next into main (#73)

Reviewed-on: #73

.dockerignore

@@ -4,6 +4,3 @@ tmp
 .DS_Store
 *.log
 .claude
-
-# .git is sent so the build can stamp the version, without its config.
-.git/config

Dockerfile

@@ -20,10 +20,7 @@ RUN make lint
 # golang:1.25-alpine (2026-02-27)
 FROM golang:1.25-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
 
-# gcc and musl-dev are for make test: its race detector needs cgo, which
+RUN apk add --no-cache make
-# Go turns on by itself once a C compiler is present. make build still
-# sets CGO_ENABLED=0, so the binary stays static.
-RUN apk add --no-cache gcc git make musl-dev
 
 WORKDIR /src
 
@@ -40,24 +37,11 @@ RUN make test
 
 # make build is a shim around backend/script/build, the one definition
 # of the build command:
-# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=..."
+# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=... -X main.Buildarch=..."
 # That script reads VERSION from the environment, so it is handed over
 # there rather than as a make variable.
-#
+ARG VERSION=dev
-# The version is the VERSION build argument when one is given, otherwise
+RUN VERSION="${VERSION}" make build
-# `git describe --tags --always` of the repo's .git: the tag on a tagged
-# commit, tag-N-gHASH on a commit after one, the short commit when no
-# tag is reachable. A version that still comes out empty, dev or unknown
-# fails the build. .git goes to /git, not /src/.git, where go build would
-# find it and record VCS details of a work tree holding only backend/.
-COPY .git /git
-ARG VERSION
-RUN version="${VERSION:-$(git --git-dir=/git describe --tags --always)}"; \
-    case "$version" in ""|dev|unknown) \
-        echo "version is '$version' although .git is present" >&2; \
-        exit 1 ;; \
-    esac; \
-    VERSION="$version" make build
 
 # Frontend stage
 # node:22-alpine as of 2026-02-22
@@ -68,9 +52,8 @@ RUN yarn install --frozen-lockfile
 RUN apk add --no-cache git make
 COPY . .
 # make frontend-check is the frontend half of make check (test + lint +
-# fmt-check); its test step runs the unit tests, then the production
+# fmt-check); its test step is the production yarn build, so this both
-# yarn build, so this both produces dist/ and gates the image on
+# produces dist/ and gates the image on lint/fmt-check/test regressions.
-# lint/fmt-check/test regressions.
 # This node stage has neither Go nor Docker; the lint and builder stages
 # above gate the backend half.
 RUN make frontend-check

README.md

@@ -39,23 +39,21 @@ halves, so the root `make check` fails if either one is broken. We provide:
 - `script/bootstrap` — install all dependencies (the pinned node via nvm unless
   one new enough for the frontend's dependencies is installed, yarn via
   corepack, `yarn install --frozen-lockfile`, the pinned Go unless one at least
-  as new as `backend/go.mod` asks for is installed, the Go modules, and gcc with
+  as new as `backend/go.mod` asks for is installed, and the Go modules), linking
-  the C library headers unless gcc is installed, for the race detector in
+  what it installs itself into `~/.local/bin`, which has to be on `PATH`. It
-  `make test`), linking what it installs itself into `~/.local/bin`, which has
+  installs no Go linter and not Docker: `make lint` runs the linter in Docker
-  to be on `PATH`. It installs no Go linter and not Docker: `make lint` runs the
-  linter in Docker
 - `script/setup` — make a fresh clone ready for development: bootstrap plus the
   git pre-commit hook
 - `script/projectname` — print the project name (used for the Docker image tag)
-- `script/test` — run `script/frontend-test`, then the backend's Go tests, each
+- `script/test` — run `script/frontend-test`, then the backend's Go tests, both
-  under its own 30-second timeout
+  within one 30-second timeout
 - `script/lint` — run `script/frontend-lint`, then golangci-lint in Docker, by
   building the lint stage of `Dockerfile` without the cache
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`
 - `script/fmt-check` — check formatting (read-only): prettier, then gofmt
 - `script/check` — run test, lint, and fmt-check
-- `script/frontend-test` — run the unit tests in `test/unit/` with Node's
+- `script/frontend-test` — run the production build as the frontend's test (no
-  built-in test runner, then the production build
+  unit tests yet)
 - `script/frontend-lint` — run prettier in check mode
 - `script/frontend-fmt` — format everything prettier understands (writes)
 - `script/frontend-fmt-check` — check prettier formatting (read-only)
@@ -138,14 +136,8 @@ Local hosts are tracked separately from WAN stats.
 ### Latency measurement
 
 HEAD requests with `mode: 'no-cors'` and `cache: 'no-store'`, timed with
-`performance.now()`. Each check times out after 80% of the refresh interval (24
+`performance.now()`. 1-second timeout; anything over 1000ms is clamped to
-seconds at 30 seconds) and is then recorded as a timeout, so a round's checks
+unreachable. IPv4 only.
-have all finished before the next round is due. When no WAN host answers, a
-recovery probe checks 4 random WAN hosts every half second, giving up the checks
-it started half a second before. As soon as one answers, a new round starts at
-once, as it does after an interval change. A round started early gives up the
-last round's checks if they are still waiting, and that round records nothing,
-so rounds never overlap. IPv4 only.
 
 ### Color coding
 
@@ -224,10 +216,8 @@ What the [upaas](https://git.eeqj.de/sneak/upaas) app for netwatch needs:
     - `CORS_ALLOWED_ORIGINS`, default empty: other origins whose pages may call
       the API
     - `DEBUG`, default `false`: debug logging
-    - `DATA_DIR`, default `/data/reports`: the directory the reports are kept
+    - `DATA_DIR`, default `/data/reports`: leave unset; reports kept outside
-      in: `/data` or a path below it, with no `.` or `..` part and no extra `/`.
+      `/data` do not survive a redeploy
-      The container also stops if the path goes through a symbolic link that
-      leads out of `/data` or is written as a full path
     - `TRUSTED_PROXIES`, default empty: set it to the address the reverse proxy
       in front of the container connects from, as an IP address or CIDR; several
       are separated by commas. nginx takes the client address from

TODO.md

@@ -23,35 +23,6 @@ latest run passes.
 
