sessions: persist to disk, prune, track client liveness, accept UE_LOGFMT (#1014)HEADmain

Branch started as a sessions-service overhaul (persistence, client liveness, UE_LOGFMT intake) and grew to pick up adjacent infrastructure work: an early-startup log backlog, a hardened `MemoryArena`, the `zen trace serve` viewer gaining a counter view + compact timeline + tabbed callsite panel, defensive fixes in the third-party `tourist` trace parser, a series of allocation reductions across the HTTP and compact-binary hot paths, and a new `zen sessions` CLI command tree.

## Sessions service

**Persistence.** Each session lives on disk under `<DataRoot>/sessions/<id>/` as `info.cb` (metadata) plus `log.bin` (length-prefixed CbObject log records). On startup the service scans that directory and loads prior sessions as ended sessions, preloading the tail of each log so historical views work after a restart. `SessionLog` is noexcept-constructed and falls back to a disabled state on disk errors, so a bad disk can't take down `RegisterSession`. `GetSession` falls back to the ended-sessions list (fixes historical log fetches over HTTP). `LoadTail` counts only successfully-parsed records.

**Pruning.** Periodic cleanup task drops ended sessions once any of three caps is exceeded: age (default 1 year), count (default 1000), or total on-disk footprint (default 50 MiB). Runs 30 s after startup, hourly thereafter. Active sessions never pruned; disk removal and directory stat happen outside the exclusive lock so a slow filesystem can't stall lookups.

**Client liveness.** Sessions carry a `ProcessHandle` for the client-reported pid, captured at registration time so Windows pid recycling can't produce false positives. A 30 s asio timer probes liveness and ends dead sessions through the normal remove path, producing a synthetic `Session ended: process exited (...)` line persisted to `log.bin`. Windows decodes common NTSTATUS exit codes to human names (Ctrl-C, access violation, stack overflow, ...); POSIX stays at plain `process exited`. Clients auto-fill `ClientPid` only for local targets (unix socket / loopback); the server defensively accepts pids only from `IsLocalMachineRequest()` peers. zenserver also reports its own pid when registering its self-session, so it shows up with a real pid in the dashboard and `zen sessions ls`.

**Synthetic end-of-session line.** `RemoveSession` takes an optional reason; before the session moves to the ended list it appends an Info-level `Session ended[: reason]` entry through the normal log path (released outside `m_Lock`). Current reasons: `client request` (HTTP DELETE), `server shutdown` (self-session), `process exited (...)` (liveness).

**UE_LOGFMT structured entries.** `POST /sessions/{id}/log` now accepts `{level, logger, format, fields}` alongside the existing `{level, logger, message}` shape. New `logtemplate.{h,cpp}` implements UE's `StructuredLog.cpp` template grammar (field paths with `.name` / `[N]`, `{{`/`}}` escapes, `$text` / `$format` / `$locformat` object conventions, bounded recursion). Renders to a displayable message at intake while persisting raw format + fields so a future UI can drill into fields without another schema bump. Hot path is zero-alloc — renders into `ExtendableStringBuilder<256>` using stack-buffered `Oid::ToString` / `IoHash::ToHexString` overloads. UI shows a `{…}` marker with the raw template + JSON-pretty fields on hover.

**Parent sessions.** `SessionInfo` gains `parent_session_id`; hub-managed storage server child processes inherit the hub's session id via `--parent-session=<id>`. `ZEN_SESSIONS_URL` env var becomes a fallback for `--sessions-url` / config when neither is provided. The in-process session log sink is disabled when a remote sessions target is configured (logs flow through `SessionsServiceClient` instead). The sessions UI groups child sessions under their parent (collapsible/expandable, sorts as a unit, supports nesting).

**Platform reporting.** `SessionInfo` gains `Platform`, flowed end-to-end: client auto-fills via `GetRuntimePlatformName()`, server persists in `info.cb` (`plat`) and emits on GET. UI renders as a SimpleIcons-style inline SVG (windows / macOS / iOS / linux / wine / android / playstation / xbox / nintendo) with case-insensitive alias resolution (Win32/Win64, PS4/PS5, XSX/XSS, NintendoSwitch, iPhone/iPad, Darwin/OSX). Unknown values fall back to text; sorting runs on the underlying string.

