fix(eta): server-authoritative windowed-throughput ETA, consistent across admin + live

admin.html (updateETA) and live.html (cbRender) each computed ETA
independently from different inputs (run-start vs batch-start timestamp;
status counters vs deduped result rows), so they disagreed. The server now
owns one ETA and broadcasts it; both pages just render the same value.

server.js:
- computeEtaFinishAt(st): windowed real-throughput estimate. Keeps a rolling
  window (ETA_WINDOW=12) of node-completion epochs, derives rate (nodes/ms)
  from the first/last span, and returns an absolute finish epoch
  Date.now() + remaining/rate. Null unless status==='running' with >=2
  completions and total>0; Date.now() (finish-now) when remaining<=0.
- broadcast(): on 'result' record the completion FIRST (so the just-finished
  node is in the window), detect a new pass via counter reset, then stamp
  data.state.etaFinishAtMs onto any state payload (covers both 'state' and
  direct-pipeline 'result' broadcasts).
- /api/events init frame computes etaFinishAtMs so a fresh admin isn't blank.
- etaFinishAtMs added to PUBLIC_STATE_KEYS so /live receives it.

admin.html + live.html: ETA is now a per-second countdown to
state.etaFinishAtMs (HH:MM:SS), replacing the divergent elapsed/tested math.
live.html gets a dedicated 1s ETA ticker (gated on _cb.startedAt so it freezes
on stop/done).

test/eta-estimate.test.js: vm-extracts the real computeEtaFinishAt and asserts
the null guards, finish-now path, first/last-span window math (rate 1/sec,
remaining 20 -> ~20000ms), and that PUBLIC_STATE_KEYS carries etaFinishAtMs.
public-sse-fields.test.js updated for the new 11-key allowlist. Full suite 0.

Author: Sentinel-Bluebuilder

admin.html

@@ -1488,25 +1488,20 @@ <h1 style="margin:0;flex:0 0 auto">SENTINEL NODE TEST</h1>
     }
 
     function updateETA() {
+      // Server-authoritative ETA: the server computes ONE absolute finish epoch
+      // (state.etaFinishAtMs) from a windowed real-throughput estimate and
+      // broadcasts it. Both admin and live render the same value — we just
+      // count down to it. See computeEtaFinishAt() in server.js.
       const el = document.getElementById('etaTime');
-      if (state.status !== 'running' || !state.startedAt) {
-        if (state.status === 'done') el.textContent = '00:00:00';
-        return;
-      }
-      let done, total;
-      if (state.retestMode) {
-        done = state.retestTested || 0;
-        total = state.retestTotal || 0;
+      if (state.status === 'done') { el.textContent = '00:00:00'; return; }
+      if (state.status !== 'running') return;
+      if (Number.isFinite(state.etaFinishAtMs)) {
+        const rem = Math.max(0, state.etaFinishAtMs - Date.now());
+        const h = Math.floor(rem / 3600000), m = Math.floor((rem % 3600000) / 60000), s = Math.floor((rem % 60000) / 1000);
+        el.textContent = `${String(h).padStart(2,'0')}:${String(m).padStart(2,'0')}:${String(s).padStart(2,'0')}`;
       } else {
-        done = (state.testedNodes || 0) + (state.failedNodes || 0) + (state.skippedNodes || 0);
-        total = state.totalNodes || 0;
+        el.textContent = 'Calculating...';
       }
-      const remaining = total - done;
-      if (done === 0 || remaining <= 0) { el.textContent = 'Calculating...'; return; }
-      const elapsed = Date.now() - new Date(state.startedAt).getTime();
-      const ms = remaining * (elapsed / done);
-      const h = Math.floor(ms / 3600000), m = Math.floor((ms % 3600000) / 60000), s = Math.floor((ms % 60000) / 1000);
-      el.textContent = `${String(h).padStart(2,'0')}:${String(m).padStart(2,'0')}:${String(s).padStart(2,'0')}`;
     }
 
