rails_error_dashboard 0.12.1 → 0.13.0

data/lib/rails_error_dashboard/commands/flush_swallowed_exceptions.rb

@@ -25,8 +25,11 @@ module RailsErrorDashboard
         app_id = current_application_id
 
         # Process raise counts
+        # Keys are scrubbed before they are split: a class name or path with an
+        # invalid byte makes split/blank? raise, and the outer rescue would then
+        # drop every remaining count in the batch along with it.
         @raise_counts.each do |key, count|
-          class_name, location = key.split("|", 2)
+          class_name, location = Services::EncodingSanitizer.scrub(key.to_s).split("|", 2)
           next if class_name.blank? || location.blank?
 
           upsert_raise(class_name, location, period, app_id, count)
@@ -34,7 +37,7 @@ module RailsErrorDashboard
 
         # Process rescue counts
         @rescue_counts.each do |key, count|
-          class_name, locations = key.split("|", 2)
+          class_name, locations = Services::EncodingSanitizer.scrub(key.to_s).split("|", 2)
           next if class_name.blank? || locations.blank?
 
           raise_loc, rescue_loc = locations.split("->", 2)

data/lib/rails_error_dashboard/commands/link_existing_issue.rb

@@ -32,6 +32,7 @@ module RailsErrorDashboard
 
       def call
         return { success: false, error: red_t("red.commands.issue.url_required") } if @issue_url.blank?
+        return { success: false, error: red_t("red.commands.issue.url_invalid") } unless Services::UrlSafety.http_url?(@issue_url)
 
         error = ErrorLog.find(@error_id)
         parsed = parse_issue_url(@issue_url)

data/lib/rails_error_dashboard/commands/log_error.rb

@@ -106,12 +106,18 @@ module RailsErrorDashboard
         # FlushStormCounts#canonical_hash does for storm counts.
         identity_parts = capture_identity_parts(exception, context)
 
-        exception_data = {
+        # Scrub BEFORE anything is serialized: ActiveJob JSON-encodes the
+        # payload on this (the request) thread, and an invalid byte in the
+        # message, a backtrace line or the context would raise right here. The
+        # identity above is still taken from the raw exception, exactly as the
+        # sync path takes it, so grouping is unchanged.
+        context = Services::EncodingSanitizer.scrub_deep(context)
+        exception_data = Services::EncodingSanitizer.scrub_deep(
           class_name: exception.class.name,
           message: exception.message,
           backtrace: exception.backtrace,
           cause_chain: serialize_cause_chain(exception)
-        }
+        )
 
         # Redact BEFORE the payload crosses the queue boundary. Until now the
         # filter ran only just before the INSERT, so a durable adapter
@@ -264,6 +270,10 @@ module RailsErrorDashboard
 
         context = context.merge(request_params: filtered[:request_params]) if context.key?(:request_params)
         context = context.merge(request_url: filtered[:request_url]) if context.key?(:request_url)
+        # The raw session ID must not sit in Redis / Solid Queue either.
+        if context[:session_id]
+          context = context.merge(session_id: Services::SensitiveDataFilter.digest_session_id(context[:session_id]))
+        end
 
         [ exception_data, context ]
       rescue => e
@@ -292,7 +302,7 @@ module RailsErrorDashboard
           chain << {
             class_name: current.class.name,
             message: current.message&.to_s,
-            backtrace: current.backtrace&.first(20)&.map { |line| Services::BacktraceProcessor.shorten_gem_path(line) }
+            backtrace: current.backtrace&.first(20)&.map { |line| Services::BacktraceProcessor.shorten_gem_path(Services::EncodingSanitizer.scrub(line)) }
           }
 
           current = current.respond_to?(:cause) ? current.cause : nil
@@ -317,7 +327,10 @@ module RailsErrorDashboard
       #   Job can retry it; every other failure is still swallowed.
       def initialize(exception, context = {}, worker: false)
         @exception = exception
-        @context = context
+        # Invalid bytes anywhere in the context would raise as soon as it is
+        # JSON-encoded (ErrorContext does that in its constructor). A clean
+        # context costs one scan and its strings come back as the same objects.
+        @context = Services::EncodingSanitizer.scrub_deep(context)
         @worker = worker
       end
 
