milestone 30: overview as a dashboard, explicit health contract, period aggregations

src/storage/repositories/events_repo.zig

@@ -172,6 +172,24 @@ pub fn resolveActiveByKey(
     return database.changes() != 0;
 }
 
+const resolve_by_code_sql =
+    \\UPDATE operational_events SET resolved_at = ?2
+    \\ WHERE code = ?1 AND resolved_at IS NULL
+;
+
+/// Closes every open episode of `code`, and returns how many. The store uses it
+/// once at init for a code no emitter writes any more: an episode whose producer
+/// no longer exists can never demonstrate recovery, so nothing but this would
+/// ever close it.
+pub fn resolveActiveByCode(database: *db.Db, now_s: i64, code: []const u8) db.Error!i64 {
+    var stmt = try database.prepare(resolve_by_code_sql);
+    defer stmt.deinit();
+    try stmt.bindText(1, code);
+    try stmt.bindInt(2, now_s);
+    try stmt.exec();
+    return database.changes();
+}
+
 const select_active_id_sql =
     "SELECT id FROM operational_events WHERE code = ?1 AND subject_key = ?2 AND resolved_at IS NULL";
 

src/storage/repositories/queries_repo.zig

@@ -547,7 +547,6 @@ fn likePattern(arena: Allocator, needle: []const u8) Allocator.Error![]const u8
 pub const StatsTotals = struct {
     queries: u64,
     blocked: u64,
-    cached: u64,
     distinct_clients: u64,
     avg_response_time_us: ?i64,
 };
@@ -557,7 +556,6 @@ pub const StatsTotals = struct {
 const stats_totals_sql =
     \\SELECT count(*),
     \\       coalesce(sum(blocked <> 0), 0),
-    \\       coalesce(sum(cache_hit = 1), 0),
     \\       count(DISTINCT client_ip),
     \\       coalesce(sum(response_time_us), 0),
     \\       count(response_time_us)
@@ -577,13 +575,12 @@ pub fn statsTotals(database: *db.Db, since: i64, until: i64) db.Error!StatsTotal
     // statement is not the one this function prepared.
     if (!try stmt.step()) return error.Misuse;
 
-    const timed = stmt.columnInt(5);
+    const timed = stmt.columnInt(4);
     return .{
         .queries = try countOf(stmt.columnInt(0)),
         .blocked = try countOf(stmt.columnInt(1)),
-        .cached = try countOf(stmt.columnInt(2)),
-        .distinct_clients = try countOf(stmt.columnInt(3)),
-        .avg_response_time_us = if (timed == 0) null else @divTrunc(stmt.columnInt(4), timed),
+        .distinct_clients = try countOf(stmt.columnInt(2)),
+        .avg_response_time_us = if (timed == 0) null else @divTrunc(stmt.columnInt(3), timed),
     };
 }
 
@@ -653,10 +650,217 @@ pub fn timeseries(database: *db.Db, since: i64, bucket_seconds: u32, out: []Buck
     return out.len;
 }
 
+/// One row of `/api/stats/types`. `qtype` is nullable in the schema, so the
+/// rows that carry no type group into a row of their own rather than
+/// disappearing from a breakdown that claims to add up.
+///
+/// No name field: the only qtype-name table lives in the admin, and a second
+/// copy here would drift out of agreement with it.
+pub const TypeCount = struct {
+    qtype: ?u16,
+    count: u64,
+};
+
+/// `qtype IS NULL` sorts 0 before 1, which puts the null row last within a tie.
+/// The ordering is total, so two reads of one window return the same list in
+/// the same order — which is what makes the goldens byte-stable. It is an
+/// order, not an identity: a caller keys on the `qtype` value, never on a row's
+/// position, because a rank change between refreshes moves rows and must not
+/// move what they mean.
+const stats_types_sql =
+    \\SELECT qtype, count(*)
+    \\  FROM query_log
+    \\ WHERE timestamp >= ?1 AND timestamp < ?2
+    \\ GROUP BY qtype
+    \\ ORDER BY count(*) DESC, qtype IS NULL, qtype ASC
+;
+
+/// The query-type breakdown of `[since, until)`. No zero rows: a type absent
+/// from the window is absent from the list.
+pub fn statsTypes(
+    database: *db.Db,
+    arena: Allocator,
+    since: i64,
+    until: i64,
+) db.Error!std.ArrayList(TypeCount) {
+    var out: std.ArrayList(TypeCount) = .empty;
+
+    var stmt = try database.prepare(stats_types_sql);
+    defer stmt.deinit();
+    try stmt.bindInt(1, since);
+    try stmt.bindInt(2, until);
+
+    while (try stmt.step()) {
+        try out.append(arena, .{
+            .qtype = if (stmt.isNull(0)) null else try columnU16(&stmt, 0),
+            .count = try countOf(stmt.columnInt(1)),
+        });
+    }
+    return out;
+}
+
+/// One row of `/api/stats/routes`: how a slice of the window was answered.
+///
+/// `source` is the answering resolver's identity and nothing else — the
+/// upstream url for `upstream` rows, the zone for `forward_zone` rows, null
+/// everywhere else. It is deliberately not `source_name`, which names the
+/// blocklist a block came from and would read as an upstream here.
+pub const RouteCount = struct {
+    route: provenance.RouteKind,
+    source: ?[]const u8,
+    count: u64,
+};
+
+/// A null upstream on an `upstream` row is its own group, not a dropped row: it
+/// is a real state of the log and the caller labels it.
+const stats_routes_sql =
+    \\SELECT route_kind,
+    \\       CASE route_kind
+    \\            WHEN 'upstream' THEN upstream
+    \\            WHEN 'forward_zone' THEN forward_zone
+    \\       END AS source,
+    \\       count(*)
+    \\  FROM query_log
+    \\ WHERE timestamp >= ?1 AND timestamp < ?2
+    \\ GROUP BY route_kind, source
+    \\ ORDER BY count(*) DESC, route_kind ASC, source IS NULL, source ASC
+;
+
+/// The answering-route breakdown of `[since, until)`. Strings are copied into
+/// `arena`, which outlives the statement.
