fix(collector): log quality — relabel runtime registrations, HTTP code, quiet stop-drop

[lotgon]

What (from the live agent-log review)

Native collector + agent logging fixes surfaced by reading hsm-agent.log:

1. Relabel runtime registrations. PostRegistrationsWire runs at Start (the connect batch) and at runtime for lazily-created sensors (top-CPU process, network interface, TCP-fail-rate, service-status). It hardcoded Registered N sensor(s) on connect. / …on Start: for all of them, so runtime registrations spammed Info ~once/minute with a false "on connect" label (and, during an outage, Failed to register 1 sensor(s) on Start — the misread "restart storm"). Now: connect batch → Info … on connect; runtime → Debug, named by sensor path.

2. HTTP status in registration failures (HSMCppWrapper #3). Failures now carry the HTTP code (HTTP <code>) from HttpResponse.status_code, matching the feat(native): collector logging parity — built-in file logger + events + tests #1221 value send-fail log; falls back to the transport error text (e.g. "Could not connect to server") when no HTTP response arrived.

3. Stop-drop is not an Error (Develop #2). Dropping buffered values on a bounded graceful stop is expected and contracted — it was logged at Error on every routine restart (32× in the log, and Error → Windows Event Log). Now Debug.

4. Agent file-logger min-level. The agent's FileLogger wrote every level to hsm-agent.log; add a min_level (default Info, parity with the collector's built-in file logger) so the Debug demotions above stay out of the file by default (and out of the Event Log, which only takes Error).

Agent version bumped 0.5.25 → 0.5.26 per src/agent/AGENTS.md (the shipped agent binary's behavior changed).

Test

native_http_registration_failure_logs_status — a capture server returns 503; asserts the registration error carries HTTP 503 and keeps the on connect label, and that the stale on Start label is gone.

Verify live

Deploy 0.5.26 and confirm hsm-agent.log: no [ERROR] Collector stop dropped…, no ~1/min Registered 1 sensor(s) on connect, registration failures show HTTP <code>.

Related

Follow-up to #1221 (the logging it added). Companion resilience fix (re-register on transport recovery) comes as a separate PR.

🤖 Generated with Claude Code

[github-actions]

Review — fix/collector-log-quality (#1225)

Focused, well-documented cleanup of collector/agent log quality. I verified the logic against the surrounding code and the log-level enum. No blocking issues found — the change is correct, follows the directory's versioning policy, and adds a matching test.

Correctness — verified

• Log-level filtering direction is right. LogLevel is Debug=0, Info=1, Error=2 (enums.hpp / hsm_collector.h), so the agent's new if (level < min_level_) return; with min_level_ = Info drops only Debug. This matches the collector's built-in FileLogger guard (e.level >= min_level_, hsm_collector.cpp:853), so the "parity" claim in the comment holds.
• Constructor reorder is safe. min_level was inserted as the second parameter, pushing max_bytes to third. Both existing callers (main.cpp:93, windows_service.cpp:86) use the single-arg form FileLogger file(LogFilePath()), so no caller silently reinterprets a max_bytes value as a level. Member-init order (path_, max_bytes_, min_level_) matches declaration order — no -Wreorder.
• min_level_ read without the lock is fine — it's set once in the constructor and never mutated, so the pre-lock early return in Write has no data race.
• Status-code fallback is correct. HttpResponse::status_code defaults to 0 (hsm_http_transport.hpp:24) and is only set when an HTTP response actually arrives, so status_code > 0 ? "HTTP <code>" : (error text or "no response") cleanly distinguishes a non-2xx response from a connect failure. Good parity with the value send-fail log.
• Versioning policy followed. HsmAgent VERSION bumped 0.5.25 → 0.5.26. Per src/agent/AGENTS.md, a collector-behavior change that alters the shipped agent binary MUST bump this so self-update (update_checker.cpp, strictly-greater semver) actually delivers it. The collector's own VERSION 0.4.0 tracks the C ABI and correctly stays put (no ABI change).

Design judgment — reasonable

• Stop-drop demoted Error → Debug. Dropping buffered values on a bounded graceful stop is contracted behavior, so demoting it is justified and the comment explains it well. Note the collector LogLevel enum has no Warning tier, so Debug vs Info was the only real choice; Debug (kept out of the file by the new default) is defensible for a routine-restart breadcrumb. Worth being aware that this signal now vanishes from the default file log — acceptable given the rationale.
• Runtime registrations demoted to Debug prevents per-sample sensor registrations (top-CPU process, network iface, service-status, TCP-rate) from spamming the log, while failures still log at Error. Good.

Minor / non-blocking

• Comment vs. behavior nuance in PostRegistrationsWire. The comment says "the connect batch by count," but the what string names by path whenever sensors.size() == 1 — including a connect batch that happens to contain exactly one sensor (as in the new test, which logs sensor reg/int on connect). The behavior is arguably nicer than the comment implies; just a slight mismatch between comment and code, not a bug.
• Test coverage of the runtime path. NativeHttpRegistrationFailureLogsStatus covers the connect batch (runtime=false, "on connect" label, HTTP 503, no stale "on Start"). The runtime=true failure branch — which drops the "on connect" suffix and, on success, logs at Debug — isn't directly asserted anywhere. Optional: a small case pinning the runtime label/level would lock in the other half of the new branch.

Summary

Clean, correct, and appropriately tested. The two minor items are optional polish; nothing needs to change to merge.