Stabilize diagnostic export and preserve authorized policy continuity

apps/browser/main.cjs

@@ -240,7 +240,11 @@ async function applyPolicyImpl(envelope){
     // Same versions must describe identical policy; reject equivocation.
     if(JSON.stringify(next)!==JSON.stringify(policy))throw Error('Policy changed without a new version');acceptBookmarks();await diagnosticSpan('browser.policy',{operation:'policy.agent-reconcile'},()=>reconcileAgentPolicy());enforceEvidencePolicy();if(Date.parse(policy.expiresAt)>Date.now())configureDiagnostics(policy.diagnostics);emit();return;
   }
-  configureDiagnostics({enabled:false});quarantine('Applying company policy…');
+  // The signed policy and bookmark assignment have been verified above. Keep
+  // an unchanged diagnostics authorization alive across a policy-only update;
+  // changed/disabled telemetry or expired authority still cancels immediately.
+  const continueDiagnostics=policy&&policy.version>0&&Date.parse(policy.expiresAt)>Date.now()&&diagnostics.canContinue?.(next.diagnostics,diagnosticContext({policyVersion:next.version}))===true;
+  if(!continueDiagnostics)configureDiagnostics({enabled:false});quarantine('Applying company policy…');
   const proxy=next.proxy;
   const settings={mode:proxy.mode,...(proxy.mode==='fixed_servers'?{proxyRules:proxy.rules,proxyBypassRules:proxy.bypass}:{}),...(proxy.mode==='pac_script'?{pacScript:proxy.pacUrl}:{})};
   localRelay.invalidate();await browserSession.closeAllConnections();