Add telemetry ingest, feedback collector, pressure API and insight CLI

Completes FLUID-WP-0005. Normalization and redaction live on one path,
shared by the in-process emitter and the ingest endpoint: two paths with
two normalizations would eventually disagree, and the disagreement would
surface as a pressure finding that is really a pipeline bug.

Telemetry kind is inferred from event shape rather than defaulting to
"request", since an error filed as a request understates the interface's
failure rate. A malformed event in a batch does not discard the rest.

Feedback is stored as evidence and creates no pressure and no hypothesis
on its own, per API Standards 15, with the consumer recorded as the
actor so their untrusted status stays visible in the audit trail. The
feedback endpoint is the only consumer-reachable part of the control
plane.

The observation endpoints are not served at all when no pseudonymization
salt is configured, rather than served with a generated one: a salt that
changed per run would make the same consumer look new every time and
every cohort count wrong.

Adds an end-to-end test driving real traffic through the gateway and
confirming it becomes a classified pressure record, with no raw consumer
identity reaching the store.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014KmVxhJ35tCo7rE7UnLwWu

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1116572@bnt-lap001
Assistant-Session: 8ba9bb93-a72a-4883-b189-2499cce5c400

internal/contract/event_gen.go

@@ -10,6 +10,7 @@ const (
 	FluidEventEntityTypeHypothesis         FluidEventEntityType = "hypothesis"
 	FluidEventEntityTypeRevision           FluidEventEntityType = "revision"
 	FluidEventEntityTypeExperiment         FluidEventEntityType = "experiment"
+	FluidEventEntityTypeFeedback           FluidEventEntityType = "feedback"
 	FluidEventEntityTypeBackendRequirement FluidEventEntityType = "backend_requirement"
 	FluidEventEntityTypeIntent             FluidEventEntityType = "intent"
 	FluidEventEntityTypeDecision           FluidEventEntityType = "decision"
@@ -19,7 +20,7 @@ const (
 // Valid reports whether v is a defined FluidEventEntityType.
 func (v FluidEventEntityType) Valid() bool {
 	switch v {
-	case FluidEventEntityTypePressure, FluidEventEntityTypeHypothesis, FluidEventEntityTypeRevision, FluidEventEntityTypeExperiment, FluidEventEntityTypeBackendRequirement, FluidEventEntityTypeIntent, FluidEventEntityTypeDecision, FluidEventEntityTypeRoutingPolicy:
+	case FluidEventEntityTypePressure, FluidEventEntityTypeHypothesis, FluidEventEntityTypeRevision, FluidEventEntityTypeExperiment, FluidEventEntityTypeFeedback, FluidEventEntityTypeBackendRequirement, FluidEventEntityTypeIntent, FluidEventEntityTypeDecision, FluidEventEntityTypeRoutingPolicy:
 		return true
 	}
 	return false

internal/control/api.go

@@ -23,11 +23,13 @@ import (
 type Server struct {
 	revisions *RevisionAPI
 	intents   *IntentAPI
+	pressure  *PressureAPI
 }
 
-// NewServer wires the control APIs.
-func NewServer(rev *RevisionAPI, in *IntentAPI) *Server {
-	return &Server{revisions: rev, intents: in}
+// NewServer wires the control APIs. The pressure API may be nil where an
+// interface runs without an observation plane.
+func NewServer(rev *RevisionAPI, in *IntentAPI, p *PressureAPI) *Server {
+	return &Server{revisions: rev, intents: in, pressure: p}
 }
 
 // Routes returns the control-plane mux.
@@ -40,6 +42,14 @@ func (s *Server) Routes() *http.ServeMux {
 	mux.HandleFunc("/control/v1/intents/", s.intents.handleItem)
 	mux.HandleFunc("/control/v1/intents/active", s.intents.handleActive)
 
