@deepseek-ai/dsh-session-telemetry-otel 0.1.2-alpha.5 → 0.1.3-alpha.2

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/session/session-telemetry-otel/README.md
-README.md: 2f489cbdae9a64ac95484cf6ed3aeddac3fe2b1e
-README.zh.md: 78bc221542d9709acd287f258c54b930ac389106
+README.md: 35dc351bd56fdce396eb4c89c321008eb14796ce
+README.zh.md: a771a06b0e2dab39a2b1e9460a99e8c4c2828fb3

package/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-`dsh-session-telemetry-otel` delivers session records through OpenTelemetry logs and is the only entry a deployment loads for the [session-telemetry seam](../session-telemetry/README.md). Its `mode` decides whether session records follow the live stream, are released only at recorded feedback, or stay local: `FULL` hands every record to the OTel SDK immediately, `FEEDBACK_ONLY` replays the canonical log when a `feedback/record` lands, and `DISABLED` (the default) constructs nothing and shares nothing. Uploading modes compose the OTel JS SDK as-is — `LoggerProvider` → `BatchLogRecordProcessor` → OTLP/HTTP log exporter — and map each record onto `logger.emit()`, so batching, retry, queueing, and loss policy follow the SDK. Records carry the complete event data as the seam's redaction waterfall returns it, so a deployment exporting beyond a trusted boundary mounts its own redaction rules. Modes, configuration, and the export surface come first; the implementation internals live in a collapsible developer section below.
+`dsh-session-telemetry-otel` exports session records through the OTel JS SDK only after new explicit feedback, for all users and providers, including `deepseek-official`. `FEEDBACK_ONLY` releases the canonical prefix through that feedback, including context; later records wait for the next explicit feedback. `DISABLED` constructs no transport. SDK batching can finish an authorized upload without another user interaction or model call. Deployments own their redaction rules.
 
 ## Table of Contents
 
@@ -31,11 +31,10 @@ Mount this plugin when a deployment should export session records through OpenTe
 
 | `mode` | Behavior |
 |---|---|
-| `FULL` | Every projected record, including lifecycle ops records, is handed to the OTel SDK immediately |
-| `FEEDBACK_ONLY` | Each `feedback/record` replays, projects, and redacts the canonical session-log suffix through that event; later records wait for another feedback event and remain local if none arrives |
-| `DISABLED` | Default. No coordinator, provider, processor, or exporter is constructed; no telemetry record leaves the process, and a `feedback/record` logs that nothing will be shared |
+| `FEEDBACK_ONLY` | Default. Text feedback, rating creation/edit, note edit, and withdrawal release the unhanded prefix through that canonical feedback event; later records wait |
+| `DISABLED` | No coordinator, provider, processor, or exporter is constructed; no telemetry record leaves the process. Live feedback warns locally; cold mutations stay silent |
 
-Programmatic TypeScript configuration uses the exported `SessionTelemetryMode` enum; raw string literals are not assignable. The mounted service discloses the resolved mode through the seam's [`SessionTelemetrySharingStatus`](../session-telemetry/README.md#the-sharing-disclosure) `sharing` property (`full` / `feedback-only` / `disabled`), so the `/feedback` acknowledgement reports whether and how the session is shared — even `DISABLED` discloses `disabled`.
+Programmatic TypeScript configuration uses the exported `SessionTelemetryMode` enum; raw string literals are not assignable. `FULL` is rejected, not an alias. The [`sharing` property](../session-telemetry/README.md#the-sharing-disclosure) reports `feedback-only` or `disabled`, not a delivery receipt. The `/feedback` acknowledgement confirms recording only.
 
