@haystackeditor/cli 0.24.1 → 0.25.0

package/dist/assets/telemetry/runtime.cjs

@@ -1,379 +1,152 @@
 'use strict';
 
 /*
- * Haystack's automatically injected Node telemetry runtime.
+ * Haystack's automatically injected Node telemetry runtime: sampler version 5
+ * (CAPTURE-V1 rule 9, infra/lambda/haystack-design-verifier-shared/capture_contracts.ts).
  *
- * This file is copied beside compiled application code by
- * `haystack telemetry instrument`. It has no package dependencies, records no
- * raw values, and is inert unless all three HAYSTACK_TELEMETRY_* activation
- * variables are present. Every application-facing hook returns the original
- * value and catches its own errors so telemetry cannot change app behavior.
+ * This file is copied beside compiled application code by `haystack telemetry
+ * instrument` (or the Next.js wrapper). It has no package dependencies, never
+ * records a value (only its shape and size, or an approved setting literal),
+ * and is inert unless all three HAYSTACK_TELEMETRY_* variables are present.
+ *
+ * Rule 9(a): every call of a site is counted (one increment); the first
+ * SERVER_SAMPLE_AFTER_CALLS calls of a site in this process are classified
+ * (the census), later ones with probability 1/SERVER_SAMPLE_RATE from a per-site
+ * PRNG; a per-second budget bounds classification and counts what it skipped.
+ * A flush sends per site its window's calls, census, sampled and skipped deltas.
+ *
+ * Rule 13(b), do no harm:
+ *  - every probe returns its argument unchanged and no exception leaves this
+ *    file; classification never runs customer code (no getters, proxy traps,
+ *    valueOf or Symbol.toPrimitive), and nothing it sends is serialized by
+ *    JSON.stringify of an object (which would look up an inherited toJSON):
+ *    bodies are assembled from primitives only;
+ *  - every byte it keeps (site metadata, field keys, counters, a window being
+ *    serialized, bodies waiting to be sent) is accounted against
+ *    SERVER_RUNTIME_MAX_BYTES: new categories past the counters' share become
+ *    `overflow`, and anything that would cross the cap turns telemetry off;
+ *  - flushes run on an unref'd timer, one send in flight, each bounded by
+ *    SERVER_SEND_TIMEOUT_MS; three failed sends stop sending and counting;
+ *  - the process exits as it would without telemetry: the beforeExit flush has
+ *    one absolute SERVER_EXIT_FLUSH_MS deadline across everything it does, and
+ *    the exit and crash paths make at most one bounded synchronous write;
+ *  - no process handlers but the passive uncaughtExceptionMonitor, and no
+ *    output at all (a stalled stderr pipe could block the event loop); why it
+ *    turned itself off is in status().
  */
 
 const { createHash, randomBytes } = require('node:crypto');
-const { AsyncLocalStorage } = require('node:async_hooks');
-const diagnosticsChannel = require('node:diagnostics_channel');
 const { types: utilTypes } = require('node:util');
-const { mkdirSync, readFileSync, readdirSync, renameSync, statSync, unlinkSync, writeFileSync } = require('node:fs');
+const { readFileSync, writeFileSync, promises: fsPromises } = require('node:fs');
 const { tmpdir } = require('node:os');
 const { join } = require('node:path');
 
 // Capture the few mutable language intrinsics used on customer values before
 // application code runs. Calling a customer-patched prototype method from a
 // probe would itself be an application-visible side effect.
-const safeStringTrim = Function.call.bind(String.prototype.trim);
 const safeString = String;
-const safeStringStartsWith = Function.call.bind(String.prototype.startsWith);
-const safeStringEndsWith = Function.call.bind(String.prototype.endsWith);
-const safeStringIndexOf = Function.call.bind(String.prototype.indexOf);
 const safeStringSlice = Function.call.bind(String.prototype.slice);
 const safeStringCharCodeAt = Function.call.bind(String.prototype.charCodeAt);
+const safeStringStartsWith = Function.call.bind(String.prototype.startsWith);
 const safeRegExpTest = Function.call.bind(RegExp.prototype.test);
 const safeJsonParse = JSON.parse;
+// Only ever called on primitives (strings, finite numbers): JSON.stringify
+// looks up toJSON on objects, never on primitives.
 const safeJsonStringify = JSON.stringify;
 const safeArrayIsArray = Array.isArray;
-const safeArrayFilter = Function.call.bind(Array.prototype.filter);
-const safeArrayFind = Function.call.bind(Array.prototype.find);
-const safeArrayFlatMap = Function.call.bind(Array.prototype.flatMap);
-const safeArrayMap = Function.call.bind(Array.prototype.map);
-const safeArrayReduce = Function.call.bind(Array.prototype.reduce);
-const safeArrayShift = Function.call.bind(Array.prototype.shift);
-const safeArraySlice = Function.call.bind(Array.prototype.slice);
+const safeArrayPush = Function.call.bind(Array.prototype.push);
+const safeArrayJoin = Function.call.bind(Array.prototype.join);
 const safeArraySort = Function.call.bind(Array.prototype.sort);
-const safeNumber = Number;
-const safeNumberIsFinite = Number.isFinite;
+const safeArrayShift = Function.call.bind(Array.prototype.shift);
 const safeNumberIsSafeInteger = Number.isSafeInteger;
 const safeNumberParseInt = Number.parseInt;
 const safeMathImul = Math.imul;
-const safeMathMax = Math.max;
 const safeMathMin = Math.min;
 const safeBufferByteLength = Buffer.byteLength;
-const safeObjectKeys = Object.keys;
-const safeObjectEntries = Object.entries;
 const safeObjectCreate = Object.create;
 const safeObjectFreeze = Object.freeze;
 const safeGetOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
 const safeGetPrototypeOf = Object.getPrototypeOf;
 const safeHasOwn = Function.call.bind(Object.prototype.hasOwnProperty);
+const ObjectPrototype = Object.prototype;
+const SafeMap = Map;
 const safeMapGet = Function.call.bind(Map.prototype.get);
 const safeMapSet = Function.call.bind(Map.prototype.set);
-const safeMapHas = Function.call.bind(Map.prototype.has);
-const safeMapSize = Function.call.bind(Object.getOwnPropertyDescriptor(Map.prototype, 'size').get);
 const safeMapEntries = Function.call.bind(Map.prototype.entries);
-const safeMapValues = Function.call.bind(Map.prototype.values);
-const safeWeakMapGet = Function.call.bind(WeakMap.prototype.get);
-const safeWeakMapSet = Function.call.bind(WeakMap.prototype.set);
-const safeSetAdd = Function.call.bind(Set.prototype.add);
-const safeSetValues = Function.call.bind(Set.prototype.values);
-const safeArrayPush = Function.call.bind(Array.prototype.push);
-const SafeMap = Map;
-const SafeSet = Set;
-const SafeWeakMap = WeakMap;
+const safeMapSize = Function.call.bind(Object.getOwnPropertyDescriptor(Map.prototype, 'size').get);
+const safeSetSize = Function.call.bind(Object.getOwnPropertyDescriptor(Set.prototype, 'size').get);
+const safeMapIteratorNext = Function.call.bind(Object.getPrototypeOf(safeMapEntries(new SafeMap())).next);
 const SafeDate = Date;
 const safeDateNow = Date.now;
 const safeDateToISOString = Function.call.bind(Date.prototype.toISOString);
-const safeMapIteratorNext = Function.call.bind(
-  Object.getPrototypeOf(safeMapEntries(new SafeMap())).next,
-);
-const safeSetIteratorNext = Function.call.bind(
-  Object.getPrototypeOf(safeSetValues(new SafeSet())).next,
-);
 const hashPrototype = Object.getPrototypeOf(createHash('sha256'));
 const safeHashUpdate = Function.call.bind(hashPrototype.update);
 const safeHashDigest = Function.call.bind(hashPrototype.digest);
 const safeIsProxy = utilTypes.isProxy;
+const safeIsMap = utilTypes.isMap;
+const safeIsSet = utilTypes.isSet;
 const safeIsNativeError = utilTypes.isNativeError;
-const safeActionGetStore = Function.call.bind(AsyncLocalStorage.prototype.getStore);
-const safeActionEnterWith = Function.call.bind(AsyncLocalStorage.prototype.enterWith);
+const SafePromise = Promise;
 const safePromiseFinally = Function.call.bind(Promise.prototype.finally);
-const safeFetch = typeof fetch === 'function' ? fetch : null;
-const safeAbortTimeout = typeof AbortSignal?.timeout === 'function' ? AbortSignal.timeout : null;
-const safeResponseOk = typeof Response === 'function'
-  ? Function.call.bind(Object.getOwnPropertyDescriptor(Response.prototype, 'ok').get)
-  : null;
-const safeResponseStatus = typeof Response === 'function'
-  ? Function.call.bind(Object.getOwnPropertyDescriptor(Response.prototype, 'status').get)
-  : null;
+const safePromiseThen = Function.call.bind(Promise.prototype.then);
+// Sends are one HTTP/1.1 request written on a socket of their own: the socket
+// is unref'd, so a send in flight never keeps the process alive (fetch's would,
+// up to its timeout, past the application's own end), and no HTTP client code
+// runs (node:http checks parser results with `instanceof Error`, which would
+// call a customer's Error[Symbol.hasInstance]).
+const { connect: safeNetConnect, isIP: safeIsIP } = require('node:net');
+const { connect: safeTlsConnect } = require('node:tls');
+const safeBufferToString = Function.call.bind(Buffer.prototype.toString);
+const safeStringIndexOf = Function.call.bind(String.prototype.indexOf);
+const safeSetTimeout = setTimeout;
+const safeClearTimeout = clearTimeout;
+const safeSetInterval = setInterval;
 const safeClearInterval = clearInterval;
-const SafeError = Error;
-const nativeErrorPrototypes = safeObjectFreeze({
-  type: TypeError.prototype,
-  range: RangeError.prototype,
-  syntax: SyntaxError.prototype,
-  reference: ReferenceError.prototype,
-  aggregate: typeof AggregateError === 'function' ? AggregateError.prototype : null,
-  uri: URIError.prototype,
-  eval: EvalError.prototype,
-  generic: Error.prototype,
-});
-
-function compareStrings(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-function mapEntriesArray(map) {
-  const result = [];
-  const iterator = safeMapEntries(map);
-  while (true) {
-    const step = safeMapIteratorNext(iterator);
-    if (step.done) return result;
-    safeArrayPush(result, step.value);
-  }
-}
-
-function mapValuesArray(map) {
-  const entries = mapEntriesArray(map);
-  const result = [];
-  for (let index = 0; index < entries.length; index++) safeArrayPush(result, entries[index][1]);
-  return result;
-}
-
-function setValuesArray(set) {
-  const result = [];
-  const iterator = safeSetValues(set);
-  while (true) {
-    const step = safeSetIteratorNext(iterator);
-    if (step.done) return result;
-    safeArrayPush(result, step.value);
-  }
-}
-
-function objectFromEntryArray(entries) {
-  const result = safeObjectCreate(null);
-  for (let index = 0; index < entries.length; index++) {
-    const entry = entries[index];
-    result[entry[0]] = entry[1];
-  }
-  return result;
-}
-
-function objectFromMap(map) {
-  return objectFromEntryArray(mapEntriesArray(map));
-}
-
-function sha256Hex(value) {
-  const hash = createHash('sha256');
-  safeHashUpdate(hash, value);
-  return safeHashDigest(hash, 'hex');
-}
-
-function responseAccepted(response) {
-  try {
-    return safeResponseOk ? safeResponseOk(response) : false;
-  } catch {
-    return false;
-  }
-}
+const safeSetImmediate = setImmediate;
+const noop = () => {};
+const nextTurn = () => new SafePromise(resolve => safeSetImmediate(resolve));
+const processHost = require('node:process');
 
-function responseStatus(response) {
-  try {
-    return safeResponseStatus ? safeResponseStatus(response) : 0;
-  } catch {
-    return 0;
-  }
-}
+// The contract's sampler constants and category vocabulary, substituted from
+// the CLI's mirror of capture_contracts.ts when the runtime is authenticated.
+const CONTRACT = /* __HAYSTACK_SERVER_CONTRACT__ */ null;
 