 # Completed Steps
 
-- 2026-10-03: root no longer acts outside `/data` when it prepares `DATA_DIR`
-  (issue #80): `bin/entrypoint.sh` runs `netwatch-server prepare-data-dir`,
-  which refuses a `DATA_DIR` that is not `/data` or a path below it written in
-  full, then creates `DATA_DIR`, gives `/data` and everything in it to
-  `netwatch` and sets the modes, all through a Go `os.Root` opened on `/data`.
-  That refuses any path leading out of `/data`, so neither a symbolic link
-  already there nor one a host process swaps in during the start can make root
-  create or change anything elsewhere, and `DATA_DIR=/etc` no longer gives
-  `/etc` to `netwatch`. The `README.md` section "Running under upaas" says which
-  values are accepted
-- 2026-10-03: the Go tests run with the race detector and coverage (issue #88):
-  `backend/script/test` runs `go test -timeout 30s -race -cover ./...` and, if
-  that fails, runs it again with `-v` and fails. Go's `-timeout` bounds the
-  tests, not their compile; the root `script/test` no longer puts one 30-second
-  timeout around both halves, which a cold Go build cache could use up on
-  compiling alone. The race detector needs a C compiler: the builder stage of
-  `Dockerfile` has gcc and musl-dev, and `script/bootstrap` installs gcc, with
-  the C library headers on apt and apk, when gcc is missing; the binary is still
-  built with `CGO_ENABLED=0`. New tests cover the health check's answer, a valid
-  report's answer, a report file's exact contents, and the flush when the buffer
-  reaches 10 MiB; the handlers' `TestImport` stub is gone
-- 2026-10-03: each target check times out after 80% of the refresh interval
-  (issue #78), 24 seconds at 30 seconds, where it was capped at 3 seconds. A
-  round started early, after an interval change or when the recovery probe finds
-  a target answering, gives up the last round's checks if they are still
-  waiting, so rounds never overlap; the recovery probe gives up its own checks
-  after half a second. The frontend has its first unit tests, run by
-  `script/frontend-test` with Node's built-in test runner; for them,
-  `index.html` now links `src/styles.css`, which `src/main.js` used to import
 - 2026-09-29: the container sets up its own data directory (issue #75):
   `bin/entrypoint.sh`, still as root, creates `DATA_DIR` if missing and gives it
   and `/data` to the `netwatch` user with mode 750 before starting the backend

backend/README.md

@@ -32,13 +32,10 @@ pattern as the repo root: the targets in `backend/Makefile` are thin shims over
 `test`, `fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
-  stamped in. The version is `VERSION` from the environment;
+  and architecture stamped in. The version is `VERSION` from the environment;
   when that is unset or empty, it falls back to `git describe` inside a git
   checkout, then to `dev`
-- `script/test` — run the Go tests with the race detector and coverage. Go's
+- `script/test` — run the Go tests under a 30-second timeout
-  `-timeout 30s` bounds the tests, not their compile. If they fail, they run
-  again with `-v` for the details, and the script fails. The race detector needs
-  a C compiler
 - `script/lint` — check `.golangci.yml` against its pinned sha256, then run
   golangci-lint. It runs inside the golangci-lint image of the lint stage of
   the root `Dockerfile`; from a checkout, run `make lint` at the repo root,
@@ -107,9 +104,8 @@ this server. The image's entrypoint, `bin/entrypoint.sh`, starts the server as
 user `netwatch` (uid 1000) with `BIND_ADDRESS=127.0.0.1` and `PORT=8081`, so
 only nginx reaches it, and with `TRUSTED_PROXIES=127.0.0.1/32`, so it takes the
 client address nginx passes on and no other. `DATA_DIR` is `/data/reports`, on
-the `/data` volume; before starting the server, the entrypoint creates it and
+the `/data` volume; the entrypoint creates it and gives it and `/data` to
-gives it and `/data` to `netwatch` with `netwatch-server prepare-data-dir`,
+`netwatch` before starting the server. nginx replaces the security headers
-which acts on nothing outside `/data`. nginx replaces the security headers
 this server sets with those in the root `security-headers.conf`, so those are
 what clients of the image see.
 

backend/cmd/netwatch-server/main.go

@@ -4,7 +4,6 @@ package main
 import (
 	"fmt"
 	"os"
-	"os/user"
 
 	"sneak.berlin/go/netwatch/internal/config"
 	"sneak.berlin/go/netwatch/internal/globals"
@@ -20,8 +19,9 @@ import (
 
 //nolint:gochecknoglobals // set via ldflags at build time
 var (
-	Appname = "netwatch-server"
+	Appname   = "netwatch-server"
-	Version string
+	Version   string
+	Buildarch string
 )
 
 func main() {
@@ -38,28 +38,9 @@ func main() {
 		return
 	}
 
-	// "netwatch-server prepare-data-dir DATA_DIR" gets DATA_DIR ready
-	// for the netwatch user, or exits 1 with the error; see
-	// reportbuf.PrepareDataDir. bin/entrypoint.sh runs it as root
-	// before it starts this server as that user.
-	if len(os.Args) == 3 && os.Args[1] == "prepare-data-dir" {
-		netwatch, err := user.Lookup("netwatch")
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-
-		err = reportbuf.PrepareDataDir("/data", os.Args[2], netwatch)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "DATA_DIR '%s': %v\n", os.Args[2], err)
-			os.Exit(1)
-		}
-
-		return
-	}
-
 	globals.Appname = Appname
 	globals.Version = Version
+	globals.Buildarch = Buildarch
 
 	fx.New(
 		fx.Provide(

backend/internal/globals/globals.go

@@ -10,18 +10,22 @@ var (
 	Appname string
 	// Version is the git version tag.
 	Version string
+	// Buildarch is the build architecture.
+	Buildarch string
 )
 
 // Globals holds build-time metadata for the application.
 type Globals struct {
-	Appname string
+	Appname   string
-	Version string
+	Version   string
+	Buildarch string
 }
 
 // New creates a Globals instance from package-level variables.
 func New(_ fx.Lifecycle) (*Globals, error) {
 	return &Globals{
-		Appname: Appname,
+		Appname:   Appname,
-		Version: Version,
+		Buildarch: Buildarch,
+		Version:   Version,
 	}, nil
 }

backend/internal/handlers/handlers_test.go

@@ -0,0 +1,13 @@
+package handlers_test
+
+import (
+	"testing"
+
+	_ "sneak.berlin/go/netwatch/internal/handlers"
+)
+
+func TestImport(t *testing.T) {
+	t.Parallel()
+	// Compilation check — verifies the package parses
+	// and all imports resolve.
+}

