railwatch 0.4.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e3cbe26df2ef93b1488b1cfb67d2cb15bb9c2930f63607651af4e5a9d4f526cb
-  data.tar.gz: b62edbbb492f16ef449e4bc7ccc57ad90206f67c0e538c24232b30d931290339
+  metadata.gz: 538efe4f9ba268dd88e694a7052542638a86d64f34978bffd45e5edb9e71dd18
+  data.tar.gz: 3f5d5b22228381e4f9d6657544c44fb3e337c754c9b7a9d683dada967d1592af
 SHA512:
-  metadata.gz: dc2578bf58e017c5f311d9642c9b51f52c7c203a84328d8bbe7845568c0836afe5bc7cbec5327aa286cd9e4bb378e930111cedce72b27337f2608e36a6305484
-  data.tar.gz: 2e4f1467282564b4ef5d6d3f1446acb80f6cbfdf116588df899bb5a0cb3172330b817282d7d797d29d0cced2b7ab6aa1688d6fa266324d1634fcdafbb3cfe0df
+  metadata.gz: 923dc66f9d7e94815affc41d5d0df65db1891a6e46b9462ab6dd2931989f60786149fe70142de5f451a1b1d3ff13a8c551fb8b2487b8bd93aade6e95d0ce3600
+  data.tar.gz: 5f1fc6b7a9e2afade92562883b6467b1ace633c1dcd85ef2d6cde7c6b72f53328922f6e4c7e8c47eb596af2662dcb5b4d09103d061dd4a718484d512ff766913

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Changelog
 
+## 0.5.0 (2026-09-21)
+
+The telemetry layer the hosted platform runs is this gem's, not a copy. Everything
+Railwatch Cloud had improved in its fork comes home, and the two seams the platform
+needs are named.
+
+- **Chart bucket widths.** `Telemetry::Aggregations` offers `STEPS` (1m to 1d),
+  `default_step`, and `steps_for` a window; `series` takes a `step:` and reads raw
+  rows with exact per-bucket percentiles under an hour, rollups at an hour and up;
+  `fill` zero-fills quiet buckets. The dashboard shows a step picker beside the
+  window picker, and every series page, release health, tenants, processes, and
+  exceptions draw at the chosen step. Latency lines break over an empty bucket
+  instead of dropping to zero.
+- **One `Window`.** `Railwatch::Window` resolves `?window=` presets and custom
+  `?from=&to=` ranges, with the previous period for deltas; the controller concern
+  reads it instead of carrying the table.
+- **Rollup extras.** `Telemetry::Rollup.summarize` merges each type's `extra`
+  (LLM spend and tokens, cache hits and misses) the way `absorb!` does.
+- **LLM thresholds and anomaly rules.** `spend`, `tokens`, and `truncation_rate`
+  metrics on `llm_calls` and `llm_tools`; the form narrows metrics by kind and
+  shows the unit; `Threshold#format_value` prints dollars and percentages.
+- **`as_row`** on Execution, Log, Exception, and Query: the one row shape every
+  list surface shows. The commands page reads the exit code from `status`.
+- `Railwatch::TelemetryRecord` documents that the hosted platform tenants it, and
+  `docs/embedded.md` says what the platform is in terms of this engine.
+
 ## 0.4.0 (2026-09-21)
 
 The gem is the one author of what goes over the wire and what runs in the

data/app/controllers/railwatch/commands_controller.rb

@@ -5,7 +5,7 @@ module Railwatch
     def index
       rows = telemetry { Telemetry::Execution.commands.between(*window_range).recent.limit(200).to_a }
       render inertia: { commands: grouped("command", limit: 100),
-                        runs: rows.map { |r| { execution_id: r.execution_id, name: r.name, exit_code: r.status, duration: r.duration_ms.round(1), occurred_at: r.occurred_at, server: r.server, exception_preview: r.exception_preview } } }
+                        runs: rows.map(&:as_row) }
     end
 
     def show

data/app/controllers/railwatch/environment_scoped.rb

@@ -6,14 +6,13 @@ module Railwatch
   module EnvironmentScoped
     extend ActiveSupport::Concern
 
-    WINDOWS = { "1h" => 1.hour, "6h" => 6.hours, "24h" => 24.hours, "7d" => 7.days, "30d" => 30.days }.freeze
-    MAX_CUSTOM_RANGE = 90.days
-
     included do
       before_action :set_environment
       inertia_share environment: -> { environment_props }
-      inertia_share window: -> { window_key }
-      inertia_share range: -> { from, to = window_range; { from: from.iso8601(6), to: to.iso8601(6) } }
+      inertia_share window: -> { window.key }
+      inertia_share range: -> { window.to_h }
+      inertia_share step: -> { step_key }
+      inertia_share steps: -> { Telemetry::Aggregations.steps_for(*window_range) }
       inertia_share saved_views: -> { SavedView.props_for(environment, Viewer.user) }
     end
 