-const RUNTIME_VERSION = 1;
-const SAMPLER_VERSION = 4;
+const RUNTIME_VERSION = 2;
 const DEFAULT_FLUSH_INTERVAL_MS = 60_000;
-const DEFAULT_SITE_OBSERVATIONS = 8;
-const MAX_SITE_OBSERVATIONS = 4_096;
-const DEFAULT_PROCESS_PROBE_OBSERVATIONS = 4_096;
-const MAX_PROCESS_PROBE_OBSERVATIONS = 65_536;
-const MAX_SAFE_COUNT = Number.MAX_SAFE_INTEGER;
-const MAX_COUNTER_KEYS = 50_000;
-const MAX_EXECUTION_FAMILIES = 64;
-const MAX_EXECUTION_EVENTS = 48;
-const MAX_EXECUTION_ACTION_BYTES = 24 * 1024;
-const MAX_EXECUTION_BYTES = 1024 * 1024;
 const MAX_PAYLOAD_BYTES = 4 * 1024 * 1024;
 const PAYLOAD_CHUNK_BUDGET = MAX_PAYLOAD_BYTES - 256 * 1024;
+// Crash and exit spool: at most MAX_SPOOL_FILES fixed slots of at most
+// SPOOL_FILE_BYTES each, so a slot needs no directory listing to stay bounded.
 const MAX_SPOOL_FILES = 8;
-const MAX_SPOOL_BYTES = 16 * 1024 * 1024;
-const SAMPLE_FIRST_ACTIONS = 4;
-const DEFAULT_PROCESS_SAMPLE_RATE = 1;
-const DEFAULT_ACTION_SAMPLE_RATE = 64;
-const MAX_ACTION_SAMPLE_RATE = 4_096;
+const SPOOL_FILE_BYTES = 2 * 1024 * 1024;
 const MAX_CONSECUTIVE_FAILURES = 3;
+// Sites serialized per event-loop turn by an interval flush.
+const FLUSH_SLICE_SITES = 500;
+// Memory accounting (bytes): what a site's state, metadata and lookup entry
+// keep beyond their strings; a string's header; a Map's and a Map entry's
+// footprint. Estimates on the high side, so the cap is a true upper bound.
+const SITE_BYTES = 480;
+const STRING_BYTES = 24;
+const MAP_BYTES = 160;
+const ENTRY_BYTES = 96;
+// Of the cap: what a window's counters may use before new categories become
+// overflow (the rest serializes them into bodies), and what is kept back for
+// overflow entries themselves.
+const COUNTER_SHARE = 0.4;
+const RESERVE_BYTES = 1024 * 1024;
 const CONTROL_GLOBAL = '__haystackTelemetryControlV1';
 const CONTROL_CHANNEL = '__HAYSTACK_TELEMETRY_CONTROL_CHANNEL__';
 const RUNTIME_INTEGRITY = '__HAYSTACK_TELEMETRY_RUNTIME_INTEGRITY__';
-const SUPPRESSED_ACTION = safeObjectFreeze({ suppressed: true });
+const MANIFEST_SCHEMA_VERSION = 'haystack-node-telemetry-instrumentation-v4';
 
 let installed = false;
+let installResult = null;
 let activeControl = null;
-const processHost = require('node:process');
-
-function selectProbe(name, fallback) {
-  try {
-    const selected = activeControl?.selectProbe(name);
-    return typeof selected === 'function' ? selected : fallback;
-  } catch {
-    return fallback;
-  }
-}
 
-function trustedSelectProbe(name, fallback) {
-  return selectProbe(name, fallback);
-}
-
-Object.defineProperty(trustedSelectProbe, 'haystackRuntimeIntegrity', {
-  configurable: false,
-  enumerable: false,
-  writable: false,
-  value: RUNTIME_INTEGRITY,
-});
-
-function safeSelectProbe(expectedIntegrity, name, fallback) {
-  try {
-    if (expectedIntegrity !== RUNTIME_INTEGRITY) return fallback;
-    return trustedSelectProbe(name, fallback);
-  } catch {
-    return fallback;
-  }
-}
-
-function safeSelectSiteProbe(expectedIntegrity, name, site, fallback) {
-  try {
-    if (expectedIntegrity !== RUNTIME_INTEGRITY) return fallback;
-    const selected = activeControl?.selectSiteProbe(name, site);
-    return typeof selected === 'function' ? selected : fallback;
-  } catch {
-    return fallback;
-  }
-}
-
-function debug(message, error) {
-  if (process.env.HAYSTACK_TELEMETRY_DEBUG !== '1') return;
-  const detail = safeIsNativeError(error) ? ': native error' : error ? ': telemetry error' : '';
-  process.stderr.write(`[haystack-telemetry] ${message}${detail}\n`);
-}
-
-function safeSegment(value, fallback) {
-  return typeof value === 'string' && safeRegExpTest(/^[A-Za-z0-9._-]{1,128}$/, value) ? value : fallback;
-}
-
-function sizeBucket(length) {
-  if (length === 0) return 'empty';
-  if (length === 1) return 'one';
-  if (length <= 4) return 'few';
-  return 'many';
-}
-
-function stringForm(value) {
-  if (value.length === 0) return 'empty';
-  const trimmed = safeStringTrim(value);
-  if (!trimmed) return 'whitespace';
-  // Bound parsing work. Long strings still report their generic form/size;
-  // their contents are never retained or transmitted.
-  if (trimmed.length <= 4_096 && safeStringStartsWith(trimmed, '```') && safeStringEndsWith(trimmed, '```')) {
-    const newline = safeStringIndexOf(trimmed, '\n');
-    if (newline >= 0) {
-      const body = safeStringTrim(safeStringSlice(trimmed, newline + 1, -3));
-      try {
-        const parsed = safeJsonParse(body);
-        return safeArrayIsArray(parsed)
-          ? 'markdown-fenced-json-array'
-          : parsed !== null && typeof parsed === 'object'
-            ? 'markdown-fenced-json-object'
-            : 'markdown-fenced-json-scalar';
-      } catch {
-        return 'markdown-fenced-text';
-      }
-    }
-    return 'markdown-fenced-text';
-  }
-  if (trimmed.length <= 4_096) {
-    try {
-      const parsed = safeJsonParse(trimmed);
-      return safeArrayIsArray(parsed)
-        ? 'json-array'
-        : parsed !== null && typeof parsed === 'object'
-          ? 'json-object'
-          : 'json-scalar';
-    } catch {
-      // Ordinary text is the expected case.
-    }
-  }
-  return 'text';
-}
-
-function valueShape(value) {
-  if (value === null) return 'null';
-  if (value === undefined) return 'undefined';
-  if (typeof value === 'string') return `string:${stringForm(value)}:${sizeBucket(value.length)}`;
-  if (typeof value === 'number') return safeNumberIsFinite(value) ? 'number:finite' : 'number:nonfinite';
-  if (typeof value === 'boolean') return 'boolean';
-  if (typeof value === 'object' && safeIsProxy(value)) return 'object:uninspectable';
-  if (safeArrayIsArray(value)) return `array:${sizeBucket(value.length)}`;
-  if (typeof value === 'object') {
-    try {
-      if (safeIsNativeError(value)) return `error:${errorClass(value)}`;
-      return `object:${sizeBucket(safeObjectKeys(value).length)}`;
-    } catch {
-      return 'object:uninspectable';
-    }
-  }
-  return `nonjson:${typeof value}`;
-}
-
-function stableIdentity(prefix, parts) {
-  let framed = '';
-  for (let index = 0; index < parts.length; index++) {
-    if (index > 0) framed += '|';
-    const part = parts[index];
-    framed += `${safeBufferByteLength(part, 'utf8')}:${part}`;
-  }
-  return `${prefix}-${safeStringSlice(sha256Hex(framed), 0, 24)}`;
-}
-
-function canonicalJson(value) {
-  if (value === null || typeof value !== 'object') return safeJsonStringify(value);
-  if (safeArrayIsArray(value)) {
-    let result = '[';
-    for (let index = 0; index < value.length; index++) {
-      if (index > 0) result += ',';
-      result += canonicalJson(value[index]);
-    }
-    return `${result}]`;
-  }
-  const keys = safeArraySort(safeObjectKeys(value), compareStrings);
-  let result = '{';
-  for (let index = 0; index < keys.length; index++) {
-    if (index > 0) result += ',';
-    const key = keys[index];
-    result += `${safeJsonStringify(key)}:${canonicalJson(value[key])}`;
-  }
-  return `${result}}`;
-}
-
-function errorClass(value) {
-  try {
-    if (value !== null && typeof value === 'object' && safeIsProxy(value)) return 'uninspectable';
-    if (safeIsNativeError(value)) {
-      // Compare the direct native prototype with references captured before
-      // application code. This retains common built-in classes without
-      // invoking mutable Symbol.hasInstance/name/tag hooks.
-      const prototype = safeGetPrototypeOf(value);
-      if (prototype === nativeErrorPrototypes.type) return 'type';
-      if (prototype === nativeErrorPrototypes.range) return 'range';
-      if (prototype === nativeErrorPrototypes.syntax) return 'syntax';
-      if (prototype === nativeErrorPrototypes.reference) return 'reference';
-      if (prototype === nativeErrorPrototypes.aggregate) return 'aggregate';
-      if (prototype === nativeErrorPrototypes.uri) return 'uri';
-      if (prototype === nativeErrorPrototypes.eval) return 'eval';
-      return 'generic';
-    }
-  } catch {
-    return 'uninspectable';
-  }
-  if (value === null) return 'non-error-null';
-  return `non-error-${typeof value}`;
-}
-
-function httpMethod(value) {
-  return value === 'GET' || value === 'POST' || value === 'PUT' || value === 'PATCH' ||
-    value === 'DELETE' || value === 'HEAD' || value === 'OPTIONS' ? value : 'OTHER';
+function sha256Hex(value) {
+  const hash = createHash('sha256');
+  safeHashUpdate(hash, value);
+  return safeHashDigest(hash, 'hex');
 }
 
 function hashSeed(value) {
@@ -382,15 +155,24 @@ function hashSeed(value) {
     hash ^= safeStringCharCodeAt(value, index);
     hash = safeMathImul(hash, 0x01000193);
   }
+  // xorshift must never be seeded with 0.
   return (hash >>> 0) || 1;
 }
 
+function stringBytes(value) {
+  return STRING_BYTES + value.length * 2;
+}
+
+function safeSegment(value, fallback) {
+  return typeof value === 'string' && safeRegExpTest(/^[A-Za-z0-9._-]{1,128}$/, value) ? value : fallback;
+}
+
 function validEndpoint(raw) {
   try {
     const endpoint = new URL(raw);
     if (endpoint.protocol === 'https:') return endpoint.toString();
     if (endpoint.protocol === 'http:' && (endpoint.hostname === '127.0.0.1' ||
-        endpoint.hostname === 'localhost' || endpoint.hostname === '::1')) {
+        endpoint.hostname === 'localhost' || endpoint.hostname === '[::1]')) {
       return endpoint.toString();
     }
   } catch {
@@ -399,82 +181,137 @@ function validEndpoint(raw) {
   return null;
 }
 
