rails_error_dashboard 0.8.1 → 0.8.3

data/db/migrate/20260730000001_create_rails_error_dashboard_rack_attack_events.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+class CreateRailsErrorDashboardRackAttackEvents < ActiveRecord::Migration[7.0]
+  def change
+    # Guard against the squashed schema migration having already created this
+    # table — without it, every later migration is silently cancelled.
+    return if table_exists?(:rails_error_dashboard_rack_attack_events)
+
+    create_table :rails_error_dashboard_rack_attack_events do |t|
+      t.string   :rule,          null: false, limit: 250
+      t.string   :match_type,    null: false, limit: 50
+      # discriminator and path are capped at 191 (not 250) to keep the unique
+      # upsert index within MySQL's 3072-byte utf8mb4 limit. Budget:
+      # 250+50+191+191 chars * 4 bytes + 2 length-prefix each = 2736 bytes.
+      # See issue #96 — the swallowed_exceptions index blew this limit at 5042.
+      t.string   :discriminator, limit: 191
+      t.string   :path,          limit: 191
+      t.string   :http_method,   limit: 10
+      t.datetime :period_hour,   null: false
+      t.integer  :event_count,   null: false, default: 0
+      t.datetime :last_seen_at
+      t.bigint   :application_id
+      t.timestamps
+    end
+
+    add_index :rails_error_dashboard_rack_attack_events,
+              :period_hour,
+              name: "index_rack_attack_events_on_period_hour"
+
+    add_index :rails_error_dashboard_rack_attack_events,
+              [ :application_id, :period_hour ],
+              name: "index_rack_attack_events_on_app_and_hour"
+
+    add_index :rails_error_dashboard_rack_attack_events,
+              [ :rule, :period_hour ],
+              name: "index_rack_attack_events_on_rule_and_hour"
+
+    # http_method is intentionally NOT part of the upsert key — it would push
+    # the index over the MySQL byte limit and adds no aggregation value.
+    add_index :rails_error_dashboard_rack_attack_events,
+              [ :rule, :match_type, :discriminator, :path, :period_hour, :application_id ],
+              unique: true,
+              name: "index_rack_attack_events_upsert_key"
+  end
+end

data/lib/generators/rails_error_dashboard/install/templates/initializer.rb

@@ -518,6 +518,42 @@ RailsErrorDashboard.configure do |config|
   # No PII or request bodies in span attributes — just metadata + timing.
   # Safe to enable on production OTel pipelines.
 
+  # ============================================================================
+  # STORM PROTECTION (circuit breaker + adaptive sampling) — ON by default
+  # ============================================================================
+  #
+  # When the error rate spikes (bad deploy, dependency outage), storm
+  # protection limits the gem's own database writes so it never amplifies
+  # the incident. Occurrences are ALWAYS counted exactly — only per-event
+  # detail (context payloads, occurrence rows) is sampled under load.
+  #
+  # How it degrades, in order:
+  #   1. Per-fingerprint cap: past N/min, context is shed, then rows sampled
+  #   2. Global breaker: shedding (context off) → open (count-only mode)
+  #   3. Per-error notifications replaced by ONE "storm in progress" message
+  #   4. Counts reconciled onto error records every flush interval
+  #
+  # All thresholds are PER PROCESS (each Puma worker runs its own breaker).
+  #
+  # config.enable_storm_protection = true
+  # config.storm_fingerprint_full_per_minute = 30   # full-fidelity captures per fingerprint/min
+  # config.storm_occurrence_sample_keep_every = 10  # past the cap, keep every Nth occurrence
+  # config.storm_shedding_threshold_per_second = 10 # global rate entering shedding state
+  # config.storm_open_threshold_per_second = 50     # global rate opening the breaker (count-only)
+  # config.storm_cooldown_seconds = 60              # open → half-open probe delay
+  # config.storm_notification = true                # one notification per storm episode
+  #
+  # Always-on issue cap (a storm of NEW critical errors must not open
+  # hundreds of GitHub/Linear issues):
+  # config.auto_issue_rate_limit_count = 5
+  # config.auto_issue_rate_limit_window_minutes = 10
+  #
+  # Calm-weather context economy: an error seen 1000x/day doesn't need 1000
+  # breadcrumb trails. After N full-context captures per fingerprint per day,
+  # context is kept every Mth time (occurrence rows are unaffected):
+  # config.context_sampling_threshold_per_day = 25
+  # config.context_sampling_keep_every = 10
+
   # ============================================================================
   # ISSUE TRACKING (GitHub / GitLab / Codeberg / Linear)
   # ============================================================================

