fix: improve the quality of the app

src/client/components/StatusHistoryBar.tsx

@@ -1,12 +1,7 @@
 import type { PublicService } from '../api/status';
-import { useMediaQuery } from '../lib/useMediaQuery';
 
 const DAY_MS = 24 * 60 * 60 * 1000;
-// Desktop mirrors the API's full 90-day history. Compact screens use the most
-// recent 45 days so each daily bar remains legible.
 const HISTORY_DAYS = 90;
-const HISTORY_DAYS_COMPACT = 45;
-const COMPACT_QUERY = '(max-width: 520px)';
 
 type HistoryEntry = PublicService['history'][number];
 
@@ -32,25 +27,23 @@ function dayTitle(day: number, uptimePct: number | null | undefined) {
 }
 
 export function StatusHistoryBar({ history }: { history: HistoryEntry[] }) {
-	const compact = useMediaQuery(COMPACT_QUERY);
-	const windowDays = compact ? HISTORY_DAYS_COMPACT : HISTORY_DAYS;
 	const historyByDay = new Map(history.map((entry) => [entry.day, entry.uptimePct]));
 	const now = new Date();
 	const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
-	const days = Array.from({ length: windowDays }, (_day, index) => {
-		const day = today - (windowDays - 1 - index) * DAY_MS;
+	const days = Array.from({ length: HISTORY_DAYS }, (_day, index) => {
+		const day = today - (HISTORY_DAYS - 1 - index) * DAY_MS;
 		return { day, uptimePct: historyByDay.get(day) };
 	});
 
 	return (
 		<div className="status-history">
-			<div className="uptime-days" aria-label={`Daily uptime over the last ${windowDays} days`}>
+			<div className="uptime-days" aria-label={`Daily uptime over the last ${HISTORY_DAYS} days`}>
 				{days.map(({ day, uptimePct }) => (
 					<span className={`uptime-day ${dayClass(uptimePct)}`} key={day} title={dayTitle(day, uptimePct)} />
 				))}
 			</div>
 			<div className="uptime-days-caption" aria-hidden="true">
-				<span>{windowDays} days ago</span>
+				<span>{HISTORY_DAYS} days ago</span>
 				<i />
 				<span>Today</span>
 			</div>

src/worker/autopilot/index.ts

@@ -14,11 +14,12 @@ import type { CheckResult, Monitor } from '../checks/run-check';
 import { getDb } from '../db/client';
 import { aiSettings, incidentUpdates, incidents } from '../db/schema';
 import { humanizeDuration } from '../lib/humanize';
+import { resolveRunLimits } from '../lib/runtime-config';
 import { advanceStatus, computeImpact, nextFollowupDueAt, type AutopilotIncidentStatus } from './cadence';
 import { loadIncidentSignal, findLatestAutoIncidentForMonitor } from './signal';
 
-export const MAX_AI_CALLS_PER_RUN = 12;
-export const MAX_FOLLOWUP_CALLS_PER_RUN = 6;
+// Per-pass ceilings come from resolveRunLimits(env): AI_CALLS_PER_RUN / AI_FOLLOWUP_CALLS_PER_RUN,
+// defaulting to DEFAULT_RUN_LIMITS. They keep one autopilot pass within the free-plan subrequest budget.
 export const AUTOPILOT_CONCURRENCY = 4;
 export const AUTOPILOT_DEADLINE_MS = 45_000;
 
@@ -215,6 +216,7 @@ async function processFollowup(env: Env, settings: Settings, incident: typeof in
 
 async function loadFollowupTasks(env: Env, settings: Settings, excluded: Set<number>): Promise<Task[]> {
 	const db = getDb(env);
+	const maxFollowups = resolveRunLimits(env).aiFollowupCallsPerRun;
 	const rows = await db
 		.select({
 			incident: incidents,
@@ -264,7 +266,7 @@ async function loadFollowupTasks(env: Env, settings: Settings, excluded: Set<num
 			monitorId: signal.monitor.id,
 			run: () => processFollowup(env, settings, row.incident),
 		});
-		if (tasks.length >= MAX_FOLLOWUP_CALLS_PER_RUN) break;
+		if (tasks.length >= maxFollowups) break;
 	}
 	return tasks;
 }
@@ -277,7 +279,7 @@ export async function runAutopilot(
 	const db = getDb(env);
 	const [settings] = await db.select().from(aiSettings).where(eq(aiSettings.id, 1)).limit(1);
 	if (!settings?.enabled || !settings.autopilotEnabled || !settings.baseUrl || !settings.apiKey || !settings.model) return summary;
-	const budget = input.budget ?? { remaining: MAX_AI_CALLS_PER_RUN, deadline: Date.now() + AUTOPILOT_DEADLINE_MS };
+	const budget = input.budget ?? { remaining: resolveRunLimits(env).aiCallsPerRun, deadline: Date.now() + AUTOPILOT_DEADLINE_MS };
 	budget.deadline ??= Date.now() + AUTOPILOT_DEADLINE_MS;
 	const tasks: Task[] = [];
 	const excluded = new Set<number>();