+/** A JSON string literal of a primitive string. */
+function quote(value) {
+  return safeJsonStringify(value);
+}
+
+/** Rule 9(c): an approved literal is a boolean, a safe integer or a short
+ * printable string, and its category is `setting:` plus exactly this JSON. */
+function literalJson(literal) {
+  if (literal === true) return 'true';
+  if (literal === false) return 'false';
+  if (typeof literal === 'number') return `${literal}`;
+  return quote(literal);
+}
+
+function validSettingLiteral(literal) {
+  if (typeof literal === 'boolean') return true;
+  if (typeof literal === 'number') return safeNumberIsSafeInteger(literal);
+  if (typeof literal !== 'string' || literal.length < 1 || literal.length > CONTRACT.SETTINGS_MAX_LITERAL_CHARS) return false;
+  for (let index = 0; index < literal.length; index++) {
+    const code = safeStringCharCodeAt(literal, index);
+    if (code < 0x20 || (code >= 0xd800 && code <= 0xdfff)) return false;
+  }
+  return true;
+}
+
+/** An own data property of a parsed manifest object (never an inherited one). */
+function own(object, key) {
+  if (object === null || typeof object !== 'object' || !safeHasOwn(object, key)) return undefined;
+  const descriptor = safeGetOwnPropertyDescriptor(object, key);
+  return descriptor && safeHasOwn(descriptor, 'value') ? descriptor.value : undefined;
+}
+
 function loadInstrumentation() {
-  try {
-    const manifest = safeJsonParse(readFileSync(join(__dirname, 'instrumentation.json'), 'utf8'));
-    if (manifest.schema_version !== 'haystack-node-telemetry-instrumentation-v3' ||
-        !safeArrayIsArray(manifest.sites)) return { sites: new SafeMap(), entrySourcePath: null };
-    const siteEntries = safeArrayMap(manifest.sites, site => [site.probe_key, safeObjectFreeze({
-      probeKey: site.probe_key,
-      siteId: site.site_id,
-      sourcePath: site.source_path,
-      qualifiedName: site.qualified_name,
-      probeKind: site.probe_kind,
-      ownerKey: site.owner_key,
-      structuralKey: site.structural_key,
-      ...(site.label ? { label: site.label } : {}),
-      allowedFields: safeArrayIsArray(site.allowed_fields)
-        ? safeArraySlice(site.allowed_fields, 0)
-        : [],
-      // Source position, present only when the build instrumented source
-      // itself (bundler loader). Joins to the change's function line ranges.
-      ...(safeNumberIsSafeInteger(site.line) && site.line >= 1
-        ? {
-            line: site.line,
-            ...(safeNumberIsSafeInteger(site.column) && site.column >= 0 ? { column: site.column } : {}),
-          }
-        : {}),
-    })]);
-    const sites = new SafeMap();
-    for (let index = 0; index < siteEntries.length; index++) {
-      safeMapSet(sites, siteEntries[index][0], siteEntries[index][1]);
+  const FIELD_NAME = new RegExp(CONTRACT.SERVER_FIELD_NAME_PATTERN);
+  const manifest = safeJsonParse(readFileSync(join(__dirname, 'instrumentation.json'), 'utf8'));
+  const sitesIn = own(manifest, 'sites');
+  if (own(manifest, 'schema_version') !== MANIFEST_SCHEMA_VERSION || !safeArrayIsArray(sitesIn)) return null;
+  const sites = [];
+  let bytes = 0;
+  for (let index = 0; index < sitesIn.length; index++) {
+    const site = sitesIn[index];
+    const strings = ['probe_key', 'site_id', 'source_path', 'qualified_name', 'probe_kind', 'owner_key', 'structural_key'];
+    const values = [];
+    for (let position = 0; position < strings.length; position++) safeArrayPush(values, own(site, strings[position]));
+    let valid = true;
+    for (let position = 0; position < values.length; position++) if (typeof values[position] !== 'string') valid = false;
+    if (!valid) continue;
+    const label = own(site, 'label');
+    const line = own(site, 'line');
+    const column = own(site, 'column');
+    const allowed = own(site, 'allowed_fields');
+    const fields = [];
+    if (safeArrayIsArray(allowed)) {
+      for (let position = 0; position < allowed.length && fields.length < CONTRACT.SERVER_FIELDS_PER_SITE; position++) {
+        const field = allowed[position];
+        if (typeof field === 'string' && safeRegExpTest(FIELD_NAME, field)) safeArrayPush(fields, field);
+      }
+    }
+    const declared = own(site, 'settings');
+    let settings = null;
+    if (safeArrayIsArray(declared) && declared.length >= 1 && declared.length <= CONTRACT.SETTINGS_MAX_DOMAIN + 2) {
+      settings = [];
+      for (let position = 0; position < declared.length; position++) {
+        if (!validSettingLiteral(declared[position])) {
+          settings = null;
+          break;
+        }
+        safeArrayPush(settings, declared[position]);
+      }
+    }
+    // A telemetry-owned, null-prototype record of primitives: what a flush
+    // serializes for the site (ServerSiteV5) without any object reaching
+    // JSON.stringify.
+    const metadata = safeObjectCreate(null);
+    metadata.probeKey = values[0];
+    metadata.siteId = values[1];
+    metadata.sourcePath = values[2];
+    metadata.qualifiedName = values[3];
+    metadata.probeKind = values[4];
+    metadata.ownerKey = values[5];
+    metadata.structuralKey = values[6];
+    metadata.label = typeof label === 'string' && label.length > 0 ? label : null;
+    metadata.line = safeNumberIsSafeInteger(line) && line >= 1 ? line : null;
+    metadata.column = metadata.line !== null && safeNumberIsSafeInteger(column) && column >= 0 ? column : null;
+    metadata.fields = fields;
+    metadata.settings = settings;
+    safeArrayPush(sites, metadata);
+    bytes += SITE_BYTES;
+    for (let position = 0; position < values.length; position++) bytes += stringBytes(values[position]);
+    if (metadata.label !== null) bytes += stringBytes(metadata.label);
+    for (let position = 0; position < fields.length; position++) bytes += 8 + stringBytes(fields[position]);
+    if (settings !== null) {
+      bytes += MAP_BYTES;
+      for (let position = 0; position < settings.length; position++) {
+        bytes += ENTRY_BYTES + stringBytes(`setting:${literalJson(settings[position])}`);
+      }
     }
-    const entryFile = safeArrayIsArray(manifest.instrumented_files)
-      ? safeArrayFind(manifest.instrumented_files, file => file.output_path === manifest.entry)
-      : null;
-    return {
-      sites,
-      buildId: safeSegment(manifest.build_id, 'unknown'),
-      entrySourcePath: typeof entryFile?.source_path === 'string' ? entryFile.source_path : null,
-    };
-  } catch (error) {
-    debug('instrumentation manifest could not be read; telemetry stayed disabled', error);
-    return { sites: new SafeMap(), buildId: 'unknown', entrySourcePath: null };
   }
+  return { sites, bytes, buildId: safeSegment(own(manifest, 'build_id'), 'unknown') };
 }
 
-function installRuntime(options = {}) {
-  if (installed) return activeControl ?? { enabled: false, reason: 'already-installed' };
+function installRuntime() {
+  if (installed) return activeControl ?? installResult ?? { enabled: false, reason: 'already-installed' };
   installed = true;
 
   const endpoint = validEndpoint(process.env.HAYSTACK_TELEMETRY_ENDPOINT ?? '');
   const token = process.env.HAYSTACK_TELEMETRY_TOKEN;
-  if (process.env.HAYSTACK_TELEMETRY !== '1' || !endpoint || !token || !safeFetch || !safeAbortTimeout) {
+  if (process.env.HAYSTACK_TELEMETRY !== '1' || !endpoint || !token || CONTRACT === null) {
     return { enabled: false, reason: 'not-configured' };
   }
-  if (CONTROL_CHANNEL in processHost) {
-    debug('telemetry control name is already owned; telemetry stayed disabled');
-    return { enabled: false, reason: 'global-conflict' };
-  }
+  if (CONTROL_CHANNEL in processHost) return { enabled: false, reason: 'global-conflict' };
 
-  // The manifest-derived build identity is part of every exact DDB family ID.
-  // Do not accept a runtime override that could merge unrelated builds.
-  const instrumentation = loadInstrumentation();
-  const buildId = instrumentation.buildId;
-  const sitesByProbe = instrumentation.sites;
-  const sitesById = new SafeMap();
-  const probeStates = new SafeMap();
-  const siteValues = mapValuesArray(sitesByProbe);
-  for (let index = 0; index < siteValues.length; index++) {
-    const metadata = siteValues[index];
-    safeMapSet(sitesById, metadata.siteId, metadata);
-    safeMapSet(probeStates, metadata.probeKey, {
-      metadata,
-      calls: 0,
-      saturated: false,
-    });
+  // The manifest-derived build identity is part of every raw flush key. Do not
+  // accept a runtime override that could merge unrelated builds.
+  let instrumentation;
+  try {
+    instrumentation = loadInstrumentation();
+  } catch {
+    instrumentation = null;
+  }
+  if (!instrumentation || instrumentation.sites.length === 0) {
+    return { enabled: false, reason: 'missing-instrumentation-manifest' };
   }
-  if (safeMapSize(sitesByProbe) === 0) return { enabled: false, reason: 'missing-instrumentation-manifest' };
+  const MAX_BYTES = CONTRACT.SERVER_RUNTIME_MAX_BYTES;
+  // Site metadata is kept for the life of the process; a build whose sites
+  // alone would take half the cap leaves too little to count with, and
+  // installs nothing.
+  if (instrumentation.bytes > MAX_BYTES / 2) {
+    return { enabled: false, reason: 'instrumentation-exceeds-memory-cap' };
+  }
+  const { buildId } = instrumentation;
   const runId = safeSegment(
     process.env.HAYSTACK_TELEMETRY_RUN_ID,
     `${safeDateNow()}-${process.pid}-${randomBytes(4).toString('hex')}`,
@@ -483,987 +320,691 @@ function installRuntime(options = {}) {
   const flushIntervalMs = safeNumberIsSafeInteger(intervalRequested) && intervalRequested >= 100
     ? intervalRequested
     : DEFAULT_FLUSH_INTERVAL_MS;
-  const requestedSiteObservations = safeNumberParseInt(
-    process.env.HAYSTACK_TELEMETRY_SITE_OBSERVATIONS ?? '',
-    10,
-  );
-  const siteObservationLimit = safeNumberIsSafeInteger(requestedSiteObservations) &&
-    requestedSiteObservations >= 1 && requestedSiteObservations <= MAX_SITE_OBSERVATIONS
-    ? requestedSiteObservations
-    : DEFAULT_SITE_OBSERVATIONS;
-  const requestedProcessProbeObservations = safeNumberParseInt(
-    process.env.HAYSTACK_TELEMETRY_PROCESS_PROBE_OBSERVATIONS ?? '',
-    10,
-  );
-  const processProbeObservationLimit = safeNumberIsSafeInteger(requestedProcessProbeObservations) &&
-    requestedProcessProbeObservations >= 1 &&
-    requestedProcessProbeObservations <= MAX_PROCESS_PROBE_OBSERVATIONS
-    ? requestedProcessProbeObservations
-    : DEFAULT_PROCESS_PROBE_OBSERVATIONS;
-  const requestedProcessSampleRate = safeNumberParseInt(
-    process.env.HAYSTACK_TELEMETRY_PROCESS_SAMPLE_RATE ?? '',
-    10,
-  );
-  const processSampleRate = safeNumberIsSafeInteger(requestedProcessSampleRate) &&
-    requestedProcessSampleRate >= 0 && requestedProcessSampleRate <= MAX_ACTION_SAMPLE_RATE
-    ? requestedProcessSampleRate
-    : DEFAULT_PROCESS_SAMPLE_RATE;
-  const requestedActionSampleRate = safeNumberParseInt(
-    process.env.HAYSTACK_TELEMETRY_ACTION_SAMPLE_RATE ?? '',
-    10,
-  );
-  const actionSampleRate = safeNumberIsSafeInteger(requestedActionSampleRate) &&
-    requestedActionSampleRate >= 1 && requestedActionSampleRate <= MAX_ACTION_SAMPLE_RATE
-    ? requestedActionSampleRate
-    : DEFAULT_ACTION_SAMPLE_RATE;
 
