main() is one call into internal/cli (closes #160)

cmd/netwatch-server/main.go parsed the command line, ran the check-cidr
and prepare-data-dir subcommands and built the fx application itself;
the Go style guide puts all of that in internal/ or pkg/. The new
package internal/cli does it, with the same arguments, messages and
exit codes. main() is now os.Exit(cli.Main(os.Stderr, Appname, Version,
os.Args[1:], cli.RunServer)): Main takes the writer for errors and the
function that runs the server, so its tests give it a buffer and a
function that fails them. Appname and Version stay in main, where the
build sets Version. prepare-data-dir also takes the volume and the
user's name, so its own tests give it a temporary directory and the
user they run as.

Model: opus-5-5

.dockerignore

@@ -73,12 +73,9 @@
 
 # This repository's own entries, after the shared content above: the
 # frontend build, the viewport test's output, the binary `make build`
-# writes and the reports `make run` stores, and Go test binaries,
+# writes and the reports `make run` stores, and log files at the root.
-# coverage output and log files at the root.
 /dist
 /tmp
 /netwatch-server
 /data
-/*.test
-/*.out
 /*.log

.editorconfig

@@ -11,8 +11,7 @@ insert_final_newline = true
 [Makefile]
 indent_style = tab
 
+# This repository's own entries, after the shared content above.
+
 [*.go]
 indent_style = tab
-
-# This repository's own sections, such as one for another language it
-# uses, go below this comment, and a re-vendor keeps them.

.gitea/workflows/check.yml

@@ -1,20 +1,9 @@
 name: check
 on: [push]
-# Free the shared runner: a new push cancels only the same branch's older run.
-concurrency:
-    group: ${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: true
 jobs:
     check:
         runs-on: ubuntu-latest
-        # Free the shared runner from a hung build.
-        timeout-minutes: 20
         steps:
             # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-              # script/cibuild needs no token, so none is left in .git/config.
-              with:
-                  persist-credentials: false
-                  # All history and tags, so git describe finds the version tag.
-                  fetch-depth: 0
             - run: script/cibuild

.gitignore

@@ -27,7 +27,7 @@ node_modules/
 # Environment files. `*.env` covers bare `.env` and the `prod.env`
 # convention. Only the templates `example.env` and `sample.env` are
 # re-included below. A repository that commits any other template adds
-# its own negation at the end of this file, for example `!.env.example`.
+# its own negation after these lines, for example `!.env.example`.
 *.[eE][nN][vV]
 .[eE][nN][vV].*
 .[eE][nN][vV][rR][cC]
@@ -46,9 +46,7 @@ node_modules/
 [iI][dD]_[eE][dD]25519
 [iI][dD]_[eE][dD]25519_[sS][kK]
 
-# This repository's own entries, such as its build outputs, go below
+# This repository's own entries, after the shared content above.
-# this comment, and a re-vendor keeps them. Anchor a binary built at the
-# root: `/myapp`, never `myapp`, which also ignores `cmd/myapp/`.
 
 # Build output
 dist/

.golangci.yml

@@ -25,8 +25,6 @@ linters:
     # silenced by disabling that name, not by enabling the successor.
     - wsl              # Deprecated, replaced by wsl_v5
     - gomodguard       # Deprecated, replaced by gomodguard_v2
-    # Misses findings at random in v2.14.0; back once a pinned release fixes it
-    - canonicalheader
   settings:
     lll:
       line-length: 88

bin/entrypoint.sh

@@ -13,27 +13,24 @@ set -u
 # address and start anyway, and reports a bad port without naming
 # PORT, so a value that is not a usable port stops the container here,
 # before either process starts.
-check_port() {
+export PORT="${PORT:-8080}"
-    export PORT="${PORT:-8080}"
+case "$PORT" in
-    case "$PORT" in
+    *[!0-9]*)
-        *[!0-9]*)
+        echo "entrypoint: PORT must be a port number, not '$PORT'" >&2
-            echo "entrypoint: PORT must be a port number, not '$PORT'" >&2
-            exit 1
-            ;;
-    esac
-    # The length is checked first because, for a number too big for it,
-    # the shell's test prints an error and is false, so the range checks
-    # alone would let it through.
-    if [ "${#PORT}" -gt 5 ] || [ "$PORT" -lt 1 ] || [ "$PORT" -gt 65535 ]; then
-        echo "entrypoint: PORT must be from 1 to 65535, not '$PORT'" >&2
         exit 1
-    fi
+        ;;
-    if [ "$PORT" -eq 8081 ]; then
+esac
-        echo "entrypoint: PORT cannot be 8081, netwatch-server" \
+# The length is checked first because, for a number too big for it,
-            "listens there" >&2
+# the shell's test prints an error and is false, so the range checks
-        exit 1
+# alone would let it through.
-    fi
+if [ "${#PORT}" -gt 5 ] || [ "$PORT" -lt 1 ] || [ "$PORT" -gt 65535 ]; then
-}
+    echo "entrypoint: PORT must be from 1 to 65535, not '$PORT'" >&2
+    exit 1
+fi
+if [ "$PORT" -eq 8081 ]; then
+    echo "entrypoint: PORT cannot be 8081, netwatch-server listens there" >&2
+    exit 1
+fi
 
 # TRUSTED_PROXIES names the reverse proxies in front of the container,
 # as IP addresses or CIDRs separated by commas. nginx takes the client
@@ -50,23 +47,21 @@ check_port() {
 # TRUSTED_PROXIES. Its error, naming the CIDR, is dropped for the one
 # below, naming the entry as written. set -f keeps a * in an entry from
 # becoming a list of file names.
-write_trusted_proxies() {
+TRUSTED_PROXIES="${TRUSTED_PROXIES-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
-    TRUSTED_PROXIES="${TRUSTED_PROXIES-10.0.0.0/8,172.16.0.0/12,192.168.0.0/16}"
+set -f
-    set -f
+for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
-    for proxy in $(printf '%s' "$TRUSTED_PROXIES" | tr ',' ' '); do
+    case "$proxy" in
-        case "$proxy" in
+        */*) cidr="$proxy" ;;
-            */*) cidr="$proxy" ;;
+        *:*) cidr="$proxy/128" ;;
-            *:*) cidr="$proxy/128" ;;
+        *) cidr="$proxy/32" ;;
-            *) cidr="$proxy/32" ;;
+    esac
-        esac
+    if ! netwatch-server check-cidr "$cidr" 2> /dev/null; then
-        if ! netwatch-server check-cidr "$cidr" 2> /dev/null; then
+        echo "entrypoint: TRUSTED_PROXIES must be IP addresses or CIDRs" \
-            echo "entrypoint: TRUSTED_PROXIES must be IP addresses or CIDRs" \
+            "separated by commas; '$proxy' is neither" >&2
-                "separated by commas; '$proxy' is neither" >&2
+        exit 1
-            exit 1
+    fi
-        fi
+    echo "set_real_ip_from $cidr;"
-        echo "set_real_ip_from $cidr;"
+done > /etc/nginx/trusted-proxies.conf
-    done > /etc/nginx/trusted-proxies.conf
-}
 
