dashboard-blipburst 0.1.0 → 0.2.4

package/README.md

@@ -26,6 +26,23 @@ Override the preferred port with `--port` / `-p`, or the `BLIPBURST_DASHBOARD_PO
 blipburst-dashboard --port 5000
 ```
 
+### Hosted environments
+
+Locally, the SDK-side adapter finds the dashboard automatically via the `.blipburst/port` file written to the current directory — that only works because both processes share a filesystem. In a hosted setup (the dashboard deployed somewhere, the BlipBurst-instrumented app deployed somewhere else), there's no shared file, so use env vars on both sides instead:
+
+**On the dashboard's deployment**, set `PORT` (the convention Render/Railway/Fly/Heroku-style platforms already inject) or `BLIPBURST_DASHBOARD_PORT`. Either one makes the server bind exactly there and **fail loudly instead of silently drifting to another port** on conflict — unlike a bare local run, which auto-increments for dev convenience, a hosted deployment can only be reached on the port its platform is routing to, so drifting silently would just make it unreachable:
+
+```bash
+# most hosting platforms set PORT for you automatically — nothing else needed
+blipburst-dashboard
+```
+
+**On the app reporting events**, set `BLIPBURST_DASHBOARD_URL` to the dashboard's public URL — every adapter function (`toDashboardTransport`, `toDashboardWebhookUrl`, `wrapForDashboard`) picks it up automatically, no code change needed:
+
+```bash
+BLIPBURST_DASHBOARD_URL=https://blipburst-dashboard.internal.example.com node server.js
+```
+
 ## Wire it up to BlipBurst
 
 No changes to `blipburst` itself are needed — everything below plugs into config options `blipburst` already supports.
@@ -78,6 +95,10 @@ await sim.makeRequest(); // now tracked whether or not a fault fired
 
 This also unlocks exact MTTR (measured time from a failed call to the next success on that endpoint) instead of the log-only estimate (duration of consecutive fault bursts).
 
+### A quiet dashboard in production is expected, not broken
+
+BlipBurst's `enabled: false` option (or `BLIPBURST_ENABLED=false`) is a global kill switch — when it's off, no faults ever fire, so nothing reaches any of the ingest endpoints above regardless of how the transport/webhook/wrapper is wired. If you point the dashboard at a production deployment that correctly disables chaos there, an empty live feed and heatmap is the dashboard working correctly, not a wiring bug. Point it at a dev/staging deployment (where chaos is actually enabled) to see live data.
+
 ## What the dashboard shows
 
 - **Live fault feed** — streamed over SSE as `fault.injected` / `request.failed` events arrive.
@@ -85,7 +106,14 @@ This also unlocks exact MTTR (measured time from a failed call to the next succe
 - **MTTR per fault type** — mean time from a fault firing to recovery, per `Fault['kind']`.
 - **Experiment run history** — events grouped by run (one per adapter instance / process), with start/end time, event and failure counts, and a fault-kind breakdown.
 
-History persists to `.blipburst/events.jsonl` in the dashboard's working directory across restarts.
+## Data retention
+
+Two different things are kept, on purpose, with different lifetimes:
+
+- **Raw event log** (`.blipburst/events.jsonl`) — the last 5,000 events, in memory and on disk. This backs the live feed / `/api/events`. It's a rolling window: once it fills up, older raw events are dropped to keep disk and memory use bounded, whether the dashboard runs for an hour or a month.
+- **Aggregates** (`.blipburst/aggregates.json`) — per-endpoint heatmap totals, per-fault-kind MTTR running averages, and per-run summaries. These are updated incrementally on every event and never pruned, so the heatmap, MTTR, and run history stay accurate for the dashboard's entire lifetime even after the raw log has rolled over many times. This file stays small (a few KB) regardless of how much raw traffic has passed through.
+
+In the browser, the dashboard also caches recent events in IndexedDB (capped at 2,000 rows, oldest pruned first) so a page reload repaints instantly from local cache and only delta-fetches what's new from the server, instead of re-downloading the full recent-events window every time.
 
 ## HTTP API
 

package/bin/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { startDashboardServer } from '../src/server.js';
-import { DEFAULT_PORT } from '../src/port.js';
+import { DEFAULT_PORT, explicitPortFromEnv } from '../src/port.js';
 
 function parseArgs(argv) {
   const out = { port: undefined };
@@ -16,18 +16,30 @@ function parseArgs(argv) {
 }
 
 async function main() {
-  const { port } = parseArgs(process.argv.slice(2));
-  const preferredPort = Number.isFinite(port) ? port : DEFAULT_PORT;
+  const { port: cliPort } = parseArgs(process.argv.slice(2));
+  // --port wins, then BLIPBURST_DASHBOARD_PORT / the hosting-platform-standard
+  // PORT (Render/Railway/Fly/Heroku all inject this). Any of these being set
+  // means something upstream expects this exact port — a hosted deployment
+  // routes traffic there and nowhere else — so silently drifting to another
+  // port on conflict would make the deployment unreachable. Bare local runs
+  // with nothing set get the old convenience behavior: auto-increment.
