Target check timeout is 80% of the refresh interval (closes #78)

Each target check now times out after 80% of the refresh interval, 24
seconds at 30 seconds, where it was capped at 3 seconds, so slow, far
targets are recorded with their real time. Rounds never overlap: a
round gives up the last round's checks if they are still waiting, which
happens only when a round starts early, after an interval change or
when the recovery probe finds a target answering. The probe still
checks every half second, giving up its previous checks, so they do not
pile up.

The frontend has its first unit tests, run by script/frontend-test with
Node's built-in test runner on a mocked clock. index.html now links
src/styles.css, which src/main.js imported, since Node cannot import
CSS.

Model: opus-5-5

.dockerignore

@@ -4,3 +4,6 @@ tmp
 .DS_Store
 *.log
 .claude
+
+# .git is sent so the build can stamp the version, without its config.
+.git/config

Dockerfile

@@ -20,7 +20,7 @@ RUN make lint
 # golang:1.25-alpine (2026-02-27)
 FROM golang:1.25-alpine@sha256:f6751d823c26342f9506c03797d2527668d095b0a15f1862cddb4d927a7a4ced AS builder
 
-RUN apk add --no-cache make
+RUN apk add --no-cache git make
 
 WORKDIR /src
 
@@ -37,11 +37,24 @@ RUN make test
 
 # make build is a shim around backend/script/build, the one definition
 # of the build command:
-# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=... -X main.Buildarch=..."
+# CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X main.Version=..."
 # That script reads VERSION from the environment, so it is handed over
 # there rather than as a make variable.
-ARG VERSION=dev
-RUN VERSION="${VERSION}" make build
+#
+# The version is the VERSION build argument when one is given, otherwise
+# `git describe --tags --always` of the repo's .git: the tag on a tagged
+# commit, tag-N-gHASH on a commit after one, the short commit when no
+# tag is reachable. A version that still comes out empty, dev or unknown
+# fails the build. .git goes to /git, not /src/.git, where go build would
+# find it and record VCS details of a work tree holding only backend/.
+COPY .git /git
+ARG VERSION
+RUN version="${VERSION:-$(git --git-dir=/git describe --tags --always)}"; \
+    case "$version" in ""|dev|unknown) \
+        echo "version is '$version' although .git is present" >&2; \
+        exit 1 ;; \
+    esac; \
+    VERSION="$version" make build
 
 # Frontend stage
 # node:22-alpine as of 2026-02-22
@@ -52,8 +65,9 @@ RUN yarn install --frozen-lockfile
 RUN apk add --no-cache git make
 COPY . .
 # make frontend-check is the frontend half of make check (test + lint +
-# fmt-check); its test step is the production yarn build, so this both
-# produces dist/ and gates the image on lint/fmt-check/test regressions.
+# fmt-check); its test step runs the unit tests, then the production
+# yarn build, so this both produces dist/ and gates the image on
+# lint/fmt-check/test regressions.
 # This node stage has neither Go nor Docker; the lint and builder stages
 # above gate the backend half.
 RUN make frontend-check

README.md

@@ -138,9 +138,12 @@ Local hosts are tracked separately from WAN stats.
 HEAD requests with `mode: 'no-cors'` and `cache: 'no-store'`, timed with
 `performance.now()`. Each check times out after 80% of the refresh interval (24
 seconds at 30 seconds) and is then recorded as a timeout, so a round's checks
-have all finished before the next round is due. A round due while the last one
-is still waiting, which happens only after an interval change or when the
-recovery probe starts one, is skipped. IPv4 only.
+have all finished before the next round is due. When no WAN host answers, a
+recovery probe checks 4 random WAN hosts every half second, giving up the checks
+it started half a second before. As soon as one answers, a new round starts at
+once, as it does after an interval change. A round started early gives up the
+last round's checks if they are still waiting, and that round records nothing,
+so rounds never overlap. IPv4 only.
 
 ### Color coding
 

TODO.md

@@ -23,11 +23,12 @@ latest run passes.
 