+	if s.pressure != nil {
+		mux.HandleFunc("/control/v1/pressure", s.pressure.handleCollection)
+		mux.HandleFunc("/control/v1/pressure/", s.pressure.handleItem)
+		mux.HandleFunc("/control/v1/telemetry", s.pressure.handleTelemetry)
+		// Consumer-reachable, unlike the rest of this surface.
+		mux.HandleFunc("/v1/feedback", s.pressure.handleFeedback)
+	}
+
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
 	})

internal/control/api_test.go

@@ -57,7 +57,7 @@ func newServer(t *testing.T) (*http.ServeMux, *evidence.SQLStore) {
 		t.Fatal(err)
 	}
 
-	srv := NewServer(NewRevisionAPI(store, pipeline), NewIntentAPI(intents, gate))
+	srv := NewServer(NewRevisionAPI(store, pipeline), NewIntentAPI(intents, gate), nil)
 	return srv.Routes(), store
 }
 

internal/control/pressure.go

@@ -0,0 +1,171 @@
+package control
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"github.com/tegwick/fluid-core/internal/contract"
+	"github.com/tegwick/fluid-core/internal/observation"
+)
+
+// PressureAPI implements ArchitectureBlueprint.md section 44.2: record
+// pressure, aggregate, link evidence, link hypothesis, close or dismiss.
+type PressureAPI struct {
+	registry *observation.PressureRegistry
+	ingest   *observation.Ingest
+}
+
+// NewPressureAPI returns the pressure API.
+func NewPressureAPI(r *observation.PressureRegistry, in *observation.Ingest) *PressureAPI {
+	return &PressureAPI{registry: r, ingest: in}
+}
+
+func (a *PressureAPI) handleCollection(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		status := contract.FluidPressureStatus(r.URL.Query().Get("status"))
+		if status != "" && !status.Valid() {
+			writeError(w, http.StatusBadRequest, "unknown status filter")
+			return
+		}
+		list, err := a.registry.List(r.Context(), status)
+		if err != nil {
+			writeError(w, http.StatusInternalServerError, "could not list pressure")
+			return
+		}
+		writeJSON(w, http.StatusOK, map[string]any{"pressures": list})
+	default:
+		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
+	}
+}
+
+func (a *PressureAPI) handleItem(w http.ResponseWriter, r *http.Request) {
+	id := pathTail(r.URL.Path, "/control/v1/pressure")
+	if id == "" {
+		writeError(w, http.StatusNotFound, "no pressure named")
+		return
+	}
+
+	switch r.Method {
+	case http.MethodGet:
+		p, err := a.registry.Get(r.Context(), contract.PressureID(id))
+		if err != nil {
+			writeError(w, statusForStoreError(err), "pressure not found")
+			return
+		}
+		writeJSON(w, http.StatusOK, p)
+
+	case http.MethodPatch:
+		a.patch(w, r, contract.PressureID(id))
+
+	default:
+		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
+	}
+}
+
+// PatchPressureRequest changes a pressure's disposition.
+type PatchPressureRequest struct {
+	Status     contract.FluidPressureStatus `json:"status,omitempty"`
+	Reason     string                       `json:"reason,omitempty"`
+	Actor      contract.Actor               `json:"actor"`
+	Hypothesis contract.HypothesisID        `json:"link_hypothesis,omitempty"`