**WebSocket log streaming.** Sessions UI moves from 2 s polling to a WebSocket push model. New `WsSubscriber` has a stable id + helper methods. UI caps the log-line DOM at 5 000 entries with a shared cursor-regression helper, factored out of two call sites. Per-broadcast allocations trimmed on the push path; fixed a stack overrun in the WS log broadcast hex-id buffer.

**Log memory.** `LogEntry::Level` is now `logging::LogLevel` (1 byte) instead of `std::string` (~32 B) — saves ~310 KB per full 10 k-entry deque and eliminates a per-message allocation in the in-proc sink. On-disk format writes an int32 and accepts either int or legacy string on read. `LogEntry` strings now live in a `MemoryArena`; logger names are interned across the deque. `SessionLog::Append` and `WriteSessionInfoFile` drop their `UniqueBuffer` round-trip and write `CbObject::GetView()` straight through `BasicFile` / `SafeWriteFile`. Multi-entry `POST /log` batched under one lock + one push.

**In-proc log timestamps.** `InProcSessionLogSink::TimePointToDateTime` previously preserved only whole seconds, so every in-proc entry rendered at `.000` ms in the dashboard and `zen sessions tail`. It now adds the sub-second part (nanoseconds → 100 ns ticks) to keep ms precision end-to-end.

**UI.** Side "Session Details" panel is gone — its info is inline in the table (appname, mode, platform, id, timestamps, this/log pills, active dot). Bottom panel is a tabbed `Log | Metadata` view with a right-side "Session Information" panel beside metadata; log-only controls (filter, newest-first, follow, log-level filter, expand/collapse) hide when Metadata is active, polling keeps running across tab switches. Wide-mode toggle fills the viewport edge-to-edge. Log lines show the logger category; timestamps render in 24 h with zero-padded fields regardless of locale. Sessions list defaults to All / 10 per page / created-desc, gains click-to-sort headers on the full dataset, a header filter box, and a pager aligned to the table's right edge. Duplicate auto-injected `<h1>Sessions</h1>` removed.

## `zen sessions` CLI

New command tree on the `zen` client for inspecting the sessions service from the terminal:

- **`zen sessions ls`** — lists sessions (active first, ended next; newest-first within each group) with id, status, app/mode, pid, created, duration, and log count. Supports `--status active|ended|all` (default `all`).
- **`zen sessions status`** — prints the sessions service summary: self id, active / ended counts, and the read/write/delete/list/request/bad-request counters from `/stats/sessions`.
- **`zen sessions tail [session]`** — tails a session's log. With no argument it tails zenserver's own session (resolved via `/sessions/list`'s `self_id`); an explicit 24-hex id targets any session, including ended ones (historical replay). `--lines N` (default 50, 0 = all buffered) trims the initial dump client-side. `--follow` prefers a WebSocket push subscription on `/sessions/ws` for sub-second latency; on upgrade failure (older server, blocked port, unix-socket transport) it falls back to HTTP cursor polling at `--interval-ms` (default 500), with sleeps chunked to 50 ms so Ctrl-C reacts quickly. Output matches `zen::logging::FullFormatter` (`[YY-MM-DD HH:MM:SS.mmm] [lvl] [logger] message`); on a TTY the level is colored and the logger is bold, with continuation lines indented under the message column using the *visible* prefix width. 404 surfaces as `(session ended)` and connection errors as `(server gone)` — both clean exits, so stopping the server mid-tail no longer prints a stack trace.
- **`zen sessions ui`** — opens `<host>/dashboard/?page=sessions` in the user's default browser. Rejects unix-socket hosts.

A small `ZenServiceClient::IsUnixSocket()` helper now wraps the unix-socket check used by `ui`, `sessions tail` (WS path), and `sessions ui`.

## Logging

`BacklogSink` captures early-startup log entries in a fixed-capacity ring so late-attached sinks (session sink, file sink) can replay them. Detaches from the broadcast list when disabled; backed by destructor-only cleanup (no `unique_ptr` indirection per entry). Tuned defaults so the backlog covers typical bring-up without unbounded growth.

