telemetry-dev-litellm 0.2.2__tar.gz → 0.2.3__tar.gz

{telemetry_dev_litellm-0.2.2 → telemetry_dev_litellm-0.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: telemetry-dev-litellm
-Version: 0.2.2
+Version: 0.2.3
 Summary: LiteLLM integration for telemetry.dev Python SDK
 Keywords: telemetry,opentelemetry,llm,genai,litellm,tracing
 Author: telemetry.dev
@@ -146,7 +146,7 @@ Rerank spans emit `gen_ai.operation.name="rerank"`:
 
 Responses spans emit `gen_ai.operation.name="chat"` and capture request input, instructions, sampling options, metadata, response output/status/id, usage, cost, and provider. Streaming Responses events are handled separately from chat chunks; terminal failure and error events mark the span as failed, and early close records the partial output collected so far.
 
-Streamed chat chunks and Responses reconstruction are retained up to 48 KiB and 1,000 items. Non-streamed Responses input and output and rerank input and results are retained up to 64 KiB and 1,024 items. The configured `max_attribute_length` does not shrink these retention bounds; the core applies it to the exported attribute after the mask runs. A chat stream that is cut at its bound, closed early, or fails, and a Responses stream that is cut at its bound, ends without a terminal response, or ends with an `error` event set `telemetry.dev.capture.truncated`. With a mask configured, the incomplete reconstructed output is omitted because the mask cannot inspect the complete value.
+Streamed chat chunks and Responses reconstruction are kept up to 16 MiB, and all streams in flight share the `max_stream_bytes` bound of the core (64 MiB by default). These bounds need a `telemetry-dev` core with `max_stream_bytes`; with an older core, each stream keeps up to 64 KiB and 1,024 items. Non-streamed Responses input and output and rerank input and results are retained up to 16 MiB each. The configured `max_attribute_length` does not shrink these retention bounds; the core applies it to the exported attribute after the mask runs. A chat stream that is cut at its bound, closed early, or fails, or whose response fails to rebuild or map when it ends or is closed (reported to `on_error`; the span then has no output), and a Responses stream that is cut at its bound, ends without a terminal response, or ends with an `error` event set `telemetry.dev.capture.truncated`. A chat chunk or Responses event whose output fails to record also sets the attribute, and no later chunk or event is kept: a chat stream keeps the chunks before it, and a Responses stream reads only its terminal event after it. A complete output in that terminal response still replaces what was recorded, and then the attribute is not set. An empty terminal output does not replace output already recorded from the deltas, or lost with an event. A failure in a chat chunk's ID, model, usage, or finish reasons, or in the time to first chunk and IDs of a stream's first event, loses only that metadata and does not set the attribute. A Responses stream whose terminal output fails to map keeps its response fields (status, error, usage) and sets the attribute, and one whose output fails to rebuild from its events when it ends or is closed also sets the attribute and has no output. With a mask configured, the incomplete reconstructed output is omitted because the mask cannot inspect the complete value. A Responses stream whose terminal response fields (ID, model, usage, cost, status, error) fail to map also sets the attribute; its output is mapped apart, so it is kept, also with a mask configured, and a failed response is still recorded as failed. Each of these stream failures is reported to `on_error`, once per stream. When the response of a successful non-streamed completion, embedding, Responses, or rerank call fails to map, the failure is reported to `on_error` and the span ends without output and with `telemetry.dev.capture.truncated`; it is marked failed only when it is a failed Responses response.
 
 Aggregate usage keys are `input_tokens`, `output_tokens`, `total_tokens`, `cache_read_input_tokens`, `cache_creation_input_tokens`, and `reasoning_output_tokens`. The core contract also includes modality fields; Responses usage emits text, image, and audio input/output token details when LiteLLM exposes them.
 
@@ -154,7 +154,7 @@ Aggregate usage keys are `input_tokens`, `output_tokens`, `total_tokens`, `cache
 
 On a LiteLLM or Router call made outside the LiteLLM proxy, each key of the call's `litellm_metadata` argument, or of `metadata` when `litellm_metadata` is absent or empty, is exported as `td.metadata.<key>`, except the keys listed below. That includes keys LiteLLM's Router adds to the argument, such as `model_group`, `deployment`, `model_info` and `api_base`. Rerank spans also add `result_count` and `search_units`.
 
-Strings, numbers, booleans and non-empty sequences of only strings, only booleans or only numbers are exported as they are; other values, including empty sequences, are JSON-encoded. Each string, including each string in a sequence, and each JSON value is truncated to `max_attribute_length`. Metadata values are not passed to the `mask` callback, and metadata is exported whatever `capture_input` and `capture_output` are set to.
+Strings, numbers, booleans and non-empty sequences of only strings, only booleans or only numbers are exported as they are; other values, including empty sequences, are JSON-encoded. When `max_attribute_length` is set, each string, including each string in a sequence, and each JSON value is truncated to it; by default they are exported whole, or cut at 65,536 characters with `telemetry-dev` 0.3.2 or earlier. Metadata values are not passed to the `mask` callback, and metadata is exported whatever `capture_input` and `capture_output` are set to.
 