+}
+
+func (a *PressureAPI) patch(w http.ResponseWriter, r *http.Request, id contract.PressureID) {
+	var req PatchPressureRequest
+	if err := decodeBody(r, &req); err != nil {
+		writeError(w, http.StatusBadRequest, "could not decode request", err.Error())
+		return
+	}
+	if req.Actor.ID == "" {
+		// A disposition change with no actor cannot be audited, and dismissals
+		// are exactly the decisions worth attributing.
+		writeError(w, http.StatusBadRequest, "a disposition change must name its actor")
+		return
+	}
+
+	if req.Hypothesis != "" {
+		if err := a.registry.LinkHypothesis(r.Context(), id, req.Hypothesis); err != nil {
+			writeError(w, statusForStoreError(err), err.Error())
+			return
+		}
+	}
+
+	if req.Status != "" {
+		if err := a.registry.SetStatus(r.Context(), id, req.Status, req.Actor, req.Reason); err != nil {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+	}
+
+	p, err := a.registry.Get(r.Context(), id)
+	if err != nil {
+		writeError(w, statusForStoreError(err), "pressure not found")
+		return
+	}
+	writeJSON(w, http.StatusOK, p)
+}
+
+// handleTelemetry accepts telemetry from out-of-process adapters and consumers.
+func (a *PressureAPI) handleTelemetry(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
+		return
+	}
+
+	var batch struct {
+		Events []contract.FluidTelemetry `json:"events"`
+	}
+	if err := json.NewDecoder(http.MaxBytesReader(w, r.Body, 4<<20)).Decode(&batch); err != nil {
+		writeError(w, http.StatusBadRequest, "could not decode telemetry", err.Error())
+		return
+	}
+
+	accepted, rejected := a.ingest.WriteBatch(r.Context(), batch.Events)
+
+	causes := make([]string, 0, len(rejected))
+	for _, err := range rejected {
+		causes = append(causes, err.Error())
+	}
+	// Partial acceptance is reported rather than failed: telemetry is
+	// best-effort evidence and the good events are worth keeping.
+	writeJSON(w, http.StatusAccepted, map[string]any{
+		"accepted": accepted,
+		"rejected": len(rejected),
+		"causes":   causes,
+	})
+}
+
+// handleFeedback accepts explicit consumer feedback.
+//
+// This endpoint is reachable by consumers, unlike the rest of the control
+// plane. What it accepts is evidence, never authority: recording feedback
+// creates no pressure and no hypothesis on its own.
+func (a *PressureAPI) handleFeedback(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		writeError(w, http.StatusMethodNotAllowed, "method not allowed")
+		return
+	}
+
+	var f contract.FluidFeedback
+	if err := decodeBody(r, &f); err != nil {
+		writeError(w, http.StatusBadRequest, "could not decode feedback", err.Error())
+		return
+	}
+
+	stored, err := a.ingest.RecordFeedback(r.Context(), f)
+	if err != nil {
+		if errors.Is(err, observation.ErrWrongInterface) {
+			writeError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	writeJSON(w, http.StatusCreated, map[string]any{
+		"id":   stored.ID,
+		"note": "recorded as evidence; feedback does not itself authorize an interface change",
+	})
+}