 # netwatch-server keeps its report files in DATA_DIR, on the /data
 # volume, which may be a host directory owned by root or by another
@@ -78,10 +73,12 @@ write_trusted_proxies() {
 # naming DATA_DIR, unless DATA_DIR is /data or a path below it, and it
 # acts on nothing outside /data, whatever symbolic or hard links it
 # meets there.
-prepare_data_dir() {
+export DATA_DIR="${DATA_DIR:-/data/reports}"
-    export DATA_DIR="${DATA_DIR:-/data/reports}"
+netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
-    netwatch-server prepare-data-dir "$DATA_DIR" || exit 1
+
-}
+# A stop signal is only noted here; the loop below acts on it.
+stop_requested=""
+trap 'stop_requested=yes' TERM INT
 
 # netwatch-server runs as the netwatch user and listens on loopback
 # only, on a port other than the public one; configs/nginx.conf proxies
@@ -90,11 +87,9 @@ prepare_data_dir() {
 # the container has. The netwatch user has no login shell, hence -s
 # /bin/sh. busybox su replaces itself with the command instead of
 # staying on as its parent, so $! is the server's own PID.
-start_backend() {
+BIND_ADDRESS=127.0.0.1 PORT=8081 TRUSTED_PROXIES=127.0.0.1/32 \
-    BIND_ADDRESS=127.0.0.1 PORT=8081 TRUSTED_PROXIES=127.0.0.1/32 \
+    su -s /bin/sh netwatch -c 'exec netwatch-server' &
-        su -s /bin/sh netwatch -c 'exec netwatch-server' &
+backend=$!
-    backend=$!
-}
 
 # nginx starts through the nginx image's own entrypoint, which applies
 # the image's start-up configuration and then replaces itself with
@@ -103,11 +98,9 @@ start_backend() {
 # that rendering to PORT: a variable nginx itself uses, such as $uri,
 # would otherwise be replaced by an environment variable of the same
 # name.
-start_nginx() {
+NGINX_ENVSUBST_FILTER='^PORT$' \
-    NGINX_ENVSUBST_FILTER='^PORT$' \
+    /docker-entrypoint.sh nginx -g 'daemon off;' &
-        /docker-entrypoint.sh nginx -g 'daemon off;' &
+nginx=$!
-    nginx=$!
-}
 
 running() {
     kill -0 "$1" 2>/dev/null
@@ -116,47 +109,26 @@ running() {
 # POSIX sh cannot wait for whichever of two children exits first, so
 # look once a second. The shell collects a child that has exited while
 # it runs sleep, and running() is false for that child from then on.
-wait_for_stop_or_exit() {
+while [ -z "$stop_requested" ] && running "$backend" && running "$nginx"; do
-    while [ -z "$stop_requested" ] && running "$backend" && running "$nginx"; do
+    sleep 1
-        sleep 1
+done
-    done
-}
 
 # Stop both, then wait until neither is left.
-stop_both() {
+kill -TERM "$backend" "$nginx" 2>/dev/null
-    kill -TERM "$backend" "$nginx" 2>/dev/null
+while running "$backend" || running "$nginx"; do
-    while running "$backend" || running "$nginx"; do
+    sleep 1
-        sleep 1
+done
-    done
+
-}
+wait "$backend"
+backend_status=$?
+wait "$nginx"
+nginx_status=$?
+echo "entrypoint: netwatch-server exited $backend_status," \
+    "nginx exited $nginx_status"
 
 # Success is a requested stop that both processes exited cleanly from.
-exit_with_status() {
+if [ -n "$stop_requested" ] && [ "$backend_status" -eq 0 ] &&
-    wait "$backend"
+    [ "$nginx_status" -eq 0 ]; then
-    backend_status=$?
+    exit 0
-    wait "$nginx"
+fi
-    nginx_status=$?
+exit 1
-    echo "entrypoint: netwatch-server exited $backend_status," \
-        "nginx exited $nginx_status"
-    if [ -n "$stop_requested" ] && [ "$backend_status" -eq 0 ] &&
-        [ "$nginx_status" -eq 0 ]; then
-        exit 0
-    fi
-    exit 1
-}
-
-main() {
-    check_port
-    write_trusted_proxies
-    prepare_data_dir
-    # A stop signal is only noted here; wait_for_stop_or_exit acts on it.
-    stop_requested=""
-    trap 'stop_requested=yes' TERM INT
-    start_backend
-    start_nginx
-    wait_for_stop_or_exit
-    stop_both
-    exit_with_status
-}
-
-main "$@"

configs/security-headers.conf

@@ -8,9 +8,10 @@ add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" alway
 # Scripts and styles load only from the page's own origin. Inline ones
 # are blocked, style attributes in markup included, so style elements
 # through classes or element.style. data: images are for the favicon
-# in web/index.html. connect-src is * because the page checks every
+# in web/index.html. connect-src is * because the browser checks each
-# target in web/src/main.js. A list of hosts here would have to change
+# probe in web/src/main.js against it, and also every redirect the probe
-# with every change to those targets. It also covers the reports the
+# follows, and several of those hosts redirect to others; a list of
+# hosts here would block those probes. It also covers the reports the
 # page sends to its own origin.
 add_header Content-Security-Policy "default-src 'self'; connect-src *; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
 

internal/cli/cli.go

@@ -1,7 +1,7 @@
 // Package cli runs netwatch-server from its command line: the
 // check-cidr and prepare-data-dir subcommands, which bin/entrypoint.sh
-// runs before it starts the server, and, given no arguments, the
+// runs before it starts the server, and otherwise the server, with the
-// server, with the fx wiring.
+// fx wiring.
 package cli
 
 import (
@@ -22,21 +22,16 @@ import (
 	"go.uber.org/fx/fxevent"
 )
 