data/lib/rails_error_dashboard/commands/flush_rack_attack_events.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Commands
+    # Command: Upsert buffered Rack::Attack event counts into the database.
+    #
+    # Receives a snapshot hash from RackAttackTracker and merges it into
+    # hourly-bucketed rows. Uses find_or_initialize_by + increment for
+    # cross-database compatibility (no raw SQL upsert).
+    #
+    # counts keys: "rule\x1Fmatch_type\x1Fdiscriminator\x1Fpath\x1Fhttp_method"
+    class FlushRackAttackEvents
+      def self.call(counts:)
+        new(counts: counts).call
+      end
+
+      def initialize(counts:)
+        @counts = counts || {}
+      end
+
+      def call
+        return if @counts.empty?
+
+        period = Time.current.beginning_of_hour
+        app_id = current_application_id
+
+        @counts.each do |key, count|
+          rule, match_type, discriminator, path, http_method =
+            Services::RackAttackTracker.parse_key(key)
+
+          next if rule.blank? || match_type.blank?
+
+          upsert_event(
+            rule: rule,
+            match_type: match_type,
+            discriminator: discriminator,
+            path: path,
+            http_method: http_method,
+            period: period,
+            app_id: app_id,
+            count: count
+          )
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] FlushRackAttackEvents failed: #{e.class} - #{e.message}"
+        )
+      end
+
+      private
+
+      def upsert_event(rule:, match_type:, discriminator:, path:, http_method:, period:, app_id:, count:)
+        # nil and "" must map to the same row — the unique index treats them as
+        # distinct in some adapters, so normalize blanks to nil consistently.
+        record = RackAttackEvent.find_or_initialize_by(
+          rule: rule,
+          match_type: match_type,
+          discriminator: discriminator.presence,
+          path: path.presence,
+          period_hour: period,
+          application_id: app_id
+        )
+
+        record.http_method = http_method.presence if record.http_method.blank?
+        record.event_count = (record.event_count || 0) + count
+        record.last_seen_at = Time.current
+        record.save!
+      rescue => e
+        RailsErrorDashboard::Logger.debug(
+          "[RailsErrorDashboard] FlushRackAttackEvents.upsert_event failed for #{rule}: #{e.message}"
+        )
+      end
+
+      def current_application_id
+        app_name = RailsErrorDashboard.configuration.application_name
+        return nil unless app_name.present?
+
+        Application.find_by(name: app_name)&.id
+      rescue => e
+        nil
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/commands/flush_storm_counts.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Commands
+    # Command: Reconcile counted-not-stored storm events onto ErrorLog rows
+    # and maintain the storm_events episode record.
+    #
+    # Runs in a background job (DB allowed). For each counted fingerprint:
+    #   1. Recompute the canonical error_hash from the stored identity parts
+    #      (the gate's key deliberately omits application_id — resolved here)
+    #   2. Unresolved match  → single UPDATE: occurrence_count += N
+    #   3. Resolved match    → reopen (mirrors FindOrIncrementError semantics)
+    #   4. No match          → create a minimal ErrorLog from the exemplar
+    #
+    # Counts are exact. Notifications are NOT dispatched from here — during a
+    # storm they're suppressed by design; the storm notification covers it.
+    class FlushStormCounts
+      def self.call(entries:, overflow: 0, episode: nil)
+        new(entries: entries, overflow: overflow, episode: episode).call
+      end
+
+      def initialize(entries:, overflow: 0, episode: nil)
+        @entries = Array(entries)
+        @overflow = overflow.to_i
+        @episode = episode
+      end
+
+      def call
+        application = resolve_application
+        counted = 0
+
+        @entries.each do |entry|
+          entry = entry.with_indifferent_access if entry.respond_to?(:with_indifferent_access)
+          counted += reconcile_entry(entry, application)
+        rescue => e
+          # A corrupt (non-Hash) entry must not abort the whole batch — and the
+          # log line itself must not assume `entry` is subscriptable (an Integer
+          # from a broken serializer would raise again here, escaping this rescue).
+          error_class = entry.is_a?(Hash) ? entry["error_class"] : entry.class
+          RailsErrorDashboard::Logger.error(
+            "[RailsErrorDashboard] Storm count reconcile failed for #{error_class}: #{e.class} - #{e.message}"
+          )
+        end
+
+        upsert_storm_event(counted)
+        { success: true, reconciled: counted, overflow: @overflow }
+      rescue => e
+        RailsErrorDashboard::Logger.error(
+          "[RailsErrorDashboard] FlushStormCounts failed: #{e.class} - #{e.message}"
+        )
+        { success: false, error: "#{e.class}: #{e.message}" }
+      end
+
+      private
+
+      def reconcile_entry(entry, application)
+        count = entry["count"].to_i
+        return 0 if count <= 0
+
+        error_hash = canonical_hash(entry, application)
+        last_seen = parse_time(entry["last_seen_at"]) || Time.current
+
+        # Priority 1: unresolved match — one UPDATE, no row instantiation
