fix(clickhouse): harden R/W path P0–P3 (cleanup, durability, rollups)

Honest TTL cleanup semantics; enqueue-safe dedup with flush retry and writer
metrics; model insert hooks; latest-per-node and hourly metric/openresty
rollups; small-host pool/async defaults, traffic hourly TTL, and UV labeling.

internal/repository/analytics/node_access_log_delete.go

@@ -9,7 +9,7 @@ import (
 	"time"
 )
 
-// DeleteAllNodeAccessLogs deletes all node access logs.
+// DeleteAllNodeAccessLogs hard-deletes all node access logs via TRUNCATE.
 func DeleteAllNodeAccessLogs(ctx context.Context) (int64, error) {
 	conn, err := nodeAccessLogConn()
 	if err != nil {
@@ -19,47 +19,69 @@ func DeleteAllNodeAccessLogs(ctx context.Context) (int64, error) {
 	if err != nil {
 		return 0, err
 	}
-	return outcome.EligibleCount, nil
+	return outcome.DeletedCount, nil
 }
 
-// DeleteNodeAccessLogsBefore expires logs older than cutoff via table TTL.
-func DeleteNodeAccessLogsBefore(ctx context.Context, cutoff time.Time) (int64, error) {
-	conn, err := nodeAccessLogConn()
+// DeleteNodeAccessLogsBefore force-materializes of_node_access_logs table TTL.
+//
+// The cutoff argument is kept for call-site compatibility and is not used to select rows:
+// ClickHouse MATERIALIZE TTL only enforces the DDL policy (TableTTLDaysNodeAccessLogs).
+// Returns an estimate of rows past table TTL as the int64 (not a hard-deleted count).
+// Callers that need honest API fields should prefer MaterializeNodeAccessLogsTTL.
+func DeleteNodeAccessLogsBefore(ctx context.Context, _ time.Time) (int64, error) {
+	outcome, err := MaterializeNodeAccessLogsTTL(ctx)
 	if err != nil {
 		return 0, err
 	}
+	return outcome.EligibleCount, nil
+}
+
+// MaterializeNodeAccessLogsTTL force-materializes table TTL and reports an honest outcome.
+func MaterializeNodeAccessLogsTTL(ctx context.Context) (CleanupOutcome, error) {
+	conn, err := nodeAccessLogConn()
+	if err != nil {
+		return CleanupOutcome{}, err
+	}
 	tableName := nodeAccessLogTableName()
-	cutoff = cutoff.UTC()
-	outcome, err := expireRowsViaTTL(
+	ttlDays := TableTTLDaysNodeAccessLogs
+	cutoff := tableTTLCutoff(ttlDays, time.Now())
+	return materializeExpiredByTableTTL(
 		ctx,
 		conn,
 		tableName,
+		ttlDays,
 		fmt.Sprintf("SELECT count() FROM %s WHERE logged_at < ?", tableName),
 		[]any{cutoff},
 	)
+}
+
+// DeleteNodeAccessLogsByNodeBefore force-materializes table-global TTL.
+//
+// Node-scoped hard delete is not supported: MATERIALIZE TTL is table-global.
+// The returned count is an estimate of rows for nodeID past table TTL only.
+func DeleteNodeAccessLogsByNodeBefore(ctx context.Context, nodeID string, _ time.Time) (int64, error) {
+	outcome, err := MaterializeNodeAccessLogsTTLByNode(ctx, nodeID)
 	if err != nil {
 		return 0, err
 	}
 	return outcome.EligibleCount, nil
 }
 
-// DeleteNodeAccessLogsByNodeBefore expires logs for a node older than cutoff via table TTL.
-func DeleteNodeAccessLogsByNodeBefore(ctx context.Context, nodeID string, before time.Time) (int64, error) {
+// MaterializeNodeAccessLogsTTLByNode materializes table-global TTL and estimates node-scoped rows past TTL.
+func MaterializeNodeAccessLogsTTLByNode(ctx context.Context, nodeID string) (CleanupOutcome, error) {
 	conn, err := nodeAccessLogConn()
 	if err != nil {
-		return 0, err
+		return CleanupOutcome{}, err
 	}
 	tableName := nodeAccessLogTableName()
-	before = before.UTC()
-	outcome, err := expireRowsViaTTL(
+	ttlDays := TableTTLDaysNodeAccessLogs
+	cutoff := tableTTLCutoff(ttlDays, time.Now())
+	return materializeExpiredByTableTTL(
 		ctx,
 		conn,
 		tableName,
+		ttlDays,
 		fmt.Sprintf("SELECT count() FROM %s WHERE node_id = ? AND logged_at < ?", tableName),
-		[]any{nodeID, before},
+		[]any{nodeID, cutoff},
 	)
-	if err != nil {
-		return 0, err
-	}
-	return outcome.EligibleCount, nil
-}
+}