feat(obs): 访问日志 SSOT 与 edge_health，去掉协议兼容层

Agent 仅上报 host_metrics/edge_health/access_logs；业务流量与 UV 由
Server 侧访问日志聚合。新增 of_node_edge_health 与 of_access_log_hourly，
删除 request_reports/openresty 吞吐路径；API 不再暴露 traffic_reports
与 openresty_rx|tx。心跳/离线默认阈值与回填迁移一并入库。

internal/apps/agent/observability/collector.go

@@ -84,16 +84,37 @@ func BuildSnapshot(cfg *config.Config, stateStore *state.Store) *protocol.NodeMe
 	return metric
 }
 
-// BuildOpenrestyObservation builds the OpenResty observation protocol model from the managed metrics.
-func BuildOpenrestyObservation(managed *ManagedOpenRestyMetrics) *protocol.NodeOpenrestyObservation {
-	if managed == nil {
-		return nil
+// BuildEdgeHealth builds the edge_health payload from a local probe and node status.
+func BuildEdgeHealth(probe *EdgeHealthSnapshot, openrestyStatus, openrestyMessage string) *protocol.NodeEdgeHealth {
+	status := strings.TrimSpace(openrestyStatus)
+	message := strings.TrimSpace(openrestyMessage)
+	if probe == nil {
+		if status == "" {
+			return nil
+		}
+		return &protocol.NodeEdgeHealth{
+			CapturedAtUnix: time.Now().UTC().Unix(),
+			Status:         status,
+			Message:        message,
+			Connections:    0,
+		}
 	}
-	return &protocol.NodeOpenrestyObservation{
-		CapturedAtUnix:       time.Now().UTC().Unix(),
-		OpenrestyRxBytes:     managed.OpenrestyRxBytes,
-		OpenrestyTxBytes:     managed.OpenrestyTxBytes,
-		OpenrestyConnections: managed.OpenrestyConnections,
+
+	captured := probe.CapturedAtUnix
+	if captured <= 0 {
+		captured = time.Now().UTC().Unix()
+	}
+	if status == "" {
+		status = protocol.OpenrestyStatusUnknown
+		if probe.OK {
+			status = protocol.OpenrestyStatusHealthy
+		}
+	}
+	return &protocol.NodeEdgeHealth{
+		CapturedAtUnix: captured,
+		Status:         status,
+		Message:        message,
+		Connections:    probe.Connections,
 	}
 }
 

internal/apps/agent/observability/openresty_local.go

@@ -4,48 +4,37 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
 	"net/http"
-	"regexp"
-	"strconv"
-	"strings"
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
-	"github.com/Rain-kl/Wavelet/internal/apps/agent/protocol"
 )
 
-const (
-	openRestyObservabilityPath      = "/openflare/observability"
-	openRestyStubStatusPath         = "/openflare/stub_status"
-	stubStatusActiveMatchGroupCount = 2
-)
+const openRestyObservabilityPath = "/openflare/observability"
 
-var stubStatusActivePattern = regexp.MustCompile(`Active connections:\s+(\d+)`)
-
-// ManagedOpenRestyMetrics holds metrics collected from the local OpenResty instance.
-type ManagedOpenRestyMetrics struct {
-	TrafficReport        *protocol.NodeTrafficReport
-	OpenrestyRxBytes     int64
-	OpenrestyTxBytes     int64
-	OpenrestyConnections int64
+// EdgeHealthSnapshot is the L2 OpenResty health probe result.
+type EdgeHealthSnapshot struct {
+	OK             bool
+	CapturedAtUnix int64
+	Connections    int64
+	Reading        int64
+	Writing        int64
+	Waiting        int64
 }
 
 type openRestyObservabilityResponse struct {
-	WindowStartedAtUnix int64            `json:"window_started_at_unix"`
-	WindowEndedAtUnix   int64            `json:"window_ended_at_unix"`
-	RequestCount        int64            `json:"request_count"`
-	ErrorCount          int64            `json:"error_count"`
-	UniqueVisitorCount  int64            `json:"unique_visitor_count"`
-	StatusCodes         map[string]int64 `json:"status_codes"`
-	TopDomains          map[string]int64 `json:"top_domains"`
-	SourceCountries     map[string]int64 `json:"source_countries"`
-	OpenrestyRxBytes    int64            `json:"openresty_rx_bytes"`
-	OpenrestyTxBytes    int64            `json:"openresty_tx_bytes"`
+	OK             bool  `json:"ok"`
+	CapturedAtUnix int64 `json:"captured_at_unix"`
+	Connections    struct {
+		Active  int64 `json:"active"`
+		Reading int64 `json:"reading"`
+		Writing int64 `json:"writing"`
+		Waiting int64 `json:"waiting"`
+	} `json:"connections"`
 }
 