+        updated = ErrorLog.unresolved
+          .where(error_hash: error_hash, application_id: application.id)
+          .update_all([ "occurrence_count = occurrence_count + ?, last_seen_at = ?", count, last_seen ])
+        return count if updated.positive?
+
+        # Priority 2: resolved/wont_fix match — reopen, mirroring
+        # FindOrIncrementError so storm recurrences don't stay buried
+        resolved = ErrorLog
+          .where(error_hash: error_hash, application_id: application.id)
+          .where(status: %w[resolved wont_fix])
+          .order(last_seen_at: :desc)
+          .first
+        if resolved
+          attrs = {
+            resolved: false,
+            status: "new",
+            resolved_at: nil,
+            occurrence_count: resolved.occurrence_count + count,
+            last_seen_at: last_seen
+          }
+          attrs[:reopened_at] = Time.current if ErrorLog.column_names.include?("reopened_at")
+          resolved.update!(attrs)
+          return count
+        end
+
+        # Priority 3: first seen during count-only mode — minimal ErrorLog
+        # from the exemplar (no backtrace/context was captured; the next
+        # occurrence after the storm fills in detail via the normal path)
+        ErrorLog.create!(
+          application_id: application.id,
+          error_type: entry["error_class"],
+          message: entry["message"],
+          backtrace: entry["first_app_frame"],
+          controller_name: entry["controller_name"],
+          action_name: entry["action_name"],
+          occurred_at: parse_time(entry["first_seen_at"]) || Time.current,
+          last_seen_at: last_seen,
+          occurrence_count: count,
+          error_hash: error_hash,
+          resolved: false
+        )
+        count
+      end
+
+      # Mirrors ErrorHashGenerator.call exactly: same fields, same order,
+      # same normalization — so counts land on the same ErrorLog the full
+      # capture path would have used.
+      def canonical_hash(entry, application)
+        return entry["custom_hash"] if entry["custom_hash"].present?
+
+        digest_input = [
+          entry["error_class"],
+          Services::ErrorHashGenerator.normalize_message(entry["message"]),
+          entry["first_app_frame"],
+          entry["controller_name"],
+          entry["action_name"],
+          application.id.to_s
+        ].compact.join("|")
+
+        Digest::SHA256.hexdigest(digest_input)[0..15]
+      end
+
+      def resolve_application
+        # Same chain LogError uses — app name is process-global
+        app_name = RailsErrorDashboard.configuration.application_name ||
+                   ENV["APPLICATION_NAME"] ||
+                   (defined?(Rails) && Rails.application.class.module_parent_name) ||
+                   "Rails Application"
+        Application.find_or_create_by_name(app_name)
+      end
+
+      def upsert_storm_event(counted)
+        return unless @episode.is_a?(Hash)
+        return unless StormEvent.table_exists?
+
+        started_at = parse_time(@episode["started_at"])
+        return unless started_at
+
+        event = StormEvent.active.recent_first.first || StormEvent.create!(started_at: started_at)
+
+        event.events_counted_only = event.events_counted_only.to_i + counted
+        event.events_overflow = event.events_overflow.to_i + @overflow
+        # events_total is the count-only total: in-map reconciled + overflow.
+        # It deliberately excludes :lite/:full admissions (those became real
+        # ErrorLog rows on the hot path and are never counted here), so it is
+        # always events_counted_only + events_overflow. Derive it rather than
+        # accumulate so it can't drift from its two components.
+        event.events_total = event.events_counted_only.to_i + event.events_overflow.to_i
+        event.fingerprints_affected = [ event.fingerprints_affected.to_i, @entries.size ].max
+        event.peak_rate_per_minute = [ event.peak_rate_per_minute.to_i, @episode["peak_rate_per_minute"].to_i ].max
+        event.reached_open ||= @episode["reached_open"] == true
+        event.top_fingerprints = top_fingerprints_json(event)
+        event.ended_at = parse_time(@episode["ended_at"]) if @episode["ended_at"]
+        event.save!
+      rescue => e
+        RailsErrorDashboard::Logger.error(
+          "[RailsErrorDashboard] Storm event upsert failed: #{e.class} - #{e.message}"
+        )
+      end
+
+      def top_fingerprints_json(event)
+        existing = event.top_fingerprints_list
+        fresh = @entries.map { |e|
+          e = e.with_indifferent_access if e.respond_to?(:with_indifferent_access)
+          { "class" => e["error_class"], "message" => e["message"].to_s[0, 120], "count" => e["count"].to_i }
+        }
+
+        merged = (existing + fresh)
+          .group_by { |f| [ f["class"], f["message"] ] }
+          .map { |_k, group| group.first.merge("count" => group.sum { |f| f["count"].to_i }) }
+
+        merged.sort_by { |f| -f["count"].to_i }.first(5).to_json
+      end
+
+      def parse_time(value)
+        return value if value.is_a?(Time) || value.is_a?(ActiveSupport::TimeWithZone)
+        return nil if value.blank?
+
+        Time.zone.parse(value.to_s)
+      rescue ArgumentError
+        nil
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/commands/log_error.rb

