rails_pulse 0.4.0.pre.2 → 0.4.0.pre.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b102fc4776d7fe701b47011e02d682f47a2784500103f3cb7d7598a757b174ff
-  data.tar.gz: 34f4055047c1bb9151c9e811f14c4e90fe83e52508c61ea4433929b2b431d568
+  metadata.gz: b24fa9677dc2c9b2dd4042acadb464247dd64d2136836e2197a1afe5b90f3f21
+  data.tar.gz: 2c45d0508fb24753b4d65b87b57afb19382b82277747a532e5182d6a6e2a8bdd
 SHA512:
-  metadata.gz: 974fcf20833ab11e46a00db96d21590f32a699a73de8d2af229d1fa5559f0817c107ba684f4ada34cdb067a77f6293ecc11ee3d24f7911f9fe074353a2991d79
-  data.tar.gz: 507afdae03f11fef23d0bbd7cc5ee8e8123656e41efbc219a10f8b6682602bfb7dcfa91e9ac424352d68ad05b3bceed4070eead220d053713f56aa1ade7bec01
+  metadata.gz: 83270431a2752bb64ada4380744b5fc087696c36109bfcdd157412eb9689124e0dc8d1945371978455a8a2baefceced920ff27f82c3d311c4cd297b73f8ae52f
+  data.tar.gz: d3c00d842cebe64770e3039e0c50b029bdde9169590857ec17526a8a05bad7abf71eecebe0fe614ebd1f726a5567d8c4070f08831ccc5847b28c0018184c9ced

