Add a statistics pane to the webhook page (closes #368)

Each webhook's event database keeps one row of running totals: events,
deliveries and failures, and how many of each retention removed.
Storing an event, creating a delivery, a delivery becoming failed and
the retention sweep each update it in the transaction that writes or
deletes the rows it counts. Deliveries get a finished_at column, the
last column of the status index, so the last-10-minutes and
last-24-hours figures are index-range counts. The pane is its own
template, included at the top of the page.

The schema changes in place with nothing back-filled, so an existing
database must be recreated.

Model: opus-5-5

.dockerignore

@@ -3,8 +3,10 @@
 # stage of the Dockerfile.
 .git/
 bin/
-# Extracted from 3p/ by `make assets` inside the build; a host copy is not
-# needed. The tarball in 3p/ must stay in the context.
+# Third-party browser assets are fetched and hash-verified inside the build by
+# script/fetch-assets. Excluding any host copy keeps a developer's working tree
+# from supplying the bytes that get shipped. The script and its
+# static/vendor.sha256 manifest stay in the context.
 static/js/alpine.min.js
 *.md
 LICENSE

.gitignore

@@ -46,6 +46,7 @@ temp/
 # CI cache barrier, written into the build context by the check workflow
 .ci-fingerprint
 
-# Alpine.js, extracted by `make assets` from its tarball in 3p/, which is
-# what is committed.
-/static/js/alpine.min.js
+# Third-party browser assets, fetched and hash-verified by
+# script/fetch-assets against static/vendor.sha256. Not committed:
+# REPO_POLICIES.md forbids minified bundles in version control.
+/static/js/alpine.min.js 

Dockerfile

@@ -51,8 +51,15 @@ RUN go mod download
 # the lint stage above.
 COPY . .
 
-# Run tests and build. Both first run script/assets, which extracts Alpine.js
-# from its tarball in 3p/.
+# Fetch the third-party browser assets the UI serves. They are not committed
+# (REPO_POLICIES.md forbids minified bundles in version control) and
+# .dockerignore keeps any host copy out of the build context, so this step is
+# the only way they enter the image. Each download is checked against a
+# hardcoded sha256 and the build fails on mismatch; make test re-checks the
+# hashes against the bytes go:embed actually put in the binary.
+RUN script/fetch-assets
+
+# Run tests and build
 RUN make test
 
 # Version stamped into the binary. .dockerignore excludes .git/, so
@@ -60,8 +67,8 @@ RUN make test
 # host and passes it in. The default is what a bare `docker build .`
 # with no --build-arg gets, and it names no tag the tree may not be at.
 #
-# Declared here, below the test step, so a changed version does not
-# invalidate its cached layer.
+# Declared here, below the test and asset steps, so a changed version
+# does not invalidate their cached layers.
 ARG VERSION=unknown
 
 RUN make build VERSION="$VERSION"

Makefile

@@ -28,7 +28,7 @@ setup:
 	@script/setup
 
 assets:
-	@script/assets
+	@script/fetch-assets
 
 test:
 	@script/test
@@ -45,13 +45,13 @@ fmt-check:
 check:
 	@script/check
 
-build: assets
+build:
 	go build -ldflags '$(strip -X main.version=$(VERSION) $(GO_LDFLAGS))' -o bin/webhooker ./cmd/webhooker
 
 run: build
 	./bin/webhooker
 
-dev: assets
+dev:
 	go run ./cmd/webhooker
 
 deps:

README.md

@@ -21,6 +21,9 @@ before deploying one.
 - Go 1.26.1+ (the version in `go.mod`)
 - Docker (for linting, for the test stage of the CI gate, and for
   containerized deployment)
+- `curl`, used by `script/fetch-assets` to download the third-party
+  browser assets, which are not committed (`make bootstrap` installs
+  it if missing)
 
 golangci-lint is not a prerequisite and must not be installed on the
 host: `script/bootstrap` does not install it, and `make lint` runs the
@@ -33,7 +36,9 @@ digest-pinned linter image via `Dockerfile.lint`.
 git clone https://git.eeqj.de/sneak/webhooker.git
 cd webhooker
 
-# Install the Go toolchain if missing, and the Go dependencies
+# Install Go dependencies and the third-party browser assets.
+# `make deps` alone is not enough: it only runs go mod download/tidy,
+# and the checks below need the fetched assets.
 make bootstrap
 
 # Run all checks (test, lint, format check)
@@ -53,7 +58,7 @@ make docker
 ```bash
 make bootstrap  # Install all dependencies (idempotent)
 make setup      # Bootstrap + install git pre-commit hook
-make assets     # Extract Alpine.js from 3p/ (test, check, build, dev run it)
+make assets     # Fetch + verify third-party browser assets
 make fmt        # Format code (gofmt + goimports)
 make fmt-check  # Fail if gofmt would change anything (writes nothing)
 make lint       # Run golangci-lint in Docker (Dockerfile.lint)
@@ -1065,7 +1070,7 @@ unconditionally against whatever files it finds:
 - the main database on connect — `Setting`, `User`, `APIKey`, `Webhook`,
   `Entrypoint`, `Target`
 - each event database when it is lazily opened — `Event`, `Delivery`,
-  `DeliveryResult`, `EventTotals`, `TargetTotals`
+  `DeliveryResult`, `Totals`
 - each archive database on every open and reopen
 
 There is no schema version table, no migration ledger, and no down
@@ -1216,15 +1221,14 @@ This repository adheres to the
 standard: normalized scripts in `script/` are the entrypoints for the
 development workflow. Ten of the Makefile's seventeen targets are thin
 shims that call them; `build`, `run`, `dev`, `deps`, `clean`, `css` and
-`version` are inline commands with no script behind them, though `build`,
-`run` and `dev` first run `script/assets`, and `build` and `version` both
-take their value from `script/version`.
+`version` are inline commands with no script behind them, though
+`build` and `version` both take their value from `script/version`.
 
-`script/test`, `make build` and `make dev` each run `script/assets`
-first, which writes the ignored `static/js/alpine.min.js` (see
-[Third-party browser assets](#third-party-browser-assets)), so
-`make test`, `make check` and the pre-commit hook work on a fresh clone
-without a separate step.
+`make check` needs the third-party browser assets in `static/`, which
+are not committed, so run `make bootstrap` (or just `make assets`) once
+after cloning. Without them the tests fail with a message naming that
+remedy. `make check` does not fetch them itself because it must not
+change any files in the repo.
 
 We provide:
 
@@ -1232,8 +1236,8 @@ We provide:
 - `script/setup` — make a fresh clone ready for development
   (bootstrap, then install-precommit)
 - `script/projectname` — output the project name ("webhooker")
-- `script/assets` — extract Alpine.js from its tarball in `3p/` (see
-  [Third-party browser assets](#third-party-browser-assets))
+- `script/fetch-assets` — download the third-party browser assets into
+  `static/`, verifying each against its pinned sha256
 - `script/test` — run the test suite
 - `script/lint` — run golangci-lint in Docker (see Linting below)
 - `script/fmt` — format all code (writes)
@@ -1255,25 +1259,24 @@ We provide:
 
 ## Third-party browser assets
 
-The web UI serves one third-party script, Alpine.js. Its npm package tarball
-is committed as `3p/alpinejs-3.14.9.tgz`, byte for byte as the npm registry
-publishes it. It is a dependency, not this repo's build output, so
-`REPO_POLICIES.md`'s rule against committed build artifacts does not apply.
-The directory is `3p/` rather than `vendor/` because Go treats a root
-`vendor/` directory as its module vendor directory.
+The web UI serves one third-party script, Alpine.js. It is **not** committed:
+a minified bundle in the tree is unreviewable, and `REPO_POLICIES.md` bars
+both committed build artifacts and unpinned external references.
 
-`script/assets` (`make assets`) extracts the browser build,
-`package/dist/cdn.min.js`, from the tarball to `static/js/alpine.min.js`,
-where `go:embed` picks it up. `script/test`, `make build` and `make dev` run
-it first, and the Dockerfile builds through `make test` and `make build`, so
-nothing downloads Alpine.js. The extracted file is not committed, and
-`.dockerignore` keeps any host copy out of the build context.
+Instead `script/fetch-assets` downloads it from a pinned URL, checks the
+download against a hardcoded sha256, and installs it under `static/`. The
+sha256 of every installed asset is recorded in `static/vendor.sha256`, and
+`static/vendor_test.go` re-hashes the bytes `go:embed` put in the binary
+against that manifest — so the pin is enforced on what actually ships, not
+merely written down. Any mismatch fails the build.
 
-To move to a new version: download
-`https://registry.npmjs.org/alpinejs/-/alpinejs-<version>.tgz`, check it
-against the `dist.integrity` hash listed at
-`https://registry.npmjs.org/alpinejs/<version>`, replace the tarball in `3p/`
-with it, update its file name in `script/assets`, and run `make check`.
+`make bootstrap` runs the fetch for local development, and the Dockerfile
+runs it in the build stage; `.gitignore` and `.dockerignore` keep the
+artifact out of both the repo and the build context.
+
+To move to a new version: update the version, URL, and tarball sha256 in
+`script/fetch-assets` and the asset sha256 in `static/vendor.sha256`, then
+run `make assets && make check`.
 
 ## Rationale
 
@@ -1381,7 +1384,7 @@ The codebase uses consistent naming throughout (rename completed in
 
 ### Data Model
 
-webhooker's data model has eleven entities organized into two tiers: the
+webhooker's data model has ten entities organized into two tiers: the
 **application tier** (user and webhook configuration) and the **event
 tier** (event ingestion, delivery, and logging).
 
@@ -1411,12 +1414,9 @@ tier** (event ingestion, delivery, and logging).
 │  │  Event   │──1:N──│ Delivery │──1:N──│ DeliveryResult  │  │
 │  └──────────┘       └──────────┘       └─────────────────┘  │
 │                                                             │
-│  ┌──────────────┐  (one row: running counts of events)      │
-│  │ EventTotals  │                                           │
-│  └──────────────┘                                           │
-│  ┌──────────────┐  (one row per target: running counts      │
-│  │ TargetTotals │   of its deliveries)                      │
-│  └──────────────┘                                           │
+│  ┌──────────┐                                               │
+│  │  Totals  │  (one row of running counts)                  │
+│  └──────────┘                                               │
 └─────────────────────────────────────────────────────────────┘
 ```
 
@@ -1737,65 +1737,57 @@ retries) is individually logged for full observability.
 
 **Relations:** Belongs to Delivery.
 
-#### EventTotals and TargetTotals
+#### Totals
 
-Running counts in each event database, read by the statistics pane at the
-top of the webhook page. `EventTotals` is one row:
-
-| Field            | Type    | Description |
-| ---------------- | ------- | ----------- |
-| `events`         | integer | Events ever stored, resubmitted copies included |
-| `events_removed` | integer | Events retention has deleted |
-
-`TargetTotals` is one row per target, created by the first delivery to it:
+The one row of running counts in each event database, read by the
+statistics pane at the top of the webhook page.
 
 | Field                | Type    | Description |
 | -------------------- | ------- | ----------- |
-| `target_id`          | UUID    | The target (primary key) |
-| `deliveries`         | integer | Deliveries to it ever created, replays included |
-| `delivered`          | integer | Of those, how many became `delivered` |
-| `failed`             | integer | Of those, how many became `failed` |
-| `deliveries_removed` | integer | Its deliveries retention has deleted |
-| `failed_removed`     | integer | Its failed deliveries retention has deleted |
+| `events`             | integer | Events ever stored, resubmitted copies included |
+| `deliveries`         | integer | Deliveries ever created, replays included |
+| `failures`           | integer | Deliveries that ever became `failed` |
+| `events_removed`     | integer | Events retention has deleted |
+| `deliveries_removed` | integer | Deliveries retention has deleted |
+| `failures_removed`   | integer | Failed deliveries retention has deleted |
 
 Each count changes in the transaction that writes or deletes the rows it
-counts. The pane's lifetime events are `events`, and its lifetime
-deliveries and failures are `deliveries` and `failed` summed over the
-targets; each figure within retention is the same less what retention
-removed, so neither needs the rows themselves. Its last-10-minutes and
-last-24-hours figures are counted from the `events` and `deliveries`
-indexes over just that window, the deliveries in one query grouped by
-target. Its failure percentage for a window is the deliveries that became
+counts. The pane shows each of the first three as a lifetime figure, and
+less what retention removed as the figure within retention, so neither
+needs the rows themselves. Its last-10-minutes and last-24-hours figures
+are counted from the `events` and `deliveries` indexes over just that
+window. Its failure percentage for a window is the deliveries that became
 `failed` in it out of all that became `delivered` or `failed` in it, and
 a dash when none did.
 
