, y: from.y + (to.y - from.y) * i / steps }] });
+    if (lift) sent.push(touch('touchEnd', []));
-    if (lift) await cdp.send('Input.dispatchTouchEvent', { type: 'touchEnd', touchPoints: [] });
+    await Promise.all(sent);
     return cdp;
   }
 
@@ -1656,3 +1782,183 @@ test('a refresh button turns while what it checks is being checked', async ({ pa
   await page.evaluate(() => setScanning('multi-show', false));
   expect(await spin('#scanAll .i')).toBe('none');
 });
+
+test.describe('on a narrow phone', () => {
+  test.use({ viewport: { width: 360, height: 760 } });
+
+  test("a feed's buttons stay on one row, and the bar round the island is the page's colour", async ({ page }) => {
+    // Seven 44px buttons did not fit 360px, and Unsubscribe went onto a row of its own (#146).
+    await page.locator('#burger').click();
+    await page.locator('.feed', { hasText: 'Test Show' }).first().click();
+    const tops = await page.locator('#content .acts .btn').evaluateAll(bs => bs.map(b => b.getBoundingClientRect().top));
+    expect(tops.length).toBe(7);
+    expect(new Set(tops).size).toBe(1);
+    // iOS 26 paints behind the status bar and the Dynamic Island in the colour of a sticky bar at
+    // the top edge, older ones in theme-color: both the top bar's, which is the page's (#147).
+    const bar = await page.locator('#topbar').evaluate(b => [getComputedStyle(b).position, b.getBoundingClientRect().top, getComputedStyle(b).backgroundColor]);
+    expect(bar.slice(0, 2)).toEqual(['sticky', 0]);
+    expect(bar[2]).toBe(await page.evaluate(() => getComputedStyle(document.body).backgroundColor));
+    expect(await page.evaluate(() => document.querySelector('meta[name=theme-color]').content)).toBe(bar[2]);
+    // Glass's bar is see-through on a desktop, which no flat strip can match: solid on a phone.
+    for (const mode of ['dark', 'light']) {
+      const [c, tc] = await page.evaluate(m => { setTheme('glass', m);
+        return [getComputedStyle(document.querySelector('#topbar')).backgroundColor, document.querySelector('meta[name=theme-color]').content]; }, mode);
+      expect(c).toMatch(/^rgb\(/);
+      expect(tc).toBe(c);
+    }
+    await page.evaluate(() => setTheme('modern', 'dark'));
+  });
+});
+
+test('a page brought back into view catches up with what was read elsewhere', async ({ page }) => {
+  // Reading an item tells no other page, and a phone's page misses everything while it is in the
+  // background: All Subscriptions went on counting an item read elsewhere as unread (#168).
+  const badge = page.locator('.place[data-id=":all"] .badge');
+  const [one] = (await (await page.request.get('/api/entries?limit=1')).json()).entries;
+  const flag = read => page.request.post(`/api/entries/${encodeURIComponent(one.feed_id)}/${encodeURIComponent(one.guid)}/flags`, { data: { read } });
+  await flag(false);
+  await page.reload();
+  const before = Number(await badge.textContent());
+  expect(before).toBeGreaterThan(0);
+  await flag(true);                                     // read on another device
+  await page.evaluate(() => {
+    Object.defineProperty(document, 'hidden', { configurable: true, get: () => false });
+    document.dispatchEvent(new Event('visibilitychange'));
+  });
+  await expect(badge).toHaveText(String(before - 1));
+});
+
+test('a feed\'s settings say what downloads, take words as chips, and keep what is saved', async ({ page }) => {
+  // The redesigned dialog (#167): the download choice, word chips, the fold, and a save that holds.
+  const open = async () => {
+    await page.locator('#feedlist .feed', { hasText: 'Test Show' }).first().click();
+    await page.locator('#content .acts [data-a="settings"]').click();
+    await expect(page.locator('#modalCard.fset')).toBeVisible();
+  };
+  await open();
+  // The strip is the feed's own items, and Newest 5 lights every one of its two.
+  await expect(page.locator('#sepwin i')).toHaveCount(2);
+  await page.locator('.seg label', { hasText: 'Newest' }).click();
+  await page.locator('#smax').fill('5');
+  await expect(page.locator('#sepwin i.on')).toHaveCount(2);
+  await expect(page.locator('#swcap')).toContainText('Downloads the newest');
+  // Words become chips with Enter or a comma, and come off with their x.
+  await page.locator('#skwin').fill('first, second');
+  await page.locator('#skwin').press('Enter');
+  await expect(page.locator('#skw .chip')).toHaveCount(2);
+  await page.locator('#skw .chip', { hasText: 'second' }).locator('.chipx').click();
+  await expect(page.locator('#skw .chip')).toHaveCount(1);
+  await page.locator('#sblockin').fill('spoiler');
+  await page.locator('#sblockin').press('Enter');
+  // What only automatic downloads use folds away with them.
+  await page.locator('.switch', { hasText: 'Download automatically' }).click();
+  await expect(page.locator('#sdeps')).toHaveClass(/\boff\b/);
+  await page.locator('.switch', { hasText: 'Download automatically' }).click();
+  await expect(page.locator('#sdeps')).not.toHaveClass(/\boff\b/);
+  await page.locator('#ssave').click();
+  await expect(page.locator('#modal.on')).toBeHidden();
+
+  // Saved: open again and it is all there.
+  await open();
+  await expect(page.locator('[name=swin][value=newest]')).toBeChecked();
+  await expect(page.locator('#smax')).toHaveValue('5');
+  await expect(page.locator('#skw .chip')).toHaveText(['first']);
+  await expect(page.locator('#sblock .chip')).toHaveText(['spoiler']);
+
+  // Back as it was, for the tests after this one.
+  await page.locator('.seg label', { hasText: 'Default' }).click();
+  await page.locator('#skw .chipx').click();
+  await page.locator('#sblock .chipx').click();
+  await page.locator('#ssave').click();
+  await expect(page.locator('#modal.on')).toBeHidden();
+  await open();
+  await expect(page.locator('[name=swin][value=default]')).toBeChecked();
+  await expect(page.locator('#skw .chip, #sblock .chip')).toHaveCount(0);
+  await page.keyboard.press('Escape');
+});
+
+test('DeadAir is off until turned on for a show, then plays it shortened, with your pause, and switches back', async ({ page }) => {
+  // #171/#172. A show of its own, with real audio, added here and left at the end.
+  const { id } = await (await page.request.post('/api/feeds', { data: { url: 'http://127.0.0.1:8792/quiet.xml' } })).json();
+  const entry = async () => {
+    const r = await page.request.get(`/api/feeds/${encodeURIComponent(id)}/entries`);
+    return (await r.json()).entries?.[0];
+  };
+  await expect.poll(async () => (await entry())?.guid, { timeout: 15_000 }).toBe('quiet-1');
+  await page.request.post(`/api/feeds/${encodeURIComponent(id)}/download-latest`, { data: { count: 1 } });
+  await expect.poll(async () => !!(await entry())?.enclosures[0]?.path, { timeout: 15_000 }).toBe(true);
+  // Off for a show until someone turns it on: nothing is cut.
+  expect((await entry()).enclosures[0].deadair).toBeUndefined();
+  await page.reload();
+
+  // On, in the show's settings.
+  await page.locator('#feedlist .feed', { hasText: 'Quiet Show' }).first().click();
+  await page.locator('#content .acts [data-a="settings"]').click();
+  const sw = page.locator('#sdead');
+  await expect(sw).not.toBeChecked();
+  await sw.locator('xpath=..').click();
+  await page.locator('#ssave').click();
+  // Found at once, not at the next pass, and the row says so when it is done without a reload:
+  // "Cutting dead air…" until then, then about 1.7 s off each of four 2 s silences.
+  const row = page.locator('.ep', { hasText: 'Pauses Between' });
+  await expect(row).toContainText('s shorter', { timeout: 20_000 });
+  expect((await entry()).enclosures[0].deadair).toBeGreaterThan(5);
+  await expect(row).not.toContainText('Cutting dead air');
+
+  // A longer pause of your own (#182) saves less.
+  const usual = (await entry()).enclosures[0].deadair;
+  await page.locator('#content .acts [data-a="settings"]').click();
+  await expect(page.locator('#sdpause')).toHaveValue('300');
+  await page.locator('#sdpause').fill('500');
+  await page.locator('#ssave').click();
+  await expect.poll(async () => (await entry()).enclosures[0].deadair).toBeLessThan(usual);
+
+  // Saved without its dead air too (#186): smaller than the original, named to say so.
+  const saved = await page.evaluate(async id => {
+    const [d, o, p] = await Promise.all([fetch(`/media/${id}/deadair`), fetch(`/media/${id}`), fetch(`/media/${id}/deadair.mp3`, { headers: { Range: 'bytes=0-99' } })]);
+    return { status: d.status, name: d.headers.get('content-disposition'), size: (await d.arrayBuffer()).byteLength, full: (await o.arrayBuffer()).byteLength,
+      // Kept out of shared caches, or Cloudflare serves its own copy to anyone (#189).
+      caching: [d, o, p].map(r => r.headers.get('cache-control')), piece: p.status };
+  }, (await entry()).enclosures[0].id);
+  expect(saved.status).toBe(200);
+  expect(saved.name).toContain('DeadAir');
+  expect(saved.size).toBeLessThan(saved.full);
+  expect(saved.caching).toEqual(['private', 'private', 'private']);
+  expect(saved.piece).toBe(206);
+
+  // Played through DeadAir's playlist (#181), by hls.js in Chromium, with the switch beside the
+  // speed pressed. The element's own src is then hls.js's blob: address.
+  // How long it took to start goes to the server's log, under the trace of the tap (#190).
+  const started = page.waitForRequest(r => r.url().endsWith('/api/client') && r.postDataJSON()?.ev === 'play_start');
+  const piece = page.waitForRequest(r => r.url().endsWith('/deadair.mp3'));
+  await row.locator('[data-a=play]').click();
+  await expect.poll(() => page.evaluate(() => player.src)).toMatch(/\/deadair\.m3u8$/);
+  const report = await started;
+  expect(report.postDataJSON()).toMatchObject({ deadair: true });
+  expect(report.postDataJSON().ms).toBeGreaterThan(0);
+  expect(report.headers().traceparent).toMatch(/^00-[0-9a-f]{32}-[0-9a-f]{16}-01$/);
+  // hls.js's own requests carry the same trace as the tap that played them (#192).
+  const traceOf = h => h.traceparent?.split('-')[1];
+  expect(traceOf((await piece).headers())).toBe(traceOf(report.headers()));
+  await expect.poll(() => page.evaluate(() => document.querySelector('#audio').currentTime), { timeout: 15_000 }).toBeGreaterThan(0.5);
+  await expect(page.locator('#pdead')).toHaveAttribute('aria-pressed', 'true');
+  // Off from the player: the original, from the same place.
+  await page.locator('#pdead').click();
+  await expect(page.locator('#pdead')).toHaveAttribute('aria-pressed', 'false');
+  await expect.poll(() => page.evaluate(() => document.querySelector('#audio').getAttribute('src'))).toMatch(/\/media\/\d+$/);
+  expect((await entry()).enclosures[0].deadair).toBeUndefined();
+
+  await page.locator('#pclose').click();
+  await page.request.delete(`/api/feeds/${encodeURIComponent(id)}`);
+});
+
+test('a downloaded file\'s buttons sit on one row in the files pane', async ({ page }) => {
+  await page.setViewportSize({ width: 1280, height: 800 });
+  await page.locator('#feedlist .feed', { hasText: 'Test Show' }).first().click();
+  await expect(page.locator('.ep').first()).toBeVisible();
+  await page.evaluate(() => showDetail(S.entries.find(e => e.enclosures.some(x => x.path))));
+  const box = page.locator('#files .encbox').first();
+  await expect(box.locator('.btn')).toHaveCount(4);
+  const tops = await box.locator('.btn').evaluateAll(bs => bs.map(b => Math.round(b.getBoundingClientRect().top)));
+  expect(new Set(tops).size, 'play, save, share and delete wrapped onto two rows').toBe(1);
+});

tests/ui/fixtures/quiet.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<rss version="2.0" xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd">
+<channel><title>Quiet Show</title><link>http://127.0.0.1:8792/</link><description>Real audio with long silences, for DeadAir.</description>
+<item><title>Pauses Between</title><guid>quiet-1</guid>
+  <pubDate>Mon, 15 Sep 2026 10:00:00 +0000</pubDate>
+  <description>A second of tone, then two of silence, five times.</description>
+  <enclosure url="http://127.0.0.1:8792/quiet.mp3" length="60518" type="audio/mpeg"/></item>
+</channel></rss>

tests/ui/global-setup.js

@@ -6,6 +6,9 @@ const os = require('os');
 
 const root = path.join(os.tmpdir(), 'ipx-ui-test');
 const TOKEN = 'testtokentesttokentesttoken12345';   // fixed, so tests need not scrape a log
+// The suite's own directory service (#205), and this daemon's token for it, which may do anything.
+const DIRECTORY = 'http://127.0.0.1:8795';
+const DIRECTORY_TOKEN = 'ipxd_testdirectorytoken';
 
 // Called from playwright.config.js at load time, NOT as globalSetup: Playwright starts
 // webServer *before* globalSetup, so a config written there does not exist yet when the
@@ -29,13 +32,17 @@ download_dir = "${path.join(root, 'downloads')}"
 socket = "${path.join(root, 'ipx.sock')}"
 schedule = "every 60m"
 max_new_per_check = 1
+directory_url = "${DIRECTORY}"
+directory_token = "${DIRECTORY_TOKEN}"
+directory_share = true
 
 [torrent]
 enabled = false
 
 [web]
 enabled = true
-bind = "127.0.0.1:8791"
+# Behind Caddy, which serves the pages on 8791 and passes the API here (#203).
+bind = "127.0.0.1:8796"
 token = "${TOKEN}"
 # The proxy path, for tests that send the header themselves: the daemon sees them at 127.0.0.1.
 trusted_header = "X-Test-User"
@@ -64,7 +71,16 @@ auto_download = false
 [feeds.paid-show]
 url = "http://127.0.0.1:8792/paid.xml?auth=secret123"
 auto_download = false
+`);
+  fs.writeFileSync(path.join(root, 'directory.toml'), `
+bind = "127.0.0.1:8795"
+database_url_env = "DIRECTORY_DATABASE_URL"
+
+[[tokens]]
+name = "test"
+access = "rwa"
+token_sha256 = "${require('crypto').createHash('sha256').update(DIRECTORY_TOKEN).digest('hex')}"
 `);
 }
 
