railwatch 0.9.3 → 1.0.0

data/app/models/railwatch/alert.rb

@@ -1,229 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  class Alert < ApplicationRecord
-    self.table_name = "railwatch_alerts"
-    MAX_DELIVERY_ATTEMPTS = 5
-    DELIVERY_LEASE = 5.minutes
-    ENQUEUE_LEASE = 5.minutes
-    RETRY_DELAYS = [ 1.minute, 5.minutes, 15.minutes, 1.hour ].freeze
-
-    # An alert is always addressed to an integration; the rule is only why it
-    # fired, and a "Send test" delivery has no rule behind it at all.
-    # No integrations in an embedded install yet: alerts are recorded, not delivered.
-    def integration = nil
-
-    def integration=(_)
-      nil
-    end
-    belongs_to :alert_rule, optional: true
-    belongs_to :issue, optional: true
-    belongs_to :summary_alert, class_name: "Alert", optional: true
-    has_many :summarized_alerts, class_name: "Alert", foreign_key: :summary_alert_id,
-      dependent: :nullify, inverse_of: :summary_alert
-
-    # `delivering` is a leased claim. A process that disappears while holding
-    # one is recovered by ReconcileAlertDeliveriesJob after DELIVERY_LEASE.
-    STATUSES = %w[pending delivering sent failed skipped collapsed summarized].freeze
-    TERMINAL_STATUSES = %w[sent failed skipped summarized].freeze
-
-    attr_accessor :suppress_auto_enqueue
-
-    before_validation :inherit_integration, on: :create
-    before_validation :assign_delivery_metadata, on: :create
-    after_create_commit :enqueue_initial_work, unless: :suppress_auto_enqueue
-
-    # How far back reconciliation looks. An alert older than this that is
-    # still pending or collapsed predates the outbox (a row an old container
-    # wrote, or one left over from before this shipped); delivering it now
-    # would page someone about something that happened hours ago.
-    RECONCILE_WINDOW = 1.hour
-
-    scope :due_for_delivery, ->(now = Time.current) {
-      where(status: "pending").where(created_at: (now - RECONCILE_WINDOW)..)
-        .where("next_delivery_at IS NULL OR next_delivery_at <= ?", now)
-        .where("delivery_enqueued_until IS NULL OR delivery_enqueued_until <= ?", now)
-    }
-    scope :with_stale_delivery_lease, ->(now = Time.current) {
-      where(status: "delivering").where("delivery_lease_expires_at <= ?", now)
-    }
-    scope :overdue_collapsed, ->(now = Time.current) {
-      where(status: "collapsed").where(created_at: (now - RECONCILE_WINDOW)..(now - AlertRule::BURST_WINDOW))
-    }
-
-    # Reserve a queue hand-off. If the process dies after this write and before
-    # perform_later, reconciliation retries once this short reservation expires.
-    def enqueue_delivery!(wait_until: nil)
-      reserved_until = nil
-      target = nil
-      with_lock do
-        return false unless status == "pending"
-
-        target = [ wait_until, next_delivery_at, Time.current ].compact.max
-        return false if delivery_enqueued_until&.future?
-
-        reserved_until = target + ENQUEUE_LEASE
-        update!(delivery_enqueued_until: reserved_until)
-      end
-
-      if target.future?
-        DeliverAlertJob.set(wait_until: target).perform_later(self)
-      else
-        DeliverAlertJob.perform_later(self)
-      end
-      true
-    rescue StandardError
-      Alert.where(id: id, status: "pending", delivery_enqueued_until: reserved_until)
-        .update_all(delivery_enqueued_until: nil, updated_at: Time.current) if reserved_until
-      raise
-    end
-
-    # Atomically turns one queued job into the only worker allowed to deliver.
-    # Duplicate jobs and jobs for terminal alerts return nil without I/O.
-    def claim_delivery!
-      with_lock do
-        return unless status == "pending"
-        return if next_delivery_at.present? && next_delivery_at.future?
-
-        token = SecureRandom.uuid
-        update!(status: "delivering", delivery_attempts: delivery_attempts + 1,
-          delivery_key: delivery_key.presence || SecureRandom.uuid,
-          delivery_lease_id: token, delivery_lease_expires_at: DELIVERY_LEASE.from_now,
-          delivery_enqueued_until: nil)
-        token
-      end
-    end
-
-    def perform_claimed_delivery!(token)
-      if integration.enabled?
-        integration.deliver(self)
-        finish_claim!(token, "sent")
-      else
-        finish_claim!(token, "skipped")
-      end
-    end
-
-    # Persists retry intent before another job is scheduled. A crash at the
-    # following queue boundary is recovered by ReconcileAlertDeliveriesJob.
-    def fail_claim!(token, exception)
-      message = "#{exception.class}: #{exception.message}".first(1000)
-      retry_at = nil
-      with_lock do