backend/internal/handlers/healthcheck_test.go

@@ -1,120 +0,0 @@
-package handlers_test
-
-import (
-	"encoding/json"
-	"maps"
-	"net/http"
-	"net/http/httptest"
-	"slices"
-	"testing"
-	"time"
-
-	"sneak.berlin/go/netwatch/internal/globals"
-	"sneak.berlin/go/netwatch/internal/handlers"
-	"sneak.berlin/go/netwatch/internal/healthcheck"
-	"sneak.berlin/go/netwatch/internal/logger"
-
-	"go.uber.org/fx/fxtest"
-)
-
-// newStartedHandlers builds Handlers with a real health check for the
-// server named in g, and starts them, which records the time the
-// uptime counts from.
-func newStartedHandlers(t *testing.T, g *globals.Globals) *handlers.Handlers {
-	t.Helper()
-
-	lc := fxtest.NewLifecycle(t)
-
-	log, err := logger.New(lc, logger.Params{Globals: g})
-	if err != nil {
-		t.Fatalf("logger: %v", err)
-	}
-
-	hc, err := healthcheck.New(lc,
-		healthcheck.Params{Globals: g, Logger: log})
-	if err != nil {
-		t.Fatalf("health check: %v", err)
-	}
-
-	h, err := handlers.New(lc,
-		handlers.Params{Globals: g, Healthcheck: hc, Logger: log})
-	if err != nil {
-		t.Fatalf("handlers: %v", err)
-	}
-
-	lc.RequireStart()
-	t.Cleanup(lc.RequireStop)
-
-	return h
-}
-
-// TestHandleHealthCheck checks the health check's answer: 200, a JSON
-// content type, and a JSON object with exactly the fields of
-// healthcheck.Response, carrying this server's name and version and
-// an uptime counted from its start.
-func TestHandleHealthCheck(t *testing.T) {
-	t.Parallel()
-
-	g := &globals.Globals{Appname: "netwatch-server", Version: "v1.2.3"}
-	h := newStartedHandlers(t, g)
-
-	rec := httptest.NewRecorder()
-	req := httptest.NewRequestWithContext(t.Context(),
-		http.MethodGet, "/.well-known/healthcheck", http.NoBody)
-
-	h.HandleHealthCheck().ServeHTTP(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-	}
-
-	contentType := rec.Header().Get("Content-Type")
-	if contentType != "application/json; charset=utf-8" {
-		t.Errorf("Content-Type = %q, want %q",
-			contentType, "application/json; charset=utf-8")
-	}
-
-	var body map[string]any
-
-	err := json.Unmarshal(rec.Body.Bytes(), &body)
-	if err != nil {
-		t.Fatalf("body not a JSON object: %v (%q)", err, rec.Body.String())
-	}
-
-	fields := []string{
-		"appname", "now", "status", "uptimeHuman", "uptimeSeconds", "version",
-	}
-	if got := slices.Sorted(maps.Keys(body)); !slices.Equal(got, fields) {
-		t.Fatalf("fields = %v, want %v", got, fields)
-	}
-
-	for field, want := range map[string]string{
-		"appname": g.Appname, "status": "ok", "version": g.Version,
-	} {
-		if body[field] != want {
-			t.Errorf("%s = %v, want %q", field, body[field], want)
-		}
-	}
-
-	now, _ := body["now"].(string)
-
-	at, err := time.Parse(time.RFC3339Nano, now)
-	if err != nil || time.Since(at).Abs() > time.Minute {
-		t.Errorf("now = %q, want the current time in RFC 3339 (%v)", now, err)
-	}
-
-	// Started just now, so the uptime is well under a minute.
-	human, _ := body["uptimeHuman"].(string)
-
-	uptime, err := time.ParseDuration(human)
-	if err != nil || uptime > time.Minute {
-		t.Errorf("uptimeHuman = %q, want a duration under a minute (%v)",
-			human, err)
-	}
-
-	seconds, ok := body["uptimeSeconds"].(float64)
-	if !ok || seconds < 0 || seconds > time.Minute.Seconds() {
-		t.Errorf("uptimeSeconds = %v, want a number of seconds under a minute",
-			body["uptimeSeconds"])
-	}
-}

backend/internal/handlers/report_test.go

@@ -46,63 +46,6 @@ func decodeStatus(t *testing.T, body []byte) string {
 	return resp.Status
 }
 
-// TestHandleReportAcceptsValidReports checks the answer to a valid
-// report, one with no hosts and one shaped as the frontend sends them:
-// 200 and {"status":"ok"} as JSON.
-func TestHandleReportAcceptsValidReports(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name string
-		body string
-	}{
-		{
-			name: "no hosts",
-			body: `{"clientId":"c1","geo":null,"hosts":[],` +
-				`"timestamp":"2026-10-03T12:00:00.000Z"}`,
-		},
-		{
-			name: "a host with a latency and an error sample",
-			body: `{"clientId":"c1","geo":null,"hosts":[{` +
-				`"name":"Example","url":"https://example.com/",` +
-				`"status":"error","history":[` +
-				`{"t":1790000000000,"latency":42,"error":null},` +
-				`{"t":1790000003000,"latency":null,"error":"timeout"}]}],` +
-				`"timestamp":"2026-10-03T12:00:00.000Z"}`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			h := newTestHandlers(stubAppender{}, io.Discard)
-
-			rec := httptest.NewRecorder()
-			req := httptest.NewRequestWithContext(t.Context(),
-				http.MethodPost, "/api/v1/reports",
-				strings.NewReader(tt.body),
-			)
-
-			h.HandleReport().ServeHTTP(rec, req)
-
-			if rec.Code != http.StatusOK {
-				t.Fatalf("status = %d, want %d", rec.Code, http.StatusOK)
-			}
-
-			contentType := rec.Header().Get("Content-Type")
-			if contentType != "application/json; charset=utf-8" {
-				t.Errorf("Content-Type = %q, want %q",
-					contentType, "application/json; charset=utf-8")
-			}
-
-			if got := rec.Body.String(); got != "{\"status\":\"ok\"}\n" {
-				t.Errorf("body = %q, want %q", got, "{\"status\":\"ok\"}\n")
-			}
-		})
-	}
-}
-
 func TestHandleReportStorageFailureIsNon2xx(t *testing.T) {
 	t.Parallel()
 

backend/internal/logger/logger.go

@@ -5,7 +5,6 @@ package logger
 import (
 	"log/slog"
 	"os"
-	"runtime"
 
 	"sneak.berlin/go/netwatch/internal/globals"
 
