rails_error_dashboard 0.12.0 → 0.13.0

data/lib/rails_error_dashboard/configuration.rb

@@ -157,6 +157,8 @@ module RailsErrorDashboard
     attr_accessor :notification_minimum_severity   # Minimum severity to notify (default: :low = notify all)
     attr_accessor :notification_cooldown_minutes    # Per-error cooldown in minutes (default: 5, 0 = disabled)
     attr_accessor :notification_threshold_alerts    # Occurrence milestones that trigger notification (default: [10, 50, 100, 500, 1000])
+    attr_accessor :notification_burst_limit          # Max FIRST-OCCURRENCE notifications per window, per process (default: 10, 0 = no cap)
+    attr_accessor :notification_burst_window_seconds # Length of that window in seconds (default: 60)
 
     # Breadcrumbs (request activity trail)
     attr_accessor :enable_breadcrumbs              # Master switch (default: false)
@@ -302,7 +304,8 @@ module RailsErrorDashboard
 
       @use_separate_database = ENV.fetch("USE_SEPARATE_ERROR_DB", "false") == "true"
 
-      # Retention policy - days to keep errors before automatic deletion (default: 90)
+      # Retention policy - days an error may go unseen (last_seen_at) before it is
+      # deleted automatically (default: 90). An error still occurring is kept.
       # Set to nil to keep errors forever (not recommended for production)
       # Schedule cleanup: RailsErrorDashboard::RetentionCleanupJob.perform_later
       @retention_days = 90
@@ -384,6 +387,8 @@ module RailsErrorDashboard
       @notification_minimum_severity = :low  # Notify on all severities (current behavior)
       @notification_cooldown_minutes = 5     # 5 min cooldown per error_hash (0 = disabled)
       @notification_threshold_alerts = [ 10, 50, 100, 500, 1000 ] # Occurrence milestones
+      @notification_burst_limit = 10          # New-error notifications per window, per process (0 = no cap)
+      @notification_burst_window_seconds = 60 # One summary message replaces the rest of the window
 
       # Breadcrumbs defaults - OFF by default (opt-in)
       @enable_breadcrumbs = false         # Master switch
@@ -854,6 +859,19 @@ module RailsErrorDashboard
         errors << "notification_threshold_alerts must be an Array (got: #{notification_threshold_alerts.class})"
       end
 
+      # Validate the first-occurrence burst cap (non-negative integers; 0 or nil
+      # turns the cap off)
+      {
+        notification_burst_limit: notification_burst_limit,
+        notification_burst_window_seconds: notification_burst_window_seconds
+      }.each do |name, value|
+        next if value.nil?
+
+        unless value.is_a?(Integer) && value >= 0
+          errors << "#{name} must be a non-negative Integer (got: #{value.inspect})"
+        end
+      end
+
       # Log warnings (non-fatal issues)
       warnings.each do |warning|
         Rails.logger.warn "[Rails Error Dashboard] #{warning}" if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger

data/lib/rails_error_dashboard/engine.rb

@@ -71,6 +71,11 @@ module RailsErrorDashboard
         next
       end
 
+      # Resolve the running commit now (three small file reads, memoised, never
+      # raises) so that no capture ever pays for it. Skipped when the SHA is
+      # configured: then it is never consulted.
+      RailsErrorDashboard.detected_git_sha if RailsErrorDashboard.configuration.git_sha.blank?
+
       if RailsErrorDashboard.configuration.enable_error_subscriber
         Rails.error.subscribe(RailsErrorDashboard::ErrorReporter.new)
       end
@@ -188,6 +193,16 @@ module RailsErrorDashboard
       # Enable TracePoint(:raise) + TracePoint(:rescue) for swallowed exception detection
       if RailsErrorDashboard.configuration.detect_swallowed_exceptions
         RailsErrorDashboard::Services::SwallowedExceptionTracker.enable!
+
+        # Drain buffered counts at the end of every request and job. Without
+        # this the buffer is only ever drained by a LATER rescue on the SAME
+        # thread, so a swallowed exception that happens once stays invisible
+        # until the process exits. to_complete fires after the response body
+        # is closed, so it never delays a request (safety rule 2); the flush is
+        # deadline-gated, so a flood is still one write per interval.
+        Rails.application.executor.to_complete do
+          RailsErrorDashboard::Services::SwallowedExceptionTracker.flush_if_due!
+        end
       end
 