src/worker/checks/run-check.ts

@@ -11,7 +11,11 @@ export type CheckResult = {
 	error: string | null;
 };
 
-export const MAX_BODY_MATCH_BYTES = 256 * 1024;
+// Keyword matching decodes and lowercases this many bytes of the response body on the hot
+// path. 64 KiB covers page titles, health-check payloads and status JSON while keeping the
+// per-check CPU cost small — the free plan allows only 10 ms of CPU per invocation and one
+// scheduled run decodes bodies for every keyword monitor.
+export const MAX_BODY_MATCH_BYTES = 64 * 1024;
 
 function requestHeaders(monitor: Monitor) {
 	let configured: Record<string, string> = {};

src/worker/checks/run-due-checks.ts

@@ -2,16 +2,18 @@ import { and, eq, sql } from 'drizzle-orm';
 import type { AutopilotEvent } from '../autopilot';
 import { getDb } from '../db/client';
 import { aiSettings, monitors } from '../db/schema';
+import { DEFAULT_RUN_LIMITS, resolveRunLimits } from '../lib/runtime-config';
 import { loadActiveMaintenance } from '../maintenance/windows';
 import { buildAlertEvent } from '../notifications/compose';
-import { dispatchNotification, MAX_NOTIFICATIONS_PER_RUN, type NotificationBudget } from '../notifications/dispatch';
+import { dispatchNotification, type NotificationBudget } from '../notifications/dispatch';
 import { buildResultStatements } from './persist-result';
 import { runCheck, runCheckWithRetries, type RetryBudget } from './run-check';
 
 const MAX_MONITORS_PER_RUN = 40;
 const CONCURRENCY = 10;
 const MAX_BATCH_STATEMENTS = 100;
-export const MAX_RETRY_ATTEMPTS_PER_RUN = 60;
+/** Default retry ceiling for one scheduled run; override with the RETRY_ATTEMPTS_PER_RUN env var. */
+export const MAX_RETRY_ATTEMPTS_PER_RUN = DEFAULT_RUN_LIMITS.retryAttemptsPerRun;
 const RETRY_DEADLINE_MS = 90_000;
 
 export type DueCheckSummary = {
@@ -40,11 +42,12 @@ export async function runDueChecks(env: Env, ctx?: Pick<ExecutionContext, 'waitU
 		.limit(MAX_MONITORS_PER_RUN);
 
 	if (due.length === 0) return { checked: 0, up: 0, down: 0, pending: 0, opened: 0, retries: 0, events: [] };
+	const limits = resolveRunLimits(env);
 	const [activeMaintenance, [settings]] = await Promise.all([
 		loadActiveMaintenance(db, new Date()),
 		db.select().from(aiSettings).where(eq(aiSettings.id, 1)).limit(1),
 	]);
-	const budget: RetryBudget = { remaining: MAX_RETRY_ATTEMPTS_PER_RUN, deadline: Date.now() + RETRY_DEADLINE_MS };
+	const budget: RetryBudget = { remaining: limits.retryAttemptsPerRun, deadline: Date.now() + RETRY_DEADLINE_MS };
 
 	const completed: Array<{
 		monitor: (typeof due)[number];
@@ -84,7 +87,7 @@ export async function runDueChecks(env: Env, ctx?: Pick<ExecutionContext, 'waitU
 	}
 	if (statementChunk.length > 0) await db.batch(statementChunk as [(typeof statementChunk)[number], ...typeof statementChunk]);
 