 #### Event-tier indexes
 
 These indexes on the per-webhook event databases are declared in the model
-tags, so `AutoMigrate` creates them on a fresh database:
+tags, so `AutoMigrate` creates them on a fresh and on an existing database:
 
 | Table              | Columns                     | Serves |
 | ------------------ | --------------------------- | ------ |
-| `deliveries`       | `status`, `deleted_at`, `finished_at`, `target_id` | Startup recovery, the retry and pending sweeps every 60 seconds and the queue-depth sampler every 30 seconds, which select deliveries by status, and the webhook page's statistics, which count each target's deliveries by status and when they finished |
-| `deliveries`       | `event_id`, `deleted_at`    | The event log, which loads each event's deliveries, and retention, which counts and deletes the deliveries of expired events |
+| `deliveries`       | `status`, `deleted_at`, `finished_at` | Startup recovery, the retry and pending sweeps every 60 seconds and the queue-depth sampler every 30 seconds, which select deliveries by status, and the webhook page's statistics, which count deliveries by status and when they finished |
+| `deliveries`       | `event_id`, `deleted_at`    | The event log, which loads each event's deliveries, and retention, which selects and deletes the deliveries of expired events |
 | `delivery_results` | `delivery_id`, `deleted_at` | The event log, which loads the attempts of a page's deliveries, and retention, which deletes the attempts of expired events |
-| `events`           | `deleted_at`, `created_at`  | The webhook page's statistics, which count recent events and find the newest |
-| `events`           | `created_at`                | Retention, which selects expired events by age |
+| `events`           | `deleted_at`, `created_at`  | Retention, which selects expired events by age, and the webhook page's statistics, which count recent events and find the newest |
+| `events`           | `created_at`                | Retention's delete of the expired events themselves |
 
-GORM's soft delete adds `deleted_at IS NULL` to these queries; retention
-leaves it out. SQLite keeps no statistics on these tables, and without them it
-rates the `deleted_at` index, which every live row matches, above an index on
-a column matched against several values or compared with `<`. So every index
-but the last also covers `deleted_at`. It comes second, so that retention can
-use the index without it, except in `events`, where `created_at` is compared
-with `<` and SQLite narrows by a `<` only on the last column it uses.
+GORM's soft delete adds `deleted_at IS NULL` to these queries; retention's
+deletes leave it out, but their lookups of expired rows keep it. SQLite keeps
+no statistics on these tables, and without them it rates the `deleted_at`
+index, which every live row matches, above an index on a column matched
+against several values or compared with `<`. So every index but the last also
+covers `deleted_at`. It comes second, so that retention's deletes can use the
+index without it, except in `events`, where `created_at` is compared with `<`
+and SQLite narrows by a `<` only on the last column it uses.
 
 #### Common Fields
 
-Every entity except `Setting`, `EventTotals` and `TargetTotals` includes
-these fields from `BaseModel`. `Setting` is a bare key-value row with no
-`id`, no timestamps and no soft delete, and the two totals tables hold
-only counts, keyed by a numeric `id` and by `target_id`:
+Every entity except `Setting` and `Totals` includes these fields from
+`BaseModel`. `Setting` is a bare key-value row with no `id`, no
+timestamps and no soft delete, and `Totals` is a single row of counts
+with only a numeric `id`:
 
 | Field        | Type      | Description |
 | ------------ | --------- | ----------- |
@@ -1837,8 +1829,7 @@ encryption key is generated and stored, and an `admin` user is created.
 - **Events** — captured incoming webhook payloads
 - **Deliveries** — event-to-target pairings and their status
 - **DeliveryResults** — individual delivery attempt logs
-- **EventTotals** and **TargetTotals** — running counts of the above,
-  the deliveries per target, kept through retention
+- **Totals** — running counts of the above, kept through retention
 
