fix(observe): gate the filter ledger behind Ctx.Stats() so observe records nothing enforced

[OsherElhadad]

Closes #46.

The leak

cmdfilter called c.FilterStats with no mode check, so an observe-only run — zero enforced requests, sync_enforced: 0 — still reported real-looking entries:

"cmdfilter_families": {"tests": {"acts": 1, "saved_tokens": 1787}},
"cmdfilter_filters":  {"pytest": {"acts": 1, "saved_tokens": 1787}},
"cmdfilter_selector_misses": [ … ]

Those tokens were never saved — nothing was forwarded.

Why these three fields, and not the two observe deliberately shares

#43 correctly keeps two enforced-namespace fields populated in observe mode:

• cg_added_ms_avg — a true measurement of the enforced path, and its reading of ~0 is observe's headline result. Zeroing it would hide a real number.
• llm_calls/llm_*_tokens — real money actually spent measuring off-path. Relabelling real spend as potential_* would be a worse lie. Labelled via observe_llm_notice.

These three are different: no mode label, no potential_* counterpart. A consumer cannot tell them from real savings. That is exactly the failure #31 named as its primary correctness risk — a mislabelled hypothetical is worse than no number, because it silently inflates the product's own headline claim.

The fix is an accessor, not a call-site check

func (c *Ctx) Stats() FilterStatsSink {
	if c == nil || c.Mode == ModeObserve {
		return nil
	}
	return c.FilterStats
}

Gating at Ctx rather than at cmdfilter's two call sites is deliberate: a component author reaching for c.FilterStats has no reason to think about operating modes, so the next sink added to Ctx would reproduce this bug exactly. An accessor makes the safe path the only convenient one. The field's doc comment now says to read it through Stats().

Provenance

This is new leakage from #42 × #43 composing — neither PR's own review could see it, because the stats sink and observe mode landed independently and each was correct in isolation. Found by the integration review of the five merges, which is the class of defect per-PR review structurally cannot catch.

Test

TestObserveModeDoesNotRecordFilterStats drives the component in both modes and asserts sync does record — otherwise a broken sink would pass it for the wrong reason.

Verified non-vacuous. With the gate removed it reproduces the reported symptom:

--- FAIL: TestObserveModeDoesNotRecordFilterStats
    mode=observe: 1 ledger events (acts=1 misses=0), wantRecord=false

Gates

go build -tags cg_skeleton ./... · go test -tags cg_skeleton ./... · go test -race ./components/... ./proxy/... · gofmt -l · go vet — all clean.

Note on the remaining integration findings

#45 (the volatile-tail split is a silent no-op on Bedrock Converse), #47 (pin-budget exhaustion reopening the TailOnly fail-open on /compact only) and #48 (the selector-miss ledger bounding key count but not key size) are still open and unaddressed by this PR.