feat(obs): 访问日志 SSOT 与 edge_health，去掉协议兼容层

Agent 仅上报 host_metrics/edge_health/access_logs；业务流量与 UV 由 Server 侧访问日志聚合。新增 of_node_edge_health 与 of_access_log_hourly，删除 request_reports/openresty 吞吐路径；API 不再暴露 traffic_reports 与 openresty_rx|tx。心跳/离线默认阈值与回填迁移一并入库。
2026-10-04 23:16:37 +08:00 · 2026-07-18 11:53:11 +08:00
parent 9a0974cce8
commit f0e234df1f
60 changed files with 1799 additions and 2164 deletions
@@ -16,6 +16,7 @@ const (
 	maxAccessLogPageSize       = 200
 	defaultAccessLogSortBy     = "logged_at"
 	defaultAccessLogSortOrder  = "desc"
+	accessLogSortOrderAsc      = "asc"
 	defaultAccessLogFoldMinute = 3
 	defaultIPTrendHours        = 24
 	defaultIPTrendBucketMinute = 30
@@ -605,8 +606,8 @@ func normalizeAccessLogSortBy(sortBy string) string {
 }

 func normalizeAccessLogSortOrder(sortOrder string) string {
-	if strings.EqualFold(strings.TrimSpace(sortOrder), "asc") {
-		return "asc"
+	if strings.EqualFold(strings.TrimSpace(sortOrder), accessLogSortOrderAsc) {
+		return accessLogSortOrderAsc
 	}
 	return defaultAccessLogSortOrder
 }
@@ -5,7 +5,6 @@ package observability

 import (
 	"context"
-	"encoding/json"
 	"sort"
 	"strings"
 	"time"
@@ -22,6 +21,7 @@ const (
 	healthSeverityCritical    = "critical"
 	healthSeverityWarning     = "warning"
 	percentageMultiplier      = 100
+	sortOrderAsc              = "asc"
 )

 // DistributionItem is a key/value distribution entry.
@@ -37,9 +37,9 @@ type TrafficDistributions struct {
 	SourceCountries []DistributionItem `json:"source_countries"`
 }

-const metricSnapshotOpenrestyMatchWindow = 2 * time.Minute
+const metricSnapshotEdgeHealthMatchWindow = 2 * time.Minute

-// NodeMetricSnapshotView is a metric snapshot enriched with OpenResty observations.
+// NodeMetricSnapshotView is a metric snapshot enriched with edge health connections.
 type NodeMetricSnapshotView struct {
 	ID                   uint      `json:"id,omitempty"`
 	NodeID               string    `json:"node_id,omitempty"`
@@ -53,8 +53,6 @@ type NodeMetricSnapshotView struct {
 	DiskWriteBytes       int64     `json:"disk_write_bytes"`
 	NetworkRxBytes       int64     `json:"network_rx_bytes"`
 	NetworkTxBytes       int64     `json:"network_tx_bytes"`
-	OpenrestyRxBytes     int64     `json:"openresty_rx_bytes"`
-	OpenrestyTxBytes     int64     `json:"openresty_tx_bytes"`
 	OpenrestyConnections int64     `json:"openresty_connections"`
 }

@@ -98,13 +96,15 @@ type CapacityTrendPoint struct {
 }

 // NetworkTrendPoint is a network trend bucket.
+// Host network_* is L3 (宿主机网卡).
+// bytes_received/provided are L1 business bytes from access logs.
 type NetworkTrendPoint struct {
-	BucketStartedAt  time.Time `json:"bucket_started_at"`
-	NetworkRxBytes   int64     `json:"network_rx_bytes"`
-	NetworkTxBytes   int64     `json:"network_tx_bytes"`
-	OpenrestyRxBytes int64     `json:"openresty_rx_bytes"`
-	OpenrestyTxBytes int64     `json:"openresty_tx_bytes"`
-	ReportedNodes    int       `json:"reported_nodes"`
+	BucketStartedAt time.Time `json:"bucket_started_at"`
+	NetworkRxBytes  int64     `json:"network_rx_bytes"`
+	NetworkTxBytes  int64     `json:"network_tx_bytes"`
+	BytesReceived   int64     `json:"bytes_received"` // sum(request_length)
+	BytesProvided   int64     `json:"bytes_provided"` // sum(bytes_sent)
+	ReportedNodes   int       `json:"reported_nodes"`
 }

 // DiskIOTrendPoint is a disk IO trend bucket.
@@ -141,30 +141,39 @@ type networkCounterState struct {
 	seen bool
 }