       # Import crash files from previous process death, then register at_exit hook

data/lib/rails_error_dashboard/queries/analytics_stats.rb

@@ -17,7 +17,7 @@ module RailsErrorDashboard
 
       def call
         # Cache analytics data for 5 minutes to reduce database load
-        # Cache key includes days parameter and last error update timestamp
+        # Cache key includes the days parameter and the cache generation
         Rails.cache.fetch(cache_key, expires_in: 5.minutes) do
           {
             days: @days,
@@ -41,13 +41,14 @@ module RailsErrorDashboard
         # - Query class name
         # - Days parameter (different time ranges = different caches)
         # - Application ID (per-app caching)
-        # - Last error update timestamp (auto-invalidates when errors change)
+        # - The cache generation (bumped by user actions; see AnalyticsCacheManager).
+        #   Captures do not bump it: they rely on the 5-minute TTL.
         # - Start date (ensures correct time window)
         [
           "analytics_stats",
           @days,
           @application_id || "all",
-          base_scope.maximum(:updated_at)&.to_i || 0,
+          Services::AnalyticsCacheManager.generation,
           @start_date.to_date.to_s
         ].join("/")
       end
@@ -64,29 +65,45 @@ module RailsErrorDashboard
         base_scope.where("occurred_at >= ?", @start_date)
       end
 
+      # Two counting units, kept distinct on purpose.
+      #
+      # An ErrorLog row is a GROUP; its occurrence_count says how many times
+      # that error actually happened. Volume figures are EVENTS (the sum), so
+      # this page agrees with the Overview, which counts the same way. Resolved
+      # and unresolved stay GROUP counts -- a group is the thing that gets
+      # resolved, and an event cannot be.
       def error_statistics
         {
-          total: base_query.count,
+          total: event_count,
+          total_groups: base_query.count,
           unresolved: base_query.unresolved.count,
-          by_type: base_query.group(:error_type).count.sort_by { |_, count| -count }.to_h,
-          by_day: base_query.group("DATE(occurred_at)").count
+          resolved: base_query.resolved.count,
+          by_type: base_query.group(:error_type).sum(:occurrence_count).sort_by { |_, count| -count }.to_h,
+          by_day: base_query.group("DATE(occurred_at)").sum(:occurrence_count),
+          affected_users_incomplete: affected_users_incomplete?
         }
       end
 
+      # Total EVENTS in the window. dashboard_stats.rb and
+      # platform_comparison.rb:165 count the same way.
+      def event_count
+        base_query.sum(:occurrence_count)
+      end
+
       def errors_over_time
-        base_query.group_by_day(:occurred_at).count
+        base_query.group_by_day(:occurred_at).sum(:occurrence_count)
       end
 
       def errors_by_type
         base_query.group(:error_type)
-                  .count
+                  .sum(:occurrence_count)
                   .sort_by { |_, count| -count }
                   .first(10)
                   .to_h
       end
 
       def errors_by_platform
-        base_query.group(:platform).count
+        base_query.group(:platform).sum(:occurrence_count)
       end
 
       # NULL (captured before the column existed) is reported under :unknown
@@ -94,25 +111,81 @@ module RailsErrorDashboard
       def errors_by_environment
         return {} unless ErrorLog.column_names.include?("environment")
 
-        base_query.group(:environment).count.transform_keys { |env| env.nil? ? :unknown : env }
+        base_query.group(:environment).sum(:occurrence_count).transform_keys { |env| env.nil? ? :unknown : env }
       end
 
       def errors_by_hour
         # group_by_hour_of_day buckets into 0..23 to show diurnal patterns
         # (when in the day errors peak). The chart title says "Errors by Hour
         # of Day" — group_by_hour produced a chronological time series instead.
-        base_query.group_by_hour_of_day(:occurred_at).count
+        base_query.group_by_hour_of_day(:occurred_at).sum(:occurrence_count)
       end
 
