[WRONG BRANCH] fix(usage): bound incremental append reads - #278

Motivation

• The incremental retained-tail reader could read and parse every byte appended since the retained snapshot before applying maxReadBytes, violating the bounded-read contract and risking CPU/memory exhaustion on large append bursts.

Description

• Add an early bound check in readUsageEntriesIncrementally (src/usage/log.ts) that abandons the incremental path and falls back to a bounded full-tail read when size - retained.coveredThroughBytes > maxReadBytes.
• Add a regression test in tests/api-usage.test.ts that verifies a large append burst triggers a bounded full read rather than an unbounded incremental parse.
• Preserve existing API semantics for callers: when the incremental path is refused, the reader performs the existing bounded full read to satisfy maxReadBytes.

Testing

• bun run typecheck completed successfully.
• bun run privacy:scan completed and passed.
• bun test tests/api-usage.test.ts could not complete in this environment due to a runtime import error (zstdDecompressSync not found in node:zlib), so the new test was added but could not be exercised here; the failure appears environmental rather than related to the change.

Codex Task

Summary by CodeRabbit

• Bug Fixes
  • Improved usage-log processing when large bursts of new data exceed the configured read limit.
  • Ensures the system performs a bounded full read and correctly accounts for available entries.