rootle's opt-in diagnostic session sink: one private, bounded JSONL file per session, written by a dedicated thread.
Producers never perform file I/O, never wait for the writer, and never
wait for queue capacity — a full queue, an oversize record, a cap or a
writer failure is an explicit capture failure surfaced through
[take_failure] and [TraceSession::finish], never a silent drop.
Only the writer thread touches the file, flushing every batch it
receives, and every file it closes ends with a terminal trace_end
marker stating whether the capture is complete and why. A capped,
failed, panicked or abandoned capture can never look complete, and a
crash that prevents the marker leaves its absence as the verdict.
Envelopes carry schema_version, the writer-owned seq, elapsed_us,
a thread label, the thread's optional operation_id correlation, the
event kind and producer fields; sequence and timestamps agree with
admission order under concurrent producers.
Metadata capture is diagnostic, not anonymous: paths, repository
identities, revisions and timing can still be sensitive — inspect files
before sharing. Nothing here ever prints to stdout/stderr; the only
outputs are the file and explicit Results.