rails_error_dashboard 0.12.1 → 0.14.0

data/lib/rails_error_dashboard/commands/log_error.rb

@@ -19,6 +19,14 @@ module RailsErrorDashboard
         ActiveRecord::Deadlocked
       ].freeze
 
+      # Context keys whose Hash value ErrorContext#extract_params folds into the
+      # stored request_params. Each one must be redacted before the payload
+      # crosses the queue, or the queue and the database drift apart.
+      # :job/:job_class carry live objects rather than Hashes and are skipped by
+      # the is_a?(Hash) guard; their arguments reach the payload through
+      # :params, which is covered here.
+      CONTEXT_PARAM_KEYS = %i[params additional_context metadata].freeze
+
       def self.call(exception, context = {})
         # Filter FIRST (ignore list + static sampling) so ignored exceptions
         # never count toward storm state. _pre_filtered prevents the sync path
@@ -79,7 +87,14 @@ module RailsErrorDashboard
       # Kept as a module-level helper so both sync and async paths can call it.
       # @return [Hash<String, Object>]
       def self.build_capture_span_attributes(exception, was_async:)
-        msg = exception.message.to_s
+        # Redact BEFORE truncating. The span leaves the process for a collector
+        # the host app may not control, so it is an export boundary and gets the
+        # same policy as storage -- otherwise enabling tracing silently widened
+        # what counts as safe to emit. filter_attributes returns its input
+        # unchanged when filter_sensitive_data is off and rescues internally.
+        msg = Services::SensitiveDataFilter.filter_attributes(
+          message: exception.message.to_s
+        )[:message].to_s
         {
           "error.type" => exception.class.name,
           "error.message" => msg.length > 200 ? "#{msg[0, 200]}…" : msg,
@@ -106,12 +121,18 @@ module RailsErrorDashboard
         # FlushStormCounts#canonical_hash does for storm counts.
         identity_parts = capture_identity_parts(exception, context)
 
-        exception_data = {
+        # Scrub BEFORE anything is serialized: ActiveJob JSON-encodes the
+        # payload on this (the request) thread, and an invalid byte in the
+        # message, a backtrace line or the context would raise right here. The
+        # identity above is still taken from the raw exception, exactly as the
+        # sync path takes it, so grouping is unchanged.
+        context = Services::EncodingSanitizer.scrub_deep(context)
+        exception_data = Services::EncodingSanitizer.scrub_deep(
           class_name: exception.class.name,
           message: exception.message,
           backtrace: exception.backtrace,
           cause_chain: serialize_cause_chain(exception)
-        }
+        )
 
         # Redact BEFORE the payload crosses the queue boundary. Until now the
         # filter ran only just before the INSERT, so a durable adapter
@@ -127,13 +148,33 @@ module RailsErrorDashboard
         exception_data, context = redact_async_payload(exception_data, context)
         context = context.merge(_identity: identity_parts) if identity_parts
 
+        # Stamp WHEN and WHAT RELEASE this event was captured under, before it
+        # crosses the queue. Both used to be resolved by the worker from
+        # Time.current and its own process configuration, so a queue backed up
+        # across a deploy gave the event the drain time and the new release --
+        # an error captured at 12:00 under v1 and drained at 14:00 under v2 was
+        # stored as 14:00/v2, and release comparison blamed the wrong build.
+        # The row's created_at still records when the worker wrote it, so queue
+        # lag stays observable.
+        context = context.merge(_captured_at: (normalized_occurred_at(context) || Time.current).iso8601(6))
+        context = context.merge(_app_version: capture_app_version) unless context.key?(:_app_version)
+        context = context.merge(_git_sha: capture_git_sha) unless context.key?(:_git_sha)
+
         # Storm shedding: :lite captures skip ALL pre-enqueue context harvest —
         # this is request-thread CPU, the most valuable thing to shed.
         lite = storm_lite?(context)
 
         # Harvest breadcrumbs NOW (before job dispatch — different thread won't have them)
         if !lite && RailsErrorDashboard.configuration.enable_breadcrumbs
-          context = context.merge(_serialized_breadcrumbs: Services::BreadcrumbCollector.harvest)
+          # A failing job's snapshot rides the envelope: the worker that runs
+          # the capture is a different thread (and often a different process),
+          # so a thread-local left here would never be seen again. Prefer it
+          # over the live buffer, which the job's ensure has already cleared.
+          job_trail = Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY]
+          Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY] = nil
+          harvested = Services::BreadcrumbCollector.harvest
+          trail = job_trail.is_a?(Array) && job_trail.any? ? job_trail : harvested
+          context = context.merge(_serialized_breadcrumbs: trail)
         end
 
