rails_error_dashboard 0.12.1 → 0.14.0

data/lib/rails_error_dashboard/commands/find_or_increment_error.rb

@@ -10,8 +10,9 @@ module RailsErrorDashboard
     # and two concurrent captures could both read count N and both write N+1.
     #
     # Search order:
+    # 0. wont_fix errors with same hash (any age) → increment, status untouched
     # 1. Unresolved errors with same hash within 24 hours → increment occurrence count
-    # 2. Resolved/wont_fix errors with same hash (any age) → reopen and increment
+    # 2. Resolved errors with same hash (any age) → reopen and increment
     # 3. No match → create new error record
     #
     # Environment is a MATCH dimension, not part of the hash: the same error in
@@ -42,11 +43,15 @@ module RailsErrorDashboard
 
       def call
         ErrorLog.transaction do
+          # Priority 0: a wont_fix row absorbs its recurrences, at any age
+          sticky = find_wont_fix
+          next increment_existing(sticky) if sticky
+
           # Priority 1: Find unresolved match (existing behavior)
           existing = find_unresolved
           next increment_existing(existing) if existing
 
-          # Priority 2: Find resolved/wont_fix match → reopen
+          # Priority 2: Find resolved match → reopen
           resolved = find_resolved
           next reopen_existing(resolved) if resolved
 
@@ -57,9 +62,26 @@ module RailsErrorDashboard
 
       private
 
+      # The three lookups are DISJOINT by status, so which row a recurrence
+      # lands on never depends on the order they happen to run in.
+
+      # "Won't fix" is a decision that the error recurs and will not be acted
+      # on, so it has no time window: the row counts its recurrences for as
+      # long as it keeps the status. It used to be matched by find_unresolved
+      # for 24 hours and then REOPENED by find_resolved -- sticky for a day,
+      # after which the triage decision was silently thrown away.
+      def find_wont_fix
+        with_environment(
+          ErrorLog
+            .where(error_hash: @error_hash)
+            .where(application_id: @attributes[:application_id])
+            .where(status: "wont_fix")
+        ).lock.order(last_seen_at: :desc).first
+      end
+
       def find_unresolved
         with_environment(
-          ErrorLog.unresolved
+          not_wont_fix(ErrorLog.unresolved)
             .where(error_hash: @error_hash)
             .where(application_id: @attributes[:application_id])
             .where("occurred_at >= ?", 24.hours.ago)
@@ -71,10 +93,16 @@ module RailsErrorDashboard
           ErrorLog
             .where(error_hash: @error_hash)
             .where(application_id: @attributes[:application_id])
-            .where(status: %w[resolved wont_fix])
+            .where(status: "resolved")
         ).lock.order(last_seen_at: :desc).first
       end
 
+      # Spelled out rather than where.not(status: "wont_fix"): in SQL that also
+      # drops every row whose status is NULL.
+      def not_wont_fix(scope)
+        scope.where("status IS NULL OR status <> ?", "wont_fix")
+      end
+
       # Restrict to this occurrence's environment or a legacy NULL row, exact
       # first. Literal SQL, no interpolation. A blank environment (column not
       # migrated yet, or an attribute-less caller) leaves the scope unchanged.
@@ -109,21 +137,78 @@ module RailsErrorDashboard
       # leaves both the snapshot and its provenance alone -- otherwise the row
       # would claim a fresh capture time for evidence from an older event,
       # which is precisely the confusion this exists to remove.
-      def context_provenance(refreshed)
+      def context_provenance(refreshed, error = nil)
         return {} unless refreshed.any? || refreshed_request_identity?
         return {} unless ErrorLog.column_names.include?("context_captured_at")
 
         provenance = { context_captured_at: @attributes[:occurred_at] || Time.current }
         if ErrorLog.column_names.include?("context_fidelity")
-          provenance[:context_fidelity] = @attributes[:_context_fidelity].presence || "full"
+          provenance[:context_fidelity] =
+            @attributes[:_context_fidelity].presence || snapshot_fidelity(error)
         end
         provenance
       end
 