 These top-level keys are always dropped:
 

{telemetry_dev_litellm-0.2.2 → telemetry_dev_litellm-0.2.3}/README.md

@@ -122,7 +122,7 @@ Rerank spans emit `gen_ai.operation.name="rerank"`:
 
 Responses spans emit `gen_ai.operation.name="chat"` and capture request input, instructions, sampling options, metadata, response output/status/id, usage, cost, and provider. Streaming Responses events are handled separately from chat chunks; terminal failure and error events mark the span as failed, and early close records the partial output collected so far.
 
-Streamed chat chunks and Responses reconstruction are retained up to 48 KiB and 1,000 items. Non-streamed Responses input and output and rerank input and results are retained up to 64 KiB and 1,024 items. The configured `max_attribute_length` does not shrink these retention bounds; the core applies it to the exported attribute after the mask runs. A chat stream that is cut at its bound, closed early, or fails, and a Responses stream that is cut at its bound, ends without a terminal response, or ends with an `error` event set `telemetry.dev.capture.truncated`. With a mask configured, the incomplete reconstructed output is omitted because the mask cannot inspect the complete value.
+Streamed chat chunks and Responses reconstruction are kept up to 16 MiB, and all streams in flight share the `max_stream_bytes` bound of the core (64 MiB by default). These bounds need a `telemetry-dev` core with `max_stream_bytes`; with an older core, each stream keeps up to 64 KiB and 1,024 items. Non-streamed Responses input and output and rerank input and results are retained up to 16 MiB each. The configured `max_attribute_length` does not shrink these retention bounds; the core applies it to the exported attribute after the mask runs. A chat stream that is cut at its bound, closed early, or fails, or whose response fails to rebuild or map when it ends or is closed (reported to `on_error`; the span then has no output), and a Responses stream that is cut at its bound, ends without a terminal response, or ends with an `error` event set `telemetry.dev.capture.truncated`. A chat chunk or Responses event whose output fails to record also sets the attribute, and no later chunk or event is kept: a chat stream keeps the chunks before it, and a Responses stream reads only its terminal event after it. A complete output in that terminal response still replaces what was recorded, and then the attribute is not set. An empty terminal output does not replace output already recorded from the deltas, or lost with an event. A failure in a chat chunk's ID, model, usage, or finish reasons, or in the time to first chunk and IDs of a stream's first event, loses only that metadata and does not set the attribute. A Responses stream whose terminal output fails to map keeps its response fields (status, error, usage) and sets the attribute, and one whose output fails to rebuild from its events when it ends or is closed also sets the attribute and has no output. With a mask configured, the incomplete reconstructed output is omitted because the mask cannot inspect the complete value. A Responses stream whose terminal response fields (ID, model, usage, cost, status, error) fail to map also sets the attribute; its output is mapped apart, so it is kept, also with a mask configured, and a failed response is still recorded as failed. Each of these stream failures is reported to `on_error`, once per stream. When the response of a successful non-streamed completion, embedding, Responses, or rerank call fails to map, the failure is reported to `on_error` and the span ends without output and with `telemetry.dev.capture.truncated`; it is marked failed only when it is a failed Responses response.
 
 Aggregate usage keys are `input_tokens`, `output_tokens`, `total_tokens`, `cache_read_input_tokens`, `cache_creation_input_tokens`, and `reasoning_output_tokens`. The core contract also includes modality fields; Responses usage emits text, image, and audio input/output token details when LiteLLM exposes them.
 
@@ -130,7 +130,7 @@ Aggregate usage keys are `input_tokens`, `output_tokens`, `total_tokens`, `cache
 
 On a LiteLLM or Router call made outside the LiteLLM proxy, each key of the call's `litellm_metadata` argument, or of `metadata` when `litellm_metadata` is absent or empty, is exported as `td.metadata.<key>`, except the keys listed below. That includes keys LiteLLM's Router adds to the argument, such as `model_group`, `deployment`, `model_info` and `api_base`. Rerank spans also add `result_count` and `search_units`.
 
-Strings, numbers, booleans and non-empty sequences of only strings, only booleans or only numbers are exported as they are; other values, including empty sequences, are JSON-encoded. Each string, including each string in a sequence, and each JSON value is truncated to `max_attribute_length`. Metadata values are not passed to the `mask` callback, and metadata is exported whatever `capture_input` and `capture_output` are set to.
+Strings, numbers, booleans and non-empty sequences of only strings, only booleans or only numbers are exported as they are; other values, including empty sequences, are JSON-encoded. When `max_attribute_length` is set, each string, including each string in a sequence, and each JSON value is truncated to it; by default they are exported whole, or cut at 65,536 characters with `telemetry-dev` 0.3.2 or earlier. Metadata values are not passed to the `mask` callback, and metadata is exported whatever `capture_input` and `capture_output` are set to.
 
