rails_error_dashboard 0.11.9 → 0.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f07dcfe9569e107c4f8b3bee4f15e106c4b537690d9bf002af887e832d9e0a9b
-  data.tar.gz: 5defe92b8156a8564a6a1286d2e5199b450b2f6ca894bcafd65586fe3723a7e0
+  metadata.gz: 2c23f8c75c71f71913d2f5964f25a38642373f2f720e8996377a5877e54a1e6a
+  data.tar.gz: 95e1db7a2687ed2900e3a02a2f33d1a1c21fc70c4597f9d9bf5d5855356d2f98
 SHA512:
-  metadata.gz: 0fe0f1b0894c8c1c797e341b2e00d2120871dca2bcc2800527f69a99831cd700005f21245b6a3a0fef86f0c7466ec0e1f588e21cb503c8c3621f9d203c79ce4c
-  data.tar.gz: ba3e9269169d059eeab3cf3f469294ac520a9144558199c05e0dc0b5262b7bbbd0ec8a28896f15fd26ee5a605ed74f5707eae7e38a354160341b676cbe9d7d58
+  metadata.gz: acb081a03269304c9c70b63ee996bd8d446a525bd506f401851d8249ad9bffe2ead0bf63798be64c231604176e03c614c761e4f551b9827802b7881b99f3b1b0
+  data.tar.gz: d28393ca63c1b9639daeb2409cdc3f20074f905e1cbc9e3a89ae7b881dbe2666bfbaf53052d1172803de0ca46d58ff7ae8b4bd6f4d9b24be3ffa61ae1283a20e

data/README.md

@@ -679,14 +679,14 @@ end
 
 ## Languages
 
-RED ships in English with machine-translated previews for ten additional languages, covering the dashboard, its emails and its notification payloads. Native-speaking Rails developers are invited to review and improve them; once a locale has been reviewed it will be marked individually as community-reviewed. Eleven locales ship:
+RED ships in English, with French reviewed by a native speaker and machine-translated previews for nine further languages, covering the dashboard, its emails and its notification payloads. Native-speaking Rails developers are invited to review and improve them; once a locale has been reviewed it is marked individually as community-reviewed, as French now is. Eleven locales ship:
 
 | Locale | Language | Status |
 |---|---|---|
 | `en` | English | Source language |
 | `de` | Deutsch | Machine-translated, unreviewed |
 | `es` | Español | Machine-translated, unreviewed |
-| `fr` | Français | Machine-translated, unreviewed |
+| `fr` | Français | Community-reviewed by a native speaker |
 | `pt-BR` | Português (Brasil) | Machine-translated, unreviewed |
 | `ja` | 日本語 | Machine-translated, unreviewed |
 | `ru` | Русский | Machine-translated, unreviewed |
@@ -701,9 +701,9 @@ config.dashboard_locale = "de"  # en, de, es, fr, pt-BR, ja, ru, uk, pl, it, zh-
 
 Users can also switch language per-session from the picker in the dashboard navbar, which overrides the configured default for them alone.
 
-**Everything but English is machine-translated and has not been reviewed by a native speaker.** That is stated plainly rather than as "beta", which would imply a review process that has not happened — RED's maintainer reads only English. Key structure, interpolation variables and plural categories *are* verified mechanically in every locale; wording, register and idiom are not verified by anyone. A wrong or missing translation falls back to **English**, never to a broken page.
+**French has been reviewed by a native speaker; everything but English and French is machine-translated and has not been.** That is stated plainly rather than as "beta", which would imply a review process that has not happened — RED's maintainer reads only English. Key structure, interpolation variables and plural categories *are* verified mechanically in every locale; outside French, wording, register and idiom are not verified by anyone. A wrong or missing translation falls back to **English**, never to a broken page.
 
