Avenue (v4.3beta9)

A correctness-and-hardening follow-up to beta8, prompted by a review of the beta8 changes. It reworks announce IP/port validation to be per-family and fail as a client fault, makes configuration writes atomic, replaces the truthy %placeholder% defaults with real typed values, and turns the announce rate-limit into a self-contained tunable — plus smaller fixes for numwant=0 and non-UTF-8 client labels, a walk-back of beta8's most aggressive interval defaults, and a round of setting renames for clarity. The tracker protocol and database schema are unchanged — no DB migration is required.

• BREAKING: Rename several hand-edited settings for clarity and consistency. A phoenix.custom.php that sets an old key silently falls back to the new default, so update any overrides: external_ip → allow_client_ip (it accepts a client-supplied IP — not to be confused with announce_external_ip, which returns one), announce_interval → announce_rec_interval and min_interval → announce_min_interval (symmetry with scrape_min_interval), random_limit → random_peers_threshold, clean_with_requests → clean_request_percent, allow_any_proxy → trust_any_forwarded, and backup_rotate → backup_retention (matching task_retention / stats_retention). The installer and admin panel only ever write unaffected keys, so a normal install needs no change.
• FIX: Rework announce IP/port validation to be per-family and reject bad input as a client fault rather than a server one. A resolved address with no listening port (?port omitted, ?port=0) is now rejected up front (Missing port.) instead of being stored as an unreachable peer or left to fail at insert; an out-of-range port drops only its own address family, so a valid IPv4 pair still registers when a client supplies a bad ?ipv6=[…]:port (with allow_client_ip on); and a peer with no routable address — e.g. a private REMOTE_ADDR dropped by reject_private_ips with no public fallback — is rejected rather than stored addressless. A dropped family's absent port is normalised to 0 before it is bound, so an out-of-range per-family port no longer throws on the peer insert under a strict-mode database.
• FIX: Publish config/phoenix.custom.php atomically. The admin panel, the installer set-password gate, and the login-time hash upgrade now write to a sibling temp file under an exclusive lock and rename() it over the target, so a concurrent request's settings_load() never includes a half-written file and fatals the whole tracker. Existing file permissions are preserved, and a failed write leaves the previous config intact.
• FIX: Replace the %placeholder% values in config/phoenix.default.php with real, typed defaults. db_persist and open_tracker were strings — truthy by accident and mistyped against the settings contract — and are now proper booleans (true / false); db_prefix defaults to phoenix_; the database credentials ship empty. db_is_configured() reads empty credentials as "not configured", and the missing-config fallback no longer injects demo credentials (a hard-coded root / Password1), so an unconfigured tracker reports Tracker is not configured. cleanly instead of attempting a weak-credential local connection.
• FEATURE: Make the announce rate-limit tunable and decouple its window from the announce cadence. New announce_rate_limit (how many other peer_ids one IP may carry on a torrent within the window before the next is throttled; 0 disables the check) and announce_rate_window (seconds) settings replace the old hard count > 0 gate, which cross-blocked unrelated peers sharing one public IPv4 (a home NAT, or CGNAT). The window is now independent, so tuning the announce cadence no longer widens the anti-abuse window as a side effect. On a tracker fronted by a reverse proxy, prefer its per-IP rate limiting and set announce_rate_limit to 0.
• FIX: Honour numwant=0 as the valid "send me no peers" request it is (a seed, or a stopped / completed announce) instead of folding it up to max_peers; the value now clamps to [0, max_peers] and negatives floor to 0. (numwant is a de-facto convention, not a numbered BEP; BEPs.md is corrected accordingly.)
• FIX: Harden the detected peer-client label against non-UTF-8 and control bytes. An unrecognised Azureus-style client code is surfaced only when it is plain alphanumeric; anything else collapses to Unknown, so raw peer_id bytes can never reach the admin Peers views or the stored events.client label. The views additionally escape with ENT_SUBSTITUTE, so an unexpected byte renders as a replacement character rather than blanking the cell.
• IMPROVES: Walk back beta8's most aggressive interval defaults, now that per-IP abuse is handled by the rate-limit setting: announce_min_interval returns to 1 minute (from 10) and scrape_min_interval to 15 minutes (from 30), so a manual re-announce or a client scrape is not throttled as hard. announce_rec_interval stays at 30 minutes for steady-state load.

Compare v4.3beta9 with v4.3beta8