data/CHANGELOG.md

@@ -7,185 +7,132 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0.pre.6] - 2026-09-20
+
+## [0.4.0.pre.5] - 2026-09-20
+
+### Changed
+
+- **Services now autoload through Zeitwerk.** `app/services` was hidden from the Rails autoloader and wired up by hand, so services never reloaded in development and every new one had to be registered in the engine. They now load and reload like the rest of `app/`, with the few acronym-prone file names pinned so a host's `inflect.acronym` declarations cannot change the constants the gem expects.
+
+### Removed
+
+- `RailsPulse.warm_metric_cache!` (a no-op) and `RailsPulse.clear_metric_cache!` (used `delete_matched`, which some cache stores do not support). Neither was referenced by the dashboard.
+
+### Fixed
+
+- **Dashboard pages issue fewer queries.** Tag filtering now runs as subqueries inside each card and chart query instead of plucking every route, query and job id first; the route-backfill check is a single indexed query once every route has an action; and the dashboard's storage headline reuses table sizes for five minutes instead of measuring every table on every load.
+- **Lower per-query capture overhead.** The SQL, template and cache subscribers materialised the whole call stack on every event to find the calling app file; they now walk it lazily and stop at the first app frame, which cuts the per-event cost by half to two thirds on a typical controller stack.
+- **Summary aggregation writes each period in a handful of statements.** Every route, query and job summary used to be found and saved individually, so an hour with a few hundred routes and queries cost over 700 SQL statements; rows are now upserted in bulk against the summaries unique index.
+- **Background tracking no longer spawns a thread per request.** A burst of traffic used to fan out into one writer thread per request, each holding one of the app's database connections, so the app's own request threads could wait seconds for a connection. One writer thread per process now drains a bounded queue on a single connection; when the queue is full the newest request is dropped and counted rather than slowing the app. Adds `config.async_queue_size` (default 1000), `RailsPulse::Tracker.stats`, and an exit hook that drains the queue on restart. SQL normalisation and N+1 detection have moved off the request thread as well.
+- **Metric card sparklines are now correct in time zones east of UTC.** Daily buckets were computed from the stored UTC timestamp, so in zones such as London, Melbourne or Tokyo every card showed each day's value a day early with the latest day at zero, and half-hour zones got empty hourly sparklines. Grouping now follows `config.time_zone`, and the gem no longer adds `group_by_date` / `group_by_hour` to the host's `ActiveRecord::Relation`.
+- **Summary aggregation now runs its transaction on the Rails Pulse connection.** On separate-database installs it was opened on the host's primary database, so a failure part-way through a period could leave partial summaries behind.
+- **The dashboard's own HTTP, mailer, job and storage events are no longer recorded.** These subscribers skipped the recursion guard that SQL and template events already honoured.
+- **Storage page reports real table sizes again.** A leftover screenshot fixture replaced every table's live count, size, and age with hard-coded sample numbers in any environment other than `test`.
+- **Standalone dashboard settings forms no longer fail CSRF verification.** The standalone server (`rails_pulse_server`) used the plain `rack-session` gem's `Rack::Session::Cookie`, which knows nothing about Rails' CSRF handling: a token generated for a form is only written into the session by `commit_csrf_token`, a hook that only Rails' own `ActionDispatch::Session::CookieStore` calls. Every generated token was silently discarded, so every submission failed verification. Switched to `ActionDispatch::Cookies` + `ActionDispatch::Session::CookieStore` (seeding the `action_dispatch.*` env Rails normally sets up before reaching the engine).
+- **Standalone dashboard no longer 404s on the time range and global filters pickers.** Those forms submit `POST` with a hidden `_method=patch` field — the standard verb-override trick — which the mounted engine translates via the host app's default middleware stack. The standalone server (`rails_pulse_server`) builds its own minimal Rack stack and never added `Rack::MethodOverride`, so the request reached routing as a plain `POST` and 404'd against the `PATCH`-only route.
+- **Cleanup no longer risks statement timeouts on large tables.** `CleanupService`'s orphan checks for queries, routes, jobs, and exception groups used a `NOT IN` subquery, which some databases (notably PostgreSQL at scale) execute by materializing and rescanning the full subquery result instead of using an index. Switched to a correlated `NOT EXISTS`, which lets the planner use an index per row. A stalled cleanup stage previously blocked all later stages, including hourly summary pruning. (#253)
+- **Idle periods no longer trigger false "summary job not running" warnings.** `SummaryJob` now records a zero-count overall summary for hours/days with no requests, so the dashboard banner, `rails_pulse:status`, the storage-pressure card, and count-based cleanup no longer mistake "no traffic" for "job stopped running." (#250)
+- **Custom date range charts on the Routes, Queries, and Jobs pages no longer render blank when the server's OS timezone differs from `config.time_zone`.** A custom range was rounded to a day/hour boundary in whatever offset the parsed time happened to carry rather than `Time.zone`, so the boundary could land hours away from where summary data is actually bucketed — every chart series came back all-nil while the metric cards and table (queried differently) kept showing data, which was the visible symptom.
+- **Dashboard charts and metric cards now honor a custom date range instead of always showing the trailing days.** The dashboard collapsed the selected range to a day count and had every chart, card, and sparkline re-derive "the last N days ending now" from it, so a range in the past rendered recent data under the selected range's labels, and the day count itself was truncated by integer division. Charts and cards now bucket the exact selected range.
+- **Custom date range no longer 500s the dashboard on Marshal-backed session stores.** The custom range was written with symbol keys but read back expecting string keys, so stores that preserve symbols (e.g. `activerecord-session_store`) broke every page until the session was cleared; both shapes are now accepted and unreadable preferences fall back to the default range. (#252)
+- **`config.logger` is now honored.** `RailsPulse.logger` previously ignored a custom logger set in the initializer and always wrote to the tagged `Rails.logger`; the configured logger now receives all Rails Pulse log output. (#244)
+- **Cached SQL reads no longer captured as operations.** Query-cache hits were going through the same stack-walk and operation-allocation path as real queries, adding measurable overhead on requests with heavy cache reuse. `config.ignored_queries` now also works — it was previously validated but never consulted when collecting SQL operations.
+- **Dashboard status bar badges are now all clickable.** Routes, Queries, and Jobs badges link to their respective pages, matching Exceptions and Storage.
+- **Standalone auth notice logged once per process.** The "standalone dashboard ignores config.authentication_method / config.authorize" notice kept its once-only flag on each controller class, so it repeated for every engine controller a visitor reached. The flag now lives on `RailsPulse::Standalone` and the notice is logged once per process.
+
+## [0.4.0.pre.4] - 2026-09-07
+
+### Fixed
+
+- Dependency and packaging fixes only; no user-facing changes beyond 0.4.0.pre.3.
+
+## [0.4.0.pre.3] - 2026-09-06
+
+### Added
+
+- **Shell-based deployment tracking.** `rake rails_pulse:record_deployment` and the new `rake rails_pulse:finish_deployment[revision]` let release scripts record and close deployments without the HTTP API or a token.
+- **Standalone mode improvements.** Dashboard links now resolve correctly when served at `/`, and a new `config.standalone_authentication_method` (with an HTTP Basic fallback) replaces host-app authentication, which the standalone process can't use.
+- **`rails rails_pulse:status`.** Reports schema, migration, and tracking/auth config state in one command, and exits 1 if anything needs action before deploying.
+- **Schema drift guard.** `RailsPulse::SchemaCheck` detects tables or columns the running gem expects but that haven't been migrated yet, and pauses tracking (dashboard returns 503) with a clear warning instead of erroring. Disable with `config.schema_check_enabled = false`.
+
+### Fixed
+
+- Fixed breadcrumb links becoming protocol-relative (`//queries`) when the engine is mounted at `/`.
+- Fixed the standalone dashboard server 404ing on its own stylesheets and scripts.
+- Fixed asset responses using mixed-case headers, which `Rack::Lint` rejects under Rack 3.
+- Fixed `rails_pulse_server` ignoring `RAILS_ENV`/`RACK_ENV` and always booting `rackup` in development mode.
+- Fixed the standalone server requiring a literal `SECRET_KEY_BASE` instead of falling back to the host app's.
+
+### Security
+
+- Updated development dependencies mail, net-imap, and json for several CVEs (gem dev/CI only).
+- Updated development dependencies nokogiri, loofah, and rails-html-sanitizer for several CVEs (gem dev/CI only).
+- Updated development dependencies Rails, puma, websocket-driver, and concurrent-ruby for Dependabot's critical/high alerts. Host apps should update their own Rails to 8.1.3.1.
+
+### Changed
+
+- `rails generate rails_pulse:upgrade` now reports unrun migrations and outstanding route backfill instead of saying everything is up to date.
+- Cleaned up `rake test` output — no more RDoc warnings, stray blank lines, or leaked log noise.
+
 ## [0.4.0.pre.2] - 2026-09-04
 
