feat: the first pages, and what a browser walk found behind them

Phase 4. `/rust` is the server list and the module's landing page (D12);
`/rust/servers/:id` is one server with four tabs — feed, leaderboard, who is
on, wipes (D13). Everything selectable lives in the URL, so any view of the
page is a link. The feed and the presence list poll every twenty seconds while
the tab is visible and not at all when it is not (D14); the leaderboard and the
wipe list load once. `site.footer.status` is filled with a live server and
player count (D15).

Nothing on these pages calls a game server. Every field comes from this
module's own tables, which is what the phase criterion is about: the site
renders the last thing each server said while every server is off.

Walking that criterion in a browser against a live rig found four defects, two
of them already shipped in phase 3:

  * An unreachable refresh called `putState` — the whole-row write — with two
    fields, so a host that rebooted lost its hostname, map, size, seed and wipe
    id. The list then read "Offline" with nothing beside it, which is not "here
    is what we know" but "we have never heard of it". `markUnreachable` now
    moves three columns and mentions no others.
  * "Last reported" read `updated_at`, which a FAILED poll writes too — so an
    offline server claimed it had reported just now, every thirty seconds, for
    as long as it stayed down. `last_seen_at` is the new column, moved only by a
    frame that arrived.
  * Feed rows showed a bare time of day, so three events from six weeks ago all
    read as this afternoon once the feed was filtered to a past wipe.
  * `/rust/servers/typo` rendered core's ErrorState under its own heading and
    read "No such server / Something went wrong", sending a reader who mistyped
    a URL looking for an outage.

Also: a detail route (`GET …/servers/:id`), because it is the only route under
that path that can say a server does not exist — the other four answer an empty
list for an id nobody configured, and each of those is a good answer to its own
question.

`useAsync` cannot poll: it blanks its data on every dependency change, so a
twenty-second refresh built on it would clear the killfeed and re-fill it four
times a minute. `hooks/usePolled.js` is the module's own, invisible when it
succeeds and keeping the rows when it fails.

The client test fake was *nearly* core — it prefixed routes without stripping
the trailing separator, so the first module to register an index route failed
the nav check for a link that works in a browser. It now copies core's line
character for character.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

server/boot.js

@@ -106,7 +106,12 @@ async function refreshOne(server) {
     // whose plugin is not loaded yet, and reporting it as unreachable sends the
     // operator to look at the network instead of at the game server.
     if (!board.ok) {
-      await db.putState({ serverId: server.id, reachable: false, online: false })
+      // `markUnreachable`, not `putState`: nothing answered, so the only new fact
+      // is that nothing answered. Writing the whole row from that one fact would
+      // blank the hostname, the map, the seed and the wipe — the last thing this
+      // server said, which is exactly what the pages exist to render while it is
+      // off.
+      await db.markUnreachable(server.id, false)
       return
     }
 
@@ -117,7 +122,7 @@ async function refreshOne(server) {
       // The sidecar is up and has never heard from the game. Presence is emptied
       // rather than left alone: a stale list of players on a server nobody can
       // reach is worse than an empty one, because it looks current.
-      await db.putState({ serverId: server.id, reachable: true, online: false })
+      await db.markUnreachable(server.id, true)
       await ingest.applyBoards(server.id, {})
       return
     }

server/db/schema.sql

@@ -298,3 +298,14 @@ CREATE TABLE IF NOT EXISTS rust_ingest_cursor (
 -- would reach fresh installs only — which is the worst possible distribution for
 -- a schema change, because it works everywhere it is tested.
 ALTER TABLE rust_server_state ADD COLUMN IF NOT EXISTS wipe_id VARCHAR(48) NULL;
+
+-- Phase 4. `updated_at` is when THIS module last wrote the row, which is not the
+-- same fact as when the server last said something — and the pages were reading
+-- the first as if it were the second, so a server that had been down for three
+-- days rendered "last reported just now" on every failed poll.
+--
+-- They are genuinely two facts and both are wanted: `updated_at` decides whether
+-- the row is stale (a module that stopped polling must not leave a page claiming
+-- a server is up), and `last_seen_at` is when a `server.hello` last arrived. Only
+-- a successful refresh moves it.
+ALTER TABLE rust_server_state ADD COLUMN IF NOT EXISTS last_seen_at DATETIME NULL;

server/model/servers/servers.db.js

@@ -80,11 +80,56 @@ async function listState() {
     `SELECT server_id AS serverId, reachable, online, players, max_players AS maxPlayers,
             hostname, level, seed, world_size AS worldSize, boot_id AS bootId,
             save_created_at AS saveCreatedAt, wipe_id AS wipeId, protocol,
-            updated_at AS updatedAt
+            last_seen_at AS lastSeenAt, updated_at AS updatedAt
        FROM ${STATE}`,
   )
 }
 