 These top-level keys are always dropped:
 

{telemetry_dev_litellm-0.2.2 → telemetry_dev_litellm-0.2.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "telemetry-dev-litellm"
-version = "0.2.2"
+version = "0.2.3"
 description = "LiteLLM integration for telemetry.dev Python SDK"
 readme = "README.md"
 license = "MIT"

{telemetry_dev_litellm-0.2.2 → telemetry_dev_litellm-0.2.3}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "telemetry-dev-litellm"
-version = "0.2.2"
+version = "0.2.3"
 description = "LiteLLM integration for telemetry.dev Python SDK"
 readme = "README.md"
 license = "MIT"

{telemetry_dev_litellm-0.2.2 → telemetry_dev_litellm-0.2.3}/src/telemetry_dev_litellm/__init__.py

@@ -3,19 +3,21 @@ from __future__ import annotations
 import asyncio
 import inspect
 import math
+import os
 import re
 import threading
 import time
 from collections.abc import AsyncIterator, Awaitable, Callable, Iterator, Mapping, Sequence
 from functools import wraps
 from inspect import Parameter
+from io import StringIO
 from typing import Any, TypeVar, cast
 
 import litellm
 import telemetry_dev
 from opentelemetry import trace
 
-__version__ = "0.2.2"
+__version__ = "0.2.3"
 
 RequestMapper = Callable[[tuple[Any, ...], Mapping[str, Any]], tuple[str, dict[str, Any]]]
 ResponseMapper = Callable[[Any], dict[str, Any]]
@@ -29,9 +31,25 @@ _DROPIN_WRAPPERS: dict[str, tuple[Any, Callable[..., Any]]] = {}
 _PENDING_CLOSE_TASKS: set[asyncio.Future[Any]] = set()
 _installed = False
 _install_lock = threading.Lock()
+
+
+def _reset_install_lock_in_child() -> None:
+    """A thread of the parent can hold the lock at a fork, and only this thread exists here."""
+    global _install_lock
+    _install_lock = threading.Lock()
+
+
+# A hook is enough: a fork that runs no hooks, as uWSGI's fork of its workers by default,
+# starts from its master, which serves no requests. os.register_at_fork cannot remove a hook,
+# and importlib.reload runs this module again with the same globals, so the hook of the first
+# run stays. Windows has no fork.
+if hasattr(os, "register_at_fork") and "_install_fork_hook" not in globals():
+    _install_fork_hook = True
+    os.register_at_fork(after_in_child=_reset_install_lock_in_child)
+
 _OMIT = object()
-# Retention uses fixed bounds; the core applies max_attribute_length after the mask.
-_STREAM_CAPTURE_MAX_BYTES = 48 * 1024
+# The core applies max_attribute_length after the mask. More choices, or more responses items
+# and rejected parts tracked for truncation, than this are not kept.
 _STREAM_CAPTURE_MAX_ITEMS = 1000
 # Retained finish reasons stay outside the output budget so a terminal one is still exported,
 # so each is capped instead.
@@ -109,7 +127,37 @@ def _native(value: Any) -> Any:
 
 
 def _stream_capture_budget() -> telemetry_dev.CaptureBudget:
-    return telemetry_dev.CaptureBudget(_STREAM_CAPTURE_MAX_BYTES, _STREAM_CAPTURE_MAX_ITEMS)
+    # Older cores have no for_stream and bound each budget at 64 KiB on its own.
+    for_stream = getattr(telemetry_dev.CaptureBudget, "for_stream", None)
+    budget = for_stream() if callable(for_stream) else telemetry_dev.CaptureBudget()
+    return cast(telemetry_dev.CaptureBudget, budget)
+
+
+def _release_budget(budget: telemetry_dev.CaptureBudget) -> None:
+    release = getattr(budget, "release", None)
+    if callable(release):
+        release()
+
+
+def _reserve_bytes(budget: telemetry_dev.CaptureBudget, total: int) -> bool:
+    # Older cores have no reserve_bytes; there the caller's check against max_bytes stands.
+    reserve = getattr(budget, "reserve_bytes", None)
+    if callable(reserve):
+        return bool(reserve(total))
+    budget.bytes_used = total
+    return True
+
+
+def _adopt_budget(
+    stream: telemetry_dev.CaptureBudget, measured: telemetry_dev.CaptureBudget
+) -> bool:
+    """Takes the counts of a budget that measured a replacement into the stream's own budget,
+    which holds the bytes in the stream budget. Returns False, and takes nothing, when another
+    stream took the room after the measure."""
+    if not _reserve_bytes(stream, measured.bytes_used):
+        return False
+    stream.items_used = measured.items_used
+    return True
 
 
 def _capture_masked(handle: telemetry_dev.SpanHandle) -> bool:
@@ -146,7 +194,9 @@ def _bounded_responses_native(
         ):
             active_budget.truncated = True
             raise _CaptureLimit
-        active_budget.bytes_used += byte_count
+        if not _reserve_bytes(active_budget, active_budget.bytes_used + byte_count):
+            active_budget.truncated = True
+            raise _CaptureLimit
         active_budget.items_used += item_count
 
     def convert(item: Any, item_type: str | None, depth: int) -> Any:
@@ -796,13 +846,6 @@ def _end_once(handle: telemetry_dev.SpanHandle) -> Callable[..., None]:
     return end
 
