rails_error_dashboard 0.13.0 → 0.14.0

data/lib/rails_error_dashboard/commands/log_error.rb

@@ -19,6 +19,14 @@ module RailsErrorDashboard
         ActiveRecord::Deadlocked
       ].freeze
 
+      # Context keys whose Hash value ErrorContext#extract_params folds into the
+      # stored request_params. Each one must be redacted before the payload
+      # crosses the queue, or the queue and the database drift apart.
+      # :job/:job_class carry live objects rather than Hashes and are skipped by
+      # the is_a?(Hash) guard; their arguments reach the payload through
+      # :params, which is covered here.
+      CONTEXT_PARAM_KEYS = %i[params additional_context metadata].freeze
+
       def self.call(exception, context = {})
         # Filter FIRST (ignore list + static sampling) so ignored exceptions
         # never count toward storm state. _pre_filtered prevents the sync path
@@ -79,7 +87,14 @@ module RailsErrorDashboard
       # Kept as a module-level helper so both sync and async paths can call it.
       # @return [Hash<String, Object>]
       def self.build_capture_span_attributes(exception, was_async:)
-        msg = exception.message.to_s
+        # Redact BEFORE truncating. The span leaves the process for a collector
+        # the host app may not control, so it is an export boundary and gets the
+        # same policy as storage -- otherwise enabling tracing silently widened
+        # what counts as safe to emit. filter_attributes returns its input
+        # unchanged when filter_sensitive_data is off and rescues internally.
+        msg = Services::SensitiveDataFilter.filter_attributes(
+          message: exception.message.to_s
+        )[:message].to_s
         {
           "error.type" => exception.class.name,
           "error.message" => msg.length > 200 ? "#{msg[0, 200]}…" : msg,
@@ -133,13 +148,33 @@ module RailsErrorDashboard
         exception_data, context = redact_async_payload(exception_data, context)
         context = context.merge(_identity: identity_parts) if identity_parts
 
+        # Stamp WHEN and WHAT RELEASE this event was captured under, before it
+        # crosses the queue. Both used to be resolved by the worker from
+        # Time.current and its own process configuration, so a queue backed up
+        # across a deploy gave the event the drain time and the new release --
+        # an error captured at 12:00 under v1 and drained at 14:00 under v2 was
+        # stored as 14:00/v2, and release comparison blamed the wrong build.
+        # The row's created_at still records when the worker wrote it, so queue
+        # lag stays observable.
+        context = context.merge(_captured_at: (normalized_occurred_at(context) || Time.current).iso8601(6))
+        context = context.merge(_app_version: capture_app_version) unless context.key?(:_app_version)
+        context = context.merge(_git_sha: capture_git_sha) unless context.key?(:_git_sha)
+
         # Storm shedding: :lite captures skip ALL pre-enqueue context harvest —
         # this is request-thread CPU, the most valuable thing to shed.
         lite = storm_lite?(context)
 
         # Harvest breadcrumbs NOW (before job dispatch — different thread won't have them)
         if !lite && RailsErrorDashboard.configuration.enable_breadcrumbs
-          context = context.merge(_serialized_breadcrumbs: Services::BreadcrumbCollector.harvest)
+          # A failing job's snapshot rides the envelope: the worker that runs
+          # the capture is a different thread (and often a different process),
+          # so a thread-local left here would never be seen again. Prefer it
+          # over the live buffer, which the job's ensure has already cleared.
+          job_trail = Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY]
+          Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY] = nil
+          harvested = Services::BreadcrumbCollector.harvest
+          trail = job_trail.is_a?(Array) && job_trail.any? ? job_trail : harvested
+          context = context.merge(_serialized_breadcrumbs: trail)
         end
 