-  let enabled = true;
-  let collecting = true;
-  let processProbeObservations = 0;
+  const SAMPLE_AFTER_CALLS = CONTRACT.SERVER_SAMPLE_AFTER_CALLS;
+  const SAMPLE_RATE = CONTRACT.SERVER_SAMPLE_RATE;
+  // The draw stays in integer arithmetic: a power-of-two rate keeps the low
+  // bits (a mask); any other rate takes an unsigned remainder.
+  const SAMPLE_MASK = (SAMPLE_RATE & (SAMPLE_RATE - 1)) === 0 ? SAMPLE_RATE - 1 : -1;
+  const OBSERVATIONS_PER_SECOND = CONTRACT.SERVER_OBSERVATIONS_PER_SECOND;
+  const SEND_TIMEOUT_MS = CONTRACT.SERVER_SEND_TIMEOUT_MS;
+  const EXIT_FLUSH_MS = CONTRACT.SERVER_EXIT_FLUSH_MS;
+  const C = CONTRACT.categories;
+  const OVERFLOW = C.overflow;
+  const FIELD_STATE_PRESENT = 0;
+  const FIELD_STATE_MISSING = 1;
+  const FIELD_STATE_NULL = 2;
+  const FIELD_STATE_UNDEFINED = 3;
+  const FIELD_STATE_OPAQUE = 4;
+  const FIELD_STATES = CONTRACT.SERVER_FIELD_STATES;
+  const KIND_BRANCH = 0;
+  const KIND_VALUE = 1;
+
+  let counting = true;
+  let offReason = null;
   let sequence = 0;
   let consecutiveFailures = 0;
-  let currentShape = new SafeMap();
-  let currentBranch = new SafeMap();
-  let currentExecutions = new SafeMap();
-  let currentExecutionBytes = 0;
-  let omittedExecutionFamilyObservations = 0;
-  let sampledActions = 0;
-  let unsampledActions = 0;
-  let currentOmissions = new SafeMap();
+  let budgetUsed = 0;
   let pending = null;
   let pendingQueue = [];
   let flushInFlight = null;
-  let beforeExitStarted = false;
-  const actionStorage = new AsyncLocalStorage();
-  const httpActions = new SafeWeakMap();
-  let actionSequence = 0;
-  const actionSeed = hashSeed(`${buildId}:${runId}`);
-  let processSelected = true;
-  let hasChildActions = false;
-
-  function shouldSampleAction(actionKind) {
-    const sequence = actionSequence++;
-    if (actionKind !== 'process' && !processSelected) {
-      unsampledActions++;
-      return false;
-    }
-    if (actionKind !== 'process' && sequence <= SAMPLE_FIRST_ACTIONS) {
-      sampledActions++;
-      return true;
+  let spoolReplayed = false;
+  let exiting = false;
+  let exitDeadline = 0;
+  let spooled = false;
+  let currentSend = null;
+
+  // Every retained byte, by what holds it (rule 13b: the cap covers them all).
+  const memory = {
+    sites: instrumentation.bytes,
+    fieldKeys: 0,
+    counters: 0,
+    serializing: 0,
+    queued: 0,
+  };
+  const used = () => memory.sites + memory.fieldKeys + memory.counters + memory.serializing + memory.queued;
+  const COUNTER_CAP = (MAX_BYTES - memory.sites) * COUNTER_SHARE;
+  const allocatable = bytes => used() + bytes <= MAX_BYTES - RESERVE_BYTES;
+
+  const statesByProbe = new SafeMap();
+  const states = [];
+  for (let index = 0; index < instrumentation.sites.length; index++) {
+    const metadata = instrumentation.sites[index];
+    let settings = null;
+    if (metadata.settings !== null) {
+      // Map keys compare by SameValueZero: 'dark' and 1 never meet, and a
+      // lookup never coerces the customer's value.
+      settings = new SafeMap();
+      for (let position = 0; position < metadata.settings.length; position++) {
+        const literal = metadata.settings[position];
+        safeMapSet(settings, literal, `${CONTRACT.SERVER_SETTING_CATEGORY_PREFIX}${literalJson(literal)}`);
+      }
     }
-    const rate = actionKind === 'process' ? processSampleRate : actionSampleRate;
-    const sampled = rate === 1 || (rate > 1 &&
-      ((actionSeed + safeMathImul(sequence + 1, 0x9e3779b1)) >>> 0) % rate === 0);
-    if (actionKind === 'process') processSelected = sampled;
-    if (sampled) sampledActions++;
-    else unsampledActions++;
-    return sampled;
-  }
-
-  function startAction(actionKind, actionSiteId, actionMethod) {
-    if (!shouldSampleAction(actionKind)) return SUPPRESSED_ACTION;
-    return {
-      suppressed: false,
-      actionKind,
-      actionSiteId,
-      actionMethod,
-      events: [],
-      eventBytes: 0,
-      truncated: false,
-      omittedEvents: 0,
-      finalized: false,
-      outcome: null,
-      terminalError: 'none',
+    const state = {
+      metadata,
+      kind: metadata.probeKind === 'condition' ? KIND_BRANCH : KIND_VALUE,
+      probeName: metadata.probeKind === 'condition'
+        ? '__hstBranch'
+        : metadata.probeKind === 'throw' ? '__hstThrow' : '__hstValue',
+      settings,
+      // Lifetime calls (the census is the process's first SERVER_SAMPLE_AFTER_CALLS); a window's calls are seen
+      // minus the mark its last flush left.
+      seen: 0,
+      flushedSeen: 0,
+      index,
+      skipped: 0,
+      census: null,
+      sampled: null,
+      // Bytes this site's window counters hold (part of memory.counters).
+      bytes: 0,
     };
+    safeMapSet(statesByProbe, metadata.probeKey, state);
+    safeArrayPush(states, state);
   }
 
-  function actionForProbe() {
-    const action = hasChildActions ? safeActionGetStore(actionStorage) : processAction;
-    return action && !action.finalized ? action : null;
+  // Per-site PRNG state in an Int32Array: a 32-bit state kept on an object
+  // would be boxed as a heap number on every draw.
+  const randomState = new Int32Array(states.length);
+  for (let index = 0; index < states.length; index++) {
+    randomState[index] = hashSeed(`${runId}:${states[index].metadata.siteId}`) | 0;
+  }
+  memory.sites += states.length * 4;
+
+  // Field keys (`.<field>:<state>`), built on first use and shared by every
+  // site declaring the same field.
+  const fieldKeysByName = new SafeMap();
+  function fieldKeys(field) {
+    let keys = safeMapGet(fieldKeysByName, field);
+    if (keys !== undefined) return keys;
+    const cost = ENTRY_BYTES + 5 * stringBytes(`.${field}:undefined`);
+    if (!allocatable(cost)) return null;
+    keys = [`.${field}:${FIELD_STATES[0]}`, `.${field}:${FIELD_STATES[1]}`, `.${field}:${FIELD_STATES[2]}`,
+      `.${field}:${FIELD_STATES[3]}`, `.${field}:${FIELD_STATES[4]}`];
+    safeMapSet(fieldKeysByName, field, keys);
+    memory.fieldKeys += cost;
+    return keys;
   }
 
-  function omitExecutionEvents(action, count = 1) {
-    if (!action || action.suppressed || count < 1) return;
-    action.truncated = true;
-    action.omittedEvents = safeMathMin(MAX_SAFE_COUNT, action.omittedEvents + count);
+  // The fields' states and keys for the call being classified, reused across calls.
+  const fieldScratch = new Uint8Array(CONTRACT.SERVER_FIELDS_PER_SITE);
+  const keyScratch = [];
+
+  function turnOff(reason) {
+    if (!counting) return;
+    counting = false;
+    offReason = reason;
+    safeClearInterval(timer);
+    safeClearInterval(budgetTimer);
+    if (currentSend !== null) currentSend();
+    pending = null;
+    pendingQueue = [];
+    for (let index = 0; index < states.length; index++) {
+      const state = states[index];
+      state.flushedSeen = state.seen;
+      state.skipped = 0;
+      state.census = null;
+      state.sampled = null;
+      state.bytes = 0;
+    }
+    memory.counters = 0;
+    memory.serializing = 0;
+    memory.queued = 0;
   }
 
-  function currentAction() {
-    const action = actionForProbe();
-    return action && !action.suppressed ? action : null;
+  function sizeIndex(size) {
+    return size === 0 ? 0 : size === 1 ? 1 : size <= 5 ? 2 : size <= 20 ? 3 : size <= 100 ? 4 : 5;
   }
 
-  function passThrough(_site, value) {
-    return value;
+  function numberCategory(value) {
+    if (value !== value || value === Infinity || value === -Infinity) return C.numberNonfinite;
+    if (value === 0) return C.numberZero;
+    const negative = value < 0;
+    const magnitude = negative ? -value : value;
+    const index = magnitude < 1 ? 0 : magnitude < 10 ? 1 : magnitude < 100 ? 2 : magnitude < 1000 ? 3 : 4;
+    return negative ? C.numberNegative[index] : C.numberPositive[index];
   }
 
-  function addExecutionEvent(site, kind, scope, outcome) {
-    const action = currentAction();
-    if (!action) return;
-    if (action.truncated) {
-      omitExecutionEvents(action);
-      return;
-    }
-    const metadata = safeMapGet(sitesByProbe, site);
-    if (!metadata) return;
-    const previous = action.events[action.events.length - 1];
-    if (previous && previous.siteId === metadata.siteId && previous.kind === kind &&
-        previous.scope === scope && previous.outcome === outcome) {
-      previous.observations++;
-      return;
-    }
-    const event = {
-      siteId: metadata.siteId,
-      kind,
-      scope,
-      outcome,
-      observations: 1,
-    };
-    const eventBytes = safeBufferByteLength(safeJsonStringify({
-      ...event,
-      sourcePath: metadata.sourcePath,
-      qualifiedName: metadata.qualifiedName,
-      probeKind: metadata.probeKind,
-    }), 'utf8');
-    if (action.events.length >= MAX_EXECUTION_EVENTS ||
-        action.eventBytes + eventBytes > MAX_EXECUTION_ACTION_BYTES) {
-      action.truncated = true;
-      omitExecutionEvents(action);
-      return;
+  /** Rule 9(b2): a field's state through property descriptors only, up the
+   * prototype chain to Object.prototype; an accessor or a proxy anywhere on
+   * the way is opaque, never invoked. */
+  function fieldState(object, field) {
+    let holder = object;
+    for (let depth = 0; depth < 8; depth++) {
+      const descriptor = safeGetOwnPropertyDescriptor(holder, field);
+      if (descriptor !== undefined) {
+        if (!safeHasOwn(descriptor, 'value')) return FIELD_STATE_OPAQUE;
+        const value = descriptor.value;
+        return value === undefined ? FIELD_STATE_UNDEFINED : value === null ? FIELD_STATE_NULL : FIELD_STATE_PRESENT;
+      }
+      const prototype = safeGetPrototypeOf(holder);
+      if (prototype === null || prototype === ObjectPrototype) return FIELD_STATE_MISSING;
+      if (safeIsProxy(prototype)) return FIELD_STATE_OPAQUE;
+      holder = prototype;
     }
-    safeArrayPush(action.events, event);
-    action.eventBytes += eventBytes;
+    return FIELD_STATE_OPAQUE;
   }
 
-  function finalizeAction(action, outcome) {
-    if (!action || action.suppressed || action.finalized) return;
-    action.finalized = true;
-    action.outcome = outcome;
-    if (action.events.length === 0) {
-      if (action.omittedEvents > 0 && omittedExecutionFamilyObservations < MAX_SAFE_COUNT) {
-        omittedExecutionFamilyObservations++;
+  /** Rule 9(b), (b2), (c): exactly one value category per call, never a value
+   * except an approved literal, and no customer code run to find it. */
+  function valueCategory(state, value) {
+    if (value === undefined) return C.undefined;
+    if (value === null) return C.null;
+    const type = typeof value;
+    if (state.settings !== null) {
+      if (type === 'string' || type === 'number' || type === 'boolean') {
+        const literal = safeMapGet(state.settings, value);
+        return literal === undefined ? C.other : literal;
       }
-      return;
-    }
-    const sketch = {
-      actionKind: action.actionKind,
-      actionSiteId: action.actionSiteId,
-      actionMethod: action.actionMethod,
-      outcome,
-      terminalError: action.terminalError,
-      truncated: action.truncated,
-      omittedEvents: action.omittedEvents,
-      events: action.events,
-    };
-    const familyId = stableIdentity('execution-local-family', [canonicalJson(sketch)]);
-    const existing = safeMapGet(currentExecutions, familyId);
-    if (existing) {
-      existing.observations++;
-      return;
-    }
-    const sketchBytes = action.eventBytes + safeBufferByteLength(safeJsonStringify(sketch), 'utf8');
-    if (safeMapSize(currentExecutions) >= MAX_EXECUTION_FAMILIES ||
-        currentExecutionBytes + sketchBytes > MAX_EXECUTION_BYTES) {
-      omittedExecutionFamilyObservations++;
-      return;
+      return (type === 'object' || type === 'function') && safeIsProxy(value) ? C.opaque : C.other;
     }
-    safeMapSet(currentExecutions, familyId, { familyId, observations: 1, ...sketch });
-    currentExecutionBytes += sketchBytes;
+    if (type === 'string') return C.string[sizeIndex(value.length)];
+    if (type === 'number') return numberCategory(value);
+    if (type === 'boolean') return C.boolean;
+    if (type === 'bigint') return C.bigint;
+    if (type === 'symbol') return C.symbol;
+    if (safeIsProxy(value)) return C.opaque;
+    if (type === 'function') return C.function;
+    // A genuine array's length is an own data property; Map and Set sizes come
+    // from the built-in getters captured above, never the value's own.
+    if (safeArrayIsArray(value)) return C.array[sizeIndex(value.length)];
+    if (safeIsMap(value)) return C.map[sizeIndex(safeMapSize(value))];
+    if (safeIsSet(value)) return C.set[sizeIndex(safeSetSize(value))];
+    if (safeIsNativeError(value)) return C.error;
+    return C.object;
   }
 
-  let processAction = startAction(
-    'process',
-    stableIdentity('action-site', [instrumentation.entrySourcePath || 'unknown-entry']),
-    'NONE',
-  );
-  safeActionEnterWith(actionStorage, processAction);
+  function entryCost(key) {
+    return ENTRY_BYTES + key.length * 2;
+  }
 
-  function continueProcessAction() {
-    if (processAction.suppressed) return;
-    const previous = processAction;
-    const active = safeActionGetStore(actionStorage);
-    processAction = {
-      suppressed: false,
-      actionKind: processAction.actionKind,
-      actionSiteId: processAction.actionSiteId,
-      actionMethod: processAction.actionMethod,
-      events: [],
-      eventBytes: 0,
-      truncated: false,
-      omittedEvents: 0,
-      finalized: false,
-      outcome: null,
-      terminalError: 'none',
-    };
-    if (!hasChildActions || !active || active === previous) {
-      safeActionEnterWith(actionStorage, processAction);
+  function bump(state, counters, key) {
+    const existing = safeMapGet(counters, key);
+    if (existing === undefined) {
+      const cost = entryCost(key);
+      state.bytes += cost;
+      memory.counters += cost;
+      safeMapSet(counters, key, 1);
+    } else {
+      safeMapSet(counters, key, existing + 1);
     }
   }
 