-	const notificationBudget: NotificationBudget = { remaining: MAX_NOTIFICATIONS_PER_RUN };
+	const notificationBudget: NotificationBudget = { remaining: limits.notificationsPerRun };
 	const notifications = persisted.flatMap((item) => {
 		const work: Promise<unknown>[] = [];
 		if (item.transition === 'opened' || item.transition === 'resolved') {

src/worker/db/schema.ts

@@ -40,7 +40,11 @@ export const loginAttempts = sqliteTable(
 		ipAddress: text('ip_address').notNull(),
 		attemptedAt: integer('attempted_at', { mode: 'timestamp_ms' }).notNull(),
 	},
-	(table) => [index('login_attempts_ip_attempted_at_idx').on(table.ipAddress, table.attemptedAt)],
+	(table) => [
+		index('login_attempts_ip_attempted_at_idx').on(table.ipAddress, table.attemptedAt),
+		// Retention cleanup filters on attempted_at alone; the composite index above cannot serve it.
+		index('login_attempts_attempted_at_idx').on(table.attemptedAt),
+	],
 );
 
 export const monitors = sqliteTable(
@@ -128,7 +132,12 @@ export const checks = sqliteTable(
 		maintenance: integer('maintenance', { mode: 'boolean' }).notNull().default(false),
 		degraded: integer('degraded', { mode: 'boolean' }).notNull().default(false),
 	},
-	(table) => [index('checks_monitor_id_checked_at_idx').on(table.monitorId, table.checkedAt)],
+	(table) => [
+		index('checks_monitor_id_checked_at_idx').on(table.monitorId, table.checkedAt),
+		// Daily rollup and retention cleanup scan by checked_at across every monitor; without this
+		// index those become full-table scans, which dominate D1 "rows read" at scale.
+		index('checks_checked_at_idx').on(table.checkedAt),
+	],
 );
 
 export const incidents = sqliteTable(
@@ -247,7 +256,11 @@ export const notificationDeliveries = sqliteTable(
 		attempts: integer('attempts').notNull().default(1),
 		createdAt: integer('created_at', { mode: 'timestamp_ms' }).notNull(),
 	},
-	(table) => [index('notification_deliveries_channel_id_created_at_idx').on(table.channelId, table.createdAt)],
+	(table) => [
+		index('notification_deliveries_channel_id_created_at_idx').on(table.channelId, table.createdAt),
+		// Retention cleanup filters on created_at alone; the composite index above cannot serve it.
+		index('notification_deliveries_created_at_idx').on(table.createdAt),
+	],
 );
 
 export const monitorDailyStats = sqliteTable(
@@ -264,5 +277,9 @@ export const monitorDailyStats = sqliteTable(
 		minLatencyMs: integer('min_latency_ms'),
 		maxLatencyMs: integer('max_latency_ms'),
 	},
-	(table) => [uniqueIndex('monitor_daily_stats_monitor_id_day_uidx').on(table.monitorId, table.day)],
+	(table) => [
+		uniqueIndex('monitor_daily_stats_monitor_id_day_uidx').on(table.monitorId, table.day),
+		// Retention cleanup filters on day alone; the composite unique index above cannot serve it.
+		index('monitor_daily_stats_day_idx').on(table.day),
+	],
 );

src/worker/index.ts

@@ -9,7 +9,7 @@ import maintenanceRoutes from './routes/maintenance';
 import monitorRoutes from './routes/monitors';
 import settingsRoutes from './routes/settings';
 import statusRoutes from './routes/status';
-import { cleanupExpiredAuthRecords } from './scheduled/cleanup';
+import { cleanupExpiredAuthRecords, cleanupStaleData } from './scheduled/cleanup';
 import { runDailyRollup } from './scheduled/rollup';
 
 const app = new Hono<{ Bindings: Env }>();
@@ -41,6 +41,7 @@ export default {
 	async scheduled(controller, env, ctx) {
 		if (controller.cron === '5 0 * * *') {
 			const result = await runDailyRollup(env, new Date(controller.scheduledTime));
+			await cleanupStaleData(env);
 			console.log(
 				JSON.stringify({
 					message: 'daily rollup completed',

