build: bump version to 0.0.13

waiting for a slot now spends the query budget; truncated attempts that
expire fault the budget, not the upstream, and are never attributed.
admission sweeps in priority order before blocking. forward zones spend
read_timeout_ms once across udp, truncation and tcp. adds
nxdns_upstream_budget_exhausted_total and a 64-upstream validation limit.

CHANGELOG.md

@@ -4,7 +4,30 @@ All notable changes to nxdns are recorded here. The format follows [Keep a Chang
 
 Sections are written by hand. Nothing here is generated from commit messages: the point of the file is to say what changed for an operator, which a commit subject rarely does.
 
-## [0.0.11] - 2026-08-24
+## [0.0.13] - 2026-08-27
+
+The upstream query budget becomes one honest deadline. A busy network no longer blames a healthy standby for running out of time, and a query burst no longer queues invisibly until everything answers SERVFAIL at once.
+
+### Fixed
+
+- **The per-query upstream budget is now one absolute deadline, spent by everything that blocks.** Waiting for a free slot on a saturated upstream now spends the query's `upstream.total_timeout_ms` budget just like the exchange itself, instead of being invisible to it — under a burst, queries used to wait out their whole budget in the queue and then start attempts they could never finish. An attempt near the end of the budget runs truncated, and when a truncated attempt runs out of time that is evidence about the budget, not the upstream: it no longer counts against that upstream's health or success rate, and the query log no longer names an upstream that was given no fair chance. A field incident produced 279 rows blaming a standby whose health counters read zero for zero; those rows now attribute nothing.
+- **A query no longer blocks behind a saturated upstream while another has capacity.** Admission sweeps the upstreams in priority order and takes the first free slot; priority now means the order among upstreams that can be admitted right now, and a query blocks only when nothing has capacity — on the highest-priority eligible upstream, bounded by the remaining budget.
+- **Conditional forward zones spend `upstream.read_timeout_ms` once per query.** A UDP attempt, a truncated answer and the TCP retry now share the one budget instead of taking a fresh one each, so a slow zone resolver can no longer stretch a single query to several times the configured timeout.
+
+### Added
+
+- **`nxdns_upstream_budget_exhausted_total`.** A pool-wide counter of queries whose budget ran out — in the queue or mid-attempt — before any upstream answered. It carries no per-upstream label on purpose: running out of budget is a fact about the pool.
+- **A configuration with more than 64 enabled upstreams is rejected at validation** with a clear message, instead of tripping an internal limit at startup.
+
+## [0.0.12] - 2026-08-27
+
+Overview stops re-reading the whole query log. One endpoint, one snapshot, pre-aggregated buckets — a 30-day view now costs the same on a month of history as on a day of it. Read the upgrade note first: it resets your query history.
+
+### Changed
+
+- **Upgrading resets your query history.** The query-log schema gains the aggregate tables described below, and `querylog.db` is never migrated: the first start after the upgrade sets the old file aside (kept on disk next to the new one, named with the reason) and begins a fresh log. Settings, groups, blocklists and every other configuration are untouched.
+- **The Overview is served by one endpoint, `GET /api/overview`.** It replaces `GET /api/stats`, `/api/stats/timeseries`, `/api/stats/types`, `/api/stats/routes` and `/api/stats/clients`, which are gone. The five panels now come from a single database snapshot, so they can no longer disagree with each other, and the page shows one loading and one error state instead of five.
+- **Query statistics are pre-aggregated as they are written.** The query log now maintains 30-minute aggregate tables in the same transaction that stores the rows, and the 24-hour, 7-day and 30-day views read those instead of scanning every logged query. The cost of opening the Overview no longer grows with the size of the log: measured at three million rows, the 30-day view went from roughly eight-tenths of a second of scanning to under fifty milliseconds, at the price of about ten percent on each background write batch and ~1.5 MB of disk. The server also keeps the most recent response per period in memory and serves repeat polls from it while nothing has changed — until new queries land, retention prunes, or the period's time window rolls forward — so on a quiet network most of the steady 30-second refreshes do no database work at all.
 
 The Overview charts move to visx and grow up: one hover treatment across all four, honest labels, and maintained d3 math under the app's own rendering.
 

PLAN.md

@@ -238,7 +238,7 @@ src/
   web/
     server.zig  router.zig  auth.zig  sse.zig  static.zig  metrics.zig  openapi.zig
     handlers/
-      auth.zig  stats.zig  queries.zig  clients.zig  groups.zig  blocklists.zig
+      auth.zig  overview.zig  queries.zig  clients.zig  groups.zig  blocklists.zig
       rules.zig  local.zig  lookup.zig  pause.zig  settings.zig
       upstream_health.zig  certs.zig  health.zig  version.zig
 