-module.exports = { prepare, root, TOKEN };
+module.exports = { prepare, root, TOKEN, DIRECTORY, DIRECTORY_TOKEN };

web/CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog: ipx-web
+
+The page, and the container that serves it (Caddy). ipx's changelog is
+[crates/ipx/CHANGELOG.md](../crates/ipx/CHANGELOG.md), which was the page's too until 0.12.0, and the
+directory's [crates/directory/CHANGELOG.md](../crates/directory/CHANGELOG.md).
+
+Its version is in `package.json`, and a release is tagged `web-vX.Y.Z`.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [1.0.1] - 2026-10-13
+
+### Fixed
+
+- A live update or a list refresh that fails because the network is gone (a laptop asleep) is no longer reported as an error, an error page from Cloudflare no longer becomes a request's message, and requests a minute or more after a tap start a trace of their own instead of joining that tap's (#219).
+
+## [1.0.0] - 2026-10-12
+
+### Added
+
+- With a directory token that may administer it, an admin has Check now and Remove from the directory on a Directory feed's page, and Servers and Blocked lists in Admin, Directory (#206).
+- The page has a version of its own, which the logo's tooltip shows beside ipx's (#207).
+- The page is served by its own container, ipx-web (Caddy), which passes the API to ipx on the same address, so a change to the page deploys without rebuilding ipx (#203).
+- Admin, Directory sets the directory's address and this server's token, and whether to share, and says how the last share went (#205).
+- A feed's settings have a Private switch, which keeps it out of the directory; on and locked for a feed whose address or login shows it is private (#205).
+- ipx-web logs one line a request, without the request's headers or a sign-in token in the address (#210).
+- ipx-web sends a trace span for each request when `WEB_TRACING=on`, continuing the page's trace into ipx (#213).
+
+### Changed
+
+- The Directory says when no directory is set up, and its counts are of everyone on every sharing server (#205).
+- Add a feed no longer asks for a folder; a feed's folder is its title (#201).
+
+### Fixed
+
+- On a phone, the Subscribe button on a Directory feed's page is full size again, not squashed to a sliver (#212).
+
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/web-v1.0.1...main
+[1.0.1]: https://git.sdf1.net/rays/ipx/compare/web-v1.0.0...web-v1.0.1
+[1.0.0]: https://git.sdf1.net/rays/ipx/releases/tag/web-v1.0.0

web/Caddyfile

@@ -0,0 +1,119 @@
+# ipx-web (#203): the frontend as static files, and everything else passed to ipx, on one origin,
+# so the session cookie, live updates and Cloudflare Access work as they did when ipx served it.
+#   IPX_UPSTREAM  where ipx is, host:port            (ipx:8099)
+#   WEB_BIND      where to listen                    (:8080)
+#   WEB_TRACING   on: a span for each request to OpenTelemetry (OTEL_EXPORTER_OTLP_ENDPOINT,
+#                 OTEL_EXPORTER_OTLP_PROTOCOL, OTEL_SERVICE_NAME), continuing the page's traceparent
+#                 and passing it to ipx, so one trace runs browser, Caddy, ipx (#213). Off: none,
+#                 and no export failing every few seconds where there is nothing to send to.
+#   TUNNEL_PEER   the one address whose Cf-Access-* headers are passed on: where cloudflared's
+#                 requests come from. Nobody else's are, so nobody else can claim to be signed in
+#                 by Cloudflare. Unset passes none.
+{
+	admin off
+	auto_https off
+	# Everything else Caddy logs, its errors among them, which carry the request too: the same
+	# filter as the access log's below.
+	log default {
+		output stderr
+		format filter {
+			wrap json
+			fields {
+				request>uri query {
+					delete token
+				}
+				request>headers delete
+			}
+		}
+	}
+}
+
+(tracing-on) {
+	tracing {
+		span ipx-web
+	}
+}
+(tracing-off) {
+}
+
+http://{$WEB_BIND::8080} {
+	import tracing-{$WEB_TRACING:off}
+
+	root * {$WEB_ROOT:/srv}
+
+	# One JSON line a request on stdout, for Loki and the dashboard's Page row (#210). Not the
+	# shared token a ?token= link carries, nor the request's headers, which hold the session
+	# cookie and Cloudflare Access's token.
+	log {
+		output stdout
+		format filter {
+			wrap json
+			fields {
+				request>uri query {
+					delete token
+				}
+				request>headers delete
+			}
+		}
+	}
+
+	# Before anything else, so no page or API call sees them: only ipx sets these.
+	@forged not remote_ip {$TUNNEL_PEER:255.255.255.255}
+	request_header @forged -Cf-Access-Authenticated-User-Email
+	request_header @forged -Cf-Access-Jwt-Assertion
+
+	@api path /api/* /media/*
+	handle @api {
+		# Live updates are a stream: flushed as they come, never buffered.
+		reverse_proxy {$IPX_UPSTREAM:ipx:8099} {
+			flush_interval -1
+		}
+	}
+
+	# Signing in with the shared token in the address (?token=): ipx sets the session cookie and
+	# sends the browser on to the page without it.
+	@tokened {
+		path / /admin
+		query token=*
+	}
+	handle @tokened {
+		rewrite * /api/signin?{query}
+		reverse_proxy {$IPX_UPSTREAM:ipx:8099}
+	}
+
+	# The app and the admin page go to whoever ipx says may have them: a browser not signed in is
+	# sent to /login, anyone but an admin asking for /admin to the app.
+	@page path / /index.html /admin /admin.html /admin.js
+	handle @page {
+		forward_auth {$IPX_UPSTREAM:ipx:8099} {
+			uri /api/page-check
+		}
+		rewrite / /index.html
+		rewrite /admin /admin.html
+		header Cache-Control no-cache
+		file_server
+	}
+
+	# The sign-in form, except for someone Cloudflare Access vouches for, who is sent to the app.
+	@login path /login /login.html
+	handle @login {
+		forward_auth {$IPX_UPSTREAM:ipx:8099} {
+			uri /api/login-check
+		}
+		rewrite * /login.html
+		header Cache-Control no-cache
+		file_server
+	}
+
+	# Scripts and the stylesheet are named by a hash of their contents (web/build.mjs), so a browser
+	# keeps them a year; the icons a day, under names that do not change.
+	@hashed path /app.js /admin.js /login.js /app.css /hls.js /boot.js
+	header @hashed Cache-Control "public, max-age=31536000, immutable"
+	# The same PNG as /favicon.png, for a browser that asks for /favicon.ico on its own.
+	header /favicon.ico Content-Type image/png
+	@icons path *.png *.svg *.ico *.woff2
+	header @icons Cache-Control "public, max-age=86400"
+	handle {
+		file_server
+	}
+}

web/admin.html

@@ -4,27 +4,31 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="color-scheme" content="dark light">
+<meta name="theme-color" content="#0a1726">
 <title>iPX admin</title>
 <link rel="icon" type="image/png" sizes="128x128" id="favicon" href="/favicon.png" data-light="/favicon.png" data-dark="/favicon-dark.png">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
 <link rel="stylesheet" data-src="app.css">
+<script src="/boot.js"></script>
 </head>
 <body class="adminpage">
-<!-- The server sends this page, and its script, to admins only. -->
+<!-- Caddy sends this page, and its script, to admins only: it asks ipx first (/api/page-check). -->
 <header id="topbar">
   <a class="btn ico" href="/" title="Back to iPX" aria-label="Back to iPX" data-icon="left"></a>
-  <img class="logo onlight" src="/logo.svg" alt="" width="26"><img class="logo ondark" src="/logo-dark.svg" alt="" width="26">
+  <img class="logo onlight" src="/logo.svg" alt="" width="26"><img class="logo ondark" src="/logo-dark.svg" alt="" width="26"><img class="logo classic" src="/icon.png" alt="" width="26">
   <h1>Admin</h1>
   <span class="grow"></span>
   <nav class="tabs" id="atabs">
     <a href="#server" data-t="server">Server</a>
     <a href="#accounts" data-t="accounts">Accounts</a>
+    <a href="#directory" data-t="directory">Directory</a>
     <a href="#log" data-t="log">Log</a>
   </nav>
 </header>
 <main class="wrap plain" id="admin">
   <section id="server" hidden></section>
   <section id="accounts" hidden></section>
+  <section id="directory" hidden></section>
   <section id="log" hidden></section>
 </main>
 <div id="toasts"></div>

web/app.css

@@ -426,6 +426,7 @@
   --glass-hi:rgba(255,255,255,.26);
   --glass-lo:rgba(255,255,255,.10);
   --glass-sheen:rgba(255,255,255,.07);
+  --glass-bar:#191e34;  /* the top bar on a phone: what the glass one showed, on average */
   --wash1:rgba(64,120,255,.30);
   --wash2:rgba(175,82,222,.24);
   --wash3:rgba(48,176,199,.20);
@@ -450,6 +451,7 @@
   --glass-hi:rgba(255,255,255,.9);
   --glass-lo:rgba(255,255,255,.45);
   --glass-sheen:rgba(255,255,255,.5);
+  --glass-bar:#f6f7ff;
   --wash1:rgba(64,120,255,.22);
   --wash2:rgba(175,82,222,.16);
   --wash3:rgba(48,176,199,.18);
@@ -458,6 +460,10 @@
 /* A rule that sets display beats the UA's [hidden], and several below do. */
 [hidden]{display:none!important}
 html,body{height:100%}
+/* What iOS paints behind the status bar where nothing sticky is at the top edge, as in the
+   reader on a phone, which brings its own. With no colour of its own, the root went black or
+   white there instead (#147). */
+html{background-color:var(--bg)}
 body{
   margin:0;background:var(--bg);color:var(--fg);
   font:14.5px/1.55 Inter,system-ui,-apple-system,"Segoe UI",Roboto,sans-serif;
@@ -498,6 +504,9 @@ a{color:var(--accent)}
 /* The logo in the mode's own variant. Dark unless the page says light, as the palette is: with
    Auto, data-mode arrives with the script, and until then the page is drawn dark. */
 :root[data-mode="light"] .logo.ondark,:root:not([data-mode="light"]) .logo.onlight{display:none}
+/* Classic is the 2004 app, so it wears the 2004 app's icon. */
+.logo.classic,:root[data-theme="classic"] .logo:not(.classic){display:none}
+:root[data-theme="classic"] .logo.classic{display:block}
 .iconbtn{
   width:30px;height:30px;border-radius:8px;display:grid;place-items:center;
   color:var(--dim);flex:none;
@@ -522,6 +531,10 @@ a{color:var(--accent)}
   padding-top:calc(7px + var(--safe-t));padding-bottom:7px;
   padding-left:calc(12px + var(--safe-l));padding-right:calc(12px + var(--safe-r));
   background:var(--panel);border-bottom:1px solid var(--line);
+  /* Nothing scrolls under it: it is sticky only because iOS 26 paints the strip behind the status
+     bar and the Dynamic Island in the colour of a sticky or fixed bar at the top edge, and ignores
+     theme-color, so the bar now runs all the way up behind the island (#147). */
+  position:sticky;top:0;
 }
 #topbar .grow{flex:1}
 #topbar #epSearch{width:260px;flex:none}
@@ -793,7 +806,11 @@ body.scan-this .fhead [data-a=scan] .i,body.scan-any .fhead [data-a=scanall] .i,
 #files{grid-area:files;overflow-y:auto;padding:8px 12px;border-left:1px solid var(--line);background:var(--panel)}
 /* Nothing selected, or an item with no files: the list takes the width. */
 #split:has(>#files[hidden]){grid-template-columns:minmax(0,1fr) 0}
-#files .encbox{margin-top:8px}
+/* One row in the narrow pane: four buttons and the size wrapped the last button under the rest.
+   The size gives way first, with an ellipsis. */
+#files .encbox{margin-top:8px;flex-wrap:nowrap;gap:6px;padding:10px}
+#files .encbox .meta{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}
+#files .encbox .btn.ico{padding:4px 7px;min-width:0;flex:none}
 #files .empty{padding:24px 0}
 .fhd{font-size:12px;color:var(--faint)}
 #grab{grid-area:grab;cursor:row-resize;background:var(--line)}
@@ -802,6 +819,9 @@ body.scan-this .fhead [data-a=scan] .i,body.scan-any .fhead [data-a=scanall] .i,
 .dt{font-size:18px;font-weight:650;margin:0 0 5px;line-height:1.3;overflow-wrap:anywhere}
 .dmeta{color:var(--faint);font-size:12.5px;display:flex;gap:8px;flex-wrap:wrap;align-items:center;margin-bottom:14px}
 .dmeta .btn{padding:3px 9px;font-size:12px}
+/* The reader's buttons go as one: as items of the line itself, a long feed name took them onto
+   the next line one at a time (#146). */
+.dacts{display:flex;gap:inherit;flex:none}
 #detail .encbox{margin:0 0 10px}
 .dbody{font-size:14.5px;line-height:1.65;overflow-wrap:anywhere;color:var(--fg)}
 .dbody img{max-width:100%;height:auto;border-radius:6px}
@@ -818,7 +838,7 @@ body.scan-this .fhead [data-a=scan] .i,body.scan-any .fhead [data-a=scanall] .i,
 .fhead .sub{color:var(--dim);font-size:13px;margin-bottom:8px}
 .fhead .sub a{color:var(--dim);text-decoration:none}
 .fhead .sub a:hover{color:var(--accent)}
-.acts{display:flex;gap:7px;flex-wrap:wrap;align-items:center;margin-top:auto}
+.acts{display:flex;gap:7px;align-items:center;margin-top:auto}
 .acts .btn{display:inline-flex;align-items:center;gap:6px;padding:7px 13px;border-radius:999px}
 .acts .btn i{font-style:normal;font-size:13px;line-height:1;opacity:.7}
 .acts .btn:hover{background:var(--raise)}
@@ -868,8 +888,13 @@ body.adminpage #topbar{position:sticky;top:0;z-index:5}
 body.adminpage #topbar h1{font-size:16px;margin:0;font-weight:650}
 body.adminpage #topbar .logo{border-radius:6px}
 body.adminpage #topbar > a.btn{text-decoration:none}
+/* The link to Admin, for admins only: the page is the same for everyone now (#203), and the head
+   script marks an admin's from the last visit before the first frame. */
+html:not([data-admin]) #topbar a#admin{display:none}
 body.adminpage #admin{max-width:780px;margin:0 auto}
 body.adminpage #admin h2{font-size:18px;margin:0 0 12px}
+/* The directory's Servers and Blocked follow its Save and each other's rows (#206). */
+body.adminpage #dadmin h2{margin-top:32px}
 body.adminpage #log{max-width:none}
 .urow{padding:9px 0;border-bottom:1px solid var(--line)}
 .toolbar .grow{flex:1;min-width:150px;max-width:320px}
@@ -913,6 +938,11 @@ body.adminpage #log{max-width:none}
    the row does not move when it changes. */
 .ep .fl.on,.ep .fl.on:hover{color:var(--ink);background:radial-gradient(circle,var(--accent) 8.5px,transparent 9px)}
 .ep .fl.on .i{width:9px;height:9px}
+/* The reader's and a feed's pin button, and the toolbar's, pinned: filled with the accent, as the
+   disc is. A solid pin on the button's own grey read the same as an outlined one (#148). */
+.btn.ico[data-a=pin][aria-pressed=true],.btn.ico[data-a=pin][aria-pressed=true]:hover,
+.btn.ico[data-a=flag][aria-pressed=true],.btn.ico[data-a=flag][aria-pressed=true]:hover,
+#tbFlag[aria-pressed=true],#tbFlag[aria-pressed=true]:hover{background:var(--accent);border-color:var(--accent);color:var(--ink)}
 /* The icon's EQ bars mark what is playing: standing still, and moving only while it plays. A
    paused animation was tried first; the frames it held were a pixel apart and read as dots. */
 .eq{display:inline-flex;align-items:flex-end;gap:2px;width:13px;height:12px;flex:none}
@@ -1034,6 +1064,93 @@ input[type=range]::-moz-range-thumb{width:12px;height:12px;border:0;border-radiu
 .inline input[type=number]{flex:none;width:90px}
 .check input{width:16px;height:16px;accent-color:var(--accent)}
 .cardacts{display:flex;gap:8px;justify-content:flex-end;margin-top:16px}
+
+/* ---------- a feed's settings (#167) ---------- */
+/* A frame of its own: the body scrolls and Save stays at the foot, where on a phone it had been
+   three screens down. */
+.card.fset{padding:0;display:flex;flex-direction:column;overflow:hidden;width:min(520px,100%)}
+.fsetbody{overflow:auto;min-height:0;padding:22px 24px 24px}
+.card.fset .fsetfoot{flex:none;margin:0;padding:12px 24px;border-top:1px solid var(--line)}
+.fsethead{display:flex;gap:14px;align-items:center;margin-bottom:18px}
+.fsethead .art{width:56px;height:56px;border-radius:12px;font-size:18px}
+.fsethead h3{margin:0;font-size:19px;line-height:1.25;letter-spacing:-.01em;overflow-wrap:anywhere}
+.fsethead p{margin:3px 0 0;font-size:12.5px;line-height:1.45;color:var(--dim)}
+.faddr{margin-bottom:18px}
+.moved{margin:2px 0 0;font-size:13px;color:var(--accent)}
+/* On or off, drawn as iOS draws it, as the app is on a phone (#53). The box is the real control,
+   unseen over the track, so a click, a tap, the keyboard and a screen reader all reach it. */
+.switch{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:38px;font-size:14px;font-weight:500;cursor:pointer}
+/* The one switch the rest hang from. */
+.switch.lead{font-weight:600}
+.sw{position:relative;flex:none;width:42px;height:26px}
+.sw input{position:absolute;inset:0;width:100%;height:100%;margin:0;opacity:0;cursor:pointer}
+.sw i{position:absolute;inset:0;border-radius:999px;background:var(--raise);border:1px solid var(--line);pointer-events:none;transition:background-color .18s,border-color .18s}
+/* White, as iOS has it, in every theme: in --ink, the dark themes' knob was a black hole in the track. */
+.sw i::after{content:"";position:absolute;top:2px;left:2px;width:20px;height:20px;border-radius:50%;background:#fff;box-shadow:0 1px 3px rgba(0,0,0,.35);transition:transform .18s}
+.sw input:checked+i{background:var(--accent);border-color:var(--accent)}
+.sw input:checked+i::after{transform:translateX(16px)}
+.sw input:focus-visible+i{outline:2px solid var(--accent);outline-offset:2px}
+/* The switch and what only matters while it downloads on its own, in one box; the rest folds away
+   when it is off. In --line, not --edge, so the box shows on a phone, which draws no outlines. The
+   rows in a grid of one row, 1fr open and 0fr shut, so the fold has a height to move. */
+.fdl{border:1px solid var(--line);border-radius:12px;padding:4px 14px}
+/* The same box round a part of a dialog that stands apart: API tokens in Settings. */
+.field.boxed{border:1px solid var(--line);border-radius:12px;padding:12px 14px}
+.fdeps{display:grid;grid-template-rows:1fr;transition:grid-template-rows .22s ease}
+.fdeps.off{grid-template-rows:0fr}
+.fdeps>div{min-height:0;overflow:hidden}
+.fdepsin{padding:6px 2px 10px}
+/* The app's own segmented control, with radio buttons in it, for the arrow keys. */
+.seg{margin-bottom:12px}
+.seg label{flex:1;position:relative;text-align:center;white-space:nowrap;padding:5px 10px;border-radius:7px;font-size:13px;color:var(--dim);cursor:pointer}
+.seg input{position:absolute;width:1px;height:1px;opacity:0;pointer-events:none}
+.seg label:has(input:checked){background:var(--raise);color:var(--fg);font-weight:500}
+.seg label:has(input:focus-visible){outline:2px solid var(--accent);outline-offset:-2px}
+/* The feed's newest items, newest first, each as tall as it is long; lit, those that download on
+   their own. Dragged along, it sets how many. Only drawing: the number in the sentence below is
+   what a keyboard and a screen reader use. */
+.epwin{display:flex;align-items:flex-end;gap:2px;height:38px;margin-bottom:8px;cursor:ew-resize;touch-action:pan-y;user-select:none;-webkit-user-select:none}
+.epwin:empty{display:none}
+.epwin i{flex:1 1 0;min-width:2px;max-width:10px;height:var(--h);border-radius:2px;background:var(--line);transition:background-color .2s calc(var(--n) * 12ms)}
+.epwin i.on{background:var(--accent)}
+.epwin i.nofile{height:4px}
+.epwin small{flex:none;align-self:center;margin-left:8px;font-size:12px;color:var(--faint);font-variant-numeric:tabular-nums}
+.epwin.all small{color:var(--accent)}
+.wcap{margin:0 0 16px;font-size:13px;line-height:1.55;color:var(--dim)}
+.wcap input[type=number]{display:inline-block;width:4.2em;margin:0 2px;padding:1px 4px;font-size:13px;text-align:center;font-variant-numeric:tabular-nums;color:var(--fg)}
+.ffield{display:grid;gap:6px;margin-bottom:14px}
+/* DeadAir's pause: four stops on one scale, a dot at each so it reads as four places to stop. */
+.dpause{display:grid;gap:6px;margin-top:6px}
+.dphead{display:flex;justify-content:space-between;align-items:baseline}
+.dphead output{font-variant-numeric:tabular-nums;font-weight:600}
+.dpslide{--t:22px;position:relative;height:var(--t)}
+.dpslide::before,.dpslide::after{content:'';position:absolute;top:50%;pointer-events:none}
+.dpslide::before{left:0;right:0;height:6px;margin-top:-3px;border-radius:3px;background:var(--raise)}
+.dpslide::after{left:calc(var(--t)/2 - 3px);right:calc(var(--t)/2 - 3px);height:6px;margin-top:-3px;
+  background:radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 0 0/6px 6px no-repeat,
+    radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 33.333% 0/6px 6px no-repeat,
+    radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 66.667% 0/6px 6px no-repeat,
+    radial-gradient(circle,var(--dim) 2px,transparent 2.5px) 100% 0/6px 6px no-repeat}
+.dpslide input[type=range]{position:relative;z-index:1;width:100%;height:var(--t);margin:0;background:transparent}
+.dpslide input[type=range]::-webkit-slider-thumb{width:var(--t);height:var(--t);box-shadow:0 0 0 3px var(--panel),0 1px 4px rgba(0,0,0,.3)}
+.dpslide input[type=range]::-moz-range-thumb{width:var(--t);height:var(--t);box-shadow:0 0 0 3px var(--panel),0 1px 4px rgba(0,0,0,.3)}
+.dpslide input[type=range]:focus-visible{outline:2px solid var(--accent);outline-offset:4px;border-radius:var(--t)}
+.dpends{display:flex;justify-content:space-between;font-size:12.5px;color:var(--dim)}
+.dpause:has(input:disabled){opacity:.45}
+.dpslide input[type=range]:disabled{cursor:default}
+.fdl+.ffield{margin-top:18px}
+/* DeadAir shares the box but not the fold: it applies whether or not this show downloads on its own. */
+.fdead{border-top:1px solid var(--line);padding-top:10px;margin-top:4px}
+.flabel{font-size:14px;font-weight:500}
+.cap{margin:0;font-size:12.5px;line-height:1.45;color:var(--dim)}
+/* Words and phrases as chips: in one comma-separated box, one ran into the next. */
+.chips{display:flex;flex-wrap:wrap;gap:6px;align-items:center;min-height:38px;padding:5px;border:1px solid var(--line);border-radius:9px;background:var(--bg);cursor:text}
+.chips:focus-within{border-color:var(--accent)}
+.chip{display:inline-flex;align-items:center;gap:2px;max-width:100%;padding:3px 3px 3px 10px;border-radius:999px;background:var(--panel2);color:var(--fg);font-size:13px;line-height:1.3;overflow-wrap:anywhere}
+.chipx{display:grid;place-items:center;flex:none;width:20px;height:20px;padding:0;border-radius:50%;color:var(--dim)}
+.chipx:hover{background:var(--raise);color:var(--fg)}
+.chipx .i{width:9px;height:9px}
+.chips .chipin{flex:1 0 8ch;width:auto;min-width:0;padding:4px 6px;border:0;background:none}
 #toasts{position:fixed;bottom:88px;right:18px;display:flex;flex-direction:column;gap:8px;z-index:60}
 .toast{
   background:var(--raise);border:1px solid var(--line);border-radius:9px;
@@ -1073,8 +1190,10 @@ body:has(#player.on) #status{padding-bottom:3px}
 
