Speedtests that measure the line, and a dashboard search engines leave alone

An iperf3 speedtest ran on a single TCP stream by default, which
measures that stream's congestion window rather than your connection.
On a real ~350 Mbps path, 1 stream reported 116 Mbps, 4 reported 202
and 8 reported 268 - the same link, more than twice the answer. The
default is now 8, suited to a 500 Mbps - 1 Gbps line, and the ceiling
moves from 8 to 32 because that same path was still climbing at 12
with the server 93% idle. Past about twelve the differences are mostly
run-to-run noise, which the tooltip and the docs now say. The number
stays yours to pick: an instrument that retunes itself turns its own
choices into apparent ISP changes. The tester enforces the same
ceiling the settings do, so a raised count reaches the wire instead of
being accepted, stored, displayed and then quietly dropped.

The Legacy RSA padding toggle no longer promises something your own
machine cannot do. Whether that option can be sent is decided by the
iperf3 build on THIS host - it arrived in 3.17 and 3.20 reclassified
it as server-only - so on a current build, ticking it made the run
fail with a message that read like a server or credential problem. It
is now locked outside that window, with a note saying which side of it
this host falls on, and a build that cannot be identified locks
nothing. Locked against being turned on, never against being turned
off: a server saved with it already on - ticked under an older build,
or from before this host's iperf3 moved past 3.20 - keeps sending the
flag on every run, so that one stays clickable and says to turn it
off, rather than leaving the only cure as deleting the server and its
stored password. Unticking it locks the toggle again on the spot, so
the escape hatch cannot be used to put the flag back.

The warning about re-entering an iperf3 server's password stops
outliving the edit that raised it. Nothing used to clear it - not
opening another server, not closing and reopening the drawer - so it
sat there accusing a server that was saved and authenticating fine.
The message belongs to an open edit and now dies with
it - on save, on Done, on Load defaults, on opening another server -
and typing the original address back takes it away with the edit,
instead of demanding a retype for a password the box still had. What
survives is the durable signal: the password field itself says whether
this address has one saved.

A greyed-out setting no longer greys out the help tooltip inside it.
Opacity applies to everything an element contains, so a dimmed label
dimmed its own explanation to about 3.2:1 - the one thing an operator
opens precisely because the control is unavailable. The rest of the
settings list has carried an escape for this all along; the iperf3
server editor's fields now use the same one.

A dashboard reachable from the internet is no longer something search
engines will index. It is one person's view of one connection - ISP,
exit city, speed history, outage log - and because every install
renders identical titles, indexing also scattered duplicate branded
pages. The server now sends X-Robots-Tag: noindex, nofollow, which
covers /api and /metrics as well; the public demo is a separate build
on its own host and is unaffected.

Separately: the review-round labels are gone from the source. Forty-two
comments cited a finding id - C-57, audit F-11 - from a review document
no reader outside it can obtain, and three of them shipped inside the
dashboard, where every install and the public demo serve them in View
Source. Each one is now the reason the assertion exists, which is what
the label was standing in for. Nine test files named after the round
that produced them are named for what they test instead, and four tests
that were only grouped by that round moved to the file their subject
already lives in. No test was added, removed or changed: 966 before,
966 after.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: cansofgrease

.github/workflows/iperf-integration.yml

@@ -1,6 +1,6 @@
 name: iperf integration
 
-# WHY THIS WORKFLOW EXISTS (audit finding F-12)
+# WHY THIS WORKFLOW EXISTS
 # ------------------------------------------------------------------------------
 # Every committed iperf3 test stubs the child process through the exec seam
 # (internal/speedtest/iperf.go: iperfExec) and feeds back canned -J/--json bodies.

