overview: one endpoint, live projections and a response cache (m36)

CHANGELOG.md

@@ -4,7 +4,15 @@ All notable changes to nxdns are recorded here. The format follows [Keep a Chang
 
 Sections are written by hand. Nothing here is generated from commit messages: the point of the file is to say what changed for an operator, which a commit subject rarely does.
 
-## [0.0.11] - 2026-08-24
+## [0.0.12] - 2026-08-27
+
+Overview stops re-reading the whole query log. One endpoint, one snapshot, pre-aggregated buckets — a 30-day view now costs the same on a month of history as on a day of it. Read the upgrade note first: it resets your query history.
+
+### Changed
+
+- **Upgrading resets your query history.** The query-log schema gains the aggregate tables described below, and `querylog.db` is never migrated: the first start after the upgrade sets the old file aside (kept on disk next to the new one, named with the reason) and begins a fresh log. Settings, groups, blocklists and every other configuration are untouched.
+- **The Overview is served by one endpoint, `GET /api/overview`.** It replaces `GET /api/stats`, `/api/stats/timeseries`, `/api/stats/types`, `/api/stats/routes` and `/api/stats/clients`, which are gone. The five panels now come from a single database snapshot, so they can no longer disagree with each other, and the page shows one loading and one error state instead of five.
+- **Query statistics are pre-aggregated as they are written.** The query log now maintains 30-minute aggregate tables in the same transaction that stores the rows, and the 24-hour, 7-day and 30-day views read those instead of scanning every logged query. The cost of opening the Overview no longer grows with the size of the log: measured at three million rows, the 30-day view went from roughly eight-tenths of a second of scanning to under fifty milliseconds, at the price of about ten percent on each background write batch and ~1.5 MB of disk. The server also keeps the most recent response per period in memory and serves repeat polls from it while nothing has changed — until new queries land, retention prunes, or the period's time window rolls forward — so on a quiet network most of the steady 30-second refreshes do no database work at all.
 
 The Overview charts move to visx and grow up: one hover treatment across all four, honest labels, and maintained d3 math under the app's own rendering.
 

PLAN.md

@@ -238,7 +238,7 @@ src/
   web/
     server.zig  router.zig  auth.zig  sse.zig  static.zig  metrics.zig  openapi.zig
     handlers/
-      auth.zig  stats.zig  queries.zig  clients.zig  groups.zig  blocklists.zig
+      auth.zig  overview.zig  queries.zig  clients.zig  groups.zig  blocklists.zig
       rules.zig  local.zig  lookup.zig  pause.zig  settings.zig
       upstream_health.zig  certs.zig  health.zig  version.zig
 
@@ -484,6 +484,8 @@ CREATE INDEX idx_query_log_client ON query_log(client_ip);
 CREATE INDEX idx_query_log_domain ON query_log(domain_id);
 ```
 
+The sketch above is the original shape; `src/storage/querylog_schema.zig` is the authority, and the provenance columns milestone 28 added are not repeated here. Beside the raw rows the file carries four projection tables — `bucket_totals`, `bucket_clients`, `bucket_types`, `bucket_routes` — on a 30-minute grain, which is what `GET /api/overview` reads for the 24h, 7d and 30d windows instead of scanning every row. They are maintained by the batch writer and by retention inside the same transaction as the raw rows, so SQLite's transaction is the whole coherence story: no second file, no backfill, no rebuild command. The 1h window is narrower than the grain and takes one raw scan.
+
 ### 11.4 Query Logger
 
 - In-memory buffer, mutex guarded, hard cap `query_log_buffer_max` (default 10000).
@@ -493,7 +495,7 @@ CREATE INDEX idx_query_log_domain ON query_log(domain_id);
 
 ### 11.5 Retention
 
-Periodic delete of rows older than `retention_days`; scheduled checkpoint/VACUUM on `querylog.db` only.
+Periodic delete of rows older than `retention_days`, dropping the projection buckets behind the cutoff and recomputing the straddling one in the same transaction; scheduled checkpoint/VACUUM on `querylog.db` only.
 
 ### 11.6 Disk Discipline (cloudflared lesson)
 
@@ -536,7 +538,7 @@ Scalars in `settings(key, value)`; ordered/structured items in dedicated tables.
 ### 13.1 Endpoints
 
 - `POST /api/auth/login`, `POST /api/auth/logout`
-- `GET /api/stats?period=…`, `GET /api/stats/timeseries?period=…`, `GET /api/stats/types?period=…`, `GET /api/stats/routes?period=…`, `GET /api/stats/clients?period=…`
+- `GET /api/overview?period=…` — every Overview panel in one response over one read transaction
 - `GET /api/queries` (filter + paginate), `GET /api/queries/live` (SSE, per-IP cap)
 - `GET/PUT /api/clients/{id}`
 - `GET/POST/PUT/DELETE /api/groups…`, `/api/blocklists…`, `/api/rules…`, `/api/local-records…`, `/api/forward-zones…`
@@ -664,7 +666,7 @@ The project publishes released binaries and container images from its own Gitea
 6. Disk-fill degrades gracefully; no silent log-flood failure mode.
 7. Web UI + API provide full admin functionality; OpenAPI contract tests green.
 8. `nxdns export` round-trips via `nxdns import`.
-9. Query logging, stats, SSE live stream work; querylog.db corruption self-heals.
+9. Query logging, the overview, SSE live stream work; querylog.db corruption self-heals.
 10. Local DoH + DoT endpoints serve LAN clients.
 11. Schema upgrade = install + restart (migration test proves it).
 12. All suites green in Gitea CI for both targets.

admin/src/features/configuration/authority.test.tsx

@@ -99,14 +99,17 @@ test("a failed status is announced by the shell on a page that is not configurat
 	stubApi(DATABASE, {
 		responses: {
 			"GET /api/config/status": new Response(JSON.stringify({ error: "gone" }), { status: 404 }),
-			"GET /api/stats?period=24h": {
+			"GET /api/overview?period=24h": {
 				period: "24h",
 				since: 0,
 				until: 86400,
-				queries: 0,
-				blocked: 0,
-				clients: 0,
-				avg_response_time_us: null,
+				bucket_seconds: 1800,
+				totals: { queries: 0, blocked: 0, clients: 0, avg_response_time_us: null },
+				buckets: [],
+				clients: [],
+				other: [],
+				types: [],
+				routes: [],
 				coverage: { complete: true, available_since: 0 },
 			},
 		},

admin/src/features/overview/ClientChart.test.tsx

@@ -2,23 +2,14 @@ import { fireEvent, render as renderBare, screen, within } from "@testing-librar
 import { QueryClientProvider } from "@tanstack/react-query";
 import { createQueryClient } from "@/lib/queryClient";
 import { formatTime } from "@/lib/format";
-import type { StatsClients } from "@/lib/types";
-import ClientChart from "./ClientChart";
+import ClientChart, { type ClientChartData } from "./ClientChart";
 import { OTHER_KEY, clientKey, seriesColor } from "./seriesColors";
 
 const SINCE = 1_700_000_000;
 const BUCKET = 1800;
 
-function clients(named: { client: string; buckets: number[] }[], other: number[]): StatsClients {
-	return {
-		period: "24h",
-		since: SINCE,
-		until: SINCE + other.length * BUCKET,
-		bucket_seconds: BUCKET,
-		coverage: { complete: true, available_since: SINCE },
-		clients: named,
-		other,
-	};
+function clients(named: { client: string; buckets: number[] }[], other: number[]): ClientChartData {
+	return { since: SINCE, bucket_seconds: BUCKET, clients: named, other };
 }
 
 const TWO_BUCKETS = clients(
@@ -34,15 +25,15 @@ const TWO_BUCKETS = clients(
  * client is registered in these fixtures, which is what leaves the addresses on
  * screen as the labels.
  */
-function render(data: StatsClients) {
+function render(data: ClientChartData) {
 	const client = createQueryClient();
-	const tree = (next: StatsClients) => (
+	const tree = (next: ClientChartData) => (
 		<QueryClientProvider client={client}>
 			<ClientChart data={next} />
 		</QueryClientProvider>
 	);
 	const result = renderBare(tree(data));
-	return { ...result, rerender: (next: StatsClients) => result.rerender(tree(next)) };
+	return { ...result, rerender: (next: ClientChartData) => result.rerender(tree(next)) };
 }
 
 beforeEach(() => {

admin/src/features/overview/ClientChart.tsx

@@ -13,7 +13,7 @@ import * as stylex from "@stylexjs/stylex";
 import { Group } from "@visx/group";
 import { BarStack } from "@visx/shape";
 import { formatTime } from "@/lib/format";
-import type { StatsClients } from "@/lib/types";
+import type { OverviewClientSeries } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
 import { colors } from "@/ui/tokens.stylex";
 import { clientLabel, useClientNames, type ClientNames } from "@/features/clients/clientNames";
@@ -82,7 +82,7 @@ interface Series {
  * and a table column all saying zero. The named clients stay at zero, because a
  * client that went quiet is something the reader wants to see.
  */
-function seriesOf(data: StatsClients, names: ClientNames): Series[] {
+function seriesOf(data: ClientChartData, names: ClientNames): Series[] {
 	const named = data.clients.map((client) => ({
 		key: clientKey(client.client),
 		// The name if the client is registered under one, the address otherwise —
@@ -100,10 +100,21 @@ function seriesOf(data: StatsClients, names: ClientNames): Series[] {
 	];
 }
 
+/**
+ * The slice of the Overview body this chart draws. Declared here rather than
+ * taken whole, so what the chart reads is stated where it is read.
+ */
+export interface ClientChartData {
+	since: number;
+	bucket_seconds: number;
+	clients: OverviewClientSeries[];
+	other: number[];
+}
+
 /** One column: the timestamp plus one entry per series, keyed by the series key. */
 type Column = { ts: number } & Record<string, number>;
 
-export default function ClientChart({ data }: { data: StatsClients }) {
+export default function ClientChart({ data }: { data: ClientChartData }) {
 	const [containerRef, width] = useMeasuredWidth();
 	// A hover survives a re-render only while it still names the same bucket at
 	// the same place: a poll that rolls the window, or a resize, retires it.

admin/src/features/overview/OverviewFrame.tsx

@@ -0,0 +1,133 @@
+/**
+ * The part of Overview that does not wait for anything: the heading, the period
+ * picker, and the pulsing body the page shows while the window is in flight.
+ *
+ * It lives apart from `OverviewPage` so the route's pending component can render
+ * the identical surface while the page chunk loads. Importing the page itself
+ * would pull the charts into the main bundle, and a second hand-written copy of
+ * the frame would drift. Nothing here imports a chart.
+ */
+
+import * as stylex from "@stylexjs/stylex";
+import { useNavigate, useSearch } from "@tanstack/react-router";
+import type { Period } from "@/lib/types";
+import { styles as shared } from "@/ui/styles";
+import { colors } from "@/ui/tokens.stylex";
+import { DEFAULT_PERIOD, PERIODS } from "./period";
+
+const styles = stylex.create({
+	page: {
+		display: "flex",
+		flexDirection: "column",
+		gap: "1rem",
+	},
+	headingRow: {
+		display: "flex",
+		flexWrap: "wrap",
+		alignItems: "center",
+		justifyContent: "space-between",
+		gap: "0.75rem",
+	},
+	heading: {
+		fontSize: "1.5rem",
+		lineHeight: "2rem",
+		fontWeight: 600,
+	},
+	periodGroup: {
+		display: "flex",
+		gap: "0.25rem",
+	},
+	period: {
+		borderStyle: "none",
+		borderRadius: "0.25rem",
+		paddingInline: "0.625rem",
+		paddingBlock: "0.25rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+	},
+	/** The pressed fill is heavier than `surfaceHover`, so a hover cannot mimic it. */
+	periodSelected: {
+		backgroundColor: {
+			default: "oklch(92% 0.004 286.32)",
+			"@media (prefers-color-scheme: dark)": "oklch(37% 0.013 285.805)",
+		},
+		color: colors.text,
+		fontWeight: 500,
+	},
+	periodIdle: {
+		backgroundColor: { default: "transparent", ":hover": colors.surfaceHover },
+		color: colors.textSecondary,
+	},
+	loading: {
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textMuted,
+	},
+});
+
+export function PeriodPicker({ period, onChange }: { period: Period; onChange: (period: Period) => void }) {
+	return (
+		<div role="group" aria-label="Period" {...stylex.props(styles.periodGroup)}>
+			{PERIODS.map((option) => (
+				<button
+					key={option}
+					type="button"
+					aria-pressed={option === period}
+					onClick={() => onChange(option)}
+					{...stylex.props(
+						styles.period,
+						option === period ? styles.periodSelected : styles.periodIdle,
+						shared.focusRing,
+					)}
+				>
+					{option}
+				</button>
+			))}
+		</div>
+	);
+}
+
+export function OverviewLoading() {
+	return (
+		<p role="status" {...stylex.props(styles.loading, shared.pulse)}>
+			Loading…
+		</p>
+	);
+}
+
+export function OverviewFrame({
+	period,
+	onChange,
+	children,
+}: {
+	period: Period;
+	onChange: (period: Period) => void;
+	children: React.ReactNode;
+}) {
+	return (
+		<div {...stylex.props(styles.page)}>
+			<div {...stylex.props(styles.headingRow)}>
+				<h1 {...stylex.props(styles.heading)}>Overview</h1>
+				<PeriodPicker period={period} onChange={onChange} />
+			</div>
+			{children}
+		</div>
+	);
+}
+
+/**
+ * The route's pending surface. The picker stays live because it only writes the
+ * search parameter, which the route already re-reads on its own.
+ */
+export function OverviewPending() {
+	const period = useSearch({ from: "/shell/overview" }).period ?? DEFAULT_PERIOD;
+	const navigate = useNavigate({ from: "/overview" });
+	return (
+		<OverviewFrame
+			period={period}
+			onChange={(next) => void navigate({ search: (prev) => ({ ...prev, period: next }) })}
+		>
+			<OverviewLoading />
+		</OverviewFrame>
+	);
+}

admin/src/features/overview/OverviewPage.test.tsx

@@ -16,64 +16,32 @@ import { createQueryClient } from "@/lib/queryClient";
 import { createAppRouter } from "@/routes";
 import { clientKey, qtypeKey, seriesColor } from "./seriesColors";
 import { health } from "@/lib/healthFixture";
-import type { Health, StatsClients, StatsRoutes, StatsTimeseries, StatsTotals, StatsTypes } from "@/lib/types";
+import type { Health, Overview } from "@/lib/types";
 
 const SINCE = Date.UTC(2026, 0, 1, 0, 0) / 1000;
 const UNTIL = Date.UTC(2026, 0, 2, 0, 0) / 1000;
 const COVERAGE = { complete: true, available_since: SINCE };
 
-const TOTALS: StatsTotals = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
-	queries: 1000,
-	blocked: 250,
-	clients: 7,
-	avg_response_time_us: 2345,
-	coverage: COVERAGE,
-};
-
-const SERIES: StatsTimeseries = {
+const OVERVIEW: Overview = {
 	period: "24h",
 	since: SINCE,
 	until: UNTIL,
 	bucket_seconds: 1800,
+	totals: { queries: 1000, blocked: 250, clients: 7, avg_response_time_us: 2345 },
 	buckets: [
 		{ ts: SINCE, queries: 60, blocked: 20, cached: 10 },
 		{ ts: SINCE + 1800, queries: 40, blocked: 0, cached: 0 },
 	],
-	coverage: COVERAGE,
-};
-
-const CLIENTS: StatsClients = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
-	bucket_seconds: 1800,
 	clients: [
 		{ client: "192.0.2.30", buckets: [40, 20] },
 		{ client: "192.0.2.31", buckets: [20, 20] },
 	],
 	other: [0, 0],
-	coverage: COVERAGE,
-};
-
-const TYPES: StatsTypes = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
 	types: [
 		{ qtype: 1, count: 600 },
 		{ qtype: 28, count: 300 },
 		{ qtype: null, count: 100 },
 	],
-	coverage: COVERAGE,
-};
-
-const ROUTES: StatsRoutes = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
 	routes: [
 		{ route: "upstream", source: "https://dns.example/dns-query", count: 500 },
 		{ route: "blocked", source: null, count: 250 },
@@ -83,22 +51,27 @@ const ROUTES: StatsRoutes = {
 	coverage: COVERAGE,
 };
 
-/** The same shapes an hour wide, so a period change is observable in every panel. */
-const HOUR = {
-	totals: { ...TOTALS, period: "1h", since: UNTIL - 3600, queries: 12, blocked: 3, clients: 2 } as StatsTotals,
-	timeseries: { ...SERIES, period: "1h", since: UNTIL - 3600, bucket_seconds: 60, buckets: [] } as StatsTimeseries,
-	clients: { ...CLIENTS, period: "1h", since: UNTIL - 3600, clients: [], other: [] } as StatsClients,
-	types: { ...TYPES, period: "1h", since: UNTIL - 3600, types: [] } as StatsTypes,
-	routes: { ...ROUTES, period: "1h", since: UNTIL - 3600, routes: [] } as StatsRoutes,
+/** The same shape an hour wide and empty, so a period change is observable. */
+const HOUR: Overview = {
+	...OVERVIEW,
+	period: "1h",
+	since: UNTIL - 3600,
+	bucket_seconds: 60,
+	totals: { queries: 12, blocked: 3, clients: 2, avg_response_time_us: 2345 },
+	buckets: [],
+	clients: [],
+	other: [],
+	types: [],
+	routes: [],
 };
 
 let healthBody: Health;
-let failing: Set<string>;
+let failing: boolean;
 /** The registered clients, as `/api/clients` answers them. */
 let registered: { ip: string; name: string; learned_name: string }[];
 let coverageComplete: boolean;
-/** Paths held in flight, so a test can look at the page while one is pending. */
-let delayed: Map<string, Promise<void>>;
+/** Held in flight, so a test can look at the page while the request is pending. */
+let delayed: Promise<void> | null;
 
 function json(payload: unknown, status = 200): Response {
 	return new Response(JSON.stringify(payload), { status, headers: { "content-type": "application/json" } });
@@ -110,27 +83,18 @@ function withCoverage<T extends { coverage: typeof COVERAGE }>(body: T): T {
 
 beforeEach(() => {
 	healthBody = health();
-	failing = new Set();
+	failing = false;
 	registered = [];
 	coverageComplete = true;
-	delayed = new Map();
+	delayed = null;
 	vi.stubGlobal(
 		"fetch",
 		vi.fn(async (input: RequestInfo | URL) => {
 			const url = String(input);
-			const hour = url.includes("period=1h");
-			for (const [path, body] of [
-				["/api/stats/timeseries", hour ? HOUR.timeseries : SERIES],
-				["/api/stats/clients", hour ? HOUR.clients : CLIENTS],
-				["/api/stats/types", hour ? HOUR.types : TYPES],
-				["/api/stats/routes", hour ? HOUR.routes : ROUTES],
-				["/api/stats", hour ? HOUR.totals : TOTALS],
-			] as const) {
-				if (!url.startsWith(path)) continue;
-				if (failing.has(path)) return json({ error: "endpoint unavailable" }, 400);
-				const held = delayed.get(path);
-				if (held !== undefined) await held;
-				return json(withCoverage(body));
+			if (url.startsWith("/api/overview")) {
+				if (failing) return json({ error: "endpoint unavailable" }, 400);
+				if (delayed !== null) await delayed;
+				return json(withCoverage(url.includes("period=1h") ? HOUR : OVERVIEW));
 			}
 			if (url === "/api/clients") {
 				return json({
@@ -215,25 +179,27 @@ test("the page builds a donut slice's colour from the entry's identity", async (
 	expect(swatch.getAttribute("style")).toContain(seriesColor(qtypeKey(1)));
 });
 
-test("a slow endpoint does not hold the page back: the panels that answered render beside it", async () => {
-	// Through the real route, which is the point: the loader starts the five
-	// requests and awaits none of them. If it awaited, the router would hold the
-	// whole page until the slowest answered and this would time out on the tiles.
+test("a request in flight leaves the heading and the picker usable behind one loading surface", async () => {
+	// Through the real route, which is the point: the loader starts the request
+	// and awaits it nowhere. If it awaited, the router would hold the whole page —
+	// heading and period picker included — until the response landed.
 	let release = () => {};
-	delayed.set("/api/stats/routes", new Promise<void>((resolve) => (release = resolve)));
+	delayed = new Promise<void>((resolve) => (release = resolve));
 
 	renderApp();
 
-	// The tiles and both charts are readable while the routes request is still
-	// in flight, and the panel waiting on it says so for itself.
-	await screen.findByText("1,000");
-	expect(within(panel("Queries over time")).getAllByText("Blocked").length).toBeGreaterThan(0);
-	expect(within(panel("Client activity over time")).getAllByText("192.0.2.30")).toHaveLength(2);
-	expect(within(panel("Query types")).getAllByText("A")).toHaveLength(2);
-	expect(within(panel("Upstream servers")).getByRole("status").textContent).toBe("Loading…");
+	await screen.findByRole("heading", { name: "Overview", level: 1 });
+	expect(screen.getByRole("button", { name: "1h" })).toBeTruthy();
+	// One loading state for the whole page, not one per panel.
+	const loading = await screen.findByText("Loading…");
+	expect(loading.getAttribute("role")).toBe("status");
+	expect(screen.getAllByText("Loading…")).toHaveLength(1);
+	expect(screen.queryByRole("heading", { name: "Query types" })).toBeNull();
 
 	release();
-	await waitFor(() => expect(within(panel("Upstream servers")).queryByRole("status")).toBeNull());
+	delayed = null;
+	await screen.findByText("1,000");
+	expect(screen.queryByText("Loading…")).toBeNull();
 });
 
 test("a registered client is named in the chart, an unregistered one keeps its address", async () => {
@@ -392,17 +358,24 @@ test("the picker rescopes every panel and writes the period into the url", async
 	expect(screen.queryByText("1,000")).toBeNull();
 });
 
-test("one failing panel keeps its own error and leaves the rest of the page standing", async () => {
-	failing.add("/api/stats/routes");
+test("a failed request is one error for the whole page, stated once and retryable", async () => {
+	failing = true;
 	renderApp();
-	await screen.findByText("1,000");
 
-	await waitFor(() => expect(within(panel("Upstream servers")).getByText("endpoint unavailable")).toBeTruthy());
-	expect(within(panel("Upstream servers")).getByRole("button", { name: "Retry" })).toBeTruthy();
-	// A failed donut never blanks the charts.
-	expect(screen.getByRole("img", { name: /queries over time/i })).toBeTruthy();
-	expect(screen.getByRole("img", { name: /client activity over time/i })).toBeTruthy();
+	await screen.findByText("endpoint unavailable");
+	// One statement of the failure, not one per panel: there is a single request
+	// behind every panel, so a second copy would only repeat this sentence.
+	expect(screen.getAllByText("endpoint unavailable")).toHaveLength(1);
+	expect(screen.getAllByRole("button", { name: "Retry" })).toHaveLength(1);
+	// The heading and the picker survive it, so the reader can rescope or retry.
+	expect(screen.getByRole("heading", { name: "Overview", level: 1 })).toBeTruthy();
+	expect(screen.getByRole("button", { name: "1h" })).toBeTruthy();
 	expect(screen.queryByText("Something went wrong")).toBeNull();
+
+	failing = false;
+	fireEvent.click(screen.getByRole("button", { name: "Retry" }));
+	await screen.findByText("1,000");
+	expect(screen.getByRole("img", { name: /queries over time/i })).toBeTruthy();
 });
 
 test("an incomplete window states its watermark once for the whole page", async () => {

admin/src/features/overview/OverviewPage.tsx

@@ -8,9 +8,9 @@
  * The period is URL state, so a view is a link: `/overview?period=1h` opens
  * exactly what the sender was reading.
  *
- * Every panel reads the same window (`overviewWindow.ts`) and renders on its
- * own. A donut whose request failed shows its own error while the charts keep
- * their data, and no two panels ever describe different spans.
+ * One request feeds every panel (`overviewWindow.ts`), so the page has one
+ * loading state and one error state rather than six: there is no longer a
+ * partial answer to render, and nothing left for a panel to disagree about.
