Delete the oldest report files to stay under the size cap (closes #54)

When a report would take the report files past DATA_DIR_MAX_BYTES,
reportbuf now deletes the oldest report files until it fits, and does
the same at start when files left by an earlier run are already past
it. A file joins the files that may be deleted only once it is
completely written, so a file still being written is never deleted. A
report is refused with 507 only when the reports waiting to be written
fill the cap on their own, and then no file is deleted. The reports of
a failed write stop counting, and the part of its file written is
removed. A file whose deletion fails keeps counting; one already
deleted by hand counts as freed.

Model: opus-5-5

Dockerfile

@@ -65,8 +65,9 @@ RUN yarn install --frozen-lockfile
 RUN apk add --no-cache git make
 COPY . .
 # make frontend-check is the frontend half of make check (test + lint +
-# fmt-check); its test step is the production yarn build, so this both
-# produces dist/ and gates the image on lint/fmt-check/test regressions.
+# fmt-check); its test step runs the unit tests, then the production
+# yarn build, so this both produces dist/ and gates the image on
+# lint/fmt-check/test regressions.
 # This node stage has neither Go nor Docker; the lint and builder stages
 # above gate the backend half.
 RUN make frontend-check

README.md

@@ -52,8 +52,8 @@ halves, so the root `make check` fails if either one is broken. We provide:
 - `script/fmt` — format all files (writes): prettier, then gofmt over `backend/`
 - `script/fmt-check` — check formatting (read-only): prettier, then gofmt
 - `script/check` — run test, lint, and fmt-check
-- `script/frontend-test` — run the production build as the frontend's test (no
-  unit tests yet)
+- `script/frontend-test` — run the unit tests in `test/unit/` with Node's
+  built-in test runner, then the production build
 - `script/frontend-lint` — run prettier in check mode
 - `script/frontend-fmt` — format everything prettier understands (writes)
 - `script/frontend-fmt-check` — check prettier formatting (read-only)
@@ -136,8 +136,14 @@ Local hosts are tracked separately from WAN stats.
 ### Latency measurement
 
 HEAD requests with `mode: 'no-cors'` and `cache: 'no-store'`, timed with
-`performance.now()`. 1-second timeout; anything over 1000ms is clamped to
-unreachable. IPv4 only.
+`performance.now()`. Each check times out after 80% of the refresh interval (24
+seconds at 30 seconds) and is then recorded as a timeout, so a round's checks
+have all finished before the next round is due. When no WAN host answers, a
+recovery probe checks 4 random WAN hosts every half second, giving up the checks
+it started half a second before. As soon as one answers, a new round starts at
+once, as it does after an interval change. A round started early gives up the
+last round's checks if they are still waiting, and that round records nothing,
+so rounds never overlap. IPv4 only.
 
 ### Color coding
 

TODO.md

@@ -27,10 +27,19 @@ latest run passes.
   (issue #54): when a report would take them past it, the oldest report files
   are deleted to make room, each deletion logged, and at start files already
   past it are deleted the same way. A file still being written is never deleted.
-  A report is refused with 507 only when the reports not yet written leave no
-  room for it on their own, and then no file is deleted. A file that cannot be
-  deleted still counts until the next start; one already deleted by hand counts
-  as freed
+  A report is refused with 507 only when the reports waiting to be written fill
+  the cap on their own, and then no file is deleted. The reports of a failed
+  write stop counting, and the part of its file written is removed. A file that
+  cannot be deleted still counts until the next start; one already deleted by
+  hand counts as freed
+- 2026-10-03: each target check times out after 80% of the refresh interval
+  (issue #78), 24 seconds at 30 seconds, where it was capped at 3 seconds. A
+  round started early, after an interval change or when the recovery probe finds
+  a target answering, gives up the last round's checks if they are still
+  waiting, so rounds never overlap; the recovery probe gives up its own checks
+  after half a second. The frontend has its first unit tests, run by
+  `script/frontend-test` with Node's built-in test runner; for them,
+  `index.html` now links `src/styles.css`, which `src/main.js` used to import
 - 2026-09-29: the container sets up its own data directory (issue #75):
   `bin/entrypoint.sh`, still as root, creates `DATA_DIR` if missing and gives it
   and `/data` to the `netwatch` user with mode 750 before starting the backend