@@ -25,38 +24,19 @@ module Railwatch
       @environment = Environment.find(params[:environment_id] || Environment::ID)
     end
 
-    def window_key
-      custom_range ? "custom" : (WINDOWS.key?(params[:window].to_s) ? params[:window].to_s : "24h")
-    end
-
-    def window_range
-      return @window_range if defined?(@window_range)
-      @window_range = custom_range || begin
-        key = WINDOWS.key?(params[:window].to_s) ? params[:window].to_s : "24h"
-        to = Time.current
-        [ to - WINDOWS[key], to ]
-      end
+    def window
+      @window ||= Window.parse(window: params[:window], from: params[:from], to: params[:to])
     end
 
-    def custom_range
-      return @custom_range if defined?(@custom_range)
-      from = parse_time(params[:from])
-      to = from && (parse_time(params[:to]) || Time.current)
-      valid = from && to && to > from && (to - from) <= MAX_CUSTOM_RANGE
-      @custom_range = valid ? [ from, to ] : nil
-    end
-
-    def parse_time(value)
-      return nil if value.blank?
-      Time.zone.parse(value.to_s)
-    rescue ArgumentError, TypeError
-      nil
-    end
+    def window_range = window.range
 
-    def previous_window_range
+    # The chart bucket width: ?step= when it is one the window offers, else the
+    # window's default (a minute for an hour, an hour for a day, and so on).
+    def step_key
+      return @step_key if defined?(@step_key)
       from, to = window_range
-      span = to - from
-      [ from - span, from ]
+      offered = Telemetry::Aggregations.steps_for(from, to)
+      @step_key = offered.include?(params[:step].to_s) ? params[:step].to_s : Telemetry::Aggregations.default_step(from, to)
     end
 
     def telemetry(&block) = environment.with_telemetry(&block)
@@ -79,9 +59,11 @@ module Railwatch
       environment.deploys.between(*window_range).recent.limit(50).map { |d| { deploy: d.deploy, ref: d.short_ref, at: d.deployed_at } }
     end
 
-    def series(record_type, group_hash: nil, name: nil)
+    # Time-bucketed series for charts, one point per step_key across the
+    # window: [{t, count, errors, client_errors, avg, p50, p95, p99}]
+    def series(record_type, group_hash: nil)
       from, to = window_range
-      Telemetry::Aggregations.series(environment, record_type, from: from, to: to, group_hash: group_hash, name: name)
+      Telemetry::Aggregations.series(environment, record_type, from: from, to: to, group_hash: group_hash, step: step_key)
     end
 
     def grouped(record_type, limit: 100, order: nil, dir: nil)
@@ -91,7 +73,7 @@ module Railwatch
 
     def summary_with_delta(record_type, group_hash: nil)
       from, to = window_range
-      previous_from, previous_to = previous_window_range
+      previous_from, previous_to = window.previous.range
       Telemetry::Aggregations.summary_with_delta(environment, record_type, from: from, to: to,
                                                   previous_from: previous_from, previous_to: previous_to, group_hash: group_hash)
     end

data/app/controllers/railwatch/exceptions_controller.rb

@@ -38,16 +38,15 @@ module Railwatch
     # `errors` carries the unhandled count so the chart legend (handled /
     # unhandled) agrees with the Unhandled card above the table.
     def exception_series(from, to)
+      step = Telemetry::Aggregations::STEPS.fetch(step_key)
+      bucket = Telemetry::Aggregations.bucket_sql("occurred_at", step)
       buckets = Hash.new { |h, k| h[k] = { count: 0, errors: 0 } }
-      Telemetry::Exception.between(from, to)
-        .group(Arel.sql("strftime('%Y-%m-%dT%H:00:00Z', occurred_at)"), :handled)
-        .count
-        .each do |(bucket, handled), c|
-          buckets[bucket][:count] += c
-          buckets[bucket][:errors] += c unless handled
-        end
-      buckets.map { |bucket, b| { t: bucket, count: b[:count], errors: b[:errors], client_errors: 0, avg: 0, p50: 0, p95: 0, p99: 0 } }
-        .sort_by { |r| r[:t] }
+      Telemetry::Exception.between(from, to).group(bucket, :handled).count.each do |(b, handled), c|
+        buckets[b][:count] += c
+        buckets[b][:errors] += c unless handled
+      end
+      points = buckets.map { |b, c| { t: Time.at(b).utc, count: c[:count], errors: c[:errors], client_errors: 0, avg: nil, p50: nil, p95: nil, p99: nil } }
+      Telemetry::Aggregations.fill(points, from, to, step)
     end
     end
 end

