Coverage tooling: knowing what you're not measuring

Analytics dashboards are great at showing you the traffic you have. They are structurally terrible at showing you the traffic you should have but don't — the launched page nobody linked, the snippet that fell off a template, the custom event that silently stopped firing after a refactor. Absence doesn't render.

So Tracely has grown a small family of coverage tools, all aimed at the same question from different angles: is the measurement itself working?

Expected URL coverage

The simplest one. In site settings you paste a list of paths you expect to receive traffic — one per line, /pricing, or full URLs if that's what your sitemap export gives you; query strings are ignored. The Expected URLs report then shows you every path on that list that received zero pageviews in the last 7 or 30 days.

That's the whole feature, and it catches an embarrassing amount: typos in the list itself, pages that shipped without the snippet, launches that never got announced, redirects that quietly ate a URL. It's the analytics equivalent of a dead-link checker, and like a dead-link checker, it's boring right up until it isn't.

Edge config lint

Some Tracely installs route ingest traffic through a Cloudflare Worker, an nginx or Caddy reverse proxy, or a Node fetch wrapper. Those snippets fail in predictable ways, so the Edge lint tool pattern-matches for the mistakes that actually show up in practice: wrong HTTP method, consumed request bodies, missing client-context forwarding (which silently ruins geo and device analytics), CORS gaps on browser-facing edges, and an accidental Authorization header on public ingest.

You paste the code, run the checks, and get structured findings — each with a stable rule id, a level from pass to error, and a category like routing, headers, or resilience. Nothing is executed; it's purely static analysis of the text. There are also presets that fill the editor with working Worker, nginx, Caddy, and Node examples, which double as documentation for how the proxy should look.

The embed security scorecard

This one exists because of procurement, honestly. When someone's security team reviews an analytics vendor, they ask a checklist of questions, and answering them by hand is a chore. The Embed security page at /sites/{site}/embed-security runs the checklist against your actual configuration: HTTPS, tracking id, ingest hostname enforcement, optional subresource integrity, API token posture, public dashboard exposure, CSP reporting — and produces a copyable plain-text report you can paste straight into the review thread.

It's also useful outside procurement as a periodic "did I configure this properly" sweep. Configuration drifts; a scorecard notices.

The CI event contract

My favorite of the four, because it moves the check into the pipeline. You define rules in config/tracely_event_contract.php — each rule names a path and the custom events that should exist on it, like /checkout and its funnel events. Then in CI or a staging check you run:

php artisan tracely:verify-event-contract {site_ulid} --days=14

Exit code 0 when every rule passes, 1 when any expected event is missing from recent traffic. That's it — a contract between your instrumentation and your deploy process. The classic failure this catches is the refactor that renames a component and drops the event call with it: no error anywhere, just a metric that flatlines and a chart nobody checks until the monthly review. Now it's a red build instead.

Why this matters more in privacy-first analytics

There's a reason I keep investing here. Tracely is aggregate-first and cookieless by design — there's no session replay or per-user trail to reconstruct what happened when a number looks wrong. That's the right trade, but it raises the bar on trusting the pipeline itself. If the aggregates are all you keep, you'd better be sure the aggregates are complete. Coverage tooling is how a privacy-first product earns that confidence, and it's a big part of what I mean when I say the operational story should be boring and dependable.