rails_error_dashboard 0.13.0 → 0.14.0

data/lib/rails_error_dashboard/queries/dashboard_stats.rb

@@ -5,6 +5,10 @@ module RailsErrorDashboard
     # Query: Fetch dashboard statistics
     # This is a read operation that aggregates error data for the dashboard
     class DashboardStats
+      # The widest window any figure on the Overview covers (total_month).
+      # The completeness predicate is matched to this, not to "today".
+      WIDEST_DISPLAYED_WINDOW = 30.days
+
       # One instance answers ONE call: several aggregates (today's event count,
       # the 7-day trend, spike detection) are memoised on it so that they are
       # computed once per call rather than once per card that shows them.
@@ -28,8 +32,8 @@ module RailsErrorDashboard
               # Summing is also exact during a storm: counted-only events never
               # create occurrence rows, but they DO raise occurrence_count.
               total_today: today_event_count,
-              total_week: event_count_since(7.days.ago),
-              total_month: event_count_since(30.days.ago),
+              total_week: week_event_counts.values.sum,
+              total_month: month_event_count,
               unresolved: base_scope.unresolved.count,
               resolved: base_scope.resolved.count,
               reopened: reopened_count,
@@ -54,6 +58,13 @@ module RailsErrorDashboard
               # window, the dimension is incomplete and the page says so
               # rather than presenting an undercount as fact.
               affected_users_incomplete: affected_users_incomplete?,
+              # A storm episode in this window lost its per-bucket TIMING
+              # evidence, so every time-window figure for it rests on the
+              # group's own occurred_at rather than on per-event records.
+              # Reported for the same reason as affected_users_incomplete:
+              # an incomplete dimension should say so rather than present a
+              # figure of unknown completeness as fact.
+              event_timing_incomplete: event_timing_incomplete?,
               data_unavailable: false
             }
           end
@@ -71,6 +82,7 @@ module RailsErrorDashboard
           {
             data_unavailable: true,
             affected_users_incomplete: false,
+            event_timing_incomplete: false,
             total_today: 0,
             total_week: 0,
             total_month: 0,
@@ -116,14 +128,29 @@ module RailsErrorDashboard
         scope
       end
 
-      # Total EVENTS in a window: the sum of every matching group's
-      # occurrence_count. platform_comparison.rb counts the same way.
+      # Total EVENTS in a window -- the events that HAPPENED in it, not the
+      # lifetime volume of the groups first seen in it.
+      #
+      # This used to filter groups by occurred_at and sum occurrence_count.
+      # occurred_at is first-seen and is never rewritten on recurrence, so an
+      # error first seen at 23:59 that recurred at 00:01 reported zero errors
+      # today and two yesterday. Queries::EventVolume counts per-event records
+      # instead: occurrence rows, plus storm-shed time buckets, plus the
+      # remainder of any group that has neither.
       def event_count_since(since)
-        base_scope.where("occurred_at >= ?", since).sum(:occurrence_count)
+        Queries::EventVolume.in_window(base_scope, since)
+      end
+
+      # The widest-window total, memoised: the stats hash shows it and the
+      # completeness predicate needs the same number. One instance answers one
+      # call, and this runs on the capture path via the stats broadcast, so a
+      # second identical aggregate here is pure waste.
+      def month_event_count
+        @month_event_count ||= event_count_since(WIDEST_DISPLAYED_WINDOW.ago)
       end
 
       def event_count_between(from, to)
-        base_scope.where("occurred_at >= ? AND occurred_at < ?", from, to).sum(:occurrence_count)
+        Queries::EventVolume.in_window(base_scope, from, to)
       end
 
       # Occurrence rows carry the user of EACH event. The group's user_id is
@@ -156,44 +183,143 @@ module RailsErrorDashboard
         false
       end
 