internal/observation/feedback.go

@@ -0,0 +1,22 @@
+package observation
+
+import (
+	"encoding/json"
+
+	"github.com/tegwick/fluid-core/internal/contract"
+)
+
+// consumerLabel names the source of a piece of feedback for the audit trail.
+//
+// It prefers the cohort over anything consumer-specific: the trail needs to
+// know what kind of consumer said this, not which one.
+func consumerLabel(f contract.FluidFeedback) string {
+	if f.Cohort != nil && *f.Cohort != "" {
+		return string(*f.Cohort)
+	}
+	return "unclassified"
+}
+
+func marshalFeedback(f contract.FluidFeedback) ([]byte, error) {
+	return json.Marshal(contract.FeedbackDocument{FluidFeedback: f})
+}

internal/observation/ingest.go

@@ -0,0 +1,191 @@
+package observation
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/tegwick/fluid-core/internal/contract"
+	"github.com/tegwick/fluid-core/internal/evidence"
+)
+
+// Ingest normalizes, redacts and stores telemetry.
+//
+// Redaction happens here rather than at the query side because the evidence
+// store is append-only: anything written unredacted stays unredacted forever.
+// The filter belongs on the way in, where there is still a decision to make.
+type Ingest struct {
+	store  evidence.Store
+	policy RedactionPolicy
+	iface  contract.InterfaceID
+	now    func() time.Time
+}
+
+// NewIngest returns an ingest pipeline.
+func NewIngest(store evidence.Store, iface contract.InterfaceID, policy RedactionPolicy) (*Ingest, error) {
+	if err := policy.Validate(); err != nil {
+		return nil, err
+	}
+	return &Ingest{store: store, policy: policy, iface: iface, now: time.Now}, nil
+}
+
+// ErrWrongInterface reports telemetry submitted for another interface.
+var ErrWrongInterface = errors.New("telemetry belongs to a different interface")
+
+// Normalize fills in defaults and applies redaction.
+//
+// It is separated from Write so the same normalization runs whether an event
+// arrives from the in-process emitter or over the ingest endpoint. Two paths
+// with two normalizations would eventually disagree, and the disagreement would
+// surface as a pressure finding that is really a bug in the pipeline.
+func (i *Ingest) Normalize(ev contract.FluidTelemetry) (contract.FluidTelemetry, error) {
+	if ev.InterfaceID == "" {
+		ev.InterfaceID = i.iface
+	}
+	if ev.InterfaceID != i.iface {
+		return ev, fmt.Errorf("%w: event is for %q, ingest serves %q",
+			ErrWrongInterface, ev.InterfaceID, i.iface)
+	}
+
+	if ev.SchemaVersion == "" {
+		ev.SchemaVersion = "0.1"
+	}
+	if ev.ID == "" {
+		ev.ID = newID("tl-")
+	}
+	if ev.OccurredAt.IsZero() {
+		ev.OccurredAt = i.now().UTC()
+	}
+	ev.OccurredAt = ev.OccurredAt.UTC()
+
+	if ev.Kind == "" {
+		// Infer from shape rather than defaulting to "request": an error event
+		// filed as a request would understate the interface's failure rate.
+		switch {
+		case ev.Error != nil:
+			ev.Kind = contract.FluidTelemetryKindError
+		case ev.Adoption != nil:
+			ev.Kind = contract.FluidTelemetryKindAdoption
+		case ev.Sequence != nil:
+			ev.Kind = contract.FluidTelemetryKindSequence
+		default:
+			ev.Kind = contract.FluidTelemetryKindRequest
+		}
+	}
+	if !ev.Kind.Valid() {
+		return ev, fmt.Errorf("unknown telemetry kind %q", ev.Kind)
+	}
+
+	// Raw payload capture is not the default (Blueprint 6.2). Where a policy
+	// forbids it, error detail is the only free-text field that survives, and
+	// it is scrubbed below.