 @media (max-width:820px){
   #shell{grid-template-columns:1fr}
-  #sidebar{position:fixed;inset:0 auto 0 0;padding-top:var(--safe-t);width:min(300px,86vw);z-index:42;transform:translateX(-100%);transition:transform .2s;box-shadow:var(--shadow)}
+  /* The shadow only while open: off the screen, the drawer's fell across the page's left edge,
-  #sidebar.open{transform:none}
+     the top bar's included (#151). */
+  #sidebar{position:fixed;inset:0 auto 0 0;padding-top:var(--safe-t);width:min(300px,86vw);z-index:42;transform:translateX(-100%);transition:transform .2s,box-shadow .2s}
+  #sidebar.open{transform:none;box-shadow:var(--shadow)}
   #scrim{position:fixed;inset:0;background:rgba(0,0,0,.5);z-index:41}
   #player{
     position:relative;z-index:39;gap:8px;
@@ -1111,8 +1230,8 @@ body:has(#player.on) #status{padding-bottom:3px}
   #dpeek>div{width:calc(100% - 16px);height:100%;overflow:hidden;padding:12px 16px 90px;padding-top:calc(12px + var(--safe-t));background:var(--panel)}
   #dpeek.next>div{margin-left:16px}
   #dpeek .encbox{margin:0 0 10px}
-  #dpeek.end{display:flex;align-items:center;padding-left:28px;color:var(--faint);font-size:13px}
+  /* Past the last item, the accent and no words: the colour says it is the end. */
-  #dpeek.end p{max-width:4.5em;margin:0}
+  #dpeek.end{background:var(--accent)}
   /* Going back to the list from the first item: the list waits under a dimmer that lifts as the
      reader, shadowed along its edge, is drawn off it. */
   #dpeek.dim{width:100%;z-index:37;background:#000}
@@ -1207,6 +1326,12 @@ body:has(#player.on) #status{padding-bottom:3px}
   .fhead .sub{font-size:15px}
   .acts{gap:8px}
   .acts .btn{min-width:44px;height:44px;padding:0 13px;justify-content:center;font-size:15px}
+  /* Seven to a row with no room to spare at 390px: below that an icon button narrows rather than
+     the row breaking, which left Unsubscribe alone on a second row (#146). */
+  .acts .btn.ico{flex:0 1 44px;min-width:0;padding:0}
+  /* A Directory feed's few buttons have room, and nothing sizes their row: allowed to shrink,
+     they went to 18px (#212). */
+  .show .acts .btn.ico{flex:0 0 44px}
 
   /* Tabs as a segmented control: equal segments on one track, the chosen one lifted. */
   .tabs{flex:1 1 100%;border-radius:10px;padding:2px}
@@ -1241,6 +1366,27 @@ body:has(#player.on) #status{padding-bottom:3px}
   .card h3{font-size:22px}
   .field label,.field .hint{font-size:13px}
   .check{font-size:17px}
+  /* A feed's settings, at a phone's sizes. */
+  .card.fset{padding:0}
+  .fsetbody{padding:20px 16px 24px}
+  .card.fset .fsetfoot{padding:12px 16px calc(12px + var(--safe-b))}
+  .fsethead .art{width:64px;height:64px;border-radius:14px}
+  .fsethead p,.wcap,.cap{font-size:14px}
+  .switch,.flabel{font-size:17px}
+  .switch{min-height:44px}
+  .sw{width:51px;height:31px}
+  .sw i::after{width:25px;height:25px}
+  .sw input:checked+i::after{transform:translateX(20px)}
+  .seg label{padding:7px 4px;border-radius:8px;font-size:14px}
+  .seg label:has(input:checked){box-shadow:0 1px 3px rgba(0,0,0,.22)}
+  .dpslide{--t:28px}
+  .dpends{font-size:14px}
+  /* 16px or more, or Safari zooms the page in on it. */
+  .wcap input[type=number]{font-size:16px;padding:3px 4px}
+  .chips{background:var(--panel2);border-color:var(--edge);border-radius:10px}
+  .chip{background:var(--panel);font-size:15px;padding:5px 4px 5px 12px}
+  .chipx{width:26px;height:26px}
+  .fdl,.field.boxed{border-radius:14px}
   .toast{border-radius:14px}
 }
 @keyframes sheet{from{transform:translateY(100%)}}
@@ -1254,6 +1400,8 @@ body:has(#player.on) #status{padding-bottom:3px}
 :root[data-theme="classic"] #topbar,
 :root[data-theme="classic"] #status,
 :root[data-theme="classic"] #player{background:linear-gradient(#ececec,#c9c9c9);border-color:#8e8e8e;color:#1a1a1a}
+/* The colour iOS takes for above the bar, where it reads no gradient: the top of the metal. */
+:root[data-theme="classic"] #topbar{background-color:#ececec}
 :root[data-theme="classic"] #status{text-align:center}
 :root[data-theme="classic"] #sidebar{background:#e7ebf1;border-right-color:#a3a3a3}
 :root[data-theme="classic"] #files{background:#f4f4f4}
@@ -1274,6 +1422,11 @@ body:has(#player.on) #status{padding-bottom:3px}
 :root[data-theme="classic"] .feed.sel .txt small,
 :root[data-theme="classic"] .place.sel .ico{color:#e6eeff}
 :root[data-theme="classic"] #epSearch{border-radius:14px}
+/* The 2004 app had checkboxes, not switches. */
+:root[data-theme="classic"] .sw{width:auto;height:auto}
+:root[data-theme="classic"] .sw input{position:static;width:14px;height:14px;opacity:1}
+:root[data-theme="classic"] .sw i{display:none}
+:root[data-theme="classic"] .seg label:has(input:checked){background:linear-gradient(#86b0ec,#3a73cf);color:#fff}
 :root[data-theme="classic"] .badge{background:#c9302c;color:#fff}
 :root[data-theme="classic"] .badge.zero{background:#b4bdc9;color:#fff}
 :root[data-theme="classic"] .ephead,
@@ -1350,7 +1503,7 @@ body:has(#player.on) #status{padding-bottom:3px}
 :root[data-theme="glass"] .toast.bad{border-color:var(--bad)}
 /* A narrow screen slides the feed list over the page, so it keeps its shadow. */
 @media (max-width:820px){
-  :root[data-theme="glass"] #sidebar{box-shadow:inset -1px 0 0 var(--glass-hi),var(--shadow)}
+  :root[data-theme="glass"] #sidebar.open{box-shadow:inset -1px 0 0 var(--glass-hi),var(--shadow)}
 }
 /* The card is the glass; a lighter scrim leaves something behind it to see through. */
 :root[data-theme="glass"] #modal{background:rgba(0,0,0,.3)}
@@ -1369,12 +1522,17 @@ body:has(#player.on) #status{padding-bottom:3px}
   :root[data-theme="glass"] .sidefoot button{border-radius:10px}
 }
 :root[data-theme="glass"] .btn.primary{box-shadow:inset 0 1px 0 rgba(255,255,255,.35)}
+:root[data-theme="glass"] .card.fset .fsetfoot{border-top-color:var(--glass-edge);background:color-mix(in srgb,var(--panel) 60%,transparent)}
 /* On a phone the rim all round a small capsule or bar read as the outline #53 took away, so the
    light only catches the top edge there, and the bars at the top and bottom have none. */
 @media (max-width:820px){
   :root[data-theme="glass"]{--glass-rim:inset 0 1px 0 var(--glass-lo)}
   :root[data-theme="glass"] #topbar,
   :root[data-theme="glass"] #status{box-shadow:none}
+  /* Solid, in the colour the glass showed on average. iOS paints the strip above it, behind the
+     status bar and the Dynamic Island, in one flat colour, and over a see-through bar that met it
+     at a seam: near-black above a blue bar (#147). */
+  :root[data-theme="glass"] #topbar{background:var(--glass-bar);-webkit-backdrop-filter:none;backdrop-filter:none}
 }
 /* Someone who has asked the system for less transparency, or more contrast, gets solid panels. */
 @media (prefers-reduced-transparency:reduce),(prefers-contrast:more){