 
-def _safe_response_fields(mapper: ResponseMapper, response: Any) -> dict[str, Any]:
-    try:
-        return mapper(response)
-    except Exception:
-        return {}
-
-
 def _safe_start_span(
     op: str, mapper: RequestMapper, args: tuple[Any, ...], kwargs: Mapping[str, Any]
 ) -> tuple[telemetry_dev.SpanHandle, Callable[..., None], float, str | None]:
@@ -874,6 +917,8 @@ class _InstrumentedStream:
         self._finish_reasons: dict[int, str] = {}
         self._choice_indices: set[int] = set()
         self._finish_reasons_truncated = False
+        self._reported = False
+        self._output_recorded = False
 
     def __getattr__(self, name: str) -> Any:
         return getattr(self._inner, name)
@@ -896,7 +941,7 @@ class _InstrumentedStream:
             except BaseException:
                 pass
             raise
-        self._record(chunk, received_at)
+        self._record_guarded(chunk, received_at)
         return chunk
 
     def __aiter__(self) -> AsyncIterator[Any]:
@@ -917,7 +962,7 @@ class _InstrumentedStream:
             except BaseException:
                 pass
             raise
-        self._record(chunk, received_at)
+        self._record_guarded(chunk, received_at)
         return chunk
 
     def __enter__(self) -> _InstrumentedStream:
@@ -950,7 +995,85 @@ class _InstrumentedStream:
             return bool(await _maybe_await(exit_method(exc_type, exc, tb)))
         return False
 
+    def _report(self, exc: Exception) -> None:
+        # A stream reports only its first failure; a broken mapper fails on every chunk.
+        if self._reported:
+            return
+        self._reported = True
+        try:
+            self._handle.report_error(exc)
+        except Exception:
+            pass
+
+    def _record_guarded(self, chunk: Any, received_at: float) -> None:
+        self._output_recorded = False
+        try:
+            self._record(chunk, received_at)
+        except Exception as exc:
+            if not self._output_recorded:
+                # The chunk may be lost. The truncated budget keeps no later chunk, so the
+                # output stays a prefix, flagged and withheld from a mask.
+                self._budget.truncated = True
+            self._report(exc)
+
     def _record(self, chunk: Any, received_at: float) -> None:
+        # Timings are recorded before the chunk is mapped, so a failure in its mapping neither
+        # moves the first-chunk time to a later chunk nor drops the chunk from the chunk timings;
+        # like a chunk past the bound, a lost chunk was still delivered. Each timing step loses
+        # only its own value when it fails.
+        if not self._saw_first:
+            self._saw_first = True
+            try:
+                self._handle.update(time_to_first_chunk_ms=(received_at - self._started_at) * 1000)
+            except Exception as exc:
+                self._report(exc)
+            try:
+                self._handle.update(
+                    response_id=_string(_field(chunk, "id")),
+                    response_model=_string(_field(chunk, "model")),
+                )
+            except Exception as exc:
+                self._report(exc)
+        try:
+            has_output = False
+            for choice in _sequence_items(_field(chunk, "choices")):
+                delta = _field(choice, "delta")
+                has_output = (
+                    has_output
+                    or any(
+                        isinstance(value, str) and bool(value)
+                        for value in (
+                            _field(delta, "content"),
+                            _field(delta, "reasoning_content"),
+                            _field(delta, "refusal"),
+                            _field(_field(delta, "audio"), "data"),
+                        )
+                    )
+                    or (
+                        isinstance(_field(_field(delta, "function_call"), "arguments"), str)
+                        and bool(_field(_field(delta, "function_call"), "arguments"))
+                    )
+                    or any(
+                        isinstance(arguments, str) and bool(arguments)
+                        for arguments in (
+                            _field(_field(tool, "function"), "arguments")
+                            for tool in _sequence_items(_field(delta, "tool_calls"))
+                        )
+                    )
+                )
+            if has_output:
+                self._saw_output = True
+                record_output_chunk = getattr(self._handle, "record_output_chunk", None)
+                if callable(record_output_chunk):
+                    record_output_chunk(received_at * 1000)
+        except Exception as exc:
+            self._report(exc)
+        # The chunk is kept before its metadata is read, so a failure in the metadata (ID,
+        # model, usage, finish reasons) loses only that metadata. A chunk object keeps its delta
+        # fields where the budget does not walk, so the budget measures its JSON copy.
+        if not self._budget.truncated and self._budget.accept(_native(chunk)):
+            self._chunks.append(chunk)
+        self._output_recorded = True
         response_id = _string(_field(chunk, "id"))
         if self._response_id is None and response_id is not None:
             self._response_id = response_id
@@ -960,32 +1083,7 @@ class _InstrumentedStream:
         usage = _usage_from(_field(chunk, "usage"))
         if usage is not None and (self._usage is None or _reports_tokens(usage)):
             self._usage = usage
-        has_output = False
         for fallback_index, choice in enumerate(_sequence_items(_field(chunk, "choices"))):
-            delta = _field(choice, "delta")
-            has_output = (
-                has_output
-                or any(
-                    isinstance(value, str) and bool(value)
-                    for value in (
-                        _field(delta, "content"),
-                        _field(delta, "reasoning_content"),
-                        _field(delta, "refusal"),
-                        _field(_field(delta, "audio"), "data"),
-                    )
-                )
-                or (
-                    isinstance(_field(_field(delta, "function_call"), "arguments"), str)
-                    and bool(_field(_field(delta, "function_call"), "arguments"))
-                )
-                or any(
-                    isinstance(arguments, str) and bool(arguments)
-                    for arguments in (
-                        _field(_field(tool, "function"), "arguments")
-                        for tool in _sequence_items(_field(delta, "tool_calls"))
-                    )
-                )
-            )
             choice_index = _number(_field(choice, "index"))
             key = (
                 int(choice_index)
@@ -1004,20 +1102,6 @@ class _InstrumentedStream:
             finish_reason = _string(_field(choice, "finish_reason"))
             if finish_reason is not None:
                 self._finish_reasons[key] = finish_reason[:_FINISH_REASON_MAX_LENGTH]
-        if has_output:
-            self._saw_output = True
-            record_output_chunk = getattr(self._handle, "record_output_chunk", None)
-            if callable(record_output_chunk):
-                record_output_chunk(received_at * 1000)
-        if not self._saw_first:
-            self._saw_first = True
-            self._handle.update(
-                time_to_first_chunk_ms=(time.perf_counter() - self._started_at) * 1000,
-                response_id=response_id,
-                response_model=response_model,
-            )
-        if self._budget.accept(chunk):
-            self._chunks.append(chunk)
 