         # Capture system health NOW (metrics are time-sensitive, different thread = different state)
@@ -265,6 +306,28 @@ module RailsErrorDashboard
         context = context.merge(request_params: filtered[:request_params]) if context.key?(:request_params)
         context = context.merge(request_url: filtered[:request_url]) if context.key?(:request_url)
 
+        # request_params is only one of the shapes that becomes the stored
+        # params: ErrorContext#extract_params also folds in :params,
+        # :additional_context, :metadata and the job/sidekiq keys. Those crossed
+        # the queue raw, so the row was redacted while the secret sat in the
+        # queue's backing store -- exactly the drift this method exists to
+        # prevent. ParameterFilter takes a Hash directly; filter_json_string is
+        # no use here because these are Hashes, not JSON strings.
+        param_filter = Services::SensitiveDataFilter.parameter_filter
+        if param_filter
+          CONTEXT_PARAM_KEYS.each do |key|
+            value = context[key]
+            next unless value.is_a?(Hash)
+
+            context = context.merge(key => param_filter.filter(value))
+          end
+        end
+
+        # The raw session ID must not sit in Redis / Solid Queue either.
+        if context[:session_id]
+          context = context.merge(session_id: Services::SensitiveDataFilter.digest_session_id(context[:session_id]))
+        end
+
         [ exception_data, context ]
       rescue => e
         # Never fail a capture over redaction. Fall back to the previous
@@ -292,7 +355,7 @@ module RailsErrorDashboard
           chain << {
             class_name: current.class.name,
             message: current.message&.to_s,
-            backtrace: current.backtrace&.first(20)&.map { |line| Services::BacktraceProcessor.shorten_gem_path(line) }
+            backtrace: current.backtrace&.first(20)&.map { |line| Services::BacktraceProcessor.shorten_gem_path(Services::EncodingSanitizer.scrub(line)) }
           }
 
           current = current.respond_to?(:cause) ? current.cause : nil
@@ -317,7 +380,10 @@ module RailsErrorDashboard
       #   Job can retry it; every other failure is still swallowed.
       def initialize(exception, context = {}, worker: false)
         @exception = exception
-        @context = context
+        # Invalid bytes anywhere in the context would raise as soon as it is
+        # JSON-encoded (ErrorContext does that in its constructor). A clean
+        # context costs one scan and its strings come back as the same objects.
+        @context = Services::EncodingSanitizer.scrub_deep(context)
         @worker = worker
       end
 
@@ -360,7 +426,11 @@ module RailsErrorDashboard
         truncated_backtrace = Services::BacktraceProcessor.truncate(@exception.backtrace)
         attributes = {
           application_id: application.id,
-          error_type: @exception.class.name,
+          # The reported type wins over the reconstructed class: an async
+          # capture of a type with no Ruby class here (a frontend error) is
+          # rebuilt as StandardError, and that name must not become the group
+          # identity. Falls back to the real class for every ordinary capture.
+          error_type: reported_error_type || @exception.class.name,
           message: @exception.message,
           backtrace: truncated_backtrace,
           user_id: error_context.user_id,
@@ -371,7 +441,12 @@ module RailsErrorDashboard
           platform: error_context.platform,
           controller_name: error_context.controller_name,
           action_name: error_context.action_name,
-          occurred_at: Time.current
+          # Three sources, most specific first. A caller-supplied event time
+          # (ManualErrorReporter documents it, already clamped to not-future by
+          # ErrorContext) beats the capture-time stamp carried across the queue
+          # (see call_async), which in turn beats this worker's clock. Ordinary
+          # synchronous captures supply neither and fall through to now.
+          occurred_at: error_context.occurred_at || captured_at_from_context || Time.current
         }
 