data/app/controllers/railwatch/processes_controller.rb

@@ -6,7 +6,7 @@ module Railwatch
       live_since = Telemetry::HealthSample::LIVE_WINDOW.ago
       samples, series, queues, live_servers, processes = telemetry do
         live = Telemetry::HealthSample.live(live_since).to_a
-        [ live, Telemetry::HealthSample.series(*window_range), Telemetry::HealthSample.queue_depths(live),
+        [ live, Telemetry::HealthSample.series(*window_range, bucket: Telemetry::Aggregations::STEPS.fetch(step_key)), Telemetry::HealthSample.queue_depths(live),
           live.map(&:server) | Telemetry::Execution.servers_since(live_since),
           Telemetry::Process.recent.limit(200).to_a ]
       end

data/app/controllers/railwatch/releases_controller.rb

@@ -17,7 +17,7 @@ module Railwatch
       new_issues = new_issue_counts(deploys, to)
       summary, series, adoption, health = telemetry do
         [ Telemetry::ReleaseHealth.for_deploy(nil, from, to),
-          Telemetry::ReleaseHealth.series(nil, from, to),
+          Telemetry::ReleaseHealth.series(nil, from, to, step: step_key),
           Telemetry::ReleaseHealth.adoption(from, to),
           deploys.to_h { |d| [ d.deploy, Telemetry::ReleaseHealth.for_deploy(d.deploy, from, to) ] } ]
       end
@@ -37,7 +37,7 @@ module Railwatch
       data = telemetry do
         { summary: Telemetry::ReleaseHealth.for_deploy(release, from, to),
           previous_summary: previous && Telemetry::ReleaseHealth.for_deploy(previous.deploy, *previous.window),
-          series: Telemetry::ReleaseHealth.series(release, from, to),
+          series: Telemetry::ReleaseHealth.series(release, from, to, step: step_key),
           sessions: Telemetry::Session.where(deploy: release).recent.limit(SESSIONS_SHOWN).map { |s| session_row(s) } }
       end
       render inertia: data.merge(

data/app/controllers/railwatch/tenants_controller.rb

@@ -20,8 +20,8 @@ module Railwatch
       from, to = window_range
       data = telemetry do
         { tenant: tenant, summary: { current: Telemetry::Tenant.summary(tenant, from, to),
-                                    previous: Telemetry::Tenant.summary(tenant, *previous_window_range) },
-          series: Telemetry::Tenant.series(tenant, from, to), routes: Telemetry::Tenant.routes(tenant, from, to),
+                                    previous: Telemetry::Tenant.summary(tenant, *window.previous.range) },
+          series: Telemetry::Tenant.series(tenant, from, to, step: step_key), routes: Telemetry::Tenant.routes(tenant, from, to),
           jobs: Telemetry::Tenant.job_classes(tenant, from, to), exceptions: Telemetry::Tenant.exceptions(tenant, from, to),
           people: Telemetry::Tenant.people(tenant), recent_requests: Telemetry::Tenant.recent_requests(tenant, from, to) }
       end

data/app/controllers/railwatch/thresholds_controller.rb

@@ -8,7 +8,14 @@ module Railwatch
                         jobs: telemetry { Telemetry::Rollup.for_type("job_attempt").where("bucket > ?", 7.days.ago).distinct.pluck(:name).sort },
                         kinds: Threshold::TARGET_KINDS, metrics: Threshold::METRICS,
                         anomaly_rules: environment.anomaly_rules.order(:target_kind, :target).map { |r| r.slice(:id, :target_kind, :target, :metric, :deviation, :window_minutes, :baseline_days, :enabled, :last_fired_at).merge(description: r.description) },
-                        anomaly_target_kinds: AnomalyRule::TARGET_KINDS, anomaly_metrics: AnomalyRule::METRICS }
+                        # Spend and tokens only exist on llm_calls, so the form
+                        # narrows with the kind rather than offering a rule that
+                        # could never fire.
+                        metrics_for_kind: Threshold::TARGET_KINDS.index_with { |k| Threshold.metrics_for(k) },
+                        units: Threshold::UNITS,
+                        llm_models: telemetry { Telemetry::Rollup.for_type("llm_call").where("bucket > ?", 7.days.ago).distinct.pluck(:name).compact.sort },
+                        anomaly_target_kinds: AnomalyRule::TARGET_KINDS, anomaly_metrics: AnomalyRule::METRICS,
+                        anomaly_metrics_for_kind: AnomalyRule::TARGET_KINDS.index_with { |k| AnomalyRule.metrics_for(k) } }
     end
 
     def create

data/app/jobs/railwatch/detect_performance_issues_job.rb

@@ -12,7 +12,8 @@ module Railwatch
     MAX_ROLLUP_ROWS_PER_RULE = MAX_GROUPS_PER_RULE * 25
 