     def _finish(self, error: BaseException | None = None) -> None:
         if self._finished:
@@ -1028,10 +1112,12 @@ class _InstrumentedStream:
         try:
             stream_chunk_builder = cast(Callable[..., Any], cast(Any, litellm).stream_chunk_builder)
             rebuilt = stream_chunk_builder(self._chunks, messages=self._messages)
-        except Exception:
-            rebuilt = None
-        if rebuilt is not None:
-            fields = _safe_response_fields(_completion_response, rebuilt)
+            if rebuilt is not None:
+                fields = _completion_response(rebuilt)
+        except Exception as exc:
+            # The output is lost; the truncated budget flags it and keeps it from a mask.
+            self._budget.truncated = True
+            self._report(exc)
         rebuilt_usage = fields.get("usage")
         if self._usage is not None and (
             rebuilt_usage is None
@@ -1079,7 +1165,10 @@ class _InstrumentedStream:
             fields["error"] = error
             if self._request_provider is None and fields.get("provider") is None:
                 fields["provider"] = _provider_from_error(error)
-        self._end(**fields)
+        try:
+            self._end(**fields)
+        finally:
+            _release_budget(self._budget)
 
     def close(self) -> None:
         self._finish()
@@ -1102,6 +1191,77 @@ class _InstrumentedStream:
             await _maybe_await(close())
 
 
+# On Python 3.10 and 3.11, StringIO keeps up to 100,000 written strings in a list before it
+# joins them, about 60 bytes each that the stream bound does not charge: 15 bytes a character
+# for 4-character deltas. Deltas are joined 256 at a time, so that those waiting hold under
+# about 22 KB, onto a string that is written once it has 4,096 characters, so that what is
+# written costs about 1.5% more than its text. Python 3.12 dropped the list.
+_DELTA_BATCH = 256
+_WRITE_CHARS = 4096
+
+
+class _DeltaBuffer:
+    # A write takes several steps, unlike one StringIO call, so without the lock a read on
+    # another thread, such as one that closes the stream, could copy a batch twice or drop it.
+    # A fork copies the lock held if another thread was writing, and that thread does not run
+    # in the child to release it. Every fork, also one that runs no at-fork hooks, changes the
+    # process ID, so a child takes a new lock. The check is inline because it runs per delta.
+    # A signal handler runs on the thread it interrupts, so one that reads the stream, such as
+    # one that closes it, can read inside a write. So the lock is reentrant, and each step takes
+    # the deltas and the tail out of the buffer before it joins or writes them, so that a read
+    # inside the step does not write them as well; that read returns a prefix, which can leave
+    # out the deltas being joined. A handler that writes inside a step is not supported. An
+    # exception inside a step, such as KeyboardInterrupt from a handler, puts back the text the
+    # step took unless the StringIO has it, so that a later read still has every delta.
+    __slots__ = ("_buffer", "_lock", "_pending", "_pid", "_tail")
+
+    def __init__(self) -> None:
+        self._buffer = StringIO()
+        self._lock = threading.RLock()
+        self._pid = os.getpid()
+        self._pending: list[str] = []
+        self._tail = ""
+
+    def write(self, text: str) -> None:
+        pid = os.getpid()
+        if self._pid != pid:
+            self._lock = threading.RLock()
+            self._pid = pid
+        with self._lock:
+            self._pending.append(text)
+            if len(self._pending) >= _DELTA_BATCH:
+                self._join(_WRITE_CHARS)
+
+    def getvalue(self) -> str:
+        pid = os.getpid()
+        if self._pid != pid:
+            self._lock = threading.RLock()
+            self._pid = pid
+        with self._lock:
+            self._join(1)
+            return self._buffer.getvalue()
+
+    def _join(self, write_at: int) -> None:
+        if not self._pending and len(self._tail) < write_at:
+            return
+        written = self._buffer.tell()
+        pending: list[str] = []
+        tail = ""
+        try:
+            pending, self._pending = self._pending, []
+            tail, self._tail = self._tail, ""
+            joined = "".join([tail, *pending])
+            if len(joined) >= write_at:
+                self._buffer.write(joined)
+            else:
+                self._tail = joined
+        except BaseException:
+            if self._buffer.tell() == written:
+                self._pending[:0] = pending
+                self._tail = tail + self._tail
+            raise
+
+
 class _InstrumentedResponsesStream:
     def __init__(
         self,
@@ -1132,6 +1292,8 @@ class _InstrumentedResponsesStream:
         self._budget = _stream_capture_budget()
         self._charges: dict[object, tuple[int, int]] = {}
         self._annotation_charge_keys: dict[object, dict[int, object]] = {}
+        self._reported = False
+        self._record_failed = False
 