@@ -414,7 +427,7 @@ module RailsErrorDashboard
                                   ENV["GIT_SHA"] ||
                                   ENV["HEROKU_SLUG_COMMIT"] ||
                                   ENV["RENDER_GIT_COMMIT"] ||
-                                  detect_git_sha_from_command
+                                  RailsErrorDashboard.detected_git_sha
         end
 
         if ErrorLog.column_names.include?("app_version")
@@ -434,6 +447,10 @@ module RailsErrorDashboard
           attributes[:environment] = resolve_environment
         end
 
+        # Neutralise invalid bytes BEFORE filtering: the filter runs regexes,
+        # which raise on an invalid string, and PostgreSQL rejects the INSERT.
+        attributes = Services::EncodingSanitizer.scrub_deep(attributes)
+
         # Apply sensitive data filtering (on by default)
         attributes = Services::SensitiveDataFilter.filter_attributes(attributes)
 
@@ -453,14 +470,14 @@ module RailsErrorDashboard
 
           if raw_breadcrumbs.is_a?(Array) && raw_breadcrumbs.any?
             filtered = Services::BreadcrumbCollector.filter_sensitive(raw_breadcrumbs)
-            attributes[:breadcrumbs] = filtered.to_json
+            attributes[:breadcrumbs] = Services::EncodingSanitizer.scrub_deep(filtered).to_json
           end
         end
 
         # Capture system health snapshot (if enabled and column exists)
         if !storm_lite && ErrorLog.column_names.include?("system_health") && RailsErrorDashboard.configuration.enable_system_health
           health_data = @context[:_serialized_system_health] || Services::SystemHealthSnapshot.capture
-          attributes[:system_health] = health_data.to_json
+          attributes[:system_health] = Services::EncodingSanitizer.scrub_deep(health_data).to_json
         end
 
         # Capture local variables (if enabled and column exists)
@@ -472,7 +489,7 @@ module RailsErrorDashboard
             raw_locals ||= @context[:_serialized_local_variables]
             if raw_locals.is_a?(Hash) && raw_locals.any?
               serialized = raw_locals == @context[:_serialized_local_variables] ? raw_locals : Services::VariableSerializer.call(raw_locals)
-              attributes[:local_variables] = serialized.to_json
+              attributes[:local_variables] = Services::EncodingSanitizer.scrub_deep(serialized).to_json
             end
           rescue => e
             RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] Local variable serialization failed: #{e.message}")
@@ -496,7 +513,7 @@ module RailsErrorDashboard
                   additional_filter_patterns: RailsErrorDashboard.configuration.instance_variable_filter_patterns
                 )
               end
-              attributes[:instance_variables] = serialized.to_json
+              attributes[:instance_variables] = Services::EncodingSanitizer.scrub_deep(serialized).to_json
             end
           rescue => e
             RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] Instance variable serialization failed: #{e.message}")
@@ -532,13 +549,16 @@ module RailsErrorDashboard
               occurred_at: attributes[:occurred_at],
               user_id: attributes[:user_id],
               request_id: error_context.request_id,
-              session_id: error_context.session_id
+              # Digest, not the raw ID -- it is a bearer credential. Idempotent,
+              # so a value already digested at the queue boundary passes through.
+              session_id: Services::SensitiveDataFilter.storable_session_id(error_context.session_id)
             }
             # The release THIS event happened under. The group keeps its first
             # release; per-release counts come from here (ReleaseTimeline).
             occurrence_columns = ErrorOccurrence.column_names
             occurrence_attrs[:app_version] = attributes[:app_version] if occurrence_columns.include?("app_version")
             occurrence_attrs[:git_sha] = attributes[:git_sha] if occurrence_columns.include?("git_sha")
+            occurrence_attrs = Services::EncodingSanitizer.scrub_deep(occurrence_attrs)
             ErrorOccurrence.create(ErrorOccurrence.clamp_string_attributes(occurrence_attrs))
           rescue => e
             RailsErrorDashboard::Logger.error("Failed to create error occurrence: #{e.message}")
@@ -548,12 +568,12 @@ module RailsErrorDashboard
         # Send notifications for new errors and reopened errors (with throttling).
         # Muted errors skip notification dispatch but still fire plugin events.
         if error_log.occurrence_count == 1
-          maybe_notify(error_log) { Services::NotificationThrottler.severity_meets_minimum?(error_log) }
+          maybe_notify(error_log, first_occurrence: true) { Services::NotificationThrottler.severity_meets_minimum?(error_log) }
           PluginRegistry.dispatch(:on_error_logged, error_log)
           trigger_callbacks(error_log)
           emit_instrumentation_events(error_log)
         elsif error_log.just_reopened
-          maybe_notify(error_log) { Services::NotificationThrottler.should_notify?(error_log) }
+          maybe_notify(error_log, respect_cooldown: true) { Services::NotificationThrottler.severity_meets_minimum?(error_log) }
           PluginRegistry.dispatch(:on_error_reopened, error_log)
           trigger_callbacks(error_log)
           emit_instrumentation_events(error_log)
@@ -590,14 +610,30 @@ module RailsErrorDashboard
       # Muted errors skip notifications but still fire plugin events/callbacks.
       # During a storm (breaker not closed) per-error notifications are
       # suppressed — a single storm notification replaces them.
-      def maybe_notify(error_log)
+      #
+      # respect_cooldown is true only for the reopened path, which is the only one
+      # the cooldown has ever applied to: a first occurrence and a threshold
+      # milestone always notify. They still stamp the row, so an error reopened
+      # minutes after its first notification is throttled.
+      def maybe_notify(error_log, respect_cooldown: false, first_occurrence: false)
         return if error_log.muted?
+        # wont_fix: the team has decided not to act on this error, so its
+        # recurrences are counted and nothing else. Plugin events still fire,
+        # exactly as they do for a muted error.
+        return if error_log.status.to_s == "wont_fix"
         return if Services::StormProtection::Gate.notifications_suppressed?
         return unless Services::NotificationThrottler.environment_allowed?(error_log)
         return unless yield
+        return if first_occurrence && burst_capped?
+
+        # Claim, THEN send. The claim is a conditional UPDATE only one process can
+        # win, so N workers reopening the same error send one notification, not
+        # N. The price: if the send below fails, this error is not retried inside
+        # the cooldown window. Recording after sending is what let every process
+        # through.
+        return unless Services::NotificationThrottler.claim!(error_log, respect_cooldown: respect_cooldown)
 