-// CollectManagedOpenRestyMetrics collects metrics from the local OpenResty observability endpoints.
-func CollectManagedOpenRestyMetrics(ctx context.Context, cfg *config.Config) *ManagedOpenRestyMetrics {
+// CollectEdgeHealth probes the local OpenResty observability JSON endpoint.
+func CollectEdgeHealth(ctx context.Context, cfg *config.Config) *EdgeHealthSnapshot {
 	if cfg == nil || cfg.OpenrestyObservabilityPort <= 0 {
 		return nil
 	}
@@ -53,31 +42,23 @@ func CollectManagedOpenRestyMetrics(ctx context.Context, cfg *config.Config) *Ma
 	baseURL := fmt.Sprintf("http://127.0.0.1:%d", cfg.OpenrestyObservabilityPort)
 	client := &http.Client{Timeout: 1500 * time.Millisecond}
 
-	observabilityResp := openRestyObservabilityResponse{}
-	if err := fetchLocalJSON(ctx, client, baseURL+openRestyObservabilityPath, &observabilityResp); err != nil {
+	var resp openRestyObservabilityResponse
+	if err := fetchLocalJSON(ctx, client, baseURL+openRestyObservabilityPath, &resp); err != nil {
 		return nil
 	}
 
-	result := &ManagedOpenRestyMetrics{
-		TrafficReport: &protocol.NodeTrafficReport{
-			WindowStartedAtUnix: observabilityResp.WindowStartedAtUnix,
-			WindowEndedAtUnix:   observabilityResp.WindowEndedAtUnix,
-			RequestCount:        observabilityResp.RequestCount,
-			ErrorCount:          observabilityResp.ErrorCount,
-			UniqueVisitorCount:  observabilityResp.UniqueVisitorCount,
-			StatusCodes:         normalizeCountMap(observabilityResp.StatusCodes),
-			TopDomains:          normalizeCountMap(observabilityResp.TopDomains),
-			SourceCountries:     normalizeCountMap(observabilityResp.SourceCountries),
-		},
-		OpenrestyRxBytes: observabilityResp.OpenrestyRxBytes,
-		OpenrestyTxBytes: observabilityResp.OpenrestyTxBytes,
+	captured := resp.CapturedAtUnix
+	if captured <= 0 {
+		captured = time.Now().UTC().Unix()
 	}
-
-	if text, err := fetchLocalText(ctx, client, baseURL+openRestyStubStatusPath); err == nil {
-		result.OpenrestyConnections = parseStubStatusActiveConnections(text)
+	return &EdgeHealthSnapshot{
+		OK:             resp.OK,
+		CapturedAtUnix: captured,
+		Connections:    resp.Connections.Active,
+		Reading:        resp.Connections.Reading,
+		Writing:        resp.Connections.Writing,
+		Waiting:        resp.Connections.Waiting,
 	}
-
-	return result
 }
 
 func fetchLocalJSON(ctx context.Context, client *http.Client, url string, target any) error {
@@ -95,50 +76,3 @@ func fetchLocalJSON(ctx context.Context, client *http.Client, url string, target
 	}
 	return json.NewDecoder(resp.Body).Decode(target)
 }
-
-func fetchLocalText(ctx context.Context, client *http.Client, url string) (string, error) {
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-	if err != nil {
-		return "", err
-	}
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer func() { _ = resp.Body.Close() }()
-	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("unexpected local stub status: %s", resp.Status)
-	}
-	data, err := io.ReadAll(resp.Body)
-	if err != nil {
-		return "", err
-	}
-	return string(data), nil
-}
-
-func parseStubStatusActiveConnections(raw string) int64 {
-	matches := stubStatusActivePattern.FindStringSubmatch(raw)
-	if len(matches) != stubStatusActiveMatchGroupCount {
-		return 0
-	}
-	value, err := strconv.ParseInt(matches[1], 10, 64)
-	if err != nil {
-		return 0
-	}
-	return value
-}
-
-func normalizeCountMap(values map[string]int64) map[string]int64 {
-	if len(values) == 0 {
-		return map[string]int64{}
-	}
-	result := make(map[string]int64, len(values))
-	for key, value := range values {
-		key = strings.TrimSpace(key)
-		if key == "" || value <= 0 {
-			continue
-		}
-		result[key] = value
-	}
-	return result
-}

internal/apps/agent/observability/openresty_local_test.go

@@ -2,82 +2,63 @@ package observability
 
 import (
 	"context"
-	"net"
 	"net/http"
 	"net/http/httptest"
-	"strings"
 	"testing"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
 )
 