 ### Minimal configuration
 
@@ -45,7 +44,7 @@ Uploading modes require an exporter URL and accept the SDK option blocks verbati
 - id: sessionTelemetry-otel
   name: '@deepseek-ai/dsh-session-telemetry-otel'
   config:
-    mode: FULL                # explicit opt-in; default: DISABLED
+    mode: FEEDBACK_ONLY       # optional; defaults to FEEDBACK_ONLY
     shutdownTimeoutMillis: 3000 # optional; defaults to 3000
     exporter:                # passed verbatim to the SDK's OTLP/HTTP log exporter
       url: https://collector.example.com/v1/logs
@@ -56,12 +55,14 @@ Uploading modes require an exporter URL and accept the SDK option blocks verbati
 
 | Field | Default | Meaning |
 |---|---|---|
-| `mode` | `DISABLED` | Sharing policy: `FULL`, `FEEDBACK_ONLY`, or `DISABLED` |
+| `mode` | `FEEDBACK_ONLY` | Sharing policy: `FEEDBACK_ONLY` or `DISABLED` |
 | `exporter.url` | required in uploading modes | Full OTLP logs endpoint; must parse as `http(s)` |
 | `exporter`, `processor` | — | Passed verbatim to the SDK exporter and batch processor |
 | `shutdownTimeoutMillis` | `3,000` | Outer deadline for the SDK's complete shutdown sequence |
 
-The generated [configuration catalog](../../../docs/config-catalog.md#deepseek-aidsh-session-telemetry-otel) is the exhaustive source for every accepted field. Upload authorization is positive and fail-closed: an unknown direct-construction mode fails before transport configuration is read, only `FULL` accepts direct `ctx.sessionTelemetry.emit()` calls, and `FEEDBACK_ONLY` treats only the exact `feedback/record` object already stored in the canonical log as consent.
+Direct `ctx.sessionTelemetry.emit()` calls are no-ops in every mode and cannot bypass feedback authorization. Inherited parent feedback does not authorize a child export: the child needs new feedback of its own. Its authorized prefix then includes inherited context.
+
+Model requests, request headers, Session creation or adoption, restoration, and plugin mount or HMR do not authorize capture. Stored feedback alone triggers nothing. SDK scheduled flush and shutdown may finish batches authorized earlier, but never capture new records.
 
 ### What leaves the machine
 
@@ -83,7 +84,7 @@ This section explains the backend's composition; the observable behavior is full
 
 ### Design concept
 
-The backend is a thin adapter over the OTel JS SDK: it owns capture mode, resource identity, and an outer shutdown deadline, and passes everything else through verbatim. Two instrumentation scopes separate record channels — ledger records on `@deepseek-ai/dsh-session-telemetry-otel`, operational records on `@deepseek-ai/dsh-session-telemetry-otel/ops` — so receivers can alert on ops without summing them. Resource identity carries `service.name`/`service.version` from `dsh-llm`'s `APP_IDENTITY` plus the package's anonymous `user.id` (from `$DSH_HOME/.anonymous-user-id`), once per export batch rather than per record.
+The backend is a thin adapter over the OTel JS SDK: it owns feedback authorization, resource identity, and an outer shutdown deadline. Canonical ledger records use the `@deepseek-ai/dsh-session-telemetry-otel` instrumentation scope; this backend captures no operational records. Resource identity carries `service.name`/`service.version` from `dsh-llm`'s `APP_IDENTITY` plus the anonymous `user.id` (from `$DSH_HOME/.anonymous-user-id`), once per export batch rather than per record.
 
 ### Source map
 
@@ -93,11 +94,11 @@ The backend is a thin adapter over the OTel JS SDK: it owns capture mode, resour
 
 ### Capture wiring
 
-`FULL` composes the coordinator in `live` mode and lets direct service calls through; `FEEDBACK_ONLY` composes it in `on-demand` mode, gives the coordinator a private backend capability, and triggers `captureSession(session, event.seq)` only when `session.eventAt(event.seq) === event` confirms the exact canonical feedback record; `DISABLED` registers nothing but a warning on `feedback/record`. The backend deliberately implements no `flush()`: the batch processor owns ordinary flushing, and forwarding the hint to `forceFlush()` would create the sole source of concurrent flushes whose interaction with shutdown's drain is undocumented.
+The backend uses on-demand capture with stored history included. Only new own `feedback/record`, `feedback/message-put`, or `feedback/message-delete` events trigger live capture, bounded by that event. A cold `feedback/committed` notification supplies its committed canonical snapshot without publishing a live Session or Agent. Same-object handoff cursors suppress repeated capture. The backend implements no `flush()`; the SDK owns batching and shutdown drain.
 