+pub fn statsRoutes(
+    database: *db.Db,
+    arena: Allocator,
+    since: i64,
+    until: i64,
+) db.Error!std.ArrayList(RouteCount) {
+    var out: std.ArrayList(RouteCount) = .empty;
+
+    var stmt = try database.prepare(stats_routes_sql);
+    defer stmt.deinit();
+    try stmt.bindInt(1, since);
+    try stmt.bindInt(2, until);
+
+    while (try stmt.step()) {
+        try out.append(arena, .{
+            .route = try provenance.parse(provenance.RouteKind, stmt.columnText(0)),
+            .source = try stmt.columnTextAllocOrNull(arena, 1),
+            .count = try countOf(stmt.columnInt(2)),
+        });
+    }
+    return out;
+}
+
+/// How many clients `/api/stats/clients` names before the rest become `other`.
+/// Eight is what one legend can carry without becoming a second table.
+pub const max_client_series = 8;
+
+/// One named client's series. `buckets` is always the caller's bucket count
+/// long, zero-filled, and aligned exactly like `timeseries`.
+pub const ClientSeries = struct {
+    client: []const u8,
+    buckets: []const u64,
+};
+
+/// `other` is always present and always bucket-count sized — including for an
+/// empty window and for a window with eight clients or fewer. A caller charting
+/// a stack must not have to invent the residual series.
+pub const ClientsBreakdown = struct {
+    clients: []const ClientSeries,
+    other: []const u64,
+};
+
+/// Ranked by in-window total, ties broken by address, so the cut at eight is
+/// the same cut on every request over the same data.
+const stats_clients_rank_sql =
+    \\SELECT client_ip
+    \\  FROM query_log
+    \\ WHERE timestamp >= ?1 AND timestamp < ?2
+    \\ GROUP BY client_ip
+    \\ ORDER BY count(*) DESC, client_ip ASC
+    \\ LIMIT ?3
+;
+
+const stats_clients_buckets_sql =
+    \\SELECT client_ip, (timestamp - ?1) / ?2, count(*)
+    \\  FROM query_log
+    \\ WHERE timestamp >= ?1 AND timestamp < ?3
+    \\ GROUP BY 1, 2
+;
+
+/// Per-client counts over `bucket_count` buckets of `bucket_seconds` starting
+/// at `since`. Everything outside the top `max_client_series` sums into
+/// `other`, so the series still add up to the window's total.
+///
+/// Two statements, one ranking and one bucketing: the caller runs them inside
+/// one read transaction, so the rank and the buckets describe one state.
+pub fn statsClients(
+    database: *db.Db,
+    arena: Allocator,
+    since: i64,
+    bucket_seconds: u32,
+    bucket_count: u32,
+) db.Error!ClientsBreakdown {
+    if (bucket_seconds == 0 or bucket_count == 0) return error.Misuse;
+    const width: i64 = bucket_seconds;
+    const span = std.math.mul(i64, width, bucket_count) catch return error.Misuse;
+    const until = std.math.add(i64, since, span) catch return error.Misuse;
+
+    var names: std.ArrayList([]const u8) = .empty;
+    var series: std.ArrayList([]u64) = .empty;
+    {
+        var stmt = try database.prepare(stats_clients_rank_sql);
+        defer stmt.deinit();
+        try stmt.bindInt(1, since);
+        try stmt.bindInt(2, until);
+        try stmt.bindInt(3, max_client_series);
+
+        while (try stmt.step()) {
+            try names.append(arena, try stmt.columnTextAlloc(arena, 0));
+            try series.append(arena, try zeroedBuckets(arena, bucket_count));
+        }
+    }
+
+    const other = try zeroedBuckets(arena, bucket_count);
+
+    var stmt = try database.prepare(stats_clients_buckets_sql);
+    defer stmt.deinit();
+    try stmt.bindInt(1, since);
+    try stmt.bindInt(2, width);
+    try stmt.bindInt(3, until);
+
+    while (try stmt.step()) {
+        // The WHERE clause bounds the index already; the check keeps a schema
+        // surprise from writing past the slice.
+        const index = std.math.cast(usize, stmt.columnInt(1)) orelse return error.Mismatch;
+        if (index >= bucket_count) return error.Mismatch;
+        const count = try countOf(stmt.columnInt(2));
+
+        const client = stmt.columnText(0);
+        const target = for (names.items, series.items) |name_, buckets| {
+            if (std.mem.eql(u8, name_, client)) break buckets;
+        } else other;
+        target[index] += count;
+    }
+
+    const clients = try arena.alloc(ClientSeries, names.items.len);
+    for (clients, names.items, series.items) |*entry, name_, buckets| {
+        entry.* = .{ .client = name_, .buckets = buckets };
+    }
+    return .{ .clients = clients, .other = other };
+}
+
+fn zeroedBuckets(arena: Allocator, bucket_count: u32) Allocator.Error![]u64 {
+    const buckets = try arena.alloc(u64, bucket_count);
+    @memset(buckets, 0);
+    return buckets;
+}
+
 // ---------------------------------------------------------------------------
 // tests
 // ---------------------------------------------------------------------------
 
+const logger = @import("../logger.zig");
 const querylog_schema = @import("../querylog_schema.zig");
 
 const testing = std.testing;
@@ -1469,7 +1673,6 @@ test "statsTotals aggregates the window and averages only the timed rows" {
     const totals = try statsTotals(&database, 100, 200);
     try testing.expectEqual(@as(u64, 3), totals.queries);
     try testing.expectEqual(@as(u64, 1), totals.blocked);
-    try testing.expectEqual(@as(u64, 1), totals.cached);
     try testing.expectEqual(@as(u64, 2), totals.distinct_clients);
     // (100 + 200) / 2 — the untimed row is not in the divisor.
     try testing.expectEqual(@as(?i64, 150), totals.avg_response_time_us);
@@ -1484,7 +1687,6 @@ test "statsTotals over an empty window is zeros with a null average" {
         const totals = try statsTotals(&database, window[0], window[1]);
         try testing.expectEqual(@as(u64, 0), totals.queries);
         try testing.expectEqual(@as(u64, 0), totals.blocked);
-        try testing.expectEqual(@as(u64, 0), totals.cached);
         try testing.expectEqual(@as(u64, 0), totals.distinct_clients);
         try testing.expectEqual(@as(?i64, null), totals.avg_response_time_us);
     }
@@ -1588,3 +1790,334 @@ test "likePattern wraps the needle and neutralises every metacharacter" {
     try testing.expectEqualStrings("%a\\\\b%", try likePattern(arena, "a\\b"));
     try testing.expectEqualStrings("%%", try likePattern(arena, ""));
 }
+
+// ---------------------------------------------------------------------------
+// period aggregations (milestone 30)
+// ---------------------------------------------------------------------------
+
+const agg_since: i64 = 1_700_000_000;
+const agg_width: u32 = 60;
+const agg_buckets: u32 = 10;
+const agg_until: i64 = agg_since + agg_width * agg_buckets;
+
+/// One row of the aggregation fixtures. Everything the three breakdowns read
+/// is a parameter; everything else is the same on every row, so a test that
+/// changes an outcome names the reason it changed.
