chronos-ruby 0.2.0.pre.1 → 0.4.0.pre.1

data/docs/modules/remote-configuration.md

@@ -0,0 +1,54 @@
+# Remote configuration module
+
+## Problem
+
+Operators may need to reduce event volume or stop collection during an incident without redeploying a legacy application. Accepting unrestricted server instructions would create remote-code, SSRF, credential, privacy, and memory risks.
+
+## Boundary
+
+`NetHttpTransport` only parses a bounded JSON object from the `X-Chronos-Remote-Configuration` success-response header. `Chronos::Application::RemoteConfiguration` owns the allowlist and local upper bounds. `DeliveryPipeline` applies accepted policy to later capture and delivery work.
+
+## Allowed fields
+
+| Field | Accepted value | Local restriction |
+|---|---|---|
+| `sampling_rate` | Number from `0.0` to `1.0` | Cannot exceed local `sampling_rate` |
+| `enabled_event_types` | Array of strings | Intersected with local and implemented event types |
+| `max_payload_size` | Integer | Cannot exceed local maximum or fall below 256 bytes |
+| `ignored_fingerprints` | Up to 100 strings | Exact matching only; 256 bytes per value |
+| `send_interval` | Non-negative seconds | Cannot exceed `max_remote_send_interval` |
+| `kill_switch` | Boolean | Stops later capture while active |
+
+Unknown keys are ignored. If a recognized value is invalid, the document is rejected atomically and the previous policy remains active.
+
+## Explicitly forbidden
+
+Remote configuration cannot change host, proxy, project ID, project key, TLS verification, logger, queue or backlog capacity, retry limits, local upper bounds, Ruby code, object serialization, regular expressions, or arbitrary headers. No `eval`, `send`, `Marshal`, YAML, or application callback is used.
+
+## Example server response
+
+```text
+HTTP/1.1 202 Accepted
+X-Chronos-Remote-Configuration: {"sampling_rate":0.25,"send_interval":1.0,"kill_switch":false}
+```
+
+Disable this channel locally when it is not required:
+
+```ruby
+Chronos.configure do |config|
+  # connection settings omitted
+  config.remote_configuration = false
+end
+```
+
+## Risks and limits
+
+- The policy is process-local and is not persisted across restarts.
+- A stale policy remains until another accepted response changes it.
+- The header size is bounded before JSON parsing, but upstream proxies may impose a lower header limit.
+- Sampling uses process-local randomness and is not a globally exact rate.
+- Version 0.3 does not poll a separate configuration endpoint.
+
+## Tests
+
+Tests cover the field allowlist, local caps, unsupported event types, invalid types, regex rejection, forbidden endpoint and credential keys, response-header byte limits, kill switch, sampling, and atomic preservation of previous state.