 ### Field mapping
 
-Each seam record maps onto one SDK log record: `time` and `severity` become the SDK timestamp and severity fields, and `body` and `attributes` carry through verbatim; the exact field mapping lives in [`src/index.ts`](src/index.ts). In `FULL`, receivers can detect crashes by `shutdown`-record absence — the marker is emitted at the session's own disposal or application teardown, and a marker followed by more events is a telemetry reload. In `FEEDBACK_ONLY`, a released prefix normally has no later `shutdown` marker, so its absence is not a crash signal.
+Each telemetry record maps to one SDK log record with captured timestamp, severity, body, and attributes. Feedback authorizes the complete unhanded prefix, not only the feedback payload.
 
 </details>
 
@@ -133,7 +134,9 @@ These limits define where SDK behavior governs and where export guarantees end.
 
 - **Upstream experimental tree** — `@opentelemetry/sdk-logs` is published from the upstream experimental tree; SDK API churn lands here and only here, while the seam contract does not move.
 - **Live-collector behavior belongs to the SDK exporter** — authentication, TLS, throttling, and other real OTLP deployment behavior follow the upstream SDK rather than a package-owned compatibility layer.
-- **Feedback-time snapshot** — `FEEDBACK_ONLY` retains no telemetry-owned copy before feedback; it reads and redacts the current canonical log when feedback is recorded, so a crash before feedback uploads nothing and policy changes before feedback affect what that replay exports.
+- **Best-effort handoff** — new cold snapshots and a new feedback submission after restart can repeat prefixes; receivers deduplicate by Session id, format version, and event seq. There is no durable outbox, delivery watermark, automatic retry promise, or collector-acceptance guarantee. OTel and the opt-in DeepSeek API path can overlap. Withdrawal exports a deletion event, not remote erasure.
+
+- **Backend availability** — feedback submitted while this plugin is disabled or unloaded is recorded locally but not automatically replayed when it returns. Capture requires the subscriber to remain mounted until it observes the submission; unloading during a pending cold write can miss its post-flush notification.
 
 <a id="dev-note"></a>
 ### Dev Note

package/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-reference"
 
 ## 概述
 
-`dsh-session-telemetry-otel` 通过 OpenTelemetry 日志投递会话记录，是[会话遥测 seam](../session-telemetry/README.zh.md) 的后端，也是部署方唯一要加载的条目。其 `mode` 决定会话记录是跟随实时流、仅在记录反馈时释放，还是留在本地：`FULL` 把每条记录立即交给 OTel SDK，`FEEDBACK_ONLY` 在 `feedback/record` 落地时回放权威日志，`DISABLED`（默认值）不构造任何内容也不共享任何内容。上传模式会原样组合 OTel JS SDK——`LoggerProvider` → `BatchLogRecordProcessor` → OTLP/HTTP 日志导出器——并把每条记录映射到 `logger.emit()`，因此批处理、重试、排队与丢失策略都遵循 SDK。记录携带 seam 脱敏 waterfall（瀑布式事件）返回的完整事件数据，因此向可信边界之外导出的部署方要挂载自己的脱敏规则。模式、配置与导出面在前；实现内部细节放在下方可折叠的开发者章节中。
+`dsh-session-telemetry-otel` 仅在新的显式反馈后通过 OTel JS SDK 导出会话记录，适用于所有用户和提供方，包括 `deepseek-official`。`FEEDBACK_ONLY` 释放截至该反馈的权威日志前缀，包含上下文；后续记录等待下一次显式反馈。`DISABLED` 不构造传输。SDK 批处理可完成已授权的上传，无需另一次用户交互或模型调用。部署方负责脱敏规则。
 
 ## 目录
 
@@ -31,11 +31,10 @@ kind: "package-reference"
 
 | `mode` | 行为 |
 |---|---|
-| `FULL` | 每条已投影记录都立即交给 OTel SDK，包括生命周期运维记录 |
-| `FEEDBACK_ONLY` | 每个 `feedback/record` 都会回放权威会话日志中截至该事件的后缀，并进行投影与脱敏；后续记录等待下一个反馈事件；如果没有后续反馈，则留在本地 |
-| `DISABLED` | 默认值。不构造协调器、提供方、处理器或导出器；没有遥测记录会离开进程，`feedback/record` 会记录「不会共享任何内容」 |
+| `FEEDBACK_ONLY` | 默认值。文本反馈、评分创建或修改、备注修改和撤回释放尚未交接的前缀，截止该权威反馈事件；后续记录等待 |
+| `DISABLED` | 不构造协调器、提供方、处理器或导出器；没有遥测记录离开进程。活跃会话反馈在本地告警；冷会话修改保持静默 |
 