 ### Fixed
 
-- **`rails generate rails_pulse:upgrade` wrote a migration that would not parse.**
-  The schema parser matched a column comment with `comment: "([^"]*)"`, which stops
-  at the first escaped quote. The `http_methods` comment embeds a `["GET","POST"]`
-  example, so it was truncated mid-escape and the trailing backslash escaped the
-  closing quote of the generated `comment:` string — the copied
-  `upgrade_rails_pulse_tables.rb` then failed to load with
-  `unterminated string meets end of file`. Comments are now matched as complete Ruby
-  string literals, decoded with `String#undump`, and re-escaped with `String#inspect`
-  when the migration is rendered.
-
-- **Background tracking writes corrupted the host app's test database connection.**
-  Under `use_transactional_tests` Rails pins one connection per pool and hands that
-  same connection to every thread, so the tracker's writer thread interleaved its
-  INSERTs with the test's own statements on a single socket. PostgreSQL reported
-  this as `message type 0x5a arrived from server while idle` and
-  `server sent data ("D" message) without prior row description`, and suites hung
-  or failed at random. The gem's own dummy app avoided it with
-  `config.async = false if Rails.env.test?`, but the installed initializer never
-  shipped that line. The tracker now writes inline whenever the pool's connection
-  is shared across threads, and `rails generate rails_pulse:install` adds the
-  test-environment line to the initializer. Existing installs should add
-  `config.async = false if Rails.env.test?` to `config/initializers/rails_pulse.rb`.
+- Fixed `rails generate rails_pulse:upgrade` writing a migration that failed to parse when a column comment contained an escaped quote.
+- Fixed background tracking writes corrupting the test database connection under transactional tests. Existing installs should add `config.async = false if Rails.env.test?` to their initializer.
 
