build: bump version to 0.0.8

.gitea/workflows/gates.yml

@@ -119,39 +119,39 @@ jobs:
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
-          cache-dependency-path: web/package-lock.json
+          cache-dependency-path: admin/package-lock.json
 
       - name: Install dependencies
-        working-directory: web
+        working-directory: admin
         run: npm ci
 
       - name: Check formatting
-        working-directory: web
+        working-directory: admin
         run: npm run format:check
 
       - name: Lint
-        working-directory: web
+        working-directory: admin
         run: npm run lint
 
       - name: Typecheck
-        working-directory: web
+        working-directory: admin
         run: npm run typecheck
 
       - name: Run tests
-        working-directory: web
+        working-directory: admin
         run: npm test
 
       - name: Build
-        working-directory: web
+        working-directory: admin
         run: npm run build
 
       # The licence inventory has to cover every package whose bytes ship, and
       # the lockfile does not answer that question: it lists what could be
       # reached, not what rollup kept. The bundle is what this reads. The logic
-      # lives in web/scripts/, unit-tested by `npm test`, so it runs on a laptop
+      # lives in admin/scripts/, unit-tested by `npm test`, so it runs on a laptop
       # exactly as it runs here (milestone-14 deviation 24).
-      - name: Assert the packages bundled into web/dist are the recorded ones
+      - name: Assert the packages bundled into admin/dist are the recorded ones
-        working-directory: web
+        working-directory: admin
         run: npm run assert-bundled
 
       # The package and container jobs consume this bundle instead of building
@@ -164,16 +164,16 @@ jobs:
       #
       # A later move to v4 has to add `include-hidden-files: true` here.
       # `npm run build` writes the freshness stamp to the hidden file
-      # web/dist/.src-hash (milestone-15 ruling 5), and v4.4.0 and later drop
+      # admin/dist/.src-hash (milestone-15 ruling 5), and v4.4.0 and later drop
       # dotfiles by default. It is inactive today — v3 keeps them, and the
       # package job's target path skips the stamp check regardless — but a move
-      # to v4 that also pointed the download back at web/dist would fail with
+      # to v4 that also pointed the download back at admin/dist would fail with
-      # "web/dist is stale".
+      # "admin/dist is stale".
       - name: Upload the built web UI
         uses: actions/upload-artifact@c24449f33cd45d4826c6702db7e49f7cdb9b551d # v3.2.1-node20
         with:
-          name: web-dist
+          name: admin-dist
-          path: web/dist
+          path: admin/dist
           if-no-files-found: error
 
   package:
@@ -201,22 +201,22 @@ jobs:
       - name: Create the fetch temp dir zig assumes
         run: mkdir -p "${ZIG_GLOBAL_CACHE_DIR:?}/tmp"
 
-      # `dist` refuses web/dist-placeholder (ruling 4), so a real bundle has to
+      # `dist` refuses admin/dist-placeholder (ruling 4), so a real bundle has to
       # exist before the packaging gate runs. It arrives from the frontend job,
       # already formatted, linted, typechecked, tested and licence-checked.
       #
-      # The target is deliberately not `web/dist`: build.zig runs the freshness
+      # The target is deliberately not `admin/dist`: build.zig runs the freshness
       # stamp check for that exact path and no other (milestone-15 ruling 5),
       # and the check shells out to `node`. Here it would buy nothing — the
-      # stamp hashes the web/ sources, not the bundle, so against a checkout of
+      # stamp hashes the admin/ sources, not the bundle, so against a checkout of
       # the same commit that built the bundle it can only agree. An explicit
       # path is the case build.zig documents for a bundle built elsewhere, and
       # taking it keeps node out of this job entirely.
       - name: Download the web UI built by the frontend job
         uses: actions/download-artifact@ad191675b41f6a5b46da9a048cb6893812da158b # v3.1.0-node20
         with:
-          name: web-dist
+          name: admin-dist
-          path: web-dist-ci
+          path: admin-dist-ci
 
       # Ruling 2: build.zig.zon is the only place besides the tag that carries
       # the version, and ruling 5 makes verify-dist assert the two agree. The
@@ -239,7 +239,7 @@ jobs:
           zig build dist \
             -Dversion-string="$CI_VERSION" \
             -Dgit-commit="$GITHUB_SHA" \
-            -Dweb-dist=web-dist-ci \
+            -Dadmin-dist=admin-dist-ci \
             -Doptimize=ReleaseSafe
 
       # verify-dist owns every assert the CI shell used to make: ELF static
@@ -255,7 +255,7 @@ jobs:
           zig build verify-dist \
             -Dversion-string="$CI_VERSION" \
             -Dgit-commit="$GITHUB_SHA" \
-            -Dweb-dist=web-dist-ci \
+            -Dadmin-dist=admin-dist-ci \
             -Doptimize=ReleaseSafe
 
       # deploy/docker/Dockerfile copies both of these trees and nothing else

.gitea/workflows/release.yml

@@ -269,10 +269,10 @@ jobs:
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: npm
-          cache-dependency-path: web/package-lock.json
+          cache-dependency-path: admin/package-lock.json
 
       - name: Build the web UI
-        working-directory: web
+        working-directory: admin
         run: |
           npm ci
           npm run build
@@ -283,7 +283,7 @@ jobs:
           zig build dist
           -Dversion-string="$VERSION"
           -Dgit-commit="$TAG_COMMIT"
-          -Dweb-dist=web/dist
+          -Dadmin-dist=admin/dist
           -Doptimize=ReleaseSafe
 
       - name: Verify the release artifacts
@@ -291,7 +291,7 @@ jobs:
           zig build verify-dist
           -Dversion-string="$VERSION"
           -Dgit-commit="$TAG_COMMIT"
-          -Dweb-dist=web/dist
+          -Dadmin-dist=admin/dist
           -Doptimize=ReleaseSafe
 
       # Step 9. Extracted and validated before anything is pushed anywhere, so

.gitignore

@@ -1,7 +1,7 @@
 .zig-cache/
 zig-out/
 zig-pkg/
-web/node_modules/
+admin/node_modules/
-web/dist/
+admin/dist/
-web/dist-sourcemap/
+admin/dist-sourcemap/
-web-dist-ci/
+admin-dist-ci/

AGENTS.md

@@ -2,79 +2,42 @@
 
 ## Aim
 
-nxdns: a self-hosted DNS sinkhole for a household LAN, written in Zig 0.16.0.
+nxdns: a self-hosted DNS sinkhole for a household LAN, written in Zig 0.16.0. Portfolio-grade public repo. PLAN.md is the source of truth for scope and design; specs/ holds per-milestone contracts; specs/research/ holds verified stdlib facts.
-Portfolio-grade public repo. PLAN.md is the source of truth for scope and design;
-specs/ holds per-milestone contracts; specs/research/ holds verified stdlib facts.
 
 ## Values
 
-We intentionally architect this code to be robust, maintainable, pragmatic —
+We intentionally architect this code to be robust, maintainable, pragmatic — good craftsmanship and good engineering. We explicitly avoid tech debt, code smells, bad architecture decisions, and brittle implementations.
-good craftsmanship and good engineering. We explicitly avoid tech debt, code
-smells, bad architecture decisions, and brittle implementations.
 
 What that means in practice:
 
-- This is a greenfield project. Breaking changes are allowed. Never keep a bad
+- This is a greenfield project. Breaking changes are allowed. Never keep a bad interface for compatibility; fix it at the root.
-  interface for compatibility; fix it at the root.
+- No versioning of scope. A feature is in scope (build it completely) or out of scope (do not build it). No "v2 later", no stubs left behind.
-- No versioning of scope. A feature is in scope (build it completely) or out of
-  scope (do not build it). No "v2 later", no stubs left behind.
 - Fix root causes, not symptoms. Do not iterate on workarounds.
-- Scope is small on purpose: household scale, two targets, few dependencies.
+- Scope is small on purpose: household scale, two targets, few dependencies. Do not add generality nobody asked for.
-  Do not add generality nobody asked for.
+- Dependencies are liabilities: stdlib first; vendored + pinned C deps (sqlite3, mbedTLS) only where the stdlib has nothing.
-- Dependencies are liabilities: stdlib first; vendored + pinned C deps
+- Verify stdlib claims against ../zig at tag 0.16.0 — pre-0.16 knowledge is stale (std.Io migration). See specs/research/zig-0.16-api-notes.md.
-  (sqlite3, mbedTLS) only where the stdlib has nothing.
+- Pure core: dns/, filter/, local/, cache/ take bytes and return bytes — no Io, no sockets, no clocks hidden inside.
-- Verify stdlib claims against ../zig at tag 0.16.0 — pre-0.16 knowledge is
+- Every failure mode must be visible: no silent drops, no unbounded logs, no swallowed errors. Counters + health surfaces over log spam.
-  stale (std.Io migration). See specs/research/zig-0.16-api-notes.md.
+- Tests are runnable acceptance criteria, not decoration. Required CI stays deterministic — no network-dependent tests in blocking jobs.
-- Pure core: dns/, filter/, local/, cache/ take bytes and return bytes — no Io,
+- Comments state constraints the code cannot show. No narration, no commented-out code.
-  no sockets, no clocks hidden inside.
+- Git: GPG-signed commits (`git commit -S`), simple lowercase messages, no generated-by footers.
-- Every failure mode must be visible: no silent drops, no unbounded logs, no
-  swallowed errors. Counters + health surfaces over log spam.
-- Tests are runnable acceptance criteria, not decoration. Required CI stays
-  deterministic — no network-dependent tests in blocking jobs.
-- Comments state constraints the code cannot show. No narration, no
-  commented-out code.
-- Git: GPG-signed commits (`git commit -S`), simple lowercase messages, no
-  generated-by footers.
 
 ## Reading `zig build test` output
 
-A fully passing `zig build test` still prints a line like `failed command:
+A fully passing `zig build test` still prints a line like `failed command: .../test --cache-dir=... --seed=... --listen=-`, and still exits 0. That line is a known upstream zig 0.16.0 labelling defect. It does not mean a test failed, and no test binary crashed.
-.../test --cache-dir=... --seed=... --listen=-`, and still exits 0. That line
-is a known upstream zig 0.16.0 labelling defect. It does not mean a test
-failed, and no test binary crashed.
 
-The build runner sets a step's `result_failed_command` on every spawn
+The build runner sets a step's `result_failed_command` on every spawn (`std/Build/Step/Run.zig:1540`) and never clears it on success. It then prints a step's diagnostics whenever the step wrote anything to stderr, explicitly "no matter the result" (`compiler/build_runner.zig:1381`), and that printer emits the `failed command: ` label unconditionally when the field is set (`compiler/build_runner.zig:1515`). Our suite writes to stderr on every run, because the tests that cover the warning paths log through the real sink. A minimal reproducer with no mbedTLS and no C — one passing test whose body is a `std.debug.print` — prints the same label and reports "3/3 steps succeeded; 1/1 tests passed"; deleting the print removes the label. No upstream issue matched a search, so the reference is the 0.16.0 source lines above.
-(`std/Build/Step/Run.zig:1540`) and never clears it on success. It then prints
-a step's diagnostics whenever the step wrote anything to stderr, explicitly "no
-matter the result" (`compiler/build_runner.zig:1381`), and that printer emits
-the `failed command: ` label unconditionally when the field is set
-(`compiler/build_runner.zig:1515`). Our suite writes to stderr on every run,
-because the tests that cover the warning paths log through the real sink. A
-minimal reproducer with no mbedTLS and no C — one passing test whose body is a
-`std.debug.print` — prints the same label and reports "3/3 steps succeeded;
-1/1 tests passed"; deleting the print removes the label. No upstream issue
-matched a search, so the reference is the 0.16.0 source lines above.
 
-Any *other* failure text is real. Trust the summary line: `zig build test`
+Any *other* failure text is real. Trust the summary line: `zig build test` exiting non-zero, a `N failed` count, or a panic backtrace all mean a genuine failure. Do not filter, wrap, or suppress the runner's output to hide the label — that would hide real failures with it.
-exiting non-zero, a `N failed` count, or a panic backtrace all mean a genuine
-failure. Do not filter, wrap, or suppress the runner's output to hide the
-label — that would hide real failures with it.
 
-One trap: running a cached test binary by hand with `--listen=-` aborts with
+One trap: running a cached test binary by hand with `--listen=-` aborts with `internal test runner failure: EndOfStream`. That is not a teardown bug; the IPC runner is talking to a closed stdin because no build runner is on the other end. Run the binary with no arguments to get the plain stdio report.
-`internal test runner failure: EndOfStream`. That is not a teardown bug; the
-IPC runner is talking to a closed stdin because no build runner is on the other
-end. Run the binary with no arguments to get the plain stdio report.
 
 ## Regenerating the contract samples
 
-`web/src/lib/contractSamples.gen.ts` is a committed golden of canonicalized
+`admin/src/lib/contractSamples.gen.ts` is a committed golden of canonicalized API responses, byte-compared against the live server by a `-Dintegration` test and type-checked by `tsc`. After a deliberate API contract change, regenerate it with:
-API responses, byte-compared against the live server by a `-Dintegration`
-test and type-checked by `tsc`. After a deliberate API contract change,
-regenerate it with:
 
 ```
-zig build test -Dintegration -Dcontract-samples-out="$PWD/web/src/lib/contractSamples.gen.ts"
+zig build test -Dintegration -Dcontract-samples-out="$PWD/admin/src/lib/contractSamples.gen.ts"
 ```
 
-then update `web/src/lib/types.ts` to match and commit both. Never edit the
+then update `admin/src/lib/types.ts` to match and commit both. Never edit the generated file by hand.
-generated file by hand.

CHANGELOG.md

@@ -1,146 +1,108 @@
 # Changelog
 
-All notable changes to nxdns are recorded here. The format follows
+All notable changes to nxdns are recorded here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
-[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-Sections are written by hand. Nothing here is generated from commit messages:
+Sections are written by hand. Nothing here is generated from commit messages: the point of the file is to say what changed for an operator, which a commit subject rarely does.
-the point of the file is to say what changed for an operator, which a commit
-subject rarely does.
 
-## [Unreleased]
+## [0.0.8] - 2026-08-21
+
+One constant, chosen from the 0.0.7 field numbers: the checkpoint cadence was the last first-order write cost on the Pi's SD card.
+
+### Changed
+
+- **The query log checkpoints its write-ahead log every 32 MiB instead of every 4 MiB.** Batching the writer in 0.0.7 took the deployed Pi from about 0.5 to 0.281 GiB of writes a day, and about 130 MiB of what is left is checkpoint writeback: SQLite's 1000-page default trips roughly every 40 minutes and rewrites the same hot index and interior pages into `querylog.db` each time. Every read-write connection to `querylog.db` now sets `wal_autocheckpoint` to 8192 pages, which stretches that to roughly five hours and cuts those in-place rewrites about eightfold, for an expected total near 190 MiB a day. The price is durability under power loss or a kernel panic. At `synchronous = NORMAL` a commit does not fsync, so the checkpoint is the only guaranteed durability boundary, and it now sits about five hours of query rows and upstream-history minutes back rather than 40 minutes. Kernel writeback normally makes the real loss far smaller than that, but nothing guarantees it. A process crash or a clean stop still loses nothing that was committed, and the database is never left inconsistent: recovery replays the longest valid prefix of the log. The `querylog.db-wal` file is expected to sit near 32 MiB rather than capped there, since a long-running reader can hold a checkpoint off and let it overshoot, and the daily retention pass still truncates it. `config.db` is unchanged.
+
+## [0.0.7] - 2026-08-20
+
+Operational failures get a page of their own, and the query log stops wearing out the disk it lives on: the deployed Pi was writing half a gigabyte a day to store two megabytes of query rows, one transaction per query. Both came out of running 0.0.6 on real hardware.
+
+### Added
+
+- **A diagnostics page.** Operational failures now land in one curated log instead of only journald: blocklist download failures, certificate reload failures, disk pressure, query-log writer and maintenance failures, upstream exchange and history failures, client tracking failures, listener and configuration problems at boot, and the query-log recreation an upgrade causes. One entry per failing subject — an entry opens on the first failure, counts repeats, and closes itself when the subject recovers; nothing needs dismissing. Each entry says what it means for the service and what to do about it. `GET /api/diagnostics` serves the log, `GET /api/health` reports the active counts and degrades while the diagnostics store itself cannot write, and `/metrics` gains `nxdns_diagnostics_active_warnings`, `nxdns_diagnostics_active_errors` and `nxdns_diagnostics_write_failures_total`. Resolved entries can be purged when you decide the history has served its purpose — one entry from its row or its detail page, or the whole resolved history at once with "Purge all resolved" (`DELETE /api/diagnostics/{id}` and `DELETE /api/diagnostics`). An entry that is still failing is the current state of the box, not history, so it has no purge action and the API answers 409.
+
+### Changed
+
+- **The query log commits once a minute instead of once a query.** The writer batched for 100 milliseconds, which at a household's query rate means almost every query got a transaction of its own — and a transaction costs the disk far more than the row it carries. On the deployed Pi that came to roughly 0.5 GiB of writes a day to store 2.3 MB of query rows, the kind of write volume that kills an SD card. The batch window is now `logging.query_log_flush_interval_s`: 60 seconds by default (the same minute Pi-hole's `DBinterval` defaults to, for the same reason), anything from 0 to 3600, editable on the settings page. Batches are still capped at 100 rows, so a burst is committed as soon as it fills one rather than waiting out the window, and the in-memory queue, its drop-oldest backpressure and retention are untouched. The price is two kinds of lag: a crash costs about one interval of query history — more if the writer was held back by a full disk or a slow write — and every query-log-backed view — the query-log page, the dashboard totals, the timeseries — is about one interval behind. The live page is not affected; it is fed before the queue. Set the key to `0` for the old write-immediately behavior.
+
+### Fixed
+
+- **Shutdown no longer races the last query rows to the disk.** The query-log writer was stopped by the same cancellation that stopped the DNS listeners, so whether the batch it was holding reached the database depended on which happened to land first, the cancellation or the queue closing. Shutdown now stops and joins the listeners and every other query producer first, then closes the queue, then waits for the writer to finish emptying it — the held batch and everything still queued get written. If free space is below the critical threshold and the disk monitor will not let that final write through, the rows are counted as dropped instead of holding the exit open indefinitely.
+- **An upstream success rate no longer rounds up to 100.0% while failures stand.** One decimal place cannot hold 12,696 successes out of 12,698 attempts: it rounded to `100.0%`, so the row claimed perfect reliability next to a failure count of 2. Neither end of the scale is reachable by rounding any more — `100.0%` needs an actual absence of failures and `0.0%` an actual absence of successes, and a rate a hair off either end shows `99.9%` or `0.1%` instead.
+- **A query log set aside by a schema change is no longer named `corrupt`.** Every recreate wrote the old file to `querylog.db.corrupt-<unix seconds>`, whatever sent it there — including the fingerprint mismatch an upgrade causes, where the file is a healthy database this build simply cannot read. The name is the only account of the reason that outlives the log line, so it read as an accusation and invited operators to delete an intact file. The name now says which of the four cases it hit: `querylog.db.corrupt-…`, `.not-a-database-…`, `.quick-check-failed-…` or `.schema-changed-…`. The 0.0.6 upgrade produces `schema-changed`. Nothing else about the recreate changed, and no existing aside file is renamed.
+
+## [0.0.6] - 2026-08-17
+
+The period picker now scopes the whole dashboard. The upstream table was the last widget that ignored it, and fixing that meant recording upstream outcomes over time instead of counting them since boot. Read the query-log note below before you upgrade.
+
+### Added
+
+- Four metrics for the new upstream-history recorder: `nxdns_upstream_history_flushes_total`, `nxdns_upstream_history_flush_failures_total`, `nxdns_upstream_history_rows_dropped_total` and the `nxdns_upstream_history_pending` gauge. While a flush to the database keeps failing, `GET /api/health` reports `degraded`; it recovers on the next flush that succeeds.
+
+### Changed
+
+- **Upstream health answers for the selected period.** The dashboard's upstream table used to print counters accumulated since process start beside a success rate taken over the last 32 exchanges, which is how "63 failures" and "100.0% success rate" ended up in the same row under a period picker that scoped nothing there. Every upstream outcome is now aggregated into its wall-clock minute and written to `querylog.db`, and `GET /api/upstream/health?period=…` serves the selected window: attempts, failures, success rate, and the last failure with its error name, all inside the period, from 31 days of history. A window with no attempts reports no success rate at all instead of a perfect one, and the table shows an em-dash. The in-memory health state that drives failover and backoff is unchanged, as are its `/metrics` series.
+- **`GET /api/upstream/health` changed shape.** Gone from each upstream: `consecutive_failures`, `total_successes`, `total_failures`, the last-32 `success_rate`, `last_error` and `last_error_age_s`. Each upstream keeps `url`, `enabled` and `available` and gains a `period` object with the ranged numbers; the body gains `period`, `since`, `until` and a `complete` flag that says whether any outcome was known to be dropped inside the window. The removed counters are still exported by `/metrics` under their existing names. On the dashboard the "Right now" section is gone with them: the upstream table rejoined the ranged part of the page, and the disk card, the one live widget left, is titled "Storage now".
+- **The query log is recreated on upgrade.** Recording upstream history added two tables to the `querylog.db` schema, and its fingerprint check refuses a database that does not match the shipped definition. On first start this version renames the existing `querylog.db` aside as `querylog.db.corrupt-<unix seconds>` in the data directory and creates a fresh one, so query history and stats restart empty. The renamed file is left in place rather than deleted, so removing it is your call. `config.db` is untouched: no configuration is lost.
+
+## [0.0.5] - 2026-08-16
+
+One rendering fix on the 0.0.4 feature, caught the day it shipped.
+
+### Changed
+
+- The query tables no longer repeat the *learned* tag on every row: in the live page and the query log a learned name is just muted, with the address still in the row's tooltip. The clients page keeps the tag, where it appears once per client and says something.
+
+## [0.0.4] - 2026-08-16
+
+The names learned in 0.0.3 now show up where queries do: the live page and the query log name each client instead of printing its address.
+
+### Added
+
+- **Client names in the query tables.** The live page and the query log show each query's client by name, with the same precedence as the clients page: a hand-typed name wins, else the learned name (muted, tagged *learned*), else the bare address. When a name replaces the address, the address stays readable as the row's tooltip. Devices that appear mid-stream show their address first and pick up their name within half a minute.
 
 ## [0.0.3] - 2026-08-15
 
-Devices name themselves: the clients table asks the router over reverse DNS
+Devices name themselves: the clients table asks the router over reverse DNS instead of waiting for the operator to type every name. The CI container gate also moved from workflow shell into a compiled, tested tool, which fixed a latent temp-directory bug shared with the release tool.
-instead of waiting for the operator to type every name. The CI container gate
-also moved from workflow shell into a compiled, tested tool, which fixed a
-latent temp-directory bug shared with the release tool.
 
 ### Added
 
-- **Client names learned over reverse DNS.** A client row that carries no
+- **Client names learned over reverse DNS.** A client row that carries no hand-typed name gets one from the network: each tracker flush pass takes up to 16 unnamed rows, builds each address's reverse name, matches it against the declared `forward_zones`, and on a match sends one PTR query to that zone's resolver, storing the answer as a *learned* name. This requires a conditional forward zone covering the LAN's reverse space — for example `168.192.in-addr.arpa` pointed at the router; without one, nothing is sent anywhere. A hand-typed name always wins, learned names never appear in `nxdns export` and are never set by `nxdns import`, and each row refreshes once a day (an hour after a failure), so a rename can show stale for up to 24 hours. The API's `Client` object gains a `learned_name` field and the clients page shows it.
-  hand-typed name gets one from the network: each tracker flush pass takes up
-  to 16 unnamed rows, builds each address's reverse name, matches it against
-  the declared `forward_zones`, and on a match sends one PTR query to that
-  zone's resolver, storing the answer as a *learned* name. This requires a
-  conditional forward zone covering the LAN's reverse space — for example
-  `168.192.in-addr.arpa` pointed at the router; without one, nothing is sent
-  anywhere. A hand-typed name always wins, learned names never appear in
-  `nxdns export` and are never set by `nxdns import`, and each row refreshes
-  once a day (an hour after a failure), so a rename can show stale for up to
-  24 hours. The API's `Client` object gains a `learned_name` field and the
-  clients page shows it.
 