-程序化 TypeScript 配置使用导出的 `SessionTelemetryMode` 枚举；原始字符串字面量不可赋值。已挂载服务通过 seam 的 [`SessionTelemetrySharingStatus`](../session-telemetry/README.zh.md#the-sharing-disclosure) `sharing` 属性披露解析后的模式（`full` / `feedback-only` / `disabled`），因此 `/feedback` 的确认文本可以报告会话是否以及如何被共享——即使 `DISABLED` 也会披露 `disabled`。
+程序化 TypeScript 配置使用导出的 `SessionTelemetryMode` 枚举；原始字符串字面量不可赋值。`FULL` 会被拒绝，不是别名。[`sharing` 属性](../session-telemetry/README.zh.md#the-sharing-disclosure)报告 `feedback-only` 或 `disabled`，不代表投递回执。`/feedback` 确认文本只确认记录。
 
 ### 最小配置
 
@@ -45,7 +44,7 @@ kind: "package-reference"
 - id: sessionTelemetry-otel
   name: '@deepseek-ai/dsh-session-telemetry-otel'
   config:
-    mode: FULL                # explicit opt-in; default: DISABLED
+    mode: FEEDBACK_ONLY       # optional; defaults to FEEDBACK_ONLY
     shutdownTimeoutMillis: 3000 # optional; defaults to 3000
     exporter:                # passed verbatim to the SDK's OTLP/HTTP log exporter
       url: https://collector.example.com/v1/logs
@@ -56,12 +55,14 @@ kind: "package-reference"
 
 | 字段 | 默认值 | 含义 |
 |---|---|---|
-| `mode` | `DISABLED` | 共享策略：`FULL`、`FEEDBACK_ONLY` 或 `DISABLED` |
+| `mode` | `FEEDBACK_ONLY` | 共享策略：`FEEDBACK_ONLY` 或 `DISABLED` |
 | `exporter.url` | 上传模式必填 | 完整 OTLP 日志端点；必须能解析为 `http(s)` |
 | `exporter`、`processor` | — | 原样传给 SDK 导出器与批处理器 |
 | `shutdownTimeoutMillis` | `3,000` | SDK 完整关闭序列的外层截止时间 |
 
-生成的[配置目录](../../../docs/config-catalog.zh.md#deepseek-aidsh-session-telemetry-otel)是每个受支持字段的穷尽式真源。上传授权采用显式许可，且为 fail-closed：通过直接构造传入未知模式时会在读取传输配置前失败，只有 `FULL` 接受对 `ctx.sessionTelemetry.emit()` 的直接调用，`FEEDBACK_ONLY` 只把权威日志中已存储的精确 `feedback/record` 对象视为同意。
+直接调用 `ctx.sessionTelemetry.emit()` 在任何模式下都是空操作，不能绕过反馈授权。继承的父会话反馈不授权子会话导出：子会话需要新的自身反馈。授权后的前缀包含继承的上下文。
+
+模型请求、请求头、Session 创建或接纳、恢复，以及插件挂载或 HMR（热模块替换） 均不授权捕获。仅有存储的反馈不会触发任何上传。SDK 定时刷新和关闭可以完成先前已授权的批次，但绝不捕获新记录。
 
 ### 哪些数据会离开本机
 
@@ -83,7 +84,7 @@ kind: "package-reference"
 
 ### 设计理念
 
-后端是对 OTel JS SDK 的薄适配层：它拥有捕获模式、资源身份与一个外层关闭截止时间，其余全部原样透传。两个插桩作用域区分记录通道——ledger 记录挂在 `@deepseek-ai/dsh-session-telemetry-otel` 下，运维记录挂在 `@deepseek-ai/dsh-session-telemetry-otel/ops` 下——使接收端可以在不累加它们的情况下对运维记录告警。资源身份携带 `service.name`/`service.version`（来自 `dsh-llm` 的 `APP_IDENTITY`）以及本包的匿名 `user.id`（来自 `$DSH_HOME/.anonymous-user-id`），按导出批次携带一次，而非逐条记录。
+后端是对 OTel JS SDK 的薄适配层：它拥有反馈授权、资源身份与外层关闭截止时间。权威 ledger 记录使用 `@deepseek-ai/dsh-session-telemetry-otel` 插桩作用域；此后端不捕获运维记录。资源身份携带 `service.name`/`service.version`（来自 `dsh-llm` 的 `APP_IDENTITY`）以及匿名 `user.id`（来自 `$DSH_HOME/.anonymous-user-id`），按导出批次携带一次，而非逐条记录。
 