+fn aggRow(offset: i64, client: []const u8, qtype: ?u16, kind: provenance.RouteKind, source: ?[]const u8) Row {
+    return .{
+        .timestamp = agg_since + offset,
+        .domain = "example.com",
+        .client_ip = client,
+        .qtype = qtype,
+        .qclass = 1,
+        .rcode = 0,
+        .blocked = kind == .blocked,
+        .response_time_us = 1000,
+        .cache_hit = kind == .cache,
+        .upstream = if (kind == .upstream) source else null,
+        .group_id = 1,
+        .group_name = "default",
+        .policy_action = if (kind == .blocked) .block else .allow,
+        .policy_reason = if (kind == .blocked) .blocklist_domain else .no_match,
+        .matched = null,
+        .source_id = null,
+        // Blocklist provenance, deliberately set on every row: the routes
+        // breakdown must never group by it.
+        .source_name = "StevenBlack",
+        .cname_target = null,
+        .safe_search_target = null,
+        .route_kind = kind,
+        .forward_zone = if (kind == .forward_zone) source else null,
+    };
+}
+
+test "the type breakdown groups by qtype, keeps the null row and orders it last" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+
+    try seed(&database, &.{
+        aggRow(0, "192.0.2.10", 1, .upstream, "9.9.9.9"),
+        aggRow(1, "192.0.2.10", 1, .upstream, "9.9.9.9"),
+        aggRow(2, "192.0.2.10", 1, .upstream, "9.9.9.9"),
+        aggRow(3, "192.0.2.10", 28, .upstream, "9.9.9.9"),
+        aggRow(4, "192.0.2.10", 28, .upstream, "9.9.9.9"),
+        // Ties with qtype 28, so the tie-break puts the lower code first.
+        aggRow(5, "192.0.2.10", 16, .upstream, "9.9.9.9"),
+        aggRow(6, "192.0.2.10", 16, .upstream, "9.9.9.9"),
+        // A row with no type at all: its own group, never a dropped row.
+        aggRow(7, "192.0.2.10", null, .upstream, "9.9.9.9"),
+        aggRow(8, "192.0.2.10", null, .upstream, "9.9.9.9"),
+        // Outside the window.
+        aggRow(-1, "192.0.2.10", 255, .upstream, "9.9.9.9"),
+    });
+
+    const rows = (try statsTypes(&database, arena, agg_since, agg_until)).items;
+    try testing.expectEqual(@as(usize, 4), rows.len);
+    try testing.expectEqual(@as(?u16, 1), rows[0].qtype);
+    try testing.expectEqual(@as(u64, 3), rows[0].count);
+    try testing.expectEqual(@as(?u16, 16), rows[1].qtype);
+    try testing.expectEqual(@as(?u16, 28), rows[2].qtype);
+    try testing.expectEqual(@as(?u16, null), rows[3].qtype);
+    try testing.expectEqual(@as(u64, 2), rows[3].count);
+}
+
+test "an empty window has no type rows at all" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const rows = (try statsTypes(&database, arena_state.allocator(), agg_since, agg_until)).items;
+    try testing.expectEqual(@as(usize, 0), rows.len);
+}
+
+test "the route breakdown keys on the answering resolver, not on blocklist provenance" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+
+    try seed(&database, &.{
+        aggRow(0, "192.0.2.10", 1, .upstream, "https://a.example/dns-query"),
+        aggRow(1, "192.0.2.10", 1, .upstream, "https://a.example/dns-query"),
+        aggRow(2, "192.0.2.10", 1, .upstream, "https://b.example/dns-query"),
+        // An upstream row whose resolver the log did not record: its own group.
+        aggRow(3, "192.0.2.10", 1, .upstream, null),
+        aggRow(4, "192.0.2.10", 1, .forward_zone, "lan"),
+        aggRow(5, "192.0.2.10", 1, .blocked, null),
+        aggRow(6, "192.0.2.10", 1, .cache, null),
+        aggRow(7, "192.0.2.10", 1, .local, null),
+        aggRow(8, "192.0.2.10", 1, .rejected, null),
+    });
+
+    const rows = (try statsRoutes(&database, arena, agg_since, agg_until)).items;
+    // Two upstreams, one null-source upstream, one forward zone and four
+    // source-less kinds. Every row carries the same `source_name`, so a
+    // breakdown that grouped by it would collapse to one row.
+    try testing.expectEqual(@as(usize, 8), rows.len);
+
+    try testing.expectEqual(provenance.RouteKind.upstream, rows[0].route);
+    try testing.expectEqualStrings("https://a.example/dns-query", rows[0].source.?);
+    try testing.expectEqual(@as(u64, 2), rows[0].count);
+
+    // The seven remaining rows all count 1, so the tie-break orders them:
+    // route ascending, then source ascending with nulls last.