-**Corrections are very welcome, and a one-key PR is a perfectly good PR.** If you read one of these languages, [every locale has an open issue](https://github.com/AnjanJ/rails_error_dashboard/issues?q=is%3Aissue+is%3Aopen+label%3Atranslation%3Aneeds-review) tracking its review — comment there, or [report a bad translation](https://github.com/AnjanJ/rails_error_dashboard/issues/new?template=translation_report.yml) without touching any code. You do not need to know Ruby, and you are not expected to review a whole file.
+**Corrections are very welcome, and a one-key PR is a perfectly good PR.** If you read one of these languages, [every unreviewed locale has an open issue](https://github.com/AnjanJ/rails_error_dashboard/issues?q=is%3Aissue+is%3Aopen+label%3Atranslation%3Aneeds-review) tracking its review — comment there, or [report a bad translation](https://github.com/AnjanJ/rails_error_dashboard/issues/new?template=translation_report.yml) without touching any code. You do not need to know Ruby, and you are not expected to review a whole file.
 
 RED translates through its own private I18n backend, so it never reads, writes or mutates your application's `I18n` configuration — your locale and its `available_locales` are untouched.
 

data/app/controllers/rails_error_dashboard/errors_controller.rb

@@ -769,13 +769,23 @@ module RailsErrorDashboard
       @current_application_id.present? ? { application_id: @current_application_id } : {}
     end
 
+    # Cache key for one linked issue's platform data. Includes the repository
+    # (or Linear team), because provider + number alone is not unique: issue 42
+    # exists in every repository, and Linear numbers issues per team.
+    def issue_cache_key(kind, error)
+      repo = error.respond_to?(:external_issue_repo) ? error.external_issue_repo : nil
+      [ "red", kind, error.external_issue_provider, repo.presence || "-", error.external_issue_number ].join("/")
+    end
+
     def fetch_platform_issue(error)
       return nil unless error.external_issue_url.present? && error.external_issue_number.present?
       return nil unless RailsErrorDashboard.configuration.enable_issue_tracking
 
-      cache_key = "red/issue_state/#{error.external_issue_provider}/#{error.external_issue_number}"
+      # The repository belongs in the key: two repositories sharing an issue
+      # number would otherwise read each other's cached state.
+      cache_key = issue_cache_key("issue_state", error)
       Rails.cache.fetch(cache_key, expires_in: 60.seconds) do
-        client = Services::IssueTrackerClient.from_config
+        client = Services::IssueTrackerClient.for_error(error)
         return nil unless client
 
         result = client.fetch_issue(number: error.external_issue_number)
@@ -790,9 +800,9 @@ module RailsErrorDashboard
       return [] unless RailsErrorDashboard.configuration.enable_issue_tracking
 
       # Cache for 60 seconds to avoid API hammering on page refreshes
-      cache_key = "red/issue_comments/#{error.external_issue_provider}/#{error.external_issue_number}"
+      cache_key = issue_cache_key("issue_comments", error)
       Rails.cache.fetch(cache_key, expires_in: 60.seconds) do
-        client = Services::IssueTrackerClient.from_config
+        client = Services::IssueTrackerClient.for_error(error)
         return [] unless client
 
         result = client.fetch_comments(number: error.external_issue_number, per_page: 20)

data/app/controllers/rails_error_dashboard/webhooks_controller.rb

@@ -127,7 +127,7 @@ module RailsErrorDashboard
       issue_number = payload.dig("issue", "number")
       return unless issue_number
 
-      error = find_error_by_issue(issue_number, "github")
+      error = find_error_by_issue(issue_number, "github", repo_from_payload("github", payload))
       return unless error
 
       case payload["action"]
@@ -146,7 +146,7 @@ module RailsErrorDashboard
       issue_iid = payload.dig("object_attributes", "iid")
       return unless issue_iid
 
-      error = find_error_by_issue(issue_iid, "gitlab")
+      error = find_error_by_issue(issue_iid, "gitlab", repo_from_payload("gitlab", payload))
       return unless error
 
       case action
@@ -164,7 +164,7 @@ module RailsErrorDashboard
       issue_number = payload.dig("issue", "number")
       return unless issue_number
 
-      error = find_error_by_issue(issue_number, "codeberg")
+      error = find_error_by_issue(issue_number, "codeberg", repo_from_payload("codeberg", payload))
       return unless error
 
       case payload["action"]
@@ -185,7 +185,7 @@ module RailsErrorDashboard
       issue_number = payload.dig("data", "number")
       return unless issue_number
 