         # Capture system health NOW (metrics are time-sensitive, different thread = different state)
@@ -270,6 +305,24 @@ module RailsErrorDashboard
 
         context = context.merge(request_params: filtered[:request_params]) if context.key?(:request_params)
         context = context.merge(request_url: filtered[:request_url]) if context.key?(:request_url)
+
+        # request_params is only one of the shapes that becomes the stored
+        # params: ErrorContext#extract_params also folds in :params,
+        # :additional_context, :metadata and the job/sidekiq keys. Those crossed
+        # the queue raw, so the row was redacted while the secret sat in the
+        # queue's backing store -- exactly the drift this method exists to
+        # prevent. ParameterFilter takes a Hash directly; filter_json_string is
+        # no use here because these are Hashes, not JSON strings.
+        param_filter = Services::SensitiveDataFilter.parameter_filter
+        if param_filter
+          CONTEXT_PARAM_KEYS.each do |key|
+            value = context[key]
+            next unless value.is_a?(Hash)
+
+            context = context.merge(key => param_filter.filter(value))
+          end
+        end
+
         # The raw session ID must not sit in Redis / Solid Queue either.
         if context[:session_id]
           context = context.merge(session_id: Services::SensitiveDataFilter.digest_session_id(context[:session_id]))
@@ -373,7 +426,11 @@ module RailsErrorDashboard
         truncated_backtrace = Services::BacktraceProcessor.truncate(@exception.backtrace)
         attributes = {
           application_id: application.id,
-          error_type: @exception.class.name,
+          # The reported type wins over the reconstructed class: an async
+          # capture of a type with no Ruby class here (a frontend error) is
+          # rebuilt as StandardError, and that name must not become the group
+          # identity. Falls back to the real class for every ordinary capture.
+          error_type: reported_error_type || @exception.class.name,
           message: @exception.message,
           backtrace: truncated_backtrace,
           user_id: error_context.user_id,
@@ -384,7 +441,12 @@ module RailsErrorDashboard
           platform: error_context.platform,
           controller_name: error_context.controller_name,
           action_name: error_context.action_name,
-          occurred_at: Time.current
+          # Three sources, most specific first. A caller-supplied event time
+          # (ManualErrorReporter documents it, already clamped to not-future by
+          # ErrorContext) beats the capture-time stamp carried across the queue
+          # (see call_async), which in turn beats this worker's clock. Ordinary
+          # synchronous captures supply neither and fall through to now.
+          occurred_at: error_context.occurred_at || captured_at_from_context || Time.current
         }
 
         # Enriched request context (if columns exist)
@@ -423,17 +485,21 @@ module RailsErrorDashboard
 
         #  Add git/release info if columns exist
         if ErrorLog.column_names.include?("git_sha")
-          attributes[:git_sha] = RailsErrorDashboard.configuration.git_sha ||
-                                  ENV["GIT_SHA"] ||
-                                  ENV["HEROKU_SLUG_COMMIT"] ||
-                                  ENV["RENDER_GIT_COMMIT"] ||
-                                  RailsErrorDashboard.detected_git_sha
+          # The release the event was CAPTURED under, carried across the queue,
+          # falling back to this process's own for a synchronous capture.
+          attributes[:git_sha] = context_value(:_git_sha) || capture_git_sha
         end
 
         if ErrorLog.column_names.include?("app_version")
-          attributes[:app_version] = RailsErrorDashboard.configuration.app_version ||
-                                      ENV["APP_VERSION"] ||
-                                      detect_version_from_file
+          # Same precedence as occurred_at above. The reporter's own version
+          # wins over this server's -- for a mobile or frontend report they are
+          # different and the client's is the useful one (documented by
+          # ManualErrorReporter, previously discarded) -- then the release the
+          # event was CAPTURED under carried across the queue, then this
+          # process's own.
+          attributes[:app_version] = error_context.app_version ||
+                                      context_value(:_app_version) ||
+                                      capture_app_version
         end
 