backend/README.md

@@ -148,15 +148,17 @@ credentials, so it is bounded instead. Both refusals below answer with the same
   `X-RateLimit-Reset` headers.
 - **Size cap.** The report files in `DATA_DIR` may total at most
   `DATA_DIR_MAX_BYTES`, counting the files already there at start. Reports
-  waiting in memory count at their uncompressed size until they are written.
-  When a report would take the total past the cap, the oldest report files are
-  deleted to make room, and each deletion is logged with the file's name and
-  size; a file still being written is never deleted. A report is refused with
-  507, and nothing of it is stored, only when the reports not yet written leave
-  no room for it on their own, and then no file is deleted. At start, report
-  files past the cap, as after lowering it, are deleted the same way. So the cap
-  is how much of the newest reports is kept: the default of 1 GiB is small
-  enough for any host; set it to the space you can give `DATA_DIR`.
+  waiting in memory count at their uncompressed size until they are written;
+  those lost to a failed write stop counting, and the part of its file written
+  is removed. When a report would take the total past the cap, the oldest report
+  files are deleted to make room, and each deletion is logged with the file's
+  name and size; a file still being written is never deleted. A report is
+  refused with 507, and nothing of it is stored, only when the reports waiting
+  to be written fill the cap on their own, and then no file is deleted. At
+  start, report files past the cap, as after lowering it, are deleted the same
+  way. So the cap is how much of the newest reports is kept: the default of 1
+  GiB is small enough for any host; set it to the space you can give
+  `DATA_DIR`.
 
 ### CORS
 

backend/internal/handlers/report.go

@@ -86,11 +86,12 @@ func (s *Handlers) decodeErrorStatus(err error) int {
 }
 
 // appendErrorStatus logs a failure to store a report and returns
-// the status to send: 507 when the report files are at their size
-// cap, otherwise 500.
+// the status to send: 507 when the reports waiting to be written fill
+// the size cap, otherwise 500.
 func (s *Handlers) appendErrorStatus(err error) int {
 	if errors.Is(err, reportbuf.ErrFull) {
-		s.log.Warn("report refused: report files at their size cap")
+		s.log.Warn("report refused: " +
+			"reports waiting to be written fill the size cap")
 
 		return http.StatusInsufficientStorage
 	}

backend/internal/handlers/report_test.go

@@ -68,9 +68,9 @@ func TestHandleReportStorageFailureIsNon2xx(t *testing.T) {
 	}
 }
 
-// TestHandleReportFullIs507 checks the answer when the report files
-// are at their size cap: 507 and the usual error body, which tells
-// the client nothing more.
+// TestHandleReportFullIs507 checks the answer when the reports waiting
+// to be written fill the size cap: 507 and the usual error body, which
+// tells the client nothing more.
 func TestHandleReportFullIs507(t *testing.T) {
 	t.Parallel()
 

backend/internal/reportbuf/export_test.go

@@ -1,6 +1,9 @@
 package reportbuf
 
-import "time"
+import (
+	"os"
+	"time"
+)
 
 // Flush writes the buffered reports to a file now, as the periodic
 // flush does, so tests need not wait a minute for it.
@@ -13,3 +16,10 @@ func (b *Buffer) Flush() error {
 func (b *Buffer) StopClock(at time.Time) {
 	b.now = func() time.Time { return at }
 }
+
+// OnFileCreated makes the buffer call fn with each report file it
+// writes from now on, once the file is created and before anything is
+// written to it.
+func (b *Buffer) OnFileCreated(fn func(f *os.File)) {
+	b.fileCreated = fn
+}

backend/internal/reportbuf/reportbuf.go

@@ -38,10 +38,10 @@ const (
 	fileSuffix = ".jsonl.zst"
 )
 
-// ErrFull is returned by Append when the reports not yet written
-// leave no room for the report under the configured maximum size,
-// however many report files are deleted.
-var ErrFull = errors.New("report files at their size cap")
+// ErrFull is returned by Append when the reports waiting to be
+// written leave no room for the report under the configured maximum
+// size, however many report files are deleted.
+var ErrFull = errors.New("reports waiting to be written fill the size cap")
 