.goreleaser.yaml

@@ -182,7 +182,7 @@ release:
   # rolling-commit amend, so the GitHub pre-release already exists with same-named
   # assets and the re-run would 422 on upload without this overwrite. A STABLE
   # release, by contrast, is cut once and must stay immutable: its checksums are
-  # attested in release.yml (C-28), and silently overwriting a published stable
+  # attested in release.yml, and silently overwriting a published stable
   # asset would invalidate that provenance. This field is a plain bool (not
   # templateable), so the prerelease-vs-stable split is enforced upstream in
   # release.yml - the "Forbid re-cutting a published stable release" guard fails the

internal/logbuf/logbuf_test.go

@@ -129,9 +129,8 @@ func TestRingByteCeiling(t *testing.T) {
 // After eviction the backing array's tail must no longer reference the dropped
 // entries: trim compacts survivors to the front and zeros the vacated slots, so
 // the evicted strings become collectable instead of being pinned by the backing
-// array until a later Append overwrites the slot. Regression for C-57 (both the
-// one-line duplicate-survivor case and larger drops that retained evicted
-// strings).
+// array until a later Append overwrites the slot. Covers both the one-line
+// duplicate-survivor case and larger drops that retained evicted strings.
 func TestTrimReleasesEvictedSlots(t *testing.T) {
 	r := New(3)
 	for i := 1; i <= 6; i++ {
@@ -152,8 +151,7 @@ func TestTrimReleasesEvictedSlots(t *testing.T) {
 }
 
 // Clear must release the retained entries, not merely reslice to length 0 (which
-// would leave the backing array pinning every cleared string). Regression for
-// C-57.
+// would leave the backing array pinning every cleared string).
 func TestClearReleasesReferences(t *testing.T) {
 	r := New(4)
 	for i := 1; i <= 4; i++ {
@@ -173,7 +171,7 @@ func TestClearReleasesReferences(t *testing.T) {
 }
 
 // LoadFile must refuse a symlink rather than following it to an attacker-chosen
-// target, and must not seed the ring from it. Regression for C-23.
+// target, and must not seed the ring from it.
 func TestLoadFileRejectsSymlink(t *testing.T) {
 	dir := t.TempDir()
 	real := filepath.Join(dir, "real.txt")
@@ -195,7 +193,6 @@ func TestLoadFileRejectsSymlink(t *testing.T) {
 
 // LoadFile must refuse a device file rather than reading from it forever (a
 // never-ending stream like /dev/zero would otherwise OOM/hang startup).
-// Regression for C-23.
 func TestLoadFileRejectsDevice(t *testing.T) {
 	const dev = "/dev/zero"
 	if _, err := os.Lstat(dev); err != nil {
@@ -213,7 +210,7 @@ func TestLoadFileRejectsDevice(t *testing.T) {
 // A file far larger than the ring's byte ceiling must not be read whole: only a
 // bounded tail is loaded (honouring the memory bound before allocation), the
 // newest entries are kept, and the partial line at the seek boundary is dropped
-// rather than fabricated into a torn entry. Regression for C-23.
+// rather than fabricated into a torn entry.
 func TestLoadFileReadsBoundedNewestTail(t *testing.T) {
 	dir := t.TempDir()
 	path := filepath.Join(dir, "logs.txt")

internal/monitor/monitor_test.go

@@ -1111,7 +1111,7 @@ func TestPendingEventRetryLandsExactlyOnce(t *testing.T) {
 // A DNS probe whose lookup fails because the monitor is shutting down (its round
 // ctx is cancelled) must be neutral: no "dns down" warning and no dns.fail.* bump,
 // so a normal stop can't log a phantom resolver outage or poison the recovered
-// counters. Regression for C-64.
+// counters.
 func TestRoundDNSCancelledLookupIsNeutral(t *testing.T) {
 	stats.ResetForTest()
 	var buf bytes.Buffer
@@ -1148,7 +1148,6 @@ func TestRoundDNSCancelledLookupIsNeutral(t *testing.T) {
 
 // Toggling the DNS sub-toggle OFF must clear the seed so re-enabling starts as
 // "no reading yet" rather than resurfacing the pre-disable value as live.
-// Regression for C-65.
 func TestRoundDNSToggleOffClearsSeed(t *testing.T) {
 	stats.ResetForTest()
 	m, _ := newTestMonitor(t, 10, 1)
@@ -1181,7 +1180,7 @@ func TestRoundDNSToggleOffClearsSeed(t *testing.T) {
 }
 
