- Shipped
- August 3, 2026 at 3:02 AM UTC
- Author
- Kamo
- Commit
- 584d798
Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each looks exactly like "this correspondent has no photo", which is also what correct behaviour looks like. There is no user-visible difference between working and completely dead, so it has to be measured. Metrics (Prometheus was already wired up, so this is mostly naming): cache hit ratio, chain duration tagged by the tier that answered, per-provider hit/miss, worker queue depth, and a discarded-task total. That last one previously used DiscardPolicy, which drops silently by design; it now increments a counter, and the counter is declared before the executor because field initializers run in source order and relying on lazy capture would break on a harmless reorder. Disclosures go to their own logger. Only the identity tier is a personal disclosure — the domain tiers transmit the right-hand side of an address, which identifies no one — and it is recorded before the call rather than after, so the trail exists even when the request then fails. The address is written in full and deliberately: the point is to answer "who was this person's data shared with", and a hash cannot answer that. The reaper closes a leak: deleteExpiredBefore existed and nothing called it, so sender_identity grew forever. A busy mailbox touches thousands of correspondents once each and leaves a negative row behind for every one. Tests cover the fetcher against a real socket, because the interesting cases are all provider behaviours rather than logic: a 404 carrying a valid image (DuckDuckGo), a soft-404 serving HTML, an origin understating Content-Length, a 1x1 stub, and a redirect aimed into the pod network. The production client cannot be pointed at a loopback test server — its DNS pin refuses to resolve anything private, which is the whole point — so those run against a relaxed client and the pin is asserted separately.