-// usageExitCode is what Main returns for a command line it does not
-// understand, the usual exit code for a usage error.
-const usageExitCode = 2
-
 // Main runs netwatch-server with args, its command line after the
-// program's name, and returns the exit code. With no args, Main runs
+// program's name, and returns the exit code; the subcommands write
-// the server by calling serve with appname and version, the name and
+// their errors to stderr. Unless args are "check-cidr CIDR" or
-// version the server logs and reports. With "check-cidr CIDR" or
+// "prepare-data-dir DATA_DIR", Main runs the server by calling serve
-// "prepare-data-dir DATA_DIR" it runs that subcommand, which writes its
+// with appname and version, the name and version the server logs and
-// errors to stderr. Any other args get a one-line usage message on
+// reports. main passes os.Stderr and RunServer; the tests pass a
-// stderr and exit code 2. main passes os.Stderr and RunServer; the
+// buffer and a function that fails them, so that no test starts the
-// tests pass a buffer and a function of their own, so that no test
+// server. When serve is RunServer and the server fails to start or to
-// starts the server. When serve is RunServer and the server fails to
+// stop, fx's Run exits the process with status 1 and Main never
-// start, to listen or to stop, fx's Run exits the process with status 1
+// returns.
-// and Main never returns.
 func Main(
 	stderr io.Writer,
 	appname, version string,
@@ -58,15 +53,6 @@ func Main(
 		return prepareDataDir(stderr, "/data", args[1], "netwatch")
 	}
 
-	// Any other command line is refused, so that a mistyped one does
-	// not start the server.
-	if len(args) > 0 {
-		_, _ = fmt.Fprintln(stderr,
-			"usage: netwatch-server [check-cidr CIDR | prepare-data-dir DATA_DIR]")
-
-		return usageExitCode
-	}
-
 	serve(appname, version)
 
 	return 0
@@ -110,8 +96,8 @@ func prepareDataDir(stderr io.Writer, volume, dataDir, username string) int {
 
 // RunServer runs the server until it is told to stop, with appname and
 // version as the name and version it logs and reports. If the server
-// fails to start, to listen or to stop, fx's Run exits the process
+// fails to start or to stop, fx's Run exits the process with status 1
-// with status 1 itself.
+// itself.
 func RunServer(appname, version string) {
 	globals.Appname = appname
 	globals.Version = version

internal/cli/cli_test.go

@@ -2,6 +2,7 @@ package cli_test
 
 import (
 	"bytes"
+	"io"
 	"os"
 	"os/user"
 	"path/filepath"
@@ -13,31 +14,18 @@ import (
 	"sneak.berlin/go/netwatch/internal/reportbuf"
 )
 
-// TestMainRunsCheckCIDR: Main given check-cidr returns 0, writing
+// TestMainRunsCheckCIDR: Main given check-cidr returns 0 for a CIDR the
-// nothing, for a CIDR the server takes in its TRUSTED_PROXIES, and 1,
+// server takes in its TRUSTED_PROXIES and 1 for one it refuses, and
-// with an error naming TRUSTED_PROXIES and the CIDR, for one it
+// does not start the server.
-// refuses, and does not start the server.
 func TestMainRunsCheckCIDR(t *testing.T) {
 	t.Parallel()
 
-	var stderr bytes.Buffer
+	for cidr, want := range map[string]int{"10.0.0.0/8": 0, "1.2.3/32": 1} {
-
+		code := cli.Main(io.Discard, "netwatch", "test",
-	code := cli.Main(&stderr, "netwatch", "test",
+			[]string{"check-cidr", cidr}, failIfServerStarts(t))
-		[]string{"check-cidr", "10.0.0.0/8"}, failIfServerStarts(t))
+		if code != want {
-	if code != 0 || stderr.Len() != 0 {
+			t.Errorf("check-cidr %q: exit %d, want %d", cidr, code, want)
-		t.Errorf("check-cidr 10.0.0.0/8: exit %d, stderr %q; want exit 0 and no output",
+		}
-			code, stderr.String())
-	}
-
-	stderr.Reset()
-
-	code = cli.Main(&stderr, "netwatch", "test",
-		[]string{"check-cidr", "1.2.3/32"}, failIfServerStarts(t))
-
-	want := `TRUSTED_PROXIES "1.2.3/32": `
-	if code != 1 || !strings.HasPrefix(stderr.String(), want) {
-		t.Errorf("check-cidr 1.2.3/32: exit %d, stderr %q; want exit 1 and %q...",
-			code, stderr.String(), want)
 	}
 }
 
@@ -61,61 +49,6 @@ func TestMainRunsPrepareDataDir(t *testing.T) {
 	}
 }
 
-// TestMainRunsServerWithNoArguments: Main given no arguments starts the
-// server with the name and version it was given, writes nothing and
-// returns 0.
-func TestMainRunsServerWithNoArguments(t *testing.T) {
-	t.Parallel()
-
-	var (
-		stderr                 bytes.Buffer
-		gotAppname, gotVersion string
-	)
-
-	code := cli.Main(&stderr, "netwatch", "test", []string{},
-		func(appname, version string) {
-			gotAppname, gotVersion = appname, version
-		})
-	if code != 0 || stderr.Len() != 0 {
-		t.Errorf("exit %d, stderr %q; want exit 0 and no output",
-			code, stderr.String())
-	}
-
-	if gotAppname != "netwatch" || gotVersion != "test" {
-		t.Errorf("server started with %q %q; want %q %q",
-			gotAppname, gotVersion, "netwatch", "test")
-	}
-}
-
-// TestMainRefusesOtherCommandLines: Main given a subcommand with too
-// few or too many values, or a misspelt subcommand, writes the usage
-// message to stderr, returns 2 and does not start the server.
-func TestMainRefusesOtherCommandLines(t *testing.T) {
-	t.Parallel()
-
-	want := "usage: netwatch-server " +
-		"[check-cidr CIDR | prepare-data-dir DATA_DIR]\n"
-
-	for _, commandLine := range []string{
-		"netwatch-server check-cidr",
-		"netwatch-server check-cidr 192.0.2.0/24 198.51.100.0/24",
-		"netwatch-server prepare-data-dir",
-		"netwatch-server prepare-data-dir /data/reports /data/other",
-		"netwatch-server check-cdir 192.0.2.0/24",
-	} {
-		var stderr bytes.Buffer
-
-		// Main takes the command line after the program's name.
-		args := strings.Fields(commandLine)[1:]
-
-		code := cli.Main(&stderr, "netwatch", "test", args, failIfServerStarts(t))
-		if code != 2 || stderr.String() != want {
-			t.Errorf("%q: exit %d, stderr %q; want exit 2 and %q",
-				commandLine, code, stderr.String(), want)
-		}
-	}
-}
-
 // TestCheckCIDRTakesCIDR: check-cidr exits 0, writing nothing, for a
 // CIDR the server takes in its TRUSTED_PROXIES.
 func TestCheckCIDRTakesCIDR(t *testing.T) {

internal/server/server.go

@@ -79,7 +79,7 @@ func New(
 			s.SetupRoutes()
 			s.httpServer = s.newHTTPServer()
 