 ### Changed
 
-- The container CI gate — image build, image-contents assertion against the
+- The container CI gate — image build, image-contents assertion against the packaged artifacts, and the startup/shutdown smoke test — moved from workflow shell into `tools/container_check.zig`, compiled and unit-tested by `zig build test` and runnable on a laptop against a local docker daemon. The health probe now runs under a real 60-second deadline (the shell loop's "30 seconds" could stretch past three minutes), and the gate's docker objects carry an ownership label so anything a dead runner leaks is discoverable. The version in CI is parsed from `build.zig.zon` through the zon grammar, once, instead of by two copies of a `sed` regex.
-  packaged artifacts, and the startup/shutdown smoke test — moved from
-  workflow shell into `tools/container_check.zig`, compiled and unit-tested by
-  `zig build test` and runnable on a laptop against a local docker daemon.
-  The health probe now runs under a real 60-second deadline (the shell loop's
-  "30 seconds" could stretch past three minutes), and the gate's docker
-  objects carry an ownership label so anything a dead runner leaks is
-  discoverable. The version in CI is parsed from `build.zig.zon` through the
-  zon grammar, once, instead of by two copies of a `sed` regex.
 
 ### Fixed
 
-- The release tool's temporary-directory claim was not exclusive: the
+- The release tool's temporary-directory claim was not exclusive: the "create" it relied on succeeds on a directory that already exists, so a stale or concurrent directory could be silently adopted, written into, and deleted on exit. Both the release tool and the new container gate now claim their directories exclusively and retry on collision.
-  "create" it relied on succeeds on a directory that already exists, so a
-  stale or concurrent directory could be silently adopted, written into, and
-  deleted on exit. Both the release tool and the new container gate now claim
-  their directories exclusively and retry on collision.
 
 ## [0.0.2] - 2026-08-14
 
-Configuration can now be a file that every boot converges to, filtering gains
+Configuration can now be a file that every boot converges to, filtering gains regex rules and honors blocklist exception lines, and two refresh bugs that silently kept stale state are fixed. Note the three breaking changes below if you script against `nxdns import` or run with `--config`.
-regex rules and honors blocklist exception lines, and two refresh bugs that
-silently kept stale state are fixed. Note the three breaking changes below if
-you script against `nxdns import` or run with `--config`.
 
 ### Added
 
-- **Declarative configuration for IaC.** `nxdns run --config=<file>` makes the
+- **Declarative configuration for IaC.** `nxdns run --config=<file>` makes the file the sole source of configuration: every boot converges the database to it in one transaction, preserving blocklist downloads, compiled lists and client history, so an unchanged file costs zero downloads and zero writes. Bare `nxdns run` keeps the database (and the web UI) in charge, exactly as before. In file mode the web UI is read-only for configuration and says so; runtime actions (pause, blocklist refresh, certificate reload) stay live. `GET /api/settings` reports which authority governs the process.
-  file the sole source of configuration: every boot converges the database to
+- `nxdns import` now refuses a file whose application would delete configuration rows, names the tables and counts, and applies it only with the new `--allow-delete` flag. Additive and edit-in-place imports need no flag.
-  it in one transaction, preserving blocklist downloads, compiled lists and
+- **Regex rules.** Rules gain a third kind, `regex`, beside `exact` and `wildcard`, for per-group allow and block patterns such as `^ad[0-9]+-`. The engine is homegrown and linear-time by construction, so no pattern can make matching blow up; backreferences and lookaround do not exist, and a bad pattern is refused at insert time with the limit it hit. Matches appear in `/api/lookup` and the query log as `rule_allow_regex` / `rule_block_regex`. Regex still comes only from you: regex lines in downloaded lists stay counted and skipped.
-  client history, so an unchanged file costs zero downloads and zero writes.
+- **Blocklist exception lines are honored.** An Adblock-Plus `@@||name^` line in a downloaded list now lifts that name — and its subdomains — out of what the attached lists block. Exceptions sit below every rule you wrote: a downloaded list can reopen only a hole another downloaded list dug, never override an operator decision. Each source reports how many it carried.
-  Bare `nxdns run` keeps the database (and the web UI) in charge, exactly as
+- **Browser-only lines are counted where you can see them.** Every source now reports how many of its lines nxdns skipped as syntax with no DNS meaning — cosmetic filters, `$`-modifier rules — beside the existing skipped-regex count. Both blocklist tables show the number and the UI explains the difference: a list whose skipped-unsupported count dwarfs its domain count is written for browser extensions, and its DNS or hosts variant will block more. Previously such a list compiled to almost nothing and looked clean.
-  before. In file mode the web UI is read-only for configuration and says so;
-  runtime actions (pause, blocklist refresh, certificate reload) stay live.
-  `GET /api/settings` reports which authority governs the process.
-- `nxdns import` now refuses a file whose application would delete
-  configuration rows, names the tables and counts, and applies it only with
-  the new `--allow-delete` flag. Additive and edit-in-place imports need no
-  flag.
-- **Regex rules.** Rules gain a third kind, `regex`, beside `exact` and
-  `wildcard`, for per-group allow and block patterns such as `^ad[0-9]+-`. The
-  engine is homegrown and linear-time by construction, so no pattern can make
-  matching blow up; backreferences and lookaround do not exist, and a bad
-  pattern is refused at insert time with the limit it hit. Matches appear in
-  `/api/lookup` and the query log as `rule_allow_regex` / `rule_block_regex`.
-  Regex still comes only from you: regex lines in downloaded lists stay
-  counted and skipped.
-- **Blocklist exception lines are honored.** An Adblock-Plus `@@||name^` line
-  in a downloaded list now lifts that name — and its subdomains — out of what
-  the attached lists block. Exceptions sit below every rule you wrote: a
-  downloaded list can reopen only a hole another downloaded list dug, never
-  override an operator decision. Each source reports how many it carried.
-- **Browser-only lines are counted where you can see them.** Every source now
-  reports how many of its lines nxdns skipped as syntax with no DNS meaning —
-  cosmetic filters, `$`-modifier rules — beside the existing skipped-regex
-  count. Both blocklist tables show the number and the UI explains the
-  difference: a list whose skipped-unsupported count dwarfs its domain count
-  is written for browser extensions, and its DNS or hosts variant will block
-  more. Previously such a list compiled to almost nothing and looked clean.
 
 ### Changed
 
-- **Breaking: `nxdns run --config <file>` changed meaning.** It used to seed
+- **Breaking: `nxdns run --config <file>` changed meaning.** It used to seed the database once and then ignore the file; it now makes the file the authority on every boot, which deletes any configuration the file does not declare — including edits made through the web UI since the seed. Before upgrading a unit that carries `--config`: either drop the flag to keep the database in charge, or adopt file mode with the sequence in the upgrade guide. Order matters there: export the file with the NEW binary (stopped).
-  the database once and then ignore the file; it now makes the file the
+- **Breaking: 0.0.1 exports are refused by this version.** A 0.0.1 `nxdns export` writes both `.password = ""` and the stored `.password_hash`, and this version refuses a file that carries both. This bites any old export — an adoption file or a configuration backup fed to `nxdns import` alike. Fix an existing export by deleting its `.password = ""` line (keep the `.password_hash` line). Take fresh backups with the new binary.
-  authority on every boot, which deletes any configuration the file does not
+- **Breaking: the offline password-change recipe changed.** Setting `.password = "new"` together with `.password_hash = ""` is now refused (empty `password_hash` is an explicit "disable authentication", and the two fields cannot both be present). To change the password in the file: set `.password` and delete the `.password_hash` line entirely.
-  declare — including edits made through the web UI since the seed. Before
-  upgrading a unit that carries `--config`: either drop the flag to keep the
-  database in charge, or adopt file mode with the sequence in the upgrade
-  guide. Order matters there: export the file with the NEW binary (stopped).
-- **Breaking: 0.0.1 exports are refused by this version.** A 0.0.1
-  `nxdns export` writes both `.password = ""` and the stored
-  `.password_hash`, and this version refuses a file that carries both. This
-  bites any old export — an adoption file or a configuration backup fed to
-  `nxdns import` alike. Fix an existing export by deleting its
-  `.password = ""` line (keep the `.password_hash` line). Take fresh backups
-  with the new binary.
-- **Breaking: the offline password-change recipe changed.** Setting
-  `.password = "new"` together with `.password_hash = ""` is now refused
-  (empty `password_hash` is an explicit "disable authentication", and the two
-  fields cannot both be present). To change the password in the file: set
-  `.password` and delete the `.password_hash` line entirely.
 - `nxdns import --force` is renamed `--allow-delete`.
-- A fresh install no longer seeds from `/etc/nxdns/config.zon` by presence.
+- A fresh install no longer seeds from `/etc/nxdns/config.zon` by presence. Use `nxdns import` once, or run in file mode with `--config`.
-  Use `nxdns import` once, or run in file mode with `--config`.
+- The admin UI's internals moved to TypeScript 7 and replaced Tailwind with StyleX and React Aria. The visible change is small: selects are real widgets with working keyboard focus; everything else renders as before.
-- The admin UI's internals moved to TypeScript 7 and replaced Tailwind with
+- The `config.db` schema is a single baseline definition again; numbered migration steps start accumulating at v0.1.
-  StyleX and React Aria. The visible change is small: selects are real
-  widgets with working keyboard focus; everything else renders as before.
-- The `config.db` schema is a single baseline definition again; numbered
-  migration steps start accumulating at v0.1.
 
 ### Fixed
 
-- **A list switching a name between its exact and wildcard forms never took
+- **A list switching a name between its exact and wildcard forms never took effect.** The compiled-list checksum hashed the exact and wildcard bodies as one unseparated byte stream, so a list carrying `a.example` and the same list carrying `*.a.example` produced the same digest, and the refresh kept the old compiled files. The checksum now separates the bodies. Every source recompiles once on its first refresh after the upgrade; no re-download of unchanged content is forced beyond the refresh's normal fetch.
-  effect.** The compiled-list checksum hashed the exact and wildcard bodies as
+- **A refresh could store stale skip counts.** When a refresh found the list content unchanged, it wrote the previously stored skip counters back to the database while showing the fresh ones in the UI, and the next restart reverted the numbers to the stale copy. All counters now persist from the fresh compile.
-  one unseparated byte stream, so a list carrying `a.example` and the same
+- An Adblock-Plus entry with embedded whitespace (`||good.example bad.example^`) compiled into an entry no query could ever match. Such lines are now counted as unsupported instead.
-  list carrying `*.a.example` produced the same digest, and the refresh kept
-  the old compiled files. The checksum now separates the bodies. Every source
-  recompiles once on its first refresh after the upgrade; no re-download of
-  unchanged content is forced beyond the refresh's normal fetch.
-- **A refresh could store stale skip counts.** When a refresh found the list
-  content unchanged, it wrote the previously stored skip counters back to the
-  database while showing the fresh ones in the UI, and the next restart
-  reverted the numbers to the stale copy. All counters now persist from the
-  fresh compile.
-- An Adblock-Plus entry with embedded whitespace
-  (`||good.example bad.example^`) compiled into an entry no query could ever
-  match. Such lines are now counted as unsupported instead.
 
 ## [0.0.1] - 2026-08-09
 
@@ -148,47 +110,18 @@ First release. Everything below is new.
 
 ### Added
 
-- **Forwarding DNS server.** UDP and TCP listeners with a wire-format parser and
+- **Forwarding DNS server.** UDP and TCP listeners with a wire-format parser and encoder written against RFC 1035 and EDNS(0), a bounded worker model, per-client rate limiting and a `pause` control that stops filtering without stopping resolution.
-  encoder written against RFC 1035 and EDNS(0), a bounded worker model, per-client
+- **Encrypted upstreams.** DNS-over-HTTPS and DNS-over-TLS clients over a pool that tracks per-upstream health and fails over, with SNI and certificate verification driven by a per-upstream TLS name.
-  rate limiting and a `pause` control that stops filtering without stopping
+- **DoH and DoT endpoints.** nxdns also answers as an encrypted resolver, with a certificate store that reloads on disk changes and through the API, so renewals do not need a restart.
-  resolution.
+- **Blocklist filtering.** Subscriptions in hosts, plain-domain and Adblock-Plus-style formats, compiled into a compact matcher; per-group allow and block rules with wildcards; safe-search enforcement.
-- **Encrypted upstreams.** DNS-over-HTTPS and DNS-over-TLS clients over a pool
+- **Per-client policy groups.** Clients are identified by address and assigned to groups, so the filtering a device gets depends on which device it is.
-  that tracks per-upstream health and fails over, with SNI and certificate
+- **Local DNS.** Local A/AAAA/CNAME/PTR records and conditional forwarding of internal zones to another resolver.
-  verification driven by a per-upstream TLS name.
+- **Cache.** A bounded in-memory cache that respects upstream TTLs and expires entries rather than serving them stale.
-- **DoH and DoT endpoints.** nxdns also answers as an encrypted resolver, with a
+- **Query log.** Queries land in SQLite under a retention policy in both rows and days, with disk-full self-protection that degrades instead of corrupting, and a live SSE stream of the same events.
-  certificate store that reloads on disk changes and through the API, so renewals
+- **Web UI and REST API.** A React single-page admin UI embedded in the binary, a REST API with a served OpenAPI document, session authentication, API rate limiting and Prometheus-style `/metrics`.
-  do not need a restart.
+- **Configuration.** A ZON configuration file seeds the database on first boot; after that the database is the truth, and `nxdns export` / `nxdns import` move configuration in and out. `nxdns check` validates a file without starting.
-- **Blocklist filtering.** Subscriptions in hosts, plain-domain and
-  Adblock-Plus-style formats, compiled into a compact matcher; per-group allow
-  and block rules with wildcards; safe-search enforcement.
-- **Per-client policy groups.** Clients are identified by address and assigned to
-  groups, so the filtering a device gets depends on which device it is.
-- **Local DNS.** Local A/AAAA/CNAME/PTR records and conditional forwarding of
-  internal zones to another resolver.
-- **Cache.** A bounded in-memory cache that respects upstream TTLs and expires
-  entries rather than serving them stale.
-- **Query log.** Queries land in SQLite under a retention policy in both rows and
-  days, with disk-full self-protection that degrades instead of corrupting, and a
-  live SSE stream of the same events.
-- **Web UI and REST API.** A React single-page admin UI embedded in the binary,
-  a REST API with a served OpenAPI document, session authentication, API rate
-  limiting and Prometheus-style `/metrics`.
-- **Configuration.** A ZON configuration file seeds the database on first boot;
-  after that the database is the truth, and `nxdns export` / `nxdns import` move
-  configuration in and out. `nxdns check` validates a file without starting.
 - **CLI.** `run`, `check`, `export`, `import`, `version` and `help`.
-- **Packaging.** A hardened systemd unit with a sysusers fragment, and a
+- **Packaging.** A hardened systemd unit with a sysusers fragment, and a `FROM scratch` container image holding the binary, a CA bundle and the licence files, assembled by a builder stage pinned to `alpine:3.22` by digest. Nothing from Alpine ships in the published image except that CA bundle.
-  `FROM scratch` container image holding the binary, a CA bundle and the licence
+- **Releases.** Tags publish five assets — static musl tarballs for `x86_64-linux-musl` and `aarch64-linux-musl`, `IMAGE-DIGEST.txt` naming the multi-architecture container image by digest, `SHA256SUMS.txt` over those three, and `SHA256SUMS.txt.asc`, a detached signature over the checksum file. `zig build dist` and `zig build verify-dist` produce and check the same artifacts on a laptop.
-  files, assembled by a builder stage pinned to `alpine:3.22` by digest. Nothing
+- **Licensing.** EUPL-1.2, with a `THIRD-PARTY-NOTICES` file in every tarball and image assembled from a reviewed inventory of what the artifacts contain.
-  from Alpine ships in the published image except that CA bundle.
+- **Documentation.** A Diátaxis split — tutorial, how-to, reference, explanation — with drift guards that fail the build when the reference pages fall behind the code.
-- **Releases.** Tags publish five assets — static musl tarballs for
-  `x86_64-linux-musl` and `aarch64-linux-musl`, `IMAGE-DIGEST.txt` naming the
-  multi-architecture container image by digest, `SHA256SUMS.txt` over those
-  three, and `SHA256SUMS.txt.asc`, a detached signature over the checksum file.
-  `zig build dist` and `zig build verify-dist` produce and check the same
-  artifacts on a laptop.
-- **Licensing.** EUPL-1.2, with a `THIRD-PARTY-NOTICES` file in every tarball and
-  image assembled from a reviewed inventory of what the artifacts contain.
-- **Documentation.** A Diátaxis split — tutorial, how-to, reference, explanation —
-  with drift guards that fail the build when the reference pages fall behind the
-  code.

INSTALL.md

@@ -11,12 +11,9 @@ This directory is an nxdns release for one architecture. It holds:
 | `THIRD-PARTY-NOTICES` | Licences of everything compiled or bundled in |
 | `INSTALL.md` | This file |
 
-The binary is statically linked against musl and needs nothing installed on the
+The binary is statically linked against musl and needs nothing installed on the target host.
-target host.
 
-Verify the download before you trust it. `docs/how-to/verify-a-release.md` in
+Verify the download before you trust it. `docs/how-to/verify-a-release.md` in the repository covers where the public key comes from, what fingerprint to expect, and what the signature does and does not prove.
-the repository covers where the public key comes from, what fingerprint to
-expect, and what the signature does and does not prove.
 
 ## 1. Install the binary, the user and the unit
 
@@ -34,12 +31,9 @@ systemctl daemon-reload
 mkdir -p -m 0755 /etc/nxdns
 ```
 
-`nxdns.conf` ships under the name it is installed as, so there is no rename to
+`nxdns.conf` ships under the name it is installed as, so there is no rename to get wrong.
-get wrong.
 
-Do not create `/var/lib/nxdns` or `/var/log/nxdns` by hand. The unit's
+Do not create `/var/lib/nxdns` or `/var/log/nxdns` by hand. The unit's `StateDirectory` and `LogsDirectory` settings make systemd create them on first start, `/var/lib/nxdns` at mode 0700 owned by `nxdns`.
-`StateDirectory` and `LogsDirectory` settings make systemd create them on first
-start, `/var/lib/nxdns` at mode 0700 owned by `nxdns`.
 
 ## 2. Write the configuration
 
@@ -53,20 +47,14 @@ nxdns will not start with nothing to forward to. Write `/etc/nxdns/config.zon`:
 }
 ```
 
-That file holds a password in plain text. Root's umask is 022 on most
+That file holds a password in plain text. Root's umask is 022 on most distributions, so restrict it as soon as you have written it:
-distributions, so restrict it as soon as you have written it:
 
 ```sh
 chown root:nxdns /etc/nxdns/config.zon
 chmod 0640 /etc/nxdns/config.zon
 ```
 
-0640 with group `nxdns` rather than 0600: the service runs as `nxdns`, and
+0640 with group `nxdns` rather than 0600: the service runs as `nxdns`, and systemd leaves `/etc/nxdns` owned by root. Keep that group read bit for good. Under `run --config` the service reads this file on **every** start, not once, so tightening the mode after the first boot breaks the next restart. Under database authority it is `nxdns import` that reads the file, as whoever runs that command, and a bare `nxdns run` never reads it at all.
-systemd leaves `/etc/nxdns` owned by root. Keep that group read bit for good.
-Under `run --config` the service reads this file on **every** start, not once,
-so tightening the mode after the first boot breaks the next restart. Under
-database authority it is `nxdns import` that reads the file, as whoever runs
-that command, and a bare `nxdns run` never reads it at all.
 
 Check it before starting the service:
 
@@ -74,9 +62,7 @@ Check it before starting the service:
 nxdns check --config /etc/nxdns/config.zon
 ```
 
-A good file ends with `OK: no problems found`. Exit 2 means `check` found
+A good file ends with `OK: no problems found`. Exit 2 means `check` found something to fix and printed every problem it found. The upstream probe sends a real query, so this needs working DNS on the host.
-something to fix and printed every problem it found. The upstream probe sends a
-real query, so this needs working DNS on the host.
 
 Load it into the database:
 
@@ -84,10 +70,7 @@ Load it into the database:
 nxdns import /etc/nxdns/config.zon
 ```
 
-The packaged unit runs `nxdns run` with no `--config`, so from here the database
+The packaged unit runs `nxdns run` with no `--config`, so from here the database is the configuration and nothing reads the file again. `web.password` is hashed and the plaintext is never stored, so once you have logged in you can delete the file:
-is the configuration and nothing reads the file again. `web.password` is hashed
-and the plaintext is never stored, so once you have logged in you can delete the
-file:
 
 ```sh
 rm /etc/nxdns/config.zon
@@ -95,10 +78,7 @@ rm /etc/nxdns/config.zon
 
 A kept file is not a backup. `nxdns export` is.
 
-To keep the file as the configuration instead — converged at every start, with
+To keep the file as the configuration instead — converged at every start, with the UI refusing configuration edits — do not delete it, and add a drop-in that appends `--config=/etc/nxdns/config.zon` to `ExecStart`. See `docs/how-to/install-with-systemd.md`.
-the UI refusing configuration edits — do not delete it, and add a drop-in that
-appends `--config=/etc/nxdns/config.zon` to `ExecStart`. See
-`docs/how-to/install-with-systemd.md`.
 
 ## 3. Start it
 
@@ -107,9 +87,7 @@ systemctl enable --now nxdns
 journalctl -u nxdns -f
 ```
 
-A healthy start logs a line naming every socket it bound. Port 53 is
+A healthy start logs a line naming every socket it bound. Port 53 is privileged, and the unit grants `CAP_NET_BIND_SERVICE` through `AmbientCapabilities`.
-privileged, and the unit grants `CAP_NET_BIND_SERVICE` through
-`AmbientCapabilities`.
 