@@ -484,6 +484,8 @@ CREATE INDEX idx_query_log_client ON query_log(client_ip);
 CREATE INDEX idx_query_log_domain ON query_log(domain_id);
 ```
 
+The sketch above is the original shape; `src/storage/querylog_schema.zig` is the authority, and the provenance columns milestone 28 added are not repeated here. Beside the raw rows the file carries four projection tables — `bucket_totals`, `bucket_clients`, `bucket_types`, `bucket_routes` — on a 30-minute grain, which is what `GET /api/overview` reads for the 24h, 7d and 30d windows instead of scanning every row. They are maintained by the batch writer and by retention inside the same transaction as the raw rows, so SQLite's transaction is the whole coherence story: no second file, no backfill, no rebuild command. The 1h window is narrower than the grain and takes one raw scan.
+
 ### 11.4 Query Logger
 
 - In-memory buffer, mutex guarded, hard cap `query_log_buffer_max` (default 10000).
@@ -493,7 +495,7 @@ CREATE INDEX idx_query_log_domain ON query_log(domain_id);
 
 ### 11.5 Retention
 
-Periodic delete of rows older than `retention_days`; scheduled checkpoint/VACUUM on `querylog.db` only.
+Periodic delete of rows older than `retention_days`, dropping the projection buckets behind the cutoff and recomputing the straddling one in the same transaction; scheduled checkpoint/VACUUM on `querylog.db` only.
 
 ### 11.6 Disk Discipline (cloudflared lesson)
 
@@ -536,7 +538,7 @@ Scalars in `settings(key, value)`; ordered/structured items in dedicated tables.
 ### 13.1 Endpoints
 
 - `POST /api/auth/login`, `POST /api/auth/logout`
-- `GET /api/stats?period=…`, `GET /api/stats/timeseries?period=…`, `GET /api/stats/types?period=…`, `GET /api/stats/routes?period=…`, `GET /api/stats/clients?period=…`
+- `GET /api/overview?period=…` — every Overview panel in one response over one read transaction
 - `GET /api/queries` (filter + paginate), `GET /api/queries/live` (SSE, per-IP cap)
 - `GET/PUT /api/clients/{id}`
 - `GET/POST/PUT/DELETE /api/groups…`, `/api/blocklists…`, `/api/rules…`, `/api/local-records…`, `/api/forward-zones…`
@@ -664,7 +666,7 @@ The project publishes released binaries and container images from its own Gitea
 6. Disk-fill degrades gracefully; no silent log-flood failure mode.
 7. Web UI + API provide full admin functionality; OpenAPI contract tests green.
 8. `nxdns export` round-trips via `nxdns import`.
-9. Query logging, stats, SSE live stream work; querylog.db corruption self-heals.
+9. Query logging, the overview, SSE live stream work; querylog.db corruption self-heals.
 10. Local DoH + DoT endpoints serve LAN clients.
 11. Schema upgrade = install + restart (migration test proves it).
 12. All suites green in Gitea CI for both targets.

admin/src/features/configuration/authority.test.tsx

@@ -99,14 +99,17 @@ test("a failed status is announced by the shell on a page that is not configurat
 	stubApi(DATABASE, {
 		responses: {
 			"GET /api/config/status": new Response(JSON.stringify({ error: "gone" }), { status: 404 }),
-			"GET /api/stats?period=24h": {
+			"GET /api/overview?period=24h": {
 				period: "24h",
 				since: 0,
 				until: 86400,
-				queries: 0,
-				blocked: 0,
-				clients: 0,
-				avg_response_time_us: null,
+				bucket_seconds: 1800,
+				totals: { queries: 0, blocked: 0, clients: 0, avg_response_time_us: null },
+				buckets: [],
+				clients: [],
+				other: [],
+				types: [],
+				routes: [],
 				coverage: { complete: true, available_since: 0 },
 			},
 		},

admin/src/features/overview/ClientChart.test.tsx

@@ -2,23 +2,14 @@ import { fireEvent, render as renderBare, screen, within } from "@testing-librar
 import { QueryClientProvider } from "@tanstack/react-query";
 import { createQueryClient } from "@/lib/queryClient";
 import { formatTime } from "@/lib/format";
-import type { StatsClients } from "@/lib/types";
-import ClientChart from "./ClientChart";
+import ClientChart, { type ClientChartData } from "./ClientChart";
 import { OTHER_KEY, clientKey, seriesColor } from "./seriesColors";
 
 const SINCE = 1_700_000_000;
 const BUCKET = 1800;
 
-function clients(named: { client: string; buckets: number[] }[], other: number[]): StatsClients {
-	return {
-		period: "24h",
-		since: SINCE,
-		until: SINCE + other.length * BUCKET,
-		bucket_seconds: BUCKET,
-		coverage: { complete: true, available_since: SINCE },
-		clients: named,
-		other,
-	};
+function clients(named: { client: string; buckets: number[] }[], other: number[]): ClientChartData {
+	return { since: SINCE, bucket_seconds: BUCKET, clients: named, other };
 }
 
 const TWO_BUCKETS = clients(
@@ -34,15 +25,15 @@ const TWO_BUCKETS = clients(
  * client is registered in these fixtures, which is what leaves the addresses on
  * screen as the labels.
  */
-function render(data: StatsClients) {
+function render(data: ClientChartData) {
 	const client = createQueryClient();
-	const tree = (next: StatsClients) => (
+	const tree = (next: ClientChartData) => (
 		<QueryClientProvider client={client}>
 			<ClientChart data={next} />
 		</QueryClientProvider>
 	);
 	const result = renderBare(tree(data));
-	return { ...result, rerender: (next: StatsClients) => result.rerender(tree(next)) };
+	return { ...result, rerender: (next: ClientChartData) => result.rerender(tree(next)) };
 }
 
 beforeEach(() => {

admin/src/features/overview/ClientChart.tsx

@@ -13,7 +13,7 @@ import * as stylex from "@stylexjs/stylex";
 import { Group } from "@visx/group";
 import { BarStack } from "@visx/shape";
 import { formatTime } from "@/lib/format";
-import type { StatsClients } from "@/lib/types";
+import type { OverviewClientSeries } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
 import { colors } from "@/ui/tokens.stylex";
 import { clientLabel, useClientNames, type ClientNames } from "@/features/clients/clientNames";
@@ -82,7 +82,7 @@ interface Series {
  * and a table column all saying zero. The named clients stay at zero, because a
  * client that went quiet is something the reader wants to see.
  */
-function seriesOf(data: StatsClients, names: ClientNames): Series[] {
+function seriesOf(data: ClientChartData, names: ClientNames): Series[] {
 	const named = data.clients.map((client) => ({
 		key: clientKey(client.client),
 		// The name if the client is registered under one, the address otherwise —
@@ -100,10 +100,21 @@ function seriesOf(data: StatsClients, names: ClientNames): Series[] {
 	];
 }
 
+/**
+ * The slice of the Overview body this chart draws. Declared here rather than
+ * taken whole, so what the chart reads is stated where it is read.
+ */
+export interface ClientChartData {
+	since: number;
+	bucket_seconds: number;
+	clients: OverviewClientSeries[];
+	other: number[];
+}
+
 /** One column: the timestamp plus one entry per series, keyed by the series key. */
 type Column = { ts: number } & Record<string, number>;
 
-export default function ClientChart({ data }: { data: StatsClients }) {
+export default function ClientChart({ data }: { data: ClientChartData }) {
 	const [containerRef, width] = useMeasuredWidth();
 	// A hover survives a re-render only while it still names the same bucket at
 	// the same place: a poll that rolls the window, or a resize, retires it.

admin/src/features/overview/OverviewFrame.tsx

@@ -0,0 +1,133 @@
+/**
+ * The part of Overview that does not wait for anything: the heading, the period
+ * picker, and the pulsing body the page shows while the window is in flight.
+ *
+ * It lives apart from `OverviewPage` so the route's pending component can render
+ * the identical surface while the page chunk loads. Importing the page itself
+ * would pull the charts into the main bundle, and a second hand-written copy of
+ * the frame would drift. Nothing here imports a chart.
+ */
+
+import * as stylex from "@stylexjs/stylex";
+import { useNavigate, useSearch } from "@tanstack/react-router";
+import type { Period } from "@/lib/types";
+import { styles as shared } from "@/ui/styles";
+import { colors } from "@/ui/tokens.stylex";
+import { DEFAULT_PERIOD, PERIODS } from "./period";
+
+const styles = stylex.create({
+	page: {
+		display: "flex",
+		flexDirection: "column",
+		gap: "1rem",
+	},
+	headingRow: {
+		display: "flex",
+		flexWrap: "wrap",
+		alignItems: "center",
+		justifyContent: "space-between",
+		gap: "0.75rem",
+	},
+	heading: {
+		fontSize: "1.5rem",
+		lineHeight: "2rem",
+		fontWeight: 600,
+	},
+	periodGroup: {
+		display: "flex",
+		gap: "0.25rem",
+	},
+	period: {
+		borderStyle: "none",
+		borderRadius: "0.25rem",
+		paddingInline: "0.625rem",
+		paddingBlock: "0.25rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+	},
+	/** The pressed fill is heavier than `surfaceHover`, so a hover cannot mimic it. */
+	periodSelected: {
+		backgroundColor: {
+			default: "oklch(92% 0.004 286.32)",
+			"@media (prefers-color-scheme: dark)": "oklch(37% 0.013 285.805)",
+		},
+		color: colors.text,
+		fontWeight: 500,
+	},
+	periodIdle: {
+		backgroundColor: { default: "transparent", ":hover": colors.surfaceHover },
+		color: colors.textSecondary,
+	},
+	loading: {
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textMuted,
+	},
+});
+
+export function PeriodPicker({ period, onChange }: { period: Period; onChange: (period: Period) => void }) {
+	return (
+		<div role="group" aria-label="Period" {...stylex.props(styles.periodGroup)}>
+			{PERIODS.map((option) => (
+				<button
+					key={option}
+					type="button"
+					aria-pressed={option === period}
+					onClick={() => onChange(option)}
+					{...stylex.props(
+						styles.period,
+						option === period ? styles.periodSelected : styles.periodIdle,
+						shared.focusRing,
+					)}
+				>
+					{option}
+				</button>
+			))}
+		</div>
+	);
+}
+
+export function OverviewLoading() {
+	return (
+		<p role="status" {...stylex.props(styles.loading, shared.pulse)}>
+			Loading…
+		</p>
+	);
+}
+
+export function OverviewFrame({
+	period,
+	onChange,
+	children,
+}: {
+	period: Period;
+	onChange: (period: Period) => void;
+	children: React.ReactNode;
+}) {
+	return (
+		<div {...stylex.props(styles.page)}>
+			<div {...stylex.props(styles.headingRow)}>
+				<h1 {...stylex.props(styles.heading)}>Overview</h1>
+				<PeriodPicker period={period} onChange={onChange} />
+			</div>
+			{children}
+		</div>
+	);
+}
+
+/**
+ * The route's pending surface. The picker stays live because it only writes the
+ * search parameter, which the route already re-reads on its own.
+ */
+export function OverviewPending() {
+	const period = useSearch({ from: "/shell/overview" }).period ?? DEFAULT_PERIOD;
+	const navigate = useNavigate({ from: "/overview" });
+	return (
+		<OverviewFrame
+			period={period}
+			onChange={(next) => void navigate({ search: (prev) => ({ ...prev, period: next }) })}
+		>
+			<OverviewLoading />
+		</OverviewFrame>
+	);
+}

admin/src/features/overview/OverviewPage.test.tsx

@@ -16,64 +16,32 @@ import { createQueryClient } from "@/lib/queryClient";
 import { createAppRouter } from "@/routes";
 import { clientKey, qtypeKey, seriesColor } from "./seriesColors";
 import { health } from "@/lib/healthFixture";
-import type { Health, StatsClients, StatsRoutes, StatsTimeseries, StatsTotals, StatsTypes } from "@/lib/types";
+import type { Health, Overview } from "@/lib/types";
 
 const SINCE = Date.UTC(2026, 0, 1, 0, 0) / 1000;
 const UNTIL = Date.UTC(2026, 0, 2, 0, 0) / 1000;
 const COVERAGE = { complete: true, available_since: SINCE };
 
-const TOTALS: StatsTotals = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
-	queries: 1000,
-	blocked: 250,
-	clients: 7,
-	avg_response_time_us: 2345,
-	coverage: COVERAGE,
-};
-
-const SERIES: StatsTimeseries = {
+const OVERVIEW: Overview = {
 	period: "24h",
 	since: SINCE,
 	until: UNTIL,
 	bucket_seconds: 1800,
+	totals: { queries: 1000, blocked: 250, clients: 7, avg_response_time_us: 2345 },
 	buckets: [
 		{ ts: SINCE, queries: 60, blocked: 20, cached: 10 },
 		{ ts: SINCE + 1800, queries: 40, blocked: 0, cached: 0 },
 	],
-	coverage: COVERAGE,
-};
-
-const CLIENTS: StatsClients = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
-	bucket_seconds: 1800,
 	clients: [
 		{ client: "192.0.2.30", buckets: [40, 20] },
 		{ client: "192.0.2.31", buckets: [20, 20] },
 	],
 	other: [0, 0],
-	coverage: COVERAGE,
-};
-
-const TYPES: StatsTypes = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
 	types: [
 		{ qtype: 1, count: 600 },
 		{ qtype: 28, count: 300 },
 		{ qtype: null, count: 100 },
 	],
-	coverage: COVERAGE,
-};
-
-const ROUTES: StatsRoutes = {
-	period: "24h",
-	since: SINCE,
-	until: UNTIL,
 	routes: [
 		{ route: "upstream", source: "https://dns.example/dns-query", count: 500 },
 		{ route: "blocked", source: null, count: 250 },
@@ -83,22 +51,27 @@ const ROUTES: StatsRoutes = {
 	coverage: COVERAGE,
 };
 
-/** The same shapes an hour wide, so a period change is observable in every panel. */
-const HOUR = {
-	totals: { ...TOTALS, period: "1h", since: UNTIL - 3600, queries: 12, blocked: 3, clients: 2 } as StatsTotals,
-	timeseries: { ...SERIES, period: "1h", since: UNTIL - 3600, bucket_seconds: 60, buckets: [] } as StatsTimeseries,
-	clients: { ...CLIENTS, period: "1h", since: UNTIL - 3600, clients: [], other: [] } as StatsClients,
-	types: { ...TYPES, period: "1h", since: UNTIL - 3600, types: [] } as StatsTypes,
-	routes: { ...ROUTES, period: "1h", since: UNTIL - 3600, routes: [] } as StatsRoutes,
+/** The same shape an hour wide and empty, so a period change is observable. */
+const HOUR: Overview = {
+	...OVERVIEW,
+	period: "1h",
+	since: UNTIL - 3600,
+	bucket_seconds: 60,
+	totals: { queries: 12, blocked: 3, clients: 2, avg_response_time_us: 2345 },
+	buckets: [],
+	clients: [],
+	other: [],
+	types: [],
+	routes: [],
 };
 
 let healthBody: Health;
-let failing: Set<string>;
+let failing: boolean;
 /** The registered clients, as `/api/clients` answers them. */
 let registered: { ip: string; name: string; learned_name: string }[];
 let coverageComplete: boolean;
-/** Paths held in flight, so a test can look at the page while one is pending. */
-let delayed: Map<string, Promise<void>>;
+/** Held in flight, so a test can look at the page while the request is pending. */
+let delayed: Promise<void> | null;
 
 function json(payload: unknown, status = 200): Response {
 	return new Response(JSON.stringify(payload), { status, headers: { "content-type": "application/json" } });
@@ -110,27 +83,18 @@ function withCoverage<T extends { coverage: typeof COVERAGE }>(body: T): T {
 
 beforeEach(() => {
 	healthBody = health();
-	failing = new Set();
+	failing = false;
 	registered = [];
 	coverageComplete = true;
-	delayed = new Map();
+	delayed = null;
 	vi.stubGlobal(
 		"fetch",
 		vi.fn(async (input: RequestInfo | URL) => {
 			const url = String(input);
-			const hour = url.includes("period=1h");
-			for (const [path, body] of [
-				["/api/stats/timeseries", hour ? HOUR.timeseries : SERIES],
-				["/api/stats/clients", hour ? HOUR.clients : CLIENTS],
-				["/api/stats/types", hour ? HOUR.types : TYPES],
-				["/api/stats/routes", hour ? HOUR.routes : ROUTES],
-				["/api/stats", hour ? HOUR.totals : TOTALS],
-			] as const) {
-				if (!url.startsWith(path)) continue;
-				if (failing.has(path)) return json({ error: "endpoint unavailable" }, 400);
-				const held = delayed.get(path);
-				if (held !== undefined) await held;
-				return json(withCoverage(body));
+			if (url.startsWith("/api/overview")) {
+				if (failing) return json({ error: "endpoint unavailable" }, 400);
+				if (delayed !== null) await delayed;
+				return json(withCoverage(url.includes("period=1h") ? HOUR : OVERVIEW));
 			}
 			if (url === "/api/clients") {
 				return json({
@@ -215,25 +179,27 @@ test("the page builds a donut slice's colour from the entry's identity", async (
 	expect(swatch.getAttribute("style")).toContain(seriesColor(qtypeKey(1)));
 });
 
-test("a slow endpoint does not hold the page back: the panels that answered render beside it", async () => {
-	// Through the real route, which is the point: the loader starts the five
-	// requests and awaits none of them. If it awaited, the router would hold the
-	// whole page until the slowest answered and this would time out on the tiles.
+test("a request in flight leaves the heading and the picker usable behind one loading surface", async () => {
+	// Through the real route, which is the point: the loader starts the request
+	// and awaits it nowhere. If it awaited, the router would hold the whole page —
+	// heading and period picker included — until the response landed.
 	let release = () => {};
-	delayed.set("/api/stats/routes", new Promise<void>((resolve) => (release = resolve)));
+	delayed = new Promise<void>((resolve) => (release = resolve));
 
 	renderApp();
 
-	// The tiles and both charts are readable while the routes request is still
-	// in flight, and the panel waiting on it says so for itself.
-	await screen.findByText("1,000");
-	expect(within(panel("Queries over time")).getAllByText("Blocked").length).toBeGreaterThan(0);
-	expect(within(panel("Client activity over time")).getAllByText("192.0.2.30")).toHaveLength(2);
-	expect(within(panel("Query types")).getAllByText("A")).toHaveLength(2);
-	expect(within(panel("Upstream servers")).getByRole("status").textContent).toBe("Loading…");
+	await screen.findByRole("heading", { name: "Overview", level: 1 });
+	expect(screen.getByRole("button", { name: "1h" })).toBeTruthy();
+	// One loading state for the whole page, not one per panel.
+	const loading = await screen.findByText("Loading…");
+	expect(loading.getAttribute("role")).toBe("status");
+	expect(screen.getAllByText("Loading…")).toHaveLength(1);
+	expect(screen.queryByRole("heading", { name: "Query types" })).toBeNull();
 
 	release();
-	await waitFor(() => expect(within(panel("Upstream servers")).queryByRole("status")).toBeNull());
+	delayed = null;
+	await screen.findByText("1,000");
+	expect(screen.queryByText("Loading…")).toBeNull();
 });
 
 test("a registered client is named in the chart, an unregistered one keeps its address", async () => {
@@ -392,17 +358,24 @@ test("the picker rescopes every panel and writes the period into the url", async
 	expect(screen.queryByText("1,000")).toBeNull();
 });
 
-test("one failing panel keeps its own error and leaves the rest of the page standing", async () => {
-	failing.add("/api/stats/routes");
+test("a failed request is one error for the whole page, stated once and retryable", async () => {
+	failing = true;
 	renderApp();
-	await screen.findByText("1,000");
 
-	await waitFor(() => expect(within(panel("Upstream servers")).getByText("endpoint unavailable")).toBeTruthy());
-	expect(within(panel("Upstream servers")).getByRole("button", { name: "Retry" })).toBeTruthy();
-	// A failed donut never blanks the charts.
-	expect(screen.getByRole("img", { name: /queries over time/i })).toBeTruthy();
-	expect(screen.getByRole("img", { name: /client activity over time/i })).toBeTruthy();
+	await screen.findByText("endpoint unavailable");
+	// One statement of the failure, not one per panel: there is a single request
+	// behind every panel, so a second copy would only repeat this sentence.
+	expect(screen.getAllByText("endpoint unavailable")).toHaveLength(1);
+	expect(screen.getAllByRole("button", { name: "Retry" })).toHaveLength(1);
+	// The heading and the picker survive it, so the reader can rescope or retry.
+	expect(screen.getByRole("heading", { name: "Overview", level: 1 })).toBeTruthy();
+	expect(screen.getByRole("button", { name: "1h" })).toBeTruthy();
 	expect(screen.queryByText("Something went wrong")).toBeNull();
+
+	failing = false;
+	fireEvent.click(screen.getByRole("button", { name: "Retry" }));
+	await screen.findByText("1,000");
+	expect(screen.getByRole("img", { name: /queries over time/i })).toBeTruthy();
 });
 
 test("an incomplete window states its watermark once for the whole page", async () => {

admin/src/features/overview/OverviewPage.tsx

@@ -8,9 +8,9 @@
  * The period is URL state, so a view is a link: `/overview?period=1h` opens
  * exactly what the sender was reading.
  *
- * Every panel reads the same window (`overviewWindow.ts`) and renders on its
- * own. A donut whose request failed shows its own error while the charts keep
- * their data, and no two panels ever describe different spans.
+ * One request feeds every panel (`overviewWindow.ts`), so the page has one
+ * loading state and one error state rather than six: there is no longer a
+ * partial answer to render, and nothing left for a panel to disagree about.
  */
 
 import * as stylex from "@stylexjs/stylex";
@@ -18,16 +18,16 @@ import { useNavigate, useSearch } from "@tanstack/react-router";
 import CoverageNotice from "@/lib/CoverageNotice";
 import InlineError from "@/lib/InlineError";
 import { qtypeName } from "@/features/provenance/qtype";
-import type { Period, StatsRoutes, StatsTypes } from "@/lib/types";
-import { styles as shared } from "@/ui/styles";
+import type { Overview, OverviewRouteRow, OverviewTypeRow } from "@/lib/types";
 import { colors } from "@/ui/tokens.stylex";
 import ClientChart from "./ClientChart";
 import Donut from "./Donut";
 import StatTiles from "./StatTiles";
 import TimeseriesChart from "./TimeseriesChart";
 import type { DonutSlice } from "./Donut";
+import { OverviewFrame, OverviewLoading } from "./OverviewFrame";
 import { useOverviewWindow, type Panel } from "./overviewWindow";
-import { DEFAULT_PERIOD, PERIODS } from "./period";
+import { DEFAULT_PERIOD } from "./period";
 import { qtypeKey, routeKey, seriesColor } from "./seriesColors";
 
 /**
@@ -48,48 +48,6 @@ const ROUTE_LABELS = {
 } as const;
 
 const styles = stylex.create({
-	page: {
-		display: "flex",
-		flexDirection: "column",
-		gap: "1rem",
-	},
-	headingRow: {
-		display: "flex",
-		flexWrap: "wrap",
-		alignItems: "center",
-		justifyContent: "space-between",
-		gap: "0.75rem",
-	},
-	heading: {
-		fontSize: "1.5rem",
-		lineHeight: "2rem",
-		fontWeight: 600,
-	},
-	periodGroup: {
-		display: "flex",
-		gap: "0.25rem",
-	},
-	period: {
-		borderStyle: "none",
-		borderRadius: "0.25rem",
-		paddingInline: "0.625rem",
-		paddingBlock: "0.25rem",
-		fontSize: "0.875rem",
-		lineHeight: "1.25rem",
-	},
-	/** The pressed fill is heavier than `surfaceHover`, so a hover cannot mimic it. */
-	periodSelected: {
-		backgroundColor: {
-			default: "oklch(92% 0.004 286.32)",
-			"@media (prefers-color-scheme: dark)": "oklch(37% 0.013 285.805)",
-		},
-		color: colors.text,
-		fontWeight: 500,
-	},
-	periodIdle: {
-		backgroundColor: { default: "transparent", ":hover": colors.surfaceHover },
-		color: colors.textSecondary,
-	},
 	panel: {
 		borderRadius: "0.25rem",
 		borderWidth: 1,
@@ -110,54 +68,20 @@ const styles = stylex.create({
 		gap: "1rem",
 		gridTemplateColumns: { default: "minmax(0, 1fr)", [TWO_COLUMN]: "repeat(2, minmax(0, 1fr))" },
 	},
-	loading: {
-		fontSize: "0.875rem",
-		lineHeight: "1.25rem",
-		color: colors.textMuted,
-	},
 });
 
-function PeriodPicker({ period, onChange }: { period: Period; onChange: (period: Period) => void }) {
-	return (
-		<div role="group" aria-label="Period" {...stylex.props(styles.periodGroup)}>
-			{PERIODS.map((option) => (
-				<button
-					key={option}
-					type="button"
-					aria-pressed={option === period}
-					onClick={() => onChange(option)}
-					{...stylex.props(
-						styles.period,
-						option === period ? styles.periodSelected : styles.periodIdle,
-						shared.focusRing,
-					)}
-				>
-					{option}
-				</button>
-			))}
-		</div>
-	);
-}
-
 /**
- * One panel's three states. Loading and error are the panel's own: a failure
- * here never reaches past this box, which is what keeps a failed donut from
- * blanking the charts beside it.
+ * The page's three states. The heading and the period picker stay put through
+ * all three, so the reader can rescope or retry without waiting for anything.
  */
-function PanelBody<T>({ panel, children }: { panel: Panel<T>; children: (data: T) => React.ReactNode }) {
+function PageBody({ panel, children }: { panel: Panel<Overview>; children: (data: Overview) => React.ReactNode }) {
 	if (panel.status === "error") return <InlineError error={panel.error} onRetry={panel.retry} />;
-	if (panel.status === "loading") {
-		return (
-			<p role="status" {...stylex.props(styles.loading, shared.pulse)}>
-				Loading…
-			</p>
-		);
-	}
+	if (panel.status === "loading") return <OverviewLoading />;
 	return <>{children(panel.data)}</>;
 }
 
-function typeSlices(data: StatsTypes): DonutSlice[] {
-	return data.types.map((row) => ({
+function typeSlices(types: OverviewTypeRow[]): DonutSlice[] {
+	return types.map((row) => ({
 		key: qtypeKey(row.qtype),
 		label: row.qtype === null ? "Unknown" : qtypeName(row.qtype),
 		value: row.count,
@@ -171,8 +95,8 @@ function typeSlices(data: StatsTypes): DonutSlice[] {
  * appear under two kinds and two rows can both be "Unknown". The four
  * source-less kinds are their own label and need no qualifier.
  */
-function routeSlices(data: StatsRoutes): DonutSlice[] {
-	return data.routes.map((row) => {
+function routeSlices(routes: OverviewRouteRow[]): DonutSlice[] {
+	return routes.map((row) => {
 		const named = row.route === "upstream" || row.route === "forward_zone";
 		return {
 			key: routeKey(row.route, row.source),
@@ -190,59 +114,54 @@ export default function OverviewPage() {
 	const overview = useOverviewWindow(period);
 
 	return (
-		<div {...stylex.props(styles.page)}>
-			<div {...stylex.props(styles.headingRow)}>
-				<h1 {...stylex.props(styles.heading)}>Overview</h1>
-				<PeriodPicker
-					period={period}
-					onChange={(next) => void navigate({ search: (prev) => ({ ...prev, period: next }) })}
-				/>
-			</div>
+		<OverviewFrame
+			period={period}
+			onChange={(next) => void navigate({ search: (prev) => ({ ...prev, period: next }) })}
+		>
+			<PageBody panel={overview}>
+				{(data) => (
+					<>
+						<StatTiles stats={{ since: data.since, until: data.until, ...data.totals }} />
 
-			<PanelBody panel={overview.totals}>{(totals) => <StatTiles stats={totals} />}</PanelBody>
+						{/* One notice for the page: every panel came out of this one
+						    response, so a second copy would only repeat this sentence. */}
+						<CoverageNotice coverage={data.coverage} />
 
-			{/* One notice for the page: every panel is judged against the same window,
-			    so a second copy would only repeat this sentence. */}
-			{overview.coverage !== null && <CoverageNotice coverage={overview.coverage} />}
+						<section aria-labelledby="overview-queries" {...stylex.props(styles.panel)}>
+							<h2 id="overview-queries" {...stylex.props(styles.panelHeading)}>
+								Queries over time
+							</h2>
+							<TimeseriesChart data={data} />
+						</section>
 
-			<section aria-labelledby="overview-queries" {...stylex.props(styles.panel)}>
-				<h2 id="overview-queries" {...stylex.props(styles.panelHeading)}>
-					Queries over time
-				</h2>
-				<PanelBody panel={overview.timeseries}>{(data) => <TimeseriesChart data={data} />}</PanelBody>
-			</section>
+						<section aria-labelledby="overview-clients" {...stylex.props(styles.panel)}>
+							<h2 id="overview-clients" {...stylex.props(styles.panelHeading)}>
+								Client activity over time
+							</h2>
+							<ClientChart data={data} />
+						</section>
 
-			<section aria-labelledby="overview-clients" {...stylex.props(styles.panel)}>
-				<h2 id="overview-clients" {...stylex.props(styles.panelHeading)}>
-					Client activity over time
-				</h2>
-				<PanelBody panel={overview.clients}>{(data) => <ClientChart data={data} />}</PanelBody>
-			</section>
-
-			<div {...stylex.props(styles.donutRow)}>
-				<section aria-labelledby="overview-types" {...stylex.props(styles.panel)}>
-					<h2 id="overview-types" {...stylex.props(styles.panelHeading)}>
-						Query types
-					</h2>
-					<PanelBody panel={overview.types}>
-						{(data) => <Donut slices={typeSlices(data)} caption="Queries by DNS type" unit="Queries" />}
-					</PanelBody>
-				</section>
-				<section aria-labelledby="overview-routes" {...stylex.props(styles.panel)}>
-					<h2 id="overview-routes" {...stylex.props(styles.panelHeading)}>
-						Upstream servers
-					</h2>
-					<PanelBody panel={overview.routes}>
-						{(data) => (
-							<Donut
-								slices={routeSlices(data)}
-								caption="Queries by how they were answered"
-								unit="Queries"
-							/>
-						)}
-					</PanelBody>
-				</section>
-			</div>
-		</div>
+						<div {...stylex.props(styles.donutRow)}>
+							<section aria-labelledby="overview-types" {...stylex.props(styles.panel)}>
+								<h2 id="overview-types" {...stylex.props(styles.panelHeading)}>
+									Query types
+								</h2>
+								<Donut slices={typeSlices(data.types)} caption="Queries by DNS type" unit="Queries" />
+							</section>
+							<section aria-labelledby="overview-routes" {...stylex.props(styles.panel)}>
+								<h2 id="overview-routes" {...stylex.props(styles.panelHeading)}>
+									Upstream servers
+								</h2>
+								<Donut
+									slices={routeSlices(data.routes)}
+									caption="Queries by how they were answered"
+									unit="Queries"
+								/>
+							</section>
+						</div>
+					</>
+				)}
+			</PageBody>
+		</OverviewFrame>
 	);
 }

admin/src/features/overview/StatTiles.tsx

@@ -5,7 +5,7 @@
  * typographic, so the eye ranks the figures rather than the panels, and a tile
  * never implies a state it is not reporting.
  *
- * The Activity links carry the bounds the **stats response** returned, not
+ * The Activity links carry the bounds the **overview response** returned, not
  * bounds computed here — a client-computed window would send the reader to a
  * slightly different span than the one they were just reading.
  */
@@ -13,7 +13,7 @@
 import * as stylex from "@stylexjs/stylex";
 import { Link } from "@tanstack/react-router";
 import { formatMicros } from "@/lib/format";
-import type { StatsTotals } from "@/lib/types";
+import type { OverviewTotals } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
 import { colors } from "@/ui/tokens.stylex";
 
@@ -101,7 +101,13 @@ function Tile({
 	);
 }
 
-export default function StatTiles({ stats }: { stats: StatsTotals }) {
+/** The window's totals with the bounds they were measured over. */
+export interface StatTilesData extends OverviewTotals {
+	since: number;
+	until: number;
+}
+
+export default function StatTiles({ stats }: { stats: StatTilesData }) {
 	const window = {
 		mode: "history" as const,
 		since: stats.since,

admin/src/features/overview/TimeseriesChart.test.tsx

@@ -1,24 +1,17 @@
 import { fireEvent, render, screen, within } from "@testing-library/react";
 import * as stylex from "@stylexjs/stylex";
 import { formatTime } from "@/lib/format";
-import type { Bucket, StatsTimeseries } from "@/lib/types";
+import type { Bucket } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
-import TimeseriesChart from "./TimeseriesChart";
+import TimeseriesChart, { type TimeseriesData } from "./TimeseriesChart";
 
 const SINCE = 1_700_000_000;
 
-function timeseries(buckets: Bucket[]): StatsTimeseries {
-	return {
-		period: "24h",
-		since: SINCE,
-		until: SINCE + buckets.length * 1800,
-		bucket_seconds: 1800,
-		coverage: { complete: true, available_since: SINCE },
-		buckets,
-	};
+function timeseries(buckets: Bucket[]): TimeseriesData {
+	return { since: SINCE, bucket_seconds: 1800, buckets };
 }
 
-function counting(bucketCount: number): StatsTimeseries {
+function counting(bucketCount: number): TimeseriesData {
 	return timeseries(
 		Array.from({ length: bucketCount }, (_, i) => ({
 			ts: SINCE + i * 1800,

admin/src/features/overview/TimeseriesChart.tsx

@@ -2,7 +2,7 @@ import * as stylex from "@stylexjs/stylex";
 import { Group } from "@visx/group";
 import { BarStack } from "@visx/shape";
 import { formatTime } from "@/lib/format";
-import type { Bucket, StatsTimeseries } from "@/lib/types";
+import type { Bucket } from "@/lib/types";
 import { styles as shared } from "@/ui/styles";
 import { colors } from "@/ui/tokens.stylex";
 import {
@@ -103,7 +103,17 @@ function tooltipOf(column: Column): TooltipContent {
 	};
 }
 
-export default function TimeseriesChart({ data }: { data: StatsTimeseries }) {
+/**
+ * The slice of the Overview body this chart draws. Declared here rather than
+ * taken whole, so what the chart reads is stated where it is read.
+ */
+export interface TimeseriesData {
+	since: number;
+	bucket_seconds: number;
+	buckets: Bucket[];
+}
+
+export default function TimeseriesChart({ data }: { data: TimeseriesData }) {
 	const [containerRef, width] = useMeasuredWidth();
 	// A hover survives a re-render only while it still names the same bucket at
 	// the same place: a poll that rolls the window, or a resize, retires it.

admin/src/features/overview/overviewWindow.test.tsx

@@ -1,74 +1,41 @@
 /**
- * Window coherence across the five Overview requests, migrated from the
- * two-request `activityWindow` this replaces. Every behaviour that hook pinned
- * is pinned here — the identity, the one retry per mismatch episode, the
- * terminal error, the discarded previous-period pair and the stale completion
- * that must not speak — now over five endpoints and with the watermark in the
- * identity, plus the per-panel isolation the layout added.
+ * The hook over the single `/api/overview` request.
+ *
+ * The five-endpoint build reconciled five window identities here — the retry per
+ * mismatch episode, the terminal "different window" error, the orphaned stale
+ * completion. One request cannot disagree with itself, so those behaviours have
+ * no subject left and are gone rather than ported. What survived the collapse is
+ * pinned below: the three states, and the one rule a single request still does
+ * not settle — that a `keepPreviousData` body from the period the reader left
+ * must never render under the new period's label.
  */
 
 import { render, screen, waitFor } from "@testing-library/react";
 import { QueryClientProvider } from "@tanstack/react-query";
 import { createQueryClient } from "@/lib/queryClient";
-import type { Coverage, Period } from "@/lib/types";
-import {
-	newerWindow,
-	sameWindow,
-	useOverviewWindow,
-	windowIdOf,
-	OVERVIEW_ENDPOINTS,
-	type OverviewEndpoint,
-} from "./overviewWindow";
+import type { Period } from "@/lib/types";
+import { useOverviewWindow } from "./overviewWindow";
 
 const SINCE = Date.UTC(2026, 0, 1, 0, 0) / 1000;
 const UNTIL = Date.UTC(2026, 0, 2, 0, 0) / 1000;
-const COVERAGE: Coverage = { complete: true, available_since: SINCE };
 
-/** Where each endpoint's body currently ends, and what watermark it admits. */
-interface Bounds {
-	until: number;
-	availableSince: number;
-}
+let failing: boolean;
+let calls: number;
 
-const PATHS: Record<OverviewEndpoint, string> = {
-	totals: "/api/stats?period=",
-	timeseries: "/api/stats/timeseries?period=",
-	clients: "/api/stats/clients?period=",
-	types: "/api/stats/types?period=",
-	routes: "/api/stats/routes?period=",
-};
-
-let bounds: Record<OverviewEndpoint, Bounds>;
-let failing: Set<OverviewEndpoint>;
-let calls: Record<OverviewEndpoint, number>;
-/** Endpoints that answer for the page's window from their second call onward. */
-let catchUp: Set<OverviewEndpoint>;
-/** Held to keep one answer in flight while the test moves the page on. */
-let hold: { promise: Promise<void>; release: () => void } | null;
-
-function endpointOf(url: string): OverviewEndpoint | null {
-	// Longest prefix first: `/api/stats?` and `/api/stats/…` share a stem.
-	for (const endpoint of ["timeseries", "clients", "types", "routes", "totals"] as const) {
-		if (url.startsWith(PATHS[endpoint])) return endpoint;
-	}
-	return null;
-}
-
-function body(endpoint: OverviewEndpoint, period: Period): unknown {
-	const { until, availableSince } = bounds[endpoint];
-	const shared = { period, since: SINCE, until, coverage: { ...COVERAGE, available_since: availableSince } };
-	switch (endpoint) {
-		case "totals":
-			return { ...shared, queries: 10, blocked: 2, clients: 1, avg_response_time_us: 1000 };
-		case "timeseries":
-			return { ...shared, bucket_seconds: 3600, buckets: [] };
-		case "clients":
-			return { ...shared, bucket_seconds: 3600, clients: [], other: [] };
-		case "types":
-			return { ...shared, types: [] };
-		case "routes":
-			return { ...shared, routes: [] };
-	}
+function body(period: Period): unknown {
+	return {
+		period,
+		since: SINCE,
+		until: UNTIL,
+		bucket_seconds: 1800,
+		totals: { queries: 10, blocked: 2, clients: 1, avg_response_time_us: 1000 },
+		buckets: [],
+		clients: [],
+		other: [],
+		types: [],
+		routes: [],
+		coverage: { complete: true, available_since: SINCE },
+	};
 }
 
 function json(payload: unknown, status = 200): Response {
@@ -76,55 +43,36 @@ function json(payload: unknown, status = 200): Response {
 }
 
 beforeEach(() => {
-	bounds = {
-		totals: { until: UNTIL, availableSince: SINCE },
-		timeseries: { until: UNTIL, availableSince: SINCE },
-		clients: { until: UNTIL, availableSince: SINCE },
-		types: { until: UNTIL, availableSince: SINCE },
-		routes: { until: UNTIL, availableSince: SINCE },
-	};
-	failing = new Set();
-	catchUp = new Set();
-	hold = null;
-	calls = { totals: 0, timeseries: 0, clients: 0, types: 0, routes: 0 };
+	failing = false;
+	calls = 0;
 	vi.stubGlobal(
 		"fetch",
 		vi.fn(async (input: RequestInfo | URL) => {
 			const url = String(input);
-			const endpoint = endpointOf(url);
-			if (endpoint === null) return json({ error: "not stubbed" }, 404);
-			calls[endpoint] += 1;
-			if (failing.has(endpoint)) return json({ error: "endpoint unavailable" }, 400);
-			if (catchUp.has(endpoint) && calls[endpoint] >= 2)
-				bounds[endpoint] = { until: UNTIL, availableSince: SINCE };
+			if (!url.startsWith("/api/overview")) return json({ error: "not stubbed" }, 404);
+			calls += 1;
+			if (failing) return json({ error: "endpoint unavailable" }, 400);
 			const period = (new URLSearchParams(url.split("?")[1]).get("period") ?? "24h") as Period;
-			// Built before the wait, so a held answer carries what its own request
-			// would have returned rather than what the page has moved on to.
-			const payload = json(body(endpoint, period));
-			if (hold !== null && endpoint === "routes" && calls.routes === 2) await hold.promise;
-			return payload;
+			return json(body(period));
 		}),
 	);
 });
 
 afterEach(() => vi.unstubAllGlobals());
 
+/** The last retry the hook handed out, so a test can spend it. */
+let lastRetry: () => void;
+
 function Probe({ period }: { period: Period }) {
-	const overview = useOverviewWindow(period);
-	return (
-		<ul>
-			{OVERVIEW_ENDPOINTS.map((endpoint) => {
-				const panel = overview[endpoint];
-				const detail =
-					panel.status === "ready"
-						? `${panel.data.period}@${panel.data.until}/${panel.data.coverage.available_since}`
-						: panel.status === "error"
-							? (panel.error as Error).message
-							: "";
-				return <li key={endpoint}>{`${endpoint}:${panel.status}:${detail}`}</li>;
-			})}
-		</ul>
-	);
+	const panel = useOverviewWindow(period);
+	if (panel.status === "error") lastRetry = panel.retry;
+	const detail =
+		panel.status === "ready"
+			? `${panel.data.period}@${panel.data.until}`
+			: panel.status === "error"
+				? (panel.error as Error).message
+				: "";
+	return <p>{`${panel.status}:${detail}`}</p>;
 }
 
 function renderProbe(period: Period = "24h") {
@@ -144,149 +92,36 @@ function renderProbe(period: Period = "24h") {
 	};
 }
 
-function line(endpoint: OverviewEndpoint): string {
-	const item = screen.getAllByRole("listitem").find((element) => element.textContent?.startsWith(`${endpoint}:`));
-	if (item === undefined) throw new Error(`no probe line for ${endpoint}`);
-	return item.textContent ?? "";
+function line(): string {
+	return screen.getByRole("paragraph").textContent ?? "";
 }
 
-test("the window identity is the period, both bounds and the watermark together", () => {
-	const base = { period: "24h" as const, since: SINCE, until: UNTIL, availableSince: SINCE };
-	expect(sameWindow(base, { ...base })).toBe(true);
-	expect(sameWindow(base, { ...base, period: "1h" })).toBe(false);
-	expect(sameWindow(base, { ...base, since: SINCE - 1 })).toBe(false);
-	expect(sameWindow(base, { ...base, until: UNTIL + 1 })).toBe(false);
-	// The bounds agree and the answers still describe different windows: a prune
-	// between the two requests moved what the same span can be answered for.
-	expect(sameWindow(base, { ...base, availableSince: SINCE + 60 })).toBe(false);
-});
-
-test("the newer until wins, and for equal bounds the later watermark does", () => {
-	const base = { period: "24h" as const, since: SINCE, until: UNTIL, availableSince: SINCE };
-	expect(newerWindow(base, { ...base, until: UNTIL + 60 }).until).toBe(UNTIL + 60);
-	expect(newerWindow({ ...base, until: UNTIL + 60 }, base).until).toBe(UNTIL + 60);
-	expect(newerWindow(base, { ...base, availableSince: SINCE + 60 }).availableSince).toBe(SINCE + 60);
-	// A newer watermark does not outrank an older window's later bound.
-	expect(newerWindow({ ...base, until: UNTIL + 60 }, { ...base, availableSince: SINCE + 60 }).until).toBe(UNTIL + 60);
-});
-
-test("windowIdOf reads the four fields off any of the five bodies", () => {
-	expect(windowIdOf({ period: "7d", since: 1, until: 2, coverage: { complete: false, available_since: 3 } })).toEqual(
-		{
-			period: "7d",
-			since: 1,
-			until: 2,
-			availableSince: 3,
-		},
-	);
-});
-
-test("five responses for one window render as five ready panels", async () => {
+test("the page is loading until the body for the selected period arrives", async () => {
 	renderProbe();
-	await waitFor(() => expect(line("totals")).toContain("ready"));
-	for (const endpoint of OVERVIEW_ENDPOINTS) {
-		expect(line(endpoint)).toBe(`${endpoint}:ready:24h@${UNTIL}/${SINCE}`);
-	}
+	expect(line()).toBe("loading:");
+	await waitFor(() => expect(line()).toBe(`ready:24h@${UNTIL}`));
 });
 
-test("one endpoint behind a bucket boundary is refetched once and then agrees", async () => {
-	// Behind on its first answer, caught up by the time the hook asks again.
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	catchUp.add("routes");
+test("a failed request is one error for the whole page, with a retry that refetches", async () => {
+	failing = true;
 	renderProbe();
 
-	await waitFor(() => expect(line("routes")).toContain("ready"));
-	expect(calls.routes).toBe(2);
-	expect(calls.totals).toBe(1);
-});
+	await waitFor(() => expect(line()).toBe("error:endpoint unavailable"));
+	const spent = calls;
 
-test("a laggard that stays behind fails its own panel and leaves the rest rendering", async () => {
-	bounds.types = { until: UNTIL - 3600, availableSince: SINCE };
-	renderProbe();
-
-	await waitFor(() => expect(line("types")).toContain("error"));
-	expect(line("types")).toContain("different window");
-	// One retry, not a loop.
-	expect(calls.types).toBe(2);
-	for (const endpoint of ["totals", "timeseries", "clients", "routes"] as const) {
-		expect(line(endpoint)).toContain("ready");
-	}
-});
-
-test("a failed request degrades its own panel; the charts keep the window", async () => {
-	failing.add("routes");
-	renderProbe();
-
-	await waitFor(() => expect(line("routes")).toContain("error"));
-	expect(line("routes")).toContain("endpoint unavailable");
-	expect(line("timeseries")).toContain("ready");
-	expect(line("totals")).toContain("ready");
-});
-
-test("a watermark that advanced mid-page is a mismatch, not a mixed window", async () => {
-	// Same bounds, later watermark: retention pruned between the two responses.
-	bounds.clients = { until: UNTIL, availableSince: SINCE + 600 };
-	renderProbe();
-
-	await waitFor(() => expect(line("clients")).toContain(`/${SINCE + 600}`));
-	// The page adopts the later watermark, so the four older answers are the
-	// laggards and each gets its one retry rather than rendering beside it.
-	await waitFor(() => expect(calls.totals).toBe(2));
-	expect(line("clients")).toContain("ready");
+	failing = false;
+	lastRetry();
+	await waitFor(() => expect(line()).toBe(`ready:24h@${UNTIL}`));
+	expect(calls).toBeGreaterThan(spent);
 });
 
 test("a retained previous-period body never renders under the new period's label", async () => {
 	const { rerenderWith } = renderProbe("24h");
-	await waitFor(() => expect(line("totals")).toBe(`totals:ready:24h@${UNTIL}/${SINCE}`));
+	await waitFor(() => expect(line()).toBe(`ready:24h@${UNTIL}`));
 
 	rerenderWith("1h");
-	// Whatever `keepPreviousData` is holding, no panel may claim it answers 1h.
-	await waitFor(() => expect(line("totals")).toBe(`totals:ready:1h@${UNTIL}/${SINCE}`));
-	for (const endpoint of OVERVIEW_ENDPOINTS) expect(line(endpoint)).toContain("1h@");
-});
-
-test("a period change buys the new window its own retry", async () => {
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	const { rerenderWith } = renderProbe("24h");
-	await waitFor(() => expect(line("routes")).toContain("error"));
-	const spent = calls.routes;
-
-	rerenderWith("1h");
-	// The mismatch persists under the new period, and the episode key changed
-	// with it: the retry the abandoned period spent is not the new one's.
-	await waitFor(() => expect(calls.routes).toBeGreaterThan(spent));
-	await waitFor(() => expect(line("routes")).toContain("error"));
-});
-
-test("a retry in flight when the period changes cannot spend the window's retry later", async () => {
-	// The stale completion the tokens exist to orphan: routes lags under 24h, the
-	// hook issues its one retry, and the reader picks 1h before that retry lands.
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	let release = () => {};
-	hold = { promise: new Promise<void>((resolve) => (release = resolve)), release: () => release() };
-
-	const { rerenderWith } = renderProbe("24h");
-	await waitFor(() => expect(calls.routes).toBe(2));
-
-	bounds.routes = { until: UNTIL, availableSince: SINCE };
-	rerenderWith("1h");
-	await waitFor(() => expect(line("routes")).toContain("1h@"));
-
-	// The abandoned retry lands now, under a period it was never asked for.
-	hold.release();
-	hold = null;
-	await waitFor(() => expect(line("routes")).toContain("ready"));
-
-	// Back to the window it was issued for, still lagging. The stale completion
-	// must not have marked this episode spent: the panel gets a real retry before
-	// it is allowed to reach the terminal error.
-	bounds.routes = { until: UNTIL - 3600, availableSince: SINCE };
-	rerenderWith("24h");
-
-	// The cached lagging body is there to render immediately, and the panel must
-	// not state the terminal error off it: that error means "retried and still
-	// behind", and this visit has not retried anything yet. An abandoned
-	// completion recording the episode as spent is what would produce it here.
-	expect(line("routes")).toContain("loading");
-	await waitFor(() => expect(line("routes")).toContain("different window"));
+	// `keepPreviousData` is holding the 24h body. It is a complete answer and
+	// still the wrong one to draw under "1h", so the page waits.
+	expect(line()).toBe("loading:");
+	await waitFor(() => expect(line()).toBe(`ready:1h@${UNTIL}`));
 });

admin/src/features/overview/overviewWindow.ts

@@ -1,249 +1,34 @@
 /**
- * One period, five requests, one window.
+ * One period, one request, one window.
  *
- * Totals, the timeline, the per-client series and the two breakdowns are
- * separate calls, so a refresh that straddles a bucket boundary — or a retention
- * pass that advances the watermark mid-page — can answer them for different
- * windows. Rendering them side by side anyway would put a headline count above
- * charts of a different span, a mixed page that looks exactly like a real one.
+ * The five per-panel endpoints this replaces could each answer for a different
+ * span, so the page had to reconcile five window identities, retry the laggards
+ * and fail the ones that stayed behind. `GET /api/overview` answers every panel
+ * out of a single read transaction: the totals, both timelines and both
+ * breakdowns describe the same span and the same database state by construction,
+ * and none of that reconciliation has anything left to reconcile.
  *
- * This is **window** coherence, not data-snapshot coherence: matching bounds
- * cannot prove a common database state, and live inserts between requests may
- * still shift counts slightly between panels. What it does guarantee is that no
- * two panels ever describe different spans.
- *
- * Rendering is per panel. A panel whose request is still in flight shows its own
- * loading state and a panel whose request failed shows its own error, while the
- * panels that match the window keep rendering — a failed donut never blanks the
- * charts.
+ * What remains is the one rule a single request does not settle by itself.
+ * `keepPreviousData` holds the body of the period the reader just left — a
+ * complete, self-consistent answer, and still the wrong one to draw under the
+ * new label — so a body is a member of this window only while its own `period`
+ * is the selected one. Until then the page is loading.
  */
 
-import { useCallback, useEffect, useRef, useState } from "react";
-import { keepPreviousData, useQuery, type UseQueryResult } from "@tanstack/react-query";
-import { statsClientsQuery, statsQuery, statsRoutesQuery, statsTypesQuery, timeseriesQuery } from "@/lib/queries";
-import type {
-	Coverage,
-	Period,
-	StatsClients,
-	StatsRoutes,
-	StatsTimeseries,
-	StatsTotals,
-	StatsTypes,
-} from "@/lib/types";
-
-export const OVERVIEW_ENDPOINTS = ["totals", "timeseries", "clients", "types", "routes"] as const;
-export type OverviewEndpoint = (typeof OVERVIEW_ENDPOINTS)[number];
-
-interface EndpointBodies {
-	totals: StatsTotals;
-	timeseries: StatsTimeseries;
-	clients: StatsClients;
-	types: StatsTypes;
-	routes: StatsRoutes;
-}
-
-/**
- * What makes two responses the same window. `available_since` joins the bounds
- * because retention advancing between requests changes what the same `[since,
- * until)` can answer for, and mixing a pre-prune answer with a post-prune one is
- * the failure the bounds alone would not catch.
- */
-export interface WindowId {
-	period: Period;
-	since: number;
-	until: number;
-	availableSince: number;
-}
-
-/** The four fields every window-bounded stats body carries. */
-interface Bounded {
-	period: Period;
-	since: number;
-	until: number;
-	coverage: Coverage;
-}
-
-export function windowIdOf(body: Bounded): WindowId {
-	return {
-		period: body.period,
-		since: body.since,
-		until: body.until,
-		availableSince: body.coverage.available_since,
-	};
-}
-
-export function sameWindow(a: WindowId, b: WindowId): boolean {
-	return a.period === b.period && a.since === b.since && a.until === b.until && a.availableSince === b.availableSince;
-}
-
-/**
- * Which of two candidate windows the page adopts: the one that reaches further
- * forward in time, and for identical bounds the one that admits the later
- * watermark. Both rules pick the answer a laggard has to catch up to.
- */
-export function newerWindow(a: WindowId, b: WindowId): WindowId {
-	if (b.until !== a.until) return b.until > a.until ? b : a;
-	return b.availableSince > a.availableSince ? b : a;
-}
-
-function keyOf(id: WindowId): string {
-	return `${id.period}|${id.since}|${id.until}|${id.availableSince}`;
-}
+import { useCallback } from "react";
+import { keepPreviousData, useQuery } from "@tanstack/react-query";
+import { overviewQuery } from "@/lib/queries";
+import type { Overview, Period } from "@/lib/types";
 
 export type Panel<T> =
 	{ status: "loading" } | { status: "error"; error: unknown; retry: () => void } | { status: "ready"; data: T };
 
-export interface OverviewWindow {
-	/** Null until one response for the selected period has arrived. */
-	window: WindowId | null;
-	/** The adopted window's watermark, for the page's single coverage notice. */
-	coverage: Coverage | null;
-	totals: Panel<StatsTotals>;
-	timeseries: Panel<StatsTimeseries>;
-	clients: Panel<StatsClients>;
-	types: Panel<StatsTypes>;
-	routes: Panel<StatsRoutes>;
-}
-
-/**
- * A laggard that stayed behind after its one retry. Not an `ApiError`: nothing
- * failed, the endpoint simply never caught up, and `InlineError` renders the
- * message verbatim.
- */
-export const MISMATCH = new Error("This panel is for a different window than the rest of the page. Try again.");
-
-export function useOverviewWindow(period: Period): OverviewWindow {
-	const queries: { [K in OverviewEndpoint]: UseQueryResult<EndpointBodies[K]> } = {
-		totals: useQuery({ ...statsQuery(period), placeholderData: keepPreviousData }),
-		timeseries: useQuery({ ...timeseriesQuery(period), placeholderData: keepPreviousData }),
-		clients: useQuery({ ...statsClientsQuery(period), placeholderData: keepPreviousData }),
-		types: useQuery({ ...statsTypesQuery(period), placeholderData: keepPreviousData }),
-		routes: useQuery({ ...statsRoutesQuery(period), placeholderData: keepPreviousData }),
-	};
-
-	// A `keepPreviousData` placeholder for the period just left is a complete,
-	// self-consistent body — and still the wrong one to show under the new label,
-	// so it is neither a candidate for the window nor a member of it.
-	const answers = new Map<OverviewEndpoint, WindowId>();
-	for (const endpoint of OVERVIEW_ENDPOINTS) {
-		const data = queries[endpoint].data;
-		if (data !== undefined && data.period === period) answers.set(endpoint, windowIdOf(data));
-	}
-
-	let window: WindowId | null = null;
-	for (const id of answers.values()) window = window === null ? id : newerWindow(window, id);
-
-	// The effect below runs on what the responses say, not on how many times they
-	// arrived: a poll that returns byte-identical data must not restart the retry
-	// bookkeeping. The refetchers ride a ref for the same reason — TanStack hands
-	// back a fresh function identity on some renders, and depending on it would
-	// re-enter the effect with nothing changed.
-	const answersKey = OVERVIEW_ENDPOINTS.map((endpoint) => {
-		const id = answers.get(endpoint);
-		return id === undefined ? "" : keyOf(id);
-	}).join("~");
-	const latest = useRef({ answers, refetch: queries });
-	latest.current = { answers, refetch: queries };
-
-	// Which mismatch episode each endpoint has already spent its retry on, keyed
-	// by endpoint and window identity so a new window buys a new attempt.
-	const retriedFor = useRef(new Map<OverviewEndpoint, string>());
-	// Which retry each endpoint is waiting on. Per endpoint, because one shared
-	// counter would let a second endpoint's retry silence the first's completion;
-	// bumped on every retry issued, so a completion from a window or a period the
-	// page has left can neither clear an error the current one reached nor spend
-	// the current window's one retry.
-	const tokens = useRef(new Map<OverviewEndpoint, number>());
-	// State, not a ref: a retry that returns byte-identical data changes nothing
-	// else a render could see, and the panel still has to reach its error.
-	const [landedFor, setLandedFor] = useState(new Map<OverviewEndpoint, string>());
-
-	// Leaving a period ends every episode it opened. A retry issued for the old
-	// period can still be in flight, and without this its completion would land
-	// under the new one holding a token the map still honours: it would record an
-	// episode as spent, so a return to that window would reach the terminal error
-	// without the retry that error is supposed to follow. Bumping the tokens
-	// orphans those answers, and the cleared maps let the new window start clean.
-	const [lastPeriod, setLastPeriod] = useState(period);
-	if (lastPeriod !== period) {
-		setLastPeriod(period);
-		for (const endpoint of OVERVIEW_ENDPOINTS) {
-			tokens.current.set(endpoint, (tokens.current.get(endpoint) ?? 0) + 1);
-		}
-		retriedFor.current.clear();
-		setLandedFor(new Map());
-	}
-
-	const windowKey = window === null ? null : keyOf(window);
-
-	useEffect(() => {
-		if (windowKey === null) return;
-		for (const [endpoint, identity] of latest.current.answers) {
-			if (keyOf(identity) === windowKey) {
-				retriedFor.current.delete(endpoint);
-				continue;
-			}
-			const episode = `${endpoint}|${windowKey}`;
-			if (retriedFor.current.get(endpoint) === episode) continue;
-			retriedFor.current.set(endpoint, episode);
-			const token = (tokens.current.get(endpoint) ?? 0) + 1;
-			tokens.current.set(endpoint, token);
-			const landed = () => {
-				if (tokens.current.get(endpoint) !== token) return;
-				setLandedFor((previous) => new Map(previous).set(endpoint, episode));
-			};
-			void latest.current.refetch[endpoint].refetch().then(landed, landed);
-		}
-	}, [answersKey, windowKey]);
-
-	const retry = useCallback((endpoint: OverviewEndpoint) => {
-		retriedFor.current.delete(endpoint);
-		tokens.current.set(endpoint, (tokens.current.get(endpoint) ?? 0) + 1);
-		setLandedFor((previous) => {
-			const next = new Map(previous);
-			next.delete(endpoint);
-			return next;
-		});
-		void latest.current.refetch[endpoint].refetch();
-	}, []);
-
-	function panelOf<K extends OverviewEndpoint>(endpoint: K): Panel<EndpointBodies[K]> {
-		const query = queries[endpoint];
-		const onRetry = () => retry(endpoint);
-		if (query.isError) return { status: "error", error: query.error, retry: onRetry };
-		const data = query.data;
-		if (
-			data !== undefined &&
-			windowKey !== null &&
-			data.period === period &&
-			keyOf(windowIdOf(data)) === windowKey
-		) {
-			return { status: "ready", data };
-		}
-		if (windowKey !== null && landedFor.get(endpoint) === `${endpoint}|${windowKey}`) {
-			return { status: "error", error: MISMATCH, retry: onRetry };
-		}
-		return { status: "loading" };
-	}
-
-	const panels = {
-		totals: panelOf("totals"),
-		timeseries: panelOf("timeseries"),
-		clients: panelOf("clients"),
-		types: panelOf("types"),
-		routes: panelOf("routes"),
-	};
-
-	// The notice describes the window, so any member of it can supply the
-	// watermark: whichever panel arrived says the same thing about coverage.
-	let coverage: Coverage | null = null;
-	for (const endpoint of OVERVIEW_ENDPOINTS) {
-		const panel = panels[endpoint];
-		if (panel.status === "ready") {
-			coverage = panel.data.coverage;
-			break;
-		}
-	}
-
-	return { window, coverage, ...panels };
+export function useOverviewWindow(period: Period): Panel<Overview> {
+	const query = useQuery({ ...overviewQuery(period), placeholderData: keepPreviousData });
+	const { refetch } = query;
+	const retry = useCallback(() => void refetch(), [refetch]);
+
+	if (query.isError) return { status: "error", error: query.error, retry };
+	if (query.data !== undefined && query.data.period === period) return { status: "ready", data: query.data };
+	return { status: "loading" };
 }

admin/src/lib/api.test.ts

@@ -1,4 +1,4 @@
-import { ApiError, deleteGroup, getQueries, getStats, listGroups, login, putGroupSources } from "@/lib/api";
+import { ApiError, deleteGroup, getOverview, getQueries, listGroups, login, putGroupSources } from "@/lib/api";
 
 function jsonResponse(payload: unknown, status = 200, headers: Record<string, string> = {}): Response {
 	return new Response(JSON.stringify(payload), {
@@ -50,7 +50,7 @@ test("falls back to a status message on a non-JSON error body", async () => {
 
 test("parses Retry-After on 429", async () => {
 	fetchMock.mockResolvedValue(jsonResponse({ error: "rate limited" }, 429, { "Retry-After": "17" }));
-	const failure = await getStats("1h").catch((e: unknown) => e);
+	const failure = await getOverview("1h").catch((e: unknown) => e);
 	expect(failure).toBeInstanceOf(ApiError);
 	expect((failure as ApiError).status).toBe(429);
 	expect((failure as ApiError).retryAfter).toBe(17);
@@ -58,7 +58,7 @@ test("parses Retry-After on 429", async () => {
 
 test("ignores a malformed Retry-After header", async () => {
 	fetchMock.mockResolvedValue(jsonResponse({ error: "rate limited" }, 429, { "Retry-After": "soon" }));
-	const failure = await getStats().catch((e: unknown) => e);
+	const failure = await getOverview().catch((e: unknown) => e);
 	expect((failure as ApiError).retryAfter).toBeUndefined();
 });
 

admin/src/lib/api.ts

@@ -23,6 +23,7 @@ import type {
 	LoginResponse,
 	LogoutResponse,
 	LookupResult,
+	Overview,
 	PausePost,
 	PauseState,
 	Period,
@@ -35,11 +36,6 @@ import type {
 	SettingsEnvelope,
 	SettingsPatch,
 	SourceStatus,
-	StatsClients,
-	StatsRoutes,
-	StatsTimeseries,
-	StatsTotals,
-	StatsTypes,
 	Upstream,
 	UpstreamEcho,
 	UpstreamInput,
@@ -112,7 +108,7 @@ export const login = (body: LoginRequest): Promise<LoginResponse> =>
 	request("/api/auth/login", { method: "POST", body });
 export const logout = (): Promise<LogoutResponse> => request("/api/auth/logout", { method: "POST", body: {} });
 
-// Query log + stats
+// Query log + overview
 
 export const getQueries = (filter: QueriesFilter = {}): Promise<QueriesPage> =>
 	request(`/api/queries${qs({ ...filter })}`);
@@ -123,13 +119,8 @@ export const getQueryDetail = (id: number): Promise<QueryDetail> => request(`/ap
 /** `EventSource` URL for the live stream; not a fetch route. */
 export const liveQueriesUrl = "/api/queries/live";
 
-export const getStats = (period?: Period): Promise<StatsTotals> => request(`/api/stats${qs({ period })}`);
-export const getStatsTimeseries = (period?: Period): Promise<StatsTimeseries> =>
-	request(`/api/stats/timeseries${qs({ period })}`);
-export const getStatsTypes = (period?: Period): Promise<StatsTypes> => request(`/api/stats/types${qs({ period })}`);
-export const getStatsRoutes = (period?: Period): Promise<StatsRoutes> => request(`/api/stats/routes${qs({ period })}`);
-export const getStatsClients = (period?: Period): Promise<StatsClients> =>
-	request(`/api/stats/clients${qs({ period })}`);
+/** Every Overview panel for one window, from one read transaction. */
+export const getOverview = (period?: Period): Promise<Overview> => request(`/api/overview${qs({ period })}`);
 
 export const getLookup = (domain: string, groupId?: number): Promise<LookupResult> =>
 	request(`/api/lookup${qs({ domain, group_id: groupId })}`);

admin/src/lib/contractSamples.gen.ts

@@ -29,6 +29,7 @@ import type {
 	LoginResponse,
 	LogoutResponse,
 	LookupResult,
+	Overview,
 	PauseState,
 	QueriesPage,
 	QueryDetail,
@@ -36,11 +37,6 @@ import type {
 	RuleEcho,
 	SettingsEnvelope,
 	SourceStatus,
-	StatsClients,
-	StatsRoutes,
-	StatsTimeseries,
-	StatsTotals,
-	StatsTypes,
 	Upstream,
 	UpstreamEcho,
 	Version,
@@ -588,39 +584,6 @@ export const sample_get_query_detail: QueryDetail = {
 	},
 };
 
-export const sample_get_stats: StatsTotals = {
-	avg_response_time_us: null,
-	blocked: 0,
-	clients: 0,
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	period: "1h",
-	queries: 0,
-	since: 0,
-	until: 0,
-};
-
-export const sample_get_stats_timeseries: StatsTimeseries = {
-	bucket_seconds: 0,
-	buckets: [
-		{
-			blocked: 0,
-			cached: 0,
-			queries: 0,
-			ts: 0,
-		},
-	],
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	period: "1h",
-	since: 0,
-	until: 0,
-};
-
 export const sample_get_pause: PauseState = {
 	paused: false,
 	until: null,
@@ -837,31 +800,35 @@ export const sample_error_not_found: ErrorEnvelope = {
 	error: "not found",
 };
 
-export const sample_get_stats_types: StatsTypes = {
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	period: "1h",
-	since: 0,
-	types: [
+export const sample_get_overview: Overview = {
+	bucket_seconds: 0,
+	buckets: [
 		{
-			count: 0,
-			qtype: 0,
+			blocked: 0,
+			cached: 0,
+			queries: 0,
+			ts: 0,
 		},
+	],
+	clients: [
 		{
-			count: 0,
-			qtype: null,
+			buckets: [0],
+			client: "192.0.2.30",
+		},
+		{
+			buckets: [0],
+			client: "192.0.2.31",
+		},
+		{
+			buckets: [0],
+			client: "192.0.2.32",
 		},
 	],
-	until: 0,
-};
-
-export const sample_get_stats_routes: StatsRoutes = {
 	coverage: {
 		available_since: 0,
 		complete: true,
 	},
+	other: [0],
 	period: "1h",
 	routes: [
 		{
@@ -906,32 +873,22 @@ export const sample_get_stats_routes: StatsRoutes = {
 		},
 	],
 	since: 0,
-	until: 0,
-};
-
-export const sample_get_stats_clients: StatsClients = {
-	bucket_seconds: 0,
-	clients: [
+	totals: {
+		avg_response_time_us: 0,
+		blocked: 0,
+		clients: 0,
+		queries: 0,
+	},
+	types: [
 		{
-			buckets: [0],
-			client: "192.0.2.30",
+			count: 0,
+			qtype: 0,
 		},
 		{
-			buckets: [0],
-			client: "192.0.2.31",
-		},
-		{
-			buckets: [0],
-			client: "192.0.2.32",
+			count: 0,
+			qtype: null,
 		},
 	],
-	coverage: {
-		available_since: 0,
-		complete: true,
-	},
-	other: [0],
-	period: "1h",
-	since: 0,
 	until: 0,
 };
 

admin/src/lib/queries.ts

@@ -21,11 +21,7 @@ import type {
 export const queryKeys = {
 	health: ["health"] as const,
 	version: ["version"] as const,
-	stats: (period: Period) => ["stats", period] as const,
-	timeseries: (period: Period) => ["stats", "timeseries", period] as const,
-	statsTypes: (period: Period) => ["stats", "types", period] as const,
-	statsRoutes: (period: Period) => ["stats", "routes", period] as const,
-	statsClients: (period: Period) => ["stats", "clients", period] as const,
+	overview: (period: Period) => ["overview", period] as const,
 	queriesInfinite: (filter: QueriesFilter) => ["queries", "infinite", filter] as const,
 	queryDetail: (id: number) => ["queries", "detail", id] as const,
 	diagnosticsInfinite: (filter: DiagnosticsFilter) => ["diagnostics", "infinite", filter] as const,
@@ -54,34 +50,10 @@ export const healthQuery = () =>
 export const versionQuery = () =>
 	queryOptions({ queryKey: queryKeys.version, queryFn: api.getVersion, staleTime: Infinity });
 
-export const statsQuery = (period: Period = "24h") =>
-	queryOptions({ queryKey: queryKeys.stats(period), queryFn: () => api.getStats(period), refetchInterval: 30_000 });
-
-export const timeseriesQuery = (period: Period = "24h") =>
+export const overviewQuery = (period: Period = "24h") =>
 	queryOptions({
-		queryKey: queryKeys.timeseries(period),
-		queryFn: () => api.getStatsTimeseries(period),
-		refetchInterval: 30_000,
-	});
-
-export const statsTypesQuery = (period: Period = "24h") =>
-	queryOptions({
-		queryKey: queryKeys.statsTypes(period),
-		queryFn: () => api.getStatsTypes(period),
-		refetchInterval: 30_000,
-	});
-
-export const statsRoutesQuery = (period: Period = "24h") =>
-	queryOptions({
-		queryKey: queryKeys.statsRoutes(period),
-		queryFn: () => api.getStatsRoutes(period),
-		refetchInterval: 30_000,
-	});
-
-export const statsClientsQuery = (period: Period = "24h") =>
-	queryOptions({
-		queryKey: queryKeys.statsClients(period),
-		queryFn: () => api.getStatsClients(period),
+		queryKey: queryKeys.overview(period),
+		queryFn: () => api.getOverview(period),
 		refetchInterval: 30_000,
 	});
 

admin/src/lib/types.ts

@@ -291,15 +291,13 @@ export interface DiagnosticsFilter {
 	before?: number;
 }
 
-export interface StatsTotals {
-	period: Period;
-	since: number;
-	until: number;
+/** The window's four headline numbers. */
+export interface OverviewTotals {
 	queries: number;
 	blocked: number;
+	/** Distinct clients seen in the window, not a sum of per-bucket counts. */
 	clients: number;
 	avg_response_time_us: number | null;
-	coverage: Coverage;
 }
 
 export interface Bucket {
@@ -309,67 +307,53 @@ export interface Bucket {
 	cached: number;
 }
 
-export interface StatsTimeseries {
-	period: Period;
-	since: number;
-	until: number;
-	bucket_seconds: number;
-	buckets: Bucket[];
-	coverage: Coverage;
-}
-
 /**
  * One DNS type's share of the window. `qtype` is the numeric code as logged:
  * naming it is the admin's job (`features/provenance/qtype.ts`), and a row whose
  * type was never recorded keeps its own `null` group rather than disappearing.
  */
-export interface StatsTypeRow {
+export interface OverviewTypeRow {
 	qtype: number | null;
 	count: number;
 }
 
-export interface StatsTypes {
-	period: Period;
-	since: number;
-	until: number;
-	types: StatsTypeRow[];
-	coverage: Coverage;
-}
-
 /**
  * How the window's queries were answered. `source` names the answering upstream
  * on `upstream` rows and the zone on `forward_zone` rows; every other route kind
  * carries null, as does a row whose identity was not recorded.
  */
-export interface StatsRouteRow {
+export interface OverviewRouteRow {
 	route: RouteKind;
 	source: string | null;
 	count: number;
 }
 
-export interface StatsRoutes {
-	period: Period;
-	since: number;
-	until: number;
-	routes: StatsRouteRow[];
-	coverage: Coverage;
-}
-
-/** One client's per-bucket counts, aligned to `StatsTimeseries`'s buckets. */
-export interface StatsClientSeries {
+/** One client's per-bucket counts, aligned to `Overview.buckets`. */
+export interface OverviewClientSeries {
 	client: string;
 	buckets: number[];
 }
 
-export interface StatsClients {
+/**
+ * Everything the Overview page draws, for one window, from one request. The
+ * server answers all six panels out of a single read transaction, so the
+ * headline totals, the two timelines and the two breakdowns are guaranteed to
+ * describe the same span *and* the same database state — a coherence the five
+ * endpoints this replaces could not offer.
+ */
+export interface Overview {
 	period: Period;
 	since: number;
 	until: number;
 	bucket_seconds: number;
+	totals: OverviewTotals;
+	buckets: Bucket[];
 	/** The eight busiest clients in the window, ranked by total count. */
-	clients: StatsClientSeries[];
+	clients: OverviewClientSeries[];
 	/** Everything outside the top eight. Always present and always bucket-count-sized. */
 	other: number[];
+	types: OverviewTypeRow[];
+	routes: OverviewRouteRow[];
 	coverage: Coverage;
 }
 

admin/src/routes.tsx

@@ -32,18 +32,15 @@ import {
 	groupsQuery,
 	healthQuery,
 	localRecordsQuery,
+	overviewQuery,
 	queriesInfiniteQuery,
 	queryDetailQuery,
 	rulesQuery,
 	settingsQuery,
-	statsClientsQuery,
-	statsQuery,
-	statsRoutesQuery,
-	statsTypesQuery,
-	timeseriesQuery,
 	upstreamsQuery,
 } from "@/lib/queries";
 import { DEFAULT_PERIOD, parsePeriod } from "@/features/overview/period";
+import { OverviewPending } from "@/features/overview/OverviewFrame";
 import {
 	validateGroupId,
 	validateProtectionSearch,
@@ -168,26 +165,28 @@ const overviewRoute = createRoute({
 	}),
 	loaderDeps: ({ search }): { period: Period } => ({ period: search.period ?? DEFAULT_PERIOD }),
 	/**
-	 * Started here, awaited nowhere. Every panel reads these with `useQuery` and
-	 * owns its own loading and error surface, so awaiting would trade that whole
-	 * contract for one blocking navigation: the page would sit on the slowest of
-	 * five requests and then appear complete, instead of the four that answered
-	 * rendering beside the one still in flight. The rejections are caught only to
-	 * keep them from going unhandled; the panels state them.
+	 * Started here, awaited nowhere. The page reads these with `useQuery` and owns
+	 * its own loading and error surface, so awaiting would trade that contract for
+	 * one blocking navigation: nothing at all until the request answered, rather
+	 * than the heading and the period picker while it is in flight. The rejections
+	 * are caught only to keep them from going unhandled; the page states them.
 	 */
 	loader: ({ context, deps }) => {
 		const start = (promise: Promise<unknown>) => void promise.catch(() => {});
 		start(context.queryClient.ensureQueryData(healthQuery()));
-		start(context.queryClient.ensureQueryData(statsQuery(deps.period)));
-		start(context.queryClient.ensureQueryData(timeseriesQuery(deps.period)));
-		start(context.queryClient.ensureQueryData(statsClientsQuery(deps.period)));
+		start(context.queryClient.ensureQueryData(overviewQuery(deps.period)));
 		// The registered names the client chart labels its series with. Started here
 		// so the lookup is not a second round trip after the page chunk lands.
 		start(context.queryClient.ensureQueryData(clientsQuery()));
-		start(context.queryClient.ensureQueryData(statsTypesQuery(deps.period)));
-		start(context.queryClient.ensureQueryData(statsRoutesQuery(deps.period)));
 	},
 	component: lazyRouteComponent(() => import("@/features/overview/OverviewPage")),
+	/**
+	 * The page's own loading surface, rendered while its chunk is still in flight.
+	 * The default pending component would put a second, differently-placed
+	 * "Loading…" before it, which reads as a stutter rather than one wait.
+	 * `OverviewFrame` is a separate module so this import leaves the charts lazy.
+	 */
+	pendingComponent: OverviewPending,
 });
 
 /**

admin/src/shell/AppShell.test.tsx

@@ -19,44 +19,16 @@ const RECONCILED_AT = 1754899200;
 const DATABASE: ConfigStatus = { authority: "database", path: null, reconciled_at: null, restart_pending: false };
 
 const RESPONSES: Record<string, unknown> = {
-	"/api/stats?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
-		queries: 0,
-		blocked: 0,
-		clients: 0,
-		avg_response_time_us: null,
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/timeseries?period=24h": {
+	"/api/overview?period=24h": {
 		period: "24h",
 		since: 0,
 		until: 86400,
 		bucket_seconds: 1800,
+		totals: { queries: 0, blocked: 0, clients: 0, avg_response_time_us: null },
 		buckets: [],
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/clients?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
-		bucket_seconds: 1800,
 		clients: [],
 		other: [],
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/types?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
 		types: [],
-		coverage: { complete: true, available_since: 0 },
-	},
-	"/api/stats/routes?period=24h": {
-		period: "24h",
-		since: 0,
-		until: 86400,
 		routes: [],
 		coverage: { complete: true, available_since: 0 },
 	},

build.zig.zon

@@ -1,6 +1,6 @@
 .{
     .name = .nxdns,
-    .version = "0.0.10",
+    .version = "0.0.13",
     .minimum_zig_version = "0.16.0",
     .paths = .{""},
     .fingerprint = 0x3307b311dded1d91,

docs/how-to/set-up-admin-authentication.md

@@ -62,7 +62,7 @@ Which of steps 4 and 5 applies to your server depends on its authority. Under `n
 Login is `POST /api/auth/login` with a JSON body. Without a session, the API answers 401:
 