## `zen trace serve` viewer

- Compact timeline mode for high-density views.
- New `TRACE_INT_VALUE` / `TRACE_FLOAT_VALUE` counter trace points + a counters page in the viewer.
- Callsite tables collapsed into a single tabbed panel.
- Lossless `Oid <-> Guid` bridge for trace session ids; trace `SessionId` plumbed through.
- `tourist` parser hardening: bounds-check `BufferStream::read`, validate `Type::info_size` before `patch()`, convert `parse_important_aux` to a loop (avoids deep recursion), widen `ParserPool` index to `uint32`, bounds-check field offsets in the dispatcher, pin `Types::parse` buffer up-front.

## `MemoryArena`

Configurable chunk size, inline chunk list, oversize requests routed to truly-dedicated chunks (no slack waste, no fragmentation when one allocation is much larger than the chunk).

## Allocation cleanups across hot paths

- `zenhttp::HttpRequestRouter::HandleRequest` and `FormatPackageMessageInternal`: drop heap allocations.
- Compact-binary validation: `eastl::fixed_vector` + `eastl::sort`; eliminate `std::vector` churn.
- `zenserverprocess`: trim transient allocations in spawn paths.
- Sessions HTTP intake / broadcast: drop transient `std::string` allocs.

1 files changed, 390 insertions, 0 deletions

diff --git a/src/zenserver/sessions/logtemplate.cpp b/src/zenserver/sessions/logtemplate.cpp
new file mode 100644
index 000000000..b4d8f37e8
--- /dev/null
+++ b/src/zenserver/sessions/logtemplate.cpp
@@ -0,0 +1,390 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include "logtemplate.h"
+
+#include <zencore/fmtutils.h>
+#include <zencore/guid.h>
+#include <zencore/iohash.h>
+#include <zencore/string.h>
+#include <zencore/uid.h>
+
+ZEN_THIRD_PARTY_INCLUDES_START
+#include <fmt/format.h>
+ZEN_THIRD_PARTY_INCLUDES_END
+
+namespace zen {
+using namespace std::literals;
+
+namespace {
+
+	// Bounded recursion so pathological nesting (e.g. an object that references
+	// itself through $format) can't stack-overflow the server. Depth counts
+	// every nested template expansion OR value descent.
+	constexpr size_t kMaxRecursionDepth = 16;
+
+	void RenderTemplateInto(std::string_view Template, CbObjectView Fields, StringBuilderBase& Out, bool Localized, size_t Depth);
+	void RenderValue(CbFieldView Field, StringBuilderBase& Out, bool Localized, size_t Depth);
+
+	//////////////////////////////////////////////////////////////////////////
+	//
+	// Path resolution: walk a UE field_path — `name` followed by zero or
+	// more `.name` / `[N]` segments — starting from the fields root. Returns
+	// an empty field on any miss.
+	//
+
+	CbFieldView ResolvePath(CbObjectView Root, std::string_view Path)
+	{
+		CbFieldView Cur;
+		bool		Entered = false;  // have we applied at least one segment?
+
+		const auto ApplyName = [&](std::string_view Name) -> bool {
+			if (Name.empty())
+			{
+				return false;
+			}
+			if (!Entered)
+			{
+				Cur = Root[Name];
+			}
+			else
+			{
+				if (!Cur.IsObject())
+				{
+					return false;
+				}
+				Cur = Cur.AsObjectView()[Name];
+			}
+			Entered = true;
+			return Cur.operator bool();
+		};
+
+		const auto ApplyIndex = [&](uint64_t Idx) -> bool {
+			if (!Entered || !Cur.IsArray())
+			{
+				return false;
+			}
+			uint64_t N = 0;
+			for (CbFieldView Elem : Cur.AsArrayView().CreateViewIterator())
+			{
+				if (N == Idx)
+				{
+					Cur = Elem;
+					return Cur.operator bool();
+				}
+				++N;
+			}
+			return false;
+		};
+
+		size_t i = 0;
+		while (i < Path.size())
+		{
+			const char C = Path[i];
+			if (C == '.')
+			{
+				++i;
+				continue;
+			}
+			if (C == '[')
+			{
+				const size_t End = Path.find(']', i + 1);