+/** One server's observed state, or `null`. The single-row twin of `listState`. */
+async function getState(serverId) {
+  const rows = await core.query(
+    `SELECT server_id AS serverId, reachable, online, players, max_players AS maxPlayers,
+            hostname, level, seed, world_size AS worldSize, boot_id AS bootId,
+            save_created_at AS saveCreatedAt, wipe_id AS wipeId, protocol,
+            last_seen_at AS lastSeenAt, updated_at AS updatedAt
+       FROM ${STATE}
+      WHERE server_id = ?`,
+    [serverId],
+  )
+  return rows[0] || null
+}
+
+/**
+ * Mark a server unreachable **without forgetting what it last said**.
+ *
+ * `putState` replaces the row whole, which is right when a sidecar answered: the
+ * frame it answered with is the complete truth about that server. It is wrong
+ * when nothing answered. A refresh that cannot reach a sidecar knows exactly one
+ * new fact — that it could not reach it — and writing the whole row from that
+ * one fact sets `hostname`, `level`, `seed`, `world_size` and `wipe_id` to NULL.
+ *
+ * The site's whole premise is that it renders the last thing each server said
+ * while every server is off. A row blanked the first time a game host reboots
+ * cannot do that: the page loses the map, the size, the seed and the wipe, and
+ * what it shows is not "offline, here is what we know" but "offline, and we have
+ * never heard of it". It is invisible in every test that stubs a reachable
+ * sidecar, and it shows up as a page that was complete an hour ago.
+ *
+ * So: three columns move, and the description stays where it is.
+ */
+async function markUnreachable(serverId, reachable = false) {
+  await core.query(
+    `INSERT INTO ${STATE} (server_id, reachable, online, players, updated_at)
+     VALUES (?, ?, 0, 0, CURRENT_TIMESTAMP)
+     ON DUPLICATE KEY UPDATE
+       reachable = VALUES(reachable),
+       online = 0,
+       players = 0,
+       updated_at = CURRENT_TIMESTAMP`,
+    [serverId, reachable ? 1 : 0],
+  )
+}
+
 /**
  * Replace one server's observed state.
  *
@@ -100,15 +145,20 @@ async function putState(state) {
   await core.query(
     `INSERT INTO ${STATE}
        (server_id, reachable, online, players, max_players, hostname, level, seed,
-        world_size, boot_id, save_created_at, wipe_id, protocol, raw, updated_at)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP)
+        world_size, boot_id, save_created_at, wipe_id, protocol, raw, last_seen_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)
      ON DUPLICATE KEY UPDATE
        reachable = VALUES(reachable), online = VALUES(online), players = VALUES(players),
        max_players = VALUES(max_players), hostname = VALUES(hostname), level = VALUES(level),
        seed = VALUES(seed), world_size = VALUES(world_size), boot_id = VALUES(boot_id),
        save_created_at = VALUES(save_created_at), wipe_id = VALUES(wipe_id),
        protocol = VALUES(protocol),
-       raw = VALUES(raw), updated_at = CURRENT_TIMESTAMP`,
+       raw = VALUES(raw),
+       -- Only a frame moves this; an unreachable write leaves it alone, which is
+       -- what lets a page say how long a server has been down rather than how
+       -- recently we failed to reach it.
+       last_seen_at = CURRENT_TIMESTAMP,
+       updated_at = CURRENT_TIMESTAMP`,
     [
       state.serverId,
       state.reachable ? 1 : 0,
@@ -136,5 +186,7 @@ module.exports = {
   upsertServer,
   deleteServer,
   listState,
+  getState,
+  markUnreachable,
   putState,
 }

server/model/servers/servers.model.js

@@ -73,6 +73,7 @@ async function listPublic(now = Date.now()) {
 
 function shapePublic(row, state, now) {
   const updatedAt = state && state.updatedAt ? new Date(state.updatedAt) : null
+  const lastSeenAt = state && state.lastSeenAt ? new Date(state.lastSeenAt) : null
   const stale = !updatedAt || now - updatedAt.getTime() > STALE_AFTER_MS
 