-      error = find_error_by_issue(issue_number, "linear")
+      error = find_error_by_issue(issue_number, "linear", repo_from_payload("linear", payload))
       return unless error
 
       state_type = payload.dig("data", "state", "type")
@@ -196,11 +196,84 @@ module RailsErrorDashboard
       end
     end
 
-    def find_error_by_issue(issue_number, provider)
-      ErrorLog.find_by(
+    # The repository (or Linear team) this payload is about.
+    #
+    # Every provider already sends it and RED already parses the rest of the
+    # payload around it; it was simply never read. Linear has no repository --
+    # issue numbers are scoped to a team, which is exactly why it needs this
+    # most -- so the team key is taken from the issue identifier ("ENG-123")
+    # or the team object.
+    def repo_from_payload(provider, payload)
+      case provider
+      when "github", "codeberg"
+        payload.dig("repository", "full_name")
+      when "gitlab"
+        payload.dig("project", "path_with_namespace") ||
+          payload.dig("object_attributes", "project", "path_with_namespace")
+      when "linear"
+        key = payload.dig("data", "team", "key")
+        key ||= payload.dig("data", "identifier").to_s[/\A([A-Za-z][A-Za-z0-9]*)-\d+\z/, 1]
+        key&.upcase
+      end
+    end
+
+    # Match the FULL issue identity: provider, number and repository.
+    #
+    # A validly signed webhook from one repository used to resolve an error
+    # linked to a different repository that happened to share an issue number.
+    # That is not a signature bypass -- the request is genuine -- but it acts
+    # on the wrong error, which matters for shared databases, several linked
+    # repositories, a repository rename, and Linear's team-scoped numbering.
+    #
+    # A row that DOES record a repository is never matched by a different one.
+    #
+    # Rows linked before the repository was recorded have NULL there, and
+    # cannot simply be adopted by whoever asks first -- that would leave the
+    # original defect intact for exactly the rows most likely to be affected.
+    # Their stored issue URL is corroborating evidence: it names the repository
+    # the link was made against. If it disagrees with the payload, this webhook
+    # is about a different issue that merely shares a number.
+    #
+    # Only a legacy row whose URL cannot be parsed at all (an unrecognised
+    # forge) falls back to matching on provider + number, as before -- there is
+    # no evidence either way there, and dropping the event would break a
+    # working link.
+    def find_error_by_issue(issue_number, provider, repo = nil)
+      scope = ErrorLog.where(
         external_issue_number: issue_number,
         external_issue_provider: provider
       )
+      return scope.first unless ErrorLog.column_names.include?("external_issue_repo")
+
+      return scope.first if repo.blank?
+
+      exact = scope.where(external_issue_repo: repo).first
+      return exact if exact
+
+      legacy = scope.where(external_issue_repo: nil).find { |error|
+        url_repo = repo_from_issue_url(provider, error.external_issue_url)
+        url_repo.nil? || url_repo.casecmp?(repo.to_s)
+      }
+      # The identity is now established, so the row is precise from here on.
+      legacy&.update_columns(external_issue_repo: repo)
+      legacy
+    end
+
+    # The repository a stored issue URL was linked against, using the same
+    # patterns LinkExistingIssue parses links with -- one definition, so the
+    # two can never disagree about what a URL means.
+    #
+    # nil when the URL is absent or from an unrecognised forge.
+    def repo_from_issue_url(provider, url)
+      return nil if url.blank?
+
+      pattern = Commands::LinkExistingIssue::PROVIDER_PATTERNS[provider.to_s.to_sym]
+      return nil unless pattern
+
+      match = url.match(pattern)
+      return nil unless match
+
+      provider.to_s == "linear" ? match[1].upcase : match[1]
     end
 
     def resolve_error(error, message)

data/app/jobs/rails_error_dashboard/add_issue_recurrence_comment_job.rb

@@ -9,7 +9,7 @@ module RailsErrorDashboard
   class AddIssueRecurrenceCommentJob < ApplicationJob
     queue_as :error_notifications
 
-    retry_on StandardError, wait: :polynomially_longer, attempts: 2
+    retry_on StandardError, wait: RailsErrorDashboard::ApplicationJob::POLYNOMIAL_BACKOFF, attempts: 2
     discard_on ActiveRecord::RecordNotFound
 
     THROTTLE_INTERVAL = 3600 # 1 hour
@@ -27,7 +27,9 @@ module RailsErrorDashboard
       error = ErrorLog.find(error_log_id)
       return unless error.external_issue_url.present? && error.external_issue_number.present?
 
