@mentra/engine 3.4.0-dev.1207 → 3.4.0-dev.1209

package/src/services/fleet/fleetQueue.ts

@@ -13,6 +13,13 @@
  *   sequence and the oldest and newest record keys.
  * - `l:<partition>` holds the losses not yet reported: `{dropped, expired, from, to, updatedAt}`.
  * - `n:<partition>` holds the collector-session sequence counters, as `[collectorSessionId, next][]`.
+ * - `t:<partition>` holds the miniapp telemetry lost and not yet reported, per package (`FleetTelemetryLosses`).
+ *
+ * Telemetry (Phase 12) has a share of the queue: a `telemetry_event`'s record ID starts with `tel.`, so its key says
+ * what it is. Telemetry takes at most 2,000 of the 10,000 places. When that share or the queue is full, the oldest
+ * telemetry record gives way, and a record of any other kind never does to telemetry: an arriving record that finds
+ * the queue full evicts the oldest telemetry before anything else. Telemetry that is evicted, expires, or that MFM
+ * rejects is counted per package under `t:`, never as a coverage gap, and the reporter sends it as `telemetry_loss`.
  *
  * MMKV can list keys only by listing all of them, so the first call for a partition in a process scans the store
  * once, repairs the index if a crash left it behind, and keeps the partition's ordered record keys in memory.
@@ -29,7 +36,7 @@
  * `sweepExpired` is how the 7-day bound still holds for it: one scan finds every partition, expires its old
  * records and removes what an empty partition no longer needs.
  */
-import {FLEET_LIMITS, type FleetRecord} from "@mentra/cloud-protocol"
+import {FLEET_LIMITS, FLEET_TELEMETRY_LIMITS, type FleetRecord} from "@mentra/cloud-protocol"
 import {normalizeCoreUrl} from "./coreUrl"
 import {getFleetStore} from "./fleetStorage"
 import {sha256HexOfText, utf8ByteLength} from "./utf8"
@@ -54,6 +61,18 @@ export interface FleetLosses {
   to: string | null
 }
 
+/** The telemetry the queue (or the Mentra App's limits) lost, per package, since the last `takeTelemetryLosses`. */
+export interface FleetTelemetryLosses {
+  packages: Record<string, {overLimit: number; evicted: number; expired: number; rejected: number}>
+  from: string | null
+  to: string | null
+}
+export type FleetTelemetryLossKind = "overLimit" | "evicted" | "expired" | "rejected"
+
+/** A telemetry record's ID starts with this, so the queue tells telemetry from the rest by its key. */
+export const TELEMETRY_RECORD_PREFIX = "tel."
+export const isTelemetryRecordId = (recordId: string) => recordId.startsWith(TELEMETRY_RECORD_PREFIX)
+
 /** A partition is one account on one Core. */
 export interface FleetQueue {
   /** Adds a record. Drops the oldest beyond 10,000 and counts the drop. Never throws: a record that cannot be stored is counted as dropped. */
@@ -86,6 +105,10 @@ export interface FleetQueue {
    * an idle reporter does not wake to sweep). `now` defaults to the queue's clock.
    */
   sweepExpired(now?: number): void
+  /** Counts `count` of `packageName`'s telemetry as lost, as of `at` (epoch ms). Never throws. */
+  noteTelemetryLoss(partition: string, packageName: string, kind: FleetTelemetryLossKind, count: number, at?: number): void
+  /** The telemetry lost since the last call, per package, and resets the counters; `null` when nothing was lost. */
+  takeTelemetryLosses(partition: string, now: number): FleetTelemetryLosses | null
   /** Forgets everything held for the partition: records, losses and sequence counters. */
   clearPartition(partition: string): void
   size(partition: string): number
@@ -138,6 +161,7 @@ const recordPrefix = (partition: string) => `q:${partition}:`
 const indexKey = (partition: string) => `i:${partition}`
 const lossKey = (partition: string) => `l:${partition}`
 const sequenceKey = (partition: string) => `n:${partition}`
+const telemetryLossKey = (partition: string) => `t:${partition}`
 
 function recordKey(partition: string, sequence: number, recordId: string): string {
   return `${recordPrefix(partition)}${String(sequence).padStart(SEQUENCE_WIDTH, "0")}:${recordId}`
@@ -213,6 +237,7 @@ interface FoundPartition {
   records: string[]
   hasIndex: boolean
   hasLosses: boolean
+  hasTelemetryLosses: boolean
   hasSequences: boolean
 }
 
