feat: wire the telemetry text cap through settings

`PGW_TELEMETRY_TEXT_CAP` now reaches the emitter on every assembly path.
Unset means no truncation, which stays the default: a truncated row is
no longer audit evidence and cannot be replayed, and downstreams rely on
that today. The flip side — contracts and bids sitting in `llm_calls`
indefinitely, multi-tenant — is spelled out in `.env.example` so readers
can weigh both.

All three `from_settings` paths are wired (chat, embedding, OCR): they
write the same table, so capping only chat would leave half of it
uncontrolled. `TelemetryEmitter.__init__` now rejects `text_cap <= 0`;
it is the single point where the three clients converge, so the direct
construction path — a public assembly route the settings guard never
sees — is covered too. `0` would otherwise reduce every body to a bare
elision marker.

src/polygateway/client.py

@@ -317,6 +317,7 @@ class GatewayClient:
             pricing=PricingTable.from_file(settings.pricing_path)
             if settings.pricing_path is not None
             else None,
+            text_cap=settings.telemetry_text_cap,
             cache=cache if cache is not None else _build_cache(settings),
             cache_namespace=settings.cache_namespace,
             cache_ttl_s=settings.cache_ttl_s,

src/polygateway/config.py

@@ -58,6 +58,8 @@ _TELEMETRY_BACKENDS = frozenset({"sqlite", "postgres", "none"})
 # 遥测 schema 档位(issue #13): auto 允许 recorder 给旧表 ALTER 补列,manual 不发 DDL
 _SCHEMA_MODES = frozenset({"auto", "manual"})
 _SCHEMA_MODE_KEY = "PGW_TELEMETRY_SCHEMA_MODE"
+# 遥测正文字符上限(issue #12);二态键,未设 = 不截断
+_TEXT_CAP_KEY = "PGW_TELEMETRY_TEXT_CAP"
 _REDIS_DEPENDENT_BACKENDS = ("limiter_backend", "breaker_backend", "cache_backend")
 # 背压默认(M1 仅 poll 生效;CHS _BACKOFF_S=0.05 同源)
 _DEFAULT_STALL_WINDOW_S = 300.0
@@ -139,6 +141,11 @@ class GatewaySettings:
     # backend=none 时恒 False 这条跨字段不变量则由 `_validate_telemetry`
     # 把关,对直接构造与 `dataclasses.replace` 同样生效
     telemetry_auto_migrate: bool
+    # 遥测落库正文的字符上限(issue #12);None = 不截断,与本字段出现之前逐字节相同。
+    # 缺省不截断是人类决策: 截断后的遥测不再是审计证据、也无法用于复现与重放,而
+    # 既有下游正依赖这一行为。值域(> 0)由 `_validate_telemetry` 把关,直接构造、
+    # `dataclasses.replace` 与 env 三条路一并覆盖
+    telemetry_text_cap: int | None
     redis_url: str | None
     pricing_path: str | None
     structured_max_retries: int
@@ -224,7 +231,16 @@ class GatewaySettings:
         recorder 消费它,True 是个自相矛盾却无害的状态。`from_env` 那条路的派生
         已经给出 False,归一化是为了直接构造与 `dataclasses.replace` 也一致——
         不变量挂在构造期,才不用每加一个装配工厂就多一处要同步。
+
+        `telemetry_text_cap` 的值域则是**报错**而非归一化: 0 与负数都不是"不截断"
+        的写法(不截断写 None),把它们悄悄改成 None 等于用默认值掩盖调用方的错误。
+        报错文本同时点出字段名与 env 键名,两条装配路的调用方各看得懂自己那套。
         """
+        if self.telemetry_text_cap is not None and self.telemetry_text_cap <= 0:
+            raise ValueError(
+                f"telemetry_text_cap({_TEXT_CAP_KEY})必须 > 0: {self.telemetry_text_cap};"
+                "不截断请不设该键(None),0 只会让每条正文退化成一个省略标记"
+            )
         if self.telemetry_backend == "none" and self.telemetry_auto_migrate:
             object.__setattr__(self, "telemetry_auto_migrate", False)
         if self.telemetry_backend == "sqlite" and not self.telemetry_sqlite_path:
@@ -461,6 +477,7 @@ def _load_pgw(env: Mapping[str, str]) -> dict[str, object]:
         else None,
         "telemetry_pg_dsn": _load_pg_dsn(env) if telemetry_backend == "postgres" else None,
         "telemetry_auto_migrate": auto_migrate,
+        "telemetry_text_cap": _load_text_cap(env),
         "redis_url": redis_url,
         "pricing_path": env.get("PGW_PRICING_PATH") or None,
         "structured_max_retries": _load_structured_retries(env),
@@ -496,6 +513,28 @@ def _load_schema_mode(env: Mapping[str, str], telemetry_backend: str) -> bool:
     return _load_choice(env, _SCHEMA_MODE_KEY, _SCHEMA_MODES, "auto") == "auto"
 