data/docs/modules/retry-backlog.md

@@ -0,0 +1,60 @@
+# Retry and backlog module
+
+## Problem
+
+Transient endpoint failures must not discard every event immediately, block application threads indefinitely, or grow memory without a limit.
+
+## Boundary
+
+Retry belongs to `Chronos::Application::DeliveryPipeline`, not `NetHttpTransport`, because HTTP classifies an outcome while application policy decides whether another attempt is acceptable. `Chronos::Internal::MemoryBacklog` is separate from the asynchronous queue because it stores failed deliveries, not newly accepted work.
+
+## Data flow
+
+```mermaid
+stateDiagram-v2
+  [*] --> accepted
+  accepted --> serialized
+  serialized --> queued: asynchronous capture
+  queued --> sent: successful delivery
+  serialized --> sent: synchronous delivery
+  queued --> retried: network, 408, 429, or 5xx
+  retried --> sent: later attempt succeeds
+  retried --> backlog: attempts exhausted or circuit open
+  backlog --> sent: later half-open recovery
+  backlog --> dropped: backlog full
+  queued --> rejected: permanent 4xx
+```
+
+`RetryPolicy` calculates exponential backoff with positive bounded jitter. `Retry-After` is respected only within `retry_max_interval`. `CircuitBreaker` opens after the configured consecutive failure count, rejects concurrent probes, and permits one half-open probe after `circuit_reset_timeout`.
+
+The memory backlog accepts only `SerializedEvent`. Sanitization and safe serialization therefore happen before an event can enter retry storage. Its capacity is `backlog_size`; zero disables retention. The oldest stored event is attempted as new delivery activity arrives. No background timer or additional thread exists for backlog draining.
+
+## Configuration and extension
+
+```ruby
+Chronos.configure do |config|
+  # connection settings omitted
+  config.max_retries = 3
+  config.retry_base_interval = 0.5
+  config.retry_max_interval = 30.0
+  config.retry_jitter = 0.25
+  config.backlog_size = 100
+  config.circuit_failure_threshold = 5
+  config.circuit_reset_timeout = 30.0
+end
+```
+
+Tests may inject a clock, sleeper, random source, backlog, or retry policy into `DeliveryPipeline`. These are internal composition points rather than stable public configuration APIs.
+
+## Risks and limits
+
+- Events in memory are lost on process exit.
+- A quiet process does not drain backlog until another event triggers delivery.
+- Backlog order is best effort when multiple workers are active.
+- Retry sleeps occupy a fixed worker, never the application caller for asynchronous capture.
+- Synchronous capture waits for configured retries and should be used only when that latency is acceptable.
+- Disk persistence is deliberately excluded from version 0.3.
+
+## Tests
+
+Unit tests cover bounded exponential delay, retry limits, `Retry-After`, permanent `4xx`, circuit opening and half-open recovery, fixed backlog capacity, raw-object rejection, prolonged outage, state counters, and recovery draining. The privacy contract proves that fixture secrets do not enter backlog storage.

data/docs/modules/transport.md

@@ -2,8 +2,10 @@
 
 `Chronos::Ports::Transport` defines delivery behavior. `Chronos::Adapters::NetHttpTransport` implements it with the Ruby standard library.
 
-Each event uses bounded open and read timeouts. TLS verification is enabled by default. Authentication and idempotency values are headers. Redirects are not followed. Statuses are classified as success, client error, rate limited, server error, network error, or closed.
+Each event uses bounded open and read timeouts. TLS verification is enabled by default. Authentication and idempotency values are headers. Redirects are not followed. Statuses are classified as success, request timeout, client error, rate limited, server error, network error, or closed. HTTP `408`, `429`, `5xx`, and network failures are retryable; other `4xx` responses are permanent.
 
-The adapter creates a connection per event in version 0.2. This is conservative for legacy applications and avoids shared socket lifecycle state. Batch optimization and retry may be added behind the same port.
+The adapter creates a connection per event in version 0.3. This is conservative for legacy applications and avoids shared socket lifecycle state. Retry remains in `DeliveryPipeline`, behind the transport port.
 
-Risks include proxy credential exposure, TLS incompatibility on old operating systems, and endpoint latency. Tests use a local fake HTTP server to verify headers, `2xx`, `429`, `500`, timeout, and invalid TLS behavior.
+A successful response may contain `X-Chronos-Remote-Configuration`. The adapter rejects the header when it exceeds `remote_config_max_bytes` or is not a JSON object. It never interprets policy or accepts remote endpoint and credential changes; that allowlist belongs to `RemoteConfiguration`.
+
+Risks include proxy credential exposure, TLS incompatibility on old operating systems, endpoint latency, and stale remote policy until another response arrives. Tests use a local fake HTTP server to verify headers, `2xx`, `408`, `429`, `500`, timeout, invalid TLS, and bounded remote policy parsing.

data/docs/performance.md

@@ -1,6 +1,6 @@
 # Performance
 
-Performance is a functional requirement, but version 0.2 makes no unverified speed claim.
+Performance is a functional requirement, but version 0.4 makes no unverified speed claim.
 
 Current controls:
 
@@ -12,9 +12,14 @@ Current controls:
 - worker count is fixed and threads start lazily;
 - producers never wait for queue capacity;
 - HTTP open and read timeouts are explicit;
+- retry count, delay, jitter, and `Retry-After` are capped;
+- the circuit breaker suppresses requests during sustained failure;
+- retry backlog capacity is fixed and may be disabled;
 - shutdown and flush have caller-controlled timeouts.
+- request context and breadcrumbs have fixed structural and byte limits;
+- Rack middleware never consumes request or response bodies.
 