   return {
@@ -87,11 +88,43 @@ function shapePublic(row, state, now) {
     level: (state && state.level) || null,
     worldSize: state && state.worldSize != null ? Number(state.worldSize) : null,
     seed: state && state.seed != null ? Number(state.seed) : null,
+    // The CURRENT wipe, from the state row rather than from the newest row in
+    // `rust_wipes`. The two usually agree and the state row is the one that is
+    // right when they do not: a wipe list is derived from events that have been
+    // ingested, so a server that has just wiped and said nothing since has a new
+    // wipe id here and no row there at all.
+    wipeId: (state && state.wipeId) || null,
+    wipedAt: (state && state.saveCreatedAt) || null,
+    // Two timestamps, because they are two facts. `lastSeenAt` is when a frame
+    // last arrived and is what a page means by "last reported"; `updatedAt` is
+    // when this module last wrote the row, and is what `stale` is computed from.
+    // Reading the second as the first is what made an offline server claim it had
+    // reported just now, on every failed poll, for as long as it stayed down.
+    lastSeenAt: lastSeenAt ? lastSeenAt.toISOString() : null,
     updatedAt: updatedAt ? updatedAt.toISOString() : null,
     stale,
   }
 }
 
+/**
+ * One enabled server, or `null`.
+ *
+ * It exists because `/rust/servers/:id` is a page and a page needs to be able to
+ * 404. A detail view built by fetching the list and finding the row in it cannot
+ * tell "no such server" from "a server that has said nothing" — both are an
+ * absence — and renders an empty page under a heading for a server that does not
+ * exist. Filtering happens here, where `enabled = 0` and "never configured" are
+ * the same answer on purpose: a disabled server is not a 403, it is not there.
+ */
+async function getPublic(id, now = Date.now()) {
+  if (!id) return null
+
+  const row = await db.getServer(id)
+  if (!row || !row.enabled) return null
+
+  return shapePublic(row, await db.getState(row.id), now)
+}
+
 /**
  * The admin view: configuration plus reachability, and **no token**.
  *
@@ -133,6 +166,7 @@ module.exports = {
   withToken,
   listForPolling,
   listPublic,
+  getPublic,
   listForAdmin,
   shapePublic,
   encryptToken,

server/router/public/rust.controller.js

@@ -25,6 +25,30 @@ async function listServers(req, res) {
   }
 }
 
+/**
+ * One server, or a 404.
+ *
+ * **The 404 is the feature.** Everything else under `/servers/:id` answers an
+ * empty list for a server that does not exist — an unknown id has no events, no
+ * leaderboard and nobody online, and each of those is a perfectly good answer to
+ * the question it was asked. Only this route can tell the page that the server
+ * itself is not there, which is what stops `/rust/servers/typo` rendering as a
+ * quiet server with nothing to say.
+ */
+async function getServer(req, res) {
+  try {
+    const server = await servers.getPublic(req.params.id)
+    if (!server) {
+      res.status(404).json({ error: 'No such server' })
+      return
+    }
+    res.json({ server })
+  } catch (err) {
+    log.error('failed to read a server', { server: req.params.id, error: err.message })
+    res.status(500).json({ error: 'Failed to read the server' })
+  }
+}
+
 /**
  * The killfeed, and everything else public that happened on one server.
  *
@@ -83,4 +107,4 @@ async function listOnline(req, res) {
   }
 }
 
-module.exports = { listServers, listEvents, listLeaderboard, listWipes, listOnline }
+module.exports = { listServers, getServer, listEvents, listLeaderboard, listWipes, listOnline }

server/router/public/rust.router.js

@@ -52,6 +52,18 @@ rustRouter.get(
 // Protocol 2 carries IP addresses and player reports; they are stored, and they
 // do not come out here.
 
+rustRouter.get(
+  '/servers/:id',
+  // #swagger.tags = ['Public · Rust']
+  // #swagger.summary = 'One Rust server'
+  // #swagger.description = 'The same shape the list answers with, for one server, and a `404` when there is no such server or an operator has disabled it. The detail page needs the difference: every other route under this path answers an empty list for an id that does not exist, because an unknown server genuinely has no events and nobody online.'
+  // #swagger.parameters['id'] = { in: 'path', required: true, description: 'The server’s slug', schema: { type: 'string' } }
+  /* #swagger.responses[200] = { description: 'The server' } */
+  /* #swagger.responses[404] = { description: 'No such server, or it is disabled' } */
+  siteMode,
+  servers.getServer,
+)
+
 rustRouter.get(
   '/servers/:id/events',
   // #swagger.tags = ['Public · Rust']

