[Epic]: Make the IDE telemetry path dependable — VS Code provider and the Copilot spool drain

## Sprint tracker — the `Estimate` on this epic is deliberately `0`

Every point of this epic's work is estimated on its child **stories**. If the epic also carried
its rollup, a sprint holding both would report roughly double the work committed.
**True rollup: 11 points across four stories, plus ~4 points of loose tickets** (see below).
Sum the **children**, never the epic row.

## Executive Summary

The VS Code language-model provider shipped (#215) and `copilot-push` shipped (#228). Both were
verified against the live gateway, and both left a tail of defects and gaps that adversarial
review found but that were deliberately not fixed in-flight. This epic is that tail, plus the
follow-ups the independent gate ranked as blocking-adjacent.

## Strategic Intent

RFC-0003 §2a now carries a thirteenth row — `VS Code LM provider`, `push-in-band`, identity
bound-at-issuance. It is the strongest attribution row in the matrix. That claim only holds if
the client is dependable under a throttled gateway, a rotated spool and an interrupted wake.
This epic is what turns "it worked when we tried it" into "it runs unattended".

## Problem Statement

Eight defects and gaps, each found by measurement rather than review, and each filed with a
reproduction:

- A rate limit **empties the model picker** (#232) — the catalogue path treats 429 as "these
models are withdrawn".
- The spool **grows without bound** (#230); the only rotation that occurs is one we do not
control, and it was losing records silently until #228 closed the identity half.
- A developer configures VS Code **by hand** and gets it wrong (#233) — observed live.
- `provideTokenCount` is the one function shipped **untested**, and the test stub makes its
likely bug untestable by construction (#231).
- `status` is **not trustworthy from a script** (#234) — #213 fixed only the TTY path.
- Three maintenance items: `cache.rs` at 719 lines after three baseline raises (#235), a flaky
epoch-aligned rate-limit test (#236), and helper duplication across eight test files (#237).

## Desired Outcome

A developer installs the extension, runs one command, and the IDE path works — including when
the gateway throttles, the spool rotates, or a wake is killed. Nothing in that sentence is
currently guaranteed.

## Scope

**In:** the four stories below and the three loose maintenance tickets.

**Out:** the VS Code Session Info panel reading `0%`. That is
[microsoft/vscode#314722](https://github.com/microsoft/vscode/issues/314722) — VS Code
hard-codes usage to zero for extension-contributed endpoints. Nothing in this repository can
fix it, and it is not a defect in our provider.

**Out:** proactive client-side rate limiting. The gateway advertises no limit headers
(measured: only `server` and `x-envoy-upstream-service-time` on a 200), so pacing would mean
guessing a budget. The cheaper fix is `RateLimit-*` headers at the gateway — an `ai-helm`
concern, tracked separately.

**Out:** whether draining the Copilot OTel spool is worth scheduling at all. Measurement
(RFC-0003 §2a, correction 3) shows it carries usage and orchestration but **no** accept/reject
signal. That is a product decision, not this epic's.

## Source of truth (links)

- RFC-0003 §2a, corrections 1–4 — `docs/rfc/0003-telemetry-source-taxonomy-and-roadmap.md`
- `ide/vscode/docs/matrix-row.md` — the §9 source declaration
- `docs/governance-auth/default-flow.md` — the runbook this epic keeps true
- PRs #215, #218, #228 · issues #230–#237

## Stakeholders

Platform / IDE telemetry. Downstream: anyone reading per-developer usage KPIs, since the
provider row is where identity is provable.

## Key Assumptions

- The gateway keeps serving `/v1/models/info` in the OpenRouter shape. A schema drift is now
loud rather than silent (#228), but it would still stop the picker.
- Copilot's OTel file format is the JS SDK's **private** object graph and can change between
releases. The drain degrades rather than aborts, but a format change still costs data.

## Constraints

- LoC gate: 200 per new file. `cache.rs` is already at 719 after three raises (#235).
- npm is fenced to `ide/vscode` with its own path-filtered workflow; it must not become a
dependency of the Rust gate.

## Risks

- **#230 is data-loss adjacent.** Growth is measured at 73 KB → 315 KB in six minutes of
ordinary use. Rotation is unimplemented, so the failure mode is somebody else's rotation.
- **#232 is user-visible immediately** — an empty picker reads as "the product is broken".
- The `copilot-push` value question is unresolved; #230's cost may be spent on a stream nobody
should be draining.

## Success metrics

- A throttled gateway degrades to a retry, never to an empty picker.
- `copilot-push` runs a week unattended with zero uncounted records and a bounded spool.
- `governance-auth configure` produces a working VS Code setup with no hand-editing.
- `provideTokenCount` has a test that fails when it is broken.

## Child User Stories

Linked as sub-issues below. Loose tickets (#235, #236, #237) are maintenance, not story work —
they consume ~4 days that the story total does not show.

## Human accountable owner

@stephane-segning

## AI Usage Declaration

AI-assisted. Every defect referenced was **reproduced** before being filed — the reproductions
are in the individual issues. Claude Opus 5 drafted this epic; a human owns intent,
verification and consequences. https://adorsys-gis.github.io/ai-governance/

## Human verification completed

- [ ] Owner has reviewed scope and the capacity arithmetic in the sprint comment