-Run the scripts under `benchmarks/` and record Ruby version, operating system, CPU, warmup, iteration count, median, and dispersion before publishing results. `benchmarks/filtering.rb` measures the version 0.2 privacy pass. Request overhead is not measured because automatic request integration is outside version 0.2.
+Run the scripts under `benchmarks/` and record Ruby version, operating system, CPU, warmup, iteration count, median, and dispersion before publishing results. `benchmarks/filtering.rb` measures privacy filtering, `benchmarks/retry_backlog.rb` measures fixed-memory outage behavior, and `benchmarks/request_overhead.rb` compares a successful direct Rack-protocol call with the middleware path.
 
 ## Version 0.2 development measurement
 
@@ -26,3 +31,35 @@ A local diagnostic run on 2026-07-19 used macOS arm64 (`T8103`), legacy x86_64 R
 | Ruby 2.6.3 | 1,904 µs/event | 4,705 µs/event | 1,037 µs/pass |
 
 The capture benchmark uses an in-memory transport and includes queue draining. The serialization fixture contains 20 backtrace frames; the filtering fixture contains nested fields and 20 repeated items. These are single aggregate development runs, not published performance claims: they do not provide median or dispersion and must be repeated on controlled hardware before comparison with another agent.
+
+## Version 0.3 resilience benchmark
+
+Run:
+
+```bash
+ITERATIONS=10000 bundle _1.17.3_ exec ruby benchmarks/retry_backlog.rb
+```
+
+The benchmark opens the circuit after one synthetic network failure, retains at most 100 serialized events, and measures bounded rejection into a full backlog. It performs no network I/O and is intended to detect accidental unbounded growth or excessive control-path overhead, not to claim production throughput.
+
+A local diagnostic run on 2026-07-20 used Ruby 2.2.10 on macOS arm64 with 1,000 capture, serialization, and filtering iterations plus 10,000 queue and outage iterations:
+
+| Measurement | Result |
+|---|---:|
+| Asynchronous local capture | 1,824 µs/event |
+| Full serialization | 3,961 µs/event |
+| Privacy filtering fixture | 777 µs/pass |
+| Bounded queue | 1,648,533 operations/second |
+| Open-circuit backlog handling | 88,922 operations/second |
+
+The outage run retained exactly 100 events and rejected 9,900 additional events without growing the backlog. These are single development runs without median or dispersion and are not comparative performance claims.
+
+## Version 0.4 Rack middleware benchmark
+
+Run:
+
+```bash
+ITERATIONS=100000 bundle _1.17.3_ exec ruby benchmarks/request_overhead.rb
+```
+
+A local diagnostic run on 2026-07-20 used Ruby 2.2.10 on macOS arm64 and 10,000 successful Rack-protocol calls. The direct application calls took 0.013272 seconds and middleware calls took 0.539758 seconds, for an estimated 52.649 microseconds of middleware work per request. The fixture uses no network, error capture, or response-body enumeration. This is a single development measurement, not a production latency claim; controlled warmup, median, and dispersion remain required before publishing a performance claim.

data/docs/privacy-lgpd.md

@@ -1,6 +1,6 @@
 # Privacy and LGPD
 
-Version 0.2 sanitizes every exception event before JSON serialization, queueing, or transport. This reduces accidental exposure, but the host application remains responsible for lawful purpose, minimization, access control, retention, and responses to data-subject requests.
+Version 0.4 sanitizes every exception event before JSON serialization, queueing, retry backlog, or transport. This reduces accidental exposure, but the host application remains responsible for lawful purpose, minimization, access control, retention, and responses to data-subject requests.
 