server/test/refresh.test.js

@@ -0,0 +1,116 @@
+// ── What a refresh writes when nobody answers ─────────────────────────────
+//
+// The refresh loop has three outcomes (see `boot.js`), and the two unhappy ones
+// are the interesting half of this module's promise: the site renders the last
+// thing each server said **while every server is off**. A page can only do that
+// if the row still holds what the server said.
+//
+// The defect this suite exists for shipped in phase 3 and was found by walking
+// phase 4's own pages: an unreachable refresh called `putState` with two fields,
+// and `putState` replaces the row — so the first time a game host rebooted, the
+// hostname, the map, the size, the seed and the wipe id were all set to NULL.
+// The list then read "Offline" with nothing beside it, which is not "here is
+// what we know about a server that is down", it is "we have never heard of it".
+//
+// It is invisible to any test that stubs a sidecar which answers, which is why
+// there was not one.
+
+const test = require('node:test')
+const assert = require('node:assert')
+
+const { fakeCtx } = require('./_fakes')
+
+function withCore(ctx = fakeCtx()) {
+  require('../core')._reset()
+  require('../core').init(ctx)
+  return ctx
+}
+
+/** The columns a description lives in — the ones an unreachable write must not touch. */
+const DESCRIPTION = ['hostname', 'level', 'seed', 'world_size', 'boot_id', 'save_created_at', 'wipe_id']
+
+test('an unreachable refresh does not write the description columns at all', async () => {
+  const queries = []
+  withCore(fakeCtx({
+    db: {
+      query: (sql, params) => {
+        queries.push({ sql, params })
+        return Promise.resolve([])
+      },
+      pool: {},
+    },
+  }))
+
+  const db = require('../model/servers/servers.db')
+  await db.markUnreachable('main', false)
+
+  assert.equal(queries.length, 1)
+  const { sql, params } = queries[0]
+
+  // Asserted against the SQL rather than against a round trip, because the whole
+  // failure is about which columns a statement mentions. A column named here is
+  // a column that can be nulled.
+  for (const column of DESCRIPTION) {
+    assert.ok(!sql.includes(column), `markUnreachable writes ${column}, which is the server's description`)
+  }
+
+  assert.ok(sql.includes('reachable'))
+  assert.ok(sql.includes('online'))
+  assert.ok(sql.includes('updated_at'))
+  assert.deepStrictEqual(params, ['main', 0])
+})
+
+test('a sidecar that is up with no game behind it is reachable and offline', async () => {
+  // The middle outcome, and the one that is easy to collapse into the other two:
+  // a fresh install whose plugin is not loaded yet. Reporting it as unreachable
+  // sends an operator to look at the network instead of at the game server.
+  const queries = []
+  withCore(fakeCtx({
+    db: {
+      query: (sql, params) => {
+        queries.push({ sql, params })
+        return Promise.resolve([])
+      },
+      pool: {},
+    },
+  }))
+
+  await require('../model/servers/servers.db').markUnreachable('main', true)
+  assert.deepStrictEqual(queries[0].params, ['main', 1])
+})
+
+test('neither unhappy path calls putState', async () => {
+  // The regression in one assertion: `putState` is the whole-row write, and
+  // calling it with two fields is what blanked the description.
+  withCore(fakeCtx({ db: { query: () => Promise.resolve([]), pool: {} } }))
+
+  const db = require('../model/servers/servers.db')
+  const sidecar = require('../sidecarClient')
+  const boot = require('../boot')
+
+  const originalPut = db.putState
+  const originalMark = db.markUnreachable
+  const originalBoards = sidecar.boards
+  const marked = []
+  let putCalls = 0
+
+  db.putState = async () => { putCalls += 1 }
+  db.markUnreachable = async (id, reachable) => { marked.push([id, reachable]) }
+
+  try {
+    // Nothing answered.
+    sidecar.boards = async () => ({ ok: false, status: 0, data: null })
+    await boot.refreshOne({ id: 'main', baseUrl: 'http://127.0.0.1:1', token: 't', protocol: 2 })
+
+    // The sidecar answered, and has never heard from a game.
+    sidecar.boards = async () => ({ ok: true, status: 200, data: { boards: {} } })
+    await boot.refreshOne({ id: 'main', baseUrl: 'http://127.0.0.1:1', token: 't', protocol: 2 })
+
+    assert.equal(putCalls, 0, 'an unhappy refresh replaced the whole state row')
+    assert.deepStrictEqual(marked, [['main', false], ['main', true]])
+  } finally {
+    db.putState = originalPut
+    db.markUnreachable = originalMark
+    sidecar.boards = originalBoards
+  }
+})

server/test/servers.test.js

@@ -97,10 +97,96 @@ test('the public shape carries nothing about the sidecar', () => {
   // someone who did not read this file, and an allowlist is the only assertion
   // that catches one.
   assert.deepStrictEqual(Object.keys(shaped).sort(), [
-    'hostname', 'id', 'level', 'maxPlayers', 'name', 'online', 'players', 'seed', 'stale', 'updatedAt', 'worldSize',
+    'hostname', 'id', 'lastSeenAt', 'level', 'maxPlayers', 'name', 'online', 'players', 'seed', 'stale',
+    'updatedAt', 'wipeId', 'wipedAt', 'worldSize',
   ])
 })
 
