rails_error_dashboard 0.12.1 → 0.14.0

data/app/jobs/rails_error_dashboard/notification_burst_summary_job.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # Sends the ONE message that replaces the rest of a burst of new-error
+  # notifications.
+  #
+  # A bad deploy can produce hundreds of DISTINCT new errors. Each is a first
+  # occurrence, so the per-error cooldown never applies; without a cap every
+  # one of them pages. NotificationThrottler.burst_decision lets the first
+  # config.notification_burst_limit through per window and asks for this job
+  # exactly once, when the limit is first exceeded.
+  #
+  # The message states the limit and the window rather than a count of what
+  # was suppressed: it is sent when suppression STARTS, and a count at that
+  # moment would always be one. Every error is still stored and counted; only
+  # the notifications are held back.
+  class NotificationBurstSummaryJob < ApplicationJob
+    include Concerns::PlainChannelMessage
+
+    queue_as :default
+
+    # @param limit [Integer] config.notification_burst_limit when the cap engaged
+    # @param window_seconds [Integer] config.notification_burst_window_seconds
+    # @param locale [String, nil] resolved at enqueue time
+    def perform(limit:, window_seconds:, locale: nil)
+      config = RailsErrorDashboard.configuration
+
+      deliver_plain_message(build_message(limit, window_seconds, config, job_locale(locale)), {
+        event: "new_error_notifications_suppressed",
+        limit: limit,
+        window_seconds: window_seconds,
+        application: app_name(config)
+      })
+    rescue => e
+      Rails.logger.error("[RailsErrorDashboard] NotificationBurstSummaryJob failed: #{e.class} - #{e.message}")
+    end
+
+    private
+
+    # Whole sentences joined, never fragments: see StormNotificationJob.
+    # ":warning:" is Slack/Discord emoji shortcode, not text.
+    def build_message(limit, window_seconds, config, locale)
+      dashboard = (config.dashboard_base_url || "").chomp("/")
+      link = if dashboard.present?
+        " " + t("red.notifications.burst.dashboard", locale, url: "#{dashboard}/errors")
+      else
+        ""
+      end
+
+      ":warning: " \
+        "#{t("red.notifications.burst.suppressed", locale, application: app_name(config), limit: limit, window: window_seconds)} " \
+        "#{t("red.notifications.burst.still_recorded", locale)}#{link}"
+    end
+  end
+end

data/app/jobs/rails_error_dashboard/retention_cleanup_job.rb

@@ -14,6 +14,25 @@ module RailsErrorDashboard
   class RetentionCleanupJob < ApplicationJob
     queue_as :default
 
+    # The errors retention applies to: "not seen for retention_days", not
+    # "first seen retention_days ago". occurred_at is stamped when a group is
+    # created and never moves, so expiring by it deleted errors that were still
+    # happening today -- with their comments and triage history -- the day
+    # they turned N days old.
+    #
+    # Equivalent to COALESCE(last_seen_at, occurred_at) < cutoff (the NULL arm
+    # covers rows from before last_seen_at existed), but written so that each
+    # arm can use its own index; wrapping the columns in COALESCE would force a
+    # full scan of the largest table on every run.
+    #
+    # Public because the rake task previews the same selection before it asks
+    # for confirmation.
+    def self.expired_scope(cutoff)
+      ErrorLog.where(
+        "last_seen_at < :cutoff OR (last_seen_at IS NULL AND occurred_at < :cutoff)", cutoff: cutoff
+      )
+    end
+
     # @return [Integer] number of errors deleted
     def perform
       retention_days = RailsErrorDashboard.configuration.retention_days
@@ -26,8 +45,11 @@ module RailsErrorDashboard
       # whenever no error logs happen to be expired.
       cleanup_rack_attack_events(cutoff)
       cleanup_storm_flush_batches(cutoff)
+      cleanup_diagnostic_dumps(cutoff)
+      cleanup_swallowed_exceptions(cutoff)
+      cleanup_event_timing_gaps(cutoff)
 