+      # True when a storm episode overlapping this window degraded without
+      # writing its time buckets.
+      #
+      # Read from the persisted episode rather than recomputed: the flush that
+      # knew is long over by the time the dashboard renders, and the flag has
+      # to survive a replay. Every guard here is deliberate -- the storm table
+      # may not exist, and the column may not be migrated yet on an older host.
+      # True when any recorded timing gap overlaps a window this page shows.
+      #
+      # The page displays today, 7-day AND 30-day figures, so the predicate has
+      # to match the WIDEST of them. An earlier version asked only about today
+      # and dropped the warning while the weekly and monthly numbers on the
+      # same screen still contained the affected events.
+      #
+      # Read from EventTimingGap rather than the storm episode: the episode is
+      # optional (the gate can shed with its breaker closed), and it is written
+      # after the counts transaction commits. See the migration for the full
+      # history of why this moved.
+      def event_timing_incomplete?
+        # Nothing left to qualify, so no warning.
+        #
+        # Gaps are deliberately retained past their own retention while the
+        # figures they describe are still shown (see the cleanup job), so a gap
+        # can outlive every event it covered -- a group expiring is what
+        # removes those events. Warning about a window whose subject matter is
+        # gone is noise, and noise trains people to ignore the banner.
+        #
+        # Asked of surviving GROUPS, not of the event aggregate. The aggregate
+        # is the wrong witness here: losing the time buckets is exactly what
+        # makes events invisible to it, so an old group that recurs today
+        # reports zero for every window (EventVolume can only place an
+        # untracked remainder at the group's own occurred_at, which precedes
+        # the window -- see untracked_groups) while the events are real, the
+        # group is alive and a current gap records them. Reading that zero as
+        # "nothing happened" suppressed the banner in precisely the state it
+        # exists to announce.
+        #
+        # last_seen_at is the right evidence because it is what retention
+        # deletes on: a group is expired only once it has not been seen for
+        # retention_days, so "no group seen in this window" is the same fact as
+        # "the covered events are gone" -- and it is indexed, and immune to the
+        # timing loss itself.
+        #
+        # Suppressed only when BOTH witnesses are silent, because neither alone
+        # is sufficient and they fail in opposite directions. The aggregate
+        # misses an old group's untracked recurrence (the defect above); the
+        # liveness check misses the converse, since EventVolume windows
+        # occurrence rows and buckets on THEIR OWN timestamps against an
+        # unwindowed group set (see group_ids), so a group whose last_seen_at
+        # has fallen behind its own event rows can still put events on the page.
+        # Requiring both to be empty means the banner can never be dropped
+        # while any displayed figure is non-zero, which is the F22 invariant.
+        return false unless groups_seen_in_widest_window? || month_event_count.positive?
+
+        EventTimingGap.affecting?(WIDEST_DISPLAYED_WINDOW.ago, application_id: @application_id)
+      rescue StandardError
+        false
+      end
+
+      # Whether any error group was last seen inside the widest displayed
+      # window. Existence, not a count: one indexed row settles it, and this
+      # runs on the capture path via the stats broadcast.
+      #
+      # The NULL arm covers rows written before last_seen_at existed, whose
+      # occurred_at is the only timestamp they have -- the same COALESCE
+      # equivalence the retention job documents, written so each arm keeps its
+      # own index.
+      def groups_seen_in_widest_window?
+        cutoff = WIDEST_DISPLAYED_WINDOW.ago
+        base_scope.where(
+          "last_seen_at >= :cutoff OR (last_seen_at IS NULL AND occurred_at >= :cutoff)", cutoff: cutoff
+        ).exists?
+      end
+
       def reopened_count
         return 0 unless ErrorLog.column_names.include?("reopened_at")
 
         base_scope.where.not(reopened_at: nil).count
       end
 
+      # Top error types in the last 7 days, by EVENTS.
+      #
+      # Filtering groups by first-seen and summing their LIFETIME
+      # occurrence_count answered a different question: an August group that
+      # recurred today was excluded entirely, so reopening it produced an empty
+      # list while the headline total (already on EventVolume) counted the
+      # event. Routed through the same primitive as the total so the page's
+      # parts and its whole cannot drift apart.
       def top_errors
-        base_scope.where("occurred_at >= ?", 7.days.ago)
-                  .group(:error_type)
-                  .sum(:occurrence_count)
-                  .sort_by { |_, count| -count }
-                  .first(10)
-                  .to_h
+        weekly_volume.by_group_attribute(:error_type)
+                     .sort_by { |_, count| -count }
+                     .first(10)
+                     .to_h
+      end
+
+      # One EventVolume for the 7-day window, shared by every weekly breakdown.
+      def weekly_volume
+        @weekly_volume ||= Queries::EventVolume.new(base_scope, 7.days.ago)
       end
 
