fix: critical Keep-Alive correlation bug - network events evicted prematurely

- Fix cleanExpired() to use TTL map instead of event timestamp for B events
- Increase default correlation time window from 1s to 10s
- Increase default network TTL from 30s to 120s for long sessions
- Use payload timestamp for network events when available (fallback to now)
- Add comprehensive Keep-Alive tests (TTL reset, long session scenarios)
- Bump version to 1.1.7

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

packaging/rpm/logcorrelator.spec

@@ -2,7 +2,7 @@
 # Compatible with CentOS 7, Rocky Linux 8, 9, 10
 
 # Define version before Version: field for RPM macro support
-%global spec_version 1.1.6
+%global spec_version 1.1.7
 
 Name:           logcorrelator
 Version:        %{spec_version}
@@ -121,6 +121,13 @@ fi
 /etc/logrotate.d/logcorrelator
 
 %changelog
+* Tue Mar 03 2026 logcorrelator <dev@example.com> - 1.1.7-1
+- Fix: Critical Keep-Alive bug - network events evicted based on original timestamp instead of reset TTL
+- Fix: Correlation time window increased from 1s to 10s for HTTP Keep-Alive support
+- Fix: Network source now uses payload timestamp if available (fallback to reception time)
+- Change: Default network TTL increased from 30s to 120s for long Keep-Alive sessions
+- Test: Added comprehensive Keep-Alive tests (TTL reset, long session scenarios)
+
 * Tue Mar 03 2026 logcorrelator <dev@example.com> - 1.1.6-1
 - Docs: Update ClickHouse schema documentation (http_logs_raw + http_logs tables)
 - Fix: ClickHouse insertion uses single raw_json column (FORMAT JSONEachRow)