+      # "full" means every displayed field came from THIS occurrence. When the
+      # `||` chain keeps an older value beside a newly refreshed one, the row
+      # is showing a mixture of two events, and calling that a fresh full
+      # capture is what made the snapshot unreadable: a new request URL sat
+      # beside a previous occurrence's user and locals under one timestamp.
+      #
+      # Keeping the older value is still the right behaviour -- a useful
+      # exemplar beats a blank one -- so only the LABEL changes.
+      def snapshot_fidelity(error)
+        return "full" if error.nil?
+
+        retains_older_value?(error) ? "partial" : "full"
+      end
+
+      # Every field whose stored value this capture could RETAIN from an
+      # earlier occurrence. Defined once, so a field cannot join the displayed
+      # snapshot without joining the provenance policy -- which is exactly how
+      # local variables came to be shown beside a "full" label and a newer
+      # timestamp while belonging to a different event.
+      #
+      # Request identity plus the context payloads: both are subject to the
+      # same `||` chain, and a reader cannot tell them apart on the page.
+      PROVENANCE_TRACKED = (REFRESHED_REQUEST_IDENTITY + REFRESHED_CONTEXT).uniq.freeze
+
+      # True when the row already holds a displayed value that this occurrence
+      # did NOT supply, so the `||` chain is about to keep it and the stored
+      # snapshot will describe two different events.
+      def retains_older_value?(error)
+        PROVENANCE_TRACKED.any? do |key|
+          next false unless ErrorLog.column_names.include?(key.to_s)
+
+          @attributes[key].nil? && previous_value(error, key).present?
+        end
+      end
+
+      # read_attribute, never public_send: :instance_variables would otherwise
+      # resolve to Ruby's own Object#instance_variables if the generated
+      # attribute method were ever absent (ignored_columns, load order), and
+      # silently compare an Array of symbols against captured context.
+      def previous_value(error, key)
+        error.read_attribute(key)
+      rescue StandardError
+        nil
+      end
+
       def refreshed_request_identity?
         REFRESHED_REQUEST_IDENTITY.any? { |key| !@attributes[key].nil? }
       end
 
+      # Inside the 24-hour matching window find_unresolved uses, so the group
+      # this creates can still be found by its own recurrences.
+      def clamped_group_time(time)
+        return Time.current if time.blank?
+
+        floor = 24.hours.ago + 1.minute
+        time < floor ? floor : time
+      rescue StandardError
+        Time.current
+      end
+
       # A group first seen during a storm has a MINIMAL exemplar: the flush job
       # could only record the first app frame, because a counted-only event
       # captures no backtrace. The comment there promises the next occurrence
@@ -177,7 +262,7 @@ module RailsErrorDashboard
           user_agent: @attributes[:user_agent] || error.user_agent,
           ip_address: @attributes[:ip_address] || error.ip_address,
           **refreshed,
-          **context_provenance(refreshed),
+          **context_provenance(refreshed, error),
           **backtrace_upgrade(error),
           **environment_adoption(error)
         )
@@ -197,7 +282,7 @@ module RailsErrorDashboard
           user_agent: @attributes[:user_agent] || error.user_agent,
           ip_address: @attributes[:ip_address] || error.ip_address,
           **(refreshed = latest_context),
-          **context_provenance(refreshed),
+          **context_provenance(refreshed, error),
           **backtrace_upgrade(error),
           **environment_adoption(error)
         }
@@ -217,6 +302,15 @@ module RailsErrorDashboard
         attrs = @attributes.reject { |key, _| key.to_s.start_with?("_") }
         attrs = attrs.reverse_merge(resolved: false)
 