         Services::ErrorNotificationDispatcher.call(error_log)
-        Services::NotificationThrottler.record_notification(error_log)
       rescue => e
         # The error row is already written by the time we get here. A channel
         # that cannot be reached (Redis down for the Slack job's enqueue, a
@@ -608,6 +644,37 @@ module RailsErrorDashboard
         )
       end
 
+      # A bad deploy can produce hundreds of DISTINCT new errors, each a first
+      # occurrence the per-error cooldown never sees. Past
+      # config.notification_burst_limit per window, new-error notifications are
+      # held back and ONE summary says so. Asked only for first occurrences that
+      # were otherwise going to notify, and before the cooldown claim, so a
+      # suppressed error is not stamped as notified. The error itself is already
+      # stored; only the notification is dropped.
+      def burst_capped?
+        # Nothing can notify, so there is nothing to cap, and no summary to enqueue.
+        return false unless Services::ErrorNotificationDispatcher.any_channel?
+
+        case Services::NotificationThrottler.burst_decision
+        when :summarize
+          config = RailsErrorDashboard.configuration
+          NotificationBurstSummaryJob.perform_later(
+            limit: config.notification_burst_limit.to_i,
+            window_seconds: config.notification_burst_window_seconds.to_i,
+            locale: ApplicationJob.enqueue_locale
+          )
+          true
+        when :suppress
+          true
+        else
+          false
+        end
+      rescue => e
+        # Fail-open: a cap that cannot decide must not cost a notification.
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] burst cap check failed: #{e.class}: #{e.message}")
+        false
+      end
+
       # The environment this error is attributed to: an explicit context value
       # (truncated to the column) or the process-wide resolution. Never nil.
       def resolve_environment
@@ -704,6 +771,7 @@ module RailsErrorDashboard
         # Return early if baseline alerts are disabled or error is muted
         return unless config.enable_baseline_alerts
         return if error_log.muted?
+        return if error_log.status.to_s == "wont_fix" # see maybe_notify
         return unless Services::NotificationThrottler.environment_allowed?(error_log)
         return unless defined?(Queries::BaselineStats)
         return unless defined?(BaselineAlertJob)
@@ -760,15 +828,6 @@ module RailsErrorDashboard
         nil
       end
 