+	if !i.policy.AllowRawPayload && ev.Error != nil && ev.Error.Detail != "" {
+		if len(ev.Error.Detail) > 512 {
+			ev.Error.Detail = ev.Error.Detail[:512] + "…"
+		}
+	}
+
+	i.policy.Apply(&ev)
+	return ev, nil
+}
+
+// Write normalizes and stores one event.
+func (i *Ingest) Write(ctx context.Context, ev contract.FluidTelemetry) error {
+	normalized, err := i.Normalize(ev)
+	if err != nil {
+		return err
+	}
+	return i.store.WriteTelemetry(ctx, normalized)
+}
+
+// WriteBatch stores several events, reporting how many landed.
+//
+// A malformed event in a batch does not discard the rest. Telemetry is
+// best-effort evidence, and dropping a hundred good events because one was
+// wrong would lose more than it protects.
+func (i *Ingest) WriteBatch(ctx context.Context, events []contract.FluidTelemetry) (accepted int, rejected []error) {
+	for _, ev := range events {
+		if err := i.Write(ctx, ev); err != nil {
+			rejected = append(rejected, err)
+			continue
+		}
+		accepted++
+	}
+	return accepted, rejected
+}
+
+// RecordFeedback stores explicit consumer feedback.
+//
+// FluidAPIStandards.md section 15: feedback is evidence and must not itself
+// authorize interface changes. It is stored as a record and an event, and
+// nothing here creates pressure or a hypothesis from it — that stays a
+// deliberate step someone takes.
+func (i *Ingest) RecordFeedback(ctx context.Context, f contract.FluidFeedback) (contract.FluidFeedback, error) {
+	if f.Goal == "" {
+		// Feedback with no stated goal cannot be interpreted later; the goal is
+		// the part that says what the consumer was actually trying to do.
+		return f, errors.New("feedback must state a goal")
+	}
+
+	if f.SchemaVersion == "" {
+		f.SchemaVersion = "0.1"
+	}
+	if f.ID == "" {
+		f.ID = contract.FeedbackID(newID("F-"))
+	}
+	if err := contract.RequireKind(string(f.ID), contract.KindFeedback); err != nil {
+		return f, err
+	}
+	if f.InterfaceID == "" {
+		f.InterfaceID = i.iface
+	}
+	if f.InterfaceID != i.iface {
+		return f, fmt.Errorf("%w: feedback is for %q", ErrWrongInterface, f.InterfaceID)
+	}
+	if f.ReceivedAt.IsZero() {
+		f.ReceivedAt = i.now().UTC()
+	}
+
+	// Consumers write free text; it passes the same filter as everything else.
+	f.Goal, _ = i.policy.Scrub(f.Goal)
+	f.Outcome, _ = i.policy.Scrub(f.Outcome)
+	f.Attempt, _ = i.policy.Scrub(f.Attempt)
+	f.MissingCapability, _ = i.policy.Scrub(f.MissingCapability)
+
+	body, err := marshalFeedback(f)
+	if err != nil {
+		return f, err
+	}
+	if err := i.store.PutRecord(ctx, contract.KindFeedback, string(f.ID), body); err != nil {
+		return f, err
+	}
+
+	if err := i.store.AppendEvent(ctx, contract.FluidEvent{
+		SchemaVersion: "0.1",
+		ID:            contract.EventID(fmt.Sprintf("EV-%s-%d", f.ID, i.now().UnixNano())),
+		OccurredAt:    f.ReceivedAt,
+		EntityType:    contract.FluidEventEntityTypeFeedback,
+		EntityID:      string(f.ID),
+		EventType:     "FEEDBACK_RECEIVED",
+		// The consumer is the actor, and a consumer is untrusted (Blueprint 47).
+		// Recording them as the actor keeps that visible in the audit trail.
+		Actor:  contract.Actor{Type: contract.ActorTypeConsumer, ID: consumerLabel(f)},
+		Reason: f.Goal,
+	}); err != nil {
+		return f, err
+	}
+
+	return f, nil
+}
+
+// newID generates an identifier with the given prefix.
+func newID(prefix string) string {
+	var b [10]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		return prefix + "0"
+	}
+	return prefix + hex.EncodeToString(b[:])
+}