 ### 源码地图
 
@@ -93,11 +94,11 @@ kind: "package-reference"
 
 ### 捕获接线
 
-`FULL` 以 `live` 模式组装协调器，并放行直接服务调用；`FEEDBACK_ONLY` 以 `on-demand` 模式组装协调器，给协调器一个私有后端能力，并且仅在 `session.eventAt(event.seq) === event` 确认精确的权威反馈记录时触发 `captureSession(session, event.seq)`；`DISABLED` 除了在 `feedback/record` 上发出警告外不注册任何内容。后端刻意不实现 `flush()`：常规 flush 由批处理器负责，把提示转发给 `forceFlush()` 会成为并发 flush 的唯一来源，而它与关闭排空的交互没有文档。
+后端使用包含存储历史的按需捕获。只有新的自身 `feedback/record`、`feedback/message-put` 或 `feedback/message-delete` 事件触发活跃会话捕获，并以该事件为上限。冷会话 `feedback/committed` 通知提供已提交的权威快照，不发布存活 Session 或 Agent。同对象交接游标抑制重复捕获。后端不实现 `flush()`；SDK 负责批处理和关闭排空。
 
 ### 字段映射
 
-每条 seam 记录映射为一条 SDK 日志记录：`time` 与 `severity` 变为 SDK 的时间戳与严重级别字段，`body` 与 `attributes` 原样照搬；确切字段映射见 [`src/index.ts`](src/index.ts)。在 `FULL` 中，接收端可通过缺少 `shutdown` 记录检测崩溃——该标记在会话自身 dispose（资源释放）或应用关闭时发出，标记之后出现更多事件说明遥测发生了重载。在 `FEEDBACK_ONLY` 中，已释放的前缀通常不包含随后的 `shutdown` 标记，因此缺少该标记不是崩溃信号。
+每条遥测记录映射为一条 SDK 日志记录，携带捕获的时间戳、严重级别、正文和属性。反馈授权的是尚未交接的完整前缀，而非只有反馈载荷。
 
 </details>
 
@@ -133,7 +134,9 @@ kind: "package-reference"
 
 - **上游实验性源码树**——`@opentelemetry/sdk-logs` 从上游实验性源码树发布；SDK API 的变动只会落在本包，也仅落在本包，而 seam 约定不动。
 - **真实 collector 行为属于 SDK 导出器**——身份验证、TLS、限流及其他真实 OTLP 部署行为遵循上游 SDK，不由本包自有兼容层处理。
-- **反馈时快照**——`FEEDBACK_ONLY` 在反馈前不保留遥测自有副本；记录反馈时读取并脱敏当前的权威日志，因此反馈前崩溃时什么都不上传，反馈前的策略变更会影响该次回放的导出内容。
+- **尽力交接**——新冷快照以及重启后的新反馈提交可能重复前缀；接收方按 Session id、格式版本和事件 seq 去重。没有持久化 outbox、投递水位、自动重试承诺或采集端接受保证。OTel 与需显式启用的 DeepSeek API 路径可能重叠。撤回导出删除事件，不是远端擦除。
+
+- **后端可用性**——本插件禁用或卸载期间提交的反馈会记录在本地，但恢复插件不会自动重放。捕获要求订阅方保持挂载直到观察到提交；在冷写入尚未完成时卸载，可能错过其 flush 后通知。
 