         # Enriched request context (if columns exist)
@@ -410,17 +485,21 @@ module RailsErrorDashboard
 
         #  Add git/release info if columns exist
         if ErrorLog.column_names.include?("git_sha")
-          attributes[:git_sha] = RailsErrorDashboard.configuration.git_sha ||
-                                  ENV["GIT_SHA"] ||
-                                  ENV["HEROKU_SLUG_COMMIT"] ||
-                                  ENV["RENDER_GIT_COMMIT"] ||
-                                  detect_git_sha_from_command
+          # The release the event was CAPTURED under, carried across the queue,
+          # falling back to this process's own for a synchronous capture.
+          attributes[:git_sha] = context_value(:_git_sha) || capture_git_sha
         end
 
         if ErrorLog.column_names.include?("app_version")
-          attributes[:app_version] = RailsErrorDashboard.configuration.app_version ||
-                                      ENV["APP_VERSION"] ||
-                                      detect_version_from_file
+          # Same precedence as occurred_at above. The reporter's own version
+          # wins over this server's -- for a mobile or frontend report they are
+          # different and the client's is the useful one (documented by
+          # ManualErrorReporter, previously discarded) -- then the release the
+          # event was CAPTURED under carried across the queue, then this
+          # process's own.
+          attributes[:app_version] = error_context.app_version ||
+                                      context_value(:_app_version) ||
+                                      capture_app_version
         end
 
         # Add environment snapshot (if column exists)
@@ -434,6 +513,10 @@ module RailsErrorDashboard
           attributes[:environment] = resolve_environment
         end
 
+        # Neutralise invalid bytes BEFORE filtering: the filter runs regexes,
+        # which raise on an invalid string, and PostgreSQL rejects the INSERT.
+        attributes = Services::EncodingSanitizer.scrub_deep(attributes)
+
         # Apply sensitive data filtering (on by default)
         attributes = Services::SensitiveDataFilter.filter_attributes(attributes)
 
@@ -442,25 +525,49 @@ module RailsErrorDashboard
 
         # Harvest breadcrumbs (if enabled and column exists)
         if !storm_lite && ErrorLog.column_names.include?("breadcrumbs") && RailsErrorDashboard.configuration.enable_breadcrumbs
-          # Sync path: harvest from current thread
-          raw_breadcrumbs = Services::BreadcrumbCollector.harvest
-
-          # Async path fallback: use pre-serialized breadcrumbs from call_async context
-          if raw_breadcrumbs.empty?
-            serialized = @context[:_serialized_breadcrumbs]
-            raw_breadcrumbs = serialized if serialized.is_a?(Array)
-          end
+          # The envelope wins when there is one.
+          #
+          # An async capture harvests the REQUEST's trail before enqueue and
+          # carries it here; the worker thread running this job now has a
+          # buffer of its own (jobs get one, so a failing job has a trail), and
+          # harvesting that first would show the worker's activity in place of
+          # the request's. Draining the current thread stays the sync path, and
+          # still runs below so a worker's own buffer is not left to leak.
+          serialized = @context[:_serialized_breadcrumbs] || @context["_serialized_breadcrumbs"]
+
+          # A failing job's trail, snapshotted by the around_perform on its way
+          # out. Active Job reports a job error two frames OUTSIDE the callback
+          # that owns the buffer, so by now the live buffer is already gone and
+          # a current-thread harvest returns nothing -- the snapshot is the only
+          # surviving copy. Consumed here, whoever wrote it.
+          job_trail = Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY]
+          Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY] = nil
+
+          # Still unconditional: drains a worker's own buffer so it cannot leak.
+          current = Services::BreadcrumbCollector.harvest
+
+          # The envelope stays FIRST. An async capture carries the request's
+          # trail across the queue, and neither the worker's own buffer nor a
+          # snapshot may displace it.
+          raw_breadcrumbs =
+            if serialized.is_a?(Array) && serialized.any?
+              serialized
+            elsif job_trail.is_a?(Array) && job_trail.any?
+              job_trail
+            else
+              current
+            end
 
           if raw_breadcrumbs.is_a?(Array) && raw_breadcrumbs.any?
             filtered = Services::BreadcrumbCollector.filter_sensitive(raw_breadcrumbs)
-            attributes[:breadcrumbs] = filtered.to_json
+            attributes[:breadcrumbs] = Services::EncodingSanitizer.scrub_deep(filtered).to_json
           end
         end
 