internal/observation/ingest_test.go

@@ -0,0 +1,264 @@
+package observation
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	_ "modernc.org/sqlite"
+
+	"github.com/tegwick/fluid-core/internal/contract"
+	"github.com/tegwick/fluid-core/internal/evidence"
+)
+
+func newIngest(t *testing.T) (*Ingest, *evidence.SQLStore) {
+	t.Helper()
+	store, err := evidence.OpenSQLite(context.Background(), filepath.Join(t.TempDir(), "e.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = store.Close() })
+
+	in, err := NewIngest(store, "hall-publishing", testPolicy())
+	if err != nil {
+		t.Fatal(err)
+	}
+	return in, store
+}
+
+func TestIngestRejectsUnsaltedPolicy(t *testing.T) {
+	store, err := evidence.OpenSQLite(context.Background(), filepath.Join(t.TempDir(), "e.db"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer store.Close()
+
+	if _, err := NewIngest(store, "x", RedactionPolicy{}); !errors.Is(err, ErrNoSalt) {
+		t.Errorf("an unsalted ingest was constructed: %v", err)
+	}
+}
+
+// TestRedactionHappensOnTheWayIn: the store is append-only, so anything written
+// unredacted stays that way forever.
+func TestRedactionHappensOnTheWayIn(t *testing.T) {
+	ctx := context.Background()
+	in, store := newIngest(t)
+
+	err := in.Write(ctx, contract.FluidTelemetry{
+		ConsumerRef: "bernd@example.com",
+		Request:     &contract.FluidTelemetryRequest{Route: "/v1/entries?token=hunter2", Method: "GET"},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rows, err := store.Telemetry(ctx, evidence.TelemetryFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("stored %d rows, want 1", len(rows))
+	}
+
+	stored := rows[0]
+	if strings.Contains(stored.ConsumerRef, "@") {
+		t.Errorf("raw consumer identity reached the store: %q", stored.ConsumerRef)
+	}
+	if strings.Contains(stored.Request.Route, "hunter2") {
+		t.Errorf("credential reached the store: %q", stored.Request.Route)
+	}
+	if stored.Redaction == nil || !stored.Redaction.Applied {
+		t.Error("redaction was applied but not recorded on the stored event")
+	}
+}
+
+// TestKindIsInferredFromShape: an error event filed as a request would
+// understate the interface's failure rate.
+func TestKindIsInferredFromShape(t *testing.T) {
+	in, _ := newIngest(t)
+
+	got, err := in.Normalize(contract.FluidTelemetry{
+		Error: &contract.FluidTelemetryError{Class: contract.FluidTelemetryErrorClassTimeout},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Kind != contract.FluidTelemetryKindError {
+		t.Errorf("kind = %s, want error", got.Kind)
+	}
+
+	got, err = in.Normalize(contract.FluidTelemetry{
+		Adoption: &contract.FluidTelemetryAdoption{Event: contract.FluidTelemetryAdoptionEventFirstUse},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Kind != contract.FluidTelemetryKindAdoption {
+		t.Errorf("kind = %s, want adoption", got.Kind)
+	}
+}
+
+func TestNormalizeFillsDefaultsAndGuardsInterface(t *testing.T) {
+	in, _ := newIngest(t)
+
+	got, err := in.Normalize(contract.FluidTelemetry{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.ID == "" || got.OccurredAt.IsZero() || got.SchemaVersion == "" {
+		t.Errorf("defaults not filled: %+v", got)
+	}
+	if got.InterfaceID != "hall-publishing" {
+		t.Errorf("interface = %q", got.InterfaceID)
+	}
+
+	// Another interface's telemetry must not land in this evidence store.
+	if _, err := in.Normalize(contract.FluidTelemetry{InterfaceID: "some-other-api"}); !errors.Is(err, ErrWrongInterface) {
+		t.Errorf("foreign telemetry accepted: %v", err)
+	}
+}
+
+// TestBatchKeepsGoodEventsWhenOneIsBad: dropping a hundred good events because
+// one was malformed loses more than it protects.
+func TestBatchKeepsGoodEventsWhenOneIsBad(t *testing.T) {
+	ctx := context.Background()
+	in, store := newIngest(t)
+
+	accepted, rejected := in.WriteBatch(ctx, []contract.FluidTelemetry{
+		{Request: &contract.FluidTelemetryRequest{Route: "/a"}},
+		{InterfaceID: "wrong-interface"},
+		{Request: &contract.FluidTelemetryRequest{Route: "/b"}},