@@ -6,15 +6,59 @@ module RailsErrorDashboard
     # This is a write operation that creates an ErrorLog record
     class LogError
       def self.call(exception, context = {})
-        # Check if async logging is enabled
+        # Filter FIRST (ignore list + static sampling) so ignored exceptions
+        # never count toward storm state. _pre_filtered prevents the sync path
+        # from re-rolling the sampling dice (rate would square otherwise).
+        # The filter + gate run inside this method's rescue: nothing in the
+        # capture path may ever raise into the host app.
+        begin
+          unless Services::ExceptionFilter.should_log?(exception)
+            # Preserve the OTel contract: filtered captures still emit a span
+            # tagged filtered=true (no-op when OTel export is disabled).
+            Integrations::Tracer.in_span(
+              "capture_error",
+              kind: :capture,
+              attributes: build_capture_span_attributes(exception, was_async: false)
+            ) do |span|
+              span&.set_attribute("rails_error_dashboard.filtered", true)
+            end
+            return nil
+          end
+          context = context.merge(_pre_filtered: true)
+
+          # Storm protection gate — BEFORE the async branch, because with
+          # SolidQueue the enqueue itself is a DB write. :count_only events are
+          # tallied in memory and reconciled by StormFlushJob; nothing else
+          # happens for them (that's the point).
+          storm_decision = Services::StormProtection::Gate.admit!(exception, context)
+          return nil if storm_decision == :count_only
+          context = context.merge(_storm_decision: storm_decision) if storm_decision == :lite
+        rescue => e
+          RailsErrorDashboard::Logger.error(
+            "[RailsErrorDashboard] Capture pre-checks failed: #{e.class} - #{e.message}"
+          )
+          # Fall through and attempt full capture — fail open, never raise
+        end
+
         if RailsErrorDashboard.configuration.async_logging
           # For async logging, just enqueue the job
-          # All filtering happens when the job runs
           call_async(exception, context)
         else
           # For sync logging, execute immediately
           new(exception, context).call
         end
+      rescue => e
+        RailsErrorDashboard::Logger.error(
+          "[RailsErrorDashboard] LogError.call failed: #{e.class} - #{e.message}"
+        )
+        nil
+      end
+
+      # :lite captures shed context (breadcrumbs/health/locals/ivars) — the
+      # storm shedding ladder's first economy. Symbol or string key: the
+      # async job round-trips context through the queue serializer.
+      def self.storm_lite?(context)
+        context[:_storm_decision].to_s == "lite"
       end
 