         # Capture system health snapshot (if enabled and column exists)
         if !storm_lite && ErrorLog.column_names.include?("system_health") && RailsErrorDashboard.configuration.enable_system_health
           health_data = @context[:_serialized_system_health] || Services::SystemHealthSnapshot.capture
-          attributes[:system_health] = health_data.to_json
+          attributes[:system_health] = Services::EncodingSanitizer.scrub_deep(health_data).to_json
         end
 
         # Capture local variables (if enabled and column exists)
@@ -472,7 +579,7 @@ module RailsErrorDashboard
             raw_locals ||= @context[:_serialized_local_variables]
             if raw_locals.is_a?(Hash) && raw_locals.any?
               serialized = raw_locals == @context[:_serialized_local_variables] ? raw_locals : Services::VariableSerializer.call(raw_locals)
-              attributes[:local_variables] = serialized.to_json
+              attributes[:local_variables] = Services::EncodingSanitizer.scrub_deep(serialized).to_json
             end
           rescue => e
             RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] Local variable serialization failed: #{e.message}")
@@ -496,7 +603,7 @@ module RailsErrorDashboard
                   additional_filter_patterns: RailsErrorDashboard.configuration.instance_variable_filter_patterns
                 )
               end
-              attributes[:instance_variables] = serialized.to_json
+              attributes[:instance_variables] = Services::EncodingSanitizer.scrub_deep(serialized).to_json
             end
           rescue => e
             RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] Instance variable serialization failed: #{e.message}")
@@ -511,9 +618,15 @@ module RailsErrorDashboard
         # context payloads by design, and must not be recorded as though it
         # refreshed the snapshot -- nor allowed to overwrite a good backtrace.
         # It is stripped before the INSERT (it is a signal, not a column).
+        #
+        # Only the SHED case is asserted here. "This capture was complete" and
+        # "the stored snapshot is complete" are different claims: when the
+        # grouping command keeps an earlier occurrence's user or locals beside
+        # this one's URL, the row displays a mixture, and only that command can
+        # see it. Passing nil lets it decide between "full" and "partial".
         error_log = ErrorLog.find_or_increment_by_hash(
           error_hash,
-          attributes.merge(error_hash: error_hash, _context_fidelity: storm_lite ? "lite" : "full")
+          attributes.merge(error_hash: error_hash, _context_fidelity: storm_lite ? "lite" : nil)
         )
 
         # OTel: now that the error_log exists, attach its id + dedup flag + severity
@@ -532,13 +645,16 @@ module RailsErrorDashboard
               occurred_at: attributes[:occurred_at],
               user_id: attributes[:user_id],
               request_id: error_context.request_id,
-              session_id: error_context.session_id
+              # Digest, not the raw ID -- it is a bearer credential. Idempotent,
+              # so a value already digested at the queue boundary passes through.
+              session_id: Services::SensitiveDataFilter.storable_session_id(error_context.session_id)
             }
             # The release THIS event happened under. The group keeps its first
             # release; per-release counts come from here (ReleaseTimeline).
             occurrence_columns = ErrorOccurrence.column_names
             occurrence_attrs[:app_version] = attributes[:app_version] if occurrence_columns.include?("app_version")
             occurrence_attrs[:git_sha] = attributes[:git_sha] if occurrence_columns.include?("git_sha")
+            occurrence_attrs = Services::EncodingSanitizer.scrub_deep(occurrence_attrs)
             ErrorOccurrence.create(ErrorOccurrence.clamp_string_attributes(occurrence_attrs))
           rescue => e
             RailsErrorDashboard::Logger.error("Failed to create error occurrence: #{e.message}")
@@ -548,12 +664,12 @@ module RailsErrorDashboard
         # Send notifications for new errors and reopened errors (with throttling).
         # Muted errors skip notification dispatch but still fire plugin events.
         if error_log.occurrence_count == 1
-          maybe_notify(error_log) { Services::NotificationThrottler.severity_meets_minimum?(error_log) }
+          maybe_notify(error_log, first_occurrence: true) { Services::NotificationThrottler.severity_meets_minimum?(error_log) }
           PluginRegistry.dispatch(:on_error_logged, error_log)
           trigger_callbacks(error_log)
           emit_instrumentation_events(error_log)
         elsif error_log.just_reopened
-          maybe_notify(error_log) { Services::NotificationThrottler.should_notify?(error_log) }
+          maybe_notify(error_log, respect_cooldown: true) { Services::NotificationThrottler.severity_meets_minimum?(error_log) }
           PluginRegistry.dispatch(:on_error_reopened, error_log)
           trigger_callbacks(error_log)
           emit_instrumentation_events(error_log)
@@ -590,14 +706,30 @@ module RailsErrorDashboard
       # Muted errors skip notifications but still fire plugin events/callbacks.
       # During a storm (breaker not closed) per-error notifications are
       # suppressed — a single storm notification replaces them.
-      def maybe_notify(error_log)
+      #
+      # respect_cooldown is true only for the reopened path, which is the only one
+      # the cooldown has ever applied to: a first occurrence and a threshold
+      # milestone always notify. They still stamp the row, so an error reopened
+      # minutes after its first notification is throttled.
+      def maybe_notify(error_log, respect_cooldown: false, first_occurrence: false)
         return if error_log.muted?
+        # wont_fix: the team has decided not to act on this error, so its
+        # recurrences are counted and nothing else. Plugin events still fire,
+        # exactly as they do for a muted error.
+        return if error_log.status.to_s == "wont_fix"
         return if Services::StormProtection::Gate.notifications_suppressed?
         return unless Services::NotificationThrottler.environment_allowed?(error_log)
         return unless yield
+        return if first_occurrence && burst_capped?
+
+        # Claim, THEN send. The claim is a conditional UPDATE only one process can
+        # win, so N workers reopening the same error send one notification, not
+        # N. The price: if the send below fails, this error is not retried inside
+        # the cooldown window. Recording after sending is what let every process
+        # through.
+        return unless Services::NotificationThrottler.claim!(error_log, respect_cooldown: respect_cooldown)
 