src/worker/lib/runtime-config.ts

@@ -0,0 +1,53 @@
+/**
+ * Environment-tunable runtime knobs.
+ *
+ * Cloudflare's free plan caps a Worker invocation at 50 subrequests and 10 ms CPU, and the
+ * 5-minute cron runs checks, retries, notifications and AI autopilot inside a single
+ * invocation. The defaults below keep a healthy run well under that ceiling and make a large
+ * correlated outage shed the least-critical work first (AI, then retries) instead of failing
+ * mid-batch. Raise them with same-named environment variables on the Workers Paid plan, where
+ * the ceiling is 1,000 subrequests and 5 minutes of CPU.
+ */
+
+export type RunLimits = {
+	/** Immediate check retries attempted across one scheduled run, shared by every monitor. */
+	retryAttemptsPerRun: number;
+	/** Alert deliveries attempted across one scheduled run. */
+	notificationsPerRun: number;
+	/** AI completion calls attempted across one autopilot pass. */
+	aiCallsPerRun: number;
+	/** AI follow-up updates queued across one autopilot pass. */
+	aiFollowupCallsPerRun: number;
+};
+
+export const DEFAULT_RUN_LIMITS: RunLimits = {
+	retryAttemptsPerRun: 15,
+	notificationsPerRun: 12,
+	aiCallsPerRun: 4,
+	aiFollowupCallsPerRun: 2,
+};
+
+/** Seconds the public status responses are held in the edge cache. 0 disables edge caching. */
+export const DEFAULT_STATUS_CACHE_SECONDS = 30;
+
+type EnvVars = Record<string, string | undefined>;
+
+function boundedInt(raw: string | undefined, fallback: number, minimum: number): number {
+	if (raw === undefined) return fallback;
+	const value = Number(raw);
+	return Number.isInteger(value) && value >= minimum ? value : fallback;
+}
+
+export function resolveRunLimits(env: Env): RunLimits {
+	const vars = env as unknown as EnvVars;
+	return {
+		retryAttemptsPerRun: boundedInt(vars.RETRY_ATTEMPTS_PER_RUN, DEFAULT_RUN_LIMITS.retryAttemptsPerRun, 1),
+		notificationsPerRun: boundedInt(vars.NOTIFICATIONS_PER_RUN, DEFAULT_RUN_LIMITS.notificationsPerRun, 1),
+		aiCallsPerRun: boundedInt(vars.AI_CALLS_PER_RUN, DEFAULT_RUN_LIMITS.aiCallsPerRun, 1),
+		aiFollowupCallsPerRun: boundedInt(vars.AI_FOLLOWUP_CALLS_PER_RUN, DEFAULT_RUN_LIMITS.aiFollowupCallsPerRun, 1),
+	};
+}
+
+export function resolveStatusCacheSeconds(env: Env): number {
+	return boundedInt((env as unknown as EnvVars).STATUS_CACHE_SECONDS, DEFAULT_STATUS_CACHE_SECONDS, 0);
+}

src/worker/routes/status.ts

@@ -1,8 +1,9 @@
 import { and, desc, eq, gte, inArray, isNull, lt, sql } from 'drizzle-orm';
-import { Hono } from 'hono';
+import { Hono, type Context } from 'hono';
 import { DEGRADED_MESSAGE, deterministicIncidentMessage } from '../ai/fallback-message';
 import { getDb } from '../db/client';
 import { checks, incidentMonitors, incidents, incidentUpdates, monitorDailyStats, monitors } from '../db/schema';
+import { resolveStatusCacheSeconds } from '../lib/runtime-config';
 import { loadActiveMaintenance, type ActiveMaintenance } from '../maintenance/windows';
 import { resolveFavicon } from './monitors';
 
@@ -111,9 +112,58 @@ const incidentSelection = {
 	startStatusCode: incidents.startStatusCode,
 };
 
+function edgeCache(): EdgeCache | null {
+	try {
+		return (caches as CacheStorage & { readonly default: EdgeCache }).default;
+	} catch {
+		return null;
+	}
+}
+
+// Key on origin + path only. These responses do not vary by query string, so ignoring it also
+// stops `?x=1`, `?x=2`, … spray from bypassing the cache and hammering D1 on every request.
+function statusCacheKey(context: Context<{ Bindings: Env }>): Request {
+	const url = new URL(context.req.url);
+	return new Request(`${url.origin}${url.pathname}`);
+}
+
+/**
+ * The public status endpoints are polled by every open status-page tab every 60s. Serving them
+ * from the edge cache collapses that traffic to one origin computation per window and keeps the
+ * `checks` / `monitor_daily_stats` scans they run off D1's free-tier read budget. Set the
+ * STATUS_CACHE_SECONDS env var to 0 to disable.
+ */
+async function cachedStatusResponse(context: Context<{ Bindings: Env }>): Promise<Response | undefined> {
+	if (resolveStatusCacheSeconds(context.env) <= 0) return undefined;
+	const cache = edgeCache();
+	if (!cache) return undefined;
+	try {
+		return await cache.match(statusCacheKey(context));
+	} catch {
+		return undefined;
+	}
+}
+
+function jsonWithEdgeCache(context: Context<{ Bindings: Env }>, body: unknown): Response {
+	const seconds = resolveStatusCacheSeconds(context.env);
+	if (seconds <= 0) return Response.json(body);
+	const response = Response.json(body, { headers: { 'Cache-Control': `public, max-age=${seconds}` } });
+	const cache = edgeCache();
+	if (cache) {
+		try {
+			context.executionCtx.waitUntil(cache.put(statusCacheKey(context), response.clone()).catch(() => undefined));
+		} catch {
+			// No ExecutionContext available (e.g. unit tests): serve without populating the edge cache.
+		}
+	}
+	return response;
+}
+
 const statusRoutes = new Hono<{ Bindings: Env }>();
 
