A second download source, for when the first one refuses

Cloudflare rate-limits by volume, and the block it handed out while this was
being built lasted over twenty minutes — too fragile to be the only thing behind
a button. So the download phase tries its sources in order: the anycast endpoint
first, then a plain 100 MB file on Linode's Seattle mirror, which has no opinion
about how much has been pulled today.

Only a refusal moves to the next one; anything else would fail the same way
twice. Every result names the source it used, and the page says "from
linode-seattle" rather than "via SEA" when it was the fallback — that mirror is
in one fixed place, so somewhere else it reads low, and a figure that quietly
came from a different continent would be a lie.

Upload stays on Cloudflare, which has never been the one to refuse.

Also: the too-short-window guard was refusing to divide 512 MiB by ten
milliseconds on a link fast enough to hit the runaway budget before the first
tick. It now guards against dividing by zero and nothing more.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -611,10 +611,17 @@ Decisions worth keeping:
   in, it reported 31 ms for a 7 ms line. Jitter is the mean change between consecutive
   probes, not a standard deviation, so one slow probe doesn't run away with it.
 - **A refused phase is not a number.** The far end rate-limits by volume, and a test moves a
-  few hundred megabytes; several in a row earn 429s. So: a 20-second cooldown between tests,
-  a stream that retries twice before giving up, the rate computed over the window in which
-  bytes were actually still arriving, and a plain sentence when it was cut short. Coasting to
-  the end of the clock with nothing arriving reported a third of the truth.
+  few hundred megabytes; several in a row earn 429s, and the block observed while building this
+  lasted over twenty minutes. So: a 20-second cooldown counted from the last *attempt* (a
+  refused test still used the line), a stream that retries twice before giving up, the rate
+  computed over the window in which bytes were actually still arriving, and a plain sentence
+  when it was cut short. Coasting to the end of the clock with nothing arriving reported a
+  third of the truth.
+- **A second download source, for when the first refuses.** A plain 100 MB file on Linode's
+  Seattle mirror, which has no opinion about volume. It is only reached after a refusal, and
+  every result names the source it used — that mirror is in one place, so on a machine far from
+  Seattle it would read low, and a number that quietly came from somewhere else would be a lie.
+  Upload stays on Cloudflare, which has never been the one to refuse.
 - **The last result is published as sensors** (`net.internet.*`), so the line is a widget, a
   graph, an alert or a Prometheus series like anything else. Each carries the time the test
   ran, not the time it was asked for.