       # Build the base OTel span attributes available before any work happens.
@@ -42,18 +86,22 @@ module RailsErrorDashboard
           cause_chain: serialize_cause_chain(exception)
         }
 
+        # Storm shedding: :lite captures skip ALL pre-enqueue context harvest —
+        # this is request-thread CPU, the most valuable thing to shed.
+        lite = storm_lite?(context)
+
         # Harvest breadcrumbs NOW (before job dispatch — different thread won't have them)
-        if RailsErrorDashboard.configuration.enable_breadcrumbs
+        if !lite && RailsErrorDashboard.configuration.enable_breadcrumbs
           context = context.merge(_serialized_breadcrumbs: Services::BreadcrumbCollector.harvest)
         end
 
         # Capture system health NOW (metrics are time-sensitive, different thread = different state)
-        if RailsErrorDashboard.configuration.enable_system_health
+        if !lite && RailsErrorDashboard.configuration.enable_system_health
           context = context.merge(_serialized_system_health: Services::SystemHealthSnapshot.capture)
         end
 
         # Capture local variables NOW (TracePoint attaches to exception, must extract before job dispatch)
-        if RailsErrorDashboard.configuration.enable_local_variables
+        if !lite && RailsErrorDashboard.configuration.enable_local_variables
           begin
             raw_locals = Services::LocalVariableCapturer.extract(exception)
             if raw_locals.is_a?(Hash) && raw_locals.any?
@@ -65,7 +113,7 @@ module RailsErrorDashboard
         end
 
         # Capture instance variables NOW (same reason — attached to exception object)
-        if RailsErrorDashboard.configuration.enable_instance_variables
+        if !lite && RailsErrorDashboard.configuration.enable_instance_variables
           begin
             raw_ivars = Services::LocalVariableCapturer.extract_instance_vars(exception)
             if raw_ivars.is_a?(Hash) && raw_ivars.any?
@@ -157,12 +205,19 @@ module RailsErrorDashboard
           kind: :capture,
           attributes: self.class.build_capture_span_attributes(@exception, was_async: false)
         ) do |span|
-        # Check if this exception should be logged (ignore list + sampling)
-        if !Services::ExceptionFilter.should_log?(@exception)
+        # Check if this exception should be logged (ignore list + sampling).
+        # Skipped when self.call already filtered (re-rolling the sampling
+        # dice here would square the effective rate).
+        if !@context[:_pre_filtered] && !Services::ExceptionFilter.should_log?(@exception)
           span&.set_attribute("rails_error_dashboard.filtered", true)
           next nil
         end
 