     def __getattr__(self, name: str) -> Any:
         return getattr(self._inner, name)
@@ -1153,7 +1315,7 @@ class _InstrumentedResponsesStream:
             except BaseException:
                 pass
             raise
-        self._record(event, received_at)
+        self._record_guarded(event, received_at)
         return event
 
     def __aiter__(self) -> AsyncIterator[Any]:
@@ -1173,7 +1335,7 @@ class _InstrumentedResponsesStream:
             except BaseException:
                 pass
             raise
-        self._record(event, received_at)
+        self._record_guarded(event, received_at)
         return event
 
     def __enter__(self) -> _InstrumentedResponsesStream:
@@ -1268,10 +1430,12 @@ class _InstrumentedResponsesStream:
     def _materialize_partial(self, value: dict[str, Any]) -> dict[str, Any]:
         if "_field" not in value:
             return value
+        # Each partial value with a "_field" has a _DeltaBuffer under "_fragments", or a StringIO
+        # when _append_delta measures its first delta.
         field = cast(str, value["_field"])
-        fragments = cast(list[str], value["_fragments"])
+        fragments = cast(_DeltaBuffer | StringIO, value["_fragments"])
         return {key: item for key, item in value.items() if key not in {"_field", "_fragments"}} | {
-            field: "".join(fragments)
+            field: fragments.getvalue()
         }
 
     def _set_completed_item(self, key: object, value: Any) -> None:
@@ -1316,7 +1480,7 @@ class _InstrumentedResponsesStream:
         budget.bytes_used = max(0, self._budget.bytes_used - removed_bytes)
         budget.items_used = max(0, self._budget.items_used - removed_items)
         before = (budget.bytes_used, budget.items_used)
-        if not budget.accept(value):
+        if not budget.accept(value) or not _adopt_budget(self._budget, budget):
             return False
         for key in keys:
             self._charges.pop(key, None)
@@ -1324,7 +1488,6 @@ class _InstrumentedResponsesStream:
             budget.bytes_used - before[0],
             budget.items_used - before[1],
         )
-        self._budget = budget
         self._budget.truncated = bool(self._truncated_items) or self._truncation_overflow
         return True
 
@@ -1347,7 +1510,7 @@ class _InstrumentedResponsesStream:
         budget.items_used = max(0, self._budget.items_used - removed_items)
         before = (budget.bytes_used, budget.items_used)
         converted, budget = _bounded_responses_native(value, budget=budget)
-        if converted is None or budget.truncated:
+        if converted is None or budget.truncated or not _adopt_budget(self._budget, budget):
             return False, None
         for key in keys:
             self._charges.pop(key, None)
@@ -1355,7 +1518,6 @@ class _InstrumentedResponsesStream:
             budget.bytes_used - before[0],
             budget.items_used - before[1],
         )
-        self._budget = budget
         self._budget.truncated = bool(self._truncated_items) or self._truncation_overflow
         return True, converted
 