-      client = Services::IssueTrackerClient.from_config
+      # The repository this issue was actually opened in, not whatever the
+      # global configuration currently points at.
+      client = Services::IssueTrackerClient.for_error(error)
       return unless client
 
       comment = "Error occurred again (#{error.occurrence_count} total occurrences).\n\n"

data/app/jobs/rails_error_dashboard/application_job.rb

@@ -5,24 +5,66 @@ module RailsErrorDashboard
     # the request-scoped locale directly — see Concerns::LocalizedJob for why.
     include Concerns::LocalizedJob
 
+    # Polynomial backoff, as a Proc rather than the :polynomially_longer
+    # symbol.
+    #
+    # That symbol arrived in Rails 7.1; on 7.0 -- which this gem still
+    # supports -- retry_on raises "Couldn't determine a delay based on
+    # :polynomially_longer" the moment a retry is actually scheduled. The
+    # symbol therefore passed every 7.1+ CI row and failed every 7.0 one.
+    #
+    # This is the same formula Rails uses: (executions ** 4) + 2, with jitter.
+    POLYNOMIAL_BACKOFF = ->(executions) {
+      ((executions**4) + 2) + (Kernel.rand * (executions**4) * 0.15)
+    }
+
     # CRITICAL: Ensure job failures don't break the app or spam error logs
-    # Retry failed jobs with polynomial backoff, but limit attempts
-    retry_on StandardError, wait: :polynomially_longer, attempts: 3
+    # Retry failed jobs with polynomial backoff, but limit attempts.
+    #
+    # This must be the ONLY StandardError handler on this class. A
+    # `rescue_from StandardError` used to sit below it and log-then-re-raise:
+    # rescue_from is resolved in reverse registration order, so it won the
+    # lookup every time and retry_on's handler was never consulted. Retries
+    # still happened (the re-raise reached the adapter) but the polynomial
+    # backoff never applied -- failures retried immediately, three times, on
+    # every job in the gem. The logging that block provided now runs from
+    # retry_on's own exhaustion block, where it fires once, after the last
+    # attempt, with the same detail.
+    retry_on StandardError, wait: RailsErrorDashboard::ApplicationJob::POLYNOMIAL_BACKOFF, attempts: 3 do |job, error|
+      Rails.logger.error("[RailsErrorDashboard] Job #{job.class.name} failed: #{error.class} - #{error.message}")
+      Rails.logger.error("Job arguments: #{job.arguments.inspect}")
+      Rails.logger.error("Attempt: #{job.executions}/3")
+      Rails.logger.error(error.backtrace&.first(10)&.join("\n")) if error.backtrace
+      Rails.logger.error("[RailsErrorDashboard] Job #{job.class.name} discarded after #{job.executions} attempts")
+    end
 
-    # Global exception handling for all dashboard jobs
-    rescue_from StandardError do |exception|
-      # Log the error for debugging but don't propagate
-      Rails.logger.error("[RailsErrorDashboard] Job #{self.class.name} failed: #{exception.class} - #{exception.message}")
-      Rails.logger.error("Job arguments: #{arguments.inspect}")
-      Rails.logger.error("Attempt: #{executions}/3") if respond_to?(:executions)
-      Rails.logger.error(exception.backtrace&.first(10)&.join("\n")) if exception.backtrace
+    # Did this perform_later actually reach the queue?
+    #
+    # Active Job does NOT raise on every failed handoff: from Rails 7.2 an
+    # ActiveJob::EnqueueError raised by the adapter is caught inside
+    # perform_later, which then returns false and leaves enqueue_error set on
+    # the job. A caller that only rescues therefore treats a dropped job as a
+    # successful one. Callbacks that abort the enqueue behave the same way.
+    #
+    # Returns true for adapters/versions that predate successfully_enqueued?
+    # (Rails 7.0/7.1 let the error propagate instead, so the caller's rescue
+    # is what catches it there).
+    #
+    # @param job [ActiveJob::Base, false, nil] whatever perform_later returned
+    # @return [Boolean]
+    def self.enqueued?(job)
+      return false unless job
+      return job.successfully_enqueued? if job.respond_to?(:successfully_enqueued?)
 