-        return unless owns_delivery_claim?(token)
-
-        if delivery_attempts >= MAX_DELIVERY_ATTEMPTS
-          update!(status: "failed", error: message, next_delivery_at: nil,
-            delivery_lease_id: nil, delivery_lease_expires_at: nil, delivery_enqueued_until: nil)
-        else
-          retry_at = RETRY_DELAYS.fetch(delivery_attempts - 1).from_now
-          update!(status: "pending", error: message, next_delivery_at: retry_at,
-            delivery_lease_id: nil, delivery_lease_expires_at: nil, delivery_enqueued_until: nil)
-        end
-        integration.update_columns(last_error: message)
-      end
-      retry_at
-    end
-
-    # A lease expiry is indistinguishable from a worker dying after the remote
-    # endpoint accepted the message but before `sent` committed. Retrying is
-    # required for at-least-once delivery; webhook consumers can deduplicate by
-    # delivery_key / Idempotency-Key.
-    def recover_stale_delivery!
-      retryable = false
-      with_lock do
-        return false unless status == "delivering" && delivery_lease_expires_at&.past?
-
-        message = error.presence || "Delivery lease expired before completion"
-        if delivery_attempts >= MAX_DELIVERY_ATTEMPTS
-          update!(status: "failed", error: message, next_delivery_at: nil,
-            delivery_lease_id: nil, delivery_lease_expires_at: nil, delivery_enqueued_until: nil)
-        else
-          update!(status: "pending", error: message, next_delivery_at: Time.current,
-            delivery_lease_id: nil, delivery_lease_expires_at: nil, delivery_enqueued_until: nil)
-          retryable = true
-        end
-      end
-      retryable
-    end
-
-    # Explicit operator action: terminal failures get a fresh, bounded attempt
-    # budget. Sent/skipped alerts are intentionally not replayed by this path.
-    def retry_delivery!
-      with_lock do
-        return false unless status == "failed"
-
-        update!(status: "pending", error: nil, delivery_attempts: 0,
-          next_delivery_at: Time.current, delivery_enqueued_until: nil,
-          delivery_lease_id: nil, delivery_lease_expires_at: nil)
-      end
-      enqueue_delivery!
-    end
-
-    # Synchronous delivery is retained for "Send test", whose HTTP response
-    # must report the real destination outcome. Normal alerts use the leased job
-    # path above.
-    def deliver!
-      return self if TERMINAL_STATUSES.include?(status)
-      return update!(status: "skipped") unless integration.enabled?
-
-      integration.deliver(self)
-      mark_sent!
-      self
-    rescue StandardError => e
-      message = "#{e.class}: #{e.message}".first(1000)
-      update!(status: "failed", error: message)
-      integration.update_columns(last_error: message)
-      raise
-    end
-
-    private
-
-    def enqueue_initial_work
-      # An embedded install has no integration to deliver to and no delivery
-      # jobs to enqueue on; the alert is recorded and that is the end of it.
-      return if integration.nil?
-
-      if status == "pending"
-        enqueue_delivery!
-      elsif status == "collapsed" && alert_rule
-        SummarizeAlertBurstJob.set(wait_until: created_at + AlertRule::BURST_WINDOW).perform_later(alert_rule)
-      end
-    end
-
-    def assign_delivery_metadata
-      self.delivery_key ||= SecureRandom.uuid
-      self.next_delivery_at ||= Time.current if status.blank? || status == "pending"
-    end
-
-    def inherit_integration
-      self.integration ||= alert_rule&.integration
-    end
-
-    def owns_delivery_claim?(token)
-      status == "delivering" && delivery_lease_id == token
-    end
-
-    def finish_claim!(token, outcome)
-      with_lock do
-        return false unless owns_delivery_claim?(token)
-
-        attributes = { status: outcome, error: nil, next_delivery_at: nil,
-                      delivery_lease_id: nil, delivery_lease_expires_at: nil,
-                      delivery_enqueued_until: nil }
-        attributes[:sent_at] = Time.current if outcome == "sent"
-        update!(attributes)
-        if outcome == "sent"
-          integration.update_columns(last_delivered_at: Time.current, last_error: nil)
-          issue&.activities&.create!(kind: "alert", data: { event: event, integration: integration.kind })
-        end
-        true
-      end
-    end
-
-    def mark_sent!
-      update!(status: "sent", sent_at: Time.current, error: nil)
-      integration.update_columns(last_delivered_at: Time.current, last_error: nil)
-      issue&.activities&.create!(kind: "alert", data: { event: event, integration: integration.kind })
-    end
-  end
-end