+  const explicitPort = Number.isFinite(cliPort) ? cliPort : explicitPortFromEnv();
+  const preferredPort = explicitPort ?? DEFAULT_PORT;
+  const maxPortAttempts = explicitPort ? 0 : 20;
 
-  const { port: resolvedPort } = await startDashboardServer({ port: preferredPort });
+  const { port: resolvedPort, store } = await startDashboardServer({ port: preferredPort, maxPortAttempts });
 
   console.log(`BlipBurst dashboard running at http://localhost:${resolvedPort}`);
   if (resolvedPort !== preferredPort) {
     console.log(`(port ${preferredPort} was in use — auto-selected ${resolvedPort})`);
   }
   console.log(`Port written to .blipburst/port — point BlipBurst's logger/webhook adapter at it automatically.`);
+  console.log(`Hosted setup: set BLIPBURST_DASHBOARD_URL on the reporting app's environment to point it at this dashboard's public URL instead of relying on .blipburst/port.`);
 
-  const shutdown = () => process.exit(0);
+  const shutdown = () => {
+    store.flushNow(); // persist the last few seconds of heatmap/MTTR/run aggregates before exiting
+    process.exit(0);
+  };
   process.on('SIGINT', shutdown);
   process.on('SIGTERM', shutdown);
 }

package/index.d.ts

@@ -23,7 +23,11 @@ export interface BlipBurstLike {
 export interface DashboardAdapterOptions {
   /** Group events from this call under a specific run id instead of a freshly generated one. */
   runId?: string;
-  /** Dashboard port override; otherwise read from `.blipburst/port` or defaults to 4477. */
+  /**
+   * Dashboard port override for the local `http://localhost:<port>` case.
+   * Ignored when BLIPBURST_DASHBOARD_URL is set — see resolveDashboardUrl.
+   * Otherwise resolved from BLIPBURST_DASHBOARD_PORT / PORT / `.blipburst/port` / 4477.
+   */
   port?: number;
 }
 
@@ -54,9 +58,15 @@ export interface StartDashboardServerOptions {
   maxPortAttempts?: number;
 }
 
+export interface DashboardEventStore {
+  /** Force an immediate flush of the persistent heatmap/MTTR/run aggregates — call before process exit. */
+  flushNow(): void;
+}
+
 export interface StartDashboardServerResult {
   server: import('node:http').Server;
   port: number;
+  store: DashboardEventStore;
 }
 
 /** Starts the dashboard HTTP+SSE server. Used by the `blipburst-dashboard` bin; importable for embedding/tests. */
@@ -64,3 +74,20 @@ export function startDashboardServer(options?: StartDashboardServerOptions): Pro
 
 export const DEFAULT_PORT: number;
 export function resolvePort(explicitPort?: number): number;
+
+/**
+ * Resolve the full base URL to reach the dashboard at. Set
+ * BLIPBURST_DASHBOARD_URL (e.g. `https://dashboard.internal.example.com`)
+ * on the reporting app's environment to point every adapter function at a
+ * dashboard running on a different host — no code change needed. Falls
+ * back to `http://localhost:<resolvePort()>` otherwise.
+ */
+export function resolveDashboardUrl(explicitPort?: number): string;
+
+/**
+ * A port from BLIPBURST_DASHBOARD_PORT or the hosting-platform-standard
+ * PORT (Render/Railway/Fly/Heroku), or `null` if neither is set. Used to
+ * decide whether binding should fail loudly on conflict instead of
+ * auto-incrementing — see `startDashboardServer`'s `maxPortAttempts`.
+ */
+export function explicitPortFromEnv(): number | null;

package/index.js

@@ -1,3 +1,3 @@
 export { toDashboardTransport, toDashboardWebhookUrl, wrapForDashboard, flushBuffer } from './src/adapter.js';
 export { startDashboardServer } from './src/server.js';
-export { DEFAULT_PORT, resolvePort } from './src/port.js';
+export { DEFAULT_PORT, resolvePort, resolveDashboardUrl, explicitPortFromEnv } from './src/port.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dashboard-blipburst",
-  "version": "0.1.0",
+  "version": "0.2.4",
   "description": "Local live dashboard for BlipBurst — fault feed, experiment run history, endpoint/tenant chaos heatmap, and MTTR per fault type. Install globally, point BlipBurst's logger/webhook at it.",
   "type": "module",
   "main": "./index.js",

package/public/index.html

@@ -178,7 +178,66 @@
   document.getElementById('port-hint').textContent = location.host;
 
   const MAX_FEED_ROWS = 150;
+  const IDB_NAME = 'blipburst-dashboard';
+  const IDB_STORE = 'events';
+  const IDB_CAP = 2000; // client-local retention cap — separate from the server's own MAX_EVENTS
   let feedRows = [];
+  let idb = null;
+
+  // IndexedDB caches recent events per-browser so a reload doesn't need to
+  // re-fetch full history from the server, and so the feed keeps some
+  // scrollback beyond what the server's own bounded window still holds.