+    for (rows[1..]) |row| try testing.expectEqual(@as(u64, 1), row.count);
+    try testing.expectEqual(provenance.RouteKind.blocked, rows[1].route);
+    try testing.expectEqual(@as(?[]const u8, null), rows[1].source);
+    try testing.expectEqual(provenance.RouteKind.cache, rows[2].route);
+    try testing.expectEqual(provenance.RouteKind.forward_zone, rows[3].route);
+    try testing.expectEqualStrings("lan", rows[3].source.?);
+    try testing.expectEqual(provenance.RouteKind.local, rows[4].route);
+    try testing.expectEqual(provenance.RouteKind.rejected, rows[5].route);
+    try testing.expectEqual(provenance.RouteKind.upstream, rows[6].route);
+    try testing.expectEqualStrings("https://b.example/dns-query", rows[6].source.?);
+    try testing.expectEqual(provenance.RouteKind.upstream, rows[7].route);
+    try testing.expectEqual(@as(?[]const u8, null), rows[7].source);
+}
+
+test "an empty window has no route rows at all" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const rows = (try statsRoutes(&database, arena_state.allocator(), agg_since, agg_until)).items;
+    try testing.expectEqual(@as(usize, 0), rows.len);
+}
+
+test "an empty window still has a zero-filled other series and no named clients" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const result = try statsClients(&database, arena_state.allocator(), agg_since, agg_width, agg_buckets);
+    try testing.expectEqual(@as(usize, 0), result.clients.len);
+    try testing.expectEqual(@as(usize, agg_buckets), result.other.len);
+    for (result.other) |count| try testing.expectEqual(@as(u64, 0), count);
+}
+
+test "client series are bucket-aligned, zero-filled and ranked by in-window total" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    try seed(&database, &.{
+        aggRow(0, "192.0.2.20", 1, .upstream, "9.9.9.9"),
+        aggRow(1, "192.0.2.20", 1, .upstream, "9.9.9.9"),
+        aggRow(agg_width * 3, "192.0.2.20", 1, .upstream, "9.9.9.9"),
+        aggRow(agg_width * 3, "192.0.2.10", 1, .upstream, "9.9.9.9"),
+        // Outside the window on both sides.
+        aggRow(-1, "192.0.2.20", 1, .upstream, "9.9.9.9"),
+        aggRow(agg_width * agg_buckets, "192.0.2.10", 1, .upstream, "9.9.9.9"),
+    });
+
+    const result = try statsClients(&database, arena_state.allocator(), agg_since, agg_width, agg_buckets);
+    try testing.expectEqual(@as(usize, 2), result.clients.len);
+    try testing.expectEqualStrings("192.0.2.20", result.clients[0].client);
+    try testing.expectEqualStrings("192.0.2.10", result.clients[1].client);
+
+    for (result.clients) |series| try testing.expectEqual(@as(usize, agg_buckets), series.buckets.len);
+    try testing.expectEqual(@as(u64, 2), result.clients[0].buckets[0]);
+    try testing.expectEqual(@as(u64, 1), result.clients[0].buckets[3]);
+    try testing.expectEqual(@as(u64, 0), result.clients[0].buckets[9]);
+    try testing.expectEqual(@as(u64, 1), result.clients[1].buckets[3]);
+    for (result.other) |count| try testing.expectEqual(@as(u64, 0), count);
+}
+
+test "the ninth client folds into other and the cut is the same on every read" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+
+    // Nine clients, each with one more query than the next, so the ranking is
+    // total and the ninth is unambiguously the one that folds.
+    var address: [16]u8 = undefined;
+    var index: u32 = 0;
+    while (index < 9) : (index += 1) {
+        const client = try std.fmt.bufPrint(&address, "192.0.2.{d}", .{100 + index});
+        var repeat: u32 = 0;
+        while (repeat <= index) : (repeat += 1) {
+            try seed(&database, &.{aggRow(@intCast(repeat), client, 1, .upstream, "9.9.9.9")});
+        }
+    }
+
+    const result = try statsClients(&database, arena, agg_since, agg_width, agg_buckets);
+    try testing.expectEqual(@as(usize, max_client_series), result.clients.len);
+    // The busiest is 192.0.2.108 with nine rows; the lone folded client is
+    // 192.0.2.100 with one.
+    try testing.expectEqualStrings("192.0.2.108", result.clients[0].client);
+    for (result.clients) |series| {
+        try testing.expect(!std.mem.eql(u8, "192.0.2.100", series.client));
+    }
+
+    var other_total: u64 = 0;
+    for (result.other) |count| other_total += count;
+    try testing.expectEqual(@as(u64, 1), other_total);
+}
+
+test "the three breakdowns conserve the window's total" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+    const arena = arena_state.allocator();
+
+    // A matrix that exercises every branch the aggregations partition on: null
+    // and non-null qtypes, every route kind, a null resolver identity, and ten
+    // clients so the top-eight cut has a residual to carry.
+    const kinds = [_]provenance.RouteKind{ .blocked, .local, .forward_zone, .upstream, .cache, .rejected };
+    var address: [16]u8 = undefined;
+    var index: u32 = 0;
+    while (index < 40) : (index += 1) {
+        const client = try std.fmt.bufPrint(&address, "192.0.2.{d}", .{100 + index % 10});
+        const kind = kinds[index % kinds.len];
+        try seed(&database, &.{aggRow(
+            @intCast(index % (agg_width * agg_buckets)),
+            client,
+            if (index % 7 == 0) null else @intCast(1 + index % 3),
+            kind,
+            if (index % 11 == 0) null else "9.9.9.9",
+        )});
+    }
+
+    const totals = try statsTotals(&database, agg_since, agg_until);
+    try testing.expect(totals.queries > 0);
+
+    var typed: u64 = 0;
+    for ((try statsTypes(&database, arena, agg_since, agg_until)).items) |row| typed += row.count;
+    try testing.expectEqual(totals.queries, typed);
+
+    var routed: u64 = 0;
+    for ((try statsRoutes(&database, arena, agg_since, agg_until)).items) |row| routed += row.count;
+    try testing.expectEqual(totals.queries, routed);
+
+    var buckets: [agg_buckets]Bucket = undefined;
+    _ = try timeseries(&database, agg_since, agg_width, &buckets);
+    const clients = try statsClients(&database, arena, agg_since, agg_width, agg_buckets);
+    // Per bucket, not just in total: a series misaligned by one bucket would
+    // still sum correctly over the window.
+    for (buckets, 0..) |bucket, at| {
+        var summed: u64 = clients.other[at];
+        for (clients.clients) |series| summed += series.buckets[at];
+        try testing.expectEqual(bucket.queries, summed);
+    }
+}
+
+test "the aggregations pass a redacted client through as the log stored it" {
+    var database = try openLog();
+    defer database.close();
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    // `hide_client_ips` is applied by the logger before the row is written, so
+    // the read path has nothing to transform — and must not invent anything
+    // either. The marker is the client's whole identity here.
