pi-lens 4.3.0 → 4.4.1

package/dist/clients/bounded-cache.js

@@ -1,190 +0,0 @@
-/**
- * Small insertion-ordered FIFO map used for process-lifetime memo tables
- * whose eviction order must not be perturbed by reads: `get` never
- * re-inserts, and `set` never reorders an already-present key — it behaves
- * exactly like native `Map#set` on an existing key. A caller that wants a
- * WRITE (not a read) to refresh recency does its own `delete` + `set` around
- * this map, exactly as it would against a raw `Map` (#2442).
- *
- * {@link BoundedLruCache} extends this class and overrides exactly the two
- * methods that differ (`get` re-inserts; `set` deletes first so a write moves
- * the key to most-recently-used). Eviction, capacity and the whole `Map`-ish
- * surface live here once — the two classes shipped as near-identical copies
- * until #2442's review round flagged the duplication.
- */
-export class BoundedFifoMap {
-    entries = new Map();
-    maxEntries;
-    constructor(maxEntries) {
-        this.maxEntries = maxEntries;
-    }
-    get(key) {
-        return this.entries.get(key);
-    }
-    has(key) {
-        return this.entries.has(key);
-    }
-    /**
-     * Insert or update `key` without reordering. Evicts the oldest
-     * (insertion-order) entries once the map exceeds capacity.
-     *
-     * Returns the evicted `[key, value]` pairs, oldest first — callers with
-     * eviction-side bookkeeping use the return value instead of hand-rolling
-     * `keys().next().value` (#2442). The VALUE is returned, not just the key,
-     * because the eviction-coupled sites need it: `tree-sitter-cache.ts` has to
-     * retire the dropped entry's WASM-heap tree (#417/#890) and
-     * `tree-sitter-client.ts` has to `delete()` the dropped compiled query.
-     * Handing back only the key would force those sites to read the value out
-     * of the map before eviction — i.e. to hand-roll the block this class
-     * exists to delete.
-     */
-    set(key, value) {
-        this.entries.set(key, value);
-        return this.evictOverflow();
-    }
-    /**
-     * Change the capacity ceiling, evicting down to it immediately when it
-     * shrinks. Returns the evicted `[key, value]` pairs, oldest first, on the
-     * same contract as {@link set} — a caller with a DYNAMIC cap (an env-read
-     * ceiling, `TreeCache.setMaxSize`) needs the shrink to free the same
-     * resources an ordinary overflow frees.
-     */
-    setMaxEntries(maxEntries) {
-        this.maxEntries = maxEntries;
-        return this.evictOverflow();
-    }
-    /** Current capacity ceiling. */
-    getMaxEntries() {
-        return this.maxEntries;
-    }
-    /** Drop oldest-first until within capacity. The one eviction block. */
-    evictOverflow() {
-        const evicted = [];
-        while (this.entries.size > this.maxEntries) {
-            const oldest = this.entries.entries().next().value;
-            if (oldest === undefined)
-                break;
-            this.entries.delete(oldest[0]);
-            evicted.push(oldest);
-        }
-        return evicted;
-    }
-    delete(key) {
-        return this.entries.delete(key);
-    }
-    clear() {
-        this.entries.clear();
-    }
-    get size() {
-        return this.entries.size;
-    }
-    keys() {
-        return this.entries.keys();
-    }
-    values() {
-        return this.entries.values();
-    }
-    entriesArray() {
-        return [...this.entries.entries()];
-    }
-    [Symbol.iterator]() {
-        return this.entries[Symbol.iterator]();
-    }
-}
-/**
- * Small insertion-ordered FIFO SET used for process-lifetime membership-only
- * caps — "is this key known", with no associated value.