 # Completed Steps
 
-- 2026-09-29: each target check times out after 80% of the refresh interval
+- 2026-10-03: each target check times out after 80% of the refresh interval
   (issue #78), 24 seconds at 30 seconds, where it was capped at 3 seconds. A
-  round due while the last one's checks are still waiting is skipped, so rounds
-  never overlap, and the recovery probe starts no new checks while its last ones
-  are waiting. The frontend has its first unit tests, run by
+  round started early, after an interval change or when the recovery probe finds
+  a target answering, gives up the last round's checks if they are still
+  waiting, so rounds never overlap; the recovery probe gives up its own checks
+  after half a second. The frontend has its first unit tests, run by
   `script/frontend-test` with Node's built-in test runner; for them,
   `index.html` now links `src/styles.css`, which `src/main.js` used to import
 - 2026-09-29: the container sets up its own data directory (issue #75):

backend/README.md

@@ -32,7 +32,7 @@ pattern as the repo root: the targets in `backend/Makefile` are thin shims over
 `test`, `fmt` and `fmt-check`:
 
 - `script/build` — compile the static `netwatch-server` binary with its version
-  and architecture stamped in. The version is `VERSION` from the environment;
+  stamped in. The version is `VERSION` from the environment;
   when that is unset or empty, it falls back to `git describe` inside a git
   checkout, then to `dev`
 - `script/test` — run the Go tests under a 30-second timeout

backend/cmd/netwatch-server/main.go

@@ -19,9 +19,8 @@ import (
 
 //nolint:gochecknoglobals // set via ldflags at build time
 var (
-	Appname   = "netwatch-server"
-	Version   string
-	Buildarch string
+	Appname = "netwatch-server"
+	Version string
 )
 
 func main() {
@@ -40,7 +39,6 @@ func main() {
 
 	globals.Appname = Appname
 	globals.Version = Version
-	globals.Buildarch = Buildarch
 
 	fx.New(
 		fx.Provide(

backend/internal/globals/globals.go

@@ -10,22 +10,18 @@ var (
 	Appname string
 	// Version is the git version tag.
 	Version string
-	// Buildarch is the build architecture.
-	Buildarch string
 )
 
 // Globals holds build-time metadata for the application.
 type Globals struct {
-	Appname   string
-	Version   string
-	Buildarch string
+	Appname string
+	Version string
 }
 
 // New creates a Globals instance from package-level variables.
 func New(_ fx.Lifecycle) (*Globals, error) {
 	return &Globals{
-		Appname:   Appname,
-		Buildarch: Buildarch,
-		Version:   Version,
+		Appname: Appname,
+		Version: Version,
 	}, nil
 }

backend/internal/logger/logger.go

@@ -5,6 +5,7 @@ package logger
 import (
 	"log/slog"
 	"os"
+	"runtime"
 
 	"sneak.berlin/go/netwatch/internal/globals"
 
@@ -95,6 +96,6 @@ func (l *Logger) Identify() {
 	l.log.Info("starting",
 		"appname", l.params.Globals.Appname,
 		"version", l.params.Globals.Version,
-		"buildarch", l.params.Globals.Buildarch,
+		"arch", runtime.GOARCH,
 	)
 }

backend/internal/server/http.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"net"
 	"net/http"
+	"runtime"
 	"strconv"
 	"time"
 
@@ -53,7 +54,7 @@ func (s *Server) listenAndServe() {
 	s.log.Info("http begin listen",
 		"listenaddr", s.httpServer.Addr,
 		"version", s.params.Globals.Version,
-		"buildarch", s.params.Globals.Buildarch,
+		"arch", runtime.GOARCH,
 	)
 
 	err := s.httpServer.ListenAndServe()

backend/script/build

@@ -1,6 +1,6 @@
 #!/bin/sh
 # script/build: compile the static netwatch-server binary into the
-# backend project root, with its version and architecture stamped in.
+# backend project root, with its version stamped in.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -14,7 +14,7 @@ main() {
     version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
-        -ldflags "-s -w -X main.Version=$version -X main.Buildarch=$(uname -m)" \
+        -ldflags "-s -w -X main.Version=$version" \
         -o netwatch-server ./cmd/netwatch-server/
 }
 

script/cibuild

@@ -16,9 +16,8 @@ main() {
     "$SCRIPT_DIR/check"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. VERSION is computed here because .dockerignore
-    # excludes .git, so `git describe` in a build stage yields an empty
-    # version without failing.
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

script/docker

@@ -12,9 +12,8 @@ main() {
     cd "$ROOT"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
-    # empty constant. VERSION is computed here because .dockerignore
-    # excludes .git, so `git describe` in a build stage yields an empty
-    # version without failing.
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
     docker build --no-cache \

src/main.js

@@ -503,12 +503,16 @@ class Reporter {
 
 // --- Latency Measurement -----------------------------------------------------
 
-export async function measureLatency(url) {
+// Checks one target. The check times out after CONFIG.requestTimeout; the
+// caller can give it up sooner through the optional signal, which also ends
+// it as a timeout.
+export async function measureLatency(url, signal) {
     const controller = new AbortController();
     const timeoutId = setTimeout(
         () => controller.abort(),
         CONFIG.requestTimeout,
     );
+    signal?.addEventListener("abort", () => controller.abort());
 
     const targetUrl = new URL(url);
     targetUrl.searchParams.set("_cb", Date.now().toString());
@@ -1101,7 +1105,7 @@ function sortAndRebuildWAN(state) {
 