+      # Events per user, counted from OCCURRENCE rows.
+      #
+      # The group's user_id is overwritten by each new occurrence, so grouping
+      # ErrorLog by it attributed a whole group to whoever happened to hit it
+      # last -- at most one user per group, and their "count" was a number of
+      # groups. Occurrence rows carry the user of each individual event.
+      #
+      # Storm count-only events create no occurrence row, so during a storm
+      # this is a floor; affected_users_incomplete? says when.
       def top_affected_users
         user_model = RailsErrorDashboard.configuration.user_model
 
-        base_query.where.not(user_id: nil)
-                  .group(:user_id)
-                  .count
-                  .sort_by { |_, count| -count }
-                  .first(10)
-                  .map { |user_id, count| { user_id: user_id, email: find_user_email(user_id, user_model), count: count } }
+        counts = user_event_counts
+        counts.sort_by { |_, count| -count }
+              .first(10)
+              .map { |user_id, count| { user_id: user_id, email: find_user_email(user_id, user_model), count: count } }
+      end
+
+      def user_event_counts
+        return group_user_counts unless occurrences_available?
+
+        occurrences = ErrorOccurrence.table_name
+        counts = occurrence_scope.where("#{occurrences}.occurred_at >= ?", @start_date)
+                                 .where.not(occurrences => { user_id: nil })
+                                 .group("#{occurrences}.user_id")
+                                 .count
+
+        # A user whose events predate occurrence tracking -- or whose events
+        # were shed by storm protection, which writes no occurrence row -- still
+        # belongs in the table. Fall back to the group's own user for those,
+        # taking whichever count is larger. UserImpactSummary merges the same way.
+        group_user_counts.merge(counts) { |_user, group_count, occurrence_count| [ group_count, occurrence_count ].max }
+      rescue StandardError
+        group_user_counts
+      end
+
+      def group_user_counts
+        base_query.where.not(user_id: nil).group(:user_id).sum(:occurrence_count)
+      end
+
+      # Occurrence rows joined back to error_logs, so the application filter
+      # (which the occurrence table has no column for) still applies.
+      def occurrence_scope
+        scope = ErrorOccurrence.joins(:error_log)
+        scope = scope.where(ErrorLog.table_name => { application_id: @application_id }) if @application_id.present?
+        scope
+      end
+
+      def occurrences_available?
+        defined?(ErrorOccurrence) && ErrorOccurrence.table_exists?
+      rescue StandardError
+        false
+      end
+
+      # True when the window holds more events than recorded occurrences --
+      # storm shedding dropped per-event rows, so any occurrence-derived
+      # figure (the affected-user table) is a floor, not a total.
+      def affected_users_incomplete?
+        return false unless occurrences_available?
+
+        occurrences = ErrorOccurrence.table_name
+        recorded = occurrence_scope.where("#{occurrences}.occurred_at >= ?", @start_date).count
+        recorded < event_count
+      rescue StandardError
+        false
       end
 
       def find_user_email(user_id, user_model)
@@ -122,23 +195,31 @@ module RailsErrorDashboard
         "User ##{user_id}"
       end
 
+      # Resolution rate is GROUPS over GROUPS.
+      #
+      # Volume is now measured in events, but resolving is something that
+      # happens to a group, so dividing resolved groups by total events would
+      # collapse the rate toward zero the moment any error recurred. The
+      # Overview computes this the same way (resolved / resolved + unresolved),
+      # so both pages report one rate.
+      #
+      # Same scoped relation on both sides: an unscoped numerator counted every
+      # application's resolved errors against one application's total, and the
+      # "rate" went past 100%.
       def resolution_rate
-        total = error_statistics[:total]
-        return 0 if total.zero?
-
-        # Same scoped relation as the denominator: an unscoped numerator
-        # counted every application's resolved errors against one
-        # application's total, and the "rate" went past 100%.
         resolved_count = base_query.resolved.count
-        ((resolved_count.to_f / total) * 100).round(1)
+        total_groups = resolved_count + base_query.unresolved.count
+        return 0 if total_groups.zero?
+
+        ((resolved_count.to_f / total_groups) * 100).round(1)
       end
 
       def mobile_errors_count
-        base_query.where(platform: [ "iOS", "Android" ]).count
+        base_query.where(platform: [ "iOS", "Android" ]).sum(:occurrence_count)
       end
 
       def api_errors_count
-        base_query.where("platform IS NULL OR platform = ?", "API").count
+        base_query.where("platform IS NULL OR platform = ?", "API").sum(:occurrence_count)
       end
 