 <a id="dev-note"></a>
 ### 开发备注

package/lib/index.js

@@ -1,5 +1,6 @@
 import { createRequire } from "node:module";
 import z from "@deepseek-ai/schemastery";
+import { Session } from "@deepseek-ai/dsh-session";
 import { SessionTelemetryBackend, SessionTelemetryCoordinator } from "@deepseek-ai/dsh-session-telemetry";
 import { APP_IDENTITY } from "@deepseek-ai/dsh-llm";
 import { getOrCreateAnonymousUserId } from "@deepseek-ai/dsh-anonymous-user-id";
@@ -25,20 +26,27 @@ const { version } = createRequire(import.meta.url)("../package.json");
 /** Session-sharing policy selected by {@link Config.mode}. */
 var SessionTelemetryMode;
 (function(SessionTelemetryMode) {
-	SessionTelemetryMode["FULL"] = "FULL";
 	SessionTelemetryMode["FEEDBACK_ONLY"] = "FEEDBACK_ONLY";
 	SessionTelemetryMode["DISABLED"] = "DISABLED";
 })(SessionTelemetryMode || (SessionTelemetryMode = {}));
 /** Default session-sharing policy for schema and direct construction. */
-const DEFAULT_TELEMETRY_MODE = SessionTelemetryMode.DISABLED;
-const DISABLED_FEEDBACK_WARNING = "session telemetry is DISABLED; nothing will be shared and this feedback remains local";
-const NON_CANONICAL_FEEDBACK_WARNING = "session telemetry ignored a feedback event absent from the canonical session log";
-const DROP_RECORD = () => {};
+const DEFAULT_TELEMETRY_MODE = SessionTelemetryMode.FEEDBACK_ONLY;
+const DISABLED_FEEDBACK_WARNING = "OpenTelemetry session upload is DISABLED; this feedback is not uploaded through OpenTelemetry";
+const NON_CANONICAL_EVENT_WARNING = "session telemetry ignored an event absent from the canonical session log";
+/** Only this Session's explicit feedback authorizes replay; fork seeds do not. */
+function isFeedback(session, event) {
+	if (event.seq < session.inheritedEventCount) return false;
+	switch (event.type) {
+		case "feedback/record": return true;
+		case "feedback/message-put":
+		case "feedback/message-delete": return event.data.sessionId === session.id;
+		default: return false;
+	}
+}
 /** Resolve the default and reject unknown runtime values before transport setup. */
 function resolveMode(mode) {
 	const resolved = mode ?? DEFAULT_TELEMETRY_MODE;
 	switch (resolved) {
-		case SessionTelemetryMode.FULL:
 		case SessionTelemetryMode.FEEDBACK_ONLY:
 		case SessionTelemetryMode.DISABLED: return resolved;
 		default: return assertNever(resolved);
@@ -51,7 +59,6 @@ function assertNever(value) {
 /** Map the serialized mode onto the seam's backend-independent sharing vocabulary. */
 function sharingStatusFor(mode) {
 	switch (mode) {
-		case SessionTelemetryMode.FULL: return "full";
 		case SessionTelemetryMode.FEEDBACK_ONLY: return "feedback-only";
 		case SessionTelemetryMode.DISABLED: return "disabled";
 		/* v8 ignore next 2 -- resolveMode already rejected unknown values before this switch; the closed enum cannot reach the default. */
@@ -91,14 +98,13 @@ const SEVERITY = {
 };
 /**
 * The backend plugin — the only entry a deployment loads. It always registers
-* the `telemetry` service (duplicate load throws). Uploading modes wire the SDK
-* pipeline and compose {@link SessionTelemetryCoordinator}; `DISABLED` constructs no
+* the `sessionTelemetry` service (duplicate load throws). `FEEDBACK_ONLY` wires the SDK
+* pipeline and on-demand {@link SessionTelemetryCoordinator}; `DISABLED` constructs no
 * SDK state and listens only to warn when recorded feedback stays local.
 */