web/boot.js

@@ -0,0 +1,6 @@
+// Runs in <head>, before the first frame (#203): this browser's theme, from its cookie, and
+// whether the last visit here was an admin's, so the link to Admin is there from the start. The
+// server wrote both into the page while it served it; the page is a static file now.
+(()=>{const r=document.documentElement,c=/(?:^|; )ipx_theme=([a-z]{1,20})\.(light|dark|auto)(?:;|$)/.exec(document.cookie);
+if(c){r.dataset.theme=c[1];r.dataset.choice=c[2];if(c[2]!=='auto')r.dataset.mode=c[2];}
+try{if(localStorage.getItem('ipx.admin')==='1')r.dataset.admin='';}catch{}})();

web/build.mjs

@@ -1,12 +1,12 @@
-// Builds the pages ipx serves: each page's TypeScript from web/src, types stripped and minified
+// Builds the frontend (#203): each page's TypeScript from web/src, types stripped and minified
-// by swc into a script of its own (app.js, login.js), and the page minified, its
+// by swc into a script of its own (app.js, login.js), the page minified, its <script data-src>
-// <script data-src> pointing at that script. build.rs runs it into OUT_DIR, where web.rs
+// pointing at that script, and the icons, logos and typeface beside them. The result, web/dist,
-// include_str!s the results, so the binary still carries everything and nothing is served
+// is a static site: Caddy serves it (web/Caddyfile, Dockerfile.web) and passes the API to ipx.
-// from disk.
 //
 // The page names its script with a hash of the script's contents, /app.js?v=<hash>, and the
 // server lets a browser keep that for a year without asking again. A changed script is a new
-// URL, and the page, which the browser checks on every visit, is what carries it.
+// URL, and the page, which the browser checks on every visit, is what carries it. Caddy's file
+// server ignores the query.
 //
 //   node web/build.mjs [out-dir]      default out-dir: web/dist
 import crypto from 'node:crypto';
@@ -17,6 +17,8 @@ import swc from '@swc/core';
 import html from '@swc/html';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
+// The page's own version (package.json), given to its script in place of __WEB_VERSION__.
+const WEB_VERSION = JSON.parse(fs.readFileSync(path.join(here, '..', 'package.json'), 'utf8')).version;
 
 // The files are one script, concatenated in this order, not modules: they share one top-level
 // scope, as the single inline script did, and code that runs at load needs what came before it.
@@ -30,6 +32,11 @@ const STYLE = 'app.css';
 
 const hash = s => crypto.createHash('sha256').update(s).digest('hex').slice(0, 12);
 
+// hls.js, for browsers that cannot play DeadAir's playlists themselves (#181). Served as it comes,
+// by a name with its hash in it, which the page's script is given in place of __HLS_JS__.
+const HLS = fs.readFileSync(path.join(here, '..', 'node_modules', 'hls.js', 'dist', 'hls.light.min.js'), 'utf8');
+const HLS_URL = `/hls.js?v=${hash(HLS)}`;
+
 /// The shared stylesheet, minified. @swc/html minifies CSS inside a page, so it goes through as
 /// one; the doctype only keeps it from complaining that a fragment has none.
 export function buildStyle({ minify = true } = {}) {
@@ -51,7 +58,9 @@ export function buildStyle({ minify = true } = {}) {
 /// The page and its script, built: { html, js, script }, where script is the file's name.
 export function buildPage(name, { minify = true } = {}) {
   const { script, src: files } = PAGES[name];
-  const src = files.map(f => fs.readFileSync(path.join(here, 'src', f + '.ts'), 'utf8')).join('\n');
+  const src = files.map(f => fs.readFileSync(path.join(here, 'src', f + '.ts'), 'utf8')).join('\n')
+    .replaceAll('__HLS_JS__', HLS_URL)
+    .replaceAll('__WEB_VERSION__', WEB_VERSION);
   const js = swc.transformSync(src, {
     filename: name + '.ts',
     jsc: {
@@ -75,7 +84,7 @@ export function buildPage(name, { minify = true } = {}) {
   // The icons are named by their contents too. They are kept a day under a fixed name, and a new
   // logo went unseen for that day, in browsers and at Cloudflare's edge. The server ignores the
   // query; /favicon.ico, which a browser asks for on its own, cannot carry one.
-  out = out.replace(/(href|src|srcset|data-light|data-dark)="\/(favicon\.png|favicon-dark\.png|apple-touch-icon\.png|logo\.svg|logo-dark\.svg)"/g,
+  out = out.replace(/(href|src|srcset|data-light|data-dark)="\/(favicon\.png|favicon-dark\.png|apple-touch-icon\.png|logo\.svg|logo-dark\.svg|boot\.js)"/g,
     (_, attr, file) => `${attr}="/${file}?v=${hash(fs.readFileSync(path.join(here, file)))}"`);
   if (!minify) return { html: out, js, script };
   const r = html.minifySync(out, { minifyJs: false, minifyCss: true, removeComments: true });
@@ -88,6 +97,17 @@ if (process.argv[1] === fileURLToPath(import.meta.url)) {
   const out = process.argv[2] || path.join(here, 'dist');
   fs.mkdirSync(out, { recursive: true });
   fs.writeFileSync(path.join(out, STYLE), buildStyle());
+  fs.writeFileSync(path.join(out, 'hls.js'), HLS);
+  // Served as they are, under the names the pages and the stylesheet use. /favicon.ico is the
+  // PNG, for a browser that asks for that on its own; iOS asks for the precomposed touch icon
+  // first when the site is added to a home screen (#109). /icon.png is the 2004 icon, which
+  // nothing here shows any more but the classic theme.
+  for (const [from, to] of [
+    ['logo.svg', 'logo.svg'], ['logo-dark.svg', 'logo-dark.svg'],
+    ['favicon.png', 'favicon.png'], ['favicon.png', 'favicon.ico'], ['favicon-dark.png', 'favicon-dark.png'],
+    ['apple-touch-icon.png', 'apple-touch-icon.png'], ['apple-touch-icon.png', 'apple-touch-icon-precomposed.png'],
+    ['ipodderx-icon.png', 'icon.png'], ['boot.js', 'boot.js'], ['InterVariable.woff2', 'inter.woff2'], ['Inter-LICENSE.txt', 'Inter-LICENSE.txt'],
+  ]) fs.copyFileSync(path.join(here, from), path.join(out, to));
   for (const name of Object.keys(PAGES)) {
     const { html, js, script } = buildPage(name);
     fs.writeFileSync(path.join(out, name), html);

web/index.html

@@ -4,17 +4,19 @@
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
 <meta name="color-scheme" content="dark light">
+<meta name="theme-color" content="#0a1726">
 <title>iPX</title>
 <link rel="icon" type="image/png" sizes="128x128" id="favicon" href="/favicon.png" data-light="/favicon.png" data-dark="/favicon-dark.png">
 <link rel="apple-touch-icon" href="/apple-touch-icon.png">
 <link rel="stylesheet" data-src="app.css">
+<script src="/boot.js"></script>
 </head>
 <body>
 <header id="topbar">
   <button class="iconbtn" id="burger" title="Feeds" aria-label="Feeds" data-icon="menu"></button>
   <!-- One group per thing acted on, in the order the panes read: feeds, then the selected item.
        A phone hides the item group, which it has no table for. -->
-  <span id="applogo" title="iPX {version}"><img class="logo onlight" src="/logo.svg" alt="iPX"><img class="logo ondark" src="/logo-dark.svg" alt="iPX"></span>
+  <span id="applogo" title="iPX"><img class="logo onlight" src="/logo.svg" alt="iPX"><img class="logo ondark" src="/logo-dark.svg" alt="iPX"><img class="logo classic" src="/icon.png" alt="iPodderX"></span>
   <div class="tgroup">
     <button id="addFeed" title="Add a feed" aria-label="Add a feed" data-icon="plus"></button>
     <button id="tbRemove" title="Unsubscribe from this feed" aria-label="Unsubscribe from this feed" data-icon="circleMinus" disabled></button>
@@ -65,6 +67,7 @@
     </div>
   </div>
   <div id="pright">
+    <button class="iconbtn" id="pdead" aria-pressed="false" aria-label="DeadAir" hidden></button>
     <select id="rate" title="Speed">
       <option value="0.8">0.8×</option><option value="1" selected>1×</option>
       <option value="1.25">1.25×</option><option value="1.5">1.5×</option>

web/src/admin.ts

@@ -7,7 +7,7 @@
 let me: {name: string} | null = null;
 api('/api/me').then(u => { me = u; }).catch(() => {});
 
-const SECTIONS: Record<string, () => void> = {server: drawServer, accounts: drawAccounts, log: drawLogView};
+const SECTIONS: Record<string, () => void> = {server: drawServer, accounts: drawAccounts, directory: drawDirectorySettings, log: drawLogView};
 
 function showSection(){
   const t = SECTIONS[location.hash.slice(1)] ? location.hash.slice(1) : 'server';
@@ -70,6 +70,110 @@ async function drawServer(){
   };
 }
 
+/* ---------------- directory ---------------- */
+// The directory service the Directory shows (#205): where it is, this server's token for it, and
+// whether to share. The token is sent, never shown: the server says only whether one is set.
+const ACCESS: Record<string, string> = {ro: 'browse', rw: 'browse and share', rwa: 'browse, share and administer the directory'};
+
+async function drawDirectorySettings(){
+  const box = $('#directory');
+  const g = await api('/api/settings');
+  box.innerHTML = `<h2>Directory</h2>
+    <p class="hint">The Directory shows podcasts from a directory service that iPX servers share.
+    Without one, people add feeds by their address.</p>
+    <div class="field"><label for="durl">Directory address</label>
+      <input type="text" inputmode="url" id="durl" value="${esc(g.directory_url)}" placeholder="https://directory.example.net" spellcheck="false"></div>
+    <div class="field"><label for="dtoken">Access token</label>
+      <div class="inline"><input type="password" id="dtoken" autocomplete="off" spellcheck="false"
+        placeholder="${g.directory_token_set ? 'Set. Paste a new one to replace it' : 'Paste the token the directory gave this server'}">
+      ${g.directory_token_set ? `<button type="button" class="btn" id="dclear">Clear</button>` : ''}</div>
+      <span class="hint">Whoever runs the directory makes one for each server, and can revoke it.</span></div>
+    <div class="field"><label class="check"><input type="checkbox" id="dshare"${g.directory_share ? ' checked' : ''}> Share this server's public feeds</label>
+      <span class="hint">Sends the directory the feeds people here subscribe to, and how many of them do, every
+      half hour. Never a private feed: one marked private, one with a login, or one whose address carries a key.</span></div>
+    <div class="field"><label>Status</label><p class="hint" id="dstatus">Asking the directory…</p></div>
+    <div class="cardacts"><button class="btn primary" id="dsave">${ICON.check} Save</button></div>
+    <div id="dadmin"></div>`;
+  const save = async (patch: Record<string, unknown>, said: string) => {
+    try{
+      await api('/api/settings', {method: 'PATCH', body: JSON.stringify(patch)});
+      toast(said);
+      drawDirectorySettings();
+    }catch(e){ toast(e.message, true); }
+  };
+  $('#dsave').onclick = () => {
+    const patch: Record<string, unknown> = {directory_url: $('#durl').value.trim(), directory_share: $('#dshare').checked};
+    // Blank leaves the token as it is; Clear is the way to remove it.
+    if($('#dtoken').value.trim()) patch.directory_token = $('#dtoken').value.trim();
+    save(patch, 'Directory settings saved');
+  };
+  const clear = $('#dclear');
+  if(clear) clear.onclick = () => save({directory_token: ''}, 'Token cleared');
+  drawDirectoryStatus();
+}
+
+async function drawDirectoryStatus(){
+  const el = $('#dstatus');
+  let s;
+  try{ s = await api('/api/directory-status'); }catch(e){ el.textContent = e.message; return; }
+  if(!el.isConnected) return;
+  const lines: string[] = [];
+  if(!s.configured) lines.push('Not set up: it needs an address and a token.');
+  else if(s.error) lines.push(esc(s.error));
+  else lines.push(`Connected as <b>${esc(s.name)}</b>, which may ${esc(ACCESS[s.access] || s.access)}.`);
+  const sh = s.shared;
+  if(sh){
+    const when = new Date(sh.at * 1000).toLocaleString();
+    lines.push(sh.error ? `Sharing failed at ${esc(when)}: ${esc(sh.error)}`
+      : `Shared ${plural(sh.accepted, 'feed')} at ${esc(when)}.` +
+        (sh.refused_private ? ` The directory refused ${plural(sh.refused_private, 'feed')} as private.` : '') +
+        (sh.refused_blocked ? ` ${plural(sh.refused_blocked, 'feed')} the directory has removed.` : ''));
+  }
+  el.innerHTML = lines.join('<br>');
+  if(s.access === 'rwa') drawDirectoryAdmin();
+}
+
+/// What a token that may administer the directory can change from here (#206): the servers
+/// sharing with it, and the feeds removed from it.
+async function drawDirectoryAdmin(){
+  const box = $('#dadmin');
+  let a;
+  try{ a = await api('/api/directory-admin'); }catch(e){ box.innerHTML = `<p class="hint">${esc(e.message)}</p>`; return; }
+  if(!box.isConnected) return;
+  box.innerHTML = `<h2>Servers</h2>
+    <p class="hint">Each server sharing with the directory, by its token's name. Dropping one removes its
+    feeds and counts until it next shares; to keep it out, revoke its token in the directory's config.</p>
+    ${a.instances.length ? a.instances.map(i => `<div class="inline urow" data-name="${esc(i.name)}">
+      <div style="flex:1;min-width:0"><b style="overflow-wrap:anywhere">${esc(i.name)}</b>
+        <small style="display:block;color:var(--faint)">${plural(i.feeds, 'feed')} · ${plural(i.subscribers, 'subscriber')}</small></div>
+      <button class="btn ico danger" data-a="drop" title="Drop ${esc(i.name)}'s feeds" aria-label="Drop ${esc(i.name)}'s feeds">${ICON.trash}</button></div>`).join('')
+      : '<p class="hint">No server is sharing yet.</p>'}
+    <h2>Blocked</h2>
+    <p class="hint">Feeds removed from the directory. No snapshot brings them back until they are unblocked.</p>
+    ${a.blocked.length ? a.blocked.map(b => `<div class="inline urow" data-id="${esc(b.id)}">
+      <div style="flex:1;min-width:0"><b style="overflow-wrap:anywhere">${esc(b.title || 'Untitled')}</b>
+        <small style="display:block;color:var(--faint)">Removed ${dateOf(b.at)}</small></div>
+      <button class="btn" data-a="unblock">Unblock</button></div>`).join('')
+      : '<p class="hint">Nothing is blocked.</p>'}`;
+  box.onclick = async ev => {
+    const b = (ev.target as Element).closest<HTMLElement>('[data-a]');
+    if(!b) return;
+    const row = b.closest<HTMLElement>('.urow');
+    try{
+      if(b.dataset.a === 'drop'){
+        const name = row.dataset.name;
+        if(!confirm(`Drop ${name}'s feeds and counts from the directory? They come back the next time ${name} shares.`)) return;
+        await api(`/api/directory-instances/${encodeURIComponent(name)}`, {method: 'DELETE'});
+        toast(`Dropped ${name}'s snapshot`);
+      }else if(b.dataset.a === 'unblock'){
+        await api(`/api/directory-blocked/${encodeURIComponent(row.dataset.id)}`, {method: 'DELETE'});
+        toast('Unblocked. It comes back with the next snapshot that has it');
+      }
+      drawDirectoryAdmin();
+    }catch(e){ toast(e.message, true); }
+  };
+}
+
 /* ---------------- accounts ---------------- */
 async function drawAccounts(){
   const box = $('#accounts');