-func TestCollectManagedOpenRestyMetrics(t *testing.T) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("Listen failed: %v", err)
-	}
-	port := listener.Addr().(*net.TCPAddr).Port
-
-	mux := http.NewServeMux()
-	mux.HandleFunc(openRestyObservabilityPath, func(writer http.ResponseWriter, request *http.Request) {
-		writer.Header().Set("Content-Type", "application/json")
-		_, _ = writer.Write([]byte(`{"window_started_at_unix":1710403200,"window_ended_at_unix":1710403210,"request_count":12,"error_count":2,"unique_visitor_count":5,"status_codes":{"200":10,"502":2},"top_domains":{"app.example.com":9,"api.example.com":3},"source_countries":{},"openresty_rx_bytes":4096,"openresty_tx_bytes":8192}`))
-	})
-	mux.HandleFunc(openRestyStubStatusPath, func(writer http.ResponseWriter, request *http.Request) {
-		_, _ = writer.Write([]byte("Active connections: 7 \nserver accepts handled requests\n 10 10 12 \nReading: 1 Writing: 2 Waiting: 4 \n"))
-	})
-
-	server := httptest.NewUnstartedServer(mux)
-	server.Listener = listener
-	server.Start()
+func TestCollectEdgeHealth(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/openflare/observability" {
+			http.NotFound(w, r)
+			return
+		}
+		_, _ = w.Write([]byte(`{"ok":true,"captured_at_unix":1710403200,"connections":{"active":12,"reading":1,"writing":2,"waiting":9}}`))
+	}))
 	defer server.Close()
 
-	metrics := CollectManagedOpenRestyMetrics(context.Background(), &config.Config{
-		OpenrestyObservabilityPort: port,
+	health := CollectEdgeHealth(context.Background(), &config.Config{
+		OpenrestyObservabilityPort: mustPort(server.URL),
 	})
-	if metrics == nil || metrics.TrafficReport == nil {
-		t.Fatalf("expected managed openresty metrics, got %+v", metrics)
+	if health == nil {
+		t.Fatal("expected edge health")
 	}
-	if metrics.TrafficReport.RequestCount != 12 || metrics.TrafficReport.ErrorCount != 2 {
-		t.Fatalf("unexpected traffic report: %+v", metrics.TrafficReport)
-	}
-	if metrics.OpenrestyRxBytes != 4096 || metrics.OpenrestyTxBytes != 8192 {
-		t.Fatalf("unexpected openresty byte counters: %+v", metrics)
-	}
-	if metrics.OpenrestyConnections != 7 {
-		t.Fatalf("unexpected openresty connections: %+v", metrics)
+	if !health.OK || health.Connections != 12 {
+		t.Fatalf("unexpected health: %+v", health)
 	}
 }
 
-func TestParseStubStatusActiveConnections(t *testing.T) {
-	if value := parseStubStatusActiveConnections("Active connections: 19\n"); value != 19 {
-		t.Fatalf("unexpected active connections: %d", value)
+func mustPort(rawURL string) int {
+	u := rawURL
+	idx := stringsLastColon(u)
+	if idx < 0 {
+		return 0
 	}
+	var port int
+	for _, ch := range u[idx+1:] {
+		if ch < '0' || ch > '9' {
+			break
+		}
+		port = port*10 + int(ch-'0')
+	}
+	return port
 }
 
-func TestNormalizeCountMapDropsEmptyKeys(t *testing.T) {
-	normalized := normalizeCountMap(map[string]int64{
-		"":                4,
-		" 200 ":           3,
-		"app.example.com": 0,
-	})
-	if len(normalized) != 1 || normalized["200"] != 3 {
-		t.Fatalf("unexpected normalized map: %+v", normalized)
+func stringsLastColon(s string) int {
+	for i := len(s) - 1; i >= 0; i-- {
+		if s[i] == ':' {
+			return i
+		}
 	}
+	return -1
 }
 