 ## [0.4.0.pre.1] - 2026-09-03
 
-This release contains a **breaking schema change** and requires a one-time data
-migration. Read "Upgrading from 0.3.x" below before deploying. Take a database
-backup first: the route migration is irreversible.
+This release contains a **breaking schema change** and requires a one-time data migration. Back up your database first — the route migration is irreversible. See "Upgrading from 0.3.x" below.
 
 ### Security
 
-- **Job failure messages are redacted and bounded.** `rails_pulse_job_runs.error_message`
-  used to be stored raw and unbounded. It now goes through the same sanitizer as
-  exception messages: `key=value` / `key: value` / `"key":"value"` fragments are
-  masked whenever the key matches `config.filter_parameters` (same rules as logged
-  params), and MySQL `Duplicate entry '<value>'` values are redacted alongside
-  PostgreSQL `DETAIL:` clauses.
-- **CSRF protection is now declared by the engine.** `RailsPulse::ApplicationController`
-  calls `protect_from_forgery with: :exception` itself instead of inheriting it from the
-  host's `default_protect_from_forgery`, which only `load_defaults 5.2+` enables. Hosts
-  on an older `load_defaults` had no CSRF protection on any engine endpoint (tags,
-  exception status, query reanalyze, session filters). Brakeman's `CheckForgerySetting`
-  is no longer skipped.
-- **Authentication hooks fail closed.** An `authentication_method` that returned
-  `false` without rendering or redirecting used to grant access — `proc { current_user&.admin? }`
-  looked right and let every non-admin in. Literal `false` is now a 403; `nil`
-  (what the documented `unless … redirect_to … end` style returns on success) still allows.
-- **EXPLAIN hardening.** The query analyzer now refuses SQL containing `;`, `--` or `/*`
-  anywhere (PostgreSQL's `execute` runs every statement in a string, so a captured
-  `SELECT …; UPDATE …` would have re-run the UPDATE on each page view), runs the
-  PostgreSQL EXPLAIN inside `SET LOCAL transaction_read_only = on` with a 5s
-  `statement_timeout` instead of `Timeout.timeout`, and always rolls its savepoint back.
-- **Deployments API input is bounded.** `revision` is capped at 255 characters,
-  serialized `metadata` at 4 KB, and `started_at` may be at most one hour in the future
-  (a forged future marker would have stamped every later exception with a revision
-  that never shipped). `rails_pulse_deployments` now has a count cap
-  (`max_table_records`, default 1 000) enforced by `CleanupService`; deployments are
-  never pruned by age.
-- **Backtrace source snippets are limited to `app/`, `lib/` and `config/routes.rb`**
-  (`.rb`, `.erb`, `.rake`, `.haml`, `.slim`, `.jbuilder`). Previously any file under
-  `Rails.root` was readable through a backtrace frame, including initializers with
-  inline keys, `config/database.yml`, and `.env`.
-- **Standalone dashboard session cookie is `Secure` in production** (override with
-  `RAILS_PULSE_INSECURE_SESSION=1`). The rackup's "no Rails app" branch, which could
-  never boot (`NameError: uninitialized constant Rails`), is replaced with a clear
-  error; the deployment docs now give the working invocation.
+- Job failure messages (`rails_pulse_job_runs.error_message`) are now redacted the same way exception messages are.
+- CSRF protection is now declared directly by the engine instead of depending on the host's `load_defaults` version.
+- Fixed `authentication_method` granting access when it returned a falsy-but-not-`false`/redirect value; it's now fail-closed.
+- Hardened EXPLAIN analysis against SQL injection and added a statement timeout.
+- Bounded deployment API input (revision length, metadata size, future timestamps) and capped the `rails_pulse_deployments` row count.
+- Backtrace source snippets are now limited to `app/`, `lib/`, and `config/routes.rb`, instead of any file under `Rails.root`.
+- The standalone dashboard's session cookie is now `Secure` in production.
 
