[kwisatzh]

Summary

Closes #80 in the next release only. The published v0.13.0 tag and artifacts are unchanged; no version bump, release, installer, dependency or workflow change is included.

• Read only the exact, case-sensitive Langfuse level enum: DEFAULT, DEBUG, WARNING, ERROR. Normalize missing/null/empty/non-string/unrecognized levels to a fixed unknown label; no aliases, trimming or coercion.
• Keep provider call status unknown for every Langfuse observation. Non-error severity is not proof of provider success, receipt completeness or final billing. Per-request splits remain unavailable.
• Remove severity-only usage-review noise for DEFAULT/DEBUG/WARNING. Preserve other accounting flags. ERROR and unknown levels require review; ERROR is an observation error, not a confirmed failed provider call.
• Add bounded enum counters and ERROR-observation token subsets to period/model windows, with unknown finality and unchanged overall tokens/cost. Existing LiteLLM output goldens remain unchanged.
• Include normalized severity in duplicate conflict checks and every completed-snapshot replay digest. SQL status projections cannot inject adapter severity semantics.

Privacy

JSON retains at most a 44-byte enum lookahead (enough for seven fully escaped ASCII characters); CSV buffers at most seven enum bytes and discards an overlong value while validating the rest. Only recognized enum strings or the fixed unknown label enter the projected row. Existing row/file/directory bounds remain in force.

Observation input/output/metadata/tool_calls/status_message values are still syntax-scanned and discarded, never decoded into payload strings or printed. Tests cover all four enums, escaped keys/values, whitespace, missing/null/invalid/long/nested values, duplicate/conflicting projections, cross-format normalization, late malformed data, and privacy sentinels.

Verification

• Offline Go 1.26.10: full go test -race -p 2 ./... and go vet -p 2 ./....
• All packaged-command regressions, including severity/error/privacy text and JSON checks against a source-built binary.
• Six JSON/JSONL/CSV plain/gzip formats, small transport chunks, and unchanged accounting totals.
• Existing stopped native-capture regression: sealed payload integrity, six actual formats, twelve manifests and cross-format deduplication; no Docker restart or new capture.
• Existing LiteLLM regression goldens and private-field boundaries.

Supplied Review And Final Fixes

Vijay supplied Claude's review approving the enum parsing, bounds, privacy and semantics. The six requested pre-merge fixes are included:

• One nonzero-only observation-level summary in the completeness section, plus an ERROR-token line only for nonzero tokens. JSON fields are unchanged.
• Short call-status wording; no inline enum tutorial.
• Public Langfuse documentation continues to describe v0.13.0. The unreleased severity section is deferred to the next release PR.
• Correct v0.13.0's changelog date to 2026-10-24; retain the Unreleased entry.
• DEFAULT-enriched synthetic example with exact manifest sizes, clean next-release output and verified compatibility with the unchanged published v0.13.0 binary.
• Duplicate conflicts name only a fixed approved field (for example level), never its value. Fixed-size field hashes preserve normalized deduplication and private diagnostics.

Vijay authorized merge only after green final heads. No release is authorized. No automatic contact or fabricated reviewer identity is involved; the supplied review and instructions came directly through Vijay.