     function applyState() {

live.html

@@ -1718,17 +1718,18 @@ <h1 class="live-page-title">
 
       const etaEl = _cbEl('cbEta');
       if (etaEl) {
-        const remaining = snap > 0 ? snap - tested : 0;
-        const startedAt = _cb.startedAt ? new Date(_cb.startedAt).getTime() : 0;
-        if (snap > 0 && tested > 0 && remaining > 0 && startedAt > 0) {
-          const elapsed = Date.now() - startedAt;
-          const ms = remaining * (elapsed / tested);
-          const h = Math.floor(ms / 3600000);
-          const m = Math.floor((ms % 3600000) / 60000);
-          const s = Math.floor((ms % 60000) / 1000);
+        // Server-authoritative ETA: the server computes ONE absolute finish
+        // epoch (_liveState.etaFinishAtMs) from a windowed real-throughput
+        // estimate and broadcasts it. We just count down to it — so this page
+        // and admin.html always show the same value. The old elapsed/tested
+        // per-node math (which diverged from admin's) is gone.
+        const finishAt = Number(_liveState && _liveState.etaFinishAtMs);
+        if (Number.isFinite(finishAt) && finishAt > 0) {
+          const rem = Math.max(0, finishAt - Date.now());
+          const h = Math.floor(rem / 3600000);
+          const m = Math.floor((rem % 3600000) / 60000);
+          const s = Math.floor((rem % 60000) / 1000);
           etaEl.textContent = `ETA ${String(h).padStart(2,'0')}:${String(m).padStart(2,'0')}:${String(s).padStart(2,'0')}`;
-        } else if (snap > 0 && remaining <= 0 && tested > 0) {
-          etaEl.textContent = 'ETA 00:00:00';
         } else {
           etaEl.textContent = 'ETA —';
         }
@@ -1885,48 +1886,17 @@ <h1 class="live-page-title">
     }
 
     setInterval(() => {
-      if (_cb.startedAt && _cb.tested >= 0) cbRender();
       renderLiveStats();
       applyHeaderStatsFromState();
     }, 5000);
 
-    // True only while a run is genuinely in flight. A stopped/done/error/idle
-    // status from the server means the run ended — the ETA must freeze and the
-    // status label must drop out of "running". Without this gate the ETA timer
-    // keeps ticking off `_cb.startedAt` (which is never cleared on stop) so the
-    // countdown climbs forever and /live looks like the test is still running.
-    function isRunLive() {
-      // The ETA ticks ONLY while the run is actively testing. Paused states
-      // (the pipeline emits paused_balance / paused_internet — never bare
-      // 'paused') freeze the ETA so a long balance/internet pause doesn't inflate
-      // the projection; terminal states (stopped/done/error/idle) freeze it too.
-      // Resume re-emits status='running' + a fresh batch:start, re-arming the ETA.
-      return ((_liveState && _liveState.status) || '') === 'running';
-    }
-
-    // Tick ETA every second so the countdown reads smoothly between
-    // node:result events (which can be 10–60s apart on slow nodes).
+    // Dedicated 1s ETA ticker. The ETA is now a countdown to the
+    // server-broadcast absolute finish epoch (_liveState.etaFinishAtMs), so it
+    // must re-render every second to tick down between server events. Gated on
+    // _cb.startedAt (cbFreeze nulls it on stop/done/error/idle) so a finished
+    // run's ETA freezes instead of marching.
     setInterval(() => {
-      if (!_cb.startedAt) return;
-      // Freeze the ETA the moment the run is no longer live (stopped/done/etc).
-      if (!isRunLive()) return;
-      const etaEl = document.getElementById('cbEta');
-      if (!etaEl) return;
-      // Use the same run-total source cbRender() uses (prefers
-      // _liveState.totalNodes, falls back to _cb.snapshotSize) so the ticker
-      // and the rendered progress don't diverge on resume → no per-second flicker.
-      const snap = runTotalNodes();
-      const tested = (Array.isArray(resultsArr) && resultsArr.length > 0) ? resultsArr.length : _cb.tested;
-      const remaining = snap > 0 ? snap - tested : 0;
-      const startedAt = _cb.startedAt ? new Date(_cb.startedAt).getTime() : 0;
-      if (snap > 0 && tested > 0 && remaining > 0 && startedAt > 0) {
-        const elapsed = Date.now() - startedAt;
-        const ms = remaining * (elapsed / tested);
-        const h = Math.floor(ms / 3600000);
-        const m = Math.floor((ms % 3600000) / 60000);
-        const s = Math.floor((ms % 60000) / 1000);
-        etaEl.textContent = `ETA ${String(h).padStart(2,'0')}:${String(m).padStart(2,'0')}:${String(s).padStart(2,'0')}`;
-      }
+      if (_cb.startedAt) cbRender();
     }, 1000);
 