 ### Added
 
-- **Exception tracking** — Captures unhandled exceptions from web requests and
-  background jobs, groups them by class and location, and displays backtraces (first
-  50 frames) with filtered request params in a new Exceptions tab. Exception
-  messages are redacted before storage: `key=value` / `key: value` / `"key":"value"`
-  fragments are masked whenever the key matches `config.filter_parameters`, and
-  MySQL `Duplicate entry '<value>'` values are redacted alongside PostgreSQL
-  `DETAIL:` clauses.
-- **`track_exceptions` config option** — Gem default is `false`, so existing installs
-  do not begin capturing on upgrade; the upgrade generator inserts `false`
-  explicitly. The install template sets `true` for new apps.
-- **`capture_exception_params` config option** — Captures request params alongside
-  each occurrence, filtered via Rails' `filter_parameters`. Occurrences whose params
-  exceed 10 KB after filtering are stored without params. Default `true`, and only
-  consulted while `track_exceptions` is on.
-- **`exception_message_filter` config option** — an optional `->(message, exception)`
-  hook applied after the built-in redaction for app-specific patterns. If the hook
-  raises, the message is stored as `[FILTERED]` rather than unfiltered.
-- **`authorize` config option** — a fail-closed predicate, `->(controller) { … }`
-  (or a zero-argument proc run in the controller). Anything falsy is a 403. Runs after
-  `authentication_method` when both are set, and replaces the HTTP Basic fallback on
-  its own. This is now the recommended way to gate the dashboard.
-- **Upgrade generator syncs new initializer settings** — Appends keys (and
-  `max_table_records` entries) the host file does not already mention, without
-  rewriting existing values. Review with `git diff`.
+- **Exception tracking.** Captures unhandled exceptions from requests and jobs, with grouping, backtraces, and redacted params in a new Exceptions tab.
+- **`track_exceptions` config option**, off by default for existing installs and on by default for new ones.
+- **`capture_exception_params` config option** to include filtered request params with each exception occurrence.
+- **`exception_message_filter` config option** for app-specific redaction beyond the built-in rules.
+- **`authorize` config option** — a fail-closed predicate for gating dashboard access; now the recommended approach.
+- **The upgrade generator now syncs new initializer settings** into the host's config file without overwriting existing values.
 
 ### Changed
 
-- **BREAKING — route identity is now `[controller_action, path]`.** GET `/users`
-  (`users#index`) and POST `/users` (`users#create`) are distinct routes. Dynamic
-  paths are normalized at capture time (`/posts/42` → `/posts/:id`).
-- **A one-time backfill is mandatory.** `rails rails_pulse:migrate_routes` backfills
-  `controller_action` (from the live router, then from request history), collapses
-  historical literal paths, and merges routes sharing an action (GET+POST `/sign_in`
-  → `sessions#new`). A schema migrate alone leaves the Action column empty. The
-  upgrade generator and the dashboard both warn when the step is outstanding.
-- **The JavaScript bundle is 66% smaller: 2.19 MB → 759 KB (754 KB → 248 KB gzipped).**
-  ECharts is now tree-shaken — `application.js` imports from `echarts/core` and
-  registers only the series and components the dashboard uses, instead of the
-  `echarts` barrel that bundled every chart type including maps, sankey and gauge.
-  Charts outside that set must now register their module explicitly; see
-  `docs/stimulus_echarts_usage.md`. The stylesheet is 5% smaller.
+- **BREAKING — route identity is now `[controller_action, path]`**, so different HTTP methods on the same path are tracked as distinct routes.
+- **A one-time `rails rails_pulse:migrate_routes` backfill is required** after migrating; a schema migrate alone leaves the Action column empty.
+- **The JavaScript bundle is 66% smaller** (2.19 MB → 759 KB) after tree-shaking ECharts.
 