data/app/models/railwatch/alert_rule.rb

@@ -1,121 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  class AlertRule < ApplicationRecord
-    self.table_name = "railwatch_alert_rules"
-    TITLE_PATTERN_MAX_LENGTH = 256
-    TITLE_PATTERN_TIMEOUT = 0.01
-    EVENTS = %w[new_issue regressed_issue resolved_issue ignored_issue assigned_issue threshold anomaly silent_host quota crash_free_drop].freeze
-
-    # A deploy that breaks one page opens dozens of issues in a minute, and
-    # each one used to be its own Slack message. These two events are the ones
-    # that arrive in bursts.
-    BURST_EVENTS = %w[new_issue regressed_issue].freeze
-    BURST_WINDOW = 60.seconds
-    # Deliver this many individually, then fold the rest of the window into one
-    # summary message.
-    BURST_LIMIT = 5
-
-    def application = Application.current
-    def integration = nil
-    has_many :alerts, dependent: :destroy
-
-    validates :event, inclusion: { in: EVENTS }
-    validate :valid_title_pattern
-
-    # De-duplicate: one alert per issue per event per 30 minutes.
-    def fire!(event:, issue: nil, payload: {})
-      # Serialize the duplicate/burst decision per rule. The alert is born in
-      # its final outbox state, so its after-commit hook can never enqueue a row
-      # that is about to become collapsed.
-      with_lock do
-        return if issue && alerts.where(issue: issue, event: event).where("created_at > ?", 30.minutes.ago).exists?
-
-        status = bursting?(event, issue) ? "collapsed" : "pending"
-        alerts.create!(event: event, issue: issue, payload: payload, status: status)
-      end
-    end
-
-    # Optional narrowing of what this rule notifies about, stored in `filters`:
-    # environment_ids, kinds, min_priority, title_pattern. An absent or empty
-    # filter matches everything; an issue-less alert (quota, silent_host) is
-    # only narrowed by environment, via payload[:environment_id].
-    def matches?(issue:, payload: {})
-      return false unless environment_matches?(issue, payload)
-      return true unless issue
-      kind_matches?(issue) && priority_matches?(issue) && title_matches?(issue)
-    end
-
-    private
-
-    def valid_title_pattern
-      pattern = filters["title_pattern"].to_s
-      return if pattern.blank?
-
-      if pattern.length > TITLE_PATTERN_MAX_LENGTH
-        errors.add(:filters, "title pattern is too long (maximum is #{TITLE_PATTERN_MAX_LENGTH} characters)")
-        return
-      end
-      return unless regular_expression_pattern?(pattern)
-
-      compile_title_pattern(pattern)
-    rescue RegexpError => e
-      errors.add(:filters, "title pattern is not a valid regular expression: #{e.message}")
-    end
-
-    # True once this rule has already fired BURST_LIMIT issue alerts inside the
-    # window. Only alerts that carry an issue are counted, so summary rows can
-    # never inflate the next window's tally.
-    def bursting?(event, issue)
-      return false unless BURST_EVENTS.include?(event) && issue
-      alerts.where(event: event, created_at: BURST_WINDOW.ago..).where.not(issue_id: nil).count >= BURST_LIMIT
-    end
-
-    def environment_matches?(issue, payload)
-      ids = Array(filters["environment_ids"]).compact_blank.map(&:to_i)
-      return true if ids.empty?
-      ids.include?((issue&.environment_id || payload[:environment_id] || payload["environment_id"]).to_i)
-    end
-
-    def kind_matches?(issue)
-      kinds = Array(filters["kinds"]).compact_blank
-      kinds.empty? || kinds.include?(issue.kind)
-    end
-
-    def priority_matches?(issue)
-      minimum = filters["min_priority"]
-      return true if minimum.blank? || Issue::PRIORITIES.exclude?(minimum)
-      Issue::PRIORITIES.index(issue.priority) >= Issue::PRIORITIES.index(minimum)
-    end
-
-    # A pattern wrapped in slashes is a regular expression, anything else is a
-    # case-insensitive substring.
-    def title_matches?(issue)
-      pattern = filters["title_pattern"].to_s
-      return true if pattern.blank?
-      if regular_expression_pattern?(pattern)
-        begin
-          return issue.title.match?(compile_title_pattern(pattern))
-        rescue Regexp::TimeoutError
-          # A pattern that backtracks past its budget matches nothing rather
-          # than stalling every alert behind it.
-          Rails.logger.warn("alert rule title pattern timed out alert_rule_id=#{id}")
-          return false
-        rescue RegexpError
-          # An unparsable regexp degrades to a substring match on its source, so
-          # a rule saved before this was validated does not silently go dark.
-          pattern = pattern[1..-2]
-        end
-      end
-      issue.title.downcase.include?(pattern.downcase)
-    end
-
-    def regular_expression_pattern?(pattern)
-      pattern.start_with?("/") && pattern.end_with?("/") && pattern.length > 2
-    end
-
-    def compile_title_pattern(pattern)
-      Regexp.new(pattern[1..-2], Regexp::IGNORECASE, timeout: TITLE_PATTERN_TIMEOUT)
-    end
-  end
-end