-			go func() { s.listenAndServe() }()
+			go s.listenAndServe()
 
 			return nil
 		},

package.json

@@ -1,6 +1,6 @@
 {
     "name": "netwatch",
-    "private": true,
+    "version": "1.0.0",
     "description": "Real-time network latency monitor SPA",
     "type": "module",
     "scripts": {

script/add-dependency

@@ -23,8 +23,8 @@ main() {
     "" | -* | *[[:space:]]*) usage ;;
     esac
     cd "$ROOT"
-    "$ROOT/script/yarn" add --dev "$1"
+    yarn add --dev "$1"
-    "$ROOT/script/yarn" install --frozen-lockfile
+    yarn install --frozen-lockfile
 }
 
 main "$@"

script/bootstrap

@@ -3,14 +3,11 @@
 # this repo. Idempotent: every install is guarded by a check so already
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes nothing is present. Node is
-# used directly only if it has the major version of NODE_VERSION and is
+# used directly if it is at least NODE_MIN_VERSION; otherwise it is
-# at least NODE_MIN_VERSION; otherwise NODE_VERSION is installed via nvm
+# installed at a pinned version via nvm (installing nvm itself first,
-# (installing nvm itself first, from a hash-verified release archive,
+# from a hash-verified release archive, never curl | sh). Go, with its
-# never curl | sh). Yarn is used directly only if it is exactly
+# gofmt, is used directly only if it is exactly GO_VERSION; otherwise
-# YARN_VERSION; otherwise that version is prepared through corepack,
+# that release is installed from its hash-verified archive.
-# or installed with npm where there is no corepack.
-# Go, with its gofmt, is used directly only if it is exactly GO_VERSION;
-# otherwise that release is installed from its hash-verified archive.
 #
 # What this script installs outside the system package manager lives
 # under $HOME and is linked into ~/.local/bin, where make and the git
@@ -145,63 +142,32 @@ ensure_nvm() {
     rm -rf "$tmp"
 }
 
-# node_ok: the node on PATH has the major version of NODE_VERSION and is
+# node_ok: the node on PATH is at least NODE_MIN_VERSION. node itself
-# at least NODE_MIN_VERSION. Only the major is compared with the pin,
+# compares the two: major, then minor, then patch.
-# as REPO_POLICIES.md asks. node itself compares the versions: major,
-# then minor, then patch. A node that fails does not pass.
-# script/bootstrap and script/yarn carry this function unchanged.
 node_ok() {
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
+    if missing node; then return 1; fi
     node -e '
         const have = process.versions.node.split(".").map(Number);
         const want = process.argv[1].split(".").map(Number);
-        const pinned = process.argv[2].split(".").map(Number);
-        if (have[0] !== pinned[0]) process.exit(1);
         for (let i = 0; i < 3; i++) {
             if (have[i] !== want[i]) process.exit(have[i] > want[i] ? 0 : 1);
         }
-    ' "$NODE_MIN_VERSION" "$NODE_VERSION"
+    ' "$NODE_MIN_VERSION"
 }
 
 # ensure_node: unless node_ok, install NODE_VERSION and link its node.
-# Afterwards node is looked up through PATH again and must pass node_ok.
 ensure_node() {
-    if node_ok; then
+    if node_ok; then return 0; fi
-        echo "bootstrap: using node $(node --version)"
-        return 0
-    fi
     ensure_nvm
     nvm_sh "nvm install $NODE_VERSION"
     link_bin "$HOME/.nvm/versions/node/v$NODE_VERSION/bin/node" node
-    hash -r
-    if ! node_ok; then
-        echo "bootstrap: after installing node $NODE_VERSION through nvm," >&2
-        echo "  the node on PATH, $(command -v node), is not it" >&2
-        exit 1
-    fi
-    echo "bootstrap: installed node $(node --version)"
 }
 
-# yarn_ok: yarn --version on PATH prints exactly YARN_VERSION, compared
+# ensure_yarn: corepack writes its shims (pnpm and yarnpkg as well as
-# over the whole version. A yarn that fails or prints anything else does
+# yarn) into $TOOLCHAIN rather than next to itself, and the npm fallback
-# not pass.
+# installs there too; only yarn is linked.
-yarn_ok() {
-    if missing yarn; then return 1; fi
-    version="$(yarn --version 2>/dev/null)" || return 1
-    [ "$version" = "$YARN_VERSION" ]
-}
-
-# ensure_yarn: unless yarn_ok, prepare YARN_VERSION and link its yarn.
-# corepack writes its shims (pnpm and yarnpkg as well as yarn) into
-# $TOOLCHAIN rather than next to itself, and the npm fallback installs
-# there too; only yarn is linked. Afterwards yarn is looked up through
-# PATH again and must pass yarn_ok, so another yarn that hides the link
-# stops bootstrap.
 ensure_yarn() {
-    if yarn_ok; then
+    if ! missing yarn; then return 0; fi
-        echo "bootstrap: using yarn $(yarn --version)"
-        return 0
-    fi
     shims="$TOOLCHAIN/corepack-shims"
     mkdir -p "$shims"
     if ! missing corepack; then
@@ -216,13 +182,6 @@ ensure_yarn() {
         shims="$TOOLCHAIN/npm-global/bin"
     fi
     link_bin "$shims/yarn" yarn
-    hash -r
-    if ! yarn_ok; then
-        echo "bootstrap: after installing yarn $YARN_VERSION in $shims," >&2
-        echo "  the yarn on PATH, $(command -v yarn), does not report it" >&2
-        exit 1
-    fi
-    echo "bootstrap: installed yarn $(yarn --version)"
 }
 
 # go_ok: the go on PATH has its gofmt beside it (a Go release ships the

script/build

@@ -8,12 +8,11 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/yarn" build
+    yarn build
 
-    # VERSION comes from the environment. Unset or empty, it is
+    # VERSION comes from the environment. Unset or empty, it is git
-    # `git describe --tags --always --dirty`, as in script/docker, or
+    # describe, or "dev" where there is no git or no repository history.
-    # "dev" where there is no git or no repository history.
+    version="${VERSION:-$(git describe --always --dirty 2>/dev/null || echo dev)}"
-    version="${VERSION:-$(git describe --tags --always --dirty 2>/dev/null || echo dev)}"
 