 ## 4. Confirm it answers
 
@@ -119,9 +97,7 @@ From another machine on the LAN:
 dig @<server-ip> example.com A +short
 ```
 
-The admin interface is on port 8080 by default; log in with the password from
+The admin interface is on port 8080 by default; log in with the password from the configuration file. `http://<server-ip>:8080/api/health` reports upstream availability and disk state without a login.
-the configuration file. `http://<server-ip>:8080/api/health` reports upstream
-availability and disk state without a login.
 
 ## More
 

PLAN.md

@@ -1,7 +1,6 @@
 # nxdns — Implementation Plan v3.0 (Zig 0.16.0 Stable)
 
-Source of truth for **nxdns**, a self-hosted DNS sinkhole written in Zig 0.16.0 stable.
+Source of truth for **nxdns**, a self-hosted DNS sinkhole written in Zig 0.16.0 stable. All stdlib claims in this document are verified against the `0.16.0` tag of the Zig repo (`../zig`).
-All stdlib claims in this document are verified against the `0.16.0` tag of the Zig repo (`../zig`).
 
 There is no v1/v2 versioning. Scope is binary: a feature is in scope (and gets built) or out of scope (and does not). "Done" = everything in scope implemented, tested, documented.
 
@@ -121,16 +120,9 @@ Rule kinds: `exact`, parent-walk (implicit via candidate chain), `wildcard` (`*`
 
 Tie-break at same specificity: **allow wins**.
 
-Each level is checked against the whole candidate chain before the next level is
+Each level is checked against the whole candidate chain before the next level is checked against any, which is what makes an allow rule on a parent beat a block rule on the child.
-checked against any, which is what makes an allow rule on a parent beat a block
-rule on the child.
 
-Two positions carry an argument rather than a preference. The regex levels come
+Two positions carry an argument rather than a preference. The regex levels come last among the operator rules because they are the only ones that are not a set lookup or a label walk: a regex runs only once every cheaper level has missed. Blocklist exceptions come below **every** operator level because a downloaded list may cancel what another list blocked and must never cancel what the operator decided — no list can open an allow hole the operator did not open.
-last among the operator rules because they are the only ones that are not a set
-lookup or a label walk: a regex runs only once every cheaper level has missed.
-Blocklist exceptions come below **every** operator level because a downloaded
-list may cancel what another list blocked and must never cancel what the
-operator decided — no list can open an allow hole the operator did not open.
 
 ### 3.11 Network Posture
 
@@ -250,7 +242,7 @@ src/
       rules.zig  local.zig  lookup.zig  pause.zig  settings.zig
       upstream_health.zig  certs.zig  health.zig  version.zig
 
-web/                     # Vite + React + TS + StyleX + React Aria + TanStack
+admin/                   # Vite + React + TS + StyleX + React Aria + TanStack
 vendor/                  # sqlite3 amalgamation, mbedtls (pinned)
 docs/                    # tutorial/ how-to/ reference/ explanation/ (Diátaxis)
 tests/                   # dns/ integration/ fuzz/
@@ -290,8 +282,7 @@ Walk chain to depth 8; any target hitting block logic → synthesize blocked res
 
 ### 7.1 Evaluation
 
-For `{domain, group_id}` (the qtype travels with the query for logging and response synthesis, not
+For `{domain, group_id}` (the qtype travels with the query for logging and response synthesis, not for matching):
-for matching):
 1. Normalize: lowercase, trim trailing dot.
 2. Build candidate chain (full, parent1, parent2, …).
 3. Explicit rules per §3.10 precedence, allow before block at each level: exact rules against every candidate in the chain, then wildcard patterns and then regex patterns against the whole name (both kinds express their own reach, so neither walks the chain).
@@ -300,10 +291,7 @@ for matching):
 6. Group's blocklist wildcards, matched against every proper parent of the query name.
 7. No match → allow.
 
-Blocklist *domain* entries do not parent-walk: they are matched against the query name alone. Wildcard
+Blocklist *domain* entries do not parent-walk: they are matched against the query name alone. Wildcard entries match every proper parent, and exception entries walk the candidate chain the way rules do (§3.9), so `@@||good.ads.example^` also lifts `y.good.ads.example`. ABP `||x.y^` emits both a domain entry `x.y` and a wildcard entry `x.y`, which together give domain-and-subdomains semantics.
-entries match every proper parent, and exception entries walk the candidate chain the way rules do
-(§3.9), so `@@||good.ads.example^` also lifts `y.good.ads.example`. ABP `||x.y^` emits both a domain
-entry `x.y` and a wildcard entry `x.y`, which together give domain-and-subdomains semantics.
 
 ### 7.2 Group Assignment
 
@@ -314,12 +302,7 @@ entry `x.y` and a wildcard entry `x.y`, which together give domain-and-subdomain
 
 ### 7.3 Reload
 
-New immutable matcher built from DB + compiled list files → swap under an `std.Io.RwLock` with a
+New immutable matcher built from DB + compiled list files → swap under an `std.Io.RwLock` with a generation counter. Readers take the shared lock for the microseconds of one evaluate; the writer takes the exclusive lock only for the swap, and the source status table is installed in the same critical section, so a failed reload publishes neither. (Deliberate deviation from "readers lock-free": freeing the old snapshot without a lock needs epoch-based reclamation, unjustifiable at household scale — see specs/milestone-5.md S8.3.)
-generation counter. Readers take the shared lock for the microseconds of one evaluate; the writer
-takes the exclusive lock only for the swap, and the source status table is installed in the same
-critical section, so a failed reload publishes neither. (Deliberate deviation from "readers
-lock-free": freeing the old snapshot without a lock needs epoch-based reclamation, unjustifiable at
-household scale — see specs/milestone-5.md S8.3.)
 
 ### 7.4 Safe-Search
 
@@ -342,7 +325,7 @@ Per-group boolean. Rewrites known engine domains to their safe-search CNAME targ
 
 - Schemes: `https://…` → DoH, `tls://host:853` → DoT.
 - Ordered by priority; sequential attempt; per-upstream failure counters; exponential backoff with jitter; success resets.
-- `UpstreamHealth` per upstream: last_success_at, last_error_at, last_error_message, rolling success rate, consecutive failures, backoff-until. Exposed via `GET /api/upstream/health`, dashboard, `/metrics`, and `nxdns check`.
+- `UpstreamHealth` per upstream: last_success_at, last_error_at, last_error_message, rolling success rate, consecutive failures, backoff-until. This is routing state: it drives failover and backoff, and is exposed through `/metrics` and `nxdns check`. `GET /api/upstream/health?period=…` exposes none of it except the live `enabled`/`available` pair; its counts, success rate and last failure are ranged aggregates read from the per-minute upstream history in `querylog.db`, so the dashboard's period scopes them like every other number on the page.
 - DoH client: `std.http.Client` with `content-type/accept: application/dns-message`; strict status + payload checks.
 - `platform/tls_client.zig` enforces per-connection read/write deadlines, classifies TLS errors explicitly, retries with backoff. Integration tests cover timeout/hang scenarios so compiler upgrades can't silently regress them.
 - Connect, read, and total-budget timeouts each configurable.
@@ -365,14 +348,9 @@ Per-group boolean. Rewrites known engine domains to their safe-search CNAME targ
 
 ### 11.2 config.db Schema (v1 baseline)
 
-The DDL below is the live schema, kept byte-identical to
+The DDL below is the live schema, kept byte-identical to `src/storage/config_schema.zig`. `src/storage/migrations.zig` carries it as its one and only step, so a database is at **version 1** or it does not exist.
-`src/storage/config_schema.zig`. `src/storage/migrations.zig` carries it as its
-one and only step, so a database is at **version 1** or it does not exist.
 
-Until nxdns reaches v0.1 this baseline is **editable**: a schema change edits
+Until nxdns reaches v0.1 this baseline is **editable**: a schema change edits this section and `config_schema.zig` together and adds no migration step. nxdns has no installs, so there is no database for a step to reconcile. At v0.1 the baseline freezes and every later change becomes an append-only step.
-this section and `config_schema.zig` together and adds no migration step. nxdns
-has no installs, so there is no database for a step to reconcile. At v0.1 the
-baseline freezes and every later change becomes an append-only step.
 
 ```sql
 CREATE TABLE schema_version (version INTEGER NOT NULL);
@@ -457,8 +435,28 @@ CREATE TABLE forward_zones (
 );
 
 CREATE TABLE settings (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+
+CREATE TABLE operational_events (
+    id INTEGER PRIMARY KEY,
+    code TEXT NOT NULL,
+    subject_key TEXT NOT NULL,
+    subject_label TEXT NOT NULL,
+    severity TEXT NOT NULL CHECK (severity IN ('warning', 'error')),
+    first_seen INTEGER NOT NULL,
+    last_seen INTEGER NOT NULL,
+    occurrences INTEGER NOT NULL CHECK (occurrences > 0),
+    resolved_at INTEGER,
+    detail TEXT NOT NULL DEFAULT '',
+    CHECK (resolved_at IS NULL OR resolved_at >= first_seen)
+);
+CREATE UNIQUE INDEX idx_operational_events_active
+    ON operational_events(code, subject_key) WHERE resolved_at IS NULL;
+CREATE INDEX idx_operational_events_last_seen
+    ON operational_events(last_seen DESC);
 ```
 
+`operational_events` is the one table here that is **not** configuration. It is the diagnostics log of `src/storage/events.zig`: one row per failure episode, opened on the first failure and resolved when the same subject succeeds again. It is deliberately absent from `config_schema.table_names` and `config_schema.delete_order`, so `nxdns export` never emits it and `nxdns import` never wipes it.
+
 ### 11.3 querylog.db Schema
 
 ```sql
@@ -482,12 +480,30 @@ CREATE TABLE query_log (
 CREATE INDEX idx_query_log_ts ON query_log(timestamp);
 CREATE INDEX idx_query_log_client ON query_log(client_ip);
 CREATE INDEX idx_query_log_domain ON query_log(domain_id);
+
+CREATE TABLE upstream_targets (
+    id INTEGER PRIMARY KEY,
+    url TEXT NOT NULL UNIQUE   -- the historical identity: config.db ids cannot cross database files
+);
+
+CREATE TABLE upstream_minute (
+    upstream_id INTEGER NOT NULL REFERENCES upstream_targets(id),
+    minute_ts INTEGER NOT NULL,
+    successes INTEGER NOT NULL,
+    failures INTEGER NOT NULL,
+    last_failure_ts INTEGER,
+    last_error TEXT,
+    PRIMARY KEY (upstream_id, minute_ts),
+    CHECK (successes >= 0),
+    CHECK (failures >= 0)
+) WITHOUT ROWID;
+CREATE INDEX idx_upstream_minute_ts ON upstream_minute(minute_ts);
 ```
 
 ### 11.4 Query Logger
 
 - In-memory buffer, mutex guarded, hard cap `query_log_buffer_max` (default 10000).
-- Flush: batch size (default 100) or max interval (default 100ms).
+- Flush: batch size (100, comptime) or max interval `query_log_flush_interval_s` (default 60s, 0–3600, 0 = do not wait). One transaction per interval: at household query rates a per-query commit costs orders of magnitude more disk writes than the rows are worth. The interval is also roughly what a crash costs, while the writer is healthy and the disk gate is open — a gated or lock-delayed batch is older, so it is a normal case, not a bound.
 - Privacy transforms (hide_domains / hide_client_ips) applied before persist + SSE fanout.
 - Backpressure: buffer full → drop oldest unflushed entry, increment monotonic `queries_dropped` (exposed in `/api/health` + `/metrics`). SSE fanout precedes buffer insert, so live viewers still see dropped-from-persistence entries.
 
@@ -509,14 +525,7 @@ Periodic delete of rows older than `retention_days`; scheduled checkpoint/VACUUM
 
 ### 12.1 Config ZON Shape
 
-The canonical shape is not duplicated here. It lives in
+The canonical shape is not duplicated here. It lives in [docs/reference/configuration.md](docs/reference/configuration.md), which is handwritten against `config/model.zig` and only partly guarded (the drift test covers settings-key rows, not the whole shape, so a new collection can go undocumented while the guard stays green), and `nxdns export` emits it. A copy in this document is how §12.1 came to describe an `.upstream.servers` field that never existed and to omit the required `.groups` and `.upstreams` — a sample nobody could load. The skeleton, for orientation only:
-[docs/reference/configuration.md](docs/reference/configuration.md), which is
-handwritten against `config/model.zig` and only partly guarded (the drift test
-covers settings-key rows, not the whole shape, so a new collection can go
-undocumented while the guard stays green), and `nxdns export` emits it. A copy in
-this document is how §12.1 came to describe an `.upstream.servers` field that
-never existed and to omit the required `.groups` and `.upstreams` — a sample
-nobody could load. The skeleton, for orientation only:
 
 ```zon
 .{
@@ -551,7 +560,7 @@ Scalars in `settings(key, value)`; ordered/structured items in dedicated tables.
 - `GET /api/lookup?domain=…&group_id=…`
 - `GET/POST /api/pause`
 - `GET/PUT /api/settings`
-- `GET /api/upstream/health`
+- `GET /api/upstream/health?period=…`
 - `POST /api/certs/reload`
 - `GET /api/health` — overall + disk + upstream + queries_dropped rollup
 - `GET /metrics` — Prometheus text exposition: query counters (total/blocked/cached), per-upstream health, cache stats, queries_dropped, disk gauges
@@ -584,48 +593,37 @@ Requirements: responsive desktop/mobile; route loaders for initial fetch; TanSta
 ## 16. Implementation Order
 
 ### Phase 0 — Build Baseline
-Scaffold tree; `build.zig` with 0.16 assertion, musl targets, vendored sqlite3 + mbedtls compiling; version plumbing; Gitea Actions workflows (test, integration, fuzz smoke, OpenAPI lint, frontend build).
+Scaffold tree; `build.zig` with 0.16 assertion, musl targets, vendored sqlite3 + mbedtls compiling; version plumbing; Gitea Actions workflows (test, integration, fuzz smoke, OpenAPI lint, frontend build). Exit: cross-compiled hello-world linking both C deps on both targets; CI green.
-Exit: cross-compiled hello-world linking both C deps on both targets; CI green.
 
 ### Phase 1 — Platform Layer
-`platform/address.zig` (v4/v6 parity + canonical keys); `platform/tls_client.zig` (deadlines, error classes); `platform/tls_server.zig` (mbedTLS handshake → `std.Io.Reader`/`Writer`).
+`platform/address.zig` (v4/v6 parity + canonical keys); `platform/tls_client.zig` (deadlines, error classes); `platform/tls_server.zig` (mbedTLS handshake → `std.Io.Reader`/`Writer`). Exit: UDP echo over `std.Io`; TLS client handshake against a real host; mbedTLS server terminating a loopback TLS connection.
-Exit: UDP echo over `std.Io`; TLS client handshake against a real host; mbedTLS server terminating a loopback TLS connection.
 
 ### Phase 2 — DNS Core
-Types/header/name/question/record/packet; parser + encoder tests + fuzz target; EDNS + DO passthrough.
+Types/header/name/question/record/packet; parser + encoder tests + fuzz target; EDNS + DO passthrough. Exit: unit + fuzz smoke pass.
-Exit: unit + fuzz smoke pass.
 
 ### Phase 3 — Resolver Transport
-UDP server, TCP server, DoH + DoT upstream clients, pool + failover/backoff + health.
+UDP server, TCP server, DoH + DoT upstream clients, pool + failover/backoff + health. Exit: A/AAAA forwarding over UDP + TCP; health populated.
-Exit: A/AAAA forwarding over UDP + TCP; health populated.
 
 ### Phase 4 — Storage + Config
-SQLite wrapper; config.db schema + migration runner; querylog.db schema + recreate-on-mismatch; repositories; ZON loading + import/export; `nxdns check`.
+SQLite wrapper; config.db schema + migration runner; querylog.db schema + recreate-on-mismatch; repositories; ZON loading + import/export; `nxdns check`. Exit: export → import round-trips byte-stable. (The ZON bootstrap this phase shipped was replaced in m20 by the two authority modes above.)
-Exit: export → import round-trips byte-stable. (The ZON bootstrap this phase shipped was replaced in m20 by the two authority modes above.)
 
 ### Phase 5 — Filtering + Local DNS
-Rule matcher (exact/parent/wildcard; `regex` added in m21); blocklist parsers → compiled file format; fetcher + scheduled update; RCU swap; per-group safe-search; local records; forward zones.
+Rule matcher (exact/parent/wildcard; `regex` added in m21); blocklist parsers → compiled file format; fetcher + scheduled update; RCU swap; per-group safe-search; local records; forward zones. Exit: precedence table validated by tests; local zone answers + conditional forwards work.
-Exit: precedence table validated by tests; local zone answers + conditional forwards work.
 
 ### Phase 6 — Cache + Rate Limit + Logging + Disk Monitor
-TTL cache + reconstruction; v4/v6 rate limiter; async query logger + backpressure + retention; DiskMonitor + rotation + error-log dedup.
+TTL cache + reconstruction; v4/v6 rate limiter; async query logger + backpressure + retention; DiskMonitor + rotation + error-log dedup. Exit: disk thresholds trigger degradation + drop counters in integration test.
-Exit: disk thresholds trigger degradation + drop counters in integration test.
 
 ### Phase 7 — Handler Integration
-Full pipeline composition; CNAME uncloaking; pause/resume.
+Full pipeline composition; CNAME uncloaking; pause/resume. Exit: end-to-end DNS flow with blocking, local records, cache, failover.
-Exit: end-to-end DNS flow with blocking, local records, cache, failover.
 
 ### Phase 8 — Web / API / SSE / Auth / Metrics
-HTTP server + router; handlers; SSE; optional auth; API rate limiting; `/metrics`; OpenAPI served + contract tests; embedded frontend + dev-mode disk serving.
+HTTP server + router; handlers; SSE; optional auth; API rate limiting; `/metrics`; OpenAPI served + contract tests; embedded frontend + dev-mode disk serving. Exit: frontend fully drives config and operations; contract tests green.
-Exit: frontend fully drives config and operations; contract tests green.
 
 ### Phase 9 — Local DoH/DoT Endpoints
-DoH server + DoT server on `platform/tls_server.zig`; cert watcher + reload.
+DoH server + DoT server on `platform/tls_server.zig`; cert watcher + reload. Exit: LAN client resolves via DoH and DoT against local certs.
-Exit: LAN client resolves via DoH and DoT against local certs.
 
 ### Phase 10 — Packaging + Ops + Docs
-systemd unit (`AmbientCapabilities=CAP_NET_BIND_SERVICE`, hardened, writable `/var/lib/nxdns` + optional `/var/log/nxdns`); Dockerfile + compose (53/udp+tcp, 8080; mounts `/etc/nxdns`, `/var/lib/nxdns`); operator/architecture/config-reference/API docs.
+systemd unit (`AmbientCapabilities=CAP_NET_BIND_SERVICE`, hardened, writable `/var/lib/nxdns` + optional `/var/log/nxdns`); Dockerfile + compose (53/udp+tcp, 8080; mounts `/etc/nxdns`, `/var/lib/nxdns`); operator/architecture/config-reference/API docs. Exit: documented deployment works end-to-end on the Pi 5.
-Exit: documented deployment works end-to-end on the Pi 5.
 
 ---
 
@@ -660,9 +658,7 @@ Exit: documented deployment works end-to-end on the Pi 5.
 
 ## 20. Publication
 
-The project publishes released binaries and container images from its own Gitea
+The project publishes released binaries and container images from its own Gitea instance. Building from source stays fully supported and documented; it is no longer the only path.
-instance. Building from source stays fully supported and documented; it is no
-longer the only path.
 
 - **Trigger.** Pushing an annotated, GPG-signed tag `vX.Y.Z` to `git.mial.net/mokhtar/nxdns`. Nothing else publishes. Pre-release tags are rejected.
 - **Version.** The tag is authoritative. `build.zig.zon`'s `.version` must equal the tag, and the packaging gate asserts it. Nowhere else stores a version.

README.md

@@ -1,7 +1,6 @@
 # nxdns
 
-nxdns is a DNS sinkhole for your LAN. It blocks the names you do not want, and
+nxdns is a DNS sinkhole for your LAN. It blocks the names you do not want, and forwards the rest over an encrypted connection.
-forwards the rest over an encrypted connection.
 
 ```mermaid
 flowchart LR
@@ -12,49 +11,30 @@ flowchart LR
     nxdns -- "blocked" --> sink["0.0.0.0 / NXDOMAIN"]
 ```
 
-One static Zig binary. SQLite holds the state and the query log, which the web
+One static Zig binary. SQLite holds the state and the query log, which the web UI, the REST API and `/metrics` read.
-UI, the REST API and `/metrics` read.
 
 ## Features
 
-- Blocklist filtering: subscribe to hosts, domain and Adblock Plus lists —
+- Blocklist filtering: subscribe to hosts, domain and Adblock Plus lists — whose `@@` exception lines are honoured — plus your own allow and block rules, exact, wildcard (`*.example.com`) or regular expression
-  whose `@@` exception lines are honoured — plus your own allow and block rules,
+- Two configuration modes: a database the web UI edits, or a ZON file you keep in git and converge onto at every start
-  exact, wildcard (`*.example.com`) or regular expression
+- Per-client policy groups: different filtering for the kids' tablet and your workstation
-- Two configuration modes: a database the web UI edits, or a ZON file you keep
-  in git and converge onto at every start
-- Per-client policy groups: different filtering for the kids' tablet and
-  your workstation
 - Local DNS records and conditional forwarding for internal zones
 - Encrypted upstreams: DNS-over-HTTPS and DNS-over-TLS with failover
 - Built-in DoH and DoT server endpoints, with certificate hot-reload
 - Bounded in-memory DNS cache with TTL-respecting expiry
 - Query log with retention limits, live-streamed over SSE
 - Web UI (embedded in the binary) and a REST API with a served OpenAPI spec
-- Prometheus-style `/metrics`, per-client rate limiting, disk-full
+- Prometheus-style `/metrics`, per-client rate limiting, disk-full self-protection
-  self-protection
 
 ## Install
 
-**No release exists yet.** This repository has no tags, nothing has been
+**No release exists yet.** This repository has no tags, nothing has been published to <https://git.mial.net/mokhtar/nxdns/releases>, and no container image has been pushed. Every release URL on this page and in the how-to guides is a 404 today, and `docker pull` finds nothing. Until the first tag ships, building from source is the only way to get nxdns.
-published to <https://git.mial.net/mokhtar/nxdns/releases>, and no container
-image has been pushed. Every release URL on this page and in the how-to guides
-is a 404 today, and `docker pull` finds nothing. Until the first tag ships,
-building from source is the only way to get nxdns.
 
-What a tag will publish, once one exists: five assets — two static musl
+What a tag will publish, once one exists: five assets — two static musl tarballs (`nxdns-<version>-x86_64-linux-musl.tar.gz`, `nxdns-<version>-aarch64-linux-musl.tar.gz`), `IMAGE-DIGEST.txt` naming the multi-architecture container image by digest, `SHA256SUMS.txt` covering those three files, and `SHA256SUMS.txt.asc`, a detached OpenPGP signature over the checksum file. Verify what you downloaded before you run it: [docs/how-to/verify-a-release.md](docs/how-to/verify-a-release.md), which also says what that signature does and does not prove.
-tarballs (`nxdns-<version>-x86_64-linux-musl.tar.gz`,
-`nxdns-<version>-aarch64-linux-musl.tar.gz`), `IMAGE-DIGEST.txt` naming the
-multi-architecture container image by digest, `SHA256SUMS.txt` covering those
-three files, and `SHA256SUMS.txt.asc`, a detached OpenPGP signature over the
-checksum file. Verify what you downloaded before you run it:
-[docs/how-to/verify-a-release.md](docs/how-to/verify-a-release.md), which also
-says what that signature does and does not prove.
 
 ## Quickstart (docker compose)
 
-Write a minimal configuration and start the published image. This is what the
+Write a minimal configuration and start the published image. This is what the first release will make possible; it does not work today, because there is no image in the registry to pull:
-first release will make possible; it does not work today, because there is no
-image in the registry to pull:
 
 ```sh
 cd deploy/docker
@@ -69,90 +49,52 @@ EOF
 NXDNS_VERSION=<version> docker compose up -d
 ```
 
-The compose file defaults to `:latest`; pin a version for anything you intend
+The compose file defaults to `:latest`; pin a version for anything you intend to keep running. To run it before a release exists, build the image yourself and name it — `NXDNS_IMAGE=nxdns docker compose up -d` — as [docs/how-to/install-with-docker.md](docs/how-to/install-with-docker.md) describes. DNS is on port 53, the web UI on <http://localhost:8080>.
-to keep running. To run it before a release exists, build the image yourself and
-name it — `NXDNS_IMAGE=nxdns docker compose up -d` — as
-[docs/how-to/install-with-docker.md](docs/how-to/install-with-docker.md)
-describes. DNS is on port 53, the web UI on <http://localhost:8080>.
 
-The compose file runs `nxdns run --config=/etc/nxdns/config.zon`, which makes
+The compose file runs `nxdns run --config=/etc/nxdns/config.zon`, which makes that file the configuration: every start reconciles the database onto it, and the UI refuses configuration edits. Edit the file and restart to change anything. Drop the `command:` line to run bare `nxdns run` instead, where the database is the configuration and changes go through the UI, the API, or `nxdns export` / `nxdns import` — the packaged systemd unit does that. Which mode is live is printed at every start (`authority: database` / `authority: file (<path>)`); see [docs/explanation/configuration-model.md](docs/explanation/configuration-model.md).
-that file the configuration: every start reconciles the database onto it, and
-the UI refuses configuration edits. Edit the file and restart to change
-anything. Drop the `command:` line to run bare `nxdns run` instead, where the
-database is the configuration and changes go through the UI, the API, or
-`nxdns export` / `nxdns import` — the packaged systemd unit does that. Which
-mode is live is printed at every start (`authority: database` /
-`authority: file (<path>)`); see
-[docs/explanation/configuration-model.md](docs/explanation/configuration-model.md).
 
-Full install instructions, including the systemd path and the Pi 5 recipe, are
+Full install instructions, including the systemd path and the Pi 5 recipe, are in [docs/how-to/install-with-systemd.md](docs/how-to/install-with-systemd.md) and [docs/how-to/install-with-docker.md](docs/how-to/install-with-docker.md).
-in
-[docs/how-to/install-with-systemd.md](docs/how-to/install-with-systemd.md) and
-[docs/how-to/install-with-docker.md](docs/how-to/install-with-docker.md).
 