-func buildTrafficWindowSummary(report *model.OpenFlareRequestReport) *TrafficWindowSummary {
-	if report == nil {
+func buildTrafficWindowSummaryFromAccessLogs(
+	ctx context.Context,
+	nodeID string,
+	since, until time.Time,
+) *TrafficWindowSummary {
+	row, err := model.TrafficSummaryOpenFlareAccessLogs(ctx, model.OpenFlareAccessLogQuery{
+		NodeID: nodeID,
+		Since:  since,
+		Until:  until,
+	})
+	if err != nil || row.RequestCount <= 0 {
 		return nil
 	}
-	summary := TrafficWindowSummary{
-		WindowStartedAt:    report.WindowStartedAt,
-		WindowEndedAt:      report.WindowEndedAt,
-		RequestCount:       report.RequestCount,
-		UniqueVisitorCount: report.UniqueVisitorCount,
-		ErrorCount:         report.ErrorCount,
+	summary := &TrafficWindowSummary{
+		WindowStartedAt:    since.UTC(),
+		WindowEndedAt:      until.UTC(),
+		RequestCount:       row.RequestCount,
+		UniqueVisitorCount: row.UniqueIPCount,
+		ErrorCount:         row.ErrorCount,
 	}
-	if duration := report.WindowEndedAt.Sub(report.WindowStartedAt).Seconds(); duration > 0 {
-		summary.EstimatedQPS = float64(report.RequestCount) / duration
+	if duration := until.Sub(since).Seconds(); duration > 0 {
+		summary.EstimatedQPS = float64(row.RequestCount) / duration
 	}
-	if report.RequestCount > 0 {
-		summary.ErrorRatePercent = (float64(report.ErrorCount) / float64(report.RequestCount)) * 100
+	if row.RequestCount > 0 {
+		summary.ErrorRatePercent = (float64(row.ErrorCount) / float64(row.RequestCount)) * 100
 	}
-	return &summary
+	return summary
 }

-// BuildMetricSnapshotViews merges metric snapshots with OpenResty observations for API responses.
+// BuildMetricSnapshotViews merges metric snapshots with edge health connections for API responses.
 func BuildMetricSnapshotViews(
 	snapshots []*model.OpenFlareMetricSnapshot,
-	openrestyObs []*model.OpenFlareNodeObservationOpenresty,
+	edgeHealth []*model.OpenFlareEdgeHealth,
 ) []*NodeMetricSnapshotView {
 	if len(snapshots) == 0 {
 		return []*NodeMetricSnapshotView{}
@@ -188,40 +197,49 @@ func BuildMetricSnapshotViews(
 			NetworkRxBytes:    snapshot.NetworkRxBytes,
 			NetworkTxBytes:    snapshot.NetworkTxBytes,
 		}
-		if matched := matchOpenrestyObservation(snapshot.CapturedAt, openrestyObs); matched != nil {
-			view.OpenrestyRxBytes = matched.OpenrestyRxBytes
-			view.OpenrestyTxBytes = matched.OpenrestyTxBytes
-			view.OpenrestyConnections = matched.OpenrestyConnections
+		if matched := matchEdgeHealth(snapshot.CapturedAt, edgeHealth); matched != nil {
+			view.OpenrestyConnections = matched.Connections
 		}
 		views = append(views, view)
 	}
 	return views
 }

-// BuildTrafficDistributions aggregates traffic distribution charts.
-func BuildTrafficDistributions(
-	reports []*model.OpenFlareRequestReport,
-	accessLogRegions []*model.OpenFlareAccessLogRegionCount,
+// BuildTrafficDistributionsFromAccessLogs builds distributions from access logs (L1).
+func BuildTrafficDistributionsFromAccessLogs(
+	ctx context.Context,
+	since, until time.Time,
 	limit int,
+	accessLogRegions []*model.OpenFlareAccessLogRegionCount,
 ) TrafficDistributions {
 	statusCodes := make(distributionAccumulator)
 	topDomains := make(distributionAccumulator)
-	reportSourceCountries := make(distributionAccumulator)
-	for _, report := range reports {
-		mergeJSONCounts(statusCodes, report.StatusCodesJSON)
-		mergeJSONCounts(topDomains, report.TopDomainsJSON)
-		mergeJSONCounts(reportSourceCountries, report.SourceCountriesJSON)
-	}
-	sourceCountries := reportSourceCountries
-	if len(accessLogRegions) > 0 {
-		sourceCountries = make(distributionAccumulator, len(accessLogRegions))
-		for _, item := range accessLogRegions {
-			if item == nil || strings.TrimSpace(item.Region) == "" || item.Count <= 0 {
+
+	query := model.OpenFlareAccessLogQuery{Since: since, Until: until}
+	if statusRows, err := model.ValueCountsOpenFlareAccessLogs(ctx, query, "status_code", limit); err == nil {
+		for _, row := range statusRows {
+			if strings.TrimSpace(row.Value) == "" || row.Count <= 0 {
 				continue
 			}
-			sourceCountries[item.Region] = item.Count
+			statusCodes[row.Value] = row.Count
 		}
 	}
+	if hostRows, err := model.ValueCountsOpenFlareAccessLogs(ctx, query, "host", limit); err == nil {
+		for _, row := range hostRows {
+			if strings.TrimSpace(row.Value) == "" || row.Count <= 0 {
+				continue
+			}
+			topDomains[row.Value] = row.Count
+		}
+	}
+
+	sourceCountries := make(distributionAccumulator)
+	for _, item := range accessLogRegions {
+		if item == nil || strings.TrimSpace(item.Region) == "" || item.Count <= 0 {
+			continue
+		}
+		sourceCountries[item.Region] = item.Count
+	}
 	return TrafficDistributions{
 		StatusCodes:     toDistributionItems(statusCodes, limit),
 		TopDomains:      toDistributionItems(topDomains, limit),
@@ -231,7 +249,7 @@ func BuildTrafficDistributions(