-      # Re-raise to trigger retry mechanism (up to 3 attempts)
-      # After 3 attempts, ActiveJob will discard the job and log it
-      raise exception if executions < 3
+      true
+    end
 
-      # If we've exhausted retries, log and give up gracefully
-      Rails.logger.error("[RailsErrorDashboard] Job #{self.class.name} discarded after #{executions} attempts")
+    # Why a handoff failed, for the log line that reports it.
+    # @param job [ActiveJob::Base, false, nil]
+    # @return [String]
+    def self.enqueue_failure_reason(job)
+      (job.respond_to?(:enqueue_error) && job.enqueue_error&.message) ||
+        "perform_later returned #{job.inspect}"
     end
   end
 end

data/app/jobs/rails_error_dashboard/async_error_logging_job.rb

@@ -23,11 +23,29 @@ module RailsErrorDashboard
         context[:_serialized_cause_chain] = exception_data[:cause_chain]
       end
 
-      # Log the error synchronously in the background job
-      # Call .new().call to bypass async check (we're already async)
-      Commands::LogError.new(exception, context).call
+      # Log the error synchronously in the background job.
+      # .new(...).call bypasses the async check (we're already async);
+      # worker: true makes an unreachable error store raise instead of being
+      # swallowed, so this job fails and retries rather than acknowledging a
+      # capture it never wrote.
+      Commands::LogError.new(exception, context, worker: true).call
+    rescue *Commands::LogError::RETRYABLE_STORE_ERRORS => e
+      # The error database is unreachable. Protecting a user request and
+      # deciding whether a background job succeeded are different contracts:
+      # swallowing here told Active Job the capture was delivered when nothing
+      # was written, so the payload was gone for good. Let it fail instead and
+      # let retry_on schedule another attempt.
+      #
+      # Rails reports this job failure to Rails.error, so RED will try to
+      # capture it too; that capture fails the same way and is swallowed by
+      # LogError's own rescue. ErrorReporter's recursion guard (issue #114)
+      # plus the attempt cap bound this to a few wasted attempts, not a loop.
+      Rails.logger.error("AsyncErrorLoggingJob: error storage unavailable (#{e.class}: #{e.message}) — will retry")
+      raise
     rescue => e
-      # Don't let async job errors break the job queue
+      # A payload problem (unparseable arguments, a class that cannot be
+      # reconstructed). Retrying replays the identical payload, so it would
+      # fail identically three times and still be discarded. Log and drop.
       Rails.logger.error("AsyncErrorLoggingJob failed: #{e.message}")
       Rails.logger.error("Backtrace: #{e.backtrace&.first(5)&.join("\n")}")
     end

data/app/jobs/rails_error_dashboard/close_linked_issue_job.rb

@@ -8,14 +8,16 @@ module RailsErrorDashboard
   class CloseLinkedIssueJob < ApplicationJob
     queue_as :error_notifications
 
-    retry_on StandardError, wait: :polynomially_longer, attempts: 2
+    retry_on StandardError, wait: RailsErrorDashboard::ApplicationJob::POLYNOMIAL_BACKOFF, attempts: 2
     discard_on ActiveRecord::RecordNotFound
 
     def perform(error_log_id)
       error = ErrorLog.find(error_log_id)
       return unless error.external_issue_url.present? && error.external_issue_number.present?
 
