milestone 16: behavioral fixes for silent failures, locks, counters and the query log

src/platform/logging.zig

@@ -102,10 +102,12 @@ pub fn boundedScopeName(scope_name: []const u8) []const u8 {
 // ---------------------------------------------------------------------------
 
 /// PLAN §11.6 rate-limits exactly the scopes whose failures repeat once per
-/// query; every other scope logs unconditionally.
+/// query; every other scope logs unconditionally. `.tls_server` joins them
+/// (milestone-16 ruling 16): its warnings are peer-driven, so an unhappy client
+/// could otherwise evict genuine warnings from the rotating log.
 pub fn isDedupScope(comptime scope: @EnumLiteral()) bool {
     return scope == .doh_client or scope == .dot_client or
-        scope == .pool or scope == .forward_client;
+        scope == .pool or scope == .forward_client or scope == .tls_server;
 }
 
 pub fn buildKey(
@@ -651,13 +653,16 @@ test "enabled admits at and above the threshold only" {
     try testing.expect(enabled(.debug, .debug));
 }
 
-test "isDedupScope selects exactly the four upstream scopes" {
+test "isDedupScope selects exactly the four upstream scopes and tls_server" {
     try testing.expect(isDedupScope(.doh_client));
     try testing.expect(isDedupScope(.dot_client));
     try testing.expect(isDedupScope(.pool));
     try testing.expect(isDedupScope(.forward_client));
+    try testing.expect(isDedupScope(.tls_server));
     try testing.expect(!isDedupScope(.default));
     try testing.expect(!isDedupScope(.cache));
+    try testing.expect(!isDedupScope(.dot_server));
+    try testing.expect(!isDedupScope(.doh_server));
 }
 
 test "buildKey separates the scope from the message" {