 // Params defines the dependencies for Buffer.
 type Params struct {
@@ -64,6 +64,10 @@ type Buffer struct {
 	buf     bytes.Buffer
 	dataDir string
 	done    chan struct{}
+	// fileCreated is called with each report file once it is
+	// created, before anything is written to it: it does nothing,
+	// except in tests that hold the write open or make it fail.
+	fileCreated func(f *os.File)
 	// files are the report files that may be deleted to make room,
 	// oldest first: those in dataDir at start, then each one this
 	// buffer writes, once it is complete. A file still being written
@@ -81,8 +85,8 @@ type Buffer struct {
 	seq      atomic.Uint64
 	stopOnce sync.Once
 	// usedBytes is what Append checks against maxBytes: the size
-	// of the report files in dataDir, plus the reports not yet
-	// written to one at their uncompressed size.
+	// of the report files in dataDir, plus the reports waiting to
+	// be written to one at their uncompressed size.
 	usedBytes int64
 }
 
@@ -100,6 +104,7 @@ func New(
 	b := &Buffer{
 		dataDir:     dir,
 		done:        make(chan struct{}),
+		fileCreated: func(*os.File) {},
 		log:         params.Logger.Get(),
 		maxBytes:    params.Config.DataDirMaxBytes,
 		now:         time.Now,
@@ -206,9 +211,9 @@ func (b *Buffer) Append(v any) error {
 }
 
 // deleteOldestFiles deletes report files, oldest first, until n more
-// bytes fit under maxBytes. It deletes none when the reports not yet
-// written leave no room for n even with every file gone, since that
-// would lose the files for nothing. The caller must hold b.mu.
+// bytes fit under maxBytes. It deletes none when the reports waiting
+// to be written leave no room for n even with every file gone, since
+// that would lose the files for nothing. The caller must hold b.mu.
 func (b *Buffer) deleteOldestFiles(n int64) {
 	for b.usedBytes+n > b.maxBytes && len(b.files) > 0 {
 		if b.usedBytes-b.filesBytes+n > b.maxBytes {
@@ -282,15 +287,41 @@ func (b *Buffer) drainBuf() []byte {
 	return data
 }
 
-// writeFile creates a timestamped zstd-compressed JSONL file
-// in the data directory.
+// writeFile writes data, reports drained from the buffer, to a new
+// timestamped zstd-compressed JSONL file in the data directory.
 func (b *Buffer) writeFile(data []byte) error {
 	// The timestamp comes first, so the names sort by time; the number
 	// after it tells apart files named in the same millisecond.
 	ts := b.now().UTC().Format("2006-01-02T15-04-05.000Z")
 	name := fmt.Sprintf("%s%s-%d%s", filePrefix, ts, b.seq.Add(1), fileSuffix)
-	path := filepath.Join(b.dataDir, name)
 
+	size, err := b.createFile(filepath.Join(b.dataDir, name), data)
+
+	// The reports no longer wait to be written, so they stop counting
+	// at their uncompressed size. If the write failed they are lost;
+	// otherwise they count as the file, which from here on may be
+	// deleted to make room.
+	b.mu.Lock()
+	defer b.mu.Unlock()
+
+	b.usedBytes -= int64(len(data))
+
+	if err != nil {
+		return err
+	}
+
+	b.usedBytes += size
+	b.files = append(b.files, reportFile{name: name, size: size})
+	b.filesBytes += size
+
+	return nil
+}
+
+// createFile creates the file at path holding data compressed with
+// zstd, and returns its size. If the write fails once the file is
+// created, it removes the file, so that a failed write leaves nothing
+// behind to take room.
+func (b *Buffer) createFile(path string, data []byte) (int64, error) {
 	// path is built from the operator-supplied dataDir plus a
 	// generated timestamp and number, so it carries no external input.
 	f, err := os.OpenFile( //nolint:gosec // see comment above
@@ -299,53 +330,54 @@ func (b *Buffer) writeFile(data []byte) error {
 		filePerms,
 	)
 	if err != nil {
-		return fmt.Errorf("create report file: %w", err)
+		return 0, fmt.Errorf("create report file: %w", err)
 	}
 
-	// Closes the file on the early returns below. The success
-	// path closes it explicitly to check the error; closing it
-	// a second time here is harmless.
-	defer func() { _ = f.Close() }()
+	b.fileCreated(f)
 