+        # The GROUP's occurred_at is clamped into the matching window, even
+        # when the EVENT is older. find_unresolved matches on
+        # `occurred_at >= 24.hours.ago`, so a backdated report (a mobile client
+        # flushing a queue it collected offline) would otherwise create a row
+        # that can never be matched again -- every recurrence making yet
+        # another group. The event's true time is preserved on its occurrence
+        # row, which is what the time-window queries read.
+        attrs[:occurred_at] = clamped_group_time(attrs[:occurred_at])
+
         if ErrorLog.column_names.include?("context_captured_at")
           attrs[:context_captured_at] ||= @attributes[:occurred_at] || Time.current
         end
@@ -235,9 +329,13 @@ module RailsErrorDashboard
           ErrorLog.create!(new_record_attributes)
         end
       rescue ActiveRecord::RecordNotUnique
-        # Race condition: another process created the same error
+        # Race condition: another process created the same error. Same three
+        # lookups, same order, as the first pass.
+        retry_sticky = find_wont_fix
+        return increment_existing(retry_sticky) if retry_sticky
+
         retry_existing = with_environment(
-          ErrorLog.unresolved
+          not_wont_fix(ErrorLog.unresolved)
             .where(error_hash: @error_hash)
             .where(application_id: @attributes[:application_id])
             .where("occurred_at >= ?", 24.hours.ago)
@@ -257,7 +355,7 @@ module RailsErrorDashboard
             ErrorLog
               .where(error_hash: @error_hash)
               .where(application_id: @attributes[:application_id])
-              .where(status: %w[resolved wont_fix])
+              .where(status: "resolved")
           ).lock.first
 
           if retry_resolved

data/lib/rails_error_dashboard/commands/flush_rack_attack_events.rb

@@ -28,8 +28,10 @@ module RailsErrorDashboard
         app_id = current_application_id
 
         @counts.each do |key, count|
+          # Path and user agent are attacker-supplied, so invalid bytes are the
+          # expected case here. Scrub the whole key before it is split.
           rule, match_type, discriminator, path, http_method, user_agent =
-            Services::RackAttackTracker.parse_key(key)
+            Services::RackAttackTracker.parse_key(Services::EncodingSanitizer.scrub(key.to_s))
 
           next if rule.blank? || match_type.blank?
 

data/lib/rails_error_dashboard/commands/flush_storm_counts.rb

@@ -16,13 +16,26 @@ module RailsErrorDashboard
     # Counts are exact. Notifications are NOT dispatched from here — during a
     # storm they're suppressed by design; the storm notification covers it.
     class FlushStormCounts
+      # A bucket write failed in a way that may succeed on retry. Raised so the
+      # per-entry rescue in #call classifies it exactly as it classifies a
+      # transient COUNT failure: roll the batch back, leave the ledger
+      # unclaimed, let the job retry the whole batch intact.
+      class EventCountWriteFailed < StandardError; end
+
       def self.call(entries:, overflow: 0, episode: nil, batch_id: nil)
         new(entries: entries, overflow: overflow, episode: episode, batch_id: batch_id).call
       end
 
       def initialize(entries:, overflow: 0, episode: nil, batch_id: nil)
-        @entries = Array(entries)
+        # The gate scrubs what it buffers, so this is normally a no-op scan. It
+        # covers entries buffered by an older release and direct callers: the
+        # exemplar becomes an ErrorLog row, and its message is matched by regex.
+        @entries = Array(Services::EncodingSanitizer.scrub_deep(entries))
         @overflow = overflow.to_i
+        # Set when a bucket write was permanently unavailable. The counts are
+        # still correct; only their placement in TIME is missing, and a caller
+        # reading a time window deserves to know that.
+        @buckets_incomplete = false
         @episode = episode
         @batch_id = batch_id
       end
@@ -31,6 +44,7 @@ module RailsErrorDashboard
         application = resolve_application
         counted = 0
         failed = 0
+        aborted = false
 
         # Counts are applied additively (occurrence_count + N), which is not
         # idempotent: delivering the same snapshot twice counted it twice. The
@@ -52,6 +66,20 @@ module RailsErrorDashboard
           @entries.each do |entry|
             entry = entry.with_indifferent_access if entry.respond_to?(:with_indifferent_access)
             counted += reconcile_entry(entry, application)
+          rescue EventCountWriteFailed, *Commands::LogError::RETRYABLE_STORE_ERRORS => e
+            # A transient store failure is NOT a bad entry. Claiming the batch
+            # here would commit the ledger row and strand every entry not yet
+            # applied: the retry is then suppressed as a replay and those events
+            # are lost for good. Re-raise so the whole transaction rolls back --
+            # nothing was committed, so nothing can double -- and let the job
+            # retry the batch intact. The generic rescue below still keeps a
+            # permanently malformed entry from poisoning its batch.
+            failed += 1
+            aborted = true
+            RailsErrorDashboard::Logger.error(
+              "[RailsErrorDashboard] Storm batch aborted by a transient store failure: #{e.class} - #{e.message}"
+            )
+            raise
           rescue => e
             # A corrupt (non-Hash) entry must not abort the whole batch — and the
             # log line itself must not assume `entry` is subscriptable (an Integer
@@ -67,26 +95,56 @@ module RailsErrorDashboard
           # roll the claim back and let the job retry the whole batch.
           raise ActiveRecord::Rollback if failed.positive? && counted.zero?
 
