stream: fallback only replays already-aired tracks

The fallback played the whole /cache directory, which at cold start holds
only the 2-3 tracks being pre-fetched — so it looped them until the
request.dynamic buffer filled. Restrict the fallback to tracks already
aired: the ingest daemon exposes them at GET /fallback.m3u (played_at set,
still on disk), and the stream fetches that into a local /tmp/fallback.m3u
that playlist watches. Cold start is now silent (assumed) instead of a tight
loop, and a mid-stream drain degrades across the whole listening history.

A local file (not a remote playlist URL) is used to avoid Liquidsoap's http
resolver mis-sniffing the response as text/html; mime_type is forced so an
empty header-only m3u still parses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

ingest/radieo/__main__.py

@@ -153,7 +153,7 @@ def main() -> None:
     queue = TrackQueue(scheduler, fetchers, db)
     queue.start()
 
-    server = IngestServer((config.HTTP_HOST, config.HTTP_PORT), queue)
+    server = IngestServer((config.HTTP_HOST, config.HTTP_PORT), queue, db)
     log.info(
         "ingest listening on %s:%d (cache=%s, state=%s)",
         config.HTTP_HOST,

ingest/radieo/api.py

@@ -1,15 +1,19 @@
 """HTTP API exposing the next track to the stream layer.
 
 Endpoints:
-  GET /next     -> annotated Liquidsoap URI, or an empty body when nothing is
-                   ready (Liquidsoap then falls back to the local cache).
-  GET /healthz  -> "ok"
+  GET /next          -> annotated Liquidsoap URI, or an empty body when nothing
+                        is ready (Liquidsoap then falls back to /fallback.m3u).
+  GET /fallback.m3u  -> playlist of already-aired files, the stream's safety
+                        net; empty (→ silence) until something has played.
+  GET /healthz       -> "ok"
 """
 
 import logging
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from pathlib import Path
 
+from . import config
+from .db import Database
 from .models import Track
 from .queue import TrackQueue
 
@@ -29,9 +33,10 @@ def annotate_uri(path: Path, track: Track) -> str:
 
 
 class IngestServer(ThreadingHTTPServer):
-    def __init__(self, address, queue: TrackQueue):
+    def __init__(self, address, queue: TrackQueue, db: Database):
         super().__init__(address, _Handler)
         self.queue = queue
+        self.db = db
 
 
 class _Handler(BaseHTTPRequestHandler):
@@ -40,6 +45,8 @@ class _Handler(BaseHTTPRequestHandler):
     def do_GET(self):  # noqa: N802 (name imposed by BaseHTTPRequestHandler)
         if self.path == "/next":
             self._serve_next()
+        elif self.path == "/fallback.m3u":
+            self._serve_fallback()
         elif self.path == "/healthz":
             self._text(200, "ok\n")
         else:
@@ -55,10 +62,18 @@ class _Handler(BaseHTTPRequestHandler):
         log.info("next -> %s", track)
         self._text(200, annotate_uri(path, track) + "\n")
 
-    def _text(self, code: int, body: str):
+    def _serve_fallback(self):
+        # Only already-aired files, newest first, that still exist on disk.
+        lines = ["#EXTM3U"]
+        for p in self.server.db.played_files(config.RETENTION_KEEP):
+            if Path(p).exists():
+                lines.append(p)
+        self._text(200, "\n".join(lines) + "\n", "audio/x-mpegurl; charset=utf-8")
+
+    def _text(self, code: int, body: str, ctype: str = "text/plain; charset=utf-8"):
         data = body.encode("utf-8")
         self.send_response(code)
-        self.send_header("Content-Type", "text/plain; charset=utf-8")
+        self.send_header("Content-Type", ctype)
         self.send_header("Content-Length", str(len(data)))
         self.end_headers()
         self.wfile.write(data)

ingest/radieo/db.py

@@ -141,6 +141,20 @@ class Database:
                 (path, track_key),
             )
 
+    def played_files(self, limit: int) -> list[str]:
+        """Files already aired, newest first (the stream's fallback pool).
+
+        Only played tracks appear here, so files still being pre-fetched are
+        never served as fallback — that is what stopped the cold-start loop.
+        """
+        with self._lock:
+            rows = self._conn.execute(
+                "SELECT path FROM cache_files WHERE played_at IS NOT NULL"
+                " ORDER BY played_at DESC LIMIT ?",
+                (limit,),
+            ).fetchall()
+        return [r["path"] for r in rows]
+
     def mark_played(self, path: str) -> None:
         with self._lock:
             self._conn.execute(