+	size, err := writeCompressed(f, data)
+	if err != nil {
+		_ = f.Close()
+
+		return 0, errors.Join(err, os.Remove(path))
+	}
+
+	err = f.Close()
+	if err != nil {
+		err = fmt.Errorf("close report file: %w", err)
+
+		return 0, errors.Join(err, os.Remove(path))
+	}
+
+	return size, nil
+}
+
+// writeCompressed writes data to f compressed with zstd, and returns
+// the size of f.
+func writeCompressed(f *os.File, data []byte) (int64, error) {
 	enc, err := zstd.NewWriter(f)
 	if err != nil {
-		return fmt.Errorf("create zstd encoder: %w", err)
+		return 0, fmt.Errorf("create zstd encoder: %w", err)
 	}
 
 	_, err = enc.Write(data)
 	if err != nil {
 		_ = enc.Close()
 
-		return fmt.Errorf("write compressed data: %w", err)
+		return 0, fmt.Errorf("write compressed data: %w", err)
 	}
 
 	err = enc.Close()
 	if err != nil {
-		return fmt.Errorf("close zstd encoder: %w", err)
+		return 0, fmt.Errorf("close zstd encoder: %w", err)
 	}
 
 	info, err := f.Stat()
 	if err != nil {
-		return fmt.Errorf("stat report file: %w", err)
+		return 0, fmt.Errorf("stat report file: %w", err)
 	}
 
-	err = f.Close()
-	if err != nil {
-		return fmt.Errorf("close report file: %w", err)
-	}
-
-	// The reports counted at their uncompressed size while they
-	// waited; now they count as the file, which from here on may be
-	// deleted to make room. After a failed write they stay counted as
-	// they were, which errs toward refusing reports early rather than
-	// letting the files pass the cap.
-	b.mu.Lock()
-	b.usedBytes += info.Size() - int64(len(data))
-	b.files = append(b.files, reportFile{name: name, size: info.Size()})
-	b.filesBytes += info.Size()
-	b.mu.Unlock()
-
-	return nil
+	return info.Size(), nil
 }
 
 // reportFiles returns the report files in dir, oldest first:

backend/internal/reportbuf/reportbuf_test.go

@@ -424,36 +424,111 @@ func TestFileDeletedByHandFreesRoom(t *testing.T) {
 	}
 }
 
-// TestUncountedReportFileIsNeverDeleted: only the report files counted,
-// those in DATA_DIR at start and those the buffer has finished
-// writing, are deleted to make room. A file still being written is not
-// among them, so it is kept even when that means refusing a report. A
-// write cannot be paused here, so a report file put in DATA_DIR after
-// start, which is not counted either, stands in for one being written.
-func TestUncountedReportFileIsNeverDeleted(t *testing.T) {
-	report := map[string]string{"id": "uncounted"}
-	dir := t.TempDir()
-	uncounted := reportFilePath(dir, 1)
+// TestFileBeingWrittenIsNeverDeleted holds a write open, its file
+// created but not complete, while a report needs room. The file may
+// not be deleted to make it, so the report is refused. Once the write
+// is complete, the file is deleted when room is needed.
+func TestFileBeingWrittenIsNeverDeleted(t *testing.T) {
+	report := map[string]string{"id": "writing"}
 
-	t.Setenv("DATA_DIR", dir)
+	t.Setenv("DATA_DIR", t.TempDir())
 	t.Setenv("DATA_DIR_MAX_BYTES", strconv.Itoa(lineBytes(t, report)))
 
 	buf := startBuffer(t)
 
+	created := make(chan string)
+	release := make(chan struct{})
+
+	buf.OnFileCreated(func(f *os.File) {
+		created <- f.Name()
+
+		<-release
+	})
+
 	err := buf.Append(report)
 	if err != nil {
 		t.Fatalf("report that fills the cap exactly: %v", err)
 	}
 
-	writeBytes(t, uncounted, 100)
+	flushed := make(chan error)
 