+        # Storm shedding: :lite captures keep the error + occurrence row but
+        # shed context payloads (breadcrumbs/health/locals/ivars).
+        storm_lite = self.class.storm_lite?(@context)
+        span&.set_attribute("rails_error_dashboard.storm_degraded", true) if storm_lite
+
         error_context = ValueObjects::ErrorContext.new(@context, @context[:source])
 
         # Find or create application (cached lookup)
@@ -239,7 +294,7 @@ module RailsErrorDashboard
         attributes = Services::SensitiveDataFilter.filter_attributes(attributes)
 
         # Harvest breadcrumbs (if enabled and column exists)
-        if ErrorLog.column_names.include?("breadcrumbs") && RailsErrorDashboard.configuration.enable_breadcrumbs
+        if !storm_lite && ErrorLog.column_names.include?("breadcrumbs") && RailsErrorDashboard.configuration.enable_breadcrumbs
           # Sync path: harvest from current thread
           raw_breadcrumbs = Services::BreadcrumbCollector.harvest
 
@@ -256,13 +311,13 @@ module RailsErrorDashboard
         end
 
         # Capture system health snapshot (if enabled and column exists)
-        if ErrorLog.column_names.include?("system_health") && RailsErrorDashboard.configuration.enable_system_health
+        if !storm_lite && ErrorLog.column_names.include?("system_health") && RailsErrorDashboard.configuration.enable_system_health
           health_data = @context[:_serialized_system_health] || Services::SystemHealthSnapshot.capture
           attributes[:system_health] = health_data.to_json
         end
 
         # Capture local variables (if enabled and column exists)
-        if ErrorLog.column_names.include?("local_variables") && RailsErrorDashboard.configuration.enable_local_variables
+        if !storm_lite && ErrorLog.column_names.include?("local_variables") && RailsErrorDashboard.configuration.enable_local_variables
           begin
             # Sync path: extract from exception ivar
             raw_locals = Services::LocalVariableCapturer.extract(@exception)
@@ -278,7 +333,7 @@ module RailsErrorDashboard
         end
 
         # Capture instance variables (if enabled and column exists)
-        if ErrorLog.column_names.include?("instance_variables") && RailsErrorDashboard.configuration.enable_instance_variables
+        if !storm_lite && ErrorLog.column_names.include?("instance_variables") && RailsErrorDashboard.configuration.enable_instance_variables
           begin
             # Sync path: extract from exception ivar
             raw_ivars = Services::LocalVariableCapturer.extract_instance_vars(@exception)
@@ -364,8 +419,11 @@ module RailsErrorDashboard
 
       # Dispatch notification if error is not muted and the throttle check passes.
       # Muted errors skip notifications but still fire plugin events/callbacks.
+      # During a storm (breaker not closed) per-error notifications are
+      # suppressed — a single storm notification replaces them.
       def maybe_notify(error_log)
         return if error_log.muted?
+        return if Services::StormProtection::Gate.notifications_suppressed?
         return unless yield
 
         Services::ErrorNotificationDispatcher.call(error_log)

data/lib/rails_error_dashboard/configuration.rb

@@ -67,6 +67,25 @@ module RailsErrorDashboard
     # Sampling rate for non-critical errors (0.0 to 1.0, default 1.0 = 100%)
     attr_accessor :sampling_rate
 
