chore(telemetry): implement robust path-confusion stall guard, persist verify signatures correctly, and redact secrets from telemetry logs

app/api/chat/route.ts

@@ -883,6 +883,13 @@ export async function POST(request: Request) {
       let toolCallsSinceText = 0;
       let loopBreakReason: string | null = null;
 
+      // ── Phase & Intent State ──
+      const turnIntent = classifyTurnIntent(message);
+      const maxToolRounds = activeMcpToken ? TOOL_BUDGETS[turnIntent] : 0;
+      let phase: AgentPhase = "recon";
+      let checkpointEmitted = false;
+      let verificationPassed = false;
+
       // ── Server-side conversational guard (C-03 enforcement) ───────────
       // If the user's message looks conversational we withhold tools for
       // round 1. The model MUST respond in text first. If its reply then
@@ -915,13 +922,6 @@ export async function POST(request: Request) {
       let fileHashes = new Map<string, string>();
       let stallRounds = 0;
 
-      // ── Phase & Intent State ──
-      const turnIntent = classifyTurnIntent(message);
-      const maxToolRounds = activeMcpToken ? TOOL_BUDGETS[turnIntent] : 0;
-      let phase: AgentPhase = "recon";
-      let checkpointEmitted = false;
-      let verificationPassed = false;
-
       emit({ type: "phase", phase, label: "Investigating & Planning" });
 
       try {