         Services::ErrorNotificationDispatcher.call(error_log)
-        Services::NotificationThrottler.record_notification(error_log)
       rescue => e
         # The error row is already written by the time we get here. A channel
         # that cannot be reached (Redis down for the Slack job's enqueue, a
@@ -608,6 +740,37 @@ module RailsErrorDashboard
         )
       end
 
+      # A bad deploy can produce hundreds of DISTINCT new errors, each a first
+      # occurrence the per-error cooldown never sees. Past
+      # config.notification_burst_limit per window, new-error notifications are
+      # held back and ONE summary says so. Asked only for first occurrences that
+      # were otherwise going to notify, and before the cooldown claim, so a
+      # suppressed error is not stamped as notified. The error itself is already
+      # stored; only the notification is dropped.
+      def burst_capped?
+        # Nothing can notify, so there is nothing to cap, and no summary to enqueue.
+        return false unless Services::ErrorNotificationDispatcher.any_channel?
+
+        case Services::NotificationThrottler.burst_decision
+        when :summarize
+          config = RailsErrorDashboard.configuration
+          NotificationBurstSummaryJob.perform_later(
+            limit: config.notification_burst_limit.to_i,
+            window_seconds: config.notification_burst_window_seconds.to_i,
+            locale: ApplicationJob.enqueue_locale
+          )
+          true
+        when :suppress
+          true
+        else
+          false
+        end
+      rescue => e
+        # Fail-open: a cap that cannot decide must not cost a notification.
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] burst cap check failed: #{e.class}: #{e.message}")
+        false
+      end
+
       # The environment this error is attributed to: an explicit context value
       # (truncated to the column) or the process-wide resolution. Never nil.
       def resolve_environment
@@ -704,6 +867,7 @@ module RailsErrorDashboard
         # Return early if baseline alerts are disabled or error is muted
         return unless config.enable_baseline_alerts
         return if error_log.muted?
+        return if error_log.status.to_s == "wont_fix" # see maybe_notify
         return unless Services::NotificationThrottler.environment_allowed?(error_log)
         return unless defined?(Queries::BaselineStats)
         return unless defined?(BaselineAlertJob)
@@ -760,17 +924,75 @@ module RailsErrorDashboard
         nil
       end
 