data/app/models/railwatch/anomaly_rule.rb

@@ -1,51 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  # "Alert when p95 of GET /checkout is more than 3 standard deviations above
-  # its 7-day baseline for the same time of day." Evaluated by
-  # DetectAnomaliesJob against hourly rollups.
-  class AnomalyRule < ApplicationRecord
-    self.table_name = "railwatch_anomaly_rules"
-    MIN_BASELINE_DAYS = 3
-    MAX_BASELINE_DAYS = 30
-    MAX_DEVIATION = 10
-    MAX_WINDOW_MINUTES = 1_440
-    TARGET_KINDS = %w[requests jobs queries outgoing_requests scheduled_tasks llm_calls].freeze
-    # spend included because "we are spending well above baseline for this
-    # hour of the week" is the LLM alert that needs no threshold picked.
-    METRICS = %w[p95 avg count error_rate spend].freeze
-    SHARED_METRICS = %w[p95 avg count error_rate].freeze
-    LLM_METRICS = %w[spend].freeze
-
-    def self.metrics_for(target_kind)
-      target_kind == "llm_calls" ? SHARED_METRICS + LLM_METRICS : SHARED_METRICS
-    end
-
-    def environment = Environment.current
-
-    validates :target_kind, inclusion: { in: TARGET_KINDS }
-    validates :metric, inclusion: { in: METRICS }
-    validate :metric_applies_to_target_kind
-    validates :target, presence: true, length: { maximum: 256 }
-    validates :deviation, numericality: { greater_than: 0, less_than_or_equal_to: MAX_DEVIATION }
-    validates :window_minutes, numericality: { only_integer: true, greater_than: 0,
-                                               less_than_or_equal_to: MAX_WINDOW_MINUTES }
-    validates :baseline_days, numericality: { only_integer: true, greater_than_or_equal_to: MIN_BASELINE_DAYS,
-                                              less_than_or_equal_to: MAX_BASELINE_DAYS }
-
-    scope :enabled, -> { where(enabled: true) }
-
-    def description
-      "#{target_kind} #{target == '*' ? 'all' : target}: #{metric} > #{deviation}σ above #{baseline_days}-day baseline"
-    end
-
-    private
-
-    def metric_applies_to_target_kind
-      return if metric.blank? || target_kind.blank?
-      return if AnomalyRule.metrics_for(target_kind).include?(metric)
-
-      errors.add(:metric, "is not available for #{target_kind}")
-    end
-  end
-end