 func buildHealthSummary(
 	snapshot *model.OpenFlareMetricSnapshot,
-	report *model.OpenFlareRequestReport,
+	traffic *TrafficWindowSummary,
 	events []*model.OpenFlareHealthEvent,
 ) HealthSummary {
 	summary := HealthSummary{}
@@ -258,41 +276,37 @@ func buildHealthSummary(
 		storageUsage := Percentage(snapshot.StorageUsedBytes, snapshot.StorageTotalBytes)
 		summary.HasCapacityRisk = snapshot.CPUUsagePercent >= 80 || memoryUsage >= 85 || storageUsage >= 85
 	}
-	if report != nil && report.RequestCount >= 100 {
-		summary.HasTrafficRisk = (float64(report.ErrorCount) / float64(report.RequestCount)) >= 0.05
+	if traffic != nil && traffic.RequestCount >= 100 {
+		summary.HasTrafficRisk = (float64(traffic.ErrorCount) / float64(traffic.RequestCount)) >= 0.05
 	}
 	summary.HasRuntimeRisk = summary.ActiveAlerts > 0 || summary.HasCapacityRisk || summary.HasTrafficRisk
 	return summary
 }

-// BuildNodeTrends builds 24h trend series, preferring ClickHouse hourly aggregates
-// over limited raw snapshot windows so capacity/network/disk charts stay complete.
+// BuildNodeTrends builds 24h trend series.
+// Business traffic (requests/errors/UV and provided/received bytes) comes from access logs.
+// Host capacity/disk/network come from metric snapshots (hourly when available).
 func BuildNodeTrends(
 	ctx context.Context,
 	now time.Time,
 	nodeID string,
 	snapshots []*model.OpenFlareMetricSnapshot,
-	openrestyObs []*model.OpenFlareNodeObservationOpenresty,
-	reports []*model.OpenFlareRequestReport,
 ) NodeTrends {
 	trendSince := now.Add(-24 * time.Hour)
-	trafficTrend := BuildTrafficTrendPoints(now, reports)
-	if trafficHourly, err := model.ListOpenFlareTrafficHourlySince(ctx, nodeID, trendSince); err == nil && len(trafficHourly) > 0 {
-		trafficTrend = BuildTrafficTrendPointsFromHourly(now, trafficHourly)
-	}

+	trafficTrend := BuildTrafficTrendPointsFromAccessLogs(ctx, now, nodeID, trendSince)
 	capacityTrend := BuildCapacityTrendPoints(now, snapshots)
-	networkTrend := BuildNetworkTrendPoints(now, snapshots, openrestyObs)
+	networkTrend := BuildNetworkTrendPoints(now, snapshots)
+	// Overlay L1 business bytes onto network points.
+	applyAccessLogBytesToNetworkTrend(ctx, now, nodeID, trendSince, networkTrend)
 	diskIOTrend := BuildDiskIOTrendPoints(now, snapshots)

 	metricHourly, metricErr := model.ListOpenFlareMetricHourlySince(ctx, nodeID, trendSince)
 	if metricErr == nil && len(metricHourly) > 0 {
 		capacityTrend = BuildCapacityTrendPointsFromHourly(now, metricHourly)
 		diskIOTrend = BuildDiskIOTrendPointsFromHourly(now, metricHourly)
-	}
-	openrestyHourly, openrestyErr := model.ListOpenFlareOpenrestyHourlySince(ctx, nodeID, trendSince)
-	if metricErr == nil && openrestyErr == nil && (len(metricHourly) > 0 || len(openrestyHourly) > 0) {
-		networkTrend = BuildNetworkTrendPointsFromHourly(now, metricHourly, openrestyHourly)
+		networkTrend = BuildNetworkTrendPointsFromHourly(now, metricHourly)
+		applyAccessLogBytesToNetworkTrend(ctx, now, nodeID, trendSince, networkTrend)
 	}