 ```sh
-curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8451/api/stats
+curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8451/api/overview
 ```
 
 ```
@@ -92,7 +92,7 @@ The cookie is named `nxdns_session` and carries `HttpOnly; SameSite=Lax; Path=/`
 
 ```sh
 curl -sS -b /tmp/nxdns-lab/cookies.txt -o /dev/null -w '%{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+  http://127.0.0.1:8451/api/overview
 ```
 
 ```
@@ -125,13 +125,13 @@ Sessions live in memory only. A restart logs everyone out. Thirty-two concurrent
 ```sh
 curl -sS -b /tmp/nxdns-lab/cookies.txt -c /tmp/nxdns-lab/cookies.txt \
   -X POST http://127.0.0.1:8451/api/auth/logout
-curl -sS -b /tmp/nxdns-lab/cookies.txt -o /dev/null -w 'stats: %{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+curl -sS -b /tmp/nxdns-lab/cookies.txt -o /dev/null -w 'overview: %{http_code}\n' \
+  http://127.0.0.1:8451/api/overview
 ```
 
 ```
 {"authenticated":false}
-stats: 401
+overview: 401
 ```
 
 Logging out with a stale cookie, or with none, answers the same way. The point of logging out is to end up logged out, and that is where such a request already is.
@@ -154,7 +154,7 @@ Changing the password ends every session, including the one that made the change
 
 ```sh
 curl -sS -b /tmp/nxdns-lab/c2.txt -o /dev/null -w 'old session: %{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+  http://127.0.0.1:8451/api/overview
 curl -sS -X POST http://127.0.0.1:8451/api/auth/login \
   -H 'content-type: application/json' -d '{"password":"lab-password"}' \
   -w ' (old password)\n'
@@ -217,14 +217,14 @@ curl -sS -X POST http://127.0.0.1:8451/api/auth/login \
 curl -sS -c /tmp/nxdns-lab/c5.txt -X POST http://127.0.0.1:8451/api/auth/login \
   -H 'content-type: application/json' -d '{"password":"offline-password"}' \
   -w ' (new password, http %{http_code})\n'
-curl -sS -b /tmp/nxdns-lab/c5.txt -o /dev/null -w 'stats: %{http_code}\n' \
-  http://127.0.0.1:8451/api/stats
+curl -sS -b /tmp/nxdns-lab/c5.txt -o /dev/null -w 'overview: %{http_code}\n' \
+  http://127.0.0.1:8451/api/overview
 ```
 
 ```
 {"error":"invalid password"} (old password, http 401)
 {"authenticated":true,"auth_required":true} (new password, http 200)
-stats: 200
+overview: 200
 ```
 
 The next export shows the new hash and a null `password` again:
@@ -245,7 +245,7 @@ See [back up and restore](back-up-and-restore.md) for when `import` does need `-
 Authentication is off. Every route is open, and a login attempt succeeds without minting anything — there is nothing to log in to, and a session that authorises nothing would be a lie for the browser to store:
 
 ```sh
-curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8453/api/stats
+curl -sS -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8453/api/overview
 curl -sS -X POST http://127.0.0.1:8453/api/auth/login \
   -H 'content-type: application/json' -d '{"password":"anything"}'
 ```

docs/how-to/troubleshoot.md

@@ -267,11 +267,11 @@ cat /etc/resolv.conf
 curl -s http://127.0.0.1:8080/metrics | grep nxdns_upstream_
 ```
 
-`nxdns_upstream_in_flight` against `nxdns_upstream_slots` is how much of an upstream's concurrency is in use right now, and `nxdns_upstream_queued_total` counts exchanges that had to wait for a slot (with `nxdns_upstream_queued_seconds_total` for how long they waited in total). Both queue counters are approximate — they are sampled when a query is admitted, not measured as a queue length. A `queued_total` climbing with each burst means queries are waiting on the upstream rather than failing at it, and a query that waits past `upstream.total_timeout_ms` is canceled in the queue and answered SERVFAIL.
+`nxdns_upstream_in_flight` against `nxdns_upstream_slots` is how much of an upstream's concurrency is in use right now, and `nxdns_upstream_queued_total` counts exchanges that had to wait for a slot (with `nxdns_upstream_queued_seconds_total` for how long they waited in total). Both queue counters are approximate — they are sampled when a query is admitted, not measured as a queue length. A `queued_total` climbing with each burst means queries are waiting on the upstream rather than failing at it, and a query that waits past `upstream.total_timeout_ms` is given up on in the queue and answered SERVFAIL. `nxdns_upstream_budget_exhausted_total` counts those give-ups pool-wide — queries whose own budget ran out, in the queue or mid-attempt, before any upstream answered. It carries no `url` label on purpose: running out of budget is a fact about the pool, so the exhausted attempt is never charged to an upstream's health and is never attributed in the query log, although the row can still name the last endpoint whose success or recorded failure preceded it.
 
 `nxdns_upstream_reuse_recoveries_total` is the other half of the picture: it counts DoT connections that went stale between exchanges and were redialed. A few are normal — a resolver is free to close an idle connection. One per query means the connection is never being reused, and every query is paying a full TLS handshake.
 
-**Fix.** Raise `upstream.total_timeout_ms` if the queue drains but drains too slowly for the budget. Otherwise the queue is telling you the upstream is slow: an upstream answering in a few milliseconds does not fill eight concurrent slots at household query rates, so sustained queueing points at the resolver you configured, and a faster one is the fix. Adding a second upstream is not: failover is strict priority, not load spreading — a query waits for a slot on the first available upstream and only reaches the next one when that upstream fails or is in backoff, so a second entry adds no concurrent capacity to the first. The per-upstream slot count is compiled, not configured, so there is no knob to widen one upstream either.
+**Fix.** Raise `upstream.total_timeout_ms` if the queue drains but drains too slowly for the budget. Otherwise the queue is telling you the upstream is slow: an upstream answering in a few milliseconds does not fill eight concurrent slots at household query rates, so sustained queueing points at the resolver you configured, and a faster one is the fix. Adding a second upstream helps only with saturation, not with latency: failover is strict priority, not load spreading. A query does take the next upstream when the first one's slots are all busy — priority orders the candidates that can be admitted right now — but once every eligible upstream is full it blocks on the highest-priority one, and it still sends one query to one upstream at a time. The per-upstream slot count is compiled, not configured, so there is no knob to widen one upstream either.
 
 ## The disk is filling up
 

docs/reference/api.md

@@ -109,11 +109,7 @@ Auth `open` means no session is required; `session` means a valid session cookie
 | GET | `/api/queries` | session | counted | read | Query log rows for the Activity page |
 | GET | `/api/queries/{id}` | session | counted | read | One query, fully explained |
 | GET | `/api/queries/live` | session | exempt | read | Live query stream (server-sent events) |
-| GET | `/api/stats` | session | counted | read | Totals for a period |
-| GET | `/api/stats/timeseries` | session | counted | read | Bucketed counts for a period |
-| GET | `/api/stats/types` | session | counted | read | Query-type breakdown for a period |
-| GET | `/api/stats/routes` | session | counted | read | How the period's queries were answered |
-| GET | `/api/stats/clients` | session | counted | read | Per-client bucketed counts for a period |
+| GET | `/api/overview` | session | counted | read | Everything the Overview page draws, for one period |
 | GET | `/api/lookup` | session | counted | read | Explain a domain |
 | GET | `/api/diagnostics` | session | counted | read | Operational event log |
 | DELETE | `/api/diagnostics` | session | counted | runtime action | Purge every resolved event |
@@ -221,6 +217,6 @@ A non-empty `rewrites.cname_target` on a query detail means the decision landed
 
 ### Coverage
 
-Every window-bounded read — `GET /api/queries` and the five `GET /api/stats*` endpoints — answers with a `coverage` object: `available_since` is the oldest instant the query log is still complete for, and `complete` is true only when the window the request asked about starts at or after it. Retention deletes rows and advances the watermark in one transaction, so a client can tell an empty window from a pruned one instead of charting the gap as zero. A request with no lower bound at all asks about the whole of history, and is never complete.
+Every window-bounded read — `GET /api/queries` and `GET /api/overview` — answers with a `coverage` object: `available_since` is the oldest instant the query log is still complete for, and `complete` is true only when the window the request asked about starts at or after it. Retention deletes rows and advances the watermark in one transaction, so a client can tell an empty window from a pruned one instead of charting the gap as zero. A request with no lower bound at all asks about the whole of history, and is never complete.
 
-Each of these responses reads its rows and its watermark inside one SQLite read transaction, so retention cannot prune between the two and hand back pre-prune rows tagged with a post-prune `available_since`. Coherence stops there: two separate requests are two separate reads, and queries logged between them can move the counts.
+Each of these responses reads its rows and its watermark inside one SQLite read transaction, so retention cannot prune between the two and hand back pre-prune rows tagged with a post-prune `available_since`. `GET /api/overview` puts every Overview panel inside that one transaction, so its totals and its four breakdowns describe one database state. Coherence stops there: two separate requests are two separate reads, and queries logged between them can move the counts.

docs/reference/configuration.md

@@ -37,12 +37,14 @@ Timeouts for talking to upstream resolvers.
 | Key | Type | Default | Unit | Validation | Consumed by |
 |---|---|---|---|---|---|
 | `upstream.attempt_timeout_ms` | u32 | 2500 | ms | 100–120000, and not above `total_timeout_ms` | deadline on one attempt against one upstream inside the pool's failover loop (`src/upstream/pool.zig`), the whole attempt including the connect |
-| `upstream.read_timeout_ms` | u32 | 3000 | ms | 100–120000 | read deadline on conditional-forward-zone exchanges (`src/local/forward_client.zig`) |
+| `upstream.read_timeout_ms` | u32 | 3000 | ms | 100–120000 | budget for a whole conditional-forward-zone exchange (`src/local/forward_client.zig`): the UDP attempt, a TC=1 fallback and the TCP retry together |
 | `upstream.total_timeout_ms` | u32 | 5000 | ms | 100–120000 | per-query budget of the upstream pool (`src/upstream/pool.zig`): every failover attempt together, not one of them; also the `nxdns check` probe deadline |
 
 The two pool budgets nest. `attempt_timeout_ms` bounds one try against one upstream; when it expires the pool records the failure and moves to the next candidate. `total_timeout_ms` bounds the whole loop, so a query against five unreachable upstreams costs the total budget once, not five attempt budgets in a row. When the total expires the in-flight attempt is canceled and the query fails with a timeout.
 
-`read_timeout_ms` is unrelated to both. It bounds a different subsystem — the conditional-forward-zone client — so no cross-check relates it to the pool's budgets, and it is free to sit above either of them.
+Budget semantics. The deadline is an instant, computed once when the query enters the pool, and every blocking step spends against it — waiting for a free slot on an upstream as much as the exchange itself. An attempt therefore runs against `min(now + attempt_timeout_ms, deadline)`, which near the end of the budget is *truncated*: shorter than the configured attempt. Attribution follows from that. A truncated attempt that expires is evidence about the budget, not about the upstream, so it leaves that upstream's health and success rate untouched and the query log's `upstream` field unchanged — the row may still name the endpoint of the preceding attributable attempt, and is null only when there was none — and it increments the pool-wide `nxdns_upstream_budget_exhausted_total` metric. An attempt that expires on its full budget, or that fails outright (a refused connection, a bad answer, the peer's own timeout), is evidence about the upstream: it is recorded against that upstream's health and names it in the query log. Either way the client is answered SERVFAIL. Forward-zone queries are not affected — they have one configured resolver, so a timeout there always names it.
+
+`read_timeout_ms` is unrelated to both pool budgets. It bounds a different subsystem — the conditional-forward-zone client — so no cross-check relates it to the pool's budgets, and it is free to sit above either of them. Within that subsystem it is one budget for the whole exchange: a query that goes out over UDP, comes back truncated and is retried over TCP has the two legs and the fallback share `read_timeout_ms`, never one each.
 
 ### dns
 
@@ -318,7 +320,7 @@ Zones resolved by a specific resolver instead of the configured upstreams, for L
 | `zone` | string | required | a valid domain name; unique |
 | `resolver` | string | required | `udp://IP:port` or `tcp://IP:port`; the host must be an IP literal and the port is mandatory |
 
-The resolver host must be an IP literal because resolving the resolver's own name would be a bootstrap problem. Matching is longest suffix (`src/local/forward_zones.zig`); the exchange is UDP then TCP (`src/local/forward_client.zig`) with `upstream.read_timeout_ms` as the read deadline.
+The resolver host must be an IP literal because resolving the resolver's own name would be a bootstrap problem. Matching is longest suffix (`src/local/forward_zones.zig`); the exchange is UDP then TCP (`src/local/forward_client.zig`), with `upstream.read_timeout_ms` bounding the whole exchange rather than each leg.
 