     TYPE_FOR = { "requests" => "request", "jobs" => "job_attempt", "commands" => "command", "queries" => "query",
-                 "scheduled_tasks" => "scheduled_task", "outgoing_requests" => "outgoing_request" }.freeze
+                 "scheduled_tasks" => "scheduled_task", "outgoing_requests" => "outgoing_request",
+                 "llm_calls" => "llm_call", "llm_tools" => "llm_tool" }.freeze
 
     def perform(environment)
       now = Time.current
@@ -51,19 +52,28 @@ module Railwatch
           .transform_values { |group_rows| [ group_rows.first.name, Telemetry::Rollup.summarize(group_rows) ] }
     end
 
+    NANOS_PER_DOLLAR = 1_000_000_000.0
+
     def value_for(metric, s)
+      extra = s[:extra] || {}
       case metric
       when "p95" then s[:p95] / 1000.0
       when "max" then s[:max] / 1000.0
       when "avg" then s[:avg] / 1000.0
       when "error_rate", "failure_rate" then s[:count].zero? ? nil : (s[:errors] * 100.0 / s[:count])
+      # Money and tokens are sums over the window, not percentiles of it.
+      when "spend" then extra["cost_nanos"].to_i / NANOS_PER_DOLLAR
+      when "tokens" then extra["input_tokens"].to_i + extra["output_tokens"].to_i
+      # A cut-off answer is a successful call, so it is invisible to
+      # error_rate. This is the only way to be told about it.
+      when "truncation_rate" then s[:count].zero? ? nil : (extra["truncated"].to_i * 100.0 / s[:count])
       end
     end
 
     def open_issue(environment, threshold, group_hash, name, value, from, now)
       issue, outcome = Issue.record_occurrence!(
         environment: environment, group_hash: "perf:#{threshold.id}:#{group_hash}", kind: "performance",
-        title: "#{name} exceeded #{threshold.metric} #{threshold.limit}#{threshold.metric.end_with?('rate') ? '%' : 'ms'} (#{value.round(1)})",
+        title: "#{name} exceeded #{threshold.metric} #{threshold.format_value(threshold.limit)} (#{threshold.format_value(value.round(2))})",
         culprit: name, occurred_at: now, deploy: nil, user_ref: nil,
         sample: { threshold_id: threshold.id, value: value.round(2), metric: threshold.metric, limit: threshold.limit })
       carry_detection(issue, outcome) do

data/app/models/railwatch/anomaly_rule.rb

@@ -10,13 +10,22 @@ module Railwatch
     MAX_BASELINE_DAYS = 30
     MAX_DEVIATION = 10
     MAX_WINDOW_MINUTES = 1_440
-    TARGET_KINDS = %w[requests jobs queries outgoing_requests scheduled_tasks].freeze
-    METRICS = %w[p95 avg count error_rate].freeze
+    TARGET_KINDS = %w[requests jobs queries outgoing_requests scheduled_tasks llm_calls].freeze
+    # spend included because "we are spending well above baseline for this
+    # hour of the week" is the LLM alert that needs no threshold picked.
+    METRICS = %w[p95 avg count error_rate spend].freeze
+    SHARED_METRICS = %w[p95 avg count error_rate].freeze
+    LLM_METRICS = %w[spend].freeze
+
+    def self.metrics_for(target_kind)
+      target_kind == "llm_calls" ? SHARED_METRICS + LLM_METRICS : SHARED_METRICS
+    end
 
     def environment = Environment.current
 
     validates :target_kind, inclusion: { in: TARGET_KINDS }
     validates :metric, inclusion: { in: METRICS }
+    validate :metric_applies_to_target_kind
     validates :target, presence: true, length: { maximum: 256 }
     validates :deviation, numericality: { greater_than: 0, less_than_or_equal_to: MAX_DEVIATION }
     validates :window_minutes, numericality: { only_integer: true, greater_than: 0,
@@ -29,5 +38,14 @@ module Railwatch
     def description
       "#{target_kind} #{target == '*' ? 'all' : target}: #{metric} > #{deviation}σ above #{baseline_days}-day baseline"
     end
+
+    private
+
+    def metric_applies_to_target_kind
+      return if metric.blank? || target_kind.blank?
+      return if AnomalyRule.metrics_for(target_kind).include?(metric)
+
+      errors.add(:metric, "is not available for #{target_kind}")
+    end
   end
 end

data/app/models/railwatch/telemetry/aggregations.rb

@@ -9,18 +9,154 @@ module Railwatch
     class Aggregations
       GROUPED_SORT_FIELDS = %i[count p50 p95 p99 errors avg max].freeze
 
