feat: codified backtests, honest docs, belt-and-braces serving, perf fixes

Retrained on the gap-filled DB (592k -> 976k rows) and re-examined the
flood backtests, now reproducible via scripts/backtest_render.py (renders
the three docs/img charts and gates on a >=12h 2024 first-alert lead —
currently failing by design and documented as such).

Findings, all documented in FLOOD_FORECASTING.md: the true 2024 crossing
was 24 Sep 17:00 (8h earlier than recorded; confirmed against the
independent HII sensor), the historical 24h-warning claim was partly a
missing-data artifact, and retrained warn classifiers collapse on the
filled grid (P.1 24h PR-AUC 0.900 -> 0.288) while regression MAE improves
(11.3 -> 10.5 cm). Serving therefore becomes max(classifier,
sigmoid(regression)) so alerting is never worse than the regression path;
metrics table, head-gating tiers, honest-limits and runbook expectations
all updated to the current model (hgb-v1+d2d0e65).

Perf, from Locust load testing (scripts/locustfile.py + load_test.py):
single-flight lock around /forecast inference (concurrent cache misses
previously each ran ~18s inference and starved the shared thread pool;
200-user run after: 105 rps, 0.01% errors), and /measurements/latest +
/health moved off the event loop (synchronous DB/network calls in async
handlers were stalling every request under load).

scripts/backtest_render.py

@@ -0,0 +1,253 @@
+#!/usr/bin/env python3
+"""Regenerate the documented P.1 flood-backtest charts in docs/img/.
+
+For each chart an eval-only model (regression 24 h peak + warning classifier)
+is trained on data STRICTLY BEFORE the event, then the event window is walked
+hour by hour exactly as the live system would have seen it:
+
+  backtest-2024-p1.png         Oct 2024 record flood, trained < 1 Sep 2024
+  backtest-2024-p1-detail.png  22-28 Sep 2024 zoom of the first crossing
+  backtest-2025-p1.png         Sep 2025 flood, deployed config (trained <= 2024)
+
+This codifies the previously prose-only acceptance test: the run fails with a
+non-zero exit if the model gives less than 12 h of warning before the first
+3.70 m crossing of the 2024 event.
+
+Usage:
+    python scripts/backtest_render.py                 # uses FLOOD_ML_DB_URL/Config
+    python scripts/backtest_render.py --db-url postgresql://...
+"""
+
+import argparse
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), ".."))
+
+import matplotlib
+
+matplotlib.use("Agg")
+import matplotlib.dates as mdates
+import matplotlib.pyplot as plt
+import pandas as pd
+
+from src.ml import data, features
+from src.ml.train import _make_classifier, _make_regressor
+
+STATION = "P.1"
+STAGE1 = 3.70  # official Chiang Mai stage 1 - city flooding begins
+STAGE7 = 4.60  # stage 7 - widespread
+HORIZON = 24
+
+INK = "#132b35"
+BLUE = "#1c6ea4"
+AMBER = "#c07d10"
+RED = "#d9534f"
+
+
+def fit_backtest_model(df_long: pd.DataFrame, train_end: str):
+    """Train the 24 h regression + warning heads on rows <= train_end only."""
+    X, Y, _meta = features.build_matrix(df_long, STATION, (HORIZON,))
+    train_mask = X.index <= pd.Timestamp(train_end)
+    X_train, Y_train = X.loc[train_mask], Y.loc[train_mask]
+
+    max_col, warn_col = f"max_level_{HORIZON}", f"exceed_warn_{HORIZON}"
+    reg_rows = Y_train[max_col].notna()
+    reg = _make_regressor().fit(X_train.loc[reg_rows], Y_train.loc[reg_rows, max_col])
+    warn_rows = Y_train[warn_col].notna()
+    clf = _make_classifier().fit(
+        X_train.loc[warn_rows], Y_train.loc[warn_rows, warn_col].astype(int)
+    )
+    return X, reg, clf
+
+
+def event_series(df_long, X, reg, clf, window_start: str, window_end: str):
+    """Observed level plus the forecasts the model would have issued hourly."""
+    grid = features.make_hourly_grid(df_long)
+    # observed has MultiIndex columns (station_code, field)
+    observed = grid.observed[(STATION, "water_level")]
+    observed = observed.loc[window_start:window_end].dropna().astype(float)
+
+    Xw = X.loc[window_start:window_end]
+    forecasts = pd.DataFrame(index=Xw.index)
+    forecasts["pred_max"] = reg.predict(Xw)
+    # Belt-and-braces probability: the classifier OR the regression-sigmoid,
+    # whichever is more alarmed. The classifier alone proved unreliable on
+    # out-of-distribution extremes (silent on the 2024 record flood).