-      # Detect git SHA from git command (fallback)
-      def detect_git_sha_from_command
-        return nil unless File.exist?(Rails.root.join(".git"))
-        `git rev-parse --short HEAD 2>/dev/null`.strip.presence
-      rescue => e
-        RailsErrorDashboard::Logger.debug("Could not detect git SHA: #{e.message}")
-        nil
-      end
-
       # Detect app version from VERSION file (fallback)
       def detect_version_from_file
         version_file = Rails.root.join("VERSION")

data/lib/rails_error_dashboard/commands/mute_error.rb

@@ -32,6 +32,7 @@ module RailsErrorDashboard
           muted_reason: @reason
         )
 
+        Services::AnalyticsCacheManager.clear
         PluginRegistry.dispatch(:on_error_muted, error)
         error
       end

data/lib/rails_error_dashboard/commands/resolve_error.rb

@@ -25,6 +25,8 @@ module RailsErrorDashboard
           resolution_reference: @resolution_data[:resolution_reference],
           status: "resolved"
         )
+        # The stat cards are cached; a user action must show up at once.
+        Services::AnalyticsCacheManager.clear
 
         # Dispatch plugin event for resolved error
         PluginRegistry.dispatch(:on_error_resolved, error)

data/lib/rails_error_dashboard/commands/scrub_invalid_encoding.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Commands
+    # Command: repair rows that were stored with invalid bytes
+    #
+    # New captures are scrubbed on the way in (Services::EncodingSanitizer), but
+    # that does nothing for rows already in the table. SQLite and MySQL accept
+    # invalid UTF-8 and NUL bytes, and a row holding them makes the pages that
+    # render it answer 500. PostgreSQL rejects such rows at INSERT, so there is
+    # normally nothing to repair there; the scan is harmless.
+    #
+    # Behind `rake error_dashboard:scrub_invalid_encoding`. Safe to re-run: a
+    # second pass finds nothing to repair.
+    #
+    # @example
+    #   ScrubInvalidEncoding.call # => { scanned: 1200, repaired: 3, unreadable: [] }
+    class ScrubInvalidEncoding
+      BATCH_SIZE = 500
+
+      MODEL_NAMES = %w[ErrorLog ErrorOccurrence].freeze
+
+      def self.call(batch_size: BATCH_SIZE)
+        new(batch_size: batch_size).call
+      end
+
+      def initialize(batch_size: BATCH_SIZE)
+        @batch_size = batch_size
+        @scanned = 0
+        @repaired = 0
+        @unreadable = []
+      end
+
+      # @return [Hash] { scanned:, repaired:, unreadable: [ "ErrorLog#12", ... ] }
+      def call
+        models.each { |model| scrub_model(model) }
+
+        { scanned: @scanned, repaired: @repaired, unreadable: @unreadable }
+      end
+
+      private
+
+      def models
+        MODEL_NAMES.filter_map do |name|
+          model = RailsErrorDashboard.const_get(name)
+          model if model.table_exists?
+        rescue => e
+          RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] ScrubInvalidEncoding skipped #{name}: #{e.class}")
+          nil
+        end
+      end
+
+      def scrub_model(model)
+        columns = model.columns.select { |column| %i[string text].include?(column.type) }.map(&:name)
+        return if columns.empty?
+
+        model.in_batches(of: @batch_size) do |batch|
+          ids = batch.pluck(model.primary_key)
+          load_rows(model, ids).each { |row| scrub_row(row, columns) }
+        end
+      end
+
+      # One query per batch; if that batch cannot be materialised at all, fall
+      # back to row-by-row so a single unreadable row is reported by id instead
+      # of hiding the 499 readable ones around it.
+      def load_rows(model, ids)
+        model.where(model.primary_key => ids).to_a
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] ScrubInvalidEncoding batch read failed: #{e.class}")
+        ids.filter_map do |id|
+          model.find(id)
+        rescue => row_error
+          @unreadable << "#{model.name.demodulize}##{id} (#{row_error.class})"
+          nil
+        end
+      end
+
+      def scrub_row(row, columns)
+        @scanned += 1
+
+        changes = columns.each_with_object({}) do |column, fixed|
+          value = row.read_attribute(column)
+          next unless value.is_a?(String)
+
+          clean = Services::EncodingSanitizer.scrub(value)
+          fixed[column] = clean unless clean.equal?(value) || clean == value
+        end
+        # The model scrubs invalid strings as it loads a row, so by now they
+        # read as clean. It remembers which ones it had to repair.
+        row.invalid_encoding_attributes.each do |column|
+          changes[column] = row.read_attribute(column) if columns.include?(column)
+        end
+        return if changes.empty?
+
+        # update_columns: no callbacks, no validations, no updated_at bump. This
+        # is a byte-level repair, not an edit.
+        row.update_columns(changes)
+        @repaired += 1
+      rescue => e
+        @unreadable << "#{row.class.name.demodulize}##{row.id} (#{e.class})"
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/commands/snooze_error.rb