 // --- Main Loop ---------------------------------------------------------------
 
-async function tick(state, onOffline) {
+async function tick(state, signal, onOffline) {
     const ts = Date.now();
 
     if (state.paused) {
@@ -1123,11 +1127,12 @@ async function tick(state, onOffline) {
     log.debug(`Tick #${state.tickCount + 1} started`);
 
     const results = await Promise.all(
-        state.allHosts.map((h) => measureLatency(h.url)),
+        state.allHosts.map((h) => measureLatency(h.url, signal)),
     );
 
-    // User may have paused while awaiting results — discard them
-    if (state.paused) return;
+    // User may have paused, or the next round may have given up this
+    // one's checks, while awaiting results — discard them
+    if (state.paused || signal.aborted) return;
 
     state.tickCount++;
 
@@ -1168,9 +1173,10 @@ async function tick(state, onOffline) {
 
 // --- Recovery Probe ----------------------------------------------------------
 
-// When offline, rapidly poll 4 random WAN hosts every 500ms. As soon as any
-// responds, stop probing and fire a normal tick to refresh all hosts.
-function startRecoveryProbe(state, triggerTick) {
+// When offline, check 4 random WAN hosts every 500ms, giving up the checks
+// started 500ms before, so at most 4 are ever waiting. As soon as one
+// answers, stop probing and start a new round at once.
+function startRecoveryProbe(state, startRounds) {
     if (state._recoveryProbeId) return; // already running
     const candidates = [...state.wan];
     for (let i = candidates.length - 1; i > 0; i--) {
@@ -1181,20 +1187,18 @@ function startRecoveryProbe(state, triggerTick) {
     log.notice(
         `Recovery probe started (${canaries.map((h) => h.name).join(", ")})`,
     );
-    // A check can wait up to CONFIG.requestTimeout, far longer than
-    // 500ms, so no new checks start while the last ones are waiting.
-    let checking = false;
-    state._recoveryProbeId = setInterval(async () => {
-        if (state.paused || checking) return;
-        checking = true;
-        const results = await Promise.all(
-            canaries.map((h) => measureLatency(h.url)),
-        );
-        checking = false;
-        if (results.some((r) => r.error === null)) {
-            log.notice("Recovery probe: connectivity detected");
-            stopRecoveryProbe(state);
-            triggerTick();
+    state._recoveryProbeId = setInterval(() => {
+        if (state.paused) return;
+        state._recoveryProbeChecks?.abort();
+        const checks = new AbortController();
+        state._recoveryProbeChecks = checks;
+        for (const host of canaries) {
+            measureLatency(host.url, checks.signal).then((r) => {
+                if (r.error !== null || checks.signal.aborted) return;
+                log.notice("Recovery probe: connectivity detected");
+                stopRecoveryProbe(state);
+                startRounds();
+            });
         }
     }, 500);
 }
@@ -1203,6 +1207,7 @@ function stopRecoveryProbe(state) {
     if (state._recoveryProbeId) {
         clearInterval(state._recoveryProbeId);
         state._recoveryProbeId = null;
+        state._recoveryProbeChecks?.abort();
     }
 }
 
@@ -1379,28 +1384,34 @@ async function init() {
     updateClocks();
     setInterval(updateClocks, 1000);
 
-    // A round waits up to CONFIG.requestTimeout for its checks. A round
-    // asked for while one is still waiting, after an interval change or
-    // by the recovery probe, is skipped, so rounds never overlap.
-    let roundRunning = false;
-    async function doTick() {
-        if (roundRunning) return;
-        roundRunning = true;
-        try {
-            await tick(state, () => startRecoveryProbe(state, doTick));
-        } finally {
-            roundRunning = false;
-        }
+    // Rounds never overlap: a round first gives up the last round's checks
+    // if they are still waiting, and the last round then records nothing.
+    // At a steady interval they never are, as they time out at 80% of it;
+    // they can be when a round starts early, after an interval change or
+    // when the recovery probe finds a target answering.
+    let roundChecks = new AbortController();
+    function doTick() {
+        roundChecks.abort();
+        roundChecks = new AbortController();
+        tick(state, roundChecks.signal, () =>
+            startRecoveryProbe(state, startRounds),
+        );
     }
 