+    import numpy as np
+    p_clf = clf.predict_proba(Xw)[:, 1]
+    p_sig = 1.0 / (1.0 + np.exp(-(forecasts["pred_max"] - STAGE1) / 0.15))
+    forecasts["p_flood"] = np.maximum(p_clf, p_sig)
+
+    flood_start = observed[observed >= STAGE1].index.min()
+    alerts = forecasts[forecasts["p_flood"] >= 0.5].index
+    first_alert = alerts.min() if len(alerts) else None
+    return observed, forecasts, flood_start, first_alert
+
+
+def _style_axes(ax):
+    ax.spines[["top", "right"]].set_visible(False)
+    ax.tick_params(colors=INK, labelsize=11)
+    ax.grid(axis="y", color="#dfe9e7", linewidth=0.8)
+    ax.set_axisbelow(True)
+
+
+def render(observed, forecasts, flood_start, first_alert, out_path, *,
+           title, subtitle, detail=False, show_stage7=False, peak_note=None):
+    fig, (ax, axp) = plt.subplots(
+        2, 1, figsize=(12.6, 7.6), sharex=True,
+        gridspec_kw={"height_ratios": [2.2, 1], "hspace": 0.12},
+    )
+    fig.patch.set_facecolor("white")
+
+    marker = dict(marker="o", markersize=3) if detail else {}
+    ax.plot(observed.index, observed.values, color=BLUE, linewidth=2.2,
+            label="Observed level" + (" (hourly)" if detail else ""), **marker)
+    marker = dict(marker="s", markersize=3) if detail else {}
+    ax.plot(forecasts.index, forecasts["pred_max"], color=AMBER, linewidth=2,
+            linestyle="--", label="Predicted 24 h peak (issued at that hour)", **marker)
+
+    ax.axhline(STAGE1, color=RED, linewidth=1, alpha=0.65)
+    ax.annotate(f"{STAGE1:.2f} m · stage 1 · flooding begins", xy=(0.06, STAGE1),
+                xycoords=("axes fraction", "data"), xytext=(0, 5),
+                textcoords="offset points", color=RED, fontsize=10.5)
+    if show_stage7:
+        ax.axhline(STAGE7, color=RED, linewidth=1, alpha=0.65)
+        ax.annotate(f"{STAGE7:.2f} m · stage 7 · widespread", xy=(0.06, STAGE7),
+                    xycoords=("axes fraction", "data"), xytext=(0, 5),
+                    textcoords="offset points", color=RED, fontsize=10.5)
+
+    if peak_note:
+        peak_ts = observed.idxmax()
+        ax.annotate(peak_note, xy=(peak_ts, observed.max()),
+                    xytext=(12, 10), textcoords="offset points",
+                    color=BLUE, fontsize=11.5, fontweight="bold")
+
+    ax.set_ylabel("P.1 water level (m)", color=INK, fontsize=11.5)
+    ax.legend(loc="upper left", frameon=False, fontsize=10.5)
+    _style_axes(ax)
+
+    axp.plot(forecasts.index, forecasts["p_flood"], color=AMBER, linewidth=1.8)
+    axp.fill_between(forecasts.index, 0, forecasts["p_flood"],
+                     color=AMBER, alpha=0.28)
+    axp.axhline(0.5, color=INK, linewidth=0.9, linestyle=":", alpha=0.6)
+    axp.set_ylim(-0.02, 1.1)
+    axp.set_ylabel(f"P(flooding within {HORIZON} h)", color=INK, fontsize=11.5)
+    _style_axes(axp)
+
+    if first_alert is not None:
+        lead_h = None if flood_start is None else \
+            int((flood_start - first_alert).total_seconds() // 3600)
+        lead_txt = "" if lead_h is None else (
+            f"\n({lead_h} h before flooding began)" if lead_h >= 0
+            else f"\n({-lead_h} h after flooding began)"
+        )
+        if detail and flood_start is not None:
+            for a in (ax, axp):
+                a.axvline(first_alert, color=AMBER, linewidth=1.4, alpha=0.85)
+                a.axvline(flood_start, color=BLUE, linewidth=1.4, alpha=0.85)
+            # Anchor labels away from each other in chronological order so a
+            # late alert (alert AFTER crossing) cannot overprint the labels.