-      client = Services::IssueTrackerClient.from_config
+      # The repository this issue was actually opened in, not whatever the
+      # global configuration currently points at.
+      client = Services::IssueTrackerClient.for_error(error)
       return unless client
 
       # Add resolution comment

data/app/jobs/rails_error_dashboard/create_issue_job.rb

@@ -12,7 +12,7 @@ module RailsErrorDashboard
   class CreateIssueJob < ApplicationJob
     queue_as :error_notifications
 
-    retry_on StandardError, wait: :polynomially_longer, attempts: 3
+    retry_on StandardError, wait: RailsErrorDashboard::ApplicationJob::POLYNOMIAL_BACKOFF, attempts: 3
     discard_on ActiveRecord::RecordNotFound
 
     # Simple circuit breaker — class-level failure tracking

data/app/jobs/rails_error_dashboard/reopen_linked_issue_job.rb

@@ -8,14 +8,16 @@ module RailsErrorDashboard
   class ReopenLinkedIssueJob < ApplicationJob
     queue_as :error_notifications
 
-    retry_on StandardError, wait: :polynomially_longer, attempts: 2
+    retry_on StandardError, wait: RailsErrorDashboard::ApplicationJob::POLYNOMIAL_BACKOFF, attempts: 2
     discard_on ActiveRecord::RecordNotFound
 
     def perform(error_log_id)
       error = ErrorLog.find(error_log_id)
       return unless error.external_issue_url.present? && error.external_issue_number.present?
 
-      client = Services::IssueTrackerClient.from_config
+      # The repository this issue was actually opened in, not whatever the
+      # global configuration currently points at.
+      client = Services::IssueTrackerClient.for_error(error)
       return unless client
 
       # Reopen the issue

data/app/jobs/rails_error_dashboard/retention_cleanup_job.rb

@@ -25,6 +25,7 @@ module RailsErrorDashboard
       # errors — clean them up BEFORE the early return below, which fires
       # whenever no error logs happen to be expired.
       cleanup_rack_attack_events(cutoff)
+      cleanup_storm_flush_batches(cutoff)
 
       expired_scope = ErrorLog.where("occurred_at < ?", cutoff)
       return 0 if expired_scope.none?
@@ -61,6 +62,30 @@ module RailsErrorDashboard
 
     private
 
+    # Expire the storm batch ledger. Its only job is to make a replayed batch
+    # a no-op, and a replay arrives within the job's retry window (minutes),
+    # so rows well past the retention cutoff protect nothing. Own rescue, like
+    # the rack-attack cleanup: a failure here must never block error cleanup.
+    def cleanup_storm_flush_batches(cutoff)
+      return unless RailsErrorDashboard.configuration.enable_storm_protection
+      return unless StormFlushBatch.table_exists?
+
+      deleted = 0
+      StormFlushBatch.where("applied_at < ?", cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} storm flush batch records"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Storm flush batch retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
+
     # Expire aggregated Rack Attack event rows. Isolated in its own rescue so a
     # failure here (e.g. table not yet migrated) never blocks error cleanup.
     def cleanup_rack_attack_events(cutoff)

data/app/jobs/rails_error_dashboard/storm_flush_job.rb

@@ -5,15 +5,33 @@ module RailsErrorDashboard
   # the gate accumulates counts in memory with zero I/O, snapshots are handed
   # to this job at most once per flush interval, and ALL DB writes happen here.
   class StormFlushJob < ApplicationJob
+    # Raised when the command reports that nothing in the batch could be
+    # written, so retry_on can schedule another attempt.
+    class FlushFailed < StandardError; end
+
     queue_as :default
 
-    def perform(entries: [], overflow: 0, episode: nil)
+    def perform(entries: [], overflow: 0, episode: nil, batch_id: nil)
       entries = entries.map { |e| e.respond_to?(:stringify_keys) ? e.stringify_keys : e }
       episode = episode.stringify_keys if episode.respond_to?(:stringify_keys)
 
