rails_error_dashboard 0.9.1 → 0.11.0

data/lib/rails_error_dashboard/commands/backfill_environments.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Commands
+    # Command: fill in `environment` on error logs captured before the column
+    # existed, using the rails_env recorded in environment_info at capture time.
+    #
+    # Opt-in (rails_error_dashboard:backfill_environments). Live errors do not
+    # need it — FindOrIncrementError adopts a NULL row on its next occurrence —
+    # but history that never recurs would otherwise stay unbadged and
+    # unfilterable forever.
+    #
+    # Runs in batches, one UPDATE per row: the value is inside a JSON text
+    # column, so it has to be parsed in Ruby and no portable single UPDATE can
+    # do it across PostgreSQL, MySQL and SQLite.
+    class BackfillEnvironments
+      BATCH_SIZE = 500
+      COLUMN_LIMIT = 64
+
+      def self.call(batch_size: BATCH_SIZE)
+        new(batch_size: batch_size).call
+      end
+
+      def initialize(batch_size: BATCH_SIZE)
+        @batch_size = batch_size
+      end
+
+      # @return [Integer] rows updated
+      def call
+        return 0 unless ErrorLog.column_names.include?("environment")
+
+        updated = 0
+        ErrorLog.where(environment: nil).where.not(environment_info: nil)
+                .in_batches(of: @batch_size) do |batch|
+          batch.pluck(:id, :environment_info).each do |id, raw|
+            env = rails_env_from(raw)
+            next if env.nil?
+
+            updated += ErrorLog.where(id: id, environment: nil).update_all(environment: env)
+          end
+        end
+        updated
+      end
+
+      private
+
+      def rails_env_from(raw)
+        parsed = JSON.parse(raw.to_s)
+        return nil unless parsed.is_a?(Hash)
+
+        value = parsed["rails_env"].to_s.strip
+        value.empty? ? nil : value[0, COLUMN_LIMIT]
+      rescue JSON::ParserError
+        nil
+      end
+    end
+  end
+end

data/lib/rails_error_dashboard/commands/find_or_increment_error.rb

@@ -9,6 +9,12 @@ module RailsErrorDashboard
     # 1. Unresolved errors with same hash within 24 hours → increment occurrence count
     # 2. Resolved/wont_fix errors with same hash (any age) → reopen and increment
     # 3. No match → create new error record
+    #
+    # Environment is a MATCH dimension, not part of the hash: the same error in
+    # staging and production is two rows with independent status. A row with a
+    # NULL environment predates the column; it matches as a wildcard and is
+    # stamped by the first occurrence that claims it, so history migrates
+    # itself without a backfill. An exact match always wins over a NULL one.
     class FindOrIncrementError
       def self.call(error_hash, attributes = {})
         new(error_hash, attributes).call
@@ -35,23 +41,40 @@ module RailsErrorDashboard
       private
 
       def find_unresolved
-        ErrorLog.unresolved
-          .where(error_hash: @error_hash)
-          .where(application_id: @attributes[:application_id])
-          .where("occurred_at >= ?", 24.hours.ago)
-          .lock
-          .order(last_seen_at: :desc)
-          .first
+        with_environment(
+          ErrorLog.unresolved
+            .where(error_hash: @error_hash)
+            .where(application_id: @attributes[:application_id])
+            .where("occurred_at >= ?", 24.hours.ago)
+        ).lock.order(last_seen_at: :desc).first
       end
 
       def find_resolved
-        ErrorLog
-          .where(error_hash: @error_hash)
-          .where(application_id: @attributes[:application_id])
-          .where(status: %w[resolved wont_fix])
-          .lock
-          .order(last_seen_at: :desc)
-          .first
+        with_environment(
+          ErrorLog
+            .where(error_hash: @error_hash)
+            .where(application_id: @attributes[:application_id])
+            .where(status: %w[resolved wont_fix])
+        ).lock.order(last_seen_at: :desc).first
+      end
+
+      # Restrict to this occurrence's environment or a legacy NULL row, exact
+      # first. Literal SQL, no interpolation. A blank environment (column not
+      # migrated yet, or an attribute-less caller) leaves the scope unchanged.
+      def with_environment(scope)
+        env = @attributes[:environment]
+        return scope if env.blank? || !ErrorLog.column_names.include?("environment")
+
+        scope.where(environment: [ env, nil ])
+             .order(Arel.sql("CASE WHEN environment IS NULL THEN 1 ELSE 0 END"))
+      end
+
+      # {} unless this is a legacy NULL-environment row being claimed.
+      def environment_adoption(error)
+        return {} unless ErrorLog.column_names.include?("environment")
+        return {} if error.environment.present? || @attributes[:environment].blank?
+
+        { environment: @attributes[:environment] }
       end
 