  */
 
 import * as stylex from "@stylexjs/stylex";
@@ -18,16 +18,16 @@ import { useNavigate, useSearch } from "@tanstack/react-router";
 import CoverageNotice from "@/lib/CoverageNotice";
 import InlineError from "@/lib/InlineError";
 import { qtypeName } from "@/features/provenance/qtype";
-import type { Period, StatsRoutes, StatsTypes } from "@/lib/types";
-import { styles as shared } from "@/ui/styles";
+import type { Overview, OverviewRouteRow, OverviewTypeRow } from "@/lib/types";
 import { colors } from "@/ui/tokens.stylex";
 import ClientChart from "./ClientChart";
 import Donut from "./Donut";
 import StatTiles from "./StatTiles";
 import TimeseriesChart from "./TimeseriesChart";
 import type { DonutSlice } from "./Donut";
+import { OverviewFrame, OverviewLoading } from "./OverviewFrame";
 import { useOverviewWindow, type Panel } from "./overviewWindow";
-import { DEFAULT_PERIOD, PERIODS } from "./period";
+import { DEFAULT_PERIOD } from "./period";
 import { qtypeKey, routeKey, seriesColor } from "./seriesColors";
 
 /**
@@ -48,48 +48,6 @@ const ROUTE_LABELS = {
 } as const;
 
 const styles = stylex.create({
-	page: {
-		display: "flex",
-		flexDirection: "column",
-		gap: "1rem",
-	},
-	headingRow: {
-		display: "flex",
-		flexWrap: "wrap",
-		alignItems: "center",
-		justifyContent: "space-between",
-		gap: "0.75rem",
-	},
-	heading: {
-		fontSize: "1.5rem",
-		lineHeight: "2rem",
-		fontWeight: 600,
-	},
-	periodGroup: {
-		display: "flex",
-		gap: "0.25rem",
-	},
-	period: {
-		borderStyle: "none",
-		borderRadius: "0.25rem",
-		paddingInline: "0.625rem",
-		paddingBlock: "0.25rem",
-		fontSize: "0.875rem",
-		lineHeight: "1.25rem",
-	},
-	/** The pressed fill is heavier than `surfaceHover`, so a hover cannot mimic it. */
-	periodSelected: {
-		backgroundColor: {
-			default: "oklch(92% 0.004 286.32)",
-			"@media (prefers-color-scheme: dark)": "oklch(37% 0.013 285.805)",
-		},
-		color: colors.text,
-		fontWeight: 500,
-	},
-	periodIdle: {
-		backgroundColor: { default: "transparent", ":hover": colors.surfaceHover },
-		color: colors.textSecondary,
-	},
 	panel: {
 		borderRadius: "0.25rem",
 		borderWidth: 1,
@@ -110,54 +68,20 @@ const styles = stylex.create({
 		gap: "1rem",
 		gridTemplateColumns: { default: "minmax(0, 1fr)", [TWO_COLUMN]: "repeat(2, minmax(0, 1fr))" },
 	},
-	loading: {
-		fontSize: "0.875rem",
-		lineHeight: "1.25rem",
-		color: colors.textMuted,
-	},
 });
 
-function PeriodPicker({ period, onChange }: { period: Period; onChange: (period: Period) => void }) {
-	return (
-		<div role="group" aria-label="Period" {...stylex.props(styles.periodGroup)}>
-			{PERIODS.map((option) => (
-				<button
-					key={option}
-					type="button"
-					aria-pressed={option === period}
-					onClick={() => onChange(option)}
-					{...stylex.props(
-						styles.period,
-						option === period ? styles.periodSelected : styles.periodIdle,
-						shared.focusRing,
-					)}
-				>
-					{option}
-				</button>
-			))}
-		</div>
-	);
-}
-
 /**
- * One panel's three states. Loading and error are the panel's own: a failure
- * here never reaches past this box, which is what keeps a failed donut from
- * blanking the charts beside it.
+ * The page's three states. The heading and the period picker stay put through
+ * all three, so the reader can rescope or retry without waiting for anything.
  */
-function PanelBody<T>({ panel, children }: { panel: Panel<T>; children: (data: T) => React.ReactNode }) {
+function PageBody({ panel, children }: { panel: Panel<Overview>; children: (data: Overview) => React.ReactNode }) {
 	if (panel.status === "error") return <InlineError error={panel.error} onRetry={panel.retry} />;
-	if (panel.status === "loading") {
-		return (
-			<p role="status" {...stylex.props(styles.loading, shared.pulse)}>
-				Loading…
-			</p>
-		);
-	}
+	if (panel.status === "loading") return <OverviewLoading />;
 	return <>{children(panel.data)}</>;
 }
 
-function typeSlices(data: StatsTypes): DonutSlice[] {
-	return data.types.map((row) => ({
+function typeSlices(types: OverviewTypeRow[]): DonutSlice[] {
+	return types.map((row) => ({
 		key: qtypeKey(row.qtype),
 		label: row.qtype === null ? "Unknown" : qtypeName(row.qtype),
 		value: row.count,
@@ -171,8 +95,8 @@ function typeSlices(data: StatsTypes): DonutSlice[] {
  * appear under two kinds and two rows can both be "Unknown". The four
  * source-less kinds are their own label and need no qualifier.
  */
-function routeSlices(data: StatsRoutes): DonutSlice[] {
-	return data.routes.map((row) => {
+function routeSlices(routes: OverviewRouteRow[]): DonutSlice[] {
+	return routes.map((row) => {
 		const named = row.route === "upstream" || row.route === "forward_zone";
 		return {
 			key: routeKey(row.route, row.source),
@@ -190,59 +114,54 @@ export default function OverviewPage() {
 	const overview = useOverviewWindow(period);
 
 	return (
-		<div {...stylex.props(styles.page)}>
-			<div {...stylex.props(styles.headingRow)}>
-				<h1 {...stylex.props(styles.heading)}>Overview</h1>
-				<PeriodPicker
-					period={period}
-					onChange={(next) => void navigate({ search: (prev) => ({ ...prev, period: next }) })}
-				/>
-			</div>
+		<OverviewFrame
+			period={period}
+			onChange={(next) => void navigate({ search: (prev) => ({ ...prev, period: next }) })}
+		>
+			<PageBody panel={overview}>
+				{(data) => (
+					<>
+						<StatTiles stats={{ since: data.since, until: data.until, ...data.totals }} />
 
-			<PanelBody panel={overview.totals}>{(totals) => <StatTiles stats={totals} />}</PanelBody>
+						{/* One notice for the page: every panel came out of this one
+						    response, so a second copy would only repeat this sentence. */}
+						<CoverageNotice coverage={data.coverage} />
 
-			{/* One notice for the page: every panel is judged against the same window,
-			    so a second copy would only repeat this sentence. */}
-			{overview.coverage !== null && <CoverageNotice coverage={overview.coverage} />}
+						<section aria-labelledby="overview-queries" {...stylex.props(styles.panel)}>
+							<h2 id="overview-queries" {...stylex.props(styles.panelHeading)}>
+								Queries over time
+							</h2>
+							<TimeseriesChart data={data} />
+						</section>
 
-			<section aria-labelledby="overview-queries" {...stylex.props(styles.panel)}>
-				<h2 id="overview-queries" {...stylex.props(styles.panelHeading)}>
-					Queries over time
-				</h2>
-				<PanelBody panel={overview.timeseries}>{(data) => <TimeseriesChart data={data} />}</PanelBody>
-			</section>
+						<section aria-labelledby="overview-clients" {...stylex.props(styles.panel)}>
+							<h2 id="overview-clients" {...stylex.props(styles.panelHeading)}>
+								Client activity over time
+							</h2>
+							<ClientChart data={data} />
+						</section>
 
-			<section aria-labelledby="overview-clients" {...stylex.props(styles.panel)}>
-				<h2 id="overview-clients" {...stylex.props(styles.panelHeading)}>
-					Client activity over time
-				</h2>
-				<PanelBody panel={overview.clients}>{(data) => <ClientChart data={data} />}</PanelBody>
-			</section>
-
-			<div {...stylex.props(styles.donutRow)}>
-				<section aria-labelledby="overview-types" {...stylex.props(styles.panel)}>
-					<h2 id="overview-types" {...stylex.props(styles.panelHeading)}>
-						Query types
-					</h2>
-					<PanelBody panel={overview.types}>
-						{(data) => <Donut slices={typeSlices(data)} caption="Queries by DNS type" unit="Queries" />}
-					</PanelBody>
-				</section>
-				<section aria-labelledby="overview-routes" {...stylex.props(styles.panel)}>
-					<h2 id="overview-routes" {...stylex.props(styles.panelHeading)}>
-						Upstream servers
-					</h2>
-					<PanelBody panel={overview.routes}>
-						{(data) => (
-							<Donut
-								slices={routeSlices(data)}
-								caption="Queries by how they were answered"
-								unit="Queries"
-							/>
-						)}
-					</PanelBody>
-				</section>
-			</div>
-		</div>
+						<div {...stylex.props(styles.donutRow)}>
+							<section aria-labelledby="overview-types" {...stylex.props(styles.panel)}>
+								<h2 id="overview-types" {...stylex.props(styles.panelHeading)}>
+									Query types
+								</h2>
+								<Donut slices={typeSlices(data.types)} caption="Queries by DNS type" unit="Queries" />
+							</section>
+							<section aria-labelledby="overview-routes" {...stylex.props(styles.panel)}>
+								<h2 id="overview-routes" {...stylex.props(styles.panelHeading)}>
+									Upstream servers
+								</h2>
+								<Donut
+									slices={routeSlices(data.routes)}
+									caption="Queries by how they were answered"
+									unit="Queries"
+								/>
+							</section>
+						</div>
+					</>
+				)}
+			</PageBody>
+		</OverviewFrame>
 	);
 }

admin/src/features/overview/StatTiles.tsx

@@ -5,7 +5,7 @@
  * typographic, so the eye ranks the figures rather than the panels, and a tile
  * never implies a state it is not reporting.
  *
- * The Activity links carry the bounds the **stats response** returned, not
+ * The Activity links carry the bounds the **overview response** returned, not
  * bounds computed here — a client-computed window would send the reader to a
  * slightly different span than the one they were just reading.
  */
@@ -13,7 +13,7 @@
 import * as stylex from "@stylexjs/stylex";
 import { Link } from "@tanstack/react-router";
 import { formatMicros } from "@/lib/format";
-import type { StatsTotals } from "@/lib/types";
+import type { OverviewTotals } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
 import { colors } from "@/ui/tokens.stylex";
 
@@ -101,7 +101,13 @@ function Tile({
 	);
 }
 
-export default function StatTiles({ stats }: { stats: StatsTotals }) {
+/** The window's totals with the bounds they were measured over. */
+export interface StatTilesData extends OverviewTotals {
+	since: number;
+	until: number;
+}
+
+export default function StatTiles({ stats }: { stats: StatTilesData }) {
 	const window = {
 		mode: "history" as const,
 		since: stats.since,

admin/src/features/overview/TimeseriesChart.test.tsx

@@ -1,24 +1,17 @@
 import { fireEvent, render, screen, within } from "@testing-library/react";
 import * as stylex from "@stylexjs/stylex";
 import { formatTime } from "@/lib/format";
-import type { Bucket, StatsTimeseries } from "@/lib/types";
+import type { Bucket } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
-import TimeseriesChart from "./TimeseriesChart";
+import TimeseriesChart, { type TimeseriesData } from "./TimeseriesChart";
 
 const SINCE = 1_700_000_000;
 
-function timeseries(buckets: Bucket[]): StatsTimeseries {
-	return {
-		period: "24h",
-		since: SINCE,
-		until: SINCE + buckets.length * 1800,
-		bucket_seconds: 1800,
-		coverage: { complete: true, available_since: SINCE },
-		buckets,
-	};
+function timeseries(buckets: Bucket[]): TimeseriesData {
+	return { since: SINCE, bucket_seconds: 1800, buckets };
 }
 
-function counting(bucketCount: number): StatsTimeseries {
+function counting(bucketCount: number): TimeseriesData {
 	return timeseries(
 		Array.from({ length: bucketCount }, (_, i) => ({
 			ts: SINCE + i * 1800,

admin/src/features/overview/TimeseriesChart.tsx

@@ -2,7 +2,7 @@ import * as stylex from "@stylexjs/stylex";
 import { Group } from "@visx/group";
 import { BarStack } from "@visx/shape";
 import { formatTime } from "@/lib/format";
-import type { Bucket, StatsTimeseries } from "@/lib/types";
+import type { Bucket } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
 import { colors } from "@/ui/tokens.stylex";
 import {
@@ -103,7 +103,17 @@ function tooltipOf(column: Column): TooltipContent {
 	};
 }
 
-export default function TimeseriesChart({ data }: { data: StatsTimeseries }) {
+/**
+ * The slice of the Overview body this chart draws. Declared here rather than
+ * taken whole, so what the chart reads is stated where it is read.
+ */
+export interface TimeseriesData {
+	since: number;
+	bucket_seconds: number;
+	buckets: Bucket[];
+}
+
+export default function TimeseriesChart({ data }: { data: TimeseriesData }) {
 	const [containerRef, width] = useMeasuredWidth();
 	// A hover survives a re-render only while it still names the same bucket at
 	// the same place: a poll that rolls the window, or a resize, retires it.

admin/src/features/overview/overviewWindow.test.tsx

@@ -1,74 +1,41 @@
 /**
- * Window coherence across the five Overview requests, migrated from the
- * two-request `activityWindow` this replaces. Every behaviour that hook pinned
- * is pinned here — the identity, the one retry per mismatch episode, the
- * terminal error, the discarded previous-period pair and the stale completion
- * that must not speak — now over five endpoints and with the watermark in the
- * identity, plus the per-panel isolation the layout added.
+ * The hook over the single `/api/overview` request.
+ *
+ * The five-endpoint build reconciled five window identities here — the retry per
+ * mismatch episode, the terminal "different window" error, the orphaned stale
+ * completion. One request cannot disagree with itself, so those behaviours have
+ * no subject left and are gone rather than ported. What survived the collapse is
+ * pinned below: the three states, and the one rule a single request still does
+ * not settle — that a `keepPreviousData` body from the period the reader left
+ * must never render under the new period's label.
  */
 
 import { render, screen, waitFor } from "@testing-library/react";
 import { QueryClientProvider } from "@tanstack/react-query";
 import { createQueryClient } from "@/lib/queryClient";
-import type { Coverage, Period } from "@/lib/types";
-import {
-	newerWindow,
-	sameWindow,
-	useOverviewWindow,
-	windowIdOf,
-	OVERVIEW_ENDPOINTS,
-	type OverviewEndpoint,
-} from "./overviewWindow";
+import type { Period } from "@/lib/types";
+import { useOverviewWindow } from "./overviewWindow";
 
 const SINCE = Date.UTC(2026, 0, 1, 0, 0) / 1000;
 const UNTIL = Date.UTC(2026, 0, 2, 0, 0) / 1000;
-const COVERAGE: Coverage = { complete: true, available_since: SINCE };
 
-/** Where each endpoint's body currently ends, and what watermark it admits. */
-interface Bounds {
-	until: number;
-	availableSince: number;
-}
+let failing: boolean;
+let calls: number;
 
-const PATHS: Record<OverviewEndpoint, string> = {
-	totals: "/api/stats?period=",
-	timeseries: "/api/stats/timeseries?period=",
-	clients: "/api/stats/clients?period=",
-	types: "/api/stats/types?period=",
-	routes: "/api/stats/routes?period=",
-};
-
-let bounds: Record<OverviewEndpoint, Bounds>;
-let failing: Set<OverviewEndpoint>;
-let calls: Record<OverviewEndpoint, number>;
-/** Endpoints that answer for the page's window from their second call onward. */
-let catchUp: Set<OverviewEndpoint>;
-/** Held to keep one answer in flight while the test moves the page on. */
-let hold: { promise: Promise<void>; release: () => void } | null;
-
-function endpointOf(url: string): OverviewEndpoint | null {
-	// Longest prefix first: `/api/stats?` and `/api/stats/…` share a stem.
-	for (const endpoint of ["timeseries", "clients", "types", "routes", "totals"] as const) {
-		if (url.startsWith(PATHS[endpoint])) return endpoint;
-	}
-	return null;
-}
-
-function body(endpoint: OverviewEndpoint, period: Period): unknown {
-	const { until, availableSince } = bounds[endpoint];
-	const shared = { period, since: SINCE, until, coverage: { ...COVERAGE, available_since: availableSince } };
-	switch (endpoint) {
-		case "totals":
-			return { ...shared, queries: 10, blocked: 2, clients: 1, avg_response_time_us: 1000 };
-		case "timeseries":
-			return { ...shared, bucket_seconds: 3600, buckets: [] };
-		case "clients":
-			return { ...shared, bucket_seconds: 3600, clients: [], other: [] };
-		case "types":
-			return { ...shared, types: [] };
-		case "routes":
-			return { ...shared, routes: [] };
-	}
+function body(period: Period): unknown {
+	return {
+		period,
+		since: SINCE,
+		until: UNTIL,
+		bucket_seconds: 1800,
+		totals: { queries: 10, blocked: 2, clients: 1, avg_response_time_us: 1000 },
+		buckets: [],
+		clients: [],
+		other: [],
+		types: [],
+		routes: [],
+		coverage: { complete: true, available_since: SINCE },
+	};
 }
 
 function json(payload: unknown, status = 200): Response {
@@ -76,55 +43,36 @@ function json(payload: unknown, status = 200): Response {
 }
 
 beforeEach(() => {
-	bounds = {
-		totals: { until: UNTIL, availableSince: SINCE },
-		timeseries: { until: UNTIL, availableSince: SINCE },
-		clients: { until: UNTIL, availableSince: SINCE },
-		types: { until: UNTIL, availableSince: SINCE },
-		routes: { until: UNTIL, availableSince: SINCE },
-	};
-	failing = new Set();
-	catchUp = new Set();
-	hold = null;
-	calls = { totals: 0, timeseries: 0, clients: 0, types: 0, routes: 0 };
+	failing = false;
+	calls = 0;
 	vi.stubGlobal(
 		"fetch",
 		vi.fn(async (input: RequestInfo | URL) => {
 			const url = String(input);
-			const endpoint = endpointOf(url);
-			if (endpoint === null) return json({ error: "not stubbed" }, 404);
-			calls[endpoint] += 1;
-			if (failing.has(endpoint)) return json({ error: "endpoint unavailable" }, 400);
-			if (catchUp.has(endpoint) && calls[endpoint] >= 2)
-				bounds[endpoint] = { until: UNTIL, availableSince: SINCE };
+			if (!url.startsWith("/api/overview")) return json({ error: "not stubbed" }, 404);
+			calls += 1;
+			if (failing) return json({ error: "endpoint unavailable" }, 400);
 			const period = (new URLSearchParams(url.split("?")[1]).get("period") ?? "24h") as Period;
-			// Built before the wait, so a held answer carries what its own request
-			// would have returned rather than what the page has moved on to.
-			const payload = json(body(endpoint, period));
-			if (hold !== null && endpoint === "routes" && calls.routes === 2) await hold.promise;
-			return payload;
+			return json(body(period));
 		}),
 	);
 });
 
 afterEach(() => vi.unstubAllGlobals());
 
+/** The last retry the hook handed out, so a test can spend it. */
+let lastRetry: () => void;
+
 function Probe({ period }: { period: Period }) {
-	const overview = useOverviewWindow(period);
-	return (
-		<ul>
-			{OVERVIEW_ENDPOINTS.map((endpoint) => {
-				const panel = overview[endpoint];
-				const detail =
-					panel.status === "ready"
-						? `${panel.data.period}@${panel.data.until}/${panel.data.coverage.available_since}`
-						: panel.status === "error"
-							? (panel.error as Error).message
-							: "";
-				return <li key={endpoint}>{`${endpoint}:${panel.status}:${detail}`}</li>;
-			})}
-		</ul>
-	);
+	const panel = useOverviewWindow(period);
+	if (panel.status === "error") lastRetry = panel.retry;
+	const detail =
+		panel.status === "ready"
+			? `${panel.data.period}@${panel.data.until}`
+			: panel.status === "error"
+				? (panel.error as Error).message
+				: "";
+	return <p>{`${panel.status}:${detail}`}</p>;
 }
 
 function renderProbe(period: Period = "24h") {
@@ -144,149 +92,36 @@ function renderProbe(period: Period = "24h") {
 	};
 }
 
-function line(endpoint: OverviewEndpoint): string {
-	const item = screen.getAllByRole("listitem").find((element) => element.textContent?.startsWith(`${endpoint}:`));
-	if (item === undefined) throw new Error(`no probe line for ${endpoint}`);
-	return item.textContent ?? "";
+function line(): string {
+	return screen.getByRole("paragraph").textContent ?? "";
 }
 
-test("the window identity is the period, both bounds and the watermark together", () => {
-	const base = { period: "24h" as const, since: SINCE, until: UNTIL, availableSince: SINCE };
-	expect(sameWindow(base, { ...base })).toBe(true);
-	expect(sameWindow(base, { ...base, period: "1h" })).toBe(false);
-	expect(sameWindow(base, { ...base, since: SINCE - 1 })).toBe(false);
-	expect(sameWindow(base, { ...base, until: UNTIL + 1 })).toBe(false);
-	// The bounds agree and the answers still describe different windows: a prune
-	// between the two requests moved what the same span can be answered for.
-	expect(sameWindow(base, { ...base, availableSince: SINCE + 60 })).toBe(false);
-});
-
-test("the newer until wins, and for equal bounds the later watermark does", () => {
-	const base = { period: "24h" as const, since: SINCE, until: UNTIL, availableSince: SINCE };
-	expect(newerWindow(base, { ...base, until: UNTIL + 60 }).until).toBe(UNTIL + 60);
-	expect(newerWindow({ ...base, until: UNTIL + 60 }, base).until).toBe(UNTIL + 60);
-	expect(newerWindow(base, { ...base, availableSince: SINCE + 60 }).availableSince).toBe(SINCE + 60);
-	// A newer watermark does not outrank an older window's later bound.
-	expect(newerWindow({ ...base, until: UNTIL + 60 }, { ...base, availableSince: SINCE + 60 }).until).toBe(UNTIL + 60);
-});
-
-test("windowIdOf reads the four fields off any of the five bodies", () => {
-	expect(windowIdOf({ period: "7d", since: 1, until: 2, coverage: { complete: false, available_since: 3 } })).toEqual(
-		{
-			period: "7d",
-			since: 1,
-			until: 2,
-			availableSince: 3,
-		},
-	);
-});
-
-test("five responses for one window render as five ready panels", async () => {
+test("the page is loading until the body for the selected period arrives", async () => {
 	renderProbe();
-	await waitFor(() => expect(line("totals")).toContain("ready"));
-	for (const endpoint of OVERVIEW_ENDPOINTS) {
-		expect(line(endpoint)).toBe(`${endpoint}:ready:24h@${UNTIL}/${SINCE}`);
-	}
+	expect(line()).toBe("loading:");
+	await waitFor(() => expect(line()).toBe(`ready:24h@${UNTIL}`));
 });
 
-test("one endpoint behind a bucket boundary is refetched once and then agrees", async () => {
-	// Behind on its first answer, caught up by the time the hook asks again.
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	catchUp.add("routes");
+test("a failed request is one error for the whole page, with a retry that refetches", async () => {
+	failing = true;
 	renderProbe();
 
-	await waitFor(() => expect(line("routes")).toContain("ready"));
-	expect(calls.routes).toBe(2);
-	expect(calls.totals).toBe(1);
-});
+	await waitFor(() => expect(line()).toBe("error:endpoint unavailable"));
+	const spent = calls;
 
-test("a laggard that stays behind fails its own panel and leaves the rest rendering", async () => {
-	bounds.types = { until: UNTIL - 3600, availableSince: SINCE };
-	renderProbe();
-
-	await waitFor(() => expect(line("types")).toContain("error"));
-	expect(line("types")).toContain("different window");
-	// One retry, not a loop.
-	expect(calls.types).toBe(2);
-	for (const endpoint of ["totals", "timeseries", "clients", "routes"] as const) {
-		expect(line(endpoint)).toContain("ready");
-	}
-});
-
-test("a failed request degrades its own panel; the charts keep the window", async () => {
-	failing.add("routes");
-	renderProbe();
-
-	await waitFor(() => expect(line("routes")).toContain("error"));
-	expect(line("routes")).toContain("endpoint unavailable");
-	expect(line("timeseries")).toContain("ready");
-	expect(line("totals")).toContain("ready");
-});
-
-test("a watermark that advanced mid-page is a mismatch, not a mixed window", async () => {
-	// Same bounds, later watermark: retention pruned between the two responses.
-	bounds.clients = { until: UNTIL, availableSince: SINCE + 600 };
-	renderProbe();
-
-	await waitFor(() => expect(line("clients")).toContain(`/${SINCE + 600}`));
-	// The page adopts the later watermark, so the four older answers are the
-	// laggards and each gets its one retry rather than rendering beside it.
-	await waitFor(() => expect(calls.totals).toBe(2));
-	expect(line("clients")).toContain("ready");
+	failing = false;
+	lastRetry();
+	await waitFor(() => expect(line()).toBe(`ready:24h@${UNTIL}`));
+	expect(calls).toBeGreaterThan(spent);
 });
 
 test("a retained previous-period body never renders under the new period's label", async () => {
 	const { rerenderWith } = renderProbe("24h");
-	await waitFor(() => expect(line("totals")).toBe(`totals:ready:24h@${UNTIL}/${SINCE}`));
+	await waitFor(() => expect(line()).toBe(`ready:24h@${UNTIL}`));
 
 	rerenderWith("1h");
-	// Whatever `keepPreviousData` is holding, no panel may claim it answers 1h.
-	await waitFor(() => expect(line("totals")).toBe(`totals:ready:1h@${UNTIL}/${SINCE}`));
-	for (const endpoint of OVERVIEW_ENDPOINTS) expect(line(endpoint)).toContain("1h@");
-});
-
-test("a period change buys the new window its own retry", async () => {
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	const { rerenderWith } = renderProbe("24h");
-	await waitFor(() => expect(line("routes")).toContain("error"));
-	const spent = calls.routes;
-
-	rerenderWith("1h");
-	// The mismatch persists under the new period, and the episode key changed
-	// with it: the retry the abandoned period spent is not the new one's.
