feat(analytics): recover desktop instrumentation and consent-safe delivery

[yaacovcorcos]

What changed

Recover the useful unfinished desktop analytics work onto current main, preserving the original dirty worktree and its snapshot. Extend the existing Scient contract/worker instead of adding a second telemetry system or altering provider-management ownership.

• Strict 45-event revision-2 contract and generated gateway fixture; Pi included and inherited terminal-event double counting suppressed.
• Bounded, non-blocking observations at actual provider/scientific workflow outcomes, plus best-effort renderer termination reporting without raw crash content.
• Consent epochs, bounded queues/retries, authenticated deletion and identity rotation. Review-found startup, deletion-buffer and retry-recovery races are fixed and covered by regression tests.
• Recognized packaged releases make the settings available. Missing preferences default to usage/reliability sharing; saved Off and narrower preferences are preserved. Explicit development QA uses only a loopback test destination, never a third-party telemetry host.

Qualification and limitations

• Focused runtime, contract, service, observer, desktop and renderer tests passed.
• Formatting and merged-head lint passed. Full type checking found one exact-optional-property error in the QA endpoint; it was corrected and server type checking then passed (the other tasks had passed).
• Production server/web/desktop bundles passed; the final candidate was rebuilt and its Electron/gateway pipeline proof passed again.
• Initial recursive run passed all non-server tasks. The final local server run finished with 6050 passes, 63 skips and two router-test failures: requests received OpenCode HTML instead of expected JSON. Both tests passed in isolation, and all 208 tests in the router file passed on rerun. This does not erase the failed full-run result or establish its root cause; clean CI qualification remains separate.
• Independent read-only review's concrete consent/deletion/lifecycle findings were fixed and rechecked. Live production PostHog/D1 behavior and human product acceptance are not proved by synthetic tests.

Integration readiness

Owner reviewed the desktop UI and authorized merge/auto-merge; production activation remains separate. The candidate includes main's provider-update fix #254 through a normal merge. Gateway validation/migrations must land and be deployed before releasing these producers. The companion gateway PR keeps both production gates disabled pending qualification.

The manual candidate has fresh isolated state and a local-only gateway without PostHog credentials. Stable Scient and original dirty worktrees are untouched.

Documentation impact: Updated — docs/internals/product-analytics.md and scient-analysis-seams.json. Dependent PRs: gateway/privacy #33 and Scient policy #108.

AI assistance: Codex (GPT-5-based agent), Codex desktop harness; independent read-only reviewer. No agent visual acceptance substitutes for the owner's review.

Latest reviewed UI/defaults checkpoint

• One Share usage and reliability switch, compact shared information and deletion confirmation.
• Prepared notification remains disabled at the root mount. No status read, toast, dismissal write or notification lifecycle listener runs while disabled. Audience/timing selection is deferred. Collection controls and production gateway gates are unchanged.
• Retained notification covers explicit dismissal, leaving the screen/app, environment boundaries and stale status responses. New subscription-faithful test mocks cover compiler-cached wrappers; three pre-push failures with nonreactive mocks were corrected without weakening assertions or changing runtime behavior.
• Latest local checks: 23 UI tests across three files; 11 backend service/control tests; web and server type checks; scoped formatting/lint and whitespace checks. Lint retains existing warnings in the settings effect and root route. Full repository checks/build are not claimed rerun for this increment; CI must qualify this new head.
• Yaacov reviewed the UI interactively and requested notification activation be deferred. No agent visual review or application restart in this publication pass.
• Latest main (fix(release): render paragraph release notes in preflight #257) incorporated through a normal merge; no conflicts.
• Owner authorized merge/auto-merge. Coverage/dashboard follow-up and production activation remain separate.

Documentation impact: Updated — docs/internals/product-analytics.md and docs/user/telemetry.md; companion privacy/plan PRs synchronized with disabled notification.

CI failure resolved

The failed Web 1 shard had 2,377 passing assertions and one unhandled exception: the existing fileEditorLanguageReadiness test removed animation-frame globals before Pierre's final queued worker-state broadcast. Teardown now awaits the public stopped-state subscription receipt as well as worker termination. No production editor code or assertion was weakened. 30 focused editor/analytics UI tests and web type checking passed. Web 1 now passes on CI. Merge-commit auto-merge is enabled on the exact corrected head; remaining required checks still gate integration.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+1 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	+3 B (+0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.2 KiB	56.2 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.5 KiB	13.6 KiB	+106 B (+0.8%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−1 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.5 KiB	+107 B (+1.6%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	57.0 KiB	57.8 KiB	+840 B (+1.4%)	66.4 KiB	✅
Claude	Live turn messages	8	8	0 (0.0%)	21	✅

Baseline: dfa5312 · PR result: 1b42747 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.9 KiB
• Claude decoded thread snapshot: 114.6 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.