Repository navigation
Count only what was actually served: no HEADs, no 304s, no abandoned downloads - #12
Merged
Merged
Conversation
…downloads A full audit of the statistics against a real socket found four ways the numbers overstated what had happened: - A HEAD ran the GET handler and was recorded as a download carrying the file's whole size as bytes sent; two header checks on a 29 MB episode put 56 MB on the Audio served card. HEADs are no longer recorded. - A 304 on an episode counted as a download. It is now a zero-byte row in the log and in no total. - A download the app disconnected from was flagged in its own row and still counted, badged 200, exported as "ok". It is now partial everywhere and counted nowhere; a stream the player stopped is still a stream. - Apple Podcasts fetches with `Range: bytes=0-` and was always a stream, so the most common iPhone app never registered a download. A range from byte zero that delivers the whole file is a download. Also: AppleCoreMedia is the system player for any iOS app and is no longer credited to Apple Podcasts; the bytes delta is formatted in its own unit; a resumed download answered whole keeps the range it asked for in the log. Dependencies brought to patched releases (fastify 5.12.5, sharp 0.35.5, music-metadata 11.16.1, transitive fixes); npm audit is clean. The acceptance script now proves HEAD, 304, bytes=0- and an abandoned transfer over a real socket, which fastify.inject cannot. The full audit report is in doc/audit-2026-10-09.md. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Oct 9, 2026
Refuse giant images, hide shows from strangers, and sign other sessions out on a password change
#13
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A full audit of SelfPod (report in
doc/audit-2026-10-09.md, added here) tested the statistics against a real socket and found four ways the headline numbers overstated what had happened. This is Tier 1 of the audit's fix plan: statistics correctness plus dependency bumps.What changed
partialin the CSV. A stream the player stopped mid-way is still a stream, because that is how players behave.Range: bytes=0-that delivers the whole file is a download. That is every Apple Podcasts download; they were all streams before.AppleCoreMediais now "Apple media player" (it is the system player for any iOS app, not only Apple Podcasts).npm audit --omit=devis clean (was 1 high, 7 fastify advisories, 8 others).How it was verified
npm test: 1313 pass (9 new tests cover HEAD, 304, bytes=0-, the abandoned path, the stopped stream, and the stale-address resume)../test/acceptance/run.sh selfpod:tier1against a built image: 63 passed, 0 failed. Six new checks prove HEAD, 304, bytes=0- and an abandoned 29 MB transfer over a real socket, whichfastify.injectcannot.Stacked PRs for the other tiers (security, performance, UI/UX) follow.
🤖 Generated with Claude Code