 Reverse zones are declared the same way, and one is the prerequisite for [learned client names](#learned-names):
 

specs/milestone-36.md

@@ -0,0 +1,417 @@
+# Milestone 36: Overview performance — combined endpoint, projections, cache
+
+Replace the five per-panel stats endpoints with one `GET /api/overview` served
+from materialized projections in `querylog.db` plus an in-memory response
+cache, so Overview cost stops growing with query-log size.
+
+## Motivation (measured)
+
+Today each Overview load runs five separate scans of every raw row in the
+window, serialized on `WebState.querylog_lock`, re-polled every 30 s. Measured
+x86 ReleaseSafe (bench at scratchpad `statsbench2/`, production-like skew;
+Pi ≈ 3–3.5× slower):
+
+| Rows | 30d, five scans (today) | 30d, one combined scan | 30d, projections |
+|-----:|------------------------:|-----------------------:|-----------------:|
+| 1M   | ~2.2 s                  | 264 ms                 | 41 ms            |
+| 3M   | ~6.6 s                  | 793 ms                 | 38 ms            |
+| 5M   | ~11.8 s                 | 1,346 ms               | 40 ms            |
+
+Projection maintenance costs +10% per 100-row insert batch, and ~1.5 MB of
+disk in the bench — a size bounded by retained buckets × distinct
+client/type/route keys, independent of raw query volume. Production is on a ~100k rows/day growth
+curve (≈3M rows at 30-day retention), so the projection path is the design
+target, not a contingency. Both computations were cross-checked for identical
+output in the bench.
+
+Design ruling (owner + Codex consultation, 2026-08-27): stay on SQLite;
+projections live in the same file as the raw rows and are updated in the same
+transaction, so SQLite's transaction is the coherence mechanism — no second
+file, no epoch protocol. The DDL change re-fingerprints `querylog.db`; the
+existing rename-aside path handles old files (one-time history reset,
+disclosed in the changelog). No backfill migration.
+
+## Sessions
+
+Four sessions. A first. B and C after A, in parallel (disjoint files). D after B.
+
+- A: storage — projection schema, writer maintenance, retention, new read path.
+  A does NOT delete the five existing aggregate functions — `stats.zig` still
+  calls them until B lands, and A must leave `zig build test` green.
+- B: web — `/api/overview` handler, response cache, removal of the five old
+  endpoints, OpenAPI/contract regeneration.
+- C: admin — one overview query, types, component/data plumbing, tests.
+- D: storage cleanup — delete the five now-unreferenced aggregate functions.
+
+---
+
+## Session A: storage
+
+### A.1 Schema (src/storage/querylog_schema.zig)
+
+Append four projection tables to `ddl`. Grain: 30-minute buckets, `bucket` =
+floor-to-grid of the row timestamp: `@divFloor(timestamp, 1800) * 1800` in Zig
+and the equivalent floor semantics in any SQL (SQLite integer `/` truncates
+toward zero, which differs on negative timestamps — use floor everywhere, as
+`window()` does). 1800 divides every serving
+width ≥ 30 min (1800, 3600, 21600), which is what makes one grain serve the
+24h, 7d and 30d windows exactly. The 1h window (60 s buckets) is NOT served
+from projections (A.4).
+
+```sql
+CREATE TABLE bucket_totals (
+    bucket INTEGER PRIMARY KEY,
+    queries INTEGER NOT NULL,
+    blocked INTEGER NOT NULL,
+    cached INTEGER NOT NULL,
+    rt_sum INTEGER NOT NULL,     -- sum(response_time_us) over timed rows
+    rt_count INTEGER NOT NULL    -- count(response_time_us)
+) WITHOUT ROWID;
+
+CREATE TABLE bucket_clients (
+    bucket INTEGER NOT NULL,
+    client_ip TEXT NOT NULL,
+    queries INTEGER NOT NULL,
+    PRIMARY KEY (bucket, client_ip)
+) WITHOUT ROWID;
+
+CREATE TABLE bucket_types (
+    bucket INTEGER NOT NULL,
+    qtype INTEGER NOT NULL,      -- -1 encodes a NULL qtype, losslessly
+    count INTEGER NOT NULL,
+    PRIMARY KEY (bucket, qtype)
+) WITHOUT ROWID;
+
+CREATE TABLE bucket_routes (
+    bucket INTEGER NOT NULL,
+    route_kind TEXT NOT NULL,
+    source_present INTEGER NOT NULL,  -- 0: source NULL; 1: source = source_text
+    source_text TEXT NOT NULL,        -- '' when source_present = 0
+    count INTEGER NOT NULL,
+    PRIMARY KEY (bucket, route_kind, source_present, source_text),
+    CHECK (source_present IN (0, 1)),
+    CHECK (source_present = 1 OR source_text = '')
+) WITHOUT ROWID;
+```
+
+Column semantics match the existing aggregates exactly: `blocked` counts
+`blocked <> 0`; `cached` counts `cache_hit = 1`; routes' `source` is the
+existing CASE (`upstream` rows → `upstream`, `forward_zone` rows →
+`forward_zone`, else NULL). The fingerprint moves automatically; do not touch
+the fingerprint machinery.
+
+### A.2 Writer maintenance (src/storage/repositories/queries_repo.zig)
+
+`BatchWriter.writeBatch` updates all four projections inside the same
+transaction that inserts the raw rows:
+
+- Aggregate the batch in Zig first, producing per-key deltas; then one UPSERT
+  per touched key:
+  `INSERT ... ON CONFLICT(...) DO UPDATE SET queries = queries + excluded.queries, ...`.
+  The aggregation must accept any slice length — `writeBatch`'s API does not
+  enforce the logger's 100-row batching, so no fixed-size arrays sized to it.
+  `BatchWriter` currently owns no allocator: `init` gains one, owned for the
+  writer's life, used only for the per-batch delta maps; scratch is freed (or
+  a retained map cleared) at the end of every `writeBatch`, and
+  `error.OutOfMemory` fails the batch before the transaction opens — no
+  hidden global allocator, no implicit size cap, no quadratic rescanning.
+- No per-row SQL, no triggers.
+- Failure contract: any failed projection statement rolls the whole
+  transaction back — raw rows and projections together — resets every
+  projection statement, and leaves the writer usable for the next batch
+  (`resetAll` discipline as for the raw statements today). Fault-injection
+  acceptance: a batch whose projection update fails leaves the database
+  unchanged, and the next batch succeeds.
+- The bench measured this at 0.39 ms vs 0.34 ms per batch — acceptance is
+  correctness, not speed.
+
+### A.3 Retention (src/storage/repositories/queries_repo.zig, prune path)
+
+In the same transaction as `pruneOlderThan(cutoff)`'s raw delete:
+
+1. Delete projection rows with `bucket < floor(cutoff / 1800) * 1800` from all
+   four tables.
+2. If `cutoff` is not on a bucket boundary, recompute the straddling bucket
+   (`floor(cutoff/1800)*1800`) from the remaining raw rows and replace its
+   projection rows in all four tables. Never approximate.
+
+Failure atomicity: a failure during the projection delete or the
+straddling-bucket replacement rolls back the raw delete, the watermark
+advance and every projection change together — one transaction, tested by
+fault injection.
+
+Implementation note (Session A, recorded post-build): the bucket_totals
+recompute carries `HAVING count(*) > 0` — a bare SQL aggregate always yields
+one row, and an emptied straddling bucket must disappear, not persist as
+zeros.
+
+### A.4 Read path (src/storage/repositories/queries_repo.zig)
+
+One function producing the whole Overview payload for a window, from one
+already-open read transaction (the caller owns transaction + lock, as today):
+
+```zig
+pub const Overview = struct {
+    totals: StatsTotals,
+    buckets: []const Bucket,          // bucket_count entries, zero-filled
+    clients: ClientsBreakdown,        // top-8 + other, as today
+    types: []const TypeCount,         // sorted as stats_types_sql sorts
+    routes: []const RouteCount,       // sorted as stats_routes_sql sorts
+};
+
+pub fn overview(
+    database: *db.Db,
+    arena: Allocator,
+    since: i64,
+    bucket_seconds: u32,
+    bucket_count: u32,
+) db.Error!Overview
+```
+
+Storage owns these scalars — no import of any web module. `until` is derived
+as `since + bucket_seconds * bucket_count` with the same overflow checks as
+`timeseries`. Preconditions, checked before path selection and tested:
+`bucket_seconds != 0` and `bucket_count != 0` (else `error.Misuse`, matching
+the existing clients contract); on the projection path
+(`bucket_seconds >= 1800`) additionally `since` a multiple of 1800 and
+`bucket_seconds % 1800 == 0`, else `error.Misuse`. The handler's `window()`
+guarantees all of them.
+
+Two implementations behind one entry point, chosen by `bucket_seconds`:
+
+- `bucket_seconds >= 1800` (24h, 7d, 30d): read the four projection tables
+  over `[since, until)`, aggregating 30-min rows up to the serving width in
+  Zig. `distinct_clients` comes from grouping `bucket_clients` by `client_ip`
+  over the window — never from summing per-bucket counts.
+  `avg_response_time_us` = `sum(rt_sum) / sum(rt_count)`, null when
+  `rt_count` sums to 0. Top-8 clients ranked by window total desc, ties by
+  `client_ip` asc (BINARY), residual summed into `other` — identical cut
+  semantics to `statsClients`.
+- `bucket_seconds < 1800` (1h): one single pass over the raw rows in the
+  window (one SELECT of the needed columns, stepped once), aggregating
+  everything in Zig. Memory bound: O(distinct clients + distinct qtypes +
+  distinct routes) in the window — explicitly permitted; this is a household
+  LAN and the same bound the arena-returning aggregates already carry. This
+  replaces today's five scans and the clients rank+bucket double scan. Same
+  output contracts.
+
+Sort orders and tie-breaks must reproduce the existing SQL orderings exactly
+(types: count desc, null last within tie, qtype asc; routes: count desc,
+route_kind asc, null source last, source asc) — the goldens' byte-stability
+argument carries over. Note: `RouteKind`'s enum declaration order is not
+alphabetical; "route_kind asc" means the stored text's byte order, so any Zig
+comparator orders by `@tagName` bytes, never by enum ordinal (Session A's
+accumulator already does; mutation-tested).
+
+### A.5 Acceptance criteria
+
+- [ ] `zig build test` green.
+- [ ] Property test: after an arbitrary interleaving of batches and prunes
+      (including a prune cutoff off the bucket grid), every projection table
+      equals a from-scratch recomputation from `query_log`.
+- [ ] Equivalence test: `overview()` output (both paths) equals a test-only
+      oracle over the same window on the same data — including empty windows,
+      NULL qtype, NULL source on an `upstream` row, ties in ranking, and a
+      window whose last bucket is in progress. The oracle is a copy of the
+      five existing SQL aggregates living in the test file, so it survives
+      Session D's deletion of the production functions.
+- [ ] Fingerprint test updated (table/index count assertions in
+      querylog_schema tests).
+
+---
+
+## Session B: web
+
+### B.1 Endpoint (src/web/handlers/overview.zig, replacing stats.zig's five)
+
+`GET /api/overview?period=1h|24h|30d|7d` (same grammar, default 24h, same 400
+text). One read transaction under `WebState.querylog_lock` covering the
+aggregate and `coverage.read` — one snapshot, no cross-panel skew. Response:
+
+```json
+{
+  "period": "24h", "since": ..., "until": ..., "bucket_seconds": 1800,
+  "totals": { "queries": n, "blocked": n, "clients": n, "avg_response_time_us": n|null },
+  "buckets": [ { "ts": ..., "queries": n, "blocked": n, "cached": n }, ... ],
+  "clients": [ { "client": "ip", "buckets": [n, ...] }, ... ],
+  "other": [n, ...],
+  "types": [ { "qtype": n|null, "count": n }, ... ],
+  "routes": [ { "route": "...", "source": "..."|null, "count": n }, ... ],
+  "coverage": { ... }
+}
+```
+
+Field shapes and semantics are exactly today's five bodies merged; `Period`,
+`window()`, `max_buckets` move to (or stay importable from) the new handler.
+503 when the query log is unavailable; 500 logging unchanged. Route metadata
+identical to the removed endpoints: same authentication (`.session`), same
+rate-limit class (`.counted`), same authority policy (`.read`).
+
+Remove `GET /api/stats`, `/api/stats/timeseries`, `/api/stats/types`,
+`/api/stats/routes`, `/api/stats/clients` and their routes.
+
+Contract surface (B owns all of it): add the new path and schema to the
+OpenAPI document, remove the five old operations and their schemas, update
+every drift guard that lists them, add a contract sample for
+`/api/overview`, and regenerate `admin/src/lib/contractSamples.gen.ts`
+(reserved for B — Session C must not touch it). Update the API listings in
+`docs/` and `PLAN.md` that name the five endpoints or the querylog layout.
+
+### B.2 Response cache (src/web/server.zig WebState + overview.zig)
+
+Per-period cached response body, invalidated by data change or window roll.
+Key: `(period, window.until, data_version)` where `data_version` is `PRAGMA
+data_version` on the web task's connection (it changes when any other
+connection — logger, retention — commits).
+
+The entire cache decision happens under `querylog_lock`; nothing touches the
+shared connection or the slots outside it. Exact sequence per request:
+
+1. Acquire `querylog_lock` — ONCE. `server.QuerylogRead.open` acquires this
+   lock itself, so the overview handler must not call it after step 1: B
+   refactors the scope into a lock-owning wrapper plus a
+   locked-caller variant (for example `QuerylogRead.openLocked`, documented
+   as requiring the lock), and the overview path uses the locked-caller
+   variant for step 4. A literal "lock, then QuerylogRead.open" deadlocks.
+2. Sample `PRAGMA data_version` (inside the lock — the shared connection may
+   otherwise have a foreign transaction open, and the slots need the mutual
+   exclusion anyway).
+3. Hit (`slot.period == period and slot.until == window.until and
+   slot.data_version == sampled`): copy the stored bytes into the request
+   arena, release the lock, respond. The copy is what makes a concurrent
+   rebuild's free-and-replace safe.
+4. Miss: open the read transaction, build the body, commit. Publish to the
+   slot ONLY after a successful commit, keyed by the version sampled in
+   step 2 (a commit landing during the build bumps `data_version`, so the
+   next request rebuilds — stale-under-new-key is impossible). A failed
+   commit or build publishes nothing and responds 500 as today.
+5. Copy to the request arena, release the lock, write the socket. The lock
+   never spans a socket write (existing discipline).
+
+Because the check happens only under the lock, `querylog_lock` is the
+single-flight: a second request for the same key waits and then hits.
+
+Storage: one slot per period (4 slots) in `WebState`; body bytes allocated
+from `WebState.gpa`, replaced on rebuild (free old, install new), freed in
+`deinit`. No capacity limit beyond the allocator — a body is bounded by the
+fixed bucket counts plus the household client/type/route cardinality.
+
+No adaptive polling and no combined-endpoint staging: with projections + this
+cache a rebuild is ~40 ms x86 / ~0.13 s Pi, so the admin's existing 30 s
+cadence is fine.
+
+### B.3 Acceptance criteria
+
+- [ ] `zig build test` green; handler tests ported from stats.zig (period
+      grammar, window math, one-snapshot behavior) plus: cache hit returns
+      byte-identical body; a logger commit (data_version bump) invalidates;
+      a window roll invalidates; a retention prune committed through another
+      connection invalidates (both the aggregates and the cached
+      `coverage.available_since` are replaced); a failed read-transaction
+      commit neither installs nor replaces a cache entry.
+- [ ] `curl /api/overview?period=30d` on a seeded scratch instance returns all
+      panels consistent (breakdowns sum to totals on a quiet database).
+- [ ] The five old routes return 404.
+
+---
+
+## Session C: admin
+
+### C.1 Data layer
+
+- `admin/src/lib/types.ts`: one `Overview` type mirroring B.1; remove the five
+  per-panel response types.
+- `admin/src/lib/api.ts`: `getOverview(period)`; remove the five getters.
+- `admin/src/lib/queries.ts`: `overviewQuery(period)` with
+  `refetchInterval: 30_000` and key `["overview", period]`; remove the five
+  stats query factories and their keys.
+
+### C.2 Overview page
+
+`admin/src/features/overview/overviewWindow.ts` and the chart components
+consume the single query: one `useQuery` where five ran in parallel. Loading,
+error and coverage handling collapse to one page-level surface (one spinner
+state, one error state for the whole Overview); the per-panel shells,
+layout, copy, chart dimensions and accessibility attributes stay exactly as
+they are. Chart components (TimeseriesChart, ClientChart, Donut) keep their
+props — adapt the mapping layer, not the charts. C must not touch
+`contractSamples.gen.ts` (B owns its regeneration).
+
+### C.3 Acceptance criteria
+
+- [ ] `npm test` green in admin/ (mock the one endpoint; port the five-query
+      tests).
+- [ ] `npm run typecheck` green — the build alone does not run tsc. B and C
+      are file-disjoint but type-coupled through `contractSamples.gen.ts`:
+      C's typecheck/test/build gates run (or re-run) AFTER B has regenerated
+      that file. Implementation may proceed in parallel; the green gate is
+      sequenced.
+- [ ] `npm run build` green; bundle-size assertion still passes.
+- [ ] Manual: scratch instance renders all Overview panels from the new
+      endpoint on all four periods.
+
+---
+
+## Session D: storage cleanup
+
+After B is merged and green: delete `statsTotals`, `timeseries`, `statsTypes`,
+`statsRoutes`, `statsClients` and their SQL constants from
+`queries_repo.zig` — nothing references them once `stats.zig` is gone. The
+test-only oracle from A.5 stays. Acceptance: `zig build test` green, no dead
+stats SQL remains in production code.
+
+---
+
+## Module layout
+
+- `src/web/handlers/overview.zig` — new; replaces `src/web/handlers/stats.zig`
+  (deleted by B).
+- `src/storage/querylog_schema.zig` — projection DDL appended.
+- `src/storage/repositories/queries_repo.zig` — writer maintenance, retention
+  integration, `overview()` read path (A); five old aggregates deleted (D).
+- Admin files per C.1/C.2.
+
+## File ownership
+
+- A: `src/storage/*` (old aggregates left in place), plus the mechanical
+  allocator-plumbing at every `BatchWriter.init` call site outside storage
+  (`src/web/handlers/*`, `src/web/web_integration_test.zig`, any test using
+  the writer) — A runs before B, so this is sequential, not shared,
+  ownership; A's gate is the full `zig build test`.
+- B: `src/web/*`, plus: `src/app.zig` (cache cleanup at the composition
+  root), `src/tests.zig` (handler import swap), the OpenAPI document and its
+  drift guards, contract samples including
+  `admin/src/lib/contractSamples.gen.ts`, `docs/**` API listings, `PLAN.md`
+  stale sections, and the Overview/API sections of `specs/ui-redesign.md`
+  (which still mandates the five endpoints and must be amended, not obeyed).
+- C: `admin/*` EXCEPT `admin/src/lib/contractSamples.gen.ts`.
+- D: `src/storage/repositories/queries_repo.zig` (sequential, after B).
+- Orchestrator: `CHANGELOG.md` (hand-written, per release process).
+B and C run in parallel; the one shared-tree exception above is reserved to B.
+
+## Acceptance criteria (milestone complete)
+
+- [ ] `zig build test` and `zig build test -Dintegration` green (the
+      integration suite carries the live route walk, contract-sample
+      comparison, concurrent querylog reads and OpenAPI guards); admin
+      `npm test`/`typecheck`/`build` green.
+- [ ] Scratch-instance smoke: seeded data + live digs; Overview correct on all
+      periods; old endpoints gone.
+- [ ] Changelog discloses: schema change resets query history (rename-aside),
+      five endpoints replaced by `/api/overview`.
+- [ ] Release gate (`zig build cut` fingerprint check) satisfied.
+
+## Anti-requirements
+
+- No second database file, no epoch/validity protocol, no ATTACH.
+- No backfill migration, no rebuild command, no catch-up cursor — projections
+  are born with the file and maintained transactionally; that is the whole
+  coherence story.
+- No connection pool, no adaptive polling, no DuckDB.
+- No new indexes on `query_log`, no triggers, no per-row projection SQL.
+- Do not change the 1h/24h/7d/30d period grammar, bucket widths or counts.
+- No HTTP-level caching of any kind: no ETag, no `Cache-Control`, no
+  stale-while-revalidate, no background refresh, and never cache a 500/503
+  body. The cache is exactly the in-process design of B.2.
+- No visual redesign, no chart-prop changes, no cache configuration knobs,
+  no cache metrics. This milestone changes data acquisition and storage only.

specs/milestone-37.md

@@ -0,0 +1,337 @@
+# Milestone 37: Upstream failover budget — deadline ownership and honest attribution
+
+Make the pool's failover loop own one deadline (admission included), revive the
+standby under primary saturation, and stop blaming endpoints for budget
+exhaustion.
+
+## The defect (field-verified on the Pi, 0.0.11)
+
+With defaults attempt=2500 ms / total=5000 ms and two upstreams:
+
+1. `Pool.exchangeLoopLen` (pool.zig:277) never computes remaining time. The
+   semaphore wait consumes the total budget invisibly: under a traffic burst
+   the primary's slots saturate, a new request queues behind them while the
+   standby sits idle with free slots, and the outer `raceWithin(total)` cancels
+   whatever finally runs. 155 requests died at the 5 s cap; 706 of 717
+   SERVFAILs came from one bursty client. On an idle pool a fast standby works
+   today — the queue is the killer, not the timer arithmetic alone.
+2. The reporting contradicts itself. `selected` is written before the attempt
+   runs (pool.zig:348), so the query log blamed the standby on 279 rows;
+   cancelled attempts are excluded from health (pool.zig:363), so its counters
+   read 0/0. Nothing records "the request exhausted its own budget."
+
+Design reviewed and converged with Codex (thread of 2026-08-27). Defaults do
+not change.
+
+## Sessions
+
+Three, strictly sequential: A (transport vocabulary) → B (pool) → C
+(handler, forward client, surfaces).
+
+---
+
+## Session A: transport vocabulary
+
+### A.1 `error.BudgetExhausted` and a fourth group (src/upstream/transport.zig)
+
+- Add `BudgetExhausted` to `ExchangeError`.
+- Add `.budget_exhausted` to `Group`; `group()` maps the new error to it. The
+  switch stays exhaustive with no `else` — every switch over `Group` breaks at
+  compile time until it handles the new group, which is the point. The
+  production switches are `pool.zig` (:353), `handler.zig` (:677, :735) and
+  `forward_client.zig` (:124). Session A owns a mechanical placeholder arm at
+  each (pool and forward_client: propagate the error without recording
+  health; handler: `=> ctx.servFail()`), plus any test switches the compiler
+  flags, so A's `zig build test` passes. B and C then own the real behavior
+  at their sites. (health.zig has no `group` call; the doh/dot occurrences
+  are tests, not switches.)
+
+### A.2 Timer-origin race (src/upstream/transport.zig)
+
+`raceWithin` collapses "the expiry task won" and "the raced operation itself
+returned error.Timeout" into one `error.Timeout`. Add:
+
+```zig
+pub const RaceOutcome = enum { completed, expired };
+
+pub fn raceUntilTagged(
+    io: std.Io,
+    expiry_at: std.Io.Clock.Timestamp,
+    outcome: *RaceOutcome,
+    comptime f: anytype,
+    args: anytype,
+) ExchangeError!RacedPayload(f)
+```
+
+The expiry parameter is an ABSOLUTE timestamp, not a duration: a duration
+computed from `deadline.toDurationFromNow()` and then slept re-anchors at
+"now", drifting past the total deadline and misclassifying a nominally full
+attempt. The pool computes `expiry_at = min(now + attempt, total_deadline)`
+and passes the timestamp. On the expiry side the function sets `outcome.* =
+.expired` and returns `error.Timeout`; on completion it sets `.completed` and
+returns the raced result (which may itself be `error.Timeout` from the leaf —
+that is a completed peer timeout, not an expiry). `raceWithin` keeps its
+public API and behavior but delegates to the same internal harness (compute
+the absolute deadline, discard the outcome) — one `Select` harness in the
+file, not two copies.
+
+### A.3 Acceptance
+
+- [ ] `zig build test` green.
+- [ ] Unit tests: tagged race distinguishes leaf `error.Timeout` (completed)
+      from expiry (`expired`); the untagged wrapper is unchanged behavior.
+
+---
+
+## Session B: the pool (src/upstream/pool.zig)
+
+### B.1 One deadline owns the loop
+
+- `Pool.exchange` establishes `deadline = std.Io.Timeout{ .duration =
+  self.timeouts.total }.toDeadline(io)` (`.awake` clock, as the loop uses
+  today) and passes it down. The equal-deadline outer `raceWithin` at
+  pool.zig:267 is REMOVED — the loop owns the deadline; two timers aimed at
+  the same instant race each other and let the outer cancellation bypass the
+  loop's classification. No replacement watchdog (the outer race never bounded
+  uncancelable health writes anyway; a later-firing watchdog is scope creep).
+- Every blocking step consumes the deadline:
+  - Admission: through the ownership-safe protocol of B.2 — never a bare
+    `Semaphore.wait` raced against an expiry. Racing the wait with
+    `Select.cancelDiscard` can leak a permit: the wait may have decremented
+    the count in the same instant the expiry wins, and the discarded success
+    never reaches the caller's release-defer. If no time remains before
+    admission, return `error.BudgetExhausted` without waiting.
+  - Attempt: raced via `raceUntilTagged` against
+    `expiry_at = min(now + timeouts.attempt, total_deadline)`.
+- `total < attempt` is already rejected by validate.zig; `total == attempt`
+  (and any admission overhead) simply yields truncated attempts, handled by
+  B.3.
+
+### B.2 Admission without head-of-line blocking
+
+Zig 0.16's `Semaphore` has neither try-acquire nor a timed wait, so the pool
+gains a local admission helper mirroring the standard semaphore's own
+mutex/decrement/condition protocol (never by patching `../zig`, never by
+spinning):
+
+- `tryAcquire()` — take a permit if one is immediately available, else fail
+  without blocking.
+- `acquireUntil(deadline)` — timed acquisition; returns Acquired (holding a
+  permit), Expired (holding none), or `error.Canceled` (holding none).
+  `std.Io.Condition` has no timed wait in 0.16, so this is a NEW pool-local
+  primitive, specified exactly: state lives under one mutex (permit count +
+  waiter bookkeeping); the wait itself may race `Condition.wait` against a
+  sleep via `Select`, because a permit is only ever taken under the mutex
+  AFTER the race resolves — a discarded wake is a lost notification, not a
+  lost permit. To keep that lost notification from stranding another waiter,
+  an exiting waiter that may have absorbed a signal (expiry or cancellation
+  path) re-signals the condition before returning. Permit conservation is by
+  construction: the decrement and the "did I win" decision happen under the
+  same mutex. Every take is non-blocking (the mutex's `tryLock`): a lock
+  miss reads as "no permit now", and `acquireUntil` re-enters the
+  absolute-deadline race on each miss, so contention on the admission mutex
+  never carries a call past its deadline (review round 2026-08-27). Tests:
+  an expiry/acquisition tie leaves the permit count exact; a cancelled
+  waiter holds nothing and a peer waiter still wakes; a contended admission
+  mutex does not carry `acquireUntil` past its deadline.
+
+Loop semantics — priority means ordering among immediately admissible
+candidates:
+
+1. Pass one, first sweep in priority order: `tryAcquire` on each available
+   entry; the first immediate success is attempted. A saturated entry is
+   skipped while another eligible entry has capacity.
+2. If the attempted entry fails (peer fault), the sweep continues from the
+   next entry, still by `tryAcquire`; previously skipped saturated entries
+   are re-tried by `tryAcquire` on each subsequent sweep step (a slot may
+   have freed).
+3. Only when no eligible entry has an immediate permit does the loop block:
+   `acquireUntil(remaining deadline)` on the highest-priority eligible
+   entry. Expired → `error.BudgetExhausted`. The no-head-of-line guarantee
+   is deliberately scoped to capacity observed during the sweep: once
+   blocked, a lower-priority slot freeing does not wake this waiter
+   (any-entry wakeups need multi-wait machinery this milestone does not
+   buy). Record this bound in the admission helper's doc comment.
+4. Pass two (backoff probing) keeps today's in-order probing but admits
+   through the same helper bounded by the remaining deadline — it
+   deliberately retains blocking, one entry at a time, because probing a
+   backed-off entry is already a last resort.
+5. The post-admission health recheck survives the refactor: after acquiring
+   a permit by either path in pass one, re-read health against a fresh
+   `now`; an entry that entered backoff while this task waited is released
+   (permit returned) and the sweep resumes. The existing regression test
+   for this recheck is retained.
+6. Before any attempt starts — immediate admission included — the loop
+   re-reads the clock; a deadline already passed returns
+   `error.BudgetExhausted` with the permit returned and no endpoint named,
+   so an instantly-completing leaf can never manufacture evidence after
+   exhaustion (review round 2026-08-27). Test: an exchange whose deadline
+   is already gone starts no attempt.
+7. The compiled pool bound (`Pool.max_entries`, 64) is enforced at config
+   validation: more than 64 ENABLED upstreams is `TooManyUpstreams` at path
+   `upstreams`, so a valid config can never trip the pool assert (review
+   round 2026-08-27). Tests: 64 enabled passes, 65 fails, 65 listed with
+   64 disabled passes.
+8. Queue accounting keeps its meaning: `queued_total` and
+   `queued_seconds_total` count only the blocking `acquireUntil` path,
+   recorded whether it ends in acquisition, expiry or cancellation; a
+   `tryAcquire` — hit or miss — never counts as queued. Acceptance test
+   retained.
+
+### B.3 Classification (uses A.2's tagged race)
+
+| Attempt outcome | Budget it ran with | Health | `selected` | Loop action |
+| --- | --- | --- | --- | --- |
+| success | any | success | this endpoint | return answer |
+| expiry (`expired`) | full `attempt` | failure | this endpoint | continue failover |
+| expiry (`expired`) | truncated | untouched | unchanged | return `error.BudgetExhausted` |
+| completed peer fault (incl. leaf Timeout) | any, even truncated | failure | this endpoint | continue failover |
+| local_resource | — | untouched | unchanged | return err (as today) |
+| cancellation | — | untouched | unchanged | return `error.Canceled` |
+| wait exhausts deadline | — | untouched | unchanged (null if nothing ran) | return `error.BudgetExhausted` |
+| completed attempt returns `error.BudgetExhausted` (a leaf may emit it once it exists) | any | untouched | unchanged | return it; counter increments once at the outer pool |
+
+A truncated expiry is a censored observation: the pool did not grant the
+configured observation interval, so it is evidence about the pool's budget,
+never about the peer. No minimum-attempt floor exists.
+
+### B.4 `selected` = last attributable endpoint
+
+Assign `selected.*` only in the success row and the two health-recording
+failure rows above — after the attempt completes, not before it starts. This
+attribution rule is POOL-SPECIFIC: leaf clients (DoH, DoT, ForwardClient,
+test fakes) keep their write-before-attempt behavior — they have one
+endpoint and record no health, so "the endpoint I tried" is honest there.
+The `Client.exchange` doc comment in transport.zig is amended to state both
+contracts: implementations may write before each attempt; `Pool` documents
+its stricter last-attributable rule on `Pool.exchange` itself. The pool-level
+tests at pool.zig:748-771 (selected-before-attempt) and :910 invert into the
+new contract's tests; leaf-client tests are untouched.
+
+### B.5 The counter
+
+`Pool` gains one pool-level counter, `budget_exhausted_total` (atomic u64,
+incremented once per exchange that returns `error.BudgetExhausted`, never per
+endpoint). `Pool.snapshot` returns per-entry rows and cannot carry a
+pool-wide number without duplicating it — so the counter is exposed through a
+separate getter, `Pool.budgetExhaustedTotal()`, and B owns the mechanical
+plumbing at every existing snapshot call site its change touches so B's own
+gate passes before C. No per-stage split (queue vs attempt) —
+fixed-cardinality stage labels are deferred until an operator needs them.
+
+### B.6 Acceptance (the decisive regressions first)
+
+- [ ] Fast standby at shipped defaults: entry 0 stalls its full attempt
+      budget, entry 1 answers instantly, attempt = total/2 → entry 1 answers.
+- [ ] Saturated primary, free standby: entry 0's slots all held by stalled
+      exchanges, entry 1 free and fast → entry 1 answers well inside the
+      deadline. This is the Pi reproduction; it must FAIL against the current
+      code and pass after B.2.
+- [ ] Truncated expiry mutates no health, returns BudgetExhausted, leaves
+      `selected` at the last attributable endpoint.
+- [ ] Truncated attempt failing with ConnectionRefused mutates health and
+      updates `selected`.
+- [ ] Queue-only exhaustion → BudgetExhausted with `selected == null`.
+- [ ] All-backoff pass two runs under the same deadline.
+- [ ] External cancellation returns Canceled, counts no budget, mutates
+      nothing.
+- [ ] `budget_exhausted_total` increments once per exhausted exchange.
+- [ ] Existing invariants hold: cancelled waiter returns its permit; two
+      stalling upstreams cost ≤ total, not one budget each.
+
+---
+
+## Session C: handler, forward client, surfaces
+
+### C.1 Handler (src/server/handler.zig)
+
+Both `transport.group` switches (:677, :735) gain `.budget_exhausted =>
+ctx.servFail()` — SERVFAIL on the wire, same as peer faults; no rcode fits
+better. No per-query warn log (spam); the counter is the record.
+
+### C.2 Forward client (src/local/forward_client.zig)
+
+One outer budget for the whole exchange: wrap UDP attempt → truncation
+fallback → TCP in a single tagged race against `read_timeout` (the UDP
+receive's internal deadline and the TCP `raceWithin` at :217 collapse into
+the one outer bound — remove the fresh TCP budget). Every timeout here
+concerns the single configured resolver, so expiry stays `error.Timeout`
+(peer evidence), never BudgetExhausted — the budget/peer distinction is pool
+policy. Test: truncated-UDP-then-stalled-TCP completes or expires within one
+`read_timeout`, not two. Update the doc comment on `read_timeout_ms` in the
+config (validate.zig:360 note and the settings description) to say it bounds
+the whole forward-zone exchange. The key is NOT renamed (anti-requirement).
+
+### C.3 Surfaces
+
+- Metrics: `nxdns_upstream_budget_exhausted_total` (pool-wide) wherever
+  `nxdns_upstream_*` counters render, read via `Pool.budgetExhaustedTotal()`.
+- `/api/health` is NOT changed (decision, not omission): the counter is an
+  operator metric, it never changes health status, and adding it to the API
+  would drag openapi.yaml, admin types, fixtures, contract samples and the
+  admin gates into a milestone that owes them nothing. Metrics only.
+- docs: `docs/reference/configuration.md` — every statement describing
+  `read_timeout_ms` as a per-read or per-attempt bound is rewritten to the
+  whole-exchange contract; the upstream timeouts section gains one paragraph
+  on budget semantics (deadline, truncation, attribution). The stale contract
+  text in `src/config/model.zig` (the setting's doc comment) and the note at
+  `src/config/validate.zig:360` are updated to match.
+
+### C.4 Acceptance
+
+- [ ] `zig build test` and `zig build test -Dintegration` green.
+- [ ] Metrics test covers the new counter's rendering.
+- [ ] Forward-client single-budget test per C.2.
+
+---
+
+## File ownership
+
+- A: `src/upstream/transport.zig`, plus mechanical placeholder arms at the
+  broken `Group` switches (`src/upstream/pool.zig`, `src/server/handler.zig`,
+  `src/local/forward_client.zig`, test switches the compiler flags) —
+  sequential ownership, A runs alone; C takes forward_client.zig and
+  handler.zig over later in sequence.
+- B: `src/upstream/pool.zig` (+ the `Client.exchange` doc contract in
+  transport.zig and snapshot-caller plumbing for the new getter — B runs
+  alone after A).
+- C: `src/server/handler.zig`, `src/local/forward_client.zig`, the metrics
+  rendering files, `src/config/model.zig` + `src/config/validate.zig` doc
+  text, `docs/reference/configuration.md`.
+- Orchestrator: CHANGELOG.md.
+
+## Acceptance criteria (milestone complete)
+
+- [ ] All session criteria; both suites green; `zig fmt --check` clean.
+- [x] The saturated-primary regression demonstrably fails on pre-milestone
+      code and passes after. Evidence (orchestrator-run mutation check,
+      2026-08-27): with the pass-one `tryAcquire` sweep disabled in
+      `Pool.admit` — restoring pre-fix head-of-line blocking — the test
+      "a saturated primary defers to a standby that has capacity" fails with
+      `error.BudgetExhausted` out of the blocking admission path, and four
+      queue-accounting/attribution tests fail with it (5 failed, seed
+      0x91ce5df5). Sweep restored: 30/30 steps, 1892/2067 passed, 0 failed.
+- [ ] Changelog: failover now works under primary saturation; SERVFAILs from
+      budget exhaustion are counted, not blamed on an upstream; for
+      upstream-pool queries the query-log `upstream` field now names only
+      endpoints whose outcome was recorded (may be null) — forward-zone
+      queries keep naming their single configured resolver as before.
+
+## Anti-requirements
+
+- No default timeout changes.
+- No parallel/racing fan-out to multiple upstreams. Priority failover stays,
+  with priority defined as ordering among immediately admissible candidates
+  (B.2) — a saturated higher-priority entry defers to an admissible
+  lower-priority one; it does not outrank an idle standby by blocking on it.
+- No `/api/health` or admin changes; the counter surfaces in metrics only.
+- No patching of the vendored/system Zig stdlib; the admission helper is
+  pool-local.
+- No rename of `upstream.read_timeout_ms` (doc fix only).
+- No minimum-attempt floor constant.
+- No per-stage split of the budget counter; no per-query budget log lines.
+- No watchdog replacing the removed outer race.
+- No fake upstream identity (e.g. "budget") in the query log; no new
+  query-log column.
+- No changes to backoff policy, slot counts, or health scoring beyond the
+  attribution rules above.

specs/ui-redesign.md

@@ -54,14 +54,14 @@ One question, answered over a period the reader chooses: what did the resolver d
 
 Top to bottom, edge to edge:
 
-1. **Four stat tiles**, neutral chrome throughout — no coloured accents; emphasis is typographic. Queries, Blocked (count and rate), Clients, Average response. Each tile carries the way into the rows behind its number: Queries and Blocked open Activity for exactly the bounds the stats response returned, Clients opens the clients page, and Average response has nothing to open.
+1. **Four stat tiles**, neutral chrome throughout — no coloured accents; emphasis is typographic. Queries, Blocked (count and rate), Clients, Average response. Each tile carries the way into the rows behind its number: Queries and Blocked open Activity for exactly the bounds the overview response returned, Clients opens the clients page, and Average response has nothing to open.
 2. **Queries over time** — the existing query-volume timeline, split blocked/cached/other, full width.
 3. **Client activity over time** — one stacked series per named client plus "other", on the same bucket alignment as the timeline so the two charts share an x-axis. A client registered under a name is labelled by it, with the same precedence the query tables apply and the address kept as the title; colour keys on the address, so naming a client never repaints its series.
 4. **Query types** and **Upstream servers** — two donuts, side by side above 1280px and stacked below, with the ring and its legend centred in the panel while stacked and left-anchored once they are a pair. Types are labelled by the admin's own `qtypeName()`; routes by route-kind labels and by the answering resolver or zone. Each donut's SVG is decoration (`aria-hidden`, `focusable="false"`); a visible legend and a visually hidden table are the accessible surface. An empty window says "No queries in this period." rather than drawing nothing.
 