 	return NodeTrends{
@@ -303,7 +317,131 @@ func BuildNodeTrends(
 	}
 }

+// BuildTrafficTrendPointsFromAccessLogs builds 24h request/error buckets from access logs.
+// Prefers of_access_log_hourly when available; falls back to raw bucket aggregates.
+// UniqueVisitorCount on hourly path is 0 (use TrafficSummary for exact UV).
+func BuildTrafficTrendPointsFromAccessLogs(ctx context.Context, now time.Time, nodeID string, since time.Time) []TrafficTrendPoint {
+	start := trendWindowStart(now)
+	points := make([]TrafficTrendPoint, observabilityTrendBuckets)
+	for index := range points {
+		points[index].BucketStartedAt = start.Add(time.Duration(index) * time.Hour)
+	}
+
+	if hourly, err := model.ListOpenFlareTrafficHourlySince(ctx, nodeID, since); err == nil && len(hourly) > 0 {
+		for _, row := range hourly {
+			if row == nil {
+				continue
+			}
+			index, ok := trendBucketIndex(row.Hour, start)
+			if !ok {
+				continue
+			}
+			points[index].RequestCount += row.RequestCount
+			points[index].ErrorCount += row.ErrorCount
+			// UniqueVisitorCount intentionally not summed from hourly rollup (always 0 / overcounts).
+		}
+		return points
+	}
+
+	buckets, err := model.ListOpenFlareAccessLogBuckets(ctx, model.OpenFlareAccessLogBucketQuery{
+		NodeID:      nodeID,
+		Since:       since,
+		Until:       now,
+		FoldMinutes: 60,
+		SortBy:      "logged_at",
+		SortOrder:   sortOrderAsc,
+	})
+	if err != nil || len(buckets) == 0 {
+		return points
+	}
+	byEpoch := make(map[int64]*model.OpenFlareAccessLogBucketRow, len(buckets))
+	for _, row := range buckets {
+		if row == nil {
+			continue
+		}
+		byEpoch[row.BucketEpoch] = row
+	}
+	for index := range points {
+		epoch := points[index].BucketStartedAt.Unix()
+		if row, ok := byEpoch[epoch]; ok {
+			points[index].RequestCount = row.RequestCount
+			points[index].ErrorCount = row.ServerErrorCount
+			points[index].UniqueVisitorCount = row.UniqueIPCount
+		}
+	}
+	return points
+}
+
+func applyAccessLogBytesToNetworkTrend(ctx context.Context, now time.Time, nodeID string, since time.Time, points []NetworkTrendPoint) {
+	if len(points) == 0 {
+		return
+	}
+	// Prefer of_access_log_hourly (summed across hosts).
+	if hourly, err := analyticsListAccessLogHourlyBytes(ctx, nodeID, since); err == nil && len(hourly) > 0 {
+		for hourUnix, totals := range hourly {
+			for index := range points {
+				if points[index].BucketStartedAt.Unix() == hourUnix {
+					points[index].BytesProvided = totals.provided
+					points[index].BytesReceived = totals.received
+				}
+			}
+		}
+		return
+	}
+
+	buckets, err := model.ListOpenFlareAccessLogBuckets(ctx, model.OpenFlareAccessLogBucketQuery{
+		NodeID:      nodeID,
+		Since:       since,
+		Until:       now,
+		FoldMinutes: 60,
+		SortBy:      "logged_at",
+		SortOrder:   sortOrderAsc,
+	})
+	if err != nil || len(buckets) == 0 {
+		return
+	}
+	byEpoch := make(map[int64]*model.OpenFlareAccessLogBucketRow, len(buckets))
+	for _, row := range buckets {
+		if row == nil {
+			continue
+		}
+		byEpoch[row.BucketEpoch] = row
+	}
+	for index := range points {
+		epoch := points[index].BucketStartedAt.Unix()
+		if row, ok := byEpoch[epoch]; ok {
+			points[index].BytesProvided = row.BytesSent
+			points[index].BytesReceived = row.RequestLength
+		}
+	}
+}
+
+type accessLogHourBytes struct {
+	provided int64
+	received int64
+}
+
+func analyticsListAccessLogHourlyBytes(ctx context.Context, nodeID string, since time.Time) (map[int64]accessLogHourBytes, error) {
+	rows, err := model.ListOpenFlareAccessLogHourlySince(ctx, nodeID, since)
+	if err != nil {
+		return nil, err
+	}
+	out := make(map[int64]accessLogHourBytes)
+	for _, row := range rows {
+		if row == nil {
+			continue
+		}
+		key := row.Hour.UTC().Truncate(time.Hour).Unix()
+		cur := out[key]
+		cur.provided += row.BytesSent
+		cur.received += row.RequestLength
+		out[key] = cur
+	}
+	return out, nil
+}
+
 // BuildTrafficTrendPointsFromHourly builds 24h traffic trend buckets from hourly rollups.
+// UniqueVisitorCount is left at 0: hourly UV is not summed (use TrafficSummary for exact UV).
 func BuildTrafficTrendPointsFromHourly(now time.Time, hourly []*model.OpenFlareTrafficHourly) []TrafficTrendPoint {
 	start := trendWindowStart(now)
 	points := make([]TrafficTrendPoint, observabilityTrendBuckets)
@@ -320,26 +458,6 @@ func BuildTrafficTrendPointsFromHourly(now time.Time, hourly []*model.OpenFlareT
 		}
 		points[index].RequestCount += row.RequestCount
 		points[index].ErrorCount += row.ErrorCount
-		points[index].UniqueVisitorCount += row.UniqueVisitorCount
-	}
-	return points
-}
-
-// BuildTrafficTrendPoints builds 24h traffic trend buckets.
-func BuildTrafficTrendPoints(now time.Time, reports []*model.OpenFlareRequestReport) []TrafficTrendPoint {
-	start := trendWindowStart(now)
-	points := make([]TrafficTrendPoint, observabilityTrendBuckets)
-	for index := range points {
-		points[index].BucketStartedAt = start.Add(time.Duration(index) * time.Hour)
-	}
-	for _, report := range reports {
-		index, ok := trendBucketIndex(report.WindowEndedAt, start)
-		if !ok {
-			continue
-		}
-		points[index].RequestCount += report.RequestCount
-		points[index].ErrorCount += report.ErrorCount
-		points[index].UniqueVisitorCount += report.UniqueVisitorCount
 	}
 	return points
 }
@@ -404,12 +522,12 @@ func BuildCapacityTrendPointsFromHourly(now time.Time, hourly []*model.OpenFlare
 	return points
 }