 Per-webhook databases are created automatically when a webhook is
 created (and lazily on first access for webhooks that predate this
@@ -2794,8 +2785,6 @@ imports. The entry point is `cmd/webhooker/main.go`.
 
 ```
 webhooker/
-├── 3p/
-│   └── alpinejs-3.14.9.tgz    # Alpine.js npm package, extracted by make assets
 ├── cmd/webhooker/
 │   └── main.go               # Entry point: subcommand dispatch; no args locks DATA_DIR and wires fx
 ├── internal/
@@ -2819,7 +2808,6 @@ webhooker/
 │   │   ├── model_event.go     # Event entity (per-webhook DB)
 │   │   ├── model_delivery.go  # Delivery entity (per-webhook DB)
 │   │   ├── model_delivery_result.go  # DeliveryResult entity (per-webhook DB)
-│   │   ├── model_totals.go    # EventTotals and TargetTotals (per-webhook DB)
 │   │   ├── model_apikey.go    # APIKey entity
 │   │   ├── password.go        # Argon2id hashing and verification
 │   │   ├── retention.go       # Retention reaper (per-webhook event expiry)
@@ -2890,7 +2878,8 @@ webhooker/
 │   ├── css/tailwind.css       # Generated stylesheet the pages load
 │   ├── css/style.css          # Older hand-written stylesheet, no longer loaded
 │   ├── js/app.js              # Progressive-enhancement copy-to-clipboard
-│   └── js/alpine.min.js       # Alpine.js, extracted from 3p/ by make assets, not committed
+│   ├── js/alpine.min.js       # Alpine.js, fetched by script/fetch-assets, not committed
+│   └── vendor.sha256          # Pinned hashes the fetched assets are verified against
 ├── templates/                 # Go HTML templates (base, login, sources, etc.)
 ├── script/                    # Scripts to Rule Them All entrypoints
 ├── Dockerfile                 # Three stages: lint, test+build, Alpine runtime
@@ -3202,14 +3191,14 @@ version is fixed independently of the compiler's:
    `make fmt-check`, then `golangci-lint config verify` and
    `golangci-lint run`, both with `--network=none`.
 2. **Builder stage** (`golang:1.26.1-bookworm`) — depends on the lint
-   stage passing (it copies a file from it), runs `make test` and
-   `make build` (both extract Alpine.js from `3p/` first), and finally
-   rebuilds the binary with `CGO_ENABLED=1` and static linking so it
-   runs on musl. Both builds go through `make build`, the relink adding
-   its `-extldflags` via `GO_LDFLAGS`, so neither can drop the `-X` that
-   stamps the version. The version arrives as the `VERSION` build arg,
-   since the context has no `.git` (see
-   [Version stamping](#version-stamping)).
+   stage passing (it copies a file from it), runs `script/fetch-assets`
+   to download and verify the third-party browser assets, then runs
+   `make test` and `make build`, and finally rebuilds the binary with
+   `CGO_ENABLED=1` and static linking so it runs on musl. Both builds
+   go through `make build`, the relink adding its `-extldflags` via
+   `GO_LDFLAGS`, so neither can drop the `-X` that stamps the version.
+   The version arrives as the `VERSION` build arg, since the context
+   has no `.git` (see [Version stamping](#version-stamping)).
 3. **Runtime stage** (`alpine:3.21`) — copies the static binary and
    `deploy/docker-entrypoint.sh`, creates the `/var/lib/webhooker`
    directory for all SQLite databases, exposes port 8080, and includes

internal/database/event_tier_indexes_test.go

@@ -93,11 +93,12 @@ func TestEventTierQueriesUseTheirIndexes(t *testing.T) {
 		deliveries []database.Delivery
 		results    []database.DeliveryResult
 		depths     []struct{ Depth int }
-		removed    []database.TargetTotals
+		failed     struct{ Count int64 }
 	)
 
 	byStatus := "idx_deliveries_status (status=? AND deleted_at=?)"
 	byEvent := "idx_deliveries_event_id (event_id=? AND deleted_at=?)"
+	byAge := "idx_events_deleted_at_created_at (deleted_at=? AND created_at<?)"
 
 	// The delivery engine: recovery and the retry sweep, the sweep for
 	// stranded pending deliveries, and the queue depth count.
@@ -123,38 +124,38 @@ func TestEventTierQueriesUseTheirIndexes(t *testing.T) {
 		Order("attempt_num ASC").Find(&results),
 		"idx_delivery_results_delivery_id (delivery_id=? AND deleted_at=?)")
 
-	// Retention (reapExpired, deleteEvents): one batch of expired
-	// events, then their attempts, deliveries and the events.
-	var expired []string
+	// Retention's deletes (deleteExpired), whose subqueries are built
+	// afresh for each statement as it builds them.
+	expiredEventIDs := func() *gorm.DB {
+		return dry.Model(&database.Event{}).Select("id").
+			Where("created_at < ?", cutoff)
+	}
 
-	assertPlanUses(t, db, dry.Unscoped().Model(&database.Event{}).
-		Where("created_at < ?", cutoff).
-		Limit(database.ExportReapBatchSize).Pluck("id", &expired),
-		"idx_events_created_at (created_at<?)")
 	assertPlanUses(t, db, dry.Unscoped().Where(
-		"delivery_id IN (?)", dry.Unscoped().Model(&database.Delivery{}).
-			Select("id").Where("event_id IN ?", ids),
+		"delivery_id IN (?)", dry.Model(&database.Delivery{}).
+			Select("id").Where("event_id IN (?)", expiredEventIDs()),
 	).Delete(&database.DeliveryResult{}),
-		"idx_delivery_results_delivery_id (delivery_id=?)",
-		"idx_deliveries_event_id (event_id=?)")
+		"idx_delivery_results_delivery_id (delivery_id=?)", byEvent, byAge)
 	assertPlanUses(t, db, dry.Unscoped().Model(&database.Delivery{}).
-		Select("target_id, count(*) AS deliveries_removed, "+
-			"count(CASE WHEN status = ? THEN 1 END) AS failed_removed",
+		Select("count(CASE WHEN status = ? THEN 1 END) AS count",
 			database.DeliveryStatusFailed).
-		Where("event_id IN ?", ids).Group("target_id").Find(&removed),
-		"idx_deliveries_event_id (event_id=?)")
-	assertPlanUses(t, db, dry.Unscoped().Where("event_id IN ?", ids).
-		Delete(&database.Delivery{}), "idx_deliveries_event_id (event_id=?)")
-	assertPlanUses(t, db, dry.Unscoped().Where("id IN ?", ids).
-		Delete(&database.Event{}), "sqlite_autoindex_events_1 (id=?)")
+		Where("event_id IN (?)", expiredEventIDs()).
+		Take(&failed),
+		"idx_deliveries_event_id (event_id=?)", byAge)
+	assertPlanUses(t, db, dry.Unscoped().Where(
+		"event_id IN (?)", expiredEventIDs(),
+	).Delete(&database.Delivery{}),
+		"idx_deliveries_event_id (event_id=?)", byAge)
+	assertPlanUses(t, db, dry.Unscoped().Where(
+		"created_at < ?", cutoff,
+	).Delete(&database.Event{}), "idx_events_created_at (created_at<?)")
 }
 
 // TestStatisticsQueriesUseTheirIndexes does the same for the webhook
 // page's statistics (readEventStats in the handlers): deliveries in
-// progress, each target's deliveries finished since a time, which must
-// come from the index alone, events received since a time, and the
-// newest event, which must come straight off an index rather than from
-// sorting every event.
+// progress, deliveries finished and events received since a time, and
+// the newest event, which must come straight off an index rather than
+// from sorting every event.
 func TestStatisticsQueriesUseTheirIndexes(t *testing.T) {
 	t.Parallel()
 
@@ -171,9 +172,8 @@ func TestStatisticsQueriesUseTheirIndexes(t *testing.T) {
 	since := time.Now()
 
 	var (
-		count    int64
-		newest   []time.Time
-		byTarget []struct{ TargetID string }
+		count  int64
+		newest []time.Time
 	)
 
 	assertPlanUses(t, db, dry.Model(&database.Delivery{}).
@@ -183,18 +183,9 @@ func TestStatisticsQueriesUseTheirIndexes(t *testing.T) {
 		}).Count(&count),
 		"idx_deliveries_status (status=? AND deleted_at=?)")
 	assertPlanUses(t, db, dry.Model(&database.Delivery{}).
-		Select("target_id, "+
-			"count(CASE WHEN status = ? THEN 1 END) AS delivered, "+
-			"count(CASE WHEN status = ? THEN 1 END) AS failed",
-			database.DeliveryStatusDelivered,
-			database.DeliveryStatusFailed).
-		Where("status IN ? AND finished_at >= ?",
-			[]database.DeliveryStatus{
-				database.DeliveryStatusDelivered,
-				database.DeliveryStatusFailed,
-			}, since).
-		Group("target_id").Find(&byTarget),
-		"COVERING INDEX idx_deliveries_status "+
+		Where("status = ? AND finished_at >= ?",
+			database.DeliveryStatusFailed, since).Count(&count),
+		"idx_deliveries_status "+
 			"(status=? AND deleted_at=? AND finished_at>?)")
 	assertPlanUses(t, db, dry.Model(&database.Event{}).
 		Where("created_at >= ?", since).Count(&count),

internal/database/export_test.go

@@ -28,10 +28,6 @@ func NewTestRetentionReaper(
 	}
 }
 
-// ExportReapBatchSize exposes how many expired events one retention
-// transaction deletes.
-const ExportReapBatchSize = reapBatchSize
-
 // ExportSweep runs a single retention sweep synchronously for tests.
 func (r *RetentionReaper) ExportSweep(ctx context.Context) {
 	r.sweep(ctx)

internal/database/model_delivery.go

@@ -41,7 +41,7 @@ type Delivery struct {
 	BaseModel
 
 	EventID  string         `gorm:"type:uuid;not null;index:idx_deliveries_event_id,priority:1"       json:"eventId"`
-	TargetID string         `gorm:"type:uuid;not null;index:idx_deliveries_status,priority:4"         json:"targetId"`
+	TargetID string         `gorm:"type:uuid;not null"                                                json:"targetId"`
 	Status   DeliveryStatus `gorm:"not null;default:'pending';index:idx_deliveries_status,priority:1" json:"status"`
 
 	// DeletedAt repeats the BaseModel field only to be the second column
@@ -50,10 +50,9 @@ type Delivery struct {
 	DeletedAt gorm.DeletedAt `gorm:"index:idx_deliveries_event_id,priority:2;index:idx_deliveries_status,priority:2" json:"deletedAt,omitzero"`
 
 	// FinishedAt is when the delivery became delivered or failed, and
-	// nil while it is pending or retrying. It and then TargetID end the
-	// status index, so the webhook page counts each target's deliveries
-	// that finished in a recent window by reading just that window from
-	// the index.
+	// nil while it is pending or retrying. It ends the status index,
+	// so the webhook page counts the deliveries that finished in a
+	// recent window by reading that window from the index.
 	FinishedAt *time.Time `gorm:"index:idx_deliveries_status,priority:3" json:"finishedAt,omitempty"`
 
 	// Relations

internal/database/model_totals.go

@@ -6,85 +6,67 @@ import (
 	"gorm.io/gorm"
 )
 
-// The running totals in a webhook's event database keep the webhook
-// page's lifetime figures right after retention has removed the rows
-// they count, and let the page show them without counting every row.
-// Each total changes in the transaction that writes or deletes the
-// rows it counts.
-
-// EventTotals is the single row counting a webhook's events: every
-// event ever stored, and how many of them retention has deleted.
-type EventTotals struct {
+// Totals is the single row of running totals in a webhook's event
+// database. It is what keeps the webhook page's lifetime figures right
+// after retention has removed the rows they count, and what lets the
+// page show them without counting every row.
+//
+// Storing an event, creating a delivery and failing a delivery each
+// add one, and retention adds what it deletes to the Removed columns.
+// Every addition goes through AddTotals, in the transaction that
+// writes or deletes the rows it counts.
+type Totals struct {
 	ID int64 `gorm:"primaryKey"`
 
-	Events        int64 `gorm:"not null"`
-	EventsRemoved int64 `gorm:"not null"`
-}
-
-// TableName names the table AddEventTotals updates.
-func (EventTotals) TableName() string {
-	return "event_totals"
-}
-
-// TargetTotals is one row per target counting its deliveries: every
-// delivery ever created, how many became delivered and how many
-// failed, and how many deliveries and failed deliveries retention has
-// deleted. The webhook's delivery figures are these rows summed.
-type TargetTotals struct {
-	TargetID string `gorm:"type:uuid;primaryKey"`
-
+	Events     int64 `gorm:"not null"`