     CGO_ENABLED=0 go build -trimpath \
         -ldflags "-s -w -X main.Version=$version" \

script/dev

@@ -7,7 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/yarn" dev
+    yarn dev
 }
 
 main "$@"

script/frontend-fmt

@@ -10,7 +10,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/yarn" prettier --write '**/*.{js,css,html,md}'
+    yarn prettier --write '**/*.{js,css,html,md}'
 }
 
 main "$@"

script/frontend-fmt-check

@@ -7,7 +7,7 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/yarn" prettier --check '**/*.{js,css,html,md}'
+    yarn prettier --check '**/*.{js,css,html,md}'
 }
 
 main "$@"

script/frontend-test

@@ -14,14 +14,12 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    NODE_OPTIONS=--test-reporter=dot \
+    NODE_OPTIONS=--test-reporter=dot timeout 90 yarn --silent run test || {
-        timeout 90 "$ROOT/script/yarn" --silent run test || {
         echo "--- Rerunning with every test listed for details ---"
-        NODE_OPTIONS=--test-reporter=spec \
+        NODE_OPTIONS=--test-reporter=spec timeout 90 yarn --silent run test
-            timeout 90 "$ROOT/script/yarn" --silent run test
         exit 1
     }
-    timeout 30 "$ROOT/script/yarn" build
+    timeout 30 yarn build
 }
 
 main "$@"

script/yarn

@@ -1,55 +0,0 @@
-#!/bin/sh
-# script/yarn: run yarn with the given arguments under the node
-# script/bootstrap would use. Every script that runs yarn on the host
-# runs it through this one, except script/bootstrap, which picks its
-# own node and yarn.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# Must match the pins in script/bootstrap.
-NODE_VERSION="22.17.0"
-NODE_MIN_VERSION="22.13.0"
-
-# node_ok: the node on PATH has the major version of NODE_VERSION and is
-# at least NODE_MIN_VERSION. Only the major is compared with the pin,
-# as REPO_POLICIES.md asks. node itself compares the versions: major,
-# then minor, then patch. A node that fails does not pass.
-# script/bootstrap and script/yarn carry this function unchanged.
-node_ok() {
-    if ! command -v node >/dev/null 2>&1; then return 1; fi
-    node -e '
-        const have = process.versions.node.split(".").map(Number);
-        const want = process.argv[1].split(".").map(Number);
-        const pinned = process.argv[2].split(".").map(Number);
-        if (have[0] !== pinned[0]) process.exit(1);
-        for (let i = 0; i < 3; i++) {
-            if (have[i] !== want[i]) process.exit(have[i] > want[i] ? 0 : 1);
-        }
-    ' "$NODE_MIN_VERSION" "$NODE_VERSION"
-}
-
-# Run the yarn script/bootstrap installed: the yarn on PATH when the
-# node on PATH passes node_ok, and otherwise yarn under the pinned node
-# in nvm. nvm is a bash script, hence the subshell.
-run_yarn() {
-    if node_ok && command -v yarn >/dev/null 2>&1; then
-        exec yarn "$@"
-    fi
-    if node_ok || [ ! -s "$HOME/.nvm/nvm.sh" ]; then
-        echo "script/yarn: no yarn; run script/bootstrap first" >&2
-        exit 1
-    fi
-    exec bash -c '. "$HOME/.nvm/nvm.sh" && nvm use "$1" >/dev/null &&
-        shift && exec yarn "$@"' bash "$NODE_VERSION" "$@"
-}
-
-main() {
-    cd "$ROOT"
-    # script/bootstrap links the node and yarn it installs into
-    # ~/.local/bin, which the shell that called it may not have on PATH.
-    PATH="$HOME/.local/bin:$PATH"
-    run_yarn "$@"
-}
-
-main "$@"

test/unit/main.test.js

@@ -180,91 +180,6 @@ test("a check fetches the target's URL as written, with no query string added",
     );
 });
 
-test("a check sends no Referer header, wherever the page is served from", async (t) => {
-    mockTargets(t, () => 10);
-    const check = measureLatency("https://fsn1-speed.hetzner.com");
-    t.mock.timers.tick(10);
-    assert.notEqual(await settled(check), "still waiting");
-    assert.equal(
-        fetch.mock.calls[0].arguments[1].referrerPolicy,
-        "no-referrer",
-    );
-});
-
-// These targets' home pages answer with a redirect. A check follows it and
-// times the request to the new URL too, often on another host. The Google
-// Cloud Console redirects only requests that do not say they come from
-// another site, such as curl's. Each target is checked at /robots.txt on
-// its own host, which answers without a redirect. An S3 region answers it
-// with 403, and any answer counts as reachable.
-test("a target whose home page redirects is checked at /robots.txt on its own host", () => {
-    const checked = new Map(
-        new AppState([]).wan.map((host) => [host.name, host.url]),
-    );
-    for (const [name, url] of [
-        ["AWS Console", "https://console.aws.amazon.com/robots.txt"],
-        ["Google Cloud Console", "https://console.cloud.google.com/robots.txt"],
-        ["Akamai", "https://www.akamai.com/robots.txt"],
-        ["B2", "https://api.backblazeb2.com/robots.txt"],
-        [
-            "S3 af-south-1 (Cape Town)",
-            "https://s3.af-south-1.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 eu-west-2 (London)",
-            "https://s3.eu-west-2.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 me-south-1 (Bahrain)",
-            "https://s3.me-south-1.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 ap-northeast-1 (Tokyo)",
-            "https://s3.ap-northeast-1.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 ap-southeast-1 (Singapore)",
-            "https://s3.ap-southeast-1.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 ap-southeast-2 (Sydney)",
-            "https://s3.ap-southeast-2.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 us-west-2 (Oregon)",
-            "https://s3.us-west-2.amazonaws.com/robots.txt",
-        ],
-        [
-            "S3 sa-east-1 (São Paulo)",
-            "https://s3.sa-east-1.amazonaws.com/robots.txt",
-        ],
-    ]) {
-        assert.equal(checked.get(name), url);
-    }
-});
-
-// Chrome keeps the connection to an S3 region open after a HEAD check, but
-// closes it after most GET checks. The Hetzner servers do not answer HEAD.
-test("a round checks each S3 region with a HEAD request and every other target with a GET request", async (t) => {
-    const state = new AppState([
-        { name: "Local CPE", url: "http://192.168.100.1" },
-    ]);
-    mockTargets(t, () => 10);
-    const round = tick(state, new AbortController().signal);
-    t.mock.timers.tick(10);
-    assert.notEqual(await settled(round), "still waiting");
-    const methods = new Map(
-        fetch.mock.calls.map((call) => [
-            call.arguments[0],
-            call.arguments[1].method,
-        ]),
-    );
-    for (const host of state.allHosts) {
-        const method = host.name.startsWith("S3 ") ? "HEAD" : "GET";
-        assert.equal(methods.get(host.url), method, host.name);
-    }
-});
-
 test("at a 30000ms interval, a target answering after 1000ms shows in its row while another target's check is still waiting", async (t) => {
     CONFIG.updateInterval = 30000;
     const state = new AppState([