+          # INSIDE the transaction, deliberately.
+          #
+          # The counts and the record that their timing is unreliable have to
+          # land together or not at all. Writing this after the commit (as the
+          # storm-episode marker did) meant a transient failure lost the
+          # marker while the ledger had already recorded the batch as applied
+          # -- the replay was then suppressed and the gap was never recorded,
+          # so the dashboard reported completeness it could not vouch for.
+          #
+          # If this write fails, the whole batch rolls back and stays
+          # replayable. Counts whose unreliability we cannot record are worth
+          # retrying, not committing silently.
+          record_timing_gap!(counted) if @buckets_incomplete && counted.positive?
+
           finalize_batch!(ledger, counted)
         end
 
         # Every entry failed and none was written. Reporting success with
         # reconciled: 0 made a total loss indistinguishable from an empty
         # batch, so the job acknowledged counts that never reached the
-        # database. Partial success stays successful: the entries that were
-        # written are written, and replaying the batch would double them.
+        # database.
+        #
+        # Reaching here means every failure was PERMANENT -- a transient store
+        # failure re-raises above and rolls the whole batch back. Partial
+        # success over permanent failures stays successful: the entries that
+        # were written are written, replaying would double them, and retrying a
+        # corrupt payload only loops forever.
         if failed.positive? && counted.zero?
-          return { success: false, reconciled: 0, failed: failed, overflow: @overflow,
+          return { success: false, retryable: false, reconciled: 0, failed: failed, overflow: @overflow,
+                   buckets_incomplete: @buckets_incomplete,
                    error: "all #{failed} entries failed to reconcile" }
         end
 
         upsert_storm_event(counted)
-        { success: true, reconciled: counted, failed: failed, overflow: @overflow }
+        result = { success: true, reconciled: counted, failed: failed, overflow: @overflow }
+        result[:buckets_incomplete] = true if @buckets_incomplete
+        result
       rescue => e
         RailsErrorDashboard::Logger.error(
           "[RailsErrorDashboard] FlushStormCounts failed: #{e.class} - #{e.message}"
         )
-        { success: false, error: "#{e.class}: #{e.message}" }
+        # retryable: true says "the batch is intact, replay it" -- nothing was
+        # committed, so the job can retry without doubling. A permanent failure
+        # carries no such promise.
+        retryable = Commands::LogError::RETRYABLE_STORE_ERRORS.any? { |klass| e.is_a?(klass) }
+        result = { success: false, retryable: retryable, error: "#{e.class}: #{e.message}" }
+        # reconciled: 0 because the transaction rolled back -- whatever this
+        # batch had counted in memory never reached the database.
+        result.merge!(reconciled: 0, failed: failed, overflow: @overflow) if aborted
+        result
       end
 