       def increment_existing(error)
@@ -62,7 +85,8 @@ module RailsErrorDashboard
           request_url: @attributes[:request_url] || error.request_url,
           request_params: @attributes[:request_params] || error.request_params,
           user_agent: @attributes[:user_agent] || error.user_agent,
-          ip_address: @attributes[:ip_address] || error.ip_address
+          ip_address: @attributes[:ip_address] || error.ip_address,
+          **environment_adoption(error)
         )
         error
       end
@@ -78,7 +102,8 @@ module RailsErrorDashboard
           request_url: @attributes[:request_url] || error.request_url,
           request_params: @attributes[:request_params] || error.request_params,
           user_agent: @attributes[:user_agent] || error.user_agent,
-          ip_address: @attributes[:ip_address] || error.ip_address
+          ip_address: @attributes[:ip_address] || error.ip_address,
+          **environment_adoption(error)
         }
         attrs[:reopened_at] = Time.current if ErrorLog.column_names.include?("reopened_at")
         error.update!(attrs)
@@ -90,27 +115,28 @@ module RailsErrorDashboard
         ErrorLog.create!(@attributes.reverse_merge(resolved: false))
       rescue ActiveRecord::RecordNotUnique
         # Race condition: another process created the same error
-        retry_existing = ErrorLog.unresolved
-          .where(error_hash: @error_hash)
-          .where(application_id: @attributes[:application_id])
-          .where("occurred_at >= ?", 24.hours.ago)
-          .lock
-          .first
+        retry_existing = with_environment(
+          ErrorLog.unresolved
+            .where(error_hash: @error_hash)
+            .where(application_id: @attributes[:application_id])
+            .where("occurred_at >= ?", 24.hours.ago)
+        ).lock.first
 
         if retry_existing
           retry_existing.update!(
             occurrence_count: retry_existing.occurrence_count + 1,
-            last_seen_at: Time.current
+            last_seen_at: Time.current,
+            **environment_adoption(retry_existing)
           )
           retry_existing
         else
           # Also check resolved in race condition path
-          retry_resolved = ErrorLog
-            .where(error_hash: @error_hash)
-            .where(application_id: @attributes[:application_id])
-            .where(status: %w[resolved wont_fix])
-            .lock
-            .first
+          retry_resolved = with_environment(
+            ErrorLog
+              .where(error_hash: @error_hash)
+              .where(application_id: @attributes[:application_id])
+              .where(status: %w[resolved wont_fix])
+          ).lock.first
 
           if retry_resolved
             reopen_existing(retry_resolved)

data/lib/rails_error_dashboard/commands/flush_rack_attack_events.rb

@@ -8,7 +8,10 @@ module RailsErrorDashboard
     # hourly-bucketed rows. Uses find_or_initialize_by + increment for
     # cross-database compatibility (no raw SQL upsert).
     #
-    # counts keys: "rule\x1Fmatch_type\x1Fdiscriminator\x1Fpath\x1Fhttp_method"
+    # counts keys: "rule\x1Fmatch_type\x1Fdiscriminator\x1Fpath\x1Fhttp_method\x1Fuser_agent"
+    #
+    # http_method and user_agent are carried on the key but are NOT part of the
+    # row's identity — see upsert_event.
     class FlushRackAttackEvents
       def self.call(counts:)
         new(counts: counts).call
@@ -25,7 +28,7 @@ module RailsErrorDashboard
         app_id = current_application_id
 