 var OpenTelemetrySessionBackend = class extends SessionTelemetryBackend {
 	static inject = ["sessions"];
 	static Config = Config;
-	directEmit;
 	provider;
 	shutdownTimeoutMillis;
 	sharing;
@@ -107,11 +113,10 @@ var OpenTelemetrySessionBackend = class extends SessionTelemetryBackend {
 		super(ctx);
 		this.sharing = sharingStatusFor(mode);
 		if (mode === SessionTelemetryMode.DISABLED) {
-			this.directEmit = DROP_RECORD;
 			this.provider = void 0;
 			this.shutdownTimeoutMillis = DEFAULT_SHUTDOWN_TIMEOUT_MILLIS;
-			ctx.on("session/event", (_session, event) => {
-				if (event.type === "feedback/record") ctx.logger.warn(DISABLED_FEEDBACK_WARNING);
+			ctx.on("session/event", (session, event) => {
+				if (isFeedback(session, event)) ctx.logger.warn(DISABLED_FEEDBACK_WARNING);
 			});
 			return;
 		}
@@ -141,9 +146,8 @@ var OpenTelemetrySessionBackend = class extends SessionTelemetryBackend {
 			})]
 		});
 		const ledger = this.provider.getLogger("@deepseek-ai/dsh-session-telemetry-otel", version);
-		const ops = this.provider.getLogger("@deepseek-ai/dsh-session-telemetry-otel/ops", version);
 		const enqueue = (record) => {
-			(record.channel === "ops" ? ops : ledger).emit({
+			ledger.emit({
 				timestamp: record.time,
 				observedTimestamp: record.time,
 				...SEVERITY[record.severity],
@@ -151,35 +155,35 @@ var OpenTelemetrySessionBackend = class extends SessionTelemetryBackend {
 				attributes: record.attributes
 			});
 		};
-		const backend = {
+		const coordinator = new SessionTelemetryCoordinator(ctx, {
 			emit: enqueue,
 			shutdown: () => this.shutdown()
-		};
-		if (mode === SessionTelemetryMode.FULL) {
-			this.directEmit = enqueue;
-			new SessionTelemetryCoordinator(ctx, backend, "live");
-			return;
-		}
-		this.directEmit = DROP_RECORD;
-		const coordinator = new SessionTelemetryCoordinator(ctx, backend, "on-demand");
+		}, {
+			capture: "on-demand",
+			includeHistory: true
+		});
 		ctx.on("session/event", (session, event) => {
-			if (event.type !== "feedback/record") return;
+			if (!isFeedback(session, event)) return;
 			if (session.eventAt(event.seq) !== event) {
-				ctx.logger.warn(NON_CANONICAL_FEEDBACK_WARNING);
+				ctx.logger.warn(NON_CANONICAL_EVENT_WARNING);
 				return;
 			}
 			coordinator.captureSession(session, event.seq);
 		});
+		ctx.on("feedback/committed", (inspection) => {
+			const snapshot = structuredClone(inspection);
+			const committed = snapshot.events.at(-1);
+			if (committed === void 0) return;
+			const session = Session.fromRestore(snapshot.meta.id, snapshot.events, snapshot.meta, snapshot.inheritedEventCount, "detached");
+			if (isFeedback(session, committed)) coordinator.captureSession(session, committed.seq);
+		});
 	}
 	/**
-	* Hand a direct service record to the SDK only in `FULL`. Direct calls are
-	* no-ops in `FEEDBACK_ONLY` and `DISABLED`; feedback replay uses a private
-	* backend capability created only for the canonical feedback listener.
-	* @param record - the logical record offered directly to the service.
+	* Drop direct records. Only a new canonical feedback submission can authorize
+	* capture through the private coordinator sink, for every provider.
+	* @param _record - the direct record, never uploaded.
 	*/
-	emit(record) {
-		this.directEmit(record);
-	}
+	emit(_record) {}
 	/**
 	* Ask the SDK to drain and quiesce, but reject after the backend-owned
 	* deadline. OTel's processor export timeout wraps `exportCompleted` only;