       private
@@ -145,7 +203,68 @@ module RailsErrorDashboard
       end
 
 
+      # Reconcile one buffered entry and, on every path that adds counts, give
+      # those shed events a TIME BUCKET as well as a total.
+      #
+      # occurrence_count alone is a lifetime counter: it says how many events
+      # there were but not when, so no window query can place them. Ordinary
+      # captures carry their own ErrorOccurrence row; shed events write none by
+      # design, which is what made them invisible to "errors today". The bucket
+      # written here is what Queries::EventVolume adds to the occurrence rows.
       def reconcile_entry(entry, application)
+        error_log_id = nil
+        count = reconcile_entry_count(entry, application) { |id| error_log_id = id }
+        write_event_buckets(entry, error_log_id, count) if count.positive? && error_log_id
+        count
+      end
+
+      # Write one row per BUCKET the producer recorded, not one row for the
+      # whole entry.
+      #
+      # The buffer tallies events per 15-minute bucket precisely so this does
+      # not have to guess: assigning the entry's whole total to last_seen_at's
+      # bucket put an event from 23:59:59 and one from 00:00:01 on the same
+      # day. A payload from an older release carries no buckets, so it falls
+      # back to the old behaviour rather than losing the count.
+      def write_event_buckets(entry, error_log_id, count)
+        buckets = entry["buckets"]
+        buckets = nil unless buckets.is_a?(Hash) && buckets.any?
+
+        pairs =
+          if buckets
+            buckets.map { |at, n| [ Time.zone.at(at.to_i), n.to_i ] }
+          else
+            [ [ parse_time(entry["last_seen_at"]) || Time.current, count ] ]
+          end
+
+        pairs.each do |bucket_at, n|
+          next unless n.positive?
+
+          # Three outcomes, three responses.
+          #
+          # :written     -- done.
+          # raises       -- TRANSIENT. Handled by the caller's rescue, which
+          #                 aborts and replays the batch intact. Swallowing it
+          #                 finalized the ledger with the bucket missing, so
+          #                 the replay was suppressed as already-applied and
+          #                 the time window lost those events permanently
+          #                 while the lifetime count stayed correct.
+          # :unavailable -- PERMANENT. Degrade: the rollup is simply not
+          #                 usable on this host (never migrated, adapter
+          #                 refuses the statement). Raising here rolled back
+          #                 the surrounding transaction and destroyed the
+          #                 authoritative lifetime count along with it --
+          #                 turning a missing time bucket into a lost count,
+          #                 which is strictly worse. Record it instead, so the
+          #                 result can say the timing evidence is incomplete.
+          case EventCount.accumulate(error_log_id: error_log_id, bucket_at: bucket_at, count: n)
+          when :written then next
+          else @buckets_incomplete = true
+          end
+        end
+      end
+
+      def reconcile_entry_count(entry, application)
         count = entry["count"].to_i
         return 0 if count <= 0
 
@@ -165,7 +284,12 @@ module RailsErrorDashboard
         # long-running unresolved error legitimately owns several unresolved
         # rows. An update_all across the whole hash would add N to every one
         # of them — seven real events becoming twelve counted occurrences.
-        target = unresolved_target(error_hash, application, env)
+        #
+        # Priority 0, tried first: a wont_fix row absorbs its recurrences at any
+        # age and keeps its status (FindOrIncrementError#find_wont_fix). Same
+        # atomic increment, so it shares the branch below.
+        target = wont_fix_target(error_hash, application, env) ||
+                 unresolved_target(error_hash, application, env)
         if target
           if env && target.environment.blank?
             ErrorLog.where(id: target.id).update_all([
@@ -177,30 +301,56 @@ module RailsErrorDashboard
               "occurrence_count = occurrence_count + ?, last_seen_at = ?", count, last_seen
             ])
           end
+          yield target.id if block_given?
           return count
         end
 
-        # Priority 2: resolved/wont_fix match — reopen, mirroring
+        # Priority 2: resolved match — reopen, mirroring
         # FindOrIncrementError so storm recurrences don't stay buried
         resolved_scope = ErrorLog
           .where(error_hash: error_hash, application_id: application.id)
-          .where(status: %w[resolved wont_fix])
+          .where(status: "resolved")
         if env
           resolved_scope = resolved_scope.where(environment: [ env, nil ])
             .order(Arel.sql("CASE WHEN environment IS NULL THEN 1 ELSE 0 END"))
         end
-        resolved = resolved_scope.order(last_seen_at: :desc).first
+        # .lock (SELECT ... FOR UPDATE) held to commit by the transaction opened
+        # in #call, exactly as FindOrIncrementError does for the same reopen.
+        # Without it this branch read occurrence_count into Ruby and wrote an
+        # ABSOLUTE value back, so two concurrent batches both read N and both
+        # wrote N+count -- one batch's events vanished while both reported
+        # success. The unresolved branch above is safe because it increments in
+        # SQL; this branch cannot use update_all because reopening is a state
+        # transition the dashboard must see, and update_all skips the
+        # after_update_commit broadcast.
+        resolved = resolved_scope.lock.order(last_seen_at: :desc).first
         if resolved
+          # The count is incremented in SQL, never read into Ruby and written
+          # back. This branch used to compute `resolved.occurrence_count + count`
+          # and write that ABSOLUTE value, so two concurrent batches both read N
+          # and both wrote N+count -- one batch's events vanished while both
+          # reported success. The .lock above serializes the pair on
+          # PostgreSQL/MySQL; the atomic increment below conserves the count on
+          # every adapter, including SQLite where FOR UPDATE is a no-op.
+          ErrorLog.where(id: resolved.id).update_all([
+            "occurrence_count = occurrence_count + ?", count
+          ])
+
+          # The reopen is a state transition the dashboard must see, so it stays
+          # an update! -- update_all would skip the after_update_commit
+          # broadcast. Reload first so this write does not clobber the increment
+          # just made with a stale in-memory occurrence_count.
+          resolved.reload
           attrs = {
             resolved: false,
             status: "new",
             resolved_at: nil,
-            occurrence_count: resolved.occurrence_count + count,
             last_seen_at: last_seen
           }
           attrs[:reopened_at] = Time.current if ErrorLog.column_names.include?("reopened_at")
           attrs[:environment] = env if env && resolved.environment.blank?
           resolved.update!(attrs)
+          yield resolved.id if block_given?
           return count
         end
 