@@ -96,6 +95,6 @@ func (l *Logger) Identify() {
 	l.log.Info("starting",
 		"appname", l.params.Globals.Appname,
 		"version", l.params.Globals.Version,
-		"arch", runtime.GOARCH,
+		"buildarch", l.params.Globals.Buildarch,
 	)
 }

backend/internal/reportbuf/datadir.go

@@ -1,113 +0,0 @@
-package reportbuf
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"syscall"
-)
-
-// ErrDataDirOutsideVolume is returned by PrepareDataDir for a DATA_DIR
-// that is not the volume or a path below it, written in full.
-var ErrDataDirOutsideVolume = errors.New(
-	"must be /data or a path below it, with no '.', '..' or extra '/'")
-
-// PrepareDataDir gets dir, the server's DATA_DIR, ready for owner, the
-// user the server runs as, so that a host directory mounted at volume,
-// /data in the image, needs no preparing: it creates dir, gives volume
-// and everything in it to owner, and gives volume and dir the mode the
-// server gives a directory it creates. dir must be volume or a path
-// below it, with no '.', '..', empty part or '/' at the end.
-//
-// bin/entrypoint.sh runs this as root, which would follow a symbolic
-// link anywhere, so every step goes through an os.Root opened on
-// volume: it follows a link only when it is written as a relative
-// path that stays inside volume, and refuses any other. A process on
-// the host can swap a link onto a path in volume at any moment while
-// this runs. Even then, the os.Root checks each link as it reaches it,
-// MkdirAll never creates a directory through a link, Lchown never
-// changes what a link points to, and the modes are set on directories
-// already opened (see chmodDir), so the most that process can do is
-// make a step fail or wait, or act on something else inside volume.
-func PrepareDataDir(volume, dir string, owner *user.User) error {
-	// rel is dir as a path from volume; IsLocal is false for one that
-	// leads out of it.
-	rel, err := filepath.Rel(volume, dir)
-	if err != nil || dir != filepath.Clean(dir) || !filepath.IsLocal(rel) {
-		return ErrDataDirOutsideVolume
-	}
-
-	uid, err := strconv.Atoi(owner.Uid)
-	if err != nil {
-		return err
-	}
-
-	gid, err := strconv.Atoi(owner.Gid)
-	if err != nil {
-		return err
-	}
-
-	root, err := os.OpenRoot(volume)
-	if err != nil {
-		return err
-	}
-
-	defer func() { _ = root.Close() }()
-
-	err = root.MkdirAll(rel, dirPerms)
-	if err != nil {
-		return err
-	}
-
-	// WalkDir does not follow a symbolic link, and Lchown gives the
-	// link itself to owner, not what it points to.
-	err = fs.WalkDir(root.FS(), ".",
-		func(name string, _ fs.DirEntry, err error) error {
-			if err != nil {
-				return err
-			}
-
-			return root.Lchown(name, uid, gid)
-		})
-	if err != nil {
-		return err
-	}
-
-	err = chmodDir(root, ".")
-	if err != nil {
-		return err
-	}
-
-	return chmodDir(root, rel)
-}
-
-// chmodDir gives name, a directory inside root, the mode the server
-// gives a directory it creates. Root.Chmod would not hold: on Linux it
-// checks that name is not a symbolic link, then sets the mode by name,
-// following a link swapped in between. So chmodDir opens name through
-// root and sets the mode on the open directory. It refuses anything
-// but a directory: a directory has no second name (hard link), so the
-// one opened is inside root, where any other file could be a hard link
-// to one outside.
-func chmodDir(root *os.Root, name string) error {
-	dir, err := root.Open(name)
-	if err != nil {
-		return err
-	}
-
-	defer func() { _ = dir.Close() }()
-
-	info, err := dir.Stat()
-	if err != nil {
-		return err
-	}
-
-	if !info.IsDir() {
-		return &fs.PathError{Op: "chmod", Path: name, Err: syscall.ENOTDIR}
-	}
-
-	return dir.Chmod(dirPerms)
-}