@@ -4,7 +4,14 @@ module RailsErrorDashboard
   module Commands
     # Command: Snooze an error for a given number of hours
     # This is a write operation that sets snoozed_until and optionally creates a comment
+    # Returns {success: bool, error: ErrorLog}; a failure also carries
+    # reason: :invalid_hours and writes nothing.
     class SnoozeError
+      # 30 days. The form offers at most a week; the cap is for anything that
+      # does not come from the form. Without one, a negative value "snoozed"
+      # into the past and a huge one overflowed the timestamp.
+      MAX_SNOOZE_HOURS = 720
+
       def self.call(error_id, hours:, reason: nil)
         new(error_id, hours, reason).call
       end
@@ -17,18 +24,35 @@ module RailsErrorDashboard
 
       def call
         error = ErrorLog.find(@error_id)
-        snooze_until = @hours.hours.from_now
-
-        # Store snooze reason in comments if provided
-        if @reason.present?
-          error.comments.create!(
-            author_name: error.assigned_to || "System",
-            body: "Snoozed for #{@hours} hours: #{@reason}"
-          )
+        hours = whole_hours(@hours)
+
+        unless hours && (1..MAX_SNOOZE_HOURS).cover?(hours)
+          return { success: false, error: error, reason: :invalid_hours }
+        end
+
+        error.transaction do
+          if @reason.present?
+            error.comments.create!(
+              author_name: error.assigned_to || "System",
+              body: "Snoozed for #{hours} hours: #{@reason}"
+            )
+          end
+
+          error.update!(snoozed_until: hours.hours.from_now)
         end
 
-        error.update!(snoozed_until: snooze_until)
-        error
+        { success: true, error: error }
+      end
+
+      private
+
+      # An Integer, or a String that is one ("24"). Anything else -- a Float, a
+      # nested parameter, "abc" -- is nil rather than a guess.
+      def whole_hours(value)
+        case value
+        when Integer then value
+        when String then Integer(value.strip, 10, exception: false)
+        end
       end
     end
   end

data/lib/rails_error_dashboard/commands/unmute_error.rb

@@ -22,6 +22,7 @@ module RailsErrorDashboard
           muted_reason: nil
         )
 
+        Services::AnalyticsCacheManager.clear
         PluginRegistry.dispatch(:on_error_unmuted, error)
         error
       end

data/lib/rails_error_dashboard/commands/update_error_priority.rb

@@ -4,6 +4,8 @@ module RailsErrorDashboard
   module Commands
     # Command: Update the priority level of an error
     # This is a write operation that updates the priority_level field on an ErrorLog record
+    # Returns {success: bool, error: ErrorLog}; a failure also carries
+    # reason: :invalid_priority and leaves the existing priority alone.
     class UpdateErrorPriority
       def self.call(error_id, priority_level:)
         new(error_id, priority_level).call
@@ -16,8 +18,27 @@ module RailsErrorDashboard
 