+  // Degrades to network-only (no local cache) if IndexedDB is unavailable.
+  function openIdb() {
+    return new Promise((resolve) => {
+      if (!('indexedDB' in window)) return resolve(null);
+      const req = indexedDB.open(IDB_NAME, 1);
+      req.onupgradeneeded = () => {
+        const db = req.result;
+        if (!db.objectStoreNames.contains(IDB_STORE)) {
+          const store = db.createObjectStore(IDB_STORE, { keyPath: 'id' });
+          store.createIndex('receivedAt', 'receivedAt');
+        }
+      };
+      req.onsuccess = () => resolve(req.result);
+      req.onerror = () => resolve(null);
+    });
+  }
+
+  function idbGetAll(db) {
+    return new Promise((resolve) => {
+      if (!db) return resolve([]);
+      const req = db.transaction(IDB_STORE, 'readonly').objectStore(IDB_STORE).getAll();
+      req.onsuccess = () => resolve(req.result || []);
+      req.onerror = () => resolve([]);
+    });
+  }
+
+  function idbPutMany(db, records) {
+    if (!db || records.length === 0) return;
+    const store = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE);
+    for (const r of records) store.put(r);
+  }
+
+  /** Deletes the oldest rows (by receivedAt) beyond `cap` — the client-side "invalidate older data" policy. */
+  function idbPruneOldest(db, cap) {
+    if (!db) return;
+    const store = db.transaction(IDB_STORE, 'readwrite').objectStore(IDB_STORE);
+    const countReq = store.count();
+    countReq.onsuccess = () => {
+      const excess = countReq.result - cap;
+      if (excess <= 0) return;
+      let deleted = 0;
+      const cursorReq = store.index('receivedAt').openCursor(); // ascending = oldest first
+      cursorReq.onsuccess = (ev) => {
+        const cursor = ev.target.result;
+        if (!cursor || deleted >= excess) return;
+        cursor.delete();
+        deleted++;
+        cursor.continue();
+      };
+    };
+  }
 
   function fmtTime(iso) {
     try { return new Date(iso).toLocaleTimeString(); } catch { return iso; }
@@ -208,6 +267,10 @@
     feedRows.unshift(e);
     if (feedRows.length > MAX_FEED_ROWS) feedRows.length = MAX_FEED_ROWS;
     renderFeed();
+    if (idb) {
+      idbPutMany(idb, [e]);
+      idbPruneOldest(idb, IDB_CAP);
+    }
   }
 
   async function refreshHeatmap() {
@@ -275,9 +338,31 @@
   }
 
   async function loadInitial() {
-    const res = await fetch('/api/events?limit=150');
+    idb = await openIdb();
+
+    // Paint whatever's cached locally first — instant, no network wait —
+    // then delta-fetch only what's new since the newest cached event
+    // instead of re-downloading the full recent-events window every load.
+    const cached = await idbGetAll(idb);
+    cached.sort((a, b) => (a.receivedAt < b.receivedAt ? 1 : -1));
+    if (cached.length) {
+      feedRows = cached.slice(0, MAX_FEED_ROWS);
+      renderFeed();
+    }
+
+    const since = cached.length ? cached[0].receivedAt : undefined;
+    const url = '/api/events?limit=500' + (since ? '&since=' + encodeURIComponent(since) : '');
+    const res = await fetch(url);
     const data = await res.json();
-    feedRows = (data.events || []).slice().reverse();
+    const fresh = data.events || [];
+
+    if (fresh.length) {
+      idbPutMany(idb, fresh);
+      idbPruneOldest(idb, IDB_CAP);
+      const seen = new Set();
+      const merged = [...fresh].reverse().concat(feedRows);
+      feedRows = merged.filter((e) => (seen.has(e.id) ? false : (seen.add(e.id), true))).slice(0, MAX_FEED_ROWS);
+    }
     renderFeed();
     refreshDerived();
   }

package/src/adapter.js

@@ -1,6 +1,16 @@
 import { randomUUID } from 'node:crypto';
 import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
-import { resolvePort, ensureBlipDir, BUFFER_FILE } from './port.js';
+import { resolveDashboardUrl, ensureBlipDir, BUFFER_FILE } from './port.js';
+
+// toDashboardTransport() and wrapForDashboard() are commonly used together
+// in the same process (the README's "full request coverage" combo) — they
+// need to land in the same run, so default to one shared per-process runId
+// generated lazily on first use, rather than each function minting its own.