+	go func() { flushed <- buf.Flush() }()
+
+	writing := <-created
+
+	// Errorf, not Fatalf, until the write is released, so that a
+	// failure here does not leave it held.
 	err = buf.Append(report)
 	if !errors.Is(err, reportbuf.ErrFull) {
-		t.Fatalf("report past the cap: error = %v, want ErrFull", err)
+		t.Errorf("report while the first was being written: "+
+			"error = %v, want ErrFull", err)
 	}
 
-	if !exists(t, uncounted) {
-		t.Fatal("report file deleted, though the buffer had not counted it")
+	if !exists(t, writing) {
+		t.Error("report file deleted while it was being written")
+	}
+
+	close(release)
+
+	err = <-flushed
+	if err != nil {
+		t.Fatalf("flush: %v", err)
+	}
+
+	// Writes from here on, the final one at stop included, go
+	// through unheld.
+	buf.OnFileCreated(func(*os.File) {})
+
+	err = buf.Append(report)
+	if err != nil {
+		t.Fatalf("report after the write was complete: %v", err)
+	}
+
+	if exists(t, writing) {
+		t.Fatal("complete report file kept when room was needed")
+	}
+}
+
+// TestFailedWriteStopsCounting makes a write fail once its file is
+// created. Its reports are lost, so they stop counting, and the part of
+// the file written is removed, so it takes no room.
+func TestFailedWriteStopsCounting(t *testing.T) {
+	report := map[string]string{"id": "failed"}
+
+	t.Setenv("DATA_DIR", t.TempDir())
+	t.Setenv("DATA_DIR_MAX_BYTES", strconv.Itoa(lineBytes(t, report)))
+
+	buf := startBuffer(t)
+
+	var failed string
+
+	// Closing the file under the write makes the write fail.
+	buf.OnFileCreated(func(f *os.File) {
+		failed = f.Name()
+
+		_ = f.Close()
+	})
+
+	err := buf.Append(report)
+	if err != nil {
+		t.Fatalf("report that fills the cap exactly: %v", err)
+	}
+
+	err = buf.Flush()
+	if err == nil {
+		t.Fatal("flush succeeded, though its file was closed under it")
+	}
+
+	if exists(t, failed) {
+		t.Fatal("file of the failed write kept")
+	}
+
+	// Writes from here on, the final one at stop included, succeed.
+	buf.OnFileCreated(func(*os.File) {})
+
+	err = buf.Append(report)
+	if err != nil {
+		t.Fatalf("report after the failed write: %v", err)
 	}
 }
 

index.html

@@ -9,6 +9,9 @@
             type="image/svg+xml"
             href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>📡</text></svg>"
         />
+        <!-- Linked here, not imported by src/main.js, so the unit tests can
+             import that module in Node, which cannot import CSS. -->
+        <link rel="stylesheet" href="/src/styles.css" />
     </head>
     <body class="bg-gray-900 text-white min-h-screen">
         <div id="app"></div>

script/frontend-test

@@ -1,13 +1,14 @@
 #!/bin/sh
-# script/frontend-test: run the frontend test suite. The frontend has no
-# unit tests; the production build serves as the test (fails on broken
-# code).
+# script/frontend-test: run the frontend test suite: the unit tests in
+# test/unit/ with Node's built-in test runner, then the production
+# build, which fails on broken code.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    timeout 30 node --test test/unit/*.test.js
     timeout 30 yarn build
 }
 

src/main.js

@@ -1,14 +1,14 @@
-import "./styles.css";
-
 // --- Configuration -----------------------------------------------------------
 
-// Timing, axis labels, and display constants. Latency above maxLatency is
-// clamped to "unreachable". The sparkline Y-axis is capped at
+// Timing, axis labels, and display constants. A target check times out
+// after requestTimeout, 80% of updateInterval, so a round's checks have
+// all finished before the next round is due; latency above maxLatency is
+// recorded as a timeout. The sparkline Y-axis is capped at
 // graphMaxLatency — values above it pin to the top of the chart but still
 // display their real value in the latency figure. The history buffer holds
 // maxHistoryPoints samples (historyDuration / updateInterval).
 // reportInterval is how often collected samples are POSTed to the backend.
-const CONFIG = {
+export const CONFIG = {
     updateInterval: 3000,
     maxHistoryPoints: 100,
     reportInterval: 60000,
@@ -16,7 +16,7 @@ const CONFIG = {
         return (this.maxHistoryPoints * this.updateInterval) / 1000;
     },
     get requestTimeout() {
-        return Math.min(this.updateInterval - 100, 3000);
+        return this.updateInterval * 0.8;
     },
     get maxLatency() {
         return this.requestTimeout;
@@ -503,12 +503,16 @@ class Reporter {
 
