fix(#51): clone config defaults, null-unset route overrides, resettable session, telemetry on every command

[bigknoxy]

Closes #51.

Four real defects from the long-tail sweep; three of the seven items in the issue (3, 4, 5) were already fixed by #40 and #105 and are covered by existing tests.

1. loadConfig aliased the default telemetry object

A shallow spread of the frozen DEFAULT_CONFIG left the nested telemetry object shared. One caller mutating its own config silently rewrote the defaults for the rest of the process. Invisible in the CLI (one process, one call); a cross-request leak in the MCP server and any library embedding. cloneDefaults() deep-clones.

2. Route-policy overrides could not be unset

A higher-priority config could add or change an override but never remove one, so a global "always diff for Python" policy could not be opted out of per project. The override maps are now Record<string, EditRoute | null>; mergeOverrides treats an explicit null as "unset", and policyForce coerces null to undefined.

3. Telemetry session id was fixed for process lifetime

A module-level const meant a long-lived host reported every event under one session forever. newSession() and setSessionId(id) added and re-exported from the barrel.

4. Roughly half the CLI commands emitted no telemetry event

Health reports therefore undercounted usage. Rather than thread recordEvent through ~20 actions with several finish() sites each, the fallback event is emitted inside finish() itself — the single choke point every command funnels through — gated on getRecordedEventCount() === 0 so richer per-command events are never double-counted. telemetry * and uninstall are exempt: recording there would grow the very log being inspected, or outlive the directory being removed. (Commander postAction hooks were considered and rejected: the CLI uses sync program.parse() with async actions.)

Verification

• tests/longtail-51.test.ts — 10 tests. Items 1 and 2 run as a child-process probe under an isolated HOME, because a real global config on the dev machine rebuilds the nested object and masks the aliasing. Item 4 enumerates commands in child processes and asserts exactly one event each with elapsed_ms > 0, plus a test that telemetry summary writes nothing.
• Falsification: stashing src/core/config.ts → 3 failures (items 1, 2); stashing src/core/exit-codes.ts → 2 failures (item 4).
• Full suite 866 pass / 0 fail across 42 files; bun run lint:docs clean; no scratch leftovers.
• No bench case: these are config and telemetry defects, outside the bench harness's edit-correctness model.

🤖 Generated with Claude Code

[bigknoxy]

🎉 This PR is included in version 4.4.15 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