         # Add environment snapshot (if column exists)
@@ -459,14 +525,38 @@ module RailsErrorDashboard
 
         # Harvest breadcrumbs (if enabled and column exists)
         if !storm_lite && ErrorLog.column_names.include?("breadcrumbs") && RailsErrorDashboard.configuration.enable_breadcrumbs
-          # Sync path: harvest from current thread
-          raw_breadcrumbs = Services::BreadcrumbCollector.harvest
-
-          # Async path fallback: use pre-serialized breadcrumbs from call_async context
-          if raw_breadcrumbs.empty?
-            serialized = @context[:_serialized_breadcrumbs]
-            raw_breadcrumbs = serialized if serialized.is_a?(Array)
-          end
+          # The envelope wins when there is one.
+          #
+          # An async capture harvests the REQUEST's trail before enqueue and
+          # carries it here; the worker thread running this job now has a
+          # buffer of its own (jobs get one, so a failing job has a trail), and
+          # harvesting that first would show the worker's activity in place of
+          # the request's. Draining the current thread stays the sync path, and
+          # still runs below so a worker's own buffer is not left to leak.
+          serialized = @context[:_serialized_breadcrumbs] || @context["_serialized_breadcrumbs"]
+
+          # A failing job's trail, snapshotted by the around_perform on its way
+          # out. Active Job reports a job error two frames OUTSIDE the callback
+          # that owns the buffer, so by now the live buffer is already gone and
+          # a current-thread harvest returns nothing -- the snapshot is the only
+          # surviving copy. Consumed here, whoever wrote it.
+          job_trail = Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY]
+          Thread.current[Subscribers::BreadcrumbSubscriber::JOB_TRAIL_KEY] = nil
+
+          # Still unconditional: drains a worker's own buffer so it cannot leak.
+          current = Services::BreadcrumbCollector.harvest
+
+          # The envelope stays FIRST. An async capture carries the request's
+          # trail across the queue, and neither the worker's own buffer nor a
+          # snapshot may displace it.
+          raw_breadcrumbs =
+            if serialized.is_a?(Array) && serialized.any?
+              serialized
+            elsif job_trail.is_a?(Array) && job_trail.any?
+              job_trail
+            else
+              current
+            end
 
           if raw_breadcrumbs.is_a?(Array) && raw_breadcrumbs.any?
             filtered = Services::BreadcrumbCollector.filter_sensitive(raw_breadcrumbs)
@@ -528,9 +618,15 @@ module RailsErrorDashboard
         # context payloads by design, and must not be recorded as though it
         # refreshed the snapshot -- nor allowed to overwrite a good backtrace.
         # It is stripped before the INSERT (it is a signal, not a column).
+        #
+        # Only the SHED case is asserted here. "This capture was complete" and
+        # "the stored snapshot is complete" are different claims: when the
+        # grouping command keeps an earlier occurrence's user or locals beside
+        # this one's URL, the row displays a mixture, and only that command can
+        # see it. Passing nil lets it decide between "full" and "partial".
         error_log = ErrorLog.find_or_increment_by_hash(
           error_hash,
-          attributes.merge(error_hash: error_hash, _context_fidelity: storm_lite ? "lite" : "full")
+          attributes.merge(error_hash: error_hash, _context_fidelity: storm_lite ? "lite" : nil)
         )
 
         # OTel: now that the error_log exists, attach its id + dedup flag + severity
@@ -828,8 +924,75 @@ module RailsErrorDashboard
         nil
       end
 