         @counts.each do |key, count|
-          rule, match_type, discriminator, path, http_method =
+          rule, match_type, discriminator, path, http_method, user_agent =
             Services::RackAttackTracker.parse_key(key)
 
           next if rule.blank? || match_type.blank?
@@ -36,6 +39,7 @@ module RailsErrorDashboard
             discriminator: discriminator,
             path: path,
             http_method: http_method,
+            user_agent: user_agent,
             period: period,
             app_id: app_id,
             count: count
@@ -49,7 +53,8 @@ module RailsErrorDashboard
 
       private
 
-      def upsert_event(rule:, match_type:, discriminator:, path:, http_method:, period:, app_id:, count:)
+      def upsert_event(rule:, match_type:, discriminator:, path:, http_method:, user_agent:,
+                       period:, app_id:, count:)
         # nil and "" must map to the same row — the unique index treats them as
         # distinct in some adapters, so normalize blanks to nil consistently.
         record = RackAttackEvent.find_or_initialize_by(
@@ -61,7 +66,11 @@ module RailsErrorDashboard
           application_id: app_id
         )
 
+        # http_method and user_agent are deliberately NOT part of the upsert key
+        # (the unique index is already at 2736 of MySQL's 3072 bytes), so they
+        # are first-write-wins attributes of the bucket rather than identity.
         record.http_method = http_method.presence if record.http_method.blank?
+        record.user_agent = user_agent.presence if record.user_agent.blank?
         record.event_count = (record.event_count || 0) + count
         record.last_seen_at = Time.current
         record.save!

data/lib/rails_error_dashboard/commands/flush_storm_counts.rb

@@ -59,20 +59,38 @@ module RailsErrorDashboard
 
         error_hash = canonical_hash(entry, application)
         last_seen = parse_time(entry["last_seen_at"]) || Time.current
-
-        # Priority 1: unresolved match — one UPDATE, no row instantiation
-        updated = ErrorLog.unresolved
-          .where(error_hash: error_hash, application_id: application.id)
-          .update_all([ "occurrence_count = occurrence_count + ?, last_seen_at = ?", count, last_seen ])
-        return count if updated.positive?
+        env = current_environment
+
+        # Priority 1: unresolved match — one UPDATE, no row instantiation.
+        # Environment mirrors FindOrIncrementError: exact row first, then a
+        # legacy NULL row which is stamped as it is claimed. Two statements
+        # rather than one IN (env, NULL), because update_all would hit BOTH
+        # rows when they coexist and double-count.
+        unresolved = ErrorLog.unresolved.where(error_hash: error_hash, application_id: application.id)
+        if env
+          updated = unresolved.where(environment: env)
+            .update_all([ "occurrence_count = occurrence_count + ?, last_seen_at = ?", count, last_seen ])
+          return count if updated.positive?
+
+          updated = unresolved.where(environment: nil)
+            .update_all([ "occurrence_count = occurrence_count + ?, last_seen_at = ?, environment = ?",
+                          count, last_seen, env ])
+          return count if updated.positive?
+        else
+          updated = unresolved.update_all([ "occurrence_count = occurrence_count + ?, last_seen_at = ?", count, last_seen ])
+          return count if updated.positive?
+        end
 
         # Priority 2: resolved/wont_fix match — reopen, mirroring
         # FindOrIncrementError so storm recurrences don't stay buried
-        resolved = ErrorLog
+        resolved_scope = ErrorLog
           .where(error_hash: error_hash, application_id: application.id)
           .where(status: %w[resolved wont_fix])
-          .order(last_seen_at: :desc)
-          .first
+        if env
+          resolved_scope = resolved_scope.where(environment: [ env, nil ])
+            .order(Arel.sql("CASE WHEN environment IS NULL THEN 1 ELSE 0 END"))
+        end
+        resolved = resolved_scope.order(last_seen_at: :desc).first
         if resolved
           attrs = {
             resolved: false,
@@ -82,6 +100,7 @@ module RailsErrorDashboard
             last_seen_at: last_seen
           }
           attrs[:reopened_at] = Time.current if ErrorLog.column_names.include?("reopened_at")
+          attrs[:environment] = env if env && resolved.environment.blank?
           resolved.update!(attrs)
           return count
         end
@@ -89,7 +108,11 @@ module RailsErrorDashboard
         # Priority 3: first seen during count-only mode — minimal ErrorLog
         # from the exemplar (no backtrace/context was captured; the next
         # occurrence after the storm fills in detail via the normal path)
+        create_attrs = {
+          environment: env
+        }.compact
         ErrorLog.create!(
+          **create_attrs,
           application_id: application.id,
           error_type: entry["error_class"],
           message: entry["message"],
@@ -123,6 +146,14 @@ module RailsErrorDashboard
         Digest::SHA256.hexdigest(digest_input)[0..15]
       end
 