- *
- * A thin wrapper over `BoundedFifoMap<T, true>` (#2460 review T1): eviction,
- * capacity and the whole Map-ish surface already live in `BoundedFifoMap`
- * exactly once, and this class's earlier standalone `Set`-backed
- * implementation was a byte-for-byte copy of that eviction block one layer
- * down — the exact duplication `BoundedFifoMap`'s own header describes
- * `BoundedLruCache` existing to delete (#2442). The `true` dummy value never
- * escapes this wrapper: it is not a cost paid by call sites, only by this
- * file, so the earlier objection to building membership on top of the K,V
- * map (#2460's first review, about `clients/observed-mutation.ts`'s
- * `handled` set) does not apply here — that objection was about a caller
- * storing a dummy value itself, not about a wrapper hiding one.
- *
- * Same eviction contract as {@link BoundedFifoMap}: `add` never reorders an
- * already-present member (matches native `Set#add`), and both `add` and
- * {@link setMaxEntries} return the evicted values, oldest first, so a call
- * site with an eviction side effect (naming the dropped identity in a bounded
- * telemetry record) consumes the return value instead of hand-rolling
- * `values().next().value` or a `for (... of set) { …; break }` walk (#2442).
- */
-export class BoundedSet {
-    entries;
-    constructor(maxEntries) {
-        this.entries = new BoundedFifoMap(maxEntries);
-    }
-    has(value) {
-        return this.entries.has(value);
-    }
-    /**
-     * Insert `value` without reordering an already-present member. Evicts the
-     * oldest (insertion-order) members once the set exceeds capacity.
-     *
-     * Returns the evicted values, oldest first — see the class doc for why a
-     * call site consumes this instead of hand-rolling the drop.
-     */
-    add(value) {
-        return this.entries.set(value, true).map(([evicted]) => evicted);
-    }
-    /**
-     * Change the capacity ceiling, evicting down to it immediately when it
-     * shrinks. Returns the evicted values, oldest first, on the same contract
-     * as {@link add}.
-     */
-    setMaxEntries(maxEntries) {
-        return this.entries.setMaxEntries(maxEntries).map(([evicted]) => evicted);
-    }
-    /** Current capacity ceiling. */
-    getMaxEntries() {
-        return this.entries.getMaxEntries();
-    }
-    delete(value) {
-        return this.entries.delete(value);
-    }
-    clear() {
-        this.entries.clear();
-    }
-    get size() {
-        return this.entries.size;
-    }
-    values() {
-        return this.entries.keys();
-    }
-    [Symbol.iterator]() {
-        return this.entries.keys();
-    }
-}
-/**
- * Small insertion-ordered LRU used for process-lifetime memo tables. Same
- * bounded-`Map` surface as {@link BoundedFifoMap}; the only two differences
- * are overridden below.
- */
-export class BoundedLruCache extends BoundedFifoMap {
-    /**
-     * Read and promote to most-recently-used.
-     *
-     * A stored `undefined` value is NOT promoted — the hit is indistinguishable
-     * from a miss on this signature, and pre-#2442 `BoundedLruCache` behaved
-     * the same way. No caller stores `undefined`; the note exists so a future
-     * one does not assume otherwise.
-     */
-    get(key) {
-        const value = this.entries.get(key);
-        if (value !== undefined) {
-            this.entries.delete(key);
-            this.entries.set(key, value);
-        }
-        return value;
-    }
-    /** Insert or update `key`, moving it to the most-recently-used position. */
-    set(key, value) {
-        this.entries.delete(key);
-        return super.set(key, value);
-    }
-}

package/dist/clients/bounded-pid-file-lock.js

@@ -1,202 +0,0 @@
-import { randomUUID } from "node:crypto";
-import * as fs from "node:fs";
-import fsp from "node:fs/promises";
-import path from "node:path";
-const waitArray = new Int32Array(new SharedArrayBuffer(4));
-function ownerPidIsLive(pid) {
-    if (!Number.isSafeInteger(pid) || pid <= 0)
-        return false;
-    try {
-        process.kill(pid, 0);
-        return true;
-    }
-    catch (error) {
-        return error.code === "EPERM";
-    }
-}
-function quarantinePath(lockPath, token) {
-    return `${lockPath}.quarantine-${process.pid}-${token}`;
-}
-async function restoreQuarantinedLock(lockPath, quarantined) {
-    try {
-        await fsp.rename(quarantined, lockPath);
-    }
-    catch {
-        // A replacement owner may already hold the canonical name. Never overwrite it.