@@ -224,7 +249,7 @@ function groupByPartition(keys: string[]): Map<string, FoundPartition> {
   const entry = (partition: string): FoundPartition => {
     let existing = found.get(partition)
     if (!existing) {
-      existing = {records: [], hasIndex: false, hasLosses: false, hasSequences: false}
+      existing = {records: [], hasIndex: false, hasLosses: false, hasTelemetryLosses: false, hasSequences: false}
       found.set(partition, existing)
     }
     return existing
@@ -236,6 +261,7 @@ function groupByPartition(keys: string[]): Map<string, FoundPartition> {
     } else if (key.startsWith("i:")) entry(key.slice(2)).hasIndex = true
     else if (key.startsWith("l:")) entry(key.slice(2)).hasLosses = true
     else if (key.startsWith("n:")) entry(key.slice(2)).hasSequences = true
+    else if (key.startsWith("t:")) entry(key.slice(2)).hasTelemetryLosses = true
   }
   return found
 }
@@ -367,10 +393,11 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
 
   /** Discards records that cannot be read, counting them as dropped. */
   function discardUnreadable(partition: string, state: PartitionState, unreadable: string[]): void {
+    // An unreadable telemetry record names no miniapp to count it for, and is never a coverage gap.
     noteLosses(
       partition,
       "dropped",
-      unreadable.map(() => undefined),
+      unreadable.filter((key) => !isTelemetryKey(partition, key)).map(() => undefined),
     )
     const gone = new Set(unreadable)
     for (const key of unreadable) removeKey(key)
@@ -378,7 +405,26 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
     persistIndex(partition, state)
   }
 
+  const idOffsetOf = (partition: string) => recordPrefix(partition).length + SEQUENCE_WIDTH + 1
+  const isTelemetryKey = (partition: string, key: string) => isTelemetryRecordId(key.slice(idOffsetOf(partition)))
+
+  /** Removes the telemetry record at `key`, counting it as `kind` for its package. */
+  function evictTelemetry(partition: string, state: PartitionState, key: string, kind: "evicted" | "expired", at: number = now()): void {
+    const record = readEntry(key)?.record
+    const packageName = record?.kind === "telemetry_event" ? record.payload.packageName : null
+    if (packageName !== null) noteTelemetryLoss(partition, packageName, kind, 1, at, record!.observedAt)
+    state.keys.splice(state.keys.indexOf(key), 1)
+    removeKey(key)
+  }
+
+  /**
+   * Keeps the partition inside its places: telemetry inside its share, and the whole inside 10,000, the oldest
+   * telemetry going first. Only a queue full of other records drops the oldest record of all, as a coverage gap.
+   */
   function trimToCapacity(partition: string, state: PartitionState): void {
+    const telemetry = state.keys.filter((key) => isTelemetryKey(partition, key))
+    while (telemetry.length > FLEET_TELEMETRY_LIMITS.queueShare) evictTelemetry(partition, state, telemetry.shift()!, "evicted")
+    while (state.keys.length > FLEET_LIMITS.phoneQueueMaxRecords && telemetry.length > 0) evictTelemetry(partition, state, telemetry.shift()!, "evicted")
     const excess = state.keys.length - FLEET_LIMITS.phoneQueueMaxRecords
     if (excess <= 0) return
     const observedAts = state.keys.slice(0, excess).map((key) => readEntry(key)?.record.observedAt)
@@ -386,6 +432,29 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
     removeOldest(state, excess)
   }
 