 ## Building from source
 
-Requires [Zig 0.16.0](https://ziglang.org/download/) and Node.js 24 (for
+Requires [Zig 0.16.0](https://ziglang.org/download/) and Node.js 24 (for the web UI). C dependencies (SQLite, mbedTLS) are vendored and built by `zig build`.
-the web UI). C dependencies (SQLite, mbedTLS) are vendored and built by
-`zig build`.
 
 ```sh
-(cd web && npm ci && npm run build)          # web UI -> web/dist
+(cd admin && npm ci && npm run build)          # web UI -> admin/dist
-zig build -Dweb-dist=web/dist                # native binary -> zig-out/bin/nxdns
+zig build -Dadmin-dist=admin/dist                # native binary -> zig-out/bin/nxdns
 zig build test --summary all                 # unit tests
 ```
 
-The release artifacts come out of the same build graph, so the whole release
+The release artifacts come out of the same build graph, so the whole release build runs on a laptop exactly as it runs on the CI runner:
-build runs on a laptop exactly as it runs on the CI runner:
 
 ```sh
-(cd web && npm ci && npm run build)                # required: dist refuses the placeholder
+(cd admin && npm ci && npm run build)                # required: dist refuses the placeholder
 VERSION=$(sed -n 's/^[[:space:]]*\.version[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p' build.zig.zon)
 zig build dist -Dversion-string="$VERSION" -Dgit-commit=$(git rev-parse HEAD) \
-    -Dweb-dist=web/dist -Doptimize=ReleaseSafe     # tarballs -> zig-out/dist/
+    -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe     # tarballs -> zig-out/dist/
 zig build verify-dist -Dversion-string="$VERSION" -Dgit-commit=$(git rev-parse HEAD) \
-    -Dweb-dist=web/dist -Doptimize=ReleaseSafe     # the release checks
+    -Dadmin-dist=admin/dist -Doptimize=ReleaseSafe     # the release checks
 ```
 
-The version comes from `build.zig.zon` because `verify-dist` asserts the two
+The version comes from `build.zig.zon` because `verify-dist` asserts the two agree; a tag sets both.
-agree; a tag sets both.
 
-That is not a claim that your tarball will hash the same as a published one.
+That is not a claim that your tarball will hash the same as a published one. Nothing in this project measures whether two builds of the same commit on two different machines land on the same bytes, so no document here describes the build as reproducible. The gate that would settle it is a recorded deferral — `specs/milestone-14.md` ruling 12 — and [docs/how-to/verify-a-release.md](docs/how-to/verify-a-release.md) explains what a matching or differing hash is worth in the meantime.
-Nothing in this project measures whether two builds of the same commit on two
-different machines land on the same bytes, so no document here describes the
-build as reproducible. The gate that would settle it is a recorded deferral —
-`specs/milestone-14.md` ruling 12 — and
-[docs/how-to/verify-a-release.md](docs/how-to/verify-a-release.md) explains what
-a matching or differing hash is worth in the meantime.
 
 ## Documentation
 
-Start at [docs/README.md](docs/README.md), which splits the documentation
+Start at [docs/README.md](docs/README.md), which splits the documentation into a tutorial, how-to guides, reference and explanation.
-into a tutorial, how-to guides, reference and explanation.
 
-- [docs/tutorial/first-run.md](docs/tutorial/first-run.md) — build it, resolve
+- [docs/tutorial/first-run.md](docs/tutorial/first-run.md) — build it, resolve a name, block a domain, on a scratch directory
-  a name, block a domain, on a scratch directory
+- [docs/how-to/install-with-systemd.md](docs/how-to/install-with-systemd.md) — a real install, including the Raspberry Pi 5
-- [docs/how-to/install-with-systemd.md](docs/how-to/install-with-systemd.md) —
+- [docs/how-to/verify-a-release.md](docs/how-to/verify-a-release.md) — checking the hashes and the signature before you install
-  a real install, including the Raspberry Pi 5
+- [docs/reference/configuration.md](docs/reference/configuration.md) — every configuration field
-- [docs/how-to/verify-a-release.md](docs/how-to/verify-a-release.md) — checking
-  the hashes and the signature before you install
-- [docs/reference/configuration.md](docs/reference/configuration.md) — every
-  configuration field
 - [docs/reference/api.md](docs/reference/api.md) — REST API, auth and SSE
-- [docs/reference/cli.md](docs/reference/cli.md) — subcommands, flags and exit
+- [docs/reference/cli.md](docs/reference/cli.md) — subcommands, flags and exit codes
-  codes
+- [docs/explanation/architecture.md](docs/explanation/architecture.md) — module map and design
-- [docs/explanation/architecture.md](docs/explanation/architecture.md) — module
+- [PLAN.md](PLAN.md) and [specs/](specs/) — scope, design decisions and per-milestone contracts
-  map and design
-- [PLAN.md](PLAN.md) and [specs/](specs/) — scope, design decisions and
-  per-milestone contracts
 
 ## Licence
 
-Copyright (c) 2026 Mokhtar Mial. nxdns is licensed under the European Union
+Copyright (c) 2026 Mokhtar Mial. nxdns is licensed under the European Union Public Licence v. 1.2 (`EUPL-1.2`); the full text is in [LICENSE](LICENSE).
-Public Licence v. 1.2 (`EUPL-1.2`); the full text is in [LICENSE](LICENSE).
 
-Every released tarball and image carries a `THIRD-PARTY-NOTICES` file assembled
+Every released tarball and image carries a `THIRD-PARTY-NOTICES` file assembled from the reviewed inventory in [licenses/](licenses/), which covers what the artifacts actually contain: musl, the Zig runtime, SQLite, Mbed TLS and its vendored Everest and p256-m code, and the JavaScript and CSS bundled into the admin UI.
-from the reviewed inventory in [licenses/](licenses/), which covers what the
-artifacts actually contain: musl, the Zig runtime, SQLite, Mbed TLS and its
-vendored Everest and p256-m code, and the JavaScript and CSS bundled into the
-admin UI.

admin/package-lock.json

@@ -1,11 +1,11 @@
 {
-	"name": "nxdns-web",
+	"name": "nxdns-admin",
 	"version": "0.0.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
-			"name": "nxdns-web",
+			"name": "nxdns-admin",
 			"version": "0.0.0",
 			"dependencies": {
 				"@stylexjs/stylex": "0.19.0",

admin/package.json

@@ -1,5 +1,5 @@
 {
-	"name": "nxdns-web",
+	"name": "nxdns-admin",
 	"private": true,
 	"version": "0.0.0",
 	"type": "module",

admin/scripts/assert-bundled-packages.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// The set of npm packages whose bytes reach web/dist must be exactly the set
+// The set of npm packages whose bytes reach admin/dist must be exactly the set
 // recorded in licenses/dependency-identity.txt (milestone-14 ruling 3).
 //
 // The shipped build carries no sourcemaps, so this makes a second build with
 // them into its own directory: the `sources` list of each chunk names the
 // modules that went into it, and the artifact `npm run build` produced stays
-// untouched. Runs from web/ as `npm run assert-bundled`, on a laptop exactly as
+// untouched. Runs from admin/ as `npm run assert-bundled`, on a laptop exactly as
 // on the runner.
 
 import { execFileSync } from "node:child_process";
@@ -85,10 +85,10 @@ try {
 
 const recorded = recordedPackages(identity);
 if (recorded === null) {
-	fail("assert-bundled: licenses/dependency-identity.txt has no '[npm packages bundled into web/dist]' section");
+	fail("assert-bundled: licenses/dependency-identity.txt has no '[npm packages bundled into admin/dist]' section");
 }
 if (recorded.length === 0) {
-	fail("assert-bundled: the '[npm packages bundled into web/dist]' section is empty");
+	fail("assert-bundled: the '[npm packages bundled into admin/dist]' section is empty");
 }
 
 const { added, removed } = comparePackages(recorded, bundled);
@@ -96,12 +96,12 @@ if (added.length !== 0 || removed.length !== 0) {
 	process.stderr.write(`${formatDiff(recorded, bundled)}\n\n`);
 	fail(
 		[
-			"the set of npm packages in web/dist has changed (-recorded +current).",
+			"the set of npm packages in admin/dist has changed (-recorded +current).",
 			"Work out what the change means for licenses/inventory.zon first, then record",
 			"the new list in that section of licenses/dependency-identity.txt.",
 		].join("\n"),
 	);
 }
 
-process.stdout.write(`web/dist bundles exactly the ${bundled.length} recorded packages:\n`);
+process.stdout.write(`admin/dist bundles exactly the ${bundled.length} recorded packages:\n`);
 for (const name of bundled) process.stdout.write(`${name}\n`);

admin/scripts/assert-css-layers.mjs

@@ -14,7 +14,7 @@
 // brace inside a string blinds the stripper; and with several stylesheets it
 // judges each alone, not their load order in the document.
 //
-// This check runs from web/ as part of `npm run build`.
+// This check runs from admin/ as part of `npm run build`.
 
 import { readdirSync, readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
@@ -110,7 +110,7 @@ for (const sheet of sheets) {
 }
 
 if (failed) {
-	console.error("Wrap it in a layer declared before StyleX's, as web/src/styles.css does.");
+	console.error("Wrap it in a layer declared before StyleX's, as admin/src/styles.css does.");
 	process.exit(1);
 }
 console.log(

admin/scripts/bundledPackages.mjs

@@ -8,7 +8,7 @@
 // lockfile, no version and no dependency set changes — only the bundle does. So
 // the bundle is what this reads.
 
-const sectionHeading = "[npm packages bundled into web/dist]";
+const sectionHeading = "[npm packages bundled into admin/dist]";
 
 // A sourcemap `sources` entry for a dependency ends in
 // `node_modules/<name>/<file>` or `node_modules/@<scope>/<name>/<file>`. Only

admin/scripts/bundledPackages.test.mjs

@@ -48,7 +48,7 @@ describe("recordedPackages", () => {
 		"[some earlier section]",
 		"ignored",
 		"",
-		"[npm packages bundled into web/dist]",
+		"[npm packages bundled into admin/dist]",
 		"react",
 		"@tanstack/react-query",
 		"",
@@ -64,7 +64,7 @@ describe("recordedPackages", () => {
 
 	it("distinguishes a missing section from an empty one", () => {
 		expect(recordedPackages("[other]\nx\n")).toBeNull();
-		expect(recordedPackages("[npm packages bundled into web/dist]\n\n[next]\n")).toEqual([]);
+		expect(recordedPackages("[npm packages bundled into admin/dist]\n\n[next]\n")).toEqual([]);
 	});
 });
 

admin/scripts/stamp-dist.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-// Freshness stamp for web/dist (milestone-15 ruling 5). A stale dist has
+// Freshness stamp for admin/dist (milestone-15 ruling 5). A stale dist has
-// already shipped a crashing settings page once. Write mode runs from web/ as
+// already shipped a crashing settings page once. Write mode runs from admin/ as
 // part of `npm run build`; check mode runs from the repository root as a
 // build.zig system command. Every path resolves from this file's own location
 // so both working directories hash the same set.
@@ -13,7 +13,7 @@ import { fileURLToPath } from "node:url";
 const webRoot = dirname(dirname(fileURLToPath(import.meta.url)));
 const distDir = join(webRoot, "dist");
 const stampFile = join(distDir, ".src-hash");
-const stampRelative = "web/dist/.src-hash";
+const stampRelative = "admin/dist/.src-hash";
 
 const inputDirs = ["src", "public"];
 const inputFiles = [
@@ -26,7 +26,7 @@ const inputFiles = [
 	"tsconfig.node.json",
 ];
 
-const staleMessage = "web/dist is stale: rebuild the frontend (npm run build)";
+const staleMessage = "admin/dist is stale: rebuild the frontend (npm run build)";
 
 function fail(message) {
 	process.stderr.write(`${message}\n`);
@@ -39,7 +39,7 @@ function walk(relativeDir) {
 	try {
 		entries = readdirSync(absolute, { withFileTypes: true });
 	} catch (err) {
-		fail(`stamp-dist: cannot read web/${relativeDir}: ${err.message}`);
+		fail(`stamp-dist: cannot read admin/${relativeDir}: ${err.message}`);
 	}
 	const found = [];
 	for (const entry of entries) {
@@ -57,9 +57,9 @@ function inputSet() {
 	const paths = [...inputFiles, ...inputDirs.flatMap(walk)];
 	for (const path of inputFiles) {
 		try {
-			if (!statSync(join(webRoot, path)).isFile()) fail(`stamp-dist: web/${path} is not a file`);
+			if (!statSync(join(webRoot, path)).isFile()) fail(`stamp-dist: admin/${path} is not a file`);
 		} catch (err) {
-			fail(`stamp-dist: cannot stat web/${path}: ${err.message}`);
+			fail(`stamp-dist: cannot stat admin/${path}: ${err.message}`);
 		}
 	}
 	// Sorted by path so the digest does not depend on directory order.

admin/src/features/clients/ClientsPage.tsx

@@ -56,23 +56,6 @@ const styles = stylex.create({
 	dash: {
 		color: colors.textMuted,
 	},
-	/**
-	 * A learned name is runtime state, not something the operator typed, so it
-	 * reads muted and carries an outlined "learned" tag. The tag is real text —
-	 * a screen reader announces it — because colour alone is not an affordance.
-	 */
-	learnedTag: {
-		marginLeft: "0.5rem",
-		borderWidth: 1,
-		borderStyle: "solid",
-		borderColor: colors.border,
-		borderRadius: "0.25rem",
-		paddingInline: "0.375rem",
-		paddingBlock: "0.125rem",
-		fontSize: "0.75rem",
-		lineHeight: "1rem",
-		color: colors.textMuted,
-	},
 	badge: {
 		marginLeft: "0.5rem",
 		borderRadius: "0.25rem",
@@ -153,9 +136,9 @@ export default function ClientsPage() {
 										{client.name !== "" ? (
 											client.name
 										) : client.learned_name !== "" ? (
-											<span {...stylex.props(styles.dash)}>
+											<span {...stylex.props(shared.learnedName)}>
 												{client.learned_name}
-												<span {...stylex.props(styles.learnedTag)}>learned</span>
+												<span {...stylex.props(shared.learnedTag)}>learned</span>
 											</span>
 										) : (
 											<span {...stylex.props(styles.dash)}>—</span>

admin/src/features/clients/clientNames.tsx

@@ -0,0 +1,53 @@
+/**
+ * The client column of the query tables reads as a name wherever one is known,
+ * with the same precedence the Clients page applies: a hand-typed `name` wins,
+ * the reverse-DNS `learned_name` stands in muted behind it, and an address with
+ * neither — including one the loaded list has never seen — stays bare.
+ *
+ * The muted colour is the whole of the affordance here. The Clients page pairs
+ * it with an outlined "learned" tag, and keeps it: one mention per client is
+ * information. Repeating that tag down every row of a query table is noise, so
+ * the tables carry the name alone.
+ */
+
+import { useMemo } from "react";
+import { useQuery } from "@tanstack/react-query";
+import * as stylex from "@stylexjs/stylex";
+import { clientsQuery } from "@/lib/queries";
+import type { Client } from "@/lib/types";
+import { styles as shared } from "@/ui/styles";
+
+export type ClientNames = ReadonlyMap<string, Pick<Client, "name" | "learned_name">>;
+
+/**
+ * The live stream names clients the loaded list has never seen. Polling folds
+ * them in on the next tick, which keeps the lookup a single cached query
+ * instead of a fetch fired per unknown address.
+ */
+const CLIENTS_POLL_MS = 30_000;
+
+export function useClientNames(): ClientNames {
+	const { data } = useQuery({ ...clientsQuery(), refetchInterval: CLIENTS_POLL_MS });
+	return useMemo(
+		() =>
+			new Map(
+				(data ?? []).map((client) => [client.ip, { name: client.name, learned_name: client.learned_name }]),
+			),
+		[data],
+	);
+}
+
+export function ClientName({ ip, names }: { ip: string; names: ClientNames }) {
+	const client = names.get(ip);
+	if (client === undefined || (client.name === "" && client.learned_name === "")) {
+		return <span {...stylex.props(shared.mono)}>{ip}</span>;
+	}
+	// The name replaces the address on screen, so the address stays reachable
+	// as the tooltip rather than disappearing from the row entirely.
+	if (client.name !== "") return <span title={ip}>{client.name}</span>;
+	return (
+		<span title={ip} {...stylex.props(shared.learnedName)}>
+			{client.learned_name}
+		</span>
+	);
+}

admin/src/features/dashboard/DashboardPage.test.tsx

@@ -5,6 +5,9 @@ import { AuthProvider } from "@/auth/store";
 import { createQueryClient } from "@/lib/queryClient";
 import { createAppRouter } from "@/routes";
 
+/** Wall clock at import; the upstream fixtures date their failures against it. */
+const NOW_S = Math.floor(Date.now() / 1000);
+
 const RESPONSES: Record<string, unknown> = {
 	"/api/stats?period=24h": {
 		period: "24h",
@@ -58,32 +61,67 @@ const RESPONSES: Record<string, unknown> = {
 		writer_failed: false,
 		refreshes_gated: 0,
 		snapshot_generation: 3,
+		diagnostics: { state: "recording", active_warnings: 1, active_errors: 0 },
 	},
-	"/api/upstream/health": {
+	"/api/upstream/health?period=24h": {
+		period: "24h",
+		since: NOW_S - 86_400,
+		until: NOW_S,
+		available: 1,
+		total: 2,
+		complete: true,
 		upstreams: [
 			{
 				url: "https://dns.example/dns-query",
 				enabled: true,
 				available: false,
-				consecutive_failures: 4,
+				period: {
-				total_successes: 90,
+					attempts: 100,
-				total_failures: 10,
+					successes: 90,
-				success_rate: 0.9,
+					failures: 10,
-				last_error: "timeout",
+					success_rate: 0.9,
+					// 3h30m before the fixture's now, far from a unit boundary.
+					last_failure_at: NOW_S - 12_600,
+					last_failure_error: "timeout",
+				},
 			},
 			{
 				url: "udp://9.9.9.9:53",
 				enabled: true,
 				available: true,
-				consecutive_failures: 0,
+				period: {
-				total_successes: 100,
+					attempts: 100,
-				total_failures: 0,
+					successes: 100,
-				success_rate: 1,
+					failures: 0,
-				last_error: "",
+					success_rate: 1,
+					last_failure_at: null,
+					last_failure_error: null,
+				},
 			},
 		],
+	},
+	"/api/upstream/health?period=1h": {
+		period: "1h",
+		since: NOW_S - 3600,
+		until: NOW_S,
 		available: 1,
-		total: 2,
+		total: 1,
+		complete: true,
+		upstreams: [
+			{
+				url: "https://dns.example/dns-query",
+				enabled: true,
+				available: true,
+				period: {
+					attempts: 7,
+					successes: 6,
+					failures: 1,
+					success_rate: 6 / 7,
+					last_failure_at: NOW_S - 300,
+					last_failure_error: "timeout",
+				},
+			},
+		],
 	},
 	"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
 };
@@ -142,7 +180,7 @@ test("dashboard renders stats, chart, disk card, upstream table and health banne
 	expect(screen.getByRole("img", { name: /queries over time/i })).toBeTruthy();
 	expect(screen.getByText("Blocked", { selector: "li" })).toBeTruthy();
 
-	expect(screen.getByText("Disk")).toBeTruthy();
+	expect(screen.getByText("Storage now")).toBeTruthy();
 	expect(screen.getByText("warn")).toBeTruthy();
 	expect(screen.getAllByText("400.0 MiB").length).toBeGreaterThan(0);
 	expect(screen.getByText("12.0 MiB")).toBeTruthy();
@@ -155,10 +193,32 @@ test("dashboard renders stats, chart, disk card, upstream table and health banne
 	expect(screen.getByText("https://dns.example/dns-query")).toBeTruthy();
 	expect(screen.getByText("90.0%")).toBeTruthy();
 	expect(screen.getByText("100.0%")).toBeTruthy();
-	expect(screen.getByText("timeout")).toBeTruthy();
+	expect(screen.getByText("timeout · 3h ago")).toBeTruthy();
 	expect(screen.getByText("1/2 available")).toBeTruthy();
 });
 
+test("live state is labeled on its own card, not by a section that disowns the picker", async () => {
+	renderDashboard();
+	await screen.findByRole("heading", { name: "Dashboard" });
+
+	expect(screen.getByText("Storage now")).toBeTruthy();
+	expect(screen.queryByRole("region", { name: "Right now" })).toBeNull();
+	expect(screen.queryByText("Right now")).toBeNull();
+	expect(screen.queryByText("Snapshot state; the period above does not apply.")).toBeNull();
+});
+
+test("the period picker rescopes the upstream table", async () => {
+	renderDashboard();
+	await screen.findByRole("heading", { name: "Dashboard" });
+	await screen.findByText("90.0%");
+
+	fireEvent.click(screen.getByRole("button", { name: "1h" }));
+
+	await screen.findByText("85.7%");
+	expect(screen.getByRole("columnheader", { name: "Selected period · 1h" })).toBeTruthy();
+	expect(screen.queryByText("90.0%")).toBeNull();
+});
+
 test("period picker refetches stats and shows the empty chart state", async () => {
 	renderDashboard();
 	await screen.findByRole("heading", { name: "Dashboard" });
@@ -173,7 +233,7 @@ test("period picker refetches stats and shows the empty chart state", async () =
 });
 
 test("one failing endpoint degrades its own widget on cold navigation", async () => {
-	failing.add("/api/upstream/health");
+	failing.add("/api/upstream/health?period=24h");
 	renderDashboard();
 	await screen.findByRole("heading", { name: "Dashboard" });
 