 
+def _load_text_cap(env: Mapping[str, str]) -> int | None:
+    """读 `PGW_TELEMETRY_TEXT_CAP`(issue #12);键未设即 None = 不截断。
+
+    与相邻的 `PGW_TELEMETRY_SCHEMA_MODE` 不同,这个键是**二态**而非三态:
+    "未设"本身就是最终答案(不截断),没有需要按后端派生的第二种缺省,故不必像
+    那边一样先探"设没设"再分两条路取值,读到什么解什么即可。
+
+    值域(> 0)刻意不在此处判: 构造期守卫那道同时覆盖直接构造与
+    `dataclasses.replace`,而报错文本已点出本键名,env 路的调用方不会看丢。
+
+    Args:
+        env: 已合并的环境映射。
+
+    Returns:
+        遥测正文的字符上限;键未设或为空串时返回 None(不截断)。
+    """
+    found = _first(env, _TEXT_CAP_KEY)
+    if found is None:
+        return None
+    return int(_cast(found[1], "int", found[0]))
+
+
 def _strip_dsn_driver(dsn: str) -> str:
     """剥 SQLAlchemy 风格的 `+driver` 后缀(asyncpg 不认);已干净的原样返回。"""
     scheme, sep, rest = dsn.partition("://")

src/polygateway/embedding.py

@@ -563,6 +563,9 @@ class EmbeddingClient:
             pricing=PricingTable.from_file(gw.pricing_path)
             if gw.pricing_path is not None
             else None,
+            # embed 行与 chat 行写同一张 llm_calls;漏传这一条,同表内就一半受控
+            # 一半不受控(issue #12)
+            text_cap=gw.telemetry_text_cap,
             batch_size=settings.batch_size,
             normalize=settings.normalize,
             expected_dim=settings.expected_dim,

src/polygateway/middleware/telemetry.py

@@ -144,7 +144,12 @@ class TelemetryEmitter:
         """`text_cap` 无默认值是有意的: 它是关键行为参数,漏传即静默改变落库正文。
 
         本类是库内部类,唯一构造者是三个公共 Client,必填能保证没有一处漏传。
+        同理,值域校验也放在这一处: 三个 Client 的 `text_cap` 全部汇流到这里,
+        `GatewaySettings` 那道只管 env 一条路,而直接构造 Client 是库承诺的另一
+        条公共装配路——`text_cap=0` 会让每条正文只剩一个省略标记(P5 不得静默)。
         """
+        if text_cap is not None and text_cap <= 0:
+            raise ValueError(f"text_cap 必须 > 0(不截断请传 None): {text_cap}")
         self._recorder = recorder
         self._pricing = pricing
         self._text_cap = text_cap

src/polygateway/ocr.py

@@ -573,6 +573,9 @@ class OcrClient:
             backpressure=gw.backpressure,
             quota_full=gw.quota_full,
             telemetry=telemetry if telemetry is not None else _build_telemetry(gw),
+            # OCR 行与 chat 行写同一张 llm_calls;漏传这一条,同表内就一半受控
+            # 一半不受控(issue #12)
+            text_cap=gw.telemetry_text_cap,
         )
 
     @classmethod