+  function readTelemetryLosses(partition: string): (FleetTelemetryLosses & {updatedAt: number}) | null {
+    const value = readJson(telemetryLossKey(partition)) as (FleetTelemetryLosses & {updatedAt: number}) | null
+    return value && typeof value === "object" && value.packages && typeof value.packages === "object" ? value : null
+  }
+
+  function noteTelemetryLoss(partition: string, packageName: string, kind: FleetTelemetryLossKind, count: number, at: number = now(), observedAt?: string): void {
+    if (!(count > 0)) return
+    try {
+      const stored = readTelemetryLosses(partition) ?? {packages: {}, from: null, to: null, updatedAt: at}
+      const entry = stored.packages[packageName] ?? {overLimit: 0, evicted: 0, expired: 0, rejected: 0}
+      entry[kind] += count
+      stored.packages[packageName] = entry
+      const when = observedAt ?? new Date(at).toISOString()
+      stored.from = earlier(stored.from, when)
+      stored.to = later(stored.to, when)
+      stored.updatedAt = at
+      store.set(telemetryLossKey(partition), JSON.stringify(stored))
+    } catch (error) {
+      // Telemetry losses are best effort: a count that cannot be stored is lost with the events it counted.
+      warn("could not persist a telemetry loss count", error)
+    }
+  }
+
   function expire(partition: string, state: PartitionState, at: number): void {
     const cutoff = at - FLEET_LIMITS.phoneQueueMaxAgeMs
     const expired: Array<string | undefined> = []
@@ -395,9 +464,14 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
     // a young record can sit ahead of older ones; those wait until it ages out, which only delays their expiry.
     for (; head < state.keys.length; head += 1) {
       const entry = readEntry(state.keys[head])
-      if (entry === null) unreadable.push(undefined)
-      else if (entry.enqueuedAt < cutoff) expired.push(entry.record.observedAt)
-      else break
+      if (entry === null) {
+        if (!isTelemetryKey(partition, state.keys[head]!)) unreadable.push(undefined)
+      } else if (entry.enqueuedAt < cutoff) {
+        // Expired telemetry is counted per package, never as a coverage gap.
+        if (entry.record.kind === "telemetry_event") {
+          noteTelemetryLoss(partition, entry.record.payload.packageName, "expired", 1, at, entry.record.observedAt)
+        } else expired.push(entry.record.observedAt)
+      } else break
     }
     if (head === 0) return
     noteLosses(partition, "expired", expired, at)
@@ -417,6 +491,10 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
       const losses = readLosses(partition)
       if (losses === null || at - losses.updatedAt > FLEET_LIMITS.phoneQueueMaxAgeMs) removeKey(lossKey(partition))
     }
+    if (found.hasTelemetryLosses) {
+      const losses = readTelemetryLosses(partition)
+      if (losses === null || at - losses.updatedAt > FLEET_LIMITS.phoneQueueMaxAgeMs) removeKey(telemetryLossKey(partition))
+    }
   }
 
   function loadSequences(partition: string): Array<[string, number]> {
@@ -441,7 +519,9 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
         state.nextSeq += 1
       } catch (error) {
         warn("could not store a record", error)
-        noteLosses(partition, "dropped", [record?.observedAt])
+        // Telemetry that cannot be stored is its miniapp's loss, never a coverage gap.
+        if (record?.kind === "telemetry_event") noteTelemetryLoss(partition, record.payload.packageName, "evicted", 1, now(), record.observedAt)
+        else noteLosses(partition, "dropped", [record?.observedAt])
         return
       }
       trimToCapacity(partition, state)
@@ -516,11 +596,24 @@ function buildQueue(store: FleetKeyValueStore, options: FleetQueueOptions): Flee
       }
     },
 
+    noteTelemetryLoss(partition, packageName, kind, count, at) {
+      noteTelemetryLoss(partition, packageName, kind, count, at)
+    },
+
+    takeTelemetryLosses(partition, at) {
+      expire(partition, load(partition), at)
+      const losses = readTelemetryLosses(partition)
+      if (losses === null || Object.keys(losses.packages).length === 0) return null
+      removeKey(telemetryLossKey(partition))
+      return {packages: losses.packages, from: losses.from, to: losses.to}
+    },
+
     clearPartition(partition) {
       const state = load(partition)
       for (const key of state.keys) removeKey(key)
       removeKey(indexKey(partition))
       removeKey(lossKey(partition))
+      removeKey(telemetryLossKey(partition))
       removeKey(sequenceKey(partition))
       state.keys = []
       state.nextSeq = 0