+      # The error type as REPORTED, carried across the queue by
+      # AsyncErrorLoggingJob. Symbol or string key: ActiveJob's serializer
+      # turns symbol keys into strings on the way through.
+      def reported_error_type
+        return nil unless @context.is_a?(Hash)
+
+        (@context[:_reported_error_type] || @context["_reported_error_type"]).presence
+      rescue StandardError
+        nil
+      end
+
       # Detect app version from VERSION file (fallback)
       def detect_version_from_file
+        self.class.detect_version_from_file
+      end
+
+      # --- Capture-time envelope -------------------------------------------
+      #
+      # The release THIS process is running, resolved on the capture thread so
+      # it can be stamped onto the payload before it crosses the queue. The
+      # worker reads the stamp instead of asking its own configuration, which
+      # is what made a queued event inherit the release it was drained under.
+
+      # ONE normalization of a caller-supplied event time, shared by both
+      # transports.
+      #
+      # ErrorContext#extract_occurred_at already parses Strings, clamps a
+      # future time and rescues bad input -- but it runs in the WORKER on the
+      # async path, long after this method's caller has already had to
+      # serialize the value. Stamping the envelope by calling .iso8601 on the
+      # raw input therefore raised NoMethodError for a String (a documented
+      # ManualErrorReporter input form), the outer rescue in .call swallowed
+      # it, and the capture vanished: nothing enqueued, no row, nothing logged
+      # at error level. The sync path accepted the identical input.
+      #
+      # Normalizing here keeps ONE policy -- including the future clamp -- and
+      # returns nil rather than raising, so an unparseable value costs the
+      # timestamp and never the error itself (Safety Rule 1).
+      # @return [Time, nil]
+      def self.normalized_occurred_at(context)
+        raw = context[:occurred_at] || context["occurred_at"]
+        return nil if raw.nil? || (raw.respond_to?(:empty?) && raw.empty?)
+
+        time = raw.is_a?(String) ? Time.zone.parse(raw) : raw
+        return nil unless time.respond_to?(:to_time)
+
+        [ time.to_time, Time.current ].min
+      rescue StandardError => e
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] Unparseable occurred_at (#{e.class}); using capture time"
+        )
+        nil
+      end
+
+      def self.capture_app_version
+        RailsErrorDashboard.configuration.app_version ||
+          ENV["APP_VERSION"] ||
+          detect_version_from_file
+      end
+
+      def self.capture_git_sha
+        RailsErrorDashboard.configuration.git_sha ||
+          ENV["GIT_SHA"] ||
+          ENV["HEROKU_SLUG_COMMIT"] ||
+          ENV["RENDER_GIT_COMMIT"] ||
+          RailsErrorDashboard.detected_git_sha
+      end
+
+      def self.detect_version_from_file
         version_file = Rails.root.join("VERSION")
         return File.read(version_file).strip if File.exist?(version_file)
         nil
@@ -837,6 +1000,35 @@ module RailsErrorDashboard
         RailsErrorDashboard::Logger.debug("Could not detect version: #{e.message}")
         nil
       end
+
+      # Symbol or string key: the async job round-trips the context through the
+      # queue serializer, which turns symbol keys into strings.
+      def context_value(key)
+        return nil unless @context.is_a?(Hash)
+
+        (@context[key] || @context[key.to_s]).presence
+      rescue StandardError
+        nil
+      end
+
+      def capture_app_version
+        self.class.capture_app_version
+      end
+
+      def capture_git_sha
+        self.class.capture_git_sha
+      end
+
+      # The capture-time stamp an async payload carries, or nil for a
+      # synchronous capture (which has no queue hop and is already "now").
+      def captured_at_from_context
+        raw = context_value(:_captured_at)
+        return nil if raw.blank?
+
+        Time.zone ? Time.zone.parse(raw.to_s) : Time.parse(raw.to_s)
+      rescue StandardError
+        nil
+      end
     end
   end
 end

data/lib/rails_error_dashboard/configuration.rb

@@ -182,6 +182,12 @@ module RailsErrorDashboard
     attr_accessor :local_variable_max_array_items     # Max array items to serialize (default: 10)
     attr_accessor :local_variable_max_hash_items      # Max hash entries to serialize (default: 20)
     attr_accessor :local_variable_filter_patterns     # Additional sensitive name patterns (default: [])
+    # Calling #inspect on an unknown object runs arbitrary APPLICATION code on
+    # the failure path; truncating the result bounds storage, not cost. The
+    # default is a safe structural summary, with full inspect per type by
+    # opt-in and a wall-clock budget even then.
+    attr_accessor :local_variable_inspect_allowlist   # Class names whose #inspect may run (default: safe built-ins)
+    attr_accessor :local_variable_inspect_budget_ms   # Wall-clock budget for one #inspect (default: 5)
 
