improve(sessions): speed up session-key routing

[steipete]

What Problem This Solves

Resolves repeated CPU and allocation work in session routing: each parse of an already-normalized agent:<id>:<rest> key tokenized the complete key, allocated a token array and tail array, then rejoined every remaining segment even though routing only needs the first two delimiters.

Why This Change Was Made

The canonical parser now validates the exact agent: prefix, locates the agent boundary once, and slices the two returned fields directly. This keeps the existing normalization owner and malformed-key rejection semantics, including rejecting an empty agent segment or first rest segment. Opaque provider-owned peer IDs and all downstream routing remain unchanged.

This is the owner-level fix rather than a caller cache: parseAgentSessionKey is the shared parser used by routing, event-session handling, policy derivation, and session-store conversion, so avoiding redundant tokenization there improves every caller without adding lifecycle or freshness state.

User Impact

Ordinary session routing and policy decisions use less CPU and allocate fewer temporary strings/arrays. There is no intended output, configuration, storage, protocol, or session-identity change.

Production LOC: +6/-6 (net 0) | Tests: +0/-0

Evidence

• Exact integration base: 3ae7ba319461c00aba59e0d1b74df0ac0e21f45e; head: 510d94ddb45d941445bb098d4be26273d946300b.
• Deterministic current-main work proof over 10,000 unique canonical keys: full-key String.prototype.split calls changed from 10,000 to 0; checksum stayed 417780.
• Fresh Node 24.15.0 benchmark, 7 rounds × 2,000,000 operations:
  • canonical owner median: 1114.813 ms → 142.222 ms (7.84× throughput-equivalent improvement)
  • public resolveAgentIdFromSessionKey median: 1375.725 ms → 292.767 ms (4.70×)
  • parsed result and benchmark checksums were unchanged.
• Exact differential: 250,008 deterministic malformed, whitespace, mixed-case, opaque Signal/Matrix, and nested-tail inputs produced zero mismatches; baseline/final SHA-256 both e1d45dd6b534a6d16d77da1fc05cb7f6db3779668847961a28740cac4e87577f.
• Focused/sibling suites after the final rebase: 152/152 tests passed across routing, case preservation, event-session routing, and runtime policy.
• Exact-head node scripts/check-changed.mjs: passed.
• Full pnpm build: passed; only existing third-party direct-eval warnings appeared.
• Fresh exact-head bundled autoreview: TruffleHog clean; Codex gpt-5.6-sol/high; no findings; patch correct confidence 0.99.

No new timing or implementation-coupled test was committed: existing behavior suites already cover the parser contract, while the deterministic external split-count proof captures the performance defect without adding a production seam.

Provenance: the original full-tail split/join shape was introduced in de3b68740aa9 (2026-01-18, Peter Steinberger); strict empty-segment semantics were carried forward by #89884 / 65fec9d787e3 (2026-06-27, authored by @mushuiyu886 and merged by @steipete). This change preserves those semantics.

AI-assisted: yes (Amp). No agent transcript is attached or published.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[steipete]

Land-ready proof for exact head 510d94ddb45d941445bb098d4be26273d946300b:

• Exact-head CI is green: https://github.com/openclaw/openclaw/actions/runs/32498625792
• Repository-native OPENCLAW_TESTBOX=1 scripts/pr prepare-run 127249 passed, including review guard/artifact validation and hosted CI/Testbox gates.
• Native review recommendation is READY FOR /prepare-pr, with zero findings; fresh exact-head bundled autoreview was also clean (patch is correct, confidence 0.99; TruffleHog clean).
• Verification passed: 152/152 focused and sibling tests, exact-head changed checks, full build, and a 250,008-input differential with zero mismatches and identical SHA-256.
• Fresh Node 24 benchmark improved the canonical parser 7.84× and public session-key agent resolution 4.70×, with unchanged parsed output and checksums.
• Deterministic work proof changed 10,000 full-key split calls to zero while retaining the same checksum.
• The latest ClawSweeper comment is a review-start placeholder and contains no findings or Rank-up moves: items to disposition.

No agent transcript is attached or published.

[steipete]

Merged via squash.

• Prepared head SHA: 510d94ddb45d941445bb098d4be26273d946300b
• Landed commit: 870f936851f9f7191586115a5a0132c2f4752d44