 // A DNS probe already in flight when the DNS sub-toggle is switched OFF must
-// DISCARD its now-disallowed result rather than publish it. Regression for C-65:
+// DISCARD its now-disallowed result rather than publish it:
 // without bumping the generation on the toggle-off edge, the late goroutine sets
 // dnsSeen=true and inserts a sample under a feature the operator turned off.
 func TestRoundDNSInflightDiscardedAfterToggleOff(t *testing.T) {

…ernal/netinfo/review_fixes_linux_test.go internal/netinfo/classify_linux_test.gointernal/netinfo/review_fixes_linux_test.go renamed to internal/netinfo/classify_linux_test.go internal/netinfo/review_fixes_linux_test.go renamed to internal/netinfo/classify_linux_test.go

@@ -4,7 +4,7 @@ package netinfo
 
 import "testing"
 
-// C-53: a raw-socket packet whose IPv4 header claims IHL < 5 (fewer than 20
+// A raw-socket packet whose IPv4 header claims IHL < 5 (fewer than 20
 // bytes) is malformed and must be rejected, not parsed - otherwise classifyRaw
 // slices the ICMP payload from inside the header and a crafted short IHL can land
 // the "type" byte on header data and be misclassified. Mirrors the darwin twin's

internal/netinfo/review_fixes_test.go internal/netinfo/generation_test.gointernal/netinfo/review_fixes_test.go renamed to internal/netinfo/generation_test.go

@@ -8,11 +8,9 @@ import (
 	"sync"
 	"testing"
 	"time"
-
-	"github.com/pingular/pingularity/internal/stats"
 )
 
-// C-20: the refresh-ordering contract. A later-STARTED refresh (higher generation)
+// The refresh-ordering contract. A later-STARTED refresh (higher generation)
 // outranks an earlier one, so once it publishes, the older/slower one is refused -
 // it can't clobber the newer snapshot when it finally returns. A refresh's own
 // several effects (m.info, then the exit patch) still pass while it stays current.
@@ -34,68 +32,7 @@ func TestGenerationPublishOrdering(t *testing.T) {
 	}
 }
 