+            events = sorted(
+                [(first_alert, "model alert", AMBER), (flood_start, "flooding begins", BLUE)]
+            )
+            for (ts, label, color), (offset, align) in zip(events, ((-8, "right"), (8, "left"))):
+                ax.annotate(f"{label}\n{ts:%d %b %H:%M}",
+                            xy=(ts, observed.min()), xytext=(offset, 18),
+                            textcoords="offset points", ha=align,
+                            color=color, fontsize=11, fontweight="bold")
+            mid_y = observed.min() + (observed.max() - observed.min()) * 0.28
+            ax.annotate("", xy=(flood_start, mid_y), xytext=(first_alert, mid_y),
+                        arrowprops=dict(arrowstyle="<->", color=INK, lw=1.3))
+            arrow_label = (
+                f"{lead_h} h warning" if lead_h >= 0 else f"alert {-lead_h} h late"
+            )
+            ax.annotate(arrow_label,
+                        xy=(first_alert + (flood_start - first_alert) / 2, mid_y),
+                        xytext=(0, 8), textcoords="offset points", ha="center",
+                        color=INK, fontsize=11.5, fontweight="bold")
+        else:
+            axp.annotate(f"first alert · {first_alert:%d %b %H:%M}{lead_txt}",
+                         xy=(first_alert, 0.62), xytext=(10, 0),
+                         textcoords="offset points", color=RED, fontsize=10.5,
+                         bbox=dict(facecolor="white", alpha=0.75, edgecolor="none"))
+
+    locator = mdates.DayLocator(interval=1 if detail else 3)
+    axp.xaxis.set_major_locator(locator)
+    axp.xaxis.set_major_formatter(mdates.DateFormatter("%d %b"))
+    fig.suptitle(f"{title}\n{subtitle}", x=0.07, y=0.985, ha="left",
+                 fontsize=15, color=INK)
+    fig.subplots_adjust(top=0.885, left=0.07, right=0.97, bottom=0.07)
+    fig.savefig(out_path, dpi=110)
+    plt.close(fig)
+    print(f"wrote {out_path}")
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--db-url", default=None)
+    parser.add_argument("--out-dir", default=os.path.join("docs", "img"))
+    args = parser.parse_args(argv)
+
+    df = data.load_measurements(db_url=args.db_url)
+    if df.empty:
+        print("no measurement data available", file=sys.stderr)
+        return 1
+    os.makedirs(args.out_dir, exist_ok=True)
+
+    # --- October 2024 record flood: trained only on data before 1 Sep 2024 ---
+    X, reg, clf = fit_backtest_model(df, "2024-08-31")
+    obs, fc, flood_start, first_alert = event_series(
+        df, X, reg, clf, "2024-09-10", "2024-10-14 23:00")
+    peak = float(obs.max())
+    render(obs, fc, flood_start, first_alert,
+           os.path.join(args.out_dir, "backtest-2024-p1.png"),
+           title="October 2024 flood: what the model saw coming",
+           subtitle="P.1 Nawarat Bridge — model trained only on data before 1 Sep 2024",
+           show_stage7=True, peak_note=f"record peak {peak:.2f} m")
+
+    obs_d, fc_d, flood_d, alert_d = event_series(
+        df, X, reg, clf, "2024-09-21 18:00", "2024-09-28 06:00")
+    lead_h = None
+    if alert_d is not None and flood_d is not None:
+        lead_h = int((flood_d - alert_d).total_seconds() // 3600)
+    render(obs_d, fc_d, flood_d, alert_d,
+           os.path.join(args.out_dir, "backtest-2024-p1-detail.png"),
+           title="Detection in detail: 22–28 September 2024, hour by hour",
+           subtitle=(
+               f"the model alerts {lead_h} h before the river crosses the flooding line"
+               if lead_h is not None and lead_h > 0
+               else "model alert vs the river crossing the flooding line"
+           ),
+           detail=True)
+
+    # --- September 2025 flood: the deployed configuration (trained <= 2024) ---
+    X25, reg25, clf25 = fit_backtest_model(df, "2024-12-31")
+    obs25, fc25, flood25, alert25 = event_series(
+        df, X25, reg25, clf25, "2025-09-22", "2025-10-02 12:00")
+    pred_at_alert = float(fc25.loc[alert25:, "pred_max"].iloc[:24].max()) if alert25 is not None else None
+    note = f"peak {float(obs25.max()):.2f} m" + (
+        f" (predicted {pred_at_alert:.2f} m)" if pred_at_alert is not None else "")
+    render(obs25, fc25, flood25, alert25,
+           os.path.join(args.out_dir, "backtest-2025-p1.png"),
+           title="The September 2025 flood — as forecast by the deployed configuration",
+           subtitle="model trained only on data through 2024; this event was never seen in training",
+           detail=True, peak_note=note)
+
+    print(f"2024: flooding began {flood_start}, first alert {first_alert}")
+    print(f"2025: flooding began {flood25}, first alert {alert25}")
+
+    # Acceptance gate: the flagship 2024 event must keep a >= 12 h warning
+    if first_alert is None or flood_start is None:
+        print("FAIL: 2024 event alert or crossing not found", file=sys.stderr)
+        return 1
+    lead = (flood_start - first_alert).total_seconds() / 3600
+    if lead < 12:
+        print(f"FAIL: 2024 first-alert lead {lead:.0f} h < 12 h", file=sys.stderr)
+        return 1
+    print(f"PASS: 2024 first-alert lead {lead:.0f} h")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/load_test.py

@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""Staged load / client-stress test for the Ping River Monitor API + dashboard.