web/src/dialogs.ts

@@ -1,7 +1,8 @@
 /* ---------------- modals ---------------- */
-function openModal(html: string, wide?: boolean){
+/// `cls` names a dialog with a frame of its own. Set whole each time, so it never outlives its dialog.
+function openModal(html: string, wide?: boolean, cls?: string){
   $('#modalCard').innerHTML=html;
-  $('#modalCard').classList.toggle('wide',!!wide);
+  $('#modalCard').className='card'+(wide?' wide':'')+(cls?' '+cls:'');
   $('#modal').classList.add('on');
 }
 function closeModal(){
@@ -14,7 +15,6 @@ $('#addFeed').onclick=()=>{
   openModal(`<h3>Add a feed</h3>
     <div class="field"><label>Feed URL</label><input type="text" id="nurl" placeholder="https://example.com/rss">
       <span class="hint">A Patreon token on its own adds every show from that creator.</span></div>
-    <div class="field"><label>Folder (optional)</label><input type="text" id="nfolder" placeholder="Defaults to the feed title"></div>
     <div class="field"><label>Keywords (optional, comma separated)</label>
       <input type="text" id="nkw"><span class="hint">Only items matching a keyword are downloaded.</span></div>
     <label class="check"><input type="checkbox" id="nexp"> Allow items marked explicit</label>
@@ -26,7 +26,7 @@ $('#addFeed').onclick=()=>{
     $('#nsave').disabled=true; $('#nsave').title='Adding…';
     try{
       const r=await api('/api/feeds',{method:'POST',body:JSON.stringify({
-        url, folder:$('#nfolder').value.trim()||null, allow_explicit:$('#nexp').checked,
+        url, allow_explicit:$('#nexp').checked,
         keywords:$('#nkw').value.split(',').map(s=>s.trim()).filter(Boolean)})});
       closeModal(); toast(r.existing?`Already subscribed as ${r.id}`:`Added ${r.id}`);
       await loadFeeds(true); selectFeed(r.id);
@@ -34,8 +34,11 @@ $('#addFeed').onclick=()=>{
   };
 };
 
-// The rows carry an id, never a URL, so a key in someone's feed address never reaches this page.
+// The rows come from the directory through iPX (#205), and carry its id, never a URL, so a key in
-const NONE_LISTED='<p class="hint">Nothing yet. Feeds people here subscribe to show up here.</p>';
+// someone's feed address never reaches this page.
+const NONE_LISTED='<p class="hint">Nothing in the directory yet. Feeds people subscribe to show up here once their servers share them.</p>';
+// Why the directory could not be shown: none set up, or it did not answer. In iPX's words.
+let dirError='';
 
 /// One listed feed: a tile in the Directory's grid or, given its place, a row in its chart. The
 /// parts are the same either way; the class lays them out. Yours opens its feed; any other, its
@@ -57,7 +60,8 @@ function listedFeed(p,cls,rank?: number){
     // Green, as a downloaded file is: it is already yours. Plus, beside it, is the way to get one.
     (p.subscribed?`<span class="subbed" title="Subscribed: click to open it" aria-label="Subscribed">${ICON.subbed}</span>`
       :`<button class="btn ico" data-a="sub" title="Subscribe" aria-label="Subscribe">${ICON.plus}</button>`);
-  if(p.subscribed){ el.onclick=()=>selectFeed(p.id); return el; }
+  // Yours has an id here as well as the directory's, and opens by it.
+  if(p.subscribed){ el.onclick=()=>selectFeed(p.feed||p.id); return el; }
   el.onclick=()=>{ dirShow=p.id; $('#content').scrollTop=0; drawDirectory(undefined,'.dback'); };
   // Its own click, not the tile's as well.
   $('[data-a="sub"]',el).onclick=ev=>{ ev.stopPropagation(); subscribeListed(p); };
@@ -66,9 +70,9 @@ function listedFeed(p,cls,rank?: number){
 
 async function subscribeListed(p){
   try{
-    await api(`/api/popular/${encodeURIComponent(p.id)}`,{method:'POST'});
+    const r=await api(`/api/popular/${encodeURIComponent(p.id)}`,{method:'POST'});
     toast(`Subscribed to ${NAME(p)}`);
-    await loadFeeds(true); selectFeed(p.id);
+    await loadFeeds(true); selectFeed(r.id);
   }catch(e){ toast(e.message,true); }
 }
 
@@ -99,7 +103,8 @@ const KIND_WORD={All:'feed',Podcasts:'podcast',Blogs:'blog'};
 async function renderDirectory(url,box){
   // Each visit starts at the front, as going back to a tab does.
   dirCat=null; dirSub=null; dirShow=null;
-  try{ dirRows=await api(url)||[]; }catch{ dirRows=[]; }
+  dirError='';
+  try{ dirRows=await api(url)||[]; }catch(e){ dirRows=[]; dirError=e.message; }
   drawDirectory(box);
   return dirRows.length;
 }
@@ -107,7 +112,7 @@ async function renderDirectory(url,box){
 /// `focus` is the control to put the keyboard back on, since the whole page is redrawn.
 function drawDirectory(box=$('#directory'), focus?: string){
   if(!box) return;
-  if(!dirRows.length){ box.innerHTML=NONE_LISTED; return; }
+  if(!dirRows.length){ box.innerHTML=dirError?`<p class="hint">${esc(dirError)}</p>`:NONE_LISTED; return; }
   // Only a choice when the server has both kinds.
   const both=dirRows.some(KINDS.Podcasts)&&dirRows.some(KINDS.Blogs);
   if(!both) dirKind='All';
@@ -137,7 +142,7 @@ function drawDirectory(box=$('#directory'), focus?: string){
       <div class="show">${artHTML(show.image,NAME(show))}<div class="meta"><h2>${esc(NAME(show))}</h2>${
         // Its category's page is one click away from here.
         show.category?`<button type="button" class="dlink" data-go="${esc(show.category)}">${esc(show.subcategory||show.category)}</button>`:''}
-        <p class="sub">${n?`${n} ${n===1?'person here subscribes':'people here subscribe'}`:'Nobody here subscribes yet'}</p>
+        ${n?`<p class="sub">${n} ${n===1?'person subscribes':'people subscribe'}</p>`:''}
         <p class="sub dfail" id="dfail" hidden></p>
         <div class="acts"><button class="btn ico primary" data-a="sub" title="Subscribe" aria-label="Subscribe">${ICON.plus}</button></div></div></div>
       <div class="about" id="dabout" hidden><p></p><button type="button" class="dlink" aria-expanded="false" hidden>More</button></div>`
@@ -153,7 +158,7 @@ function drawDirectory(box=$('#directory'), focus?: string){
     for(const p of rows){ const c=p.category||OTHER; if(!cats.has(c)) cats.set(c,[]); cats.get(c).push(p); }
     // Other, the feeds with no category, goes last.
     const order=[...cats.keys()].sort((a,b)=>Number(a===OTHER)-Number(b===OTHER)||a.localeCompare(b));
-    html=head('Directory',`${count(rows.length)} on this server. Private feeds are never listed.`)
+    html=head('Directory',`${count(rows.length)} shared by iPX servers. Private feeds are never listed.`)
       +(chart.length?sec('Most subscribed',board):'')
       +sec('Categories',`<div class="cats">${order.map(c=>catTile(c,catName(c),count(cats.get(c).length),cats.get(c))).join('')}</div>`,
         `<button type="button" class="dall" data-go="${EVERY}">See all ${rows.length.toLocaleString()}</button>`);
@@ -220,6 +225,25 @@ async function fillShow(box,p){
   }
   // A broken feed says so, or it reads as a quiet one (#142).
   if(got.failing){ const f=$('#dfail',box); f.textContent=got.failing; f.hidden=false; }
+  // An admin whose token may administer the directory (#206); once, as Refresh fills it again.
+  const acts=$('.show .acts',box);
+  if(got.can_admin&&!$('[data-a="dremove"]',acts)){
+    acts.insertAdjacentHTML('beforeend',
+      `<button class="btn ico" data-a="drefresh" title="Check this feed now" aria-label="Check this feed now">${ICON.scan}</button>`
+      +`<button class="btn ico danger" data-a="dremove" title="Remove from the directory" aria-label="Remove from the directory">${ICON.trash}</button>`);
+    $('[data-a="drefresh"]',acts).onclick=async()=>{
+      try{ await api(`/api/directory/${encodeURIComponent(p.id)}/refresh`,{method:'POST'}); toast('Checked'); fillShow(box,p); }
+      catch(e){ toast(e.message,true); }
+    };
+    $('[data-a="dremove"]',acts).onclick=async()=>{
+      if(!confirm(`Remove ${NAME(p)} from the directory? It is blocked, so no server's snapshot brings it back. Admin, Directory can unblock it.`)) return;
+      try{ await api(`/api/directory/${encodeURIComponent(p.id)}`,{method:'DELETE'}); }
+      catch(e){ return toast(e.message,true); }
+      toast(`Removed ${NAME(p)} from the directory`);
+      dirRows=dirRows.filter(r=>r.id!==p.id); dirShow=null;
+      drawDirectory(box);
+    };
+  }
   const items=got.items;
   list.innerHTML=items.length?items.map(e=>{
     const name=entryName(e), text=name.derived?'':plainText(e.description).slice(0,500);
@@ -227,8 +251,7 @@ async function fillShow(box,p){
     return `<article class="lep"><b>${e.link?`<a href="${esc(e.link)}" target="_blank" rel="noopener">${esc(name.text)}</a>`:esc(name.text)}</b>`
       +(text?`<p>${esc(text)}</p>`:'')
       +(when.length?`<small>${when.map(s=>`<span>${s}</span>`).join('<span class="dot"></span>')}</small>`:'')+'</article>';
-  }).join(''):`<p class="hint">Nothing read from it yet.${p.subscribers||got.failing?''
+  }).join(''):'<p class="hint">Nothing read from it yet. The directory checks each feed every few hours.</p>';
-    :' A feed nobody here subscribes to is checked once a day.'}</p>`;
 }
 
 /// A category as a tile: its name, how many feeds, and the covers of its three most subscribed
@@ -362,7 +385,15 @@ function due(ts){
 /// Your settings: the theme, your subscriptions as OPML, and, to read, what the server does
 /// with feeds. The server's own settings, the accounts and the log are on /admin, which only an
 /// admin is sent (issue #19); this used to hold them too, shown to admins only.
+function deadSavedText(me){
+  const s=me&&me.deadair_saved||0;
+  return s?`It has saved you ${spanText(s)} of dead air, on episodes you heard three quarters of or more.`
+    :'Turn it on in a show\'s settings, or beside the speed while it plays, to cut the dead air from it.';
+}
+
 async function prefsModal(){
+  // Fresh, so the time saved counts what was heard since the page loaded.
+  api('/api/me').then(u=>{ S.me=u; const h=$('#sdeadsaved'); if(h) h.textContent=deadSavedText(u); }).catch(()=>{});
   const g = await api('/api/settings');
   const admin = !!(S.me&&S.me.admin);
   openModal(`<button class="iconbtn cardx" onclick="closeModal()" title="Close" aria-label="Close">${ICON.close}</button><h3>Settings</h3>
@@ -373,6 +404,8 @@ async function prefsModal(){
       <select id="smode">${Object.entries(MODES).map(([k,t])=>
         `<option value="${k}"${theme.mode===k?' selected':''}>${esc(t)}</option>`).join('')}</select>
       <span class="hint">Auto follows your system's light/dark setting.</span></div>
+    <div class="field"><label>DeadAir</label>
+      <span class="hint" id="sdeadsaved">${deadSavedText(S.me)}</span></div>
     <div class="field"><label>Subscriptions</label>
       <div class="inline">
         <!-- Words as well as icons: a floppy disk and a plus mean nothing on their own here. -->
@@ -386,7 +419,7 @@ async function prefsModal(){
       <span class="hint">Comma separated words or phrases, in every feed you read. An item with
       one in its title or text is hidden from you and not downloaded for you. Each feed's
       settings can add more.</span></div>
-    <div class="field"><label for="tokname">API tokens</label>
+    <div class="field boxed"><label for="tokname">API tokens</label>
       <div id="tokens"></div>
       <div class="inline"><input type="text" id="tokname" placeholder="What it is for">
         <button class="btn" id="tokadd" title="Make an API token" aria-label="Make an API token">${ICON.plus} Make</button></div>
@@ -440,73 +473,196 @@ async function drawTokens(){
 
 const splitWords=(s: string)=>s.split(',').map(w=>w.trim()).filter(Boolean);
 