       # Get 7-day error trend (daily counts)
+      # Events per day, placed on the day they HAPPENED. Grouping the ErrorLog
+      # table by its own occurred_at put a group's whole lifetime volume on the
+      # day it was first seen, so a recurrence never moved the trend.
+      #
+      # The zero-filled date range is preserved: the chart needs a point for
+      # every day in the window, not only the days that had errors.
       def errors_trend_7d
-        @errors_trend_7d ||=
-          base_scope.where("occurred_at >= ?", 7.days.ago)
-                    .group_by_day(:occurred_at, range: 7.days.ago.to_date..Date.current, default_value: 0)
-                    .sum(:occurrence_count)
+        week_event_counts
       end
 
       # Get error counts by severity for last 7 days
       # OPTIMIZED: Use database filtering instead of loading all records into Ruby
+      # Weekly events by severity.
+      #
+      # Folded from the SAME per-type breakdown top_errors uses, rather than
+      # four independently scoped sums. Two reasons: it was summing LIFETIME
+      # counts of groups born in the window (so a reopened August group scored
+      # zero across every severity), and deriving both figures from one
+      # breakdown makes them agree by construction instead of by luck --
+      # asserted by spec/queries/dashboard_breakdowns_event_volume_spec.rb.
       def errors_by_severity_7d
-        scoped_errors = base_scope.where("occurred_at >= ?", 7.days.ago)
-
-        {
-          critical: scoped_errors.where(error_type: Services::SeverityClassifier::CRITICAL_ERROR_TYPES).sum(:occurrence_count),
-          high: scoped_errors.where(error_type: Services::SeverityClassifier::HIGH_SEVERITY_ERROR_TYPES).sum(:occurrence_count),
-          medium: scoped_errors.where(error_type: Services::SeverityClassifier::MEDIUM_SEVERITY_ERROR_TYPES).sum(:occurrence_count),
-          low: scoped_errors.where.not(
-            error_type: Services::SeverityClassifier::CRITICAL_ERROR_TYPES +
-                       Services::SeverityClassifier::HIGH_SEVERITY_ERROR_TYPES +
-                       Services::SeverityClassifier::MEDIUM_SEVERITY_ERROR_TYPES
-          ).sum(:occurrence_count)
-        }
+        critical = Services::SeverityClassifier::CRITICAL_ERROR_TYPES
+        high     = Services::SeverityClassifier::HIGH_SEVERITY_ERROR_TYPES
+        medium   = Services::SeverityClassifier::MEDIUM_SEVERITY_ERROR_TYPES
+
+        totals = { critical: 0, high: 0, medium: 0, low: 0 }
+        weekly_volume.by_group_attribute(:error_type).each do |error_type, count|
+          bucket =
+            if critical.include?(error_type) then :critical
+            elsif high.include?(error_type)  then :high
+            elsif medium.include?(error_type) then :medium
+            else :low
+            end
+          totals[bucket] += count
+        end
+        totals
       end
 
       # Detect if there's an error spike
@@ -241,8 +367,19 @@ module RailsErrorDashboard
         info
       end
 
+      # Today, yesterday and the 7-day total all come from ONE daily breakdown.
+      # Each window is three queries (occurrence rows, shed buckets, untracked
+      # remainder), and this method runs on the capture path via the stats
+      # broadcast, so asking per window multiplied the query count.
+      def week_event_counts
+        @week_event_counts ||= begin
+          counts = Queries::EventVolume.by_day(base_scope, 7.days.ago)
+          (7.days.ago.to_date..Date.current).to_h { |day| [ day, counts[day] || 0 ] }
+        end
+      end
+
       def today_event_count
-        @today_event_count ||= event_count_since(Time.current.beginning_of_day)
+        @today_event_count ||= week_event_counts[Date.current].to_i
       end
 
       # Every anomalous (error_type, platform) pair, from a fixed number of
@@ -340,7 +477,7 @@ module RailsErrorDashboard
 
       def compute_trend_percentage
         today = today_event_count
-        yesterday = event_count_between(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
+        yesterday = week_event_counts[Date.current - 1].to_i
 
         return 0.0 if today.zero? && yesterday.zero?
         return 100.0 if yesterday.zero? && today.positive?