+// An explicit `options.runId` still overrides this per call.
+let _defaultRunId = null;
+function getDefaultRunId() {
+  return (_defaultRunId ??= randomUUID());
+}
 
 function bufferEnvelope(envelope) {
   ensureBlipDir();
@@ -11,8 +21,8 @@ function bufferEnvelope(envelope) {
   }
 }
 
-async function postJson(port, path, payload) {
-  const res = await fetch(`http://localhost:${port}${path}`, {
+async function postJson(baseUrl, path, payload) {
+  const res = await fetch(`${baseUrl}${path}`, {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify(payload),
@@ -21,9 +31,9 @@ async function postJson(port, path, payload) {
 }
 
 /** Best-effort send: on any failure (dashboard not running, network error) buffer to disk instead of throwing. */
-async function sendOrBuffer(port, path, payload) {
+async function sendOrBuffer(baseUrl, path, payload) {
   try {
-    await postJson(port, path, payload);
+    await postJson(baseUrl, path, payload);
   } catch {
     bufferEnvelope({ path, payload });
   }
@@ -35,7 +45,7 @@ async function sendOrBuffer(port, path, payload) {
  * drained. Failures leave the buffer file untouched so nothing is lost.
  */
 export async function flushBuffer(port) {
-  const resolvedPort = resolvePort(port);
+  const baseUrl = resolveDashboardUrl(port);
   if (!existsSync(BUFFER_FILE)) return { flushed: 0 };
 
   let lines;
@@ -56,7 +66,7 @@ export async function flushBuffer(port) {
       continue; // drop corrupt line
     }
     try {
-      await postJson(resolvedPort, envelope.path, envelope.payload);
+      await postJson(baseUrl, envelope.path, envelope.payload);
       flushed++;
     } catch {
       remaining.push(line);
@@ -79,22 +89,27 @@ export async function flushBuffer(port) {
  * are flushed automatically the next time this transport is created (i.e.
  * the next process start) or on demand via `flushBuffer()`.
  *
+ * Locally this discovers the dashboard via `.blipburst/port` automatically.
+ * In a hosted setup where the app and the dashboard run on different hosts,
+ * set BLIPBURST_DASHBOARD_URL (e.g. `https://dashboard.internal.example.com`)
+ * on the app's environment instead — no code change needed.
+ *
  * Usage:
  *   import { toDashboardTransport } from 'dashboard-blipburst';
  *   const sim = new BlipBurst({ logger: { transport: toDashboardTransport() } });
  */
 export function toDashboardTransport(port, options = {}) {
-  const resolvedPort = resolvePort(port);
-  const runId = options.runId ?? randomUUID();
+  const baseUrl = resolveDashboardUrl(port);
+  const runId = options.runId ?? getDefaultRunId();
 
   // Try to drain anything buffered from a previous run without blocking
   // transport creation.
-  flushBuffer(resolvedPort).catch(() => {});
+  flushBuffer(port).catch(() => {});
 
   return function dashboardTransport(entry) {
     // LogTransport is synchronous/fire-and-forget by contract — never await
     // or throw here, BlipBurst calls this inline on the request path.
-    sendOrBuffer(resolvedPort, '/ingest/log', { runId, entry, source: 'logger' }).catch(() => {});
+    sendOrBuffer(baseUrl, '/ingest/log', { runId, entry, source: 'logger' }).catch(() => {});
   };
 }
 
@@ -102,14 +117,14 @@ export function toDashboardTransport(port, options = {}) {
  * Returns the URL to hand to BlipBurst's `webhook.url` option so its
  * built-in WebhookEmitter posts fault/circuit events straight at the
  * dashboard — no adapter function needed on that path since BlipBurst's
- * webhook is already URL-based.
+ * webhook is already URL-based. Respects BLIPBURST_DASHBOARD_URL the same
+ * way toDashboardTransport does.