-      Commands::FlushStormCounts.call(entries: entries, overflow: overflow, episode: episode)
-    rescue => e
-      Rails.logger.error("[RailsErrorDashboard] StormFlushJob failed: #{e.class} - #{e.message}")
+      # batch_id identifies THIS batch across retries: ApplicationJob replays
+      # the identical payload, and the ledger has to recognise it.
+      result = Commands::FlushStormCounts.call(
+        entries: entries, overflow: overflow, episode: episode, batch_id: batch_id
+      )
+
+      # A batch that reconciled nothing because every write failed is not a
+      # delivered batch. Fail the job so Active Job retries it rather than
+      # dropping counts that were only ever held in one process's memory.
+      if result.is_a?(Hash) && result[:success] == false
+        raise FlushFailed, "storm flush reconciled nothing: #{result[:error]}"
+      end
+
+      result
+    rescue *Commands::LogError::RETRYABLE_STORE_ERRORS => e
+      Rails.logger.error("[RailsErrorDashboard] StormFlushJob: error storage unavailable (#{e.class}: #{e.message}) — will retry")
+      raise
     end
   end
 end

data/app/models/rails_error_dashboard/error_log.rb

@@ -79,6 +79,7 @@ module RailsErrorDashboard
     # Set defaults and tracking
     before_validation :set_defaults, on: :create
     before_create :set_tracking_fields
+    before_save :sync_group_window
     before_create :set_priority_score
 
     # Turbo Stream broadcasting
@@ -98,6 +99,52 @@ module RailsErrorDashboard
       self.first_seen_at ||= Time.current
       self.last_seen_at ||= Time.current
       self.occurrence_count ||= 1
+      set_group_window
+    end
+
+    # The immutable bucket that completes an unresolved group's database
+    # identity (see 20260915000001). Stamped once, at creation, and never
+    # rewritten -- not on increment, not on reopen: the row keeps the identity
+    # it was created with for its whole life, which is exactly what makes it
+    # usable as an index key.
+    #
+    # Two captures racing to create the same group are milliseconds apart and
+    # therefore share a bucket, so one of them loses on the unique index and
+    # takes the existing RecordNotUnique retry path. A capture that arrives
+    # after the previous group's 24 h window has rolled over lands in a
+    # different bucket and is allowed to open a new group, which is intended
+    # behaviour.
+    def set_group_window
+      return unless respond_to?(:group_window=)
+      return if group_window.present?
+
+      self.group_window = computed_group_window
+    rescue StandardError
+      # A bad occurred_at must never block a capture; a NULL bucket simply
+      # falls back to the pre-migration behaviour for this one row.
+      nil
+    end
+
+    # The bucket is DERIVED from occurred_at, so it must follow it. In
+    # production occurred_at is written once, at creation, and never rewritten
+    # -- so this is a no-op there and the bucket is immutable in practice.
+    # But anything that does move occurred_at (a fixture ageing a row, a
+    # backfill, a data repair) would otherwise leave the bucket pointing at the
+    # old window, and the row would sit in an index slot that no longer matches
+    # its own timestamp: a later capture computing the correct bucket would
+    # collide with a row the 24 h lookup had already excluded.
+    def sync_group_window
+      return unless respond_to?(:group_window=)
+      return unless has_attribute?(:occurred_at) && will_save_change_to_attribute?(:occurred_at)
+
+      self.group_window = computed_group_window
+    rescue StandardError
+      nil
+    end
+
+    def computed_group_window
+      basis = occurred_at || first_seen_at || Time.current
+      basis.utc.strftime("%Y-%m-%d")
     end
 