backend/internal/reportbuf/datadir_test.go

@@ -1,271 +0,0 @@
-package reportbuf_test
-
-import (
-	"errors"
-	"io/fs"
-	"os"
-	"os/user"
-	"path/filepath"
-	"strconv"
-	"syscall"
-	"testing"
-
-	"sneak.berlin/go/netwatch/internal/reportbuf"
-)
-
-// reports is the last part of DATA_DIR in these tests, as in the
-// image's /data/reports.
-const reports = "reports"
-
-// currentUser is the user the test runs as, the only owner a test not
-// run as root can give files to.
-func currentUser() *user.User {
-	return &user.User{
-		Uid: strconv.Itoa(os.Getuid()),
-		Gid: strconv.Itoa(os.Getgid()),
-	}
-}
-
-// tempDirMode700 is a new directory in a t.TempDir with mode 0700, so
-// a test can tell that PrepareDataDir left its mode alone.
-func tempDirMode700(t *testing.T) string {
-	t.Helper()
-
-	dir := filepath.Join(t.TempDir(), "d")
-
-	err := os.Mkdir(dir, 0o700)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	return dir
-}
-
-func requireMode(t *testing.T, path string, want fs.FileMode) {
-	t.Helper()
-
-	info, err := os.Stat(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	if info.Mode() != want {
-		t.Errorf("%s: mode %v, want %v", path, info.Mode(), want)
-	}
-}
-
-func requireMissing(t *testing.T, path string) {
-	t.Helper()
-
-	_, err := os.Lstat(path)
-	if !errors.Is(err, fs.ErrNotExist) {
-		t.Errorf("%s: created, or Lstat failed: %v", path, err)
-	}
-}
-
-func requireOwner(t *testing.T, path string, uid, gid uint32) {
-	t.Helper()
-
-	info, err := os.Lstat(path)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	stat, _ := info.Sys().(*syscall.Stat_t)
-	if stat.Uid != uid || stat.Gid != gid {
-		t.Errorf("%s: owner %d:%d, want %d:%d", path, stat.Uid, stat.Gid,
-			uid, gid)
-	}
-}
-
-func TestPrepareDataDirCreatesDataDir(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-	dir := filepath.Join(volume, "a", reports)
-
-	err := reportbuf.PrepareDataDir(volume, dir, currentUser())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	requireMode(t, volume, fs.ModeDir|0o750)
-	requireMode(t, dir, fs.ModeDir|0o750)
-}
-
-// TestPrepareDataDirSetsModeOfExistingDataDir: a DATA_DIR already on
-// the host with another mode gets the mode too, not only a new one.
-func TestPrepareDataDirSetsModeOfExistingDataDir(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-	dir := filepath.Join(volume, reports)
-
-	err := os.Mkdir(dir, 0o700)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = reportbuf.PrepareDataDir(volume, dir, currentUser())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	requireMode(t, dir, fs.ModeDir|0o750)
-}
-
-func TestPrepareDataDirTakesTheVolumeItself(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-
-	err := reportbuf.PrepareDataDir(volume, volume, currentUser())
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	requireMode(t, volume, fs.ModeDir|0o750)
-}
-
-// TestPrepareDataDirRefusesDataDirOutsideVolume covers a DATA_DIR that
-// is relative, outside the volume, or not written in full.
-func TestPrepareDataDirRefusesDataDirOutsideVolume(t *testing.T) {
-	t.Parallel()
-
-	volume := tempDirMode700(t)
-	for _, dir := range []string{
-		reports, volume + "/../new", volume + "/", volume + "//" + reports,
-		volume + "/./" + reports, volume + "/" + reports + "/..", volume + "x",
-		"/etc",
-	} {
-		err := reportbuf.PrepareDataDir(volume, dir, currentUser())
-		if !errors.Is(err, reportbuf.ErrDataDirOutsideVolume) {
-			t.Errorf("%q: error = %v, want ErrDataDirOutsideVolume", dir, err)
-		}
-	}
-
-	requireMissing(t, filepath.Join(filepath.Dir(volume), "new"))
-	requireMode(t, volume, fs.ModeDir|0o700)
-}
-
-// TestPrepareDataDirRefusesLinkOutOfVolume puts a symbolic link to a
-// directory outside the volume on the path to DATA_DIR, written as a
-// full path and as one that climbs out with '..', and as DATA_DIR
-// itself, where the mode would be set through it.
-func TestPrepareDataDirRefusesLinkOutOfVolume(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name      string
-		climbsOut bool
-		link, dir string
-	}{
-		{"full path", false, "x", "x/reports"},
-		{"climbs out", true, "x", "x/reports"},
-		{"DATA_DIR itself", false, reports, reports},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			outside := tempDirMode700(t)
-			volume := t.TempDir()
-
-			climbOut, err := filepath.Rel(volume, outside)
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			target := outside
-			if tc.climbsOut {
-				target = climbOut
-			}
-
-			err = os.Symlink(target, filepath.Join(volume, tc.link))
-			if err != nil {
-				t.Fatal(err)
-			}
-
-			err = reportbuf.PrepareDataDir(volume,
-				filepath.Join(volume, tc.dir), currentUser())
-			if err == nil {
-				t.Error("no error")
-			}
-
-			requireMissing(t, filepath.Join(outside, reports))
-			requireMode(t, outside, fs.ModeDir|0o700)
-		})
-	}
-}
-
-// TestPrepareDataDirRefusesDanglingLink: DATA_DIR is a symbolic link
-// to a name in the volume that does not exist, which is not created.
-func TestPrepareDataDirRefusesDanglingLink(t *testing.T) {
-	t.Parallel()
-
-	volume := t.TempDir()
-
-	err := os.Symlink("missing", filepath.Join(volume, reports))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = reportbuf.PrepareDataDir(volume, filepath.Join(volume, reports),
-		currentUser())
-	if err == nil {
-		t.Error("no error")
-	}
-
-	requireMissing(t, filepath.Join(volume, "missing"))
-}
-
-// TestPrepareDataDirGivesVolumeToOwner gives everything in the volume
-// to a uid and gid that own nothing, which only root can do. A
-// symbolic link in the volume to a directory outside it is given to
-// them itself; what it points to is left as it was.
-func TestPrepareDataDirGivesVolumeToOwner(t *testing.T) {
-	t.Parallel()
-
-	if os.Geteuid() != 0 {
-		t.Skip("only root can give files to another uid")
-	}
-
-	outside := t.TempDir()
-	volume := t.TempDir()
-	old := filepath.Join(volume, "old")
-
-	err := os.WriteFile(filepath.Join(outside, "f"), nil, 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.Mkdir(old, 0o700)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.WriteFile(filepath.Join(old, "f"), nil, 0o600)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.Symlink(outside, filepath.Join(old, "link"))
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = reportbuf.PrepareDataDir(volume, filepath.Join(volume, reports),
-		&user.User{Uid: "4242", Gid: "4343"})
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	for _, path := range []string{
-		volume, filepath.Join(volume, reports), old,
-		filepath.Join(old, "f"), filepath.Join(old, "link"),
-	} {
-		requireOwner(t, path, 4242, 4343)
-	}
-
-	requireOwner(t, outside, 0, 0)
-	requireOwner(t, filepath.Join(outside, "f"), 0, 0)
-}

backend/internal/reportbuf/export_test.go

@@ -2,10 +2,6 @@ package reportbuf
 
 import "time"
 
-// FlushSizeThreshold exposes the buffer size at which Append starts
-// writing a report file to the external tests.
-const FlushSizeThreshold = flushSizeThreshold
-
 // Flush writes the buffered reports to a file now, as the periodic
 // flush does, so tests need not wait a minute for it.
 func (b *Buffer) Flush() error {

backend/internal/reportbuf/reportbuf_test.go

@@ -334,11 +334,7 @@ func TestTwoFlushesInOneMillisecond(t *testing.T) {
 		}
 	}
 
-	files, err := readReportFiles(dir)
+	files := readReportFiles(t, dir)
-	if err != nil {
-		t.Fatalf("read report files: %v", err)
-	}
-
 	if len(files) != flushes {
 		t.Fatalf("%d report files after %d flushes", len(files), flushes)
 	}
@@ -351,88 +347,6 @@ func TestTwoFlushesInOneMillisecond(t *testing.T) {
 	}
 }
 