+      # nil when the column is not migrated yet, so every environment clause
+      # above disappears and the command behaves exactly as before.
+      def current_environment
+        return nil unless ErrorLog.column_names.include?("environment")
+
+        RailsErrorDashboard.configuration.current_environment
+      end
+
       def resolve_application
         # Same chain LogError uses — app name is process-global
         app_name = RailsErrorDashboard.configuration.application_name ||

data/lib/rails_error_dashboard/commands/log_error.rb

@@ -290,6 +290,12 @@ module RailsErrorDashboard
           attributes[:environment_info] = Services::EnvironmentSnapshot.snapshot.to_json
         end
 
+        # Environment awareness (if column exists). context wins so a sender
+        # elsewhere can attribute an event to its own environment.
+        if ErrorLog.column_names.include?("environment")
+          attributes[:environment] = resolve_environment
+        end
+
         # Apply sensitive data filtering (on by default)
         attributes = Services::SensitiveDataFilter.filter_attributes(attributes)
 
@@ -424,12 +430,22 @@ module RailsErrorDashboard
       def maybe_notify(error_log)
         return if error_log.muted?
         return if Services::StormProtection::Gate.notifications_suppressed?
+        return unless Services::NotificationThrottler.environment_allowed?(error_log)
         return unless yield
 
         Services::ErrorNotificationDispatcher.call(error_log)
         Services::NotificationThrottler.record_notification(error_log)
       end
 
+      # The environment this error is attributed to: an explicit context value
+      # (truncated to the column) or the process-wide resolution. Never nil.
+      def resolve_environment
+        name = @context[:environment].to_s.strip
+        return name[0, 64] unless name.empty?
+
+        RailsErrorDashboard.configuration.current_environment
+      end
+
       # Find or create application for multi-app support
       def find_or_create_application
         app_name = RailsErrorDashboard.configuration.application_name ||
@@ -492,6 +508,7 @@ module RailsErrorDashboard
         # Return early if baseline alerts are disabled or error is muted
         return unless config.enable_baseline_alerts
         return if error_log.muted?
+        return unless Services::NotificationThrottler.environment_allowed?(error_log)
         return unless defined?(Queries::BaselineStats)
         return unless defined?(BaselineAlertJob)
 

data/lib/rails_error_dashboard/configuration.rb

@@ -14,6 +14,12 @@ module RailsErrorDashboard
     attr_accessor :application_name
     attr_accessor :database  # Database connection name for shared error dashboard DB
 
+    # Environment awareness. Errors record which environment they came from
+    # (production, staging, uat, ...). Names are free-form strings, never an
+    # enum -- teams invent environment names, and a fixed list is wrong tomorrow.
+    attr_accessor :environment                # Overrides Rails.env for captured errors (ENV: ERROR_DASHBOARD_ENVIRONMENT)
+    attr_accessor :notification_environments  # Only notify for these environments; nil = all (ENV: ERROR_DASHBOARD_NOTIFICATION_ENVIRONMENTS)
+
     # Notifications
     attr_accessor :slack_webhook_url
     attr_accessor :notification_email_recipients
@@ -262,6 +268,10 @@ module RailsErrorDashboard
       @application_name = ENV["APPLICATION_NAME"]  # Auto-detected if not set
       @database = nil  # Use primary database by default
 
+      # Environment awareness defaults: attribute to Rails.env unless overridden
+      @environment = ENV["ERROR_DASHBOARD_ENVIRONMENT"].to_s.strip.then { |v| v.empty? ? nil : v }
+      @notification_environments = parse_name_list(ENV["ERROR_DASHBOARD_NOTIFICATION_ENVIRONMENTS"])
+
       # Notification settings (disabled by default - enable during installation or in initializer)
       @slack_webhook_url = ENV["SLACK_WEBHOOK_URL"]
       @notification_email_recipients = ENV.fetch("ERROR_NOTIFICATION_EMAILS", "").split(",").map(&:strip)
@@ -792,6 +802,26 @@ module RailsErrorDashboard
         errors << "total_users_for_impact must be at least 1 (got: #{total_users_for_impact})"
       end
 