+/// Words as chips, for the words that pick or hide items: each word or phrase ends with Enter or a
+/// comma, and comes off with its x or Backspace. One comma-separated box ran one phrase into the
+/// next (#167).
+const chipHTML=(w: string)=>`<span class="chip" data-w="${esc(w)}">${esc(w)}<button type="button" class="chipx"
+  title="Remove ${esc(w)}" aria-label="Remove ${esc(w)}">${ICON.close}</button></span>`;
+/// What goes inside a chip box. The box itself is written out where it is used, id and all: the page
+/// check finds ids by reading them, and one put together here would read as missing.
+const CHIP_HINT='Add a word or phrase';
+function chipsHTML(words: string[], input: string){
+  return `${words.map(chipHTML).join('')}<input type="text" class="chipin" id="${input}"
+    placeholder="${words.length?'':CHIP_HINT}" enterkeyhint="done" autocomplete="off" spellcheck="false">`;
+}
+/// The words in a chip box, with whatever is typed and not yet a chip.
+function chipWords(box){
+  return [...$$('.chip',box).map(c=>c.dataset.w), ...splitWords($('.chipin',box).value)];
+}
+function wireChips(box){
+  const input=$('.chipin',box);
+  // The hint only in an empty box: beside chips it reads as one more.
+  const hint=()=>{ input.placeholder=$$('.chip',box).length?'':CHIP_HINT; };
+  const add=()=>{
+    const have=$$('.chip',box).map(c=>c.dataset.w.toLowerCase());
+    for(const w of splitWords(input.value)){
+      if(have.includes(w.toLowerCase())) continue;
+      input.insertAdjacentHTML('beforebegin',chipHTML(w)); have.push(w.toLowerCase());
+    }
+    input.value=''; hint();
+  };
+  input.onkeydown=e=>{
+    if(e.key==='Enter'||e.key===','){ e.preventDefault(); add(); }
+    else if(e.key==='Backspace'&&!input.value){ input.previousElementSibling?.remove(); hint(); }
+  };
+  // Typed and left without Enter is still meant: Save takes it either way.
+  input.onblur=add;
+  box.onclick=e=>{
+    const x=e.target.closest('.chipx');
+    if(x){ x.parentElement.remove(); hint(); }
+    input.focus();
+  };
+}
+
+/// Your settings for one feed, under its address (#167). What it says is what will happen, in this feed's numbers: the download limit was a bare
+/// box whose blank, number and 0 were explained in bold small print.
 function settingsModal(f, newUrl?: string){
-  const isGroup = S.feeds.some(c=>c.group===f.id);
+  const kids=S.feeds.filter(c=>c.group===f.id).length;
-  openModal(`<h3>${esc(f.title||f.id)}</h3>
+  const isGroup=kids>0;
-    ${isGroup?`<p class="hint" style="margin:-6px 0 12px">This is ${isPatreon(f)?'a Patreon creator':'an OPML subscription'}. These
+  const parent=f.managed?S.feeds.find(p=>p.id===f.group):null;
-      settings apply to it and are inherited by every feed inside it.</p>`:''}
+  const admin=!!(S.me&&S.me.admin);
-    ${f.managed?`<p class="hint" style="margin:-6px 0 12px">This feed comes from
+  const name=f.title||f.id;
-      ${isPatreon(S.feeds.find(p=>p.id===f.group))?'a Patreon creator':'an OPML subscription'} and follows its settings. Saving anything here gives it its own entry in
+  // Blank follows the server's default; 0 is every item (#166).
-      config.toml, and it stops following the subscription's settings.</p>`:''}
+  let mode=f.max_new_per_check==null?'default':f.max_new_per_check===0?'all':'newest';
-    <p class="hint" style="margin:-4px 0 10px">These are <b>your</b> settings for this feed.
+  let newest=f.max_new_per_check>0?f.max_new_per_check:(globalMax||3);
-      Everyone else keeps their own.</p>
+  const whose=isGroup
-    <div class="field"><label>Keywords</label>
+    ? `Your settings for the ${plural(kids,'show')} in this ${isPatreon(f)?'Patreon creator':'OPML subscription'}. A show you set on its own keeps its own.`
-      <input type="text" id="skw" value="${esc(f.keywords.join(', '))}">
+    : parent
-      <span class="hint">Comma separated. Empty takes everything.</span></div>
+      ? `It comes from ${esc(parent.title||parent.id)}, and follows your settings there until you save these.`
-    ${isGroup?'':`<div class="field"><label for="sblock">Hide items mentioning</label>
+      : 'Your settings for this feed. Everyone else who reads it keeps their own.';
-      <input type="text" id="sblock" value="${esc((f.blocked||[]).join(', '))}">
+  const sw=(input: string, text: string, cls='')=>`<label class="switch${cls}"><span>${text}</span><span class="sw">${input}<i></i></span></label>`;
-      <span class="hint">Comma separated words or phrases. An item with one in its title or text
+  openModal(`<div class="fsetbody">
-      is hidden from you and not downloaded for you, as well as those your Settings hide
+    <header class="fsethead">${artHTML(f.image,name)}<div><h3>${esc(name)}</h3><p>${whose}</p></div></header>
-      everywhere.</span></div>`}
+    <div class="field faddr"><label for="surl">Address</label>
-    <div class="field"><label>Newest episodes to download</label>
+      <div class="inline"><input type="text" id="surl" value="${esc(newUrl||f.url)}" spellcheck="false"${admin?'':' readonly'}>
-      <input type="number" id="smax" min="0" value="${f.max_new_per_check??''}">
+        <button type="button" class="btn ico" id="scopy" title="Copy the address" aria-label="Copy the address">${ICON.copy}</button></div>
-      <span class="hint">Blank follows the global default (${globalMax}). Older episodes stay
+      ${newUrl?'<p class="moved">The feed says it has moved here. Save to follow it.</p>':''}</div>
-      listed to download by hand. <b>0 means every episode</b>, the whole back catalogue.</span></div>
+    <div class="fdl">${sw(`<input type="checkbox" role="switch" id="sauto"${f.auto_download?' checked':''}>`,'Download automatically',' lead')}
-    <label class="check"><input type="checkbox" id="sauto" ${f.auto_download?'checked':''}> Download new items automatically</label>
+    <div class="fdeps${f.auto_download?'':' off'}" id="sdeps"><div><div class="fdepsin">
-    <label class="check"><input type="checkbox" id="sexp" ${f.allow_explicit?'checked':''}> Allow items marked explicit</label>
+      <div class="tabs seg" role="radiogroup" aria-label="How many to download">${
-    <div class="field"><label>Feed URL</label>
+        [['default',`Default (${globalMax||'all'})`],['newest','Newest'],['all','All']].map(([v,t])=>
-      <div class="inline">
+          `<label><input type="radio" name="swin" value="${v}"${mode===v?' checked':''}>${t}</label>`).join('')}</div>
-        <input type="text" id="surl" value="${esc(newUrl||f.url)}" spellcheck="false" ${S.me&&S.me.admin?'':'readonly'}>
+      <div class="epwin" id="sepwin" aria-hidden="true"></div>
-        <button type="button" class="btn ico" id="scopy" title="Copy the URL" aria-label="Copy the URL">${ICON.copy}</button>
+      <p class="wcap" id="swcap"></p>
-      </div>
+      <div class="ffield"><label class="flabel" for="skwin">Only items that mention</label>
-      <span class="hint">${S.me&&S.me.admin
+        <div class="chips" id="skw">${chipsHTML(f.keywords,'skwin')}</div>
-        ? `Shared with everyone reading this feed. Editing it keeps every item and download —
+        <p class="cap">Any one of these will do, and a phrase needs all its words. Empty takes everything.</p></div>
-           handy when an auth token in the URL is rotated. The feed is re-checked from scratch
+      ${sw(`<input type="checkbox" role="switch" id="sexp"${f.allow_explicit?' checked':''}>`,'Include explicit items')}
-           on the next scan.`
+    </div></div></div>
-        : `The same for everyone reading this feed, so only an admin can change it.`}</span></div>
+    <div class="ffield fdead">${sw(`<input type="checkbox" role="switch" id="sdead"${f.deadair?' checked':''}>`,'DeadAir',' lead')}
-    ${S.me&&S.me.admin?`<div class="field"><label>Download folder (shared)</label>
+      <p class="cap">Cuts the dead air: long silences in ${isGroup?'these shows':'this show'} shrink to a beat, so
-      <input type="text" id="sfolder" value="${esc(f.folder||'')}" placeholder="${esc(f.title||f.id)}">
+      episodes finish sooner and every voice keeps its own pace. Leave it off for stories whose pauses
-      <span class="hint">Where the files land. There is one copy however many people
+      are part of the telling.</p>
-      subscribe, so this is the same for everyone.</span></div>`:''}
+      <div class="dpause">
-    ${S.me&&S.me.admin?`<div class="field"><label>Directory category (shared)</label>
+        <div class="dphead"><label class="flabel" for="sdpause">Breathing room</label><output id="sdpauseout" for="sdpause"></output></div>
-      <input type="text" id="scat" list="scats" value="${esc(f.category||'')}" placeholder="${esc(f.feed_category||'None')}">
+        <div class="dpslide"><input type="range" id="sdpause" min="200" max="500" step="100" value="${f.deadair_pause||300}"${f.deadair?'':' disabled'}></div>
-      <datalist id="scats"></datalist>
+        <div class="dpends" aria-hidden="true"><span>Brisk</span><span>Relaxed</span></div>
-      <span class="hint">${f.feed_category
+        <p class="cap">The silence kept where a long one is cut. More is easier on the ear; less saves more time.</p></div></div></div>
-        ? `The feed names its own, ${esc(f.feed_category)}, and the Directory uses that.`
+    ${isGroup?'':`<div class="ffield"><label class="flabel" for="sblockin">Hide items that mention</label>
-        : `The feed names none, so the Directory files it under this. Pick one already listed where it fits.`}</span></div>`:''}
+      <div class="chips" id="sblock">${chipsHTML(f.blocked||[],'sblockin')}</div>
-    <div class="cardacts"><button class="btn ico" onclick="closeModal()" title="Cancel" aria-label="Cancel">${ICON.close}</button>
+      <p class="cap">Whole words or phrases. Hidden from your list and not downloaded for you, along
-      <button class="btn ico primary" id="ssave" title="Save" aria-label="Save">${ICON.check}</button></div>`);
+      with what Settings hides everywhere.</p></div>`}
+    <div class="ffield">${sw(`<input type="checkbox" role="switch" id="sprivate"${f.private||f.private_by_address?' checked':''}${
+      f.private_by_address||(f.private&&!admin)?' disabled':''}>`,'Private',' lead')}
+      <p class="cap">${f.private_by_address
+        ?'Its address or login shows it is someone’s own, so it is never shared with the directory.'
+        :f.private&&!admin
+          ?'Never shared with the directory. Only an admin can share it again.'
+          :`Never shared with the directory, for ${isGroup?'shows':'a show'} you pay for. iPX knows most paid feeds by their address; this is for the ones it does not.`}</p></div>
+    </div>
+    <div class="cardacts fsetfoot"><button class="btn ico" onclick="closeModal()" title="Cancel" aria-label="Cancel">${ICON.close}</button>
+      <button class="btn ico primary" id="ssave" title="Save" aria-label="Save">${ICON.check}</button></div>`, false, 'fset');
+
+  // What only matters while it downloads on its own folds away, out of reach, when it does not.
+  const deps=$('#sdeps'), inner=$('.fdepsin',deps);
+  inner.inert=!f.auto_download;
+  $('#sauto').onchange=e=>{ deps.classList.toggle('off',!e.target.checked); inner.inert=!e.target.checked; };
+
+  // The download limit, said as what it does. A number in a box hid that it is a window on the
+  // newest items, not a pace through the back catalogue (#97).
+  const each=isGroup?' of each show':'';
+  const older=' Older ones stay listed, to download by hand.';
+  const caption=()=>mode==='newest'
+    ? `Downloads the newest <input type="number" id="smax" min="1" value="${newest}"
+        aria-label="How many of the newest to download">${each} on its own.${older}`
+    : mode==='all'
+      ? `Downloads every item${each}: the whole back catalogue${!isGroup&&f.entries?`, ${f.entries} so far`:''}, and each new one.`
+      : globalMax
+        ? `The server's default: downloads the newest ${globalMax}${each} on its own.${older}`
+        : `The server's default: downloads every item${each}, the whole back catalogue.`;
+  const limit=()=>mode==='all'||(mode==='default'&&!globalMax)?Infinity:mode==='default'?globalMax:newest;
+  let bars=[];
+  const draw=(words: boolean)=>{
+    // The newest items with a file, as hold_back counts them: one whose files a filter all
+    // skipped holds no place.
+    let left=limit();
+    // Everything: the older ones past the strip are lit too, in words.
+    $('#sepwin')?.classList.toggle('all',left===Infinity);
+    for(const b of bars){
+      const on=!b.classList.contains('nofile')&&left>0;
+      if(on) left--;
+      b.classList.toggle('on',on);
+    }
+    if(!words) return;
+    $('#swcap').innerHTML=caption();
+    const n=$('#smax');
+    if(n) n.oninput=()=>{ newest=Math.max(1,Math.floor(Number(n.value))||1); draw(false); };
+  };
+  for(const r of $$('[name=swin]')) r.onchange=()=>{ mode=r.value; draw(true); };
+  // Breathing room only matters with DeadAir on: greyed out, not hidden, so it can be seen beforehand.
+  $('#sdead').onchange=e=>{ $('#sdpause').disabled=!e.target.checked; };
+  const pause=$('#sdpause'), pauseText=()=>{ const s=`${pause.value/1000} s`; $('#sdpauseout').textContent=s; pause.setAttribute('aria-valuetext',s); };
+  pause.oninput=pauseText; pauseText();
+  draw(true);
+  // The feed's own newest items, each as tall as it is long, so the strip reads as this show.
+  if(!isGroup) api(`/api/feeds/${encodeURIComponent(f.id)}/entries?limit=40`).then(page=>{
+    const items=page?.entries||[];
+    const strip=$('#sepwin'); if(!items.length||!strip) return;
+    const longest=Math.max(1,...items.map(e=>e.duration||0));
+    strip.innerHTML=items.map((e,i)=>{
+      const file=e.enclosures.some(x=>x.state!=='skipped');
+      const h=e.duration?Math.round(30+70*Math.sqrt(e.duration/longest)):60;
+      return `<i class="${file?'':'nofile'}" style="--h:${h}%;--n:${i}"></i>`;
+    }).join('')+(f.entries>items.length?`<small>+${f.entries-items.length} older</small>`:'');
+    bars=$$('i',strip);
+    draw(false);
+    // Drag along it to set how many: as far as the finger, the newest that far down.
+    const pick=(x: number)=>{
+      let n=0;
+      for(const b of bars){
+        if(!b.classList.contains('nofile')) n++;
+        if(x<=b.getBoundingClientRect().right) break;
+      }
+      newest=Math.max(1,n);
+      if(mode!=='newest'){ mode='newest'; $('[name=swin][value=newest]').checked=true; draw(true); }
+      else { $('#smax').value=String(newest); draw(false); }
+    };
+    strip.onpointerdown=e=>{ strip.setPointerCapture(e.pointerId); pick(e.clientX); };
+    strip.onpointermove=e=>{ if(strip.hasPointerCapture(e.pointerId)) pick(e.clientX); };
+  }).catch(()=>{});
+
+  wireChips($('#skw'));
+  if($('#sblock')) wireChips($('#sblock'));
   $('#scopy').onclick=()=>copyText($('#surl').value,$('#scopy'));
-  // Offer the categories the Directory already shows, so a blog about games joins Games rather
+  // Opened to follow a feed that moved: the new address is what there is to look at.
-  // than starting a second chip beside it.
+  if(newUrl){ $('#surl').scrollIntoView({block:'center'}); $('#surl').focus(); }
-  if($('#scats')) api('/api/directory').then(rows=>{ $('#scats').innerHTML=[...new Set((rows||[])
+
-    .flatMap(p=>[p.category,p.subcategory]).filter(Boolean))].sort().map(c=>`<option value="${esc(c)}">`).join(''); }).catch(()=>{});
   $('#ssave').onclick=async()=>{
-    const max=$('#smax').value;
     try{
       const patch: Record<string, unknown>={
-        keywords:splitWords($('#skw').value),
+        keywords:chipWords($('#skw')),
-        max_new_per_check:max===''?null:Number(max),
+        max_new_per_check:mode==='default'?null:mode==='all'?0:newest,
-        auto_download:$('#sauto').checked, allow_explicit:$('#sexp').checked};
+        auto_download:$('#sauto').checked, allow_explicit:$('#sexp').checked, deadair:$('#sdead').checked,
-      if($('#sblock')) patch.blocked=splitWords($('#sblock').value);
+        deadair_pause:Number($('#sdpause').value)};
-      // The shared half is an admin's to change, and the API refuses it from anyone else.
+      if($('#sblock')) patch.blocked=chipWords($('#sblock'));
-      if(S.me&&S.me.admin){
+      // Sent only when it changed: anyone may mark a feed private, but only an admin unmark it.
-        patch.url=$('#surl').value.trim();
+      const priv=$('#sprivate');
-        patch.folder=$('#sfolder').value.trim()||null;
+      if(!priv.disabled&&priv.checked!==!!f.private) patch.private=priv.checked;
-        patch.category=$('#scat').value.trim()||null;
+      // The address is the same for everyone: an admin's to change, for a feed that moved, and the
-      }
+      // API refuses it from anyone else. The folder and category are not this dialog's at all.
+      if(admin) patch.url=$('#surl').value.trim();
       await api(`/api/feeds/${encodeURIComponent(f.id)}`,{method:'PATCH',body:JSON.stringify(patch)});
-      closeModal(); toast('Saved — applies on the next scan');
+      closeModal(); toast('Saved. It applies from the next check.');
       await loadFeeds(true); renderFeed(); loadEntries();
     }catch(e){ toast(e.message,true); }
   };
@@ -582,6 +738,13 @@ $('#signout').onclick=async()=>{ await api('/api/logout',{method:'POST'}); locat
 api('/api/me').then(u=>{
   S.me=u;
   $('#who').textContent=u.name+(u.admin?' · admin':'');
+  // ipx's version and the page's, each released on its own.
+  $('#applogo').title=`iPX ${u.version}, page __WEB_VERSION__`;
+  // Whether the link to Admin shows, now and before the first frame of the next visit.
+  document.documentElement.toggleAttribute('data-admin',!!u.admin);
+  try{ localStorage.setItem('ipx.admin',u.admin?'1':'0'); }catch{}
+  // A browser with no theme of its own takes the one the account kept from before, once.
+  if(u.theme&&!/(^|; )ipx_theme=/.test(document.cookie)) setTheme(u.theme.name,u.theme.mode,true);
 }).catch(()=>{});
 $('#feedFilter').oninput=renderFeeds;
 // The feed list from the keyboard: Enter or Space opens a row, Right and Left open and close a

