Keep token usage label maps within their bound when merged

internal/proxy/token_usage.go

@@ -937,8 +937,9 @@ func (c *tokenUsageCounts) add(other tokenUsageCounts) {
 }
 
 // addTokenUsageLabelCounts adds src into dst, which it allocates when needed
-// and never shares with src. Past tokenUsageMaxLabelKeys distinct labels,
-// new ones count under "other", so a row stays small.
+// and never shares with src. Once dst holds tokenUsageMaxLabelKeys-1 distinct
+// labels, new ones count under "other", which keeps the last slot, so a row
+// never exceeds tokenUsageMaxLabelKeys keys whatever order src iterates in.
 func addTokenUsageLabelCounts(dst, src map[string]int64) map[string]int64 {
 	for label, count := range src {
 		if count == 0 {
@@ -947,7 +948,7 @@ func addTokenUsageLabelCounts(dst, src map[string]int64) map[string]int64 {
 		if dst == nil {
 			dst = map[string]int64{}
 		}
-		if _, exists := dst[label]; !exists && len(dst) >= tokenUsageMaxLabelKeys {
+		if _, exists := dst[label]; !exists && len(dst) >= tokenUsageMaxLabelKeys-1 {
 			label = tokenUsageOverflowLabel
 		}
 		dst[label] += count

internal/proxy/token_usage_metadata_test.go

@@ -564,3 +564,25 @@ func TestProxyRecordsWebSocketTurnLatencyAndStop(t *testing.T) {
 		t.Fatalf("row = %+v", row)
 	}
 }
+
+func TestAddTokenUsageLabelCountsKeepsBoundWhenMergingAFullMap(t *testing.T) {
+	full := map[string]int64{tokenUsageOverflowLabel: 1}
+	for i := range tokenUsageMaxLabelKeys {
+		full[fmt.Sprintf("reason_%d", i)] = 1
+	}
+	// Map iteration order varies, so merge repeatedly: "other" arriving last
+	// must not become one key too many.
+	for range 50 {
+		got := addTokenUsageLabelCounts(nil, full)
+		if len(got) > tokenUsageMaxLabelKeys {
+			t.Fatalf("merged labels = %d keys, want at most %d", len(got), tokenUsageMaxLabelKeys)
+		}
+		var total int64
+		for _, count := range got {
+			total += count
+		}
+		if total != int64(len(full)) {
+			t.Fatalf("merged total = %d, want %d", total, len(full))
+		}
+	}
+}