 	Deliveries int64 `gorm:"not null"`
-	Delivered  int64 `gorm:"not null"`
-	Failed     int64 `gorm:"not null"`
+	Failures   int64 `gorm:"not null"`
 
+	EventsRemoved     int64 `gorm:"not null"`
 	DeliveriesRemoved int64 `gorm:"not null"`
-	FailedRemoved     int64 `gorm:"not null"`
+	FailuresRemoved   int64 `gorm:"not null"`
 }
 
-// TableName names the table AddTargetTotals updates.
-func (TargetTotals) TableName() string {
-	return "target_totals"
+// TableName names the table AddTotals updates.
+func (Totals) TableName() string {
+	return "totals"
 }
 
-// AddEventTotals adds each count in add to the webhook's event totals.
-// Call it on the transaction that writes or deletes the events it
-// counts.
-func AddEventTotals(tx *gorm.DB, add EventTotals) error {
+// EventsWithinRetention is how many of the webhook's events are still
+// stored.
+func (t Totals) EventsWithinRetention() int64 {
+	return t.Events - t.EventsRemoved
+}
+
+// DeliveriesWithinRetention is how many of the webhook's deliveries
+// are still stored.
+func (t Totals) DeliveriesWithinRetention() int64 {
+	return t.Deliveries - t.DeliveriesRemoved
+}
+
+// FailuresWithinRetention is how many of the webhook's failed
+// deliveries are still stored.
+func (t Totals) FailuresWithinRetention() int64 {
+	return t.Failures - t.FailuresRemoved
+}
+
+// AddTotals adds each count in add to the webhook's running totals.
+// Call it on the transaction that writes or deletes the rows it
+// counts, so the totals change exactly when those rows do.
+func AddTotals(tx *gorm.DB, add Totals) error {
 	err := tx.Exec(
-		`UPDATE event_totals SET
+		`UPDATE totals SET
 			events = events + ?,
-			events_removed = events_removed + ?`,
-		add.Events, add.EventsRemoved,
+			deliveries = deliveries + ?,
+			failures = failures + ?,
+			events_removed = events_removed + ?,
+			deliveries_removed = deliveries_removed + ?,
+			failures_removed = failures_removed + ?`,
+		add.Events, add.Deliveries, add.Failures,
+		add.EventsRemoved, add.DeliveriesRemoved, add.FailuresRemoved,
 	).Error
 	if err != nil {
-		return fmt.Errorf("adding to event totals: %w", err)
-	}
-
-	return nil
-}
-
-// AddTargetTotals adds each count in add to the totals of the target
-// add.TargetID names, creating its row the first time. Call it on the
-// transaction that writes or deletes the deliveries it counts.
-func AddTargetTotals(tx *gorm.DB, add TargetTotals) error {
-	err := tx.Exec(
-		`INSERT INTO target_totals (target_id, deliveries, delivered,
-			failed, deliveries_removed, failed_removed)
-		VALUES (?, ?, ?, ?, ?, ?)
-		ON CONFLICT (target_id) DO UPDATE SET
-			deliveries = deliveries + excluded.deliveries,
-			delivered = delivered + excluded.delivered,
-			failed = failed + excluded.failed,
-			deliveries_removed =
-				deliveries_removed + excluded.deliveries_removed,
-			failed_removed = failed_removed + excluded.failed_removed`,
-		add.TargetID, add.Deliveries, add.Delivered,
-		add.Failed, add.DeliveriesRemoved, add.FailedRemoved,
-	).Error
-	if err != nil {
-		return fmt.Errorf(
-			"adding to totals of target %s: %w", add.TargetID, err,
-		)
+		return fmt.Errorf("adding to running totals: %w", err)
 	}
 
 	return nil

internal/database/models.go

@@ -2,8 +2,7 @@ package database
 
 // Migrate runs database migrations for the main application database.
 // Only configuration-tier models are stored in the main database.
-// Event-tier models (Event, Delivery, DeliveryResult, EventTotals,
-// TargetTotals) live in
+// Event-tier models (Event, Delivery, DeliveryResult, Totals) live in
 // per-webhook dedicated databases managed by WebhookDBManager.
 func (d *Database) Migrate() error {
 	return d.db.AutoMigrate(

internal/database/retention.go

@@ -18,13 +18,6 @@ import (
 // computation.
 const hoursPerDay = 24
 
-// reapBatchSize is how many expired events one retention transaction
-// deletes. A transaction holds the event database's write lock, which
-// the receiver and the delivery workers wait for, so a large prune is
-// split into transactions each short enough to finish well inside the
-// busy timeout.
-const reapBatchSize = 1000
-
 // RetentionReaperParams holds the fx dependencies for the
 // RetentionReaper.
 type RetentionReaperParams struct {
@@ -272,97 +265,103 @@ func retentionCutoff(
 	), true
 }
 
-// reapExpired hard-deletes the events older than cutoff, with their
-// deliveries and delivery results, reapBatchSize events per
-// transaction until none is left. It returns the number of events
-// deleted.
+// reapExpired hard-deletes, in foreign-key-safe order, the delivery
+// results, deliveries, and events associated with events older than
+// cutoff, and adds what it deleted to the running totals, all in one
+// transaction. Deletes are unscoped so rows are physically removed
+// rather than soft-deleted, reclaiming disk. It returns the number of
+// events deleted.
 func reapExpired(db *gorm.DB, cutoff time.Time) (int64, error) {
-	var total int64
+	var removed Totals
 
-	for {
-		var eventIDs []string
+	err := db.Transaction(func(tx *gorm.DB) error {
+		var err error
 
-		err := db.Transaction(func(tx *gorm.DB) error {
-			err := tx.Unscoped().Model(&Event{}).
-				Where("created_at < ?", cutoff).
-				Limit(reapBatchSize).
-				Pluck("id", &eventIDs).Error
-			if err != nil {
-				return fmt.Errorf("selecting expired events: %w", err)
-			}
-
-			if len(eventIDs) == 0 {
-				return nil
-			}
-
-			return deleteEvents(tx, eventIDs)
-		})
-		if err != nil {
-			return total, err
-		}
-
-		total += int64(len(eventIDs))
-
-		if len(eventIDs) < reapBatchSize {
-			return total, nil
-		}
-	}
-}
-
-// deleteEvents hard-deletes the given events and, in foreign-key-safe
-// order before them, their delivery results and deliveries, then adds
-// what it deleted to the running totals. It runs on reapExpired's
-// transaction, so the totals change exactly when the rows do. Deletes
-// are unscoped so rows are physically removed rather than
-// soft-deleted, reclaiming disk.
-func deleteEvents(tx *gorm.DB, eventIDs []string) error {
-	// 1. The delivery results of the events' deliveries.
-	err := tx.Unscoped().
-		Where("delivery_id IN (?)", tx.Unscoped().Model(&Delivery{}).
-			Select("id").
-			Where("event_id IN ?", eventIDs)).
-		Delete(&DeliveryResult{}).Error
-	if err != nil {
-		return fmt.Errorf("deleting expired delivery results: %w", err)
-	}
-
-	// 2. The events' deliveries, after counting them, and the failed
-	// ones among them, per target. The status is tested in the select
-	// list rather than the WHERE clause: there, SQLite would read every
-	// failed delivery the webhook has through the status index,
-	// instead of only these through the event_id index.
-	var removed []TargetTotals
-
-	err = tx.Unscoped().Model(&Delivery{}).
-		Select("target_id, count(*) AS deliveries_removed, "+
-			"count(CASE WHEN status = ? THEN 1 END) AS failed_removed",
-			DeliveryStatusFailed).
-		Where("event_id IN ?", eventIDs).
-		Group("target_id").
-		Find(&removed).Error
-	if err != nil {
-		return fmt.Errorf("counting expired deliveries: %w", err)
-	}
-
-	err = tx.Unscoped().
-		Where("event_id IN ?", eventIDs).
-		Delete(&Delivery{}).Error
-	if err != nil {
-		return fmt.Errorf("deleting expired deliveries: %w", err)
-	}
-
-	// 3. The events themselves.
-	ev := tx.Unscoped().Where("id IN ?", eventIDs).Delete(&Event{})
-	if ev.Error != nil {
-		return fmt.Errorf("deleting expired events: %w", ev.Error)
-	}
-
-	for i := range removed {
-		err = AddTargetTotals(tx, removed[i])
+		removed, err = deleteExpired(tx, cutoff)
 		if err != nil {
 			return err
 		}
+
+		return AddTotals(tx, removed)
+	})
+	if err != nil {
+		return 0, err
 	}
 
-	return AddEventTotals(tx, EventTotals{EventsRemoved: ev.RowsAffected})
+	return removed.EventsRemoved, nil
+}
+
+// deleteExpired runs reapExpired's deletes and returns how many
+// events, deliveries and failed deliveries they removed.
+func deleteExpired(tx *gorm.DB, cutoff time.Time) (Totals, error) {
+	var removed Totals
+
+	// Fresh subqueries are built per statement to avoid reusing a
+	// mutated builder across executions.
+	expiredEventIDs := func() *gorm.DB {
+		return tx.Model(&Event{}).
+			Select("id").
+			Where("created_at < ?", cutoff)
+	}
+	expiredDeliveryIDs := func() *gorm.DB {
+		return tx.Model(&Delivery{}).
+			Select("id").
+			Where("event_id IN (?)", expiredEventIDs())
+	}
+
+	// 1. Delivery results whose delivery belongs to an expired event.
+	res := tx.Unscoped().
+		Where("delivery_id IN (?)", expiredDeliveryIDs()).
+		Delete(&DeliveryResult{})
+	if res.Error != nil {
+		return removed, fmt.Errorf(
+			"deleting expired delivery results: %w",
+			res.Error,
+		)
+	}
+
+	// 2. Deliveries belonging to an expired event, after counting the
+	// failed ones among them. The status is tested in the select list
+	// rather than the WHERE clause: there, SQLite would read every
+	// failed delivery the webhook has through the status index,
+	// instead of only the expired ones through the event_id index.
+	var failed struct{ Count int64 }
+
+	err := tx.Unscoped().Model(&Delivery{}).
+		Select("count(CASE WHEN status = ? THEN 1 END) AS count",
+			DeliveryStatusFailed).
+		Where("event_id IN (?)", expiredEventIDs()).
+		Take(&failed).Error
+	if err != nil {
+		return removed, fmt.Errorf(
+			"counting expired failed deliveries: %w", err,
+		)
+	}
+
+	del := tx.Unscoped().
+		Where("event_id IN (?)", expiredEventIDs()).
+		Delete(&Delivery{})
+	if del.Error != nil {
+		return removed, fmt.Errorf(
+			"deleting expired deliveries: %w",
+			del.Error,
+		)
+	}
+
+	// 3. The expired events themselves.
+	ev := tx.Unscoped().
+		Where("created_at < ?", cutoff).
+		Delete(&Event{})
+	if ev.Error != nil {
+		return removed, fmt.Errorf(
+			"deleting expired events: %w",
+			ev.Error,
+		)
+	}
+
+	removed.EventsRemoved = ev.RowsAffected
+	removed.DeliveriesRemoved = del.RowsAffected
+	removed.FailuresRemoved = failed.Count
+
+	return removed, nil
 }

internal/database/totals_test.go

@@ -2,7 +2,6 @@ package database_test
 
 import (
 	"context"
-	"net/http"
 	"testing"
 	"time"
 
@@ -13,12 +12,12 @@ import (
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// readEventTotals reads a webhook database's row of event totals,
+// readTotals reads a webhook database's row of running totals,
 // asserting that it has exactly one.
-func readEventTotals(t *testing.T, db *gorm.DB) database.EventTotals {
+func readTotals(t *testing.T, db *gorm.DB) database.Totals {
 	t.Helper()
 
-	var rows []database.EventTotals
+	var rows []database.Totals
 
 	require.NoError(t, db.Find(&rows).Error)
 	require.Len(t, rows, 1)
@@ -26,30 +25,10 @@ func readEventTotals(t *testing.T, db *gorm.DB) database.EventTotals {
 	return rows[0]
 }
 
-// readTargetTotals reads a webhook database's target totals, keyed by
-// target.
-func readTargetTotals(
-	t *testing.T, db *gorm.DB,
-) map[string]database.TargetTotals {
-	t.Helper()
-
-	var rows []database.TargetTotals
-
-	require.NoError(t, db.Find(&rows).Error)
-
-	byTarget := make(map[string]database.TargetTotals, len(rows))
-	for _, row := range rows {
-		byTarget[row.TargetID] = row
-	}
-
-	return byTarget
-}
-
-// TestWebhookDBManager_TotalsSurviveReopen verifies that a new event
-// database starts with one row of zero event totals and no target
-// totals, that adding to a target twice adds to the one row, and that
-// opening the database again keeps everything added.
-func TestWebhookDBManager_TotalsSurviveReopen(t *testing.T) {
+// TestWebhookDBManager_TotalsRowSurvivesReopen verifies that a new
+// event database starts with one row of zero totals, and that opening
+// it again keeps that row and what was added to it.