web/src/events.ts

@@ -1,9 +1,22 @@
 /* ---------------- live events ---------------- */
 let sse;
+/// The feed list and the open list, taken again from the server. The events keep both current,
+/// and one missed is a count wrong until a reload: reading an item sends none to your other
+/// pages, so one read on another device stayed unread here, and an iPhone stops the stream while
+/// the app is in the background, when everything is missed (#168).
+const catchUp=(()=>{ let t; return ()=>{ clearTimeout(t); t=setTimeout(()=>{
+  loadFeeds(true).catch(()=>{});
+  if(S.feed) loadEntries().catch(()=>{});
+},300); }; })();
+document.addEventListener('visibilitychange',()=>{ if(!document.hidden) catchUp(); });
+let dropped=false;
 function connect(){
   sse=new EventSource('/api/events');
+  // Back after a drop: whatever was sent meanwhile went to nobody.
+  sse.onopen=()=>{ if(dropped){ dropped=false; catchUp(); } };
   const soon=(fn,ms=500)=>{ let t; return ()=>{ clearTimeout(t); t=setTimeout(fn,ms); }; };
-  const refreshEntries=soon(()=>{ if(S.feed) loadEntries(); });
+  // Caught: a network gone when one fires (a laptop asleep) was an unhandled rejection (#219).
+  const refreshEntries=soon(()=>{ if(S.feed) loadEntries().catch(()=>{}); });
   // Every scan's events reach everyone; only this person's feeds are theirs to show or refresh.
   const mine=id=>S.feeds.some(f=>f.id===id);
   sse.onmessage=m=>{
@@ -23,6 +36,13 @@ function connect(){
       if(bar){ bar.classList.remove('live'); toast('Downloaded '+ev.path.split('/').pop()); }
       refreshEntries();
     }
+    // A copy finished: the episode's "Cutting dead air…" becomes how much shorter it is.
+    else if(ev.ev==='deadair_done'){
+      if(!mine(ev.feed)) return;
+      if(ev.saved_s>0&&document.querySelector('.dapend')) toast(`DeadAir is done: ${shorter(ev.saved_s)}`);
+      refreshEntries();
+      if(S.sel) loadEntries().then(()=>{ const e=cur(); if(e) showDetail(e); }).catch(()=>{});
+    }
     else if(ev.ev==='download_error'){
       const bar=document.querySelector(`.dlbar[data-bar="${ev.enclosure}"]`);
       if(bar) bar.classList.remove('live');
@@ -48,7 +68,7 @@ function connect(){
     // page reloads; reload the list here when a scan synced an OPML if that ever matters.
     else if(ev.ev==='scan_done'){ scanning.clear(); paintScanning(); if(ev.feeds) refreshEntries(); }
   };
-  sse.onerror=()=>{ sse.close(); setTimeout(connect,4000); };
+  sse.onerror=()=>{ sse.close(); dropped=true; setTimeout(connect,4000); };
 }
 connect();
-loadFeeds();
+loadFeeds().catch(()=>{});

web/src/gestures.ts

@@ -95,7 +95,7 @@ document.addEventListener('touchmove', ev => {
 }, {passive: false});
 
 /// On a phone, what lies beside the reader while it is dragged by dx: the item it will move on
-/// to, a note that there are no more, or, going back to the list, a dimmer over the list. The
+/// to, the accent past the last one, or, going back to the list, a dimmer over the list. The
 /// reader sits over the list there, and moving it alone showed the list through the gap it left
 /// (issue #52). Kept outside #content, which every feed render rebuilds, and inert, since its
 /// copy of the reader's markup repeats the reader's ids.
@@ -109,7 +109,7 @@ function beside(dx: number){
   }
   if(p.dataset.key !== kind + (e?.guid || '')){
     p.dataset.key = kind + (e?.guid || ''); p.className = kind;
-    p.innerHTML = e ? `<div>${detailHtml(e)}</div>` : kind === 'end' ? '<p>No more items</p>' : '';
+    p.innerHTML = e ? `<div>${detailHtml(e)}</div>` : '';
   }
   return p;
 }

web/src/items.ts

@@ -39,7 +39,8 @@ function renderEntries(){
   const pane=$('#list'), top=pane?pane.scrollTop:0;
   box.innerHTML='';
   if(!S.entries.length){
-    box.innerHTML=`<p class="empty">${S.q?'Nothing matches that search.':'Nothing here yet — try Scan now.'}</p>`;
+    // Said only for a search, where the words typed are why; an empty feed or tab speaks for itself.
+    if(S.q) box.innerHTML='<p class="empty">Nothing matches that search.</p>';
     return;
   }
   for(const e of S.entries) box.appendChild(epEl(e));
@@ -77,6 +78,8 @@ function epEl(e){
         num&&`<span>${num}</span>`,
         left&&`<span>${left}</span>`,
         others>0&&`<span>+${others} more file${others===1?'':'s'}</span>`,
+        enc&&enc.deadair>0&&`<span title="DeadAir cut its dead air">${shorter(enc.deadair)}</span>`,
+        enc&&enc.deadair_pending&&DEAD_PENDING,
         enc&&enc.last_error&&enc.state==='error'&&`<span style="color:var(--bad)">${esc(enc.last_error)}</span>`,
       ].filter(Boolean).join('<span class="dot"></span>')}</div>
     </div>
@@ -265,7 +268,7 @@ function showDetail(e){
   syncTools(e);
   if(!e){
     dropTurned(S.sel);
-    box.innerHTML='<p class="empty">Pick an item to read it.</p>';
+    box.innerHTML='';
     if(files) files.innerHTML='<p class="empty">No files</p>';
     return;
   }
@@ -298,15 +301,16 @@ function detailHtml(e){
          themselves would read as a mistake. */ e.title&&e.title.trim() ? `<h3 class="dt">${esc(e.title)}</h3>` : ''}
     <div class="dmeta">
       ${/* Joined, so a missing date or number leaves no stray dot behind. */
-        [f&&esc(f.title||f.id), num, dateOf(e.published), e.duration&&clock(e.duration)]
+        [f&&esc(f.title||f.id), num, dateOf(e.published), e.duration&&clock(e.duration),
+         e.enclosures.some(x=>x.deadair_pending)&&DEAD_PENDING]
         .filter(Boolean).map(s=>`<span>${s}</span>`).join('<span class="dot"></span>')}
-      <button class="btn ico" data-a="read" title="Mark ${e.read?'unread':'read'}"
+      <span class="dacts"><button class="btn ico" data-a="read" title="Mark ${e.read?'unread':'read'}"
         aria-label="Mark ${e.read?'unread':'read'}" aria-pressed="${!!e.read}">${e.read?ICON.check:ICON.unread}</button>
       <button class="btn ico" data-a="flag" title="${e.flagged?'Pinned: never deleted. Unpin':'Pin, so it is never deleted'}"
         aria-label="${e.flagged?'Unpin':'Pin'}" aria-pressed="${!!e.flagged}">${e.flagged?ICON.pinOn:ICON.pin}</button>
       ${e.link?`<a class="btn ico" href="${esc(e.link)}" target="_blank" rel="noopener noreferrer"
         title="Open the original" aria-label="Open the original">${ICON.open}</a>
-      <button class="btn ico" data-a="share" title="Share" aria-label="Share">${ICON.share}</button>`:''}
+      <button class="btn ico" data-a="share" title="Share" aria-label="Share">${ICON.share}</button>`:''}</span>
     </div>
     ${narrow?encs:''}
     <div class="dbody">${(e.description&&e.description.trim())||'<em>No show notes.</em>'}</div>`;
@@ -323,7 +327,9 @@ function encBox(x){
     ? `Delete for everyone (shared with ${f.subscribers-1} other ${f.subscribers===2?'person':'people'} reading this feed)`
     : 'Delete file';
   const delBtn=`<button class="btn ico danger" data-a="del" data-enc="${x.id}" title="${delLabel}" aria-label="${delLabel}">${ICON.trash}</button>`;
-  const saveBtn=`<a class="btn ico" href="/media/${x.id}" download title="Save to this computer" aria-label="Save to this computer">${ICON.save}</a>`;
+  // Played without its dead air, so saved without it too (#186).
+  const saveLabel=x.deadair>0?'Save to this computer, without its dead air':'Save to this computer';
+  const saveBtn=`<a class="btn ico" href="/media/${x.id}${x.deadair>0?'/deadair':''}" download title="${saveLabel}" aria-label="${saveLabel}">${ICON.save}</a>`;
   // The publisher's address, not this server's copy, which only someone signed in here can open.
   const shareBtn=`<button class="btn ico" data-a="share" data-enc="${x.id}" title="Share the file" aria-label="Share the file">${ICON.share}</button>`;
   if(x.path && !isPlayable(x)){

web/src/player.ts

@@ -1,8 +1,42 @@
 /* ---------------- player ---------------- */
 const audio=$('#audio');
-const player: {guid: string|null, feed: string|null, entry: any, enc?: number, moved?: boolean,
+const player: {guid: string|null, feed: string|null, entry: any, enc?: number, src?: string, moved?: boolean,
   saveAt: number, marked: boolean}={guid:null,feed:null,entry:null,saveAt:0,marked:false};
 
+/// Where a file plays from: DeadAir's playlist when the server says this person plays it
+/// shortened (#171, #181), whose times the entry is already given in, else the file itself.
+const mediaSrc=enc=>enc.deadair!=null?`/media/${enc.id}/deadair.m3u8`:`/media/${enc.id}`;
+
+/// hls.js, playing DeadAir's playlist where the browser cannot itself. Fetched the first time it
+/// is needed. Only Apple's browsers play it themselves: Chromium says it can ("maybe"), then fails
+/// on the playlist's MP3 ranges with "stream parsing failed", and so plays nothing.
+let hls: any=null;
+function dropHls(){ if(hls){ hls.destroy(); hls=null; } }
+/// Puts a file in the player: null when it is there at once, else a promise to wait on before
+/// playing, while hls.js loads. Safari always takes the first way, where play() has to run within
+/// the tap itself or it is refused.
+function setSrc(url: string): Promise<void>|null{
+  dropHls();
+  const native=navigator.vendor.startsWith('Apple')&&!!audio.canPlayType('application/vnd.apple.mpegurl');
+  // Safari fetches the playlist itself, with no header to carry the tap's trace: in the address
+  // instead (#192). Only the playlist, which is never cached.
+  if(!url.endsWith('.m3u8')){ audio.src=url; return null; }
+  if(native){ audio.src=`${url}?traceparent=${traceparent()}`; return null; }
+  const w=window as any;
+  const ready=w.Hls?Promise.resolve():new Promise<void>((ok,fail)=>{
+    const s=document.createElement('script');
+    s.src='__HLS_JS__'; s.onload=()=>ok(); s.onerror=()=>fail(new Error('the DeadAir player did not load'));
+    document.head.append(s);
+  });
+  return ready.then(()=>{
+    // Its playlist and audio requests join the trace of the tap that played them (#192).
+    hls=new w.Hls({xhrSetup:(xhr: XMLHttpRequest)=>xhr.setRequestHeader('traceparent',traceparent())});
+    hls.on(w.Hls.Events.ERROR,(_,d)=>{ if(d.fatal){ toast('Playback failed: '+d.details,true);
+      report('player_error',{msg:`hls.js: ${d.type} ${d.details}`,feed:player.feed,enclosure:player.enc}); } });
+    hls.loadSource(url); hls.attachMedia(audio);
+  });
+}
+
 // Marked read when an item has actually been listened to -- at the end, or past 90%.
 // NOT on play: doing that made the item vanish from the Unread list the instant
 // you pressed play, which looks exactly like it went missing.
@@ -20,14 +54,16 @@ function play(e,enc=e.enclosures.find(isPlayable)){
     toast(e.enclosures.some(x=>x.path) ? 'That file is not audio or video' : 'Not downloaded yet', true);
     return;
   }
-  // The same file carries on where it was; another of the item's files starts from its top.
+  // The same file carries on where it was; another of the item's files starts from its top. So
-  const resuming = player.guid===e.guid && player.enc===enc.id;
+  // does the other version of the same file, from the place the entry gives in its clock.
+  const resuming = player.guid===e.guid && player.enc===enc.id && player.src===mediaSrc(enc);
   // Every play button is a pause button for what is playing, as the player bar's is.
   if(resuming && !audio.paused){ audio.pause(); return; }
+  let wait: Promise<void>|null=null;
   if(!resuming){
     player.guid=e.guid; player.feed=e.feed_id; player.entry=e; player.enc=enc.id; player.moved=false;
     document.body.classList.toggle('has-video', kindOf(enc)==='video');
-    audio.src=`/media/${enc.id}`;
+    wait=setSrc(player.src=mediaSrc(enc));
     audio.currentTime=0;
     if(e.position>5) audio.addEventListener('loadedmetadata',()=>{audio.currentTime=e.position},{once:true});
     // Initials, if it comes to that, are the feed's: the episode's read as "SE" beside the feed's art.
@@ -38,8 +74,10 @@ function play(e,enc=e.enclosures.find(isPlayable)){
     $('#player').classList.add('on');
     mediaSession(e,f);
     player.marked=false;
+    paintDead();
   }
-  audio.play().catch(err=>toast('Playback failed: '+err.message,true));
+  const go=()=>audio.play().catch(err=>toast('Playback failed: '+err.message,true));
+  if(wait) wait.then(go,err=>toast('Playback failed: '+err.message,true)); else go();
   renderEntries();
 }
 function mediaSession(e,f){
@@ -78,7 +116,8 @@ function savePos(){
   // cannot tell a finished episode from a started one. NaN before metadata, Infinity on a stream.
   const duration=isFinite(audio.duration)?Math.floor(audio.duration):null;
   navigator.sendBeacon?.(
-    `/api/entries/${encodeURIComponent(player.feed)}/${encodeURIComponent(player.guid)}/position`,
+    // A beacon sends no headers, so the trace goes in the address (#192).
+    `/api/entries/${encodeURIComponent(player.feed)}/${encodeURIComponent(player.guid)}/position?traceparent=${traceparent()}`,
     new Blob([JSON.stringify({secs:Math.floor(audio.currentTime),duration})],{type:'application/json'}));
 }
 audio.addEventListener('pause',savePos);
@@ -104,13 +143,69 @@ function syncPlayButtons(){
 }
 for(const ev of ['play','pause','timeupdate']) audio.addEventListener(ev,syncListening);
 window.addEventListener('beforeunload',savePos);
+
+/// For the server's log (#190): how long play takes to start, how long it stalls for, and what
+/// the browser says when it cannot play a file at all.
+let asked=0, waited=0;
+const playing=()=>({feed:player.feed,enclosure:player.enc,deadair:!!player.src?.endsWith('.m3u8')});
+audio.addEventListener('play',()=>{ asked=performance.now(); });
+audio.addEventListener('waiting',()=>{ if(!asked) waited=performance.now(); });
+audio.addEventListener('playing',()=>{
+  const now=performance.now();
+  if(asked) report('play_start',{ms:Math.round(now-asked),...playing()});
+  else if(waited && now-waited>=500) report('stall',{ms:Math.round(now-waited),...playing()});
+  asked=0; waited=0;
+});
+audio.addEventListener('error',()=>{ if(audio.error) report('player_error',{msg:`media error ${audio.error.code}: ${audio.error.message}`,...playing()}); });
 $('#pplay').onclick=()=>audio.paused?audio.play():audio.pause();
 $('#pback').onclick=()=>audio.currentTime-=15;
 $('#pfwd').onclick=()=>audio.currentTime+=30;
 $('#seek').oninput=e=>{const d=audio.duration;if(d)audio.currentTime=d*e.target.value/1000};
 $('#rate').onchange=e=>{audio.playbackRate=+e.target.value;localStorage.setItem('ipx.rate',e.target.value)};
 $('#vol').oninput=e=>{audio.volume=e.target.value/100;localStorage.setItem('ipx.vol',e.target.value)};
-$('#pclose').onclick=()=>{savePos();audio.pause();audio.removeAttribute('src');player.guid=null;$('#player').classList.remove('on');document.body.classList.remove('has-video');renderEntries();
+/// DeadAir's switch beside the speed: on or off for the show that is playing. The state is in the
+/// icon's shape and aria-pressed, never a colour.
+function paintDead(){
+  const b=$('#pdead'), f=S.feeds.find(x=>x.id===player.feed);
+  b.hidden=!f||document.body.classList.contains('has-video');
+  if(b.hidden) return;
+  b.setAttribute('aria-pressed',String(!!f.deadair));
+  b.innerHTML=f.deadair?ICON.deadairOn:ICON.deadair;
+  b.title=f.deadair?'DeadAir is cutting the dead air from this show':'DeadAir: cut the dead air from this show';
+}
+$('#pdead').onclick=async()=>{
+  const f=S.feeds.find(x=>x.id===player.feed); if(!f) return;
+  const on=!f.deadair;
+  try{ await api(`/api/feeds/${encodeURIComponent(f.id)}`,{method:'PATCH',body:JSON.stringify({deadair:on})}); }
+  catch(err){ toast(err.message,true); return; }
+  f.deadair=on; paintDead();
+  const switched=await switchVersion();
+  toast(!on?'DeadAir is off for this show':switched?'DeadAir is cutting the dead air from this show'
+    :'DeadAir is on for this show. Episodes lose their dead air a few minutes after they download.');
+  renderEntries();
+};
+/// Carries on at the same place in the other version of what is playing, once DeadAir has been
+/// turned on or off for its show. True if it changed version: a copy not made yet plays next time.
+async function switchVersion(){
+  if(!player.guid) return false;
+  const [feed,guid]=[player.feed,player.guid].map(encodeURIComponent);
+  // Saved and waited for, not beaconed, so the entry asked for next has this place in it.
+  if(audio.readyState){
+    await api(`/api/entries/${feed}/${guid}/position`,{method:'POST',body:JSON.stringify({
+      secs:Math.floor(audio.currentTime),duration:isFinite(audio.duration)?Math.floor(audio.duration):null})}).catch(()=>{});
+    player.moved=false;
+  }
+  const e=await api(`/api/entries/${feed}/${guid}`).catch(()=>null);
+  const enc=e&&e.enclosures.find(x=>x.id===player.enc);
+  if(!enc||mediaSrc(enc)===player.src) return false;
+  const was=!audio.paused;
+  player.entry=e; player.src=mediaSrc(enc); player.saveAt=e.position;
+  const wait=setSrc(player.src);
+  audio.addEventListener('loadedmetadata',()=>{audio.currentTime=e.position},{once:true});
+  if(was) (wait||Promise.resolve()).then(()=>audio.play()).catch(()=>{});
+  return true;
+}
+$('#pclose').onclick=()=>{savePos();audio.pause();dropHls();audio.removeAttribute('src');player.guid=null;$('#player').classList.remove('on');document.body.classList.remove('has-video');renderEntries();
   // Called here, not left to the pause event: closing a player already paused fires none.
   syncListening()};
 (function restore(){