@@ -1366,12 +1528,14 @@ class _InstrumentedResponsesStream:
             self._budget.truncated = True
             return False
         if storage_key not in self._charges:
-            candidate = self._materialize_partial({**target, "_fragments": [delta]})
+            candidate = self._materialize_partial({**target, "_fragments": StringIO(delta)})
             return self._replace_charge([], candidate, storage_key)
         if self._budget.items_used >= self._budget.max_items:
             self._budget.truncated = True
             return False
-        self._budget.bytes_used += delta_bytes
+        if not _reserve_bytes(self._budget, self._budget.bytes_used + delta_bytes):
+            self._budget.truncated = True
+            return False
         self._budget.items_used += 1
         charged_bytes, charged_items = self._charges[storage_key]
         self._charges[storage_key] = (charged_bytes + delta_bytes, charged_items + 1)
@@ -1399,16 +1563,16 @@ class _InstrumentedResponsesStream:
             keys = self._truncated_item_keys[owner]
             if key in keys:
                 return
-            if self._truncated_key_count < self._budget.max_items:
+            if self._truncated_key_count < _STREAM_CAPTURE_MAX_ITEMS:
                 keys.add(key)
                 self._truncated_key_count += 1
             else:
                 self._truncation_overflow = True
             return
-        if self._retained_item_count < self._budget.max_items:
+        if self._retained_item_count < _STREAM_CAPTURE_MAX_ITEMS:
             self._truncated_items.add(owner)
             self._retained_item_count += 1
-            if self._truncated_key_count < self._budget.max_items:
+            if self._truncated_key_count < _STREAM_CAPTURE_MAX_ITEMS:
                 self._truncated_item_keys[owner] = {key}
                 self._truncated_key_count += 1
             else:
@@ -1433,16 +1597,53 @@ class _InstrumentedResponsesStream:
         if not keys and not self._truncation_overflow:
             self._resolve_truncated(item_key)
 
+    def _report(self, exc: Exception) -> None:
+        # A stream reports only its first failure; a broken mapper fails on every event.
+        if self._reported:
+            return
+        self._reported = True
+        try:
+            self._handle.report_error(exc)
+        except Exception:
+            pass
+
+    def _record_guarded(self, event: Any, received_at: float) -> None:
+        try:
+            # After a lost event only the terminal events are read, so the output rebuilt from
+            # deltas stays a prefix; a complete terminal snapshot still replaces it.
+            if self._record_failed and _string(_field(event, "type")) not in {
+                "response.completed",
+                "response.incomplete",
+                "response.failed",
+                "error",
+            }:
+                return
+            self._record(event, received_at)
+        except Exception as exc:
+            self._record_failed = True
+            self._budget.truncated = True
+            self._report(exc)
+            if self._finished:
+                # The end failed after it began, so the span ends here, flagged, with no output.
+                try:
+                    self._end(attributes={_CAPTURE_TRUNCATED_ATTRIBUTE: True})
+                finally:
+                    _release_budget(self._budget)
+
     def _record(self, event: Any, received_at: float) -> None:
         event_type = _string(_field(event, "type"))
         response = _field(event, "response")
         if not self._saw_first:
             self._saw_first = True
-            self._handle.update(
-                time_to_first_chunk_ms=(received_at - self._started_at) * 1000,
-                response_id=_string(_field(response, "id")),
-                response_model=_string(_field(response, "model")),
-            )
+            try:
+                self._handle.update(
+                    time_to_first_chunk_ms=(received_at - self._started_at) * 1000,
+                    response_id=_string(_field(response, "id")),
+                    response_model=_string(_field(response, "model")),
+                )
+            except Exception as exc:
+                # Only the first-event timing and IDs are lost; the event's output is recorded.
+                self._report(exc)
         if event_type in {
             "response.output_item.added",
             "response.content_part.added",
@@ -1494,7 +1695,7 @@ class _InstrumentedResponsesStream:
                             **(target or {}),
                             "type": "output_text" if field == "text" else "refusal",
                             "_field": field,
-                            "_fragments": [],
+                            "_fragments": _DeltaBuffer(),
                         }
                 elif event_type in {
                     "response.reasoning_summary_text.delta",
@@ -1523,7 +1724,7 @@ class _InstrumentedResponsesStream:
                             **(target or {}),
                             "type": kind,
                             "_field": field,
-                            "_fragments": [],
+                            "_fragments": _DeltaBuffer(),
                         }
                 elif event_type in {
                     "response.function_call_arguments.delta",
@@ -1545,7 +1746,7 @@ class _InstrumentedResponsesStream:
                             **(seeded if isinstance(seeded, dict) else {}),
                             "type": event_kind[0],
                             "_field": event_kind[1],
-                            "_fragments": [],
+                            "_fragments": _DeltaBuffer(),
                         }
                         item_id = _string(_field(event, "item_id"))
                         if item_id is not None:
@@ -1555,12 +1756,13 @@ class _InstrumentedResponsesStream:
                             if value is not None:
                                 target[field] = value
                 if target is not None:
-                    fragments = cast(list[str], target["_fragments"])
+                    # Every target above is created with a _DeltaBuffer under "_fragments".
+                    fragments = cast(_DeltaBuffer, target["_fragments"])
                     accepted = not self._delta_rejected_before(storage_key) and self._append_delta(
                         storage_key, target, delta
                     )
                     if accepted:
-                        fragments.append(delta)
+                        fragments.write(delta)
                         self._remember_item_index(event, item_key)
                         if event_type in {
                             "response.function_call_arguments.delta",
@@ -1724,38 +1926,83 @@ class _InstrumentedResponsesStream:
         if self._finished:
             return
         self._finished = True
-        fields = (
-            _safe_response_fields(_responses_response_without_output, response)
-            if response is not None
-            else {}
-        )
+        fields: dict[str, Any] = {}
+        fields_lost = False
+        if response is not None:
+            try:
+                fields = _responses_response_without_output(response)
+            except Exception as exc:
+                # Only the response's own fields are lost: the output is mapped apart, so it is
+                # flagged but not cut or withheld from a mask. A failed response is still
+                # recorded as failed.
+                fields_lost = True
+                self._report(exc)
+                try:
+                    fields = {"error": _response_error(response)}
+                except Exception:
+                    pass
         if response is not None and self._capture_output:
-            terminal_output, terminal_budget = _bounded_responses_native(
-                _field(response, "output"), budget=_stream_capture_budget()
-            )
-            if terminal_output is not None and not terminal_budget.truncated:
-                fields["output"] = terminal_output
-                self._budget = terminal_budget
-                self._retained_item_count -= len(self._truncated_items)
-                self._truncated_items.clear()
-                self._truncated_item_keys.clear()
-                self._truncated_key_count = 0
-                self._truncation_overflow = False
-            elif _field(response, "output") is not None or terminal_budget.truncated:
+            try:
+                terminal_output, terminal_budget = _bounded_responses_native(
+                    _field(response, "output"),
+                    budget=telemetry_dev.CaptureBudget(
+                        self._budget.max_bytes, self._budget.max_items
+                    ),
+                )
+                # An empty terminal output does not replace output recorded from the deltas, or
+                # lost with an event, so it is read as no terminal output. A lost event leaves the
+                # budget truncated until this replacement, so the truncated budget covers it.
+                replaces_recorded = terminal_output != [] or not (
+                    self._charges or self._budget.truncated
+                )
+                if (
+                    terminal_output is not None
+                    and replaces_recorded
+                    and not terminal_budget.truncated
+                    and _adopt_budget(self._budget, terminal_budget)
+                ):
+                    fields["output"] = terminal_output
+                    self._budget.truncated = False
+                    self._retained_item_count -= len(self._truncated_items)
+                    self._truncated_items.clear()
+                    self._truncated_item_keys.clear()
+                    self._truncated_key_count = 0
+                    self._truncation_overflow = False
+                elif replaces_recorded and (
+                    _field(response, "output") is not None or terminal_budget.truncated
+                ):
+                    self._budget.truncated = True
+            except Exception as exc:
+                # The terminal output is lost; the output rebuilt from the deltas, if any, is
+                # flagged and withheld from a mask, and the mapped fields are kept.
+                fields.pop("output", None)
                 self._budget.truncated = True
+                self._report(exc)
         if "output" not in fields:
-            partial_output = self._partial_output()
+            try:
+                partial_output = self._partial_output()
+            except Exception as exc:
+                # The output cannot be rebuilt whole, so none is exported, and the stream is
+                # flagged.
+                partial_output = None
+                self._budget.truncated = True
+                self._report(exc)
             if partial_output:
                 fields["output"] = partial_output
         if self._budget.truncated or response is None or error is not None:
             _mark_capture_incomplete(fields, self._mask_output_when_incomplete)
+        elif fields_lost:
+            _mark_capture_incomplete(fields, False)
         if self._request_provider is not None:
             fields.pop("provider", None)
         if error is not None:
             fields["error"] = error
             if self._request_provider is None:
                 fields["provider"] = _provider_from_error(error)
-        self._end(**fields)
+        try:
+            self._end(**fields)
+        finally:
+            _release_budget(self._budget)
 