 Colours key on semantic identity — the qtype value, the client string, the `(route, source)` pair — so a rank change between two polls never repaints an entry. Charts stay lightweight SVG; no charting dependency.
 
-**Window coherence, five requests.** Totals, timeseries, clients, types and routes are separate calls, and the page holds one window identified by `(period, since, until, coverage.available_since)` — the watermark joins the identity because retention advancing mid-page changes what the same span can answer for. A response is a member only if all four fields match. Rendering is per panel: a member renders, a panel still in flight shows its own loading state, a panel whose request failed shows its own error and Retry, and the members keep rendering throughout — a failed donut never blanks the charts. A response behind the window is refetched once per endpoint-keyed episode and, if it stays behind, that panel alone shows an error. This is window coherence, not data-snapshot coherence: live inserts between requests may shift counts slightly between panels, and that is accepted. One coverage notice for the page, from the window's watermark.
+**One request, one snapshot (superseded 2026-08-27 by milestone 36; the paragraph below replaces the original five-request window-coherence design).** The page makes one call, `GET /api/overview?period=…`, whose body carries totals, timeseries, clients, types, routes and coverage from a single read transaction — data-snapshot coherence, so the panels cannot disagree and no reconciliation layer exists. Loading and error are page-level: one loading surface, one error with Retry for the whole Overview. The per-panel shells, layout, copy and accessibility surfaces are unchanged. One coverage notice for the page, from the response's watermark. A `keepPreviousData` body whose own `period` is not the selected one keeps the page in loading.
 
 **The shell.** The header carries no protection display at all. The Pause/Resume control sits at the foot of the sidebar, above the version label, in both the desktop rail and the mobile drawer; it is the only global runtime action, and it belongs to the resolver rather than to any page. It still appears beside the detail of a query that was blocked. The control states a pause with itself — "Paused until 14:05", or "Paused" when the pause has no end — because "Resume" names an action without naming the state it would end, and with the indicator and the status rows both gone the sidebar is the only place a page other than Diagnostics can carry that fact. An active resolver gets no line; the button says Pause, which is the whole message. The line and the health strip read one `protection` condition through one clock format, so they cannot disagree. The Diagnostics navigation item carries a badge: the open-episode count, or a neutral "!" when the rollup is degraded with nothing open and when the latest health poll failed — an unknown must never read as healthy. It is hidden only when health data exists, the latest poll succeeded, and the rollup is ok with nothing open.
 
@@ -168,7 +168,7 @@ No response payloads, answer RR sets, EDNS data or packet bytes are stored. The
 
 Privacy transforms apply to every new domain-bearing field, not only `domain`: with `hide_domains` on, matched names, CNAME targets and safe-search targets hide consistently.
 
-A one-row `querylog_meta (created_at INTEGER NOT NULL)` table lets the stats and query APIs return a conservative `available_since`, which distinguishes "zero queries" from "history does not exist".
+A one-row `querylog_meta (created_at INTEGER NOT NULL)` table lets the overview and query APIs return a conservative `available_since`, which distinguishes "zero queries" from "history does not exist".
 
 ### Historical query detail
 
@@ -208,9 +208,9 @@ Database mode uses the same information architecture with real edit actions, plu
 
 `GET /api/queries` keeps keyset pagination and its filters; rows gain `rcode`, `route_kind`, `policy_action` and the short policy reason the table needs, and the body gains `coverage: {complete, available_since}`. `GET /api/queries/{id}` returns nested `request` / `policy` / `route` / `response` provenance. `GET /api/queries/live` sends the same object without `id`.
 
-`GET /api/stats` and `/api/stats/timeseries` add `complete` and `available_since`.
+**Superseded by milestone 36 (2026-08-27).** This section originally specified five per-panel endpoints — `GET /api/stats`, `/api/stats/timeseries`, `/api/stats/types`, `/api/stats/routes` and `/api/stats/clients`. Five requests could promise a shared window but never a shared snapshot, and each one scanned every raw row in it. They are replaced by a single `GET /api/overview?period=1h|24h|7d|30d`, which returns `{period, since, until, bucket_seconds, totals:{queries, blocked, clients, avg_response_time_us}, buckets:[{ts, queries, blocked, cached}], clients:[{client, buckets}], other, types:[{qtype, count}], routes:[{route, source, count}], coverage:{complete, available_since}}` — every field with the semantics the five bodies gave it, over one deferred SQLite read transaction, so the breakdowns and the coverage watermark describe one database state. The 24h, 7d and 30d windows are served from 30-minute projection tables maintained transactionally beside the raw rows; the 1h window takes one raw scan. Per-period response caching keyed on `(window.until, PRAGMA data_version)` lives in the web layer.
 
-**Three period aggregations (added 2026-08-22)** to feed the new Overview panels, all taking the same `period` parameter and reporting over the same aligned window, and all reading their rows and their coverage watermark inside one deferred SQLite read transaction. `GET /api/stats/types` → `{period, since, until, coverage, types:[{qtype, count}]}`, the numeric type only — naming types stays the admin's job, and a second table in the server would drift out of agreement with it — with the rows that recorded no type kept as their own `null` group. `GET /api/stats/routes` → `{period, since, until, coverage, routes:[{route, source, count}]}`, grouping `upstream` rows by the answering resolver and `forward_zone` rows by the zone, with blocked, cache, local and rejected carrying no source. `GET /api/stats/clients` → `{period, since, until, bucket_seconds, coverage, clients:[{client, buckets}], other}`, bucketed exactly as `/api/stats/timeseries`, the eight busiest clients named and everything else summed into `other`, which is always present and always bucket-count-sized. No new writers and no new state: all three are pure reads over the query log's provenance columns.
+The panel semantics the five endpoints defined all carry over unchanged: types are the numeric type only — naming types stays the admin's job, and a second table in the server would drift out of agreement with it — with the rows that recorded no type kept as their own `null` group; routes group `upstream` rows by the answering resolver and `forward_zone` rows by the zone, with blocked, cache, local and rejected carrying no source; clients name the eight busiest and sum everything else into `other`, which is always present and always bucket-count-sized.
 
 Existing mutation endpoints stay specific. Diagnostics introduces no generic "perform remediation" endpoint; it invokes the existing blocklist-refresh and certificate-reload operations.
 

src/app.zig

@@ -817,6 +817,9 @@ fn serve(r: cli.Runner, args: cli.RunArgs) !u8 {
     // Same argument as the live hash: a settings PUT may have installed an
     // owned generation, and this runs after `group.cancel`.
     defer web_state.proxies.deinit(gpa);
+    // The Overview response cache owns its bodies from `gpa`. Same argument
+    // again: no web task can still be reading a slot once the group is cancelled.
+    defer web_state.overview_cache.deinit(gpa);
     if (cfg.web.enabled) web_state = .{
         .gpa = gpa,
         .web = cfg.web,

src/cli.zig

@@ -1012,7 +1012,7 @@ fn probeUpstreams(r: Runner, cfg: model.Config) !usize {
             .priority = server.priority,
             .enabled = true,
             .health = .init,
-            .sem = .{ .permits = slots.len },
+            .admission = .{ .permits = slots.len },
             .reuse_recoveries = &recoveries,
         }};
         var single: pool.Pool = .init(&entries, .{}, timeouts, seed);

src/config/model.zig

@@ -57,9 +57,11 @@ pub const Config = struct {
 pub const Upstream = struct {
     /// Bounds one attempt against one upstream inside the pool's failover loop.
     attempt_timeout_ms: u32 = 2500,
-    /// The forward-zone client's read deadline, and nothing else. It bounds a
-    /// different subsystem from the two above (`src/local/forward_client.zig`),
-    /// so no cross-check relates it to them.
+    /// The forward-zone client's whole-exchange budget, and nothing else: one
+    /// bound covers the UDP attempt, a TC=1 fallback and the TCP retry
+    /// together, not each of them. It bounds a different subsystem from the two
+    /// above (`src/local/forward_client.zig`), so no cross-check relates it to
+    /// them.
     read_timeout_ms: u32 = 3000,
     /// The whole-exchange budget: every failover attempt together, not one of
     /// them. The pool races the entire loop against it.

src/config/validate.zig

@@ -52,6 +52,7 @@ const limits = @import("limits.zig");
 const logger = @import("../storage/logger.zig");
 const regex = @import("../filter/regex.zig");
 const safe_url = @import("../safe_url.zig");
+const pool = @import("../upstream/pool.zig");
 const transport = @import("../upstream/transport.zig");
 
 const Config = model.Config;
@@ -69,6 +70,7 @@ const Prefix = address.Prefix;
 /// like every other resource failure.
 pub const ValidateError = error{
     NoUpstreams,
+    TooManyUpstreams,
     BadUpstreamUrl,
     UpstreamHostNotIpLiteral,
     DuplicateUpstreamUrl,
@@ -357,8 +359,9 @@ fn checkScalars(cfg: Config, diags: *Diagnostics) error{OutOfMemory}!void {
     // The only cross-check that relates two knobs of one subsystem: the pool
     // races one attempt against `attempt` and the whole failover loop against
     // `total`, so an attempt budget above the total one can never be reached.
-    // `read_timeout_ms` belongs to the forward-zone client and is deliberately
-    // unrelated to both.
+    // `read_timeout_ms` bounds the forward-zone client's whole exchange —
+    // UDP attempt, TC=1 fallback and TCP retry under one budget — and is
+    // deliberately unrelated to both.
     if (up.attempt_timeout_ms > up.total_timeout_ms) {
         try diags.add(
             error.BadTimeout,
@@ -823,6 +826,21 @@ fn checkCollections(cfg: Config, diags: *Diagnostics, scratch: Allocator) error{
             .{},
         );
     }
+    // Each enabled upstream becomes one pool entry, and the failover loop
+    // tracks the entries it has spent in a fixed bitset of `Pool.max_entries`
+    // bits. Without this check a config past that bound reaches an assert and
+    // panics at startup, which is the wrong way to tell an operator that a
+    // number is too large. Disabled upstreams are not counted: they never
+    // become entries.
+    if (enabled_upstreams > pool.Pool.max_entries) {
+        try diags.add(
+            error.TooManyUpstreams,
+            "upstreams",
+            .{},
+            "{d} upstreams are enabled; nxdns is built for at most {d}",
+            .{ enabled_upstreams, pool.Pool.max_entries },
+        );
+    }
 
     var client_ips: IndexSet = .empty;
     for (cfg.clients, 0..) |client, i| {
@@ -1323,6 +1341,52 @@ test "error.NoUpstreams when nothing is enabled" {
     try expectProblem(cfg, error.NoUpstreams, "upstreams");
 }
 
+/// `count` distinct enabled upstreams. Generated rather than written out
+/// because the bound this exercises is 64, and a hand-written list that long
+/// would say less than the loop does.
+fn ManyUpstreams(comptime count: usize) type {
+    return struct {
+        const list: [count]model.UpstreamServer = blk: {
+            var built: [count]model.UpstreamServer = undefined;
+            for (&built, 0..) |*server, i| {
+                server.* = .{ .url = std.fmt.comptimePrint("https://u{d}.example/dns-query", .{i}) };
+            }
+            break :blk built;
+        };
+    };
+}
+
+fn manyUpstreams(comptime count: usize) []const model.UpstreamServer {
+    return &ManyUpstreams(count).list;
+}
+
+test "as many enabled upstreams as the pool holds validates cleanly" {
+    var cfg = baseConfig();
+    cfg.upstreams = manyUpstreams(pool.Pool.max_entries);
+    try expectClean(cfg);
+}
+
+test "error.TooManyUpstreams one enabled upstream past the pool's bound" {
+    // The pool asserts this bound, so without the check here a valid-looking
+    // config panics at startup instead of being reported.
+    var cfg = baseConfig();
+    cfg.upstreams = manyUpstreams(pool.Pool.max_entries + 1);
+    try expectProblem(cfg, error.TooManyUpstreams, "upstreams");
+}
+
+test "upstreams past the pool's bound are fine while they are disabled" {
+    // Only enabled upstreams become pool entries, so a long list with a small
+    // enabled subset is not near the bound at all.
+    var cfg = baseConfig();
+    cfg.upstreams = comptime blk: {
+        var list = manyUpstreams(pool.Pool.max_entries + 1)[0 .. pool.Pool.max_entries + 1].*;
+        for (list[1..]) |*server| server.enabled = false;
+        const frozen = list;
+        break :blk &frozen;
+    };
+    try expectClean(cfg);
+}
+
 test "error.BadUpstreamUrl on an unsupported scheme" {
     var cfg = baseConfig();
     cfg.upstreams = &.{.{ .url = "ftp://dns.example/" }};

src/local/forward_client.zig

@@ -109,6 +109,11 @@ pub const ForwardClient = struct {
 
     /// `.udp` resolvers send one datagram and fall back to TCP when the answer
     /// comes back with TC=1. `.tcp` resolvers skip straight to the TCP path.
+    ///
+    /// `read_timeout` bounds the WHOLE exchange, truncation fallback included:
+    /// the instant is computed once here and every blocking step inside runs
+    /// against it, so a truncated UDP answer followed by a stalled TCP retry
+    /// costs one budget rather than two.
     pub fn exchange(
         self: *ForwardClient,
         io: std.Io,
@@ -120,10 +125,22 @@ pub const ForwardClient = struct {
         if (response_buf.len == 0) return error.BufferTooSmall;
 
         self.stats.queries += 1;
-        return self.route(io, query, response_buf) catch |err| {
+        const expiry_at: std.Io.Clock.Timestamp = .fromNow(io, self.read_timeout);
+        // The outcome is deliberately discarded. A forward zone has exactly one
+        // configured resolver, so an expiry here is still that resolver failing
+        // to answer in time: `error.Timeout` is peer evidence, and the
+        // budget/peer distinction is upstream-pool policy.
+        var outcome: transport.RaceOutcome = .completed;
+        return transport.raceUntilTagged(io, expiry_at, &outcome, route, .{
+            self,
+            io,
+            query,
+            response_buf,
+            expiry_at,
+        }) catch |err| {
             switch (transport.group(err)) {
                 .peer_fault, .local_resource => self.stats.failures += 1,
-                .cancellation => {},
+                .cancellation, .budget_exhausted => {},
             }
             return err;
         };
@@ -134,11 +151,12 @@ pub const ForwardClient = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        expiry_at: std.Io.Clock.Timestamp,
     ) transport.ExchangeError![]u8 {
         if (self.resolver.scheme == .udp) {
-            if (try self.exchangeUdp(io, query, response_buf)) |reply| return reply;
+            if (try self.exchangeUdp(io, query, response_buf, expiry_at)) |reply| return reply;
         }
-        return self.exchangeTcp(io, query, response_buf);
+        return self.tcpOnce(io, query, response_buf);
     }
 
     /// `null` means the resolver set TC=1 and the caller must retry over TCP.
@@ -151,6 +169,7 @@ pub const ForwardClient = struct {
         io: std.Io,
         query: []const u8,
         response_buf: []u8,
+        expiry_at: std.Io.Clock.Timestamp,
     ) transport.ExchangeError!?[]u8 {
         const dest = self.destination();
         const local = wildcardFor(dest);
@@ -166,9 +185,10 @@ pub const ForwardClient = struct {
             return transport.mapPhase(err, error.SendFailed);
         };
 
-        // A deadline, not a duration: a discarded foreign datagram restarts the
-        // receive, and a duration would hand each retry the full budget again.
-        const deadline = (std.Io.Timeout{ .duration = self.read_timeout }).toDeadline(io);
+        // The exchange-wide instant, not a fresh duration: a discarded foreign
+        // datagram restarts the receive, and a duration would hand each retry
+        // the full budget again.
+        const deadline: std.Io.Timeout = .{ .deadline = expiry_at };
 
         while (true) {
             const msg = socket.receiveTimeout(io, response_buf, deadline) catch |err| switch (err) {
@@ -205,18 +225,11 @@ pub const ForwardClient = struct {
         }
     }
 
-    /// The read budget bounds the whole TCP exchange through
-    /// `transport.raceWithin`. `ConnectOptions.timeout` is never set: the
-    /// Threaded backend panics on it (Threaded.zig:12076).
-    fn exchangeTcp(
-        self: *ForwardClient,
-        io: std.Io,
-        query: []const u8,
-        response_buf: []u8,
-    ) transport.ExchangeError![]u8 {
-        return transport.raceWithin(io, self.read_timeout, tcpOnce, .{ self, io, query, response_buf });
-    }
-
+    /// Unbounded on its own: `exchange` runs it inside the exchange-wide race,
+    /// which is what cancels a stalled connect or read. It takes no budget of
+    /// its own, so a truncation fallback does not start a second one.
+    /// `ConnectOptions.timeout` is never set: the Threaded backend panics on it
+    /// (Threaded.zig:12076).
     fn tcpOnce(
         self: *ForwardClient,
         io: std.Io,
@@ -307,6 +320,11 @@ fn receiveFailure(stream_reader: *const net.Stream.Reader, err: anyerror) transp
 }
 
 const testing = std.testing;
+const build_options = @import("build_options");
+const name_mod = @import("../dns/name.zig");
+const packet = @import("../dns/packet.zig");
+const question = @import("../dns/question.zig");
+const types = @import("../dns/types.zig");
 
 fn testBuf() [min_frame_buf]u8 {
     return undefined;
@@ -467,3 +485,113 @@ test "a stashed stream error is preferred over the collapsed one" {
         receiveFailure(&stream_reader, error.EndOfStream),
     );
 }
+
+const one_budget_ms = 400;
+/// Late enough in the budget that a second, fresh budget for the TCP leg would
+/// be unmistakable in the elapsed time.
+const truncate_after_ms = 300;
+
+/// Answers the first datagram late in the budget with TC=1, which sends the
+/// client to TCP — where a listener that never accepts leaves it stalled.
+fn truncatingThenStallingResolver(io: std.Io, socket: *const net.Socket) void {
+    var buf: [2048]u8 = undefined;
+    const msg = socket.receive(io, &buf) catch return;
+    const request = packet.parse(msg.data) catch return;
+
+    (std.Io.Clock.Duration{
+        .raw = .fromMilliseconds(truncate_after_ms),
+        .clock = .awake,
+    }).sleep(io) catch return;
+
+    // The question has to be echoed: `transport.validateResponse` runs before
+    // the client reads the TC bit, so a bare header would come back as
+    // `BadResponse` and never reach the TCP fallback this case is about.
+    const q = packet.firstQuestion(request) orelse return;
+    var reply_buf: [512]u8 = undefined;
+    var b = packet.ResponseBuilder.init(&reply_buf, request.header, q) catch return;
+    const reply = b.finish();
+
+    var parsed = dns_header.parse(reply) catch return;
+    parsed.flags.tc = true;
+    dns_header.encode(parsed, reply[0..types.header_len]);
+    socket.send(io, &msg.from, reply) catch return;
+}
+
+fn testQuery(io: std.Io, buf: []u8) ![]const u8 {
+    var id_bytes: [2]u8 = undefined;
+    io.random(&id_bytes);
+    dns_header.encode(.{
+        .id = std.mem.readInt(u16, &id_bytes, .big),
+        .flags = .{
+            .rcode = .no_error,
+            .z = 0,
+            .ra = false,
+            .rd = true,
+            .tc = false,
+            .aa = false,
+            .opcode = .query,
+            .qr = false,
+        },
+        .qdcount = 1,
+        .ancount = 0,
+        .nscount = 0,
+        .arcount = 0,
+    }, buf[0..types.header_len]);
+
+    var w: std.Io.Writer = .fixed(buf[types.header_len..]);
+    try question.encode(.{
+        .name = try name_mod.fromText("nas.lan"),
+        .qtype = .a,
+        .qclass = .in,
+    }, &w);
+    return buf[0 .. types.header_len + w.buffered().len];
+}
+
+test "one budget covers the udp leg, the TC=1 fallback and the tcp leg" {
+    if (!build_options.integration) return error.SkipZigTest;
+
+    var threaded: std.Io.Threaded = .init(testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    const bind_address: net.IpAddress = try .parse("127.0.0.1", 0);
+    const socket = try bind_address.bind(io, .{ .mode = .dgram });
+    defer socket.close(io);
+    const port = socket.address.ip4.port;
+
+    // Bound but never accepted: the connect completes out of the kernel's
+    // backlog and the read then waits forever, which is the stall a second
+    // budget would be spent on.
+    const tcp_address: net.IpAddress = try .parse("127.0.0.1", port);
+    var tcp_listener = try tcp_address.listen(io, .{ .reuse_address = true });
+    defer tcp_listener.deinit(io);
+
+    var group: std.Io.Group = .init;
+    defer group.cancel(io);
+    try group.concurrent(io, truncatingThenStallingResolver, .{ io, &socket });
+
+    var url_buf: [64]u8 = undefined;
+    const url = try std.fmt.bufPrint(&url_buf, "udp://127.0.0.1:{d}", .{port});
+
+    var frame_buf: [min_frame_buf]u8 = undefined;
+    var fc: ForwardClient = .init(
+        try validate.parseResolver(url),
+        &frame_buf,
+        .{ .raw = .fromMilliseconds(one_budget_ms), .clock = .awake },
+    );
+
+    var query_buf: [types.header_len + types.max_name_len + 4]u8 = undefined;
+    const query = try testQuery(io, &query_buf);
+    var response_buf: [2048]u8 = undefined;
+
+    const started = std.Io.Clock.awake.now(io);
+    try testing.expectError(error.Timeout, fc.exchange(io, query, &response_buf));
+    const elapsed = started.durationTo(std.Io.Clock.awake.now(io)).nanoseconds;
+
+    // Two budgets would spend 300 ms on the UDP leg and then a fresh 400 ms on
+    // the stalled TCP leg. The bound sits between one budget and that sum, so
+    // the double-budget shape cannot pass.
+    try testing.expect(elapsed < @as(i96, one_budget_ms + truncate_after_ms / 2) * std.time.ns_per_ms);
+    try testing.expectEqual(@as(u64, 1), fc.stats.udp_truncated);
+    try testing.expectEqual(@as(u64, 1), fc.stats.failures);
+}

src/server/handler.zig

@@ -676,7 +676,10 @@ const Context = struct {
         const answer = client.exchange(ctx.io, ctx.query, ctx.response_buf) catch |err| {
             return switch (transport.group(err)) {
                 .cancellation => .drop,
-                .peer_fault, .local_resource => ctx.servFail(),
+                // A budget that ran out is SERVFAIL like any other failure: no
+                // rcode says "I gave up in time". It is not logged per query —
+                // `nxdns_upstream_budget_exhausted_total` is the record.
+                .peer_fault, .local_resource, .budget_exhausted => ctx.servFail(),
             };
         };
 
@@ -737,7 +740,13 @@ const Context = struct {
                 // the client is about to lose the socket anyway; the listener's
                 // own counters record the abandoned datagram.
                 .cancellation => return .drop,
-                .peer_fault, .local_resource => return ctx.servFail(),
+                // A budget that ran out is SERVFAIL like any other failure: no
+                // rcode says "I gave up in time". It is not logged per query —
+                // `nxdns_upstream_budget_exhausted_total` is the record — and
+                // the pool leaves `selected` unchanged, so the row still names
+                // the last attributable endpoint if there was one, and names
+                // none only when no attributable attempt happened.
+                .peer_fault, .local_resource, .budget_exhausted => return ctx.servFail(),
             };
         };
         bump(&ctx.handler.stats.queries);

src/server/resolver_integration_test.zig

@@ -176,7 +176,7 @@ const EntryStorage = struct {
             .priority = priority,
             .enabled = true,
             .health = .init,
-            .sem = .{ .permits = self.slots.len },
+            .admission = .{ .permits = self.slots.len },
             .reuse_recoveries = &self.recoveries,
         };
     }

src/storage/logger.zig

@@ -30,6 +30,7 @@
 //! `writer_failed`, so the loss is visible rather than silent.
 
 const std = @import("std");
+const Allocator = std.mem.Allocator;
 const builtin = @import("builtin");
 
 const db = @import("db.zig");
@@ -555,13 +556,17 @@ pub const Logger = struct {
     /// group it cancels for exactly that reason.
     ///
     /// `monitor` is the §11.6 gate. Null disables gating.
+    ///
+    /// `gpa` belongs to the `BatchWriter` for that writer's whole life; it
+    /// allocates the projection deltas of one batch and nothing else.
     pub fn runWriter(
         self: *Logger,
         io: std.Io,
+        gpa: Allocator,
         database: *db.Db,
         monitor: ?*disk_monitor.Monitor,
     ) std.Io.Cancelable!void {
-        var writer = queries_repo.BatchWriter.init(database) catch |err| {
+        var writer = queries_repo.BatchWriter.init(gpa, database) catch |err| {
             scope.warn("query logger: preparing the batch statements failed: {s}", .{@errorName(err)});
             // Without a writer there is no consumer, so leaving the queue open
             // would silently swallow every later entry.
@@ -1134,7 +1139,7 @@ test "an entry with every provenance field set survives the queue, toRow, insert
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -1466,6 +1471,7 @@ test "shutdown writes the batch the writer holds and the rest of the queue" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1502,7 +1508,7 @@ test "entries that arrive inside one window reach the database in one batch" {
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [16]Entry = undefined;
@@ -1559,6 +1565,7 @@ test "the writer holds an entry for the length of the flush interval" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1611,6 +1618,7 @@ test "a full batch flushes without waiting for the interval" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1658,6 +1666,7 @@ test "the writer's next cycle uses the interval set since its last one" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, null),
     });
@@ -1700,7 +1709,7 @@ test "a gated flush holds the batch until the disk recovers" {
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -1754,7 +1763,7 @@ test "a failing batch is dropped whole and the writer stays usable" {
         \\BEGIN SELECT RAISE(ABORT, 'refused'); END;
     );
 
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -1789,7 +1798,7 @@ test "a writer that cannot prepare closes the queue and counts every entry" {
 
     for (0..3) |i| logger.log(io, sampleEntry(@intCast(i), "early.example"));
 
-    try logger.runWriter(io, &database, null);
+    try logger.runWriter(io, testing.allocator, &database, null);
 
     try testing.expect(logger.writer_failed.load(.acquire));
     try testing.expectEqual(@as(u64, 3), logger.queries_dropped.load(.monotonic));
@@ -1842,6 +1851,7 @@ test "the gating episode opens on the gate, turns losing on a drop, and clears o
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -2023,6 +2033,7 @@ test "a canceled writer counts the batch it was holding" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -2072,6 +2083,7 @@ test "a disk-gated writer drops what it holds at shutdown instead of hanging" {
     var future = try io.concurrent(Logger.runWriter, .{
         &logger,
         io,
+        testing.allocator,
         &database,
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -2121,7 +2133,7 @@ test "an empty batch touches neither the database nor the counters" {
 
     var database = try openLog();
     defer database.close();
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -2155,7 +2167,7 @@ test "a dropped batch opens an error episode the next good batch closes" {
     try fx.init(io, 1000);
     defer fx.deinit();
 
-    var writer = try queries_repo.BatchWriter.init(&database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
     defer writer.deinit();
 
     var buf: [4]Entry = undefined;
@@ -2198,7 +2210,7 @@ test "a writer that cannot prepare leaves an episode no recovery path claims" {
     var logger: Logger = .init(.{}, &buf);
     logger.diagnostics = &fx.store;
 
-    try logger.runWriter(io, &database, null);
+    try logger.runWriter(io, testing.allocator, &database, null);
 
     try testing.expectEqualStrings("writer", try fx.text(
         "SELECT subject_key FROM operational_events WHERE resolved_at IS NULL",
@@ -2209,7 +2221,7 @@ test "a writer that cannot prepare leaves an episode no recovery path claims" {
 
     // The writer returned, so nothing can ever close this. A second run finds
     // the queue closed and adds no second episode.
-    try logger.runWriter(io, &database, null);
+    try logger.runWriter(io, testing.allocator, &database, null);
     try testing.expectEqual(
         @as(i64, 1),
         try fx.count("SELECT count(*) FROM operational_events WHERE resolved_at IS NULL"),

src/storage/logger_controller.zig

@@ -248,6 +248,7 @@ pub const Controller = struct {
         owned.writer = try io.concurrent(logger.Logger.runWriter, .{
             generation.logger,
             io,
+            opts.gpa,
             &owned.database,
             opts.monitor,
         });
@@ -434,7 +435,7 @@ pub const Controller = struct {
         errdefer generation.deinit(self.gpa);
         const owned = &generation.owned.?;
 
-        owned.writer = try io.concurrent(runParkedWriter, .{ generation, io, self.monitor });
+        owned.writer = try io.concurrent(runParkedWriter, .{ generation, io, self.gpa, self.monitor });
 
         // The statements are prepared before anything is published, so a
         // failure here is a refused settings change rather than a writer that
@@ -565,11 +566,12 @@ fn drain(generation: *Generation, io: std.Io) void {
 fn runParkedWriter(
     generation: *Generation,
     io: std.Io,
+    gpa: Allocator,
     monitor: ?*disk_monitor.Monitor,
 ) std.Io.Cancelable!void {
     const owned = &generation.owned.?;
 
-    var writer = queries_repo.BatchWriter.init(&owned.database) catch |err| {
+    var writer = queries_repo.BatchWriter.init(gpa, &owned.database) catch |err| {
         owned.prepare_error = err;
         owned.ready.set(io);
         return;

src/storage/phase6_integration_test.zig

@@ -144,7 +144,7 @@ fn awaitCount(counter: *const std.atomic.Value(u64), target: u64, limit: usize)
 }
 
 fn writeRows(database: *db.Db, timestamps: []const i64, domain: []const u8) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
 
     var rows: [16]queries_repo.Row = undefined;
@@ -208,6 +208,7 @@ test "S8 case 1: the logger writes a real querylog.db end to end" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
@@ -256,6 +257,7 @@ test "S8 case 2: a single entry reaches the file once the flush interval passes"
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
@@ -311,6 +313,7 @@ test "S8 case 3: a full queue drops the oldest entries and the newest survive" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, &monitor),
     });
@@ -359,6 +362,7 @@ test "S8 case 4: the privacy transforms reach the stored rows" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, null),
     });
@@ -459,6 +463,7 @@ test "S8 case 6: a critical disk gates the flushes and recovery releases them" {
     var future = try io.concurrent(logger.Logger.runWriter, .{
         &query_log,
         io,
+        testing.allocator,
         log_db.database(),
         @as(?*disk_monitor.Monitor, &monitor),
     });

src/storage/querylog_schema.zig

@@ -25,7 +25,7 @@ const log = std.log.scoped(.querylog_schema);
 /// PLAN §11.3, plus the coverage watermark of milestone 28. Multi-statement
 /// text — it goes through `db.Db.exec`, never through `prepare`.
 ///
-/// The trailing INSERT seeds `querylog_meta`, which is part of the schema
+/// The INSERT seeds `querylog_meta`, which is part of the schema
 /// rather than a later step: a `query_log` with no watermark beside it cannot
 /// answer whether an empty result means "no queries" or "no history", and every
 /// database this program reads from is created by executing this string.
@@ -36,6 +36,13 @@ const log = std.log.scoped(.querylog_schema);
 /// logged in the same second the file was created is not evidence that the
 /// second is completely covered, and the watermark's whole job is to be
 /// conservative. From there it only ever advances, in `queries_repo.pruneOlderThan`.
+///
+/// The four `bucket_*` tables are the Overview projections (milestone 36), on a
+/// 30-minute grain that divides every serving width the API offers. They carry
+/// no history of their own: they are born with the file and maintained in the
+/// same transaction as every insert and every prune, so SQLite's transaction is
+/// the only coherence mechanism there is. There is no backfill path — a file
+/// whose projections could disagree with its rows cannot exist.
 pub const ddl: [:0]const u8 =
     \\CREATE TABLE domains (
     \\    id INTEGER PRIMARY KEY,
@@ -78,6 +85,40 @@ pub const ddl: [:0]const u8 =
     \\);
     \\INSERT INTO querylog_meta (id, created_at, available_since)
     \\VALUES (1, unixepoch(), unixepoch() + 1);
+    \\
+    \\CREATE TABLE bucket_totals (
+    \\    bucket INTEGER PRIMARY KEY,
+    \\    queries INTEGER NOT NULL,
+    \\    blocked INTEGER NOT NULL,
+    \\    cached INTEGER NOT NULL,
+    \\    rt_sum INTEGER NOT NULL,     -- sum(response_time_us) over timed rows
+    \\    rt_count INTEGER NOT NULL    -- count(response_time_us)
+    \\) WITHOUT ROWID;
+    \\
+    \\CREATE TABLE bucket_clients (
+    \\    bucket INTEGER NOT NULL,
+    \\    client_ip TEXT NOT NULL,
+    \\    queries INTEGER NOT NULL,
+    \\    PRIMARY KEY (bucket, client_ip)
+    \\) WITHOUT ROWID;
+    \\
+    \\CREATE TABLE bucket_types (
+    \\    bucket INTEGER NOT NULL,
+    \\    qtype INTEGER NOT NULL,      -- -1 encodes a NULL qtype, losslessly
+    \\    count INTEGER NOT NULL,
+    \\    PRIMARY KEY (bucket, qtype)
+    \\) WITHOUT ROWID;
+    \\
+    \\CREATE TABLE bucket_routes (
+    \\    bucket INTEGER NOT NULL,
+    \\    route_kind TEXT NOT NULL,
+    \\    source_present INTEGER NOT NULL,  -- 0: source NULL; 1: source = source_text
+    \\    source_text TEXT NOT NULL,        -- '' when source_present = 0
+    \\    count INTEGER NOT NULL,
+    \\    PRIMARY KEY (bucket, route_kind, source_present, source_text),
+    \\    CHECK (source_present IN (0, 1)),
+    \\    CHECK (source_present = 1 OR source_text = '')
+    \\) WITHOUT ROWID;
 ;
 