 ### Removed
 
-- **BREAKING — `rails_pulse_routes.method` is dropped.** The HTTP verb now lives on
-  each request (`rails_pulse_requests.method`); a route carries an `http_methods`
-  array instead. All application, worker, and dashboard processes must be restarted
-  together against the migrated schema. A rolling restart that leaves 0.3.x
-  processes running will silently drop request tracking and 500 the routes dashboard.
-- **BREAKING — the route migration is irreversible.** `db:rollback` raises
-  `ActiveRecord::IrreversibleMigration` on
-  `ChangeRailsPulseRoutesToMultiVerbModel`, and routes merged by
-  `rails_pulse:migrate_routes` are deleted with no audit trail. Recovery from a bad
-  upgrade is restore-from-backup only.
-- **Three unreachable Stimulus controllers** — `form`, `timezone` and
-  `period_selector` — were bundled and registered despite no view referencing them.
-  `timezone` also ran a `MutationObserver` over the whole document body.
-- **`theme.js`**, which registered a chart theme that `application.js` immediately
-  overwrote. Its UMD wrapper called `require('echarts')`, which alone would have
-  defeated the tree-shaking above.
-- **Dead CSS**: unused css-zero ports, the removed dashboard period selector's styles,
-  and the disabled `toolbox` chart option.
-- **`csp-test.js` is no longer shipped in the gem.** Its page is mounted only when
-  `Rails.env.local?`, so it was unreachable in a published gem. It remains in the
-  repository for development and the CSP compliance system test.
+- **BREAKING — `rails_pulse_routes.method` is dropped**; the HTTP verb now lives on each request. Restart all processes together after migrating.
+- **BREAKING — the route migration is irreversible.** Back up your database first.
+- Removed three unused Stimulus controllers (`form`, `timezone`, `period_selector`).
+- Removed `theme.js`, a chart theme that was immediately overwritten and would have defeated ECharts tree-shaking.
+- Removed dead CSS: unused css-zero ports, old period-selector styles, and a disabled toolbox option.
+- `csp-test.js` is no longer shipped in the published gem.
 