-      # Time-bucketed series from rollups for charts: [{t, count, errors, p50, p95, p99}]
-      def self.series(environment, record_type, from:, to:, group_hash: nil, name: nil)
-        environment.with_telemetry do
-          scope = Telemetry::Rollup.for_type(record_type).between(from, to)
-          scope = scope.where(group_hash: group_hash) if group_hash
-          scope = scope.where(name: name) if name
-          scope.group(:bucket).order(:bucket)
-               .pluck(:bucket, Arel.sql("SUM(count)"), Arel.sql("SUM(error_count)"), Arel.sql("SUM(client_error_count)"), Arel.sql("SUM(duration_sum)"), Arel.sql("MAX(p50)"), Arel.sql("MAX(p95)"), Arel.sql("MAX(p99)"))
-               .map { |b, c, e, ce, ds, p50, p95, p99| { t: b, count: c, errors: e, client_errors: ce, avg: c.zero? ? 0 : ds / c / 1000.0, p50: p50 / 1000.0, p95: p95 / 1000.0, p99: p99 / 1000.0 } }
+      # Bucket widths a chart can be drawn at. Anything under an hour is read
+      # from the raw tables (rollups are hourly); an hour and up groups rollups.
+      STEPS = { "1m" => 1.minute, "5m" => 5.minutes, "15m" => 15.minutes, "1h" => 1.hour, "6h" => 6.hours, "1d" => 1.day }.freeze
+      # A step is offered for a window when it draws at least two points and at
+      # most this many: more bars than pixels is mush, and a sub-hour step over
+      # a long window is also a long raw scan.
+      MAX_POINTS = 400
+
+      # The bucket a window is drawn at unless the page asks for another one.
+      # Sub-hour steps scan raw rows, so they are the default only where that
+      # scan is a few thousand rows; a day and beyond stays on rollups.
+      def self.default_step(from, to)
+        span = to - from
+        if span <= 2.hours then "1m"
+        elsif span <= 12.hours then "5m"
+        elsif span <= 7.days then "1h"
+        else "6h"
+        end
+      end
+
+      # STEPS keys that make sense for the window, finest first.
+      def self.steps_for(from, to)
+        span = to - from
+        STEPS.select { |_key, step| (span / step).between?(2, MAX_POINTS) }.keys
+      end
+
+      # Time-bucketed series for charts, one point per `step` from `from` to `to`
+      # with empty buckets filled in: [{t, count, errors, client_errors, avg,
+      # p50, p95, p99}]. Durations in milliseconds; an empty bucket carries nil
+      # for them so a latency line breaks instead of dropping to zero.
+      def self.series(environment, record_type, from:, to:, group_hash: nil, step: nil, tenant: nil)
+        environment.with_telemetry { points(record_type, from: from, to: to, group_hash: group_hash, step: step, tenant: tenant) }
+      end
+
+      # `series` for a caller already inside environment.with_telemetry. A
+      # tenant narrows to one app_tenant, which rollups do not carry, so a
+      # tenant series reads raw rows at every step.
+      def self.points(record_type, from:, to:, group_hash: nil, step: nil, tenant: nil)
+        step = STEPS.fetch(step || default_step(from, to))
+        raw = step < 1.hour || tenant
+        points = raw ? raw_series(record_type, from, to, group_hash, step, tenant) : rollup_series(record_type, from, to, group_hash, step)
+        fill(points, from, to, step)
+      end
+
+      # Sums hourly rollups into `step`-wide buckets. Percentiles are the
+      # worst hour's, the same reading series always gave across groups.
+      def self.rollup_series(record_type, from, to, group_hash, step)
+        bucket = bucket_sql("bucket", step)
+        scope = Telemetry::Rollup.for_type(record_type).between(from, to)
+        scope = scope.where(group_hash: group_hash) if group_hash
+        scope.group(bucket).order(bucket)
+             .pluck(bucket, Arel.sql("SUM(count)"), Arel.sql("SUM(error_count)"), Arel.sql("SUM(client_error_count)"), Arel.sql("SUM(duration_sum)"), Arel.sql("MAX(p50)"), Arel.sql("MAX(p95)"), Arel.sql("MAX(p99)"))
+             .map { |b, c, e, ce, ds, p50, p95, p99| point(b, c, e, ce, ds, p50, p95, p99) }
+      end
+
+      # What a raw row of each record type is, and when it counts as an error
+      # (or a client error), mirroring RollupJob#error?. Both readings of the
+      # same rows must agree, which spec/models/telemetry/aggregations_spec.rb
+      # checks for every type.
+      RAW = {
+        "request" => [ -> { Telemetry::Execution.requests }, "status >= 500", "status BETWEEN 400 AND 499" ],
+        "job_attempt" => [ -> { Telemetry::Execution.jobs }, "outcome = 'failed'" ],
+        "scheduled_task" => [ -> { Telemetry::Execution.scheduled }, "outcome = 'failed'" ],
+        "command" => [ -> { Telemetry::Execution.commands }, "status != 0" ],
+        "channel_action" => [ -> { Telemetry::Execution.channels }, "outcome = 'failed'" ],
+        "query" => [ -> { Telemetry::Query.all } ],
+        "outgoing_request" => [ -> { Telemetry::OutgoingRequest.all }, "status_code >= 500 OR status_code IS NULL OR status_code = 0" ],
+        "cache_event" => [ -> { Telemetry::CacheEvent.all } ],
+        "mail" => [ -> { Telemetry::Mail.all }, "failed" ],
+        "visit" => [ -> { Telemetry::Visit.all }, "status = 'error'" ],
+        "span" => [ -> { Telemetry::Span.all }, "status = 'failed'" ],
+        "notification" => [ -> { Telemetry::Notification.all }, "failed" ],
+        "view_render" => [ -> { Telemetry::ViewRender.all } ],
+        "transaction" => [ -> { Telemetry::Transaction.all }, "outcome = 'rollback'" ],
+        "llm_call" => [ -> { Telemetry::LlmCall.models }, "status = 'failed'" ],
+        "llm_tool" => [ -> { Telemetry::LlmCall.tools }, "status = 'failed'" ]
+      }.freeze
+
+      # Sub-hour buckets straight from the raw rows, in one statement:
+      # counts and sums per bucket, and exact nearest-rank percentiles from a
+      # ROW_NUMBER over each bucket's durations. Rollups are hourly, so this
+      # is the only reading finer than an hour; it is also the freshest one,
+      # since the current hour's rollup is up to a minute behind.
+      def self.raw_series(record_type, from, to, group_hash, step, tenant = nil)
+        scope, error_sql, client_error_sql = RAW.fetch(record_type)
+        rows = scope.call.where(occurred_at: from..to)
+        rows = rows.where(group_hash: group_hash) if group_hash
+        rows = rows.where(app_tenant: tenant) if tenant
+        model = rows.model
+        inner = rows.select(bucket_sql("occurred_at", step).to_s + " AS b", "duration", flag_sql(error_sql) + " AS err", flag_sql(client_error_sql) + " AS cerr")
+        ranked = model.unscoped.from(inner, "r").select("b", "duration", "err", "cerr",
+          "ROW_NUMBER() OVER (PARTITION BY b ORDER BY duration) AS rn", "COUNT(*) OVER (PARTITION BY b) AS n")
+        model.unscoped.from(ranked, "w").group("b").order("b")
+          .pluck(Arel.sql("b"), Arel.sql("COUNT(*)"), Arel.sql("SUM(err)"), Arel.sql("SUM(cerr)"), Arel.sql("SUM(duration)"),
+                 rank_sql(50), rank_sql(95), rank_sql(99))
+          .map { |b, c, e, ce, ds, p50, p95, p99| point(b, c, e, ce, ds, p50, p95, p99) }
+      end
+
+      # The timestamp columns a series buckets on: raw rows by occurred_at,
+      # rollups and release health by their hourly bucket.
+      BUCKET_COLUMNS = %w[occurred_at bucket].freeze
+
+      # Epoch seconds of the start of the `step`-wide bucket holding `column`.
+      # `column` must be one of BUCKET_COLUMNS and `step` is a Duration, so the
+      # fragment can only ever hold a listed column name and an integer literal.
+      def self.bucket_sql(column, step)
+        raise ArgumentError, "unknown bucket column #{column.inspect}" unless BUCKET_COLUMNS.include?(column)
+        seconds = Integer(step.to_i)
+        Arel.sql("(strftime('%s', #{column}) / #{seconds}) * #{seconds}")
+      end
+
+      # One point per bucket from `from` to `to`, keeping the computed ones and
+      # zero-filling the rest, so a quiet minute is a gap of the right width.
+      # A series with its own point shape passes a block building its empty one.
+      def self.fill(points, from, to, step)
+        by_bucket = points.index_by { |p| p[:t] }
+        first = Time.at((from.to_i / step.to_i) * step.to_i).utc
+        last = Time.at((to.to_i / step.to_i) * step.to_i).utc
+        (first.to_i..last.to_i).step(step.to_i).map do |t|
+          at = Time.at(t).utc
+          by_bucket[at] || (block_given? ? yield(at) : empty_point(at))
         end
       end
 
