Reuse upstream connections, and stop sniffing what we already know

Two costs sat in front of every video: a TLS handshake per upstream request,
and a round trip spent asking the proxy what kind of file it was about to
play.

The session cache was a thread-local, which never once hit -- the server
gives each connection a fresh thread, so every request found empty storage
and built a session, and with it a new connection to the CDN. Instrumented,
that was one session per request; a video is dozens of range requests and an
HLS stream one per segment. Sessions now live in a shared pool, checked out
for a request and returned when its response closes (for a streamed body,
after the last byte), so the connection stays warm. Measured against a
nearby CDN: 32-45ms per request becomes 9-11ms.

The player then HEADed the proxy before playback to sniff a content type --
and that HEAD ran a full upstream GET server-side, so two connections were
opened before the first byte of video was asked for. It now sniffs only when
neither the URL's extension nor yt-dlp's `protocol` says what the source is,
which is nearly never; `protocol` is newly carried through /api/resolve for
exactly this. A HEAD that does still happen asks upstream for one byte and
restates the 206 as a 200 describing the whole resource.

`format_note` joins the resolved fields too: the quality menu has been
reading it since 52d7802, but the backend was dropping it, so no note could
ever have been shown.

Tests (scratchpad, headless): sessions reused across requests, never shared
by two at once, returned after a client aborts mid-stream; HEAD probes one
byte while ranged and plain GETs are byte-identical; no HEAD for an mp4 or a
protocol-bearing URL, and one for a URL with neither.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBDkEXP4htyXTCZUwMLphd

frontend/js/feed.js

@@ -365,7 +365,7 @@ App.feed = App.feed || {};
         // What's actually on screen, so the quality menu can tick it.
         slide._activeUrl = resolved.url;
         const streamUrl = App.videos.buildStreamUrlFromSource(resolved);
-        const isHls = resolved.isLive ? true : /\.m3u8($|\?)/i.test(resolved.url);
+        const isHls = App.videos.classifySource(resolved).isHls;
 
         video.muted = state.feedMuted;
         video.preload = 'auto';

frontend/js/player.js

@@ -734,9 +734,9 @@ App.player = App.player || {};
             };
 
             let streamUrl = entry.direct ? resolved.url : App.videos.buildStreamUrlFromSource(resolved);
-            let isHls = /\.m3u8($|\?)/i.test(resolved.url);
-            let isDirectMedia = /\.(mp4|m4v|m4s|webm|ts|mov)($|\?)/i.test(resolved.url);
-            if (resolved.isLive) { isHls = true; isDirectMedia = false; }
+            const kind = App.videos.classifySource(resolved);
+            let isHls = kind.isHls;
+            let isDirectMedia = kind.isDirectMedia;
 
             video.onerror = null;
             if (state.hlsPlayer) {
@@ -749,7 +749,11 @@ App.player = App.player || {};
             video.removeAttribute('src');
             video.load();
 
-            if (!isHls && !entry.direct) {
+            // Last resort only: a HEAD through the proxy is a whole upstream
+            // connection (handshake included) before the first byte of video is
+            // ever requested, so it runs only when neither the URL nor the
+            // extractor's protocol says what this source is.
+            if (!isHls && !isDirectMedia && !entry.direct) {
                 try {
                     const headResp = await fetch(streamUrl, { method: 'HEAD' });
                     if (token !== cp.attemptToken) return;

frontend/js/videos.js

@@ -1274,7 +1274,15 @@ App.videos = App.videos || {};
             const referer = explicitReferer || deriveReferer(fmt.url);
             const userAgent = headerValue(fmt.http_headers, 'User-Agent') || metaUserAgent;
             const headers = mergeHeaders(meta.http_headers, fmt.http_headers);
-            return { url: fmt.url, referer, userAgent, headers, isLive, refererRequired: !!explicitReferer };
+            // `protocol` is the extractor's own word for how this format is
+            // delivered ('https', 'm3u8_native', ...). Carrying it through lets
+            // the player skip its content-type sniff -- a full round trip
+            // through the proxy -- for URLs whose extension gives nothing away.
+            return {
+                url: fmt.url, referer, userAgent, headers, isLive,
+                refererRequired: !!explicitReferer,
+                protocol: fmt.protocol || ''
+            };
         });
 
         if (!sources.length) {
@@ -1312,7 +1320,37 @@ App.videos = App.videos || {};
         const referer = explicitReferer || deriveReferer(fmt.url);
         const userAgent = headerValue(fmt.http_headers, 'User-Agent') || metaUserAgent;
         const headers = mergeHeaders(meta.http_headers, fmt.http_headers);
-        return { url: fmt.url, referer, userAgent, headers, isLive, refererRequired: !!explicitReferer };
+        return {
+            url: fmt.url, referer, userAgent, headers, isLive,
+            refererRequired: !!explicitReferer,
+            protocol: fmt.protocol || ''
+        };
+    };
+
+    // How does this source play -- an HLS manifest, or a media file the <video>
+    // element can take directly? Answered from the strongest evidence at hand:
+    // a live stream is always a manifest here, then the extractor's `protocol`,
+    // then the URL's extension. When none of them says (a signed CDN link with
+    // no extension and no protocol), the caller is left to sniff the content
+    // type over the network, which is why `protocol` is worth carrying around.
+    App.videos.classifySource = function(resolved) {
+        const url = (resolved && resolved.url) || '';
+        let isHls = /\.m3u8($|\?)/i.test(url);
+        let isDirectMedia = /\.(mp4|m4v|m4s|webm|ts|mov)($|\?)/i.test(url);
+        const protocol = String((resolved && resolved.protocol) || '').toLowerCase();
+        if (protocol.indexOf('m3u8') >= 0) {
+            isHls = true;
+            isDirectMedia = false;
+        } else if (protocol === 'https' || protocol === 'http') {
+            // A plain HTTP(S) download: one file, played as-is. Anything else
+            // yt-dlp names (http_dash_segments, ism, ...) stays unknown here.
+            isDirectMedia = true;
+        }
+        if (resolved && resolved.isLive) {
+            isHls = true;
+            isDirectMedia = false;
+        }
+        return { isHls, isDirectMedia };
     };
 
     // Background "direct playability" probe. The backend proxy exists to work