package/src/services/fleet/telemetryLimits.ts

@@ -0,0 +1,78 @@
+/**
+ * The Mentra App's limits on a miniapp's own events (Fleet spec, Miniapp telemetry), applied before an event is
+ * queued. MFM checks them again and rejects what still breaks one, so nothing here may let a bad record through.
+ *
+ * - An event whose name is not 1-64 lowercase letters, digits and underscores, starting with a letter, is dropped.
+ * - A property whose name breaks the same rule, or whose value is not a finite number, a boolean or a string, is
+ *   dropped; a string longer than 64 characters is cut to 64. Only the first 25 properties, in the order given, are
+ *   kept. What was dropped and cut is counted on the event.
+ * - A miniapp sends at most 60 events a minute and 2,000 a UTC day from this phone; the rest are dropped.
+ *
+ * Every drop of a whole event is counted by the caller as the miniapp's `overLimit` loss.
+ */
+import {FLEET_TELEMETRY_LIMITS, FLEET_TELEMETRY_NAME} from "@mentra/cloud-protocol"
+
+export interface LimitedEvent {
+  event: string
+  properties: Record<string, string | number | boolean>
+  droppedProperties: number
+  cutValues: number
+}
+
+/** Cuts a string to at most `max` UTF-16 code units without splitting a surrogate pair. */
+function cut(value: string, max: number): string {
+  if (value.length <= max) return value
+  const end = value.charCodeAt(max - 1)
+  return value.slice(0, end >= 0xd800 && end <= 0xdbff ? max - 1 : max)
+}
+
+const isName = (value: unknown): value is string => typeof value === "string" && FLEET_TELEMETRY_NAME.test(value)
+
+/** The event as it may be queued, or null when it must be dropped whole. Never throws. */
+export function limitEvent(event: unknown, properties: unknown): LimitedEvent | null {
+  if (!isName(event)) return null
+  const kept: Record<string, string | number | boolean> = {}
+  let droppedProperties = 0
+  let cutValues = 0
+  let count = 0
+  const entries =
+    properties !== null && typeof properties === "object" && !Array.isArray(properties) ? Object.entries(properties as Record<string, unknown>) : []
+  for (const [name, value] of entries) {
+    const valid = isName(name) && ((typeof value === "number" && Number.isFinite(value)) || typeof value === "boolean" || typeof value === "string")
+    if (!valid || count >= FLEET_TELEMETRY_LIMITS.maxProperties || name in kept) {
+      droppedProperties += 1
+      continue
+    }
+    if (typeof value === "string" && value.length > FLEET_TELEMETRY_LIMITS.maxStringValueLength) {
+      kept[name] = cut(value, FLEET_TELEMETRY_LIMITS.maxStringValueLength)
+      cutValues += 1
+    } else kept[name] = value as string | number | boolean
+    count += 1
+  }
+  return {event, properties: kept, droppedProperties, cutValues}
+}
+
+const MINUTE_MS = 60_000
+const utcDay = (at: number) => new Date(at).toISOString().slice(0, 10)
+
+/** Each miniapp's rate on this phone: 60 events in any minute and 2,000 a UTC day. Kept in memory. */
+export class TelemetryRate {
+  private readonly recent = new Map<string, number[]>()
+  private readonly daily = new Map<string, {day: string; count: number}>()
+
+  /** Whether `packageName` may send one more event at `at`; counts it when it may. */
+  admit(packageName: string, at: number): boolean {
+    const times = (this.recent.get(packageName) ?? []).filter((time) => at - time < MINUTE_MS && time <= at)
+    const day = utcDay(at)
+    const today = this.daily.get(packageName)
+    const sent = today?.day === day ? today.count : 0
+    if (times.length >= FLEET_TELEMETRY_LIMITS.eventsPerMinute || sent >= FLEET_TELEMETRY_LIMITS.eventsPerDay) {
+      this.recent.set(packageName, times)
+      return false
+    }
+    times.push(at)
+    this.recent.set(packageName, times)
+    this.daily.set(packageName, {day, count: sent + 1})
+    return true
+  }
+}