+func TestWebhookDBManager_TotalsRowSurvivesReopen(t *testing.T) {
 	t.Parallel()
 
 	mgr, lc := setupTestWebhookDBManager(t)
@@ -63,23 +42,11 @@ func TestWebhookDBManager_TotalsSurviveReopen(t *testing.T) {
 	db, err := mgr.GetDB(webhookID)
 	require.NoError(t, err)
 
-	fresh := readEventTotals(t, db)
-	assert.Equal(t, database.EventTotals{ID: fresh.ID}, fresh)
-	assert.Empty(t, readTargetTotals(t, db))
+	fresh := readTotals(t, db)
+	assert.Equal(t, database.Totals{ID: fresh.ID}, fresh)
 
-	first, second := uuid.New().String(), uuid.New().String()
-
-	require.NoError(t, database.AddEventTotals(db, database.EventTotals{
-		Events: 2,
-	}))
-	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
-		TargetID: first, Deliveries: 2, Delivered: 1,
-	}))
-	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
-		TargetID: first, Failed: 1,
-	}))
-	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
-		TargetID: second, Deliveries: 1,
+	require.NoError(t, database.AddTotals(db, database.Totals{
+		Events: 2, Deliveries: 3, Failures: 1,
 	}))
 
 	// Drop the cached connection so the next open reopens the file,
@@ -89,22 +56,16 @@ func TestWebhookDBManager_TotalsSurviveReopen(t *testing.T) {
 	db, err = mgr.GetDB(webhookID)
 	require.NoError(t, err)
 
-	assert.Equal(t, database.EventTotals{ID: fresh.ID, Events: 2},
-		readEventTotals(t, db))
-	assert.Equal(t, map[string]database.TargetTotals{
-		first: {
-			TargetID: first, Deliveries: 2, Delivered: 1, Failed: 1,
-		},
-		second: {TargetID: second, Deliveries: 1},
-	}, readTargetTotals(t, db))
+	assert.Equal(t, database.Totals{
+		ID: fresh.ID, Events: 2, Deliveries: 3, Failures: 1,
+	}, readTotals(t, db))
 }
 
-// TestRetentionReaper_PrunesMoreThanOneBatch verifies that a prune
-// larger than one transaction's batch removes every expired event with
-// its deliveries and delivery results, keeps the recent event, and
-// adds what it removed to the event and target totals, so the totals
+// TestRetentionReaper_AddsWhatItRemovesToTotals verifies that a sweep
+// leaves the lifetime totals alone and adds the events, deliveries and
+// failed deliveries it deletes to the removed totals, so the totals
 // within retention match the rows still stored.
-func TestRetentionReaper_PrunesMoreThanOneBatch(t *testing.T) {
+func TestRetentionReaper_AddsWhatItRemovesToTotals(t *testing.T) {
 	t.Parallel()
 
 	env := setupRetentionTest(t)
@@ -114,102 +75,52 @@ func TestRetentionReaper_PrunesMoreThanOneBatch(t *testing.T) {
 	db, err := env.mgr.GetDB(webhookID)
 	require.NoError(t, err)
 
-	// Every expired event has a delivered delivery to one target and a
-	// failed one to the other, each with one attempt.
-	expired := database.ExportReapBatchSize + 1
-	delivered, failed := uuid.New().String(), uuid.New().String()
-	old := time.Now().Add(-40 * 24 * time.Hour)
+	now := time.Now()
+	expired := now.Add(-40 * 24 * time.Hour)
 
-	events := make([]database.Event, expired)
-	deliveries := make([]database.Delivery, 0, 2*expired)
+	seedEventChain(t, db, webhookID, expired)
+	expiredFailure := seedEventChain(t, db, webhookID, expired)
+	recentFailure := seedEventChain(
+		t, db, webhookID, now.Add(-24*time.Hour),
+	)
 
-	for i := range events {
-		events[i] = database.Event{
-			WebhookID:    webhookID,
-			EntrypointID: uuid.New().String(),
-			Method:       http.MethodPost,
-		}
-		events[i].ID = uuid.New().String()
-		events[i].CreatedAt = old
-
-		deliveries = append(deliveries,
-			database.Delivery{
-				EventID:  events[i].ID,
-				TargetID: delivered,
-				Status:   database.DeliveryStatusDelivered,
-			},
-			database.Delivery{
-				EventID:  events[i].ID,
-				TargetID: failed,
-				Status:   database.DeliveryStatusFailed,
-			},
-		)
+	for _, id := range []string{
+		expiredFailure.deliveryID, recentFailure.deliveryID,
+	} {
+		require.NoError(t, db.Model(&database.Delivery{}).
+			Where("id = ?", id).
+			Update("status", database.DeliveryStatusFailed).Error)
 	}
 
-	require.NoError(t, db.CreateInBatches(events, 500).Error)
-	require.NoError(t, db.CreateInBatches(deliveries, 500).Error)
-
-	results := make([]database.DeliveryResult, len(deliveries))
-	for i := range deliveries {
-		results[i] = database.DeliveryResult{
-			DeliveryID: deliveries[i].ID, AttemptNum: 1,
-		}
-	}
-
-	require.NoError(t, db.CreateInBatches(results, 500).Error)
-
-	// One recent event, delivered to the first target.
-	recent := seedEventChain(t, db, webhookID, time.Now())
-	require.NoError(t, db.Model(&database.Delivery{}).
-		Where("id = ?", recent.deliveryID).
-		Update("target_id", delivered).Error)
-
 	// The totals storing those rows would have left.
-	n := int64(expired)
-	require.NoError(t, database.AddEventTotals(db, database.EventTotals{
-		Events: n + 1,
-	}))
-	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
-		TargetID: delivered, Deliveries: n + 1, Delivered: n + 1,
-	}))
-	require.NoError(t, database.AddTargetTotals(db, database.TargetTotals{
-		TargetID: failed, Deliveries: n, Failed: n,
+	require.NoError(t, database.AddTotals(db, database.Totals{
+		Events: 3, Deliveries: 3, Failures: 2,
 	}))
 
 	env.reaper.ExportSweep(context.Background())
 
-	// Only the recent event's rows are left.
-	for _, model := range []any{
-		&database.Event{}, &database.Delivery{}, &database.DeliveryResult{},
-	} {
-		var count int64
+	totals := readTotals(t, db)
+	assert.Equal(t, database.Totals{
+		ID:     totals.ID,
+		Events: 3, Deliveries: 3, Failures: 2,
+		EventsRemoved: 2, DeliveriesRemoved: 2, FailuresRemoved: 1,
+	}, totals)
 
-		require.NoError(t, db.Model(model).Count(&count).Error)
-		assert.Equal(t, int64(1), count, "%T rows left", model)
-	}
+	var events, deliveries, failures int64
 
-	assertChainPresent(t, db, recent)
+	require.NoError(t, db.Model(&database.Event{}).Count(&events).Error)
+	require.NoError(t, db.Model(&database.Delivery{}).
+		Count(&deliveries).Error)
+	require.NoError(t, db.Model(&database.Delivery{}).
+		Where("status = ?", database.DeliveryStatusFailed).
+		Count(&failures).Error)
 
-	eventTotals := readEventTotals(t, db)
-	assert.Equal(t, database.EventTotals{
-		ID: eventTotals.ID, Events: n + 1, EventsRemoved: n,
-	}, eventTotals)
-
-	targetTotals := readTargetTotals(t, db)
-	assert.Equal(t, map[string]database.TargetTotals{
-		delivered: {
-			TargetID: delivered, Deliveries: n + 1, Delivered: n + 1,
-			DeliveriesRemoved: n,
-		},
-		failed: {
-			TargetID: failed, Deliveries: n, Failed: n,
-			DeliveriesRemoved: n, FailedRemoved: n,
-		},
-	}, targetTotals)
+	assert.Equal(t, events, totals.EventsWithinRetention())
+	assert.Equal(t, deliveries, totals.DeliveriesWithinRetention())
+	assert.Equal(t, failures, totals.FailuresWithinRetention())
 
 	// A sweep with nothing left to remove changes nothing.
 	env.reaper.ExportSweep(context.Background())
 
-	assert.Equal(t, eventTotals, readEventTotals(t, db))
-	assert.Equal(t, targetTotals, readTargetTotals(t, db))
+	assert.Equal(t, totals, readTotals(t, db))
 }

internal/database/webhook_db_manager.go

@@ -36,7 +36,7 @@ var errInvalidCachedDBType = errors.New(
 // WebhookDBManager manages per-webhook SQLite database files
 // for event storage. Each webhook gets its own dedicated
 // database containing Events, Deliveries, DeliveryResults and the
-// running totals of them (EventTotals, TargetTotals).
+// running Totals of them.
 // Database connections are opened lazily and cached.
 type WebhookDBManager struct {
 	dataDir string
@@ -295,8 +295,7 @@ func (m *WebhookDBManager) openDB(
 
 	// Run migrations for event-tier models only
 	err = db.AutoMigrate(
-		&Event{}, &Delivery{}, &DeliveryResult{},
-		&EventTotals{}, &TargetTotals{},
+		&Event{}, &Delivery{}, &DeliveryResult{}, &Totals{},
 	)
 	if err != nil {
 		_ = sqlDB.Close()
@@ -307,14 +306,13 @@ func (m *WebhookDBManager) openDB(
 		)
 	}
 
-	// A new database gets its row of event totals, all zero. Target
-	// totals rows are created by the first delivery to each target.
-	err = db.FirstOrCreate(&EventTotals{}).Error
+	// A new database gets its row of running totals, all zero.
+	err = db.FirstOrCreate(&Totals{}).Error
 	if err != nil {
 		_ = sqlDB.Close()
 
 		return nil, fmt.Errorf(
-			"creating event totals for webhook database %s: %w",
+			"creating running totals for webhook database %s: %w",
 			webhookID, err,
 		)
 	}

internal/delivery/delivery_totals_test.go

@@ -11,41 +11,32 @@ import (
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
-// targetTotals reads one target's totals from a webhook database, all
-// zero when it has no row.
-func targetTotals(
-	t *testing.T, db *gorm.DB, targetID string,
-) database.TargetTotals {
+// failureTotal reads the running failure total of a webhook database.
+func failureTotal(t *testing.T, db *gorm.DB) int64 {
 	t.Helper()
 
-	var rows []database.TargetTotals
+	var totals database.Totals
 
-	require.NoError(t, db.Where("target_id = ?", targetID).
-		Find(&rows).Error)
+	require.NoError(t, db.Take(&totals).Error)
 
-	if len(rows) == 0 {
-		return database.TargetTotals{TargetID: targetID}
-	}
-
-	return rows[0]
+	return totals.Failures
 }
 
-// TestUpdateDeliveryStatus_FinishTimeAndTargetTotals pins what a status
+// TestUpdateDeliveryStatus_FinishTimeAndFailureTotal pins what a status
 // write records for the webhook page's statistics: the time a delivery
 // finished, set only when it becomes delivered or failed, and one more
-// on its target's delivered or failed total.
-func TestUpdateDeliveryStatus_FinishTimeAndTargetTotals(t *testing.T) {
+// on the failure total when it fails.
+func TestUpdateDeliveryStatus_FinishTimeAndFailureTotal(t *testing.T) {
 	t.Parallel()
 
 	tests := []struct {
-		status    database.DeliveryStatus
-		finished  bool
-		delivered int64
-		failed    int64
+		status   database.DeliveryStatus
+		finished bool
+		failures int64
 	}{
-		{database.DeliveryStatusRetrying, false, 0, 0},
-		{database.DeliveryStatusDelivered, true, 1, 0},
-		{database.DeliveryStatusFailed, true, 0, 1},
+		{database.DeliveryStatusRetrying, false, 0},
+		{database.DeliveryStatusDelivered, true, 0},
+		{database.DeliveryStatusFailed, true, 1},
 	}
 
 	for _, tt := range tests {
@@ -55,9 +46,8 @@ func TestUpdateDeliveryStatus_FinishTimeAndTargetTotals(t *testing.T) {
 			db := testWebhookDB(t)
 			e := testEngine(t, 1)
 			event := seedEvent(t, db, `{}`)
-			targetID := uuid.New().String()
 			d := seedDelivery(
-				t, db, event.ID, targetID,
+				t, db, event.ID, uuid.New().String(),
 				database.DeliveryStatusPending,
 			)
 
@@ -79,11 +69,7 @@ func TestUpdateDeliveryStatus_FinishTimeAndTargetTotals(t *testing.T) {
 				assert.Nil(t, stored.FinishedAt)
 			}
 
-			assert.Equal(t, database.TargetTotals{
-				TargetID:  targetID,
-				Delivered: tt.delivered,
-				Failed:    tt.failed,
-			}, targetTotals(t, db, targetID))
+			assert.Equal(t, tt.failures, failureTotal(t, db))
 		})
 	}
 }
@@ -98,9 +84,8 @@ func TestUpdateDeliveryStatus_DeletedDeliveryIsNotCounted(t *testing.T) {
 	db := testWebhookDB(t)
 	e := testEngine(t, 1)
 	event := seedEvent(t, db, `{}`)
-	targetID := uuid.New().String()
 	d := seedDelivery(
-		t, db, event.ID, targetID,
+		t, db, event.ID, uuid.New().String(),
 		database.DeliveryStatusRetrying,
 	)
 
@@ -111,6 +96,5 @@ func TestUpdateDeliveryStatus_DeletedDeliveryIsNotCounted(t *testing.T) {
 		db, &d, database.DeliveryStatusFailed,
 	))
 
-	assert.Equal(t, database.TargetTotals{TargetID: targetID},
-		targetTotals(t, db, targetID))
+	assert.Zero(t, failureTotal(t, db))
 }

internal/delivery/engine.go

@@ -1576,33 +1576,30 @@ func (e *Engine) updateDeliveryStatus(
 }
 
 // writeDeliveryStatus writes a delivery's new status. A delivery that
