refactor(correlation): harden UTC parsing and token sizing

[PrzemyslawKlys]

Summary

• harden UTC parsing semantics in timeline correlation executor via TryParseUtcValue (internal)
• treat timestamps without explicit offset as UTC, and preserve explicit offset conversion to UTC
• reuse the same UTC parsing path for both timeline parsing and payload when extraction
• improve correlation token StringBuilder capacity estimation with explicit constants

Why

• reduces locale/timezone ambiguity for timeline and payload timestamp normalization
• keeps correlation/timeline behavior reusable and deterministic without hardcoded assumptions
• improves token-building allocation predictability under large correlation key/value sets

Validation

• dotnet build Sources/EventViewerX/EventViewerX.csproj -c Release
• dotnet test Sources/EventViewerX.Tests/EventViewerX.Tests.csproj -c Release --filter "FullyQualifiedName~TestNamedEventsTimelineQueryExecutor"

Tests Added

• TryParseUtcValue_ShouldTreatUnspecifiedTimestampAsUtc
• TryParseUtcValue_ShouldConvertOffsetTimestampToUtc
• TryParseUtcValue_ShouldReturnFalseForInvalidInput

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[claude]

Claude finished @PrzemyslawKlys's task —— View job

---

Code Review Complete ✅

I've thoroughly reviewed this PR and it looks excellent. The changes are well-implemented, properly tested, and follow good practices.

Summary of Changes

UTC Parsing Hardening (TryParseUtcValue):

• Introduces robust UTC parsing with explicit offset detection
• Handles timestamps without offset as UTC (avoiding timezone ambiguity)
• Preserves explicit offset conversions to UTC
• Used consistently in both timeline parsing and payload extraction

Token Sizing Improvements:

• Adds explicit capacity estimation for StringBuilder in correlation token building
• Uses constants for separator character counts
• Reduces allocation overhead during correlation processing

Code Quality Assessment

✅ Strengths:

1. Robust UTC Parsing Logic (TryParseUtcValue at lines 616-653):

   • Correctly detects explicit offsets/UTC designators
   • Handles various DateTimeKind values appropriately
   • Treats unspecified timestamps as UTC (reduces locale ambiguity)
   • Uses InvariantCulture for consistent parsing

2. Performance Optimization (EstimateCorrelationTokenCapacity at lines 592-608):

   • Smart capacity estimation reduces StringBuilder reallocations
   • Well-defined constants for separator sizes
   • Minimum capacity baseline prevents under-allocation

3. Comprehensive Test Coverage:

   • Tests unspecified timestamp handling
   • Tests explicit offset conversion
   • Tests invalid input handling
   • All critical paths are covered

4. Code Organization:

   • Clean separation of concerns
   • Consistent error handling patterns
   • Good use of constants for maintainability

Security & Best Practices

✅ Security:

• No security concerns identified
• Proper input validation in TryParseUtcValue
• Safe handling of malformed datetime strings

✅ Best Practices:

• Uses InvariantCulture for parsing (prevents locale issues)
• Proper null checking and defensive programming
• Consistent naming and code style
• Good constant definitions and magic number elimination

Performance Considerations

✅ Performance Improvements:

• StringBuilder capacity estimation reduces memory allocations
• Efficient offset detection using character scanning
• Reusable parsing logic eliminates code duplication
• No performance regressions identified

Potential Edge Cases Considered

The implementation handles these edge cases well:

• Timestamps with 'Z' suffix
• Timestamps with positive/negative offsets
• Timestamps without explicit timezone info
• Invalid/malformed timestamp strings
• Various DateTimeKind scenarios

Final Assessment

This is a high-quality refactoring that:

• ✅ Improves timezone handling reliability
• ✅ Reduces allocation overhead
• ✅ Maintains backward compatibility
• ✅ Includes comprehensive tests
• ✅ Follows established patterns in the codebase

Recommendation: Approve - The changes are well-designed, properly tested, and provide clear benefits without introducing risks.