@@ -241,14 +391,67 @@ module RailsErrorDashboard
         if ErrorLog.column_names.include?("context_captured_at")
           create_attrs[:context_captured_at] = create_attrs[:occurred_at]
         end
-        ErrorLog.create!(**ErrorLog.clamp_string_attributes(Services::SensitiveDataFilter.filter_attributes(create_attrs)))
+        begin
+          # requires_new opens a SAVEPOINT: on PostgreSQL a failed INSERT aborts
+          # its transaction, and every later statement -- including the recovery
+          # lookup below -- fails with InFailedSqlTransaction. The savepoint
+          # confines the damage to this INSERT so the batch can continue.
+          ErrorLog.transaction(requires_new: true) do
+            created = ErrorLog.create!(**ErrorLog.clamp_string_attributes(Services::SensitiveDataFilter.filter_attributes(create_attrs)))
+            yield created.id if block_given?
+          end
+        rescue ActiveRecord::RecordNotUnique
+          # Another flush created this group between our lookups and this
+          # INSERT -- the group-identity index objected. Two concurrent batches
+          # for the same fingerprint is the NORMAL storm shape (every process
+          # flushes its own batch), so this must not fail the entry: the counts
+          # exist nowhere but in this payload. Re-run the same lookups and add
+          # to the row that now exists, exactly as FindOrIncrementError does.
+          #
+          # Nested in its own transaction because the failed INSERT poisons the
+          # surrounding one on PostgreSQL.
+          raise unless (target = existing_target(error_hash, application, env))
+
+          ErrorLog.where(id: target.id).update_all([
+            "occurrence_count = occurrence_count + ?, last_seen_at = ?", count, last_seen
+          ])
+          # Yield on the RECOVERY path too: these counts are as real as the ones
+          # the winning INSERT wrote, so they need a time bucket as well, or a
+          # raced create silently loses its volume from every window query.
+          yield target.id if block_given?
+        end
         count
       end
 
+      # The row a retried INSERT should add to: any row holding this group
+      # identity, whatever its status. Deliberately wider than the
+      # priority-ordered lookups above -- the index has already proved a row
+      # with this identity exists, so refusing to match a resolved or wont_fix
+      # one would drop the counts instead.
+      def existing_target(error_hash, application, env)
+        scope = ErrorLog.where(error_hash: error_hash, application_id: application.id)
+        scope = scope.where(environment: [ env, nil ]) if env
+        scope.order(last_seen_at: :desc).select(:id).first
+      end
 
       # The unresolved row the full capture path would increment right now.
+      # No time window: "won't fix" holds for as long as the row keeps the status.
+      def wont_fix_target(error_hash, application, env)
+        scope = ErrorLog
+          .where(error_hash: error_hash, application_id: application.id)
+          .where(status: "wont_fix")
+        if env
+          scope = scope.where(environment: [ env, nil ])
+            .order(Arel.sql("CASE WHEN environment IS NULL THEN 1 ELSE 0 END"))
+        end
+        scope.order(last_seen_at: :desc).select(:id, :environment).first
+      end
+
       def unresolved_target(error_hash, application, env)
+        # Disjoint from wont_fix_target. Not where.not(...): that would also
+        # drop rows whose status is NULL.
         scope = ErrorLog.unresolved
+          .where("status IS NULL OR status <> ?", "wont_fix")
           .where(error_hash: error_hash, application_id: application.id)
           .where("occurred_at >= ?", 24.hours.ago)
         if env
@@ -303,6 +506,36 @@ module RailsErrorDashboard
         Application.find_or_create_by_name(app_name)
       end
 