-func TestCollectManagedOpenRestyMetricsHandlesUnavailableEndpoint(t *testing.T) {
-	cfg := &config.Config{OpenrestyObservabilityPort: 1}
-	if metrics := CollectManagedOpenRestyMetrics(context.Background(), cfg); metrics != nil {
-		t.Fatalf("expected nil metrics for unavailable endpoint, got %+v", metrics)
-	}
-}
-
-func TestOpenRestyObservabilityPathsAreStable(t *testing.T) {
-	if !strings.HasPrefix(openRestyObservabilityPath, "/openflare/") {
-		t.Fatalf("unexpected observability path: %s", openRestyObservabilityPath)
-	}
-	if !strings.HasPrefix(openRestyStubStatusPath, "/openflare/") {
-		t.Fatalf("unexpected stub status path: %s", openRestyStubStatusPath)
+func TestCollectEdgeHealthHandlesUnavailableEndpoint(t *testing.T) {
+	if health := CollectEdgeHealth(context.Background(), &config.Config{
+		OpenrestyObservabilityPort: 1,
+	}); health != nil {
+		t.Fatalf("expected nil health, got %+v", health)
 	}
 }

internal/apps/agent/observability/traffic.go

@@ -6,10 +6,8 @@ import (
 	"errors"
 	"io"
 	"log/slog"
-	"net/http"
 	"os"
 	"regexp"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
@@ -20,63 +18,42 @@ import (
 )
 
 type accessLogRecord struct {
-	Timestamp     string `json:"ts"`
-	Host          string `json:"host"`
-	RemoteAddr    string `json:"remote_addr"`
-	Path          string `json:"path"`
-	Status        int    `json:"status"`
-	BytesSent     int64  `json:"bytes_sent"`
-	RequestLength int64  `json:"request_length"`
+	Timestamp     string  `json:"ts"`
+	Host          string  `json:"host"`
+	RemoteAddr    string  `json:"remote_addr"`
+	Path          string  `json:"path"`
+	Status        int     `json:"status"`
+	BytesSent     int64   `json:"bytes_sent"`
+	RequestLength int64   `json:"request_length"`
+	RequestTime   float64 `json:"request_time"`
 }
 
 const (
 	combinedAccessLogMatchGroupCount = 5
-	trafficTopDomainsLimit           = 8
+	// requestTimeSecondsToMs converts OpenResty $request_time (seconds float) to ms.
+	requestTimeSecondsToMs = 1000.0
+	// roundHalfUp is added before int64 truncate to round to nearest millisecond.
+	roundHalfUp = 0.5
 )
 
 var combinedAccessLogPattern = regexp.MustCompile(`^(\S+)\s+\S+\s+\S+\s+\[([^]]+)]\s+"\S+\s+(\S+)(?:\s+[^"]*)?"\s+(\d{3})\s+\S+`)
 
+// trafficAggregate collects access-log facts for the current heartbeat window.
+// Pre-aggregation (UV/TopN/TrafficReport) is intentionally not built.
 type trafficAggregate struct {
-	windowStartedAt  time.Time
-	windowEndedAt    time.Time
-	requestCount     int64
-	errorCount       int64
-	openrestyRxBytes int64
-	openrestyTxBytes int64
-	statusCodes      map[string]int64
-	topDomains       map[string]int64
-	visitors         map[string]struct{}
-	logs             []protocol.NodeAccessLog
+	logs []protocol.NodeAccessLog
 }
 
-// BuildTrafficReport generates a traffic report using access logs or falling back to managed metrics.
-func BuildTrafficReport(cfg *config.Config, stateStore *state.Store, managed *ManagedOpenRestyMetrics) *protocol.NodeTrafficReport {
-	report, _, _ := BuildTrafficObservability(cfg, stateStore, managed)
-	return report
-}
-
-// BuildTrafficObservability returns the traffic report, parsed access logs, and managed metrics.
-func BuildTrafficObservability(cfg *config.Config, stateStore *state.Store, managed *ManagedOpenRestyMetrics) (*protocol.NodeTrafficReport, []protocol.NodeAccessLog, *ManagedOpenRestyMetrics) {
+// CollectAccessLogs tails access.log and returns L1 fact rows for the current heartbeat.
+func CollectAccessLogs(cfg *config.Config, stateStore *state.Store) []protocol.NodeAccessLog {
 	if cfg == nil || stateStore == nil {
-		if managed != nil && managed.TrafficReport != nil {
-			return managed.TrafficReport, nil, managed
-		}
-		return nil, nil, managed
+		return nil
 	}
-
 	aggregate := readAccessLogDelta(cfg, stateStore)
-	var accessLogs []protocol.NodeAccessLog
-	if aggregate != nil {
-		accessLogs = aggregate.accessLogs()
-	}
-	if managed != nil && managed.TrafficReport != nil {
-		return managed.TrafficReport, accessLogs, managed
-	}
 	if aggregate == nil {
-		return nil, accessLogs, managed
+		return nil
 	}
-	fallbackManaged := aggregate.managedMetrics()
-	return aggregate.report(), accessLogs, fallbackManaged
+	return aggregate.accessLogs()
 }
 