       #  Pattern insights for top error types

data/lib/rails_error_dashboard/queries/baseline_stats.rb

@@ -23,6 +23,113 @@ module RailsErrorDashboard
         new(error_type, platform).weekly_baseline
       end
 
+      # Pairs considered by .current_anomalies, busiest first. A bound, so the
+      # check costs the same whether 5 or 50,000 error types are stored.
+      MAX_ANOMALY_PAIRS = 500
+      BASELINE_PRECEDENCE = %w[hourly daily weekly].freeze
+
+      # Every (error_type, platform) pair that is anomalous RIGHT NOW, for all
+      # pairs at once. Same rule as #check_current_anomaly -- the first baseline
+      # available among hourly / daily / weekly, compared against this hour /
+      # today / this week -- but in a fixed number of queries instead of about six
+      # per pair. DashboardStats calls this from the live stats broadcast, which
+      # runs inside the host app's capture path.
+      #
+      # Only pairs with an event this week are looked at: a pair with none has a
+      # count of zero, which no baseline can call anomalous.
+      #
+      # @return [Array<Hash>] error_type, platform, count, level, std_devs_above,
+      #   baseline_type. Empty on any failure -- never raises.
+      def self.current_anomalies(sensitivity: 2, application_id: nil)
+        return [] unless defined?(ErrorBaseline) && ErrorBaseline.table_exists?
+
+        counts = current_counts_by_pair(application_id: application_id)
+        return [] if counts.empty?
+
+        baselines = latest_baselines_for(counts.keys)
+
+        counts.filter_map do |(error_type, platform), windows|
+          kind = BASELINE_PRECEDENCE.find { |type| baselines[[ error_type, platform, type ]] }
+          next unless kind
+
+          baseline = baselines[[ error_type, platform, kind ]]
+          # A flat history has no spread to measure against; dividing by it
+          # makes any count above the mean infinitely anomalous.
+          next if baseline.std_dev.nil? || baseline.std_dev.zero?
+
+          count = windows.fetch(kind.to_sym)
+          level = baseline.anomaly_level(count, sensitivity: sensitivity)
+          next unless level
+
+          {
+            error_type: error_type,
+            platform: platform,
+            count: count,
+            level: level,
+            std_devs_above: baseline.std_devs_above_mean(count),
+            baseline_type: kind
+          }
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] current_anomalies failed: #{e.class}: #{e.message}")
+        []
+      end
+
+      # { [error_type, platform] => { hourly:, daily:, weekly: } } in ONE grouped
+      # query, counted in the units the baselines were built from (occurrence
+      # rows when that table exists). The week is the widest window, so it is
+      # the WHERE; the day and the hour are conditional sums inside it.
+      def self.current_counts_by_pair(application_id: nil)
+        logs = ErrorLog.table_name
+        column = Services::BaselineCalculator.time_column
+        now = Time.current
+
+        relation = if defined?(ErrorOccurrence) && ErrorOccurrence.table_exists?
+          ErrorOccurrence.joins(:error_log)
+        else
+          ErrorLog.all
+        end
+        relation = relation.where(logs => { application_id: application_id }) if application_id.present?
+
+        since = ->(time) { ErrorLog.sanitize_sql_array([ "SUM(CASE WHEN #{column} >= ? THEN 1 ELSE 0 END)", time ]) }
+
+        rows = relation
+                 .where("#{column} >= ?", now.beginning_of_week)
+                 .group("#{logs}.error_type", "#{logs}.platform")
+                 .order(Arel.sql("COUNT(*) DESC"))
+                 .limit(MAX_ANOMALY_PAIRS)
+                 .pluck(Arel.sql("#{logs}.error_type"), Arel.sql("#{logs}.platform"), Arel.sql("COUNT(*)"),
+                        Arel.sql(since.call(now.beginning_of_day)), Arel.sql(since.call(now.beginning_of_hour)))
+
+        rows.to_h do |error_type, platform, weekly, daily, hourly|
+          [ [ error_type, platform ], { weekly: weekly.to_i, daily: daily.to_i, hourly: hourly.to_i } ]
+        end
+      end
+
+      # { [error_type, platform, baseline_type] => ErrorBaseline }, the most recent
+      # row of each, in ONE query. Baseline rows accumulate (one per calculation
+      # period), so "latest" is resolved in SQL with a join on MAX(period_start)
+      # rather than by loading the history. The join form is portable to every
+      # adapter; a row-value IN is not.
+      def self.latest_baselines_for(pairs)
+        table = ErrorBaseline.table_name
+        types = pairs.map(&:first).compact.uniq
+        return {} if types.empty?
+
+        latest = ErrorBaseline.where(error_type: types, baseline_type: BASELINE_PRECEDENCE)
+                              .group(:error_type, :platform, :baseline_type)
+                              .select(:error_type, :platform, :baseline_type, "MAX(period_start) AS latest_period_start")
+
+        ErrorBaseline
+          .joins("INNER JOIN (#{latest.to_sql}) latest_baselines ON " \
+                 "latest_baselines.error_type = #{table}.error_type AND " \
+                 "latest_baselines.platform = #{table}.platform AND " \
+                 "latest_baselines.baseline_type = #{table}.baseline_type AND " \
+                 "latest_baselines.latest_period_start = #{table}.period_start")
+          .index_by { |baseline| [ baseline.error_type, baseline.platform, baseline.baseline_type ] }
+      end
+      private_class_method :current_counts_by_pair, :latest_baselines_for
+
       def initialize(error_type, platform)
         @error_type = error_type
         @platform = platform