+      # Record the interval whose per-event timing was lost.
+      #
+      # Keyed by the interval, NOT by a storm episode: the gate can shed events
+      # with its breaker closed and pass episode: nil, and a marker on the
+      # episode vanished in exactly that case. The events are just as
+      # untimed whether or not an episode object happens to exist.
+      #
+      # Bounds come from the entries themselves, so the gap describes when the
+      # events actually happened rather than when the worker got to them.
+      def record_timing_gap!(counted)
+        return unless EventTimingGap.table_exists?
+
+        times = @entries.filter_map do |entry|
+          entry = entry.with_indifferent_access if entry.respond_to?(:with_indifferent_access)
+          parse_time(entry["last_seen_at"]) || parse_time(entry["first_seen_at"])
+        end
+        first_seen = @entries.filter_map do |entry|
+          entry = entry.with_indifferent_access if entry.respond_to?(:with_indifferent_access)
+          parse_time(entry["first_seen_at"])
+        end
+
+        now = Time.current
+        EventTimingGap.create!(
+          application_id: resolve_application&.id,
+          covered_from: (first_seen + times).min || now,
+          covered_until: times.max || now,
+          events_affected: counted
+        )
+      end
+
       def upsert_storm_event(counted)
         return unless @episode.is_a?(Hash)
         return unless StormEvent.table_exists?
@@ -323,6 +556,13 @@ module RailsErrorDashboard
         event.fingerprints_affected = [ event.fingerprints_affected.to_i, @entries.size ].max
         event.peak_rate_per_minute = [ event.peak_rate_per_minute.to_i, @episode["peak_rate_per_minute"].to_i ].max
         event.reached_open ||= @episode["reached_open"] == true
+        # Sticky, like reached_open: once an episode has lost bucket timing it
+        # has lost it, and a later flush that happens to succeed does not make
+        # the earlier gap reappear. Guarded on the column so a host that has
+        # not run the migration yet keeps flushing normally.
+        if @buckets_incomplete && event.respond_to?(:buckets_incomplete)
+          event.buckets_incomplete = true
+        end
         event.top_fingerprints = top_fingerprints_json(event)
         event.ended_at = parse_time(@episode["ended_at"]) if @episode["ended_at"]
         event.save!

data/lib/rails_error_dashboard/commands/flush_swallowed_exceptions.rb

@@ -25,8 +25,11 @@ module RailsErrorDashboard
         app_id = current_application_id
 
         # Process raise counts
+        # Keys are scrubbed before they are split: a class name or path with an
+        # invalid byte makes split/blank? raise, and the outer rescue would then
+        # drop every remaining count in the batch along with it.
         @raise_counts.each do |key, count|
-          class_name, location = key.split("|", 2)
+          class_name, location = Services::EncodingSanitizer.scrub(key.to_s).split("|", 2)
           next if class_name.blank? || location.blank?
 
           upsert_raise(class_name, location, period, app_id, count)
@@ -34,7 +37,7 @@ module RailsErrorDashboard
 
         # Process rescue counts
         @rescue_counts.each do |key, count|
-          class_name, locations = key.split("|", 2)
+          class_name, locations = Services::EncodingSanitizer.scrub(key.to_s).split("|", 2)
           next if class_name.blank? || locations.blank?
 
           raise_loc, rescue_loc = locations.split("->", 2)

data/lib/rails_error_dashboard/commands/link_existing_issue.rb

@@ -32,6 +32,7 @@ module RailsErrorDashboard
 
       def call
         return { success: false, error: red_t("red.commands.issue.url_required") } if @issue_url.blank?
+        return { success: false, error: red_t("red.commands.issue.url_invalid") } unless Services::UrlSafety.http_url?(@issue_url)
 
         error = ErrorLog.find(@error_id)
         parsed = parse_issue_url(@issue_url)