+test('"last reported" is when a frame arrived, not when we last polled', () => {
+  withCore()
+  const servers = require('../model/servers/servers.model')
+
+  // The defect the phase-4 page walk found, in one assertion. A refresh that
+  // cannot reach a sidecar still writes `updated_at` — it has to, because that is
+  // what staleness is computed from — and a page reading it as "last reported"
+  // told a reader that a server which had been down for days had reported just
+  // now, every thirty seconds, for as long as it stayed down.
+  const state = stateRow({
+    online: 0,
+    reachable: 0,
+    updatedAt: new Date(NOW - 5_000).toISOString(),
+    lastSeenAt: new Date(NOW - 3 * 86400_000).toISOString(),
+  })
+
+  const shaped = servers.shapePublic(serverRow(), state, NOW)
+  assert.strictEqual(shaped.lastSeenAt, new Date(NOW - 3 * 86400_000).toISOString())
+  assert.strictEqual(shaped.stale, false, 'the row itself is fresh — it was written five seconds ago')
+  assert.strictEqual(shaped.online, false)
+
+  // A server nothing has ever heard from has no such moment, and `null` is what
+  // a page renders as "never" rather than as the epoch.
+  assert.strictEqual(servers.shapePublic(serverRow(), undefined, NOW).lastSeenAt, null)
+})
+
+test('the public shape carries the current wipe, from the state row', () => {
+  withCore()
+  const servers = require('../model/servers/servers.model')
+
+  // The wipe id on the STATE row, not the newest row in `rust_wipes`. The two
+  // usually agree, and the state row is the one that is right when they do not:
+  // the wipe list is derived from events that have been ingested, so a server
+  // that has just wiped and said nothing since has a new id here and no row there.
+  const shaped = servers.shapePublic(serverRow(), stateRow({ wipeId: 'w-2026-09', saveCreatedAt: '2026-09-04T18:00:00Z' }), NOW)
+  assert.strictEqual(shaped.wipeId, 'w-2026-09')
+  assert.strictEqual(shaped.wipedAt, '2026-09-04T18:00:00Z')
+
+  // A server nothing has polled yet has no wipe, and `null` is the honest answer
+  // — an empty string would be sent back as `?wipe=`, which asks a different
+  // question and answers nothing.
+  const never = servers.shapePublic(serverRow(), undefined, NOW)
+  assert.strictEqual(never.wipeId, null)
+  assert.strictEqual(never.wipedAt, null)
+})
+
+test('a disabled server is not there, rather than forbidden', async () => {
+  withCore()
+
+  const db = require('../model/servers/servers.db')
+  const model = require('../model/servers/servers.model')
+  const originalServer = db.getServer
+  const originalState = db.getState
+
+  db.getState = async () => stateRow()
+
+  try {
+    // The detail route is the only one under `/servers/:id` that can say "no such
+    // server" — the other four answer an empty list, because an unknown id
+    // genuinely has no events. So what `null` means here decides what a page
+    // renders, and a disabled server and a missing one must mean the same thing:
+    // an operator who switched a server off did not switch it into a 403.
+    db.getServer = async () => ({ ...serverRow(), enabled: 0 })
+    assert.strictEqual(await model.getPublic('main', NOW), null)
+
+    db.getServer = async () => null
+    assert.strictEqual(await model.getPublic('nope', NOW), null)
+
+    // And an id nobody asked about never reaches the database.
+    let asked = false
+    db.getServer = async () => { asked = true; return null }
+    assert.strictEqual(await model.getPublic('', NOW), null)
+    assert.strictEqual(asked, false)
+
+    db.getServer = async () => serverRow()
+    const server = await model.getPublic('main', NOW)
+    assert.strictEqual(server.id, 'main')
+    assert.strictEqual(server.online, true)
+    assert.ok(!Object.prototype.hasOwnProperty.call(server, 'sidecarBaseUrl'))
+  } finally {
+    db.getServer = originalServer
+    db.getState = originalState
+  }
+})
+
 test('the admin shape reports whether a token is stored, never the token', () => {
   withCore()
   const servers = require('../model/servers/servers.model')