-// BuildNetworkTrendPoints builds 24h network trend buckets.
-// Host and OpenResty counters are cumulative; values are consecutive deltas.
+// BuildNetworkTrendPoints builds 24h host-network trend buckets.
+// Host network counters must be process-lifetime cumulative values; this function
+// converts consecutive samples into deltas.
 func BuildNetworkTrendPoints(
 	now time.Time,
 	snapshots []*model.OpenFlareMetricSnapshot,
-	openrestyObs []*model.OpenFlareNodeObservationOpenresty,
 ) []NetworkTrendPoint {
 	start := trendWindowStart(now)
 	points := make([]NetworkTrendPoint, observabilityTrendBuckets)
@@ -452,51 +570,17 @@ func BuildNetworkTrendPoints(
 			accumulators[index].nodes[snapshot.NodeID] = struct{}{}
 		}
 	}
-	sort.Slice(openrestyObs, func(i int, j int) bool {
-		if openrestyObs[i].CapturedAt.Equal(openrestyObs[j].CapturedAt) {
-			return openrestyObs[i].NodeID < openrestyObs[j].NodeID
-		}
-		return openrestyObs[i].CapturedAt.Before(openrestyObs[j].CapturedAt)
-	})
-	previousOpenrestyByNode := make(map[string]networkCounterState, len(openrestyObs))
-	for _, obs := range openrestyObs {
-		if obs == nil {
-			continue
-		}
-		nodeKey := obs.NodeID
-		if nodeKey == "" {
-			nodeKey = unknownTrendNodeKey
-		}
-		previous := previousOpenrestyByNode[nodeKey]
-		previousOpenrestyByNode[nodeKey] = networkCounterState{
-			rx:   obs.OpenrestyRxBytes,
-			tx:   obs.OpenrestyTxBytes,
-			seen: true,
-		}
-		if !previous.seen {
-			continue
-		}
-		index, ok := trendBucketIndex(obs.CapturedAt, start)
-		if !ok {
-			continue
-		}
-		points[index].OpenrestyRxBytes += nonNegativeDelta(obs.OpenrestyRxBytes, previous.rx)
-		points[index].OpenrestyTxBytes += nonNegativeDelta(obs.OpenrestyTxBytes, previous.tx)
-		if obs.NodeID != "" {
-			accumulators[index].nodes[obs.NodeID] = struct{}{}
-		}
-	}
 	for index := range points {
 		points[index].ReportedNodes = len(accumulators[index].nodes)
 	}
 	return points
 }

-// BuildNetworkTrendPointsFromHourly builds 24h network trend buckets from hourly aggregates.
+// BuildNetworkTrendPointsFromHourly builds 24h host-network trend buckets from metric hourly aggregates.
+// Business bytes (已提供/接收) are applied separately via applyAccessLogBytesToNetworkTrend.
 func BuildNetworkTrendPointsFromHourly(
 	now time.Time,
 	metricHourly []*model.OpenFlareMetricHourly,
-	openrestyHourly []*model.OpenFlareOpenrestyHourly,
 ) []NetworkTrendPoint {
 	start := trendWindowStart(now)
 	points := make([]NetworkTrendPoint, observabilityTrendBuckets)
@@ -517,20 +601,6 @@ func BuildNetworkTrendPointsFromHourly(
 			points[index].ReportedNodes = row.ReportedNodes
 		}
 	}
-	for _, row := range openrestyHourly {
-		if row == nil {
-			continue
-		}
-		index, ok := trendBucketIndex(row.Hour, start)
-		if !ok {
-			continue
-		}
-		points[index].OpenrestyRxBytes += row.OpenrestyRxBytes
-		points[index].OpenrestyTxBytes += row.OpenrestyTxBytes
-		if row.ReportedNodes > points[index].ReportedNodes {
-			points[index].ReportedNodes = row.ReportedNodes
-		}
-	}
 	return points
 }

@@ -623,38 +693,25 @@ func latestMetricSnapshot(snapshots []*model.OpenFlareMetricSnapshot) *model.Ope
 	return latest
 }