@@ -184,6 +244,6 @@ test("one failing endpoint degrades its own widget on cold navigation", async ()
 
 	expect(screen.getByText("1,000")).toBeTruthy();
 	expect(screen.getByRole("img", { name: /queries over time/i })).toBeTruthy();
-	expect(screen.getByText("Disk")).toBeTruthy();
+	expect(screen.getByText("Storage now")).toBeTruthy();
 	expect(screen.queryByText("https://dns.example/dns-query")).toBeNull();
 });

admin/src/features/dashboard/DashboardPage.tsx

@@ -66,7 +66,7 @@ const styles = stylex.create({
 			"@media (prefers-color-scheme: dark)": "oklch(27.4% 0.006 286.033)",
 		},
 	},
-	/** The chart takes two thirds beside the disk card from `lg`, one column below. */
+	/** The chart takes two thirds beside the storage card from `lg`, one column below. */
 	panelGrid: {
 		display: "grid",
 		gap: "1rem",
@@ -123,7 +123,7 @@ export default function DashboardPage() {
 	const stats = useQuery({ ...statsQuery(period), placeholderData: keepPreviousData });
 	const timeseries = useQuery({ ...timeseriesQuery(period), placeholderData: keepPreviousData });
 	const health = useQuery(healthQuery());
-	const upstreamHealth = useQuery(upstreamHealthQuery());
+	const upstreamHealth = useQuery({ ...upstreamHealthQuery(period), placeholderData: keepPreviousData });
 
 	return (
 		<section {...stylex.props(styles.page)}>

admin/src/features/dashboard/DiskCard.tsx

@@ -74,8 +74,10 @@ function stateStyle(state: Health["disk"]["state"]) {
 export default function DiskCard({ disk }: { disk: Health["disk"] }) {
 	return (
 		<section {...stylex.props(styles.card)}>
+			{/* Live state, unlike the ranged widgets around it; the title says so
+			    rather than a section rule the picker would have to disown. */}
 			<h2 {...stylex.props(styles.heading)}>
-				Disk
+				Storage now
 				<span {...stylex.props(styles.badge, stateStyle(disk.state))}>{disk.state}</span>
 			</h2>
 			<dl {...stylex.props(styles.list)}>

admin/src/features/dashboard/UpstreamHealthTable.test.tsx

@@ -0,0 +1,180 @@
+import { render, screen, within } from "@testing-library/react";
+import type { UpstreamHealth, UpstreamHealthEntry, UpstreamPeriodStats } from "@/lib/types";
+import UpstreamHealthTable from "./UpstreamHealthTable";
+
+const NOW_S = 1_700_000_000;
+
+beforeEach(() => {
+	vi.spyOn(Date, "now").mockReturnValue(NOW_S * 1000);
+});
+
+afterEach(() => {
+	vi.restoreAllMocks();
+});
+
+const ZERO: UpstreamPeriodStats = {
+	attempts: 0,
+	successes: 0,
+	failures: 0,
+	success_rate: null,
+	last_failure_at: null,
+	last_failure_error: null,
+};
+
+function period(overrides: Partial<UpstreamPeriodStats> = {}): UpstreamPeriodStats {
+	return {
+		attempts: 100,
+		successes: 90,
+		failures: 10,
+		success_rate: 0.9,
+		// 3h30m ago, far from a unit boundary.
+		last_failure_at: NOW_S - 12_600,
+		last_failure_error: "Timeout",
+		...overrides,
+	};
+}
+
+function entry(overrides: Partial<UpstreamHealthEntry> = {}): UpstreamHealthEntry {
+	return {
+		url: "https://dns.example/dns-query",
+		enabled: true,
+		available: true,
+		period: period(),
+		...overrides,
+	};
+}
+
+function renderTable(upstreams: UpstreamHealthEntry[], overrides: Partial<UpstreamHealth> = {}) {
+	const health: UpstreamHealth = {
+		period: "24h",
+		since: NOW_S - 86_400,
+		until: NOW_S,
+		available: upstreams.filter((upstream) => upstream.available).length,
+		total: upstreams.length,
+		complete: true,
+		upstreams,
+		...overrides,
+	};
+	render(<UpstreamHealthTable health={health} />);
+}
+
+function rowOf(url: string): HTMLElement {
+	const cell = screen.getByText(url);
+	const row = cell.closest("tr");
+	if (row === null) throw new Error(`no row for ${url}`);
+	return row;
+}
+
+test("the ranged columns sit under a header naming the selected period", () => {
+	renderTable([entry()]);
+
+	expect(screen.getByRole("columnheader", { name: "Selected period · 24h" })).toBeTruthy();
+	for (const name of ["Upstream", "Status now", "Attempts", "Failures", "Success rate", "Last failure"]) {
+		expect(screen.getByRole("columnheader", { name })).toBeTruthy();
+	}
+
+	// The unranged yes/no pair the ranged table replaced.
+	expect(screen.queryByRole("columnheader", { name: "Enabled" })).toBeNull();
+	expect(screen.queryByRole("columnheader", { name: "Available" })).toBeNull();
+});
+
+test("status now is one word from live state, not from the window", () => {
+	renderTable([
+		entry({ url: "https://a.example/dns-query" }),
+		entry({ url: "https://b.example/dns-query", available: false }),
+		entry({ url: "https://c.example/dns-query", enabled: false, available: false }),
+	]);
+
+	expect(within(rowOf("https://a.example/dns-query")).getByText("Available")).toBeTruthy();
+	expect(within(rowOf("https://b.example/dns-query")).getByText("Backing off")).toBeTruthy();
+	expect(within(rowOf("https://c.example/dns-query")).getByText("Disabled")).toBeTruthy();
+});
+
+test("last failure pairs the error name with its age, em-dash when the window holds none", () => {
+	renderTable([
+		entry({ url: "https://a.example/dns-query" }),
+		entry({
+			url: "https://b.example/dns-query",
+			period: period({ last_failure_at: null, last_failure_error: null }),
+		}),
+	]);
+
+	expect(within(rowOf("https://a.example/dns-query")).getByText("Timeout · 3h ago")).toBeTruthy();
+	expect(within(rowOf("https://b.example/dns-query")).getByText("—")).toBeTruthy();
+});
+
+test("a window with no attempts renders em-dashes and never a perfect rate", () => {
+	renderTable([entry({ period: ZERO })]);
+
+	const cells = within(rowOf("https://dns.example/dns-query")).getAllByRole("cell");
+	expect(cells.map((cell) => cell.textContent)).toEqual([
+		"https://dns.example/dns-query",
+		"Available",
+		"0",
+		"0",
+		"—",
+		"—",
+	]);
+	expect(screen.queryByText("100.0%")).toBeNull();
+	expect(screen.queryByText("0.0%")).toBeNull();
+});
+
+test("the card says so when every upstream was idle in the window", () => {
+	renderTable([entry({ url: "https://a.example/dns-query", period: ZERO }), entry({ period: ZERO })]);
+
+	expect(screen.getByText("No upstream attempts in this period.")).toBeTruthy();
+});
+
+test("one upstream with attempts keeps the idle message away", () => {
+	renderTable([entry({ url: "https://a.example/dns-query", period: ZERO }), entry()]);
+
+	expect(screen.queryByText("No upstream attempts in this period.")).toBeNull();
+});
+
+test("an incomplete window carries a note; a complete one claims nothing", () => {
+	renderTable([entry()], { complete: false });
+	expect(screen.getByText(/history incomplete/i)).toBeTruthy();
+});
+
+test("a complete window shows no completeness text at all", () => {
+	renderTable([entry()], { complete: true });
+
+	expect(screen.queryByText(/history incomplete/i)).toBeNull();
+	expect(screen.queryByText(/complete/i)).toBeNull();
+});
+
+test("an empty pool says so instead of drawing a table", () => {
+	renderTable([]);
+
+	expect(screen.getByText("No upstreams configured.")).toBeTruthy();
+	expect(screen.queryByRole("table")).toBeNull();
+});
+
+test("a rate a hair under perfect never rounds up to 100.0% while failures stand", () => {
+	// The real row that produced this: 12,698 attempts, 2 failures, 99.984%.
+	renderTable([
+		entry({
+			period: period({ attempts: 12_698, successes: 12_696, failures: 2, success_rate: 12_696 / 12_698 }),
+		}),
+	]);
+
+	expect(screen.queryByText("100.0%")).toBeNull();
+	expect(screen.getByText("99.9%")).toBeTruthy();
+});
+
+test("a rate a hair above nothing never rounds down to 0.0% while successes stand", () => {
+	renderTable([
+		entry({
+			period: period({ attempts: 12_698, successes: 2, failures: 12_696, success_rate: 2 / 12_698 }),
+		}),
+	]);
+
+	expect(screen.queryByText("0.0%")).toBeNull();
+	expect(screen.getByText("0.1%")).toBeTruthy();
+});
+
+test("a window with no failures at all still reads 100.0%", () => {
+	renderTable([entry({ period: period({ attempts: 500, successes: 500, failures: 0, success_rate: 1 }) })]);
+
+	expect(screen.getByText("100.0%")).toBeTruthy();
+});

admin/src/features/dashboard/UpstreamHealthTable.tsx

@@ -0,0 +1,241 @@
+import * as stylex from "@stylexjs/stylex";
+import { formatAge } from "@/lib/format";
+import type { UpstreamHealth, UpstreamHealthEntry, UpstreamPeriodStats } from "@/lib/types";
+import { styles as shared } from "@/ui/styles";
+import { colors } from "@/ui/tokens.stylex";
+
+const numberFormat = new Intl.NumberFormat();
+
+const styles = stylex.create({
+	card: {
+		borderRadius: "0.25rem",
+		borderWidth: 1,
+		borderStyle: "solid",
+		borderColor: colors.border,
+		backgroundColor: colors.surfaceRaised,
+	},
+	heading: {
+		display: "flex",
+		alignItems: "baseline",
+		justifyContent: "space-between",
+		paddingInline: "1rem",
+		paddingTop: "0.75rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		fontWeight: 600,
+	},
+	count: {
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+		fontWeight: 400,
+		color: colors.textMuted,
+	},
+	empty: {
+		paddingInline: "1rem",
+		paddingBlock: "0.75rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textMuted,
+	},
+	note: {
+		paddingInline: "1rem",
+		paddingBlock: "0.5rem",
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+		color: colors.textMuted,
+	},
+	tableWrap: {
+		overflowX: "auto",
+	},
+	table: {
+		marginTop: "0.5rem",
+		width: "100%",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+	},
+	/**
+	 * The two live columns are left outside the span: everything under it answers
+	 * for the selected window, and nothing else on this card does.
+	 */
+	groupRow: {
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+		color: colors.textMuted,
+	},
+	groupHead: {
+		borderBottomWidth: 1,
+		borderBottomStyle: "solid",
+		borderBottomColor: colors.border,
+		paddingInline: "1rem",
+		paddingBottom: "0.25rem",
+		textAlign: "center",
+		fontWeight: 500,
+	},
+	headRow: {
+		borderBottomWidth: 1,
+		borderBottomStyle: "solid",
+		borderBottomColor: colors.border,
+		textAlign: "left",
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+		color: colors.textMuted,
+	},
+	th: {
+		paddingInline: "1rem",
+		paddingBlock: "0.5rem",
+		fontWeight: 500,
+	},
+	thRight: {
+		textAlign: "right",
+	},
+	/** No hairline under the last row: the card border already closes the table. */
+	row: {
+		borderBottomWidth: { default: 1, ":last-child": 0 },
+		borderBottomStyle: "solid",
+		borderBottomColor: colors.border,
+	},
+	cell: {
+		paddingInline: "1rem",
+		paddingBlock: "0.5rem",
+	},
+	cellRight: {
+		textAlign: "right",
+	},
+	small: {
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+	},
+	muted: {
+		color: colors.textMuted,
+	},
+	bad: {
+		color: colors.danger,
+	},
+});
+
+/** Live pool state in one word. Configuration first: a disabled upstream is not backing off. */
+function statusNow(upstream: UpstreamHealthEntry): "Available" | "Backing off" | "Disabled" {
+	if (!upstream.enabled) return "Disabled";
+	return upstream.available ? "Available" : "Backing off";
+}
+
+/**
+ * `success_rate` is null exactly when the window holds no attempt, and that must
+ * not read as perfect reliability — hence the em-dash rather than `100.0%`.
+ *
+ * One decimal place cannot hold 12,696 of 12,698: it rounds to `100.0%`, and the
+ * row then claims perfection beside a failure count of 2. Neither endpoint may
+ * be reached by rounding — only by actually having no failure, or no success.
+ */
+function successRate(period: UpstreamPeriodStats): string {
+	if (period.success_rate === null) return "—";
+
+	const rounded = period.success_rate * 100;
+	if (rounded > 99.9 && period.failures > 0) return "99.9%";
+	if (rounded < 0.1 && period.successes > 0) return "0.1%";
+	return `${rounded.toFixed(1)}%`;
+}
+
+/**
+ * The age is formatted once, when the row renders; nothing here ticks. It is
+ * measured against the browser's clock rather than the response's `until`, so a
+ * cached response ages visibly instead of freezing at the moment it was served.
+ */
+function lastFailure(period: UpstreamPeriodStats, nowSeconds: number): string {
+	if (period.last_failure_at === null) return "—";
+	const age = formatAge(Math.max(0, nowSeconds - period.last_failure_at));
+	const error = period.last_failure_error;
+	return error === null || error === "" ? age : `${error} · ${age}`;
+}
+
+export default function UpstreamHealthTable({ health }: { health: UpstreamHealth }) {
+	const nowSeconds = Math.floor(Date.now() / 1000);
+	const idle = health.upstreams.length > 0 && health.upstreams.every(({ period }) => period.attempts === 0);
+
+	return (
+		<section {...stylex.props(styles.card)}>
+			<h2 {...stylex.props(styles.heading)}>
+				Upstreams
+				<span {...stylex.props(styles.count, shared.tabularNums)}>
+					{health.available}/{health.total} available
+				</span>
+			</h2>
+			{health.upstreams.length === 0 ? (
+				<p {...stylex.props(styles.empty)}>No upstreams configured.</p>
+			) : (
+				<div {...stylex.props(styles.tableWrap)}>
+					<table {...stylex.props(styles.table)}>
+						<thead>
+							<tr {...stylex.props(styles.groupRow)}>
+								<td colSpan={2} />
+								<th scope="colgroup" colSpan={4} {...stylex.props(styles.groupHead)}>
+									Selected period · {health.period}
+								</th>
+							</tr>
+							<tr {...stylex.props(styles.headRow)}>
+								<th scope="col" {...stylex.props(styles.th)}>
+									Upstream
+								</th>
+								<th scope="col" {...stylex.props(styles.th)}>
+									Status now
+								</th>
+								<th scope="col" {...stylex.props(styles.th, styles.thRight)}>
+									Attempts
+								</th>
+								<th scope="col" {...stylex.props(styles.th, styles.thRight)}>
+									Failures
+								</th>
+								<th scope="col" {...stylex.props(styles.th, styles.thRight)}>
+									Success rate
+								</th>
+								<th scope="col" {...stylex.props(styles.th)}>
+									Last failure
+								</th>
+							</tr>
+						</thead>
+						<tbody>
+							{health.upstreams.map((upstream) => {
+								const status = statusNow(upstream);
+								return (
+									<tr key={upstream.url} {...stylex.props(styles.row)}>
+										<td {...stylex.props(styles.cell, styles.small, shared.mono)}>
+											{upstream.url}
+										</td>
+										<td {...stylex.props(styles.cell)}>
+											<span
+												{...stylex.props(
+													status === "Backing off" && styles.bad,
+													status === "Disabled" && styles.muted,
+												)}
+											>
+												{status}
+											</span>
+										</td>
+										<td {...stylex.props(styles.cell, styles.cellRight, shared.tabularNums)}>
+											{numberFormat.format(upstream.period.attempts)}
+										</td>
+										<td {...stylex.props(styles.cell, styles.cellRight, shared.tabularNums)}>
+											{numberFormat.format(upstream.period.failures)}
+										</td>
+										<td {...stylex.props(styles.cell, styles.cellRight, shared.tabularNums)}>
+											{successRate(upstream.period)}
+										</td>
+										<td {...stylex.props(styles.cell, styles.small, styles.muted)}>
+											{lastFailure(upstream.period, nowSeconds)}
+										</td>
+									</tr>
+								);
+							})}
+						</tbody>
+					</table>
+				</div>
+			)}
+			{idle && <p {...stylex.props(styles.note)}>No upstream attempts in this period.</p>}
+			{!health.complete && (
+				<p {...stylex.props(styles.note)}>
+					History incomplete: outcomes were dropped in this window, so these counts are a lower bound.
+				</p>
+			)}
+		</section>
+	);
+}

admin/src/features/diagnostics/DiagnosticDetailPage.test.tsx

@@ -0,0 +1,218 @@
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { RouterProvider, createMemoryHistory } from "@tanstack/react-router";
+import { AuthProvider } from "@/auth/store";
+import { createQueryClient } from "@/lib/queryClient";
+import { createAppRouter } from "@/routes";
+import { DIAGNOSTIC_CODES, type DiagnosticEvent } from "@/lib/types";
+import { EVENT_COPY } from "./eventCopy";
+
+const NOW_S = Math.floor(Date.now() / 1000);
+
+function event(overrides: Partial<DiagnosticEvent> = {}): DiagnosticEvent {
+	return {
+		id: 42,
+		code: "blocklist.refresh",
+		component: "blocklist",
+		subject: "StevenBlack",
+		severity: "warning",
+		first_seen: NOW_S - 7200,
+		last_seen: NOW_S - 600,
+		occurrences: 4,
+		resolved_at: null,
+		detail: "download failed: ConnectionTimedOut",
+		...overrides,
+	};
+}
+
+/** A 204: what `DELETE /api/diagnostics/{id}` answers on a purge. */
+const NO_CONTENT = Symbol("204");
+
+let responses: Record<string, unknown>;
+let requested: string[];
+
+beforeEach(() => {
+	requested = [];
+	responses = {
+		"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
+	};
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async (input: RequestInfo | URL, init?: { method?: string }) => {
+			const url = String(input);
+			const method = init?.method ?? "GET";
+			const key = method === "GET" ? url : `${method} ${url}`;
+			requested.push(key);
+			const payload = responses[key];
+			if (payload === undefined)
+				return new Response(JSON.stringify({ error: "no such event" }), {
+					status: 404,
+					headers: { "content-type": "application/json" },
+				});
+			if (payload === NO_CONTENT) return new Response(null, { status: 204 });
+			return new Response(JSON.stringify(payload), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}),
+	);
+});
+
+afterEach(() => {
+	vi.unstubAllGlobals();
+});
+
+/**
+ * `retry` is off in the failure test: the shared client backs 5xx off for
+ * seconds, which the render assertions would sit through for nothing.
+ */
+function renderDetail(id: number, { retry = true } = {}) {
+	const queryClient = createQueryClient();
+	if (!retry) {
+		const defaults = queryClient.getDefaultOptions();
+		queryClient.setDefaultOptions({ ...defaults, queries: { ...defaults.queries, retry: false } });
+	}
+	const router = createAppRouter(createMemoryHistory({ initialEntries: [`/diagnostics/${id}`] }), queryClient);
+	render(
+		<AuthProvider>
+			<QueryClientProvider client={queryClient}>
+				<RouterProvider router={router} />
+			</QueryClientProvider>
+		</AuthProvider>,
+	);
+	return router;
+}
+
+test("an open episode shows its facts, its copy and the error the server sent", async () => {
+	responses["/api/diagnostics/42"] = event();
+	renderDetail(42);
+
+	await screen.findByRole("heading", { name: "Blocklist source failed to update" });
+	expect(screen.getByText("Warning")).toBeTruthy();
+	expect(screen.getByText("StevenBlack")).toBeTruthy();
+	expect(screen.getByText("Active for 2h")).toBeTruthy();
+	expect(screen.getByText("Not yet — still failing")).toBeTruthy();
+	expect(screen.getByText("4")).toBeTruthy();
+	expect(screen.getByText("blocklist.refresh")).toBeTruthy();
+	expect(screen.getByText(EVENT_COPY["blocklist.refresh"].impact)).toBeTruthy();
+	expect(screen.getByText(EVENT_COPY["blocklist.refresh"].remediation)).toBeTruthy();
+	expect(screen.getByText("download failed: ConnectionTimedOut")).toBeTruthy();
+	expect(screen.getByRole("link", { name: "Go to Blocklists" }).getAttribute("href")).toBe("/blocklists");
+});
+
+test("a resolved episode states how long it lasted, not how long it has run", async () => {
+	responses["/api/diagnostics/7"] = event({ id: 7, resolved_at: NOW_S - 3600 });
+	renderDetail(7);
+
+	await screen.findByRole("heading", { name: "Blocklist source failed to update" });
+	expect(screen.getByText("Resolved after 1h")).toBeTruthy();
+	expect(screen.queryByText("Not yet — still failing")).toBeNull();
+});
+
+test("an open episode offers no purge", async () => {
+	responses["/api/diagnostics/42"] = event();
+	renderDetail(42);
+
+	await screen.findByRole("heading", { name: "Blocklist source failed to update" });
+	expect(screen.queryByRole("button", { name: "Purge" })).toBeNull();
+});
+
+test("purging a resolved episode asks first, then returns to the list", async () => {
+	responses["/api/diagnostics/7"] = event({ id: 7, resolved_at: NOW_S - 3600 });
+	responses["DELETE /api/diagnostics/7"] = NO_CONTENT;
+	responses["/api/diagnostics?state=active"] = { events: [], next_before: null, active: { warnings: 0, errors: 0 } };
+	responses["/api/diagnostics?state=resolved"] = {
+		events: [],
+		next_before: null,
+		active: { warnings: 0, errors: 0 },
+	};
+	const router = renderDetail(7);
+
+	await screen.findByRole("heading", { name: "Blocklist source failed to update" });
+	fireEvent.click(screen.getByRole("button", { name: "Purge" }));
+
+	const dialog = await screen.findByRole("alertdialog");
+	expect(dialog.textContent).toContain("Purge this resolved event? Its history is gone for good.");
+	fireEvent.click(within(dialog).getByRole("button", { name: "Cancel" }));
+	expect(requested).not.toContain("DELETE /api/diagnostics/7");
+
+	fireEvent.click(screen.getByRole("button", { name: "Purge" }));
+	fireEvent.click(within(await screen.findByRole("alertdialog")).getByRole("button", { name: "Purge" }));
+
+	await waitFor(() => expect(requested).toContain("DELETE /api/diagnostics/7"));
+	// The row it was showing no longer exists, so the page it navigates to is
+	// the list rather than a 404 of its own.
+	await waitFor(() => expect(router.state.location.pathname).toBe("/diagnostics"));
+});
+
+test("a refused purge stays on the event and shows why", async () => {
+	responses["/api/diagnostics/7"] = event({ id: 7, resolved_at: NOW_S - 3600 });
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async (input: RequestInfo | URL, init?: { method?: string }) => {
+			if (init?.method === "DELETE")
+				return new Response(JSON.stringify({ error: "the event is still active" }), {
+					status: 409,
+					headers: { "content-type": "application/json" },
+				});
+			return new Response(JSON.stringify(responses[String(input)] ?? {}), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}),
+	);
+	const router = renderDetail(7, { retry: false });
+
+	await screen.findByRole("heading", { name: "Blocklist source failed to update" });
+	fireEvent.click(screen.getByRole("button", { name: "Purge" }));
+	fireEvent.click(within(await screen.findByRole("alertdialog")).getByRole("button", { name: "Purge" }));
+
+	const alert = await screen.findByRole("alert");
+	expect(alert.textContent).toContain("the event is still active");
+	expect(router.state.location.pathname).toBe("/diagnostics/7");
+});
+
+test("every code renders its own title, impact and remediation", async () => {
+	for (const [index, code] of DIAGNOSTIC_CODES.entries()) {
+		const id = 100 + index;
+		responses[`/api/diagnostics/${id}`] = event({ id, code, component: code.slice(0, code.indexOf(".")) });
+		renderDetail(id);
+
+		const copy = EVENT_COPY[code];
+		await screen.findByRole("heading", { name: copy.title });
+		expect(screen.getByText(copy.impact), code).toBeTruthy();
+		expect(screen.getByText(copy.remediation), code).toBeTruthy();
+		screen.getByText(code);
+		cleanup();
+	}
+});
+
+test("an event retention has removed shows the server's message, not an empty page", async () => {
+	renderDetail(999);
+	await screen.findByText("no such event");
+	expect(screen.getByRole("link", { name: "← All diagnostics" })).toBeTruthy();
+});
+
+test("an unavailable store reports the failure instead of loading forever", async () => {
+	responses["/api/diagnostics/42"] = event();
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async (input: RequestInfo | URL) =>
+			String(input).startsWith("/api/diagnostics/")
+				? new Response(JSON.stringify({ error: "store unavailable" }), {
+						status: 503,
+						headers: { "content-type": "application/json" },
+					})
+				: new Response(JSON.stringify(responses[String(input)] ?? {}), {
+						status: 200,
+						headers: { "content-type": "application/json" },
+					}),
+		),
+	);
+	renderDetail(42, { retry: false });
+
+	const alert = await screen.findByRole("alert");
+	expect(alert.textContent).toContain("The server is starting or degraded.");
+	expect(screen.queryByText("Loading event…")).toBeNull();
+	expect(screen.getByRole("link", { name: "← All diagnostics" })).toBeTruthy();
+});