 // --- Latency Measurement -----------------------------------------------------
 
-async function measureLatency(url) {
+// Checks one target. The check times out after CONFIG.requestTimeout; the
+// caller can give it up sooner through the optional signal, which also ends
+// it as a timeout.
+export async function measureLatency(url, signal) {
     const controller = new AbortController();
     const timeoutId = setTimeout(
         () => controller.abort(),
         CONFIG.requestTimeout,
     );
+    signal?.addEventListener("abort", () => controller.abort());
 
     const targetUrl = new URL(url);
     targetUrl.searchParams.set("_cb", Date.now().toString());
@@ -1101,7 +1105,7 @@ function sortAndRebuildWAN(state) {
 
 // --- Main Loop ---------------------------------------------------------------
 
-async function tick(state, onOffline) {
+async function tick(state, signal, onOffline) {
     const ts = Date.now();
 
     if (state.paused) {
@@ -1123,11 +1127,12 @@ async function tick(state, onOffline) {
     log.debug(`Tick #${state.tickCount + 1} started`);
 
     const results = await Promise.all(
-        state.allHosts.map((h) => measureLatency(h.url)),
+        state.allHosts.map((h) => measureLatency(h.url, signal)),
     );
 
-    // User may have paused while awaiting results — discard them
-    if (state.paused) return;
+    // User may have paused, or the next round may have given up this
+    // one's checks, while awaiting results — discard them
+    if (state.paused || signal.aborted) return;
 
     state.tickCount++;
 
@@ -1168,9 +1173,10 @@ async function tick(state, onOffline) {
 
 // --- Recovery Probe ----------------------------------------------------------
 
-// When offline, rapidly poll 4 random WAN hosts every 500ms. As soon as any
-// responds, stop probing and fire a normal tick to refresh all hosts.
-function startRecoveryProbe(state, triggerTick) {
+// When offline, check 4 random WAN hosts every 500ms, giving up the checks
+// started 500ms before, so at most 4 are ever waiting. As soon as one
+// answers, stop probing and start a new round at once.
+function startRecoveryProbe(state, startRounds) {
     if (state._recoveryProbeId) return; // already running
     const candidates = [...state.wan];
     for (let i = candidates.length - 1; i > 0; i--) {
@@ -1181,15 +1187,18 @@ function startRecoveryProbe(state, triggerTick) {
     log.notice(
         `Recovery probe started (${canaries.map((h) => h.name).join(", ")})`,
     );
-    state._recoveryProbeId = setInterval(async () => {
+    state._recoveryProbeId = setInterval(() => {
         if (state.paused) return;
-        const results = await Promise.all(
-            canaries.map((h) => measureLatency(h.url)),
-        );
-        if (results.some((r) => r.error === null)) {
+        state._recoveryProbeChecks?.abort();
+        const checks = new AbortController();
+        state._recoveryProbeChecks = checks;
+        for (const host of canaries) {
+            measureLatency(host.url, checks.signal).then((r) => {
+                if (r.error !== null || checks.signal.aborted) return;
                 log.notice("Recovery probe: connectivity detected");
                 stopRecoveryProbe(state);
-            triggerTick();
+                startRounds();
+            });
         }
     }, 500);
 }
@@ -1198,6 +1207,7 @@ function stopRecoveryProbe(state) {
     if (state._recoveryProbeId) {
         clearInterval(state._recoveryProbeId);
         state._recoveryProbeId = null;
+        state._recoveryProbeChecks?.abort();
     }
 }
 
@@ -1374,18 +1384,34 @@ async function init() {
     updateClocks();
     setInterval(updateClocks, 1000);
 
+    // Rounds never overlap: a round first gives up the last round's checks
+    // if they are still waiting, and the last round then records nothing.
+    // At a steady interval they never are, as they time out at 80% of it;
+    // they can be when a round starts early, after an interval change or
+    // when the recovery probe finds a target answering.
+    let roundChecks = new AbortController();
     function doTick() {
-        tick(state, () => startRecoveryProbe(state, doTick));
+        roundChecks.abort();
+        roundChecks = new AbortController();
+        tick(state, roundChecks.signal, () =>
+            startRecoveryProbe(state, startRounds),
+        );
     }
 