 ### Fixed
 
-- **Tag filters work on SQLite for tags containing `_`.** The `LIKE` patterns were
-  escaped but issued without an `ESCAPE` clause; SQLite has no default escape
-  character, so `my_tag` never matched and "hide records tagged my_tag" hid nothing.
-  All three adapters now get an explicit `ESCAPE '!'`.
-- **Hand-edited query strings no longer 500.** `?q=string`, unparseable custom date
-  ranges, unparseable `occurred_at` filters, a non-array `enabled_tags`, and
-  oversized or unparseable session time filters all fall back to defaults instead of
-  raising. Session-stored presets and performance thresholds are validated against
-  the known values.
-- **Chart click/zoom got slower the more you switched chart tabs.** The requests,
-  routes and queries index pages attached a fresh `document` mouseup listener every
-  time a chart tab was re-selected, and only the most recent one was ever removed.
-  After N switches a single click anywhere on the page re-ran the zoom handler N
-  times. The listener is now bound once per controller.
-- **Zooming onto the first column of a category chart reset the range.** Visible-range
-  extraction used `dataZoom.startValue || 0`, so a legitimate index of `0` fell through
-  to the full-axis fallback.
-- **Hover popovers could throw after a table refresh.** `popover_controller` left its
-  show/hide timers running on disconnect, so a pending 700ms open could fire against
-  an element a fetch had already replaced.
-- **The time range selector's hover border was invisible.** It referenced
-  `--color-border-emphasis`, which is defined nowhere, so the declaration was invalid
-  at computed-value time and the border fell back to `currentColor`. Its light-mode
-  rules also never applied on a first visit, because `data-color-scheme` is only set
-  after an explicit toggle.
-- **`[popover].positioned` was declared twice** at equal specificity, so correct
-  popover placement depended on CSS file load order. Merged into one rule.
+- Fixed tag filters not matching tags containing `_` on SQLite.
+- Fixed various hand-edited or malformed query strings causing 500s instead of falling back to defaults.
+- Fixed chart click/zoom handlers accumulating on every chart tab switch, slowing clicks down over time.
+- Fixed zooming to the first column of a category chart resetting the range instead of applying it.
+- Fixed hover popovers throwing after a table refresh replaced the underlying element.
+- Fixed the time range selector's hover border being invisible due to an undefined CSS variable.
+- Fixed a duplicate CSS rule that made popover placement depend on file load order.
 - Fixed upgrading when using a separate database installation.
-- Separate-database installs set `schema_dump: false`, so `db:migrate` no longer
-  dumps or loads `db/rails_pulse_structure.sql` (#189).
-- Fixed `assets:precompile` failing on memory-constrained hosts by not registering
-  dashboard assets with the host Sprockets pipeline. Precompile copies the pre-built
-  files into `public/assets` (digested, no compressor) so `config.asset_host` and
-  CDN-only CSP work; development and hosts without a pipeline still use
-  `/rails-pulse-assets/<gem-version>/...`.
-- SQLite `schema.rb` now keeps the partial unique index on unrecognised routes
-  (`WHERE controller_action IS NULL`). A raw `CREATE INDEX` was dumped without the
-  predicate, so `db:schema:load` and parallel tests unique-constrained every path.
+- Separate-database installs now set `schema_dump: false` so `db:migrate` doesn't dump or load `db/rails_pulse_structure.sql` (#189).
+- Fixed `assets:precompile` OOMing on memory-constrained hosts by not registering dashboard assets with Sprockets.
+- Fixed SQLite's `schema.rb` dropping the partial unique index on unrecognised routes, which over-constrained paths on `db:schema:load`.
 
 ### Upgrading from 0.3.x
 
@@ -209,21 +156,19 @@ once you have reviewed what is captured.
 
 ## [0.3.3] - 2026-06-23
 
-- **Deployment tracking** — Record deployments via `POST /rails_pulse/deployments` or `rake rails_pulse:record_deployment[sha]`. Deployments appear as vertical marker lines on performance charts so you can correlate releases with regressions
-- **`deployment_api_token` config option** — Secures the deployments endpoint with a token header for CI/CD use
-- All multi-series charts now use a native ECharts time axis (`[timestamp_ms, value]` pairs) instead of a separate labels array, enabling deployment markers and better zoom behaviour
+- **Deployment tracking** — Record deployments via `POST /rails_pulse/deployments` or `rake rails_pulse:record_deployment[sha]`, shown as marker lines on performance charts.
+- **`deployment_api_token` config option** — Secures the deployments endpoint with a token header for CI/CD use.
+- Charts now use a native ECharts time axis instead of a separate labels array, enabling deployment markers and better zoom behaviour.
 
 ## [0.3.0] - 2026-04-30
 
-This is the largest release to date — a full UI overhaul across every section of
-the dashboard. Charts are now switchable, the dashboard surfaces health status
-automatically, and the underlying controller and model code has been substantially
-refactored. Existing installs need to run the two new migrations. Hopefully future
-releases will be smaller and more incremental than this one.
+This is the largest release to date — a full UI overhaul with switchable charts and
+automatic health status across the dashboard. Existing installs need to run two new
+migrations.
 