     def close(self) -> None:
         self._finish()
@@ -1859,7 +2106,20 @@ def _wrap_sync(
             elif op == "rerank":
                 active_mapper = _rerank_response_without_output
         try:
-            fields = _safe_response_fields(active_mapper, result)
+            fields = active_mapper(result)
+        except Exception as exc:
+            # The output and response fields are lost; the call is failed only if the response
+            # says so.
+            try:
+                handle.report_error(exc)
+            except Exception:
+                pass
+            fields: dict[str, Any] = {"attributes": {_CAPTURE_TRUNCATED_ATTRIBUTE: True}}
+            if op == "responses":
+                try:
+                    fields["error"] = _response_error(result)
+                except Exception:
+                    pass
         except BaseException as exc:
             end(
                 error=exc,
@@ -1919,7 +2179,20 @@ def _wrap_async(
             elif op == "rerank":
                 active_mapper = _rerank_response_without_output
         try:
-            fields = _safe_response_fields(active_mapper, result)
+            fields = active_mapper(result)
+        except Exception as exc:
+            # The output and response fields are lost; the call is failed only if the response
+            # says so.
+            try:
+                handle.report_error(exc)
+            except Exception:
+                pass
+            fields: dict[str, Any] = {"attributes": {_CAPTURE_TRUNCATED_ATTRIBUTE: True}}
+            if op == "responses":
+                try:
+                    fields["error"] = _response_error(result)
+                except Exception:
+                    pass
         except BaseException as exc:
             end(
                 error=exc,