-  try {
-    const requestStart = diagnosticsChannel.channel('http.server.request.start');
-    const responseFinish = diagnosticsChannel.channel('http.server.response.finish');
-    requestStart.subscribe((message) => {
-      try {
-        hasChildActions = true;
-        const action = startAction(
-          'http-server',
-          stableIdentity('action-site', ['node:http-server']),
-          httpMethod(message?.request?.method),
-        );
-        safeActionEnterWith(actionStorage, action);
-        if (message?.response && typeof message.response === 'object') {
-          safeWeakMapSet(httpActions, message.response, action);
+  function classify(state, value, census) {
+    let counters = census ? state.census : state.sampled;
+    if (counters === null) {
+      if (!allocatable(MAP_BYTES + ENTRY_BYTES)) {
+        // Not even an overflow counter fits: the call is unclassified.
+        state.skipped++;
+        return;
+      }
+      counters = new SafeMap();
+      state.bytes += MAP_BYTES;
+      memory.counters += MAP_BYTES;
+      if (census) state.census = counters;
+      else state.sampled = counters;
+    }
+    let category;
+    let fieldCount = 0;
+    try {
+      if (state.kind === KIND_BRANCH) {
+        // ToBoolean never runs customer code.
+        category = value ? C.true : C.false;
+      } else {
+        category = valueCategory(state, value);
+        const fields = state.metadata.fields;
+        if (category === C.object && fields.length > 0) {
+          fieldCount = fields.length;
+          for (let index = 0; index < fieldCount; index++) {
+            fieldScratch[index] = fieldState(value, fields[index]);
+            keyScratch[index] = fieldKeys(fields[index]);
+          }
         }
-      } catch (error) {
-        debug('HTTP action start failed open', error);
       }
-    });
-    responseFinish.subscribe((message) => {
-      try {
-        const action = message?.response && typeof message.response === 'object'
-          ? safeWeakMapGet(httpActions, message.response)
-          : null;
-        const response = message?.response;
-        const statusDescriptor = response && typeof response === 'object' && !safeIsProxy(response)
-          ? safeGetOwnPropertyDescriptor(response, 'statusCode')
-          : null;
-        const status = statusDescriptor && safeHasOwn(statusDescriptor, 'value')
-          ? safeNumber(statusDescriptor.value)
-          : NaN;
-        const outcome = !safeNumberIsFinite(status)
-          ? 'completed'
-          : status >= 500
-            ? 'server-error'
-            : status >= 400
-              ? 'client-error'
-              : 'success';
-        finalizeAction(action, outcome);
-      } catch (error) {
-        debug('HTTP action finish failed open', error);
+    } catch {
+      // An exotic object refused inspection; it is opaque, and nothing escapes.
+      category = state.kind === KIND_BRANCH ? (value ? C.true : C.false) : C.opaque;
+      fieldCount = 0;
+    }
+    // Past the counters' share of the cap (or with a field key that could not
+    // be built), a call that needs a counter this window has not allocated is
+    // counted as overflow alone, its fields unrecorded, so every classified
+    // call still adds exactly one value category.
+    let complete = true;
+    for (let index = 0; complete && index < fieldCount; index++) complete = keyScratch[index] !== null;
+    if (complete && memory.counters >= COUNTER_CAP) {
+      complete = safeMapGet(counters, category) !== undefined;
+      for (let index = 0; complete && index < fieldCount; index++) {
+        complete = safeMapGet(counters, keyScratch[index][fieldScratch[index]]) !== undefined;
       }
-    });
-  } catch (error) {
-    debug('HTTP action correlation unavailable', error);
-  }
-
-  function recordOmission(site, field) {
-    const current = safeMapGet(currentOmissions, site) || {
-      counterObservations: 0,
-      probeObservations: 0,
-    };
-    current[field]++;
-    safeMapSet(currentOmissions, site, current);
-  }
-
-  function disable(reason, error) {
-    enabled = false;
-    safeClearInterval(timer);
-    debug(`disabled after ${reason}`, error);
-  }
-
-  function sampleWeight(state) {
-    if (processProbeObservations >= processProbeObservationLimit) {
-      // Attribute the one observation that exhausted the process-wide budget.
-      // Later probes are deliberately not inspected or counted: the sampler
-      // version declares that this is a bounded, lossy collection mode.
-      recordOmission(state.metadata.probeKey, 'probeObservations');
-      collecting = false;
-      return -2;
     }
-    processProbeObservations++;
-    const calls = ++state.calls;
-    if (calls > siteObservationLimit) {
-      state.saturated = true;
-      return -1;
+    if (!complete) {
+      const existing = safeMapGet(counters, OVERFLOW);
+      if (existing !== undefined) safeMapSet(counters, OVERFLOW, existing + 1);
+      else if (allocatable(entryCost(OVERFLOW))) bump(state, counters, OVERFLOW);
+      else state.skipped++;
+      return;
     }
-    return 1;
+    bump(state, counters, category);
+    for (let index = 0; index < fieldCount; index++) bump(state, counters, keyScratch[index][fieldScratch[index]]);
+    if (used() > MAX_BYTES) turnOff('memory cap');
   }
 
-  function increment(map, key, weight) {
-    const existing = safeMapGet(map, key);
-    if (existing === undefined && safeMapSize(map) >= MAX_COUNTER_KEYS) {
-      recordOmission(safeStringSlice(key, 0, safeStringIndexOf(key, '|')), 'counterObservations');
+  /** The rare path of a call: past the draw (or in the census), within the
+   * second's budget, classified; never throws into the probe. */
+  function sample(state, value, census) {
+    if (budgetUsed >= OBSERVATIONS_PER_SECOND) {
+      state.skipped++;
       return;
     }
-    safeMapSet(map, key, (existing ?? 0) + weight);
-  }
-
-  function observeState(state, value, fields) {
-    // Saturation is deliberately lossy: the first over-limit observation
-    // records an explicit saturation marker, then this probe becomes a
-    // constant-time pass-through. Counting every later omission caused severe
-    // amplification in customer hot loops while adding no new shape evidence.
-    if (!enabled || !collecting || state.saturated) return value;
+    budgetUsed++;
     try {
-      const site = state.metadata.probeKey;
-      const action = actionForProbe();
-      if (action?.suppressed) return value;
-      const probeKind = state.metadata.probeKind;
-      const executionValue = action && (probeKind === 'parameter' || probeKind === 'return');
-      const weight = sampleWeight(state);
-      if (weight === -2) {
-        if (executionValue) {
-          const skippedEvents = value !== null && typeof value === 'object' && !safeArrayIsArray(value)
-            ? 1 + safeMathMin(fields.length, 48)
-            : 1;
-          omitExecutionEvents(action, skippedEvents);
-        }
-        return value;
-      }
-      if (weight < 0) {
-        if (weight === -1) increment(currentShape, `${site}|__saturated__|info`, 1);
-        if (executionValue) {
-          const skippedEvents = value !== null && typeof value === 'object' && !safeArrayIsArray(value)
-            ? 1 + safeMathMin(fields.length, 48)
-            : 1;
-          omitExecutionEvents(action, skippedEvents);
-        }
-        return value;
-      }
-      const fieldEventCount = safeArrayIsArray(fields) && value !== null &&
-        typeof value === 'object' && !safeArrayIsArray(value)
-        ? safeMathMin(fields.length, 48)
-        : 0;
-      const correlated = executionValue && !action.truncated;
-      if (executionValue && action.truncated) omitExecutionEvents(action, 1 + fieldEventCount);
-      if (weight > 0) {
-        const selfOutcome = value === null ? 'null' : value === undefined ? 'undefined' : 'ok';
-        increment(currentShape, `${site}|__self__|${selfOutcome}`, weight);
-        increment(currentShape, `${site}|__self__|shape:${valueShape(value)}`, weight);
-      }
-      if (correlated && probeKind === 'parameter') {
-        addExecutionEvent(site, 'input', 'whole-value', `shape:${valueShape(value)}`);
-      } else if (correlated && probeKind === 'return') {
-        addExecutionEvent(site, 'output', 'whole-value', `shape:${valueShape(value)}`);
-      }
+      classify(state, value, census);
+    } catch {
+      // Nothing a probe does may reach the application.
+    }
+  }
 
-      if (safeArrayIsArray(fields) && value !== null && typeof value === 'object' && !safeArrayIsArray(value)) {
-        const proxyValue = safeIsProxy(value);
-        for (let fieldIndex = 0; fieldIndex < fields.length && fieldIndex < 48; fieldIndex++) {
-          const field = fields[fieldIndex];
-          // Manifest loading already validates the static field list. Avoid
-          // mutable RegExp/String prototype calls in this hot probe path.
-          if (typeof field !== 'string') continue;
-          const ordinal = fieldIndex + 1;
-          const fieldScope = `named-field-${ordinal < 10 ? `0${ordinal}` : ordinal}`;
-          if (proxyValue) {
-            if (weight > 0) increment(currentShape, `${site}|${field}|uninspectable`, weight);
-            if (correlated) {
-              addExecutionEvent(site, probeKind === 'parameter' ? 'input' : 'output', fieldScope, 'uninspectable');
-            }
-            continue;
-          }
-          let descriptor;
-          try {
-            descriptor = safeGetOwnPropertyDescriptor(value, field);
-          } catch {
-            if (weight > 0) increment(currentShape, `${site}|${field}|uninspectable`, weight);
-            if (correlated) {
-              addExecutionEvent(site, probeKind === 'parameter' ? 'input' : 'output', fieldScope, 'uninspectable');
-            }
-            continue;
-          }
-          if (!descriptor) {
-            if (weight > 0) increment(currentShape, `${site}|${field}|absent`, weight);
-            if (correlated) {
-              addExecutionEvent(site, probeKind === 'parameter' ? 'input' : 'output', fieldScope, 'absent');
-            }
-          } else if (!safeHasOwn(descriptor, 'value')) {
-            if (weight > 0) increment(currentShape, `${site}|${field}|accessor`, weight);
-            if (correlated) {
-              addExecutionEvent(site, probeKind === 'parameter' ? 'input' : 'output', fieldScope, 'accessor');
-            }
-          } else {
-            const fieldValue = descriptor.value;
-            const outcome = fieldValue === null ? 'null' : fieldValue === undefined ? 'undefined' : 'ok';
-            if (weight > 0) {
-              increment(currentShape, `${site}|${field}|${outcome}`, weight);
-              increment(currentShape, `${site}|${field}|shape:${valueShape(fieldValue)}`, weight);
-            }
-            if (correlated) {
-              addExecutionEvent(
-                site,
-                probeKind === 'parameter' ? 'input' : 'output',
-                fieldScope,
-                `shape:${valueShape(fieldValue)}`,
-              );
-            }
-          }
-        }
+  /** One site's probe: rule 9(a)'s single increment, then the census or a
+   * Bernoulli draw (xorshift32, decorrelated from any predicate's period,
+   * where a fixed stride would alias with it). */
+  function siteProbe(state) {
+    const index = state.index;
+    return (value) => {
+      if (!counting) return value;
+      if (++state.seen > SAMPLE_AFTER_CALLS) {
+        let random = randomState[index];
+        random ^= random << 13;
+        random ^= random >>> 17;
+        random ^= random << 5;
+        randomState[index] = random;
+        if (SAMPLE_MASK >= 0 ? (random & SAMPLE_MASK) !== 0 : (random >>> 0) % SAMPLE_RATE !== 0) return value;
+        sample(state, value, false);
+      } else {
+        sample(state, value, true);
       }
-    } catch (error) {
-      // A hostile Proxy or exotic object must never affect the host app.
-      debug('value probe failed open', error);
-    }
-    return value;
+      return value;
+    };
   }
 
-  function observe(site, value, fields) {
-    const state = safeMapGet(probeStates, site);
-    return state ? observeState(state, value, fields) : value;
+  /** Sites that counted a call since the last flush (a scan off the hot path). */
+  function activeStates() {
+    const active = [];
+    for (let index = 0; index < states.length; index++) {
+      const state = states[index];
+      if (state.seen !== state.flushedSeen || state.skipped > 0) safeArrayPush(active, state);
+    }
+    return active;
   }
 
-  function branchState(state, value) {
-    if (!enabled || !collecting || state.saturated) return value;
-    try {
-      const site = state.metadata.probeKey;
-      const action = actionForProbe();
-      if (action?.suppressed) return value;
-      const weight = sampleWeight(state);
-      if (weight === -2) {
-        omitExecutionEvents(action);
-        return value;
-      }
-      if (weight < 0) {
-        if (weight === -1) increment(currentBranch, `${site}|S`, 1);
-        omitExecutionEvents(action);
-      }
-      else if (weight > 0) {
-        const outcome = value ? 'T' : 'F';
-        increment(currentBranch, `${site}|${outcome}`, weight);
-        if (action?.truncated) omitExecutionEvents(action);
-        else if (action) addExecutionEvent(site, 'branch', 'branch-result', outcome);
-      }
-    } catch (error) {
-      debug('branch probe failed open', error);
+  /** The window so far, taken atomically: each active site's deltas and its
+   * counters handed over and reset (pointer swaps). The handed-over counters
+   * stay accounted, as serializing, until each site's JSON replaces them. */
+  function takeWindow() {
+    const active = activeStates();
+    const taken = [];
+    for (let index = 0; index < active.length; index++) {
+      const state = active[index];
+      const entry = safeObjectCreate(null);
+      entry.state = state;
+      entry.calls = state.seen - state.flushedSeen;
+      entry.skipped = state.skipped;
+      entry.census = state.census;
+      entry.sampled = state.sampled;
+      entry.bytes = state.bytes;
+      safeArrayPush(taken, entry);
+      state.flushedSeen = state.seen;
+      state.skipped = 0;
+      state.census = null;
+      state.sampled = null;
+      state.bytes = 0;
     }
-    return value;
+    memory.serializing += memory.counters;
+    memory.counters = 0;
+    return taken;
   }
 