-    }
-}
-async function releaseQuarantineLock(lockPath, token) {
-    const quarantined = quarantinePath(lockPath, `release-${token}`);
-    let renamed = false;
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-        try {
-            await fsp.rename(lockPath, quarantined);
-            renamed = true;
-            break;
-        }
-        catch (error) {
-            if (error.code !== "ENOENT" || attempt === 2)
-                return;
-            await new Promise((resolve) => setImmediate(resolve));
-        }
-    }
-    if (!renamed)
-        return;
-    try {
-        const owner = JSON.parse(await fsp.readFile(path.join(quarantined, "owner.json"), "utf8"));
-        if (owner.token === token) {
-            await fsp.rm(quarantined, { recursive: true, force: true });
-        }
-        else {
-            await restoreQuarantinedLock(lockPath, quarantined);
-        }
-    }
-    catch {
-        await restoreQuarantinedLock(lockPath, quarantined);
-    }
-}
-function quarantineOwnerIsStale(owner, staleMs) {
-    // #1816: the two staleness signals are INDEPENDENT, and the original
-    // conjunction made the dead-PID one unreachable. An `owner.json` with a
-    // valid PID but a missing or non-numeric `createdAt` (an older writer, a
-    // half-written file, a hand-edited one) short-circuited on the
-    // `Number.isFinite` guard, so a dead owner never reclaimed and the lock
-    // stayed poisoned for the life of the directory. This is
-    // `installer/index.ts:173`'s predicate: a dead PID reclaims regardless of
-    // `createdAt`, and an aged lock reclaims regardless of what the PID says.
-    const pidUsable = Number.isInteger(owner.pid) && owner.pid > 0;
-    if (pidUsable && !ownerPidIsLive(owner.pid))
-        return true;
-    return (Number.isFinite(owner.createdAt) && Date.now() - owner.createdAt > staleMs);
-}
-async function reclaimQuarantineLock(lockPath, staleMs) {
-    const quarantined = quarantinePath(lockPath, `reclaim-${Date.now()}-${randomUUID()}`);
-    try {
-        await fsp.rename(lockPath, quarantined);
-    }
-    catch {
-        return false;
-    }
-    let stale = false;
-    try {
-        const owner = JSON.parse(await fsp.readFile(path.join(quarantined, "owner.json"), "utf8"));
-        stale = quarantineOwnerIsStale(owner, staleMs);
-    }
-    catch {
-        try {
-            stale = Date.now() - (await fsp.stat(quarantined)).mtimeMs > staleMs;
-        }
-        catch {
-            stale = false;
-        }
-    }
-    if (stale) {
-        await fsp.rm(quarantined, { recursive: true, force: true });
-        return true;
-    }
-    await restoreQuarantinedLock(lockPath, quarantined);
-    return false;
-}
-async function tryAcquireQuarantineLock(lockPath, staleMs) {
-    const owner = {
-        pid: process.pid,
-        createdAt: Date.now(),
-        token: `${process.pid}-${Date.now()}-${randomUUID()}`,
-    };
-    for (let attempt = 0; attempt < 2; attempt += 1) {
-        try {
-            await fsp.mkdir(lockPath);
-            try {
-                await fsp.writeFile(path.join(lockPath, "owner.json"), JSON.stringify(owner), "utf8");
-            }
-            catch (error) {
-                await fsp
-                    .rm(lockPath, { recursive: true, force: true })
-                    .catch(() => { });
-                throw error;
-            }
-            return () => releaseQuarantineLock(lockPath, owner.token);
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-        }
-        let stale;
-        try {
-            const existing = JSON.parse(await fsp.readFile(path.join(lockPath, "owner.json"), "utf8"));
-            stale = quarantineOwnerIsStale(existing, staleMs);
-        }
-        catch {
-            try {
-                stale = Date.now() - (await fsp.stat(lockPath)).mtimeMs > staleMs;
-            }
-            catch {
-                stale = true;
-            }
-        }
-        if (!stale || !(await reclaimQuarantineLock(lockPath, staleMs)))
-            return null;
-    }
-    return null;
-}