-      expired_scope = ErrorLog.where("occurred_at < ?", cutoff)
+      expired_scope = self.class.expired_scope(cutoff)
       return 0 if expired_scope.none?
 
       deleted_count = 0
@@ -37,6 +59,12 @@ module RailsErrorDashboard
 
       # Batch delete dependent records (occurrences, comments, cascade patterns)
       ErrorOccurrence.where(error_log_id: expired_ids_scope).in_batches(of: 1000).delete_all
+      # Hour buckets for storm-shed events. Listed explicitly because this job
+      # deletes with delete_all, which does not fire the has_many :dependent
+      # callback on ErrorLog -- without this line the buckets outlive the group
+      # they describe, forever. The migration's own comment promised this
+      # pruning before the code existed.
+      EventCount.where(error_log_id: expired_ids_scope).in_batches(of: 1000).delete_all if EventCount.table_exists?
       ErrorComment.where(error_log_id: expired_ids_scope).in_batches(of: 1000).delete_all
       CascadePattern.where(parent_error_id: expired_ids_scope)
                     .or(CascadePattern.where(child_error_id: expired_ids_scope))
@@ -48,6 +76,9 @@ module RailsErrorDashboard
         deleted_count += batch_size
       end
 
+      # delete_all skips callbacks, and the stat cards are cached.
+      Services::AnalyticsCacheManager.clear if deleted_count > 0
+
       if deleted_count > 0
         RailsErrorDashboard::Logger.info(
           "[RailsErrorDashboard] Retention cleanup: deleted #{deleted_count} errors older than #{retention_days} days"
@@ -86,6 +117,96 @@ module RailsErrorDashboard
       )
     end
 
+    # Diagnostic dumps and swallowed-exception aggregates are written
+    # independently of error logs and nothing else ever deletes them, so they
+    # grew without bound. Not gated on their feature flags: rows written while
+    # a feature was on must still expire after it is switched off. Own rescue
+    # each, like the cleanups around them.
+    def cleanup_diagnostic_dumps(cutoff)
+      return unless DiagnosticDump.table_exists?
+
+      deleted = 0
+      DiagnosticDump.where("captured_at < ?", cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} diagnostic dumps"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Diagnostic dump retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
+
+    def cleanup_swallowed_exceptions(cutoff)
+      return unless SwallowedException.table_exists?
+
+      deleted = 0
+      SwallowedException.where("period_hour < ?", cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} swallowed exception records"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Swallowed exception retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
+
+    # Timing gaps are pruned by their OWN age, not by a group.
+    #
+    # A gap describes an interval, not an error, so there is no error_log_id to
+    # cascade from -- without this it would accumulate for the life of the
+    # installation. It also runs ABOVE the early return in #perform, which
+    # fires whenever no error logs happen to be expired: gaps expire
+    # independently of errors, exactly like the rack-attack events whose
+    # comment already warns about this.
+    #
+    # Safe to prune on covered_until: once the cutoff has moved past a gap, no
+    # window the dashboard displays can still reach it, so the warning it
+    # carries is no longer meaningful. Own rescue, like its siblings.
+    def cleanup_event_timing_gaps(cutoff)
+      return unless EventTimingGap.table_exists?
+
+      # Kept for the LONGER of the two horizons that govern it.
+      #
+      # This used the configured retention cutoff alone, which is wrong
+      # whenever retention is shorter than the window the dashboard reports on:
+      # at retention_days = 7 the gap was deleted while the events it qualified
+      # were still on the page -- ten monthly events, no warning, group still
+      # active. A gap outlives its own retention precisely because the figures
+      # it qualifies do.
+      #
+      # Deleting it only once BOTH clocks have passed means the warning can
+      # never disappear while the numbers it describes are still displayed.
+      # The reverse case is unaffected: with the 90-day default the retention
+      # cutoff is already the later of the two, so nothing is kept longer than
+      # before.
+      gap_cutoff = [ cutoff, Queries::DashboardStats::WIDEST_DISPLAYED_WINDOW.ago ].min
+
+      deleted = 0
+      EventTimingGap.where("covered_until < ?", gap_cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} event timing gaps"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Event timing gap retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
+
     # Expire aggregated Rack Attack event rows. Isolated in its own rescue so a
     # failure here (e.g. table not yet migrated) never blocks error cleanup.
     def cleanup_rack_attack_events(cutoff)