web/src/theme.ts

@@ -38,6 +38,10 @@ function setTheme(name = theme.name, mode = theme.mode, save = false){
     : theme.mode === 'auto' ? (systemDark && !systemDark.matches ? 'light' : 'dark') : theme.mode;
   // The tab's icon in the same variant as the logo on the page.
   const fav = $('#favicon'); if(fav) fav.href = fav.dataset[root.dataset.mode];
+  // The top bar's colour for an iPhone before iOS 26 to paint behind the status bar, as Android's
+  // toolbar does; the page's where the bar is see-through (Glass). iOS 26 reads the bar itself.
+  const tc = $('meta[name=theme-color]'), bar = $('#topbar');
+  if(tc){ const c = bar ? getComputedStyle(bar).backgroundColor : ''; tc.content = /^rgb\(/.test(c) ? c : getComputedStyle(root).backgroundColor; }
   const sel = $('#stheme'); if(sel) sel.value = theme.name;
   const ms = $('#smode'); if(ms) ms.value = theme.mode;
   const mf = $('#smodefield'); if(mf) mf.hidden = !both;
@@ -51,9 +55,9 @@ function saveTheme(){
 systemDark?.addEventListener?.('change', () => { if(theme.mode === 'auto') setTheme(); });
 (() => {
   const root = document.documentElement;
-  // Without a cookie, the server sent the theme the account kept from before; this browser takes
+  // The head script put this browser's theme from its cookie on the page. Without one, /api/me's
-  // it as its own, once, so nobody has to choose again.
+  // answer brings the account's from before (dialogs.ts).
-  if(root.dataset.choice) return setTheme(root.dataset.theme, root.dataset.choice, !/(^|; )ipx_theme=/.test(document.cookie));
+  if(root.dataset.choice) return setTheme(root.dataset.theme, root.dataset.choice);
   // Nothing on the account either. A theme this browser kept in localStorage, from before that,
   // becomes its cookie, once.
   let name: string | null = null, mode: string | null = null;

web/src/util.ts

@@ -21,6 +21,10 @@ const ICON={
   // for the outline's stroke, so the two draw the same size.
   pin:fa('-18 -18 420 548','<path fill="none" stroke="currentColor" stroke-width="36" stroke-linejoin="round" d="M32 32C32 14.3 46.3 0 64 0L320 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l-29.5 0 11.4 148.2c36.7 19.9 65.7 53.2 79.5 94.7l1 3c3.3 9.8 1.6 20.5-4.4 28.8s-15.7 13.3-26 13.3L32 352c-10.3 0-19.9-4.9-26-13.3s-7.7-19.1-4.4-28.8l1-3c13.8-41.5 42.8-74.8 79.5-94.7L93.5 64 64 64C46.3 64 32 49.7 32 32zM160 384l64 0 0 96c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-96z"/>'), // solid/thumbtack, outlined
   pinOn:fa('-18 -18 420 548','<path fill="currentColor" d="M32 32C32 14.3 46.3 0 64 0L320 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l-29.5 0 11.4 148.2c36.7 19.9 65.7 53.2 79.5 94.7l1 3c3.3 9.8 1.6 20.5-4.4 28.8s-15.7 13.3-26 13.3L32 352c-10.3 0-19.9-4.9-26-13.3s-7.7-19.1-4.4-28.8l1-3c13.8-41.5 42.8-74.8 79.5-94.7L93.5 64 64 64C46.3 64 32 49.7 32 32zM160 384l64 0 0 96c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-96z"/>'), // solid/thumbtack
+  // DeadAir (#171): a waveform. Off for this show, outlined with the silence still in its
+  // middle; on, solid with the gap closed up. Padded like pin for the outline's stroke.
+  deadair:fa('-16 -16 544 544','<g fill="none" stroke="currentColor" stroke-width="24"><rect x="14" y="200" width="44" height="112" rx="22"/><rect x="84" y="136" width="44" height="240" rx="22"/><rect x="154" y="96" width="44" height="320" rx="22"/><rect x="314" y="96" width="44" height="320" rx="22"/><rect x="384" y="136" width="44" height="240" rx="22"/><rect x="454" y="200" width="44" height="112" rx="22"/></g>'),
+  deadairOn:fa('-16 -16 544 544','<g fill="currentColor"><rect x="59" y="200" width="44" height="112" rx="22"/><rect x="129" y="136" width="44" height="240" rx="22"/><rect x="199" y="96" width="44" height="320" rx="22"/><rect x="269" y="96" width="44" height="320" rx="22"/><rect x="339" y="136" width="44" height="240" rx="22"/><rect x="409" y="200" width="44" height="112" rx="22"/></g>'),
   scan:fa('0 0 512 512','<path fill="currentColor" d="M65.9 228.5c13.3-93 93.4-164.5 190.1-164.5 53 0 101 21.5 135.8 56.2 .2 .2 .4 .4 .6 .6l7.6 7.2-47.9 0c-17.7 0-32 14.3-32 32s14.3 32 32 32l128 0c17.7 0 32-14.3 32-32l0-128c0-17.7-14.3-32-32-32s-32 14.3-32 32l0 53.4-11.3-10.7C390.5 28.6 326.5 0 256 0 127 0 20.3 95.4 2.6 219.5 .1 237 12.2 253.2 29.7 255.7s33.7-9.7 36.2-27.1zm443.5 64c2.5-17.5-9.7-33.7-27.1-36.2s-33.7 9.7-36.2 27.1c-13.3 93-93.4 164.5-190.1 164.5-53 0-101-21.5-135.8-56.2-.2-.2-.4-.4-.6-.6l-7.6-7.2 47.9 0c17.7 0 32-14.3 32-32s-14.3-32-32-32L32 320c-8.5 0-16.7 3.4-22.7 9.5S-.1 343.7 0 352.3l1 127c.1 17.7 14.6 31.9 32.3 31.7S65.2 496.4 65 478.7l-.4-51.5 10.7 10.1c46.3 46.1 110.2 74.7 180.7 74.7 129 0 235.7-95.4 253.4-219.5z"/>'), // solid/arrows-rotate
   download:fa('0 0 448 512','<path fill="currentColor" d="M256 32c0-17.7-14.3-32-32-32s-32 14.3-32 32l0 210.7-41.4-41.4c-12.5-12.5-32.8-12.5-45.3 0s-12.5 32.8 0 45.3l96 96c12.5 12.5 32.8 12.5 45.3 0l96-96c12.5-12.5 12.5-32.8 0-45.3s-32.8-12.5-45.3 0L256 242.7 256 32zM64 320c-35.3 0-64 28.7-64 64l0 32c0 35.3 28.7 64 64 64l320 0c35.3 0 64-28.7 64-64l0-32c0-35.3-28.7-64-64-64l-46.9 0-56.6 56.6c-31.2 31.2-81.9 31.2-113.1 0L110.9 320 64 320zm304 56a24 24 0 1 1 0 48 24 24 0 1 1 0-48z"/>'), // solid/download
   save:fa('0 0 448 512','<path fill="currentColor" d="M64 32C28.7 32 0 60.7 0 96L0 416c0 35.3 28.7 64 64 64l320 0c35.3 0 64-28.7 64-64l0-242.7c0-17-6.7-33.3-18.7-45.3L352 50.7C340 38.7 323.7 32 306.7 32L64 32zm32 96c0-17.7 14.3-32 32-32l160 0c17.7 0 32 14.3 32 32l0 64c0 17.7-14.3 32-32 32l-160 0c-17.7 0-32-14.3-32-32l0-64zM224 288a64 64 0 1 1 0 128 64 64 0 1 1 0-128z"/>'), // solid/floppy-disk
@@ -56,10 +60,51 @@ const EQ='<span class="eq" aria-hidden="true"><i></i><i></i><i></i></span>';
 // The page's own buttons name their icon; this draws it in, ahead of any label they carry.
 for(const b of $$('[data-icon]')) b.insertAdjacentHTML('afterbegin',ICON[b.dataset.icon]);
 
+/// An episode whose DeadAir copy is still being made: it plays as it is until then, and the line
+/// becomes how much shorter it is once the copy is ready (the dead_air event).
+const DEAD_PENDING='<span class="dapend" title="DeadAir is still working on this episode. Until it is done, it plays at its full length.">Cutting dead air…</span>';
+/// What DeadAir took off an episode, as the list says it.
+function shorter(secs){ return secs<60?`${secs} s shorter`:`${Math.round(secs/60)} min shorter`; }
+/// A total of time saved: "3 h 12 min", "12 min", "40 s".
+function spanText(secs){
+  const h=Math.floor(secs/3600), m=Math.floor(secs%3600/60);
+  return h?`${h} h ${m} min`:m?`${m} min`:`${secs} s`;
+}
+/// One trace for each thing you do (#190): the requests a tap or a key sets off share a trace id,
+/// sent as traceparent, so Tempo shows them together. getRandomValues, not randomUUID, which a
+/// LAN address over plain HTTP does not have. A trace ends after a minute with no request in it:
+/// the requests a live update or a woken laptop sets off hours later used to join the last tap's
+/// trace, which then lasted nine hours (#219). A play's position saves, every ten seconds, keep it.
+let traceId='', traceAt=0;
+const hex=(n: number)=>Array.from(crypto.getRandomValues(new Uint8Array(n)),b=>b.toString(16).padStart(2,'0')).join('');
+for(const t of ['pointerdown','keydown']) window.addEventListener(t,()=>{ traceId=hex(16); traceAt=Date.now(); },{capture:true,passive:true});
+function traceparent(){
+  const now=Date.now();
+  if(!traceId||now-traceAt>60_000) traceId=hex(16);
+  traceAt=now;
+  return `00-${traceId}-${hex(8)}-01`;
+}
+
+/// Something that went wrong, or how long something took, in the browser, for the server's log
+/// (#190). The same thing at most once a minute: a failure in a loop would otherwise send a line
+/// a frame.
+const reported=new Map<string,number>();
+function report(ev: string, o: Record<string,any>={}){
+  const key=ev+(o.msg||''), now=Date.now();
+  if(o.msg==='signed out' || now-(reported.get(key)||0)<60_000) return;
+  reported.set(key,now);
+  fetch('/api/client',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json',traceparent:traceparent()},
+    body:JSON.stringify({ev,...o})}).catch(()=>{});
+}
+window.addEventListener('error',e=>report('page_error',{msg:String(e.message||e.error||'error'),src:e.filename,line:e.lineno}));
+window.addEventListener('unhandledrejection',e=>report('rejection',{msg:String(e.reason?.message||e.reason)}));
+
 async function api(url: string, opts?: RequestInit): Promise<any>{
-  const r = await fetch(url,{headers:{'Content-Type':'application/json'},...opts});
+  const r = await fetch(url,{headers:{'Content-Type':'application/json',traceparent:traceparent()},...opts});
   if(r.status===401){ location.href='/login'; throw new Error('signed out'); }
-  if(!r.ok) throw new Error(await r.text().catch(()=>'')||String(r.status));
+  // A page in place of ipx's words is Cloudflare or Caddy answering for it: the message became a
+  // whole 502 page (#219).
+  if(!r.ok) throw new Error((!/html/.test(r.headers.get('Content-Type')||'')&&await r.text().catch(()=>''))||`${r.status} ${r.statusText}`.trim());
   return r.status===204?null:r.json().catch(()=>null);
 }
 // navigator.clipboard only exists in a secure context. Served over plain HTTP on a LAN