-    doTick();
-    let tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
+    // Starts a round now and then one every CONFIG.updateInterval.
+    let tickIntervalId;
+    function startRounds() {
+        clearInterval(tickIntervalId);
+        doTick();
+        tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
+    }
+
+    startRounds();
 
     document
         .getElementById("interval-select")
         .addEventListener("change", (e) => {
             const newInterval = parseInt(e.target.value, 10);
-            clearInterval(tickIntervalId);
             CONFIG.updateInterval = newInterval;
             log.notice(
                 `Interval changed to ${humanDuration(newInterval / 1000)}, history reset`,
@@ -1449,8 +1460,7 @@ async function init() {
 
             // Start immediately with new interval
             stopRecoveryProbe(state);
-            doTick();
-            tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
+            startRounds();
         });
 
     window.addEventListener("resize", () => handleResize(state));

test/unit/main.test.js

@@ -1,52 +1,66 @@
 // Unit tests for src/main.js, run by script/frontend-test with Node's
 // built-in test runner. Importing the module does not start the page.
 
-import { after, before, test } from "node:test";
+import { test } from "node:test";
 import assert from "node:assert/strict";
-import { createServer } from "node:http";
 import { CONFIG, measureLatency } from "../../src/main.js";
 
 // measureLatency writes timeouts to the debug log, which looks for its
 // panel in the page. There is no page here.
 globalThis.document = { getElementById: () => null };
 
-// A target that answers after the number of milliseconds in the path,
-// e.g. /600.
-let server;
-let target;
+// Mocks the clock for test t, so that a check lasting seconds takes no real
+// time, and replaces fetch with a target that answers after answerAfter
+// milliseconds of that clock, or never when answerAfter is Infinity. Both
+// are restored when the test ends.
+function mockTarget(t, answerAfter) {
+    t.mock.timers.enable({ apis: ["setTimeout", "Date"] });
+    t.mock.method(performance, "now", () => Date.now());
+    t.mock.method(
+        globalThis,
+        "fetch",
+        (url, { signal }) =>
+            new Promise((resolve, reject) => {
+                if (answerAfter !== Infinity) setTimeout(resolve, answerAfter);
+                signal.addEventListener("abort", () => reject(signal.reason));
+            }),
+    );
+}
 
-before(async () => {
-    server = createServer((req, res) => {
-        const delay = Number(new URL(req.url, "http://x").pathname.slice(1));
-        setTimeout(() => res.end(), delay);
-    });
-    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
-    target = `http://127.0.0.1:${server.address().port}`;
-});
+// The result of check if it has ended, otherwise "still waiting".
+function settled(check) {
+    return Promise.race([
+        check,
+        new Promise((resolve) => setImmediate(resolve, "still waiting")),
+    ]);
+}
 
-after(() => {
-    server.closeAllConnections();
-    server.close();
-});
+for (const interval of [10000, 30000]) {
+    const timeout = interval * 0.8;
+    // Over 3 seconds, which the timeout used to be capped at.
+    const slowAnswer = timeout - 1000;
 
-test("the timeout is 80% of the refresh interval", () => {
-    CONFIG.updateInterval = 30000;
-    assert.equal(CONFIG.requestTimeout, 24000);
-    CONFIG.updateInterval = 3000;
-    assert.equal(CONFIG.requestTimeout, 2400);
-});
-
-test("an answer within the timeout is recorded with its real time, a later one as a timeout", async () => {
-    // 600ms is past the 400ms timeout of a 500ms interval...
-    CONFIG.updateInterval = 500;
-    assert.deepEqual(await measureLatency(`${target}/600`), {
-        latency: null,
-        error: "timeout",
+    test(`at a ${interval}ms interval, an answer after ${slowAnswer}ms is recorded with its real time`, async (t) => {
+        CONFIG.updateInterval = interval;
+        mockTarget(t, slowAnswer);
+        const check = measureLatency("https://target.test");
+        t.mock.timers.tick(slowAnswer);
+        assert.deepEqual(await settled(check), {
+            latency: slowAnswer,
+            error: null,
+        });
     });
 
-    // ...and within the 1200ms timeout of a 1500ms interval.
-    CONFIG.updateInterval = 1500;
-    const { latency, error } = await measureLatency(`${target}/600`);
-    assert.equal(error, null);
-    assert.ok(latency >= 600 && latency < 1200, `latency ${latency}ms`);
-});
+    test(`at a ${interval}ms interval, a target that never answers is recorded as a timeout after ${timeout}ms`, async (t) => {
+        CONFIG.updateInterval = interval;
+        mockTarget(t, Infinity);
+        const check = measureLatency("https://target.test");
+        t.mock.timers.tick(timeout - 1);
+        assert.equal(await settled(check), "still waiting");
+        t.mock.timers.tick(1);
+        assert.deepEqual(await settled(check), {
+            latency: null,
+            error: "timeout",
+        });
+    });
+}