     def set_priority_score

data/app/models/rails_error_dashboard/storm_flush_batch.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # One row per storm count batch that has been reconciled onto ErrorLog rows.
+  #
+  # Storm counts are applied additively (occurrence_count + N), which is not
+  # idempotent, so a replayed batch would count twice. The digest is inserted
+  # in the same transaction as the increments: either both land or neither
+  # does, and a replay violates the unique index instead of double-counting.
+  #
+  # Inherits ErrorLogsRecord so separate-database routing applies.
+  class StormFlushBatch < ErrorLogsRecord
+    self.table_name = "rails_error_dashboard_storm_flush_batches"
+
+    # The identity of a batch: which fingerprints, how many of each, the
+    # overflow bucket, and the episode it belongs to.
+    #
+    # Sorted, so the same snapshot always digests to the same value whatever
+    # order the entries arrive in. Counts are included, so a LATER batch for
+    # the same fingerprints is a different identity and is applied normally --
+    # only a genuine replay of the same counts is suppressed.
+    #
+    # @param entries [Array<Hash>] snapshot entries
+    # @param overflow [Integer]
+    # @param episode [Hash, nil]
+    # @return [String] 64-character hex digest
+    def self.digest_for(entries:, overflow: 0, episode: nil, batch_id: nil)
+      # A batch id minted when the buffer was swapped identifies this batch
+      # exactly: a retry carries the same one, and two separate batches never
+      # share one. The content digest below is the fallback for a caller that
+      # has none (an older in-flight job, or a direct call).
+      return Digest::SHA256.hexdigest("batch:#{batch_id}") if batch_id.present?
+
+      parts = Array(entries).map { |entry|
+        entry = entry.with_indifferent_access if entry.respond_to?(:with_indifferent_access)
+        next nil unless entry.is_a?(Hash)
+
+        # gate_key identifies the fingerprint; opaque_identity is carried for
+        # grouping and is included so two different errors that somehow shared
+        # a gate_key could never collide here.
+        [ entry["gate_key"], entry["opaque_identity"], entry["count"].to_i,
+          entry["first_seen_at"], entry["last_seen_at"] ].join(":")
+      }.compact.sort
+
+      episode_part = episode.is_a?(Hash) ? episode["started_at"].to_s : ""
+
+      Digest::SHA256.hexdigest([ parts.join("|"), overflow.to_i, episode_part ].join("#"))
+    end
+  end
+end

data/app/views/rails_error_dashboard/errors/_request_context.html.erb

@@ -2,13 +2,39 @@
       <%# The locale is part of the cache key: this fragment contains translated
           text, and without it the first locale to render an error would be
           served to every other one. %>
-      <% cache [error, 'request_context_v5', red_locale] do %>
+      <% cache [error, 'request_context_v6', red_locale] do %>
       <div class="card mb-4" id="section-request-context">
         <div class="card-header">
           <h5 class="mb-0"><i class="bi bi-globe"></i> <%= red_t("red.errors.request_context.title") %></h5>
         </div>
         <div class="card-body">
           <table class="table table-sm">
+            <%# Provenance: which occurrence supplied everything below. The row
+                is a group; this evidence is one moment of failure. %>
+            <% if error.respond_to?(:context_captured_at) %>
+              <tr>
+                <th width="200"><%= red_t("red.errors.request_context.snapshot") %></th>
+                <td>
+                  <% if error.context_captured_at.present? %>
+                    <%= red_t("red.errors.request_context.snapshot_captured_html",
+                              time: tag.span(error.context_captured_at.utc.iso8601, class: "local-time")) %>
+                    <% if error.last_seen_at.present? && error.context_captured_at < error.last_seen_at - 1.second %>
+                      <span class="badge bg-warning text-dark ms-1"><%= red_t("red.errors.request_context.snapshot_stale") %></span>
+                    <% end %>
+                  <% else %>
+                    <span class="text-muted"><%= red_t("red.errors.request_context.snapshot_unknown") %></span>
+                  <% end %>
+                  <% if error.respond_to?(:context_fidelity) %>
+                    <% case error.context_fidelity %>
+                    <% when "lite" %>
+                      <div><small class="text-muted"><%= red_t("red.errors.request_context.snapshot_fidelity_lite") %></small></div>
+                    <% when "minimal" %>
+                      <div><small class="text-muted"><%= red_t("red.errors.request_context.snapshot_fidelity_minimal") %></small></div>
+                    <% end %>
+                  <% end %>
+                </td>
+              </tr>
+            <% end %>
             <tr>
               <th width="200"><%= red_t("red.errors.request_context.url") %></th>
               <td>

data/app/views/rails_error_dashboard/errors/_stats.html.erb

@@ -1,3 +1,9 @@
+<%# Rendered live over ActionCable by ErrorBroadcaster.broadcast_stats, which
+    names this partial by its FULL STRING PATH -- no `render "stats"` call
+    exists, so a search for one finds nothing. It is in scope for any change
+    to the stats contract.
+
+    today / this_week count EVENTS (summed occurrence_count), not groups. %>
 <div class="row g-4">
   <div class="col">
     <div class="card stat-card">