+      # Validate environment (free-form, but it has to fit the 64-char column)
+      unless environment.nil?
+        if !environment.is_a?(String) || environment.strip.empty?
+          errors << "environment must not be blank (got: #{environment.inspect}); leave it nil to use Rails.env"
+        elsif environment.length > 64
+          errors << "environment must be 64 characters or fewer (got #{environment.length})"
+        end
+      end
+
+      # Validate notification_environments (nil = notify everywhere; otherwise names only)
+      unless notification_environments.nil?
+        valid_list = notification_environments.is_a?(Array) &&
+                     notification_environments.any? &&
+                     notification_environments.all? { |name| name.is_a?(String) && !name.strip.empty? }
+        unless valid_list
+          errors << "notification_environments must be nil or a non-empty Array of environment names " \
+                    "(got: #{notification_environments.inspect})"
+        end
+      end
+
       # Validate notification_minimum_severity (must be valid symbol)
       if notification_minimum_severity
         valid_notification_severities = %i[critical high medium low]
@@ -822,6 +852,28 @@ module RailsErrorDashboard
       true
     end
 
+    # The environment this process attributes captured errors to.
+    #
+    # Explicit option first, then Rails.env. Never nil and never raises: an
+    # error must still be captured when the environment cannot be named.
+    #
+    # @return [String]
+    def current_environment
+      name = environment.to_s.strip
+      return name unless name.empty?
+
+      rails_env = defined?(Rails) && Rails.respond_to?(:env) ? Rails.env.to_s.strip : ""
+      rails_env.empty? ? "unknown" : rails_env
+    rescue StandardError
+      "unknown"
+    end
+
+    # "production, uat" -> ["production", "uat"]; blank or all-blank -> nil.
+    def parse_name_list(raw)
+      list = raw.to_s.split(",").map(&:strip).reject(&:empty?)
+      list.empty? ? nil : list
+    end
+
     # Check if using default or blank demo credentials with basic auth
     #
     # Returns false if the user explicitly set ENV vars (even to the same default values),

data/lib/rails_error_dashboard/engine.rb

@@ -85,6 +85,13 @@ module RailsErrorDashboard
       if RailsErrorDashboard.configuration.enable_rack_attack_tracking &&
          defined?(Rack::Attack)
         RailsErrorDashboard::Subscribers::RackAttackSubscriber.subscribe!
+
+        # Buffered counts live on the Puma threads that served the requests and
+        # are only written out on the flush interval, which a low-traffic rule
+        # may never reach. Without this, everything still buffered at SIGTERM
+        # (every deploy) is lost. at_exit, not Signal.trap — trapping would
+        # clobber Puma's USR1/USR2 handlers (safety rule 9).
+        at_exit { RailsErrorDashboard::Services::RackAttackTracker.flush_all_threads! }
       end
 
       # Subscribe to ActionCable AS::Notifications events (requires breadcrumbs + ActionCable)

data/lib/rails_error_dashboard/queries/analytics_stats.rb

@@ -25,6 +25,7 @@ module RailsErrorDashboard
             errors_over_time: errors_over_time,
             errors_by_type: errors_by_type,
             errors_by_platform: errors_by_platform,
+            errors_by_environment: errors_by_environment,
             errors_by_hour: errors_by_hour,
             top_users: top_affected_users,
             resolution_rate: resolution_rate,
@@ -88,6 +89,14 @@ module RailsErrorDashboard
         base_query.group(:platform).count
       end
 
+      # NULL (captured before the column existed) is reported under :unknown
+      # rather than dropped, so the chart's total still matches the period.
+      def errors_by_environment
+        return {} unless ErrorLog.column_names.include?("environment")
+
+        base_query.group(:environment).count.transform_keys { |env| env.nil? ? :unknown : env }
+      end
+
       def errors_by_hour
         # group_by_hour_of_day buckets into 0..23 to show diurnal patterns
         # (when in the day errors peak). The chart title says "Errors by Hour

data/lib/rails_error_dashboard/queries/errors_list.rb

@@ -28,6 +28,7 @@ module RailsErrorDashboard
         query = filter_by_error_type(query)
         query = filter_by_resolved(query)
         query = filter_by_platform(query)
+        query = filter_by_environment(query)
         query = filter_by_application(query)
         query = filter_by_user_id(query)
         query = filter_by_app_version(query)
@@ -92,6 +93,13 @@ module RailsErrorDashboard
         query.where(platform: @filters[:platform])
       end
 