 ## Default policy
 
@@ -13,7 +13,15 @@ Version 0.2 sanitizes every exception event before JSON serialization, queueing,
 | Payment-card candidates that pass the Luhn check | Replaced with `[FILTERED_CARD]` |
 | IPv4 addresses | Last octet replaced with `0` |
 | Unknown Ruby objects | Represented by class name without calling application serialization |
-| Request/response bodies, cookies, HTTP headers, SQL binds, environment variables | Never collected automatically in version 0.2 |
+| Request/response bodies, raw query strings, cookies, authorization headers, SQL binds, environment variables | Never collected automatically in version 0.4 |
+
+The retry backlog exists only in process memory, accepts only `SerializedEvent`, has a fixed capacity, and disappears on process exit. Version 0.4 does not persist telemetry to disk.
+
+## Rack context and breadcrumbs
+
+The Rack middleware copies only bounded operational fields and parameter hashes that another component already parsed. It does not read `rack.input` or copy `QUERY_STRING`. User context is opt-in through `chronos.user`, and user agent collection is disabled unless the middleware option enables it.
+
+Breadcrumbs contain category, bounded message, bounded metadata, and timestamp. No raw request, response, SQL, cache, job, log, or external HTTP payload is added automatically. Rack context and breadcrumbs pass through the same sanitizer as manual context before queueing.
 
 Blocklist matching accepts `String`, `Symbol`, and `Regexp`. String and Symbol matching is case-insensitive after punctuation normalization and also protects namespaced keys such as `user_password`.
 

data/docs/troubleshooting.md

@@ -2,7 +2,7 @@
 
 ## Configuration raises an error
 
-Verify `project_id`, `project_key`, and `host`. HTTPS is required while `ssl_verify` is true. Queue size, worker count, payload size, and timeouts must be positive.
+Verify `project_id`, `project_key`, and `host`. HTTPS is required while `ssl_verify` is true. Queue size, worker count, payload size, breadcrumb capacity, and timeouts must be positive. `breadcrumb_max_bytes` must be at least 128.
 
 ## `Chronos.notify` returns false
 
@@ -10,7 +10,15 @@ The agent may be unconfigured, disabled, ignored in the current environment, una
 
 ## `Chronos.notify_sync` returns false
 
-Check DNS, TLS certificates, credentials, HTTP status, proxy configuration, and timeout values. Version 0.2 does not retry.
+Check DNS, TLS certificates, credentials, HTTP status, proxy configuration, and timeout values. The resilience layer retries only network errors, HTTP `408`, `429`, and `5xx` responses. Inspect `agent.diagnostics` when constructing an agent directly to see retry state, backlog usage, and the circuit state.
+
+## Rack exception is not captured
+
+Confirm that `Chronos.configure` runs before the middleware handles requests and that the middleware wraps the application component that raises. Version 0.4 captures exceptions raised by the initial downstream Rack call; an exception raised later while a server enumerates a streaming response body is outside this release. The original exception is always re-raised, so the server log should still show it.
+
+## Context appears missing
+
+The legacy context store is thread-local. A new application-created thread does not inherit context. Establish a new `Chronos.with_context` scope inside that thread, and issue manual notification before the scope exits. For Rack capture, supply user and explicit parameters through the documented environment keys.
 
 ## Events disappear during shutdown
 

data/lib/chronos/adapters/net_http_transport.rb

@@ -1,5 +1,6 @@
 require "net/http"
 require "openssl"
+require "json"
 require "stringio"
 require "uri"
 require "zlib"
@@ -10,16 +11,17 @@ module Chronos
     #
     # @responsibility Send serialized events over bounded HTTPS requests.
     # @motivation Use the Ruby standard library to preserve legacy compatibility.
-    # @limits It classifies failures but does not retry or persist events in version 0.2.
+    # @limits It classifies failures but leaves retry and backlog policy to the application layer.
     # @collaborators Configuration::Snapshot, SerializedEvent, and TransportResult.
     # @thread_safety Creates a new Net::HTTP connection per call and synchronizes health state.
     # @compatibility Ruby 2.2.10 through Ruby 2.6; no Rails dependency.
     # @example
     #   result = transport.send_event(serialized_event)
     # @errors Network, TLS, and HTTP errors are returned, never raised to callers.
-    # @performance One bounded network request per event in version 0.2.
+    # @performance One bounded network request per delivery attempt in version 0.3.
     class NetHttpTransport
       EVENT_PATH = "/api/v1/events".freeze
+      REMOTE_CONFIGURATION_HEADER = "X-Chronos-Remote-Configuration".freeze
 
       def initialize(config, logger = nil)
         @config = config
@@ -100,7 +102,11 @@ module Chronos
       def classify(response)
         code = response.code.to_i
         options = {:status_code => code}
-        return Ports::TransportResult.new(:success, options) if code >= 200 && code < 300
+        if code >= 200 && code < 300
+          options[:remote_configuration] = parse_remote_configuration(response)
+          return Ports::TransportResult.new(:success, options)
+        end
+        return Ports::TransportResult.new(:request_timeout, options) if code == 408
         if code == 429
           options[:retry_after] = response["Retry-After"]
           return Ports::TransportResult.new(:rate_limited, options)
@@ -110,6 +116,18 @@ module Chronos
         Ports::TransportResult.new(:client_error, options)
       end
 