+      def self.point(bucket, count, errors, client_errors, duration_sum, p50, p95, p99)
+        { t: Time.at(bucket).utc, count: count, errors: errors, client_errors: client_errors,
+         avg: count.zero? ? 0 : duration_sum / count / 1000.0, p50: p50 / 1000.0, p95: p95 / 1000.0, p99: p99 / 1000.0 }
+      end
+
+      def self.empty_point(t)
+        { t: t, count: 0, errors: 0, client_errors: 0, avg: nil, p50: nil, p95: nil, p99: nil }
+      end
+
+      def self.flag_sql(predicate)
+        predicate ? "CASE WHEN #{predicate} THEN 1 ELSE 0 END" : "0"
+      end
+
+      # The nearest-rank percentile: the duration whose rank is ceil(n * p/100).
+      RANK_SQL = { 50 => Arel.sql("MAX(CASE WHEN rn = (n * 50 + 99) / 100 THEN duration END)"),
+                  95 => Arel.sql("MAX(CASE WHEN rn = (n * 95 + 99) / 100 THEN duration END)"),
+                  99 => Arel.sql("MAX(CASE WHEN rn = (n * 99 + 99) / 100 THEN duration END)") }.freeze
+
+      def self.rank_sql(percent)
+        RANK_SQL.fetch(percent)
+      end
+
+      private_class_method :rollup_series, :raw_series, :point, :empty_point, :flag_sql, :rank_sql
+
       # Per-group table rows for a record type in the window: count/error totals,
       # merged percentiles (via Telemetry::Rollup.summarize), and a sparkline.
       def self.grouped(environment, record_type, from:, to:, limit: 100, order: nil, dir: nil)
@@ -34,6 +170,15 @@ module Railwatch
         cached(key) { grouped_uncached(environment, record_type, from: from, to: to, limit: limit, order: order, sign: sign) }
       end
 