-export async function acquireQuarantinePidFileLock(lockPath, options) {
-    const deadline = Date.now() + options.waitMs;
-    for (;;) {
-        const release = await tryAcquireQuarantineLock(lockPath, options.staleMs);
-        if (release)
-            return release;
-        const remaining = deadline - Date.now();
-        if (remaining <= 0) {
-            if (options.onContention === "skip-log") {
-                options.logContention();
-                return null;
-            }
-            throw new Error(options.timeoutMessage);
-        }
-        await new Promise((resolve) => setTimeout(resolve, Math.min(options.retryMs, remaining)));
-    }
-}
-export function acquireBoundedPidFileLock(lockPath, options) {
-    const token = `${process.pid}:${Date.now()}:${randomUUID()}`;
-    const deadline = Date.now() + options.waitMs;
-    for (;;) {
-        try {
-            const fd = fs.openSync(lockPath, "wx");
-            fs.writeFileSync(fd, token, "utf8");
-            fs.closeSync(fd);
-            return () => {
-                try {
-                    if (fs.readFileSync(lockPath, "utf8") === token) {
-                        fs.unlinkSync(lockPath);
-                    }
-                }
-                catch {
-                    // Protected write completed; cleanup is best-effort.
-                }
-            };
-        }
-        catch (error) {
-            if (error.code !== "EEXIST")
-                throw error;
-            try {
-                const [pidText] = fs.readFileSync(lockPath, "utf8").split(":", 1);
-                if (!ownerPidIsLive(Number.parseInt(pidText ?? "", 10))) {
-                    fs.unlinkSync(lockPath);
-                    continue;
-                }
-            }
-            catch (lockError) {
-                if (lockError.code === "ENOENT")
-                    continue;
-            }
-            if (Date.now() >= deadline) {
-                if (options.onContention === "skip-log") {
-                    options.logContention();
-                    return null;
-                }
-                throw new Error(options.timeoutMessage, { cause: error });
-            }
-            Atomics.wait(waitArray, 0, 0, options.retryMs);
-        }
-    }
-}

package/dist/clients/bounded-telemetry.js

@@ -1,295 +0,0 @@
-/**
- * Typed bounded telemetry emission (#1743).
- *
- * Four PRs in two days hand-built the same machinery: a failure path that
- * needs a detailed `latency.log` record, an exact per-identity tally, and a
- * bound so a storming subsystem cannot flood the log. #1705 (orphan
- * forensics), #1717 (pull timeouts and late answers), #1726 (navRequest
- * timeouts, rising edge per method and file), and #1733 (loop-block floor
- * with a per-turn bound) each rebuilt it, and each needed a review round to
- * get the bounding right. This module is the intersection of those four, not
- * a speculative framework. Three of its four options come straight from those
- * sites. The fourth, `capPerTurn`, expresses #1733's per-turn bound
- * structurally and now caps re-raised auxiliary coverage-gap detail rows
- * (#2356), while the aggregate count and ledger retain bounded latest
- * identities plus the dropped count.
- *
- * Three rules the helper makes structural instead of prose:
- *
- * 1. **The rising edge comes from the ledger's own tally.** #1705 established
- *    that `incrementDegradationCount` already knows whether a
- *    (kind, subject) pair is being seen for the first time, and returns it.
- *    A caller that wants "log the detail once, count the rest" reads that
- *    return value. It never keeps a second `Set` — a parallel latch is state
- *    that must re-arm at `session_start` and will eventually be forgotten
- *    (the #1266–#1625 defect class).
- * 2. **A per-turn cap names its turn.** `capPerTurn` carries the caller's
- *    `turnIndex` in the same object as the limit. A bounded 64-turn window
- *    keeps overlapping async turns independent; results older than that window
- *    fail closed. Session start clears the window when numbering restarts.