-	await waitFor(() => expect(calls.routes).toBeGreaterThan(spent));
-	await waitFor(() => expect(line("routes")).toContain("error"));
-});
-
-test("a retry in flight when the period changes cannot spend the window's retry later", async () => {
-	// The stale completion the tokens exist to orphan: routes lags under 24h, the
-	// hook issues its one retry, and the reader picks 1h before that retry lands.
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	let release = () => {};
-	hold = { promise: new Promise<void>((resolve) => (release = resolve)), release: () => release() };
-
-	const { rerenderWith } = renderProbe("24h");
-	await waitFor(() => expect(calls.routes).toBe(2));
-
-	bounds.routes = { until: UNTIL, availableSince: SINCE };
-	rerenderWith("1h");
-	await waitFor(() => expect(line("routes")).toContain("1h@"));
-
-	// The abandoned retry lands now, under a period it was never asked for.
-	hold.release();
-	hold = null;
-	await waitFor(() => expect(line("routes")).toContain("ready"));
-
-	// Back to the window it was issued for, still lagging. The stale completion
-	// must not have marked this episode spent: the panel gets a real retry before
-	// it is allowed to reach the terminal error.
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	rerenderWith("24h");
-
-	// The cached lagging body is there to render immediately, and the panel must
-	// not state the terminal error off it: that error means "retried and still
-	// behind", and this visit has not retried anything yet. An abandoned
-	// completion recording the episode as spent is what would produce it here.
-	expect(line("routes")).toContain("loading");
-	await waitFor(() => expect(line("routes")).toContain("different window"));
+	// `keepPreviousData` is holding the 24h body. It is a complete answer and
+	// still the wrong one to draw under "1h", so the page waits.
+	expect(line()).toBe("loading:");
+	await waitFor(() => expect(line()).toBe(`ready:1h@${UNTIL}`));
 });

admin/src/features/overview/overviewWindow.ts

@@ -1,249 +1,34 @@
 /**
- * One period, five requests, one window.
+ * One period, one request, one window.
  *
- * Totals, the timeline, the per-client series and the two breakdowns are
- * separate calls, so a refresh that straddles a bucket boundary — or a retention
- * pass that advances the watermark mid-page — can answer them for different
- * windows. Rendering them side by side anyway would put a headline count above
- * charts of a different span, a mixed page that looks exactly like a real one.
+ * The five per-panel endpoints this replaces could each answer for a different
+ * span, so the page had to reconcile five window identities, retry the laggards
+ * and fail the ones that stayed behind. `GET /api/overview` answers every panel
+ * out of a single read transaction: the totals, both timelines and both
+ * breakdowns describe the same span and the same database state by construction,
+ * and none of that reconciliation has anything left to reconcile.
  *
- * This is **window** coherence, not data-snapshot coherence: matching bounds
- * cannot prove a common database state, and live inserts between requests may
- * still shift counts slightly between panels. What it does guarantee is that no
- * two panels ever describe different spans.
- *
- * Rendering is per panel. A panel whose request is still in flight shows its own
- * loading state and a panel whose request failed shows its own error, while the
- * panels that match the window keep rendering — a failed donut never blanks the
- * charts.
+ * What remains is the one rule a single request does not settle by itself.
+ * `keepPreviousData` holds the body of the period the reader just left — a
+ * complete, self-consistent answer, and still the wrong one to draw under the
+ * new label — so a body is a member of this window only while its own `period`
+ * is the selected one. Until then the page is loading.
  */
 
-import { useCallback, useEffect, useRef, useState } from "react";
-import { keepPreviousData, useQuery, type UseQueryResult } from "@tanstack/react-query";
-import { statsClientsQuery, statsQuery, statsRoutesQuery, statsTypesQuery, timeseriesQuery } from "@/lib/queries";
-import type {
-	Coverage,
-	Period,
-	StatsClients,
-	StatsRoutes,
-	StatsTimeseries,
-	StatsTotals,
-	StatsTypes,
-} from "@/lib/types";
-
-export const OVERVIEW_ENDPOINTS = ["totals", "timeseries", "clients", "types", "routes"] as const;
-export type OverviewEndpoint = (typeof OVERVIEW_ENDPOINTS)[number];
-
-interface EndpointBodies {
-	totals: StatsTotals;
-	timeseries: StatsTimeseries;
-	clients: StatsClients;
-	types: StatsTypes;
-	routes: StatsRoutes;
-}
-
-/**
- * What makes two responses the same window. `available_since` joins the bounds
- * because retention advancing between requests changes what the same `[since,
- * until)` can answer for, and mixing a pre-prune answer with a post-prune one is
- * the failure the bounds alone would not catch.
- */
-export interface WindowId {
-	period: Period;
-	since: number;
-	until: number;
-	availableSince: number;
-}
-
-/** The four fields every window-bounded stats body carries. */
-interface Bounded {
-	period: Period;
-	since: number;
-	until: number;
-	coverage: Coverage;
-}
-
-export function windowIdOf(body: Bounded): WindowId {
-	return {
-		period: body.period,
-		since: body.since,
-		until: body.until,
-		availableSince: body.coverage.available_since,
-	};
-}
-
-export function sameWindow(a: WindowId, b: WindowId): boolean {
-	return a.period === b.period && a.since === b.since && a.until === b.until && a.availableSince === b.availableSince;
-}
-
-/**
- * Which of two candidate windows the page adopts: the one that reaches further
- * forward in time, and for identical bounds the one that admits the later
- * watermark. Both rules pick the answer a laggard has to catch up to.
- */
-export function newerWindow(a: WindowId, b: WindowId): WindowId {
-	if (b.until !== a.until) return b.until > a.until ? b : a;
-	return b.availableSince > a.availableSince ? b : a;
-}
-
-function keyOf(id: WindowId): string {
-	return `${id.period}|${id.since}|${id.until}|${id.availableSince}`;
-}
+import { useCallback } from "react";
+import { keepPreviousData, useQuery } from "@tanstack/react-query";
+import { overviewQuery } from "@/lib/queries";
+import type { Overview, Period } from "@/lib/types";
 
 export type Panel<T> =
 	{ status: "loading" } | { status: "error"; error: unknown; retry: () => void } | { status: "ready"; data: T };
 
-export interface OverviewWindow {
-	/** Null until one response for the selected period has arrived. */
-	window: WindowId | null;
-	/** The adopted window's watermark, for the page's single coverage notice. */
-	coverage: Coverage | null;
-	totals: Panel<StatsTotals>;
-	timeseries: Panel<StatsTimeseries>;
-	clients: Panel<StatsClients>;
-	types: Panel<StatsTypes>;
-	routes: Panel<StatsRoutes>;
-}
-
-/**
- * A laggard that stayed behind after its one retry. Not an `ApiError`: nothing
- * failed, the endpoint simply never caught up, and `InlineError` renders the
- * message verbatim.
- */
-export const MISMATCH = new Error("This panel is for a different window than the rest of the page. Try again.");
-
-export function useOverviewWindow(period: Period): OverviewWindow {
-	const queries: { [K in OverviewEndpoint]: UseQueryResult<EndpointBodies[K]> } = {
-		totals: useQuery({ ...statsQuery(period), placeholderData: keepPreviousData }),
-		timeseries: useQuery({ ...timeseriesQuery(period), placeholderData: keepPreviousData }),
-		clients: useQuery({ ...statsClientsQuery(period), placeholderData: keepPreviousData }),
-		types: useQuery({ ...statsTypesQuery(period), placeholderData: keepPreviousData }),
-		routes: useQuery({ ...statsRoutesQuery(period), placeholderData: keepPreviousData }),
-	};
-
-	// A `keepPreviousData` placeholder for the period just left is a complete,
-	// self-consistent body — and still the wrong one to show under the new label,
-	// so it is neither a candidate for the window nor a member of it.
-	const answers = new Map<OverviewEndpoint, WindowId>();
-	for (const endpoint of OVERVIEW_ENDPOINTS) {
-		const data = queries[endpoint].data;
-		if (data !== undefined && data.period === period) answers.set(endpoint, windowIdOf(data));
-	}
-
-	let window: WindowId | null = null;
-	for (const id of answers.values()) window = window === null ? id : newerWindow(window, id);
-
-	// The effect below runs on what the responses say, not on how many times they
-	// arrived: a poll that returns byte-identical data must not restart the retry
-	// bookkeeping. The refetchers ride a ref for the same reason — TanStack hands
-	// back a fresh function identity on some renders, and depending on it would
-	// re-enter the effect with nothing changed.
-	const answersKey = OVERVIEW_ENDPOINTS.map((endpoint) => {
-		const id = answers.get(endpoint);
-		return id === undefined ? "" : keyOf(id);
-	}).join("~");
-	const latest = useRef({ answers, refetch: queries });
-	latest.current = { answers, refetch: queries };
-
-	// Which mismatch episode each endpoint has already spent its retry on, keyed
-	// by endpoint and window identity so a new window buys a new attempt.
-	const retriedFor = useRef(new Map<OverviewEndpoint, string>());
-	// Which retry each endpoint is waiting on. Per endpoint, because one shared
-	// counter would let a second endpoint's retry silence the first's completion;
-	// bumped on every retry issued, so a completion from a window or a period the
-	// page has left can neither clear an error the current one reached nor spend
-	// the current window's one retry.
-	const tokens = useRef(new Map<OverviewEndpoint, number>());
-	// State, not a ref: a retry that returns byte-identical data changes nothing
-	// else a render could see, and the panel still has to reach its error.
-	const [landedFor, setLandedFor] = useState(new Map<OverviewEndpoint, string>());
-
-	// Leaving a period ends every episode it opened. A retry issued for the old
-	// period can still be in flight, and without this its completion would land
-	// under the new one holding a token the map still honours: it would record an
-	// episode as spent, so a return to that window would reach the terminal error
-	// without the retry that error is supposed to follow. Bumping the tokens
-	// orphans those answers, and the cleared maps let the new window start clean.
-	const [lastPeriod, setLastPeriod] = useState(period);
-	if (lastPeriod !== period) {
-		setLastPeriod(period);
-		for (const endpoint of OVERVIEW_ENDPOINTS) {
-			tokens.current.set(endpoint, (tokens.current.get(endpoint) ?? 0) + 1);
-		}
-		retriedFor.current.clear();
-		setLandedFor(new Map());
-	}
-
-	const windowKey = window === null ? null : keyOf(window);
-
-	useEffect(() => {
-		if (windowKey === null) return;
-		for (const [endpoint, identity] of latest.current.answers) {
-			if (keyOf(identity) === windowKey) {
-				retriedFor.current.delete(endpoint);
-				continue;
-			}
-			const episode = `${endpoint}|${windowKey}`;
-			if (retriedFor.current.get(endpoint) === episode) continue;
-			retriedFor.current.set(endpoint, episode);
-			const token = (tokens.current.get(endpoint) ?? 0) + 1;
-			tokens.current.set(endpoint, token);
-			const landed = () => {
-				if (tokens.current.get(endpoint) !== token) return;
-				setLandedFor((previous) => new Map(previous).set(endpoint, episode));
-			};
-			void latest.current.refetch[endpoint].refetch().then(landed, landed);
-		}
-	}, [answersKey, windowKey]);
-
-	const retry = useCallback((endpoint: OverviewEndpoint) => {
-		retriedFor.current.delete(endpoint);
-		tokens.current.set(endpoint, (tokens.current.get(endpoint) ?? 0) + 1);
-		setLandedFor((previous) => {
-			const next = new Map(previous);
-			next.delete(endpoint);
-			return next;
-		});
-		void latest.current.refetch[endpoint].refetch();
-	}, []);
-
-	function panelOf<K extends OverviewEndpoint>(endpoint: K): Panel<EndpointBodies[K]> {
-		const query = queries[endpoint];
-		const onRetry = () => retry(endpoint);
-		if (query.isError) return { status: "error", error: query.error, retry: onRetry };
-		const data = query.data;
-		if (
-			data !== undefined &&
-			windowKey !== null &&
-			data.period === period &&
-			keyOf(windowIdOf(data)) === windowKey
-		) {
-			return { status: "ready", data };
-		}
-		if (windowKey !== null && landedFor.get(endpoint) === `${endpoint}|${windowKey}`) {
-			return { status: "error", error: MISMATCH, retry: onRetry };
-		}
-		return { status: "loading" };
-	}
-
-	const panels = {
-		totals: panelOf("totals"),
-		timeseries: panelOf("timeseries"),
-		clients: panelOf("clients"),
-		types: panelOf("types"),
-		routes: panelOf("routes"),
-	};
-
-	// The notice describes the window, so any member of it can supply the
-	// watermark: whichever panel arrived says the same thing about coverage.
-	let coverage: Coverage | null = null;
-	for (const endpoint of OVERVIEW_ENDPOINTS) {
-		const panel = panels[endpoint];
-		if (panel.status === "ready") {
-			coverage = panel.data.coverage;
-			break;
-		}
-	}
-
-	return { window, coverage, ...panels };
+export function useOverviewWindow(period: Period): Panel<Overview> {
+	const query = useQuery({ ...overviewQuery(period), placeholderData: keepPreviousData });
+	const { refetch } = query;
+	const retry = useCallback(() => void refetch(), [refetch]);
+
+	if (query.isError) return { status: "error", error: query.error, retry };
+	if (query.data !== undefined && query.data.period === period) return { status: "ready", data: query.data };
+	return { status: "loading" };
 }

admin/src/lib/api.test.ts

@@ -1,4 +1,4 @@
-import { ApiError, deleteGroup, getQueries, getStats, listGroups, login, putGroupSources } from "@/lib/api";
+import { ApiError, deleteGroup, getOverview, getQueries, listGroups, login, putGroupSources } from "@/lib/api";
 
 function jsonResponse(payload: unknown, status = 200, headers: Record<string, string> = {}): Response {
 	return new Response(JSON.stringify(payload), {
@@ -50,7 +50,7 @@ test("falls back to a status message on a non-JSON error body", async () => {
 
 test("parses Retry-After on 429", async () => {
 	fetchMock.mockResolvedValue(jsonResponse({ error: "rate limited" }, 429, { "Retry-After": "17" }));
-	const failure = await getStats("1h").catch((e: unknown) => e);
+	const failure = await getOverview("1h").catch((e: unknown) => e);
 	expect(failure).toBeInstanceOf(ApiError);
 	expect((failure as ApiError).status).toBe(429);
 	expect((failure as ApiError).retryAfter).toBe(17);
@@ -58,7 +58,7 @@ test("parses Retry-After on 429", async () => {
 
 test("ignores a malformed Retry-After header", async () => {
 	fetchMock.mockResolvedValue(jsonResponse({ error: "rate limited" }, 429, { "Retry-After": "soon" }));
-	const failure = await getStats().catch((e: unknown) => e);
+	const failure = await getOverview().catch((e: unknown) => e);
 	expect((failure as ApiError).retryAfter).toBeUndefined();
 });
 

admin/src/lib/api.ts

@@ -23,6 +23,7 @@ import type {
 	LoginResponse,
 	LogoutResponse,
 	LookupResult,
+	Overview,
 	PausePost,
 	PauseState,
 	Period,
@@ -35,11 +36,6 @@ import type {
 	SettingsEnvelope,
 	SettingsPatch,
 	SourceStatus,
-	StatsClients,
-	StatsRoutes,
-	StatsTimeseries,
-	StatsTotals,
-	StatsTypes,
 	Upstream,
 	UpstreamEcho,
 	UpstreamInput,
@@ -112,7 +108,7 @@ export const login = (body: LoginRequest): Promise<LoginResponse> =>
 	request("/api/auth/login", { method: "POST", body });
 export const logout = (): Promise<LogoutResponse> => request("/api/auth/logout", { method: "POST", body: {} });
 
-// Query log + stats
+// Query log + overview
 
 export const getQueries = (filter: QueriesFilter = {}): Promise<QueriesPage> =>
 	request(`/api/queries${qs({ ...filter })}`);
@@ -123,13 +119,8 @@ export const getQueryDetail = (id: number): Promise<QueryDetail> => request(`/ap
 /** `EventSource` URL for the live stream; not a fetch route. */
 export const liveQueriesUrl = "/api/queries/live";
 
-export const getStats = (period?: Period): Promise<StatsTotals> => request(`/api/stats${qs({ period })}`);
-export const getStatsTimeseries = (period?: Period): Promise<StatsTimeseries> =>
-	request(`/api/stats/timeseries${qs({ period })}`);
-export const getStatsTypes = (period?: Period): Promise<StatsTypes> => request(`/api/stats/types${qs({ period })}`);
-export const getStatsRoutes = (period?: Period): Promise<StatsRoutes> => request(`/api/stats/routes${qs({ period })}`);
-export const getStatsClients = (period?: Period): Promise<StatsClients> =>
-	request(`/api/stats/clients${qs({ period })}`);
+/** Every Overview panel for one window, from one read transaction. */
+export const getOverview = (period?: Period): Promise<Overview> => request(`/api/overview${qs({ period })}`);
 
 export const getLookup = (domain: string, groupId?: number): Promise<LookupResult> =>
 	request(`/api/lookup${qs({ domain, group_id: groupId })}`);

admin/src/lib/contractSamples.gen.ts

@@ -29,6 +29,7 @@ import type {
 	LoginResponse,
 	LogoutResponse,
 	LookupResult,
+	Overview,
 	PauseState,
 	QueriesPage,
 	QueryDetail,
@@ -36,11 +37,6 @@ import type {
 	RuleEcho,
 	SettingsEnvelope,
 	SourceStatus,
-	StatsClients,
-	StatsRoutes,
-	StatsTimeseries,
-	StatsTotals,
-	StatsTypes,
 	Upstream,
 	UpstreamEcho,
 	Version,
@@ -588,39 +584,6 @@ export const sample_get_query_detail: QueryDetail = {
 	},
 };
 
-export const sample_get_stats: StatsTotals = {
-	avg_response_time_us: null,
-	blocked: 0,
-	clients: 0,
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	period: "1h",
-	queries: 0,
-	since: 0,
-	until: 0,
-};
-
-export const sample_get_stats_timeseries: StatsTimeseries = {
-	bucket_seconds: 0,
-	buckets: [
-		{
-			blocked: 0,
-			cached: 0,
-			queries: 0,
-			ts: 0,
-		},
-	],
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	period: "1h",
-	since: 0,
-	until: 0,
-};
-
 export const sample_get_pause: PauseState = {
 	paused: false,
 	until: null,
@@ -837,31 +800,35 @@ export const sample_error_not_found: ErrorEnvelope = {
 	error: "not found",
 };
 
-export const sample_get_stats_types: StatsTypes = {
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	period: "1h",
-	since: 0,
-	types: [
+export const sample_get_overview: Overview = {
+	bucket_seconds: 0,
+	buckets: [
 		{
-			count: 0,
-			qtype: 0,
+			blocked: 0,
+			cached: 0,
+			queries: 0,
+			ts: 0,
 		},
+	],
+	clients: [
 		{
-			count: 0,
-			qtype: null,
+			buckets: [0],
+			client: "192.0.2.30",
+		},
+		{
+			buckets: [0],
+			client: "192.0.2.31",
+		},
+		{
+			buckets: [0],
+			client: "192.0.2.32",
 		},
 	],
-	until: 0,
-};
-
-export const sample_get_stats_routes: StatsRoutes = {
 	coverage: {
 		available_since: 0,
 		complete: true,
 	},
+	other: [0],
 	period: "1h",
 	routes: [
 		{
@@ -906,32 +873,22 @@ export const sample_get_stats_routes: StatsRoutes = {
 		},
 	],
 	since: 0,
-	until: 0,
-};
-
-export const sample_get_stats_clients: StatsClients = {
-	bucket_seconds: 0,
-	clients: [
+	totals: {
+		avg_response_time_us: 0,
+		blocked: 0,
+		clients: 0,
+		queries: 0,
+	},
+	types: [
 		{
-			buckets: [0],
-			client: "192.0.2.30",
+			count: 0,
+			qtype: 0,
 		},
 		{
-			buckets: [0],
-			client: "192.0.2.31",
-		},
-		{
-			buckets: [0],
-			client: "192.0.2.32",
+			count: 0,
+			qtype: null,
 		},
 	],
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	other: [0],
-	period: "1h",
-	since: 0,
 	until: 0,
 };
 

admin/src/lib/queries.ts

@@ -21,11 +21,7 @@ import type {
 export const queryKeys = {
 	health: ["health"] as const,
 	version: ["version"] as const,
-	stats: (period: Period) => ["stats", period] as const,
-	timeseries: (period: Period) => ["stats", "timeseries", period] as const,
-	statsTypes: (period: Period) => ["stats", "types", period] as const,
-	statsRoutes: (period: Period) => ["stats", "routes", period] as const,
-	statsClients: (period: Period) => ["stats", "clients", period] as const,
+	overview: (period: Period) => ["overview", period] as const,
 	queriesInfinite: (filter: QueriesFilter) => ["queries", "infinite", filter] as const,
 	queryDetail: (id: number) => ["queries", "detail", id] as const,
 	diagnosticsInfinite: (filter: DiagnosticsFilter) => ["diagnostics", "infinite", filter] as const,
@@ -54,34 +50,10 @@ export const healthQuery = () =>
 export const versionQuery = () =>
 	queryOptions({ queryKey: queryKeys.version, queryFn: api.getVersion, staleTime: Infinity });
 
-export const statsQuery = (period: Period = "24h") =>
-	queryOptions({ queryKey: queryKeys.stats(period), queryFn: () => api.getStats(period), refetchInterval: 30_000 });
-
-export const timeseriesQuery = (period: Period = "24h") =>
+export const overviewQuery = (period: Period = "24h") =>
 	queryOptions({
-		queryKey: queryKeys.timeseries(period),
-		queryFn: () => api.getStatsTimeseries(period),
-		refetchInterval: 30_000,
-	});
-
-export const statsTypesQuery = (period: Period = "24h") =>
-	queryOptions({
-		queryKey: queryKeys.statsTypes(period),
-		queryFn: () => api.getStatsTypes(period),
-		refetchInterval: 30_000,
-	});
-
-export const statsRoutesQuery = (period: Period = "24h") =>
-	queryOptions({
-		queryKey: queryKeys.statsRoutes(period),
-		queryFn: () => api.getStatsRoutes(period),
-		refetchInterval: 30_000,
-	});
-
-export const statsClientsQuery = (period: Period = "24h") =>
-	queryOptions({
-		queryKey: queryKeys.statsClients(period),
-		queryFn: () => api.getStatsClients(period),
+		queryKey: queryKeys.overview(period),
+		queryFn: () => api.getOverview(period),
 		refetchInterval: 30_000,
 	});
 

admin/src/lib/types.ts

@@ -291,15 +291,13 @@ export interface DiagnosticsFilter {
 	before?: number;
 }
 
-export interface StatsTotals {
-	period: Period;
-	since: number;
-	until: number;
+/** The window's four headline numbers. */
+export interface OverviewTotals {
 	queries: number;
 	blocked: number;
+	/** Distinct clients seen in the window, not a sum of per-bucket counts. */
 	clients: number;
 	avg_response_time_us: number | null;
-	coverage: Coverage;
 }
 
 export interface Bucket {
@@ -309,67 +307,53 @@ export interface Bucket {
 	cached: number;
 }
 
-export interface StatsTimeseries {
-	period: Period;
-	since: number;
-	until: number;
-	bucket_seconds: number;
-	buckets: Bucket[];
-	coverage: Coverage;
-}
-
 /**
  * One DNS type's share of the window. `qtype` is the numeric code as logged:
  * naming it is the admin's job (`features/provenance/qtype.ts`), and a row whose
  * type was never recorded keeps its own `null` group rather than disappearing.
  */
-export interface StatsTypeRow {
+export interface OverviewTypeRow {
 	qtype: number | null;
 	count: number;
 }
 
-export interface StatsTypes {
-	period: Period;
-	since: number;
-	until: number;
-	types: StatsTypeRow[];
-	coverage: Coverage;
-}
-
 /**
  * How the window's queries were answered. `source` names the answering upstream
  * on `upstream` rows and the zone on `forward_zone` rows; every other route kind
  * carries null, as does a row whose identity was not recorded.
  */
-export interface StatsRouteRow {
+export interface OverviewRouteRow {
 	route: RouteKind;
 	source: string | null;
 	count: number;
 }
 
-export interface StatsRoutes {
-	period: Period;
-	since: number;
-	until: number;
-	routes: StatsRouteRow[];
-	coverage: Coverage;
-}
-
-/** One client's per-bucket counts, aligned to `StatsTimeseries`'s buckets. */
-export interface StatsClientSeries {
+/** One client's per-bucket counts, aligned to `Overview.buckets`. */
+export interface OverviewClientSeries {
 	client: string;
 	buckets: number[];
 }
 
-export interface StatsClients {
+/**
+ * Everything the Overview page draws, for one window, from one request. The
+ * server answers all six panels out of a single read transaction, so the
+ * headline totals, the two timelines and the two breakdowns are guaranteed to
+ * describe the same span *and* the same database state — a coherence the five
+ * endpoints this replaces could not offer.