-// becomes delivered or failed also gets the time it finished, and is
-// added to its target's delivered or failed total. It is counted only
-// if the row was still there to update: retention may have deleted it
-// while the engine was working on it.
+// becomes delivered or failed also gets the time it finished, and a
+// failed one is added to the webhook's running failure total. The
+// failure is counted only if the row was still there to update:
+// retention may have deleted it while the engine was working on it.
 func writeDeliveryStatus(
 	tx *gorm.DB,
 	d *database.Delivery,
 	status database.DeliveryStatus,
 ) error {
-	if !status.Terminal() {
-		return tx.Model(d).Update("status", status).Error
+	columns := map[string]any{"status": status}
+	if status.Terminal() {
+		columns["finished_at"] = time.Now()
 	}
 
-	res := tx.Model(d).Updates(map[string]any{
-		"status":      status,
-		"finished_at": time.Now(),
-	})
-	if res.Error != nil || res.RowsAffected == 0 {
+	res := tx.Model(d).Updates(columns)
+	if res.Error != nil {
 		return res.Error
 	}
 
-	add := database.TargetTotals{TargetID: d.TargetID, Delivered: 1}
-	if status == database.DeliveryStatusFailed {
-		add = database.TargetTotals{TargetID: d.TargetID, Failed: 1}
+	if status == database.DeliveryStatusFailed && res.RowsAffected > 0 {
+		return database.AddTotals(tx, database.Totals{Failures: 1})
 	}
 
-	return database.AddTargetTotals(tx, add)
+	return nil
 }
 
 // settleStatus moves a delivery to its outcome status and reports a

internal/delivery/engine_test.go

@@ -57,10 +57,9 @@ func testWebhookDB(t *testing.T) *gorm.DB {
 		&database.Event{},
 		&database.Delivery{},
 		&database.DeliveryResult{},
-		&database.EventTotals{},
-		&database.TargetTotals{},
+		&database.Totals{},
 	))
-	require.NoError(t, db.Create(&database.EventTotals{}).Error)
+	require.NoError(t, db.Create(&database.Totals{}).Error)
 
 	return db
 }

internal/handlers/delivery_replay.go

@@ -300,8 +300,8 @@ func countInFlightDeliveries(
 }
 
 // createReplayDelivery writes the new pending delivery row, adds it to
-// its target's totals in the same transaction, and returns the task
-// that carries it to the delivery engine.
+// the webhook's running totals in the same transaction, and returns
+// the task that carries it to the delivery engine.
 //
 // The row is written with associations omitted, and neither Event nor
 // Target is populated on it: GORM's SaveBeforeAssociations would
@@ -326,9 +326,7 @@ func createReplayDelivery(
 			return err
 		}
 
-		return database.AddTargetTotals(tx, database.TargetTotals{
-			TargetID: dlv.TargetID, Deliveries: 1,
-		})
+		return database.AddTotals(tx, database.Totals{Deliveries: 1})
 	})
 	if err != nil {
 		return delivery.Task{}, err

internal/handlers/export_test.go

@@ -4,9 +4,7 @@ import (
 	"html/template"
 	"log/slog"
 	"net/http"
-	"time"
 
-	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
 )
 
@@ -86,14 +84,6 @@ func (s *Handlers) WebhookStatsForTest(webhookID string) *WebhookStats {
 	return s.loadWebhookStats(webhookID, entrypoints, targets)
 }
 
-// FinishedByTargetForTest exposes finishedByTarget for use in the
-// handlers_test package.
-func FinishedByTargetForTest(
-	webhookDB *gorm.DB, since time.Time,
-) ([]TargetFinished, error) {
-	return finishedByTarget(webhookDB, since)
-}
-
 // AddTemplateForTest registers a template under a page name so that
 // the handlers_test package can drive the render path with a
 // template of its own.

internal/handlers/webhook.go

@@ -297,7 +297,10 @@ func (h *Handlers) createAndFanOut(
 		return nil, nil, err
 	}
 
-	err = database.AddEventTotals(tx, database.EventTotals{Events: 1})
+	err = database.AddTotals(tx, database.Totals{
+		Events:     1,
+		Deliveries: int64(len(tasks)),
+	})
 	if err != nil {
 		tx.Rollback()
 
@@ -362,9 +365,8 @@ func (h *Handlers) finishWebhookResponse(
 }
 
 // buildDeliveryTasks creates one pending delivery per target in the
-// transaction, adds each to its target's totals, and returns the tasks
-// for the delivery engine. The caller owns the transaction and rolls
-// it back on error.
+// transaction and returns the tasks for the delivery engine. The
+// caller owns the transaction and rolls it back on error.
 func buildDeliveryTasks(
 	tx *gorm.DB,
 	event *database.Event,
@@ -388,13 +390,6 @@ func buildDeliveryTasks(
 			)
 		}
 
-		err = database.AddTargetTotals(tx, database.TargetTotals{
-			TargetID: targets[i].ID, Deliveries: 1,
-		})
-		if err != nil {
-			return nil, err
-		}
-
 		tasks = append(tasks, delivery.Task{
 			DeliveryID:   dlv.ID,
 			EventID:      event.ID,

internal/handlers/webhook_stats.go

@@ -26,10 +26,9 @@ type WebhookStats struct {
 	Targets           int
 	ActiveTargets     int
 
-	// Lifetime counts every event, delivery and failure the webhook
-	// has had, and WithinRetention those still stored.
-	Lifetime        Counts
-	WithinRetention Counts
+	// Totals holds the lifetime counts of events, deliveries and
+	// failures, and how many of each retention has removed.
+	Totals database.Totals
 
 	// InProgress counts the deliveries still pending or retrying.
 	InProgress int64
@@ -42,14 +41,6 @@ type WebhookStats struct {
 	Last24Hours   RecentWindow
 }
 
-// Counts holds a number of events, of deliveries and of failed
-// deliveries.
-type Counts struct {
-	Events     int64
-	Deliveries int64
-	Failures   int64
-}
-
 // RecentWindow holds what happened in one recent window: the events
 // received in it, and the deliveries that became delivered or failed in
 // it.
@@ -59,14 +50,6 @@ type RecentWindow struct {
 	Failed    int64
 }
 
-// TargetFinished is how many of one target's deliveries became
-// delivered, and how many failed, in a recent window.
-type TargetFinished struct {
-	TargetID  string
-	Delivered int64
-	Failed    int64
-}
-
 // FailurePercent is the share of the deliveries finished in the window
 // that failed, or a dash when none finished. Deliveries still pending
 // or retrying are not counted either way.
@@ -133,15 +116,14 @@ func (h *Handlers) loadWebhookStats(
 
 // readEventStats fills in the figures that come from the webhook's
 // event database. None of them reads every stored row: the totals are
-// one row for the events and one per target for the deliveries, and
-// every other figure is read from an index, over only the rows it
-// counts.
+// one row, and every other figure is read from an index, over only the
+// rows it counts.
 func readEventStats(
 	db *gorm.DB, now time.Time, stats *WebhookStats,
 ) error {
-	err := readTotals(db, stats)
+	err := db.Take(&stats.Totals).Error
 	if err != nil {
-		return err
+		return fmt.Errorf("reading running totals: %w", err)
 	}
 
 	err = db.Model(&database.Delivery{}).
@@ -182,36 +164,6 @@ func readEventStats(
 	return err
 }
 
-// readTotals fills in the lifetime and within-retention figures from
-// the running totals: the events' row, and the targets' rows summed.
-func readTotals(db *gorm.DB, stats *WebhookStats) error {
-	var events database.EventTotals
-
-	err := db.Take(&events).Error
-	if err != nil {
-		return fmt.Errorf("reading event totals: %w", err)
-	}
-
-	var targets []database.TargetTotals
-
-	err = db.Find(&targets).Error
-	if err != nil {
-		return fmt.Errorf("reading target totals: %w", err)
-	}
-
-	stats.Lifetime.Events = events.Events
-	stats.WithinRetention.Events = events.Events - events.EventsRemoved
-
-	for _, t := range targets {
-		stats.Lifetime.Deliveries += t.Deliveries
-		stats.Lifetime.Failures += t.Failed
-		stats.WithinRetention.Deliveries += t.Deliveries - t.DeliveriesRemoved
-		stats.WithinRetention.Failures += t.Failed - t.FailedRemoved
-	}
-
-	return nil
-}
-
 // readRecentWindow counts the events received, and the deliveries that
 // became delivered or failed, since the given time.
 func readRecentWindow(
@@ -226,46 +178,35 @@ func readRecentWindow(
 		return w, fmt.Errorf("counting recent events: %w", err)
 	}
 
-	byTarget, err := finishedByTarget(db, since)
+	w.Delivered, err = countFinishedSince(
+		db, database.DeliveryStatusDelivered, since,
+	)
 	if err != nil {
 		return w, err
 	}
 
-	for _, f := range byTarget {
-		w.Delivered += f.Delivered
-		w.Failed += f.Failed
-	}
+	w.Failed, err = countFinishedSince(
+		db, database.DeliveryStatusFailed, since,
+	)
 
-	return w, nil
+	return w, err
 }
 
-// finishedByTarget counts, for each target, the deliveries that became
-// delivered and those that failed since the given time, in one query
-// over just that window of the deliveries' status index. A target with
-// neither is left out.
-func finishedByTarget(
-	db *gorm.DB, since time.Time,
-) ([]TargetFinished, error) {
-	var byTarget []TargetFinished
+// countFinishedSince counts the deliveries that reached the given
+// final status since the given time.
+func countFinishedSince(
+	db *gorm.DB, status database.DeliveryStatus, since time.Time,
+) (int64, error) {
+	var n int64
 
 	err := db.Model(&database.Delivery{}).
-		Select("target_id, "+
-			"count(CASE WHEN status = ? THEN 1 END) AS delivered, "+
-			"count(CASE WHEN status = ? THEN 1 END) AS failed",
-			database.DeliveryStatusDelivered,
-			database.DeliveryStatusFailed).
-		Where("status IN ? AND finished_at >= ?",
-			[]database.DeliveryStatus{
-				database.DeliveryStatusDelivered,
-				database.DeliveryStatusFailed,
-			}, since).
-		Group("target_id").
-		Find(&byTarget).Error
+		Where("status = ? AND finished_at >= ?", status, since).
+		Count(&n).Error
 	if err != nil {
-		return nil, fmt.Errorf(
-			"counting deliveries finished by target: %w", err,
+		return 0, fmt.Errorf(
+			"counting deliveries %s recently: %w", status, err,
 		)
 	}
 
-	return byTarget, nil
+	return n, nil
 }

internal/handlers/webhook_stats_test.go

@@ -2,7 +2,6 @@ package handlers_test
 
 import (
 	"net/http"
-	"strings"
 	"testing"
 	"time"
 
@@ -36,10 +35,10 @@ func statsEntrypoint(
 	return ep.Path
 }
 
-// statsDelivery returns an event's delivery to a target.
+// statsDelivery returns the id of an event's delivery to a target.
 func statsDelivery(
 	t *testing.T, webhookDB *gorm.DB, eventID, targetID string,
-) database.Delivery {
+) string {
 	t.Helper()
 
 	var d database.Delivery
@@ -48,36 +47,31 @@ func statsDelivery(
 		"event_id = ? AND target_id = ?", eventID, targetID,
 	).First(&d).Error)
 
-	return d
+	return d.ID
 }
 
 // statsFinish settles a delivery as the delivery engine does: its
-// final status and the time it finished, and one more on its target's
-// delivered or failed total, in one transaction.
+// final status and the time it finished, and for a failure one more on
+// the webhook's failure total, in one transaction.
 func statsFinish(
 	t *testing.T,
 	webhookDB *gorm.DB,
-	d database.Delivery,
+	deliveryID string,
 	status database.DeliveryStatus,
 	at time.Time,
 ) {
 	t.Helper()
 
-	add := database.TargetTotals{TargetID: d.TargetID, Delivered: 1}
-	if status == database.DeliveryStatusFailed {
-		add = database.TargetTotals{TargetID: d.TargetID, Failed: 1}
-	}
-
 	require.NoError(t, webhookDB.Transaction(func(tx *gorm.DB) error {
 		err := tx.Model(&database.Delivery{}).
-			Where("id = ?", d.ID).
+			Where("id = ?", deliveryID).
 			Updates(map[string]any{"status": status, "finished_at": at}).
 			Error
-		if err != nil {
+		if err != nil || status != database.DeliveryStatusFailed {
 			return err
 		}
 
-		return database.AddTargetTotals(tx, add)
+		return database.AddTotals(tx, database.Totals{Failures: 1})
 	}))
 }
 
@@ -92,48 +86,21 @@ func statsAge(
 		Update("created_at", at).Error)
 }
 
-// statsTargetTotals reads a webhook database's target totals, keyed by
-// target.
-func statsTargetTotals(
-	t *testing.T, webhookDB *gorm.DB,