     # Instance variable capture from tp.self (receiver object at raise time)
     attr_accessor :enable_instance_variables           # Master switch (default: false)
@@ -415,6 +421,20 @@ module RailsErrorDashboard
       @local_variable_max_array_items = 10      # Max array items to serialize
       @local_variable_max_hash_items = 20       # Max hash entries to serialize
       @local_variable_filter_patterns = []      # Additional sensitive variable name patterns
+      # Struct is serialized MEMBER-WISE (never via its own #inspect), so it
+      # needs no allowlist entry -- see VariableSerializer.serialize_struct.
+      #
+      # ActiveModel is deliberately NOT allowlisted. Reading
+      # ActiveModel::Attributes#attributes runs each attribute's type cast,
+      # which is application code, so neither #inspect nor member-wise reading
+      # can be bounded for it; it gets a safe summary instead.
+      #
+      # Anything added here opts that type IN to unbounded execution: the only
+      # way to interrupt arbitrary Ruby mid-call is Timeout, which is not safe
+      # on the capture path. The budget below selects the stored OUTPUT after
+      # the fact; it does not bound the work.
+      @local_variable_inspect_allowlist = []
+      @local_variable_inspect_budget_ms = 5
 
       # Instance variable capture defaults - OFF by default (opt-in)
       @enable_instance_variables = false         # Capture ivars from tp.self at raise time

data/lib/rails_error_dashboard/engine.rb

@@ -85,6 +85,19 @@ module RailsErrorDashboard
         RailsErrorDashboard::Subscribers::BreadcrumbSubscriber.subscribe!
       end
 
+      # Give background jobs a breadcrumb buffer of their own. init_buffer had
+      # exactly one caller -- the Rack middleware -- so a job never entered the
+      # HTTP stack and had no buffer at all; every subscriber early-returns on
+      # `unless current_buffer`, so a failing job's SQL and custom crumbs were
+      # dropped in the one place an error is hardest to reproduce.
+      #
+      # Registered unconditionally and gated at PERFORM time, not here:
+      # enable_breadcrumbs defaults to false, and the ActiveJob callback list
+      # is fixed once the class loads, so a boot-time gate would leave this
+      # permanently unregistered for any host that turns the feature on in an
+      # initializer that runs later. Off, it costs one config read per job.
+      RailsErrorDashboard::Subscribers::BreadcrumbSubscriber.install_job_buffer!
+
       # Subscribe to Rack Attack AS::Notifications events (requires Rack::Attack).
       # Breadcrumbs are NOT required — events persist to their own table (issue #143).
       if RailsErrorDashboard.configuration.enable_rack_attack_tracking &&

data/lib/rails_error_dashboard/manual_error_reporter.rb

@@ -42,7 +42,11 @@ module RailsErrorDashboard
     # @param app_version [String, nil] Version of the app where error occurred
     # @param metadata [Hash, nil] Additional custom metadata about the error
     # @param occurred_at [Time, nil] When the error occurred (defaults to Time.current)
-    # @param severity [Symbol, nil] Severity level (:critical, :high, :medium, :low)
+    # @param severity [Symbol, nil] IGNORED, and kept only so existing callers
+    #   do not break. Severity is not stored: ErrorLog#severity is CLASSIFIED
+    #   from error_type by Services::SeverityClassifier, so the way to control
+    #   it is the error_type you report. Accepting this silently made callers
+    #   believe they had set a value that was never read.
     # @param source [String, nil] Source identifier (e.g., "frontend", "mobile_app")
     #
     # @return [ErrorLog, nil] The created error log record, or nil if filtered/ignored
@@ -65,8 +69,7 @@ module RailsErrorDashboard
     #     user_agent: request.user_agent,
     #     ip_address: request.remote_ip,
     #     app_version: "1.2.3",
-    #     metadata: { card_type: "visa", amount: 99.99 },
-    #     severity: :high
+    #     metadata: { card_type: "visa", amount: 99.99 }
     #   )
     def self.report(
       error_type:,
@@ -100,10 +103,18 @@ module RailsErrorDashboard
         platform: platform,
         app_version: app_version,
         metadata: metadata,
-        occurred_at: occurred_at || Time.current,
-        severity: severity
+        occurred_at: occurred_at || Time.current
       }.compact # Remove nil values
 