-      # Detect git SHA from git command (fallback)
-      def detect_git_sha_from_command
-        return nil unless File.exist?(Rails.root.join(".git"))
-        `git rev-parse --short HEAD 2>/dev/null`.strip.presence
-      rescue => e
-        RailsErrorDashboard::Logger.debug("Could not detect git SHA: #{e.message}")
+      # The error type as REPORTED, carried across the queue by
+      # AsyncErrorLoggingJob. Symbol or string key: ActiveJob's serializer
+      # turns symbol keys into strings on the way through.
+      def reported_error_type
+        return nil unless @context.is_a?(Hash)
+
+        (@context[:_reported_error_type] || @context["_reported_error_type"]).presence
+      rescue StandardError
         nil
       end
 
       # Detect app version from VERSION file (fallback)
       def detect_version_from_file
+        self.class.detect_version_from_file
+      end
+
+      # --- Capture-time envelope -------------------------------------------
+      #
+      # The release THIS process is running, resolved on the capture thread so
+      # it can be stamped onto the payload before it crosses the queue. The
+      # worker reads the stamp instead of asking its own configuration, which
+      # is what made a queued event inherit the release it was drained under.
+
+      # ONE normalization of a caller-supplied event time, shared by both
+      # transports.
+      #
+      # ErrorContext#extract_occurred_at already parses Strings, clamps a
+      # future time and rescues bad input -- but it runs in the WORKER on the
+      # async path, long after this method's caller has already had to
+      # serialize the value. Stamping the envelope by calling .iso8601 on the
+      # raw input therefore raised NoMethodError for a String (a documented
+      # ManualErrorReporter input form), the outer rescue in .call swallowed
+      # it, and the capture vanished: nothing enqueued, no row, nothing logged
+      # at error level. The sync path accepted the identical input.
+      #
+      # Normalizing here keeps ONE policy -- including the future clamp -- and
+      # returns nil rather than raising, so an unparseable value costs the
+      # timestamp and never the error itself (Safety Rule 1).
+      # @return [Time, nil]
+      def self.normalized_occurred_at(context)
+        raw = context[:occurred_at] || context["occurred_at"]
+        return nil if raw.nil? || (raw.respond_to?(:empty?) && raw.empty?)
+
+        time = raw.is_a?(String) ? Time.zone.parse(raw) : raw
+        return nil unless time.respond_to?(:to_time)
+
+        [ time.to_time, Time.current ].min
+      rescue StandardError => e
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] Unparseable occurred_at (#{e.class}); using capture time"
+        )
+        nil
+      end
+
+      def self.capture_app_version
+        RailsErrorDashboard.configuration.app_version ||
+          ENV["APP_VERSION"] ||
+          detect_version_from_file
+      end
+
+      def self.capture_git_sha
+        RailsErrorDashboard.configuration.git_sha ||
+          ENV["GIT_SHA"] ||
+          ENV["HEROKU_SLUG_COMMIT"] ||
+          ENV["RENDER_GIT_COMMIT"] ||
+          RailsErrorDashboard.detected_git_sha
+      end
+
+      def self.detect_version_from_file
         version_file = Rails.root.join("VERSION")
         return File.read(version_file).strip if File.exist?(version_file)
         nil
@@ -778,6 +1000,35 @@ module RailsErrorDashboard
         RailsErrorDashboard::Logger.debug("Could not detect version: #{e.message}")
         nil
       end
+
+      # Symbol or string key: the async job round-trips the context through the
+      # queue serializer, which turns symbol keys into strings.
+      def context_value(key)
+        return nil unless @context.is_a?(Hash)
+
+        (@context[key] || @context[key.to_s]).presence
+      rescue StandardError
+        nil
+      end
+
+      def capture_app_version
+        self.class.capture_app_version
+      end
+
+      def capture_git_sha
+        self.class.capture_git_sha
+      end
+
+      # The capture-time stamp an async payload carries, or nil for a
+      # synchronous capture (which has no queue hop and is already "now").
+      def captured_at_from_context
+        raw = context_value(:_captured_at)
+        return nil if raw.blank?
+
+        Time.zone ? Time.zone.parse(raw.to_s) : Time.parse(raw.to_s)
+      rescue StandardError
+        nil
+      end
     end
   end
 end

data/lib/rails_error_dashboard/commands/mute_error.rb

@@ -32,6 +32,7 @@ module RailsErrorDashboard
           muted_reason: @reason
         )
 