-) map[string]database.TargetTotals {
-	t.Helper()
-
-	var rows []database.TargetTotals
-
-	require.NoError(t, webhookDB.Find(&rows).Error)
-
-	byTarget := make(map[string]database.TargetTotals, len(rows))
-	for _, row := range rows {
-		byTarget[row.TargetID] = row
-	}
-
-	return byTarget
-}
-
-// statsHistory is the webhook seedStatsHistory builds: its event
-// database, its newest event, and its two active targets.
-type statsHistory struct {
-	webhook       *database.Webhook
-	webhookDB     *gorm.DB
-	newest        database.Event
-	first, second string
-}
-
 // seedStatsHistory builds the webhook the statistics test checks: one
 // day of retention, two entrypoints (one inactive) and three targets
 // (one inactive). Three events arrive through the receiver, and so
 // each has a delivery to the two active targets. The oldest event is
 // past retention, the middle one six hours old, the newest just in.
 // Their deliveries are settled as the delivery engine would, and a
-// replay adds a pending delivery to the oldest event.
+// replay adds a pending delivery to the oldest event. It returns the
+// webhook, its event database and the newest event.
 func seedStatsHistory(
 	t *testing.T,
 	h *handlers.Handlers,
 	sess *session.Session,
 	db *database.Database,
 	dbMgr *database.WebhookDBManager,
-) statsHistory {
+) (*database.Webhook, *gorm.DB, database.Event) {
 	t.Helper()
 
 	wh := &database.Webhook{
@@ -188,15 +155,9 @@ func seedStatsHistory(
 		database.DeliveryStatusDelivered, now.Add(-2*time.Minute))
 
 	require.Equal(t, http.StatusSeeOther,
-		postReplay(t, h, sess, wh.ID, oldestFailure.ID).Code)
+		postReplay(t, h, sess, wh.ID, oldestFailure).Code)
 
-	return statsHistory{
-		webhook:   wh,
-		webhookDB: webhookDB,
-		newest:    newest,
-		first:     first.ID,
-		second:    second.ID,
-	}
+	return wh, webhookDB, newest
 }
 
 // statsPrune runs the real retention reaper until it has removed one
@@ -223,7 +184,7 @@ func statsPrune(
 	lc.RequireStart()
 
 	require.Eventually(t, func() bool {
-		var totals database.EventTotals
+		var totals database.Totals
 
 		err := webhookDB.Take(&totals).Error
 
@@ -233,23 +194,31 @@ func statsPrune(
 	lc.RequireStop()
 }
 
-// statsPane returns the statistics pane from a rendered webhook page:
-// everything from its heading to the next heading on the page.
-func statsPane(t *testing.T, page string) string {
+// assertStatsTotals checks the lifetime events, deliveries and
+// failures, and those within retention.
+func assertStatsTotals(
+	t *testing.T, totals database.Totals, lifetime, within [3]int64,
+) {
 	t.Helper()
 
-	_, pane, found := strings.Cut(page, ">Statistics</h2>")
-	require.True(t, found, "the page has no statistics pane")
+	gotLifetime := [3]int64{
+		totals.Events, totals.Deliveries, totals.Failures,
+	}
+	gotWithin := [3]int64{
+		totals.EventsWithinRetention(),
+		totals.DeliveriesWithinRetention(),
+		totals.FailuresWithinRetention(),
+	}
 
-	pane, _, _ = strings.Cut(pane, "<h2")
-
-	return pane
+	assert.Equal(t, lifetime, gotLifetime,
+		"lifetime events, deliveries, failures")
+	assert.Equal(t, within, gotWithin,
+		"events, deliveries, failures within retention")
 }
 
 // TestWebhookStats_EveryFigureAcrossRetentionPrune checks every figure
 // the statistics pane shows for the history seedStatsHistory builds,
-// and each target's totals and recent figures, before and after the
-// real retention reaper removes the oldest event.
+// before and after the real retention reaper removes the oldest event.
 func TestWebhookStats_EveryFigureAcrossRetentionPrune(t *testing.T) {
 	t.Parallel()
 
@@ -266,22 +235,19 @@ func TestWebhookStats_EveryFigureAcrossRetentionPrune(t *testing.T) {
 
 	t.Cleanup(app.RequireStop)
 
-	hist := seedStatsHistory(t, h, sess, db, dbMgr)
-	first, second := hist.first, hist.second
+	wh, webhookDB, newest := seedStatsHistory(t, h, sess, db, dbMgr)
 
-	stats := h.WebhookStatsForTest(hist.webhook.ID)
+	stats := h.WebhookStatsForTest(wh.ID)
 	require.NotNil(t, stats)
 
 	assert.Equal(t, 2, stats.Entrypoints)
 	assert.Equal(t, 1, stats.ActiveEntrypoints)
 	assert.Equal(t, 3, stats.Targets)
 	assert.Equal(t, 2, stats.ActiveTargets)
-	assert.Equal(t, handlers.Counts{Events: 3, Deliveries: 7, Failures: 3},
-		stats.Lifetime)
-	assert.Equal(t, stats.Lifetime, stats.WithinRetention)
+	assertStatsTotals(t, stats.Totals, [3]int64{3, 7, 3}, [3]int64{3, 7, 3})
 	assert.Equal(t, int64(2), stats.InProgress)
 	require.NotNil(t, stats.LastEventAt)
-	assert.True(t, hist.newest.CreatedAt.Equal(*stats.LastEventAt))
+	assert.True(t, newest.CreatedAt.Equal(*stats.LastEventAt))
 	assert.Equal(t, handlers.RecentWindow{
 		Events: 1, Delivered: 1, Failed: 1,
 	}, stats.Last10Minutes)
@@ -291,95 +257,24 @@ func TestWebhookStats_EveryFigureAcrossRetentionPrune(t *testing.T) {
 	assert.Equal(t, "50.0%", stats.Last10Minutes.FailurePercent())
 	assert.Equal(t, "66.7%", stats.Last24Hours.FailurePercent())
 
-	// The first target has three deliveries and the replay, the second
-	// three; the inactive target has none and so no row.
-	assert.Equal(t, map[string]database.TargetTotals{
-		first: {TargetID: first, Deliveries: 4, Delivered: 1, Failed: 2},
-		second: {
-			TargetID: second, Deliveries: 3, Delivered: 1, Failed: 1,
-		},
-	}, statsTargetTotals(t, hist.webhookDB))
+	// Retention removes the oldest event with its three deliveries,
+	// one of them failed and one the pending replay.
+	statsPrune(t, db, dbMgr, log, webhookDB)
 
-	lastDay, err := handlers.FinishedByTargetForTest(
-		hist.webhookDB, time.Now().Add(-24*time.Hour),
-	)
-	require.NoError(t, err)
-	assert.ElementsMatch(t, []handlers.TargetFinished{
-		{TargetID: first, Delivered: 1, Failed: 1},
-		{TargetID: second, Failed: 1},
-	}, lastDay)
-
-	// Retention removes the oldest event with its three deliveries:
-	// the first target's failed one and the pending replay, and the
-	// second target's delivered one.
-	statsPrune(t, db, dbMgr, log, hist.webhookDB)
-
-	after := h.WebhookStatsForTest(hist.webhook.ID)
+	after := h.WebhookStatsForTest(wh.ID)
 	require.NotNil(t, after)
 
-	assert.Equal(t, stats.Lifetime, after.Lifetime)
-	assert.Equal(t, handlers.Counts{Events: 2, Deliveries: 4, Failures: 2},
-		after.WithinRetention)
+	assertStatsTotals(t, after.Totals, [3]int64{3, 7, 3}, [3]int64{2, 4, 2})
 	assert.Equal(t, int64(1), after.InProgress)
 	assert.Equal(t, stats.LastEventAt, after.LastEventAt)
 	assert.Equal(t, stats.Last10Minutes, after.Last10Minutes)
 	assert.Equal(t, stats.Last24Hours, after.Last24Hours)
 
-	assert.Equal(t, map[string]database.TargetTotals{
-		first: {
-			TargetID: first, Deliveries: 4, Delivered: 1, Failed: 2,
-			DeliveriesRemoved: 2, FailedRemoved: 1,
-		},
-		second: {
-			TargetID: second, Deliveries: 3, Delivered: 1, Failed: 1,
-			DeliveriesRemoved: 1,
-		},
-	}, statsTargetTotals(t, hist.webhookDB))
-
-	pane := statsPane(t, renderSourceDetailPage(t, h, sess, hist.webhook.ID))
-	assert.Contains(t, pane, "Within retention")
-	assert.Contains(t, pane, "50.0%")
-	assert.Contains(t, pane, "66.7%")
-}
-
-// TestWebhookStats_PaneShowsRetentionPeriod checks that the statistics
-// pane itself, not only the line at the foot of the page, shows the
-// webhook's retention period, for a finite one and for forever.
-func TestWebhookStats_PaneShowsRetentionPeriod(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h    *handlers.Handlers
-		sess *session.Session
-		db   *database.Database
-	)
-
-	app := newTestApp(t, &h, &sess, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	tests := []struct {
-		retentionDays int
-		want          string
-	}{
-		{30, "30 days"},
-		{database.RetentionForeverDays, "forever"},
-	}
-
-	for _, tt := range tests {
-		wh := &database.Webhook{
-			UserID:        deleteTestUserID,
-			Name:          "retention",
-			RetentionDays: tt.retentionDays,
-		}
-		require.NoError(t,
-			db.DB().Omit(clause.Associations).Create(wh).Error)
-
-		pane := statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
-		assert.Contains(t, pane, "Retention", tt.want)
-		assert.Contains(t, pane, tt.want)
-	}
+	body := renderSourceDetailPage(t, h, sess, wh.ID)
+	assert.Contains(t, body, "Statistics")
+	assert.Contains(t, body, "Within retention")
+	assert.Contains(t, body, "50.0%")
+	assert.Contains(t, body, "66.7%")
 }
 
 // TestWebhookStats_WebhookWithNoEvents covers a webhook whose event
@@ -406,7 +301,8 @@ func TestWebhookStats_WebhookWithNoEvents(t *testing.T) {
 	assert.Equal(t, &handlers.WebhookStats{}, h.WebhookStatsForTest(wh.ID))
 	assert.Equal(t, "—", handlers.RecentWindow{}.FailurePercent())
 
-	statsPane(t, renderSourceDetailPage(t, h, sess, wh.ID))
+	body := renderSourceDetailPage(t, h, sess, wh.ID)
+	assert.Contains(t, body, "Statistics")
 	assert.False(t, dbMgr.DBExists(wh.ID))
 }
 

internal/server/static_assets_test.go

@@ -13,9 +13,9 @@ import (
 
 // TestBaseTemplateScriptsAreServed walks every /s/ script the base
 // template loads on each page and fetches it through the real router.
-// Alpine.js is extracted from its tarball in 3p/ at build time, so the
-// file is not in the tree: this is the check that the page still gets
-// the JavaScript it asks for.
+// Alpine.js is fetched at build time rather than committed, so nothing
+// in the repo guarantees it is present: this is the check that the page
+// still gets the JavaScript it asks for.
 func TestBaseTemplateScriptsAreServed(t *testing.T) {
 	t.Parallel()
 

script/assets

@@ -1,16 +0,0 @@
-#!/bin/sh
-# script/assets: extract Alpine.js from its npm package tarball, committed
-# in 3p/, to static/js/alpine.min.js, where go:embed reads it. The
-# extracted file is not committed. script/test, make build and make dev run
-# this first.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-main() {
-    cd "$ROOT"
-    tar -xzOf 3p/alpinejs-3.14.9.tgz package/dist/cdn.min.js \
-        >static/js/alpine.min.js
-}
-
-main "$@"

script/bootstrap

@@ -4,7 +4,9 @@
 # installed tools are skipped. Base tooling comes from nix, apt, brew,
 # or apk (detected in that order); assumes NOTHING is present (not git,
 # make, or go). golangci-lint is deliberately not installed: linting runs
-# only in docker, via script/lint and Dockerfile.lint.
+# only in docker, via script/lint and Dockerfile.lint. Finishes by running
+# script/fetch-assets, which installs the hash-pinned third-party browser
+# assets the repo does not commit.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -67,6 +69,11 @@ main() {
 
     go mod download
 
+    # Third-party browser assets are not committed; fetch and verify them
+    # so a fresh clone can build and test.
+    if missing curl; then pkg_install curl curl curl curl; fi
+    "$ROOT/script/fetch-assets"
+
     echo "bootstrap complete"
 }
 

script/check

@@ -1,7 +1,6 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all.
-# Writes only the ignored static/js/alpine.min.js, through script/test.
+# extension to scripts-to-rule-them-all. Must not modify any files.
 # Generic: usually needs no adaptation.
 set -eu
 

script/fetch-assets

@@ -0,0 +1,104 @@
+#!/bin/sh
+# script/fetch-assets: download the third-party browser assets the web UI
+# ships and install them under static/. Minified bundles are not committed
+# (REPO_POLICIES.md: no build artifacts in version control), so the build
+# fetches them here. Every download is verified against a hardcoded sha256
+# before it is installed, and any mismatch aborts. Idempotent: an asset
+# already present with its pinned hash is left alone.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+# The sha256 of each installed asset lives in static/vendor.sha256, in
+# sha256sum(1) format, with paths relative to static/. That file is the
