Phase 5b: logging facade and redaction — tests and doubles

[Wahbeh-Mohammad]

Part of #19. Eighth PR of the nine-PR phase-5 stack — the tests for phase 5b's code PR below it. Targets that PR's branch; the phase record is the next PR up.

What lands

18 files, +3,887 / −17: fifteen suites under gems/dexpace-core/test/dexpace/instrumentation/ mirroring lib/ one file per file (render.rb and emitter.rb are private_constants asserted through Event and the two steps and say so; diagnostics_test.rb is the full rewrite of 5c's minimal mirror), plus the two doubles the design's testing strategy names and the matrix-fact suite:

• RecordingSink — a real in-memory _Sink with per-severity enablement, recording every entry it is handed exactly as handed, so an assertion that a credential never reached the sink is an assertion about the sink's own record.
• DiagnosticContext.preserve — the save-and-restore block over Fiber storage that 5c's floor-aware FiberStorageFacts helpers do not cover. Both top-level, the tree's convention (P5-98).
• 5c's Dexpace::RecordingSpan/RecordingTracer/RecordingTracerFactory/RecordingMeter, AllocationDelta and FiberStorageFacts, and 5a's FakeClock/FakeConfigSource, consumed unchanged — except allocation_delta.rb, which now reports the figure two consecutive measurements agree on (round 2's floor flake, R2-4; 5c's suites re-run green). Phase 2's FakeTransport/FakeAsyncTransport(settle_later:) and 4c's ForkingProbe drive the steps through real pipelines; no FakeFuture or fake cursor exists.

Every file's header names the requirement IDs it exercises; every class inherits DexpaceTestCase; every thread is joined; nothing uses assert_nothing_raised; GC.stat appears only inside the allocation assertions; no 5b test reads real ENV — every slot read goes through FakeConfigSource seams installed with Dexpace.configure and reset in teardown, and the reviewers ran the whole core suite under hostile HTTPS_PROXY/LOG_LEVEL/LOG_PREVIEW_BYTES/MAX_MATERIALIZED_BYTES/MAX_TRACKED_CONTEXTS (every 5b suite green; the four failures are pre-existing 3b/4b ceiling readers, phase 10 inbound bullet 42).

What the suites prove rather than restate:

• OBS-1 as identity and as a number — assert_same(Event::INERT, …) across severities, and a two-loop GC.stat delta of exactly 0.0 per call over the inert chain with the arguments precomputed under # frozen_string_literal: true (R8).
• The redaction surface, input by input — userinfo replaced with an allow-list naming the user; the default query allow-list exactly {api-version}; Token matched case-insensitively and %73ig decoded before matching; ?sig with no =, &&sig=x&, %zz=1 (a bad name is unmatchable, the value ***), a trailing ? preserved, a fragment ? not a query, an opaque mailto: with a query tail; /cb?code=S → /cb?***; '', ' ', http://[::1, a NUL, 10 KiB of ? → the sentinel, never a raise; the header-value route with userinfo on the relative, surgery and sentinel-fallback routes, leading OWS, <…>, quotes, parentheses, %20, +, @, NBSP, U+2028, obs-text and a doubled URL all losing the credential, a multi-valued Location redacted per value; the four RFC 3986 non-authority spellings kept verbatim and named as such; Authorization, Proxy-Authorization, Cookie, Set-Cookie, X-Api-Key redacted at #field and the diagnostic names kept; a credential in the logger's global context and in a Fiber[] key redacted at Logger.build and at #emit.
• OBS-6/OBS-7 — a BasicObject, a raising #inspect, an anonymous StandardError subclass, a 20 KiB multibyte string straddling the 8 KiB boundary — all render, byte-sliced, with a nil-safe class name.
• OBS-8 — 16 threads emitting once; a sink that re-enters the logger from #info not deadlocking (the mutex is released before the sink call).
• OBS-10/OBS-24, floor-aware — the fold carries exactly the two default keys and skips a nil-valued one; a snapshot reinstalled in another thread and restored afterwards including on raise; a snapshot-introduced key absent after restore on 3.3+ and present-and-nil on 3.2.11, asserted through FiberStorageFacts; the async failure event bridged across a settling thread (round 1's surviving mutation, now a case).
• OBS-20/OBS-30 through a real Pipeline — a raising sink returning the transport's response with two http.instrumentation.log diagnostics; a raising diagnostic swallowed; a raising tracer inside the same step propagating; on the async path a throwing meter reaching the settler on a later settlement and failing the request on an inline one, add and finish exactly once in all six level/settlement combinations (round 2's R2-3).
• OBS-34–OBS-39 — the span and both instruments at NONE with no event; the HEADERS payload with every credential header redacted and url.full scrubbed; BODY with preview_bytes from the configuration (16 configured, 8192 unset), text previewed, octet-stream as the binary marker, a charset with no converter falling back, a chunked body putting no size field on either event (BODY-35, round 1's other surviving mutation), the wire bytes untouched; http.response.duration_ms from a FakeClock advanced by hand; every Keys and Events constant present in the manifest.
• OBS-35 — the key required, the tiers in order through FakeConfigSource seams, an unrecognised level falling back, DEFAULT is NONE.
• The four wirings — close_quietly(bad, logger:) emitting http.instrumentation.close and returning nil, onto: still attaching, neither still silent; Hooks.notify with three raising hooks raising the first with two on the trail and two http.instrumentation.hook events; Proxy.resolve(config, logger:) on a malformed HTTPS_PROXY yielding nil, one WarningCaptured warning and one http.instrumentation.config event, with the credential in neither channel for the quoted, bracketed and doubled spellings (R3-1's eight parsed-path spellings are the open case); LOG_PREVIEW_BYTES frozen with LOG_LEVEL untouched.
• The matrix facts, pinned on every row — the five floor-straddling facts of the design plus 5c's two (Fiber[:k] = nil retaining on 3.2, Fiber["k"] raising on 3.2/3.3), fact 3 stating each row's expected map (round 0's R0-1: the first cut was order-dependent on the floor).

Verification

• bundle exec rake on Ruby 4.0.6 at this tip: exit 0, all seventeen gates green — test:gems 2,050 runs / 58,450 assertions, line coverage 99.98%; honest RuboCop 401 files clean.
• The matrix set on 3.2.11, 3.3.12 and 3.4.10 with a fresh lock: 0 failures; three extra seeds on 4.0.6 and one on 3.2.11 with identical run counts; the OBS-1 allocation assertion 0/30 whole-file and 0/30 alone on the floor after round 2's repair.
• Four reviewers applied 47, 53, 56 and 56 single-edit mutations across the rounds; every one caught at the final tip, ten on 3.2.11 as well (the OBS-8 latch race probabilistically there — R3-3).

Known follow-ups from the final review (not blocking)

• R3-3 (nit) — event_test.rb:100: the OBS-8 race test's four-thread Queue gate catches an unsynchronised latch only probabilistically on 3.2.11; a sixteen-thread barrier released on one signal would make it deterministic.
• R3-1 (on the code PR) needs its eight parsed-path proxy spellings asserted here once the belt is per-run; R3-2 needs a FakeClock-advanced caller-callback case at HEADERS and BODY asserting the histogram and the log duration agree and exclude it.
• diagnostics_test.rb changes in both this PR and the code PR: 5c's pin repaired to four constants and three functions on the code branch (the suite must be green there), the full 5b mirror here.