+    try seed(&database, &.{
+        aggRow(0, logger.hidden_marker, 1, .upstream, "9.9.9.9"),
+        aggRow(1, logger.hidden_marker, 1, .upstream, "9.9.9.9"),
+    });
+
+    const result = try statsClients(&database, arena_state.allocator(), agg_since, agg_width, agg_buckets);
+    try testing.expectEqual(@as(usize, 1), result.clients.len);
+    try testing.expectEqualStrings(logger.hidden_marker, result.clients[0].client);
+    try testing.expectEqual(@as(u64, 2), result.clients[0].buckets[0]);
+}
+
+test "a prune committed mid-read is invisible to the reader's transaction" {
+    var tmp = testing.tmpDir(.{});
+    defer tmp.cleanup();
+
+    var path_buf: [tmp_prefix.len + sub_path_len + 32]u8 = undefined;
+    const path = try std.fmt.bufPrintZ(&path_buf, "{s}{s}/querylog.db", .{ tmp_prefix, &tmp.sub_path });
+
+    var reader = try db.Db.open(path, .{ .mode = .read_write_create });
+    defer reader.close();
+    try db.applyPragmas(&reader, .{});
+    try reader.exec(querylog_schema.ddl);
+    // The seeded watermark is the file's creation second, which is now; the
+    // fixtures below are in 2023, so the prune's cutoff would never advance it.
+    try reader.exec(
+        \\UPDATE querylog_meta SET created_at = 1700000000, available_since = 1700000000 WHERE id = 1
+    );
+    try seed(&reader, &.{
+        plainRow(agg_since, "a.example"),
+        plainRow(agg_since + 1, "b.example"),
+        plainRow(agg_since + 300, "c.example"),
+    });
+
+    // A second connection to the same file, as retention has in production.
+    var pruner = try db.Db.open(path, .{ .mode = .read_write_create });
+    defer pruner.close();
+    try db.applyPragmas(&pruner, .{});
+
+    var tx = try db.ReadTx.begin(&reader);
+    const before = try statsTotals(&reader, agg_since, agg_since + 1000);
+    const watermark_before = try availableSince(&reader);
+    try testing.expectEqual(@as(u64, 3), before.queries);
+
+    // The prune commits while the reader's transaction is open.
+    const pruned = try pruneOlderThan(&pruner, agg_since + 200);
+    try testing.expectEqual(@as(i64, 2), pruned.deleted);
+    try testing.expect(pruned.available_since > watermark_before);
+
+    // Neither half of the answer moved: the rows the reader would report and
+    // the watermark it would tag them with still describe one state.
+    const during = try statsTotals(&reader, agg_since, agg_since + 1000);
+    try testing.expectEqual(before.queries, during.queries);
+    try testing.expectEqual(watermark_before, try availableSince(&reader));
+    try tx.commit();
+
+    // The next response sees the prune — both halves of it.
+    const after = try statsTotals(&reader, agg_since, agg_since + 1000);
+    try testing.expectEqual(@as(u64, 1), after.queries);
+    try testing.expectEqual(pruned.available_since, try availableSince(&reader));
+}

src/storage/repositories/upstream_history_repo.zig

@@ -1,493 +0,0 @@
-//! `upstream_minute` and its `upstream_targets` dimension table in
-//! `querylog.db` (milestone-26 rulings 2, 4, 5).
-//!
-//! One row per upstream per wall-clock UTC minute that had at least one
-//! attempt. Rows are additive facts: a flush adds to whatever is already there,
-//! so a restart inside a minute continues that minute's row rather than
-//! replacing it, and nothing here can lower a stored count.
-//!
-//! Identity is the url, not the `config.db` upstream id: ids cannot be foreign
-//! keys across database files and may be deleted or reused. Editing an
-//! upstream's url deliberately starts a new history.
-//!
-//! Nothing here retries. The accumulator owns what a failed flush means
-//! (`upstream/history.zig`).
-
-const std = @import("std");
-
-const db = @import("../db.zig");
-const health = @import("../../upstream/health.zig");
-
-/// How far back `Retention` keeps minute rows. A fixed window, not a knob
-/// (m26 anti-requirements), and deliberately wider than the widest dashboard
-/// period: `stats.window` derives `since = until - width * count` with
-/// `until > now`, so a 30-day window never asks for anything older than
-/// `now - 30d`. The extra day is slack for a retention pass that runs late.
-///
-/// `logging.retention_days` does not apply here. It bounds the query log, whose
-/// rows are per-query; these are per-minute aggregates whose whole purpose is
-/// to outlive them.
-pub const retention_window_s: i64 = 31 * 86_400;
-
-/// One minute of one upstream's outcomes, as the accumulator hands it over.
-/// Every string is borrowed for the duration of the call: `Stmt.bindText` binds
-/// with `SQLITE_TRANSIENT`, so SQLite copies before `flush` returns.
-pub const FlushRow = struct {
-    url: []const u8,
-    minute_ts: i64,
-    successes: u32,
-    failures: u32,
-    last_failure_ts: ?i64,
-    /// Empty when the minute held no failure.
-    last_error: []const u8,
-};
-
-const insert_target_sql = "INSERT OR IGNORE INTO upstream_targets (url) VALUES (?1)";
-
-const select_target_sql = "SELECT id FROM upstream_targets WHERE url = ?1";
-
-/// Additive, and the timestamp columns are max-wins, which is what makes a
-/// flush safe to repeat against a row another process already wrote.
-///
-/// `max()` over a NULL is NULL in SQLite, so the coalesce is what keeps an
-/// existing `last_failure_ts` when the incoming row carries none. The `CASE`
-/// moves `last_error` with the timestamp it belongs to: a success-only upsert
-/// leaves the stored failure and its name exactly as they were.
-const upsert_minute_sql =
-    \\INSERT INTO upstream_minute (upstream_id, minute_ts, successes, failures, last_failure_ts, last_error)
-    \\VALUES (?1, ?2, ?3, ?4, ?5, ?6)
-    \\ON CONFLICT(upstream_id, minute_ts) DO UPDATE SET
-    \\    successes = successes + excluded.successes,
-    \\    failures = failures + excluded.failures,
-    \\    last_failure_ts = coalesce(max(last_failure_ts, excluded.last_failure_ts), last_failure_ts, excluded.last_failure_ts),
-    \\    last_error = CASE
-    \\        WHEN excluded.last_failure_ts IS NOT NULL
-    \\         AND (last_failure_ts IS NULL OR excluded.last_failure_ts >= last_failure_ts)
-    \\        THEN excluded.last_error
-    \\        ELSE last_error
-    \\    END
-;
-
-/// One transaction for the whole batch: either every minute of the pass lands
-/// or none of it does, so a failed flush leaves nothing half-written for the
-/// caller's merge-back to double-count.
