fix: prevent race condition in concurrent Prometheus scrapes

Add CollectAndServe method that holds the mutex during both metric
collection and serving. This prevents a race where one request could
reset metrics while another is still serving them.

Author: claude

engine/internal/srv/metrics/collector.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/http"
 	"strconv"
 	"sync"
 	"time"
@@ -76,6 +77,20 @@ func (c *Collector) Collect(ctx context.Context) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
 
+	c.collectAll(ctx)
+}
+
+// CollectAndServe collects metrics and serves them while holding the lock.
+// This prevents race conditions between concurrent Prometheus scrapes.
+func (c *Collector) CollectAndServe(ctx context.Context, handler http.Handler, w http.ResponseWriter, r *http.Request) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.collectAll(ctx)
+	handler.ServeHTTP(w, r)
+}
+
+func (c *Collector) collectAll(ctx context.Context) {
 	c.metrics.Reset()
 
 	c.collectInstanceMetrics()

engine/internal/srv/server.go

@@ -304,8 +304,9 @@ func reportLaunching(cfg *srvCfg.Config) {
 
 // metricsHandler returns an HTTP handler that collects and exposes Prometheus metrics.
 func (s *Server) metricsHandler() http.Handler {
+	handler := promhttp.HandlerFor(s.metricsRegistry, promhttp.HandlerOpts{})
+
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		s.metricsCollector.Collect(r.Context())
-		promhttp.HandlerFor(s.metricsRegistry, promhttp.HandlerOpts{}).ServeHTTP(w, r)
+		s.metricsCollector.CollectAndServe(r.Context(), handler, w, r)
 	})
 }