       def call
         error = ErrorLog.find(@error_id)
-        error.update!(priority_level: @priority_level)
-        error
+        level = whole_number(@priority_level)
+
+        # The column is an integer, so an unchecked "x" was cast and stored as
+        # 0 -- silently replacing a real priority with Low.
+        unless ErrorLog::PRIORITY_LEVELS.key?(level)
+          return { success: false, error: error, reason: :invalid_priority }
+        end
+
+        error.update!(priority_level: level)
+        { success: true, error: error }
+      end
+
+      private
+
+      # An Integer, or a String that is one ("3"). A nested parameter, a Float
+      # or free text is nil.
+      def whole_number(value)
+        case value
+        when Integer then value
+        when String then Integer(value.strip, 10, exception: false)
+        end
       end
     end
   end

data/lib/rails_error_dashboard/commands/update_error_status.rb

@@ -4,7 +4,8 @@ module RailsErrorDashboard
   module Commands
     # Command: Update the status of an error with optional comment
     # This is a write operation that validates transitions and updates status
-    # Returns {success: bool, error: ErrorLog}
+    # Returns {success: bool, error: ErrorLog}; a failure also carries
+    # reason: :unknown_status or :invalid_transition so the caller can say which.
     class UpdateErrorStatus
       def self.call(error_id, status:, comment: nil)
         new(error_id, status, comment).call
@@ -19,15 +20,17 @@ module RailsErrorDashboard
       def call
         error = ErrorLog.find(@error_id)
 
+        # A nested param arrives as a Hash-like object, never a known status.
+        unless @status.is_a?(String) && ErrorLog::STATUSES.include?(@status)
+          return { success: false, error: error, reason: :unknown_status }
+        end
+
         unless error.can_transition_to?(@status)
-          return { success: false, error: error }
+          return { success: false, error: error, reason: :invalid_transition }
         end
 
         error.transaction do
-          error.update!(status: @status)
-
-          # Auto-resolve if status is "resolved"
-          error.update!(resolved: true) if @status == "resolved"
+          error.update!(status_attributes(error))
 
           # Add comment about status change
           if @comment.present?
@@ -38,8 +41,32 @@ module RailsErrorDashboard
           end
         end
 
+        # The stat cards are cached; a user action must show up at once.
+        Services::AnalyticsCacheManager.clear
+
         { success: true, error: error }
       end
+
+      private
+
+      # One write, so the three columns can never disagree. resolved_at is what
+      # MTTR is computed from: leaving it nil (as this command used to) dropped
+      # every error resolved through the status workflow from the MTTR figures,
+      # and leaving it set on a reopened error kept a stale resolution time.
+      # Only "resolved" sets the flag -- wont_fix stays resolved: false.
+      def status_attributes(error)
+        attrs = { status: @status }
+
+        if @status == "resolved"
+          attrs[:resolved] = true
+          attrs[:resolved_at] = Time.current
+        elsif error.status == "resolved" || error.resolved?
+          attrs[:resolved] = false
+          attrs[:resolved_at] = nil
+        end
+
+        attrs
+      end
     end
   end
 end

data/lib/rails_error_dashboard/configuration.rb

@@ -157,6 +157,8 @@ module RailsErrorDashboard
     attr_accessor :notification_minimum_severity   # Minimum severity to notify (default: :low = notify all)
     attr_accessor :notification_cooldown_minutes    # Per-error cooldown in minutes (default: 5, 0 = disabled)
     attr_accessor :notification_threshold_alerts    # Occurrence milestones that trigger notification (default: [10, 50, 100, 500, 1000])
+    attr_accessor :notification_burst_limit          # Max FIRST-OCCURRENCE notifications per window, per process (default: 10, 0 = no cap)
+    attr_accessor :notification_burst_window_seconds # Length of that window in seconds (default: 60)
 
     # Breadcrumbs (request activity trail)
     attr_accessor :enable_breadcrumbs              # Master switch (default: false)
@@ -302,7 +304,8 @@ module RailsErrorDashboard
 
       @use_separate_database = ENV.fetch("USE_SEPARATE_ERROR_DB", "false") == "true"
 
