reliability(observability): reject malformed UTF-8 alert input

[seonghobae]

Problem

Retained exchange NDJSON must fail closed on malformed UTF-8 before failure-rate, p95, rate-limit, workflow-spike, and error-code aggregation. Ordinary replacement decoding could otherwise turn byte-invalid evidence into a different Unicode document before observability semantics.

RCA

• First failing boundary: retained monitoring bytes -> alert-evaluation text/JSON semantics.
• Immediate cause: non-fatal UTF-8 decoding.
• Root cause: the observability operator lacked an explicit valid-byte/text boundary before aggregation.
• Systemic risk: corrupted retained evidence could influence alert suppression/triggering and downstream readiness interpretation.

Integrated test-first repair

Merged PR #212 is the protected-main implementation owner. Historical PR #129 was closed unmerged only after its useful regression contract was proven preserved by the integrated successor.

• fix(observability): restack fatal UTF-8 alert input after KPI merge #212 protected base at review: 5addf7fc1fc3494b3fc3dbc390d504e260ea4f09;
• RED head: 3e87cf773164a4f06602191158b4f6f8e7e7be57;
• exact GREEN head: 1c17000719e4025c46094b076bf89b303cdae958;
• protected merge commit/current protected main: 0b515c11670f26f888ccdf66707f34b946f505ef.

The integrated implementation reads exact bytes and applies fatal UTF-8 decoding before JSON/aggregation semantics while preserving thresholds, route filtering, timestamp fallback, non-JSON filtering, and output contracts.

Exact PR-head proof

For unchanged #212 GREEN head 1c17000719e4025c46094b076bf89b303cdae958 before merge:

• application ci 31569791942: terminal success;
• reviewer-ci 31569791829: terminal success;
• protected-base eligible central Security Scan 31569791851: terminal success;
• formal reviews: none;
• unresolved review threads: none;
• live ruleset 18794436 required the central Security Scan workflow and did not require an independent approval.

#212 was marked Ready without head movement, live main/reviews/threads/rules were refetched, and the unchanged exact head was merged.

Protected-main acceptance

Protected main remains 0b515c11670f26f888ccdf66707f34b946f505ef.

Fresh exact-merge-commit evidence now shows:

• push application ci run 31572413609: terminal success;
• push reviewer-ci run 31572413613: terminal success;
• CodeQL/Code Quality checks on the same exact commit are terminal success for JavaScript/TypeScript, Python, and Actions analyses at the latest fresh read;
• no queued/failed source-affecting protected-main check remains in the observed check-run set for this repair.

The source defect and its protected-main acceptance are therefore complete. This closure does not claim real production monitoring/KPI provenance, alert delivery, release/deployment, owner/legal rights, revenue, transfer evidence, or acquisition readiness.

Acceptance

• Deterministic RED proves malformed UTF-8 in otherwise valid exchange evidence exits non-zero before alert output.
• Valid UTF-8 monitoring evidence preserves current alert semantics and non-JSON filtering.
• Production code decodes retained bytes with fatal UTF-8 before JSON/aggregation semantics.
• Exact GREEN application CI, reviewer-ci, eligible central Security Scan, and current review/thread state were clean before merge.
• Merge unchanged exact head under actual live governance.
• Close stale predecessor fix(observability): reject malformed alert input bytes #129 only after successor preservation proof.
• Complete protected-main application/reviewer/CodeQL acceptance on exact merge commit 0b515c11670f26f888ccdf66707f34b946f505ef.
• Keep real production monitoring/KPI provenance, alert delivery, operational exercise, release/deployment, and acquisition evidence separate from parser hardening.

Related: #3, #27, #29, #122, #123, #126, #127, #129, #212