+      # severity is deliberately NOT forwarded: nothing downstream reads it,
+      # and passing it on would keep the illusion that it does.
+      if severity.present?
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] ManualErrorReporter: severity: is ignored — " \
+          "severity is classified from error_type (#{error_type})."
+        )
+      end
+
       # Use the existing LogError command
       Commands::LogError.call(synthetic_exception, context)
     end

data/lib/rails_error_dashboard/queries/analytics_stats.rb

@@ -67,43 +67,62 @@ module RailsErrorDashboard
 
       # Two counting units, kept distinct on purpose.
       #
-      # An ErrorLog row is a GROUP; its occurrence_count says how many times
-      # that error actually happened. Volume figures are EVENTS (the sum), so
-      # this page agrees with the Overview, which counts the same way. Resolved
-      # and unresolved stay GROUP counts -- a group is the thing that gets
-      # resolved, and an event cannot be.
+      # An ErrorLog row is a GROUP; its occurred_at is FIRST-SEEN and is never
+      # rewritten when the error recurs.
+      #
+      #   EVENT figures  -> Queries::EventVolume, which counts occurrence rows
+      #                     + storm buckets + the untracked remainder, each
+      #                     against its OWN timestamp.
+      #   GROUP figures  -> base_query, which selects groups by first-seen.
+      #                     Correct here: a group is the thing that gets
+      #                     resolved, and an event cannot be.
+      #
+      # Mixing them is what made this page disagree with the Overview: filtering
+      # GROUPS by first-seen and then summing their LIFETIME occurrence_count
+      # answers "how much total volume do the groups born in this window carry",
+      # not "how many events happened in this window". A group first seen in
+      # August that recurred today was excluded entirely, so the page reported
+      # zero events while its own affected-users table listed the very event.
       def error_statistics
         {
           total: event_count,
           total_groups: base_query.count,
           unresolved: base_query.unresolved.count,
           resolved: base_query.resolved.count,
-          by_type: base_query.group(:error_type).sum(:occurrence_count).sort_by { |_, count| -count }.to_h,
-          by_day: base_query.group("DATE(occurred_at)").sum(:occurrence_count),
+          by_type: volume.by_group_attribute(:error_type).sort_by { |_, count| -count }.to_h,
+          by_day: volume.by_day.transform_keys(&:to_s),
           affected_users_incomplete: affected_users_incomplete?
         }
       end
 
-      # Total EVENTS in the window. dashboard_stats.rb and
-      # platform_comparison.rb:165 count the same way.
+      # One EventVolume for the window, reused by every EVENT figure below so
+      # they cannot drift apart from each other or from the headline total.
+      def volume
+        @volume ||= Queries::EventVolume.new(base_scope, @start_date)
+      end
+
+      # Total EVENTS in the window. dashboard_stats.rb counts the same way,
+      # through the same primitive -- that agreement is asserted by
+      # spec/queries/overview_analytics_agreement_spec.rb.
       def event_count
-        base_query.sum(:occurrence_count)
+        volume.count
       end
 
       def errors_over_time
-        base_query.group_by_day(:occurred_at).sum(:occurrence_count)
+        volume.by_day
       end
 
+      # Top 10 by EVENTS. Deliberately a partial breakdown -- it does not sum
+      # to the headline total, and the agreement spec treats it as such.
       def errors_by_type
-        base_query.group(:error_type)
-                  .sum(:occurrence_count)
-                  .sort_by { |_, count| -count }
-                  .first(10)
-                  .to_h
+        volume.by_group_attribute(:error_type)
+              .sort_by { |_, count| -count }
+              .first(10)
+              .to_h
       end
 
       def errors_by_platform
-        base_query.group(:platform).sum(:occurrence_count)
+        volume.by_group_attribute(:platform)
       end
 
       # NULL (captured before the column existed) is reported under :unknown
@@ -111,14 +130,16 @@ module RailsErrorDashboard
       def errors_by_environment
         return {} unless ErrorLog.column_names.include?("environment")
 
-        base_query.group(:environment).sum(:occurrence_count).transform_keys { |env| env.nil? ? :unknown : env }
+        volume.by_group_attribute(:environment).transform_keys { |env| env.nil? ? :unknown : env }
       end
 