-// C-58: parseChaosTXT must validate the response against our fixed query - a
-// mismatched transaction id, a query masquerading as a response, the wrong
-// question count, a question that doesn't echo version.bind, or the wrong QCLASS
-// must all be ignored rather than trusted as the resolver's answer. A genuine
-// response still parses.
-func TestParseChaosTXTRejectsForeignResponse(t *testing.T) {
-	build := func() []byte {
-		// header: our id 0x1234, flags QR+RD+RA, QD=1 AN=1 NS=0 AR=0.
-		b := []byte{0x12, 0x34, 0x81, 0x80, 0, 1, 0, 1, 0, 0, 0, 0}
-		b = append(b, chaosVersionQuestion...)
-		// answer: name pointer -> 0x0c, TYPE TXT, CLASS CHAOS, TTL 0, RDLENGTH, RDATA.
-		b = append(b, 0xc0, 0x0c, 0x00, 0x10, 0x00, 0x03, 0, 0, 0, 0)
-		txt := "dnsmasq"
-		rd := append([]byte{byte(len(txt))}, txt...)
-		b = append(b, byte(len(rd)>>8), byte(len(rd)))
-		b = append(b, rd...)
-		return b
-	}
-	if got := parseChaosTXT(build()); got != "dnsmasq" {
-		t.Fatalf("valid response = %q, want dnsmasq (a legit answer was rejected)", got)
-	}
-	cases := []struct {
-		name   string
-		mutate func([]byte)
-	}{
-		{"wrong transaction id", func(b []byte) { b[1] = 0x35 }},
-		{"query not response (QR=0)", func(b []byte) { b[2] &^= 0x80 }},
-		{"qdcount not one", func(b []byte) { b[5] = 2 }},
-		{"question name mismatch", func(b []byte) { b[13] = 'x' }}, // corrupt the 'v' of "version"
-		{"wrong qclass (IN not CHAOS)", func(b []byte) { b[12+len(chaosVersionQuestion)-1] = 0x01 }},
-	}
-	for _, c := range cases {
-		b := build()
-		c.mutate(b)
-		if got := parseChaosTXT(b); got != "" {
-			t.Errorf("%s: parseChaosTXT trusted a foreign response = %q, want \"\"", c.name, got)
-		}
-	}
-}
-
-// C-55: a bare three-letter code is weak evidence (several collide with words -
-// "sea", "den", "van", "was"), so cityFromRDNS must raise a low-confidence marker
-// while still returning the city; an indexed code ("fra10") is stronger and must
-// not raise it. The city string is unchanged either way (display only, zero coords).
-func TestCityFromRDNSLowConfidenceMarker(t *testing.T) {
-	stats.ResetForTest()
-	if got := cityFromRDNS("core.sea.example.net"); got != "Seattle" {
-		t.Fatalf("cityFromRDNS(bare sea) = %q, want Seattle", got)
-	}
-	if n := stats.Lifetime().Counters["netinfo.rdns_city_lowconf"]; n != 1 {
-		t.Fatalf("bare three-letter token: lowconf counter = %d, want 1", n)
-	}
-	stats.ResetForTest()
-	if got := cityFromRDNS("ae1-cr2.fra10.isp.net"); got != "Frankfurt" {
-		t.Fatalf("cityFromRDNS(indexed fra10) = %q, want Frankfurt", got)
-	}
-	if n := stats.Lifetime().Counters["netinfo.rdns_city_lowconf"]; n != 0 {
-		t.Fatalf("indexed token fra10: lowconf counter = %d, want 0 (stronger evidence)", n)
-	}
-}
-
-// C-21 (part two): a trace started on the OLD network must not overwrite the
+// Part two of the in-flight-trace contract: a trace started on the OLD network must not overwrite the
 // deliberate IP-change cache-bust when it finally lands. The bust bumps traceGen
 // mid-trace; at commit the trace sees the generation moved and drops its result,
 // leaving the cache cleared so the next caller re-traces the current network.
@@ -134,7 +71,7 @@ func TestCachedExitDropsOutOfGenerationTrace(t *testing.T) {
 	}
 }
 
-// C-21 (part one): while a trace toward target A is in flight, a caller wanting a
+// Part one of the in-flight-trace contract: while a trace toward target A is in flight, a caller wanting a
 // newly-selected target B must NOT be handed A's path by the single-flight waiter.
 // After waiting it re-validates the cache against its own target and traces B.
 func TestCachedExitWaiterRetracesForNewTarget(t *testing.T) {

internal/netinfo/geo_test.go

@@ -7,6 +7,8 @@ import (
 	"net/http"
 	"strings"
 	"testing"
+
+	"github.com/pingular/pingularity/internal/stats"
 )
 
 // geoResp builds a fresh canned response (new body each call, so a host can be hit
@@ -64,3 +66,24 @@ func TestPublicIPGeo(t *testing.T) {
 		})
 	}
 }
+
+// A bare three-letter code is weak evidence (several collide with words -
+// "sea", "den", "van", "was"), so cityFromRDNS must raise a low-confidence marker
+// while still returning the city; an indexed code ("fra10") is stronger and must
+// not raise it. The city string is unchanged either way (display only, zero coords).
+func TestCityFromRDNSLowConfidenceMarker(t *testing.T) {
+	stats.ResetForTest()
+	if got := cityFromRDNS("core.sea.example.net"); got != "Seattle" {
+		t.Fatalf("cityFromRDNS(bare sea) = %q, want Seattle", got)
+	}
+	if n := stats.Lifetime().Counters["netinfo.rdns_city_lowconf"]; n != 1 {
+		t.Fatalf("bare three-letter token: lowconf counter = %d, want 1", n)
+	}
+	stats.ResetForTest()
+	if got := cityFromRDNS("ae1-cr2.fra10.isp.net"); got != "Frankfurt" {
+		t.Fatalf("cityFromRDNS(indexed fra10) = %q, want Frankfurt", got)
+	}
+	if n := stats.Lifetime().Counters["netinfo.rdns_city_lowconf"]; n != 0 {
+		t.Fatalf("indexed token fra10: lowconf counter = %d, want 0 (stronger evidence)", n)
+	}
+}