-pub fn flush(database: *db.Db, rows: []const FlushRow) db.Error!void {
-    if (rows.len == 0) return;
-
-    var insert_target = try database.prepare(insert_target_sql);
-    defer insert_target.deinit();
-    var select_target = try database.prepare(select_target_sql);
-    defer select_target.deinit();
-    var upsert = try database.prepare(upsert_minute_sql);
-    defer upsert.deinit();
-
-    var tx = try db.Tx.begin(database);
-    errdefer tx.rollback();
-
-    for (rows) |row| {
-        const upstream_id = try internTarget(&insert_target, &select_target, row.url);
-
-        try upsert.reset();
-        try upsert.bindInt(1, upstream_id);
-        try upsert.bindInt(2, row.minute_ts);
-        try upsert.bindInt(3, row.successes);
-        try upsert.bindInt(4, row.failures);
-        if (row.last_failure_ts) |at| try upsert.bindInt(5, at) else try upsert.bindNull(5);
-        try upsert.bindText(6, row.last_error);
-        try upsert.exec();
-    }
-
-    try tx.commit();
-}
-
-fn internTarget(insert: *db.Stmt, select: *db.Stmt, url: []const u8) db.Error!i64 {
-    try insert.reset();
-    try insert.bindText(1, url);
-    try insert.exec();
-
-    try select.reset();
-    try select.bindText(1, url);
-    // The insert above either created the row or found it already there, so a
-    // miss means the table changed under this connection.
-    if (!try select.step()) return error.NotFound;
-    const id = select.columnInt(0);
-    // A statement stopped on a row keeps its cursor open until it is reset;
-    // the transaction must not carry that to the next row.
-    try select.reset();
-    return id;
-}
-
-/// What `GET /api/upstream/health` reports for one upstream over one window.
-pub const WindowStats = struct {
-    attempts: u64,
-    successes: u64,
-    failures: u64,
-    last_failure_ts: ?i64,
-    /// The error name of the row holding the newest `last_failure_ts` in the
-    /// window; empty when the window holds no failure.
-    ///
-    /// By value rather than by slice: the caller loops over upstreams and
-    /// reuses one `WindowStats`, so a borrowed slice would dangle into the
-    /// storage the next iteration overwrites.
-    last_failure_error_buf: [health.error_name_capacity]u8,
-    last_failure_error_len: u8,
-
-    pub fn lastFailureError(self: *const WindowStats) []const u8 {
-        return self.last_failure_error_buf[0..self.last_failure_error_len];
-    }
-};
-
-/// **One statement, deliberately.** Two statements would not share a SQLite
-/// snapshot: the flush connection can commit between them, and the read would
-/// then pair a `max(last_failure_ts)` taken from one state with an error text
-/// taken from another.
-///
-/// The error lookup is a scalar subquery for the same reason it is not a bare
-/// column: `SELECT max(last_failure_ts), last_error` lets SQLite return the
-/// `last_error` of an arbitrary row of the group. `ORDER BY ... DESC, minute_ts
-/// DESC` makes the choice deterministic when two minutes share a timestamp.
-const window_stats_sql =
-    \\SELECT coalesce(sum(m.successes), 0), coalesce(sum(m.failures), 0), max(m.last_failure_ts),
-    \\       (SELECT e.last_error FROM upstream_minute e
-    \\        WHERE e.upstream_id = m.upstream_id AND e.minute_ts >= ?2 AND e.minute_ts < ?3
-    \\          AND e.last_failure_ts IS NOT NULL
-    \\        ORDER BY e.last_failure_ts DESC, e.minute_ts DESC LIMIT 1)
-    \\  FROM upstream_minute m JOIN upstream_targets t ON t.id = m.upstream_id
-    \\ WHERE t.url = ?1 AND m.minute_ts >= ?2 AND m.minute_ts < ?3
-;
-
-/// Aggregates `[since, until)` by `minute_ts`. An unknown url or an empty
-/// window is zeros, a null timestamp and the empty error — not an error.
-pub fn windowStats(database: *db.Db, url: []const u8, since: i64, until: i64) db.Error!WindowStats {
-    var stmt = try database.prepare(window_stats_sql);
-    defer stmt.deinit();
-    try stmt.bindText(1, url);
-    try stmt.bindInt(2, since);
-    try stmt.bindInt(3, until);
-
-    // A bare aggregate always produces exactly one row; no row means the
-    // statement is not the one this function prepared.
-    if (!try stmt.step()) return error.Misuse;
-
-    const successes = try countOf(stmt.columnInt(0));
-    const failures = try countOf(stmt.columnInt(1));
-
-    var out: WindowStats = .{
-        .attempts = successes + failures,
-        .successes = successes,
-        .failures = failures,
-        .last_failure_ts = if (stmt.isNull(2)) null else stmt.columnInt(2),
-        .last_failure_error_buf = @splat(0),
-        .last_failure_error_len = 0,
-    };
-    const name = stmt.columnText(3);
-    const copied = @min(name.len, out.last_failure_error_buf.len);
-    @memcpy(out.last_failure_error_buf[0..copied], name[0..copied]);
-    out.last_failure_error_len = @intCast(copied);
-    return out;
-}
-
-/// `sum` over `CHECK (… >= 0)` columns cannot go negative; a negative value
-/// means the row came from something other than this schema.
-fn countOf(value: i64) db.Error!u64 {
-    if (value < 0) return error.Mismatch;
-    return @intCast(value);
-}
-
-/// Deletes every `upstream_minute` row strictly older than `cutoff_ts`, then
-/// the targets no surviving row references, and returns how many **minute**
-/// rows went.
-///
-/// One transaction: a target dropped without its rows, or rows dropped while
-/// the target delete failed, would leave the foreign key pointing at nothing.
-/// The count is minute rows only, so the metric an operator watches counts
-/// aggregates rather than dimension-table housekeeping.