data/app/jobs/rails_error_dashboard/storm_flush_job.rb

@@ -21,11 +21,14 @@ module RailsErrorDashboard
         entries: entries, overflow: overflow, episode: episode, batch_id: batch_id
       )
 
-      # A batch that reconciled nothing because every write failed is not a
-      # delivered batch. Fail the job so Active Job retries it rather than
-      # dropping counts that were only ever held in one process's memory.
+      # A batch that wrote nothing is not a delivered batch. Fail the job so
+      # Active Job retries it rather than dropping counts that were only ever
+      # held in one process's memory. Two shapes reach here: every entry failed
+      # permanently, and a transient store failure that rolled the whole batch
+      # back (retryable: true) -- the latter is intact and safe to replay.
       if result.is_a?(Hash) && result[:success] == false
-        raise FlushFailed, "storm flush reconciled nothing: #{result[:error]}"
+        reason = result[:retryable] ? "storm flush rolled back" : "storm flush reconciled nothing"
+        raise FlushFailed, "#{reason}: #{result[:error]}"
       end
 
       result

data/app/jobs/rails_error_dashboard/storm_notification_job.rb

@@ -7,6 +7,8 @@ module RailsErrorDashboard
   # help nobody) — this one message replaces them. The gate guarantees at
   # most one enqueue per episode; this job just delivers.
   class StormNotificationJob < ApplicationJob
+    include Concerns::PlainChannelMessage
+
     queue_as :default
 
     # @param started_at [String] ISO8601 episode start
@@ -17,23 +19,12 @@ module RailsErrorDashboard
       config = RailsErrorDashboard.configuration
       message = build_message(started_at, state, config, job_locale(locale))
 
-      if config.enable_slack_notifications && config.slack_webhook_url.present?
-        post_json(config.slack_webhook_url, { text: message })
-      end
-
-      if config.enable_discord_notifications && config.discord_webhook_url.present?
-        post_json(config.discord_webhook_url, { content: message })
-      end
-
-      if config.enable_webhook_notifications && config.webhook_urls.any?
-        payload = {
-          event: "error_storm_detected",
-          started_at: started_at,
-          state: state,
-          application: app_name(config)
-        }
-        config.webhook_urls.each { |url| post_json(url, payload) }
-      end
+      deliver_plain_message(message, {
+        event: "error_storm_detected",
+        started_at: started_at,
+        state: state,
+        application: app_name(config)
+      })
     rescue => e
       Rails.logger.error("[RailsErrorDashboard] StormNotificationJob failed: #{e.class} - #{e.message}")
     end
@@ -61,32 +52,5 @@ module RailsErrorDashboard
         "#{t("red.notifications.storm.engaged", locale, mode: mode)} " \
         "#{t("red.notifications.storm.suppressed", locale)}#{link}"
     end
-
-    def t(key, locale, **options)
-      RailsErrorDashboard::I18nStore.translate(key, locale: locale, **options)
-    end
-
-    def app_name(config)
-      config.application_name || ENV["APPLICATION_NAME"] ||
-        (defined?(Rails) && Rails.application.class.module_parent_name) || "Rails Application"
-    end
-
-    def post_json(url, payload)
-      if defined?(HTTParty)
-        HTTParty.post(url, body: payload.to_json,
-          headers: { "Content-Type" => "application/json" }, timeout: 10)
-      else
-        uri = URI(url)
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == "https"
-        http.open_timeout = 5
-        http.read_timeout = 10
-        request = Net::HTTP::Post.new(uri.path, { "Content-Type" => "application/json" })
-        request.body = payload.to_json
-        http.request(request)
-      end
-    rescue => e
-      Rails.logger.error("[RailsErrorDashboard] Storm notification post failed: #{e.message}")
-    end
   end
 end