+    # Storm protection — circuit breaker + adaptive sampling for error floods.
+    # Protects the HOST APP from the gem's own writes during an error storm
+    # (bad deploy throwing thousands of errors/minute). Default ON: this is
+    # the feature that makes the gem quieter, so ON is the conservative choice.
+    # All thresholds are PER PROCESS (no cross-process coordination by design).
+    attr_accessor :enable_storm_protection            # Master switch (default: true)
+    attr_accessor :storm_fingerprint_full_per_minute  # Full-fidelity captures per fingerprint per minute (default: 30)
+    attr_accessor :storm_occurrence_sample_keep_every # Past the cap, keep every Nth occurrence (default: 10)
+    attr_accessor :storm_shedding_threshold_per_second # Global rate that enters shedding state (default: 10)
+    attr_accessor :storm_open_threshold_per_second    # Global rate that opens the breaker = count-only (default: 50)
+    attr_accessor :storm_cooldown_seconds             # Open → half-open probe delay (default: 60)
+    attr_accessor :storm_max_tracked_fingerprints     # Bounded in-memory map size; beyond = overflow bucket (default: 1000)
+    attr_accessor :storm_flush_interval_seconds       # Count-buffer flush cadence (default: 30)
+    attr_accessor :storm_notification                 # Single "storm in progress" notification per episode (default: true)
+    attr_accessor :auto_issue_rate_limit_count        # Max auto-created issues per window — applies always (default: 5)
+    attr_accessor :auto_issue_rate_limit_window_minutes # Window for the above (default: 10)
+    attr_accessor :context_sampling_threshold_per_day # Full-context captures per fingerprint per day before sampling (default: 25)
+    attr_accessor :context_sampling_keep_every        # After threshold, keep full context every Nth (default: 10)
+
     # Async logging configuration
     attr_accessor :async_logging
     attr_accessor :async_adapter # :sidekiq, :solid_queue, or :async
@@ -176,8 +195,11 @@ module RailsErrorDashboard
     # Code path coverage (diagnostic mode — Ruby 3.2+)
     attr_accessor :enable_coverage_tracking             # Master switch (default: false)
 
-    # Rack Attack event tracking (requires enable_breadcrumbs = true)
+    # Rack Attack event tracking — persists throttle/blocklist/track events to
+    # their own table, independent of error capture (breadcrumbs optional).
     attr_accessor :enable_rack_attack_tracking          # Master switch (default: false)
+    attr_accessor :rack_attack_max_cache_size           # Max buffered keys per thread (default: 1000)
+    attr_accessor :rack_attack_flush_interval           # Seconds between DB flushes (default: 60)
 
     # ActionCable event tracking (requires enable_breadcrumbs = true)
     attr_accessor :enable_actioncable_tracking          # Master switch (default: false)
@@ -268,6 +290,21 @@ module RailsErrorDashboard
       @ignored_exceptions = []
       @custom_fingerprint = nil # Lambda: ->(exception, context) { "custom_key" }
       @sampling_rate = 1.0 # 100% by default
+
+      # Storm protection defaults (thresholds tuned via chaos Phase G — see ROADMAP)
+      @enable_storm_protection = true
+      @storm_fingerprint_full_per_minute = 30
+      @storm_occurrence_sample_keep_every = 10
+      @storm_shedding_threshold_per_second = 10
+      @storm_open_threshold_per_second = 50
+      @storm_cooldown_seconds = 60
+      @storm_max_tracked_fingerprints = 1000
+      @storm_flush_interval_seconds = 30
+      @storm_notification = true
+      @auto_issue_rate_limit_count = 5
+      @auto_issue_rate_limit_window_minutes = 10
+      @context_sampling_threshold_per_day = 25
+      @context_sampling_keep_every = 10
       @async_logging = false
       @async_adapter = :sidekiq # Battle-tested default
       @max_backtrace_lines = 100 # Matches industry standard (Rollbar, Airbrake)
@@ -366,8 +403,11 @@ module RailsErrorDashboard
       # Code path coverage defaults - OFF by default (opt-in, Ruby 3.2+)
       @enable_coverage_tracking = false
 
-      # Rack Attack event tracking defaults - OFF by default (opt-in, requires breadcrumbs)
+      # Rack Attack event tracking defaults - OFF by default (opt-in).
+      # Persists to its own table; does NOT require breadcrumbs.
       @enable_rack_attack_tracking = false
+      @rack_attack_max_cache_size = 1000 # Max buffered keys per thread (LRU eviction)
+      @rack_attack_flush_interval = 60   # Seconds between DB flushes
 