  *
  * Usage:
  *   const sim = new BlipBurst({ webhook: { url: toDashboardWebhookUrl() } });
  */
 export function toDashboardWebhookUrl(port) {
-  const resolvedPort = resolvePort(port);
-  return `http://localhost:${resolvedPort}/ingest/webhook`;
+  return `${resolveDashboardUrl(port)}/ingest/webhook`;
 }
 
 function faultKindDiff(before, after) {
@@ -135,8 +150,8 @@ function faultKindDiff(before, after) {
  *   await sim.makeRequest();
  */
 export function wrapForDashboard(sim, options = {}) {
-  const resolvedPort = resolvePort(options.port);
-  const runId = options.runId ?? randomUUID();
+  const baseUrl = resolveDashboardUrl(options.port);
+  const runId = options.runId ?? getDefaultRunId();
   const original = sim.makeRequest.bind(sim);
 
   sim.makeRequest = async function wrappedMakeRequest(overrideUrl) {
@@ -156,7 +171,7 @@ export function wrapForDashboard(sim, options = {}) {
     } finally {
       const after = sim.getMetrics().faultStats;
       const faultKind = faultKindDiff(before, after);
-      sendOrBuffer(resolvedPort, '/ingest/request', {
+      sendOrBuffer(baseUrl, '/ingest/request', {
         runId,
         url,
         faultKind,

package/src/port.js

@@ -36,10 +36,35 @@ export function writePortFile(port) {
   }
 }
 
+/**
+ * A port set via BLIPBURST_DASHBOARD_PORT or the hosting-platform-standard
+ * PORT (Render/Railway/Fly/Heroku all inject this) means the deployment
+ * expects the process to bind exactly there — unlike the local port-file
+ * convenience, silently drifting to a different port would make it
+ * unreachable, so callers use this to decide whether auto-increment is safe.
+ */
+export function explicitPortFromEnv() {
+  const raw = process.env.BLIPBURST_DASHBOARD_PORT ?? process.env.PORT;
+  const parsed = raw ? parseInt(raw, 10) : NaN;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+
 /** Resolve the port the dashboard is (or should be) reachable on. */
 export function resolvePort(explicitPort) {
   if (explicitPort) return explicitPort;
-  const fromEnv = process.env.BLIPBURST_DASHBOARD_PORT;
-  if (fromEnv && Number.isFinite(parseInt(fromEnv, 10))) return parseInt(fromEnv, 10);
-  return readPortFile() ?? DEFAULT_PORT;
+  return explicitPortFromEnv() ?? readPortFile() ?? DEFAULT_PORT;
+}
+
+/**
+ * Resolve the full base URL to reach the dashboard at. In a hosted setup
+ * where the app reporting events and the dashboard aren't on the same
+ * machine (so there's no shared `.blipburst/port` file to read), set
+ * BLIPBURST_DASHBOARD_URL (e.g. `https://dashboard.internal.example.com`)
+ * on the app's side and every adapter function picks it up automatically.
+ * Falls back to the local `http://localhost:<port>` behavior otherwise.
+ */
+export function resolveDashboardUrl(explicitPort) {
+  const fromEnv = process.env.BLIPBURST_DASHBOARD_URL;
+  if (fromEnv) return fromEnv.replace(/\/+$/, '');
+  return `http://localhost:${resolvePort(explicitPort)}`;
 }

package/src/server.js

@@ -145,6 +145,12 @@ function listenWithAutoIncrement(server, port, attemptsLeft) {
     server.once('error', (err) => {
       if (err.code === 'EADDRINUSE' && attemptsLeft > 0) {
         resolve(listenWithAutoIncrement(server, port + 1, attemptsLeft - 1));
+      } else if (err.code === 'EADDRINUSE') {
+        reject(new Error(
+          `Port ${port} is already in use and auto-increment is disabled (maxPortAttempts: 0) — ` +
+          `this happens when the port came from --port, BLIPBURST_DASHBOARD_PORT, or PORT, since a ` +
+          `hosting platform expects the process to bind exactly there. Free the port or change the env var.`
+        ));
       } else {
         reject(err);
       }

package/src/store.js

@@ -1,8 +1,21 @@
-import { appendFileSync, existsSync, readFileSync } from 'node:fs';
+import { appendFileSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
-import { EVENTS_FILE, ensureBlipDir } from './port.js';
+import { join } from 'node:path';
+import { EVENTS_FILE, BLIP_DIR, ensureBlipDir } from './port.js';
+
+const AGGREGATES_FILE = join(BLIP_DIR, 'aggregates.json');
+
+// Bounds on the *raw* per-event log (both in-memory and on disk). This is
+// the "very recent events / live feed" window — it's expected to roll over.
+// Derived "major event" data (heatmap totals, MTTR running averages, run
+// summaries) lives in AGGREGATES_FILE instead, which is never pruned, so
+// long-term signal survives raw-log rollover.
+const MAX_EVENTS = 5000;
+// Once the on-disk log grows this far past the cap, rewrite it down to size
+// rather than compacting on every single ingest (which would be O(n) per event).