-pub fn pruneOlderThan(database: *db.Db, cutoff_ts: i64) db.Error!i64 {
-    var tx = try db.Tx.begin(database);
-    errdefer tx.rollback();
-
-    var minutes = try database.prepare("DELETE FROM upstream_minute WHERE minute_ts < ?1");
-    defer minutes.deinit();
-    try minutes.bindInt(1, cutoff_ts);
-    try minutes.exec();
-    const deleted = database.changes();
-
-    try database.exec(
-        \\DELETE FROM upstream_targets
-        \\ WHERE id NOT IN (SELECT upstream_id FROM upstream_minute);
-    );
-
-    try tx.commit();
-    return deleted;
-}
-
-pub fn countMinutes(database: *db.Db) db.Error!i64 {
-    return database.queryInt("SELECT count(*) FROM upstream_minute");
-}
-
-pub fn countTargets(database: *db.Db) db.Error!i64 {
-    return database.queryInt("SELECT count(*) FROM upstream_targets");
-}
-
-// ---------------------------------------------------------------------------
-// tests
-// ---------------------------------------------------------------------------
-
-const querylog_schema = @import("../querylog_schema.zig");
-
-const testing = std.testing;
-
-fn openLog() !db.Db {
-    var database = try db.Db.open(":memory:", .{ .mode = .memory });
-    errdefer database.close();
-    try db.applyPragmas(&database, .{});
-    try database.exec(querylog_schema.ddl);
-    return database;
-}
-
-/// `columnText` is borrowed until the statement is finalized, so the stored
-/// error name is copied out rather than returned as a slice.
-const StoredMinute = struct {
-    successes: u32,
-    failures: u32,
-    last_failure_ts: ?i64,
-    error_buf: [health.error_name_capacity]u8,
-    error_len: u8,
-
-    fn lastError(self: *const StoredMinute) []const u8 {
-        return self.error_buf[0..self.error_len];
-    }
-};
-
-fn readMinute(database: *db.Db, url: []const u8, minute_ts: i64) !StoredMinute {
-    var stmt = try database.prepare(
-        \\SELECT m.successes, m.failures, m.last_failure_ts, m.last_error
-        \\  FROM upstream_minute m JOIN upstream_targets t ON t.id = m.upstream_id
-        \\ WHERE t.url = ?1 AND m.minute_ts = ?2
-    );
-    defer stmt.deinit();
-    try stmt.bindText(1, url);
-    try stmt.bindInt(2, minute_ts);
-    try testing.expect(try stmt.step());
-    var out: StoredMinute = .{
-        .successes = @intCast(stmt.columnInt(0)),
-        .failures = @intCast(stmt.columnInt(1)),
-        .last_failure_ts = if (stmt.isNull(2)) null else stmt.columnInt(2),
-        .error_buf = @splat(0),
-        .error_len = 0,
-    };
-    const name = stmt.columnText(3);
-    @memcpy(out.error_buf[0..name.len], name);
-    out.error_len = @intCast(name.len);
-    return out;
-}
-
-test "the upsert adds to the row already there rather than replacing it" {
-    var database = try openLog();
-    defer database.close();
-
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 3, .failures = 1, .last_failure_ts = 70, .last_error = "Timeout" },
-    });
-    // The shape a restart inside one minute takes: a second process writes the
-    // same (url, minute) and the counts continue.
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 2, .failures = 4, .last_failure_ts = 90, .last_error = "ConnectFailed" },
-    });
-
-    const row = try readMinute(&database, "https://a.example", 60);
-    try testing.expectEqual(@as(u32, 5), row.successes);
-    try testing.expectEqual(@as(u32, 5), row.failures);
-    try testing.expectEqual(@as(?i64, 90), row.last_failure_ts);
-    try testing.expectEqualStrings("ConnectFailed", row.lastError());
-    // One row and one target, not two of either.
-    try testing.expectEqual(@as(i64, 1), try countMinutes(&database));
-    try testing.expectEqual(@as(i64, 1), try countTargets(&database));
-}
-
-test "a success-only upsert keeps the failure timestamp and its error" {
-    var database = try openLog();
-    defer database.close();
-
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 0, .failures = 1, .last_failure_ts = 70, .last_error = "Timeout" },
-    });
-    // `max()` over a NULL is NULL in SQLite, so without the coalesce this
-    // upsert would erase the timestamp it knows nothing about.
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 5, .failures = 0, .last_failure_ts = null, .last_error = "" },
-    });
-
-    const row = try readMinute(&database, "https://a.example", 60);
-    try testing.expectEqual(@as(u32, 5), row.successes);
-    try testing.expectEqual(@as(u32, 1), row.failures);
-    try testing.expectEqual(@as(?i64, 70), row.last_failure_ts);
-    try testing.expectEqualStrings("Timeout", row.lastError());
-}
-
-test "an older failure does not overwrite the newer error already stored" {
-    var database = try openLog();
-    defer database.close();
-
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 0, .failures = 1, .last_failure_ts = 90, .last_error = "Timeout" },
-    });
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 0, .failures = 1, .last_failure_ts = 70, .last_error = "ConnectFailed" },
-    });
-
-    const row = try readMinute(&database, "https://a.example", 60);
-    try testing.expectEqual(@as(?i64, 90), row.last_failure_ts);
-    try testing.expectEqualStrings("Timeout", row.lastError());
-}
-
-test "flush interns each url once and writes every minute of the batch" {
-    var database = try openLog();
-    defer database.close();
-
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-        .{ .url = "https://a.example", .minute_ts = 120, .successes = 2, .failures = 0, .last_failure_ts = null, .last_error = "" },
-        .{ .url = "https://b.example", .minute_ts = 60, .successes = 3, .failures = 0, .last_failure_ts = null, .last_error = "" },
-    });
-
-    try testing.expectEqual(@as(i64, 3), try countMinutes(&database));
-    try testing.expectEqual(@as(i64, 2), try countTargets(&database));
-
-    // An empty batch opens no transaction: one is already open here, so a
-    // `BEGIN IMMEDIATE` would fail.
-    var tx = try db.Tx.begin(&database);
-    try flush(&database, &.{});
-    tx.rollback();
-}
-
-test "windowStats sums only the window and pairs the newest failure with its own error" {
-    var database = try openLog();
-    defer database.close();
-
-    try flush(&database, &.{
-        // Before the window.