+ */
+export interface Overview {
 	period: Period;
 	since: number;
 	until: number;
 	bucket_seconds: number;
+	totals: OverviewTotals;
+	buckets: Bucket[];
 	/** The eight busiest clients in the window, ranked by total count. */
-	clients: StatsClientSeries[];
+	clients: OverviewClientSeries[];
 	/** Everything outside the top eight. Always present and always bucket-count-sized. */
 	other: number[];
+	types: OverviewTypeRow[];
+	routes: OverviewRouteRow[];
 	coverage: Coverage;
 }
 

admin/src/routes.tsx

@@ -32,18 +32,15 @@ import {
 	groupsQuery,
 	healthQuery,
 	localRecordsQuery,
+	overviewQuery,
 	queriesInfiniteQuery,
 	queryDetailQuery,
 	rulesQuery,
 	settingsQuery,
-	statsClientsQuery,
-	statsQuery,
-	statsRoutesQuery,
-	statsTypesQuery,
-	timeseriesQuery,
 	upstreamsQuery,
 } from "@/lib/queries";
 import { DEFAULT_PERIOD, parsePeriod } from "@/features/overview/period";
+import { OverviewPending } from "@/features/overview/OverviewFrame";
 import {
 	validateGroupId,
 	validateProtectionSearch,
@@ -168,26 +165,28 @@ const overviewRoute = createRoute({
 	}),
 	loaderDeps: ({ search }): { period: Period } => ({ period: search.period ?? DEFAULT_PERIOD }),
 	/**
-	 * Started here, awaited nowhere. Every panel reads these with `useQuery` and
-	 * owns its own loading and error surface, so awaiting would trade that whole
-	 * contract for one blocking navigation: the page would sit on the slowest of
-	 * five requests and then appear complete, instead of the four that answered
-	 * rendering beside the one still in flight. The rejections are caught only to
-	 * keep them from going unhandled; the panels state them.
+	 * Started here, awaited nowhere. The page reads these with `useQuery` and owns
+	 * its own loading and error surface, so awaiting would trade that contract for
+	 * one blocking navigation: nothing at all until the request answered, rather
+	 * than the heading and the period picker while it is in flight. The rejections
+	 * are caught only to keep them from going unhandled; the page states them.
 	 */
 	loader: ({ context, deps }) => {
 		const start = (promise: Promise<unknown>) => void promise.catch(() => {});
 		start(context.queryClient.ensureQueryData(healthQuery()));
-		start(context.queryClient.ensureQueryData(statsQuery(deps.period)));
-		start(context.queryClient.ensureQueryData(timeseriesQuery(deps.period)));
-		start(context.queryClient.ensureQueryData(statsClientsQuery(deps.period)));
+		start(context.queryClient.ensureQueryData(overviewQuery(deps.period)));
 		// The registered names the client chart labels its series with. Started here
 		// so the lookup is not a second round trip after the page chunk lands.
 		start(context.queryClient.ensureQueryData(clientsQuery()));
-		start(context.queryClient.ensureQueryData(statsTypesQuery(deps.period)));
-		start(context.queryClient.ensureQueryData(statsRoutesQuery(deps.period)));
 	},
 	component: lazyRouteComponent(() => import("@/features/overview/OverviewPage")),
+	/**
+	 * The page's own loading surface, rendered while its chunk is still in flight.
+	 * The default pending component would put a second, differently-placed
+	 * "Loading…" before it, which reads as a stutter rather than one wait.
+	 * `OverviewFrame` is a separate module so this import leaves the charts lazy.
+	 */
+	pendingComponent: OverviewPending,
 });
 
 /**

admin/src/shell/AppShell.test.tsx

@@ -19,44 +19,16 @@ const RECONCILED_AT = 1754899200;
 const DATABASE: ConfigStatus = { authority: "database", path: null, reconciled_at: null, restart_pending: false };
 
 const RESPONSES: Record<string, unknown> = {
-	"/api/stats?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
-		queries: 0,
-		blocked: 0,
-		clients: 0,
-		avg_response_time_us: null,
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/timeseries?period=24h": {
+	"/api/overview?period=24h": {
 		period: "24h",
 		since: 0,
 		until: 86400,
 		bucket_seconds: 1800,
+		totals: { queries: 0, blocked: 0, clients: 0, avg_response_time_us: null },
 		buckets: [],
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/clients?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
-		bucket_seconds: 1800,
 		clients: [],
 		other: [],
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/types?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
 		types: [],
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/routes?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
 		routes: [],
 		coverage: { complete: true, available_since: 0 },
 	},

docs/how-to/set-up-admin-authentication.md

@@ -62,7 +62,7 @@ Which of steps 4 and 5 applies to your server depends on its authority. Under `n
 Login is `POST /api/auth/login` with a JSON body. Without a session, the API answers 401:
 
 ```sh
-curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8451/api/stats
+curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8451/api/overview
 ```
 
 ```
@@ -92,7 +92,7 @@ The cookie is named `nxdns_session` and carries `HttpOnly; SameSite=Lax; Path=/`
 
 ```sh
 curl -sS -b /tmp/nxdns-lab/cookies.txt -o /dev/null -w '%{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+  http://127.0.0.1:8451/api/overview
 ```
 
 ```
@@ -125,13 +125,13 @@ Sessions live in memory only. A restart logs everyone out. Thirty-two concurrent
 ```sh
 curl -sS -b /tmp/nxdns-lab/cookies.txt -c /tmp/nxdns-lab/cookies.txt \
   -X POST http://127.0.0.1:8451/api/auth/logout
-curl -sS -b /tmp/nxdns-lab/cookies.txt -o /dev/null -w 'stats: %{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+curl -sS -b /tmp/nxdns-lab/cookies.txt -o /dev/null -w 'overview: %{http_code}\n' \
+  http://127.0.0.1:8451/api/overview
 ```
 
 ```
 {"authenticated":false}
-stats: 401
+overview: 401
 ```
 
 Logging out with a stale cookie, or with none, answers the same way. The point of logging out is to end up logged out, and that is where such a request already is.
@@ -154,7 +154,7 @@ Changing the password ends every session, including the one that made the change
 
 ```sh
 curl -sS -b /tmp/nxdns-lab/c2.txt -o /dev/null -w 'old session: %{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+  http://127.0.0.1:8451/api/overview
 curl -sS -X POST http://127.0.0.1:8451/api/auth/login \
   -H 'content-type: application/json' -d '{"password":"lab-password"}' \
   -w ' (old password)\n'
@@ -217,14 +217,14 @@ curl -sS -X POST http://127.0.0.1:8451/api/auth/login \
 curl -sS -c /tmp/nxdns-lab/c5.txt -X POST http://127.0.0.1:8451/api/auth/login \
   -H 'content-type: application/json' -d '{"password":"offline-password"}' \
   -w ' (new password, http %{http_code})\n'
-curl -sS -b /tmp/nxdns-lab/c5.txt -o /dev/null -w 'stats: %{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+curl -sS -b /tmp/nxdns-lab/c5.txt -o /dev/null -w 'overview: %{http_code}\n' \
+  http://127.0.0.1:8451/api/overview
 ```
 
 ```
 {"error":"invalid password"} (old password, http 401)
 {"authenticated":true,"auth_required":true} (new password, http 200)
-stats: 200
+overview: 200
 ```
 
 The next export shows the new hash and a null `password` again:
@@ -245,7 +245,7 @@ See [back up and restore](back-up-and-restore.md) for when `import` does need `-
 Authentication is off. Every route is open, and a login attempt succeeds without minting anything — there is nothing to log in to, and a session that authorises nothing would be a lie for the browser to store:
 
 ```sh
-curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8453/api/stats
+curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8453/api/overview
 curl -sS -X POST http://127.0.0.1:8453/api/auth/login \
   -H 'content-type: application/json' -d '{"password":"anything"}'
 ```

docs/reference/api.md

@@ -109,11 +109,7 @@ Auth `open` means no session is required; `session` means a valid session cookie
 | GET | `/api/queries` | session | counted | read | Query log rows for the Activity page |
 | GET | `/api/queries/{id}` | session | counted | read | One query, fully explained |
 | GET | `/api/queries/live` | session | exempt | read | Live query stream (server-sent events) |
-| GET | `/api/stats` | session | counted | read | Totals for a period |
-| GET | `/api/stats/timeseries` | session | counted | read | Bucketed counts for a period |
-| GET | `/api/stats/types` | session | counted | read | Query-type breakdown for a period |
-| GET | `/api/stats/routes` | session | counted | read | How the period's queries were answered |
-| GET | `/api/stats/clients` | session | counted | read | Per-client bucketed counts for a period |
+| GET | `/api/overview` | session | counted | read | Everything the Overview page draws, for one period |
 | GET | `/api/lookup` | session | counted | read | Explain a domain |
 | GET | `/api/diagnostics` | session | counted | read | Operational event log |
 | DELETE | `/api/diagnostics` | session | counted | runtime action | Purge every resolved event |
@@ -221,6 +217,6 @@ A non-empty `rewrites.cname_target` on a query detail means the decision landed
 
 ### Coverage
 
-Every window-bounded read — `GET /api/queries` and the five `GET /api/stats*` endpoints — answers with a `coverage` object: `available_since` is the oldest instant the query log is still complete for, and `complete` is true only when the window the request asked about starts at or after it. Retention deletes rows and advances the watermark in one transaction, so a client can tell an empty window from a pruned one instead of charting the gap as zero. A request with no lower bound at all asks about the whole of history, and is never complete.
+Every window-bounded read — `GET /api/queries` and `GET /api/overview` — answers with a `coverage` object: `available_since` is the oldest instant the query log is still complete for, and `complete` is true only when the window the request asked about starts at or after it. Retention deletes rows and advances the watermark in one transaction, so a client can tell an empty window from a pruned one instead of charting the gap as zero. A request with no lower bound at all asks about the whole of history, and is never complete.
 
-Each of these responses reads its rows and its watermark inside one SQLite read transaction, so retention cannot prune between the two and hand back pre-prune rows tagged with a post-prune `available_since`. Coherence stops there: two separate requests are two separate reads, and queries logged between them can move the counts.
+Each of these responses reads its rows and its watermark inside one SQLite read transaction, so retention cannot prune between the two and hand back pre-prune rows tagged with a post-prune `available_since`. `GET /api/overview` puts every Overview panel inside that one transaction, so its totals and its four breakdowns describe one database state. Coherence stops there: two separate requests are two separate reads, and queries logged between them can move the counts.

specs/milestone-36.md

@@ -0,0 +1,417 @@
+# Milestone 36: Overview performance — combined endpoint, projections, cache
+
+Replace the five per-panel stats endpoints with one `GET /api/overview` served
+from materialized projections in `querylog.db` plus an in-memory response
+cache, so Overview cost stops growing with query-log size.
+
+## Motivation (measured)
+
+Today each Overview load runs five separate scans of every raw row in the
+window, serialized on `WebState.querylog_lock`, re-polled every 30 s. Measured
+x86 ReleaseSafe (bench at scratchpad `statsbench2/`, production-like skew;
+Pi ≈ 3–3.5× slower):
+
+| Rows | 30d, five scans (today) | 30d, one combined scan | 30d, projections |
+|-----:|------------------------:|-----------------------:|-----------------:|
+| 1M   | ~2.2 s                  | 264 ms                 | 41 ms            |
+| 3M   | ~6.6 s                  | 793 ms                 | 38 ms            |
+| 5M   | ~11.8 s                 | 1,346 ms               | 40 ms            |
+
+Projection maintenance costs +10% per 100-row insert batch, and ~1.5 MB of
+disk in the bench — a size bounded by retained buckets × distinct
+client/type/route keys, independent of raw query volume. Production is on a ~100k rows/day growth
+curve (≈3M rows at 30-day retention), so the projection path is the design
+target, not a contingency. Both computations were cross-checked for identical
+output in the bench.
+
+Design ruling (owner + Codex consultation, 2026-08-27): stay on SQLite;
+projections live in the same file as the raw rows and are updated in the same
+transaction, so SQLite's transaction is the coherence mechanism — no second
+file, no epoch protocol. The DDL change re-fingerprints `querylog.db`; the
+existing rename-aside path handles old files (one-time history reset,
+disclosed in the changelog). No backfill migration.
+
+## Sessions
+
+Four sessions. A first. B and C after A, in parallel (disjoint files). D after B.
+
+- A: storage — projection schema, writer maintenance, retention, new read path.
+  A does NOT delete the five existing aggregate functions — `stats.zig` still
+  calls them until B lands, and A must leave `zig build test` green.
+- B: web — `/api/overview` handler, response cache, removal of the five old
+  endpoints, OpenAPI/contract regeneration.
+- C: admin — one overview query, types, component/data plumbing, tests.
+- D: storage cleanup — delete the five now-unreferenced aggregate functions.
+
+---
+
+## Session A: storage
+
+### A.1 Schema (src/storage/querylog_schema.zig)
+
+Append four projection tables to `ddl`. Grain: 30-minute buckets, `bucket` =
+floor-to-grid of the row timestamp: `@divFloor(timestamp, 1800) * 1800` in Zig
+and the equivalent floor semantics in any SQL (SQLite integer `/` truncates
+toward zero, which differs on negative timestamps — use floor everywhere, as
+`window()` does). 1800 divides every serving
+width ≥ 30 min (1800, 3600, 21600), which is what makes one grain serve the
+24h, 7d and 30d windows exactly. The 1h window (60 s buckets) is NOT served
+from projections (A.4).
+
+```sql
+CREATE TABLE bucket_totals (
+    bucket INTEGER PRIMARY KEY,
+    queries INTEGER NOT NULL,
+    blocked INTEGER NOT NULL,
+    cached INTEGER NOT NULL,
+    rt_sum INTEGER NOT NULL,     -- sum(response_time_us) over timed rows
+    rt_count INTEGER NOT NULL    -- count(response_time_us)
+) WITHOUT ROWID;
+
+CREATE TABLE bucket_clients (
+    bucket INTEGER NOT NULL,
+    client_ip TEXT NOT NULL,
+    queries INTEGER NOT NULL,
+    PRIMARY KEY (bucket, client_ip)
+) WITHOUT ROWID;
+
+CREATE TABLE bucket_types (
+    bucket INTEGER NOT NULL,
+    qtype INTEGER NOT NULL,      -- -1 encodes a NULL qtype, losslessly
+    count INTEGER NOT NULL,
+    PRIMARY KEY (bucket, qtype)
+) WITHOUT ROWID;
+
+CREATE TABLE bucket_routes (
+    bucket INTEGER NOT NULL,
+    route_kind TEXT NOT NULL,
+    source_present INTEGER NOT NULL,  -- 0: source NULL; 1: source = source_text
+    source_text TEXT NOT NULL,        -- '' when source_present = 0
+    count INTEGER NOT NULL,
+    PRIMARY KEY (bucket, route_kind, source_present, source_text),
+    CHECK (source_present IN (0, 1)),
+    CHECK (source_present = 1 OR source_text = '')
+) WITHOUT ROWID;
+```
+
+Column semantics match the existing aggregates exactly: `blocked` counts
+`blocked <> 0`; `cached` counts `cache_hit = 1`; routes' `source` is the
+existing CASE (`upstream` rows → `upstream`, `forward_zone` rows →
+`forward_zone`, else NULL). The fingerprint moves automatically; do not touch
+the fingerprint machinery.
+
+### A.2 Writer maintenance (src/storage/repositories/queries_repo.zig)
+
+`BatchWriter.writeBatch` updates all four projections inside the same
+transaction that inserts the raw rows:
+
+- Aggregate the batch in Zig first, producing per-key deltas; then one UPSERT
+  per touched key:
+  `INSERT ... ON CONFLICT(...) DO UPDATE SET queries = queries + excluded.queries, ...`.
+  The aggregation must accept any slice length — `writeBatch`'s API does not
+  enforce the logger's 100-row batching, so no fixed-size arrays sized to it.
+  `BatchWriter` currently owns no allocator: `init` gains one, owned for the
+  writer's life, used only for the per-batch delta maps; scratch is freed (or
+  a retained map cleared) at the end of every `writeBatch`, and
+  `error.OutOfMemory` fails the batch before the transaction opens — no
+  hidden global allocator, no implicit size cap, no quadratic rescanning.
+- No per-row SQL, no triggers.
+- Failure contract: any failed projection statement rolls the whole
+  transaction back — raw rows and projections together — resets every
+  projection statement, and leaves the writer usable for the next batch
+  (`resetAll` discipline as for the raw statements today). Fault-injection
+  acceptance: a batch whose projection update fails leaves the database
+  unchanged, and the next batch succeeds.
+- The bench measured this at 0.39 ms vs 0.34 ms per batch — acceptance is
+  correctness, not speed.
+
+### A.3 Retention (src/storage/repositories/queries_repo.zig, prune path)
+
+In the same transaction as `pruneOlderThan(cutoff)`'s raw delete:
+
+1. Delete projection rows with `bucket < floor(cutoff / 1800) * 1800` from all
+   four tables.
+2. If `cutoff` is not on a bucket boundary, recompute the straddling bucket
+   (`floor(cutoff/1800)*1800`) from the remaining raw rows and replace its
+   projection rows in all four tables. Never approximate.
+
+Failure atomicity: a failure during the projection delete or the
+straddling-bucket replacement rolls back the raw delete, the watermark
+advance and every projection change together — one transaction, tested by
+fault injection.
+
+Implementation note (Session A, recorded post-build): the bucket_totals
+recompute carries `HAVING count(*) > 0` — a bare SQL aggregate always yields
+one row, and an emptied straddling bucket must disappear, not persist as
+zeros.
+
+### A.4 Read path (src/storage/repositories/queries_repo.zig)
+
+One function producing the whole Overview payload for a window, from one
+already-open read transaction (the caller owns transaction + lock, as today):
+
+```zig
+pub const Overview = struct {
+    totals: StatsTotals,
+    buckets: []const Bucket,          // bucket_count entries, zero-filled
+    clients: ClientsBreakdown,        // top-8 + other, as today
+    types: []const TypeCount,         // sorted as stats_types_sql sorts
+    routes: []const RouteCount,       // sorted as stats_routes_sql sorts
+};
+
+pub fn overview(
+    database: *db.Db,
+    arena: Allocator,
+    since: i64,
+    bucket_seconds: u32,
+    bucket_count: u32,
+) db.Error!Overview
+```
+
+Storage owns these scalars — no import of any web module. `until` is derived
+as `since + bucket_seconds * bucket_count` with the same overflow checks as
+`timeseries`. Preconditions, checked before path selection and tested:
+`bucket_seconds != 0` and `bucket_count != 0` (else `error.Misuse`, matching
+the existing clients contract); on the projection path
+(`bucket_seconds >= 1800`) additionally `since` a multiple of 1800 and
+`bucket_seconds % 1800 == 0`, else `error.Misuse`. The handler's `window()`
+guarantees all of them.
+
+Two implementations behind one entry point, chosen by `bucket_seconds`:
+
+- `bucket_seconds >= 1800` (24h, 7d, 30d): read the four projection tables
+  over `[since, until)`, aggregating 30-min rows up to the serving width in
+  Zig. `distinct_clients` comes from grouping `bucket_clients` by `client_ip`
+  over the window — never from summing per-bucket counts.
+  `avg_response_time_us` = `sum(rt_sum) / sum(rt_count)`, null when
+  `rt_count` sums to 0. Top-8 clients ranked by window total desc, ties by
+  `client_ip` asc (BINARY), residual summed into `other` — identical cut
+  semantics to `statsClients`.
+- `bucket_seconds < 1800` (1h): one single pass over the raw rows in the
+  window (one SELECT of the needed columns, stepped once), aggregating
+  everything in Zig. Memory bound: O(distinct clients + distinct qtypes +
+  distinct routes) in the window — explicitly permitted; this is a household
+  LAN and the same bound the arena-returning aggregates already carry. This
+  replaces today's five scans and the clients rank+bucket double scan. Same
+  output contracts.
+
+Sort orders and tie-breaks must reproduce the existing SQL orderings exactly
+(types: count desc, null last within tie, qtype asc; routes: count desc,
+route_kind asc, null source last, source asc) — the goldens' byte-stability
+argument carries over. Note: `RouteKind`'s enum declaration order is not
+alphabetical; "route_kind asc" means the stored text's byte order, so any Zig
+comparator orders by `@tagName` bytes, never by enum ordinal (Session A's
+accumulator already does; mutation-tested).
+
+### A.5 Acceptance criteria
+
+- [ ] `zig build test` green.
+- [ ] Property test: after an arbitrary interleaving of batches and prunes
+      (including a prune cutoff off the bucket grid), every projection table
+      equals a from-scratch recomputation from `query_log`.
+- [ ] Equivalence test: `overview()` output (both paths) equals a test-only
+      oracle over the same window on the same data — including empty windows,
+      NULL qtype, NULL source on an `upstream` row, ties in ranking, and a
+      window whose last bucket is in progress. The oracle is a copy of the
+      five existing SQL aggregates living in the test file, so it survives
+      Session D's deletion of the production functions.
+- [ ] Fingerprint test updated (table/index count assertions in
+      querylog_schema tests).
+
+---
+
+## Session B: web
+
+### B.1 Endpoint (src/web/handlers/overview.zig, replacing stats.zig's five)
+
+`GET /api/overview?period=1h|24h|30d|7d` (same grammar, default 24h, same 400
+text). One read transaction under `WebState.querylog_lock` covering the
+aggregate and `coverage.read` — one snapshot, no cross-panel skew. Response:
+
+```json
+{
+  "period": "24h", "since": ..., "until": ..., "bucket_seconds": 1800,
+  "totals": { "queries": n, "blocked": n, "clients": n, "avg_response_time_us": n|null },
+  "buckets": [ { "ts": ..., "queries": n, "blocked": n, "cached": n }, ... ],
+  "clients": [ { "client": "ip", "buckets": [n, ...] }, ... ],
+  "other": [n, ...],
+  "types": [ { "qtype": n|null, "count": n }, ... ],
+  "routes": [ { "route": "...", "source": "..."|null, "count": n }, ... ],
+  "coverage": { ... }
+}
+```
+
+Field shapes and semantics are exactly today's five bodies merged; `Period`,
+`window()`, `max_buckets` move to (or stay importable from) the new handler.
+503 when the query log is unavailable; 500 logging unchanged. Route metadata
+identical to the removed endpoints: same authentication (`.session`), same
+rate-limit class (`.counted`), same authority policy (`.read`).
+
+Remove `GET /api/stats`, `/api/stats/timeseries`, `/api/stats/types`,
+`/api/stats/routes`, `/api/stats/clients` and their routes.
+
+Contract surface (B owns all of it): add the new path and schema to the
+OpenAPI document, remove the five old operations and their schemas, update
+every drift guard that lists them, add a contract sample for
+`/api/overview`, and regenerate `admin/src/lib/contractSamples.gen.ts`
+(reserved for B — Session C must not touch it). Update the API listings in
+`docs/` and `PLAN.md` that name the five endpoints or the querylog layout.
+
+### B.2 Response cache (src/web/server.zig WebState + overview.zig)
+
+Per-period cached response body, invalidated by data change or window roll.
+Key: `(period, window.until, data_version)` where `data_version` is `PRAGMA
+data_version` on the web task's connection (it changes when any other
+connection — logger, retention — commits).
+
+The entire cache decision happens under `querylog_lock`; nothing touches the
+shared connection or the slots outside it. Exact sequence per request:
+
+1. Acquire `querylog_lock` — ONCE. `server.QuerylogRead.open` acquires this
+   lock itself, so the overview handler must not call it after step 1: B
+   refactors the scope into a lock-owning wrapper plus a
+   locked-caller variant (for example `QuerylogRead.openLocked`, documented
+   as requiring the lock), and the overview path uses the locked-caller
+   variant for step 4. A literal "lock, then QuerylogRead.open" deadlocks.
+2. Sample `PRAGMA data_version` (inside the lock — the shared connection may
+   otherwise have a foreign transaction open, and the slots need the mutual
+   exclusion anyway).
+3. Hit (`slot.period == period and slot.until == window.until and
+   slot.data_version == sampled`): copy the stored bytes into the request
+   arena, release the lock, respond. The copy is what makes a concurrent
+   rebuild's free-and-replace safe.
+4. Miss: open the read transaction, build the body, commit. Publish to the
+   slot ONLY after a successful commit, keyed by the version sampled in
+   step 2 (a commit landing during the build bumps `data_version`, so the
+   next request rebuilds — stale-under-new-key is impossible). A failed
+   commit or build publishes nothing and responds 500 as today.
+5. Copy to the request arena, release the lock, write the socket. The lock
+   never spans a socket write (existing discipline).
+
+Because the check happens only under the lock, `querylog_lock` is the
+single-flight: a second request for the same key waits and then hits.
+
+Storage: one slot per period (4 slots) in `WebState`; body bytes allocated
+from `WebState.gpa`, replaced on rebuild (free old, install new), freed in
+`deinit`. No capacity limit beyond the allocator — a body is bounded by the
+fixed bucket counts plus the household client/type/route cardinality.
+
+No adaptive polling and no combined-endpoint staging: with projections + this
+cache a rebuild is ~40 ms x86 / ~0.13 s Pi, so the admin's existing 30 s
+cadence is fine.