data/lib/rails_error_dashboard/queries/dashboard_stats.rb

@@ -5,6 +5,9 @@ module RailsErrorDashboard
     # Query: Fetch dashboard statistics
     # This is a read operation that aggregates error data for the dashboard
     class DashboardStats
+      # One instance answers ONE call: several aggregates (today's event count,
+      # the 7-day trend, spike detection) are memoised on it so that they are
+      # computed once per call rather than once per card that shows them.
       def initialize(application_id: nil)
         @application_id = application_id
       end
@@ -24,7 +27,7 @@ module RailsErrorDashboard
               # rows reported five users hitting one error as "1 error today".
               # Summing is also exact during a storm: counted-only events never
               # create occurrence rows, but they DO raise occurrence_count.
-              total_today: event_count_since(Time.current.beginning_of_day),
+              total_today: today_event_count,
               total_week: event_count_since(7.days.ago),
               total_month: event_count_since(30.days.ago),
               unresolved: base_scope.unresolved.count,
@@ -93,13 +96,14 @@ module RailsErrorDashboard
       end
 
       def cache_key
-        # Cache key includes last error update timestamp for auto-invalidation
-        # Also includes current hour to ensure fresh data
-        # Uses base_scope to respect application_id filter for proper cache isolation
+        # The cache GENERATION, not maximum(:updated_at): the timestamp cost a
+        # query per key build and changed on every capture, so the cache never
+        # hit while errors were arriving. Freshness after a capture is the
+        # 1-minute TTL; user actions bump the generation (AnalyticsCacheManager).
         [
           "dashboard_stats",
           @application_id || "all",
-          base_scope.maximum(:updated_at)&.to_i || 0,
+          Services::AnalyticsCacheManager.generation,
           Time.current.hour
         ].join("/")
       end
@@ -147,7 +151,7 @@ module RailsErrorDashboard
         recorded = occurrence_scope
                      .where("#{ErrorOccurrence.table_name}.occurred_at >= ?", Time.current.beginning_of_day)
                      .count
-        recorded < event_count_since(Time.current.beginning_of_day)
+        recorded < today_event_count
       rescue StandardError
         false
       end
@@ -169,9 +173,10 @@ module RailsErrorDashboard
 
       # Get 7-day error trend (daily counts)
       def errors_trend_7d
-        base_scope.where("occurred_at >= ?", 7.days.ago)
-                  .group_by_day(:occurred_at, range: 7.days.ago.to_date..Date.current, default_value: 0)
-                  .sum(:occurrence_count)
+        @errors_trend_7d ||=
+          base_scope.where("occurred_at >= ?", 7.days.ago)
+                    .group_by_day(:occurred_at, range: 7.days.ago.to_date..Date.current, default_value: 0)
+                    .sum(:occurrence_count)
       end
 