-func latestTrafficReport(reports []*model.OpenFlareRequestReport) *model.OpenFlareRequestReport {
-	var latest *model.OpenFlareRequestReport
-	for _, report := range reports {
-		if report == nil {
-			continue
-		}
-		if latest == nil || report.WindowEndedAt.After(latest.WindowEndedAt) {
-			latest = report
-		}
-	}
-	return latest
-}
-
-func matchOpenrestyObservation(
+func matchEdgeHealth(
 	capturedAt time.Time,
-	observations []*model.OpenFlareNodeObservationOpenresty,
-) *model.OpenFlareNodeObservationOpenresty {
-	var matched *model.OpenFlareNodeObservationOpenresty
-	bestDelta := metricSnapshotOpenrestyMatchWindow + time.Second
-	for _, observation := range observations {
-		if observation == nil {
+	health []*model.OpenFlareEdgeHealth,
+) *model.OpenFlareEdgeHealth {
+	var matched *model.OpenFlareEdgeHealth
+	bestDelta := metricSnapshotEdgeHealthMatchWindow + time.Second
+	for _, row := range health {
+		if row == nil {
 			continue
 		}
-		delta := capturedAt.Sub(observation.CapturedAt)
+		delta := capturedAt.Sub(row.CapturedAt)
 		if delta < 0 {
 			delta = -delta
 		}
-		if delta > metricSnapshotOpenrestyMatchWindow {
+		if delta > metricSnapshotEdgeHealthMatchWindow {
 			continue
 		}
 		if matched == nil || delta < bestDelta {
-			matched = observation
+			matched = row
 			bestDelta = delta
 		}
 	}
@@ -676,21 +733,6 @@ func LatestMetricSnapshotsByNode(snapshots []*model.OpenFlareMetricSnapshot) map
 	return result
 }

-// LatestTrafficReportsByNode returns the latest traffic report per node.
-func LatestTrafficReportsByNode(reports []*model.OpenFlareRequestReport) map[string]*model.OpenFlareRequestReport {
-	result := make(map[string]*model.OpenFlareRequestReport, len(reports))
-	for _, report := range reports {
-		if report == nil || report.NodeID == "" {
-			continue
-		}
-		if existing, ok := result[report.NodeID]; ok && !report.WindowEndedAt.After(existing.WindowEndedAt) {
-			continue
-		}
-		result[report.NodeID] = report
-	}
-	return result
-}
-
 // ActiveHealthEventsByNode groups active health events by node id.
 func ActiveHealthEventsByNode(events []*model.OpenFlareHealthEvent) map[string][]*model.OpenFlareHealthEvent {
 	result := make(map[string][]*model.OpenFlareHealthEvent)
@@ -711,30 +753,6 @@ func Percentage(used int64, total int64) float64 {
 	return (float64(used) / float64(total)) * percentageMultiplier
 }

-func mergeJSONCounts(target distributionAccumulator, raw string) {
-	if len(target) == 0 && strings.TrimSpace(raw) == "" {
-		return
-	}
-	values := parseJSONCounts(raw)
-	for key, value := range values {
-		if strings.TrimSpace(key) == "" || value <= 0 {
-			continue
-		}
-		target[key] += value
-	}
-}
-
-func parseJSONCounts(raw string) map[string]int64 {
-	if strings.TrimSpace(raw) == "" {
-		return nil
-	}
-	values := make(map[string]int64)
-	if err := json.Unmarshal([]byte(raw), &values); err != nil {
-		return nil
-	}
-	return values
-}
-
 func toDistributionItems(values distributionAccumulator, limit int) []DistributionItem {
 	if len(values) == 0 {
 		return []DistributionItem{}
@@ -25,52 +25,25 @@ func TestBuildTrafficTrendPointsFromHourlyBucketsByHour(t *testing.T) {
 	if len(points) != observabilityTrendBuckets {
 		t.Fatalf("BuildTrafficTrendPointsFromHourly() len = %d, want %d", len(points), observabilityTrendBuckets)
 	}
-}
-
-func TestBuildTrafficTrendPointsBucketsByHour(t *testing.T) {
-	t.Parallel()
-
-	now := time.Date(2026, 6, 19, 17, 30, 0, 0, time.UTC)
-	reports := []*model.OpenFlareRequestReport{
-		{
-			NodeID:          "node-a",
-			WindowStartedAt: now.Add(-3 * time.Hour),
-			WindowEndedAt:   now.Add(-3*time.Hour + time.Minute),
-			RequestCount:    10,
-			ErrorCount:      1,
-		},
-		{
-			NodeID:          "node-a",
-			WindowStartedAt: now.Add(-30 * time.Minute),
-			WindowEndedAt:   now.Add(-29 * time.Minute),
-			RequestCount:    6,
-			ErrorCount:      0,
-		},
-	}
-
-	points := BuildTrafficTrendPoints(now, reports)
-	if len(points) != observabilityTrendBuckets {
-		t.Fatalf("BuildTrafficTrendPoints() len = %d, want %d", len(points), observabilityTrendBuckets)
-	}
-
-	var totalRequests int64
+	// Hourly UV must not be summed into trend points.
 	for _, point := range points {
-		totalRequests += point.RequestCount
+		if point.UniqueVisitorCount != 0 {
+			t.Fatalf("UniqueVisitorCount = %d, want 0 on hourly path", point.UniqueVisitorCount)
+		}
 	}
-	if totalRequests != 16 {
-		t.Fatalf("total request_count = %d, want 16", totalRequests)
+	index, ok := trendBucketIndex(now.Add(-2*time.Hour).Truncate(time.Hour), trendWindowStart(now))
+	if !ok {
+		t.Fatal("expected valid bucket index")
 	}
-
-	currentHour := points[len(points)-1]
-	if currentHour.RequestCount != 6 {
-		t.Fatalf("current hour request_count = %d, want 6", currentHour.RequestCount)
+	if points[index].RequestCount != 12 {
+		t.Fatalf("request_count = %d, want 12", points[index].RequestCount)
 	}
-	if currentHour.ErrorCount != 0 {
-		t.Fatalf("current hour error_count = %d, want 0", currentHour.ErrorCount)
+	if points[index].ErrorCount != 1 {
+		t.Fatalf("error_count = %d, want 1", points[index].ErrorCount)
 	}
 }

