Merge pull request #1929 from rcourtman/fix/retained-history-coverage

perf(api): avoid rune decoding in route label checks

docs/qualification/PATROL_ASSISTANT_CUSTOMER_JOURNEY.md

@@ -1248,4 +1248,83 @@ Raw log: `/opt/pulse-release-worker/patrol-dependency-action-oracles-live.log`,
 copied to `tmp/patrol-dependency-action-oracles/` at the workspace root.
 The live test source SHA-256 is
 `78b72dc44231cd3ecbd0b2ee925d53a5836af3141e695152046aa032580f1e48`.
-The ordinary qualification and CLI packages pass in 4.224s and 0.008s on Go 1.26.8 with the explicit live environment unset. The test hash is unchanged. The exact staged hook remains pending for this slice.
+The ordinary qualification and CLI packages pass in 4.224s and 0.008s on Go 1.26.8 with the explicit live environment unset. The test hash is unchanged. Commit `173d74a8e422` is pushed to PR #1928 after the exact four-file staged hook passed all 163 tests in 129.364s with unchanged source hashes. Remote landing remains pending.
+
+
+### Current ordinary Assistant diagnosis remains unqualified
+
+One read-only ordinary Assistant request on 2026-09-06 ran from
+06:49:50.441Z to 06:53:26.724Z, taking 216.283s with 15 tool calls. The
+configured `claude-subscription:claude-opus-5` route returned HTTP 200. The
+request explicitly used `autonomous_mode=false`. No alternate paid provider,
+Patrol readiness retry or infrastructure mutation was performed. This single
+request establishes neither an aggregate success rate nor a latency SLO.
+
+The missing-access correction works in this real run. One diagnostic read
+returns failed `NO_AGENT` while preserving the monitored node identity, and
+the answer correctly retains that access limit without retrying the read.
+Diagnosis still fails factual review. The answer quotes the tool contract that
+returned timestamps cannot establish collection uptime or missing-history cause,
+then claims that a coincident alert timestamp identifies observation start. It
+calls 181 seven-day returned points hourly even though their returned span is
+under twelve hours. It moves the 83.3% memory minimum from the previous evening
+at 20:34 to around 04:20, and uses low average CPU as evidence against pressure
+without direct pressure measurements. Correct tool metadata did not prevent
+these unsupported interpretations. Do not count a completed request or an
+accurate missing-access message as successful diagnosis.
+
+Private receipts, persisted tool outputs, request/source/binary bindings and
+factual evaluation are at workspace-relative
+`tmp/patrol-current-assistant-check/`. The backend binary hash remains
+`1e1c3a9c0c758a4a751afa16200c6fba793acc93fd56ea62e7eb432edcf5f6c8`
+before and after the request. The Playwright run exercised the persisted answer
+and expanded failed-tool input/output at `/patrol`, 1440x1000 and 390x1000,
+including reload. Pixel inspection confirms readable answer and error evidence.
+The test intercepted non-GET requests other than the one ordinary chat. Its
+blocked readiness check caused the selected-route warning in the screenshots,
+so those screenshots do not establish the route's unmodified readiness UI.
+
+The supported alternate-provider test remains awaiting its separately billed
+US$20 maximum approval. The cached subscription refusal for autonomous Patrol
+remains enforced. Further prompt or orchestration rules are not justified merely
+because this response ignored already explicit evidence limitations. Real-model
+diagnosis, approved/rejected action outcomes and wider customer readiness remain
+open qualification requirements.
+
+
+### Landing benchmark follow-through
+
+Run `34017211910` on `173d74a8e422` completed with the frontend, full API
+race shard, both remaining backend shards and build/smoke checks passing. Its
+only failed job was the unchanged benchmark gate, with four NormalizeSegment
+time regressions against exact base `3347f561ec7bc7ae30903e64998b0f90b5fb5217`.
+A ten-pair, 500ms-sample worker reproduction confirmed three segment regressions,
+while full middleware time and allocations remained unchanged. Both source
+files and normalized compiled instruction streams matched between base and
+candidate. The binary addresses differed. Layout sensitivity is an inference
+from these observations, not a proven functional defect.
+
+The canonical route-label classifiers now inspect ASCII bytes directly instead
+of decoding Unicode runes that cannot satisfy the numeric/hexadecimal checks.
+Existing label precedence and non-ASCII behavior are preserved, with regression
+cases for long numeric IDs, Unicode digits/names and malformed UTF-8. The full
+HTTP-metrics test file passes under the race detector in 1.057s on Go 1.26.8.
+Ten new alternating baseline/candidate pairs pass the existing greater-than-10%,
+p-less-than-0.05 gate with 500ms samples. Segment numeric, UUID, long-token,
+short-name and medium-name time changes are -32.19%, -33.59%, -38.83%, -37.06%
+and -37.11%. Bytes and allocations are unchanged. Adjacent route and full
+middleware benchmarks have no significant regressions. These are local
+microbenchmark results, not a claim about customer-perceived application speed.
+
+Final source hashes:
+
+- `internal/api/http_metrics.go`: `916c27ad5ff07e00170dd94df0b75eb509dd329e34288647f5358a0759353d37`
+- `internal/api/http_metrics_test.go`: `4d425559d84052a50de56286101a6b37422027629d076c845920d8d02f9aff41`
+
+Worker comparison: `/opt/pulse-release-worker/patrol-normalize-final-bench/`.
+Private copies, the failed initial comparison and exact CI failure output remain
+at workspace-relative `tmp/patrol-current-assistant-check/`. The preceding
+diagnostic-record commit `ba69933da352` passed its two-file staged hook, all
+163 tests in 127.527s with unchanged hashes. The current runtime change still
+requires its final staged hook and exact-head remote CI. Overall diagnostic and
+action-outcome qualification remains open.

