feat: report clamped settings via §19 ConfigClamped (contract 1.9)

[ilpanich]

Retrofit of contract 1.9's §19.2 rule 6 to this SDK, which merged before the rule existed.

Why

Two places in the contract require clamping rather than rejecting. Clamping is right — rejecting would break a caller whose configuration was merely optimistic, and honoring would let one client become the herd §16 exists to prevent. Doing it silently is the part that is wrong.

An operator who sets a 60-second decision-memo TTL believes their staleness bound is 60 seconds. It is five. Every conclusion they draw about how stale an allowed can be is wrong by a factor of twelve, and before this event nothing anywhere said so.

Scope here is narrower than in C#

This SDK's only caller-facing clamp is §17.1 rule 2's memo TTL. §16's attempt cap, base delay and delay cap are constants with no knob to raise — deliberately, per §16.1 — so there is nothing to report for them. That is why the event carries only decision_memo_ttl.

(The C# SDK is the opposite case: its three retry settings were publicly settable upward, which is what prompted the rule.)

report_clamp is called from the builder, not from DecisionMemo::new, because the telemetry sink is assembled in the same expression and construction is the only moment an operator can act on the report.

Three tests, two of them for what it must not do

Case	Expected
60 s TTL	exactly one event naming decision_memo_ttl, effective value rendering the 5 s cap
2 s TTL	nothing — already inside the limit
disabled default	nothing

That last one matters more than it looks: without it, every client ever built would fire a zero-to-zero "clamp", and an event that fires when nothing happened trains its reader to ignore it.

Verification

Gate	Result
cargo test --all-features	every binary green, 3 new
cargo clippy --all-targets --all-features -- -D warnings	clean
cargo fmt --all --check	clean
cargo doc --all-features --no-deps with RUSTDOCFLAGS=-D warnings	clean

Re-vendors CONTRACT.md at 1.9.

Notes

• The branch was force-pushed with --force-with-lease after confirming its prior head was content-identical to main (squash-merged in feat: contract 1.8 — §16 retry, §17 memo, §18 close(), §19 telemetry (D5) #45).
• Five more SDKs need this retrofit: typescript, python, go, java, kotlin. C# and PHP already have it.
• No open issues in this repository to reference.

---

Generated by Claude Code