 /// The fingerprint of an arbitrary DDL text. `tools/cut.zig` calls this at
@@ -324,13 +365,23 @@ test "ddl creates the query-log tables and every index" {
     try database.exec(ddl);
 
     try testing.expectEqual(
-        @as(i64, 3),
+        @as(i64, 7),
         try database.queryInt("SELECT count(*) FROM sqlite_schema WHERE type='table'"),
     );
+    // The three explicit indexes plus `domains.domain`'s autoindex, and
+    // nothing else: the four projection tables are WITHOUT ROWID, so each
+    // one's PRIMARY KEY *is* its storage rather than a second b-tree to keep
+    // in step on every insert.
+    try testing.expectEqual(
+        @as(i64, 4),
+        try database.queryInt("SELECT count(*) FROM sqlite_schema WHERE type='index'"),
+    );
     const objects = [_][]const u8{
         "domains",              "query_log",
         "idx_query_log_ts",     "idx_query_log_client",
         "idx_query_log_domain", "querylog_meta",
+        "bucket_totals",        "bucket_clients",
+        "bucket_types",         "bucket_routes",
     };
     for (objects) |name| {
         var stmt = try database.prepare("SELECT count(*) FROM sqlite_schema WHERE name = ?1");

src/storage/retention.zig

@@ -251,7 +251,7 @@ fn openLog() !db.Db {
 }
 
 fn writeRows(database: *db.Db, timestamps: []const i64) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
     var rows: [8]queries_repo.Row = undefined;
     for (timestamps, rows[0..timestamps.len]) |timestamp, *row| {

src/tests.zig

@@ -106,7 +106,7 @@ comptime {
     _ = @import("web/server_integration_test.zig");
     _ = @import("server/local_tables.zig");
     _ = @import("web/metrics.zig");
-    _ = @import("web/handlers/stats.zig");
+    _ = @import("web/handlers/overview.zig");
     _ = @import("web/handlers/queries.zig");
     _ = @import("web/handlers/diagnostics.zig");
     _ = @import("web/handlers/lookup.zig");

src/upstream/dot_client_integration_test.zig

@@ -458,7 +458,7 @@ test "a session the upstream closed is recovered by one redial and counted, not
         .priority = 10,
         .enabled = true,
         .health = .init,
-        .sem = .{ .permits = slots.len },
+        .admission = .{ .permits = slots.len },
         .reuse_recoveries = &fixture.recoveries,
     }};
     var pool: pool_mod.Pool = .init(&entries, .{

src/upstream/owner.zig

@@ -500,7 +500,7 @@ const Upstreams = struct {
                 .priority = server.priority,
                 .enabled = true,
                 .health = .init,
-                .sem = .{ .permits = entry_slots.len },
+                .admission = .{ .permits = entry_slots.len },
                 .reuse_recoveries = &self.recovery_counters[self.used],
             };
             self.used += 1;

src/upstream/transport.zig

@@ -1,4 +1,4 @@
-//! Shared vocabulary for every upstream client: endpoint URLs, the three
+//! Shared vocabulary for every upstream client: endpoint URLs, the four
 //! disjoint failure groups, the `Client` interface, and response validation.
 //!
 //! Everything here except the `Client` vtable is pure. `validateResponse` takes
@@ -8,8 +8,10 @@
 //!
 //! The failure classification is the reason this file exists. Health and
 //! backoff must count only what the peer did wrong: a local `OutOfMemory` says
-//! nothing about the upstream, and `error.Canceled` says nothing at all. The
-//! three error sets below are disjoint by construction and `group` switches
+//! nothing about the upstream, `error.Canceled` says nothing at all, and
+//! `error.BudgetExhausted` says the caller ran out of time before the peer was
+//! given its interval. The four error sets below are disjoint by construction
+//! and `group` switches
 //! over them exhaustively, so a new failure mode cannot silently land in the
 //! wrong bucket.
 
@@ -188,9 +190,15 @@ pub const LocalResource = error{
 
 pub const Cancellation = error{Canceled};
 
-pub const ExchangeError = PeerFault || LocalResource || Cancellation;
+/// The caller's own time ran out before any peer could be given the observation
+/// interval it was configured to get. Evidence about this process's budget, not
+/// about any endpoint, so it is never recorded against health — that is the
+/// whole reason it is not a `PeerFault`.
+pub const BudgetFault = error{BudgetExhausted};
 
-pub const Group = enum { peer_fault, local_resource, cancellation };
+pub const ExchangeError = PeerFault || LocalResource || Cancellation || BudgetFault;
+
+pub const Group = enum { peer_fault, local_resource, cancellation, budget_exhausted };
 
 /// Exhaustive switch over `ExchangeError` — no `else` arm. A new error member
 /// must break the build here, so no failure can silently land in the wrong
@@ -218,6 +226,8 @@ pub fn group(err: ExchangeError) Group {
         => .local_resource,
 
         error.Canceled => .cancellation,
+
+        error.BudgetExhausted => .budget_exhausted,
     };
 }
 
@@ -269,29 +279,29 @@ pub fn closeBlocked(io: std.Io, target: anytype) void {
     }
 }
 
-/// The payload of `f`'s return type, which `raceWithin` requires to be
+/// The payload of `f`'s return type, which the race harness requires to be
 /// `ExchangeError!T`. A raced function with any other error set would let a
 /// failure reach the pool without passing through `group`.
 fn RacedPayload(comptime f: anytype) type {
     const info = @typeInfo(@TypeOf(f));
-    if (info != .@"fn") @compileError("raceWithin needs a function, found " ++ @typeName(@TypeOf(f)));
+    if (info != .@"fn") @compileError("the race harness needs a function, found " ++ @typeName(@TypeOf(f)));
     const Return = info.@"fn".return_type orelse
-        @compileError("raceWithin needs a function with a concrete return type");
+        @compileError("the race harness needs a function with a concrete return type");
     const union_info = switch (@typeInfo(Return)) {
         .error_union => |u| u,
-        else => @compileError("raceWithin needs `ExchangeError!T`, found " ++ @typeName(Return)),
+        else => @compileError("the race harness needs `ExchangeError!T`, found " ++ @typeName(Return)),
     };
     if (union_info.error_set != ExchangeError)
-        @compileError("raceWithin needs `ExchangeError!T`, found " ++ @typeName(Return));
+        @compileError("the race harness needs `ExchangeError!T`, found " ++ @typeName(Return));
     return union_info.payload;
 }
 
 /// Runs `f(args...)` raced against `budget`, and cancels the loser.
 ///
 /// No stream read or write in 0.16.0 takes a timeout, so a deadline is a second
-/// task rather than a socket option. This is the one copy of that harness: the
-/// pool races an attempt and its whole failover loop through it, and the
-/// forward client races its TCP exchange.
+/// task rather than a socket option. `raceUntilTagged` is the one copy of that
+/// harness; this is the untagged wrapper for callers that own no deadline and
+/// only need "a bound on this one operation".
 ///
 /// `error.Timeout` means the budget won. A canceled sleep means the whole task
 /// is being torn down rather than the budget running out, so it stays
@@ -303,33 +313,69 @@ pub fn raceWithin(
     comptime f: anytype,
     args: anytype,
 ) ExchangeError!RacedPayload(f) {
-    const Outcome = union(enum) {
+    var outcome: RaceOutcome = .completed;
+    return raceUntilTagged(io, .fromNow(io, budget), &outcome, f, args);
+}
+
+/// Which side of the race ended the call.
+///
+/// `completed` means the raced operation itself returned — including when what
+/// it returned is `error.Timeout`, which is then the peer's own timeout and
+/// real evidence about that peer. `expired` means the caller's clock ran out
+/// with the operation still in flight, which is evidence about the budget only.
+pub const RaceOutcome = enum { completed, expired };
+
+/// `raceWithin` with the two timer origins told apart, and with an ABSOLUTE
+/// expiry rather than a duration.
+///
+/// The timestamp is the point of the whole function. A duration recomputed from
+/// a deadline and then slept re-anchors at "now", so every re-race drifts a
+/// little past the caller's real deadline and a truncated attempt is then
+/// indistinguishable from a full one. The caller that owns the deadline
+/// computes the instant once and passes it here.
+///
+/// `outcome` is written before this returns on both racing paths. It is left
+/// untouched when the race cannot start at all (`error.SystemResources`) or
+/// when the whole task is being canceled, since neither is an observation about
+/// this budget; callers initialize it to the value they want in those cases.
+pub fn raceUntilTagged(
+    io: std.Io,
+    expiry_at: std.Io.Clock.Timestamp,
+    outcome: *RaceOutcome,
+    comptime f: anytype,
+    args: anytype,
+) ExchangeError!RacedPayload(f) {
+    const Slot = union(enum) {
         raced: ExchangeError!RacedPayload(f),
         expiry: std.Io.Cancelable!void,
     };
 
-    var outcomes: [2]Outcome = undefined;
-    var race: std.Io.Select(Outcome) = .init(io, &outcomes);
+    var slots: [2]Slot = undefined;
+    var race: std.Io.Select(Slot) = .init(io, &slots);
     defer race.cancelDiscard();
 
     race.concurrent(.raced, f, args) catch |err| switch (err) {
         error.ConcurrencyUnavailable => return error.SystemResources,
     };
-    race.concurrent(.expiry, expire, .{ io, budget }) catch |err| switch (err) {
+    race.concurrent(.expiry, expire, .{ io, expiry_at }) catch |err| switch (err) {
         error.ConcurrencyUnavailable => return error.SystemResources,
     };
 
     switch (try race.await()) {
-        .raced => |result| return result,
+        .raced => |result| {
+            outcome.* = .completed;
+            return result;
+        },
         .expiry => |result| {
             try result;
+            outcome.* = .expired;
             return error.Timeout;
         },
     }
 }
 
-fn expire(io: std.Io, budget: std.Io.Clock.Duration) std.Io.Cancelable!void {
-    return budget.sleep(io);
+fn expire(io: std.Io, expiry_at: std.Io.Clock.Timestamp) std.Io.Cancelable!void {
+    return expiry_at.wait(io);
 }
 
 /// A thing that sends one DNS message and returns one validated DNS message.
@@ -347,13 +393,21 @@ pub const Client = struct {
     /// Returns a prefix of `response_buf`. The returned message has already
     /// passed `validateResponse` against `query`.
     ///
-    /// `selected` names the resolver the exchange used. An implementation
-    /// writes it *before* each attempt, never after, so a failed exchange still
-    /// names the last resolver it tried — a SERVFAIL row without its resolver
-    /// explains nothing. The slice must outlive the call; every implementation
-    /// borrows storage it owns for at least the query's duration. Callers
-    /// initialize it to null: a `null` after the call means no resolver was
-    /// reached at all.
+    /// `selected` names the resolver the exchange used. A single-endpoint
+    /// implementation (DoH, DoT, the forward client, test fakes) may write it
+    /// *before* each attempt: it has one resolver and records no health, so
+    /// "the one I tried" is an honest answer even for a failure, and a SERVFAIL
+    /// row without its resolver explains nothing.
+    ///
+    /// `Pool` is stricter, and documents the rule on `Pool.exchange`: it names
+    /// only endpoints whose outcome it recorded, so a query that ran out of
+    /// budget blames nobody and may leave this `null`. Both are within this
+    /// contract — the guarantee here is that a non-null value names a resolver
+    /// this exchange really used, never that a failure leaves one behind.
+    ///
+    /// The slice must outlive the call; every implementation borrows storage it
+    /// owns for at least the query's duration. Callers initialize it to null: a
+    /// `null` after the call means no resolver is being reported.
     pub fn exchange(
         self: Client,
         io: std.Io,
@@ -530,8 +584,8 @@ test "parse rejects a fragment" {
     try testing.expectError(error.BadUrl, Endpoint.parse("tls://dns.google#f"));
 }
 
-test "the three error groups are disjoint" {
-    const sets = .{ PeerFault, LocalResource, Cancellation };
+test "the four error groups are disjoint" {
+    const sets = .{ PeerFault, LocalResource, Cancellation, BudgetFault };
     inline for (sets, 0..) |a, i| {
         inline for (sets, 0..) |b, j| {
             if (i >= j) continue;
@@ -548,7 +602,8 @@ test "the three error groups are disjoint" {
     // member added to two sets at once cannot pass unnoticed.
     const total = @typeInfo(PeerFault).error_set.?.len +
         @typeInfo(LocalResource).error_set.?.len +
-        @typeInfo(Cancellation).error_set.?.len;
+        @typeInfo(Cancellation).error_set.?.len +
+        @typeInfo(BudgetFault).error_set.?.len;
     try testing.expectEqual(total, @typeInfo(ExchangeError).error_set.?.len);
 }
 
@@ -558,6 +613,7 @@ test "group classifies each member" {
     try testing.expectEqual(Group.local_resource, group(error.OutOfMemory));
     try testing.expectEqual(Group.local_resource, group(error.BufferTooSmall));
     try testing.expectEqual(Group.cancellation, group(error.Canceled));
+    try testing.expectEqual(Group.budget_exhausted, group(error.BudgetExhausted));
 }
 
 test "mapLocal folds only local and cancellation errors" {
@@ -641,6 +697,72 @@ test "raceWithin passes the raced task's own failure through" {
     );
 }
 
+test "raceUntilTagged tells a leaf Timeout apart from an expiry" {
+    var threaded: std.Io.Threaded = .init(testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    // The leaf's own timeout: it returned, so the peer really did time out and
+    // the outcome is `completed` even though the error is the same one an
+    // expiry produces.
+    var outcome: RaceOutcome = .expired;
+    const far: std.Io.Clock.Timestamp = .fromNow(io, .{ .raw = .fromSeconds(30), .clock = .awake });
+    try testing.expectError(
+        error.Timeout,
+        raceUntilTagged(io, far, &outcome, racedReply, .{
+            io, 0, @as(ExchangeError!usize, error.Timeout),
+        }),
+    );
+    try testing.expectEqual(RaceOutcome.completed, outcome);
+
+    // The expiry side, distinguishable only through the tag.
+    outcome = .completed;
+    const soon: std.Io.Clock.Timestamp = .fromNow(io, .{ .raw = .fromMilliseconds(20), .clock = .awake });
+    try testing.expectError(
+        error.Timeout,
+        raceUntilTagged(io, soon, &outcome, racedReply, .{
+            io, 30_000, @as(ExchangeError!usize, 7),
+        }),
+    );
+    try testing.expectEqual(RaceOutcome.expired, outcome);
+}
+
+test "raceUntilTagged tags a successful completion" {
+    var threaded: std.Io.Threaded = .init(testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    var outcome: RaceOutcome = .expired;
+    const far: std.Io.Clock.Timestamp = .fromNow(io, .{ .raw = .fromSeconds(30), .clock = .awake });
+    const len = try raceUntilTagged(io, far, &outcome, racedReply, .{
+        io, 0, @as(ExchangeError!usize, 7),
+    });
+    try testing.expectEqual(@as(usize, 7), len);
+    try testing.expectEqual(RaceOutcome.completed, outcome);
+}
+
+test "raceUntilTagged honours an expiry already in the past" {
+    var threaded: std.Io.Threaded = .init(testing.allocator, .{});
+    defer threaded.deinit();
+    const io = threaded.io();
+
+    // A deadline the caller has already spent: the expiry wins immediately
+    // rather than re-anchoring a duration at "now" and granting a fresh budget.
+    const past = std.Io.Clock.Timestamp.now(io, .awake)
+        .subDuration(.{ .raw = .fromSeconds(1), .clock = .awake });
+    var outcome: RaceOutcome = .completed;
+    const started = std.Io.Clock.awake.now(io);
+    try testing.expectError(
+        error.Timeout,
+        raceUntilTagged(io, past, &outcome, racedReply, .{
+            io, 30_000, @as(ExchangeError!usize, 7),
+        }),
+    );
+    try testing.expectEqual(RaceOutcome.expired, outcome);
+    const elapsed_ns = std.Io.Clock.awake.now(io).nanoseconds - started.nanoseconds;
+    try testing.expect(elapsed_ns < @as(i96, 5) * std.time.ns_per_s);
+}
+
 test "closeBlocked closes a target of either close shape" {
     // The two shapes the transports use: a socket or a plain stream, which
     // closes through the `Io`, and a `TlsStream`, which owns the one it was

src/web/coverage.zig

@@ -6,10 +6,9 @@
 //! complete for. Without that fact on the wire a chart draws a pruned week as a
 //! week of silence, which is the one reading that is certainly wrong.
 //!
-//! Three endpoints carry it — `/api/queries`, `/api/stats` and
-//! `/api/stats/timeseries` — and they judge it against their own effective
-//! lower bound: the client's `since` for the query log, the period's aligned
-//! window start for the two stats endpoints.
+//! Two endpoints carry it — `/api/queries` and `/api/overview` — and they judge
+//! it against their own effective lower bound: the client's `since` for the
+//! query log, the period's aligned window start for the overview.
 
 const std = @import("std");
 

src/web/handlers/overview.zig

@@ -0,0 +1,647 @@
+//! `GET /api/overview`: everything the Overview page draws, for one period, in
+//! one response.
+//!
+//! It replaces the five per-panel endpoints milestone 30 shipped. Those cost
+//! five scans of every raw row in the window and, being five requests, could
+//! only promise a shared *window* — queries logged between two of them moved
+//! one panel and not the other. One request over one read transaction promises
+//! a shared *snapshot*: the totals, the four breakdowns and the coverage
+//! watermark beside them all describe one database state, so the breakdowns sum
+//! to the totals for a reason and not by luck.
+//!
+//! Buckets are aligned to the UTC grid, not to the moment of the request. Every
+//! width divides a day, so flooring the current time to a multiple of the width
+//! puts each bucket on the same boundary a human reads off a clock, and two
+//! requests a second apart return the same bucket starts. The last bucket is
+//! the one in progress; it fills as the period runs.
+//!
+//! The aggregate runs on the web task's own query-log connection (m7 ruling
+//! 21), which every connection task shares. SQLite's serialized mode makes one
+//! call safe; it does not make a transaction safe, so `WebState.querylog_lock`
+//! covers the whole read and a second BEGIN can never land inside the first.
+//! The transaction is deferred, not `db.Tx`'s BEGIN IMMEDIATE, which would
+//! stall the logger and retention behind an HTTP response.
+//!
+//! The lock is released before the response is written: the body is already
+//! built in the request arena, and holding a database lock across a socket
+//! write would let one slow client serialize every other reader.
+
+const std = @import("std");
+
+const coverage = @import("../coverage.zig");
+const db = @import("../../storage/db.zig");
+const http_util = @import("../http_util.zig");
+const queries_repo = @import("../../storage/repositories/queries_repo.zig");
+const server = @import("../server.zig");
+
+const log = std.log.scoped(.web_overview);
+
+/// The four periods ruling 13 defines. The tag names are the wire spellings.
+pub const Period = enum {
+    @"1h",
+    @"24h",
+    @"7d",
+    @"30d",
+
+    pub fn parse(text: []const u8) ?Period {
+        return std.meta.stringToEnum(Period, text);
+    }
+
+    /// Ruling 13: 1h→60×1m, 24h→48×30m, 7d→168×1h, 30d→120×6h.
+    pub fn bucketSeconds(self: Period) u32 {
+        return switch (self) {
+            .@"1h" => 60,
+            .@"24h" => 30 * 60,
+            .@"7d" => 60 * 60,
+            .@"30d" => 6 * 60 * 60,
+        };
+    }
+
+    pub fn bucketCount(self: Period) u32 {
+        return switch (self) {
+            .@"1h" => 60,
+            .@"24h" => 48,
+            .@"7d" => 168,
+            .@"30d" => 120,
+        };
+    }
+
+    pub fn label(self: Period) []const u8 {
+        return @tagName(self);
+    }
+};
+
+pub const default_period: Period = .@"24h";
+
+/// The widest period's bucket count. Nothing here allocates by it any more —
+/// the repository returns arena slices — but it is the bound the response size
+/// argument rests on, and the assertion below is what keeps it true.
+pub const max_buckets = 168;
+
+comptime {
+    std.debug.assert(std.enums.values(Period).len == server.OverviewCache.slot_count);
+    for (std.enums.values(Period)) |period| {
+        std.debug.assert(period.bucketCount() <= max_buckets);
+        // The UTC alignment argument holds only while every width divides a day.
+        std.debug.assert(86_400 % period.bucketSeconds() == 0);
+    }
+}
+
+pub const Window = struct {
+    /// Inclusive, on the bucket grid.
+    since: i64,
+    /// Exclusive: the end of the bucket that `now` falls in.
+    until: i64,
+    bucket_seconds: u32,
+    bucket_count: u32,
+};
+
+pub fn window(period: Period, now_unix: i64) Window {
+    const width: i64 = period.bucketSeconds();
+    const count: i64 = period.bucketCount();
+    const until = @divFloor(now_unix, width) * width + width;
+    return .{
+        .since = until - width * count,
+        .until = until,
+        .bucket_seconds = period.bucketSeconds(),
+        .bucket_count = period.bucketCount(),
+    };
+}
+
+pub const Totals = struct {
+    queries: u64,
+    blocked: u64,
+    /// Distinct client addresses in the window.
+    clients: u64,
+    avg_response_time_us: ?i64,
+};
+
+pub const Body = struct {
+    period: []const u8,
+    since: i64,
+    until: i64,
+    bucket_seconds: u32,
+    totals: Totals,
+    buckets: []const queries_repo.Bucket,
+    clients: []const queries_repo.ClientSeries,
+    other: []const u64,
+    types: []const queries_repo.TypeCount,
+    routes: []const queries_repo.RouteCount,
+    /// Judged against `since`, which is the window this body reports on — so a
+    /// dashboard can say "history starts here" instead of charting a pruned
+    /// stretch as a quiet one.
+    coverage: coverage.Coverage,
+};
+
+pub fn handle(
+    state: *server.WebState,
+    io: std.Io,
+    request: *http_util.Request,
+) http_util.HandlerError!void {
+    const period = periodParam(request.query) catch return badPeriod(request);
+    const database = state.querylog_db orelse return unavailable(request);
+    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
+
+    const body = cachedBody(state, io, database, request.arena, period, span) catch |err| {
+        return internal(request, err);
+    };
+    return http_util.respondBytes(request, .ok, body, http_util.content_type_json, &.{});
+}
+
+/// The whole cache decision, start to finish, under one hold of
+/// `querylog_lock`. Returns bytes owned by `arena`, so the caller writes the
+/// socket with the lock already released.
+///
+/// `data_version` is sampled inside the lock and the rebuild is published under
+/// that same sample: a commit landing on another connection while this task
+/// builds moves the pragma, so the entry it installs is keyed to a version the
+/// next request will not ask for and that request rebuilds. Stale bytes under a
+/// current key are therefore not reachable. A failed build or a failed commit
+/// publishes nothing and leaves whatever the slot already held.
+fn cachedBody(
+    state: *server.WebState,
+    io: std.Io,
+    database: *db.Db,
+    arena: std.mem.Allocator,
+    period: Period,
+    span: Window,
+) db.Error![]const u8 {
+    state.querylog_lock.lockUncancelable(io);
+    defer state.querylog_lock.unlock(io);
+
+    const index = @intFromEnum(period);
+    const data_version = try database.queryInt("PRAGMA data_version");
+
+    if (state.overview_cache.get(index, span.until, data_version)) |cached| {
+        // The copy is what makes a later rebuild's free-and-replace safe: the
+        // response is written after the lock is gone, and by then these bytes
+        // may belong to nobody.
+        return arena.dupe(u8, cached);
+    }
+
+    const body = try buildBody(state, io, database, arena, period, span);
+    const owned = try state.gpa.dupe(u8, body);
+    state.overview_cache.put(state.gpa, index, span.until, data_version, owned);
+    return body;
+}
+
+/// One read transaction, one snapshot, one serialized body in `arena`. The
+/// caller holds `querylog_lock` and keeps holding it.
+fn buildBody(
+    state: *server.WebState,
+    io: std.Io,
+    database: *db.Db,
+    arena: std.mem.Allocator,
+    period: Period,
+    span: Window,
+) db.Error![]const u8 {
+    var scope = try server.QuerylogRead.openLocked(state, io, database);
+    errdefer scope.abort();
+    const data = try queries_repo.overview(
+        database,
+        arena,
+        span.since,
+        span.bucket_seconds,
+        span.bucket_count,
+    );
+    const window_coverage = try coverage.read(database, span.since);
+    try scope.commit();
+
+    var allocating: std.Io.Writer.Allocating = .init(arena);
+    errdefer allocating.deinit();
+    std.json.Stringify.value(Body{
+        .period = period.label(),
+        .since = span.since,
+        .until = span.until,
+        .bucket_seconds = span.bucket_seconds,
+        .totals = .{
+            .queries = data.totals.queries,
+            .blocked = data.totals.blocked,
+            .clients = data.totals.distinct_clients,
+            .avg_response_time_us = data.totals.avg_response_time_us,
+        },
+        .buckets = data.buckets,
+        .clients = data.clients.clients,
+        .other = data.clients.other,
+        .types = data.types,
+        .routes = data.routes,
+        .coverage = window_coverage,
+    }, .{}, &allocating.writer) catch return error.OutOfMemory;
+    return allocating.written();
+}
+
+pub const PeriodError = error{BadPeriod};
+
+/// An absent `period` is the default; anything else it cannot read is a 400,
+/// never a silent fallback — a typo must not return a window nobody asked for.
+fn periodParam(query: []const u8) PeriodError!Period {
+    var buf: [8]u8 = undefined;
+    const found = http_util.queryValue(query, "period", &buf) catch return error.BadPeriod;
+    const text = found orelse return default_period;
+    return Period.parse(text) orelse error.BadPeriod;
+}
+
+fn badPeriod(request: *http_util.Request) http_util.HandlerError!void {
+    return http_util.respondError(request, .bad_request, "period must be one of 1h, 24h, 7d, 30d");
+}
+
+fn unavailable(request: *http_util.Request) http_util.HandlerError!void {
+    return http_util.respondError(request, .service_unavailable, "query log unavailable");
+}
+
+/// The one thing this file logs. A failed aggregate is a fault in the box, not
+/// a property of the request, and the client is told nothing beyond "internal
+/// error" (ruling 8, PLAN §19).
+fn internal(request: *http_util.Request, err: db.Error) http_util.HandlerError!void {
+    log.warn("overview failed: {s}", .{@errorName(err)});
+    return http_util.respondError(request, .internal_server_error, "internal error");
+}
+
+// ---------------------------------------------------------------------------
+// tests
+// ---------------------------------------------------------------------------
+
+const querylog_schema = @import("../../storage/querylog_schema.zig");
+const testing = std.testing;
+
+test "the period grammar accepts exactly the four spellings" {
+    try testing.expectEqual(Period.@"1h", Period.parse("1h").?);
+    try testing.expectEqual(Period.@"24h", Period.parse("24h").?);
+    try testing.expectEqual(Period.@"7d", Period.parse("7d").?);
+    try testing.expectEqual(Period.@"30d", Period.parse("30d").?);
+    try testing.expectEqual(@as(?Period, null), Period.parse("12h"));
+    try testing.expectEqual(@as(?Period, null), Period.parse("1H"));
+    try testing.expectEqual(@as(?Period, null), Period.parse(""));
+}
+
+test "an absent period defaults and a bad one is rejected" {
+    try testing.expectEqual(default_period, try periodParam(""));
+    try testing.expectEqual(default_period, try periodParam("limit=5"));
+    try testing.expectEqual(Period.@"7d", try periodParam("period=7d"));
+    try testing.expectError(error.BadPeriod, periodParam("period=12h"));
+    try testing.expectError(error.BadPeriod, periodParam("period=%2"));
+    // Longer than any spelling: rejected rather than truncated to "1h".
+    try testing.expectError(error.BadPeriod, periodParam("period=1hhhhhhhhhh"));
+}
+
+test "each period spans its own bucket width times its count" {
+    for (std.enums.values(Period)) |period| {
+        const span = window(period, 1_700_000_000);
+        const width: i64 = period.bucketSeconds();
+        try testing.expectEqual(width * @as(i64, period.bucketCount()), span.until - span.since);
+    }
+}
+
+test "the window sits on the UTC grid and ends with the bucket in progress" {
+    // 2023-11-14T22:13:20Z, which is not on any bucket boundary.
+    const now: i64 = 1_700_000_000;
+    const span = window(.@"24h", now);
+
+    try testing.expectEqual(@as(i64, 0), @rem(span.since, 1800));
+    try testing.expectEqual(@as(i64, 0), @rem(span.until, 1800));
+    try testing.expect(span.until > now);
+    try testing.expect(span.until - now <= 1800);
+    try testing.expectEqual(@as(u32, 48), span.bucket_count);
+}
+
+test "two requests inside one bucket see the same window" {
+    // A bucket boundary, so the offsets below stay inside one minute.
+    const boundary: i64 = 1_700_000_000 - @rem(1_700_000_000, 60);
+    const first = window(.@"1h", boundary);
+    const second = window(.@"1h", boundary + 59);
+    try testing.expectEqual(first.since, second.since);
+    try testing.expectEqual(first.until, second.until);
+
+    const next = window(.@"1h", boundary + 60);
+    try testing.expectEqual(first.until + 60, next.until);
+}
+
+test "a timestamp exactly on a boundary starts a new bucket" {
+    const span = window(.@"7d", 1_700_000_000 - 1_700_000_000 % 3600);
+    try testing.expectEqual(@as(i64, 0), @rem(span.since, 3600));
+    try testing.expectEqual(@as(u32, 168), span.bucket_count);
+}
+
+test "every period's window is a window the repository will serve" {
+    // The projection path needs the window start on the 30-minute grid and the
+    // width a whole number of grains; `window` is the only producer of either.
+    for (std.enums.values(Period)) |period| {
+        const span = window(period, 1_700_000_123);
+        if (span.bucket_seconds < 1800) continue;
+        try testing.expectEqual(@as(i64, 0), @mod(span.since, 1800));
+        try testing.expectEqual(@as(u32, 0), span.bucket_seconds % 1800);
+    }
+}
+
+fn openLog() !db.Db {
+    var database = try db.Db.open(":memory:", .{ .mode = .memory });
+    errdefer database.close();
+    try db.applyPragmas(&database, .{});
+    try database.exec(querylog_schema.ddl);
+    return database;
+}
+
+fn writeRow(writer: *queries_repo.BatchWriter, timestamp: i64, blocked: bool, cached: ?bool) !void {
+    const rows = [_]queries_repo.Row{.{
+        .timestamp = timestamp,
+        .domain = "example.com",
+        .client_ip = "192.0.2.10",
+        .qtype = 1,
+        .qclass = 1,
+        .rcode = 0,
+        .blocked = blocked,
+        .response_time_us = 1000,
+        .cache_hit = cached,
+        .upstream = null,
+        .group_id = 1,
+        .group_name = "default",
+        .policy_action = if (blocked) .block else .allow,
+        .policy_reason = if (blocked) .blocklist_domain else .no_match,
+        .matched = null,
+        .source_id = null,
+        .source_name = null,
+        .cname_target = null,
+        .safe_search_target = null,
+        .route_kind = if (blocked) .blocked else .upstream,
+        .forward_zone = null,
+    }};
+    try writer.writeBatch(&rows);
+}
+
+test "one overview answers totals and buckets that agree over the same window" {
+    var database = try openLog();
+    defer database.close();
+
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, &database);
+    defer writer.deinit();
+    // One row in the first bucket, two in the last, one just outside.
+    try writeRow(&writer, span.since, false, false);
+    try writeRow(&writer, span.until - 1, true, false);
+    try writeRow(&writer, span.until - 2, false, true);
+    try writeRow(&writer, span.since - 1, false, false);
+
+    const data = try queries_repo.overview(
+        &database,
+        arena_state.allocator(),
+        span.since,
+        span.bucket_seconds,
+        span.bucket_count,
+    );
+
+    try testing.expectEqual(@as(u64, 3), data.totals.queries);
+    try testing.expectEqual(@as(u64, 1), data.totals.blocked);
+    try testing.expectEqual(@as(u64, 1), data.totals.distinct_clients);
+    try testing.expectEqual(@as(?i64, 1000), data.totals.avg_response_time_us);
+
+    try testing.expectEqual(@as(usize, 60), data.buckets.len);
+    var summed: u64 = 0;
+    var blocked: u64 = 0;
+    for (data.buckets) |bucket| {
+        summed += bucket.queries;
+        blocked += bucket.blocked;
+    }
+    try testing.expectEqual(data.totals.queries, summed);
+    try testing.expectEqual(data.totals.blocked, blocked);
+
+    try testing.expectEqual(span.since, data.buckets[0].ts);
+    try testing.expectEqual(@as(u64, 1), data.buckets[0].queries);
+    try testing.expectEqual(@as(u64, 2), data.buckets[59].queries);
+    try testing.expectEqual(span.until - span.bucket_seconds, data.buckets[59].ts);
+}
+
+test "an empty window reports zeros with a null mean" {
+    var database = try openLog();
+    defer database.close();
+
+    var arena_state: std.heap.ArenaAllocator = .init(testing.allocator);
+    defer arena_state.deinit();
+
+    const span = window(.@"30d", 1_700_000_000);
+    const data = try queries_repo.overview(
+        &database,
+        arena_state.allocator(),
+        span.since,
+        span.bucket_seconds,
+        span.bucket_count,
+    );
+
+    try testing.expectEqual(@as(u64, 0), data.totals.queries);
+    try testing.expectEqual(@as(?i64, null), data.totals.avg_response_time_us);
+    try testing.expectEqual(@as(usize, 120), data.buckets.len);
+    for (data.buckets) |bucket| try testing.expectEqual(@as(u64, 0), bucket.queries);
+    // `other` is bucket-count sized even here: a chart must never have to
+    // invent the residual series.
+    try testing.expectEqual(@as(usize, 120), data.clients.other.len);
+}
+
+test "the cache serves one period's bytes and rebuilds when the key moves" {
+    const gpa = testing.allocator;
+    var cache: server.OverviewCache = .{};
+    defer cache.deinit(gpa);
+
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(0, 100, 7));
+
+    cache.put(gpa, 0, 100, 7, try gpa.dupe(u8, "first"));
+    try testing.expectEqualStrings("first", cache.get(0, 100, 7).?);
+    // A different period, a rolled window and a bumped data version are three
+    // different keys, and none of them hits.
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(1, 100, 7));
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(0, 101, 7));
+    try testing.expectEqual(@as(?[]const u8, null), cache.get(0, 100, 8));
+
+    // A rebuild replaces the entry and frees the old body; the leak checker in
+    // `testing.allocator` is the assertion.
+    cache.put(gpa, 0, 100, 8, try gpa.dupe(u8, "second"));
+    try testing.expectEqualStrings("second", cache.get(0, 100, 8).?);
+}
+
+/// Two connections onto one file, which is the only arrangement in which
+/// `PRAGMA data_version` moves at all: it reports commits by *other*
+/// connections, so an in-memory database — where there is no other connection —
+/// could never witness the invalidation these tests are about.
+const CacheFixture = struct {
+    threaded: std.Io.Threaded,
+    tmp: std.testing.TmpDir,
+    /// The web task's connection, the one the cache is keyed on.
+    reader: db.Db,
+    /// Stands in for the logger and for retention.
+    writer: db.Db,
+    state: server.WebState,
+    arena_state: std.heap.ArenaAllocator,
+
+    fn init(self: *CacheFixture, gpa: std.mem.Allocator) !void {
+        self.threaded = .init(gpa, .{});
+        errdefer self.threaded.deinit();
+        self.tmp = std.testing.tmpDir(.{});
+        errdefer self.tmp.cleanup();
+
+        var path_buf: [256]u8 = undefined;
+        const path = try std.fmt.bufPrintZ(
+            &path_buf,
+            ".zig-cache/tmp/{s}/querylog.db",
+            .{self.tmp.sub_path},
+        );
+
+        self.writer = try db.Db.open(path, .{ .mode = .read_write_create });
+        errdefer self.writer.close();
+        try db.applyPragmas(&self.writer, .{});
+        try self.writer.exec(querylog_schema.ddl);
+        // The DDL stamps `created_at` from the wall clock, and the watermark
+        // with it. These tests work over a fixed 2023 window, so a 2026
+        // watermark would report every one of them as uncovered and the prune
+        // below would not move it.
+        try self.writer.exec(
+            "UPDATE querylog_meta SET created_at = 1600000000, available_since = 1600000000 WHERE id = 1",
+        );
+
+        self.reader = try db.Db.open(path, .{ .mode = .read_write_existing });
+        errdefer self.reader.close();
+        try db.applyPragmas(&self.reader, .{});
+
+        self.state = .{ .gpa = gpa, .querylog_db = &self.reader };
+        self.arena_state = .init(gpa);
+    }
+
+    fn deinit(self: *CacheFixture) void {
+        self.arena_state.deinit();
+        self.state.overview_cache.deinit(self.state.gpa);
+        self.reader.close();
+        self.writer.close();
+        self.tmp.cleanup();
+        self.threaded.deinit();
+    }
+
+    fn io(self: *CacheFixture) std.Io {
+        return self.threaded.io();
+    }
+
+    fn body(self: *CacheFixture, period: Period, span: Window) db.Error![]const u8 {
+        return cachedBody(
+            &self.state,
+            self.io(),
+            &self.reader,
+            self.arena_state.allocator(),
+            period,
+            span,
+        );
+    }
+
+    /// One row through the writer connection, which commits and so moves the
+    /// reader's `PRAGMA data_version`.
+    fn log(self: *CacheFixture, timestamp: i64) !void {
+        var batch = try queries_repo.BatchWriter.init(self.state.gpa, &self.writer);
+        defer batch.deinit();
+        try writeRow(&batch, timestamp, false, false);
+    }
+};
+
+test "a cache hit answers without opening a read transaction" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+
+    const first = try fx.body(.@"1h", span);
+    try testing.expect(first.len > 0);
+
+    // A hit never reaches the database, so a fault armed on the next commit is
+    // never spent — and the bytes are the stored ones, not a rebuild's.
+    db.read_tx_faults.failNextCommit();
+    const second = try fx.body(.@"1h", span);
+    try testing.expectEqualStrings(first, second);
+    try testing.expect(first.ptr != second.ptr);
+
+    // Spend the armed fault so it cannot leak into a later test. A miss does
+    // reach the database, so this one trips.
+    db.read_tx_faults.beginCapture();
+    defer _ = db.read_tx_faults.endCapture();
+    try testing.expectError(error.Internal, fx.body(.@"24h", window(.@"24h", 1_700_000_000)));
+}
+
+test "a commit on another connection invalidates the cached body" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+    const before = try fx.body(.@"1h", span);
+
+    try fx.log(span.since + 20);
+    const after = try fx.body(.@"1h", span);
+    try testing.expect(!std.mem.eql(u8, before, after));
+    try testing.expect(std.mem.containsAtLeast(u8, after, 1, "\"queries\":2"));
+}
+
+test "a retention prune through another connection replaces the body and the watermark" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+    const before = try fx.body(.@"1h", span);
+    try testing.expect(std.mem.containsAtLeast(u8, before, 1, "\"queries\":1"));
+
+    // Past the whole window: the row goes and the watermark advances, and both
+    // halves of the response must move together.
+    _ = try queries_repo.pruneOlderThan(&fx.writer, span.until);
+    const after = try fx.body(.@"1h", span);
+    try testing.expect(std.mem.containsAtLeast(u8, after, 1, "\"queries\":0"));
+
+    var watermark_buf: [64]u8 = undefined;
+    const watermark = try std.fmt.bufPrint(
+        &watermark_buf,
+        "\"available_since\":{d}",
+        .{span.until},
+    );
+    try testing.expect(std.mem.containsAtLeast(u8, after, 1, watermark));
+}
+
+test "a window roll rebuilds even with the data unchanged" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const now: i64 = 1_700_000_000;
+    const first = try fx.body(.@"1h", window(.@"1h", now));
+    // One bucket later: same data, a different window, and so a different body.
+    const rolled = try fx.body(.@"1h", window(.@"1h", now + 60));
+    try testing.expect(!std.mem.eql(u8, first, rolled));
+
+    // The slot now holds the rolled window; asking for the earlier one again
+    // rebuilds rather than answering from a key that no longer matches.
+    const again = try fx.body(.@"1h", window(.@"1h", now));
+    try testing.expectEqualStrings(first, again);
+}
+
+test "a failed commit installs nothing and leaves the stored entry alone" {
+    var fx: CacheFixture = undefined;
+    try fx.init(testing.allocator);
+    defer fx.deinit();
+
+    const span = window(.@"1h", 1_700_000_000);
+    try fx.log(span.since + 10);
+    const stored = try fx.body(.@"1h", span);
+
+    // A commit that fails on a rebuild: the key has moved, so this is a miss.
+    try fx.log(span.since + 20);
+    db.read_tx_faults.failNextCommit();
+    db.read_tx_faults.beginCapture();
+    try testing.expectError(error.Internal, fx.body(.@"1h", span));
+    try testing.expectEqual(@as(usize, 1), db.read_tx_faults.endCapture());
+
+    // Nothing was published under the new key: the next request rebuilds and
+    // sees the second row, rather than being served the failed read's work or
+    // the first row's body under a key that now describes two.
+    const rebuilt = try fx.body(.@"1h", span);
+    try testing.expect(!std.mem.eql(u8, stored, rebuilt));
+    try testing.expect(std.mem.containsAtLeast(u8, rebuilt, 1, "\"queries\":2"));
+}