 func readAccessLogDelta(cfg *config.Config, stateStore *state.Store) *trafficAggregate {
@@ -149,11 +126,7 @@ func managedAccessLogPath(cfg *config.Config) string {
 }
 
 func newTrafficAggregate() *trafficAggregate {
-	return &trafficAggregate{
-		statusCodes: make(map[string]int64),
-		topDomains:  make(map[string]int64),
-		visitors:    make(map[string]struct{}),
-	}
+	return &trafficAggregate{}
 }
 
 func (aggregate *trafficAggregate) consume(line []byte) {
@@ -167,39 +140,15 @@ func (aggregate *trafficAggregate) consume(line []byte) {
 		return
 	}
 
-	if aggregate.windowStartedAt.IsZero() || record.Timestamp.Before(aggregate.windowStartedAt) {
-		aggregate.windowStartedAt = record.Timestamp
-	}
-	if aggregate.windowEndedAt.IsZero() || record.Timestamp.After(aggregate.windowEndedAt) {
-		aggregate.windowEndedAt = record.Timestamp
-	}
-
-	aggregate.requestCount++
-	if record.Status >= http.StatusInternalServerError {
-		aggregate.errorCount++
-	}
-	if record.Status > 0 {
-		aggregate.statusCodes[strconv.Itoa(record.Status)]++
-	}
-	if record.RequestLength > 0 {
-		aggregate.openrestyRxBytes += record.RequestLength
-	}
-	if record.BytesSent > 0 {
-		aggregate.openrestyTxBytes += record.BytesSent
-	}
-	if host := strings.TrimSpace(record.Host); host != "" {
-		aggregate.topDomains[host]++
-	}
-	if remoteAddr := strings.TrimSpace(record.RemoteAddr); remoteAddr != "" {
-		aggregate.visitors[remoteAddr] = struct{}{}
-	}
 	aggregate.logs = append(aggregate.logs, protocol.NodeAccessLog{
-		LoggedAtUnix: record.Timestamp.Unix(),
-		RemoteAddr:   strings.TrimSpace(record.RemoteAddr),
-		Host:         strings.TrimSpace(record.Host),
-		Path:         normalizeAccessLogPath(record.Path),
-		StatusCode:   record.Status,
-		BytesSent:    record.BytesSent,
+		LoggedAtUnix:  record.Timestamp.Unix(),
+		RemoteAddr:    strings.TrimSpace(record.RemoteAddr),
+		Host:          strings.TrimSpace(record.Host),
+		Path:          normalizeAccessLogPath(record.Path),
+		StatusCode:    record.Status,
+		BytesSent:     record.BytesSent,
+		RequestLength: record.RequestLength,
+		RequestTimeMs: record.RequestTimeMs,
 	})
 }
 
@@ -211,6 +160,7 @@ type parsedAccessLogRecord struct {
 	Status        int
 	BytesSent     int64
 	RequestLength int64
+	RequestTimeMs int64
 }
 
 func parseAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
@@ -230,6 +180,10 @@ func parseJSONAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 	if err != nil {
 		return parsedAccessLogRecord{}, false
 	}
+	requestTimeMs := int64(0)
+	if record.RequestTime > 0 {
+		requestTimeMs = int64(record.RequestTime*requestTimeSecondsToMs + roundHalfUp)
+	}
 	return parsedAccessLogRecord{
 		Timestamp:     timestamp,
 		Host:          strings.TrimSpace(record.Host),
@@ -238,6 +192,7 @@ func parseJSONAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 		Status:        record.Status,
 		BytesSent:     record.BytesSent,
 		RequestLength: record.RequestLength,
+		RequestTimeMs: requestTimeMs,
 	}, true
 }
 
@@ -262,23 +217,6 @@ func parseCombinedAccessLogRecord(raw string) (parsedAccessLogRecord, bool) {
 	}, true
 }
 