admin/src/features/diagnostics/DiagnosticDetailPage.tsx

@@ -0,0 +1,226 @@
+import { useState } from "react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { Link, useNavigate, useParams } from "@tanstack/react-router";
+import * as stylex from "@stylexjs/stylex";
+import InlineError from "@/lib/InlineError";
+import { formatDuration, formatTime } from "@/lib/format";
+import { diagnosticPurgeMutation, diagnosticQuery } from "@/lib/queries";
+import ConfirmDialog from "@/ui/ConfirmDialog";
+import { styles as shared } from "@/ui/styles";
+import { colors } from "@/ui/tokens.stylex";
+import SeverityBadge from "./SeverityBadge";
+import { componentLabel, copyFor } from "./eventCopy";
+
+const styles = stylex.create({
+	back: {
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.primaryOnSurface,
+		textDecorationLine: "none",
+	},
+	headingRow: {
+		marginTop: "0.5rem",
+		display: "flex",
+		alignItems: "center",
+		flexWrap: "wrap",
+		gap: "0.5rem",
+	},
+	heading: {
+		fontSize: "1.5rem",
+		lineHeight: "2rem",
+		fontWeight: 600,
+	},
+	purgeAction: {
+		marginInlineStart: "auto",
+	},
+	subject: {
+		marginTop: "0.25rem",
+		color: colors.textSecondary,
+		wordBreak: "break-all",
+	},
+	panel: {
+		marginTop: "1rem",
+		maxWidth: "48rem",
+		borderRadius: "0.25rem",
+		borderWidth: 1,
+		borderStyle: "solid",
+		borderColor: colors.border,
+		backgroundColor: colors.surfaceRaised,
+		padding: "1rem",
+	},
+	facts: {
+		display: "grid",
+		gap: "0.5rem 1rem",
+		gridTemplateColumns: {
+			default: "auto",
+			"@media (min-width: 640px)": "max-content 1fr",
+		},
+		margin: 0,
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+	},
+	term: {
+		color: colors.textMuted,
+	},
+	value: {
+		margin: 0,
+	},
+	sectionHeading: {
+		marginTop: "1.5rem",
+		fontSize: "1.125rem",
+		lineHeight: "1.75rem",
+		fontWeight: 600,
+	},
+	prose: {
+		marginTop: "0.5rem",
+		maxWidth: "48rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.5rem",
+	},
+	detail: {
+		marginTop: "0.5rem",
+		maxWidth: "48rem",
+		overflowX: "auto",
+		borderRadius: "0.25rem",
+		borderWidth: 1,
+		borderStyle: "solid",
+		borderColor: colors.border,
+		padding: "0.75rem",
+		fontSize: "0.8125rem",
+		lineHeight: "1.25rem",
+		whiteSpace: "pre-wrap",
+		wordBreak: "break-all",
+	},
+	links: {
+		marginTop: "1rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+	},
+	link: {
+		color: colors.primaryOnSurface,
+	},
+	loading: {
+		marginTop: "1rem",
+		color: colors.textMuted,
+	},
+});
+
+export default function DiagnosticDetailPage() {
+	const { id } = useParams({ from: "/shell/diagnostics/$id" });
+	const eventId = Number(id);
+	const { data, error, isPending, refetch } = useQuery(diagnosticQuery(eventId));
+
+	const navigate = useNavigate();
+	const queryClient = useQueryClient();
+	const purge = useMutation(diagnosticPurgeMutation(queryClient));
+	const [confirming, setConfirming] = useState(false);
+
+	function confirmPurge() {
+		setConfirming(false);
+		// The row this page is about is gone, so staying here would show the
+		// 404 the purge itself caused.
+		purge.mutate(eventId, { onSuccess: () => void navigate({ to: "/diagnostics" }) });
+	}
+
+	if (isPending) {
+		return (
+			<p {...stylex.props(styles.loading, shared.pulse)} role="status">
+				Loading event…
+			</p>
+		);
+	}
+	if (data === undefined) {
+		return (
+			<section>
+				<Link to="/diagnostics" {...stylex.props(styles.back, shared.focusRing)}>
+					← All diagnostics
+				</Link>
+				<InlineError error={error} onRetry={() => void refetch()} />
+			</section>
+		);
+	}
+
+	const copy = copyFor(data.code);
+	const resolvedAt = data.resolved_at;
+	const span = (resolvedAt ?? Math.floor(Date.now() / 1000)) - data.first_seen;
+
+	return (
+		<section>
+			<Link to="/diagnostics" {...stylex.props(styles.back, shared.focusRing)}>
+				← All diagnostics
+			</Link>
+			<div {...stylex.props(styles.headingRow)}>
+				<h1 {...stylex.props(styles.heading)}>{copy.title}</h1>
+				<SeverityBadge severity={data.severity} />
+				{/* Only history can be purged: an open episode is the current state of the box. */}
+				{resolvedAt !== null && (
+					<button
+						type="button"
+						onClick={() => setConfirming(true)}
+						disabled={purge.isPending}
+						{...stylex.props(styles.purgeAction, shared.dangerLinkButton, shared.focusRing)}
+					>
+						Purge
+					</button>
+				)}
+			</div>
+			<p {...stylex.props(styles.subject)}>{data.subject}</p>
+			<InlineError error={purge.error} />
+
+			<div {...stylex.props(styles.panel)}>
+				<dl {...stylex.props(styles.facts)}>
+					<dt {...stylex.props(styles.term)}>State</dt>
+					<dd {...stylex.props(styles.value)}>
+						{resolvedAt === null
+							? `Active for ${formatDuration(span)}`
+							: `Resolved after ${formatDuration(span)}`}
+					</dd>
+					<dt {...stylex.props(styles.term)}>First seen</dt>
+					<dd {...stylex.props(styles.value)}>{formatTime(data.first_seen)}</dd>
+					<dt {...stylex.props(styles.term)}>Last seen</dt>
+					<dd {...stylex.props(styles.value)}>{formatTime(data.last_seen)}</dd>
+					<dt {...stylex.props(styles.term)}>Occurrences</dt>
+					<dd {...stylex.props(styles.value, shared.tabularNums)}>{data.occurrences}</dd>
+					<dt {...stylex.props(styles.term)}>Resolved</dt>
+					<dd {...stylex.props(styles.value)}>
+						{data.resolved_at === null ? "Not yet — still failing" : formatTime(data.resolved_at)}
+					</dd>
+					<dt {...stylex.props(styles.term)}>Component</dt>
+					<dd {...stylex.props(styles.value)}>{componentLabel(data.component)}</dd>
+					<dt {...stylex.props(styles.term)}>Code</dt>
+					<dd {...stylex.props(styles.value, shared.mono)}>{data.code}</dd>
+				</dl>
+			</div>
+
+			<h2 {...stylex.props(styles.sectionHeading)}>Impact</h2>
+			<p {...stylex.props(styles.prose)}>{copy.impact}</p>
+
+			<h2 {...stylex.props(styles.sectionHeading)}>What to do</h2>
+			<p {...stylex.props(styles.prose)}>{copy.remediation}</p>
+
+			<h2 {...stylex.props(styles.sectionHeading)}>Last error</h2>
+			{data.detail === "" ? (
+				<p {...stylex.props(styles.prose)}>The server recorded no error text for this event.</p>
+			) : (
+				<pre {...stylex.props(styles.detail, shared.mono)}>{data.detail}</pre>
+			)}
+
+			{copy.link !== undefined && (
+				<p {...stylex.props(styles.links)}>
+					<Link to={copy.link.to} {...stylex.props(styles.link, shared.focusRing)}>
+						Go to {copy.link.label}
+					</Link>
+				</p>
+			)}
+
+			<ConfirmDialog
+				isOpen={confirming}
+				title="Purge event"
+				message="Purge this resolved event? Its history is gone for good."
+				confirmLabel="Purge"
+				onConfirm={confirmPurge}
+				onCancel={() => setConfirming(false)}
+			/>
+		</section>
+	);
+}

admin/src/features/diagnostics/DiagnosticsPage.test.tsx

@@ -0,0 +1,339 @@
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { RouterProvider, createMemoryHistory } from "@tanstack/react-router";
+import { AuthProvider } from "@/auth/store";
+import { createQueryClient } from "@/lib/queryClient";
+import { createAppRouter } from "@/routes";
+import type { DiagnosticEvent, DiagnosticsPage } from "@/lib/types";
+
+// Ages are rendered against the wall clock, so the fixtures are anchored to it
+// rather than to a frozen instant: faking time here would fight the query
+// client's own timers for no gain.
+const NOW_S = Math.floor(Date.now() / 1000);
+
+function event(id: number, overrides: Partial<DiagnosticEvent> = {}): DiagnosticEvent {
+	return {
+		id,
+		code: "blocklist.refresh",
+		component: "blocklist",
+		subject: "StevenBlack",
+		severity: "warning",
+		first_seen: NOW_S - 3600,
+		last_seen: NOW_S - 300,
+		occurrences: 3,
+		resolved_at: null,
+		detail: "download failed: ConnectionTimedOut",
+		...overrides,
+	};
+}
+
+function page(events: DiagnosticEvent[], nextBefore: number | null = null): DiagnosticsPage {
+	return { events, next_before: nextBefore, active: { warnings: 1, errors: 1 } };
+}
+
+const ACTIVE = page([
+	event(42),
+	event(41, {
+		code: "upstream.exchange",
+		component: "upstream",
+		subject: "tls://dns.example:853",
+		severity: "error",
+		occurrences: 1,
+	}),
+]);
+
+const RESOLVED = page([
+	event(30, { code: "disk.space", component: "disk", subject: "data", resolved_at: NOW_S - 7200 }),
+]);
+
+/** A stubbed response that carries a non-200 status instead of a payload. */
+class Failure {
+	constructor(
+		readonly status: number,
+		readonly body: unknown,
+	) {}
+}
+
+function fail(status: number, message: string): Failure {
+	return new Failure(status, { error: message });
+}
+
+/** A 204: what `DELETE /api/diagnostics/{id}` answers on a purge. */
+const NO_CONTENT = Symbol("204");
+
+let responses: Record<string, unknown>;
+let requested: string[];
+
+beforeEach(() => {
+	requested = [];
+	responses = {
+		"/api/version": { version: "0.0.0-test", git_commit: "0000000", zig_version: "0.16.0", uptime_seconds: 1 },
+		"/api/diagnostics?state=active": ACTIVE,
+		"/api/diagnostics?state=resolved": RESOLVED,
+	};
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async (input: RequestInfo | URL, init?: { method?: string }) => {
+			const url = String(input);
+			const method = init?.method ?? "GET";
+			// Reads stay keyed by url alone, so the assertions below read as the
+			// request line they are; writes carry their method.
+			const key = method === "GET" ? url : `${method} ${url}`;
+			requested.push(key);
+			const payload = responses[key];
+			if (payload === undefined) return new Response(JSON.stringify({ error: "not stubbed" }), { status: 404 });
+			if (payload === NO_CONTENT) return new Response(null, { status: 204 });
+			if (payload instanceof Failure) {
+				return new Response(JSON.stringify(payload.body), {
+					status: payload.status,
+					headers: { "content-type": "application/json" },
+				});
+			}
+			return new Response(JSON.stringify(payload), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}),
+	);
+});
+
+afterEach(() => {
+	vi.unstubAllGlobals();
+});
+
+/**
+ * `retry` is off in the failure tests: the shared client backs 5xx off for
+ * seconds, which the render assertions would sit through for nothing.
+ */
+function renderRoute(path = "/diagnostics", { retry = true } = {}) {
+	const queryClient = createQueryClient();
+	if (!retry) {
+		const defaults = queryClient.getDefaultOptions();
+		queryClient.setDefaultOptions({ ...defaults, queries: { ...defaults.queries, retry: false } });
+	}
+	const router = createAppRouter(createMemoryHistory({ initialEntries: [path] }), queryClient);
+	render(
+		<AuthProvider>
+			<QueryClientProvider client={queryClient}>
+				<RouterProvider router={router} />
+			</QueryClientProvider>
+		</AuthProvider>,
+	);
+	return router;
+}
+
+/** A RAC Select names its trigger with the current value and then the label. */
+function trigger(label: string): HTMLElement {
+	return screen.getByRole("button", { name: new RegExp(`${label}$`) });
+}
+
+async function pick(label: string, option: string) {
+	fireEvent.click(trigger(label));
+	fireEvent.click(await screen.findByRole("option", { name: option }));
+	await waitFor(() => expect(screen.queryByRole("listbox")).toBeNull());
+}
+
+test("active episodes come first, each with its title, subject, age and count", async () => {
+	renderRoute();
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	const active = screen.getByText("Blocklist source failed to update").closest("li")!;
+	expect(within(active).getByText("Warning")).toBeTruthy();
+	expect(within(active).getByText("StevenBlack")).toBeTruthy();
+	expect(within(active).getByText(/Active for 1h · 3 occurrences/)).toBeTruthy();
+
+	const failing = screen.getByText("Upstream failing").closest("li")!;
+	expect(within(failing).getByText("Error")).toBeTruthy();
+	expect(within(failing).getByText(/1 occurrence(?!s)/)).toBeTruthy();
+
+	// The resolved history is a separate section, below the active list.
+	const table = within(screen.getByRole("table"));
+	expect(table.getByText("Disk space low")).toBeTruthy();
+	expect(screen.getByText(/Showing 1 resolved entry — end of history/)).toBeTruthy();
+});
+
+test("nothing open reads as good news, not as a broken page", async () => {
+	responses["/api/diagnostics?state=active"] = page([]);
+	renderRoute();
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	const healthy = await screen.findByText("No active operational issues.");
+	expect(healthy.getAttribute("role")).toBe("status");
+	// Quiet: no alert anywhere on the page, and no empty table standing in.
+	expect(screen.queryByRole("alert")).toBeNull();
+});
+
+test("a filter lands in the url and refetches both sections through it", async () => {
+	responses["/api/diagnostics?severity=error&state=active"] = page([
+		event(41, { code: "upstream.exchange", component: "upstream", severity: "error" }),
+	]);
+	responses["/api/diagnostics?severity=error&state=resolved"] = page([]);
+	const router = renderRoute();
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	await pick("Severity", "Errors");
+
+	await waitFor(() => expect(router.state.location.search).toEqual({ severity: "error" }));
+	await waitFor(() => expect(screen.queryByText("Blocklist source failed to update")).toBeNull());
+	expect(requested).toContain("/api/diagnostics?severity=error&state=active");
+	expect(requested).toContain("/api/diagnostics?severity=error&state=resolved");
+});
+
+test("the state filter hides the section it excludes", async () => {
+	const router = renderRoute();
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	await pick("Show", "Active only");
+
+	await waitFor(() => expect(router.state.location.search).toEqual({ state: "active" }));
+	expect(screen.queryByRole("heading", { name: "Resolved" })).toBeNull();
+	expect(screen.getByRole("heading", { name: "Active" })).toBeTruthy();
+});
+
+test("a url written by hand starts on the filters it names", async () => {
+	responses["/api/diagnostics?component=disk&state=resolved"] = RESOLVED;
+	renderRoute("/diagnostics?state=resolved&component=disk");
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	await screen.findByText("Disk space low");
+	expect(screen.queryByRole("heading", { name: "Active" })).toBeNull();
+	expect(requested).toContain("/api/diagnostics?component=disk&state=resolved");
+});
+
+test("load more appends the next page of resolved history", async () => {
+	responses["/api/diagnostics?state=resolved"] = page(
+		[event(30, { code: "disk.space", component: "disk", subject: "data", resolved_at: NOW_S - 7200 })],
+		30,
+	);
+	responses["/api/diagnostics?state=resolved&before=30"] = page([
+		event(12, {
+			code: "certificate.reload",
+			component: "certificate",
+			subject: "doh",
+			resolved_at: NOW_S - 90_000,
+		}),
+	]);
+	renderRoute();
+	await screen.findByText("Disk space low");
+
+	fireEvent.click(screen.getByRole("button", { name: "Load more" }));
+
+	await screen.findByText("TLS certificate reload failed");
+	expect(screen.getByText(/Showing 2 resolved entries — end of history/)).toBeTruthy();
+});
+
+test("an unavailable store reports the failure instead of loading forever", async () => {
+	responses["/api/diagnostics?state=active"] = fail(503, "store unavailable");
+	renderRoute("/diagnostics", { retry: false });
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	const alert = await screen.findByRole("alert");
+	expect(alert.textContent).toContain("The server is starting or degraded.");
+	expect(screen.queryByText("Loading diagnostics…")).toBeNull();
+	// The resolved section answered, so it still renders its own history.
+	expect(screen.getByText("Disk space low")).toBeTruthy();
+});
+
+test("a failed history query reports the failure and retries on demand", async () => {
+	responses["/api/diagnostics?state=resolved"] = fail(500, "diagnostics store read failed");
+	renderRoute("/diagnostics", { retry: false });
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	const alert = await screen.findByRole("alert");
+	expect(alert.textContent).toContain("diagnostics store read failed");
+	expect(screen.queryByText("Loading history…")).toBeNull();
+
+	responses["/api/diagnostics?state=resolved"] = RESOLVED;
+	fireEvent.click(screen.getByRole("button", { name: "Retry" }));
+
+	await screen.findByText("Disk space low");
+	expect(screen.queryByRole("alert")).toBeNull();
+});
+
+test("only the resolved history offers a purge", async () => {
+	renderRoute();
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	// An episode still failing is the state of the box, not history: no purge
+	// affordance anywhere on its card.
+	const active = screen.getByText("Blocklist source failed to update").closest("li")!;
+	expect(within(active).queryByRole("button", { name: "Purge" })).toBeNull();
+
+	const row = screen.getByText("Disk space low").closest("tr")!;
+	expect(within(row).getByRole("button", { name: "Purge" })).toBeTruthy();
+	expect(screen.getByRole("button", { name: "Purge all resolved" })).toBeTruthy();
+});
+
+test("with no resolved history there is nothing to purge in bulk", async () => {
+	responses["/api/diagnostics?state=resolved"] = page([]);
+	renderRoute();
+	await screen.findByRole("heading", { name: "Diagnostics" });
+
+	await screen.findByText("Nothing has failed and recovered in the retained window.");
+	expect(screen.queryByRole("button", { name: "Purge all resolved" })).toBeNull();
+});
+
+test("purging one row asks first, then sends the DELETE and refetches the lists", async () => {
+	responses["DELETE /api/diagnostics/30"] = NO_CONTENT;
+	renderRoute();
+	await screen.findByText("Disk space low");
+
+	fireEvent.click(within(screen.getByText("Disk space low").closest("tr")!).getByRole("button", { name: "Purge" }));
+
+	const dialog = await screen.findByRole("alertdialog");
+	expect(dialog.textContent).toContain("Purge this resolved event? Its history is gone for good.");
+	fireEvent.click(within(dialog).getByRole("button", { name: "Cancel" }));
+	expect(requested).not.toContain("DELETE /api/diagnostics/30");
+
+	fireEvent.click(within(screen.getByText("Disk space low").closest("tr")!).getByRole("button", { name: "Purge" }));
+	fireEvent.click(within(await screen.findByRole("alertdialog")).getByRole("button", { name: "Purge" }));
+
+	await waitFor(() => expect(requested).toContain("DELETE /api/diagnostics/30"));
+	// The invalidation covers both sections: the page the row left and the
+	// active list, whose `active` counts come from the same table.
+	await waitFor(() =>
+		expect(requested.filter((url) => url === "/api/diagnostics?state=resolved").length).toBeGreaterThan(1),
+	);
+	await waitFor(() =>
+		expect(requested.filter((url) => url === "/api/diagnostics?state=active").length).toBeGreaterThan(1),
+	);
+});
+
+test("purging the whole history asks first and sends one DELETE", async () => {
+	responses["DELETE /api/diagnostics"] = { purged: 1 };
+	renderRoute();
+	await screen.findByText("Disk space low");
+
+	fireEvent.click(screen.getByRole("button", { name: "Purge all resolved" }));
+	const dialog = await screen.findByRole("alertdialog");
+	expect(dialog.textContent).toContain("Purge all resolved events? Active events are kept.");
+
+	// What the server will answer once the purge has landed; the refetch the
+	// mutation triggers is what has to pick it up.
+	responses["/api/diagnostics?state=resolved"] = page([]);
+	fireEvent.click(within(dialog).getByRole("button", { name: "Purge all" }));
+
+	await waitFor(() => expect(requested).toContain("DELETE /api/diagnostics"));
+	await waitFor(() => expect(screen.queryByText("Disk space low")).toBeNull());
+	expect(screen.getByText("Blocklist source failed to update")).toBeTruthy();
+});
+
+test("a refused purge reports the server's reason and keeps the row", async () => {
+	responses["DELETE /api/diagnostics/30"] = fail(409, "the event is still active; it can be purged once it resolves");
+	renderRoute("/diagnostics", { retry: false });
+	await screen.findByText("Disk space low");
+
+	fireEvent.click(within(screen.getByText("Disk space low").closest("tr")!).getByRole("button", { name: "Purge" }));
+	fireEvent.click(within(await screen.findByRole("alertdialog")).getByRole("button", { name: "Purge" }));
+
+	const alert = await screen.findByRole("alert");
+	expect(alert.textContent).toContain("the event is still active");
+	expect(screen.getByText("Disk space low")).toBeTruthy();
+});
+
+test("an episode links to its own detail page", async () => {
+	responses["/api/diagnostics/42"] = event(42);
+	renderRoute();
+	const link = await screen.findByRole("link", { name: "Blocklist source failed to update" });
+	expect(link.getAttribute("href")).toBe("/diagnostics/42");
+});