     // ─── Upsert ───
@@ -2477,7 +2447,9 @@ <h1 class="live-page-title">
             } else if (newStatus && newStatus.indexOf('paused') === 0) {
               // paused_balance / paused_internet — show a friendly 'paused' label.
               // Not terminal: don't cbFreeze (keep startedAt so the resumed run's
-              // ETA continues); the ETA is frozen meanwhile via isRunLive().
+              // ETA continues). The ETA is frozen meanwhile by the server:
+              // computeEtaFinishAt returns null when status !== 'running', so the
+              // broadcast etaFinishAtMs goes null and cbRender shows "ETA —".
               setStatus('paused');
             }
             renderLiveStats();

package.json

@@ -38,7 +38,7 @@
     "postinstall": "node scripts/postinstall.js",
     "start": "node server.js",
     "audit": "node server.js",
-    "test": "node test/smoke.test.js && node test/db.smoke.test.js && node test/continuous.smoke.test.js && node test/security.test.js && node test/failure-log-ux.test.js && node test/public-no-action-buttons.test.js && node test/onchain-decode.test.js && node test/admin-log-batch.test.js && node test/live-pause-overlay.test.js && node test/live-load-gating.test.js && node test/public-run-active.test.js && node test/live-single-poll-gate.test.js && node test/public-sse-fields.test.js && node test/admin-sse-diag-trim.test.js",
+    "test": "node test/smoke.test.js && node test/db.smoke.test.js && node test/continuous.smoke.test.js && node test/security.test.js && node test/failure-log-ux.test.js && node test/public-no-action-buttons.test.js && node test/onchain-decode.test.js && node test/admin-log-batch.test.js && node test/live-pause-overlay.test.js && node test/live-load-gating.test.js && node test/public-run-active.test.js && node test/live-single-poll-gate.test.js && node test/public-sse-fields.test.js && node test/admin-sse-diag-trim.test.js && node test/eta-estimate.test.js",
     "test:ui": "node test/ui.smoke.test.js",
     "test:integration": "node test/continuous.audit-integration.test.js && node test/continuous.live-db-write.test.js && node test/node-detail.smoke.test.js && node test/resume-results-seed.test.js",
     "verify:prod-db": "node scripts/verify-prod-db.mjs",