-func (aggregate *trafficAggregate) report() *protocol.NodeTrafficReport {
-	if aggregate.requestCount == 0 || aggregate.windowStartedAt.IsZero() || aggregate.windowEndedAt.IsZero() {
-		return nil
-	}
-
-	return &protocol.NodeTrafficReport{
-		WindowStartedAtUnix: aggregate.windowStartedAt.Unix(),
-		WindowEndedAtUnix:   aggregate.windowEndedAt.Unix(),
-		RequestCount:        aggregate.requestCount,
-		ErrorCount:          aggregate.errorCount,
-		UniqueVisitorCount:  int64(len(aggregate.visitors)),
-		StatusCodes:         cloneTrafficCounts(aggregate.statusCodes, 0),
-		TopDomains:          topCounts(aggregate.topDomains, trafficTopDomainsLimit),
-		SourceCountries:     map[string]int64{},
-	}
-}
-
 func (aggregate *trafficAggregate) accessLogs() []protocol.NodeAccessLog {
 	if aggregate == nil || len(aggregate.logs) == 0 {
 		return []protocol.NodeAccessLog{}
@@ -286,21 +224,6 @@ func (aggregate *trafficAggregate) accessLogs() []protocol.NodeAccessLog {
 	return append([]protocol.NodeAccessLog(nil), aggregate.logs...)
 }
 
-func (aggregate *trafficAggregate) managedMetrics() *ManagedOpenRestyMetrics {
-	if aggregate == nil {
-		return nil
-	}
-	report := aggregate.report()
-	if report == nil && aggregate.openrestyRxBytes <= 0 && aggregate.openrestyTxBytes <= 0 {
-		return nil
-	}
-	return &ManagedOpenRestyMetrics{
-		TrafficReport:    report,
-		OpenrestyRxBytes: aggregate.openrestyRxBytes,
-		OpenrestyTxBytes: aggregate.openrestyTxBytes,
-	}
-}
-
 func parseAccessLogTime(value string) (time.Time, error) {
 	trimmed := strings.TrimSpace(value)
 	if trimmed == "" {
@@ -313,35 +236,6 @@ func parseAccessLogTime(value string) (time.Time, error) {
 	return time.Parse("02/Jan/2006:15:04:05 -0700", trimmed)
 }
 
-func cloneTrafficCounts(values map[string]int64, limit int) map[string]int64 {
-	if len(values) == 0 {
-		return map[string]int64{}
-	}
-	items := make([]trafficCountItem, 0, len(values))
-	for key, value := range values {
-		items = append(items, trafficCountItem{key: key, value: value})
-	}
-	sort.Slice(items, func(i int, j int) bool {
-		if items[i].value == items[j].value {
-			return items[i].key < items[j].key
-		}
-		return items[i].value > items[j].value
-	})
-	if limit > 0 && len(items) > limit {
-		items = items[:limit]
-	}
-	result := make(map[string]int64, len(items))
-	for _, item := range items {
-		result[item.key] = item.value
-	}
-	return result
-}
-
-type trafficCountItem struct {
-	key   string
-	value int64
-}
-
 const accessLogPathMaxRunes = 100
 
 func normalizeAccessLogPath(value string) string {
@@ -365,7 +259,3 @@ func truncateAccessLogPath(value string) string {
 	}
 	return string(runes[:accessLogPathMaxRunes])
 }
-
-func topCounts(values map[string]int64, limit int) map[string]int64 {
-	return cloneTrafficCounts(values, limit)
-}

internal/apps/agent/observability/traffic_test.go

@@ -7,39 +7,33 @@ import (
 	"testing"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/config"
-	"github.com/Rain-kl/Wavelet/internal/apps/agent/protocol"
 	"github.com/Rain-kl/Wavelet/internal/apps/agent/state"
 )
 
-func TestBuildTrafficReportAggregatesManagedAccessLog(t *testing.T) {
+func TestCollectAccessLogsReturnsFactsOnly(t *testing.T) {
 	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
+	logPath := filepath.Join(tempDir, "openflare_access.log")
 	content := []byte(
-		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n" +
-			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"app.example.com\",\"path\":\"/healthz\",\"remote_addr\":\"10.0.0.2\",\"status\":503}\n" +
-			"{\"ts\":\"2026-03-14T08:00:08Z\",\"host\":\"api.example.com\",\"path\":\"/api\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n",
+		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512,\"request_time\":0.015}\n" +
+			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256,\"request_time\":0.008}\n",
 	)
 	if err := os.WriteFile(logPath, content, 0o644); err != nil {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
 