+
+Simulates a realistic traffic mix (dashboard page loads, the API calls the
+dashboard itself makes, heavy history queries, external API consumers) at
+increasing concurrency stages, and reports throughput, latency percentiles,
+and errors per stage plus the slowest endpoints.
+
+Run against a LOCAL instance for full stress (never full-stress production —
+it hosts live flood monitoring):
+
+    python -m uvicorn src.web_api:app --port 8125   # separate shell
+    python scripts/load_test.py http://localhost:8125
+
+A gentle production baseline (low, fixed concurrency):
+
+    python scripts/load_test.py https://water.buildfor.life --gentle
+"""
+
+import argparse
+import random
+import statistics
+import threading
+import time
+from collections import Counter
+
+import requests
+
+# Weighted endpoint mix: dashboard session + API consumers
+ENDPOINTS = [
+    ("/", 10),
+    ("/measurements/latest?limit=500", 20),
+    ("/stations", 10),
+    ("/api/hii/rainfall/latest", 15),
+    ("/api/hii/waterlevel/latest", 15),
+    ("/forecast", 10),
+    ("/api/stats", 5),
+    ("/measurements/history/P.1?hours=168", 10),
+    ("/measurements/history/P.67?hours=720", 5),
+    ("/health", 5),
+]
+POOL = [endpoint for endpoint, weight in ENDPOINTS for _ in range(weight)]
+
+FULL_STAGES = [(10, 20), (50, 20), (200, 25)]  # (clients, seconds)
+GENTLE_STAGES = [(3, 15), (8, 15)]
+
+
+def _worker(base, stop_at, results, errors):
+    session = requests.Session()
+    while time.time() < stop_at:
+        path = random.choice(POOL)
+        start = time.perf_counter()
+        try:
+            response = session.get(f"{base}{path}", timeout=30)
+            elapsed = time.perf_counter() - start
+            if response.status_code == 200:
+                results.append((path, elapsed))
+            else:
+                errors.append((path, response.status_code))
+        except Exception as error:
+            errors.append((path, type(error).__name__))
+
+
+def _pct(values, p):
+    if len(values) >= 100:
+        return statistics.quantiles(values, n=100)[p - 1]
+    return max(values)
+
+
+def run_stage(base, clients, seconds):
+    results, errors = [], []
+    stop_at = time.time() + seconds
+    threads = [
+        threading.Thread(
+            target=_worker, args=(base, stop_at, results, errors), daemon=True
+        )
+        for _ in range(clients)
+    ]
+    for thread in threads:
+        thread.start()
+    for thread in threads:
+        thread.join(timeout=seconds + 35)
+
+    latencies = [elapsed for _, elapsed in results]
+    total = len(results) + len(errors)
+    print(f"\n== {clients} clients x {seconds}s ==")
+    print(
+        f"requests: {total}  ok: {len(results)}  errors: {len(errors)}  "
+        f"rps: {total / seconds:.1f}"
+    )
+    if latencies:
+        print(
+            f"latency ms  p50: {statistics.median(latencies) * 1000:.0f}  "
+            f"p95: {_pct(latencies, 95) * 1000:.0f}  "
+            f"p99: {_pct(latencies, 99) * 1000:.0f}  "
+            f"max: {max(latencies) * 1000:.0f}"
+        )
+    by_endpoint = {}
+    for path, elapsed in results:
+        by_endpoint.setdefault(path, []).append(elapsed)
+    slowest = sorted(
+        by_endpoint.items(), key=lambda kv: -statistics.median(kv[1])
+    )[:4]
+    for path, values in slowest:
+        print(
+            f"  slow: {path:45} n={len(values):5} "
+            f"p50={statistics.median(values) * 1000:6.0f}ms "
+            f"max={max(values) * 1000:7.0f}ms"
+        )
+    if errors:
+        top = Counter(f"{path} {code}" for path, code in errors).most_common(5)
+        print(f"  errors: {top}")
+    return {"clients": clients, "total": total, "errors": len(errors)}
+
+
+def main(argv=None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("base", nargs="?", default="http://localhost:8125")