src/web/handlers/queries.zig

@@ -281,7 +281,7 @@ fn openLog() !db.Db {
 /// upstream answer carries one. A fixture that broke those ties would let a
 /// serializer regression pass here and fail on real rows.
 fn seed(database: *db.Db, count: usize) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
     var rows: [16]queries_repo.Row = undefined;
     for (rows[0..count], 0..) |*row, i| {

src/web/handlers/stats.zig

@@ -1,574 +0,0 @@
-//! The five period endpoints: `GET /api/stats` and `/api/stats/timeseries`
-//! (ruling 13), and `/api/stats/types`, `/api/stats/routes` and
-//! `/api/stats/clients` (milestone 30).
-//!
-//! One period grammar, four widths, and one window shared by all five: a
-//! request for the same period gets the same `since`/`until` from every
-//! endpoint, so the totals describe exactly the span the charts draw rather
-//! than a neighbouring one.
-//!
-//! That is window coherence, not identical counts. Each endpoint is its own
-//! request against its own snapshot, so queries logged between two of them move
-//! one panel and not the other. Only a box with nothing writing to it — a test
-//! — can expect the breakdowns to sum to the totals exactly.
-//!
-//! Buckets are aligned to the UTC grid, not to the moment of the request. Every
-//! width divides a day, so flooring the current time to a multiple of the width
-//! puts each bucket on the same boundary a human reads off a clock, and two
-//! requests a second apart return the same bucket starts. The last bucket is
-//! the one in progress; it fills as the period runs.
-//!
-//! The aggregates run on the web task's own query-log connection (m7 ruling 21),
-//! which every connection task shares. SQLite's serialized mode makes one call
-//! safe; it does not make a transaction safe, so `WebState.querylog_lock` covers
-//! the whole read and a second BEGIN can never land inside the first. Each
-//! response takes one deferred read transaction, so its aggregate and the
-//! `coverage` beside it describe one database state: retention cannot prune
-//! between them and hand a client pre-prune rows tagged with a post-prune
-//! watermark. Deferred, not `db.Tx`'s BEGIN IMMEDIATE, which would stall the
-//! logger and retention behind an HTTP response.
-//!
-//! The lock is released before the response is written: the body is already
-//! built in the request arena, and holding a database lock across a socket
-//! write would let one slow client serialize every other reader.
-
-const std = @import("std");
-
-const coverage = @import("../coverage.zig");
-const db = @import("../../storage/db.zig");
-const http_util = @import("../http_util.zig");
-const queries_repo = @import("../../storage/repositories/queries_repo.zig");
-const server = @import("../server.zig");
-
-const log = std.log.scoped(.web_stats);
-
-/// The four periods ruling 13 defines. The tag names are the wire spellings.
-pub const Period = enum {
-    @"1h",
-    @"24h",
-    @"7d",
-    @"30d",
-
-    pub fn parse(text: []const u8) ?Period {
-        return std.meta.stringToEnum(Period, text);
-    }
-
-    /// Ruling 13: 1h→60×1m, 24h→48×30m, 7d→168×1h, 30d→120×6h.
-    pub fn bucketSeconds(self: Period) u32 {
-        return switch (self) {
-            .@"1h" => 60,
-            .@"24h" => 30 * 60,
-            .@"7d" => 60 * 60,
-            .@"30d" => 6 * 60 * 60,
-        };
-    }
-
-    pub fn bucketCount(self: Period) u32 {
-        return switch (self) {
-            .@"1h" => 60,
-            .@"24h" => 48,
-            .@"7d" => 168,
-            .@"30d" => 120,
-        };
-    }
-
-    pub fn label(self: Period) []const u8 {
-        return @tagName(self);
-    }
-};
-
-pub const default_period: Period = .@"24h";
-
-/// The widest period's bucket count, so one stack array serves every request.
-pub const max_buckets = 168;
-
-comptime {
-    for (std.enums.values(Period)) |period| {
-        std.debug.assert(period.bucketCount() <= max_buckets);
-        // The UTC alignment argument holds only while every width divides a day.
-        std.debug.assert(86_400 % period.bucketSeconds() == 0);
-    }
-}
-
-pub const Window = struct {
-    /// Inclusive, on the bucket grid.
-    since: i64,
-    /// Exclusive: the end of the bucket that `now` falls in.
-    until: i64,
-    bucket_seconds: u32,
-    bucket_count: u32,
-};
-
-pub fn window(period: Period, now_unix: i64) Window {
-    const width: i64 = period.bucketSeconds();
-    const count: i64 = period.bucketCount();
-    const until = @divFloor(now_unix, width) * width + width;
-    return .{
-        .since = until - width * count,
-        .until = until,
-        .bucket_seconds = period.bucketSeconds(),
-        .bucket_count = period.bucketCount(),
-    };
-}
-
-pub const TotalsBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    queries: u64,
-    blocked: u64,
-    clients: u64,
-    avg_response_time_us: ?i64,
-    /// Judged against `since`, which is the window this body reports on — so a
-    /// dashboard can say "history starts here" instead of charting a pruned
-    /// stretch as a quiet one.
-    coverage: coverage.Coverage,
-};
-
-pub const TimeseriesBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    bucket_seconds: u32,
-    buckets: []const queries_repo.Bucket,
-    coverage: coverage.Coverage,
-};
-
-pub const TypesBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    types: []const queries_repo.TypeCount,
-    coverage: coverage.Coverage,
-};
-
-pub const RoutesBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    routes: []const queries_repo.RouteCount,
-    coverage: coverage.Coverage,
-};
-
-pub const ClientsBody = struct {
-    period: []const u8,
-    since: i64,
-    until: i64,
-    bucket_seconds: u32,
-    clients: []const queries_repo.ClientSeries,
-    other: []const u64,
-    coverage: coverage.Coverage,
-};
-
-/// Everything one response reads from the query log, so the caller can end the
-/// transaction and drop the lock before it serializes anything.
-fn Read(comptime T: type) type {
-    return struct {
-        data: T,
-        coverage: coverage.Coverage,
-    };
-}
-
-const ReadScope = server.QuerylogRead;
-
-fn readTotals(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    span: Window,
-) db.Error!Read(queries_repo.StatsTotals) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const read: Read(queries_repo.StatsTotals) = .{
-        .data = try queries_repo.statsTotals(database, span.since, span.until),
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readTimeseries(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    span: Window,
-    out: []queries_repo.Bucket,
-) db.Error!Read(usize) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const read: Read(usize) = .{
-        .data = try queries_repo.timeseries(database, span.since, span.bucket_seconds, out),
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readTypes(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    arena: std.mem.Allocator,
-    span: Window,
-) db.Error!Read([]const queries_repo.TypeCount) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const list = try queries_repo.statsTypes(database, arena, span.since, span.until);
-    const read: Read([]const queries_repo.TypeCount) = .{
-        .data = list.items,
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readRoutes(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    arena: std.mem.Allocator,
-    span: Window,
-) db.Error!Read([]const queries_repo.RouteCount) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const list = try queries_repo.statsRoutes(database, arena, span.since, span.until);
-    const read: Read([]const queries_repo.RouteCount) = .{
-        .data = list.items,
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-fn readClients(
-    state: *server.WebState,
-    io: std.Io,
-    database: *db.Db,
-    arena: std.mem.Allocator,
-    span: Window,
-) db.Error!Read(queries_repo.ClientsBreakdown) {
-    var scope = try ReadScope.open(state, io, database);
-    errdefer scope.abort();
-    const read: Read(queries_repo.ClientsBreakdown) = .{
-        .data = try queries_repo.statsClients(
-            database,
-            arena,
-            span.since,
-            span.bucket_seconds,
-            span.bucket_count,
-        ),
-        .coverage = try coverage.read(database, span.since),
-    };
-    try scope.commit();
-    return read;
-}
-
-pub fn totals(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readTotals(state, io, database, span) catch |err| {
-        return internal(request, "stats totals", err);
-    };
-
-    return http_util.respondJson(request, .ok, TotalsBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .queries = read.data.queries,
-        .blocked = read.data.blocked,
-        .clients = read.data.distinct_clients,
-        .avg_response_time_us = read.data.avg_response_time_us,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn timeseries(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    var buckets: [max_buckets]queries_repo.Bucket = undefined;
-    const out = buckets[0..span.bucket_count];
-    const read = readTimeseries(state, io, database, span, out) catch |err| {
-        return internal(request, "stats timeseries", err);
-    };
-
-    return http_util.respondJson(request, .ok, TimeseriesBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .bucket_seconds = span.bucket_seconds,
-        .buckets = out[0..read.data],
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn types(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readTypes(state, io, database, request.arena, span) catch |err| {
-        return internal(request, "stats types", err);
-    };
-
-    return http_util.respondJson(request, .ok, TypesBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .types = read.data,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn routes(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readRoutes(state, io, database, request.arena, span) catch |err| {
-        return internal(request, "stats routes", err);
-    };
-
-    return http_util.respondJson(request, .ok, RoutesBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .routes = read.data,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub fn clients(
-    state: *server.WebState,
-    io: std.Io,
-    request: *http_util.Request,
-) http_util.HandlerError!void {
-    const period = periodParam(request.query) catch return badPeriod(request);
-    const database = state.querylog_db orelse return unavailable(request);
-    const span = window(period, std.Io.Clock.real.now(io).toSeconds());
-
-    const read = readClients(state, io, database, request.arena, span) catch |err| {
-        return internal(request, "stats clients", err);
-    };
-
-    return http_util.respondJson(request, .ok, ClientsBody{
-        .period = period.label(),
-        .since = span.since,
-        .until = span.until,
-        .bucket_seconds = span.bucket_seconds,
-        .clients = read.data.clients,
-        .other = read.data.other,
-        .coverage = read.coverage,
-    }, &.{});
-}
-
-pub const PeriodError = error{BadPeriod};
-
-/// An absent `period` is the default; anything else it cannot read is a 400,
-/// never a silent fallback — a typo must not return a window nobody asked for.
-fn periodParam(query: []const u8) PeriodError!Period {
-    var buf: [8]u8 = undefined;
-    const found = http_util.queryValue(query, "period", &buf) catch return error.BadPeriod;
-    const text = found orelse return default_period;
-    return Period.parse(text) orelse error.BadPeriod;
-}
-
-fn badPeriod(request: *http_util.Request) http_util.HandlerError!void {
-    return http_util.respondError(request, .bad_request, "period must be one of 1h, 24h, 7d, 30d");
-}
-
-fn unavailable(request: *http_util.Request) http_util.HandlerError!void {
-    return http_util.respondError(request, .service_unavailable, "query log unavailable");
-}
-
-/// The one thing this file logs. A failed aggregate is a fault in the box, not
-/// a property of the request, and the client is told nothing beyond "internal
-/// error" (ruling 8, PLAN §19).
-fn internal(
-    request: *http_util.Request,
-    what: []const u8,
-    err: db.Error,
-) http_util.HandlerError!void {
-    log.warn("{s} failed: {s}", .{ what, @errorName(err) });
-    return http_util.respondError(request, .internal_server_error, "internal error");
-}
-
-// ---------------------------------------------------------------------------
-// tests
-// ---------------------------------------------------------------------------
-
-const querylog_schema = @import("../../storage/querylog_schema.zig");
-const testing = std.testing;
-
-test "the period grammar accepts exactly the four spellings" {
-    try testing.expectEqual(Period.@"1h", Period.parse("1h").?);
-    try testing.expectEqual(Period.@"24h", Period.parse("24h").?);
-    try testing.expectEqual(Period.@"7d", Period.parse("7d").?);
-    try testing.expectEqual(Period.@"30d", Period.parse("30d").?);
-    try testing.expectEqual(@as(?Period, null), Period.parse("12h"));
-    try testing.expectEqual(@as(?Period, null), Period.parse("1H"));
-    try testing.expectEqual(@as(?Period, null), Period.parse(""));
-}
-
-test "an absent period defaults and a bad one is rejected" {
-    try testing.expectEqual(default_period, try periodParam(""));
-    try testing.expectEqual(default_period, try periodParam("limit=5"));
-    try testing.expectEqual(Period.@"7d", try periodParam("period=7d"));
-    try testing.expectError(error.BadPeriod, periodParam("period=12h"));
-    try testing.expectError(error.BadPeriod, periodParam("period=%2"));
-    // Longer than any spelling: rejected rather than truncated to "1h".
-    try testing.expectError(error.BadPeriod, periodParam("period=1hhhhhhhhhh"));
-}
-
-test "each period spans its own bucket width times its count" {
-    for (std.enums.values(Period)) |period| {
-        const span = window(period, 1_700_000_000);
-        const width: i64 = period.bucketSeconds();
-        try testing.expectEqual(width * @as(i64, period.bucketCount()), span.until - span.since);
-    }
-}
-
-test "the window sits on the UTC grid and ends with the bucket in progress" {
-    // 2023-11-14T22:13:20Z, which is not on any bucket boundary.
-    const now: i64 = 1_700_000_000;
-    const span = window(.@"24h", now);
-
-    try testing.expectEqual(@as(i64, 0), @rem(span.since, 1800));
-    try testing.expectEqual(@as(i64, 0), @rem(span.until, 1800));
-    try testing.expect(span.until > now);
-    try testing.expect(span.until - now <= 1800);
-    try testing.expectEqual(@as(u32, 48), span.bucket_count);
-}
-
-test "two requests inside one bucket see the same window" {
-    // A bucket boundary, so the offsets below stay inside one minute.
-    const boundary: i64 = 1_700_000_000 - @rem(1_700_000_000, 60);
-    const first = window(.@"1h", boundary);
-    const second = window(.@"1h", boundary + 59);
-    try testing.expectEqual(first.since, second.since);
-    try testing.expectEqual(first.until, second.until);
-
-    const next = window(.@"1h", boundary + 60);
-    try testing.expectEqual(first.until + 60, next.until);
-}
-
-test "a timestamp exactly on a boundary starts a new bucket" {
-    const span = window(.@"7d", 1_700_000_000 - 1_700_000_000 % 3600);
-    try testing.expectEqual(@as(i64, 0), @rem(span.since, 3600));
-    try testing.expectEqual(@as(u32, 168), span.bucket_count);
-}
-
-fn openLog() !db.Db {
-    var database = try db.Db.open(":memory:", .{ .mode = .memory });
-    errdefer database.close();
-    try db.applyPragmas(&database, .{});
-    try database.exec(querylog_schema.ddl);
-    return database;
-}
-
-fn writeRow(writer: *queries_repo.BatchWriter, timestamp: i64, blocked: bool, cached: ?bool) !void {
-    const rows = [_]queries_repo.Row{.{
-        .timestamp = timestamp,
-        .domain = "example.com",
-        .client_ip = "192.0.2.10",
-        .qtype = 1,
-        .qclass = 1,
-        .rcode = 0,
-        .blocked = blocked,
-        .response_time_us = 1000,
-        .cache_hit = cached,
-        .upstream = null,
-        .group_id = 1,
-        .group_name = "default",
-        .policy_action = if (blocked) .block else .allow,
-        .policy_reason = if (blocked) .blocklist_domain else .no_match,
-        .matched = null,
-        .source_id = null,
-        .source_name = null,
-        .cname_target = null,
-        .safe_search_target = null,
-        .route_kind = if (blocked) .blocked else .upstream,
-        .forward_zone = null,
-    }};
-    try writer.writeBatch(&rows);
-}
-
-test "the totals and the buckets agree over the same window" {
-    var database = try openLog();
-    defer database.close();
-
-    const now: i64 = 1_700_000_000;
-    const span = window(.@"1h", now);
-
-    var writer = try queries_repo.BatchWriter.init(&database);
-    defer writer.deinit();
-    // One row in the first bucket, two in the last, one just outside.
-    try writeRow(&writer, span.since, false, false);
-    try writeRow(&writer, span.until - 1, true, false);
-    try writeRow(&writer, span.until - 2, false, true);
-    try writeRow(&writer, span.since - 1, false, false);
-
-    const result = try queries_repo.statsTotals(&database, span.since, span.until);
-    try testing.expectEqual(@as(u64, 3), result.queries);
-    try testing.expectEqual(@as(u64, 1), result.blocked);
-    try testing.expectEqual(@as(u64, 1), result.distinct_clients);
-    try testing.expectEqual(@as(?i64, 1000), result.avg_response_time_us);
-
-    var buckets: [max_buckets]queries_repo.Bucket = undefined;
-    const out = buckets[0..span.bucket_count];
-    const written = try queries_repo.timeseries(&database, span.since, span.bucket_seconds, out);
-    try testing.expectEqual(@as(usize, 60), written);
-
-    var summed: u64 = 0;
-    var blocked: u64 = 0;
-    for (out) |bucket| {
-        summed += bucket.queries;
-        blocked += bucket.blocked;
-    }
-    try testing.expectEqual(result.queries, summed);
-    try testing.expectEqual(result.blocked, blocked);
-
-    try testing.expectEqual(span.since, out[0].ts);
-    try testing.expectEqual(@as(u64, 1), out[0].queries);
-    try testing.expectEqual(@as(u64, 2), out[59].queries);
-    try testing.expectEqual(span.until - span.bucket_seconds, out[59].ts);
-}
-
-test "an empty window reports zeros with a null mean" {
-    var database = try openLog();
-    defer database.close();
-
-    const span = window(.@"30d", 1_700_000_000);
-    const result = try queries_repo.statsTotals(&database, span.since, span.until);
-    try testing.expectEqual(@as(u64, 0), result.queries);
-    try testing.expectEqual(@as(?i64, null), result.avg_response_time_us);
-
-    var buckets: [max_buckets]queries_repo.Bucket = undefined;
-    const out = buckets[0..span.bucket_count];
-    try testing.expectEqual(@as(usize, 120), try queries_repo.timeseries(
-        &database,
-        span.since,
-        span.bucket_seconds,
-        out,
-    ));
-    for (out) |bucket| try testing.expectEqual(@as(u64, 0), bucket.queries);
-}

src/web/metrics.zig

@@ -166,6 +166,12 @@ pub const Sample = struct {
     udp_listener: ?udp_server.Snapshot = null,
     tcp_listener: ?tcp_server.Snapshot = null,
     upstreams: []const UpstreamSample = &.{},
+    /// Exchanges the pool gave up on because the request's own budget ran out.
+    /// Pool-wide rather than per-upstream on purpose: budget exhaustion is
+    /// evidence about the pool, never about an endpoint, so it carries no url
+    /// label and cannot live in `UpstreamSample`. Absent while no pool is
+    /// wired, like every other collaborator.
+    upstream_budget_exhausted_total: ?u64 = null,
 };
 
 pub fn handle(
@@ -271,7 +277,10 @@ pub fn collect(state: *server.WebState, io: std.Io, arena: Allocator) Allocator.
     if (state.upstreams) |owner| {
         const generation = owner.acquire(io);
         defer owner.release(io, generation);
-        if (generation.pool) |pool| sample.upstreams = try upstreams(pool, io, arena);
+        if (generation.pool) |pool| {
+            sample.upstreams = try upstreams(pool, io, arena);
+            sample.upstream_budget_exhausted_total = pool.budgetExhaustedTotal();
+        }
     }
 
     return sample;
@@ -465,6 +474,15 @@ pub fn render(w: *std.Io.Writer, sample: Sample) std.Io.Writer.Error!void {
     if (sample.doh_certs != null or sample.dot_certs != null) try renderCerts(w, sample);
 
     if (sample.upstreams.len != 0) try renderUpstreams(w, sample.upstreams);
+    if (sample.upstream_budget_exhausted_total) |total| {
+        try labeledHead(
+            w,
+            "nxdns_upstream_budget_exhausted_total",
+            "Exchanges that ran out of their own total budget before any upstream answered.",
+            "counter",
+        );
+        try w.print("nxdns_upstream_budget_exhausted_total {d}\n", .{total});
+    }
 }
 
 fn renderCerts(w: *std.Io.Writer, sample: Sample) std.Io.Writer.Error!void {
@@ -1540,7 +1558,7 @@ test "the queue families carry what a real pool recorded, through the real snaps
         .priority = 10,
         .enabled = true,
         .health = .init,
-        .sem = .{ .permits = slots.len },
+        .admission = .{ .permits = slots.len },
         .reuse_recoveries = &recoveries,
     }};
     var pool: pool_mod.Pool = .init(&entries, .{}, .{
@@ -1662,3 +1680,22 @@ fn fieldIndex(comptime name: []const u8) usize {
     }
     @compileError("no such counter: " ++ name);
 }
+
+test "the budget-exhausted counter renders pool-wide, without a url label" {
+    const text = try renderToString(testing.allocator, .{ .upstream_budget_exhausted_total = 7 });
+    defer testing.allocator.free(text);
+
+    try testing.expect(std.mem.containsAtLeast(
+        u8,
+        text,
+        1,
+        "# TYPE nxdns_upstream_budget_exhausted_total counter\n",
+    ));
+    try testing.expect(std.mem.containsAtLeast(u8, text, 1, "nxdns_upstream_budget_exhausted_total 7\n"));
+
+    // No pool, no series: an operator tells "no upstreams wired" from "zero
+    // exhausted budgets" the same way every other collaborator is told.
+    const absent = try renderToString(testing.allocator, .{});
+    defer testing.allocator.free(absent);
+    try testing.expect(!std.mem.containsAtLeast(u8, absent, 1, "nxdns_upstream_budget_exhausted_total"));
+}

src/web/openapi.yaml

@@ -422,139 +422,29 @@ paths:
         "503":
           $ref: "#/components/responses/Unavailable"
 
-  /api/stats:
+  /api/overview:
     get:
-      summary: Totals for a period
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: Totals over the period's UTC-aligned window.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsTotals"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
-
-  /api/stats/timeseries:
-    get:
-      summary: Bucketed counts for a period
+      summary: Everything the Overview page draws, for one period
       description: |
-        Fixed-width UTC buckets covering the same window `/api/stats`
-        reports for the period: 1h into 60 one-minute buckets, 24h into 48
-        half-hour buckets, 7d into 168 one-hour buckets, 30d into 120
-        six-hour buckets. Empty buckets are zero-filled.
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: The bucket series.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsTimeseries"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
+        One response over one read transaction: the period's totals, its
+        fixed-width UTC buckets, the per-client series, the query-type
+        breakdown and the answering-route breakdown, plus the coverage
+        watermark judged against the same window. The panels therefore describe
+        one database state rather than five, so the breakdowns sum to the
+        totals on a quiet box.
 