+				if (End == std::string_view::npos)
+				{
+					return {};
+				}
+				uint64_t Idx = 0;
+				for (size_t j = i + 1; j < End; ++j)
+				{
+					const char D = Path[j];
+					if (D < '0' || D > '9')
+					{
+						return {};
+					}
+					Idx = Idx * 10 + uint64_t(D - '0');
+				}
+				if (!ApplyIndex(Idx))
+				{
+					return {};
+				}
+				i = End + 1;
+				continue;
+			}
+			// Name segment: run until the next '.' or '['.
+			const size_t NameStart = i;
+			while (i < Path.size() && Path[i] != '.' && Path[i] != '[')
+			{
+				++i;
+			}
+			if (!ApplyName(Path.substr(NameStart, i - NameStart)))
+			{
+				return {};
+			}
+		}
+		return Entered ? Cur : CbFieldView{};
+	}
+
+	//////////////////////////////////////////////////////////////////////////
+	//
+	// Primitive rendering. Uses natural string forms for each CbField type.
+	// Non-string values are emitted without quotes — the caller (the JSON-ish
+	// fallback) adds quotes only around string values.
+	//
+
+	void RenderPrimitive(CbFieldView Field, StringBuilderBase& Out)
+	{
+		if (Field.IsString())
+		{
+			Out << Field.AsString();
+			return;
+		}
+		if (Field.IsBool())
+		{
+			Out << (Field.AsBool() ? "true"sv : "false"sv);
+			return;
+		}
+		if (Field.IsInteger())
+		{
+			Out << Field.AsInt64();
+			return;
+		}
+		if (Field.IsFloat())
+		{
+			// format_to into the builder directly — avoids the std::string
+			// fmt::format would otherwise build just to hand to Append.
+			fmt::format_to(StringBuilderAppender(Out), "{}", Field.AsDouble());
+			return;
+		}
+		if (Field.IsDateTime())
+		{
+			Out.Append(Field.AsDateTime().ToIso8601());
+			return;
+		}
+		if (Field.IsObjectId())
+		{
+			// ToString(char[]) writes the 24-char hex into a caller buffer;
+			// the std::string overload would allocate.
+			char Buf[Oid::StringLength + 1] = {};
+			Field.AsObjectId().ToString(Buf);
+			Out << std::string_view(Buf, Oid::StringLength);
+			return;
+		}
+		if (Field.IsHash())
+		{
+			// Appender overload writes the 40-char hex directly into the
+			// builder; the std::string overload would allocate.
+			Field.AsHash().ToHexString(Out);
+			return;
+		}
+		if (Field.IsUuid())
+		{
+			Guid G = Field.AsUuid();
+			G.ToString(Out);
+			return;
+		}
+		if (Field.IsNull())
+		{
+			Out << "null"sv;
+			return;
+		}
+		// Binary / attachment / custom / unknown → emit nothing rather than
+		// a stream of garbage bytes.
+	}
+
+	//////////////////////////////////////////////////////////////////////////
+	//
+	// JSON-ish fallback for bare objects / nested arrays. Compact single-line
+	// with quoted string keys and string values, raw other types. Intended
+	// for debug display — not strictly RFC-8259 JSON.
+	//
+
+	void AppendJsonishString(std::string_view S, StringBuilderBase& Out)
+	{
+		Out << '"';
+		for (char C : S)
+		{
+			switch (C)
+			{
+				case '"':
+					Out << "\\\""sv;
+					break;
+				case '\\':
+					Out << "\\\\"sv;
+					break;
+				case '\n':
+					Out << "\\n"sv;
+					break;
+				case '\r':
+					Out << "\\r"sv;
+					break;
+				case '\t':
+					Out << "\\t"sv;
+					break;
+				default:
+					Out << C;
+					break;
+			}
+		}
+		Out << '"';
+	}
+
+	void AppendJsonishValue(CbFieldView Field, StringBuilderBase& Out, bool Localized, size_t Depth)
+	{
+		if (Field.IsString())
+		{
+			AppendJsonishString(Field.AsString(), Out);
+			return;
+		}
+		// Non-string leaves and nested objects/arrays go through RenderValue
+		// so object short-circuits ($text / $format / ...) still apply.
+		RenderValue(Field, Out, Localized, Depth);
+	}
+
