sprints and audit work

src/AirGap/StellaOps.AirGap.Controller/Services/AirGapTelemetry.cs

@@ -26,6 +26,7 @@ public sealed class AirGapTelemetry
     private readonly Queue<(string Tenant, long Sequence)> _evictionQueue = new();
     private readonly object _cacheLock = new();
     private readonly int _maxTenantEntries;
+    private readonly int _maxEvictionQueueSize;
     private long _sequence;
 
     private readonly ObservableGauge<long> _anchorAgeGauge;
@@ -36,6 +37,8 @@ public sealed class AirGapTelemetry
     {
         var maxEntries = options.Value.MaxTenantEntries;
         _maxTenantEntries = maxEntries > 0 ? maxEntries : 1000;
+        // Bound eviction queue to 3x tenant entries to prevent unbounded memory growth
+        _maxEvictionQueueSize = _maxTenantEntries * 3;
         _logger = logger;
         _anchorAgeGauge = Meter.CreateObservableGauge("airgap_time_anchor_age_seconds", ObserveAges);
         _budgetGauge = Meter.CreateObservableGauge("airgap_staleness_budget_seconds", ObserveBudgets);
@@ -146,6 +149,7 @@ public sealed class AirGapTelemetry
 
     private void TrimCache()
     {
+        // Evict stale tenant entries when cache is over limit
         while (_latestByTenant.Count > _maxTenantEntries && _evictionQueue.Count > 0)
         {
             var (tenant, sequence) = _evictionQueue.Dequeue();
@@ -154,6 +158,19 @@ public sealed class AirGapTelemetry
                 _latestByTenant.TryRemove(tenant, out _);
             }
         }
+
+        // Trim eviction queue to prevent unbounded memory growth
+        // Discard stale entries that no longer match current tenant state
+        while (_evictionQueue.Count > _maxEvictionQueueSize)
+        {
+            var (tenant, sequence) = _evictionQueue.Dequeue();
+            // Only actually evict if this is still the current entry for the tenant
+            if (_latestByTenant.TryGetValue(tenant, out var entry) && entry.Sequence == sequence)
+            {
+                _latestByTenant.TryRemove(tenant, out _);
+            }
+            // Otherwise the queue entry is stale and can be discarded
+        }
     }
 
     private readonly record struct TelemetryEntry(long Age, long Budget, long Sequence);