data/app/models/railwatch/application.rb

@@ -1,44 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  # The one application an embedded install monitors: the host. Not a table.
-  # Issue keys need a prefix and a counter; the rest of what the platform's
-  # Application carries (account, repository links, alert rules) is either
-  # fixed here or empty.
-  class Application
-    ID = 1
-
-    attr_reader :id, :name, :slug
-
-    def self.current = @current ||= new
-    def self.find(id)
-      raise ActiveRecord::RecordNotFound, "Application #{id}" unless id.to_i == ID
-      current
-    end
-
-    def initialize
-      @id = ID
-      @name = Rails.application.class.module_parent_name
-      @slug = @name.parameterize
-    end
-
-    def issue_prefix = Railwatch.config.issue_prefix || @name.upcase.gsub(/[^A-Z0-9]/, "")[0, 4].presence || "APP"
-    def repository_url = Railwatch.config.repository_url
-    def default_branch = "main"
-    def environments = [ Environment.current ]
-    def alert_rules = AlertRule.where(application_id: ID)
-    def account = Railwatch::Embedded::Account
-    def issues = Issue.where(application_id: ID)
-
-    # Issue numbers are per application on the platform (APP-1, APP-2, ...),
-    # allocated under a row lock on the application. There is no row here, so
-    # the meta database's own write lock serialises it: Issue creation already
-    # runs inside a transaction, and SQLite allows one writer.
-    def next_issue_number!
-      (Issue.where(application_id: ID).maximum(:number) || 0) + 1
-    end
-
-    include GlobalID::Identification
-    def to_global_id(...) = GlobalID.create(self, app: "railwatch")
-  end
-end

data/app/models/railwatch/application_record.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  # Base class for what the engine owns about the monitored application besides
-  # telemetry: issues and their comments and activity, deploys, saved views,
-  # thresholds, anomaly rules, alert rules and alerts. These are authored and
-  # permanent where telemetry is derived and pruned, so they live in their own
-  # database (`railwatch` in the host's database.yml) and never in the host's
-  # primary.
-  class ApplicationRecord < ActiveRecord::Base
-    self.abstract_class = true
-    begin
-      connects_to database: { writing: :railwatch, reading: :railwatch }
-    rescue ActiveRecord::AdapterNotSpecified, LoadError
-      # No `railwatch` entry in this environment's database.yml, or an entry
-      # whose adapter gem is not in the bundle yet (LoadError). A cloud-transport
-      # app has none and still eager-loads this class in production, and so
-      # does the installer's own boot, before it has written the
-      # entry -- so loading must not raise. Using it must, though: without
-      # connects_to this class would inherit ActiveRecord::Base's PRIMARY
-      # connection, and its tables are unprefixed, so a query would read and
-      # a write would corrupt the host application's own tables. Every route
-      # into the connection goes through connection_pool, so refusing here
-      # fails closed for reads and writes alike.
-      def self.connection_pool
-        raise Railwatch::DatabaseNotConfigured,
-              "the `railwatch` database (issues, comments, saved views and deploys) is not configured for the " \
-              "#{Rails.env} environment; run `bin/rails generate railwatch:install` " \
-              "or add it to config/database.yml (docs/embedded.md)"
-      end
-    end
-  end
-end

data/app/models/railwatch/comment.rb

@@ -1,36 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  class Comment < ApplicationRecord
-    self.table_name = "railwatch_comments"
-    SOURCES = %w[railwatch linear].freeze
-
-    belongs_to :issue
-    def user
-      viewer_id && User.find_by(id: viewer_id)
-    end
-
-    def user=(u)
-      self.viewer_id = u&.id&.to_s
-    end
-
-    validates :body, presence: true
-    validates :source, inclusion: { in: SOURCES }
-    validates :user, presence: true, if: -> { source == "railwatch" }
-    validates :author_name, presence: true, if: -> { source == "linear" }
-
-    after_create :record_activity
-    after_create_commit :enqueue_linear_sync
-
-    private
-
-    def record_activity
-      issue.activities.create!(kind: "comment", user: user,
-        data: { comment_id: id, body: body, source: source, author_name: author_name })
-    end
-
-    def enqueue_linear_sync
-      nil unless source == "railwatch"
-    end
-  end
-end