+    // Starts a round now and then one every CONFIG.updateInterval.
+    let tickIntervalId;
+    function startRounds() {
+        clearInterval(tickIntervalId);
         doTick();
-    let tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
+        tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
+    }
+
+    startRounds();
 
     document
         .getElementById("interval-select")
         .addEventListener("change", (e) => {
             const newInterval = parseInt(e.target.value, 10);
-            clearInterval(tickIntervalId);
             CONFIG.updateInterval = newInterval;
             log.notice(
                 `Interval changed to ${humanDuration(newInterval / 1000)}, history reset`,
@@ -1434,8 +1460,7 @@ async function init() {
 
             // Start immediately with new interval
             stopRecoveryProbe(state);
-            doTick();
-            tickIntervalId = setInterval(doTick, CONFIG.updateInterval);
+            startRounds();
         });
 
     window.addEventListener("resize", () => handleResize(state));
@@ -1444,7 +1469,7 @@ async function init() {
 
 // Bootstrap only when loaded as the page: a real DOM containing the #app
 // mount point this module renders into. Importing the module in a unit test
-// (which has no #app) runs nothing, so buildReport can be tested in isolation.
+// (which has no #app) runs nothing, so its exports can be tested in isolation.
 if (typeof document !== "undefined" && document.getElementById("app")) {
     if (document.readyState === "loading") {
         document.addEventListener("DOMContentLoaded", init);

test/unit/main.test.js

@@ -0,0 +1,66 @@
+// Unit tests for src/main.js, run by script/frontend-test with Node's
+// built-in test runner. Importing the module does not start the page.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { CONFIG, measureLatency } from "../../src/main.js";
+
+// measureLatency writes timeouts to the debug log, which looks for its
+// panel in the page. There is no page here.
+globalThis.document = { getElementById: () => null };
+
+// Mocks the clock for test t, so that a check lasting seconds takes no real
+// time, and replaces fetch with a target that answers after answerAfter
+// milliseconds of that clock, or never when answerAfter is Infinity. Both
+// are restored when the test ends.
+function mockTarget(t, answerAfter) {
+    t.mock.timers.enable({ apis: ["setTimeout", "Date"] });
+    t.mock.method(performance, "now", () => Date.now());
+    t.mock.method(
+        globalThis,
+        "fetch",
+        (url, { signal }) =>
+            new Promise((resolve, reject) => {
+                if (answerAfter !== Infinity) setTimeout(resolve, answerAfter);
+                signal.addEventListener("abort", () => reject(signal.reason));
+            }),
+    );
+}
+
+// The result of check if it has ended, otherwise "still waiting".
+function settled(check) {
+    return Promise.race([
+        check,
+        new Promise((resolve) => setImmediate(resolve, "still waiting")),
+    ]);
+}
+
+for (const interval of [10000, 30000]) {
+    const timeout = interval * 0.8;
+    // Over 3 seconds, which the timeout used to be capped at.
+    const slowAnswer = timeout - 1000;
+
+    test(`at a ${interval}ms interval, an answer after ${slowAnswer}ms is recorded with its real time`, async (t) => {
+        CONFIG.updateInterval = interval;
+        mockTarget(t, slowAnswer);
+        const check = measureLatency("https://target.test");
+        t.mock.timers.tick(slowAnswer);
+        assert.deepEqual(await settled(check), {
+            latency: slowAnswer,
+            error: null,
+        });
+    });
+
+    test(`at a ${interval}ms interval, a target that never answers is recorded as a timeout after ${timeout}ms`, async (t) => {
+        CONFIG.updateInterval = interval;
+        mockTarget(t, Infinity);
+        const check = measureLatency("https://target.test");
+        t.mock.timers.tick(timeout - 1);
+        assert.equal(await settled(check), "still waiting");
+        t.mock.timers.tick(1);
+        assert.deepEqual(await settled(check), {
+            latency: null,
+            error: "timeout",
+        });
+    });
+}