+      # The minute cache exists because the platform's rollups only change
+      # when RollupJob writes. Embedded, every batch updates them and one
+      # person is looking, so the cache would only make the page a minute
+      # stale for nothing.
+      def self.cached(key, &block)
+        return yield if Railwatch.config.local?
+        Rails.cache.fetch(key, expires_in: 1.minute, &block)
+      end
+
       def self.grouped_uncached(environment, record_type, from:, to:, limit:, order:, sign:)
         environment.with_telemetry do
           rows = Telemetry::Rollup.for_type(record_type).between(from, to).to_a
@@ -60,16 +205,6 @@ module Railwatch
         end
       end
 
-      # The minute cache exists because the platform's rollups only change
-      # when RollupJob writes. Embedded, every batch updates them and one
-      # person is looking, so the cache would only make the page a minute
-      # stale for nothing.
-      def self.cached(key, &block)
-        return yield if Railwatch.config.local?
-
-        Rails.cache.fetch(key, expires_in: 1.minute, &block)
-      end
-
       # The digest-free half of Rollup.summarize: everything the sort keys
       # that are not percentiles need.
       def self.cheap_summary(rows)

data/app/models/railwatch/telemetry/exception.rb

@@ -9,6 +9,13 @@ module Railwatch
 
       scope :unhandled, -> { where(handled: false) }
 
+      def as_row
+        { id: id, class_name: class_name, message: message.first(500), handled: handled, severity: severity, source: source,
+          file: file, line: line, occurred_at: occurred_at, deploy: deploy, execution_id: execution_id,
+          execution_source: execution_source, execution_preview: execution_preview, user_ref: user_ref, tenant: app_tenant,
+          group_hash: group_hash }
+      end
+
       def timeline_label
         "#{class_name}: #{message.to_s.first(100)}"
       end

data/app/models/railwatch/telemetry/execution.rb

@@ -63,6 +63,24 @@ module Railwatch
         duration / 1000.0
       end
 
+      def queue_latency_ms
+        queue_latency && (queue_latency / 1000.0).round(1)
+      end
+
+      # The row every list surface shows for an execution: what the kind has
+      # in common, then what it adds.
+      def as_row
+        row = { execution_id: execution_id, kind: kind, name: name, status: status, outcome: outcome, duration: duration_ms.round(2),
+                occurred_at: occurred_at, deploy: deploy, server: server, user_ref: user_ref, tenant: app_tenant,
+                exception_preview: exception_preview }
+        case kind
+        when "request" then row.merge(method: self[:method], inertia_component: inertia_component, queries: counters["queries"])
+        when "job_attempt" then row.merge(queue: queue, attempt: attempt, job_id: job_id, queue_latency: queue_latency_ms)
+        when "scheduled_task" then row.merge(task_key: task_key)
+        else row
+        end
+      end
+
       def children_count
         counters.values.sum
       end

data/app/models/railwatch/telemetry/log.rb

@@ -77,6 +77,12 @@ module Railwatch
         def quote(term) = %("#{term.gsub('"', '""')}")
       end
 