docs/release-control/v6/internal/subsystems/performance-and-scalability.md

@@ -3104,3 +3104,15 @@ The signal survives transport loss and resets on organisation URL changes.
 
 On admission-request failure retain the existing facet without extra retries,
 polling or full-estate reads. A later successful refresh replaces that facet.
+
+
+### ASCII route-label classification
+
+HTTP metric route normalization classifies numeric IDs and UUID-like labels
+using ASCII byte checks. Unicode decoding is unnecessary for this alphabet.
+Preserve numeric-before-token precedence and ordinary Unicode or invalid UTF-8
+names while optimizing this shared path. Qualification compares exact base and
+candidate on the same worker with alternating samples, and retains full-route
+and middleware controls. Identical source or instruction sequences alone do not
+prove identical timing. The recorded final ten-pair check passes the unchanged
+time/bytes/allocation gate with no adjacent request-path regression.

internal/api/http_metrics.go

@@ -140,8 +140,9 @@ func isNumeric(s string) bool {
 	if s == "" {
 		return false
 	}
-	for _, r := range s {
-		if r < '0' || r > '9' {
+	// These labels accept ASCII digits only, so decoding UTF-8 is unnecessary.
+	for i := 0; i < len(s); i++ {
+		if s[i] < '0' || s[i] > '9' {
 			return false
 		}
 	}
@@ -152,7 +153,8 @@ func looksLikeUUID(s string) bool {
 	if len(s) != 36 {
 		return false
 	}
-	for i, r := range s {
+	for i := 0; i < len(s); i++ {
+		r := s[i]
 		switch {
 		case r == '-':
 			if i != 8 && i != 13 && i != 18 && i != 23 {

internal/api/http_metrics_test.go

@@ -83,6 +83,8 @@ func TestIsNumeric(t *testing.T) {
 		{"hexadecimal prefix", "0x10", false},
 		{"special characters", "12@34", false},
 		{"unicode digits", "１２３", false}, // fullwidth digits
+		{"arabic digits", "١٢٣", false},
+		{"invalid utf8 after digits", "123\xff", false},
 	}
 
 	for _, tt := range tests {
@@ -127,6 +129,8 @@ func TestLooksLikeUUID(t *testing.T) {
 		{"space in uuid", "550e8400 e29b-41d4-a716-446655440000", false},
 		{"underscore", "550e8400_e29b-41d4-a716-446655440000", false},
 		{"special char", "550e8400-e29b-41d4-a716-44665544000!", false},
+		{"unicode within 36 bytes", "é0e8400-e29b-41d4-a716-446655440000", false},
+		{"invalid utf8 within 36 bytes", "\xff50e8400-e29b-41d4-a716-446655440000", false},
 
 		// Edge cases
 		{"all zeros no dashes wrong length", "00000000000000000000000000000000xxxx", false},
@@ -153,6 +157,7 @@ func TestNormalizeSegment(t *testing.T) {
 		{"numeric id", "123", ":id"},
 		{"single digit", "5", ":id"},
 		{"large number", "9999999999", ":id"},
+		{"numeric precedence over token", "123456789012345678901234567890123456", ":id"},
 
 		// UUID segments -> :uuid
 		{"uuid", "550e8400-e29b-41d4-a716-446655440000", ":uuid"},
@@ -173,6 +178,8 @@ func TestNormalizeSegment(t *testing.T) {
 		{"empty string", "", ""},
 		{"single letter", "a", "a"},
 		{"mixed alphanumeric short", "user123", "user123"},
+		{"unicode name", "café", "café"},
+		{"invalid utf8 name", "node\xff", "node\xff"},
 	}
 
 	for _, tt := range tests {