+
+### B.3 Acceptance criteria
+
+- [ ] `zig build test` green; handler tests ported from stats.zig (period
+      grammar, window math, one-snapshot behavior) plus: cache hit returns
+      byte-identical body; a logger commit (data_version bump) invalidates;
+      a window roll invalidates; a retention prune committed through another
+      connection invalidates (both the aggregates and the cached
+      `coverage.available_since` are replaced); a failed read-transaction
+      commit neither installs nor replaces a cache entry.
+- [ ] `curl /api/overview?period=30d` on a seeded scratch instance returns all
+      panels consistent (breakdowns sum to totals on a quiet database).
+- [ ] The five old routes return 404.
+
+---
+
+## Session C: admin
+
+### C.1 Data layer
+
+- `admin/src/lib/types.ts`: one `Overview` type mirroring B.1; remove the five
+  per-panel response types.
+- `admin/src/lib/api.ts`: `getOverview(period)`; remove the five getters.
+- `admin/src/lib/queries.ts`: `overviewQuery(period)` with
+  `refetchInterval: 30_000` and key `["overview", period]`; remove the five
+  stats query factories and their keys.
+
+### C.2 Overview page
+
+`admin/src/features/overview/overviewWindow.ts` and the chart components
+consume the single query: one `useQuery` where five ran in parallel. Loading,
+error and coverage handling collapse to one page-level surface (one spinner
+state, one error state for the whole Overview); the per-panel shells,
+layout, copy, chart dimensions and accessibility attributes stay exactly as
+they are. Chart components (TimeseriesChart, ClientChart, Donut) keep their
+props — adapt the mapping layer, not the charts. C must not touch
+`contractSamples.gen.ts` (B owns its regeneration).
+
+### C.3 Acceptance criteria
+
+- [ ] `npm test` green in admin/ (mock the one endpoint; port the five-query
+      tests).
+- [ ] `npm run typecheck` green — the build alone does not run tsc. B and C
+      are file-disjoint but type-coupled through `contractSamples.gen.ts`:
+      C's typecheck/test/build gates run (or re-run) AFTER B has regenerated
+      that file. Implementation may proceed in parallel; the green gate is
+      sequenced.
+- [ ] `npm run build` green; bundle-size assertion still passes.
+- [ ] Manual: scratch instance renders all Overview panels from the new
+      endpoint on all four periods.
+
+---
+
+## Session D: storage cleanup
+
+After B is merged and green: delete `statsTotals`, `timeseries`, `statsTypes`,
+`statsRoutes`, `statsClients` and their SQL constants from
+`queries_repo.zig` — nothing references them once `stats.zig` is gone. The
+test-only oracle from A.5 stays. Acceptance: `zig build test` green, no dead
+stats SQL remains in production code.
+
+---
+
+## Module layout
+
+- `src/web/handlers/overview.zig` — new; replaces `src/web/handlers/stats.zig`
+  (deleted by B).
+- `src/storage/querylog_schema.zig` — projection DDL appended.
+- `src/storage/repositories/queries_repo.zig` — writer maintenance, retention
+  integration, `overview()` read path (A); five old aggregates deleted (D).
+- Admin files per C.1/C.2.
+
+## File ownership
+
+- A: `src/storage/*` (old aggregates left in place), plus the mechanical
+  allocator-plumbing at every `BatchWriter.init` call site outside storage
+  (`src/web/handlers/*`, `src/web/web_integration_test.zig`, any test using
+  the writer) — A runs before B, so this is sequential, not shared,
+  ownership; A's gate is the full `zig build test`.
+- B: `src/web/*`, plus: `src/app.zig` (cache cleanup at the composition
+  root), `src/tests.zig` (handler import swap), the OpenAPI document and its
+  drift guards, contract samples including
+  `admin/src/lib/contractSamples.gen.ts`, `docs/**` API listings, `PLAN.md`
+  stale sections, and the Overview/API sections of `specs/ui-redesign.md`
+  (which still mandates the five endpoints and must be amended, not obeyed).
+- C: `admin/*` EXCEPT `admin/src/lib/contractSamples.gen.ts`.
+- D: `src/storage/repositories/queries_repo.zig` (sequential, after B).
+- Orchestrator: `CHANGELOG.md` (hand-written, per release process).
+B and C run in parallel; the one shared-tree exception above is reserved to B.
+
+## Acceptance criteria (milestone complete)
+
+- [ ] `zig build test` and `zig build test -Dintegration` green (the
+      integration suite carries the live route walk, contract-sample
+      comparison, concurrent querylog reads and OpenAPI guards); admin
+      `npm test`/`typecheck`/`build` green.
+- [ ] Scratch-instance smoke: seeded data + live digs; Overview correct on all
+      periods; old endpoints gone.
+- [ ] Changelog discloses: schema change resets query history (rename-aside),
+      five endpoints replaced by `/api/overview`.
+- [ ] Release gate (`zig build cut` fingerprint check) satisfied.
+
+## Anti-requirements
+
+- No second database file, no epoch/validity protocol, no ATTACH.
+- No backfill migration, no rebuild command, no catch-up cursor — projections
+  are born with the file and maintained transactionally; that is the whole
+  coherence story.
+- No connection pool, no adaptive polling, no DuckDB.
+- No new indexes on `query_log`, no triggers, no per-row projection SQL.
+- Do not change the 1h/24h/7d/30d period grammar, bucket widths or counts.
+- No HTTP-level caching of any kind: no ETag, no `Cache-Control`, no
+  stale-while-revalidate, no background refresh, and never cache a 500/503
+  body. The cache is exactly the in-process design of B.2.
+- No visual redesign, no chart-prop changes, no cache configuration knobs,
+  no cache metrics. This milestone changes data acquisition and storage only.

specs/ui-redesign.md

@@ -54,14 +54,14 @@ One question, answered over a period the reader chooses: what did the resolver d
 
 Top to bottom, edge to edge:
 
-1. **Four stat tiles**, neutral chrome throughout — no coloured accents; emphasis is typographic. Queries, Blocked (count and rate), Clients, Average response. Each tile carries the way into the rows behind its number: Queries and Blocked open Activity for exactly the bounds the stats response returned, Clients opens the clients page, and Average response has nothing to open.
+1. **Four stat tiles**, neutral chrome throughout — no coloured accents; emphasis is typographic. Queries, Blocked (count and rate), Clients, Average response. Each tile carries the way into the rows behind its number: Queries and Blocked open Activity for exactly the bounds the overview response returned, Clients opens the clients page, and Average response has nothing to open.
 2. **Queries over time** — the existing query-volume timeline, split blocked/cached/other, full width.
 3. **Client activity over time** — one stacked series per named client plus "other", on the same bucket alignment as the timeline so the two charts share an x-axis. A client registered under a name is labelled by it, with the same precedence the query tables apply and the address kept as the title; colour keys on the address, so naming a client never repaints its series.
 4. **Query types** and **Upstream servers** — two donuts, side by side above 1280px and stacked below, with the ring and its legend centred in the panel while stacked and left-anchored once they are a pair. Types are labelled by the admin's own `qtypeName()`; routes by route-kind labels and by the answering resolver or zone. Each donut's SVG is decoration (`aria-hidden`, `focusable="false"`); a visible legend and a visually hidden table are the accessible surface. An empty window says "No queries in this period." rather than drawing nothing.
 
 Colours key on semantic identity — the qtype value, the client string, the `(route, source)` pair — so a rank change between two polls never repaints an entry. Charts stay lightweight SVG; no charting dependency.
 
-**Window coherence, five requests.** Totals, timeseries, clients, types and routes are separate calls, and the page holds one window identified by `(period, since, until, coverage.available_since)` — the watermark joins the identity because retention advancing mid-page changes what the same span can answer for. A response is a member only if all four fields match. Rendering is per panel: a member renders, a panel still in flight shows its own loading state, a panel whose request failed shows its own error and Retry, and the members keep rendering throughout — a failed donut never blanks the charts. A response behind the window is refetched once per endpoint-keyed episode and, if it stays behind, that panel alone shows an error. This is window coherence, not data-snapshot coherence: live inserts between requests may shift counts slightly between panels, and that is accepted. One coverage notice for the page, from the window's watermark.
+**One request, one snapshot (superseded 2026-08-27 by milestone 36; the paragraph below replaces the original five-request window-coherence design).** The page makes one call, `GET /api/overview?period=…`, whose body carries totals, timeseries, clients, types, routes and coverage from a single read transaction — data-snapshot coherence, so the panels cannot disagree and no reconciliation layer exists. Loading and error are page-level: one loading surface, one error with Retry for the whole Overview. The per-panel shells, layout, copy and accessibility surfaces are unchanged. One coverage notice for the page, from the response's watermark. A `keepPreviousData` body whose own `period` is not the selected one keeps the page in loading.
 
 **The shell.** The header carries no protection display at all. The Pause/Resume control sits at the foot of the sidebar, above the version label, in both the desktop rail and the mobile drawer; it is the only global runtime action, and it belongs to the resolver rather than to any page. It still appears beside the detail of a query that was blocked. The control states a pause with itself — "Paused until 14:05", or "Paused" when the pause has no end — because "Resume" names an action without naming the state it would end, and with the indicator and the status rows both gone the sidebar is the only place a page other than Diagnostics can carry that fact. An active resolver gets no line; the button says Pause, which is the whole message. The line and the health strip read one `protection` condition through one clock format, so they cannot disagree. The Diagnostics navigation item carries a badge: the open-episode count, or a neutral "!" when the rollup is degraded with nothing open and when the latest health poll failed — an unknown must never read as healthy. It is hidden only when health data exists, the latest poll succeeded, and the rollup is ok with nothing open.
 
@@ -168,7 +168,7 @@ No response payloads, answer RR sets, EDNS data or packet bytes are stored. The
 
 Privacy transforms apply to every new domain-bearing field, not only `domain`: with `hide_domains` on, matched names, CNAME targets and safe-search targets hide consistently.
 
-A one-row `querylog_meta (created_at INTEGER NOT NULL)` table lets the stats and query APIs return a conservative `available_since`, which distinguishes "zero queries" from "history does not exist".
+A one-row `querylog_meta (created_at INTEGER NOT NULL)` table lets the overview and query APIs return a conservative `available_since`, which distinguishes "zero queries" from "history does not exist".
 
 ### Historical query detail
 
@@ -208,9 +208,9 @@ Database mode uses the same information architecture with real edit actions, plu
 
 `GET /api/queries` keeps keyset pagination and its filters; rows gain `rcode`, `route_kind`, `policy_action` and the short policy reason the table needs, and the body gains `coverage: {complete, available_since}`. `GET /api/queries/{id}` returns nested `request` / `policy` / `route` / `response` provenance. `GET /api/queries/live` sends the same object without `id`.
 
-`GET /api/stats` and `/api/stats/timeseries` add `complete` and `available_since`.
+**Superseded by milestone 36 (2026-08-27).** This section originally specified five per-panel endpoints — `GET /api/stats`, `/api/stats/timeseries`, `/api/stats/types`, `/api/stats/routes` and `/api/stats/clients`. Five requests could promise a shared window but never a shared snapshot, and each one scanned every raw row in it. They are replaced by a single `GET /api/overview?period=1h|24h|7d|30d`, which returns `{period, since, until, bucket_seconds, totals:{queries, blocked, clients, avg_response_time_us}, buckets:[{ts, queries, blocked, cached}], clients:[{client, buckets}], other, types:[{qtype, count}], routes:[{route, source, count}], coverage:{complete, available_since}}` — every field with the semantics the five bodies gave it, over one deferred SQLite read transaction, so the breakdowns and the coverage watermark describe one database state. The 24h, 7d and 30d windows are served from 30-minute projection tables maintained transactionally beside the raw rows; the 1h window takes one raw scan. Per-period response caching keyed on `(window.until, PRAGMA data_version)` lives in the web layer.
 
-**Three period aggregations (added 2026-08-22)** to feed the new Overview panels, all taking the same `period` parameter and reporting over the same aligned window, and all reading their rows and their coverage watermark inside one deferred SQLite read transaction. `GET /api/stats/types` → `{period, since, until, coverage, types:[{qtype, count}]}`, the numeric type only — naming types stays the admin's job, and a second table in the server would drift out of agreement with it — with the rows that recorded no type kept as their own `null` group. `GET /api/stats/routes` → `{period, since, until, coverage, routes:[{route, source, count}]}`, grouping `upstream` rows by the answering resolver and `forward_zone` rows by the zone, with blocked, cache, local and rejected carrying no source. `GET /api/stats/clients` → `{period, since, until, bucket_seconds, coverage, clients:[{client, buckets}], other}`, bucketed exactly as `/api/stats/timeseries`, the eight busiest clients named and everything else summed into `other`, which is always present and always bucket-count-sized. No new writers and no new state: all three are pure reads over the query log's provenance columns.
+The panel semantics the five endpoints defined all carry over unchanged: types are the numeric type only — naming types stays the admin's job, and a second table in the server would drift out of agreement with it — with the rows that recorded no type kept as their own `null` group; routes group `upstream` rows by the answering resolver and `forward_zone` rows by the zone, with blocked, cache, local and rejected carrying no source; clients name the eight busiest and sum everything else into `other`, which is always present and always bucket-count-sized.
 
 Existing mutation endpoints stay specific. Diagnostics introduces no generic "perform remediation" endpoint; it invokes the existing blocklist-refresh and certificate-reload operations.
 

src/app.zig

@@ -817,6 +817,9 @@ fn serve(r: cli.Runner, args: cli.RunArgs) !u8 {
     // Same argument as the live hash: a settings PUT may have installed an
     // owned generation, and this runs after `group.cancel`.
     defer web_state.proxies.deinit(gpa);
+    // The Overview response cache owns its bodies from `gpa`. Same argument
+    // again: no web task can still be reading a slot once the group is cancelled.
+    defer web_state.overview_cache.deinit(gpa);
     if (cfg.web.enabled) web_state = .{
         .gpa = gpa,
         .web = cfg.web,

src/storage/logger.zig

@@ -30,6 +30,7 @@
 //! `writer_failed`, so the loss is visible rather than silent.
 
 const std = @import("std");
+const Allocator = std.mem.Allocator;
 const builtin = @import("builtin");
 
 const db = @import("db.zig");
@@ -555,13 +556,17 @@ pub const Logger = struct {
     /// group it cancels for exactly that reason.
     ///
     /// `monitor` is the §11.6 gate. Null disables gating.
+    ///
+    /// `gpa` belongs to the `BatchWriter` for that writer's whole life; it
+    /// allocates the projection deltas of one batch and nothing else.
     pub fn runWriter(
         self: *Logger,
         io: std.Io,
+        gpa: Allocator,
         database: *db.Db,
         monitor: ?*disk_monitor.Monitor,
     ) std.Io.Cancelable!void {
-        var writer = queries_repo.BatchWriter.init(database) catch |err| {
+        var writer = queries_repo.BatchWriter.init(gpa, database) catch |err| {
             scope.warn("query logger: preparing the batch statements failed: {s}", .{@errorName(err)});
             // Without a writer there is no consumer, so leaving the queue open
             // would silently swallow every later entry.
@@ -1134,7 +1139,7 @@ test "an entry with every provenance field set survives the queue, toRow, insert
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -1466,6 +1471,7 @@ test "shutdown writes the batch the writer holds and the rest of the queue" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1502,7 +1508,7 @@ test "entries that arrive inside one window reach the database in one batch" {
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [16]Entry = undefined;
@@ -1559,6 +1565,7 @@ test "the writer holds an entry for the length of the flush interval" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1611,6 +1618,7 @@ test "a full batch flushes without waiting for the interval" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1658,6 +1666,7 @@ test "the writer's next cycle uses the interval set since its last one" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1700,7 +1709,7 @@ test "a gated flush holds the batch until the disk recovers" {
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -1754,7 +1763,7 @@ test "a failing batch is dropped whole and the writer stays usable" {
         \\BEGIN SELECT RAISE(ABORT, 'refused'); END;
     );
 
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -1789,7 +1798,7 @@ test "a writer that cannot prepare closes the queue and counts every entry" {
 
     for (0..3) |i| logger.log(io, sampleEntry(@intCast(i), "early.example"));
 
-    try logger.runWriter(io, &database, null);
+    try logger.runWriter(io, testing.allocator, &database, null);
 
     try testing.expect(logger.writer_failed.load(.acquire));
     try testing.expectEqual(@as(u64, 3), logger.queries_dropped.load(.monotonic));
@@ -1842,6 +1851,7 @@ test "the gating episode opens on the gate, turns losing on a drop, and clears o
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -2023,6 +2033,7 @@ test "a canceled writer counts the batch it was holding" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -2072,6 +2083,7 @@ test "a disk-gated writer drops what it holds at shutdown instead of hanging" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -2121,7 +2133,7 @@ test "an empty batch touches neither the database nor the counters" {
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -2155,7 +2167,7 @@ test "a dropped batch opens an error episode the next good batch closes" {
     try fx.init(io, 1000);
     defer fx.deinit();
 
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -2198,7 +2210,7 @@ test "a writer that cannot prepare leaves an episode no recovery path claims" {
     var logger: Logger = .init(.{}, &buf);
     logger.diagnostics = &fx.store;
 
-    try logger.runWriter(io, &database, null);
+    try logger.runWriter(io, testing.allocator, &database, null);
 
     try testing.expectEqualStrings("writer", try fx.text(
         "SELECT subject_key FROM operational_events WHERE resolved_at IS NULL",
@@ -2209,7 +2221,7 @@ test "a writer that cannot prepare leaves an episode no recovery path claims" {
 
     // The writer returned, so nothing can ever close this. A second run finds
     // the queue closed and adds no second episode.
-    try logger.runWriter(io, &database, null);
+    try logger.runWriter(io, testing.allocator, &database, null);
     try testing.expectEqual(
         @as(i64, 1),
         try fx.count("SELECT count(*) FROM operational_events WHERE resolved_at IS NULL"),

src/storage/logger_controller.zig

@@ -248,6 +248,7 @@ pub const Controller = struct {
         owned.writer = try io.concurrent(logger.Logger.runWriter, .{
             generation.logger,
             io,
+            opts.gpa,
             &owned.database,
             opts.monitor,
         });
@@ -434,7 +435,7 @@ pub const Controller = struct {
         errdefer generation.deinit(self.gpa);
         const owned = &generation.owned.?;
 
-        owned.writer = try io.concurrent(runParkedWriter, .{ generation, io, self.monitor });
+        owned.writer = try io.concurrent(runParkedWriter, .{ generation, io, self.gpa, self.monitor });
 
         // The statements are prepared before anything is published, so a
         // failure here is a refused settings change rather than a writer that
@@ -565,11 +566,12 @@ fn drain(generation: *Generation, io: std.Io) void {
 fn runParkedWriter(
     generation: *Generation,
     io: std.Io,
+    gpa: Allocator,
     monitor: ?*disk_monitor.Monitor,
 ) std.Io.Cancelable!void {
     const owned = &generation.owned.?;
 
-    var writer = queries_repo.BatchWriter.init(&owned.database) catch |err| {
+    var writer = queries_repo.BatchWriter.init(gpa, &owned.database) catch |err| {
         owned.prepare_error = err;
         owned.ready.set(io);
         return;

src/storage/phase6_integration_test.zig

@@ -144,7 +144,7 @@ fn awaitCount(counter: *const std.atomic.Value(u64), target: u64, limit: usize)
 }
 
 fn writeRows(database: *db.Db, timestamps: []const i64, domain: []const u8) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
 
     var rows: [16]queries_repo.Row = undefined;
@@ -208,6 +208,7 @@ test "S8 case 1: the logger writes a real querylog.db end to end" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
@@ -256,6 +257,7 @@ test "S8 case 2: a single entry reaches the file once the flush interval passes"
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
@@ -311,6 +313,7 @@ test "S8 case 3: a full queue drops the oldest entries and the newest survive" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -359,6 +362,7 @@ test "S8 case 4: the privacy transforms reach the stored rows" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
@@ -459,6 +463,7 @@ test "S8 case 6: a critical disk gates the flushes and recovery releases them" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, &monitor),
     });

src/storage/querylog_schema.zig

@@ -25,7 +25,7 @@ const log = std.log.scoped(.querylog_schema);
 /// PLAN §11.3, plus the coverage watermark of milestone 28. Multi-statement
 /// text — it goes through `db.Db.exec`, never through `prepare`.
 ///
-/// The trailing INSERT seeds `querylog_meta`, which is part of the schema
+/// The INSERT seeds `querylog_meta`, which is part of the schema
 /// rather than a later step: a `query_log` with no watermark beside it cannot
 /// answer whether an empty result means "no queries" or "no history", and every
 /// database this program reads from is created by executing this string.
@@ -36,6 +36,13 @@ const log = std.log.scoped(.querylog_schema);
 /// logged in the same second the file was created is not evidence that the
 /// second is completely covered, and the watermark's whole job is to be
 /// conservative. From there it only ever advances, in `queries_repo.pruneOlderThan`.
+///
+/// The four `bucket_*` tables are the Overview projections (milestone 36), on a
+/// 30-minute grain that divides every serving width the API offers. They carry
+/// no history of their own: they are born with the file and maintained in the
+/// same transaction as every insert and every prune, so SQLite's transaction is
+/// the only coherence mechanism there is. There is no backfill path — a file
+/// whose projections could disagree with its rows cannot exist.
 pub const ddl: [:0]const u8 =
     \\CREATE TABLE domains (
     \\    id INTEGER PRIMARY KEY,
@@ -78,6 +85,40 @@ pub const ddl: [:0]const u8 =
     \\);
     \\INSERT INTO querylog_meta (id, created_at, available_since)
     \\VALUES (1, unixepoch(), unixepoch() + 1);
+    \\
+    \\CREATE TABLE bucket_totals (
+    \\    bucket INTEGER PRIMARY KEY,
+    \\    queries INTEGER NOT NULL,
+    \\    blocked INTEGER NOT NULL,
+    \\    cached INTEGER NOT NULL,
+    \\    rt_sum INTEGER NOT NULL,     -- sum(response_time_us) over timed rows
+    \\    rt_count INTEGER NOT NULL    -- count(response_time_us)
+    \\) WITHOUT ROWID;
+    \\
+    \\CREATE TABLE bucket_clients (
+    \\    bucket INTEGER NOT NULL,
+    \\    client_ip TEXT NOT NULL,
+    \\    queries INTEGER NOT NULL,
+    \\    PRIMARY KEY (bucket, client_ip)
+    \\) WITHOUT ROWID;
+    \\
+    \\CREATE TABLE bucket_types (
+    \\    bucket INTEGER NOT NULL,
+    \\    qtype INTEGER NOT NULL,      -- -1 encodes a NULL qtype, losslessly
+    \\    count INTEGER NOT NULL,
+    \\    PRIMARY KEY (bucket, qtype)
+    \\) WITHOUT ROWID;
+    \\
+    \\CREATE TABLE bucket_routes (
+    \\    bucket INTEGER NOT NULL,
+    \\    route_kind TEXT NOT NULL,
+    \\    source_present INTEGER NOT NULL,  -- 0: source NULL; 1: source = source_text
+    \\    source_text TEXT NOT NULL,        -- '' when source_present = 0
+    \\    count INTEGER NOT NULL,
+    \\    PRIMARY KEY (bucket, route_kind, source_present, source_text),
+    \\    CHECK (source_present IN (0, 1)),
+    \\    CHECK (source_present = 1 OR source_text = '')
+    \\) WITHOUT ROWID;
 ;
 
 /// The fingerprint of an arbitrary DDL text. `tools/cut.zig` calls this at
@@ -324,13 +365,23 @@ test "ddl creates the query-log tables and every index" {
     try database.exec(ddl);
 
     try testing.expectEqual(
-        @as(i64, 3),
+        @as(i64, 7),
         try database.queryInt("SELECT count(*) FROM sqlite_schema WHERE type='table'"),
     );
+    // The three explicit indexes plus `domains.domain`'s autoindex, and
+    // nothing else: the four projection tables are WITHOUT ROWID, so each
+    // one's PRIMARY KEY *is* its storage rather than a second b-tree to keep
+    // in step on every insert.
+    try testing.expectEqual(
+        @as(i64, 4),
+        try database.queryInt("SELECT count(*) FROM sqlite_schema WHERE type='index'"),
+    );
     const objects = [_][]const u8{
         "domains",              "query_log",
         "idx_query_log_ts",     "idx_query_log_client",
         "idx_query_log_domain", "querylog_meta",
+        "bucket_totals",        "bucket_clients",
+        "bucket_types",         "bucket_routes",
     };
     for (objects) |name| {
         var stmt = try database.prepare("SELECT count(*) FROM sqlite_schema WHERE name = ?1");

src/storage/retention.zig

@@ -251,7 +251,7 @@ fn openLog() !db.Db {
 }
 
 fn writeRows(database: *db.Db, timestamps: []const i64) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
     var rows: [8]queries_repo.Row = undefined;
     for (timestamps, rows[0..timestamps.len]) |timestamp, *row| {

src/tests.zig

@@ -106,7 +106,7 @@ comptime {
     _ = @import("web/server_integration_test.zig");
     _ = @import("server/local_tables.zig");
     _ = @import("web/metrics.zig");
-    _ = @import("web/handlers/stats.zig");
+    _ = @import("web/handlers/overview.zig");
     _ = @import("web/handlers/queries.zig");
     _ = @import("web/handlers/diagnostics.zig");
     _ = @import("web/handlers/lookup.zig");

src/web/coverage.zig

@@ -6,10 +6,9 @@
 //! complete for. Without that fact on the wire a chart draws a pruned week as a
 //! week of silence, which is the one reading that is certainly wrong.