+      def parse_remote_configuration(response)
+        return nil unless @config.remote_configuration
+
+        value = response[REMOTE_CONFIGURATION_HEADER]
+        return nil if value.nil? || value.bytesize > @config.remote_config_max_bytes
+
+        parsed = JSON.parse(value)
+        parsed.is_a?(Hash) ? parsed : nil
+      rescue JSON::ParserError, EncodingError
+        nil
+      end
+
       def request_body(body)
         return body unless @config.gzip
 

data/lib/chronos/adapters/thread_local_context_store.rb

@@ -0,0 +1,52 @@
+module Chronos
+  module Adapters
+    # Stores execution context in the current Ruby thread.
+    #
+    # @responsibility Isolate request context and restore nested scopes reliably.
+    # @motivation Legacy Ruby does not provide a portable fiber-local storage API.
+    # @limits Context does not propagate to new threads or across processes.
+    # @collaborators ContextStore port and Rack middleware.
+    # @thread_safety Each thread owns an independent value; one instance may be shared.
+    # @compatibility Ruby 2.2.10 through Ruby 2.6.
+    # @example
+    #   store.with_context(:request_id => "r1") { store.get }
+    # @errors The previous value is restored in ensure even when the block raises.
+    # @performance Reads and writes are constant-time thread-local operations.
+    class ThreadLocalContextStore
+      def initialize
+        @key = "chronos_context_#{object_id}".freeze
+      end
+
+      def get
+        Thread.current[@key] || {}
+      end
+
+      def set(context)
+        raise ArgumentError, "context must be a Hash" unless context.is_a?(Hash)
+
+        Thread.current[@key] = context
+      end
+
+      def clear
+        Thread.current[@key] = nil
+        nil
+      end
+
+      def with_context(context)
+        previous = Thread.current[@key]
+        set(merge_context(previous || {}, context))
+        yield
+      ensure
+        previous ? Thread.current[@key] = previous : clear
+      end
+
+      private
+
+      def merge_context(current, additional)
+        raise ArgumentError, "context must be a Hash" unless additional.is_a?(Hash)
+
+        current.merge(additional)
+      end
+    end
+  end
+end

data/lib/chronos/agent.rb

@@ -1,10 +1,10 @@
 module Chronos
   # Runtime composition root for the framework-independent Chronos agent.
   #
-  # @responsibility Own transport, queue, workers, and the capture use case.
+  # @responsibility Own delivery, capture, execution context, and breadcrumb collaborators.
   # @motivation Keep construction details outside the public module facade.
-  # @limits It does not integrate with Rails, Rack, or job systems.
-  # @collaborators Configuration snapshot, CaptureException, BoundedQueue, and NetHttpTransport.
+  # @limits It does not install Rack, Rails, or job integrations automatically.
+  # @collaborators CaptureException, DeliveryPipeline, ContextStore, and BreadcrumbBuffer.
   # @thread_safety Runtime collaborators synchronize mutable state.
   # @compatibility Ruby 2.2.10 through Ruby 2.6.
   # @example
@@ -19,39 +19,96 @@ module Chronos
     def initialize(config, options = {})
       @config = config
       @logger = options[:logger] || Internal::SafeLogger.new(config.logger)
+      @context_store = options[:context_store] || build_context_store(config.context_store)
+      unless Ports::ContextStore.compatible?(@context_store)
+        raise ArgumentError, "context store does not implement the Chronos context-store port"
+      end
       @transport = options[:transport] || Adapters::NetHttpTransport.new(config, @logger)
       unless Ports::Transport.compatible?(@transport)
         raise ArgumentError, "transport does not implement the Chronos transport port"
       end
-      @queue = options[:queue] || Internal::BoundedQueue.new(config.queue_size)
-      @worker_pool = options[:worker_pool] || Internal::WorkerPool.new(@queue, @transport, config.workers, @logger)
-      @capture = options[:capture] || Application::CaptureException.new(config, @worker_pool, @transport, @logger)
+      pipeline_options = {}
+      pipeline_options[:queue] = options[:queue] if options[:queue]
+      pipeline_options[:worker_pool] = options[:worker_pool] if options[:worker_pool]
+      @delivery_pipeline = options[:delivery_pipeline] || Application::DeliveryPipeline.new(
+        config,
+        @transport,
+        @logger,
+        pipeline_options
+      )
+      @capture = options[:capture] || Application::CaptureException.new(config, @delivery_pipeline, @logger)
     end
 