+        Services::AnalyticsCacheManager.clear
         PluginRegistry.dispatch(:on_error_muted, error)
         error
       end

data/lib/rails_error_dashboard/commands/resolve_error.rb

@@ -25,6 +25,8 @@ module RailsErrorDashboard
           resolution_reference: @resolution_data[:resolution_reference],
           status: "resolved"
         )
+        # The stat cards are cached; a user action must show up at once.
+        Services::AnalyticsCacheManager.clear
 
         # Dispatch plugin event for resolved error
         PluginRegistry.dispatch(:on_error_resolved, error)

data/lib/rails_error_dashboard/commands/scrub_invalid_encoding.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Commands
+    # Command: repair rows that were stored with invalid bytes
+    #
+    # New captures are scrubbed on the way in (Services::EncodingSanitizer), but
+    # that does nothing for rows already in the table. SQLite and MySQL accept
+    # invalid UTF-8 and NUL bytes, and a row holding them makes the pages that
+    # render it answer 500. PostgreSQL rejects such rows at INSERT, so there is
+    # normally nothing to repair there; the scan is harmless.
+    #
+    # Behind `rake error_dashboard:scrub_invalid_encoding`. Safe to re-run: a
+    # second pass finds nothing to repair.
+    #
+    # @example
+    #   ScrubInvalidEncoding.call # => { scanned: 1200, repaired: 3, unreadable: [] }
+    class ScrubInvalidEncoding
+      BATCH_SIZE = 500
+
+      MODEL_NAMES = %w[ErrorLog ErrorOccurrence].freeze
+
+      def self.call(batch_size: BATCH_SIZE)
+        new(batch_size: batch_size).call
+      end
+
+      def initialize(batch_size: BATCH_SIZE)
+        @batch_size = batch_size
+        @scanned = 0
+        @repaired = 0
+        @unreadable = []
+      end
+
+      # @return [Hash] { scanned:, repaired:, unreadable: [ "ErrorLog#12", ... ] }
+      def call
+        models.each { |model| scrub_model(model) }
+
+        { scanned: @scanned, repaired: @repaired, unreadable: @unreadable }
+      end
+
+      private
+
+      def models
+        MODEL_NAMES.filter_map do |name|
+          model = RailsErrorDashboard.const_get(name)
+          model if model.table_exists?
+        rescue => e
+          RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] ScrubInvalidEncoding skipped #{name}: #{e.class}")
+          nil
+        end
+      end
+
+      def scrub_model(model)
+        columns = model.columns.select { |column| %i[string text].include?(column.type) }.map(&:name)
+        return if columns.empty?
+
+        model.in_batches(of: @batch_size) do |batch|
+          ids = batch.pluck(model.primary_key)
+          load_rows(model, ids).each { |row| scrub_row(row, columns) }
+        end
+      end
+
+      # One query per batch; if that batch cannot be materialised at all, fall
+      # back to row-by-row so a single unreadable row is reported by id instead
+      # of hiding the 499 readable ones around it.
+      def load_rows(model, ids)
+        model.where(model.primary_key => ids).to_a
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] ScrubInvalidEncoding batch read failed: #{e.class}")
+        ids.filter_map do |id|
+          model.find(id)
+        rescue => row_error
+          @unreadable << "#{model.name.demodulize}##{id} (#{row_error.class})"
+          nil
+        end
+      end
+
+      def scrub_row(row, columns)
+        @scanned += 1
+
+        changes = columns.each_with_object({}) do |column, fixed|
+          value = row.read_attribute(column)
+          next unless value.is_a?(String)
+
+          clean = Services::EncodingSanitizer.scrub(value)
+          fixed[column] = clean unless clean.equal?(value) || clean == value
+        end
+        # The model scrubs invalid strings as it loads a row, so by now they
+        # read as clean. It remembers which ones it had to repair.
+        row.invalid_encoding_attributes.each do |column|
+          changes[column] = row.read_attribute(column) if columns.include?(column)
+        end
+        return if changes.empty?
+
+        # update_columns: no callbacks, no validations, no updated_at bump. This
+        # is a byte-level repair, not an edit.
+        row.update_columns(changes)
+        @repaired += 1
+      rescue => e
+        @unreadable << "#{row.class.name.demodulize}##{row.id} (#{e.class})"
+      end
+    end
+  end
+end