internal/netinfo/resolver_test.go

@@ -27,3 +27,43 @@ func TestFilterResolvers(t *testing.T) {
 		}
 	}
 }
+
+// parseChaosTXT must validate the response against our fixed query - a
+// mismatched transaction id, a query masquerading as a response, the wrong
+// question count, a question that doesn't echo version.bind, or the wrong QCLASS
+// must all be ignored rather than trusted as the resolver's answer. A genuine
+// response still parses.
+func TestParseChaosTXTRejectsForeignResponse(t *testing.T) {
+	build := func() []byte {
+		// header: our id 0x1234, flags QR+RD+RA, QD=1 AN=1 NS=0 AR=0.
+		b := []byte{0x12, 0x34, 0x81, 0x80, 0, 1, 0, 1, 0, 0, 0, 0}
+		b = append(b, chaosVersionQuestion...)
+		// answer: name pointer -> 0x0c, TYPE TXT, CLASS CHAOS, TTL 0, RDLENGTH, RDATA.
+		b = append(b, 0xc0, 0x0c, 0x00, 0x10, 0x00, 0x03, 0, 0, 0, 0)
+		txt := "dnsmasq"
+		rd := append([]byte{byte(len(txt))}, txt...)
+		b = append(b, byte(len(rd)>>8), byte(len(rd)))
+		b = append(b, rd...)
+		return b
+	}
+	if got := parseChaosTXT(build()); got != "dnsmasq" {
+		t.Fatalf("valid response = %q, want dnsmasq (a legit answer was rejected)", got)
+	}
+	cases := []struct {
+		name   string
+		mutate func([]byte)
+	}{
+		{"wrong transaction id", func(b []byte) { b[1] = 0x35 }},
+		{"query not response (QR=0)", func(b []byte) { b[2] &^= 0x80 }},
+		{"qdcount not one", func(b []byte) { b[5] = 2 }},
+		{"question name mismatch", func(b []byte) { b[13] = 'x' }}, // corrupt the 'v' of "version"
+		{"wrong qclass (IN not CHAOS)", func(b []byte) { b[12+len(chaosVersionQuestion)-1] = 0x01 }},
+	}
+	for _, c := range cases {
+		b := build()
+		c.mutate(b)
+		if got := parseChaosTXT(b); got != "" {
+			t.Errorf("%s: parseChaosTXT trusted a foreign response = %q, want \"\"", c.name, got)
+		}
+	}
+}

internal/settings/crypt_test.go

@@ -431,7 +431,7 @@ func (failSealCrypter) Unseal(s string) (string, error) { return s, nil }
 // If sealing a password fails, the save must ABORT - not fall through and write the
 // password in the clear. mutate returns the error before touching the store or the
 // live values, so nothing is persisted and the in-memory config is unchanged.
-// Regression for C-33 (sealServers used to `continue` past a Seal error).
+// sealServers used to `continue` past a Seal error, persisting the rest.
 func TestSealFailureAbortsSave(t *testing.T) {
 	st, err := store.Open(":memory:")
 	if err != nil {

internal/settings/settings.go

@@ -115,7 +115,7 @@ const (
 	MinIperfDur     = 1
 	MaxIperfDur     = 30
 	MinIperfStreams = 1
-	MaxIperfStreams = 8
+	MaxIperfStreams = 32
 
 	MaxOoklaConnections = 16 // ceiling for Ookla parallel connections; 0 = library default
 	MaxIperfOmit        = 5