 	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	report := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil {
-		t.Fatal("expected traffic report")
+	accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
+	if len(accessLogs) != 2 {
+		t.Fatalf("expected access logs, got %+v", accessLogs)
 	}
-	if report.RequestCount != 3 || report.ErrorCount != 1 || report.UniqueVisitorCount != 2 {
-		t.Fatalf("unexpected traffic report counters: %+v", report)
+	if accessLogs[0].BytesSent != 512 || accessLogs[0].RequestLength != 128 {
+		t.Fatalf("unexpected first log: %+v", accessLogs[0])
 	}
-	if report.StatusCodes["200"] != 2 || report.StatusCodes["503"] != 1 {
-		t.Fatalf("unexpected status codes: %+v", report.StatusCodes)
+	if accessLogs[0].RequestTimeMs != 15 {
+		t.Fatalf("request_time_ms = %d, want 15", accessLogs[0].RequestTimeMs)
 	}
-	if report.TopDomains["app.example.com"] != 2 || report.TopDomains["api.example.com"] != 1 {
-		t.Fatalf("unexpected top domains: %+v", report.TopDomains)
+	if accessLogs[0].Path != "/login" || accessLogs[1].Path != "/v1/ping" {
+		t.Fatalf("unexpected access log paths: %+v", accessLogs)
 	}
 
 	snapshot, err := stateStore.Load()
@@ -50,20 +44,16 @@ func TestBuildTrafficReportAggregatesManagedAccessLog(t *testing.T) {
 		t.Fatalf("unexpected access log offset: %d", snapshot.AccessLogOffset)
 	}
 
-	secondReport := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if secondReport != nil {
-		t.Fatalf("expected no report without appended lines, got %+v", secondReport)
+	moreLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
+	if len(moreLogs) != 0 {
+		t.Fatalf("expected no new logs, got %+v", moreLogs)
 	}
 }
 
-func TestBuildTrafficReportResetsOffsetAfterTruncate(t *testing.T) {
+func TestCollectAccessLogsResetsOffsetAfterTruncate(t *testing.T) {
 	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
-	if err := os.WriteFile(logPath, []byte("{\"ts\":\"2026-03-14T09:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.3\",\"status\":200}\n"), 0o644); err != nil {
+	logPath := filepath.Join(tempDir, "openflare_access.log")
+	if err := os.WriteFile(logPath, []byte("{\"ts\":\"2026-03-14T09:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/\",\"remote_addr\":\"10.0.0.3\",\"status\":200,\"bytes_sent\":1}\n"), 0o644); err != nil {
 		t.Fatalf("WriteFile failed: %v", err)
 	}
 
@@ -72,50 +62,15 @@ func TestBuildTrafficReportResetsOffsetAfterTruncate(t *testing.T) {
 		t.Fatalf("Save failed: %v", err)
 	}
 
-	report := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil || report.RequestCount != 1 {
-		t.Fatalf("expected one request after truncate reset, got %+v", report)
+	accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
+	if len(accessLogs) != 1 {
+		t.Fatalf("expected one access log after truncate reset, got %+v", accessLogs)
 	}
 }
 
-func TestBuildTrafficObservabilityReturnsAccessLogs(t *testing.T) {
+func TestCollectAccessLogsTruncatesLongAccessLogPath(t *testing.T) {
 	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
-	content := []byte(
-		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"/login\",\"remote_addr\":\"10.0.0.1\",\"status\":200,\"request_length\":128,\"bytes_sent\":512}\n" +
-			"{\"ts\":\"2026-03-14T08:00:05Z\",\"host\":\"api.example.com\",\"path\":\"/v1/ping\",\"remote_addr\":\"10.0.0.2\",\"status\":502,\"request_length\":64,\"bytes_sent\":256}\n",
-	)
-	if err := os.WriteFile(logPath, content, 0o644); err != nil {
-		t.Fatalf("WriteFile failed: %v", err)
-	}
-
-	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	report, accessLogs, fallbackMetrics := BuildTrafficObservability(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil || report.RequestCount != 2 {
-		t.Fatalf("expected traffic report, got %+v", report)
-	}
-	if len(accessLogs) != 2 {
-		t.Fatalf("expected access logs, got %+v", accessLogs)
-	}
-	if fallbackMetrics == nil || fallbackMetrics.OpenrestyRxBytes != 192 || fallbackMetrics.OpenrestyTxBytes != 768 {
-		t.Fatalf("expected fallback throughput metrics, got %+v", fallbackMetrics)
-	}
-	if accessLogs[0].Path != "/login" || accessLogs[1].Path != "/v1/ping" {
-		t.Fatalf("unexpected access log paths: %+v", accessLogs)
-	}
-}
-
-func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
-	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
+	logPath := filepath.Join(tempDir, "openflare_access.log")
 	longPath := "/" + strings.Repeat("a", 140)
 	content := []byte(
 		"{\"ts\":\"2026-03-14T08:00:00Z\",\"host\":\"app.example.com\",\"path\":\"" + longPath + "\",\"remote_addr\":\"10.0.0.1\",\"status\":200}\n",
@@ -125,7 +80,7 @@ func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
 	}
 