+	})
+
+	if accepted != 2 {
+		t.Errorf("accepted = %d, want 2", accepted)
+	}
+	if len(rejected) != 1 {
+		t.Errorf("rejected = %d, want 1", len(rejected))
+	}
+
+	rows, _ := store.Telemetry(ctx, evidence.TelemetryFilter{})
+	if len(rows) != 2 {
+		t.Errorf("stored %d rows, want 2", len(rows))
+	}
+}
+
+func TestErrorDetailIsBoundedWhenRawPayloadIsOff(t *testing.T) {
+	in, _ := newIngest(t)
+
+	long := strings.Repeat("x", 2000)
+	got, err := in.Normalize(contract.FluidTelemetry{
+		Error: &contract.FluidTelemetryError{
+			Class:  contract.FluidTelemetryErrorClassBackendFailure,
+			Detail: long,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got.Error.Detail) > 600 {
+		t.Errorf("error detail was not bounded: %d chars", len(got.Error.Detail))
+	}
+}
+
+func TestFeedbackIsStoredAsEvidence(t *testing.T) {
+	ctx := context.Background()
+	in, store := newIngest(t)
+
+	cohort := contract.CohortID("coding-agents")
+	got, err := in.RecordFeedback(ctx, contract.FluidFeedback{
+		Cohort:            &cohort,
+		Goal:              "publish a hall entry without splitting it by hand",
+		MissingCapability: "long-form serialization",
+		Outcome:           "capability unavailable, contact bernd@example.com",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if got.ID == "" || !strings.HasPrefix(string(got.ID), "F-") {
+		t.Errorf("feedback id = %q, want an F- prefix", got.ID)
+	}
+	// Consumers write free text; it passes the same filter as everything else.
+	if strings.Contains(got.Outcome, "bernd@example.com") {
+		t.Errorf("an address survived in feedback: %q", got.Outcome)
+	}
+
+	if _, err := store.Record(ctx, contract.KindFeedback, string(got.ID)); err != nil {
+		t.Errorf("feedback was not persisted: %v", err)
+	}
+
+	events, err := store.Events(ctx, evidence.EventFilter{EntityID: string(got.ID)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(events) != 1 {
+		t.Fatalf("feedback left %d events, want 1", len(events))
+	}
+	// A consumer is untrusted; recording them as the actor keeps that visible.
+	if events[0].Actor.Type != contract.ActorTypeConsumer {
+		t.Errorf("actor type = %s, want consumer", events[0].Actor.Type)
+	}
+}
+
+func TestFeedbackNeedsAGoal(t *testing.T) {
+	in, _ := newIngest(t)
+	// Without a goal there is nothing to interpret later.
+	if _, err := in.RecordFeedback(context.Background(), contract.FluidFeedback{
+		Outcome: "it did not work",
+	}); err == nil {
+		t.Error("feedback with no goal was accepted")
+	}
+}
+
+// TestFeedbackDoesNotCreatePressure is the section 15 boundary: feedback is
+// evidence and must not itself authorize a change.
+func TestFeedbackDoesNotCreatePressure(t *testing.T) {
+	ctx := context.Background()
+	in, store := newIngest(t)
+
+	if _, err := in.RecordFeedback(ctx, contract.FluidFeedback{
+		Goal:              "I need a bulk publish endpoint",
+		MissingCapability: "bulk publish",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	records, err := store.Records(ctx, contract.KindPressure)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(records) != 0 {
+		t.Errorf("feedback created %d pressure records on its own", len(records))
+	}
+}
+
+func TestIngestIsUsableAsARuntimeSink(t *testing.T) {
+	ctx := context.Background()
+	in, store := newIngest(t)
+
+	// The gateway's emitter writes through this interface; redaction must apply
+	// on that path too, not only to events arriving over the endpoint.
+	var sink interface {
+		Write(context.Context, contract.FluidTelemetry) error
+	} = in
+
+	if err := sink.Write(ctx, contract.FluidTelemetry{
+		ConsumerRef: "raw-identity",
+		OccurredAt:  time.Now(),
+		Request:     &contract.FluidTelemetryRequest{Route: "/v1/x"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	rows, _ := store.Telemetry(ctx, evidence.TelemetryFilter{})
+	if len(rows) != 1 {
+		t.Fatalf("stored %d rows", len(rows))
+	}
+	if rows[0].ConsumerRef == "raw-identity" {
+		t.Error("the emitter path bypassed redaction")
+	}
+}