data/app/models/rails_error_dashboard/error_baseline.rb

@@ -48,17 +48,20 @@ module RailsErrorDashboard
       return nil if mean.nil? || std_dev.nil?
       return nil if current_count <= mean
 
-      std_devs_above = (current_count - mean) / std_dev
+      # nil when std_dev is zero: a perfectly flat history has no spread to
+      # measure against, and dividing by it made every count :critical.
+      sigma = std_devs_above_mean(current_count)
+      return nil if sigma.nil?
 
-      case std_devs_above
-      when sensitivity..(sensitivity + 1)
-        :elevated
-      when (sensitivity + 1)..(sensitivity + 2)
-        :high
-      when (sensitivity + 2)..Float::INFINITY
+      # Half-open bands, highest first: a boundary value belongs to the band it
+      # opens (3.0 is :high, 4.0 is :critical). Inclusive ranges matched
+      # top-down gave each boundary to the band below it.
+      if sigma >= sensitivity + 2
         :critical
-      else
-        nil
+      elsif sigma >= sensitivity + 1
+        :high
+      elsif sigma >= sensitivity
+        :elevated
       end
     end
 

data/app/models/rails_error_dashboard/error_comment.rb

@@ -14,11 +14,6 @@ module RailsErrorDashboard
     scope :recent_first, -> { order(created_at: :desc) }
     scope :oldest_first, -> { order(created_at: :asc) }
 
-    # Get formatted timestamp for display
-    def formatted_time
-      created_at.strftime("%b %d, %Y at %I:%M %p")
-    end
-
     # Check if comment was created recently (within last hour)
     def recent?
       created_at > 1.hour.ago

data/app/models/rails_error_dashboard/error_log.rb

@@ -37,6 +37,16 @@ module RailsErrorDashboard
     # Association for tracking individual error occurrences
     has_many :error_occurrences, class_name: "RailsErrorDashboard::ErrorOccurrence", dependent: :destroy
 
+    # Hour buckets for storm-shed events. delete_all, not destroy: these rows
+    # are pure counters with no callbacks, and a group can own one per hour.
+    #
+    # The association has to live HERE. `dependent:` on EventCount's own
+    # belongs_to is rejected by Rails (":dependent option must be one of
+    # [:destroy, :delete, :destroy_async]"), so the cleanup can only be
+    # declared from the parent side. Retention deletes them separately as well,
+    # because it uses delete_all, which does not fire callbacks.
+    has_many :event_counts, class_name: "RailsErrorDashboard::EventCount", dependent: :delete_all
+
     # Comments used as internal audit trail for workflow actions (snooze, mute, status changes).
     # Manual comment form removed in v0.6 — discussion now lives on issue tracker.
     has_many :comments, class_name: "RailsErrorDashboard::ErrorComment", foreign_key: :error_log_id, dependent: :destroy
@@ -86,9 +96,9 @@ module RailsErrorDashboard
     after_create_commit -> { Services::ErrorBroadcaster.broadcast_new(self) }
     after_update_commit -> { Services::ErrorBroadcaster.broadcast_update(self) }
 
-    # Cache invalidation - clear analytics caches when errors are created/updated/deleted
-    after_save -> { Services::AnalyticsCacheManager.clear }
-    after_destroy -> { Services::AnalyticsCacheManager.clear }
+    # No cache invalidation here, on purpose. A save is what a CAPTURE does, in
+    # the host app's request thread; the stats caches expire by TTL instead, and
+    # the commands behind user actions call AnalyticsCacheManager.clear themselves.
 
