README.md: name the rounds in which the rows are sorted

Model: fable-5-1

README.md

@@ -82,12 +82,12 @@ The host list is written in `web/src/main.js`. There is no setting for it.
 
 ### What a figure measures
 
-A check is a request to the target's URL: GET, or HEAD for the S3 regions. The
+Each check is a GET request to the target's URL. The figure is the time from
-figure is the time from sending the request until the response headers arrive,
+sending the request until the response headers arrive, in milliseconds. Unlike
-in milliseconds. Unlike ping, it includes the time the server takes to answer.
+ping, it includes the time the server takes to answer. When the browser opens a
-When the browser opens a new connection, it also includes the DNS lookup, the
+new connection, it also includes the DNS lookup, the connection setup and the
-connection setup and the TLS handshake. Chrome opens a new connection for every
+TLS handshake. Chrome opens a new connection for every check of the Hetzner
-check of the Hetzner servers, and for more targets at longer intervals.
+servers, and for more targets at longer intervals.
 
 Any answer counts as reachable, an error page included. The request is made in
 the browser's `no-cors` mode, so the page cannot read the answer, only time it.
@@ -297,13 +297,6 @@ The [upaas](https://git.eeqj.de/sneak/upaas) app for netwatch needs:
       leads out of `/data` is refused too.
     - `TRUSTED_PROXIES` names the proxies nginx trusts, as IP addresses or CIDRs
       separated by commas. The backend's own setting is fixed to `127.0.0.1/32`.
-      With `TRUSTED_PROXIES` set and empty, nginx trusts no proxy. Every client
-      behind the proxy then shares the proxy's one allowance of
-      `REPORTS_PER_MINUTE`. Any client that connects from an address in the set
-      can write its own `X-Forwarded-For`. A connection through a port Docker
-      publishes can arrive from the Docker network's gateway, such as
-      `172.17.0.1`. The default includes that address. Where that matters, name
-      only the addresses that nothing but the proxy connects from.
 - Health: the image's `HEALTHCHECK`, described above.
 
 A variable set to a value the container cannot use stops it at start, with the
@@ -425,11 +418,11 @@ bounded in four ways. Each refusal answers with the body `{"status":"error"}`.
 - Rate limit. Each client address, resolved through `TRUSTED_PROXIES`, may send
   `REPORTS_PER_MINUTE` reports a minute. Past that it gets 429 with
   `Retry-After: 60`. The minute slides: reports from the minute before still
-  count, fading out over the current one. An address that sends at most half the
+  count, fading out over the current one. An address is sure never to be refused
-  limit in any 60 seconds is never refused. Above that, it may be. The page
+  only while it sends at most half the limit in any 60 seconds. The page sends
-  sends one report a minute from each open tab. So the default of 60 refuses
+  one report a minute from each open tab. So the default of 60 refuses nothing
-  nothing from up to 30 tabs behind one address, however their reports bunch up.
+  from up to 30 tabs behind one address, however their reports bunch up. Every
-  Every answer to a report carries the headers `X-RateLimit-Limit`,
+  answer to a report carries the headers `X-RateLimit-Limit`,
   `X-RateLimit-Remaining` and `X-RateLimit-Reset`.
 - Size cap. The report files in `DATA_DIR` may total at most
   `DATA_DIR_MAX_BYTES`, counting the files already there at start. Reports