 	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	_, accessLogs, _ := BuildTrafficObservability(&config.Config{AccessLogPath: logPath}, stateStore, nil)
+	accessLogs := CollectAccessLogs(&config.Config{AccessLogPath: logPath}, stateStore)
 	if len(accessLogs) != 1 {
 		t.Fatalf("expected one access log, got %+v", accessLogs)
 	}
@@ -133,56 +88,3 @@ func TestBuildTrafficObservabilityTruncatesLongAccessLogPath(t *testing.T) {
 		t.Fatalf("expected truncated path length %d, got %d (%q)", accessLogPathMaxRunes, got, accessLogs[0].Path)
 	}
 }
-
-func TestBuildTrafficReportParsesCombinedAccessLog(t *testing.T) {
-	tempDir := t.TempDir()
-	routeConfigPath := filepath.Join(tempDir, "conf.d", "openflare_routes.conf")
-	if err := os.MkdirAll(filepath.Dir(routeConfigPath), 0o755); err != nil {
-		t.Fatalf("MkdirAll failed: %v", err)
-	}
-	logPath := filepath.Join(filepath.Dir(routeConfigPath), "openflare_access.log")
-	content := []byte(
-		"10.0.0.1 - - [14/Mar/2026:08:00:00 +0000] \"GET / HTTP/1.1\" 200 123 \"-\" \"curl/8.0\"\n" +
-			"10.0.0.2 - - [14/Mar/2026:08:00:05 +0000] \"GET /healthz HTTP/1.1\" 502 64 \"-\" \"curl/8.0\"\n" +
-			"10.0.0.1 - - [14/Mar/2026:08:00:10 +0000] \"GET /api HTTP/1.1\" 200 256 \"-\" \"curl/8.0\"\n",
-	)
-	if err := os.WriteFile(logPath, content, 0o644); err != nil {
-		t.Fatalf("WriteFile failed: %v", err)
-	}
-
-	stateStore := state.NewStore(filepath.Join(tempDir, "state.json"))
-	report := BuildTrafficReport(&config.Config{AccessLogPath: logPath}, stateStore, nil)
-	if report == nil {
-		t.Fatal("expected traffic report from combined access log")
-	}
-	if report.RequestCount != 3 || report.ErrorCount != 1 || report.UniqueVisitorCount != 2 {
-		t.Fatalf("unexpected combined log counters: %+v", report)
-	}
-	if report.StatusCodes["200"] != 2 || report.StatusCodes["502"] != 1 {
-		t.Fatalf("unexpected combined log status codes: %+v", report.StatusCodes)
-	}
-	if len(report.TopDomains) != 0 {
-		t.Fatalf("expected combined access log to omit top domains when host is unavailable, got %+v", report.TopDomains)
-	}
-}
-
-func TestBuildTrafficReportReturnsManagedWindowEvenWhenRequestCountZero(t *testing.T) {
-	report := BuildTrafficReport(nil, nil, &ManagedOpenRestyMetrics{
-		TrafficReport: &protocol.NodeTrafficReport{
-			WindowStartedAtUnix: 1710403200,
-			WindowEndedAtUnix:   1710403260,
-			RequestCount:        0,
-			ErrorCount:          0,
-			UniqueVisitorCount:  0,
-			StatusCodes:         map[string]int64{},
-			TopDomains:          map[string]int64{},
-			SourceCountries:     map[string]int64{},
-		},
-	})
-	if report == nil {
-		t.Fatal("expected managed traffic report to be returned even when request count is zero")
-	}
-	if report.RequestCount != 0 || report.WindowStartedAtUnix != 1710403200 || report.WindowEndedAtUnix != 1710403260 {
-		t.Fatalf("unexpected managed traffic report: %+v", report)
-	}
-}