     def notify(exception, context = {})
-      @capture.call(exception, context)
+      @capture.call(exception, context_for_capture(context))
     end
 
     def notify_sync(exception, context = {})
-      @capture.call_sync(exception, context)
+      @capture.call_sync(exception, context_for_capture(context))
+    end
+
+    def with_context(context = {}, &block)
+      @context_store.with_context(context, &block)
+    end
+
+    def add_breadcrumb(attributes = {})
+      context = @context_store.get
+      buffer = context[:__chronos_breadcrumbs]
+      buffer ||= Core::BreadcrumbBuffer.new(@config.breadcrumb_capacity, @config.breadcrumb_max_bytes)
+      buffer.add(attributes)
+      @context_store.set(context.merge(:__chronos_breadcrumbs => buffer))
+      true
+    rescue StandardError => error
+      @logger.warn("Chronos breadcrumb failed: #{error.class}")
+      false
     end
 
     def flush(timeout = DEFAULT_FLUSH_TIMEOUT)
-      @worker_pool.flush(timeout)
+      @delivery_pipeline.flush(timeout)
     rescue StandardError => error
       @logger.warn("Chronos flush failed: #{error.class}")
       false
     end
 
     def close(timeout = DEFAULT_FLUSH_TIMEOUT)
-      @worker_pool.close(timeout)
+      @delivery_pipeline.close(timeout)
     rescue StandardError => error
       @logger.warn("Chronos close failed: #{error.class}")
       false
     end
 
     def diagnostics
-      @queue.stats
+      details = @delivery_pipeline.diagnostics
+      details[:queue].merge(details)
+    end
+
+    private
+
+    def build_context_store(strategy)
+      return Adapters::ThreadLocalContextStore.new if strategy == :thread_local
+
+      strategy
+    end
+
+    def context_for_capture(additional)
+      merged = deep_merge(context_hash(@context_store.get), context_hash(additional))
+      buffer = merged.delete(:__chronos_breadcrumbs) || merged.delete("__chronos_breadcrumbs")
+      if buffer.respond_to?(:to_a)
+        merged[:context] = context_hash(merged[:context]).merge("breadcrumbs" => buffer.to_a)
+      end
+      merged
+    rescue StandardError
+      context_hash(additional)
+    end
+
+    def deep_merge(left, right)
+      left.merge(right) do |_key, old_value, new_value|
+        old_value.is_a?(Hash) && new_value.is_a?(Hash) ? deep_merge(old_value, new_value) : new_value
+      end
+    end
+
+    def context_hash(value)
+      value.is_a?(Hash) ? value : {}
     end
   end
 end

data/lib/chronos/application/capture_exception.rb

@@ -2,10 +2,10 @@ module Chronos
   module Application
     # Orchestrates exception normalization, serialization, queueing, and delivery.
     #
-    # @responsibility Execute the version 0.2 exception capture pipeline.
+    # @responsibility Execute the exception capture pipeline for manual and integration callers.
     # @motivation Keep the public facade and transport adapters free of use-case logic.
-    # @limits It does not implement sampling, retry, backlog, or framework hooks.
-    # @collaborators NoticeBuilder, PayloadSerializer, WorkerPool, and Transport.
+    # @limits Framework hooks remain separate integration adapters.
+    # @collaborators NoticeBuilder, PayloadSerializer, and DeliveryPipeline.
     # @thread_safety Collaborators are immutable or synchronized; calls may run concurrently.
     # @compatibility Ruby 2.2.10 through Ruby 2.6; independent of Rails.
     # @example
@@ -13,20 +13,25 @@ module Chronos
     # @errors All internal StandardError failures are contained and logged.
     # @performance Local work is bounded before asynchronous queue insertion.
     class CaptureException
-      def initialize(config, worker_pool, transport, logger = nil, options = {})
+      def initialize(config, delivery_pipeline, logger = nil, options = {})
         @config = config
-        @worker_pool = worker_pool
-        @transport = transport
+        @delivery_pipeline = delivery_pipeline
         @logger = logger || Internal::SafeLogger.new(config.logger)
         @notice_builder = options[:notice_builder] || Core::NoticeBuilder.new(config)
-        @serializer = options[:serializer] || Core::PayloadSerializer.new(config)
+        @serializer = options[:serializer] || Core::PayloadSerializer.new(
+          config,
+          nil,
+          :max_payload_size => proc { @delivery_pipeline.max_payload_size }
+        )
       end
 