-// TestReportFileHoldsTheLinesAppended flushes three reports and reads
-// their file back: it must decompress to exactly their JSON lines, in
-// the order they were appended.
-func TestReportFileHoldsTheLinesAppended(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("DATA_DIR", dir)
-
-	buf := startBuffer(t)
-
-	for _, id := range []int{1, 2, 3} {
-		err := buf.Append(map[string]int{"id": id})
-		if err != nil {
-			t.Fatalf("append report %d: %v", id, err)
-		}
-	}
-
-	err := buf.Flush()
-	if err != nil {
-		t.Fatalf("flush: %v", err)
-	}
-
-	files, err := readReportFiles(dir)
-	if err != nil {
-		t.Fatalf("read report files: %v", err)
-	}
-
-	want := `{"id":1}` + "\n" + `{"id":2}` + "\n" + `{"id":3}` + "\n"
-	if len(files) != 1 || files[0] != want {
-		t.Fatalf("report files = %q, want one holding %q", files, want)
-	}
-}
-
-// TestFlushAtSizeThreshold appends reports until the buffer holds
-// FlushSizeThreshold bytes. The append that gets it there must write
-// them all to one report file, with no call to Flush and the periodic
-// flush a minute away, and no earlier append may write one.
-func TestFlushAtSizeThreshold(t *testing.T) {
-	dir := t.TempDir()
-	t.Setenv("DATA_DIR", dir)
-
-	buf := startBuffer(t)
-
-	// Large reports, so the threshold takes a few hundred appends.
-	pad := strings.Repeat("a", 64<<10)
-
-	var appended strings.Builder
-
-	for id := 0; appended.Len() < reportbuf.FlushSizeThreshold; id++ {
-		report := map[string]any{"id": id, "pad": pad}
-
-		err := buf.Append(report)
-		if err != nil {
-			t.Fatalf("append report %d: %v", id, err)
-		}
-
-		line, err := json.Marshal(report)
-		if err != nil {
-			t.Fatalf("marshal report %d: %v", id, err)
-		}
-
-		appended.Write(line)
-		appended.WriteByte('\n')
-	}
-
-	// Append writes the file in the background, so wait for it.
-	deadline := time.Now().Add(10 * time.Second)
-
-	for {
-		files, err := readReportFiles(dir)
-		if err == nil && len(files) == 1 && files[0] == appended.String() {
-			return
-		}
-
-		if time.Now().After(deadline) {
-			t.Fatalf("%d report files (error: %v), want one holding the "+
-				"%d bytes appended", len(files), err, appended.Len())
-		}
-
-		time.Sleep(10 * time.Millisecond)
-	}
-}
-
 // reportFilesBytes returns the total size of the report files in dir.
 func reportFilesBytes(t *testing.T, dir string) int64 {
 	t.Helper()
@@ -457,19 +371,20 @@ func reportFilesBytes(t *testing.T, dir string) int64 {
 }
 
 // readReportFiles returns the decompressed contents of each report
-// file in dir. A file still being written does not decompress, so it
+// file in dir.
-// gives an error.
+func readReportFiles(t *testing.T, dir string) []string {
-func readReportFiles(dir string) ([]string, error) {
+	t.Helper()
+
 	files := os.DirFS(dir)
 
 	names, err := fs.Glob(files, "reports-*.jsonl.zst")
 	if err != nil {
-		return nil, fmt.Errorf("list report files: %w", err)
+		t.Fatalf("list report files: %v", err)
 	}
 
 	dec, err := zstd.NewReader(nil)
 	if err != nil {
-		return nil, fmt.Errorf("create zstd decoder: %w", err)
+		t.Fatalf("create zstd decoder: %v", err)
 	}
 	defer dec.Close()
 
@@ -478,18 +393,18 @@ func readReportFiles(dir string) ([]string, error) {
 	for _, name := range names {
 		compressed, readErr := fs.ReadFile(files, name)
 		if readErr != nil {
-			return nil, fmt.Errorf("read %s: %w", name, readErr)
+			t.Fatalf("read %s: %v", name, readErr)
 		}
 
 		data, decErr := dec.DecodeAll(compressed, nil)
 		if decErr != nil {
-			return nil, fmt.Errorf("decompress %s: %w", name, decErr)
+			t.Fatalf("decompress %s: %v", name, decErr)
 		}
 
 		contents = append(contents, string(data))
 	}
 
-	return contents, nil
+	return contents
 }
 
 func writeBytes(t *testing.T, path string, n int) {

backend/internal/server/http.go

@@ -4,7 +4,6 @@ import (
 	"errors"
 	"net"
 	"net/http"
-	"runtime"
 	"strconv"
 	"time"
 
@@ -54,7 +53,7 @@ func (s *Server) listenAndServe() {
 	s.log.Info("http begin listen",
 		"listenaddr", s.httpServer.Addr,
 		"version", s.params.Globals.Version,
-		"arch", runtime.GOARCH,
+		"buildarch", s.params.Globals.Buildarch,
 	)
 
 	err := s.httpServer.ListenAndServe()

backend/script/build

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/build: compile the static netwatch-server binary into the
-# backend project root, with its version stamped in.
+# backend project root, with its version and architecture stamped in.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -14,7 +14,7 @@ main() {
     version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
-        -ldflags "-s -w -X main.Version=$version" \
+        -ldflags "-s -w -X main.Version=$version -X main.Buildarch=$(uname -m)" \
         -o netwatch-server ./cmd/netwatch-server/
 }
 

backend/script/test

@@ -1,20 +1,12 @@
 #!/bin/sh
-# script/test: run the backend test suite with the race detector and
+# script/test: run the backend test suite.
-# coverage. Go's own -timeout bounds the tests and not their compile,
-# so a cold build cache cannot fail it. The race detector needs cgo,
-# and so a C compiler. If the tests fail, they run again with -v for
-# the details, and the script fails even if that run passes.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... || {
+    timeout 30 go test ./...
-        echo "--- Rerunning with -v for details ---"
-        go test -timeout 30s -race -v ./...
-        exit 1
-    }
 }
 
 main "$@"

bin/entrypoint.sh

@@ -63,13 +63,26 @@ done > /etc/nginx/trusted-proxies.conf
 
 # netwatch-server keeps its report files in DATA_DIR, on the /data
 # volume, which may be a host directory owned by root or by another
-# uid. Here, as root, netwatch-server prepare-data-dir creates DATA_DIR
+# uid. Both are given to the netwatch user here, with the mode the
-# and gives /data and everything in it to the netwatch user, so the
+# server gives a directory it creates, so the host directory needs no
-# host directory needs no preparing. It stops the start, naming
+# preparing.
-# DATA_DIR, unless DATA_DIR is /data or a path below it, and it acts on
+#
-# nothing outside /data, whatever symbolic links it meets there.
+# chown and chmod, run as root, change whatever a symbolic link on the
+# path points to, anywhere in the container, and the netwatch user can
+# put one in /data. So the start stops unless readlink -f, which
+# follows every link on a path, gives /data and DATA_DIR back as they
+# are. It also writes a path in full, so a DATA_DIR with '.', '..' or
+# an extra '/' in it is refused too.
 export DATA_DIR="${DATA_DIR:-/data/reports}"
-netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
+mkdir -p "$DATA_DIR" || exit 1
+if [ "$(readlink -f /data)" != /data ] ||
+    [ "$(readlink -f "$DATA_DIR")" != "$DATA_DIR" ]; then
+    echo "entrypoint: DATA_DIR must be a full path with no '.', '..'," \
+        "extra '/' or symbolic link on it or on /data, not '$DATA_DIR'" >&2
+    exit 1
+fi
+chown -R netwatch:netwatch /data "$DATA_DIR" || exit 1
+chmod 750 /data "$DATA_DIR" || exit 1
 