-      # Retention policy - days to keep errors before automatic deletion (default: 90)
+      # Retention policy - days an error may go unseen (last_seen_at) before it is
+      # deleted automatically (default: 90). An error still occurring is kept.
       # Set to nil to keep errors forever (not recommended for production)
       # Schedule cleanup: RailsErrorDashboard::RetentionCleanupJob.perform_later
       @retention_days = 90
@@ -384,6 +387,8 @@ module RailsErrorDashboard
       @notification_minimum_severity = :low  # Notify on all severities (current behavior)
       @notification_cooldown_minutes = 5     # 5 min cooldown per error_hash (0 = disabled)
       @notification_threshold_alerts = [ 10, 50, 100, 500, 1000 ] # Occurrence milestones
+      @notification_burst_limit = 10          # New-error notifications per window, per process (0 = no cap)
+      @notification_burst_window_seconds = 60 # One summary message replaces the rest of the window
 
       # Breadcrumbs defaults - OFF by default (opt-in)
       @enable_breadcrumbs = false         # Master switch
@@ -854,6 +859,19 @@ module RailsErrorDashboard
         errors << "notification_threshold_alerts must be an Array (got: #{notification_threshold_alerts.class})"
       end
 
+      # Validate the first-occurrence burst cap (non-negative integers; 0 or nil
+      # turns the cap off)
+      {
+        notification_burst_limit: notification_burst_limit,
+        notification_burst_window_seconds: notification_burst_window_seconds
+      }.each do |name, value|
+        next if value.nil?
+
+        unless value.is_a?(Integer) && value >= 0
+          errors << "#{name} must be a non-negative Integer (got: #{value.inspect})"
+        end
+      end
+
       # Log warnings (non-fatal issues)
       warnings.each do |warning|
         Rails.logger.warn "[Rails Error Dashboard] #{warning}" if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger

data/lib/rails_error_dashboard/engine.rb

@@ -71,6 +71,11 @@ module RailsErrorDashboard
         next
       end
 
+      # Resolve the running commit now (three small file reads, memoised, never
+      # raises) so that no capture ever pays for it. Skipped when the SHA is
+      # configured: then it is never consulted.
+      RailsErrorDashboard.detected_git_sha if RailsErrorDashboard.configuration.git_sha.blank?
+
       if RailsErrorDashboard.configuration.enable_error_subscriber
         Rails.error.subscribe(RailsErrorDashboard::ErrorReporter.new)
       end
@@ -188,6 +193,16 @@ module RailsErrorDashboard
       # Enable TracePoint(:raise) + TracePoint(:rescue) for swallowed exception detection
       if RailsErrorDashboard.configuration.detect_swallowed_exceptions
         RailsErrorDashboard::Services::SwallowedExceptionTracker.enable!
+
+        # Drain buffered counts at the end of every request and job. Without
+        # this the buffer is only ever drained by a LATER rescue on the SAME
+        # thread, so a swallowed exception that happens once stays invisible
+        # until the process exits. to_complete fires after the response body
+        # is closed, so it never delays a request (safety rule 2); the flush is
+        # deadline-gated, so a flood is still one write per interval.
+        Rails.application.executor.to_complete do
+          RailsErrorDashboard::Services::SwallowedExceptionTracker.flush_if_due!
+        end
       end
 
       # Import crash files from previous process death, then register at_exit hook

data/lib/rails_error_dashboard/queries/analytics_stats.rb

@@ -17,7 +17,7 @@ module RailsErrorDashboard
 
       def call
         # Cache analytics data for 5 minutes to reduce database load
-        # Cache key includes days parameter and last error update timestamp
+        # Cache key includes the days parameter and the cache generation
         Rails.cache.fetch(cache_key, expires_in: 5.minutes) do
           {
             days: @days,
@@ -41,13 +41,14 @@ module RailsErrorDashboard
         # - Query class name
         # - Days parameter (different time ranges = different caches)
         # - Application ID (per-app caching)
-        # - Last error update timestamp (auto-invalidates when errors change)
+        # - The cache generation (bumped by user actions; see AnalyticsCacheManager).
+        #   Captures do not bump it: they rely on the 5-minute TTL.
         # - Start date (ensures correct time window)
         [
           "analytics_stats",
           @days,
           @application_id || "all",
-          base_scope.maximum(:updated_at)&.to_i || 0,
+          Services::AnalyticsCacheManager.generation,
           @start_date.to_date.to_s
         ].join("/")
       end