     def set_defaults
       self.platform ||= "API"
@@ -271,7 +281,13 @@ module RailsErrorDashboard
       end
     end
 
+    # The five workflow statuses. One list, so that a command can tell
+    # "unknown status" from "known, but not reachable from here".
+    STATUSES = %w[new in_progress investigating resolved wont_fix].freeze
+
     def can_transition_to?(new_status)
+      return false unless STATUSES.include?(new_status)
+
       # Define valid status transitions
       valid_transitions = {
         "new" => [ "in_progress", "investigating", "wont_fix" ],

data/app/models/rails_error_dashboard/error_logs_record.rb

@@ -35,6 +35,23 @@ module RailsErrorDashboard
     # after the user's configuration is loaded
     # See lib/rails_error_dashboard/engine.rb
 
+    # Read-side half of the invalid-bytes defence. Capture scrubs what it
+    # writes, but SQLite and MySQL will happily hold a row written before that
+    # (or by anything else), and one such string takes down every page that
+    # renders it: ERB raises "invalid byte sequence in UTF-8". Scrubbing on load
+    # makes the page render whether or not the operator has run
+    # error_dashboard:scrub_invalid_encoding yet. In memory only: nothing is
+    # written, and the record is not left dirty.
+    after_find :scrub_invalid_strings
+
+    # Names of the attributes the load-time scrub had to repair, so that
+    # Commands::ScrubInvalidEncoding can persist the repair: once the values
+    # are clean in memory, re-reading them can no longer tell a bad row apart.
+    # @return [Array<String>]
+    def invalid_encoding_attributes
+      @invalid_encoding_attributes || []
+    end
+
     # Rails' default for a string column when the adapter has one (MySQL).
     DEFAULT_STRING_LIMIT = 255
 
@@ -68,5 +85,22 @@ module RailsErrorDashboard
         limits[name] = column.limit || DEFAULT_STRING_LIMIT if column.type == :string
       end
     end
+
+    private
+
+    def scrub_invalid_strings
+      @attributes.each_value do |attribute|
+        value = attribute.value_before_type_cast
+        next unless value.is_a?(String)
+        next if value.encoding == Encoding::UTF_8 && value.valid_encoding? && !value.include?("\0")
+
+        name = attribute.name
+        self[name] = Services::EncodingSanitizer.scrub(value)
+        clear_attribute_changes([ name ])
+        (@invalid_encoding_attributes ||= []) << name
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] scrub on load failed: #{e.class}: #{e.message}")
+    end
   end
 end

data/app/models/rails_error_dashboard/error_occurrence.rb

@@ -23,7 +23,15 @@ module RailsErrorDashboard
     scope :in_time_window, ->(start_time, end_time) { where(occurred_at: start_time..end_time) }
     scope :for_user, ->(user_id) { where(user_id: user_id) }
     scope :for_request, ->(request_id) { where(request_id: request_id) }
-    scope :for_session, ->(session_id) { where(session_id: session_id) }
+    # Takes the raw session ID (or a stored digest). Rows are stored as a keyed
+    # digest while filter_sensitive_data is on, and raw otherwise or before the
+    # upgrade, so both forms are matched. Blank matches nothing.
+    scope :for_session, lambda { |session_id|
+      raw = session_id.to_s
+      next none if raw.empty?
+
+      where(session_id: [ raw, Services::SensitiveDataFilter.digest_session_id(raw) ].compact.uniq)
+    }
 