test/viewport/README.md

@@ -1,146 +1,114 @@
-# The viewport test
+# Responsive-layout harness
 
-`make frontend-viewport-test` checks the page's layout at several window widths
+Automated verification of the responsive layout that landed in #5. Run it with:
-in a real browser:
 
 ```bash
 make frontend-viewport-test
 ```
 
-First it runs the unit tests. Then it builds the page into `dist/`. It serves
+It builds `dist/`, serves it from the same digest-pinned `nginx` image and the
-`dist/` with the nginx image and the `configs/nginx.conf` that the Docker image
+same `configs/nginx.conf` the shipping container uses, drives a digest-pinned
-ships. Before the browser starts, it fetches `/` and `/no-such-page`, which
+headless Chrome against it over CDP, and asserts on computed layout at every
-nginx answers with the page. Both must carry `Cache-Control: no-cache` and a
+viewport width derived from the app's own CSS. Screenshots land in
-`Content-Security-Policy` header. Then it starts a headless Chrome in a
+`tmp/viewport/` alongside a `results.json`; they are artifacts for a human to
-container and opens the page in it at each width. For each width it measures the
+look at when something fails, not the evidence. The assertions are the evidence.
-layout inside the page and checks the measurements in Node. The checks decide
-pass or fail. Screenshots and a `results.json` land in `tmp/viewport/`, for a
-person to look at when a check fails.
 
-The test is not part of `make check`: it takes minutes, and `make test` has to
+The target is deliberately outside `make check`: it takes minutes, and
-finish in under 60 seconds.
+`make test` has to stay under 60 seconds.
 
-## The widths
+## How the widths are chosen
 
-The breakpoints are read from the page's own files. `viewports.js` reads the
+Not from a list of phone models. `viewports.js` parses the `@media` conditions
-`min-width` and `max-width` conditions out of the `@media` blocks in
+out of `web/src/styles.css` and scans `web/src/main.js` and `web/index.html` for
-`web/src/styles.css`. It also looks in `web/src/main.js` and `web/index.html`
+Tailwind responsive prefixes, then tests every breakpoint it finds at one pixel
-for Tailwind's responsive class prefixes, such as `md:`, and takes their
+below it, exactly on it, and one pixel above it. A generic 375px "phone" test
-breakpoints. Each breakpoint is tested at one pixel below it, exactly on it, and
+sails straight past an off-by-one at a media query boundary; `max-width: 768px`
-one pixel above it. Today the CSS has one breakpoint, `max-width: 768px`, and no
+matches _at_ 768, and the sweep pins down which side of that line each layout is
-responsive prefix is used.
+on.
 
-A `max-width: 768px` block matches at 768 pixels. Testing both sides of each
+Nothing hardcodes 768. Add a second media block or start using `md:` classes and
-breakpoint catches a layout that switches one pixel too early or too late. A
+the new breakpoint is covered without this directory being touched. The app is
-second media block, or a first `md:` class, is covered without a change to this
+desktop-first today (all narrow rules live in `max-width` blocks); a
-directory.
+`min-width`-only, mobile-first set is handled as its inverse, and a set that
+mixes the two makes the run fail loudly rather than test the right widths with
+the wrong expectation. Four further viewports are fixed anchors, each with a
+stated reason: a 320px floor, a 1280px desktop baseline, and two phone-landscape
+sizes straddling the breakpoint for the rotation case.
 
-The page is desktop-first: the wide layout is the default, and every narrow rule
+## What it asserts
-is in a `max-width` block. So a width is expected to show the narrow layout when
-one of those blocks matches it. A page with only `min-width` blocks would be
-read the other way round. A page that mixes the two kinds fails the run with a
-message, because the right expectation for each width can no longer be read from
-the breakpoints alone.
 
-Four more widths are fixed, each for a stated reason:
+- **app-rendered** — enough host rows exist and enough of them show a numeric
+  latency. This one exists so the rest cannot pass vacuously against a blank
+  page.
+- **no-horizontal-overflow** — `documentElement.scrollWidth` fits the layout
+  viewport, with the widest offending element named.
+- **nothing-past-viewport-edge** — no visible element's box extends past the
+  viewport edge.
+- **no-clipped-text** — nothing hides text behind `overflow: hidden`. Deliberate
+  ellipsis truncation (Tailwind's `truncate`, used on host names and URLs) is
+  excluded: it is a design choice, not breakage.
+- **tap-targets-44px** — every interactive control is at least 44x44 CSS px on
+  touch viewports, _and_ each selector in the control list matched at least the
+  number of visible elements it declares: one of each single control, and one
+  pin button per WAN host row. The second half is what stops the check passing
+  vacuously: with size alone, a renamed class would take its controls out of the
+  measured set and the check would report "all 0 controls are at least 44x44"
+  and pass. See below.
+- **host-rows-stacked / host-rows-side-by-side** — the rows genuinely reflow.
+  Computed `flex-direction` _and_ the actual geometry are checked, and in the
+  narrow layout the info block and the sparkline must each occupy essentially
+  the full row width. A row that merely shrank its 420px column would fail.
+- **probing-still-runs / gateway-detection-still-runs** — narrow viewports keep
+  probing and keep detecting the gateway. The mobile early-return path proposed
+  in #8 was rejected; this is what would catch it coming back.
 
-- 320 by 568 pixels: the narrowest width still in common use
+### The tap-target threshold
-- 667 by 375 pixels: a phone in landscape, inside the narrow layout
-- 844 by 390 pixels: a large phone in landscape, in the wide layout but still a
-  touch device
-- 1280 by 800 pixels: a desktop window
 
-Every width but 1280 by 800 is tested as a touch device.
+44x44 CSS px. That is the figure in Apple's Human Interface Guidelines and in
+WCAG 2.2 SC 2.5.5 "Target Size (Enhanced)". WCAG 2.2 SC 2.5.8 (level AA) sets a
+lower 24x24 floor, but that floor comes with a spacing exception these controls
+do not qualify for — the pin buttons sit directly against the host name they
+belong to.
 