- * 3. **Identity always survives.** Every emitted record carries the
- *    discriminating identity in `filePath` and in `metadata.identity`, so
- *    aggregation can still answer "which file, which method, which record is
- *    stuck" (the rule AGENTS.md states, now enforced by the signature).
- *
- * `BOUNDED_TELEMETRY_PHASES` is the registry.
- * `tests/clients/bounded-telemetry-sweep.test.ts` sweeps it registered-or-
- * fail: a failure-path phase must either route through this helper or carry a
- * stated reason for staying raw.
- *
- * Nothing here ever throws. Telemetry must not perturb the path it observes —
- * each caller has already decided its outcome before
- * calling in.
- */
-import { incrementDegradationCount } from "./degradation-ledger.js";
-import { logLatency } from "./latency-logger.js";
-/**
- * Phases that emit through this helper. The `phase` parameter is typed to
- * this list, so a new bounded phase cannot be emitted without joining the
- * registry, and the sweep proves the reverse direction: a registered phase
- * must not also be written by a raw `logLatency` call somewhere else.
- */
-export const BOUNDED_TELEMETRY_PHASES = [
-    /** #2890: a duplicate pi RPC session_start was admitted but suppressed. */
-    "session_start_duplicate_suppressed",
-    /**
-     * #2467: a demand for the analyzer bootstrap clients was not served and
-     * the caller proceeded without them. Rising-edge per demand reason, with
-     * the ledger holding the exact count — a wedged or missing analyzer graph
-     * must not turn every tool call into a log line.
-     */
-    "bootstrap_clients_unavailable",
-    /** #1705: a deferred-format record whose origin worktree never claimed it. */
-    "agent_end_deferred_format_orphan_origin_mismatch",
-    /** #1713: a `textDocument`/`workspace` diagnostic pull abandoned at budget. */
-    "lsp_pull_diagnostic_timeout",
-    /** #1713: that abandoned pull answered anyway, too late to serve anyone. */
-    "lsp_pull_late_answer_discarded",
-    /** #1773: a pull skipped outright because the caller's budget was already
-     *  exhausted — never dispatched, so it must not be confused with a genuine
-     *  timeout. */
-    "lsp_pull_skipped_budget_exhausted",
-    /** #1774: an abandoned pull's request eventually REJECTED (e.g. a server
-     *  `ContentModified`) rather than answering or staying silent forever —
-     *  the third outcome late-answer telemetry previously could not see. */
-    "lsp_pull_late_rejection",
-    /** #1716: a hover/definition/references/etc. request abandoned at budget. */
-    "lsp_nav_request_timeout",
-    /** #1716: that abandoned nav request answered anyway, after the caller left. */
-    "lsp_nav_late_answer_discarded",
-    /**
-     * #1743 review: a per-file touch skipped a server in breaker cooldown or
-     * latched permanently broken. Fires once per file per touch during an
-     * outage, so it is rising-edge per (server, file).
-     */
-    "lsp_client_skipped_broken",
-    /** #1743 review: the same skip, for a temporarily unavailable command. */
-    "lsp_client_skipped_unavailable_command",
-    /**
-     * #1934: `getWarmClientForFile` found no live client for a file that has at
-     * least one language server with a resolvable root. Its callers run per
-     * file (the cascade quiet window, read expansion, `hasWarmLSP`), so it is
-     * rising-edge per candidate (server, root) set, with the ledger holding the
-     * exact count.
-     */
-    "lsp_warm_client_missing",
-    /** #2052: a file's nearest LSP root is outside the session ceiling. */
-    "lsp_capability_skip",
-    /**
-     * #2044: failed-first test state was retired after a confirmed missing path,
-     * retained because the filesystem verdict was indeterminate, or evicted at
-     * the state cap. Selection checks and detailed rows are both capped per turn.
-     */
-    "test_runner_failed_target_state",
-    /** #2366: bounded lifecycle records for automatic test-result delivery. */
-    "test_runner_delivery",
-    /**
-     * #1723: an event-loop block at or above the floor. Not a degradation, so
-     * no ledger kind; bounded by call cadence (one `turn_end` runs it once per
-     * turn) rather than by an option here.
