# M12.6 — Performance Analyzer Correctness + Rotation-Safe 24h Reporting

Analyzer-only. No nginx, FPM, Redis, or request-path changes.

## Status filters

| Value | Meaning |
| --- | --- |
| `--status=404` | **exact** HTTP 404 only |
| `--status=500` | exact 500 |
| `--status=4xx` | 400–499 (includes 404, 422, 499) |
| `--status=5xx` | 500–599 |

`--status=404` is **not** a 4xx class. Malformed values (`foo`, `40`, `9999`) exit 2.

**Bug:** the old analyzer only special-cased `4xx` / `5xx` / `499`. `--status=404` was ignored, so almost every row was returned.

## Inputs

- `--file=path` (repeatable)
- `--glob='…/skinbase-performance.log*'`
- default single file remains `/var/log/nginx/skinbase-performance.log`
- `.gz` streamed with `gzopen` (no `zcat`, no full-file decompress)
- duplicate **paths** are collapsed via `realpath`; duplicate **events** are kept

## Time / coverage

- `--since=24h` (or `30m` / `7d`) from `--until` or now
- optional `--until=` ISO-8601, `--hours=24` alias for `--since=24h`
- Coverage uses parseable timestamps in the supplied files (15-minute tolerance)
- Incomplete sources emit: `Observed records do not demonstrate full requested coverage.`

## Backward compatible

```bash
php scripts/analyze-http-performance.php --file=/var/log/nginx/skinbase-performance.log --since=24h --host=skinbase.org
```

## Rotation-aware 24h

```bash
sudo php /opt/www/virtual/SkinbaseNova/scripts/analyze-http-performance.php \
  --glob='/var/log/nginx/skinbase-performance.log*' \
  --since=24h \
  --host=skinbase.org \
  --top=20
```

`skinbase` may not be able to read `/var/log/nginx`; use the same sudo model as today. The analyzer is read-only.