admin/src/features/diagnostics/DiagnosticsPage.tsx

@@ -0,0 +1,498 @@
+import { useState } from "react";
+import {
+	useInfiniteQuery,
+	useMutation,
+	useQueryClient,
+	type InfiniteData,
+	type UseInfiniteQueryResult,
+} from "@tanstack/react-query";
+import { Link, useNavigate, useSearch } from "@tanstack/react-router";
+import * as stylex from "@stylexjs/stylex";
+import * as api from "@/lib/api";
+import InlineError from "@/lib/InlineError";
+import { formatDuration, formatTime } from "@/lib/format";
+import { diagnosticPurgeMutation, diagnosticsInfiniteQuery, diagnosticsPurgeResolvedMutation } from "@/lib/queries";
+import type {
+	DiagnosticEvent,
+	DiagnosticSeverity,
+	DiagnosticState,
+	DiagnosticsFilter,
+	DiagnosticsPage as Page,
+} from "@/lib/types";
+import ConfirmDialog from "@/ui/ConfirmDialog";
+import Select from "@/ui/Select";
+import { styles as shared } from "@/ui/styles";
+import { colors } from "@/ui/tokens.stylex";
+import SeverityBadge from "./SeverityBadge";
+import { DIAGNOSTIC_COMPONENTS, componentLabel, copyFor } from "./eventCopy";
+
+const DARK = "@media (prefers-color-scheme: dark)";
+
+const STATE_OPTIONS = [
+	{ value: "all", label: "Active and resolved" },
+	{ value: "active", label: "Active only" },
+	{ value: "resolved", label: "Resolved only" },
+];
+
+const SEVERITY_OPTIONS = [
+	{ value: "any", label: "Any severity" },
+	{ value: "warning", label: "Warnings" },
+	{ value: "error", label: "Errors" },
+];
+
+const COMPONENT_OPTIONS = [
+	{ value: "any", label: "All components" },
+	...DIAGNOSTIC_COMPONENTS.map((component) => ({ value: component, label: componentLabel(component) })),
+];
+
+const styles = stylex.create({
+	heading: {
+		fontSize: "1.5rem",
+		lineHeight: "2rem",
+		fontWeight: 600,
+	},
+	intro: {
+		marginTop: "0.25rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textMuted,
+		maxWidth: "48rem",
+	},
+	filterGrid: {
+		marginTop: "1rem",
+		display: "grid",
+		gap: "0.75rem",
+		gridTemplateColumns: {
+			default: "repeat(1, minmax(0, 1fr))",
+			"@media (min-width: 640px)": "repeat(3, minmax(0, 1fr))",
+		},
+		maxWidth: "48rem",
+	},
+	sectionHeading: {
+		marginTop: "1.5rem",
+		fontSize: "1.125rem",
+		lineHeight: "1.75rem",
+		fontWeight: 600,
+	},
+	sectionHeadingRow: {
+		display: "flex",
+		alignItems: "baseline",
+		flexWrap: "wrap",
+		justifyContent: "space-between",
+		gap: "0.75rem",
+	},
+	/**
+	 * Nothing open is the normal state of a working install, so it gets one
+	 * quiet muted line — no border, no icon, no alert role. A panel here would
+	 * read as a broken page rather than as good news.
+	 */
+	healthy: {
+		marginTop: "0.5rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textSecondary,
+	},
+	empty: {
+		marginTop: "0.5rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textMuted,
+	},
+	cardList: {
+		marginTop: "0.75rem",
+		display: "flex",
+		flexDirection: "column",
+		gap: "0.5rem",
+		listStyleType: "none",
+		padding: 0,
+	},
+	card: {
+		borderRadius: "0.25rem",
+		borderWidth: 1,
+		borderStyle: "solid",
+		borderColor: colors.border,
+		backgroundColor: colors.surfaceRaised,
+		paddingInline: "0.75rem",
+		paddingBlock: "0.625rem",
+	},
+	cardTop: {
+		display: "flex",
+		alignItems: "baseline",
+		flexWrap: "wrap",
+		gap: "0.5rem",
+	},
+	cardTitle: {
+		fontWeight: 500,
+		color: colors.primaryOnSurface,
+		textDecorationLine: "none",
+	},
+	subject: {
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textSecondary,
+		wordBreak: "break-all",
+	},
+	meta: {
+		marginTop: "0.25rem",
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+		color: colors.textMuted,
+	},
+	tableWrap: {
+		marginTop: "0.75rem",
+		overflowX: "auto",
+		borderRadius: "0.25rem",
+		borderWidth: 1,
+		borderStyle: "solid",
+		borderColor: colors.border,
+	},
+	table: {
+		width: "100%",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+	},
+	head: {
+		backgroundColor: { default: "oklch(98.5% 0 none)", [DARK]: "oklch(21% 0.006 285.885)" },
+		textAlign: "left",
+	},
+	th: {
+		paddingInline: "0.75rem",
+		paddingBlock: "0.5rem",
+		fontWeight: 500,
+		color: colors.textSecondary,
+		whiteSpace: "nowrap",
+	},
+	row: {
+		borderTopWidth: { default: 1, ":first-child": 0 },
+		borderTopStyle: "solid",
+		borderTopColor: colors.border,
+	},
+	cell: {
+		paddingInline: "0.75rem",
+		paddingBlock: "0.5rem",
+	},
+	nowrap: {
+		whiteSpace: "nowrap",
+	},
+	rowLink: {
+		color: colors.primaryOnSurface,
+		textDecorationLine: "none",
+	},
+	footer: {
+		marginTop: "0.75rem",
+		display: "flex",
+		alignItems: "center",
+		gap: "0.75rem",
+	},
+	note: {
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.textMuted,
+	},
+	moreError: {
+		marginTop: "0.5rem",
+		fontSize: "0.875rem",
+		lineHeight: "1.25rem",
+		color: colors.dangerText,
+	},
+});
+
+type Section = UseInfiniteQueryResult<InfiniteData<Page, unknown>, Error>;
+
+/** The two enum filters, narrowed from the picker's string rather than cast. */
+function asState(value: string): DiagnosticState | undefined {
+	return value === "active" || value === "resolved" ? value : undefined;
+}
+
+function asSeverity(value: string): DiagnosticSeverity | undefined {
+	return value === "warning" || value === "error" ? value : undefined;
+}
+
+function errorMessage(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+function occurrenceText(count: number): string {
+	return `${count} ${count === 1 ? "occurrence" : "occurrences"}`;
+}
+
+function rowsOf(section: Section): DiagnosticEvent[] {
+	return (section.data?.pages ?? []).flatMap((page) => page.events);
+}
+
+/**
+ * The cursor comes from the newest page on screen, not from `hasNextPage`:
+ * while placeholder data stands in for a filter change the query state is
+ * empty, and the button would flash away and back.
+ */
+function hasMore(section: Section): boolean {
+	const pages = section.data?.pages ?? [];
+	const last = pages[pages.length - 1];
+	return last !== undefined && last.next_before !== null;
+}
+
+function MoreButton({ section }: { section: Section }) {
+	const more = hasMore(section);
+	// A 401 is already redirecting via the cache-level handleUnauthorized.
+	const isUnauthorized = section.error instanceof api.ApiError && section.error.status === 401;
+	const failed = section.isFetchNextPageError && !isUnauthorized ? errorMessage(section.error) : null;
+	if (!more && failed === null) return null;
+	return (
+		<>
+			<div {...stylex.props(styles.footer)}>
+				{more && (
+					<button
+						type="button"
+						onClick={() => {
+							if (section.isFetchingNextPage || section.isPlaceholderData) return;
+							void section.fetchNextPage();
+						}}
+						disabled={section.isFetchingNextPage || section.isPlaceholderData}
+						{...stylex.props(shared.button, shared.focusRing)}
+					>
+						{section.isFetchingNextPage ? "Loading…" : "Load more"}
+					</button>
+				)}
+			</div>
+			{failed !== null && (
+				<p role="alert" {...stylex.props(styles.moreError)}>
+					Failed to load more: {failed}
+				</p>
+			)}
+		</>
+	);
+}
+
+function ActiveCard({ event, now }: { event: DiagnosticEvent; now: number }) {
+	const copy = copyFor(event.code);
+	return (
+		<li {...stylex.props(styles.card)}>
+			<div {...stylex.props(styles.cardTop)}>
+				<SeverityBadge severity={event.severity} />
+				<Link
+					to="/diagnostics/$id"
+					params={{ id: String(event.id) }}
+					{...stylex.props(styles.cardTitle, shared.focusRing)}
+				>
+					{copy.title}
+				</Link>
+				<span {...stylex.props(styles.subject)}>{event.subject}</span>
+			</div>
+			<p {...stylex.props(styles.meta)}>
+				Active for {formatDuration(now - event.first_seen)} · {occurrenceText(event.occurrences)} · last failure{" "}
+				{formatTime(event.last_seen)}
+			</p>
+		</li>
+	);
+}
+
+function HistoryRow({ event, onPurge, busy }: { event: DiagnosticEvent; onPurge: () => void; busy: boolean }) {
+	const copy = copyFor(event.code);
+	return (
+		<tr {...stylex.props(styles.row)}>
+			<td {...stylex.props(styles.cell)}>
+				<SeverityBadge severity={event.severity} />
+			</td>
+			<td {...stylex.props(styles.cell)}>
+				<Link
+					to="/diagnostics/$id"
+					params={{ id: String(event.id) }}
+					{...stylex.props(styles.rowLink, shared.focusRing)}
+				>
+					{copy.title}
+				</Link>
+			</td>
+			<td {...stylex.props(styles.cell)}>{event.subject}</td>
+			<td {...stylex.props(styles.cell, styles.nowrap)}>{formatTime(event.first_seen)}</td>
+			<td {...stylex.props(styles.cell, styles.nowrap)}>
+				{event.resolved_at === null ? "—" : formatTime(event.resolved_at)}
+			</td>
+			<td {...stylex.props(styles.cell, styles.nowrap, shared.tabularNums)}>{event.occurrences}</td>
+			<td {...stylex.props(styles.cell, styles.nowrap)}>
+				<button
+					type="button"
+					onClick={onPurge}
+					disabled={busy}
+					{...stylex.props(shared.dangerLinkButton, shared.focusRing)}
+				>
+					Purge
+				</button>
+			</td>
+		</tr>
+	);
+}
+
+export default function DiagnosticsPage() {
+	const search = useSearch({ from: "/shell/diagnostics" });
+	const navigate = useNavigate({ from: "/diagnostics" });
+	const state = search.state ?? "all";
+
+	const base: DiagnosticsFilter = {};
+	if (search.severity !== undefined) base.severity = search.severity;
+	if (search.component !== undefined) base.component = search.component;
+
+	const active = useInfiniteQuery(diagnosticsInfiniteQuery({ ...base, state: "active" }, state !== "resolved"));
+	const history = useInfiniteQuery(diagnosticsInfiniteQuery({ ...base, state: "resolved" }, state !== "active"));
+
+	const queryClient = useQueryClient();
+	const purgeOne = useMutation(diagnosticPurgeMutation(queryClient));
+	const purgeAll = useMutation(diagnosticsPurgeResolvedMutation(queryClient));
+	// `null` is "no dialog"; the id is which row it is about, and `"all"` the
+	// whole history. One piece of state, so the two dialogs cannot both be open.
+	const [pendingPurge, setPendingPurge] = useState<number | "all" | null>(null);
+
+	const activeRows = rowsOf(active);
+	const historyRows = rowsOf(history);
+	const now = Math.floor(Date.now() / 1000);
+	const purging = purgeOne.isPending || purgeAll.isPending;
+
+	function setSearch(patch: Partial<typeof search>) {
+		void navigate({ search: (prev) => ({ ...prev, ...patch }) });
+	}
+
+	function confirmPurge() {
+		if (pendingPurge === null) return;
+		if (pendingPurge === "all") {
+			purgeAll.mutate();
+		} else {
+			purgeOne.mutate(pendingPurge);
+		}
+		setPendingPurge(null);
+	}
+
+	return (
+		<section>
+			<h1 {...stylex.props(styles.heading)}>Diagnostics</h1>
+			<p {...stylex.props(styles.intro)}>
+				Operational failures, one entry per subject that failed. An entry opens on the first failure, counts
+				repeats, and closes when the subject recovers.
+			</p>
+
+			<div {...stylex.props(styles.filterGrid)}>
+				<Select
+					variant="compactField"
+					label="Show"
+					value={state}
+					onChange={(value) => setSearch({ state: asState(value) })}
+					options={STATE_OPTIONS}
+				/>
+				<Select
+					variant="compactField"
+					label="Severity"
+					value={search.severity ?? "any"}
+					onChange={(value) => setSearch({ severity: asSeverity(value) })}
+					options={SEVERITY_OPTIONS}
+				/>
+				<Select
+					variant="compactField"
+					label="Component"
+					value={search.component ?? "any"}
+					onChange={(value) => setSearch({ component: value === "any" ? undefined : value })}
+					options={COMPONENT_OPTIONS}
+				/>
+			</div>
+
+			{state !== "resolved" && (
+				<>
+					<h2 {...stylex.props(styles.sectionHeading)}>Active</h2>
+					{active.status === "error" ? (
+						<InlineError error={active.error} onRetry={() => void active.refetch()} />
+					) : active.data === undefined ? (
+						<p {...stylex.props(styles.empty, shared.pulse)} role="status">
+							Loading diagnostics…
+						</p>
+					) : activeRows.length === 0 ? (
+						<p {...stylex.props(styles.healthy)} role="status">
+							No active operational issues.
+						</p>
+					) : (
+						<>
+							<ul {...stylex.props(styles.cardList)}>
+								{activeRows.map((event) => (
+									<ActiveCard key={event.id} event={event} now={now} />
+								))}
+							</ul>
+							<MoreButton section={active} />
+						</>
+					)}
+				</>
+			)}
+
+			{state !== "active" && (
+				<>
+					<div {...stylex.props(styles.sectionHeading, styles.sectionHeadingRow)}>
+						<h2>Resolved</h2>
+						{historyRows.length > 0 && (
+							<button
+								type="button"
+								onClick={() => setPendingPurge("all")}
+								disabled={purging}
+								{...stylex.props(shared.dangerLinkButton, shared.focusRing)}
+							>
+								Purge all resolved
+							</button>
+						)}
+					</div>
+					{history.status === "error" ? (
+						<InlineError error={history.error} onRetry={() => void history.refetch()} />
+					) : history.data === undefined ? (
+						<p {...stylex.props(styles.empty, shared.pulse)} role="status">
+							Loading history…
+						</p>
+					) : historyRows.length === 0 ? (
+						<p {...stylex.props(styles.empty)}>Nothing has failed and recovered in the retained window.</p>
+					) : (
+						<>
+							<div {...stylex.props(styles.tableWrap)}>
+								<table {...stylex.props(styles.table)}>
+									<thead {...stylex.props(styles.head)}>
+										<tr>
+											<th {...stylex.props(styles.th)}>Severity</th>
+											<th {...stylex.props(styles.th)}>Event</th>
+											<th {...stylex.props(styles.th)}>Subject</th>
+											<th {...stylex.props(styles.th)}>Started</th>
+											<th {...stylex.props(styles.th)}>Resolved</th>
+											<th {...stylex.props(styles.th)}>Occurrences</th>
+											<th {...stylex.props(styles.th)}>
+												<span {...stylex.props(shared.srOnly)}>Actions</span>
+											</th>
+										</tr>
+									</thead>
+									<tbody>
+										{historyRows.map((event) => (
+											<HistoryRow
+												key={event.id}
+												event={event}
+												busy={purging}
+												onPurge={() => setPendingPurge(event.id)}
+											/>
+										))}
+									</tbody>
+								</table>
+							</div>
+							<p {...stylex.props(styles.footer, styles.note)}>
+								Showing {historyRows.length} resolved {historyRows.length === 1 ? "entry" : "entries"}
+								{hasMore(history) ? "" : " — end of history"}
+							</p>
+							<MoreButton section={history} />
+						</>
+					)}
+					<InlineError error={purgeOne.error ?? purgeAll.error} />
+				</>
+			)}
+
+			<ConfirmDialog
+				isOpen={pendingPurge !== null}
+				title={pendingPurge === "all" ? "Purge resolved history" : "Purge event"}
+				message={
+					pendingPurge === "all"
+						? "Purge all resolved events? Active events are kept."
+						: "Purge this resolved event? Its history is gone for good."
+				}
+				confirmLabel={pendingPurge === "all" ? "Purge all" : "Purge"}
+				onConfirm={confirmPurge}
+				onCancel={() => setPendingPurge(null)}
+			/>
+		</section>
+	);
+}

admin/src/features/diagnostics/SeverityBadge.tsx

@@ -0,0 +1,42 @@
+/**
+ * The severity chip both diagnostics views carry. The word is the affordance —
+ * colour alone would leave the severity unreadable to a screen reader and to
+ * anyone who does not separate the amber from the red.
+ */
+
+import * as stylex from "@stylexjs/stylex";
+import type { DiagnosticSeverity } from "@/lib/types";
+import { colors } from "@/ui/tokens.stylex";
+
+const styles = stylex.create({
+	badge: {
+		display: "inline-block",
+		borderRadius: "0.25rem",
+		borderWidth: 1,
+		borderStyle: "solid",
+		paddingInline: "0.375rem",
+		paddingBlock: "0.125rem",
+		fontSize: "0.75rem",
+		lineHeight: "1rem",
+		fontWeight: 500,
+		whiteSpace: "nowrap",
+	},
+	warning: {
+		borderColor: colors.warnBorder,
+		backgroundColor: colors.warnSurface,
+		color: colors.warnText,
+	},
+	error: {
+		borderColor: colors.dangerBorder,
+		backgroundColor: colors.dangerSurface,
+		color: colors.dangerText,
+	},
+});
+
+export default function SeverityBadge({ severity }: { severity: DiagnosticSeverity }) {
+	return (
+		<span {...stylex.props(styles.badge, severity === "error" ? styles.error : styles.warning)}>
+			{severity === "error" ? "Error" : "Warning"}
+		</span>
+	);
+}

admin/src/features/diagnostics/eventCopy.test.ts

@@ -0,0 +1,50 @@
+import { DIAGNOSTIC_CODES } from "@/lib/types";
+import { DIAGNOSTIC_COMPONENTS, EVENT_COPY, componentLabel, copyFor } from "./eventCopy";
+
+test("the enum holds the fifteen codes the store defines", () => {
+	expect(DIAGNOSTIC_CODES).toHaveLength(15);
+	expect(new Set(DIAGNOSTIC_CODES).size).toBe(15);
+});
+
+test("every code has copy, and no copy belongs to a code that does not exist", () => {
+	for (const code of DIAGNOSTIC_CODES) {
+		const copy = EVENT_COPY[code];
+		expect(copy, code).toBeDefined();
+		expect(copy.title.length, code).toBeGreaterThan(0);
+		expect(copy.impact.length, code).toBeGreaterThan(0);
+		expect(copy.remediation.length, code).toBeGreaterThan(0);
+	}
+	expect(Object.keys(EVENT_COPY).sort()).toEqual([...DIAGNOSTIC_CODES].sort());
+});
+
+test("titles are distinct, so two open episodes never read as the same event", () => {
+	const titles = DIAGNOSTIC_CODES.map((code) => EVENT_COPY[code].title);
+	expect(new Set(titles).size).toBe(titles.length);
+});
+
+test("a code this build has never heard of falls back to the code itself", () => {
+	// The server is the authority on the enum; a newer one can send a sixteenth.
+	const copy = copyFor("nonsense.code" as (typeof DIAGNOSTIC_CODES)[number]);
+	expect(copy.title).toBe("nonsense.code");
+	expect(copy.remediation.length).toBeGreaterThan(0);
+});
+
+test("the component options are the code prefixes, deduplicated and in enum order", () => {
+	expect(DIAGNOSTIC_COMPONENTS).toEqual([
+		"disk",
+		"blocklist",
+		"certificate",
+		"query_log",
+		"upstream_history",
+		"upstream",
+		"client_names",
+		"clients",
+		"listener",
+		"configuration",
+	]);
+});
+
+test("component labels read as prose without inventing a name", () => {
+	expect(componentLabel("query_log")).toBe("Query log");
+	expect(componentLabel("disk")).toBe("Disk");
+});

admin/src/features/diagnostics/eventCopy.ts

@@ -0,0 +1,155 @@
+/**
+ * What each event code means to the operator, in three fixed fields: what the
+ * episode is (`title`), what it costs while it stays open (`impact`), and what
+ * to do about it (`remediation`). The server sends a code and an error string;
+ * every word of explanation the page shows comes from here.
+ *
+ * The record is exhaustive over `DiagnosticCode` by type, and a test walks
+ * `DIAGNOSTIC_CODES` to prove it at runtime too. A sixteenth code added to the
+ * enum fails `tsc` here before it can reach the page as a bare dotted string.
+ *
+ * `link` points at the configuration surface that governs the failure. Those
+ * are today's routes; the navigation restructure re-points them.
+ */
+
+import { DIAGNOSTIC_CODES, type DiagnosticCode } from "@/lib/types";
+
+/** The literal paths keep `link.to` assignable to a typed router `Link`. */
+export type CopyLinkPath = "/settings" | "/blocklists" | "/upstreams" | "/clients";
+
+export interface EventCopy {
+	title: string;
+	impact: string;
+	remediation: string;
+	link?: { to: CopyLinkPath; label: string };
+}
+
+/**
+ * The copy for a code, with a floor under it. `tsc` proves the record covers
+ * the union, but a server one release ahead can send a code this build has
+ * never heard of; showing the raw code beats rendering "undefined".
+ */
+export function copyFor(code: DiagnosticCode): EventCopy {
+	return (
+		EVENT_COPY[code] ?? {
+			title: code,
+			impact: "This build has no description for this event code.",
+			remediation: "The error detail below is the whole of what the server reported.",
+		}
+	);
+}
+
+const SETTINGS = { to: "/settings", label: "Settings" } as const;
+const BLOCKLISTS = { to: "/blocklists", label: "Blocklists" } as const;
+const UPSTREAMS = { to: "/upstreams", label: "Upstreams" } as const;
+const CLIENTS = { to: "/clients", label: "Clients" } as const;
+
+/**
+ * The component filter's options, derived from the codes rather than listed
+ * again: the server matches `component` against the part of `code` before the
+ * dot, so any list written by hand here could drift from the enum.
+ */
+export const DIAGNOSTIC_COMPONENTS: readonly string[] = [
+	...new Set(DIAGNOSTIC_CODES.map((code) => code.slice(0, code.indexOf(".")))),
+];
+
+/** `query_log` → "Query log". Display only; the filter sends the raw component. */
+export function componentLabel(component: string): string {
+	const spaced = component.replaceAll("_", " ");
+	return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+
+export const EVENT_COPY: Record<DiagnosticCode, EventCopy> = {
+	"disk.space": {
+		title: "Disk space low",
+		impact: "Below the critical threshold nxdns stops blocklist updates and query log flushes to protect the disk.",
+		remediation: "Free space on the data volume, or lower the retention window so the query log holds fewer days.",
+		link: SETTINGS,
+	},
+	"disk.probe": {
+		title: "Disk usage probe failed",
+		impact: "Free space is unknown, so the low-disk guard cannot act until a probe succeeds.",
+		remediation: "Check that the data and log directories exist and that the service user can read them.",
+		link: SETTINGS,
+	},
+	"blocklist.refresh": {
+		title: "Blocklist source failed to update",
+		impact: "The source keeps serving its last good snapshot, so blocking continues but the list ages.",
+		remediation: "Check the source url and the machine's internet access, then update the lists again.",
+		link: BLOCKLISTS,
+	},
+	"blocklist.snapshot": {
+		title: "Filter snapshot failed to publish",
+		impact: "The resolver keeps the snapshot it already holds; blocklist edits do not take effect until one publishes.",
+		remediation: "Check free disk space and the data directory's permissions, then update the lists again.",
+		link: BLOCKLISTS,
+	},
+	"blocklist.storage": {
+		title: "Blocklist storage operation failed",
+		impact: "Cached list files or their database rows are out of step; a later pass can redownload what is missing.",
+		remediation: "Check free disk space and the data directory's permissions.",
+		link: BLOCKLISTS,
+	},
+	"certificate.reload": {
+		title: "TLS certificate reload failed",
+		impact: "The endpoint keeps serving the certificate it already loaded, which expires on its own schedule.",
+		remediation:
+			"Check the certificate and key paths, and that renewal writes both files the service user can read.",
+		link: SETTINGS,
+	},
+	"query_log.write": {
+		title: "Query log write failed",
+		impact: "Queries are resolved and answered as usual, but they are not being recorded.",
+		remediation: "Check free disk space and the log database's permissions, then restart nxdns.",
+		link: SETTINGS,
+	},
+	"query_log.maintenance": {
+		title: "Query log maintenance failed",
+		impact: "Old rows are not being trimmed, so the log database grows past its retention window.",
+		remediation: "Check free disk space; the next maintenance pass retries on its own.",
+		link: SETTINGS,
+	},
+	"query_log.recreated": {
+		title: "Query log recreated",
+		impact: "The old log database was unreadable and was moved aside; the history it held is not in the new one.",
+		remediation: "Keep or delete the aside file named below. Nothing else is required — logging is running.",
+		link: SETTINGS,
+	},
+	"upstream_history.write": {
+		title: "Upstream history write failed",
+		impact: "Resolution is unaffected; the per-upstream success and failure aggregates lose the affected window.",
+		remediation: "Check free disk space and the configuration database's permissions.",
+		link: UPSTREAMS,
+	},
+	"upstream.exchange": {
+		title: "Upstream failing",
+		impact: "Queries fall through to the remaining upstreams; answers are slower while this one backs off.",
+		remediation: "Check the upstream's reachability and its TLS name. Remove it if it stays down.",
+		link: UPSTREAMS,
+	},
+	"client_names.storage": {
+		title: "Client name storage failed",
+		impact: "Learned reverse-DNS names are not persisted, so clients can show as bare addresses after a restart.",
+		remediation: "Check free disk space and the configuration database's permissions.",
+		link: CLIENTS,
+	},
+	"clients.storage": {
+		title: "Client record storage failed",
+		impact: "New clients may not appear in the list and stale ones may not be pruned.",
+		remediation: "Check free disk space and the configuration database's permissions.",
+		link: CLIENTS,
+	},
+	"listener.start": {
+		title: "Encrypted DNS listener failed to start",
+		impact: "That endpoint is not accepting queries. Plain DNS on port 53 is unaffected.",
+		remediation:
+			"Check the bind address, the port, and the certificate paths, then restart nxdns. The episode closes on a clean start.",
+		link: SETTINGS,
+	},
+	"configuration.load": {
+		title: "Configuration problem at startup",
+		impact: "The setting named below was rejected or replaced by its default for this run.",
+		remediation: "Correct the setting and restart nxdns. The episode closes on a clean start.",
+		link: SETTINGS,
+	},
+};