-     */
-    "loop_block",
-    /**
-     * #1925: a session event skipped because its ctx was invalidated by a
-     * session replacement or reload. A replaced session can drain a whole
-     * queue of them, so it is rising-edge per event name.
-     */
-    "session_event_stale_ctx_skip",
-    /**
-     * #2007: a worktree-mutating git command declined because another live
-     * session shares this dirty checkout. Rising edge per checkout root; the
-     * ledger keeps the exact repeat count.
-     */
-    "shared_checkout_switch_blocked",
-    /**
-     * #2007: `git status` could not report the working-tree state, so the same
-     * command was declined on an UNKNOWN rather than assumed clean.
-     */
-    "shared_checkout_probe_failed",
-    /** #2356: a notify-stall auxiliary remained uncovered after its bounded
-     * replacement window. Detailed rows are capped per turn; the ledger and
-     * aggregate turn-end row retain the complete count and identity. */
-    "lsp_scanner_coverage_gap",
-    /** #2358: a busy CPU discriminator deferred notify-stall teardown. */
-    "lsp_notify_stall_cpu_busy",
-    /**
-     * #2430: an observational pre/post snapshot was declined or cut short — the
-     * per-turn budget was already spent, the capture timed out, or the turn was
-     * aborted. Every unclassified tool call in a busy turn can reach this, so
-     * it is capped per turn with the ledger holding the exact count.
-     */
-    "observed_mutation_budget_exhausted",
-    /**
-     * #2430: the `agent_settled` tracked-file sweep could not complete within
-     * its bound. Once per settle at most, capped for the same reason.
-     */
-    "observed_sweep_skipped_budget",
-    /**
-     * #2430: a tracked file's size/mtime moved but no hashed baseline could
-     * confirm the bytes actually changed — too large for the sweep's read
-     * budget, or never hashed. Named rather than replayed, because a `touch`
-     * moves mtime without moving a byte (#2449 review round 2, F7). Bounded
-     * per turn: one settle can find many such files at once.
-     */
-    "observed_sweep_unverifiable",
-    /**
-     * #2430: an armed observation's universe was TRUNCATED because the tool
-     * named a directory with more entries than the net may watch. Bounded per
-     * turn with the ledger holding the exact count, and the identity is the
-     * tool name so the record answers WHICH tool is being watched partially
-     * (#2449 review round 3).
-     */
-    "observed_target_dir_capped",
-    /**
-     * #2430: the "pi-lens wrote these bytes itself" set hit
-     * `OBSERVED_HANDLED_MAX` and dropped its oldest entry. The dropped file is
-     * NAMED, because the eviction silently reintroduces the exact defect
-     * #2449 round 3 (S5) fixed: the ledger still holds the pre-drain bytes
-     * while the only record that those bytes were ours is gone, so the next
-     * settled sweep replays pi-lens's own formatter output as third-party
-     * drift. A cap that drops a mark has to say which one (catalog shape 10);
-     * capped per turn because a turn that overflows the set overflows it many
-     * times (#2449 review round 4, S2).
-     */
-    "observed_handled_evicted",
-];
-/**
- * Per-turn admission counters, keyed by turn and phase. Multiple turns remain
- * live because async work can finish T1 after T2 has already emitted. The map
- * retains a bounded recent window; work older than that window fails closed
- * rather than reopening an exhausted budget. Session start clears all state.
- */
-const MAX_TRACKED_TURN_CAPS = 64;
-let turnCounts = new Map();
-let latestCountedTurnIndex;
-let retiredThroughTurnIndex = Number.NEGATIVE_INFINITY;
-/**
- * Decide whether this occurrence earns a detailed record, and count it in the
- * ledger either way. Returns `true` when the caller should write the record.
- *
- * Split out from `emitBounded` for the #1705 shape: that site loops over N
- * abandoned records, admits each one, and then writes ONE batched
- * `logLatency` naming only the admitted ones. A helper that could only emit
- * per-call would have turned one record into N.