       # Get error counts by severity for last 7 days
@@ -193,21 +198,25 @@ module RailsErrorDashboard
 
       # Detect if there's an error spike
       #  Uses baselines if available, falls back to simple 2x average
+      #
+      # Memoised: the stats hash asks twice (spike_detected and spike_info), and
+      # this runs from the live stats broadcast inside the capture path.
       def spike_detected?
-        return false if errors_trend_7d.empty?
+        return @spike_detected if defined?(@spike_detected)
 
-        today_count = event_count_since(Time.current.beginning_of_day)
+        @spike_detected = compute_spike_detected
+      end
 
-        # Try baseline-based detection first
-        if baseline_anomaly_detected?(today_count)
-          return true
-        end
+      def compute_spike_detected
+        trend = errors_trend_7d
+        return false if trend.empty?
+        return true if baseline_anomalies.any?
 
         # Fall back to simple 2x average detection
-        avg_count = errors_trend_7d.values.sum / 7.0
+        avg_count = trend.values.sum / 7.0
         return false if avg_count.zero?
 
-        today_count >= (avg_count * 2)
+        today_event_count >= (avg_count * 2)
       end
 
       # Get spike information
@@ -215,7 +224,7 @@ module RailsErrorDashboard
       def spike_info
         return nil unless spike_detected?
 
-        today_count = event_count_since(Time.current.beginning_of_day)
+        today_count = today_event_count
         avg_count = (errors_trend_7d.values.sum / 7.0).round(1)
 
         info = {
@@ -226,46 +235,35 @@ module RailsErrorDashboard
         }
 
         # Add baseline info if available
-        baseline_info = baseline_anomaly_info(today_count)
+        baseline_info = baseline_anomaly_info
         info.merge!(baseline_info) if baseline_info.present?
 
         info
       end
 
-      # Check if baseline indicates anomaly
-      def baseline_anomaly_detected?(_count)
-        return false unless defined?(Queries::BaselineStats)
+      def today_event_count
+        @today_event_count ||= event_count_since(Time.current.beginning_of_day)
+      end
+
+      # Every anomalous (error_type, platform) pair, from a fixed number of
+      # queries (BaselineStats.current_anomalies), loaded once per call. This
+      # used to be about six queries per distinct pair, run twice.
+      def baseline_anomalies
+        return @baseline_anomalies if defined?(@baseline_anomalies)
 
-        # Check most common error types for anomalies
-        base_scope.distinct.pluck(:error_type, :platform).compact.any? do |(error_type, platform)|
-          Queries::BaselineStats.new(error_type, platform)
-                                .check_current_anomaly(sensitivity: 2, application_id: @application_id)[:anomaly]
+        @baseline_anomalies = if defined?(Queries::BaselineStats)
+          Queries::BaselineStats.current_anomalies(sensitivity: 2, application_id: @application_id)
+        else
+          []
         end
       end
 
       # Get baseline anomaly information
-      def baseline_anomaly_info(_total_count)
-        return nil unless defined?(Queries::BaselineStats)
-
-        # Find the most anomalous error type
-        anomalies = base_scope.distinct.pluck(:error_type, :platform).compact.map do |(error_type, platform)|
-          result = Queries::BaselineStats.new(error_type, platform)
-                                         .check_current_anomaly(sensitivity: 2, application_id: @application_id)
-          next unless result[:anomaly]
-
-          {
-            error_type: error_type,
-            platform: platform,
-            count: result[:current_count],
-            level: result[:level],
-            std_devs_above: result[:std_devs_above]
-          }
-        end.compact
-
-        return nil if anomalies.empty?
+      def baseline_anomaly_info
+        return nil if baseline_anomalies.empty?
 
         # Return info about worst anomaly
-        worst = anomalies.max_by { |a| a[:std_devs_above] || 0 }
+        worst = baseline_anomalies.max_by { |a| a[:std_devs_above] || 0 }
         {
           baseline_detected: true,
           anomaly_error_type: worst[:error_type],
@@ -283,7 +281,7 @@ module RailsErrorDashboard
       # make a real failure percentage from, so the honest figure is the rate
       # itself, uncapped, labelled with its unit.
       def error_rate
-        today_events = event_count_since(Time.current.beginning_of_day)
+        today_events = today_event_count
         return 0.0 if today_events.zero?
 