+# single source of truth: this script verifies against it, and
+# static/vendor_test.go asserts the bytes embedded into the binary match
+# it, so the hash cannot rot into a value nothing checks.
+MANIFEST="static/vendor.sha256"
+
+# Alpine.js 3.14.9, 2026-08-17. Fetched from registry.npmjs.org, the
+# publisher of record; the jsDelivr and unpkg copies are mirrors of this
+# same tarball. dist/cdn.min.js is the browser build Alpine publishes for
+# a <script> tag.
+ALPINE_VERSION="3.14.9"
+ALPINE_URL="https://registry.npmjs.org/alpinejs/-/alpinejs-${ALPINE_VERSION}.tgz"
+# sha256 of alpinejs-3.14.9.tgz
+ALPINE_TARBALL_SHA256="97dad7c0c81e659cfc8e7700055da9770f8186187cb9a8a76efb57e00d5ce52a"
+ALPINE_MEMBER="package/dist/cdn.min.js"
+ALPINE_DEST="js/alpine.min.js"
+
+sha256_of() {
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum "$1" | cut -d' ' -f1
+    else
+        shasum -a 256 "$1" | cut -d' ' -f1
+    fi
+}
+
+# expected_sha256 <path-relative-to-static>
+expected_sha256() {
+    awk -v want="$1" '$2 == want { print $1; found = 1 }
+        END { if (!found) exit 1 }' "$ROOT/$MANIFEST"
+}
+
+# verify <file> <expected-sha256> <what>
+verify() {
+    actual="$(sha256_of "$1")"
+    if [ "$actual" != "$2" ]; then
+        echo "fetch-assets: sha256 mismatch for $3" >&2
+        echo "  expected: $2" >&2
+        echo "  actual:   $actual" >&2
+        exit 1
+    fi
+}
+
+# up_to_date <path-relative-to-static> <expected-sha256>
+up_to_date() {
+    [ -f "$ROOT/static/$1" ] || return 1
+    [ "$(sha256_of "$ROOT/static/$1")" = "$2" ]
+}
+
+fetch_alpine() {
+    want="$(expected_sha256 "$ALPINE_DEST")"
+
+    if up_to_date "$ALPINE_DEST" "$want"; then
+        echo "fetch-assets: static/$ALPINE_DEST already at $want"
+        return 0
+    fi
+
+    echo "fetch-assets: fetching Alpine.js $ALPINE_VERSION from $ALPINE_URL"
+    tmp="$(mktemp -d)"
+    trap 'rm -rf "$tmp"' EXIT INT TERM
+    curl -fsSL -o "$tmp/alpine.tgz" "$ALPINE_URL"
+    verify "$tmp/alpine.tgz" "$ALPINE_TARBALL_SHA256" "alpinejs-${ALPINE_VERSION}.tgz"
+    tar -xzOf "$tmp/alpine.tgz" "$ALPINE_MEMBER" >"$tmp/alpine.min.js"
+    verify "$tmp/alpine.min.js" "$want" "$ALPINE_MEMBER from alpinejs-${ALPINE_VERSION}.tgz"
+
+    mkdir -p "$(dirname "$ROOT/static/$ALPINE_DEST")"
+    cp "$tmp/alpine.min.js" "$ROOT/static/$ALPINE_DEST"
+    rm -rf "$tmp"
+    trap - EXIT INT TERM
+    echo "fetch-assets: installed static/$ALPINE_DEST ($want)"
+}
+
+# Re-check every manifest entry against what is now on disk, so an entry
+# no script installs fails loudly instead of passing silently.
+verify_manifest() {
+    while read -r want path; do
+        case "$want" in '' | '#'*) continue ;; esac
+        if [ ! -f "$ROOT/static/$path" ]; then
+            echo "fetch-assets: $MANIFEST lists static/$path, which is missing" >&2
+            exit 1
+        fi
+        verify "$ROOT/static/$path" "$want" "static/$path"
+    done <"$ROOT/$MANIFEST"
+}
+
+main() {
+    cd "$ROOT"
+    fetch_alpine
+    verify_manifest
+    echo "fetch-assets: all assets in $MANIFEST verified"
+}
+
+main "$@"

script/test

@@ -28,7 +28,6 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    "$ROOT/script/assets"
     go test -v -race -timeout 90s ./...
 }
 

static/vendor.sha256

@@ -0,0 +1 @@
+3ed1eed252488921df65e363d6715deb04d7f92aaedb9e52199fdf73cb1e0ad3  js/alpine.min.js

static/vendor_test.go

@@ -0,0 +1,92 @@
+package static_test
+
+import (
+	"bufio"
+	"crypto/sha256"
+	"encoding/hex"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"sneak.berlin/go/webhooker/static"
+)
+
+const manifestPath = "vendor.sha256"
+
+// fetchHint is appended to every failure here: the assets the manifest
+// covers are fetched by the build, not committed, so a fresh clone that
+// has not run script/fetch-assets fails this test and should be told why.
+const fetchHint = "run `script/fetch-assets` (or `make assets`) to install " +
+	"the pinned third-party assets"
+
+// TestVendoredAssetsMatchManifest asserts that every asset listed in
+// static/vendor.sha256 is embedded in the binary with exactly the pinned
+// bytes. script/fetch-assets verifies the same hashes at download time;
+// this test verifies them again on what actually ships, so a build that
+// skipped, cached, or subverted the fetch cannot produce a binary serving
+// unpinned third-party JavaScript.
+func TestVendoredAssetsMatchManifest(t *testing.T) {
+	t.Parallel()
+
+	entries := readManifest(t)
+	require.NotEmpty(t, entries, "%s lists no assets", manifestPath)
+
+	for path, want := range entries {
+		t.Run(path, func(t *testing.T) {
+			t.Parallel()
+
+			data, err := static.Static.ReadFile(path)
+			require.NoErrorf(
+				t, err,
+				"%s is listed in %s but is not embedded; %s",
+				path, manifestPath, fetchHint,
+			)
+
+			sum := sha256.Sum256(data)
+			got := hex.EncodeToString(sum[:])
+			require.Equalf(
+				t, want, got,
+				"embedded %s does not match its pinned sha256 in %s; %s",
+				path, manifestPath, fetchHint,
+			)
+		})
+	}
+}
+
+// readManifest parses static/vendor.sha256, which is in sha256sum(1)
+// format with paths relative to static/.
+func readManifest(t *testing.T) map[string]string {
+	t.Helper()
+
+	f, err := os.Open(manifestPath)
+	require.NoError(t, err, "opening %s", manifestPath)
+
+	defer func() { require.NoError(t, f.Close()) }()
+
+	entries := make(map[string]string)
+	scanner := bufio.NewScanner(f)
+
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if line == "" || strings.HasPrefix(line, "#") {
+			continue
+		}
+
+		fields := strings.Fields(line)
+		require.Lenf(
+			t, fields, 2,
+			"%s: malformed entry %q, want \"<sha256>  <path>\"",
+			manifestPath, line,
+		)
+
+		sum, path := fields[0], fields[1]
+		require.Lenf(t, sum, 64, "%s: %q is not a sha256", manifestPath, sum)
+		entries[path] = sum
+	}
+
+	require.NoError(t, scanner.Err(), "reading %s", manifestPath)
+
+	return entries
+}

templates/webhook_stats.html

@@ -30,59 +30,53 @@
         </div>
     </div>
     <div class="p-4 grid grid-cols-1 lg:grid-cols-2 gap-6 text-sm">
-        <table class="w-full text-center text-gray-900">
-            <thead>
-                <tr class="border-b border-gray-200 text-xs text-gray-500 uppercase tracking-wide">
-                    <th></th>
-                    <th class="py-2 font-medium">Lifetime</th>
-                    <th class="py-2 font-medium">Within retention</th>
-                </tr>
-            </thead>
-            <tbody>
-                <tr>
-                    <td class="py-2 text-left text-gray-600">Events</td>
-                    <td class="py-2">{{.Lifetime.Events}}</td>
-                    <td class="py-2">{{.WithinRetention.Events}}</td>
-                </tr>
-                <tr>
-                    <td class="py-2 text-left text-gray-600">Deliveries</td>
-                    <td class="py-2">{{.Lifetime.Deliveries}}</td>
-                    <td class="py-2">{{.WithinRetention.Deliveries}}</td>
-                </tr>
-                <tr>
-                    <td class="py-2 text-left text-gray-600">Failures</td>
-                    <td class="py-2">{{.Lifetime.Failures}}</td>
-                    <td class="py-2">{{.WithinRetention.Failures}}</td>
-                </tr>
-            </tbody>
-        </table>
         <div>
-            <table class="w-full text-center text-gray-900">
-                <thead>
-                    <tr class="border-b border-gray-200 text-xs text-gray-500 uppercase tracking-wide">
-                        <th></th>
-                        <th class="py-2 font-medium">Last 10 minutes</th>
-                        <th class="py-2 font-medium">Last 24 hours</th>
-                    </tr>
-                </thead>
-                <tbody>
-                    <tr>
-                        <td class="py-2 text-left text-gray-600">Events</td>
-                        <td class="py-2">{{.Last10Minutes.Events}}</td>
-                        <td class="py-2">{{.Last24Hours.Events}}</td>
-                    </tr>
-                    <tr>
-                        <td class="py-2 text-left text-gray-600">Failures</td>
-                        <td class="py-2">{{.Last10Minutes.Failed}}</td>
-                        <td class="py-2">{{.Last24Hours.Failed}}</td>
-                    </tr>
-                    <tr>
-                        <td class="py-2 text-left text-gray-600">Failure percentage</td>
-                        <td class="py-2">{{.Last10Minutes.FailurePercent}}</td>
-                        <td class="py-2">{{.Last24Hours.FailurePercent}}</td>
-                    </tr>
-                </tbody>
-            </table>
+            <div class="flex py-2 border-b border-gray-200 text-xs text-gray-500 uppercase tracking-wide">
+                <span class="flex-1"></span>
+                <span class="w-32 text-center">Lifetime</span>
+                <span class="w-32 text-center">Within retention</span>
+            </div>
+            <div class="divide-y divide-gray-100">
+                <div class="flex py-2">
+                    <span class="flex-1 text-gray-600">Events</span>
+                    <span class="w-32 text-center text-gray-900">{{.Totals.Events}}</span>
+                    <span class="w-32 text-center text-gray-900">{{.Totals.EventsWithinRetention}}</span>
+                </div>
+                <div class="flex py-2">
+                    <span class="flex-1 text-gray-600">Deliveries</span>
+                    <span class="w-32 text-center text-gray-900">{{.Totals.Deliveries}}</span>
+                    <span class="w-32 text-center text-gray-900">{{.Totals.DeliveriesWithinRetention}}</span>
+                </div>
+                <div class="flex py-2">
+                    <span class="flex-1 text-gray-600">Failures</span>
+                    <span class="w-32 text-center text-gray-900">{{.Totals.Failures}}</span>
+                    <span class="w-32 text-center text-gray-900">{{.Totals.FailuresWithinRetention}}</span>
+                </div>
+            </div>
+        </div>
+        <div>
+            <div class="flex py-2 border-b border-gray-200 text-xs text-gray-500 uppercase tracking-wide">
+                <span class="flex-1"></span>
+                <span class="w-32 text-center">Last 10 minutes</span>
+                <span class="w-32 text-center">Last 24 hours</span>
+            </div>
+            <div class="divide-y divide-gray-100">
+                <div class="flex py-2">
+                    <span class="flex-1 text-gray-600">Events</span>
+                    <span class="w-32 text-center text-gray-900">{{.Last10Minutes.Events}}</span>
+                    <span class="w-32 text-center text-gray-900">{{.Last24Hours.Events}}</span>
+                </div>
+                <div class="flex py-2">
+                    <span class="flex-1 text-gray-600">Failures</span>
+                    <span class="w-32 text-center text-gray-900">{{.Last10Minutes.Failed}}</span>
+                    <span class="w-32 text-center text-gray-900">{{.Last24Hours.Failed}}</span>
+                </div>
+                <div class="flex py-2">
+                    <span class="flex-1 text-gray-600">Failure percentage</span>
+                    <span class="w-32 text-center text-gray-900">{{.Last10Minutes.FailurePercent}}</span>
+                    <span class="w-32 text-center text-gray-900">{{.Last24Hours.FailurePercent}}</span>
+                </div>
+            </div>
             <p class="mt-2 text-xs text-gray-500">Failure percentage is the failed deliveries out of all deliveries that finished in the window. Deliveries still pending or retrying are not counted.</p>
         </div>
     </div>