 # A stop signal is only noted here; the loop below acts on it.
 stop_requested=""

index.html

@@ -9,9 +9,6 @@
             type="image/svg+xml"
             href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📡</text></svg>"
         />
-        <!-- Linked here, not imported by src/main.js, so the unit tests can
-             import that module in Node, which cannot import CSS. -->
-        <link rel="stylesheet" href="/src/styles.css" />
     </head>
     <body class="bg-gray-900 text-white min-h-screen">
         <div id="app"></div>

script/bootstrap

@@ -64,8 +64,7 @@ detect_pkgmgr() {
     fi
 }
 
-# pkg_install <nix-attr> <apt-pkgs> <brew-formula> <apk-pkgs>: the apt
+# pkg_install <nix-attr> <apt-pkg> <brew-formula> <apk-pkg>
-# and apk arguments may each list several packages, separated by spaces.
 pkg_install() {
     detect_pkgmgr
     case "$PKGMGR" in
@@ -75,10 +74,10 @@ pkg_install() {
                 $SUDO env DEBIAN_FRONTEND=noninteractive apt-get update
                 APT_UPDATED=1
             fi
-            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y $2
+            $SUDO env DEBIAN_FRONTEND=noninteractive apt-get install -y "$2"
             ;;
         brew) brew install "$3" ;;
-        apk) apk add --no-cache $4 ;;
+        apk) apk add --no-cache "$4" ;;
     esac
 }
 
@@ -254,12 +253,6 @@ main() {
 
     if missing make; then pkg_install gnumake make make make; fi
     if missing git; then pkg_install git git git git; fi
-    # The race detector in make test needs cgo, which Go turns on only
-    # when it finds its C compiler, gcc on Linux. apt and apk ship the C
-    # library headers apart from gcc.
-    if missing gcc; then
-        pkg_install gcc "gcc libc6-dev" gcc "gcc musl-dev"
-    fi
 
     ensure_node
     ensure_yarn

script/cibuild

@@ -16,8 +16,9 @@ main() {
     "$SCRIPT_DIR/check"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
+    # empty constant. VERSION is computed here because .dockerignore
-    # the version a build stage derives from the .git in the context.
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/docker

@@ -12,8 +12,9 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. The VERSION build argument takes precedence over
+    # empty constant. VERSION is computed here because .dockerignore
-    # the version a build stage derives from the .git in the context.
+    # excludes .git, so `git describe` in a build stage yields an empty
+    # version without failing.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/frontend-test

@@ -1,14 +1,13 @@
 #!/bin/sh
-# script/frontend-test: run the frontend test suite: the unit tests in
+# script/frontend-test: run the frontend test suite. The frontend has no
-# test/unit/ with Node's built-in test runner, then the production
+# unit tests; the production build serves as the test (fails on broken
-# build, which fails on broken code.
+# code).
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    timeout 30 node --test test/unit/*.test.js
     timeout 30 yarn build
 }
 

script/test

@@ -1,17 +1,14 @@
 #!/bin/sh
 # script/test: run the test suite for the whole repo: the frontend at
-# the repo root, then the Go backend in backend/. Each half has its own
+# the repo root, then the Go backend in backend/. Both halves together
-# 30-second limit, and there is none around both: from a cold Go build
+# get 30 seconds; each also keeps its own limit for the Dockerfiles.
-# cache, compiling the backend's tests with the race detector can take
-# 30 seconds on its own, and Go's -timeout leaves the compile out.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    script/frontend-test
+    timeout 30 sh -c 'script/frontend-test && backend/script/test'
-    backend/script/test
 }
 
 main "$@"

src/main.js

@@ -1,14 +1,14 @@
+import "./styles.css";
+
 // --- Configuration -----------------------------------------------------------
 
-// Timing, axis labels, and display constants. A target check times out
+// Timing, axis labels, and display constants. Latency above maxLatency is
-// after requestTimeout, 80% of updateInterval, so a round's checks have
+// clamped to "unreachable". The sparkline Y-axis is capped at
-// all finished before the next round is due; latency above maxLatency is
-// recorded as a timeout. The sparkline Y-axis is capped at
 // graphMaxLatency — values above it pin to the top of the chart but still
 // display their real value in the latency figure. The history buffer holds
 // maxHistoryPoints samples (historyDuration / updateInterval).
 // reportInterval is how often collected samples are POSTed to the backend.
-export const CONFIG = {
+const CONFIG = {
     updateInterval: 3000,
     maxHistoryPoints: 100,
     reportInterval: 60000,
@@ -16,7 +16,7 @@ export const CONFIG = {
         return (this.maxHistoryPoints * this.updateInterval) / 1000;
     },
     get requestTimeout() {
-        return this.updateInterval * 0.8;
+        return Math.min(this.updateInterval - 100, 3000);
     },
     get maxLatency() {
         return this.requestTimeout;
@@ -503,16 +503,12 @@ class Reporter {
 
 // --- Latency Measurement -----------------------------------------------------
 
-// Checks one target. The check times out after CONFIG.requestTimeout; the
+async function measureLatency(url) {
-// caller can give it up sooner through the optional signal, which also ends
-// it as a timeout.
-export async function measureLatency(url, signal) {
     const controller = new AbortController();
     const timeoutId = setTimeout(
         () => controller.abort(),
         CONFIG.requestTimeout,
     );
-    signal?.addEventListener("abort", () => controller.abort());
 
     const targetUrl = new URL(url);
     targetUrl.searchParams.set("_cb", Date.now().toString());
@@ -1105,7 +1101,7 @@ function sortAndRebuildWAN(state) {
 
 // --- Main Loop ---------------------------------------------------------------
 
-async function tick(state, signal, onOffline) {
+async function tick(state, onOffline) {
     const ts = Date.now();
 
     if (state.paused) {
@@ -1127,12 +1123,11 @@ async function tick(state, signal, onOffline) {
     log.debug(`Tick #${state.tickCount + 1} started`);
 
     const results = await Promise.all(
-        state.allHosts.map((h) => measureLatency(h.url, signal)),
+        state.allHosts.map((h) => measureLatency(h.url)),
     );
 
-    // User may have paused, or the next round may have given up this
+    // User may have paused while awaiting results — discard them
-    // one's checks, while awaiting results — discard them
+    if (state.paused) return;
-    if (state.paused || signal.aborted) return;
 
     state.tickCount++;
 