-        .{ .url = "https://a.example", .minute_ts = 0, .successes = 9, .failures = 9, .last_failure_ts = 30, .last_error = "Outside" },
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 2, .failures = 1, .last_failure_ts = 100, .last_error = "ConnectFailed" },
-        .{ .url = "https://a.example", .minute_ts = 120, .successes = 4, .failures = 2, .last_failure_ts = 170, .last_error = "Timeout" },
-        // A later minute with no failure at all: the error must still come from
-        // the minute holding the newest `last_failure_ts`, not from this one.
-        .{ .url = "https://a.example", .minute_ts = 180, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-        // At the exclusive end of the window.
-        .{ .url = "https://a.example", .minute_ts = 240, .successes = 7, .failures = 7, .last_failure_ts = 250, .last_error = "After" },
-        // A different upstream in the same minutes.
-        .{ .url = "https://b.example", .minute_ts = 120, .successes = 5, .failures = 5, .last_failure_ts = 175, .last_error = "Other" },
-    });
-
-    const stats = try windowStats(&database, "https://a.example", 60, 240);
-    try testing.expectEqual(@as(u64, 7), stats.successes);
-    try testing.expectEqual(@as(u64, 3), stats.failures);
-    try testing.expectEqual(@as(u64, 10), stats.attempts);
-    try testing.expectEqual(@as(?i64, 170), stats.last_failure_ts);
-    try testing.expectEqualStrings("Timeout", stats.lastFailureError());
-}
-
-test "two minutes sharing the newest failure timestamp resolve to the later minute" {
-    // The tiebreak the subquery's ORDER BY owns. `max(last_failure_ts)` alone
-    // cannot choose between these two rows, so without a deterministic second
-    // key the answer is whichever row SQLite happened to visit.
-    var database = try openLog();
-    defer database.close();
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 0, .failures = 1, .last_failure_ts = 100, .last_error = "Earlier" },
-        .{ .url = "https://a.example", .minute_ts = 120, .successes = 0, .failures = 1, .last_failure_ts = 100, .last_error = "Later" },
-    });
-
-    const stats = try windowStats(&database, "https://a.example", 0, 1000);
-    try testing.expectEqual(@as(?i64, 100), stats.last_failure_ts);
-    try testing.expectEqualStrings("Later", stats.lastFailureError());
-}
-
-test "windowStats over an unknown url or an empty window is zeros and no error" {
-    var database = try openLog();
-    defer database.close();
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 1, .failures = 1, .last_failure_ts = 70, .last_error = "Timeout" },
-    });
-
-    for ([_][3]i64{ .{ 0, 60, 0 }, .{ 120, 180, 0 }, .{ 60, 60, 0 } }) |window| {
-        const stats = try windowStats(&database, "https://a.example", window[0], window[1]);
-        try testing.expectEqual(@as(u64, 0), stats.attempts);
-        try testing.expectEqual(@as(u64, 0), stats.successes);
-        try testing.expectEqual(@as(u64, 0), stats.failures);
-        try testing.expectEqual(@as(?i64, null), stats.last_failure_ts);
-        try testing.expectEqualStrings("", stats.lastFailureError());
-    }
-
-    const unknown = try windowStats(&database, "https://never.example", 0, 1000);
-    try testing.expectEqual(@as(u64, 0), unknown.attempts);
-    try testing.expectEqual(@as(?i64, null), unknown.last_failure_ts);
-    try testing.expectEqualStrings("", unknown.lastFailureError());
-}
-
-test "a window whose only failures are outside it reports no failure at all" {
-    var database = try openLog();
-    defer database.close();
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 0, .successes = 0, .failures = 1, .last_failure_ts = 30, .last_error = "Timeout" },
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 4, .failures = 0, .last_failure_ts = null, .last_error = "" },
-    });
-
-    const stats = try windowStats(&database, "https://a.example", 60, 120);
-    try testing.expectEqual(@as(u64, 4), stats.attempts);
-    try testing.expectEqual(@as(?i64, null), stats.last_failure_ts);
-    try testing.expectEqualStrings("", stats.lastFailureError());
-}
-
-test "pruneOlderThan counts minute rows only and drops the orphaned target" {
-    var database = try openLog();
-    defer database.close();
-
-    try flush(&database, &.{
-        .{ .url = "https://old.example", .minute_ts = 60, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-        .{ .url = "https://old.example", .minute_ts = 120, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-        .{ .url = "https://kept.example", .minute_ts = 120, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-        .{ .url = "https://kept.example", .minute_ts = 300, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-    });
-
-    // Three minute rows go; the two target deletes must not join the count.
-    try testing.expectEqual(@as(i64, 3), try pruneOlderThan(&database, 300));
-    try testing.expectEqual(@as(i64, 1), try countMinutes(&database));
-    // "old.example" has nothing left, "kept.example" still does.
-    try testing.expectEqual(@as(i64, 1), try countTargets(&database));
-
-    // The row exactly at the cutoff stays, and a second pass finds nothing.
-    try testing.expectEqual(@as(i64, 0), try pruneOlderThan(&database, 300));
-    try testing.expectEqual(@as(i64, 1), try countMinutes(&database));
-}
-
-test "a failed prune leaves both tables as they were" {
-    var database = try openLog();
-    defer database.close();
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 1, .failures = 0, .last_failure_ts = null, .last_error = "" },
-    });
-    try database.exec(
-        \\CREATE TRIGGER refuse_target_delete BEFORE DELETE ON upstream_targets
-        \\BEGIN SELECT RAISE(ABORT, 'refused'); END;
-    );
-
-    // The minute delete succeeds and the target delete does not; one
-    // transaction means neither survives.
-    try testing.expectError(error.Constraint, pruneOlderThan(&database, 300));
-    try testing.expectEqual(@as(i64, 1), try countMinutes(&database));
-    try testing.expectEqual(@as(i64, 1), try countTargets(&database));
-}
-
-test "an error name longer than the buffer is truncated, not overflowed" {
-    var database = try openLog();
-    defer database.close();
-    const long = "A" ** 200;
-    try flush(&database, &.{
-        .{ .url = "https://a.example", .minute_ts = 60, .successes = 0, .failures = 1, .last_failure_ts = 70, .last_error = long },
-    });
-
-    const stats = try windowStats(&database, "https://a.example", 60, 120);
-    try testing.expectEqual(@as(usize, health.error_name_capacity), stats.lastFailureError().len);
-    try testing.expectEqualStrings(long[0..health.error_name_capacity], stats.lastFailureError());
-}