Name log fields, metrics and the Core Rule Set package for what they are (closes #192)

The first half of the naming audit: names now say what they are. `internal/waf` is `internal/coreruleset`. Log fields, the action `blocked_by_core_rule_set`, the metric and the alert event say Core Rule Set. Timings end `_ms`. Percentages say of what, as `rate_limit_percent` and `bytes_limit_percent`. Setting names follow in #234.

Judgement call: `blocked_by_core_rule_set`, not the audit's `core_rule_set_blocked`, to match `blocked_by_block_rule`.
Trips a reader: an existing state file holding `waf_blocked` or the anomaly scope `watch` stops the start and must be removed. `SWW_ALERT_EVENTS` listing `waf_block` must list `core_rule_set_match`.

Model: opus-5-5

internal/discriminator/biased_test.go

@@ -79,14 +79,16 @@ func TestEachBiasedThresholdLowersTheRateLimits(t *testing.T) {
 				{http.StatusForbidden, requestlog.ActionClientIsRateLimited},
 			} {
 				line := s.get(tc.from, sent.status, sent.action)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					"50 from "+tc.setting)
 			}
 
 			// fromKP, which no setting lists, has the whole limit.
 			for range 3 {
 				line := s.get(fromKP, http.StatusOK, requestlog.ActionForward)
-				wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+				wantPercent(t, "rate_limit_percent",
+					line.RateLimitPercent, line.RateLimitPercentSetting,
 					none)
 			}
 		})
@@ -119,7 +121,8 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 				t.Errorf("log line has limit_hit %q, want %s", line.LimitHit, minuteBytes)
 			}
 
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
 				"50 from "+tc.setting)
 
 			// fromKP, which no setting lists, has the whole limit.
@@ -128,7 +131,8 @@ func TestEachBiasedThresholdLowersTheByteLimits(t *testing.T) {
 				t.Errorf("log line for %s has limit_hit %q, want none", fromKP, line.LimitHit)
 			}
 
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting, none)
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting, none)
 		})
 	}
 }
@@ -139,9 +143,9 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T)
 	for _, tc := range []struct {
 		name string
 		env  map[string]string
-		// limitPercent and bytesPercent are the log line's, as percentText
-		// gives them, and limitHit is its limit_hit.
-		limitPercent, bytesPercent, limitHit string
+		// rateLimitPercent and bytesLimitPercent are the log line's, as
+		// percentText gives them, and limitHit is its limit_hit.
+		rateLimitPercent, bytesLimitPercent, limitHit string
 	}{
 		{
 			"lowering the byte limits alone",
@@ -177,10 +181,12 @@ func TestBytesPercentSettingsTakeThePlaceOfTheOthersForByteLimits(t *testing.T)
 				t.Errorf("log line has limit_hit %q, want %q", line.LimitHit, tc.limitHit)
 			}
 
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
-				tc.limitPercent)
-			wantPercent(t, "bytes_percent", line.BytesPercent, line.BytesPercentSetting,
-				tc.bytesPercent)
+			wantPercent(t, "rate_limit_percent",
+				line.RateLimitPercent, line.RateLimitPercentSetting,
+				tc.rateLimitPercent)
+			wantPercent(t, "bytes_limit_percent",
+				line.BytesLimitPercent, line.BytesLimitPercentSetting,
+				tc.bytesLimitPercent)
 		})
 	}
 }
@@ -193,10 +199,10 @@ func TestZeroPercentIsAZeroAllowance(t *testing.T) {
 	// The first request breaks the limit, and bans the client; the log line
 	// gives the 0.
 	line := s.get(unplaced, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-	if line.fields["limit_percent"] != float64(0) ||
-		line.fields["limit_percent_setting"] != unknownLimitPercent {
-		t.Errorf("log line has limit_percent %v from %v, want 0 from %s",
-			line.fields["limit_percent"], line.fields["limit_percent_setting"],
+	if line.fields["rate_limit_percent"] != float64(0) ||
+		line.fields["rate_limit_percent_setting"] != unknownLimitPercent {
+		t.Errorf("log line has rate_limit_percent %v from %v, want 0 from %s",
+			line.fields["rate_limit_percent"], line.fields["rate_limit_percent_setting"],
 			unknownLimitPercent)
 	}
 
@@ -210,7 +216,7 @@ func TestLowestPercentageApplies(t *testing.T) {
 		name string
 		env  map[string]string
 		from string
-		// want is the log line's limit_percent, as percentText gives it.
+		// want is the log line's rate_limit_percent, as percentText gives it.
 		want string
 	}{
 		{
@@ -251,7 +257,8 @@ func TestLowestPercentageApplies(t *testing.T) {
 			s.get(tc.from, http.StatusOK, requestlog.ActionForward)
 
 			line := s.get(tc.from, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-			wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+			wantPercent(t, "rate_limit_percent",
+				line.RateLimitPercent, line.RateLimitPercentSetting,
 				tc.want)
 		})
 	}
@@ -284,7 +291,7 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 	// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 	// says, with a GeoJS that never answers.
 	synctest.Test(t, func(t *testing.T) {
-		server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
+		server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
 			map[string]string{unknownLimitPercent: "0"})
 
 		// Once the time the request waits for its answer is up, the client
@@ -294,7 +301,8 @@ func TestClientWithoutAnAnswerInTimeHasTheUnknownLimitPercent(t *testing.T) {
 
 		line := out.requestLine(t)
 		wantLine(t, line, http.StatusForbidden, requestlog.ActionClientIsRateLimited)
-		wantPercent(t, "limit_percent", line.LimitPercent, line.LimitPercentSetting,
+		wantPercent(t, "rate_limit_percent",
+			line.RateLimitPercent, line.RateLimitPercentSetting,
 			"0 from "+unknownLimitPercent)
 	})
 }
@@ -327,7 +335,7 @@ func TestRequestWaitsForItsLookupWhileABiasedThresholdIsSet(t *testing.T) {
 			// In a synctest bubble, as TestRequestWaitsAsLongAsTheLookupTimeoutSays
 			// says, with a GeoJS that never answers.
 			synctest.Test(t, func(t *testing.T) {
-				server, out, _ := newDiscriminator(t, unansweredGeoJSURL, time.Now,
+				server, out, _ := newDiscriminator(t, silentGeoJSURL, time.Now,
 					map[string]string{
 						lookupTimeout: timeout.String(), tagLists: "vpn=" + vpnList, tc.setting: tc.value,
 					})