@@ -1173,10 +1168,9 @@ async function tick(state, signal, onOffline) {
 
 // --- Recovery Probe ----------------------------------------------------------
 
-// When offline, check 4 random WAN hosts every 500ms, giving up the checks
+// When offline, rapidly poll 4 random WAN hosts every 500ms. As soon as any
-// started 500ms before, so at most 4 are ever waiting. As soon as one
+// responds, stop probing and fire a normal tick to refresh all hosts.
-// answers, stop probing and start a new round at once.
+function startRecoveryProbe(state, triggerTick) {
-function startRecoveryProbe(state, startRounds) {
     if (state._recoveryProbeId) return; // already running
     const candidates = [...state.wan];
     for (let i = candidates.length - 1; i > 0; i--) {
@@ -1187,18 +1181,15 @@ function startRecoveryProbe(state, startRounds) {
     log.notice(
         `Recovery probe started (${canaries.map((h) => h.name).join(", ")})`,
     );
-    state._recoveryProbeId = setInterval(() => {
+    state._recoveryProbeId = setInterval(async () => {
         if (state.paused) return;
-        state._recoveryProbeChecks?.abort();
+        const results = await Promise.all(
-        const checks = new AbortController();
+            canaries.map((h) => measureLatency(h.url)),
-        state._recoveryProbeChecks = checks;
+        );
-        for (const host of canaries) {
+        if (results.some((r) => r.error === null)) {
-            measureLatency(host.url, checks.signal).then((r) => {
+            log.notice("Recovery probe: connectivity detected");
-                if (r.error !== null || checks.signal.aborted) return;
+            stopRecoveryProbe(state);
-                log.notice("Recovery probe: connectivity detected");
+            triggerTick();
-                stopRecoveryProbe(state);
-                startRounds();
-            });
         }
     }, 500);
 }
@@ -1207,7 +1198,6 @@ function stopRecoveryProbe(state) {
     if (state._recoveryProbeId) {
         clearInterval(state._recoveryProbeId);
         state._recoveryProbeId = null;
-        state._recoveryProbeChecks?.abort();
     }
 }
 
@@ -1384,34 +1374,18 @@ async function init() {
     updateClocks();
     setInterval(updateClocks, 1000);
 
-    // Rounds never overlap: a round first gives up the last round's checks
-    // if they are still waiting, and the last round then records nothing.
-    // At a steady interval they never are, as they time out at 80% of it;
-    // they can be when a round starts early, after an interval change or
-    // when the recovery probe finds a target answering.
-    let roundChecks = new AbortController();
     function doTick() {
-        roundChecks.abort();
+        tick(state, () => startRecoveryProbe(state, doTick));
-        roundChecks = new AbortController();
-        tick(state, roundChecks.signal, () =>
-            startRecoveryProbe(state, startRounds),
-        );
     }
 
-    // Starts a round now and then one every CONFIG.updateInterval.
+    doTick();
-    let tickIntervalId;
+    let tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
-    function startRounds() {
-        clearInterval(tickIntervalId);
-        doTick();
-        tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
-    }
-
-    startRounds();
 
     document
         .getElementById("interval-select")
         .addEventListener("change", (e) => {
             const newInterval = parseInt(e.target.value, 10);
+            clearInterval(tickIntervalId);
             CONFIG.updateInterval = newInterval;
             log.notice(
                 `Interval changed to ${humanDuration(newInterval / 1000)}, history reset`,
@@ -1460,7 +1434,8 @@ async function init() {
 
             // Start immediately with new interval
             stopRecoveryProbe(state);
-            startRounds();
+            doTick();
+            tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
         });
 
     window.addEventListener("resize", () => handleResize(state));
@@ -1469,7 +1444,7 @@ async function init() {
 
 // Bootstrap only when loaded as the page: a real DOM containing the #app
 // mount point this module renders into. Importing the module in a unit test
-// (which has no #app) runs nothing, so its exports can be tested in isolation.
+// (which has no #app) runs nothing, so buildReport can be tested in isolation.
 if (typeof document !== "undefined" && document.getElementById("app")) {
     if (document.readyState === "loading") {
         document.addEventListener("DOMContentLoaded", init);

test/unit/main.test.js

@@ -1,66 +0,0 @@
-// Unit tests for src/main.js, run by script/frontend-test with Node's
-// built-in test runner. Importing the module does not start the page.
-
-import { test } from "node:test";
-import assert from "node:assert/strict";
-import { CONFIG, measureLatency } from "../../src/main.js";
-
-// measureLatency writes timeouts to the debug log, which looks for its
-// panel in the page. There is no page here.
-globalThis.document = { getElementById: () => null };
-
-// Mocks the clock for test t, so that a check lasting seconds takes no real
-// time, and replaces fetch with a target that answers after answerAfter
-// milliseconds of that clock, or never when answerAfter is Infinity. Both
-// are restored when the test ends.
-function mockTarget(t, answerAfter) {
-    t.mock.timers.enable({ apis: ["setTimeout", "Date"] });
-    t.mock.method(performance, "now", () => Date.now());
-    t.mock.method(
-        globalThis,
-        "fetch",
-        (url, { signal }) =>
-            new Promise((resolve, reject) => {
-                if (answerAfter !== Infinity) setTimeout(resolve, answerAfter);
-                signal.addEventListener("abort", () => reject(signal.reason));
-            }),
-    );
-}
-
-// The result of check if it has ended, otherwise "still waiting".
-function settled(check) {
-    return Promise.race([
-        check,
-        new Promise((resolve) => setImmediate(resolve, "still waiting")),
-    ]);
-}
-
-for (const interval of [10000, 30000]) {
-    const timeout = interval * 0.8;
-    // Over 3 seconds, which the timeout used to be capped at.
-    const slowAnswer = timeout - 1000;
-
-    test(`at a ${interval}ms interval, an answer after ${slowAnswer}ms is recorded with its real time`, async (t) => {
-        CONFIG.updateInterval = interval;
-        mockTarget(t, slowAnswer);
-        const check = measureLatency("https://target.test");
-        t.mock.timers.tick(slowAnswer);
-        assert.deepEqual(await settled(check), {
-            latency: slowAnswer,
-            error: null,
-        });
-    });
-
-    test(`at a ${interval}ms interval, a target that never answers is recorded as a timeout after ${timeout}ms`, async (t) => {
-        CONFIG.updateInterval = interval;
-        mockTarget(t, Infinity);
-        const check = measureLatency("https://target.test");
-        t.mock.timers.tick(timeout - 1);
-        assert.equal(await settled(check), "still waiting");
-        t.mock.timers.tick(1);
-        assert.deepEqual(await settled(check), {
-            latency: null,
-            error: "timeout",
-        });
-    });
-}