 ### Added
 
-- **New chart types across all sections** — Routes, queries, and jobs now have dedicated chart panels with switchable chart types (response time percentiles, request volume, error rate, execution volume, duration, failure rate)
+- **New chart types across all sections** — Routes, queries, and jobs now have dedicated, switchable chart panels (percentiles, volume, error/failure rate, duration)
 - **Dashboard health summary** — New `HealthSummary` model surfaces an overall health status and highlights routes/queries/jobs that need attention
 - **Dashboard "Needs Attention" section** — Automatically surfaces slow routes, high error rates, and problematic jobs without manual digging
 - **Storage pressure indicator** — Tracks and displays database storage growth so you know when to adjust retention settings
@@ -249,16 +194,16 @@ releases will be smaller and more incremental than this one.
 
 ### Changed
 
-- **Dashboard redesigned** — Full dashboard overhaul with health summary, attention sections, and chart panels replacing the previous card layout
+- **Dashboard redesigned** — Full overhaul with health summary, attention sections, and chart panels replacing the previous card layout
 - **Routes, queries, and jobs index pages redesigned** — Consistent layout with metric cards, switchable chart tabs, and paginated tables
 - **Metric card component updated** — Cards now support a richer data structure with trend indicators
-- **Application controller refactored** — Controller concerns split into focused modules (`ChartTableConcern`, `MetricCardConcern`, `PaginationConcern`, `SessionFiltersConcern`, `TagFilterConcern`, `TimeRangeConcern`, `ZoomRangeConcern`)
-- **`normalized_sql` column expanded to `text`** — Removes the 1000-character limit on PostgreSQL and MySQL (migration provided for existing installs)
+- **Application controller refactored** — Split into focused concerns (`ChartTableConcern`, `MetricCardConcern`, `PaginationConcern`, `SessionFiltersConcern`, `TagFilterConcern`, `TimeRangeConcern`, `ZoomRangeConcern`)
+- **`normalized_sql` column expanded to `text`** — Removes the 1000-character limit on PostgreSQL and MySQL (migration provided)
 - **Diagnostic fields added to queries table** — New columns captured at instrumentation time
 - **Summary job and service refactored** — Cleaner separation between job scheduling and summary calculation logic
 - **Cleanup job refactored** — Now uses `CleanupTaskRunner` and reports statistics via `CleanupStatsReporter`
 - **Configuration expanded** — New configuration options exposed in the initializer template
-- **Upgrade generator simplified** — Generator now delegates to `MigrationInstaller` and `ConfigInstaller`
+- **Upgrade generator simplified** — Now delegates to `MigrationInstaller` and `ConfigInstaller`
 - **Asset server middleware updated** — Improved asset serving reliability
 - **Request collector middleware updated** — Performance improvements and cleaner instrumentation
 - **Operation subscriber refactored** — Cleaner event handling and reduced complexity
@@ -269,10 +214,9 @@ releases will be smaller and more incremental than this one.
 
 - `StatusHelper` removed — status rendering consolidated into model concerns and view components
 - `ChartFormatters` helper removed — chart formatting moved into chart model classes
-- `chart_formatters_test.rb` removed alongside the helper
 - Slow queries and slow routes table models removed — replaced by the Needs Attention system
 - Unused `average_response_time` and `p95_response_time` dashboard chart classes removed
-- `requests/tables/index.rb` and related test removed — requests index now uses a shared approach
+- `requests/tables/index.rb` removed — requests index now uses a shared approach
 - `routes/cards/average_response_times` and `routes/charts/average_response_times` removed — replaced by percentile-based equivalents
 - `jobs/cards/average_duration` and `jobs/cards/total_jobs` removed — replaced by updated cards
 - Timezone controller removed