+    parser.add_argument(
+        "--gentle",
+        action="store_true",
+        help="low fixed concurrency (safe for the production instance)",
+    )
+    args = parser.parse_args(argv)
+    base = args.base.rstrip("/")
+
+    # Warm caches first so stage 1 doesn't measure cold-start work
+    for path in ("/forecast", "/api/stats", "/measurements/latest?limit=500"):
+        try:
+            requests.get(f"{base}{path}", timeout=60)
+        except Exception:
+            pass
+
+    print(f"target: {base}  mode: {'gentle' if args.gentle else 'full'}")
+    stages = GENTLE_STAGES if args.gentle else FULL_STAGES
+    summary = [run_stage(base, clients, seconds) for clients, seconds in stages]
+    worst = max(
+        (stage["errors"] / stage["total"] for stage in summary if stage["total"]),
+        default=1.0,
+    )
+    print(f"\nworst-stage error rate: {worst:.1%}")
+    return 0 if worst < 0.05 else 1
+
+
+if __name__ == "__main__":
+    import sys
+
+    sys.exit(main())

scripts/locustfile.py

@@ -0,0 +1,93 @@
+"""Locust load profile for the Ping River Monitor API + dashboard.
+
+Two user types mirror real traffic: dashboard visitors (page + the API calls
+the page makes, polling like the auto-refresh does) and API consumers
+(direct endpoint hits, including heavy history queries).
+
+Full stress against a LOCAL instance (never full-stress production — it hosts
+live flood monitoring):
+
+    # separate shell: python -m uvicorn src.web_api:app --port 8125
+    .venv/Scripts/python.exe -m locust -f scripts/locustfile.py \
+        --host http://localhost:8125 --headless \
+        --users 200 --spawn-rate 20 --run-time 2m \
+        --html load-report.html
+
+Interactive UI instead: drop --headless and open http://localhost:8089.
+"""
+
+import random
+
+from locust import FastHttpUser, between, task
+
+
+class DashboardVisitor(FastHttpUser):
+    """A browser session: initial page load, then periodic refresh polling."""
+
+    weight = 3
+    wait_time = between(2, 6)
+
+    def on_start(self):
+        # What one real page load requests
+        self.client.get("/")
+        self.client.get("/stations")
+        self.client.get("/measurements/latest?limit=500")
+        self.client.get("/api/hii/waterlevel/latest")
+        self.client.get("/api/hii/rainfall/latest")
+
+    @task(4)
+    def poll_latest(self):
+        self.client.get("/measurements/latest?limit=500")
+
+    @task(2)
+    def poll_forecast(self):
+        self.client.get("/forecast")
+
+    @task(2)
+    def poll_rain(self):
+        self.client.get("/api/hii/rainfall/latest")
+
+    @task(1)
+    def view_history(self):
+        station = random.choice(["P.1", "P.67", "P.103", "P.75", "P.20"])
+        hours = random.choice([24, 168, 720])
+        self.client.get(
+            f"/measurements/history/{station}?hours={hours}",
+            name="/measurements/history/[station]",
+        )
+
+    @task(1)
+    def stats(self):
+        self.client.get("/api/stats")
+
+
+class ApiConsumer(FastHttpUser):
+    """A script/integration hitting the JSON API directly, no think time."""
+
+    weight = 1
+    wait_time = between(0.1, 1)
+
+    @task(3)
+    def latest(self):
+        self.client.get("/measurements/latest?limit=100")
+
+    @task(3)
+    def hii_feeds(self):
+        self.client.get(random.choice(
+            ["/api/hii/waterlevel/latest", "/api/hii/rainfall/latest"]
+        ), name="/api/hii/[feed]/latest")
+
+    @task(2)
+    def forecast(self):
+        self.client.get("/forecast")
+
+    @task(2)
+    def heavy_history(self):
+        self.client.get(
+            "/measurements/history/P.1?hours=8760",
+            name="/measurements/history/P.1 [heavy]",
+        )
+
+    @task(1)
+    def health(self):
+        self.client.get("/health")