+const COMPACT_THRESHOLD = MAX_EVENTS * 1.5;
+const AGGREGATE_FLUSH_INTERVAL_MS = 3000;
 
-const MAX_IN_MEMORY = 5000;
 // Consecutive fault.injected log lines of the same kind+url within this gap
 // are treated as one "incident" for the log-only MTTR fallback.
 const INCIDENT_GAP_MS = 10_000;
@@ -59,7 +72,21 @@ export class EventStore {
   constructor() {
     this.events = [];
     this.subscribers = new Set();
+    this._diskLineCount = 0;
+
+    // Persistent, never-pruned aggregates ("major events").
+    this.heatmapAgg = new Map(); // url -> { totalRequests, faultCounts, coverageKnown }
+    this.mttrAgg = new Map(); // faultKind -> { sum, count }
+    this.runsAgg = new Map(); // runId -> { startedAt, endedAt, eventCount, faultCount, failureCount, faultKinds, urls: Set }
+    this._openFaultByUrl = new Map(); // in-memory only — resets on restart, at most loses one open incident
+    this._sawRequestEvents = false;
+    this._dirty = false;
+
     this._loadFromDisk();
+    this._loadAggregates();
+
+    this._flushTimer = setInterval(() => this._persistAggregatesIfDirty(), AGGREGATE_FLUSH_INTERVAL_MS);
+    this._flushTimer.unref?.();
   }
 
   _loadFromDisk() {
@@ -67,28 +94,152 @@ export class EventStore {
     if (!existsSync(EVENTS_FILE)) return;
     try {
       const lines = readFileSync(EVENTS_FILE, 'utf8').split('\n').filter(Boolean);
-      for (const line of lines.slice(-MAX_IN_MEMORY)) {
+      this._diskLineCount = lines.length;
+      for (const line of lines.slice(-MAX_EVENTS)) {
         try {
           this.events.push(JSON.parse(line));
         } catch {
           /* skip corrupt line */
         }
       }
+      // A pre-existing unbounded log (e.g. from before this retention policy
+      // existed) gets shrunk to the cap immediately rather than waiting for
+      // enough new events to cross COMPACT_THRESHOLD.
+      if (this._diskLineCount > MAX_EVENTS) this._compactDiskLog();
     } catch {
       /* best-effort load */
     }
   }
 
-  ingest(kind, body) {
-    const record = normalize(kind, body);
-    this.events.push(record);
-    if (this.events.length > MAX_IN_MEMORY) this.events.shift();
+  _loadAggregates() {
+    if (!existsSync(AGGREGATES_FILE)) return;
+    try {
+      const data = JSON.parse(readFileSync(AGGREGATES_FILE, 'utf8'));
+      for (const [url, row] of Object.entries(data.heatmap ?? {})) {
+        this.heatmapAgg.set(url, row);
+        if (row.coverageKnown) this._sawRequestEvents = true;
+      }
+      for (const [kind, agg] of Object.entries(data.mttr ?? {})) this.mttrAgg.set(kind, agg);
+      for (const [runId, run] of Object.entries(data.runs ?? {})) {
+        this.runsAgg.set(runId, { ...run, urls: new Set(run.urls ?? []) });
+      }
+    } catch {
+      /* corrupt or missing — start fresh */
+    }
+  }
+
+  _persistAggregatesIfDirty() {
+    if (!this._dirty) return;
+    this._dirty = false;
+    try {
+      ensureBlipDir();
+      const heatmap = Object.fromEntries(this.heatmapAgg);
+      const mttr = Object.fromEntries(this.mttrAgg);
+      const runs = Object.fromEntries(
+        [...this.runsAgg.entries()].map(([id, r]) => [id, { ...r, urls: [...r.urls] }])
+      );
+      writeFileSync(AGGREGATES_FILE, JSON.stringify({ heatmap, mttr, runs }));
+    } catch {
+      /* best-effort */
+    }
+  }
+
+  /** Force an immediate aggregate flush — call on graceful shutdown so the last few seconds aren't lost. */
+  flushNow() {
+    this._dirty = true;
+    this._persistAggregatesIfDirty();
+  }
+
+  _appendRaw(record) {
     try {
       ensureBlipDir();
       appendFileSync(EVENTS_FILE, JSON.stringify(record) + '\n');
+      this._diskLineCount++;
+      if (this._diskLineCount > COMPACT_THRESHOLD) this._compactDiskLog();
     } catch {
       /* best-effort persistence */
     }
+  }
+
+  /** Rewrites the raw event log down to the in-memory window instead of letting it grow unbounded. */
+  _compactDiskLog() {
+    try {
+      const lines = this.events.map((e) => JSON.stringify(e));
+      writeFileSync(EVENTS_FILE, lines.length ? lines.join('\n') + '\n' : '');
+      this._diskLineCount = lines.length;
+    } catch {
+      /* best-effort */
+    }
+  }
+
+  _updateAggregates(record) {
+    // Run summaries — one row per runId, kept forever regardless of raw-log rollover.