+      # Diurnal pattern: which hour of the day errors peak in, 0..23.
+      #
+      # Counted per EVENT against the event's own timestamp. Grouping ErrorLog
+      # by its first-seen hour put a group's whole lifetime volume on the hour
+      # it was first seen, so a recurrence never moved the curve.
       def errors_by_hour
-        # group_by_hour_of_day buckets into 0..23 to show diurnal patterns
-        # (when in the day errors peak). The chart title says "Errors by Hour
-        # of Day" — group_by_hour produced a chronological time series instead.
-        base_query.group_by_hour_of_day(:occurred_at).sum(:occurrence_count)
+        volume.by_hour_of_day
       end
 
       # Events per user, counted from OCCURRENCE rows.
@@ -150,17 +171,52 @@ module RailsErrorDashboard
 
         # A user whose events predate occurrence tracking -- or whose events
         # were shed by storm protection, which writes no occurrence row -- still
-        # belongs in the table. Fall back to the group's own user for those,
-        # taking whichever count is larger. UserImpactSummary merges the same way.
-        group_user_counts.merge(counts) { |_user, group_count, occurrence_count| [ group_count, occurrence_count ].max }
+        # belongs in the table. The fallback covers ONLY groups with no
+        # occurrence coverage at all in this window.
+        #
+        # It used to merge by taking the larger of the two counts per user, and
+        # that overstated real users: the group's user_id is overwritten by
+        # every new occurrence, so group_user_counts attributes a group's whole
+        # lifetime count to whoever hit it LAST. For occurrences {A: 2, B: 1}
+        # the group figure for B was 3, max kept 3, and the page reported five
+        # events for a three-event group. A number that overstates a user's
+        # events cannot be presented as an "at least" bound, so the uncovered
+        # case is counted and the covered case is left to the occurrence rows.
+        uncovered = uncovered_group_user_counts
+        counts.merge(uncovered) { |_user, from_occurrences, from_groups| from_occurrences + from_groups }
       rescue StandardError
         group_user_counts
       end
 
+      # GROUP-based on purpose: this is the fallback for groups with no
+      # per-event record, where the group's own user_id and lifetime count are
+      # the only evidence that exists. Routing it through EventVolume would be
+      # wrong -- EventVolume counts events, and this needs the per-user split
+      # that only the group row carries. See design.md D5.
       def group_user_counts
         base_query.where.not(user_id: nil).group(:user_id).sum(:occurrence_count)
       end
 
+      # Groups in this window that have NO occurrence row at all: rows from
+      # before occurrence tracking, and groups whose every event was shed by
+      # storm protection. Their occurrence_count is the only evidence those
+      # events happened, and the group's own user_id the only attribution
+      # available -- a floor, which affected_users_incomplete? reports.
+      #
+      # A group with even one occurrence row is excluded: its per-event rows
+      # are authoritative, and adding the group total on top is what produced
+      # the overcount.
+      def uncovered_group_user_counts
+        covered = ErrorOccurrence.where(error_log_id: base_query.select(:id)).select(:error_log_id)
+
+        base_query.where.not(user_id: nil)
+                  .where.not(id: covered)
+                  .group(:user_id)
+                  .sum(:occurrence_count)
+      rescue StandardError
+        {}
+      end
+
       # Occurrence rows joined back to error_logs, so the application filter
       # (which the occurrence table has no column for) still applies.
       def occurrence_scope
@@ -215,11 +271,13 @@ module RailsErrorDashboard
       end
 
       def mobile_errors_count
-        base_query.where(platform: [ "iOS", "Android" ]).sum(:occurrence_count)
+        Queries::EventVolume.in_window(base_scope.where(platform: [ "iOS", "Android" ]), @start_date)
       end
 
       def api_errors_count
-        base_query.where("platform IS NULL OR platform = ?", "API").sum(:occurrence_count)
+        Queries::EventVolume.in_window(
+          base_scope.where("platform IS NULL OR platform = ?", "API"), @start_date
+        )
       end
 
       #  Pattern insights for top error types