+      def as_row
+        { id: id, level: level, message: message.first(2000), tags: tags, occurred_at: occurred_at, deploy: deploy,
+          execution_id: execution_id, execution_source: execution_source, execution_preview: execution_preview,
+          source: source, tenant: app_tenant, user_ref: user_ref, context: context }
+      end
+
       def timeline_label
         message.to_s.first(120)
       end

data/app/models/railwatch/telemetry/query.rb

@@ -42,6 +42,13 @@ module Railwatch
         text
       end
 
+      def as_row
+        { id: id, group_hash: group_hash, sql: sql.first(2_000), name: name, duration: duration_ms.round(3), occurred_at: occurred_at,
+          deploy: deploy, execution_id: execution_id, execution_preview: execution_preview, source: source,
+          connection: connection, role: role, adapter: adapter, row_count: row_count, tenant: app_tenant, user_ref: user_ref,
+          explain: explain.present? }
+      end
+
       def timeline_label
         sql.to_s.first(120)
       end

data/app/models/railwatch/telemetry/release_health.rb

@@ -36,13 +36,19 @@ module Railwatch
         }
       end
 
-      # Hourly points for the stacked sessions-by-status chart.
-      def self.series(deploy, from, to)
-        between(from, to).for_release(deploy).group(:bucket).order(:bucket)
-          .pluck(:bucket, Arel.sql("SUM(sessions)"), Arel.sql("SUM(sessions_errored)"), Arel.sql("SUM(sessions_crashed)"))
-          .map { |bucket, sessions, errored, crashed|
-            { t: bucket, sessions: sessions, ok: sessions - errored - crashed, errored: errored, crashed: crashed }
+      # Points for the stacked sessions-by-status chart, one per `step` across
+      # the window. The table is hourly and a session is counted once per hour
+      # it was seen, so a step under an hour is drawn at an hour: raw session
+      # rows would count a live session on every flush.
+      def self.series(deploy, from, to, step: nil)
+        step = [ Telemetry::Aggregations::STEPS.fetch(step || Telemetry::Aggregations.default_step(from, to)), 1.hour ].max
+        bucket = Telemetry::Aggregations.bucket_sql("bucket", step)
+        points = between(from, to).for_release(deploy).group(bucket).order(bucket)
+          .pluck(bucket, Arel.sql("SUM(sessions)"), Arel.sql("SUM(sessions_errored)"), Arel.sql("SUM(sessions_crashed)"))
+          .map { |b, sessions, errored, crashed|
+            { t: Time.at(b).utc, sessions: sessions, ok: sessions - errored - crashed, errored: errored, crashed: crashed }
           }
+        Telemetry::Aggregations.fill(points, from, to, step) { |t| { t: t, sessions: 0, ok: 0, errored: 0, crashed: 0 } }
       end
 
       # Each release's share of the window's sessions, as a percentage -- how

data/app/models/railwatch/telemetry/rollup.rb

@@ -54,7 +54,7 @@ module Railwatch
       # Aggregate a relation of rollups into one summary with merged percentiles.
       def self.summarize(relation)
         rows = relation.to_a
-        return { count: 0, errors: 0, client_errors: 0, avg: 0, p50: 0, p95: 0, p99: 0, max: 0 } if rows.empty?
+        return { count: 0, errors: 0, client_errors: 0, avg: 0, p50: 0, p95: 0, p99: 0, max: 0, extra: {} } if rows.empty?
         # merge! pushes the row's centroids into one accumulating digest.
         # `+` built a brand-new digest from both operands' centroids on every
         # row, so merging N rows re-pushed every earlier centroid N times:
@@ -70,9 +70,24 @@ module Railwatch
           p50: merged.percentile(0.5).to_i,
           p95: merged.percentile(0.95).to_i,
           p99: merged.percentile(0.99).to_i,
-          max: rows.map(&:duration_max).max
+          max: rows.map(&:duration_max).max,
+          # Everything a type puts in `extra` -- llm_call's cost_nanos and
+          # token counts, cache_event's hits and misses -- merged the way
+          # absorb! merges it: numbers add up, anything else is last-wins.
+          # Spend is a sum over a window rather than a percentile of
+          # durations, so a rule about money has nowhere else to read from.
+          extra: merge_extras(rows)
         }
       end
+
+      def self.merge_extras(rows)
+        rows.each_with_object({}) do |row, out|
+          row.extra.each do |key, value|
+            existing = out[key]
+            out[key] = existing.is_a?(Numeric) && value.is_a?(Numeric) ? existing + value : value
+          end
+        end
+      end
     end
   end
 end