+    if (!this.runsAgg.has(record.runId)) {
+      this.runsAgg.set(record.runId, {
+        runId: record.runId,
+        startedAt: record.timestamp,
+        endedAt: record.timestamp,
+        eventCount: 0,
+        faultCount: 0,
+        failureCount: 0,
+        faultKinds: {},
+        urls: new Set(),
+      });
+    }
+    const run = this.runsAgg.get(record.runId);
+    run.eventCount++;
+    if (record.timestamp < run.startedAt) run.startedAt = record.timestamp;
+    if (record.timestamp > run.endedAt) run.endedAt = record.timestamp;
+    if (record.faultKind) {
+      run.faultCount++;
+      run.faultKinds[record.faultKind] = (run.faultKinds[record.faultKind] ?? 0) + 1;
+    }
+    if (record.success === false) run.failureCount++;
+    if (record.url) run.urls.add(record.url);
+
+    // Heatmap — per-url totals, kept forever.
+    if (record.url) {
+      if (!this.heatmapAgg.has(record.url)) {
+        this.heatmapAgg.set(record.url, { totalRequests: 0, faultCounts: {}, coverageKnown: false });
+      }
+      const row = this.heatmapAgg.get(record.url);
+      if (record.kind === 'request') {
+        row.totalRequests++;
+        row.coverageKnown = true;
+        this._sawRequestEvents = true;
+      }
+      if (record.faultKind) row.faultCounts[record.faultKind] = (row.faultCounts[record.faultKind] ?? 0) + 1;
+    }
+
+    // MTTR (request-source) — running sum/count per fault kind, kept forever.
+    // The "is a fault currently open" tracker itself is in-memory only, so a
+    // server restart mid-incident loses at most that one in-flight measurement.
+    if (record.kind === 'request') {
+      const openFault = this._openFaultByUrl.get(record.url);
+      if (!record.success && record.faultKind) {
+        if (!openFault) this._openFaultByUrl.set(record.url, { kind: record.faultKind, since: record.timestamp });
+      } else if (record.success && openFault) {
+        const ms = Date.parse(record.timestamp) - Date.parse(openFault.since);
+        if (Number.isFinite(ms) && ms >= 0) {
+          const agg = this.mttrAgg.get(openFault.kind) ?? { sum: 0, count: 0 };
+          agg.sum += ms;
+          agg.count++;
+          this.mttrAgg.set(openFault.kind, agg);
+        }
+        this._openFaultByUrl.delete(record.url);
+      }
+    }
+  }
+
+  ingest(kind, body) {
+    const record = normalize(kind, body);
+    this.events.push(record);
+    if (this.events.length > MAX_EVENTS) this.events.shift();
+
+    this._appendRaw(record);
+    this._updateAggregates(record);
+    this._dirty = true;
+
     for (const send of this.subscribers) send(record);
     return record;
   }
@@ -98,77 +249,40 @@ export class EventStore {
     return () => this.subscribers.delete(send);
   }
 
+  /** Recent raw events — the bounded live-feed window, not the full history. */
   recent(limit = 500, since) {
     let list = this.events;
     if (since) list = list.filter((e) => e.receivedAt > since);
     return list.slice(-limit);
   }
 
-  /** Group events by runId into a chronological experiment-run timeline. */
+  /** Chronological experiment-run timeline, from the persistent per-run aggregate (survives raw-log rollover). */
   runs() {
-    const byRun = new Map();
-    for (const e of this.events) {
-      if (!byRun.has(e.runId)) {
-        byRun.set(e.runId, {
-          runId: e.runId,
-          startedAt: e.timestamp,
-          endedAt: e.timestamp,
-          eventCount: 0,
-          faultCount: 0,
-          failureCount: 0,
-          faultKinds: {},
-          urls: new Set(),
-        });
-      }
-      const run = byRun.get(e.runId);
-      run.eventCount++;
-      if (e.timestamp < run.startedAt) run.startedAt = e.timestamp;
-      if (e.timestamp > run.endedAt) run.endedAt = e.timestamp;
-      if (e.faultKind) {
-        run.faultCount++;
-        run.faultKinds[e.faultKind] = (run.faultKinds[e.faultKind] ?? 0) + 1;
-      }
-      if (e.success === false) run.failureCount++;
-      if (e.url) run.urls.add(e.url);
-    }
-    return [...byRun.values()]
+    return [...this.runsAgg.values()]
       .map((r) => ({ ...r, urls: [...r.urls] }))
       .sort((a, b) => (a.startedAt < b.startedAt ? 1 : -1));
   }
 
   /**
-   * Endpoint x fault-kind matrix. `requestEvents` (from wrapForDashboard)
-   * tell us every call made, faulted or not, so we can surface endpoints
-   * that were exercised but never chaos-tested. Log/webhook-only setups
-   * only ever see faulted calls, so "untested" can't be computed for them
-   * — those rows are marked `coverageKnown: false`.