- */
-export function admitBounded(phase, identity, options = {}) {
-    try {
-        let isRisingEdge = true;
-        if (options.ledgerKind !== undefined) {
-            // `subject` is the identity, unmodified: the ledger's per-subject
-            // entry is what tells a reader WHICH file or method is stuck after
-            // the detailed records stop.
-            isRisingEdge = incrementDegradationCount({
-                kind: options.ledgerKind,
-                subject: identity,
-                reason: options.reason ?? phase,
-            });
-        }
-        if (options.risingEdgePer !== undefined && !isRisingEdge)
-            return false;
-        return admitAgainstTurnCap(phase, options.capPerTurn);
-    }
-    catch {
-        // Telemetry must never break the observed path. Emitting is the safer
-        // failure: an extra record is noise, a swallowed one is a blind spot.
-        return true;
-    }
-}
-/**
- * Count every occurrence in the ledger, then write ONE bounded `latency.log`
- * record if this occurrence is admitted. Returns whether the record was
- * written, so a caller can branch on it (all four migrated sites either
- * ignore it or, in #1705's case, use `admitBounded` directly).
- */
-export function emitBounded(phase, identity, payload, options = {}) {
-    try {
-        if (!admitBounded(phase, identity, options))
-            return false;
-        logLatency({
-            ...payload,
-            type: payload.type ?? "phase",
-            phase,
-            // `filePath` is what existing latency.log queries filter on, so a site
-            // may keep a coarser one; `metadata.identity` below always carries the
-            // full discriminating identity. Aggregation that loses WHICH subject
-            // is stuck is the failure AGENTS.md names.
-            filePath: payload.filePath ?? identity,
-            metadata: { ...payload.metadata, identity },
-        });
-        return true;
-    }
-    catch {
-        // Telemetry must never break the observed path.
-        return false;
-    }
-}
-/**
- * Apply the per-turn ceiling. Separated so the turn-rollover clear happens in
- * exactly one place: a cap and its reset drifting apart is how #1733's
- * compensating-pair guards got past review.
- */
-function admitAgainstTurnCap(phase, cap) {
-    if (cap === undefined)
-        return true;
-    if (cap.turnIndex <= retiredThroughTurnIndex)
-        return false;
-    let counts = turnCounts.get(cap.turnIndex);
-    if (!counts) {
-        if (turnCounts.size >= MAX_TRACKED_TURN_CAPS) {
-            const oldestTrackedTurn = Math.min(...turnCounts.keys());
-            if (cap.turnIndex < oldestTrackedTurn)
-                return false;
-            turnCounts.delete(oldestTrackedTurn);
-            retiredThroughTurnIndex = Math.max(retiredThroughTurnIndex, oldestTrackedTurn);
-        }
-        counts = new Map();
-        turnCounts.set(cap.turnIndex, counts);
-    }
-    latestCountedTurnIndex = Math.max(latestCountedTurnIndex ?? cap.turnIndex, cap.turnIndex);
-    const used = counts.get(phase) ?? 0;
-    if (used >= cap.limit)
-        return false;
-    counts.set(phase, used + 1);
-    return true;
-}
-/**
- * Session-boundary/test reset. The rising-edge state is NOT here — it lives
- * in the degradation ledger, which `handleSessionStart` already re-arms via
- * `resetDegradationLedger`. Only the per-turn counters are this module's own,
- * and they need this because turn numbering restarts at 0 each session.
- */
-export function resetBoundedTelemetry() {
-    turnCounts = new Map();
-    latestCountedTurnIndex = undefined;
-    retiredThroughTurnIndex = Number.NEGATIVE_INFINITY;
-}
-/** Test-only: one turn's live admission count for a phase. */
-export function _boundedTurnCountForTest(phase, turnIndex = latestCountedTurnIndex) {
-    if (turnIndex === undefined)
-        return 0;
-    return turnCounts.get(turnIndex)?.get(phase) ?? 0;
-}
-/** Test-only: number of turn buckets retained by the bounded counter. */
-export function _boundedTrackedTurnsForTest() {
-    return turnCounts.size;
-}