server.js

@@ -348,6 +348,36 @@ function appendEventLog(msg) {
   }
 }
 
+// ─── Server-authoritative ETA (windowed real-throughput) ───────────────────
+// Both admin.html and live.html used to compute ETA independently from
+// different inputs, so they disagreed. The server now owns the single source
+// of truth: it keeps a rolling window of the last ETA_WINDOW node-completion
+// timestamps, derives the current completion RATE (nodes/ms), and broadcasts
+// an ABSOLUTE finish epoch (`etaFinishAtMs`). Clients render
+// max(0, etaFinishAtMs - Date.now()) as HH:MM:SS, ticking every second. This
+// is throughput-based (parallelism-aware), not per-node-duration based.
+const ETA_WINDOW = 12;
+let _etaCompletions = [];   // recent node-completion epoch ms (rolling, current pass)
+let _etaLastDone = -1;      // last seen completed-count, to detect a new pass
+
+function computeEtaFinishAt(st) {
+  if (!st || typeof st !== 'object') return null;
+  // Only meaningful while a pass is actively running. done/idle/paused_* → null.
+  if (st.status !== 'running') return null;
+  const done = (st.testedNodes || 0) + (st.failedNodes || 0) + (st.skippedNodes || 0);
+  const total = st.totalNodes || 0;
+  if (total <= 0) return null;
+  const remaining = total - done;
+  if (remaining <= 0) return Date.now(); // finish now → renders 00:00:00
+  if (_etaCompletions.length < 2) return null; // not enough data → client shows "Calculating…"
+  const span = _etaCompletions[_etaCompletions.length - 1] - _etaCompletions[0];
+  if (span <= 0) return null;
+  const n = _etaCompletions.length - 1; // intervals across the window
+  const ratePerMs = n / span;
+  const etaMs = remaining / ratePerMs;
+  return Date.now() + Math.round(etaMs);
+}
+
 function broadcast(type, data = {}) {
   if (type === 'log' && data.msg) {
     // Tag the live SSE 'log' event with a category so admin/live can filter
@@ -364,6 +394,30 @@ function broadcast(type, data = {}) {
     if (data.cat === 'events') appendEventLog(data.msg);
   }
   if (type === 'state' || type === 'result') saveStateSnapshot();
+  // ─── ETA bookkeeping ──────────────────────────────────────────────────────
+  // Record the just-finished node FIRST (so it's in the window), then compute
+  // the absolute finish epoch and stamp it onto any state payload so admin
+  // (which ticks on 'result' events) and live (which ticks on 'state') both
+  // render the same value.
+  if (type === 'result') {
+    _etaCompletions.push(Date.now());
+    if (_etaCompletions.length > ETA_WINDOW) {
+      _etaCompletions = _etaCompletions.slice(-ETA_WINDOW);
+    }
+  }
+  if (data && data.state && typeof data.state === 'object') {
+    const s = data.state;
+    const done = (s.testedNodes || 0) + (s.failedNodes || 0) + (s.skippedNodes || 0);
+    if (done < _etaLastDone) _etaCompletions = []; // counters reset → new pass
+    _etaLastDone = done;
+    // NOTE: for most callers data.state IS the long-lived global `state` object,
+    // so this assignment MUTATES the global in place — etaFinishAtMs is not a
+    // per-payload-only field. That's fine: it's recomputed on every broadcast,
+    // and computeEtaFinishAt SELF-CLEARS it to null whenever status !== 'running'
+    // (done/idle/paused_*), so a stale value can never linger on the global.
+    // saveStateSnapshot's allowlist also excludes it, so it never persists.
+    data.state.etaFinishAtMs = computeEtaFinishAt(data.state);
+  }
   // NOTE: spread `data` FIRST so a payload field named `type` (e.g. the node's
   // service-type like 'wireguard') cannot clobber the SSE event type. The
   // event type is the dispatch key — clients switch on d.type — so it must win.
@@ -1900,9 +1954,13 @@ function _redactPublicError(v, max = 200) {
 //     the Server-Baseline header tile.
 //   - activeSDK ('js' | 'tkd' | 'csharp') surfaces next to the run-mode label;
 //     display name + version are joined client-side via /api/public/sdk-info.
+//   - etaFinishAtMs is the server-authoritative absolute finish epoch (ms);
+//     live.html renders max(0, etaFinishAtMs - Date.now()) as a ticking ETA so
+//     it matches admin.html exactly.
 const PUBLIC_STATE_KEYS = [
   'status',
   'totalNodes',
+  'etaFinishAtMs',
   'baselineMbps',
   'baselineHistory',
   'testRun',
@@ -2316,6 +2374,10 @@ app.get('/api/events', adminOnly, rlAdminSse, (req, res) => {
   // Strip wallet + balance internals AND runGranter (subscription granter
   // address — operator-internal, never needs to leave the server).
   const { walletAddress, balance, balanceUdvpn, spentUdvpn, runGranter, ...stateForSse } = state;
+  // The global `state` doesn't carry a fresh etaFinishAtMs (it's stamped onto
+  // broadcast payloads, not the global), so a freshly-connected admin would be
+  // blank until the next event. Compute it once here for the init frame.
+  stateForSse.etaFinishAtMs = computeEtaFinishAt(state);
   // Trim each result row's diag to the 4 fields the dashboard reads (drop the
   // credential/config/stdout blob). New array of clones — getResults() returns
   // the shared in-memory state rows; never mutate them.