v3.8.0 — silence is not health

A host that answers and then stops is not up

• With expect_body unset the body was never read, so a host that sent 200 OK and never wrote a byte was published as up, 3 ms — and that 3 ms went into the waveform and the daily average.
• The body is always read now, first 64 KB only: 512 MB served inside a two-second timeout took the process from 78 MB to 603 MB before, 7 MB after. On Cloudflare that was one monitored site killing the isolate that serves the page and runs the cron.
• A failure arriving after the status has its own word — incomplete, "answered, then stopped" — and keeps the code it was answered with.

A redirecting webhook lost every alert and reported success

• fetch follows redirects, so an http:// webhook behind a redirect to https became a bodyless GET, got a 200, and counted it delivered. The probe has refused redirects since the first commit; the alert path did the opposite.
• A lost alert now says what was lost: alert() returned how many channels refused and tick() threw it away.
• A hanging channel skipped whole probe rounds — 10 seconds whatever the interval. Each channel gets a quarter of the round's budget.
• The payload gained at, held_for and group, and is documented in configuration, including that it names a grouped member and why.
• A newline in a monitor's name forged a line — an invented recovery inside an outage alert.

A group never publishes one customer's outage as its own

• Half of a group of two is one customer. Down needs half and at least two; a group of one says troubled and never down.
• 400 hidden members writing an event each filled the whole event window in one round, erasing every named service's history from the page, the JSON and the feed. Grouped and named events get a window each.

The timing channel, the other half

• v3.7.0 made a cache hit flat and left the miss proportional to the hidden members: 5 ms at 2, 284 ms at 400, ranges not overlapping, samplable four times a minute.
• A server holds until its next round, and the round rebuilds the page itself. After: 1.34 ms and 1.39 ms.

Also

• status.json published whatever it found in the reason column while the HTML checked it against the words it documents.
• German and Spanish called a monitor "not reachable" and "no response" for every kind of failure, including one that answered 500.
• An outage under a minute reported "after 0m"; it says seconds, and every language but English gets a space before its unit.

Upgrading

• A pull. No schema change.