         hours_today = ((Time.current - Time.current.beginning_of_day) / 1.hour).round(1)
@@ -299,11 +297,12 @@ module RailsErrorDashboard
       # affected user. Storm count-only events create no occurrence row, so
       # this is a floor during a storm -- affected_users_incomplete? says when.
       def affected_users_today
-        distinct_affected_users(Time.current.beginning_of_day, nil)
+        @affected_users_today ||= distinct_affected_users(Time.current.beginning_of_day, nil)
       end
 
       def affected_users_yesterday
-        distinct_affected_users(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
+        @affected_users_yesterday ||=
+          distinct_affected_users(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
       end
 
       def distinct_affected_users(from, to)
@@ -334,7 +333,13 @@ module RailsErrorDashboard
 
       # Calculate percentage change in errors (today vs yesterday)
       def trend_percentage
-        today = event_count_since(Time.current.beginning_of_day)
+        return @trend_percentage if defined?(@trend_percentage)
+
+        @trend_percentage = compute_trend_percentage
+      end
+
+      def compute_trend_percentage
+        today = today_event_count
         yesterday = event_count_between(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
 
         return 0.0 if today.zero? && yesterday.zero?

data/lib/rails_error_dashboard/queries/error_correlation.rb

@@ -224,12 +224,15 @@ module RailsErrorDashboard
         previous_start = @start_date
         previous_end = current_start
 
-        current_errors = ErrorLog
+        # Both periods come from base_query, which carries the application
+        # filter (and the window start). Querying ErrorLog directly made this
+        # the one panel on an application-filtered page that counted every app.
+        current_errors = base_query
           .where("occurred_at >= ?", current_start)
           .count
 
-        previous_errors = ErrorLog
-          .where("occurred_at >= ? AND occurred_at < ?", previous_start, previous_end)
+        previous_errors = base_query
+          .where("occurred_at < ?", previous_end)
           .count
 
         change_percentage = if previous_errors > 0

data/lib/rails_error_dashboard/queries/errors_list.rb

@@ -5,6 +5,9 @@ module RailsErrorDashboard
     # Query: Fetch errors with filtering and pagination
     # This is a read operation that returns a filtered collection of errors
     class ErrorsList
+      # Escape character for LIKE patterns; see filter_by_search.
+      LIKE_ESCAPE = "!"
+
       def self.call(filters = {})
         new(filters).call
       end
@@ -129,9 +132,19 @@ module RailsErrorDashboard
         else
           # Fall back to LIKE for SQLite/MySQL - search across all relevant fields
           # Use LOWER() for case-insensitive search
-          search_pattern = "%#{@filters[:search]}%"
+          #
+          # % and _ in the term are escaped so they match themselves: a search
+          # for "snake_case" must not match "snakeXcase", and "%" must not
+          # match every row. The escape character is named explicitly because
+          # SQLite has no default one, and it is "!" rather than a backslash
+          # because a backslash inside a quoted SQL literal means different
+          # things to MySQL and to everyone else.
+          escaped = ActiveRecord::Base.sanitize_sql_like(@filters[:search].to_s, LIKE_ESCAPE)
+          search_pattern = "%#{escaped}%"
           query.where(
-            "LOWER(message) LIKE LOWER(?) OR LOWER(COALESCE(backtrace, '')) LIKE LOWER(?) OR LOWER(error_type) LIKE LOWER(?)",
+            "LOWER(message) LIKE LOWER(?) ESCAPE '#{LIKE_ESCAPE}' " \
+            "OR LOWER(COALESCE(backtrace, '')) LIKE LOWER(?) ESCAPE '#{LIKE_ESCAPE}' " \
+            "OR LOWER(error_type) LIKE LOWER(?) ESCAPE '#{LIKE_ESCAPE}'",
             search_pattern, search_pattern, search_pattern
           )
         end

data/lib/rails_error_dashboard/queries/similar_errors.rb

@@ -78,7 +78,7 @@ module RailsErrorDashboard
           if error_prefix.present?
             candidates += ErrorLog
                             .where(platform: target_error.platform)
-                            .where("error_type LIKE ?", "%#{error_prefix}%")
+                            .where("error_type LIKE ? ESCAPE '!'", "%#{ActiveRecord::Base.sanitize_sql_like(error_prefix, "!")}%")
                             .where.not(id: target_error.id)
                             .where.not(id: candidates.map(&:id))
                             .limit(20)