+      def filter_by_environment(query)
+        return query unless @filters[:environment].present?
+        return query unless ErrorLog.column_names.include?("environment")
+
+        query.where(environment: @filters[:environment])
+      end
+
       def filter_by_application(query)
         return query unless @filters[:application_id].present?
 

data/lib/rails_error_dashboard/queries/filter_options.rb

@@ -17,11 +17,20 @@ module RailsErrorDashboard
         {
           error_types: base_scope.distinct.pluck(:error_type).compact.sort,
           platforms: base_scope.distinct.pluck(:platform).compact,
+          environments: environments,
           applications: Application.ordered_by_name.pluck(:name, :id),
           assignees: assignees
         }
       end
 
+      # Sorted so the select is stable between requests. Empty until the
+      # environment migration has run, so the index simply shows no filter.
+      def environments
+        return [] unless ErrorLog.column_names.include?("environment")
+
+        base_scope.distinct.pluck(:environment).compact.sort
+      end
+
       def assignees
         base_scope.where.not(assigned_to: nil)
                   .select(:assigned_to)

data/lib/rails_error_dashboard/queries/rack_attack_summary.rb

@@ -24,7 +24,8 @@ module RailsErrorDashboard
 
       def call
         {
-          events: aggregated_events
+          events: aggregated_events,
+          overflow_count: overflow_count
         }
       end
 
@@ -36,15 +37,27 @@ module RailsErrorDashboard
         scope
       end
 
+      # Counts dropped by the tracker's LRU eviction, kept out of the per-rule
+      # listing (they belong to no single rule) but reported so the dashboard
+      # never silently under-states volume.
+      def overflow_count
+        base_query.where(match_type: RackAttackEvent::OVERFLOW_MATCH_TYPE).sum(:event_count).to_i
+      rescue => e
+        0
+      end
+
       def aggregated_events
-        rows = base_query.pluck(
-          :rule, :match_type, :discriminator, :path, :event_count, :last_seen_at, :period_hour
-        )
+        rows = base_query
+          .where.not(match_type: RackAttackEvent::OVERFLOW_MATCH_TYPE)
+          .pluck(
+            :rule, :match_type, :discriminator, :path, :event_count, :last_seen_at,
+            :period_hour, :user_agent
+          )
         return [] if rows.empty?
 
         grouped = {}
 
-        rows.each do |rule, match_type, discriminator, path, event_count, last_seen_at, period_hour|
+        rows.each do |rule, match_type, discriminator, path, event_count, last_seen_at, period_hour, user_agent|
           key = rule.to_s.presence || "unknown"
           count = event_count.to_i
           seen_at = last_seen_at || period_hour
@@ -55,12 +68,19 @@ module RailsErrorDashboard
             count: 0,
             ips: Set.new,
             path_counts: Hash.new(0),
+            agent_counts: Hash.new(0),
+            ai_count: 0,
             last_seen: nil
           }
 
           entry[:count] += count
           entry[:ips] << discriminator.to_s if discriminator.present?
           entry[:path_counts][path.to_s] += count if path.present?
+          if user_agent.present?
+            agent = Services::AiAgentClassifier.name(user_agent) || user_agent.to_s
+            entry[:agent_counts][agent] += count
+            entry[:ai_count] += count if Services::AiAgentClassifier.ai?(user_agent)
+          end
           entry[:last_seen] = [ entry[:last_seen], seen_at ].compact.max
 
           # Prefer the most severe match type when a rule spans several. A rule
@@ -74,11 +94,17 @@ module RailsErrorDashboard
           r[:paths] = r[:path_counts].sort_by { |_p, c| -c }.map(&:first)
           r[:unique_ips] = r[:ips].size
           r[:ips] = r[:ips].to_a
+          # Which client matched most often — the question unique_ips cannot
+          # answer, because one AI agent is a whole fleet of addresses (#170).
+          r[:top_agent] = r[:agent_counts].max_by { |_agent, count| count }&.first
+          r[:agents] = r[:agent_counts].sort_by { |_a, c| -c }.map(&:first)
+          r[:unique_agents] = r[:agent_counts].size
           # Distinct rate-limited clients is the meaningful figure here; the old
           # breadcrumb-derived :error_count no longer applies now that events are
           # stored independently of errors.
           r[:error_count] = 0
           r.delete(:path_counts)
+          r.delete(:agent_counts)
         end
 
         grouped.values.sort_by { |r| -r[:count] }