-  /api/stats/types:
-    get:
-      summary: Query-type breakdown for a period
-      description: |
-        How many queries of each DNS type the period's window holds, over the
-        same UTC-aligned window `/api/stats` reports for. Rows carry the numeric
-        type only: the type-name table lives in the admin, and a second copy
-        here would drift out of agreement with it. `qtype` is nullable in the
-        query log, so the rows that carry no type group into a row of their own
-        rather than vanishing from a breakdown that claims to add up. Ordered by
-        count descending, then type ascending with the null row last. Types
-        absent from the window are absent from the list.
+        Buckets are UTC-aligned and zero-filled: 1h into 60 one-minute buckets,
+        24h into 48 half-hour buckets, 7d into 168 one-hour buckets, 30d into
+        120 six-hour buckets. The last bucket is the one in progress.
       parameters:
         - $ref: "#/components/parameters/Period"
       responses:
         "200":
-          description: The type breakdown.
+          description: The period's overview.
           content:
             application/json:
               schema:
-                $ref: "#/components/schemas/StatsTypes"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
-
-  /api/stats/routes:
-    get:
-      summary: How the period's queries were answered
-      description: |
-        A breakdown by answering route over the same window `/api/stats`
-        reports for. `source` is the answering resolver's identity — the
-        upstream url on `upstream` rows, the zone on `forward_zone` rows, null
-        on every other kind and on rows whose identity the log did not record.
-        It is not the blocklist a block came from. Ordered by count descending,
-        then route ascending, then source ascending with nulls last.
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: The route breakdown.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsRoutes"
-        "400":
-          $ref: "#/components/responses/BadRequest"
-        "401":
-          $ref: "#/components/responses/Unauthorized"
-        "429":
-          $ref: "#/components/responses/RateLimited"
-        "500":
-          $ref: "#/components/responses/Internal"
-        "503":
-          $ref: "#/components/responses/Unavailable"
-
-  /api/stats/clients:
-    get:
-      summary: Per-client bucketed counts for a period
-      description: |
-        One zero-filled series per client, bucketed exactly like
-        `/api/stats/timeseries` so the two charts share an x-axis. The eight
-        clients with the most queries in the window are named, ranked by count
-        descending then address ascending; every other client sums into
-        `other`, which is always present and always holds one entry per bucket
-        in the window — including when `clients` is empty, when no client fell
-        outside the named eight, and when the window holds no queries at all.
-      parameters:
-        - $ref: "#/components/parameters/Period"
-      responses:
-        "200":
-          description: The per-client series.
-          content:
-            application/json:
-              schema:
-                $ref: "#/components/schemas/StatsClients"
+                $ref: "#/components/schemas/Overview"
         "400":
           $ref: "#/components/responses/BadRequest"
         "401":
@@ -2316,31 +2206,6 @@ components:
           type: integer
           description: How many resolved events the purge removed; zero when there were none.
 
-    StatsTotals:
-      type: object
-      required: [period, since, until, queries, blocked, clients, avg_response_time_us, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since:
-          type: integer
-          description: Window start, unix seconds, inclusive.
-        until:
-          type: integer
-          description: Window end, unix seconds, exclusive.
-        queries: { type: integer }
-        blocked: { type: integer }
-        clients:
-          type: integer
-          description: Distinct client addresses in the window.
-        avg_response_time_us:
-          type: integer
-          nullable: true
-          description: Null when no query in the window recorded a time.
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     Bucket:
       type: object
       required: [ts, queries, blocked, cached]
@@ -2352,23 +2217,6 @@ components:
         blocked: { type: integer }
         cached: { type: integer }
 
-    StatsTimeseries:
-      type: object
-      required: [period, since, until, bucket_seconds, buckets, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
-        bucket_seconds: { type: integer }
-        buckets:
-          type: array
-          items:
-            $ref: "#/components/schemas/Bucket"
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     TypeCount:
       type: object
       required: [qtype, count]
@@ -2381,22 +2229,6 @@ components:
             recorded no type, not an absent row.
         count: { type: integer }
 
-    StatsTypes:
-      type: object
-      required: [period, since, until, types, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
-        types:
-          type: array
-          items:
-            $ref: "#/components/schemas/TypeCount"
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     RouteCount:
       type: object
       required: [route, source, count]
@@ -2412,22 +2244,6 @@ components:
             row recorded no identity.
         count: { type: integer }
 
-    StatsRoutes:
-      type: object
-      required: [period, since, until, routes, coverage]
-      properties:
-        period:
-          type: string
-          enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
-        routes:
-          type: array
-          items:
-            $ref: "#/components/schemas/RouteCount"
-        coverage:
-          $ref: "#/components/schemas/Coverage"
-
     ClientSeries:
       type: object
       required: [client, buckets]
@@ -2443,18 +2259,47 @@ components:
           items:
             type: integer
 
-    StatsClients:
+    OverviewTotals:
       type: object
-      required: [period, since, until, bucket_seconds, clients, other, coverage]
+      required: [queries, blocked, clients, avg_response_time_us]
+      properties:
+        queries: { type: integer }
+        blocked: { type: integer }
+        clients:
+          type: integer
+          description: Distinct client addresses in the window.
+        avg_response_time_us:
+          type: integer
+          nullable: true
+          description: Null when no query in the window recorded a time.
+
+    Overview:
+      type: object
+      required: [period, since, until, bucket_seconds, totals, buckets, clients, other, types, routes, coverage]
       properties:
         period:
           type: string
           enum: [1h, 24h, 7d, 30d]
-        since: { type: integer }
-        until: { type: integer }
+        since:
+          type: integer
+          description: Window start, unix seconds, inclusive.
+        until:
+          type: integer
+          description: Window end, unix seconds, exclusive.
         bucket_seconds: { type: integer }
+        totals:
+          $ref: "#/components/schemas/OverviewTotals"
+        buckets:
+          type: array
+          description: One entry per bucket in the window, zero-filled.
+          items:
+            $ref: "#/components/schemas/Bucket"
         clients:
           type: array
+          description: |
+            The eight clients with the most queries in the window, ranked by
+            count descending then address ascending. Every other client sums
+            into `other`.
           items:
             $ref: "#/components/schemas/ClientSeries"
         other:
@@ -2466,6 +2311,30 @@ components:
             eight, and when the window holds no queries at all.
           items:
             type: integer
+        types:
+          type: array
+          description: |
+            How many queries of each DNS type the window holds. Rows carry the
+            numeric type only: the type-name table lives in the admin, and a
+            second copy here would drift out of agreement with it. `qtype` is
+            nullable in the query log, so the rows that carry no type group
+            into a row of their own rather than vanishing from a breakdown that
+            claims to add up. Ordered by count descending, then type ascending
+            with the null row last. Types absent from the window are absent
+            from the list.
+          items:
+            $ref: "#/components/schemas/TypeCount"
+        routes:
+          type: array
+          description: |
+            A breakdown by answering route. `source` is the answering
+            resolver's identity — the upstream url on `upstream` rows, the zone
+            on `forward_zone` rows, null on every other kind and on rows whose
+            identity the log did not record. It is not the blocklist a block
+            came from. Ordered by count descending, then route ascending, then
+            source ascending with nulls last.
+          items:
+            $ref: "#/components/schemas/RouteCount"
         coverage:
           $ref: "#/components/schemas/Coverage"
 

src/web/routes.zig

@@ -45,11 +45,11 @@ const local = @import("handlers/local.zig");
 const lookup = @import("handlers/lookup.zig");
 const metrics = @import("metrics.zig");
 const openapi = @import("openapi.zig");
+const overview = @import("handlers/overview.zig");
 const pause = @import("handlers/pause.zig");
 const queries = @import("handlers/queries.zig");
 const rules = @import("handlers/rules.zig");
 const settings = @import("handlers/settings.zig");
-const stats = @import("handlers/stats.zig");
 const upstreams = @import("handlers/upstreams.zig");
 const version = @import("handlers/version.zig");
 
@@ -64,18 +64,14 @@ pub const table: []const router.RouteInfo = &.{
     .{ .method = .POST, .pattern = "/api/auth/login", .auth = .open, .policy = .runtime_action, .handler = auth.login },
     .{ .method = .POST, .pattern = "/api/auth/logout", .auth = .session, .policy = .runtime_action, .handler = auth.logout },
 
-    // Query log, stats, live stream, lookup.
+    // Query log, overview, live stream, lookup.
     .{ .method = .GET, .pattern = "/api/queries", .auth = .session, .policy = .read, .handler = queries.list },
     .{ .method = .GET, .pattern = "/api/queries/live", .auth = .session, .policy = .read, .handler = live.stream, .rate_limit = .exempt },
     // Listed after the literal `live`, which a linear first-match scan reaches
     // first — though `{id}` would refuse it anyway, since it captures a
     // positive integer and nothing else.
     .{ .method = .GET, .pattern = "/api/queries/{id}", .auth = .session, .policy = .read, .handler = queries.detail },
-    .{ .method = .GET, .pattern = "/api/stats", .auth = .session, .policy = .read, .handler = stats.totals },
-    .{ .method = .GET, .pattern = "/api/stats/timeseries", .auth = .session, .policy = .read, .handler = stats.timeseries },
-    .{ .method = .GET, .pattern = "/api/stats/types", .auth = .session, .policy = .read, .handler = stats.types },
-    .{ .method = .GET, .pattern = "/api/stats/routes", .auth = .session, .policy = .read, .handler = stats.routes },
-    .{ .method = .GET, .pattern = "/api/stats/clients", .auth = .session, .policy = .read, .handler = stats.clients },
+    .{ .method = .GET, .pattern = "/api/overview", .auth = .session, .policy = .read, .handler = overview.handle },
     .{ .method = .GET, .pattern = "/api/lookup", .auth = .session, .policy = .read, .handler = lookup.handle },
 
     // Diagnostics: the operational event log (milestone 27). The two purges are
@@ -161,7 +157,7 @@ const std = @import("std");
 const testing = std.testing;
 
 test "the table carries every endpoint of the milestone" {
-    try testing.expectEqual(@as(usize, 64), table.len);
+    try testing.expectEqual(@as(usize, 60), table.len);
 }
 
 test "no two entries claim the same method and pattern" {

src/web/server.zig

@@ -175,6 +175,67 @@ pub const UpstreamBuild = struct {
     bundle_lock: *std.Io.RwLock,
 };
 
+/// The Overview response cache: one already-serialized body per period.
+///
+/// A slot is valid for exactly one `(window.until, data_version)` pair, so it
+/// expires both ways a stale Overview can arise — the window rolls onto the
+/// next bucket, or another connection (the logger, retention) commits and moves
+/// `PRAGMA data_version`. There is no time-to-live and no background refresh:
+/// nothing here can serve bytes that describe a database state the reader could
+/// not have seen.
+///
+/// Every field is read and written under `WebState.querylog_lock`, which is
+/// also what makes the cache single-flight: a second request for the same key
+/// waits for the first rebuild and then hits. The type carries no lock of its
+/// own precisely so that nobody can touch it without the one that matters.
+pub const OverviewCache = struct {
+    /// One per `overview.Period`, indexed by `@intFromEnum`. The handler asserts
+    /// the two counts agree.
+    pub const slot_count = 4;
+
+    const Slot = struct {
+        /// Empty until the first successful build; never a valid empty body,
+        /// since every response carries at least the period and the window.
+        body: []u8 = &.{},
+        until: i64 = 0,
+        data_version: i64 = 0,
+    };
+
+    slots: [slot_count]Slot = @splat(.{}),
+
+    /// The stored bytes for this key, or null. The caller copies them into its
+    /// request arena before releasing the lock: a later rebuild frees this
+    /// allocation.
+    pub fn get(self: *const OverviewCache, period_index: usize, until: i64, data_version: i64) ?[]const u8 {
+        const slot = &self.slots[period_index];
+        if (slot.body.len == 0) return null;
+        if (slot.until != until or slot.data_version != data_version) return null;
+        return slot.body;
+    }
+
+    /// Takes ownership of `body`, which must be a `gpa` allocation, and frees
+    /// whatever the slot held.
+    pub fn put(
+        self: *OverviewCache,
+        gpa: Allocator,
+        period_index: usize,
+        until: i64,
+        data_version: i64,
+        body: []u8,
+    ) void {
+        const slot = &self.slots[period_index];
+        gpa.free(slot.body);
+        slot.* = .{ .body = body, .until = until, .data_version = data_version };
+    }
+
+    pub fn deinit(self: *OverviewCache, gpa: Allocator) void {
+        for (&self.slots) |*slot| {
+            gpa.free(slot.body);
+            slot.* = .{};
+        }
+    }
+};
+
 pub const WebState = struct {
     gpa: Allocator,
     web: model.Web = .{},
@@ -272,6 +333,9 @@ pub const WebState = struct {
     /// the shared connection would fail and a third task's reads would land
     /// inside someone else's snapshot.
     querylog_lock: std.Io.Mutex = .init,
+    /// The Overview response cache, guarded by `querylog_lock` above. Whoever
+    /// owns the `WebState` calls `overview_cache.deinit`.
+    overview_cache: OverviewCache = .{},
     /// The diagnostics event store, which owns a third connection of its own
     /// and serializes every access — read and write — through its mutex. Null
     /// when `Store.init` failed, which `/api/health` reports as `unavailable`
@@ -350,11 +414,24 @@ pub const QuerylogRead = struct {
     pub fn open(state: *WebState, io: std.Io, database: *db.Db) db.Error!QuerylogRead {
         state.querylog_lock.lockUncancelable(io);
         errdefer state.querylog_lock.unlock(io);
+        var scope = try openLocked(state, io, database);
+        scope.held = true;
+        return scope;
+    }
+
+    /// The transaction alone, for a caller that already holds `querylog_lock`
+    /// and keeps holding it past `commit` — the overview handler, which decides
+    /// its response cache under the same one hold. Calling `open` there would
+    /// deadlock on a mutex the task already owns.
+    ///
+    /// The returned scope releases nothing: `commit` and `abort` end the
+    /// transaction and leave the lock to whoever took it.
+    pub fn openLocked(state: *WebState, io: std.Io, database: *db.Db) db.Error!QuerylogRead {
         return .{
             .state = state,
             .io = io,
             .tx = try db.ReadTx.begin(database),
-            .held = true,
+            .held = false,
         };
     }
 

src/web/web_integration_test.zig

@@ -83,7 +83,7 @@ const handlers_lookup = @import("handlers/lookup.zig");
 const handlers_pause = @import("handlers/pause.zig");
 const handlers_queries = @import("handlers/queries.zig");
 const handlers_settings = @import("handlers/settings.zig");
-const handlers_stats = @import("handlers/stats.zig");
+const handlers_overview = @import("handlers/overview.zig");
 const handlers_version = @import("handlers/version.zig");
 
 const Certificate = std.crypto.Certificate;
@@ -495,7 +495,7 @@ const Env = struct {
             .priority = 1,
             .enabled = true,
             .health = .init,
-            .sem = .{ .permits = self.pool_slots.len },
+            .admission = .{ .permits = self.pool_slots.len },
             .reuse_recoveries = &self.pool_recoveries,
         }};
         self.pool_owner = .{};
@@ -680,6 +680,7 @@ const Env = struct {
 
         self.state.live_hash.deinit(gpa);
         self.state.proxies.deinit(gpa);
+        self.state.overview_cache.deinit(gpa);
         self.tables.deinit(gpa);
         gpa.destroy(self.hub);
         self.limiter.deinit();
@@ -738,7 +739,7 @@ fn seedQueryLog(database: *db.Db) !void {
         \\UPDATE querylog_meta SET created_at = 1700000000, available_since = 1700000000 WHERE id = 1
     );
 
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
 
     var domain_buf: [32]u8 = undefined;
@@ -838,7 +839,7 @@ fn seedQueryLog(database: *db.Db) !void {
 const recent_clients = 3;
 
 fn seedRecentTraffic(database: *db.Db, now: i64) !void {
-    var writer = try queries_repo.BatchWriter.init(database);
+    var writer = try queries_repo.BatchWriter.init(testing.allocator, database);
     defer writer.deinit();
 
     const Shape = struct {
@@ -1048,15 +1049,11 @@ const contract = [_]Contract{
     // Refresh-all before any source row exists: nothing to fetch, 202 anyway.
     .{ .method = .POST, .pattern = "/api/blocklists/update", .auth = .session, .policy = .runtime_action, .target = "/api/blocklists/update", .status = 202, .check = jsonShape(StatusList) },
 
-    // Query log, stats, live stream, upstream health.
+    // Query log, overview, live stream, upstream health.
     .{ .method = .GET, .pattern = "/api/queries", .auth = .session, .policy = .read, .target = "/api/queries?limit=10", .status = 200, .check = jsonShape(handlers_queries.Page) },
     .{ .method = .GET, .pattern = "/api/queries/{id}", .auth = .session, .policy = .read, .target = "/api/queries/27", .status = 200, .check = jsonShape(provenance_view.QueryDetail) },
     .{ .method = .GET, .pattern = "/api/queries/live", .auth = .session, .policy = .read, .rate_limit = .exempt, .target = "/api/queries/live", .status = 200, .kind = .sse },
-    .{ .method = .GET, .pattern = "/api/stats", .auth = .session, .policy = .read, .target = "/api/stats?period=1h", .status = 200, .check = jsonShape(handlers_stats.TotalsBody) },
-    .{ .method = .GET, .pattern = "/api/stats/timeseries", .auth = .session, .policy = .read, .target = "/api/stats/timeseries?period=1h", .status = 200, .check = jsonShape(handlers_stats.TimeseriesBody) },
-    .{ .method = .GET, .pattern = "/api/stats/types", .auth = .session, .policy = .read, .target = "/api/stats/types?period=1h", .status = 200, .check = jsonShape(handlers_stats.TypesBody) },
-    .{ .method = .GET, .pattern = "/api/stats/routes", .auth = .session, .policy = .read, .target = "/api/stats/routes?period=1h", .status = 200, .check = jsonShape(handlers_stats.RoutesBody) },
-    .{ .method = .GET, .pattern = "/api/stats/clients", .auth = .session, .policy = .read, .target = "/api/stats/clients?period=1h", .status = 200, .check = jsonShape(handlers_stats.ClientsBody) },
+    .{ .method = .GET, .pattern = "/api/overview", .auth = .session, .policy = .read, .target = "/api/overview?period=1h", .status = 200, .check = jsonShape(handlers_overview.Body) },
 
     // Diagnostics. The seeded store holds one active episode (id 1) and one
     // resolved one, so both the page and the detail answer with real rows.
@@ -2587,11 +2584,7 @@ fn detailUnavailable(io: std.Io, env: *Env) anyerror!void {
     const targets = [_][]const u8{
         "/api/queries/1",
         "/api/queries?limit=1",
-        "/api/stats",
-        "/api/stats/timeseries",
-        "/api/stats/types",
-        "/api/stats/routes",
-        "/api/stats/clients",
+        "/api/overview",
     };
     for (targets) |target| {
         try conn.request("GET", target, null, null);
@@ -2657,27 +2650,20 @@ fn coverageWalk(io: std.Io, env: *Env) anyerror!void {
     );
     try testing.expect(!partial.coverage.complete);
 
-    // The stats endpoints judge the same watermark against their own aligned
-    // window, which for any live period starts well after the seeded rows.
-    try conn.request("GET", "/api/stats?period=1h", null, null);
-    const totals = try std.json.parseFromSliceLeaky(
-        handlers_stats.TotalsBody,
+    // The overview judges the same watermark against its own aligned window,
+    // which for any live period starts well after the seeded rows.
+    try conn.request("GET", "/api/overview?period=1h", null, null);
+    const overview_body = try std.json.parseFromSliceLeaky(
+        handlers_overview.Body,
         arena,
         (try conn.receive(&body_buf)).body,
         .{ .ignore_unknown_fields = false },
     );
-    try testing.expectEqual(seeded_available_since, totals.coverage.available_since);
-    try testing.expectEqual(totals.since >= seeded_available_since, totals.coverage.complete);
-
-    try conn.request("GET", "/api/stats/timeseries?period=1h", null, null);
-    const series = try std.json.parseFromSliceLeaky(
-        handlers_stats.TimeseriesBody,
-        arena,
-        (try conn.receive(&body_buf)).body,
-        .{ .ignore_unknown_fields = false },
+    try testing.expectEqual(seeded_available_since, overview_body.coverage.available_since);
+    try testing.expectEqual(
+        overview_body.since >= seeded_available_since,
+        overview_body.coverage.complete,
     );
-    try testing.expectEqual(totals.since, series.since);
-    try testing.expectEqual(totals.coverage.complete, series.coverage.complete);
 }
 
 fn getJson(
@@ -2708,33 +2694,43 @@ fn emptyAggregations(io: std.Io, env: *Env) anyerror!void {
     var body_buf: [256 * 1024]u8 = undefined;
 
     // This environment's only rows are the fixed 2023 seed, so every live
-    // window is empty. The empty bodies are exact, not merely parseable.
-    const types_body = try getJson(handlers_stats.TypesBody, arena, &conn, "/api/stats/types?period=1h", &body_buf);
-    try testing.expectEqualStrings("1h", types_body.period);
-    try testing.expectEqual(@as(usize, 0), types_body.types.len);
-
-    const routes_body = try getJson(handlers_stats.RoutesBody, arena, &conn, "/api/stats/routes?period=1h", &body_buf);
-    try testing.expectEqual(@as(usize, 0), routes_body.routes.len);
+    // window is empty. The empty body is exact, not merely parseable.
+    const body = try getJson(handlers_overview.Body, arena, &conn, "/api/overview?period=1h", &body_buf);
+    try testing.expectEqualStrings("1h", body.period);
+    try testing.expectEqual(@as(u64, 0), body.totals.queries);
+    try testing.expectEqual(@as(?i64, null), body.totals.avg_response_time_us);
+    try testing.expectEqual(@as(usize, 0), body.types.len);
+    try testing.expectEqual(@as(usize, 0), body.routes.len);
 
     // `other` is present and bucket-count sized even here: a chart must never
     // have to invent the residual series.
-    const clients = try getJson(handlers_stats.ClientsBody, arena, &conn, "/api/stats/clients?period=1h", &body_buf);
-    try testing.expectEqual(@as(usize, 0), clients.clients.len);
-    try testing.expectEqual(@as(u32, 60), clients.bucket_seconds);
-    try testing.expectEqual(@as(usize, 60), clients.other.len);
-    for (clients.other) |count| try testing.expectEqual(@as(u64, 0), count);
+    try testing.expectEqual(@as(usize, 0), body.clients.len);
+    try testing.expectEqual(@as(u32, 60), body.bucket_seconds);
+    try testing.expectEqual(@as(usize, 60), body.buckets.len);
+    try testing.expectEqual(@as(usize, 60), body.other.len);
+    for (body.other) |count| try testing.expectEqual(@as(u64, 0), count);
 
     // A window nobody covers is still reported as such, not as a quiet hour.
-    try testing.expectEqual(seeded_available_since, types_body.coverage.available_since);
-    try testing.expect(types_body.coverage.complete);
+    try testing.expectEqual(seeded_available_since, body.coverage.available_since);
+    try testing.expect(body.coverage.complete);
 
-    for ([_][]const u8{ "/api/stats/types", "/api/stats/routes", "/api/stats/clients" }) |path| {
-        var target_buf: [64]u8 = undefined;
-        const target = try std.fmt.bufPrint(&target_buf, "{s}?period=12h", .{path});
-        try conn.request("GET", target, null, null);
-        const bad = try conn.receive(&body_buf);
-        try testing.expectEqual(@as(u16, 400), bad.status);
-        try testing.expect(std.mem.containsAtLeast(u8, bad.body, 1, "period must be one of"));
+    try conn.request("GET", "/api/overview?period=12h", null, null);
+    const bad = try conn.receive(&body_buf);
+    try testing.expectEqual(@as(u16, 400), bad.status);
+    try testing.expect(std.mem.containsAtLeast(u8, bad.body, 1, "period must be one of"));
+
+    // Milestone 36 removed the five per-panel endpoints. They are gone from the
+    // table, not merely unreferenced by the admin, so the server refuses them.
+    for ([_][]const u8{
+        "/api/stats",
+        "/api/stats/timeseries",
+        "/api/stats/types",
+        "/api/stats/routes",
+        "/api/stats/clients",
+    }) |gone| {
+        try conn.request("GET", gone, null, null);
+        const missing = try conn.receive(&body_buf);
+        try testing.expectEqual(@as(u16, 404), missing.status);
     }
 }
 
@@ -2759,23 +2755,16 @@ fn populatedAggregations(io: std.Io, env: *Env) anyerror!void {
 
     var body_buf: [256 * 1024]u8 = undefined;
 
-    const totals = try getJson(handlers_stats.TotalsBody, arena, &conn, "/api/stats?period=1h", &body_buf);
-    const series = try getJson(handlers_stats.TimeseriesBody, arena, &conn, "/api/stats/timeseries?period=1h", &body_buf);
-    const types_body = try getJson(handlers_stats.TypesBody, arena, &conn, "/api/stats/types?period=1h", &body_buf);
-    const routes_body = try getJson(handlers_stats.RoutesBody, arena, &conn, "/api/stats/routes?period=1h", &body_buf);
-    const clients = try getJson(handlers_stats.ClientsBody, arena, &conn, "/api/stats/clients?period=1h", &body_buf);
+    const body = try getJson(handlers_overview.Body, arena, &conn, "/api/overview?period=1h", &body_buf);
 
-    // Nothing writes to this box between the five requests, so the window is
-    // one state and conservation is a real assertion rather than a race.
-    try testing.expectEqual(totals.since, series.since);
-    try testing.expectEqual(totals.since, types_body.since);
-    try testing.expectEqual(totals.since, routes_body.since);
-    try testing.expectEqual(totals.since, clients.since);
-    try testing.expect(totals.queries > 0);
+    // One response over one snapshot, so conservation is a property of the
+    // payload rather than of a quiet box between five requests.
+    try testing.expect(body.totals.queries > 0);
+    const totals = body.totals;
 
     var typed: u64 = 0;
     var null_qtype_rows: usize = 0;
-    for (types_body.types) |row| {
+    for (body.types) |row| {
         typed += row.count;
         if (row.qtype == null) null_qtype_rows += 1;
     }
@@ -2786,7 +2775,7 @@ fn populatedAggregations(io: std.Io, env: *Env) anyerror!void {
     var routed: u64 = 0;
     var null_source_upstreams: usize = 0;
     var named_upstreams: usize = 0;
-    for (routes_body.routes) |row| {
+    for (body.routes) |row| {
         routed += row.count;
         if (row.route != .upstream) continue;
         if (row.source == null) null_source_upstreams += 1 else named_upstreams += 1;
@@ -2795,17 +2784,20 @@ fn populatedAggregations(io: std.Io, env: *Env) anyerror!void {
     try testing.expectEqual(@as(usize, 1), null_source_upstreams);
     try testing.expectEqual(@as(usize, 2), named_upstreams);
 
-    try testing.expectEqual(@as(usize, recent_clients), clients.clients.len);
-    try testing.expectEqual(series.buckets.len, clients.other.len);
-    for (clients.clients) |entry| try testing.expectEqual(series.buckets.len, entry.buckets.len);
+    try testing.expectEqual(@as(usize, recent_clients), body.clients.len);
+    try testing.expectEqual(body.buckets.len, body.other.len);
+    for (body.clients) |entry| try testing.expectEqual(body.buckets.len, entry.buckets.len);
 
     // Per bucket, not just over the window: a series off by one bucket would
     // still sum correctly in total.
-    for (series.buckets, 0..) |bucket, at| {
-        var summed: u64 = clients.other[at];
-        for (clients.clients) |entry| summed += entry.buckets[at];
+    var bucketed: u64 = 0;
+    for (body.buckets, 0..) |bucket, at| {
+        bucketed += bucket.queries;
+        var summed: u64 = body.other[at];
+        for (body.clients) |entry| summed += entry.buckets[at];
         try testing.expectEqual(bucket.queries, summed);
     }
+    try testing.expectEqual(totals.queries, bucketed);
 }
 
 test "W10 milestone 30: the three breakdowns conserve the totals over one window" {
@@ -2826,11 +2818,8 @@ fn hammerQuerylog(io: std.Io, env: *Env) anyerror!void {
 
     var body_buf: [256 * 1024]u8 = undefined;
     const targets = [_][]const u8{
-        "/api/stats?period=1h",
-        "/api/stats/timeseries?period=1h",
-        "/api/stats/types?period=1h",
-        "/api/stats/routes?period=1h",
-        "/api/stats/clients?period=1h",
+        "/api/overview?period=1h",
+        "/api/overview?period=24h",
         "/api/queries?limit=5",
         "/api/queries/27",
     };
@@ -2875,7 +2864,7 @@ fn failedCommitIsBounded(io: std.Io, env: *Env) anyerror!void {
     // the connection recovers (the rollback attempt worked, so the next
     // `BEGIN` is not refused).
     db.read_tx_faults.failNextCommit();
-    try conn.request("GET", "/api/stats/types?period=1h", null, null);
+    try conn.request("GET", "/api/overview?period=1h", null, null);
     const failed = try conn.receive(&body_buf);
     try testing.expectEqual(@as(u16, 500), failed.status);
     try testing.expect(std.mem.containsAtLeast(u8, failed.body, 1, "internal error"));
@@ -2883,16 +2872,13 @@ fn failedCommitIsBounded(io: std.Io, env: *Env) anyerror!void {
     // Same connection, same shared query-log handle: a request after the fault
     // is an ordinary 200. This is the assertion the double-unlock bug failed —
     // it panicked here instead of answering.
-    try conn.request("GET", "/api/stats/types?period=1h", null, null);
+    try conn.request("GET", "/api/overview?period=1h", null, null);
     const recovered = try conn.receive(&body_buf);
     try testing.expectEqual(@as(u16, 200), recovered.status);
 
     // And every other query-log route still works on that connection.
     for ([_][]const u8{
-        "/api/stats?period=1h",
-        "/api/stats/timeseries?period=1h",
-        "/api/stats/routes?period=1h",
-        "/api/stats/clients?period=1h",
+        "/api/overview?period=24h",
         "/api/queries?limit=5",
         "/api/queries/27",
     }) |target| {
@@ -3012,7 +2998,7 @@ fn credentialSweep(
     // a closed queue is empty, and a zero flush interval makes it commit the
     // batch it holds rather than wait for company.
     query_logger.shutdown(io);
-    try query_logger.runWriter(io, &env.querylog_db, null);
+    try query_logger.runWriter(io, testing.allocator, &env.querylog_db, null);
     try testing.expectEqual(@as(u64, 1), query_logger.rows_written.load(.monotonic));
 
     var stmt = try env.querylog_db.prepare(
@@ -3905,15 +3891,13 @@ test "drift guard c: the health rollup matches the five objects it documents" {
     try expectSchemaMatches(gpa, handlers_health.Body, "Health");
 }
 
-test "drift guard c: the stats schemas match the structs that serialize them" {
+test "drift guard c: the overview schema matches the struct that serializes it" {
     // Guard b counts operations and guard a matches paths, so neither noticed
     // that `cached` outlived the field it documented. This one would have.
+    // It recurses, so `Bucket`, `ClientSeries`, `TypeCount` and `RouteCount`
+    // are held to their schemas here too.
     const gpa = testing.allocator;
-    try expectSchemaMatches(gpa, handlers_stats.TotalsBody, "StatsTotals");
-    try expectSchemaMatches(gpa, handlers_stats.TimeseriesBody, "StatsTimeseries");
-    try expectSchemaMatches(gpa, handlers_stats.TypesBody, "StatsTypes");
-    try expectSchemaMatches(gpa, handlers_stats.RoutesBody, "StatsRoutes");
-    try expectSchemaMatches(gpa, handlers_stats.ClientsBody, "StatsClients");
+    try expectSchemaMatches(gpa, handlers_overview.Body, "Overview");
 }
 
 test "drift guard c: the query-log schemas match the structs that serialize them" {
@@ -4094,8 +4078,6 @@ const contract_sample_walk = [_]ContractSample{
     // a matched pattern, so the golden exercises every nested object rather
     // than a row of nulls.
     .{ .name = "get_query_detail", .ts_type = "QueryDetail", .method = "GET", .target = "/api/queries/27", .status = 200 },
-    .{ .name = "get_stats", .ts_type = "StatsTotals", .method = "GET", .target = "/api/stats?period=1h", .status = 200 },
-    .{ .name = "get_stats_timeseries", .ts_type = "StatsTimeseries", .method = "GET", .target = "/api/stats/timeseries?period=1h", .status = 200 },
 
     // Pause: the GET before the POST, so one sample carries `until: null` and
     // the other the deadline.
@@ -4122,13 +4104,11 @@ const contract_sample_walk = [_]ContractSample{
     .{ .name = "error_not_found", .ts_type = "ErrorEnvelope", .method = "GET", .target = "/api/nope", .status = 404 },
 };
 
-/// The three period aggregations, captured against an environment with live
-/// traffic in it: over the fixed 2023 seed every one of them would answer with
-/// an empty array, which describes no field at all.
+/// The overview, captured against an environment with live traffic in it: over
+/// the fixed 2023 seed its four breakdowns would every one answer with an empty
+/// array, which describes no field at all.
 const stats_sample_walk = [_]ContractSample{
-    .{ .name = "get_stats_types", .ts_type = "StatsTypes", .method = "GET", .target = "/api/stats/types?period=1h", .status = 200 },
-    .{ .name = "get_stats_routes", .ts_type = "StatsRoutes", .method = "GET", .target = "/api/stats/routes?period=1h", .status = 200 },
-    .{ .name = "get_stats_clients", .ts_type = "StatsClients", .method = "GET", .target = "/api/stats/clients?period=1h", .status = 200 },
+    .{ .name = "get_overview", .ts_type = "Overview", .method = "GET", .target = "/api/overview?period=1h", .status = 200 },
 };
 
 /// A session-authenticated environment answers this without a cookie.