-  function branch(site, value) {
-    const state = safeMapGet(probeStates, site);
-    return state ? branchState(state, value) : value;
+  /** `{"<category>":<count>,...}` from a telemetry-owned Map of strings to integers. */
+  function countsJson(counters) {
+    if (counters === null) return '{}';
+    const parts = [];
+    const iterator = safeMapEntries(counters);
+    while (true) {
+      const step = safeMapIteratorNext(iterator);
+      if (step.done) break;
+      safeArrayPush(parts, `${quote(step.value[0])}:${step.value[1]}`);
+    }
+    return `{${safeArrayJoin(parts, ',')}}`;
   }
 
-  function thrownState(state, value) {
-    if (!enabled || !collecting || state.saturated) return value;
-    try {
-      const site = state.metadata.probeKey;
-      const action = actionForProbe();
-      if (action?.suppressed) return value;
-      const weight = sampleWeight(state);
-      if (weight === -2) {
-        omitExecutionEvents(action);
-        return value;
-      }
-      if (weight < 0) {
-        if (weight === -1) increment(currentShape, `${site}|__saturated__|info`, 1);
-        omitExecutionEvents(action);
-      } else if (action?.truncated) omitExecutionEvents(action);
-      else if (action) addExecutionEvent(site, 'error', 'thrown-value', `error:${errorClass(value)}`);
-    } catch (error) {
-      debug('throw probe failed open', error);
+  /** ServerSiteV5 from the site's null-prototype record of primitives. */
+  function siteJson(metadata) {
+    const fields = [];
+    for (let index = 0; index < metadata.fields.length; index++) safeArrayPush(fields, quote(metadata.fields[index]));
+    let json = `{"probeKey":${quote(metadata.probeKey)},"siteId":${quote(metadata.siteId)},` +
+      `"sourcePath":${quote(metadata.sourcePath)},"qualifiedName":${quote(metadata.qualifiedName)},` +
+      `"probeKind":${quote(metadata.probeKind)},"ownerKey":${quote(metadata.ownerKey)},` +
+      `"structuralKey":${quote(metadata.structuralKey)}`;
+    if (metadata.label !== null) json += `,"label":${quote(metadata.label)}`;
+    json += `,"allowedFields":[${safeArrayJoin(fields, ',')}]`;
+    if (metadata.line !== null) json += `,"line":${metadata.line}`;
+    if (metadata.column !== null) json += `,"column":${metadata.column}`;
+    if (metadata.settings !== null) {
+      const literals = [];
+      for (let index = 0; index < metadata.settings.length; index++) safeArrayPush(literals, literalJson(metadata.settings[index]));
+      json += `,"settings":[${safeArrayJoin(literals, ',')}]`;
     }
-    return value;
+    return `${json}}`;
   }
 
-  function thrown(site, value) {
-    const state = safeMapGet(probeStates, site);
-    return state ? thrownState(state, value) : value;
+  /** One site's part of a body, its bytes moved from serializing to queued. */
+  function unitOf(entry) {
+    const site = siteJson(entry.state.metadata);
+    const counts = `{"site":${quote(entry.state.metadata.siteId)},"calls":${entry.calls},` +
+      `"census":${countsJson(entry.census)},"sampled":${countsJson(entry.sampled)},` +
+      `"sampleRate":${SAMPLE_RATE},"skipped":${entry.skipped}}`;
+    const bytes = safeBufferByteLength(site, 'utf8') + safeBufferByteLength(counts, 'utf8') + 2;
+    memory.serializing -= entry.bytes;
+    entry.census = null;
+    entry.sampled = null;
+    memory.queued += bytes * 2;
+    if (used() > MAX_BYTES) throw new Error('memory cap');
+    return { site, counts, bytes };
   }
 
-  function makePending(reason) {
-    if (pending || pendingQueue.length > 0 || (safeMapSize(currentShape) === 0 &&
-      safeMapSize(currentBranch) === 0 && safeMapSize(currentExecutions) === 0 &&
-      omittedExecutionFamilyObservations === 0 && sampledActions === 0 && unsampledActions === 0 &&
-      safeMapSize(currentOmissions) === 0)) return;
-    const shape = objectFromMap(currentShape);
-    const branchCounters = objectFromMap(currentBranch);
-    currentShape = new SafeMap();
-    currentBranch = new SafeMap();
-    const executions = safeArraySort(
-      mapValuesArray(currentExecutions),
-      (left, right) => compareStrings(left.familyId, right.familyId),
-    );
-    currentExecutions = new SafeMap();
-    currentExecutionBytes = 0;
-    const executionOmissions = {
-      sampledActions,
-      unsampledActions,
-      omittedFamilyObservations: omittedExecutionFamilyObservations,
-    };
-    sampledActions = 0;
-    unsampledActions = 0;
-    omittedExecutionFamilyObservations = 0;
-    const omittedEntries = safeArraySort(
-      mapEntriesArray(currentOmissions),
-      (leftEntry, rightEntry) => compareStrings(leftEntry[0], rightEntry[0]),
-    );
-    const omittedSites = safeArrayMap(omittedEntries, entry => ({
-      probeKey: entry[0],
-      counterObservations: entry[1].counterObservations,
-      probeObservations: entry[1].probeObservations,
-    }));
-    currentOmissions = new SafeMap();
-    const counterGroups = new SafeMap();
-    const groupFor = (probeKey) => {
-      let group = safeMapGet(counterGroups, probeKey);
-      if (!group) {
-        group = { probeKey, shape: [], branch: [], omission: null };
-        safeMapSet(counterGroups, probeKey, group);
-      }
-      return group;
-    };
-    const shapeEntries = safeObjectEntries(shape);
-    for (let index = 0; index < shapeEntries.length; index++) {
-      const entry = shapeEntries[index];
-      safeArrayPush(groupFor(safeStringSlice(entry[0], 0, safeStringIndexOf(entry[0], '|'))).shape, entry);
-    }
-    const branchEntries = safeObjectEntries(branchCounters);
-    for (let index = 0; index < branchEntries.length; index++) {
-      const entry = branchEntries[index];
-      safeArrayPush(groupFor(safeStringSlice(entry[0], 0, safeStringIndexOf(entry[0], '|'))).branch, entry);
-    }
-    for (let index = 0; index < omittedSites.length; index++) {
-      const omission = omittedSites[index];
-      groupFor(omission.probeKey).omission = omission;
+  /** A ServerFlushV5 body, its sequence reserved now: every body built gets a
+   * sequence of its own, whether it is sent, retried, abandoned or spooled. */
+  function bodyOf(units, observedAt, reason) {
+    const sites = [];
+    const counts = [];
+    let bytes = 0;
+    for (let index = 0; index < units.length; index++) {
+      safeArrayPush(sites, units[index].site);
+      safeArrayPush(counts, units[index].counts);
+      bytes += units[index].bytes;
     }
+    const seq = sequence++;
+    const body = `{"v":1,"samplerVersion":${CONTRACT.SERVER_SAMPLER_VERSION},"buildId":${quote(buildId)},` +
+      `"runId":${quote(runId)},"seq":${seq},"ts":${quote(observedAt)},` +
+      `"reason":${quote(safeStringSlice(safeString(reason), 0, 64))},` +
+      `"sites":[${safeArrayJoin(sites, ',')}],"counts":[${safeArrayJoin(counts, ',')}]}`;
+    // The units' strings are released once joined; the body's are now held.
+    const held = safeBufferByteLength(body, 'utf8');
+    memory.queued += held - bytes * 2;
+    return { seq, body, bytes: held };
+  }
 
-    const packUnits = (units) => {
-      const chunks = [];
-      let current = [];
-      let bytes = 0;
-      for (let unitIndex = 0; unitIndex < units.length; unitIndex++) {
-        const unit = units[unitIndex];
-        let unitBytes = safeBufferByteLength(safeJsonStringify(unit), 'utf8') + 2_048;
-        if (unit.type === 'counter') {
-          unitBytes += safeBufferByteLength(safeJsonStringify(safeMapGet(sitesByProbe, unit.group.probeKey)), 'utf8');
-        } else if (unit.type === 'execution') {
-          unitBytes += safeArrayReduce(unit.unit.eventSites, (total, probeKey) =>
-            total + safeBufferByteLength(safeJsonStringify(safeMapGet(sitesByProbe, probeKey)), 'utf8'), 0);
-        }
-        if (current.length > 0 && bytes + unitBytes > PAYLOAD_CHUNK_BUDGET) {
-          safeArrayPush(chunks, current);
-          current = [];
-          bytes = 0;
-        }
-        safeArrayPush(current, unit);
-        bytes += unitBytes;
-      }
-      if (current.length > 0) safeArrayPush(chunks, current);
-      return chunks;
-    };
+  function release(entry) {
+    if (entry !== null) memory.queued -= entry.bytes;
+  }
 
