[litkhai]

Closes #139

PR #140 delivered this lab but wrote Closes 139 without the #, so #139 stayed open. This PR adds what #140 left out: a negative check and an injected fault in each test, plus a date and build on every number.

Changed

• tests/test_schema.py
  • Negative: ResourceAttributes['svc.group'] = 'g7' does not use the primary key (PK condition true, all granules), and a row without svc.* gets ''.
  • Fault: test_fault_fires drops svc_group from the logs sort key and asserts that the pruning check then fails. The test first checks that the key it edits is still in the file.
• tests/test_collector.sh
  • Negative: an untagged log gets no svc.* key.
  • Fault: a copy of standard-fields.yaml without the "app value first" guard must fail the checks, and the script exits non-zero if that copy passes. The script first checks that the guard is still in the file.
• README.md (English and Korean)
  • A tests table: positive, negative and injected fault for each test.
  • ClickHouse Cloud 26.8.1.608 written on every Cloud number.
  • Tests re-run dated 2026-11-07.
  • Removed the unsourced "20–30 %".
• lab.yaml: verified_on updated to match the README.

Checked (2026-11-07)

• python3 -m unittest discover -s labs/common-fields/tests: 5/5 tests OK on clickhouse local 26.9.6.6.
  • Also checked outside the suite: a typo in the real schema.sql ('svc.grp') made test_columns_fill fail.
• labs/common-fields/tests/test_collector.sh on otelcol-contrib 0.155.0 (Docker): 6/6 PASS on the real file. On the faulted copy, FAIL app: its own svc.group kept; the script still exits 0, because the fault was caught.
• check_links.py, check_syntax.sh and otel-profiles/bin/lint.sh all OK; gitleaks found no leaks.

Demo inserts in chunks. The owner's rerun on 2026-11-07 failed on the 2 M-row logs INSERT … SELECT with MEMORY_LIMIT_EXCEEDED. That limit is the service's total, maximum 6.89 GiB. managed/demo.py now runs the inserts as 16 chunks that keep number. In clickhouse local 26.9.6.6 the chunked and one-shot inserts give the same rows: 2,000,000 logs, 500,000 spans and 480,000 gauge points, with equal row hashes. The rerun's --cleanup removed the 2026-11-06 demo objects.

Managed ClickStack, 2026-11-07 (ClickHouse Cloud 26.8.1.608, Seoul; chunked demo.py: 2,000,000 logs, 500,000 spans, 480,000 gauge points). The four captures in images/ were retaken in dark mode on Claude in Chrome over the 15 minutes 12:39–12:54 KST, cropped so that no personal name and no other source shows:

• exact ResourceAttributes.svc.group:"g7": 24,836 results, Scanned Rows 49,152
• substring ResourceAttributes.svc.group:g7: sent as svc_group ILIKE '%g7%', Scanned Rows 49,152
• the svc-107 error span with its 4 log lines and the common fields under Resource Attributes

Confirmed in system.query_log: the exact search's query (svc_group = 'g7', 04:18:06Z) and the substring search's (svc_group ILIKE '%g7%', 04:18:38Z) each read 49,152 rows, and count() on the window gives 24,836. The ClickStack Color Mode preference was set to Dark for the captures and back to System afterwards.

The demo was removed after the captures (demo.py --cleanup, 2026-11-07): no common_fields_demo database and no cf demo * sources are left on the Seoul service.

Cost (API list-price equivalent, khai-harness cost.py): $1.56, lead only.

🤖 Generated with Claude Code