admin/src/features/live/LiveLogPage.test.tsx

@@ -0,0 +1,194 @@
+import { act, fireEvent, render, screen, within } from "@testing-library/react";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { createQueryClient } from "@/lib/queryClient";
+import type { Client, LiveQueryEvent } from "@/lib/types";
+import { FakeEventSource } from "./fakeEventSource";
+import LiveLogPage from "./LiveLogPage";
+
+function client(ip: string, name: string, learnedName: string): Client {
+	return {
+		id: Number(ip.split(".").pop()),
+		ip,
+		name,
+		learned_name: learnedName,
+		group_id: 1,
+		group: "default",
+		hand_edited: name !== "",
+		first_seen: 1_700_000_000,
+		last_seen: 1_700_000_100,
+	};
+}
+
+const CLIENTS: Client[] = [
+	client("192.0.2.10", "Kitchen Pi", "pi.lan"),
+	client("192.0.2.11", "", "laptop.lan"),
+	client("192.0.2.12", "", ""),
+];
+
+beforeEach(() => {
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async (input: RequestInfo | URL) => {
+			if (String(input) !== "/api/clients") {
+				return new Response(JSON.stringify({ error: "not stubbed" }), { status: 404 });
+			}
+			return new Response(JSON.stringify({ clients: CLIENTS }), {
+				status: 200,
+				headers: { "content-type": "application/json" },
+			});
+		}),
+	);
+});
+
+afterEach(() => {
+	vi.unstubAllGlobals();
+});
+
+function frame(ts: number, domain: string, overrides: Partial<LiveQueryEvent> = {}): { data: string } {
+	const payload: LiveQueryEvent = {
+		ts,
+		domain,
+		client_ip: "192.0.2.10",
+		qtype: 1,
+		blocked: false,
+		block_reason: "",
+		response_time_us: 500,
+		cache_hit: true,
+		upstream: "",
+		...overrides,
+	};
+	return { data: JSON.stringify(payload) };
+}
+
+function renderPage() {
+	const sources: FakeEventSource[] = [];
+	const createEventSource = (url: string) => {
+		const es = new FakeEventSource(url);
+		sources.push(es);
+		return es;
+	};
+	render(
+		<QueryClientProvider client={createQueryClient()}>
+			<LiveLogPage createEventSource={createEventSource} />
+		</QueryClientProvider>,
+	);
+	return sources;
+}
+
+test("streams rows, flags blocked ones, and freezes the display", () => {
+	const sources = renderPage();
+	expect(screen.getByText("Connecting…")).toBeTruthy();
+
+	act(() => sources[0]!.emit("open"));
+	expect(screen.getByRole("status", { name: "Live" })).toBeTruthy();
+	expect(screen.getByText("Waiting for queries…")).toBeTruthy();
+
+	act(() => {
+		sources[0]!.emit("query", frame(1000, "ok.example"));
+		sources[0]!.emit(
+			"query",
+			frame(1001, "ads.example", { blocked: true, block_reason: "blocklist:stevenblack", qtype: 28 }),
+		);
+	});
+
+	expect(screen.getByText("ok.example")).toBeTruthy();
+	expect(screen.getByText("Blocked")).toBeTruthy();
+	expect(screen.getByText("blocklist:stevenblack")).toBeTruthy();
+	expect(screen.getByText("AAAA")).toBeTruthy();
+	// StyleX compiles to opaque class names, so the check is structural: a blocked
+	// row carries every class a plain row does, plus the ones the flag adds.
+	const blockedRow = screen.getByText("ads.example").closest("tr");
+	const plainRow = screen.getByText("ok.example").closest("tr");
+	const blockedClasses = new Set(blockedRow?.className.split(" "));
+	const plainClasses = plainRow?.className.split(" ") ?? [];
+	expect(plainClasses.every((name) => blockedClasses.has(name))).toBe(true);
+	expect(blockedClasses.size).toBeGreaterThan(plainClasses.length);
+
+	const freeze = screen.getByRole("button", { name: "Freeze" });
+	fireEvent.click(freeze);
+	expect(freeze.getAttribute("aria-pressed")).toBe("true");
+
+	act(() => sources[0]!.emit("query", frame(1002, "later.example")));
+	expect(screen.queryByText("later.example")).toBeNull();
+	expect(screen.getByText(/3 in buffer/)).toBeTruthy();
+
+	fireEvent.click(screen.getByRole("button", { name: "Resume" }));
+	expect(screen.getByText("later.example")).toBeTruthy();
+});
+
+test("resolves each row's client to its display name, keeping the IP as the tooltip", async () => {
+	const sources = renderPage();
+	act(() => sources[0]!.emit("open"));
+	act(() => {
+		sources[0]!.emit("query", frame(1000, "named.example", { client_ip: "192.0.2.10" }));
+		sources[0]!.emit("query", frame(1001, "learned.example", { client_ip: "192.0.2.11" }));
+		sources[0]!.emit("query", frame(1002, "nameless.example", { client_ip: "192.0.2.12" }));
+		sources[0]!.emit("query", frame(1003, "stranger.example", { client_ip: "192.0.2.99" }));
+	});
+
+	// A hand-typed name wins outright; the learned name never surfaces for it.
+	const named = await screen.findByText("Kitchen Pi");
+	expect(named.getAttribute("title")).toBe("192.0.2.10");
+	expect(screen.queryByText("pi.lan")).toBeNull();
+
+	// A learned name reads muted and nothing more here: the "learned" tag would
+	// repeat on every row of the table, so the Clients page carries it instead.
+	const learned = screen.getByText("laptop.lan");
+	expect(learned.getAttribute("title")).toBe("192.0.2.11");
+	expect(within(learned.closest("tr")!).queryByText("learned")).toBeNull();
+
+	// A known client with neither name, and a client the loaded list has never
+	// seen, both fall back to the bare address with no tooltip standing in.
+	const nameless = screen.getByText("192.0.2.12");
+	expect(nameless.getAttribute("title")).toBeNull();
+	const stranger = screen.getByText("192.0.2.99");
+	expect(stranger.getAttribute("title")).toBeNull();
+	expect(screen.getByText("stranger.example").closest("tr")?.textContent).toContain("192.0.2.99");
+});
+
+test("rows stream in as bare IPs while the client list is still loading", async () => {
+	let releaseClients: () => void = () => {};
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(
+			(input: RequestInfo | URL) =>
+				new Promise<Response>((resolve) => {
+					if (String(input) !== "/api/clients") {
+						resolve(new Response(JSON.stringify({ error: "not stubbed" }), { status: 404 }));
+						return;
+					}
+					releaseClients = () =>
+						resolve(
+							new Response(JSON.stringify({ clients: CLIENTS }), {
+								status: 200,
+								headers: { "content-type": "application/json" },
+							}),
+						);
+				}),
+		),
+	);
+
+	const sources = renderPage();
+	act(() => sources[0]!.emit("open"));
+	act(() => sources[0]!.emit("query", frame(1000, "named.example", { client_ip: "192.0.2.10" })));
+
+	expect(screen.getByText("192.0.2.10")).toBeTruthy();
+	expect(screen.queryByText("Kitchen Pi")).toBeNull();
+
+	releaseClients();
+	expect(await screen.findByText("Kitchen Pi")).toBeTruthy();
+});
+
+test("repeated connection failures show the viewer-cap state with a retry button", () => {
+	const sources = renderPage();
+	act(() => {
+		sources[0]!.emit("error");
+		sources[0]!.emit("error");
+		sources[0]!.emit("error");
+	});
+	expect(screen.getByRole("alert").textContent).toContain("too many live viewers");
+
+	fireEvent.click(screen.getByRole("button", { name: "Retry" }));
+	expect(sources).toHaveLength(2);
+	expect(screen.getByText("Connecting…")).toBeTruthy();
+});

admin/src/features/live/LiveLogPage.tsx

@@ -1,4 +1,5 @@
 import * as stylex from "@stylexjs/stylex";
+import { useClientNames } from "@/features/clients/clientNames";
 import { QueryCells, QueryTableHead } from "@/features/queries/QueryLogPage";
 import { RING_CAPACITY } from "./ringBuffer";
 import { useLiveQueries, type EventSourceFactory, type StreamStatus } from "./useLiveQueries";
@@ -168,6 +169,7 @@ function StatusPill({ status }: { status: StreamStatus }) {
  * filling; Resume shows the current buffer (anything pushed out meanwhile is gone). */
 export default function LiveLogPage({ createEventSource }: { createEventSource?: EventSourceFactory } = {}) {
 	const live = useLiveQueries({ createEventSource });
+	const clientNames = useClientNames();
 
 	return (
 		<section>
@@ -240,7 +242,7 @@ export default function LiveLogPage({ createEventSource }: { createEventSource?:
 							<tbody>
 								{live.rows.map((row) => (
 									<tr key={row.key} {...stylex.props(styles.row, row.blocked && styles.rowBlocked)}>
-										<QueryCells row={row} />
+										<QueryCells row={row} clientNames={clientNames} />
 									</tr>
 								))}
 							</tbody>

admin/src/features/queries/QueryLogPage.test.tsx

@@ -1,9 +1,29 @@
-import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { act, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import { QueryClientProvider } from "@tanstack/react-query";
 import { createQueryClient } from "@/lib/queryClient";
-import type { QueriesPage, QueryRow } from "@/lib/types";
+import type { Client, QueriesPage, QueryRow } from "@/lib/types";
 import QueryLogPage from "./QueryLogPage";
 
+function client(id: number, ip: string, name: string, learnedName: string): Client {
+	return {
+		id,
+		ip,
+		name,
+		learned_name: learnedName,
+		group_id: 1,
+		group: "default",
+		hand_edited: name !== "",
+		first_seen: 1_700_000_000,
+		last_seen: 1_700_000_100,
+	};
+}
+
+const CLIENTS: Client[] = [
+	client(1, "192.0.2.10", "Kitchen Pi", "pi.lan"),
+	client(2, "192.0.2.11", "", "laptop.lan"),
+	client(3, "192.0.2.12", "", ""),
+];
+
 function row(id: number, domain: string, overrides: Partial<QueryRow> = {}): QueryRow {
 	return {
 		id,
@@ -48,6 +68,7 @@ beforeEach(() => {
 		"fetch",
 		vi.fn(async (input: RequestInfo | URL) => {
 			const url = String(input);
+			if (url === "/api/clients") return json({ clients: CLIENTS });
 			const payload = PAGES[url];
 			if (payload === undefined) return new Response(JSON.stringify({ error: "not stubbed" }), { status: 404 });
 			return new Response(JSON.stringify(payload), {
@@ -90,6 +111,44 @@ test("renders the first page with type names, blocked badge, and formatted cells
 	expect(screen.getByText(/Showing 2 queries/)).toBeTruthy();
 });
 
+test("resolves each row's client to its display name, keeping the IP as the tooltip", async () => {
+	vi.stubGlobal(
+		"fetch",
+		vi.fn(async (input: RequestInfo | URL) => {
+			const url = String(input);
+			if (url === "/api/clients") return json({ clients: CLIENTS });
+			if (url !== "/api/queries") return new Response(JSON.stringify({ error: "not stubbed" }), { status: 404 });
+			return json({
+				queries: [
+					row(20, "named.example", { client_ip: "192.0.2.10" }),
+					row(19, "learned.example", { client_ip: "192.0.2.11" }),
+					row(18, "nameless.example", { client_ip: "192.0.2.12" }),
+					row(17, "stranger.example", { client_ip: "192.0.2.99" }),
+				],
+				next_before: null,
+			} satisfies QueriesPage);
+		}),
+	);
+
+	renderPage();
+
+	// A hand-typed name wins outright; the learned name never surfaces for it.
+	const named = await screen.findByText("Kitchen Pi");
+	expect(named.getAttribute("title")).toBe("192.0.2.10");
+	expect(screen.queryByText("pi.lan")).toBeNull();
+
+	// A learned name reads muted and nothing more here: the "learned" tag would
+	// repeat on every row of the table, so the Clients page carries it instead.
+	const learned = screen.getByText("laptop.lan");
+	expect(learned.getAttribute("title")).toBe("192.0.2.11");
+	expect(within(learned.closest("tr")!).queryByText("learned")).toBeNull();
+
+	// A known client with neither name, and a client the loaded list has never
+	// seen, both fall back to the bare address with no tooltip standing in.
+	expect(screen.getByText("192.0.2.12").getAttribute("title")).toBeNull();
+	expect(screen.getByText("192.0.2.99").getAttribute("title")).toBeNull();
+});
+
 test("load more appends the next page and stops at the end of the log", async () => {
 	renderPage();
 	await screen.findByText("first.example");

admin/src/features/queries/QueryLogPage.tsx

@@ -5,6 +5,7 @@ import * as api from "@/lib/api";
 import { formatMicros, formatTime } from "@/lib/format";
 import { queriesInfiniteQuery } from "@/lib/queries";
 import type { QueriesFilter, QueryRow } from "@/lib/types";
+import { ClientName, useClientNames, type ClientNames } from "@/features/clients/clientNames";
 import { qtypeName } from "./qtype";
 import Select from "@/ui/Select";
 import { styles as shared } from "@/ui/styles";
@@ -162,12 +163,14 @@ export function BlockedCell({ row }: { row: Pick<QueryRow, "blocked" | "block_re
 	);
 }
 
-export function QueryCells({ row }: { row: Omit<QueryRow, "id"> }) {
+export function QueryCells({ row, clientNames }: { row: Omit<QueryRow, "id">; clientNames: ClientNames }) {
 	return (
 		<>
 			<td {...stylex.props(styles.cell, styles.nowrap, styles.muted)}>{formatTime(row.ts)}</td>
 			<td {...stylex.props(styles.cell, styles.small, styles.breakAll, shared.mono)}>{row.domain}</td>
-			<td {...stylex.props(styles.cell, styles.small, styles.nowrap, shared.mono)}>{row.client_ip}</td>
+			<td {...stylex.props(styles.cell, styles.small, styles.nowrap)}>
+				<ClientName ip={row.client_ip} names={clientNames} />
+			</td>
 			<td {...stylex.props(styles.cell, styles.nowrap)}>{qtypeName(row.qtype)}</td>
 			<td {...stylex.props(styles.cell)}>
 				<BlockedCell row={row} />
@@ -212,6 +215,7 @@ export default function QueryLogPage() {
 	const [applied, setApplied] = useState<QueriesFilter>({});
 
 	const base = useInfiniteQuery(queriesInfiniteQuery(applied));
+	const clientNames = useClientNames();
 
 	const pages = base.data?.pages ?? [];
 	const rows: QueryRow[] = pages.flatMap((page) => page.queries);
@@ -336,7 +340,7 @@ export default function QueryLogPage() {
 							<tbody>
 								{rows.map((row) => (
 									<tr key={row.id} {...stylex.props(styles.row)}>
-										<QueryCells row={row} />
+										<QueryCells row={row} clientNames={clientNames} />
 									</tr>
 								))}
 							</tbody>

admin/src/features/settings/SettingsPage.test.tsx

@@ -33,6 +33,7 @@ function baseSettings(): Settings {
 			level: "info",
 			retention_days: 30,
 			query_log_buffer_max: 10000,
+			query_log_flush_interval_s: 60,
 			hide_domains: false,
 			hide_client_ips: false,
 			output: "stderr",

admin/src/features/settings/SettingsPage.tsx

@@ -116,6 +116,7 @@ const SECTIONS: readonly AnySectionDef[] = [
 			{ key: "level", kind: ["error", "warn", "info", "debug"] },
 			{ key: "retention_days", kind: "number" },
 			{ key: "query_log_buffer_max", kind: "number" },
+			{ key: "query_log_flush_interval_s", kind: "number" },
 			{ key: "hide_domains", kind: "boolean" },
 			{ key: "hide_client_ips", kind: "boolean" },
 			{ key: "output", kind: ["stderr", "syslog", "file"] },

admin/src/features/settings/authority.test.tsx

@@ -38,6 +38,7 @@ function baseSettings(): Settings {
 			level: "info",
 			retention_days: 30,
 			query_log_buffer_max: 10000,
+			query_log_flush_interval_s: 60,
 			hide_domains: false,
 			hide_client_ips: false,
 			output: "stderr",

admin/src/lib/api.ts

@@ -6,6 +6,10 @@ import type {
 	ClientEdit,
 	ClientPrefix,
 	ClientPrefixInput,
+	DiagnosticEvent,
+	DiagnosticsFilter,
+	DiagnosticsPage,
+	DiagnosticsPurge,
 	ForwardZone,
 	ForwardZoneInput,
 	Group,
@@ -118,7 +122,22 @@ export const getStatsTimeseries = (period?: Period): Promise<StatsTimeseries> =>
 export const getLookup = (domain: string, groupId?: number): Promise<LookupResult> =>
 	request(`/api/lookup${qs({ domain, group_id: groupId })}`);
 
-export const getUpstreamHealth = (): Promise<UpstreamHealth> => request("/api/upstream/health");
+export const getUpstreamHealth = (period?: Period): Promise<UpstreamHealth> =>
+	request(`/api/upstream/health${qs({ period })}`);
+
+// Diagnostics
+
+export const getDiagnostics = (filter: DiagnosticsFilter = {}): Promise<DiagnosticsPage> =>
+	request(`/api/diagnostics${qs({ ...filter })}`);
+
+export const getDiagnostic = (id: number): Promise<DiagnosticEvent> => request(`/api/diagnostics/${id}`);
+
+/** Purges one resolved event. An event still active answers 409, an unknown id 404. */
+export const purgeDiagnostic = (id: number): Promise<void> => request(`/api/diagnostics/${id}`, { method: "DELETE" });
+
+/** Purges the whole resolved history; active events are never touched. */
+export const purgeResolvedDiagnostics = (): Promise<DiagnosticsPurge> =>
+	request("/api/diagnostics", { method: "DELETE" });
 
 // Groups
 

admin/src/lib/contractSamples.gen.ts

@@ -9,13 +9,16 @@
 // declare, and a string outside a literal union.
 //
 // Regenerate with:
-//   zig build test -Dintegration -Dcontract-samples-out="$PWD/web/src/lib/contractSamples.gen.ts"
+//   zig build test -Dintegration -Dcontract-samples-out="$PWD/admin/src/lib/contractSamples.gen.ts"
 
 import type {
 	Blocklist,
 	BlocklistEcho,
 	Client,
 	ClientPrefix,
+	DiagnosticEvent,
+	DiagnosticsPage,
+	DiagnosticsPurge,
 	ErrorEnvelope,
 	ForwardZone,
 	Group,
@@ -39,6 +42,11 @@ import type {
 } from "@/lib/types";
 
 export const sample_get_health: Health = {
+	diagnostics: {
+		active_errors: 0,
+		active_warnings: 0,
+		state: "recording",
+	},
 	disk: {
 		db_bytes: 0,
 		free_bytes: 0,
@@ -73,6 +81,57 @@ export const sample_logout: LogoutResponse = {
 	authenticated: false,
 };
 
+export const sample_get_diagnostics: DiagnosticsPage = {
+	active: {
+		errors: 0,
+		warnings: 0,
+	},
+	events: [
+		{
+			code: "upstream_history.write",
+			component: "upstream_history",
+			detail: "Busy",
+			first_seen: 0,
+			id: 0,
+			last_seen: 0,
+			occurrences: 0,
+			resolved_at: 0,
+			severity: "warning",
+			subject: "history",
+		},
+		{
+			code: "blocklist.refresh",
+			component: "blocklist",
+			detail: "download failed: ConnectionTimedOut",
+			first_seen: 0,
+			id: 0,
+			last_seen: 0,
+			occurrences: 0,
+			resolved_at: null,
+			severity: "warning",
+			subject: "StevenBlack",
+		},
+	],
+	next_before: null,
+};
+
+export const sample_get_diagnostic: DiagnosticEvent = {
+	code: "blocklist.refresh",
+	component: "blocklist",
+	detail: "download failed: ConnectionTimedOut",
+	first_seen: 0,
+	id: 0,
+	last_seen: 0,
+	occurrences: 0,
+	resolved_at: null,
+	severity: "warning",
+	subject: "StevenBlack",
+};
+
+export const sample_purge_diagnostics: DiagnosticsPurge = {
+	purged: 0,
+};
+
 export const sample_create_blocklist: BlocklistEcho = {
 	enabled: false,
 	id: 0,
@@ -333,16 +392,23 @@ export const sample_update_upstream: UpstreamEcho = {
 
 export const sample_get_upstream_health: UpstreamHealth = {
 	available: 0,
+	complete: true,
+	period: "24h",
+	since: 0,
 	total: 0,
+	until: 0,
 	upstreams: [
 		{
 			available: true,
-			consecutive_failures: 0,
 			enabled: true,
-			last_error: "",
+			period: {
-			success_rate: 0,
+				attempts: 0,
-			total_failures: 0,
+				failures: 0,
-			total_successes: 0,
+				last_failure_at: null,
+				last_failure_error: null,
+				success_rate: null,
+				successes: 0,
+			},
 			url: "https://dns.example/dns-query",
 		},
 	],
@@ -491,6 +557,7 @@ export const sample_get_settings: SettingsEnvelope = {
 		"logging.level",
 		"logging.retention_days",
 		"logging.query_log_buffer_max",
+		"logging.query_log_flush_interval_s",
 		"logging.hide_domains",
 		"logging.hide_client_ips",
 		"logging.output",
@@ -552,6 +619,7 @@ export const sample_get_settings: SettingsEnvelope = {
 			max_size_mb: 0,
 			output: "stderr",
 			query_log_buffer_max: 0,
+			query_log_flush_interval_s: 0,
 			retention_days: 0,
 		},
 		upstream: {
@@ -614,6 +682,7 @@ export const sample_put_settings: SettingsEnvelope = {
 		"logging.level",
 		"logging.retention_days",
 		"logging.query_log_buffer_max",
+		"logging.query_log_flush_interval_s",
 		"logging.hide_domains",
 		"logging.hide_client_ips",
 		"logging.output",
@@ -675,6 +744,7 @@ export const sample_put_settings: SettingsEnvelope = {
 			max_size_mb: 0,
 			output: "stderr",
 			query_log_buffer_max: 0,
+			query_log_flush_interval_s: 0,
 			retention_days: 0,
 		},
 		upstream: {

admin/src/lib/contract_samples.zig

@@ -6,4 +6,4 @@
 pub const bytes = @embedFile("contractSamples.gen.ts");
 
 /// Repo-relative path, so a failing assertion names the file to regenerate.
-pub const path = "web/src/lib/contractSamples.gen.ts";
+pub const path = "admin/src/lib/contractSamples.gen.ts";

admin/src/lib/format.test.ts

@@ -0,0 +1,44 @@
+import { formatAge, formatBytes, formatDuration, formatMicros, formatTime } from "@/lib/format";
+
+test("formatTime renders unix seconds in the given locale and zone", () => {
+	// 2024-01-01T00:00:00Z; ICU emits U+202F before AM/PM in recent Node.
+	expect(formatTime(1704067200, "en-US", "UTC").replace(/ /g, " ")).toBe("Jan 1, 2024, 12:00:00 AM");
+});
+
+test("formatBytes humanizes with binary units", () => {
+	expect(formatBytes(0)).toBe("0 B");
+	expect(formatBytes(1023)).toBe("1023 B");
+	expect(formatBytes(1024)).toBe("1.0 KiB");
+	expect(formatBytes(1536)).toBe("1.5 KiB");
+	expect(formatBytes(5 * 1024 * 1024)).toBe("5.0 MiB");
+	expect(formatBytes(3 * 1024 * 1024 * 1024)).toBe("3.0 GiB");
+	expect(formatBytes(2 * 1024 ** 4)).toBe("2.0 TiB");
+});
+
+test("formatAge steps up a unit at each boundary and truncates", () => {
+	expect(formatAge(0)).toBe("0s ago");
+	expect(formatAge(59)).toBe("59s ago");
+	expect(formatAge(60)).toBe("1m ago");
+	expect(formatAge(3599)).toBe("59m ago");
+	expect(formatAge(3600)).toBe("1h ago");
+	expect(formatAge(10800)).toBe("3h ago");
+	expect(formatAge(86399)).toBe("23h ago");
+	expect(formatAge(86400)).toBe("1d ago");
+	expect(formatAge(400000)).toBe("4d ago");
+});
+
+test("formatDuration is the same span without the 'ago', and never negative", () => {
+	expect(formatDuration(0)).toBe("0s");
+	expect(formatDuration(59)).toBe("59s");
+	expect(formatDuration(3600)).toBe("1h");
+	expect(formatDuration(86400)).toBe("1d");
+	// Clock skew between the server's timestamps and the browser's clock.
+	expect(formatDuration(-5)).toBe("0s");
+});
+
+test("formatMicros renders milliseconds with one decimal", () => {
+	expect(formatMicros(0)).toBe("0.0 ms");
+	expect(formatMicros(1234)).toBe("1.2 ms");
+	expect(formatMicros(999)).toBe("1.0 ms");
+	expect(formatMicros(2_500_000)).toBe("2500.0 ms");
+});

admin/src/lib/format.ts

@@ -0,0 +1,57 @@
+/** Unix seconds → localized date-time. `locale`/`timeZone` exist for deterministic tests. */
+export function formatTime(unixSeconds: number, locale?: string, timeZone?: string): string {
+	return new Intl.DateTimeFormat(locale, {
+		dateStyle: "medium",
+		timeStyle: "medium",
+		timeZone,
+	}).format(new Date(unixSeconds * 1000));
+}
+
+const BYTE_UNITS = ["KiB", "MiB", "GiB", "TiB"] as const;
+
+export function formatBytes(bytes: number): string {
+	if (bytes < 1024) return `${bytes} B`;
+	let value = bytes;
+	let unit: string = BYTE_UNITS[0];
+	for (const next of BYTE_UNITS) {
+		unit = next;
+		value /= 1024;
+		if (value < 1024) break;
+	}
+	return `${value.toFixed(1)} ${unit}`;
+}
+
+const AGE_UNITS = [
+	{ seconds: 86400, suffix: "d" },
+	{ seconds: 3600, suffix: "h" },
+	{ seconds: 60, suffix: "m" },
+] as const;
+
+/**
+ * Seconds of elapsed time → a coarse "3h ago". Truncating and single-unit on
+ * purpose: this labels a snapshot the caller renders once, so a reader must not
+ * take it for a live count. Nothing re-renders it as it ages.
+ */
+export function formatAge(seconds: number): string {
+	for (const unit of AGE_UNITS) {
+		if (seconds >= unit.seconds) return `${Math.floor(seconds / unit.seconds)}${unit.suffix} ago`;
+	}
+	return `${Math.floor(seconds)}s ago`;
+}
+
+/**
+ * Seconds of elapsed time → a coarse "3h", the same single truncated unit as
+ * `formatAge` without the "ago". For a span the caller labels itself, as in
+ * "active for 3h". A negative span reads "0s": clock skew is not a duration.
+ */
+export function formatDuration(seconds: number): string {
+	for (const unit of AGE_UNITS) {
+		if (seconds >= unit.seconds) return `${Math.floor(seconds / unit.seconds)}${unit.suffix}`;
+	}
+	return `${Math.max(0, Math.floor(seconds))}s`;
+}
+
+/** Microseconds → milliseconds with one decimal, e.g. 1234 → "1.2 ms". */
+export function formatMicros(micros: number): string {
+	return `${(micros / 1000).toFixed(1)} ms`;
+}