       # ActionCable event tracking defaults - OFF by default (opt-in, requires breadcrumbs)
       @enable_actioncable_tracking = false
@@ -540,11 +580,16 @@ module RailsErrorDashboard
         end
       end
 
-      # Validate rack_attack tracking requires breadcrumbs
-      if enable_rack_attack_tracking && !enable_breadcrumbs
-        warnings << "enable_rack_attack_tracking requires enable_breadcrumbs = true. " \
-                    "Rack Attack tracking has been auto-disabled."
-        @enable_rack_attack_tracking = false
+      # Rack Attack tracking no longer requires breadcrumbs — events are persisted
+      # to their own table (issue #143). Breadcrumbs only add the event to the
+      # activity trail on error detail pages.
+      if enable_rack_attack_tracking
+        if rack_attack_max_cache_size && rack_attack_max_cache_size < 1
+          errors << "rack_attack_max_cache_size must be at least 1 (got: #{rack_attack_max_cache_size})"
+        end
+        if rack_attack_flush_interval && rack_attack_flush_interval < 1
+          errors << "rack_attack_flush_interval must be at least 1 (got: #{rack_attack_flush_interval})"
+        end
       end
 
       # Validate actioncable tracking requires breadcrumbs
@@ -683,6 +728,32 @@ module RailsErrorDashboard
         end
       end
 
+      # Validate storm protection thresholds (all must be positive when protection is on)
+      if enable_storm_protection
+        {
+          storm_fingerprint_full_per_minute: storm_fingerprint_full_per_minute,
+          storm_occurrence_sample_keep_every: storm_occurrence_sample_keep_every,
+          storm_shedding_threshold_per_second: storm_shedding_threshold_per_second,
+          storm_open_threshold_per_second: storm_open_threshold_per_second,
+          storm_cooldown_seconds: storm_cooldown_seconds,
+          storm_max_tracked_fingerprints: storm_max_tracked_fingerprints,
+          storm_flush_interval_seconds: storm_flush_interval_seconds,
+          auto_issue_rate_limit_count: auto_issue_rate_limit_count,
+          auto_issue_rate_limit_window_minutes: auto_issue_rate_limit_window_minutes,
+          context_sampling_threshold_per_day: context_sampling_threshold_per_day,
+          context_sampling_keep_every: context_sampling_keep_every
+        }.each do |name, value|
+          if value.nil? || value.to_i < 1
+            errors << "#{name} must be a positive integer (got: #{value.inspect})"
+          end
+        end
+
+        if storm_open_threshold_per_second.to_i < storm_shedding_threshold_per_second.to_i
+          errors << "storm_open_threshold_per_second (#{storm_open_threshold_per_second}) must be >= " \
+                    "storm_shedding_threshold_per_second (#{storm_shedding_threshold_per_second})"
+        end
+      end
+
       # Validate total_users_for_impact (must be positive if set)
       if total_users_for_impact && total_users_for_impact < 1
         errors << "total_users_for_impact must be at least 1 (got: #{total_users_for_impact})"

data/lib/rails_error_dashboard/engine.rb

@@ -80,9 +80,9 @@ module RailsErrorDashboard
         RailsErrorDashboard::Subscribers::BreadcrumbSubscriber.subscribe!
       end
 
-      # Subscribe to Rack Attack AS::Notifications events (requires breadcrumbs + Rack::Attack)
+      # Subscribe to Rack Attack AS::Notifications events (requires Rack::Attack).
+      # Breadcrumbs are NOT required — events persist to their own table (issue #143).
       if RailsErrorDashboard.configuration.enable_rack_attack_tracking &&
-         RailsErrorDashboard.configuration.enable_breadcrumbs &&
          defined?(Rack::Attack)
         RailsErrorDashboard::Subscribers::RackAttackSubscriber.subscribe!
       end