     # Find occurrences within a time window around this occurrence
     # @param window_minutes [Integer] Time window in minutes (default: 5)

data/app/models/rails_error_dashboard/event_count.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # How many storm-shed events landed on one error group in one hour.
+  #
+  # Storm protection sheds events by folding N of them into the group's
+  # occurrence_count and writing no ErrorOccurrence row. That keeps the total
+  # exact but leaves the events with no timestamp of their own, so a window
+  # query has nothing to filter them by. This table gives them one.
+  #
+  # Window volume is therefore:
+  #
+  #   ErrorOccurrence rows in the window  +  EventCount buckets in the window
+  #
+  # Ordinary captures contribute the first term, shed events the second, and
+  # neither is double counted: an event that wrote an occurrence row is never
+  # also bucketed here.
+  #
+  # Inherits ErrorLogsRecord so separate-database routing applies.
+  class EventCount < ErrorLogsRecord
+    self.table_name = "rails_error_dashboard_event_counts"
+
+    belongs_to :error_log, class_name: "RailsErrorDashboard::ErrorLog", optional: true
+
+    scope :in_window, ->(from, to = nil) {
+      scope = where(arel_table[:bucket_at].gteq(from))
+      to ? scope.where(arel_table[:bucket_at].lt(to)) : scope
+    }
+
+    # Bucket width, shared with the PRODUCER.
+    #
+    # This must equal CountBuffer::BUCKET_SECONDS, and there is a spec that
+    # asserts it. The producer tallies 15-minute buckets precisely so that a
+    # local midnight falls on a bucket EDGE in every UTC offset in use --
+    # including +05:30 (Kolkata) and +05:45 (Kathmandu). Rounding those buckets
+    # to the hour here destroyed exactly the property the producer paid for:
+    # a storm event at 23:59:30 and one at 00:00:30 in Kolkata shared one
+    # bucket, and a day's total was wrong by the whole straddle.
+    BUCKET_SECONDS = Services::StormProtection::CountBuffer::BUCKET_SECONDS
+
+    # The bucket a time belongs to, in UTC. One definition, used by the writer
+    # and the readers -- a mismatch here silently splits or merges a bucket.
+    # @param time [Time]
+    # @return [Time]
+    def self.bucket_for(time)
+      time = (time || Time.current)
+      Time.at((time.to_i / BUCKET_SECONDS) * BUCKET_SECONDS).utc
+    end
+
+    # Add +count+ shed events to (error_log_id, bucket_at), creating the row if
+    # it is not there yet.
+    #
+    # Adapter-portable by hand rather than via upsert_all: the increment has to
+    # read the existing value, and the ON CONFLICT / ON DUPLICATE KEY syntaxes
+    # differ. The UPDATE-first shape means the common case (a storm flushing
+    # repeatedly into the same hour) is a single statement, and the INSERT race
+    # is resolved by retrying the UPDATE once.
+    #
+    # @return [Symbol] :written when the bucket landed, :unavailable when the
+    #   rollup is permanently unusable (no table, bad args, an adapter that
+    #   refuses the statement). A TRANSIENT failure raises instead.
+    #
+    #   Three states, not a boolean: the caller has to tell "the bucket is
+    #   permanently unavailable, degrade" from "the write failed, retry the
+    #   batch". Collapsing both into false made FlushStormCounts abort the
+    #   whole transaction on a host that had simply never migrated the rollup
+    #   table -- rolling back the authoritative lifetime count with it.
+    def self.accumulate(error_log_id:, bucket_at:, count:)
+      return :unavailable unless error_log_id && count.to_i.positive?
+      return :unavailable unless table_exists?
+
+      bucket = bucket_for(bucket_at)
+      updated = where(error_log_id: error_log_id, bucket_at: bucket)
+        .update_all([ "count = count + ?, updated_at = ?", count.to_i, Time.current ])
+      return :written if updated.positive?
+
+      begin
+        # requires_new: a failed INSERT aborts its transaction on PostgreSQL,
+        # which would take the caller's surrounding transaction with it.
+        transaction(requires_new: true) do
+          create!(error_log_id: error_log_id, bucket_at: bucket, count: count.to_i)
+        end
+        :written
+      rescue ActiveRecord::RecordNotUnique
+        # Another process created the same bucket between the UPDATE and the
+        # INSERT. The row exists now, so the UPDATE that missed a moment ago
+        # succeeds.
+        where(error_log_id: error_log_id, bucket_at: bucket)
+          .update_all([ "count = count + ?, updated_at = ?", count.to_i, Time.current ])
+          .positive? ? :written : :unavailable
+      end
+    rescue *Commands::LogError::RETRYABLE_STORE_ERRORS => e
+      # TRANSIENT: the store may be back in a moment. Do NOT swallow it.
+      #
+      # Returning false here let FlushStormCounts finalize its batch ledger
+      # with the bucket missing, so the replay was suppressed as
+      # already-applied and those events were erased from every time window --
+      # permanently -- while the lifetime count stayed correct. The caller
+      # turns this into an abort-and-retry of the whole batch.
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] EventCount.accumulate hit a transient failure: #{e.class} - #{e.message}"
+      )
+      raise
+    rescue StandardError => e
+      # PERMANENT: a malformed row, a missing table, an adapter that refuses
+      # this statement. Retrying cannot help, and failing the flush would turn
+      # a lost time bucket into a lost COUNT -- the authoritative total is
+      # occurrence_count on the group, and it is already written.
+      #
+      # This is the only case the old comment actually described.
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] EventCount.accumulate failed permanently: #{e.class} - #{e.message}"
+      )
+      :unavailable
+    end
+
+    # Whether the rollup table is usable.
+    #
+    # A transient connection failure here is NOT "the table does not exist":
+    # swallowing it returned false before any write was attempted, so a storm
+    # flush reported success with no bucket written, and EventVolume silently
+    # dropped the bucket term from its reads. Let the transient class through
+    # so the caller can retry; only a genuinely absent table returns false.
+    def self.table_exists?
+      connection.table_exists?(table_name)
+    rescue *Commands::LogError::RETRYABLE_STORE_ERRORS
+      raise
+    rescue StandardError
+      false
+    end
+  end
+end