 statusRoutes.get('/', async (context) => {
+	const cached = await cachedStatusResponse(context);
+	if (cached) return cached;
 	const db = getDb(context.env);
 	const monitorRows = await db
 		.select({
@@ -230,7 +280,7 @@ statusRoutes.get('/', async (context) => {
 		latestUpdate: latestUpdates.get(incident.id) ?? null,
 		services: incidentServices.get(incident.id) ?? [],
 	}));
-	return context.json({
+	return jsonWithEdgeCache(context, {
 		overall: overallStatus(
 			services.map((service) => service.status),
 			activeIncidentRows.filter((incident) => incident.source === 'manual').map((incident) => incident.impact),
@@ -242,6 +292,8 @@ statusRoutes.get('/', async (context) => {
 });
 
 statusRoutes.get('/incidents', async (context) => {
+	const cached = await cachedStatusResponse(context);
+	if (cached) return cached;
 	const db = getDb(context.env);
 	const limit = parseLimit(context.req.query('limit'), 20, 20);
 	const rows = await db
@@ -252,7 +304,7 @@ statusRoutes.get('/incidents', async (context) => {
 		.limit(limit);
 	const incidentIds = rows.map((row) => row.id);
 	const [services, latestUpdates] = await Promise.all([loadServices(db, incidentIds), loadLatestUpdates(db, incidentIds)]);
-	return context.json({
+	return jsonWithEdgeCache(context, {
 		incidents: rows.map((incident) => ({
 			id: incident.id,
 			title: publicIncidentTitle(incident),

src/worker/scheduled/cleanup.ts

@@ -8,6 +8,11 @@ const DAILY_STATS_RETENTION_MS = 400 * 24 * 60 * 60 * 1000;
 const DELIVERY_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 export const AI_EVENT_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 
+/**
+ * Cheap, high-frequency cleanup for the every-5-minute cron. Only touches the auth tables,
+ * which stay tiny and are indexed on the column filtered here, so each delete is a bounded
+ * range scan. Security-sensitive (session expiry, login rate limiting) so it must stay fresh.
+ */
 export async function cleanupExpiredAuthRecords(env: Env) {
 	const db = getDb(env);
 	const now = new Date();
@@ -15,6 +20,23 @@ export async function cleanupExpiredAuthRecords(env: Env) {
 	await db.batch([
 		db.delete(sessions).where(lt(sessions.expiresAt, now)),
 		db.delete(loginAttempts).where(lt(loginAttempts.attemptedAt, new Date(now.getTime() - LOGIN_ATTEMPT_RETENTION_MS))),
+	]);
+}
+
+/**
+ * Retention pruning for the high-volume tables. Runs once per day from the rollup cron.
+ *
+ * At 20 monitors on 5-minute checks the `checks` table alone holds ~40k rows; running these
+ * deletes every 5 minutes would scan the whole table each time and blow past D1's free-tier
+ * "rows read" budget (~5M/day). Each column filtered below is backed by a single-column index
+ * so the delete only scans the expiring slice, and running daily keeps that scan to ~one day
+ * of rows.
+ */
+export async function cleanupStaleData(env: Env) {
+	const db = getDb(env);
+	const now = new Date();
+
+	await db.batch([
 		db.delete(checks).where(lt(checks.checkedAt, new Date(now.getTime() - CHECK_RETENTION_MS))),
 		db.delete(monitorDailyStats).where(lt(monitorDailyStats.day, new Date(now.getTime() - DAILY_STATS_RETENTION_MS))),
 		db.delete(notificationDeliveries).where(lt(notificationDeliveries.createdAt, new Date(now.getTime() - DELIVERY_RETENTION_MS))),