       def call(exception, context = {})
         return false unless capture_enabled?
 
-        event = build_event(exception, context)
-        @worker_pool.enqueue(event)
+        notice = build_notice(exception, context)
+        return false unless @delivery_pipeline.capture_allowed?("exception", notice.fingerprint)
+
+        @delivery_pipeline.enqueue(@serializer.call(notice))
       rescue StandardError => error
         diagnose(error)
         false
@@ -35,8 +40,10 @@ module Chronos
       def call_sync(exception, context = {})
         return false unless capture_enabled?
 
-        event = build_event(exception, context)
-        @transport.send_event(event).success?
+        notice = build_notice(exception, context)
+        return false unless @delivery_pipeline.capture_allowed?("exception", notice.fingerprint)
+
+        @delivery_pipeline.deliver_sync(@serializer.call(notice))
       rescue StandardError => error
         diagnose(error)
         false
@@ -48,9 +55,8 @@ module Chronos
         @config.enabled_for_environment? && @config.error_notifications
       end
 
-      def build_event(exception, context)
-        notice = @notice_builder.call(exception, context)
-        @serializer.call(notice)
+      def build_notice(exception, context)
+        @notice_builder.call(exception, context)
       end
 
       def diagnose(error)

data/lib/chronos/application/circuit_breaker.rb

@@ -0,0 +1,70 @@
+module Chronos
+  module Application
+    # Small circuit breaker for retryable transport failures.
+    #
+    # @responsibility Stop delivery attempts temporarily after repeated failures.
+    # @motivation Prevent retry storms while the Chronos endpoint is unavailable.
+    # @limits It keeps no payload and permits only one half-open probe.
+    # @collaborators DeliveryPipeline and a monotonic clock.
+    # @thread_safety All transitions are protected by a mutex.
+    # @compatibility Ruby 2.2.10 through Ruby 2.6.
+    # @example
+    #   transport.send_event(event) if breaker.allow_request?
+    # @errors Clock failures are contained by DeliveryPipeline.
+    # @performance Constant time with fixed memory.
+    class CircuitBreaker
+      def initialize(failure_threshold, reset_timeout, clock)
+        @failure_threshold = failure_threshold
+        @reset_timeout = reset_timeout
+        @clock = clock
+        @state = :closed
+        @failures = 0
+        @opened_at = nil
+        @probe_in_flight = false
+        @mutex = Mutex.new
+      end
+
+      def allow_request?
+        @mutex.synchronize do
+          return true if @state == :closed
+          return false if @state == :half_open && @probe_in_flight
+          return false unless reset_elapsed?
+
+          @state = :half_open
+          @probe_in_flight = true
+          true
+        end
+      end
+
+      def record_success
+        @mutex.synchronize do
+          @state = :closed
+          @failures = 0
+          @opened_at = nil
+          @probe_in_flight = false
+        end
+      end
+
+      def record_failure
+        @mutex.synchronize do
+          @failures += 1
+          if @state == :half_open || @failures >= @failure_threshold
+            @state = :open
+            @opened_at = @clock.call
+          end
+          @probe_in_flight = false
+        end
+      end
+
+      def state
+        @mutex.synchronize { @state }
+      end
+
+      private
+
+      def reset_elapsed?
+        @opened_at && (@clock.call - @opened_at >= @reset_timeout)
+      end
+    end
+  end
+end