-## The checks
+## Determinism
 
-A failed check does not stop the others.
+The browser container runs on an `--internal` docker network and has no route to
+the internet, so the app's latency probes cannot reach anything real. The
+harness answers them itself from a fixed delay table, with a deterministic
+fraction failed outright, so the rows render a realistic spread of one-, two-
+and three-digit latencies plus some unreachable rows. That spread is what the
+layout has to survive; a `---` placeholder in every row would not exercise it.
 
-- `app-rendered`: at least 10 WAN host rows exist, and at least 5 rows show a
+## What this cannot verify
-  number as their latency. Without this, the other checks could pass against a
-  blank page.
-- `no-horizontal-overflow`: the document is no wider than the window. On a
-  failure, the widest content is named.
-- `nothing-past-viewport-edge`: no visible element extends past the window's
-  edge.
-- `no-clipped-text`: no element hides its text behind `overflow: hidden` or
-  `overflow: clip`. Text cut with an ellipsis is allowed: that cut is a design
-  choice, not a defect. Tailwind's `truncate` cuts host names and URLs that way.
-- `tap-targets-44px`, on touch widths: each measured control is at least 44 by
-  44 CSS pixels. The controls are `#pause-btn`, `#interval-select`,
-  `#debug-toggle` and the `.pin-btn` in each WAN host row. The check also
-  demands that each selector matches enough visible elements: one of each single
-  control, and one pin button per WAN host row. A renamed class would otherwise
-  take its controls out of the measured set, and the check would pass on
-  nothing.
-- `host-rows-stacked` or `host-rows-side-by-side`: each host row shows the
-  layout expected at that width. In the narrow layout, the row's
-  `flex-direction` is `column`, the graph sits below the host's details, and
-  each takes at least 90% of the row's width. In the wide layout, the direction
-  is `row` and the graph sits to the right of the details. A row that only
-  shrank its fixed 420-pixel column fails.
-- `probing-still-runs`: the page sent at least one check to a target at this
-  width. The narrow layout must not skip the checks.
-- `gateway-detection-still-runs`: the `Local Gateway` row is present at this
-  width, so the gateway was looked for and found. The narrow layout must not
-  skip that search.
 
-### The tap-target size
+Real limits, so nobody re-parks this issue as needing hardware:
 
-44 by 44 CSS pixels is the figure in Apple's Human Interface Guidelines and in
+- **Non-Chromium engines.** This is Chrome. iOS Safari is WebKit and cannot be
-WCAG 2.2 success criterion 2.5.5, "Target Size (Enhanced)". WCAG 2.2 criterion
+  emulated by it; Safari-specific bugs (viewport units under a collapsing URL
-2.5.8 sets a lower minimum of 24 by 24 pixels, with an exception that depends on
+  bar, `-webkit-fill-available`, form control metrics) will not show up here.
-the space around a control. The pin buttons sit against the host name they
+- **Real touch input.** `hasTouch` emulation changes what the page is told, not
-belong to, so the test keeps 44.
+  how a finger behaves. Gesture handling, scroll momentum, double-tap zoom and
+  hover-state fallbacks on touch are out of scope.
+- **Physical pixel density and rendering.** `deviceScaleFactor` is set, but
+  subpixel antialiasing, OLED colour rendering and actual legibility at a given
+  physical size are not measurable here.
+- **Fonts.** The container has DejaVu, not the platform's own UI monospace. Text
+  metrics are therefore close to, but not identical to, a real device — a layout
+  that fits here by a few pixels might not there.
+- **On-device performance.** Canvas sparkline redraw cost, battery, and
+  behaviour on a slow radio are not measured.
+- **Browser chrome.** The address bar, safe-area insets and notch cutouts are
+  not simulated.
 
-## The browser's network
+Everything else this issue was actually about — does the layout reflow, does
-
+anything overflow, is content clipped, are the controls big enough — is a
-The browser container runs on an internal Docker network with no route to the
+function of viewport width and CSS, and is covered above.
-internet, so the page's checks reach no real host. The test answers them itself
-from a fixed table of delays: 2, 45, 123, 456 and 780 milliseconds. Which delay
-a target gets depends on its URL, and about one target in seven fails outright.
-So the rows show one-, two- and three-digit latencies and some unreachable rows,
-and the layout is tested against that spread. The request to
-`http://192.168.1.1` is answered after 5 milliseconds, so the `Local Gateway`
-row appears.
-
-At each width, the test sets the interval to 1 second and waits until at least 5
-rows show a latency before it measures. The page discards its first round, so
-this reaches a filled page without waiting out two rounds at 3 seconds.
-
-## What the test cannot check
-
-- Other browser engines. The test runs Chrome. Safari uses WebKit, and bugs that
-  only WebKit has do not show up here.
-- Real touch input. Touch emulation changes what the page is told, not how a
-  finger behaves. Gestures, scroll momentum, double-tap zoom and hover states on
-  touch are not tested.
-- Physical pixels. The device pixel ratio is set, but antialiasing, colour
-  rendering and legibility at a given physical size are not measured.
-- Fonts. The container has DejaVu, not a phone's own monospace font. Text is
-  about as wide as on a real device, but not exactly. A layout that fits here by
-  a few pixels might not fit there.
-- Performance. The cost of redrawing the graphs, battery use and behaviour on a
-  slow connection are not measured.
-- The browser's own frame. The address bar, safe-area insets and notch cutouts
-  are not simulated.
-
-## The files
-
-- `viewports.js` derives the widths from the sources.
-- `facts.js` is run inside the page and measures the layout. It only measures;
-  it decides nothing.
-- `checks.js` turns the measurements into the pass or fail of each check, with
-  the numbers that decided it.
-- `harness.js` connects to the browser, runs each width, writes the screenshots
-  and `results.json`, and prints the results. `script/frontend-viewport-test`
-  starts it; every input it needs arrives in the environment.
 