-    const executionUnits = safeArrayMap(executions, execution => {
-      const eventSiteSet = new SafeSet();
-      for (let eventIndex = 0; eventIndex < execution.events.length; eventIndex++) {
-        const event = execution.events[eventIndex];
-        const siteMetadata = safeMapGet(sitesById, event.siteId);
-        if (siteMetadata?.probeKey) safeSetAdd(eventSiteSet, siteMetadata.probeKey);
-      }
-      const eventSites = safeArraySort(setValuesArray(eventSiteSet), compareStrings);
-      return { execution, eventSites };
-    });
-    const counterUnits = safeArrayMap(
-      safeArraySort(mapValuesArray(counterGroups),
-        (left, right) => compareStrings(left.probeKey, right.probeKey)),
-      group => ({ type: 'counter', group }),
-    );
-    const projectedExecutionUnits = safeArrayMap(executionUnits, unit => ({ type: 'execution', unit }));
-    const unitsToPack = [];
-    for (let index = 0; index < counterUnits.length; index++) safeArrayPush(unitsToPack, counterUnits[index]);
-    for (let index = 0; index < projectedExecutionUnits.length; index++) {
-      safeArrayPush(unitsToPack, projectedExecutionUnits[index]);
-    }
-    const packed = packUnits(unitsToPack);
-    const chunkInputs = safeArrayMap(packed, units => ({
-      groups: safeArrayMap(safeArrayFilter(units, unit => unit.type === 'counter'), unit => unit.group),
-      executionUnits: safeArrayMap(safeArrayFilter(units, unit => unit.type === 'execution'), unit => unit.unit),
-    }));
-    if (chunkInputs.length === 0) safeArrayPush(chunkInputs, { groups: [], executionUnits: [] });
+  /** Bodies of the window so far, chunked under the upload limit. Interval
+   * flushes yield to the event loop between slices; the exit flush stops at
+   * its deadline (what it has not serialized is abandoned). */
+  async function makePending(reason) {
+    if (pending !== null || pendingQueue.length > 0) return;
+    const taken = takeWindow();
+    if (taken.length === 0) return;
     const observedAt = safeDateToISOString(new SafeDate());
-    const serialized = safeArrayMap(chunkInputs, (chunk, index) => {
-      const chunkShape = objectFromEntryArray(safeArrayFlatMap(chunk.groups, group => group.shape));
-      const chunkBranch = objectFromEntryArray(safeArrayFlatMap(chunk.groups, group => group.branch));
-      const chunkOmittedSites = safeArrayFilter(
-        safeArrayMap(chunk.groups, group => group.omission),
-        item => item !== null && item !== undefined,
-      );
-      const chunkOmissions = safeArrayReduce(chunkOmittedSites, (totals, item) => ({
-        counterObservations: totals.counterObservations + item.counterObservations,
-        probeObservations: totals.probeObservations + item.probeObservations,
-      }), { counterObservations: 0, probeObservations: 0 });
-      const chunkExecutions = safeArrayMap(chunk.executionUnits, unit => unit.execution);
-      const usedProbeKeys = new SafeSet();
-      for (let groupIndex = 0; groupIndex < chunk.groups.length; groupIndex++) {
-        safeSetAdd(usedProbeKeys, chunk.groups[groupIndex].probeKey);
-      }
-      for (let unitIndex = 0; unitIndex < chunk.executionUnits.length; unitIndex++) {
-        const unit = chunk.executionUnits[unitIndex];
-        for (let siteIndex = 0; siteIndex < unit.eventSites.length; siteIndex++) {
-          safeSetAdd(usedProbeKeys, unit.eventSites[siteIndex]);
+    const bodies = [];
+    let units = [];
+    let unitsBytes = 0;
+    try {
+      for (let index = 0; index < taken.length; index++) {
+        if (exiting && safeDateNow() >= exitDeadline) break;
+        const unit = unitOf(taken[index]);
+        taken[index] = null;
+        if (units.length > 0 && unitsBytes + unit.bytes > PAYLOAD_CHUNK_BUDGET) {
+          safeArrayPush(bodies, bodyOf(units, observedAt, reason));
+          units = [];
+          unitsBytes = 0;
         }
+        safeArrayPush(units, unit);
+        unitsBytes += unit.bytes;
+        if (index % FLUSH_SLICE_SITES === FLUSH_SLICE_SITES - 1) await nextTurn();
       }
-      const payload = {
-        v: 1,
-        samplerVersion: SAMPLER_VERSION,
-        buildId,
-        runId,
-        seq: sequence + index,
-        ts: observedAt,
-        reason: safeStringSlice(safeString(reason), 0, 256),
-        omissions: chunkOmissions,
-        omittedSites: chunkOmittedSites,
-        executionOmissions: index === 0 ? executionOmissions : {
-          sampledActions: 0,
-          unsampledActions: 0,
-          omittedFamilyObservations: 0,
-        },
-        sites: safeArrayMap(safeArraySort(setValuesArray(usedProbeKeys), compareStrings),
-          key => safeMapGet(sitesByProbe, key)),
-        shape: chunkShape,
-        branch: chunkBranch,
-        executions: chunkExecutions,
-        coverage: [],
+      if (units.length > 0) safeArrayPush(bodies, bodyOf(units, observedAt, reason));
+    } finally {
+      // Whatever was taken and not serialized is released (abandoned at the deadline).
+      for (let index = 0; index < taken.length; index++) if (taken[index] !== null) memory.serializing -= taken[index].bytes;
+    }
+    pending = safeArrayShift(bodies) ?? null;
+    pendingQueue = bodies;
+  }
+
+  const target = new URL(endpoint);
+  const secure = target.protocol === 'https:';
+  const host = safeStringStartsWith(target.hostname, '[') ? safeStringSlice(target.hostname, 1, -1) : target.hostname;
+  const port = target.port ? safeNumberParseInt(target.port, 10) : secure ? 443 : 80;
+  const requestHead = `POST ${target.pathname}${target.search} HTTP/1.1\r\nHost: ${target.host}\r\n` +
+    `Authorization: Bearer ${token}\r\nContent-Type: application/json\r\nConnection: close\r\n`;
+
+  /** POST one body; resolves the response status (0: no response). Only the
+   * status line is read, then the socket is destroyed. */
+  function send(body, timeoutMs) {
+    return new SafePromise((resolve) => {
+      let settled = false;
+      let socket = null;
+      let timeout = null;
+      let head = '';
+      const finish = (status) => {
+        if (settled) return;
+        settled = true;
+        if (timeout !== null) safeClearTimeout(timeout);
+        if (currentSend === cancel) currentSend = null;
+        try {
+          if (socket !== null) socket.destroy();
+        } catch {
+          // Already gone.
+        }
+        resolve(status);
       };
-      const body = safeJsonStringify(payload);
-      if (safeBufferByteLength(body, 'utf8') > MAX_PAYLOAD_BYTES) {
-        throw new SafeError('bounded telemetry unit exceeded the upload byte limit');
+      const cancel = () => finish(0);
+      try {
+        // Null-prototype options: net and tls read only their own members.
+        const options = safeObjectCreate(null);
+        options.host = host;
+        options.port = port;
+        if (secure && safeIsIP(host) === 0) options.servername = host;
+        socket = secure ? safeTlsConnect(options) : safeNetConnect(options);
+        socket.unref();
+        socket.on('error', () => finish(0));
+        socket.on('close', () => finish(0));
+        socket.on('data', (chunk) => {
+          head += safeBufferToString(chunk, 'latin1', 0, safeMathMin(chunk.length, 1024));
+          const lineEnd = safeStringIndexOf(head, '\r\n');
+          if (lineEnd < 0) {
+            if (head.length > 1024) finish(0);
+            return;
+          }
+          // `HTTP/1.1 202 Accepted`
+          const status = safeStringStartsWith(head, 'HTTP/1.') ? safeNumberParseInt(safeStringSlice(head, 9, 12), 10) : 0;
+          finish(status === status ? status : 0);
+        });
+        socket.once(secure ? 'secureConnect' : 'connect', () => {
+          socket.write(`${requestHead}Content-Length: ${safeBufferByteLength(body, 'utf8')}\r\n\r\n`);
+          socket.write(body);
+        });
+        timeout = safeSetTimeout(cancel, timeoutMs);
+        timeout.unref();
+        currentSend = cancel;
+      } catch {
+        finish(0);
       }
-      return { payload, body };
     });
-    pending = safeArrayShift(serialized) ?? null;
-    pendingQueue = serialized;
+  }
+
+  function remaining() {
+    return exiting ? exitDeadline - safeDateNow() : SEND_TIMEOUT_MS;
   }
 
   async function doFlush(reason) {
-    if (!enabled) return false;
+    if (!counting) return false;
+    // A replay sends what an earlier process of this build left; never on the
+    // way out of this one.
+    if (!spoolReplayed && !exiting) {
+      spoolReplayed = true;
+      await replaySpooled();
+      if (!counting) return false;
+    }
     try {
-      makePending(reason);
-    } catch (error) {
-      disable('payload construction failure', error);
+      await makePending(reason);
+    } catch {
+      turnOff('memory cap');
       return false;
     }
-    if (!pending) return true;
-    try {
-      let uploaded = false;
-      while (pending) {
-      const response = await safeFetch(endpoint, {
-        method: 'POST',
-        headers: {
-          Authorization: `Bearer ${token}`,
-          'Content-Type': 'application/json',
-        },
-        body: pending.body,
-        signal: safeAbortTimeout(10_000),
-      });
-      if (!responseAccepted(response)) throw new SafeError(`ingestion returned HTTP ${responseStatus(response)}`);
-      pending = null;
-      sequence++;
-      uploaded = true;
-      pending = safeArrayShift(pendingQueue) ?? null;
+    if (pending === null) return true;
+    while (pending !== null) {
+      const budget = safeMathMin(SEND_TIMEOUT_MS, remaining());
+      if (budget <= 0) return false;
+      const status = await send(pending.body, budget);
+      if (!counting) return false;
+      if (status >= 200 && status < 300) {
+        release(pending);
+        pending = safeArrayShift(pendingQueue) ?? null;
+        continue;
       }
-      consecutiveFailures = 0;
-      return true;
-    } catch (error) {
+      // The exact bodies stay pending for the next interval: the same
+      // (build, run, seq) key, so a retry the ingestion already stored is a
+      // duplicate it recognizes, never a double count.
+      if (exiting) return false;
       consecutiveFailures++;
-      debug(`flush failed; exact payload retained (${consecutiveFailures}/${MAX_CONSECUTIVE_FAILURES})`, error);
-      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) disable('repeated flush failures', error);
+      if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES) turnOff(`${MAX_CONSECUTIVE_FAILURES} failed sends`);
       return false;
     }
+    consecutiveFailures = 0;
+    return true;
   }
 
-  const spoolDirectory = join(
-    tmpdir(),
-    `haystack-telemetry-${safeStringSlice(stableIdentity('owner', [endpoint, token, buildId]), 'owner-'.length)}`,
-  );
-
-  function spoolBody(body) {
-    try {
-      const bodyBytes = safeBufferByteLength(body, 'utf8');
-      if (bodyBytes > MAX_PAYLOAD_BYTES) {
-        debug('oversized crash payload was not spooled');
-        return;
-      }
-      mkdirSync(spoolDirectory, { recursive: true, mode: 0o700 });
-      const digest = sha256Hex(body);
-      const finalPath = join(spoolDirectory, `pending-${digest}.json`);
-      const pendingNames = safeArrayFilter(readdirSync(spoolDirectory),
-        name => safeRegExpTest(/^pending-[0-9a-f]{64}\.json$/, name));
-      const described = safeArrayMap(pendingNames, name => {
-          const path = join(spoolDirectory, name);
-          try {
-            const stats = statSync(path);
-            return { name, path, bytes: stats.size, modified: stats.mtimeMs };
-          } catch {
-            return null;
-          }
-        });
-      const existing = safeArraySort(
-        safeArrayFilter(described, item => item !== null && item !== undefined),
-        (left, right) => left.modified - right.modified || compareStrings(left.name, right.name),
-      );
-      let retainedBytes = safeArrayReduce(existing, (total, file) => total + file.bytes, 0);
-      const receiptPath = join(spoolDirectory, 'dropped.json');
-      let dropped = { chunks: 0, bytes: 0, payload: null };
-      try {
-        const parsed = safeJsonParse(readFileSync(receiptPath, 'utf8'));
-        if (safeNumberIsSafeInteger(parsed.chunks) && parsed.chunks >= 0 &&
-            safeNumberIsSafeInteger(parsed.bytes) && parsed.bytes >= 0 &&
-            (parsed.payload === null || typeof parsed.payload === 'object')) dropped = parsed;
-      } catch {
-        // No prior eviction receipt is the expected case.
-      }
-      while (existing.length >= MAX_SPOOL_FILES || retainedBytes + bodyBytes > MAX_SPOOL_BYTES) {
-        const oldest = safeArrayShift(existing);
-        if (!oldest) break;
-        try {
-          unlinkSync(oldest.path);
-          retainedBytes -= oldest.bytes;
-          dropped.chunks++;
-          dropped.bytes += oldest.bytes;
-          dropped.payload = null;
-        } catch {
-          break;
-        }
-      }
-      if (retainedBytes + bodyBytes > MAX_SPOOL_BYTES) return;
-      if (dropped.chunks > 0) {
-        writeFileSync(receiptPath, safeJsonStringify(dropped), { encoding: 'utf8', mode: 0o600 });
-      }
-      const temporaryPath = join(spoolDirectory, `.pending-${process.pid}-${digest}.tmp`);
-      writeFileSync(temporaryPath, body, { encoding: 'utf8', mode: 0o600 });
-      renameSync(temporaryPath, finalPath);
-    } catch (error) {
-      debug('crash payload could not be spooled', error);
+  // Crash and exit spool: fixed slots in tmpdir (`pending-<0..7>.json`), at
+  // most SPOOL_FILE_BYTES each, written once per process with one synchronous
+  // exclusive-create write and sent by the next process of the same build and
+  // endpoint. The directory is created asynchronously at start; a read-only or
+  // full file system just means nothing is spooled.
+  const spoolDirectory = join(tmpdir(), `haystack-telemetry-${safeStringSlice(sha256Hex(`${endpoint}\0${token}\0${buildId}`), 0, 24)}`);
+  const spoolSlot = join(spoolDirectory, `pending-${hashSeed(runId) % MAX_SPOOL_FILES}.json`);
+  safePromiseThen(fsPromises.mkdir(spoolDirectory, { recursive: true, mode: 0o700 }), noop, noop);
+
+  /** The first queued body that fits a slot, or a fresh one-chunk body of the
+   * window bounded by the slot (serialization only; no I/O). */
+  function spoolCandidate(reason) {
+    if (pending !== null && pending.bytes <= SPOOL_FILE_BYTES) return pending.body;
+    for (let index = 0; index < pendingQueue.length; index++) {
+      if (pendingQueue[index].bytes <= SPOOL_FILE_BYTES) return pendingQueue[index].body;
     }
-  }
-
-  function spoolCurrent(reason) {
-    try {
-      if (pending) {
-        spoolBody(pending.body);
-        sequence = safeMathMax(sequence, pending.payload.seq + 1);
-        pending = null;
-      }
-      for (let index = 0; index < pendingQueue.length; index++) {
-        const queued = pendingQueue[index];
-        spoolBody(queued.body);
-        sequence = safeMathMax(sequence, queued.payload.seq + 1);
-      }
-      pendingQueue = [];
-      makePending(reason);
-      if (pending) {
-        spoolBody(pending.body);
-        for (let index = 0; index < pendingQueue.length; index++) spoolBody(pendingQueue[index].body);
-      }
-    } catch (error) {
-      debug('crash snapshot failed open', error);
+    const taken = takeWindow();
+    const units = [];
+    let unitsBytes = 0;
+    for (let index = 0; index < taken.length; index++) {
+      const unit = unitOf(taken[index]);
+      if (unitsBytes + unit.bytes > SPOOL_FILE_BYTES - 64 * 1024) break;
+      safeArrayPush(units, unit);
+      unitsBytes += unit.bytes;
     }
+    return units.length > 0 ? bodyOf(units, safeDateToISOString(new SafeDate()), reason).body : null;
   }
 