 //!
-//! Three endpoints carry it — `/api/queries`, `/api/stats` and
-//! `/api/stats/timeseries` — and they judge it against their own effective
-//! lower bound: the client's `since` for the query log, the period's aligned
-//! window start for the two stats endpoints.
+//! Two endpoints carry it — `/api/queries` and `/api/overview` — and they judge
+//! it against their own effective lower bound: the client's `since` for the
+//! query log, the period's aligned window start for the overview.
 
 const std = @import("std");
 

src/web/handlers/overview.zig

@@ -0,0 +1,647 @@
+//! `GET /api/overview`: everything the Overview page draws, for one period, in
+//! one response.
+//!
+//! It replaces the five per-panel endpoints milestone 30 shipped. Those cost
+//! five scans of every raw row in the window and, being five requests, could
+//! only promise a shared *window* — queries logged between two of them moved
+//! one panel and not the other. One request over one read transaction promises
+//! a shared *snapshot*: the totals, the four breakdowns and the coverage
+//! watermark beside them all describe one database state, so the breakdowns sum
+//! to the totals for a reason and not by luck.
+//!
+//! Buckets are aligned to the UTC grid, not to the moment of the request. Every
+//! width divides a day, so flooring the current time to a multiple of the width
+//! puts each bucket on the same boundary a human reads off a clock, and two
+//! requests a second apart return the same bucket starts. The last bucket is
+//! the one in progress; it fills as the period runs.
+//!
+//! The aggregate runs on the web task's own query-log connection (m7 ruling
+//! 21), which every connection task shares. SQLite's serialized mode makes one
+//! call safe; it does not make a transaction safe, so `WebState.querylog_lock`
+//! covers the whole read and a second BEGIN can never land inside the first.
+//! The transaction is deferred, not `db.Tx`'s BEGIN IMMEDIATE, which would
+//! stall the logger and retention behind an HTTP response.
+//!
+//! The lock is released before the response is written: the body is already
+//! built in the request arena, and holding a database lock across a socket
+//! write would let one slow client serialize every other reader.
+
+const std = @import("std");
+
+const coverage = @import("../coverage.zig");
+const db = @import("../../storage/db.zig");
+const http_util = @import("../http_util.zig");
+const queries_repo = @import("../../storage/repositories/queries_repo.zig");
+const server = @import("../server.zig");
+
+const log = std.log.scoped(.web_overview);
+
+/// The four periods ruling 13 defines. The tag names are the wire spellings.
+pub const Period = enum {
+    @"1h",
+    @"24h",
+    @"7d",
+    @"30d",
+
+    pub fn parse(text: []const u8) ?Period {
+        return std.meta.stringToEnum(Period, text);
+    }
+
+    /// Ruling 13: 1h→60×1m, 24h→48×30m, 7d→168×1h, 30d→120×6h.
+    pub fn bucketSeconds(self: Period) u32 {
+        return switch (self) {
+            .@"1h" => 60,
+            .@"24h" => 30 * 60,
+            .@"7d" => 60 * 60,
+            .@"30d" => 6 * 60 * 60,
+        };
+    }
+
+    pub fn bucketCount(self: Period) u32 {
+        return switch (self) {
+            .@"1h" => 60,
+            .@"24h" => 48,
+            .@"7d" => 168,
+            .@"30d" => 120,
+        };
+    }
+
+    pub fn label(self: Period) []const u8 {
+        return @tagName(self);
+    }
+};
+
+pub const default_period: Period = .@"24h";
+
+/// The widest period's bucket count. Nothing here allocates by it any more —
+/// the repository returns arena slices — but it is the bound the response size
+/// argument rests on, and the assertion below is what keeps it true.
+pub const max_buckets = 168;
+
+comptime {
+    std.debug.assert(std.enums.values(Period).len == server.OverviewCache.slot_count);
+    for (std.enums.values(Period)) |period| {
+        std.debug.assert(period.bucketCount() <= max_buckets);
+        // The UTC alignment argument holds only while every width divides a day.
+        std.debug.assert(86_400 % period.bucketSeconds() == 0);
+    }
+}
+
+pub const Window = struct {
+    /// Inclusive, on the bucket grid.
+    since: i64,
+    /// Exclusive: the end of the bucket that `now` falls in.
+    until: i64,
+    bucket_seconds: u32,
+    bucket_count: u32,
+};
+
+pub fn window(period: Period, now_unix: i64) Window {
+    const width: i64 = period.bucketSeconds();
+    const count: i64 = period.bucketCount();
+    const until = @divFloor(now_unix, width) * width + width;
+    return .{
+        .since = until - width * count,
+        .until = until,
+        .bucket_seconds = period.bucketSeconds(),
+        .bucket_count = period.bucketCount(),
+    };
+}
+
+pub const Totals = struct {
+    queries: u64,
+    blocked: u64,
+    /// Distinct client addresses in the window.
+    clients: u64,
+    avg_response_time_us: ?i64,
+};
+
+pub const Body = struct {
+    period: []const u8,
+    since: i64,
+    until: i64,
+    bucket_seconds: u32,
+    totals: Totals,
+    buckets: []const queries_repo.Bucket,
+    clients: []const queries_repo.ClientSeries,
+    other: []const u64,
+    types: []const queries_repo.TypeCount,
+    routes: []const queries_repo.RouteCount,
+    /// Judged against `since`, which is the window this body reports on — so a
+    /// dashboard can say "history starts here" instead of charting a pruned
+    /// stretch as a quiet one.
+    coverage: coverage.Coverage,
+};
+
+pub fn handle(
+    state: *server.WebState,
+    io: std.Io,
+    request: *http_util.Request,
+) http_util.HandlerError!void {
+    const period = periodParam(request.query) catch return badPeriod(request);
+    const database = state.querylog_db orelse return unavailable(request);
+    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
+
+    const body = cachedBody(state, io, database, request.arena, period, span) catch |err| {
+        return internal(request, err);
+    };
+    return http_util.respondBytes(request, .ok, body, http_util.content_type_json, &.{});
+}
+
+/// The whole cache decision, start to finish, under one hold of
+/// `querylog_lock`. Returns bytes owned by `arena`, so the caller writes the
+/// socket with the lock already released.
+///
+/// `data_version` is sampled inside the lock and the rebuild is published under
+/// that same sample: a commit landing on another connection while this task
+/// builds moves the pragma, so the entry it installs is keyed to a version the
+/// next request will not ask for and that request rebuilds. Stale bytes under a
+/// current key are therefore not reachable. A failed build or a failed commit
+/// publishes nothing and leaves whatever the slot already held.
+fn cachedBody(
+    state: *server.WebState,
+    io: std.Io,
+    database: *db.Db,
+    arena: std.mem.Allocator,
+    period: Period,
+    span: Window,
+) db.Error![]const u8 {
+    state.querylog_lock.lockUncancelable(io);
+    defer state.querylog_lock.unlock(io);
+
+    const index = @intFromEnum(period);
+    const data_version = try database.queryInt("PRAGMA data_version");
+
+    if (state.overview_cache.get(index, span.until, data_version)) |cached| {
+        // The copy is what makes a later rebuild's free-and-replace safe: the
+        // response is written after the lock is gone, and by then these bytes
+        // may belong to nobody.
+        return arena.dupe(u8, cached);
+    }
+
+    const body = try buildBody(state, io, database, arena, period, span);
+    const owned = try state.gpa.dupe(u8, body);
+    state.overview_cache.put(state.gpa, index, span.until, data_version, owned);
+    return body;
+}
+
+/// One read transaction, one snapshot, one serialized body in `arena`. The
+/// caller holds `querylog_lock` and keeps holding it.
+fn buildBody(
+    state: *server.WebState,
+    io: std.Io,
+    database: *db.Db,
+    arena: std.mem.Allocator,
+    period: Period,
+    span: Window,
+) db.Error![]const u8 {
+    var scope = try server.QuerylogRead.openLocked(state, io, database);
+    errdefer scope.abort();
+    const data = try queries_repo.overview(
+        database,
+        arena,
+        span.since,
+        span.bucket_seconds,
+        span.bucket_count,
+    );
+    const window_coverage = try coverage.read(database, span.since);
+    try scope.commit();
+
+    var allocating: std.Io.Writer.Allocating = .init(arena);
+    errdefer allocating.deinit();
+    std.json.Stringify.value(Body{
+        .period = period.label(),
+        .since = span.since,
+        .until = span.until,
+        .bucket_seconds = span.bucket_seconds,
+        .totals = .{
+            .queries = data.totals.queries,
+            .blocked = data.totals.blocked,
+            .clients = data.totals.distinct_clients,
+            .avg_response_time_us = data.totals.avg_response_time_us,
+        },
+        .buckets = data.buckets,
+        .clients = data.clients.clients,
+        .other = data.clients.other,
+        .types = data.types,
+        .routes = data.routes,
+        .coverage = window_coverage,
+    }, .{}, &allocating.writer) catch return error.OutOfMemory;
+    return allocating.written();
+}
+
+pub const PeriodError = error{BadPeriod};
+
+/// An absent `period` is the default; anything else it cannot read is a 400,
+/// never a silent fallback — a typo must not return a window nobody asked for.
+fn periodParam(query: []const u8) PeriodError!Period {
+    var buf: [8]u8 = undefined;
+    const found = http_util.queryValue(query, "period", &buf) catch return error.BadPeriod;
+    const text = found orelse return default_period;
+    return Period.parse(text) orelse error.BadPeriod;
+}
+
+fn badPeriod(request: *http_util.Request) http_util.HandlerError!void {
+    return http_util.respondError(request, .bad_request, "period must be one of 1h, 24h, 7d, 30d");
+}
+
+fn unavailable(request: *http_util.Request) http_util.HandlerError!void {
+    return http_util.respondError(request, .service_unavailable, "query log unavailable");
+}
+
+/// The one thing this file logs. A failed aggregate is a fault in the box, not
+/// a property of the request, and the client is told nothing beyond "internal
+/// error" (ruling 8, PLAN §19).
+fn internal(request: *http_util.Request, err: db.Error) http_util.HandlerError!void {
+    log.warn("overview failed: {s}", .{@errorName(err)});
+    return http_util.respondError(request, .internal_server_error, "internal error");
+}
+
+// ---------------------------------------------------------------------------
+// tests
+// ---------------------------------------------------------------------------
+
+const querylog_schema = @import("../../storage/querylog_schema.zig");
+const testing = std.testing;
+
+test "the period grammar accepts exactly the four spellings" {
+    try testing.expectEqual(Period.@"1h", Period.parse("1h").?);
+    try testing.expectEqual(Period.@"24h", Period.parse("24h").?);
+    try testing.expectEqual(Period.@"7d", Period.parse("7d").?);
+    try testing.expectEqual(Period.@"30d", Period.parse("30d").?);
+    try testing.expectEqual(@as(?Period, null), Period.parse("12h"));
+    try testing.expectEqual(@as(?Period, null), Period.parse("1H"));
+    try testing.expectEqual(@as(?Period, null), Period.parse(""));
+}
+
+test "an absent period defaults and a bad one is rejected" {
+    try testing.expectEqual(default_period, try periodParam(""));
+    try testing.expectEqual(default_period, try periodParam("limit=5"));
+    try testing.expectEqual(Period.@"7d", try periodParam("period=7d"));
+    try testing.expectError(error.BadPeriod, periodParam("period=12h"));
+    try testing.expectError(error.BadPeriod, periodParam("period=%2"));
+    // Longer than any spelling: rejected rather than truncated to "1h".
+    try testing.expectError(error.BadPeriod, periodParam("period=1hhhhhhhhhh"));
+}
+
+test "each period spans its own bucket width times its count" {
+    for (std.enums.values(Period)) |period| {
+        const span = window(period, 1_700_000_000);
+        const width: i64 = period.bucketSeconds();
+        try testing.expectEqual(width * @as(i64, period.bucketCount()), span.until - span.since);
+    }
+}
+
+test "the window sits on the UTC grid and ends with the bucket in progress" {
+    // 2023-11-14T22:13:20Z, which is not on any bucket boundary.
+    const now: i64 = 1_700_000_000;
+    const span = window(.@"24h", now);
+
+    try testing.expectEqual(@as(i64, 0), @rem(span.since, 1800));
+    try testing.expectEqual(@as(i64, 0), @rem(span.until, 1800));
+    try testing.expect(span.until > now);
+    try testing.expect(span.until - now <= 1800);
+    try testing.expectEqual(@as(u32, 48), span.bucket_count);
+}
+
+test "two requests inside one bucket see the same window" {
+    // A bucket boundary, so the offsets below stay inside one minute.
+    const boundary: i64 = 1_700_000_000 - @rem(1_700_000_000, 60);
+    const first = window(.@"1h", boundary);
+    const second = window(.@"1h", boundary + 59);
+    try testing.expectEqual(first.since, second.since);
+    try testing.expectEqual(first.until, second.until);
+
+    const next = window(.@"1h", boundary + 60);
+    try testing.expectEqual(first.until + 60, next.until);
+}
+
+test "a timestamp exactly on a boundary starts a new bucket" {
+    const span = window(.@"7d", 1_700_000_000 - 1_700_000_000 % 3600);
+    try testing.expectEqual(@as(i64, 0), @rem(span.since, 3600));
+    try testing.expectEqual(@as(u32, 168), span.bucket_count);
+}
+
+test "every period's window is a window the repository will serve" {
+    // The projection path needs the window start on the 30-minute grid and the
+    // width a whole number of grains; `window` is the only producer of either.
+    for (std.enums.values(Period)) |period| {
+        const span = window(period, 1_700_000_123);
+        if (span.bucket_seconds < 1800) continue;
+        try testing.expectEqual(@as(i64, 0), @mod(span.since, 1800));
+        try testing.expectEqual(@as(u32, 0), span.bucket_seconds % 1800);
+    }
+}
+
+fn openLog() !db.Db {
+    var database = try db.Db.open(":memory:", .{ .mode = .memory });
+    errdefer database.close();
+    try db.applyPragmas(&database, .{});
+    try database.exec(querylog_schema.ddl);
+    return database;
+}
+
+fn writeRow(writer: *queries_repo.BatchWriter, timestamp: i64, blocked: bool, cached: ?bool) !void {
+    const rows = [_]queries_repo.Row{.{
+        .timestamp = timestamp,
+        .domain = "example.com",
+        .client_ip = "192.0.2.10",
+        .qtype = 1,
+        .qclass = 1,
+        .rcode = 0,
+        .blocked = blocked,
+        .response_time_us = 1000,
+        .cache_hit = cached,
+        .upstream = null,
+        .group_id = 1,
+        .group_name = "default",
+        .policy_action = if (blocked) .block else .allow,
+        .policy_reason = if (blocked) .blocklist_domain else .no_match,
+        .matched = null,
+        .source_id = null,
+        .source_name = null,
+        .cname_target = null,
+        .safe_search_target = null,
+        .route_kind = if (blocked) .blocked else .upstream,
+        .forward_zone = null,
+    }};
+    try writer.writeBatch(&rows);
+}
+
+test "one overview answers totals and buckets that agree over the same window" {
+    var database = try openLog();
+    defer database.close();
+
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
+    defer writer.deinit();
+    // One row in the first bucket, two in the last, one just outside.
+    try writeRow(&writer, span.since, false, false);
+    try writeRow(&writer, span.until - 1, true, false);
+    try writeRow(&writer, span.until - 2, false, true);
+    try writeRow(&writer, span.since - 1, false, false);
+
+    const data = try queries_repo.overview(
+        &database,
+        arena_state.allocator(),
+        span.since,
+        span.bucket_seconds,
+        span.bucket_count,
+    );
+
+    try testing.expectEqual(@as(u64, 3), data.totals.queries);
+    try testing.expectEqual(@as(u64, 1), data.totals.blocked);
+    try testing.expectEqual(@as(u64, 1), data.totals.distinct_clients);
+    try testing.expectEqual(@as(?i64, 1000), data.totals.avg_response_time_us);
+
+    try testing.expectEqual(@as(usize, 60), data.buckets.len);
+    var summed: u64 = 0;
+    var blocked: u64 = 0;
+    for (data.buckets) |bucket| {
+        summed += bucket.queries;
+        blocked += bucket.blocked;
+    }
+    try testing.expectEqual(data.totals.queries, summed);
+    try testing.expectEqual(data.totals.blocked, blocked);
+
+    try testing.expectEqual(span.since, data.buckets[0].ts);
+    try testing.expectEqual(@as(u64, 1), data.buckets[0].queries);
+    try testing.expectEqual(@as(u64, 2), data.buckets[59].queries);
+    try testing.expectEqual(span.until - span.bucket_seconds, data.buckets[59].ts);
+}
+
+test "an empty window reports zeros with a null mean" {
+    var database = try openLog();
+    defer database.close();
+
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const span = window(.@"30d", 1_700_000_000);
+    const data = try queries_repo.overview(
+        &database,
+        arena_state.allocator(),
+        span.since,
+        span.bucket_seconds,
+        span.bucket_count,
+    );
+
+    try testing.expectEqual(@as(u64, 0), data.totals.queries);
+    try testing.expectEqual(@as(?i64, null), data.totals.avg_response_time_us);
+    try testing.expectEqual(@as(usize, 120), data.buckets.len);
+    for (data.buckets) |bucket| try testing.expectEqual(@as(u64, 0), bucket.queries);
+    // `other` is bucket-count sized even here: a chart must never have to
+    // invent the residual series.
+    try testing.expectEqual(@as(usize, 120), data.clients.other.len);
+}
+
+test "the cache serves one period's bytes and rebuilds when the key moves" {
+    const gpa = testing.allocator;
+    var cache: server.OverviewCache = .{};
+    defer cache.deinit(gpa);
+
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(0, 100, 7));
+
+    cache.put(gpa, 0, 100, 7, try gpa.dupe(u8, "first"));
+    try testing.expectEqualStrings("first", cache.get(0, 100, 7).?);
+    // A different period, a rolled window and a bumped data version are three
+    // different keys, and none of them hits.
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(1, 100, 7));
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(0, 101, 7));
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(0, 100, 8));
+
+    // A rebuild replaces the entry and frees the old body; the leak checker in
+    // `testing.allocator` is the assertion.
+    cache.put(gpa, 0, 100, 8, try gpa.dupe(u8, "second"));
+    try testing.expectEqualStrings("second", cache.get(0, 100, 8).?);
+}
+
+/// Two connections onto one file, which is the only arrangement in which
+/// `PRAGMA data_version` moves at all: it reports commits by *other*
+/// connections, so an in-memory database — where there is no other connection —
+/// could never witness the invalidation these tests are about.
+const CacheFixture = struct {
+    threaded: std.Io.Threaded,
+    tmp: std.testing.TmpDir,
+    /// The web task's connection, the one the cache is keyed on.
+    reader: db.Db,
+    /// Stands in for the logger and for retention.
+    writer: db.Db,
+    state: server.WebState,
+    arena_state: std.heap.ArenaAllocator,
+
+    fn init(self: *CacheFixture, gpa: std.mem.Allocator) !void {
+        self.threaded = .init(gpa, .{});
+        errdefer self.threaded.deinit();
+        self.tmp = std.testing.tmpDir(.{});
+        errdefer self.tmp.cleanup();
+
+        var path_buf: [256]u8 = undefined;
+        const path = try std.fmt.bufPrintZ(
+            &path_buf,
+            ".zig-cache/tmp/{s}/querylog.db",
+            .{self.tmp.sub_path},
+        );
+
+        self.writer = try db.Db.open(path, .{ .mode = .read_write_create });
+        errdefer self.writer.close();
+        try db.applyPragmas(&self.writer, .{});
+        try self.writer.exec(querylog_schema.ddl);
+        // The DDL stamps `created_at` from the wall clock, and the watermark
+        // with it. These tests work over a fixed 2023 window, so a 2026
+        // watermark would report every one of them as uncovered and the prune
+        // below would not move it.
+        try self.writer.exec(
+            "UPDATE querylog_meta SET created_at = 1600000000, available_since = 1600000000 WHERE id = 1",
+        );
+
+        self.reader = try db.Db.open(path, .{ .mode = .read_write_existing });
+        errdefer self.reader.close();
+        try db.applyPragmas(&self.reader, .{});
+
+        self.state = .{ .gpa = gpa, .querylog_db = &self.reader };
+        self.arena_state = .init(gpa);
+    }
+
+    fn deinit(self: *CacheFixture) void {
+        self.arena_state.deinit();
+        self.state.overview_cache.deinit(self.state.gpa);
+        self.reader.close();
+        self.writer.close();
+        self.tmp.cleanup();
+        self.threaded.deinit();
+    }
+
+    fn io(self: *CacheFixture) std.Io {
+        return self.threaded.io();
+    }
+
+    fn body(self: *CacheFixture, period: Period, span: Window) db.Error![]const u8 {
+        return cachedBody(
+            &self.state,
+            self.io(),
+            &self.reader,
+            self.arena_state.allocator(),
+            period,
+            span,
+        );
+    }
+
+    /// One row through the writer connection, which commits and so moves the
+    /// reader's `PRAGMA data_version`.
+    fn log(self: *CacheFixture, timestamp: i64) !void {
+        var batch = try queries_repo.BatchWriter.init(self.state.gpa, &self.writer);
+        defer batch.deinit();
+        try writeRow(&batch, timestamp, false, false);
+    }
+};
+
+test "a cache hit answers without opening a read transaction" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+
+    const first = try fx.body(.@"1h", span);
+    try testing.expect(first.len > 0);
+
+    // A hit never reaches the database, so a fault armed on the next commit is
+    // never spent — and the bytes are the stored ones, not a rebuild's.
+    db.read_tx_faults.failNextCommit();
+    const second = try fx.body(.@"1h", span);
+    try testing.expectEqualStrings(first, second);
+    try testing.expect(first.ptr != second.ptr);
+
+    // Spend the armed fault so it cannot leak into a later test. A miss does
+    // reach the database, so this one trips.
+    db.read_tx_faults.beginCapture();
+    defer _ = db.read_tx_faults.endCapture();
+    try testing.expectError(error.Internal, fx.body(.@"24h", window(.@"24h", 1_700_000_000)));
+}
+
+test "a commit on another connection invalidates the cached body" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+    const before = try fx.body(.@"1h", span);
+
+    try fx.log(span.since + 20);
+    const after = try fx.body(.@"1h", span);
+    try testing.expect(!std.mem.eql(u8, before, after));
+    try testing.expect(std.mem.containsAtLeast(u8, after, 1, "\"queries\":2"));
+}
+
+test "a retention prune through another connection replaces the body and the watermark" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+    const before = try fx.body(.@"1h", span);
+    try testing.expect(std.mem.containsAtLeast(u8, before, 1, "\"queries\":1"));
+
+    // Past the whole window: the row goes and the watermark advances, and both
+    // halves of the response must move together.
+    _ = try queries_repo.pruneOlderThan(&fx.writer, span.until);
+    const after = try fx.body(.@"1h", span);
+    try testing.expect(std.mem.containsAtLeast(u8, after, 1, "\"queries\":0"));
+
+    var watermark_buf: [64]u8 = undefined;
+    const watermark = try std.fmt.bufPrint(
+        &watermark_buf,
+        "\"available_since\":{d}",
+        .{span.until},
+    );
+    try testing.expect(std.mem.containsAtLeast(u8, after, 1, watermark));
+}
+
+test "a window roll rebuilds even with the data unchanged" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const now: i64 = 1_700_000_000;
+    const first = try fx.body(.@"1h", window(.@"1h", now));
+    // One bucket later: same data, a different window, and so a different body.
+    const rolled = try fx.body(.@"1h", window(.@"1h", now + 60));
+    try testing.expect(!std.mem.eql(u8, first, rolled));
+
+    // The slot now holds the rolled window; asking for the earlier one again
+    // rebuilds rather than answering from a key that no longer matches.
+    const again = try fx.body(.@"1h", window(.@"1h", now));
+    try testing.expectEqualStrings(first, again);
+}
+
+test "a failed commit installs nothing and leaves the stored entry alone" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+    const stored = try fx.body(.@"1h", span);
+
+    // A commit that fails on a rebuild: the key has moved, so this is a miss.
+    try fx.log(span.since + 20);
+    db.read_tx_faults.failNextCommit();
+    db.read_tx_faults.beginCapture();
+    try testing.expectError(error.Internal, fx.body(.@"1h", span));
+    try testing.expectEqual(@as(usize, 1), db.read_tx_faults.endCapture());
+
+    // Nothing was published under the new key: the next request rebuilds and
+    // sees the second row, rather than being served the failed read's work or
+    // the first row's body under a key that now describes two.
+    const rebuilt = try fx.body(.@"1h", span);
+    try testing.expect(!std.mem.eql(u8, stored, rebuilt));
+    try testing.expect(std.mem.containsAtLeast(u8, rebuilt, 1, "\"queries\":2"));
+}

src/web/handlers/queries.zig

@@ -281,7 +281,7 @@ fn openLog() !db.Db {
 /// upstream answer carries one. A fixture that broke those ties would let a
 /// serializer regression pass here and fail on real rows.
 fn seed(database: *db.Db, count: usize) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
     var rows: [16]queries_repo.Row = undefined;
     for (rows[0..count], 0..) |*row, i| {

src/web/handlers/stats.zig

@@ -1,574 +0,0 @@
-//! The five period endpoints: `GET /api/stats` and `/api/stats/timeseries`
-//! (ruling 13), and `/api/stats/types`, `/api/stats/routes` and
-//! `/api/stats/clients` (milestone 30).