package/lib/types/index.d.ts

@@ -18,19 +18,18 @@ import { type BatchLogRecordProcessorOptions } from '@opentelemetry/sdk-logs';
 import type { OTLPExporterNodeConfigBase } from '@opentelemetry/otlp-exporter-base';
 /** Session-sharing policy selected by {@link Config.mode}. */
 export declare enum SessionTelemetryMode {
-    FULL = "FULL",
     FEEDBACK_ONLY = "FEEDBACK_ONLY",
     DISABLED = "DISABLED"
 }
 /** Default session-sharing policy for schema and direct construction. */
-export declare const DEFAULT_TELEMETRY_MODE = SessionTelemetryMode.DISABLED;
+export declare const DEFAULT_TELEMETRY_MODE = SessionTelemetryMode.FEEDBACK_ONLY;
 /**
  * Plugin configuration: one sharing policy, two verbatim SDK option objects,
  * and one DSH-owned shutdown bound. Uploading modes validate their endpoint
  * and shutdown deadline at plugin load; `DISABLED` reads neither.
  */
 export interface Config {
-    /** Sharing policy; defaults to local-only `DISABLED` behavior. */
+    /** Defaults to `FEEDBACK_ONLY`: capture session history only when feedback is explicitly submitted. */
     mode?: SessionTelemetryMode;
     /**
      * Passed verbatim to the SDK's OTLP/HTTP log exporter — the complete
@@ -62,25 +61,23 @@ export declare const Config: z<Config>;
 export declare const DEFAULT_SHUTDOWN_TIMEOUT_MILLIS = 3000;
 /**
  * The backend plugin — the only entry a deployment loads. It always registers
- * the `telemetry` service (duplicate load throws). Uploading modes wire the SDK
- * pipeline and compose {@link SessionTelemetryCoordinator}; `DISABLED` constructs no
+ * the `sessionTelemetry` service (duplicate load throws). `FEEDBACK_ONLY` wires the SDK
+ * pipeline and on-demand {@link SessionTelemetryCoordinator}; `DISABLED` constructs no
  * SDK state and listens only to warn when recorded feedback stays local.
  */
 export declare class OpenTelemetrySessionBackend extends SessionTelemetryBackend {
     static inject: string[];
     static Config: z<Config>;
-    private readonly directEmit;
     private readonly provider;
     private readonly shutdownTimeoutMillis;
     readonly sharing: SessionTelemetrySharingStatus;
     constructor(ctx: Context, config: Config);
     /**
-     * Hand a direct service record to the SDK only in `FULL`. Direct calls are
-     * no-ops in `FEEDBACK_ONLY` and `DISABLED`; feedback replay uses a private
-     * backend capability created only for the canonical feedback listener.
-     * @param record - the logical record offered directly to the service.
+     * Drop direct records. Only a new canonical feedback submission can authorize
+     * capture through the private coordinator sink, for every provider.
+     * @param _record - the direct record, never uploaded.
      */
-    emit(record: SessionTelemetryRecord): void;
+    emit(_record: SessionTelemetryRecord): void;
     /**
      * Ask the SDK to drain and quiesce, but reject after the backend-owned
      * deadline. OTel's processor export timeout wraps `exportCompleted` only;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@deepseek-ai/dsh-session-telemetry-otel",
   "description": "OpenTelemetry backend for the DeepSeek Harness telemetry seam: hands captured session records to the OTel JS SDK's log pipeline",
-  "version": "0.1.2-alpha.5",
+  "version": "0.1.3-alpha.2",
   "publishConfig": {
     "access": "public"
   },
@@ -36,27 +36,30 @@
     "@deepseek-ai/schemastery": "^3.18.2"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-command-feedback": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.2-alpha.5",
-    "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-session-telemetry": "^0.1.2-alpha.5"
+    "@deepseek-ai/dsh-command-feedback": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-message-feedback": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session-telemetry": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.3-alpha.2",
+    "@deepseek-ai/cordis": "^4.0.2"
   },
   "devDependencies": {
+    "@deepseek-ai/dsh-bash-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-command-feedback": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-llm": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis-plugin-logger-console": "^1.0.2",
-    "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
-    "@deepseek-ai/dsh-bash-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-app-boot": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-command-feedback": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-llm": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-loader-smoke": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-checkpoint-policy": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-session-telemetry": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-subprocess-local": "^0.1.2-alpha.5",
-    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.2-alpha.5",
+    "@deepseek-ai/dsh-loader-smoke": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-message-feedback": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session-checkpoint-policy": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-session-telemetry": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-anonymous-user-id": "^0.1.3-alpha.2",
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-session-persistence-jsonl": "^0.1.2-alpha.5"
+    "@deepseek-ai/dsh-subprocess-local": "^0.1.3-alpha.2",
+    "@deepseek-ai/dsh-http-proxy": "^0.1.3-alpha.2",
+    "@deepseek-ai/cordis-plugin-loader": "^1.0.3",
+    "@deepseek-ai/dsh-app-boot": "^0.1.3-alpha.2"
   }
 }