+   * Endpoint x fault-kind matrix, from the persistent per-url aggregate.
+   * `requestEvents` (from wrapForDashboard) tell us every call made, faulted
+   * or not, so we can surface endpoints that were exercised but never
+   * chaos-tested. Log/webhook-only setups only ever see faulted calls, so
+   * "untested" can't be computed for them — those rows are marked
+   * `coverageKnown: false`.
    */
   heatmap() {
-    const byUrl = new Map();
-    let sawRequestEvents = false;
-
-    for (const e of this.events) {
-      if (!e.url) continue;
-      if (e.kind === 'request') sawRequestEvents = true;
-      if (!byUrl.has(e.url)) byUrl.set(e.url, { url: e.url, totalRequests: 0, faultCounts: {}, coverageKnown: false });
-      const row = byUrl.get(e.url);
-      if (e.kind === 'request') {
-        row.totalRequests++;
-        row.coverageKnown = true;
-      }
-      if (e.faultKind) row.faultCounts[e.faultKind] = (row.faultCounts[e.faultKind] ?? 0) + 1;
-    }
-
-    const rows = [...byUrl.values()].map((row) => {
+    const rows = [...this.heatmapAgg.entries()].map(([url, row]) => {
       const faulted = Object.values(row.faultCounts).reduce((a, b) => a + b, 0);
       return {
+        url,
         ...row,
         faultedCount: faulted,
         untested: row.coverageKnown && row.totalRequests > 0 && faulted === 0,
       };
     });
     rows.sort((a, b) => b.faultedCount - a.faultedCount);
-    return { sawRequestEvents, rows };
+    return { sawRequestEvents: this._sawRequestEvents, rows };
   }
 
   /**
@@ -176,46 +290,23 @@ export class EventStore {
    *
    * Preferred method (`source: 'request'`): wrapForDashboard reports every
    * call's success/failure, so MTTR is the mean time between a failed call
-   * attributed to a fault kind and the next successful call on that url.
+   * attributed to a fault kind and the next successful call on that url —
+   * computed from the persistent running sum/count, so it stays accurate
+   * even after the raw log rolls over.
    *
    * Fallback (`source: 'log'`): plain logger/webhook wiring only sees
    * fault.injected lines, so we approximate recovery time as the duration
    * of each "incident" — a run of same-kind faults on the same url with no
-   * gap larger than INCIDENT_GAP_MS between them.
+   * gap larger than INCIDENT_GAP_MS between them. This one's computed from
+   * the bounded raw-event window since it's already just a rough estimate.
    */
   mttr() {
-    const requestEvents = this.events.filter((e) => e.kind === 'request');
-    if (requestEvents.length > 0) return this._mttrFromRequests(requestEvents);
-    return this._mttrFromLogs();
-  }
-
-  _mttrFromRequests(requestEvents) {
-    const byUrl = new Map();
-    for (const e of requestEvents) {
-      const list = byUrl.get(e.url) ?? [];
-      list.push(e);
-      byUrl.set(e.url, list);
-    }
-
-    const durationsByKind = new Map();
-    for (const list of byUrl.values()) {
-      list.sort((a, b) => (a.timestamp < b.timestamp ? -1 : 1));
-      let openFault = null;
-      for (const e of list) {
-        if (!e.success && e.faultKind) {
-          if (!openFault) openFault = { kind: e.faultKind, since: e.timestamp };
-        } else if (e.success && openFault) {
-          const ms = Date.parse(e.timestamp) - Date.parse(openFault.since);
-          if (Number.isFinite(ms) && ms >= 0) {
-            const arr = durationsByKind.get(openFault.kind) ?? [];
-            arr.push(ms);
-            durationsByKind.set(openFault.kind, arr);
-          }
-          openFault = null;
-        }
-      }
+    if (this._sawRequestEvents) {
+      const out = {};
+      for (const [kind, { sum, count }] of this.mttrAgg) out[kind] = count ? Math.round(sum / count) : 0;
+      return { source: 'request', mttrMsByKind: out };
     }
-    return { source: 'request', mttrMsByKind: average(durationsByKind) };
+    return this._mttrFromLogs();
   }
 
   _mttrFromLogs() {