-//!
-//! One period grammar, four widths, and one window shared by all five: a
-//! request for the same period gets the same `since`/`until` from every
-//! endpoint, so the totals describe exactly the span the charts draw rather
-//! than a neighbouring one.
-//!
-//! That is window coherence, not identical counts. Each endpoint is its own
-//! request against its own snapshot, so queries logged between two of them move
-//! one panel and not the other. Only a box with nothing writing to it — a test
-//! — can expect the breakdowns to sum to the totals exactly.
-//!
-//! Buckets are aligned to the UTC grid, not to the moment of the request. Every
-//! width divides a day, so flooring the current time to a multiple of the width
-//! puts each bucket on the same boundary a human reads off a clock, and two
-//! requests a second apart return the same bucket starts. The last bucket is
-//! the one in progress; it fills as the period runs.
-//!
-//! The aggregates run on the web task's own query-log connection (m7 ruling 21),
-//! which every connection task shares. SQLite's serialized mode makes one call
-//! safe; it does not make a transaction safe, so `WebState.querylog_lock` covers
-//! the whole read and a second BEGIN can never land inside the first. Each
-//! response takes one deferred read transaction, so its aggregate and the
-//! `coverage` beside it describe one database state: retention cannot prune
-//! between them and hand a client pre-prune rows tagged with a post-prune
-//! watermark. Deferred, not `db.Tx`'s BEGIN IMMEDIATE, which would stall the
-//! logger and retention behind an HTTP response.
-//!
-//! The lock is released before the response is written: the body is already
-//! built in the request arena, and holding a database lock across a socket
-//! write would let one slow client serialize every other reader.
-
-const std = @import("std");
-
-const coverage = @import("../coverage.zig");
-const db = @import("../../storage/db.zig");
-const http_util = @import("../http_util.zig");
-const queries_repo = @import("../../storage/repositories/queries_repo.zig");
-const server = @import("../server.zig");
-
-const log = std.log.scoped(.web_stats);
-
-/// The four periods ruling 13 defines. The tag names are the wire spellings.
-pub const Period = enum {
-    @"1h",
-    @"24h",
-    @"7d",
-    @"30d",
-
-    pub fn parse(text: []const u8) ?Period {
-        return std.meta.stringToEnum(Period, text);
-    }
-
-    /// Ruling 13: 1h→60×1m, 24h→48×30m, 7d→168×1h, 30d→120×6h.
-    pub fn bucketSeconds(self: Period) u32 {
-        return switch (self) {
-            .@"1h" => 60,
-            .@"24h" => 30 * 60,
-            .@"7d" => 60 * 60,
-            .@"30d" => 6 * 60 * 60,
-        };
-    }
-
-    pub fn bucketCount(self: Period) u32 {
-        return switch (self) {
-            .@"1h" => 60,
-            .@"24h" => 48,
-            .@"7d" => 168,
-            .@"30d" => 120,
-        };
-    }
-
-    pub fn label(self: Period) []const u8 {
-        return @tagName(self);
-    }
-};
-
-pub const default_period: Period = .@"24h";
-
-/// The widest period's bucket count, so one stack array serves every request.
-pub const max_buckets = 168;
-
-comptime {
-    for (std.enums.values(Period)) |period| {
-        std.debug.assert(period.bucketCount() <= max_buckets);
-        // The UTC alignment argument holds only while every width divides a day.
-        std.debug.assert(86_400 % period.bucketSeconds() == 0);
-    }
-}
-
-pub const Window = struct {
-    /// Inclusive, on the bucket grid.
-    since: i64,
-    /// Exclusive: the end of the bucket that `now` falls in.
-    until: i64,
-    bucket_seconds: u32,
-    bucket_count: u32,
-};
-
-pub fn window(period: Period, now_unix: i64) Window {
-    const width: i64 = period.bucketSeconds();
-    const count: i64 = period.bucketCount();
-    const until = @divFloor(now_unix, width) * width + width;
-    return .{
-        .since = until - width * count,
-        .until = until,
-        .bucket_seconds = period.bucketSeconds(),
-        .bucket_count = period.bucketCount(),
-    };
-}
-
-pub const TotalsBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    queries: u64,
-    blocked: u64,
-    clients: u64,
-    avg_response_time_us: ?i64,
-    /// Judged against `since`, which is the window this body reports on — so a
-    /// dashboard can say "history starts here" instead of charting a pruned
-    /// stretch as a quiet one.
-    coverage: coverage.Coverage,
-};
-
-pub const TimeseriesBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    bucket_seconds: u32,
-    buckets: []const queries_repo.Bucket,
-    coverage: coverage.Coverage,
-};
-
-pub const TypesBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    types: []const queries_repo.TypeCount,
-    coverage: coverage.Coverage,
-};
-
-pub const RoutesBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    routes: []const queries_repo.RouteCount,
-    coverage: coverage.Coverage,
-};
-
-pub const ClientsBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    bucket_seconds: u32,
-    clients: []const queries_repo.ClientSeries,
-    other: []const u64,
-    coverage: coverage.Coverage,
-};
-
-/// Everything one response reads from the query log, so the caller can end the
-/// transaction and drop the lock before it serializes anything.
-fn Read(comptime T: type) type {
-    return struct {
-        data: T,
-        coverage: coverage.Coverage,
-    };
-}
-
-const ReadScope = server.QuerylogRead;
-
-fn readTotals(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    span: Window,
-) db.Error!Read(queries_repo.StatsTotals) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const read: Read(queries_repo.StatsTotals) = .{
-        .data = try queries_repo.statsTotals(database, span.since, span.until),
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readTimeseries(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    span: Window,
-    out: []queries_repo.Bucket,
-) db.Error!Read(usize) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const read: Read(usize) = .{
-        .data = try queries_repo.timeseries(database, span.since, span.bucket_seconds, out),
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readTypes(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    arena: std.mem.Allocator,
-    span: Window,
-) db.Error!Read([]const queries_repo.TypeCount) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const list = try queries_repo.statsTypes(database, arena, span.since, span.until);
-    const read: Read([]const queries_repo.TypeCount) = .{
-        .data = list.items,
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readRoutes(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    arena: std.mem.Allocator,
-    span: Window,
-) db.Error!Read([]const queries_repo.RouteCount) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const list = try queries_repo.statsRoutes(database, arena, span.since, span.until);
-    const read: Read([]const queries_repo.RouteCount) = .{
-        .data = list.items,
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readClients(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    arena: std.mem.Allocator,
-    span: Window,
-) db.Error!Read(queries_repo.ClientsBreakdown) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const read: Read(queries_repo.ClientsBreakdown) = .{
-        .data = try queries_repo.statsClients(
-            database,
-            arena,
-            span.since,
-            span.bucket_seconds,
-            span.bucket_count,
-        ),
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-pub fn totals(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readTotals(state, io, database, span) catch |err| {
-        return internal(request, "stats totals", err);
-    };
-
-    return http_util.respondJson(request, .ok, TotalsBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .queries = read.data.queries,
-        .blocked = read.data.blocked,
-        .clients = read.data.distinct_clients,
-        .avg_response_time_us = read.data.avg_response_time_us,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn timeseries(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    var buckets: [max_buckets]queries_repo.Bucket = undefined;
-    const out = buckets[0..span.bucket_count];
-    const read = readTimeseries(state, io, database, span, out) catch |err| {
-        return internal(request, "stats timeseries", err);
-    };
-
-    return http_util.respondJson(request, .ok, TimeseriesBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .bucket_seconds = span.bucket_seconds,
-        .buckets = out[0..read.data],
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn types(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readTypes(state, io, database, request.arena, span) catch |err| {
-        return internal(request, "stats types", err);
-    };
-
-    return http_util.respondJson(request, .ok, TypesBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .types = read.data,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn routes(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readRoutes(state, io, database, request.arena, span) catch |err| {
-        return internal(request, "stats routes", err);
-    };
-
-    return http_util.respondJson(request, .ok, RoutesBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .routes = read.data,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn clients(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readClients(state, io, database, request.arena, span) catch |err| {
-        return internal(request, "stats clients", err);
-    };
-
-    return http_util.respondJson(request, .ok, ClientsBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .bucket_seconds = span.bucket_seconds,
-        .clients = read.data.clients,
-        .other = read.data.other,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub const PeriodError = error{BadPeriod};
-
-/// An absent `period` is the default; anything else it cannot read is a 400,
-/// never a silent fallback — a typo must not return a window nobody asked for.
-fn periodParam(query: []const u8) PeriodError!Period {
-    var buf: [8]u8 = undefined;
-    const found = http_util.queryValue(query, "period", &buf) catch return error.BadPeriod;
-    const text = found orelse return default_period;
-    return Period.parse(text) orelse error.BadPeriod;
-}
-
-fn badPeriod(request: *http_util.Request) http_util.HandlerError!void {
-    return http_util.respondError(request, .bad_request, "period must be one of 1h, 24h, 7d, 30d");
-}
-
-fn unavailable(request: *http_util.Request) http_util.HandlerError!void {
-    return http_util.respondError(request, .service_unavailable, "query log unavailable");
-}
-
-/// The one thing this file logs. A failed aggregate is a fault in the box, not
-/// a property of the request, and the client is told nothing beyond "internal
-/// error" (ruling 8, PLAN §19).
-fn internal(
-    request: *http_util.Request,
-    what: []const u8,
-    err: db.Error,
-) http_util.HandlerError!void {
-    log.warn("{s} failed: {s}", .{ what, @errorName(err) });
-    return http_util.respondError(request, .internal_server_error, "internal error");
-}
-
-// ---------------------------------------------------------------------------
-// tests
-// ---------------------------------------------------------------------------
-
-const querylog_schema = @import("../../storage/querylog_schema.zig");
-const testing = std.testing;
-
-test "the period grammar accepts exactly the four spellings" {
-    try testing.expectEqual(Period.@"1h", Period.parse("1h").?);
-    try testing.expectEqual(Period.@"24h", Period.parse("24h").?);
-    try testing.expectEqual(Period.@"7d", Period.parse("7d").?);
-    try testing.expectEqual(Period.@"30d", Period.parse("30d").?);
-    try testing.expectEqual(@as(?Period, null), Period.parse("12h"));
-    try testing.expectEqual(@as(?Period, null), Period.parse("1H"));
-    try testing.expectEqual(@as(?Period, null), Period.parse(""));
-}
-
-test "an absent period defaults and a bad one is rejected" {
-    try testing.expectEqual(default_period, try periodParam(""));
-    try testing.expectEqual(default_period, try periodParam("limit=5"));
-    try testing.expectEqual(Period.@"7d", try periodParam("period=7d"));
-    try testing.expectError(error.BadPeriod, periodParam("period=12h"));
-    try testing.expectError(error.BadPeriod, periodParam("period=%2"));
-    // Longer than any spelling: rejected rather than truncated to "1h".
-    try testing.expectError(error.BadPeriod, periodParam("period=1hhhhhhhhhh"));
-}
-
-test "each period spans its own bucket width times its count" {
-    for (std.enums.values(Period)) |period| {
-        const span = window(period, 1_700_000_000);
-        const width: i64 = period.bucketSeconds();
-        try testing.expectEqual(width * @as(i64, period.bucketCount()), span.until - span.since);
-    }
-}
-
-test "the window sits on the UTC grid and ends with the bucket in progress" {
-    // 2023-11-14T22:13:20Z, which is not on any bucket boundary.
-    const now: i64 = 1_700_000_000;
-    const span = window(.@"24h", now);
-
-    try testing.expectEqual(@as(i64, 0), @rem(span.since, 1800));
-    try testing.expectEqual(@as(i64, 0), @rem(span.until, 1800));
-    try testing.expect(span.until > now);
-    try testing.expect(span.until - now <= 1800);
-    try testing.expectEqual(@as(u32, 48), span.bucket_count);
-}
-
-test "two requests inside one bucket see the same window" {
-    // A bucket boundary, so the offsets below stay inside one minute.
-    const boundary: i64 = 1_700_000_000 - @rem(1_700_000_000, 60);
-    const first = window(.@"1h", boundary);
-    const second = window(.@"1h", boundary + 59);
-    try testing.expectEqual(first.since, second.since);
-    try testing.expectEqual(first.until, second.until);
-
-    const next = window(.@"1h", boundary + 60);
-    try testing.expectEqual(first.until + 60, next.until);
-}
-
-test "a timestamp exactly on a boundary starts a new bucket" {
-    const span = window(.@"7d", 1_700_000_000 - 1_700_000_000 % 3600);
-    try testing.expectEqual(@as(i64, 0), @rem(span.since, 3600));
-    try testing.expectEqual(@as(u32, 168), span.bucket_count);
-}
-
-fn openLog() !db.Db {
-    var database = try db.Db.open(":memory:", .{ .mode = .memory });
-    errdefer database.close();
-    try db.applyPragmas(&database, .{});
-    try database.exec(querylog_schema.ddl);
-    return database;
-}
-
-fn writeRow(writer: *queries_repo.BatchWriter, timestamp: i64, blocked: bool, cached: ?bool) !void {
-    const rows = [_]queries_repo.Row{.{
-        .timestamp = timestamp,
-        .domain = "example.com",
-        .client_ip = "192.0.2.10",
-        .qtype = 1,
-        .qclass = 1,
-        .rcode = 0,
-        .blocked = blocked,
-        .response_time_us = 1000,
-        .cache_hit = cached,
-        .upstream = null,
-        .group_id = 1,
-        .group_name = "default",
-        .policy_action = if (blocked) .block else .allow,
-        .policy_reason = if (blocked) .blocklist_domain else .no_match,
-        .matched = null,
-        .source_id = null,
-        .source_name = null,
-        .cname_target = null,
-        .safe_search_target = null,
-        .route_kind = if (blocked) .blocked else .upstream,
-        .forward_zone = null,
-    }};
-    try writer.writeBatch(&rows);
-}
-
-test "the totals and the buckets agree over the same window" {
-    var database = try openLog();
-    defer database.close();
-
-    const now: i64 = 1_700_000_000;
-    const span = window(.@"1h", now);
-
-    var writer = try queries_repo.BatchWriter.init(&database);
-    defer writer.deinit();
-    // One row in the first bucket, two in the last, one just outside.
-    try writeRow(&writer, span.since, false, false);
-    try writeRow(&writer, span.until - 1, true, false);
-    try writeRow(&writer, span.until - 2, false, true);
-    try writeRow(&writer, span.since - 1, false, false);
-
-    const result = try queries_repo.statsTotals(&database, span.since, span.until);
-    try testing.expectEqual(@as(u64, 3), result.queries);
-    try testing.expectEqual(@as(u64, 1), result.blocked);
-    try testing.expectEqual(@as(u64, 1), result.distinct_clients);
-    try testing.expectEqual(@as(?i64, 1000), result.avg_response_time_us);
-
-    var buckets: [max_buckets]queries_repo.Bucket = undefined;
-    const out = buckets[0..span.bucket_count];
-    const written = try queries_repo.timeseries(&database, span.since, span.bucket_seconds, out);
-    try testing.expectEqual(@as(usize, 60), written);
-
-    var summed: u64 = 0;
-    var blocked: u64 = 0;
-    for (out) |bucket| {
-        summed += bucket.queries;
-        blocked += bucket.blocked;
-    }
-    try testing.expectEqual(result.queries, summed);
-    try testing.expectEqual(result.blocked, blocked);
-
-    try testing.expectEqual(span.since, out[0].ts);
-    try testing.expectEqual(@as(u64, 1), out[0].queries);
-    try testing.expectEqual(@as(u64, 2), out[59].queries);
-    try testing.expectEqual(span.until - span.bucket_seconds, out[59].ts);
-}
-
-test "an empty window reports zeros with a null mean" {
-    var database = try openLog();
-    defer database.close();
-
-    const span = window(.@"30d", 1_700_000_000);
-    const result = try queries_repo.statsTotals(&database, span.since, span.until);
-    try testing.expectEqual(@as(u64, 0), result.queries);
-    try testing.expectEqual(@as(?i64, null), result.avg_response_time_us);
-
-    var buckets: [max_buckets]queries_repo.Bucket = undefined;
-    const out = buckets[0..span.bucket_count];
-    try testing.expectEqual(@as(usize, 120), try queries_repo.timeseries(
-        &database,
-        span.since,
-        span.bucket_seconds,
-        out,
-    ));
-    for (out) |bucket| try testing.expectEqual(@as(u64, 0), bucket.queries);
-}

src/web/openapi.yaml

@@ -422,139 +422,29 @@ paths:
         "503":
           $ref: "#/components/responses/Unavailable"
 
-  /api/stats:
+  /api/overview:
     get:
-      summary: Totals for a period
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: Totals over the period's UTC-aligned window.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsTotals"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
-
-  /api/stats/timeseries:
-    get:
-      summary: Bucketed counts for a period
+      summary: Everything the Overview page draws, for one period
       description: |
-        Fixed-width UTC buckets covering the same window `/api/stats`
-        reports for the period: 1h into 60 one-minute buckets, 24h into 48
-        half-hour buckets, 7d into 168 one-hour buckets, 30d into 120
-        six-hour buckets. Empty buckets are zero-filled.
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: The bucket series.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsTimeseries"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
+        One response over one read transaction: the period's totals, its
+        fixed-width UTC buckets, the per-client series, the query-type
+        breakdown and the answering-route breakdown, plus the coverage
+        watermark judged against the same window. The panels therefore describe
+        one database state rather than five, so the breakdowns sum to the
+        totals on a quiet box.
 
-  /api/stats/types:
-    get:
-      summary: Query-type breakdown for a period
-      description: |
-        How many queries of each DNS type the period's window holds, over the
-        same UTC-aligned window `/api/stats` reports for. Rows carry the numeric
-        type only: the type-name table lives in the admin, and a second copy
-        here would drift out of agreement with it. `qtype` is nullable in the
-        query log, so the rows that carry no type group into a row of their own
-        rather than vanishing from a breakdown that claims to add up. Ordered by
-        count descending, then type ascending with the null row last. Types
-        absent from the window are absent from the list.
+        Buckets are UTC-aligned and zero-filled: 1h into 60 one-minute buckets,
+        24h into 48 half-hour buckets, 7d into 168 one-hour buckets, 30d into
+        120 six-hour buckets. The last bucket is the one in progress.
       parameters:
         - $ref: "#/components/parameters/Period"
       responses:
         "200":
-          description: The type breakdown.
+          description: The period's overview.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/StatsTypes"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
-
-  /api/stats/routes:
-    get:
-      summary: How the period's queries were answered
-      description: |
-        A breakdown by answering route over the same window `/api/stats`
-        reports for. `source` is the answering resolver's identity — the
-        upstream url on `upstream` rows, the zone on `forward_zone` rows, null
-        on every other kind and on rows whose identity the log did not record.
-        It is not the blocklist a block came from. Ordered by count descending,
-        then route ascending, then source ascending with nulls last.
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: The route breakdown.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsRoutes"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
-
-  /api/stats/clients:
-    get:
-      summary: Per-client bucketed counts for a period
-      description: |
-        One zero-filled series per client, bucketed exactly like
-        `/api/stats/timeseries` so the two charts share an x-axis. The eight
-        clients with the most queries in the window are named, ranked by count
-        descending then address ascending; every other client sums into
-        `other`, which is always present and always holds one entry per bucket
-        in the window — including when `clients` is empty, when no client fell
-        outside the named eight, and when the window holds no queries at all.
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: The per-client series.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsClients"
+                $ref: "#/components/schemas/Overview"
         "400":
           $ref: "#/components/responses/BadRequest"
         "401":
@@ -2316,31 +2206,6 @@ components:
           type: integer
           description: How many resolved events the purge removed; zero when there were none.
 
-    StatsTotals:
-      type: object
-      required: [period, since, until, queries, blocked, clients, avg_response_time_us, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since:
-          type: integer
-          description: Window start, unix seconds, inclusive.
-        until:
-          type: integer
-          description: Window end, unix seconds, exclusive.
-        queries: { type: integer }
-        blocked: { type: integer }
-        clients:
-          type: integer
-          description: Distinct client addresses in the window.
-        avg_response_time_us:
-          type: integer
-          nullable: true
-          description: Null when no query in the window recorded a time.
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     Bucket:
       type: object
       required: [ts, queries, blocked, cached]
@@ -2352,23 +2217,6 @@ components:
         blocked: { type: integer }
         cached: { type: integer }
 
-    StatsTimeseries:
-      type: object
-      required: [period, since, until, bucket_seconds, buckets, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
-        bucket_seconds: { type: integer }
-        buckets:
-          type: array
-          items:
-            $ref: "#/components/schemas/Bucket"
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     TypeCount:
       type: object
       required: [qtype, count]
@@ -2381,22 +2229,6 @@ components:
             recorded no type, not an absent row.
         count: { type: integer }
 
-    StatsTypes:
-      type: object
-      required: [period, since, until, types, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
-        types:
-          type: array
-          items:
-            $ref: "#/components/schemas/TypeCount"
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     RouteCount:
       type: object
       required: [route, source, count]
@@ -2412,22 +2244,6 @@ components:
             row recorded no identity.
         count: { type: integer }
 
-    StatsRoutes:
-      type: object
-      required: [period, since, until, routes, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
-        routes:
-          type: array
-          items:
-            $ref: "#/components/schemas/RouteCount"
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     ClientSeries:
       type: object
       required: [client, buckets]
@@ -2443,18 +2259,47 @@ components:
           items:
             type: integer
 
-    StatsClients:
+    OverviewTotals:
       type: object
-      required: [period, since, until, bucket_seconds, clients, other, coverage]
+      required: [queries, blocked, clients, avg_response_time_us]
+      properties:
+        queries: { type: integer }
+        blocked: { type: integer }
+        clients:
+          type: integer
+          description: Distinct client addresses in the window.
+        avg_response_time_us:
+          type: integer
+          nullable: true
+          description: Null when no query in the window recorded a time.
+
+    Overview:
+      type: object
+      required: [period, since, until, bucket_seconds, totals, buckets, clients, other, types, routes, coverage]
       properties:
         period:
           type: string
           enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
+        since:
+          type: integer
+          description: Window start, unix seconds, inclusive.
+        until:
+          type: integer
+          description: Window end, unix seconds, exclusive.
         bucket_seconds: { type: integer }
+        totals:
+          $ref: "#/components/schemas/OverviewTotals"
+        buckets:
+          type: array
+          description: One entry per bucket in the window, zero-filled.
+          items:
+            $ref: "#/components/schemas/Bucket"
         clients:
           type: array
+          description: |
+            The eight clients with the most queries in the window, ranked by
+            count descending then address ascending. Every other client sums
+            into `other`.
           items:
             $ref: "#/components/schemas/ClientSeries"
         other:
@@ -2466,6 +2311,30 @@ components:
             eight, and when the window holds no queries at all.
           items:
             type: integer
+        types:
+          type: array
+          description: |
+            How many queries of each DNS type the window holds. Rows carry the
+            numeric type only: the type-name table lives in the admin, and a
+            second copy here would drift out of agreement with it. `qtype` is
+            nullable in the query log, so the rows that carry no type group
+            into a row of their own rather than vanishing from a breakdown that
+            claims to add up. Ordered by count descending, then type ascending
+            with the null row last. Types absent from the window are absent
+            from the list.
+          items:
+            $ref: "#/components/schemas/TypeCount"
+        routes:
+          type: array
+          description: |
+            A breakdown by answering route. `source` is the answering
+            resolver's identity — the upstream url on `upstream` rows, the zone
+            on `forward_zone` rows, null on every other kind and on rows whose
+            identity the log did not record. It is not the blocklist a block
+            came from. Ordered by count descending, then route ascending, then
+            source ascending with nulls last.
+          items:
+            $ref: "#/components/schemas/RouteCount"
         coverage:
           $ref: "#/components/schemas/Coverage"
 

src/web/routes.zig

@@ -45,11 +45,11 @@ const local = @import("handlers/local.zig");
 const lookup = @import("handlers/lookup.zig");
 const metrics = @import("metrics.zig");
 const openapi = @import("openapi.zig");
+const overview = @import("handlers/overview.zig");
 const pause = @import("handlers/pause.zig");
 const queries = @import("handlers/queries.zig");
 const rules = @import("handlers/rules.zig");
 const settings = @import("handlers/settings.zig");
-const stats = @import("handlers/stats.zig");
 const upstreams = @import("handlers/upstreams.zig");
 const version = @import("handlers/version.zig");
 
@@ -64,18 +64,14 @@ pub const table: []const router.RouteInfo = &.{
     .{ .method = .POST, .pattern = "/api/auth/login", .auth = .open, .policy = .runtime_action, .handler = auth.login },
     .{ .method = .POST, .pattern = "/api/auth/logout", .auth = .session, .policy = .runtime_action, .handler = auth.logout },
 
-    // Query log, stats, live stream, lookup.
+    // Query log, overview, live stream, lookup.