-  async function replaySpooledPayloads() {
-    let files;
+  function spoolOnce(reason) {
+    if (spooled || !counting) return;
+    spooled = true;
     try {
-      files = safeArraySlice(
-        safeArraySort(
-          safeArrayFilter(readdirSync(spoolDirectory),
-            name => safeRegExpTest(/^pending-[0-9a-f]{64}\.json$/, name)),
-          compareStrings,
-        ),
-        0,
-        MAX_SPOOL_FILES,
-      );
+      const body = spoolCandidate(reason);
+      if (body !== null) writeFileSync(spoolSlot, body, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
     } catch {
-      return;
+      // An occupied slot, a read-only or full file system: nothing is spooled.
     }
-    const receiptPath = join(spoolDirectory, 'dropped.json');
-    try {
-      const dropped = safeJsonParse(readFileSync(receiptPath, 'utf8'));
-      if (safeNumberIsSafeInteger(dropped.chunks) && dropped.chunks > 0 &&
-          safeNumberIsSafeInteger(dropped.bytes) && dropped.bytes >= 0) {
-        const payload = dropped.payload && typeof dropped.payload === 'object'
-          ? dropped.payload
-          : {
-          v: 1,
-          samplerVersion: SAMPLER_VERSION,
-          buildId,
-          runId,
-          seq: sequence,
-          ts: safeDateToISOString(new SafeDate()),
-          reason: 'crash-spool-omission',
-          omissions: { counterObservations: 0, probeObservations: 0 },
-          omittedSites: [],
-          executionOmissions: {
-            sampledActions: 0,
-            unsampledActions: 0,
-            omittedFamilyObservations: 0,
-          },
-          deliveryOmissions: {
-            droppedCrashChunks: dropped.chunks,
-            droppedCrashBytes: dropped.bytes,
-          },
-          sites: [],
-          shape: {},
-          branch: {},
-          executions: [],
-          coverage: [],
-        };
-        // Reserve this identity before any asynchronous request. Normal and
-        // beforeExit flushes may run concurrently and must never reuse it.
-        if (payload.runId === runId && safeNumberIsSafeInteger(payload.seq)) {
-          sequence = safeMathMax(sequence, payload.seq + 1);
-        }
-        if (!dropped.payload) {
-          const persisted = { chunks: dropped.chunks, bytes: dropped.bytes, payload };
-          const temporaryPath = join(spoolDirectory, `.dropped-${process.pid}.tmp`);
-          writeFileSync(temporaryPath, safeJsonStringify(persisted), { encoding: 'utf8', mode: 0o600 });
-          renameSync(temporaryPath, receiptPath);
-        }
-        const response = await safeFetch(endpoint, {
-          method: 'POST',
-          headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
-          body: safeJsonStringify(payload),
-          signal: safeAbortTimeout(10_000),
-        });
-        if (!responseAccepted(response)) return;
-        // The receiver accepted this exact omission count. A retry would add
-        // the same loss again under a new process run, so acknowledge it now.
-        unlinkSync(receiptPath);
+  }
+
+  async function replaySpooled() {
+    for (let slot = 0; slot < MAX_SPOOL_FILES && counting && !exiting; slot++) {
+      const path = join(spoolDirectory, `pending-${slot}.json`);
+      let body;
+      try {
+        body = await fsPromises.readFile(path, 'utf8');
+      } catch {
+        continue;
       }
-    } catch (error) {
-      if (error?.code !== 'ENOENT') debug('crash spool omission replay failed', error);
-    }
-    for (let index = 0; index < files.length; index++) {
-      const name = files[index];
-      const filePath = join(spoolDirectory, name);
       try {
-        const body = readFileSync(filePath, 'utf8');
-        if (safeBufferByteLength(body, 'utf8') > MAX_PAYLOAD_BYTES) {
-          unlinkSync(filePath);
-          continue;
-        }
-        const response = await safeFetch(endpoint, {
-          method: 'POST',
-          headers: {
-            Authorization: `Bearer ${token}`,
-            'Content-Type': 'application/json',
-          },
-          body,
-          signal: safeAbortTimeout(10_000),
-        });
-        if (!responseAccepted(response)) break;
-        unlinkSync(filePath);
-      } catch (error) {
-        debug('spooled crash payload replay failed', error);
-        break;
+        // A body cut short by a crash mid-write is not JSON: never sendable.
+        safeJsonParse(body);
+      } catch {
+        safePromiseThen(fsPromises.unlink(path), noop, noop);
+        continue;
+      }
+      const status = await send(body, SEND_TIMEOUT_MS);
+      // Accepted, or refused for good (a 4xx other than 408 timeout, 425 too
+      // early and 429 rate limit, which say "later"): the slot is free.
+      // Otherwise it waits for a later process.
+      const retryLater = status === 408 || status === 425 || status === 429;
+      if ((status >= 200 && status < 300) || (status >= 400 && status < 500 && !retryLater)) {
+        await safePromiseThen(fsPromises.unlink(path), noop, noop);
+      } else {
+        return;
       }
     }
   }
 
   function flush(reason = 'manual') {
     if (flushInFlight) return flushInFlight;
-    if (!processAction.suppressed && reason !== 'interval' && reason !== 'http-finish') {
-      finalizeAction(processAction, processAction.outcome || (process.exitCode ? 'error' : 'success'));
-      if (reason !== 'before-exit' && reason !== 'process-exit' &&
-          reason !== 'uncaught-exception' && reason !== 'unhandled-rejection') {
-        continueProcessAction();
-      }
-    }
-    flushInFlight = safePromiseFinally(doFlush(reason), () => {
+    flushInFlight = safePromiseFinally(safePromiseThen(doFlush(reason), result => result, () => false), () => {
       flushInFlight = null;
     });
     return flushInFlight;
   }
 
-  const timer = setInterval(() => { void flush('interval'); }, flushIntervalMs);
+  const timer = safeSetInterval(() => {
+    void flush('interval');
+  }, flushIntervalMs);
   timer.unref();
-  void replaySpooledPayloads();
-  process.on('uncaughtExceptionMonitor', (error) => {
-    const action = actionForProbe() || processAction;
-    if (action && !action.suppressed && !action.finalized) {
-      action.outcome = 'error';
-      action.terminalError = `error:${errorClass(error)}`;
-      finalizeAction(action, 'error');
-    }
-    spoolCurrent('uncaught-exception');
+  // The classification budget refills each second; a blocked event loop keeps
+  // it spent, which is exactly when classification should not add CPU.
+  const budgetTimer = safeSetInterval(() => {
+    budgetUsed = 0;
+  }, 1_000);
+  budgetTimer.unref();
+  processHost.on('uncaughtExceptionMonitor', () => {
+    spoolOnce('uncaught-exception');
   });
-  process.once('exit', (code) => {
-    if (!processAction.suppressed && !processAction.finalized) {
-      processAction.terminalError = code ? 'error:generic' : processAction.terminalError;
-      finalizeAction(processAction, code ? 'error' : processAction.outcome || 'success');
-    }
-    if (pending || pendingQueue.length || safeMapSize(currentExecutions) ||
-        safeMapSize(currentShape) || safeMapSize(currentBranch)) {
-      spoolCurrent('process-exit');
-    }
+  processHost.once('exit', () => {
+    spoolOnce('process-exit');
   });
-  process.once('beforeExit', () => {
-    if (beforeExitStarted) return;
-    beforeExitStarted = true;
-    if (!processAction.suppressed) {
-      finalizeAction(processAction, processAction.outcome || (process.exitCode ? 'error' : 'success'));
-    }
-    void flush('before-exit');
+  processHost.once('beforeExit', () => {
+    if (!counting || exiting) return;
+    // One absolute deadline for everything the way out does: a send in flight,
+    // serialization, and every send after it. At the deadline whatever is left
+    // is abandoned (and the exit handler may spool one bounded body).
+    exiting = true;
+    exitDeadline = safeDateNow() + EXIT_FLUSH_MS;
+    // Sends never keep the process alive; this one timer does, until the exit
+    // flush settles or the deadline, whichever is first.
+    const cut = safeSetTimeout(() => {
+      if (currentSend !== null) currentSend();
+    }, EXIT_FLUSH_MS);
+    const settled = flushInFlight ?? flush('before-exit');
+    safePromiseFinally(settled, () => safeClearTimeout(cut));
   });
 
   const control = safeObjectFreeze({
     enabled: true,
     runtimeVersion: RUNTIME_VERSION,
+    samplerVersion: CONTRACT.SERVER_SAMPLER_VERSION,
     buildId,
     runId,
     flush,
-    selectProbe(name) {
-      if (!enabled || processAction.suppressed) return passThrough;
-      if (name === '__hstValue') return observe;
-      if (name === '__hstBranch') return branch;
-      if (name === '__hstThrow') return thrown;
-      return null;
-    },
     selectSiteProbe(name, site) {
-      if (!enabled || processAction.suppressed) return null;
-      const state = safeMapGet(probeStates, site);
-      if (!state) return null;
-      if (name === '__hstValue') {
-        const fields = state.metadata.allowedFields;
-        return (value) => {
-          if (!enabled || !collecting || state.saturated) return value;
-          return observeState(state, value, fields);
-        };
-      }
-      if (name === '__hstBranch') return (value) => {
-        if (!enabled || !collecting || state.saturated) return value;
-        return branchState(state, value);
-      };
-      if (name === '__hstThrow') return (value) => {
-        if (!enabled || !collecting || state.saturated) return value;
-        return thrownState(state, value);
-      };
-      return null;
-    },
-    snapshotCurrentAction() {
-      try {
-        const action = currentAction();
-        if (!action || action.actionKind !== 'http-server') return null;
-        return safeObjectFreeze({
-          actionKind: action.actionKind,
-          truncated: action.truncated,
-          omittedEvents: action.omittedEvents,
-          events: safeObjectFreeze(safeArrayMap(action.events, event => safeObjectFreeze({
-            siteId: event.siteId,
-            kind: event.kind,
-            scope: event.scope,
-            outcome: event.outcome,
-            observations: event.observations,
-          }))),
-        });
-      } catch (error) {
-        debug('current action snapshot failed open', error);
-        return null;
-      }
+      if (!counting) return null;
+      const state = safeMapGet(statesByProbe, site);
+      if (!state || state.probeName !== name) return null;
+      return siteProbe(state);
     },
     status() {
       return {
-        enabled,
-        collecting,
+        counting,
+        offReason,
         sequence,
-        processProbeObservations,
-        processProbeObservationLimit,
+        activeSites: activeStates().length,
+        memory: { ...memory, total: used(), cap: MAX_BYTES },
+        consecutiveFailures,
         pending: pending !== null || pendingQueue.length > 0,
-        shapeKeys: safeMapSize(currentShape),
-        branchKeys: safeMapSize(currentBranch),
-        executionFamilies: safeMapSize(currentExecutions),
       };
     },
   });
@@ -1482,18 +1023,52 @@ function installRuntime(options = {}) {
       value: control,
     });
   }
-  debug(`enabled for build ${buildId}`);
   return control;
 }
 
-function install(options = {}) {
+function selectProbe(_name, fallback) {
+  // Sampler 5 binds per site (safeSelectSiteProbe); the shared probe is a
+  // pass-through kept for generated fallback objects.
+  return fallback;
+}
+
+function trustedSelectSiteProbe(name, site, fallback) {
+  try {
+    const selected = activeControl?.selectSiteProbe(name, site);
+    return typeof selected === 'function' ? selected : fallback;
+  } catch {
+    return fallback;
+  }
+}
+
+Object.defineProperty(trustedSelectSiteProbe, 'haystackRuntimeIntegrity', {
+  configurable: false,
+  enumerable: false,
+  writable: false,
+  value: RUNTIME_INTEGRITY,
+});
+
+function safeSelectProbe(_expectedIntegrity, _name, fallback) {
+  return fallback;
+}
+
+function safeSelectSiteProbe(expectedIntegrity, name, site, fallback) {
+  try {
+    if (expectedIntegrity !== RUNTIME_INTEGRITY) return fallback;
+    return trustedSelectSiteProbe(name, site, fallback);
+  } catch {
+    return fallback;
+  }
+}
+
+function install() {
   try {
-    return installRuntime(options);
-  } catch (error) {
+    installResult = installRuntime();
+    return installResult;
+  } catch {
     // Bootstrap is injected into the application entry point, so this final
     // boundary must catch every setup failure. Telemetry is never allowed to
     // prevent the host application from starting.
-    debug('installation failed open', error);
     return { enabled: false, reason: 'installation-failed' };
   }
 }