-func TestBuildMetricSnapshotViewsMergesOpenrestyObservation(t *testing.T) {
+func TestBuildMetricSnapshotViewsMergesEdgeHealthConnections(t *testing.T) {
 	t.Parallel()

 	capturedAt := time.Date(2026, 6, 19, 12, 0, 0, 0, time.UTC)
@@ -82,54 +55,30 @@ func TestBuildMetricSnapshotViewsMergesOpenrestyObservation(t *testing.T) {
 			CPUUsagePercent: 12.5,
 		},
 	}
-	openrestyObs := []*model.OpenFlareNodeObservationOpenresty{
+	edgeHealth := []*model.OpenFlareEdgeHealth{
 		{
-			NodeID:               "node-a",
-			CapturedAt:           capturedAt.Add(5 * time.Second),
-			OpenrestyRxBytes:     4096,
-			OpenrestyTxBytes:     8192,
-			OpenrestyConnections: 7,
+			NodeID:      "node-a",
+			CapturedAt:  capturedAt.Add(5 * time.Second),
+			Status:      "healthy",
+			Connections: 7,
 		},
 	}

-	views := BuildMetricSnapshotViews(snapshots, openrestyObs)
+	views := BuildMetricSnapshotViews(snapshots, edgeHealth)
 	if len(views) != 1 {
 		t.Fatalf("BuildMetricSnapshotViews() len = %d, want 1", len(views))
 	}
-	if views[0].OpenrestyRxBytes != 4096 {
-		t.Fatalf("OpenrestyRxBytes = %d, want 4096", views[0].OpenrestyRxBytes)
-	}
-	if views[0].OpenrestyTxBytes != 8192 {
-		t.Fatalf("OpenrestyTxBytes = %d, want 8192", views[0].OpenrestyTxBytes)
-	}
 	if views[0].OpenrestyConnections != 7 {
 		t.Fatalf("OpenrestyConnections = %d, want 7", views[0].OpenrestyConnections)
 	}
 }

-func TestLatestTrafficReportUsesLatestWindowEndedAt(t *testing.T) {
+func TestBuildTrafficWindowSummaryFromAccessLogsNilWithoutData(t *testing.T) {
 	t.Parallel()

-	older := &model.OpenFlareRequestReport{
-		WindowEndedAt: time.Date(2026, 6, 19, 10, 0, 0, 0, time.UTC),
-		RequestCount:  3,
-	}
-	newer := &model.OpenFlareRequestReport{
-		WindowEndedAt: time.Date(2026, 6, 19, 11, 0, 0, 0, time.UTC),
-		RequestCount:  9,
-	}
-
-	latest := latestTrafficReport([]*model.OpenFlareRequestReport{older, newer})
-	if latest == nil || latest.RequestCount != 9 {
-		t.Fatalf("latestTrafficReport() = %#v, want newer report with request_count 9", latest)
-	}
-}
-
-func TestBuildTrafficWindowSummaryNilWithoutReport(t *testing.T) {
-	t.Parallel()
-
-	if summary := buildTrafficWindowSummary(nil); summary != nil {
-		t.Fatalf("buildTrafficWindowSummary(nil) = %#v, want nil", summary)
+	// Without an access-log store / data, summary is nil.
+	if summary := buildTrafficWindowSummaryFromAccessLogs(t.Context(), "missing", time.Now().Add(-time.Hour), time.Now()); summary != nil {
+		t.Fatalf("buildTrafficWindowSummaryFromAccessLogs() = %#v, want nil", summary)
 	}
 }

@@ -173,12 +122,8 @@ func TestBuildNetworkTrendPointsUsesCounterDeltas(t *testing.T) {
 		{NodeID: "n1", CapturedAt: base.Add(10 * time.Minute), NetworkRxBytes: 1000, NetworkTxBytes: 2000},
 		{NodeID: "n1", CapturedAt: base.Add(20 * time.Minute), NetworkRxBytes: 1500, NetworkTxBytes: 2600},
 	}
-	openrestyObs := []*model.OpenFlareNodeObservationOpenresty{
-		{NodeID: "n1", CapturedAt: base.Add(10 * time.Minute), OpenrestyRxBytes: 100, OpenrestyTxBytes: 200},
-		{NodeID: "n1", CapturedAt: base.Add(20 * time.Minute), OpenrestyRxBytes: 180, OpenrestyTxBytes: 250},
-	}