     .{ .method = .GET, .pattern = "/api/queries", .auth = .session, .policy = .read, .handler = queries.list },
     .{ .method = .GET, .pattern = "/api/queries/live", .auth = .session, .policy = .read, .handler = live.stream, .rate_limit = .exempt },
     // Listed after the literal `live`, which a linear first-match scan reaches
     // first — though `{id}` would refuse it anyway, since it captures a
     // positive integer and nothing else.
     .{ .method = .GET, .pattern = "/api/queries/{id}", .auth = .session, .policy = .read, .handler = queries.detail },
-    .{ .method = .GET, .pattern = "/api/stats", .auth = .session, .policy = .read, .handler = stats.totals },
-    .{ .method = .GET, .pattern = "/api/stats/timeseries", .auth = .session, .policy = .read, .handler = stats.timeseries },
-    .{ .method = .GET, .pattern = "/api/stats/types", .auth = .session, .policy = .read, .handler = stats.types },
-    .{ .method = .GET, .pattern = "/api/stats/routes", .auth = .session, .policy = .read, .handler = stats.routes },
-    .{ .method = .GET, .pattern = "/api/stats/clients", .auth = .session, .policy = .read, .handler = stats.clients },
+    .{ .method = .GET, .pattern = "/api/overview", .auth = .session, .policy = .read, .handler = overview.handle },
     .{ .method = .GET, .pattern = "/api/lookup", .auth = .session, .policy = .read, .handler = lookup.handle },
 
     // Diagnostics: the operational event log (milestone 27). The two purges are
@@ -161,7 +157,7 @@ const std = @import("std");
 const testing = std.testing;
 
 test "the table carries every endpoint of the milestone" {
-    try testing.expectEqual(@as(usize, 64), table.len);
+    try testing.expectEqual(@as(usize, 60), table.len);
 }
 
 test "no two entries claim the same method and pattern" {

src/web/server.zig

@@ -175,6 +175,67 @@ pub const UpstreamBuild = struct {
     bundle_lock: *std.Io.RwLock,
 };
 
+/// The Overview response cache: one already-serialized body per period.
+///
+/// A slot is valid for exactly one `(window.until, data_version)` pair, so it
+/// expires both ways a stale Overview can arise — the window rolls onto the
+/// next bucket, or another connection (the logger, retention) commits and moves
+/// `PRAGMA data_version`. There is no time-to-live and no background refresh:
+/// nothing here can serve bytes that describe a database state the reader could
+/// not have seen.
+///
+/// Every field is read and written under `WebState.querylog_lock`, which is
+/// also what makes the cache single-flight: a second request for the same key
+/// waits for the first rebuild and then hits. The type carries no lock of its
+/// own precisely so that nobody can touch it without the one that matters.
+pub const OverviewCache = struct {
+    /// One per `overview.Period`, indexed by `@intFromEnum`. The handler asserts
+    /// the two counts agree.
+    pub const slot_count = 4;
+
+    const Slot = struct {
+        /// Empty until the first successful build; never a valid empty body,
+        /// since every response carries at least the period and the window.
+        body: []u8 = &.{},
+        until: i64 = 0,
+        data_version: i64 = 0,
+    };
+
+    slots: [slot_count]Slot = @splat(.{}),
+
+    /// The stored bytes for this key, or null. The caller copies them into its
+    /// request arena before releasing the lock: a later rebuild frees this
+    /// allocation.
+    pub fn get(self: *const OverviewCache, period_index: usize, until: i64, data_version: i64) ?[]const u8 {
+        const slot = &self.slots[period_index];
+        if (slot.body.len == 0) return null;
+        if (slot.until != until or slot.data_version != data_version) return null;
+        return slot.body;
+    }
+
+    /// Takes ownership of `body`, which must be a `gpa` allocation, and frees
+    /// whatever the slot held.
+    pub fn put(
+        self: *OverviewCache,
+        gpa: Allocator,
+        period_index: usize,
+        until: i64,
+        data_version: i64,
+        body: []u8,
+    ) void {
+        const slot = &self.slots[period_index];
+        gpa.free(slot.body);
+        slot.* = .{ .body = body, .until = until, .data_version = data_version };
+    }
+
+    pub fn deinit(self: *OverviewCache, gpa: Allocator) void {
+        for (&self.slots) |*slot| {
+            gpa.free(slot.body);
+            slot.* = .{};
+        }
+    }
+};
+
 pub const WebState = struct {
     gpa: Allocator,
     web: model.Web = .{},
@@ -272,6 +333,9 @@ pub const WebState = struct {
     /// the shared connection would fail and a third task's reads would land
     /// inside someone else's snapshot.
     querylog_lock: std.Io.Mutex = .init,
+    /// The Overview response cache, guarded by `querylog_lock` above. Whoever
+    /// owns the `WebState` calls `overview_cache.deinit`.
+    overview_cache: OverviewCache = .{},
     /// The diagnostics event store, which owns a third connection of its own
     /// and serializes every access — read and write — through its mutex. Null
     /// when `Store.init` failed, which `/api/health` reports as `unavailable`
@@ -350,11 +414,24 @@ pub const QuerylogRead = struct {
     pub fn open(state: *WebState, io: std.Io, database: *db.Db) db.Error!QuerylogRead {
         state.querylog_lock.lockUncancelable(io);
         errdefer state.querylog_lock.unlock(io);
+        var scope = try openLocked(state, io, database);
+        scope.held = true;
+        return scope;
+    }
+
+    /// The transaction alone, for a caller that already holds `querylog_lock`
+    /// and keeps holding it past `commit` — the overview handler, which decides
+    /// its response cache under the same one hold. Calling `open` there would
+    /// deadlock on a mutex the task already owns.
+    ///
+    /// The returned scope releases nothing: `commit` and `abort` end the
+    /// transaction and leave the lock to whoever took it.
+    pub fn openLocked(state: *WebState, io: std.Io, database: *db.Db) db.Error!QuerylogRead {
         return .{
             .state = state,
             .io = io,
             .tx = try db.ReadTx.begin(database),
-            .held = true,
+            .held = false,
         };
     }
 

src/web/web_integration_test.zig

@@ -83,7 +83,7 @@ const handlers_lookup = @import("handlers/lookup.zig");
 const handlers_pause = @import("handlers/pause.zig");
 const handlers_queries = @import("handlers/queries.zig");
 const handlers_settings = @import("handlers/settings.zig");
-const handlers_stats = @import("handlers/stats.zig");
+const handlers_overview = @import("handlers/overview.zig");
 const handlers_version = @import("handlers/version.zig");
 
 const Certificate = std.crypto.Certificate;
@@ -680,6 +680,7 @@ const Env = struct {
 
         self.state.live_hash.deinit(gpa);
         self.state.proxies.deinit(gpa);
+        self.state.overview_cache.deinit(gpa);
         self.tables.deinit(gpa);
         gpa.destroy(self.hub);
         self.limiter.deinit();
@@ -738,7 +739,7 @@ fn seedQueryLog(database: *db.Db) !void {
         \\UPDATE querylog_meta SET created_at = 1700000000, available_since = 1700000000 WHERE id = 1
     );
 
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
 
     var domain_buf: [32]u8 = undefined;
@@ -838,7 +839,7 @@ fn seedQueryLog(database: *db.Db) !void {
 const recent_clients = 3;
 
 fn seedRecentTraffic(database: *db.Db, now: i64) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
 
     const Shape = struct {
@@ -1048,15 +1049,11 @@ const contract = [_]Contract{
     // Refresh-all before any source row exists: nothing to fetch, 202 anyway.
     .{ .method = .POST, .pattern = "/api/blocklists/update", .auth = .session, .policy = .runtime_action, .target = "/api/blocklists/update", .status = 202, .check = jsonShape(StatusList) },
 
-    // Query log, stats, live stream, upstream health.
+    // Query log, overview, live stream, upstream health.
     .{ .method = .GET, .pattern = "/api/queries", .auth = .session, .policy = .read, .target = "/api/queries?limit=10", .status = 200, .check = jsonShape(handlers_queries.Page) },
     .{ .method = .GET, .pattern = "/api/queries/{id}", .auth = .session, .policy = .read, .target = "/api/queries/27", .status = 200, .check = jsonShape(provenance_view.QueryDetail) },
     .{ .method = .GET, .pattern = "/api/queries/live", .auth = .session, .policy = .read, .rate_limit = .exempt, .target = "/api/queries/live", .status = 200, .kind = .sse },
-    .{ .method = .GET, .pattern = "/api/stats", .auth = .session, .policy = .read, .target = "/api/stats?period=1h", .status = 200, .check = jsonShape(handlers_stats.TotalsBody) },
-    .{ .method = .GET, .pattern = "/api/stats/timeseries", .auth = .session, .policy = .read, .target = "/api/stats/timeseries?period=1h", .status = 200, .check = jsonShape(handlers_stats.TimeseriesBody) },
-    .{ .method = .GET, .pattern = "/api/stats/types", .auth = .session, .policy = .read, .target = "/api/stats/types?period=1h", .status = 200, .check = jsonShape(handlers_stats.TypesBody) },
-    .{ .method = .GET, .pattern = "/api/stats/routes", .auth = .session, .policy = .read, .target = "/api/stats/routes?period=1h", .status = 200, .check = jsonShape(handlers_stats.RoutesBody) },
-    .{ .method = .GET, .pattern = "/api/stats/clients", .auth = .session, .policy = .read, .target = "/api/stats/clients?period=1h", .status = 200, .check = jsonShape(handlers_stats.ClientsBody) },
+    .{ .method = .GET, .pattern = "/api/overview", .auth = .session, .policy = .read, .target = "/api/overview?period=1h", .status = 200, .check = jsonShape(handlers_overview.Body) },
 
     // Diagnostics. The seeded store holds one active episode (id 1) and one
     // resolved one, so both the page and the detail answer with real rows.
@@ -2587,11 +2584,7 @@ fn detailUnavailable(io: std.Io, env: *Env) anyerror!void {
     const targets = [_][]const u8{
         "/api/queries/1",
         "/api/queries?limit=1",
-        "/api/stats",
-        "/api/stats/timeseries",
-        "/api/stats/types",
-        "/api/stats/routes",
-        "/api/stats/clients",
+        "/api/overview",
     };
     for (targets) |target| {
         try conn.request("GET", target, null, null);
@@ -2657,27 +2650,20 @@ fn coverageWalk(io: std.Io, env: *Env) anyerror!void {
     );
     try testing.expect(!partial.coverage.complete);
 
-    // The stats endpoints judge the same watermark against their own aligned
-    // window, which for any live period starts well after the seeded rows.
-    try conn.request("GET", "/api/stats?period=1h", null, null);
-    const totals = try std.json.parseFromSliceLeaky(
-        handlers_stats.TotalsBody,
+    // The overview judges the same watermark against its own aligned window,
+    // which for any live period starts well after the seeded rows.
+    try conn.request("GET", "/api/overview?period=1h", null, null);
+    const overview_body = try std.json.parseFromSliceLeaky(
+        handlers_overview.Body,
         arena,
         (try conn.receive(&body_buf)).body,
         .{ .ignore_unknown_fields = false },
     );
-    try testing.expectEqual(seeded_available_since, totals.coverage.available_since);
-    try testing.expectEqual(totals.since >= seeded_available_since, totals.coverage.complete);
-
-    try conn.request("GET", "/api/stats/timeseries?period=1h", null, null);
-    const series = try std.json.parseFromSliceLeaky(
-        handlers_stats.TimeseriesBody,
-        arena,
-        (try conn.receive(&body_buf)).body,
-        .{ .ignore_unknown_fields = false },
+    try testing.expectEqual(seeded_available_since, overview_body.coverage.available_since);
+    try testing.expectEqual(
+        overview_body.since >= seeded_available_since,
+        overview_body.coverage.complete,
     );
-    try testing.expectEqual(totals.since, series.since);
-    try testing.expectEqual(totals.coverage.complete, series.coverage.complete);
 }
 
 fn getJson(
@@ -2708,33 +2694,43 @@ fn emptyAggregations(io: std.Io, env: *Env) anyerror!void {
     var body_buf: [256 * 1024]u8 = undefined;
 
     // This environment's only rows are the fixed 2023 seed, so every live
-    // window is empty. The empty bodies are exact, not merely parseable.
-    const types_body = try getJson(handlers_stats.TypesBody, arena, &conn, "/api/stats/types?period=1h", &body_buf);
-    try testing.expectEqualStrings("1h", types_body.period);
-    try testing.expectEqual(@as(usize, 0), types_body.types.len);
-
-    const routes_body = try getJson(handlers_stats.RoutesBody, arena, &conn, "/api/stats/routes?period=1h", &body_buf);
-    try testing.expectEqual(@as(usize, 0), routes_body.routes.len);
+    // window is empty. The empty body is exact, not merely parseable.
+    const body = try getJson(handlers_overview.Body, arena, &conn, "/api/overview?period=1h", &body_buf);
+    try testing.expectEqualStrings("1h", body.period);
+    try testing.expectEqual(@as(u64, 0), body.totals.queries);
+    try testing.expectEqual(@as(?i64, null), body.totals.avg_response_time_us);
+    try testing.expectEqual(@as(usize, 0), body.types.len);
+    try testing.expectEqual(@as(usize, 0), body.routes.len);
 
     // `other` is present and bucket-count sized even here: a chart must never
     // have to invent the residual series.
-    const clients = try getJson(handlers_stats.ClientsBody, arena, &conn, "/api/stats/clients?period=1h", &body_buf);
-    try testing.expectEqual(@as(usize, 0), clients.clients.len);
-    try testing.expectEqual(@as(u32, 60), clients.bucket_seconds);
-    try testing.expectEqual(@as(usize, 60), clients.other.len);
-    for (clients.other) |count| try testing.expectEqual(@as(u64, 0), count);
+    try testing.expectEqual(@as(usize, 0), body.clients.len);
+    try testing.expectEqual(@as(u32, 60), body.bucket_seconds);
+    try testing.expectEqual(@as(usize, 60), body.buckets.len);
+    try testing.expectEqual(@as(usize, 60), body.other.len);
+    for (body.other) |count| try testing.expectEqual(@as(u64, 0), count);
 
     // A window nobody covers is still reported as such, not as a quiet hour.
-    try testing.expectEqual(seeded_available_since, types_body.coverage.available_since);
-    try testing.expect(types_body.coverage.complete);
+    try testing.expectEqual(seeded_available_since, body.coverage.available_since);
+    try testing.expect(body.coverage.complete);
 
-    for ([_][]const u8{ "/api/stats/types", "/api/stats/routes", "/api/stats/clients" }) |path| {
-        var target_buf: [64]u8 = undefined;
-        const target = try std.fmt.bufPrint(&target_buf, "{s}?period=12h", .{path});
-        try conn.request("GET", target, null, null);
-        const bad = try conn.receive(&body_buf);
-        try testing.expectEqual(@as(u16, 400), bad.status);
-        try testing.expect(std.mem.containsAtLeast(u8, bad.body, 1, "period must be one of"));
+    try conn.request("GET", "/api/overview?period=12h", null, null);
+    const bad = try conn.receive(&body_buf);
+    try testing.expectEqual(@as(u16, 400), bad.status);
+    try testing.expect(std.mem.containsAtLeast(u8, bad.body, 1, "period must be one of"));
+
+    // Milestone 36 removed the five per-panel endpoints. They are gone from the
+    // table, not merely unreferenced by the admin, so the server refuses them.
+    for ([_][]const u8{
+        "/api/stats",
+        "/api/stats/timeseries",
+        "/api/stats/types",
+        "/api/stats/routes",
+        "/api/stats/clients",
+    }) |gone| {
+        try conn.request("GET", gone, null, null);
+        const missing = try conn.receive(&body_buf);
+        try testing.expectEqual(@as(u16, 404), missing.status);
     }
 }
 
@@ -2759,23 +2755,16 @@ fn populatedAggregations(io: std.Io, env: *Env) anyerror!void {
 
     var body_buf: [256 * 1024]u8 = undefined;
 
-    const totals = try getJson(handlers_stats.TotalsBody, arena, &conn, "/api/stats?period=1h", &body_buf);
-    const series = try getJson(handlers_stats.TimeseriesBody, arena, &conn, "/api/stats/timeseries?period=1h", &body_buf);
-    const types_body = try getJson(handlers_stats.TypesBody, arena, &conn, "/api/stats/types?period=1h", &body_buf);
-    const routes_body = try getJson(handlers_stats.RoutesBody, arena, &conn, "/api/stats/routes?period=1h", &body_buf);
-    const clients = try getJson(handlers_stats.ClientsBody, arena, &conn, "/api/stats/clients?period=1h", &body_buf);
+    const body = try getJson(handlers_overview.Body, arena, &conn, "/api/overview?period=1h", &body_buf);
 
-    // Nothing writes to this box between the five requests, so the window is
-    // one state and conservation is a real assertion rather than a race.
-    try testing.expectEqual(totals.since, series.since);
-    try testing.expectEqual(totals.since, types_body.since);
-    try testing.expectEqual(totals.since, routes_body.since);
-    try testing.expectEqual(totals.since, clients.since);
-    try testing.expect(totals.queries > 0);
+    // One response over one snapshot, so conservation is a property of the
+    // payload rather than of a quiet box between five requests.
+    try testing.expect(body.totals.queries > 0);
+    const totals = body.totals;
 
     var typed: u64 = 0;
     var null_qtype_rows: usize = 0;
-    for (types_body.types) |row| {
+    for (body.types) |row| {
         typed += row.count;
         if (row.qtype == null) null_qtype_rows += 1;
     }
@@ -2786,7 +2775,7 @@ fn populatedAggregations(io: std.Io, env: *Env) anyerror!void {
     var routed: u64 = 0;
     var null_source_upstreams: usize = 0;
     var named_upstreams: usize = 0;
-    for (routes_body.routes) |row| {
+    for (body.routes) |row| {
         routed += row.count;
         if (row.route != .upstream) continue;
         if (row.source == null) null_source_upstreams += 1 else named_upstreams += 1;
@@ -2795,17 +2784,20 @@ fn populatedAggregations(io: std.Io, env: *Env) anyerror!void {
     try testing.expectEqual(@as(usize, 1), null_source_upstreams);
     try testing.expectEqual(@as(usize, 2), named_upstreams);
 
-    try testing.expectEqual(@as(usize, recent_clients), clients.clients.len);
-    try testing.expectEqual(series.buckets.len, clients.other.len);
-    for (clients.clients) |entry| try testing.expectEqual(series.buckets.len, entry.buckets.len);
+    try testing.expectEqual(@as(usize, recent_clients), body.clients.len);
+    try testing.expectEqual(body.buckets.len, body.other.len);
+    for (body.clients) |entry| try testing.expectEqual(body.buckets.len, entry.buckets.len);
 
     // Per bucket, not just over the window: a series off by one bucket would
     // still sum correctly in total.
-    for (series.buckets, 0..) |bucket, at| {
-        var summed: u64 = clients.other[at];
-        for (clients.clients) |entry| summed += entry.buckets[at];
+    var bucketed: u64 = 0;
+    for (body.buckets, 0..) |bucket, at| {
+        bucketed += bucket.queries;
+        var summed: u64 = body.other[at];
+        for (body.clients) |entry| summed += entry.buckets[at];
         try testing.expectEqual(bucket.queries, summed);
     }
+    try testing.expectEqual(totals.queries, bucketed);
 }
 
 test "W10 milestone 30: the three breakdowns conserve the totals over one window" {
@@ -2826,11 +2818,8 @@ fn hammerQuerylog(io: std.Io, env: *Env) anyerror!void {
 
     var body_buf: [256 * 1024]u8 = undefined;
     const targets = [_][]const u8{
-        "/api/stats?period=1h",
-        "/api/stats/timeseries?period=1h",
-        "/api/stats/types?period=1h",
-        "/api/stats/routes?period=1h",
-        "/api/stats/clients?period=1h",
+        "/api/overview?period=1h",
+        "/api/overview?period=24h",
         "/api/queries?limit=5",
         "/api/queries/27",
     };
@@ -2875,7 +2864,7 @@ fn failedCommitIsBounded(io: std.Io, env: *Env) anyerror!void {
     // the connection recovers (the rollback attempt worked, so the next
     // `BEGIN` is not refused).
     db.read_tx_faults.failNextCommit();
-    try conn.request("GET", "/api/stats/types?period=1h", null, null);
+    try conn.request("GET", "/api/overview?period=1h", null, null);
     const failed = try conn.receive(&body_buf);
     try testing.expectEqual(@as(u16, 500), failed.status);
     try testing.expect(std.mem.containsAtLeast(u8, failed.body, 1, "internal error"));
@@ -2883,16 +2872,13 @@ fn failedCommitIsBounded(io: std.Io, env: *Env) anyerror!void {
     // Same connection, same shared query-log handle: a request after the fault
     // is an ordinary 200. This is the assertion the double-unlock bug failed —
     // it panicked here instead of answering.
-    try conn.request("GET", "/api/stats/types?period=1h", null, null);
+    try conn.request("GET", "/api/overview?period=1h", null, null);
     const recovered = try conn.receive(&body_buf);
     try testing.expectEqual(@as(u16, 200), recovered.status);
 
     // And every other query-log route still works on that connection.
     for ([_][]const u8{
-        "/api/stats?period=1h",
-        "/api/stats/timeseries?period=1h",
-        "/api/stats/routes?period=1h",
-        "/api/stats/clients?period=1h",
+        "/api/overview?period=24h",
         "/api/queries?limit=5",
         "/api/queries/27",
     }) |target| {
@@ -3012,7 +2998,7 @@ fn credentialSweep(
     // a closed queue is empty, and a zero flush interval makes it commit the
     // batch it holds rather than wait for company.
     query_logger.shutdown(io);
-    try query_logger.runWriter(io, &env.querylog_db, null);
+    try query_logger.runWriter(io, testing.allocator, &env.querylog_db, null);
     try testing.expectEqual(@as(u64, 1), query_logger.rows_written.load(.monotonic));
 
     var stmt = try env.querylog_db.prepare(
@@ -3905,15 +3891,13 @@ test "drift guard c: the health rollup matches the five objects it documents" {
     try expectSchemaMatches(gpa, handlers_health.Body, "Health");
 }
 
-test "drift guard c: the stats schemas match the structs that serialize them" {
+test "drift guard c: the overview schema matches the struct that serializes it" {
     // Guard b counts operations and guard a matches paths, so neither noticed
     // that `cached` outlived the field it documented. This one would have.
+    // It recurses, so `Bucket`, `ClientSeries`, `TypeCount` and `RouteCount`
+    // are held to their schemas here too.
     const gpa = testing.allocator;
-    try expectSchemaMatches(gpa, handlers_stats.TotalsBody, "StatsTotals");
-    try expectSchemaMatches(gpa, handlers_stats.TimeseriesBody, "StatsTimeseries");
-    try expectSchemaMatches(gpa, handlers_stats.TypesBody, "StatsTypes");
-    try expectSchemaMatches(gpa, handlers_stats.RoutesBody, "StatsRoutes");
-    try expectSchemaMatches(gpa, handlers_stats.ClientsBody, "StatsClients");
+    try expectSchemaMatches(gpa, handlers_overview.Body, "Overview");
 }
 
 test "drift guard c: the query-log schemas match the structs that serialize them" {
@@ -4094,8 +4078,6 @@ const contract_sample_walk = [_]ContractSample{
     // a matched pattern, so the golden exercises every nested object rather
     // than a row of nulls.
     .{ .name = "get_query_detail", .ts_type = "QueryDetail", .method = "GET", .target = "/api/queries/27", .status = 200 },
-    .{ .name = "get_stats", .ts_type = "StatsTotals", .method = "GET", .target = "/api/stats?period=1h", .status = 200 },
-    .{ .name = "get_stats_timeseries", .ts_type = "StatsTimeseries", .method = "GET", .target = "/api/stats/timeseries?period=1h", .status = 200 },
 
     // Pause: the GET before the POST, so one sample carries `until: null` and
     // the other the deadline.
@@ -4122,13 +4104,11 @@ const contract_sample_walk = [_]ContractSample{
     .{ .name = "error_not_found", .ts_type = "ErrorEnvelope", .method = "GET", .target = "/api/nope", .status = 404 },
 };
 
-/// The three period aggregations, captured against an environment with live
-/// traffic in it: over the fixed 2023 seed every one of them would answer with
-/// an empty array, which describes no field at all.
+/// The overview, captured against an environment with live traffic in it: over
+/// the fixed 2023 seed its four breakdowns would every one answer with an empty
+/// array, which describes no field at all.
 const stats_sample_walk = [_]ContractSample{
-    .{ .name = "get_stats_types", .ts_type = "StatsTypes", .method = "GET", .target = "/api/stats/types?period=1h", .status = 200 },
-    .{ .name = "get_stats_routes", .ts_type = "StatsRoutes", .method = "GET", .target = "/api/stats/routes?period=1h", .status = 200 },
-    .{ .name = "get_stats_clients", .ts_type = "StatsClients", .method = "GET", .target = "/api/stats/clients?period=1h", .status = 200 },
+    .{ .name = "get_overview", .ts_type = "Overview", .method = "GET", .target = "/api/overview?period=1h", .status = 200 },
 };
 
 /// A session-authenticated environment answers this without a cookie.