 ## Relation to the unit tests
 
-The unit tests in `test/unit/` call the functions that `web/src/main.js`
+Complementary layers, not two stacks. The unit tests in `test/unit/`, which
-exports, with no browser. `make test` runs them with Node's built-in test
+`make test` runs with Node's built-in test runner, exercise the functions
-runner. This test runs the built page in a real browser engine and is the only
+`web/src/main.js` exports in-process with no browser. This harness exercises
-test here that can see a media query. Neither replaces the other. Checks on
+rendered layout in a real engine and is the only thing here that can see a media
-computed styles and element geometry belong here; checks on functions belong in
+query. Neither replaces the other; assertions about computed styles and element
-`test/unit/`.
+geometry belong here, assertions about functions belong in `test/unit/`.

web/src/main.js

@@ -67,66 +67,51 @@ export const CONFIG = {
 
 // WAN endpoints to monitor. These are used for the aggregate health/stats
 // display (min/max/avg). Ordered: personal, LLM APIs, big-3 cloud, then
-// CDN/hosting/other. A check follows a redirect and times the request to
+// CDN/hosting/other.
-// the new URL too. So a target whose home page redirects is checked at
-// /robots.txt on its own host. That URL answers without a redirect.
 const WAN_HOSTS = [
     { name: "datavi.be", url: "https://datavi.be" },
     { name: "Anthropic API", url: "https://api.anthropic.com" },
     { name: "OpenAI API", url: "https://api.openai.com" },
-    { name: "AWS Console", url: "https://console.aws.amazon.com/robots.txt" },
+    { name: "AWS Console", url: "https://console.aws.amazon.com" },
-    {
+    { name: "Google Cloud Console", url: "https://console.cloud.google.com" },
-        name: "Google Cloud Console",
-        url: "https://console.cloud.google.com/robots.txt",
-    },
     { name: "Microsoft Azure", url: "https://portal.azure.com" },
     { name: "Cloudflare", url: "https://www.cloudflare.com" },
     { name: "Fastly CDN", url: "https://www.fastly.com" },
-    { name: "Akamai", url: "https://www.akamai.com/robots.txt" },
+    { name: "Akamai", url: "https://www.akamai.com" },
     { name: "Google", url: "https://www.google.com" },
     { name: "GitHub", url: "https://github.com" },
-    { name: "B2", url: "https://api.backblazeb2.com/robots.txt" },
+    { name: "B2", url: "https://api.backblazeb2.com" },
-    // Chrome keeps the connection to an S3 region open after a HEAD check,
-    // but closes it after most GET checks.
     {
         name: "S3 af-south-1 (Cape Town)",
-        url: "https://s3.af-south-1.amazonaws.com/robots.txt",
+        url: "https://s3.af-south-1.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 eu-west-2 (London)",
-        url: "https://s3.eu-west-2.amazonaws.com/robots.txt",
+        url: "https://s3.eu-west-2.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 me-south-1 (Bahrain)",
-        url: "https://s3.me-south-1.amazonaws.com/robots.txt",
+        url: "https://s3.me-south-1.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 ap-northeast-1 (Tokyo)",
-        url: "https://s3.ap-northeast-1.amazonaws.com/robots.txt",
+        url: "https://s3.ap-northeast-1.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 ap-southeast-1 (Singapore)",
-        url: "https://s3.ap-southeast-1.amazonaws.com/robots.txt",
+        url: "https://s3.ap-southeast-1.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 ap-southeast-2 (Sydney)",
-        url: "https://s3.ap-southeast-2.amazonaws.com/robots.txt",
+        url: "https://s3.ap-southeast-2.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 us-west-2 (Oregon)",
-        url: "https://s3.us-west-2.amazonaws.com/robots.txt",
+        url: "https://s3.us-west-2.amazonaws.com",
-        method: "HEAD",
     },
     {
         name: "S3 sa-east-1 (São Paulo)",
-        url: "https://s3.sa-east-1.amazonaws.com/robots.txt",
+        url: "https://s3.sa-east-1.amazonaws.com",
-        method: "HEAD",
     },
     // Hetzner regional speed test servers — genuine per-DC endpoints
     {
@@ -286,7 +271,6 @@ export class HostState {
     constructor(host, pinned = false) {
         this.name = host.name;
         this.url = host.url;
-        this.method = host.method;
         // Each entry is either a check's result, { timestamp, latency,
         // error }, or a round skipped while paused, { timestamp,
         // latency: null, paused: true }.
@@ -583,18 +567,16 @@ export class Reporter {
 
 // --- Latency Measurement -----------------------------------------------------
 
-// Checks one target with the given HTTP method, GET when none is given. The
+// Checks one target. The check times out after CONFIG.requestTimeout; the
-// check times out after CONFIG.requestTimeout; the caller can give it up
+// caller can give it up sooner through the optional signal, which also ends
-// sooner through the optional signal, which also ends it as a timeout. A
+// it as a timeout. A failed check's reason says what went wrong and after
-// failed check's reason says what went wrong and after how long; a check
+// how long; a check that answered has none.
-// that answered has none.
 //
-// The Hetzner speed-test servers close the connection without an answer
+// The URL is fetched as written, with nothing added to it: the Hetzner
-// when the URL has a query string or the request has a Referer header. So
+// speed-test servers close the connection without an answer when the URL
-// the URL is fetched as written, and referrerPolicy: "no-referrer" sends
+// has a query string, and cache: "no-store" keeps the browser's cache out
-// no Referer header, wherever the page is served from. cache: "no-store"
+// of the measurement.
-// keeps the browser's cache out of the measurement.
+export async function measureLatency(url, signal) {
-export async function measureLatency(url, signal, method = "GET") {
     const controller = new AbortController();
     const timeoutId = setTimeout(
         () => controller.abort(),
@@ -606,10 +588,9 @@ export async function measureLatency(url, signal, method = "GET") {
 
     try {
         await fetch(url, {
-            method,
+            method: "GET",
             mode: "no-cors",
             cache: "no-store",
-            referrerPolicy: "no-referrer",
             signal: controller.signal,
         });
         const latency = Math.round(performance.now() - start);
@@ -1309,7 +1290,7 @@ export async function tick(state, signal, onOffline) {
     // the round started.
     await Promise.all(
         state.allHosts.map(async (host) => {
-            const r = await measureLatency(host.url, signal, host.method);
+            const r = await measureLatency(host.url, signal);
             if (state.paused || signal.aborted || state.tickCount === 0) {
                 return;
             }
@@ -1382,7 +1363,7 @@ function startRecoveryProbe(state, startRounds) {
         const checks = new AbortController();
         state._recoveryProbeChecks = checks;
         for (const host of canaries) {
-            measureLatency(host.url, checks.signal, host.method).then((r) => {
+            measureLatency(host.url, checks.signal).then((r) => {
                 if (r.error !== null || checks.signal.aborted) return;
                 log.notice("Recovery probe: connectivity detected");
                 stopRecoveryProbe(state);