-	points := BuildNetworkTrendPoints(now, snapshots, openrestyObs)
+	points := BuildNetworkTrendPoints(now, snapshots)
 	current := points[len(points)-1]
 	if current.NetworkRxBytes != 500 {
 		t.Fatalf("network_rx_bytes = %d, want 500", current.NetworkRxBytes)
@@ -186,11 +131,30 @@ func TestBuildNetworkTrendPointsUsesCounterDeltas(t *testing.T) {
 	if current.NetworkTxBytes != 600 {
 		t.Fatalf("network_tx_bytes = %d, want 600", current.NetworkTxBytes)
 	}
-	if current.OpenrestyRxBytes != 80 {
-		t.Fatalf("openresty_rx_bytes = %d, want 80", current.OpenrestyRxBytes)
+	if current.BytesReceived != 0 || current.BytesProvided != 0 {
+		t.Fatalf("business bytes should be 0 without access logs overlay, got received=%d provided=%d",
+			current.BytesReceived, current.BytesProvided)
 	}
-	if current.OpenrestyTxBytes != 50 {
-		t.Fatalf("openresty_tx_bytes = %d, want 50", current.OpenrestyTxBytes)
+}
+
+func TestBuildHealthSummaryUsesTrafficSummary(t *testing.T) {
+	t.Parallel()
+
+	snapshot := &model.OpenFlareMetricSnapshot{
+		CPUUsagePercent:  10,
+		MemoryUsedBytes:  1,
+		MemoryTotalBytes: 10,
+	}
+	traffic := &TrafficWindowSummary{
+		RequestCount: 200,
+		ErrorCount:   20, // 10% error rate
+	}
+	summary := buildHealthSummary(snapshot, traffic, nil)
+	if !summary.HasTrafficRisk {
+		t.Fatal("HasTrafficRisk = false, want true for 10% error rate with >=100 requests")
+	}
+	if summary.HasCapacityRisk {
+		t.Fatal("HasCapacityRisk = true, want false")
 	}
 }

@@ -79,7 +79,6 @@ type NodeView struct {
 	NodeID          string                            `json:"node_id"`
 	Profile         *model.OpenFlareNodeSystemProfile `json:"profile"`
 	MetricSnapshots []*NodeMetricSnapshotView         `json:"metric_snapshots"`
-	TrafficReports  []*model.OpenFlareRequestReport   `json:"traffic_reports"`
 	HealthEvents    []*model.OpenFlareHealthEvent     `json:"health_events"`
 	Analytics       NodeAnalytics                     `json:"analytics"`
 	Trends          NodeTrends                        `json:"trends"`
@@ -118,11 +117,7 @@ func GetNodeObservability(ctx context.Context, id uint, query NodeQuery) (*NodeV
 	if err != nil {
 		return nil, err
 	}
-	openrestyObs, err := model.ListOpenFlareNodeObservationOpenresty(ctx, node.NodeID, since, limit)
-	if err != nil {
-		return nil, err
-	}
-	reports, err := model.ListOpenFlareRequestReportsSince(ctx, node.NodeID, since, limit)
+	edgeHealth, err := model.ListOpenFlareEdgeHealth(ctx, node.NodeID, since, limit)
 	if err != nil {
 		return nil, err
 	}
@@ -134,18 +129,21 @@ func GetNodeObservability(ctx context.Context, id uint, query NodeQuery) (*NodeV
 	if err != nil {
 		return nil, err
 	}
+	distributions := BuildTrafficDistributionsFromAccessLogs(
+		ctx, since, now, defaultTrafficDistributionLimit, accessLogRegions,
+	)
+	trafficSummary := buildTrafficWindowSummaryFromAccessLogs(ctx, node.NodeID, since, now)
 	view := &NodeView{
 		NodeID:          node.NodeID,
 		Profile:         profile,
-		MetricSnapshots: BuildMetricSnapshotViews(snapshots, openrestyObs),
-		TrafficReports:  reports,
+		MetricSnapshots: BuildMetricSnapshotViews(snapshots, edgeHealth),
 		HealthEvents:    events,
 		Analytics: NodeAnalytics{
-			Traffic:       buildTrafficWindowSummary(latestTrafficReport(reports)),
-			Distributions: BuildTrafficDistributions(reports, accessLogRegions, defaultTrafficDistributionLimit),
-			Health:        buildHealthSummary(latestMetricSnapshot(snapshots), latestTrafficReport(reports), events),
+			Traffic:       trafficSummary,
+			Distributions: distributions,
+			Health:        buildHealthSummary(latestMetricSnapshot(snapshots), trafficSummary, events),
 		},
-		Trends: BuildNodeTrends(ctx, now, node.NodeID, snapshots, openrestyObs, reports),
+		Trends: BuildNodeTrends(ctx, now, node.NodeID, snapshots),
 	}
 	if node.NodeType == "tunnel_relay" {
 		frpsObs, frpsErr := model.ListOpenFlareNodeObservationFrps(ctx, node.NodeID, time.Time{}, 1)