+	//////////////////////////////////////////////////////////////////////////
+	//
+	// Value rendering (the decision tree from the plan).
+	//
+
+	void RenderValue(CbFieldView Field, StringBuilderBase& Out, bool Localized, size_t Depth)
+	{
+		if (Depth >= kMaxRecursionDepth)
+		{
+			Out << "…"sv;
+			return;
+		}
+		if (Field.IsObject())
+		{
+			CbObjectView Obj = Field.AsObjectView();
+
+			if (CbFieldView Text = Obj["$text"sv]; Text.IsString())
+			{
+				Out << Text.AsString();
+				return;
+			}
+			if (CbFieldView Format = Obj["$format"sv]; Format.IsString())
+			{
+				RenderTemplateInto(Format.AsString(), Obj, Out, /*Localized=*/false, Depth + 1);
+				return;
+			}
+			if (CbFieldView LocFormat = Obj["$locformat"sv]; LocFormat.IsString())
+			{
+				RenderTemplateInto(LocFormat.AsString(), Obj, Out, /*Localized=*/true, Depth + 1);
+				return;
+			}
+
+			// Bare object — JSON-ish fallback.
+			Out << '{';
+			bool First = true;
+			for (CbFieldView Entry : Obj.CreateViewIterator())
+			{
+				if (!First)
+				{
+					Out << ", "sv;
+				}
+				First = false;
+				AppendJsonishString(Entry.GetName(), Out);
+				Out << ": "sv;
+				AppendJsonishValue(Entry, Out, Localized, Depth + 1);
+			}
+			Out << '}';
+			return;
+		}
+		if (Field.IsArray())
+		{
+			Out << '[';
+			bool First = true;
+			for (CbFieldView Elem : Field.AsArrayView().CreateViewIterator())
+			{
+				if (!First)
+				{
+					Out << ", "sv;
+				}
+				First = false;
+				AppendJsonishValue(Elem, Out, Localized, Depth + 1);
+			}
+			Out << ']';
+			return;
+		}
+		RenderPrimitive(Field, Out);
+	}
+
+	//////////////////////////////////////////////////////////////////////////
+	//
+	// Template tokenizer + renderer.
+	//
+
+	void RenderTemplateInto(std::string_view Template, CbObjectView Fields, StringBuilderBase& Out, bool Localized, size_t Depth)
+	{
+		if (Depth >= kMaxRecursionDepth)
+		{
+			Out << "…"sv;
+			return;
+		}
+
+		size_t i = 0;
+		while (i < Template.size())
+		{
+			const char C = Template[i];
+
+			// Localized escape: ` followed by {, }, or ` → literal.
+			if (Localized && C == '`' && i + 1 < Template.size())
+			{
+				const char Next = Template[i + 1];
+				if (Next == '{' || Next == '}' || Next == '`')
+				{
+					Out << Next;
+					i += 2;
+					continue;
+				}
+			}
+
+			// Non-localized escape: {{ or }} → literal { or }.
+			if (!Localized && C == '{' && i + 1 < Template.size() && Template[i + 1] == '{')
+			{
+				Out << '{';
+				i += 2;
+				continue;
+			}
+			if (!Localized && C == '}' && i + 1 < Template.size() && Template[i + 1] == '}')
+			{
+				Out << '}';
+				i += 2;
+				continue;
+			}
+
+			if (C == '{')
+			{
+				// Placeholder: scan until matching '}'.
+				const size_t End = Template.find('}', i + 1);
+				if (End == std::string_view::npos)
+				{
+					// Unterminated placeholder — emit the rest literally so we
+					// don't silently drop data. UE would have asserted at emit.
+					Out << Template.substr(i);
+					return;
+				}
+				const std::string_view Path		= Template.substr(i + 1, End - i - 1);
+				const CbFieldView	   Resolved = ResolvePath(Fields, Path);
+				if (Resolved)
+				{
+					RenderValue(Resolved, Out, Localized, Depth + 1);
+				}
+				// Missing placeholder: emit nothing. (UE asserts at emit time,
+				// so in well-formed input this never fires.)
+				i = End + 1;
+				continue;
+			}
+
+			Out << C;
+			++i;
+		}
+	}
+
+}  // namespace
+
+void
+RenderLogTemplate(std::string_view Template, CbObjectView Fields, StringBuilderBase& Out, bool Localized)
+{
+	RenderTemplateInto(Template, Fields, Out, Localized, 0);
+}
+
+}  // namespace zen