data/app/models/railwatch/deploy.rb

@@ -1,67 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  class Deploy < ApplicationRecord
-    self.table_name = "railwatch_deploys"
-    def environment = Environment.current
-
-    validates :deploy, presence: true, uniqueness: { scope: :environment_id }
-    validates :deployed_at, presence: true
-    # Rendered as the "Open" link on the deploy page. Same rule as
-    # Application#repository_url, checked by parsing: one whole http(s) URL
-    # with a host, so a hook (or whoever holds its token) cannot put a
-    # javascript:/data: link, a hostless "https://?x", or an arbitrary
-    # off-site destination behind a trusted button.
-    validate :url_is_a_web_address
-
-    scope :recent, -> { order(deployed_at: :desc) }
-    scope :between, ->(from, to) { where(deployed_at: from..to) }
-
-    before_validation :assign_previous_ref
-    before_validation :trim_commits
-
-    def short_ref
-      ref.to_s.first(7).presence || deploy.first(12)
-    end
-
-    def commits_count
-      commits.size
-    end
-
-    # The deploy immediately before this one in the same environment.
-    def previous_deploy
-      environment.deploys.where(deployed_at: ...deployed_at).recent.first
-    end
-
-    # The stretch of time this release was live: from its own deploy until the
-    # next one, or until now for the current release. Release health is summed
-    # over this, not over the page's window.
-    def window
-      [ deployed_at, environment.deploys.where("deployed_at > ?", deployed_at).order(:deployed_at).first&.deployed_at || Time.current ]
-    end
-
-    private
-
-    def url_is_a_web_address
-      return if url.blank?
-      parsed = url.match?(/\A\S+\z/) ? URI.parse(url) : nil
-      return if parsed.is_a?(URI::HTTP) && parsed.host.present?
-      errors.add(:url, "must be a single http:// or https:// URL")
-    rescue URI::InvalidURIError
-      errors.add(:url, "must be a single http:// or https:// URL")
-    end
-
-    def assign_previous_ref
-      return if previous_ref.present? || deployed_at.blank?
-      self.previous_ref = previous_deploy&.ref
-    end
-
-    # The post-deploy hook sends its most recent commits (newest first) without
-    # knowing where the last deploy stopped, so cut the list at that commit.
-    def trim_commits
-      return if previous_ref.blank?
-      index = commits.index { |c| c["sha"].to_s.start_with?(previous_ref) }
-      self.commits = commits.first(index) if index
-    end
-  end
-end

data/app/models/railwatch/environment.rb

@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-module Railwatch
-  # The one environment an embedded install monitors: the host application in
-  # its current Rails.env. Not a table. The hosted platform's Environment is an
-  # account-scoped Active Record row with a token, quota and pause state; the
-  # telemetry, ingest and dashboard code only ever asks it for an id, a slug,
-  # a name, with_telemetry, and a few display attributes, so this stands in
-  # with exactly that surface.
-  class Environment
-    ID = 1
-
-    attr_reader :id, :name, :slug, :application_name
-
-    def self.current = @current ||= new
-
-    def self.find(id)
-      raise ActiveRecord::RecordNotFound, "Environment #{id}" unless id.to_i == ID
-      current
-    end
-
-    def initialize
-      @id = ID
-      @name = Rails.env.to_s
-      @application_name = Rails.application.class.module_parent_name
-      @slug = "#{@application_name.parameterize}-#{@name}"
-    end
-
-    def with_telemetry(&block) = TelemetryRecord.with_tenant(slug, &block)
-    def telemetry_exists? = true
-    def paused? = false
-    def token_prefix = "embedded"
-    def retention_days = 7
-    # Deliberately read from the telemetry database rather than held in this
-    # process. A deployed embedded install ingests in the writer process and
-    # renders the dashboard in a web one, so a value set during ingest is
-    # invisible to the page that needs it -- and a nil here is what the
-    # dashboard treats as "no events yet", so it showed its install steps no
-    # matter how much had been recorded. The newest batch row is the same
-    # fact, in the file both processes already share, one indexed lookup away.
-    # Ordered by received_at, not id: batches are written concurrently, so one
-    # that captured an earlier receipt time can land after a later one, and
-    # taking the newest row by insertion order would hand the dashboard a
-    # timestamp that goes backwards. `recent` is the scope that states this.
-    def last_seen_at
-      with_telemetry { Telemetry::IngestBatch.recent.pick(:received_at) }
-    end
-    def application = Application.current
-    def issues = Issue.where(environment_id: ID)
-    def deploys = Deploy.where(environment_id: ID)
-    def saved_views = SavedView.where(environment_id: ID)
-    def thresholds = Threshold.where(environment_id: ID)
-    def anomaly_rules = AnomalyRule.where(environment_id: ID)
-    def events_this_month = 0
-    # The platform lets an account list the servers it expects to report so the
-    # dashboard can flag silent ones. One embedded install is its own server.
-    def expected_servers = []
-
-    # Ingest::Batch touches this after writing a batch. Nothing to record: the
-    # batch row it just wrote is what last_seen_at reads.
-    def update_columns(last_seen_at:) = nil
-
-    # GlobalID for Active Job arguments (RollupJob.perform_later(environment, bucket)).
-    include GlobalID::Identification
-    def to_global_id(...) = GlobalID.create(self, app: "railwatch")
-    def self.find_by_id(id) = find(id)
-  end
-end