data/app/models/rails_error_dashboard/event_timing_gap.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # An interval whose per-event timing evidence was lost.
+  #
+  # See the migration for why this is its own table rather than a flag on the
+  # storm episode: the episode is optional, and it is written after the counts
+  # transaction has already committed.
+  #
+  # Inherits ErrorLogsRecord so separate-database routing applies.
+  class EventTimingGap < ErrorLogsRecord
+    self.table_name = "rails_error_dashboard_event_timing_gaps"
+
+    # Gaps overlapping [from, to). Open-ended when +to+ is nil.
+    #
+    # Overlap, not containment: a gap that began before the window and runs
+    # into it still makes that window's timing unreliable. Checking only
+    # "starts inside the window" is the mistake the episode predicate made.
+    scope :overlapping, ->(from, to = nil) {
+      scope = where(arel_table[:covered_until].gteq(from))
+      to ? scope.where(arel_table[:covered_from].lt(to)) : scope
+    }
+
+    # Whether any recorded gap affects the given window.
+    #
+    # Every guard is deliberate: the table may not be migrated on an older
+    # host, and this is read on the dashboard path, which must never raise.
+    #
+    # @param from [Time] start of the window being displayed
+    # @param application_id [Integer, nil]
+    # @return [Boolean]
+    def self.affecting?(from, application_id: nil)
+      return false unless table_exists?
+
+      scope = overlapping(from)
+      # A NULL application_id means the gap applies everywhere, so it is
+      # included whatever is being filtered for.
+      scope = scope.where(application_id: [ application_id, nil ]) if application_id.present?
+      scope.exists?
+    rescue StandardError => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] EventTimingGap.affecting? failed: #{e.class} - #{e.message}"
+      )
+      false
+    end
+
+    def self.table_exists?
+      connection.table_exists?(table_name)
+    rescue *Commands::LogError::RETRYABLE_STORE_ERRORS
+      raise
+    rescue StandardError
+      false
+    end
+  end
+end