package/src/services/installMiniapp.ts

@@ -17,7 +17,7 @@
  * development build of the name it serves, over HTTP or HTTPS: never registered, never updated from its URL, with
  * its own data, tokens marked as a local build's, and no system privileges ({@link installLocalBuild}).
  */
-import type {RegistryRegisterRequest, RegistryRegisterResponse} from "@mentra/cloud-protocol"
+import type {FleetInstallFailureReason, RegistryRegisterRequest, RegistryRegisterResponse} from "@mentra/cloud-protocol"
 import {
   isLocalNetworkHost,
   normalizeMiniappUrl,
@@ -31,6 +31,7 @@ import {MiniappRunningError} from "../utils/storeInstallRuntime"
 import appRegistry, {type InstallableReleaseIdentity, type MiniappReleaseIdentity} from "./AppRegistry"
 import {cloudClientService} from "./CloudClientService"
 import type {ManagedAssignment} from "./fleet/assignmentReconciler"
+import {fleetEvents, type FleetInstallEvent} from "./fleet/fleetEvents"
 import localMiniappRuntime from "./LocalMiniappRuntime"
 import {checkMiniappAge, type AgeGateVerdict, type AgeRatedMiniapp} from "./miniappAgeGate"
 import {isPackageNameAllowedForUrl} from "./miniappDomainRule"
@@ -89,6 +90,12 @@ export interface InstallMiniappOptions {
   expectedPackageName?: string
   /** True once the install should stop. Nothing commits after that. */
   isCancelled?: () => boolean
+  /**
+   * Called once the installer knows the package, the release it would replace (null for none) and the version it would
+   * install, before anything is downloaded or asked: how Fleet reports the attempt whatever comes after
+   * (`installMiniapp`).
+   */
+  onResolved?: (packageName: string, previousVersion: string | null, version: string) => void
   /**
    * Headless only: called when the update of a running miniapp is staged and waits for the person's answer to its
    * update prompt. The call resolves once they answer: `installed`, or `deferred` for Not now.
@@ -223,6 +230,7 @@ export function createMiniappInstaller(
     // A miniapp installed from this URL opens, unless a development build of its name runs in its place: installing
     // it again replaces that build. Fleet's reconciler decides for itself what an assignment installs.
     const active = deps.activeRelease(packageName)
+    options.onResolved?.(packageName, active?.version ?? null, manifest.version)
     if (options.source !== "assignment" && active && !deps.hasDevelopmentSelection(packageName)) {
       const installedFrom = deps.updateUrl(packageName, active.identity)
       if (installedFrom && normalizeMiniappUrl(installedFrom)?.url === target.url) {
@@ -370,6 +378,7 @@ async function installFromLocalNetwork(
   assertCurrent()
   const {manifest} = served
   const packageName = manifest.packageName
+  options.onResolved?.(packageName, deps.activeRelease(packageName)?.version ?? null, manifest.version)
   if (!deps.developmentAllowed(packageName)) {
     throw new InstallMiniappError(
       "access_denied",
@@ -730,10 +739,77 @@ const engineDependencies: InstallMiniappDependencies = {
 
 let engineInstaller: ((url: string, options: InstallMiniappOptions) => Promise<InstallMiniappResult>) | null = null
 
+/** Fleet's install reason for an install that stopped (Phase 12): `assignment_outcome`'s reasons where they apply. */
+const FLEET_INSTALL_REASON: Record<InstallMiniappErrorCode, FleetInstallFailureReason> = {
+  not_a_miniapp: "not_a_miniapp",
+  domain_mismatch: "not_a_miniapp",
+  archived: "archived",
+  needs_newer_app: "incompatible_host",
+  access_denied: "access_denied",
+  age_restricted: "access_denied",
+  network: "network",
+  cancelled: "user_cancelled",
+  integrity: "download_failed",
+  signature_invalid: "signature_invalid",
+}
+
 /**
  * Install the miniapp at a miniapp URL (see the module comment). Throws {@link InstallMiniappError}.
+ *
+ * Every attempt whose package the installer resolved is reported to Fleet (`miniapp_install`): an update when it
+ * replaces an installed release, an install otherwise; installed, deferred, or failed with its reason. One the person
+ * declined is deferred, not failed. An attempt that stopped before its package was known (an unreachable URL) cannot be
+ * attributed, and is not reported.
  */
 export function installMiniapp(url: string, options: InstallMiniappOptions): Promise<InstallMiniappResult> {
-  engineInstaller ??= createMiniappInstaller(engineDependencies)
+  engineInstaller ??= withFleetReport(createMiniappInstaller(engineDependencies))
   return engineInstaller(url, options)
 }
+
+/** `installer`, reporting each attempt to Fleet as `installMiniapp` describes. Exported for tests. */
+export function withFleetReport(
+  installer: (url: string, options: InstallMiniappOptions) => Promise<InstallMiniappResult>,
+): (url: string, options: InstallMiniappOptions) => Promise<InstallMiniappResult> {
+  return (url, options) => reportAttempt(installer, url, options)
+}
+
+async function reportAttempt(
+  installer: (url: string, options: InstallMiniappOptions) => Promise<InstallMiniappResult>,
+  url: string,
+  options: InstallMiniappOptions,
+): Promise<InstallMiniappResult> {
+  const source = options.source === "assignment" ? "assignment" : options.source === "local" ? "local" : "url"
+  // What the installer resolved: the package and the release it replaces, for an update and for a failure.
+  type Attempt = {packageName: string; previousVersion: string | null; version: string}
+  let attempt: Attempt | null = null
+  const resolved: InstallMiniappOptions = {
+    ...options,
+    onResolved: (packageName, previousVersion, version) => {
+      attempt = {packageName, previousVersion, version}
+      options.onResolved?.(packageName, previousVersion, version)
+    },
+  }
+  // Every report names the version the attempt was installing, whatever is installed when it is made.
+  const report = (fields: Pick<FleetInstallEvent, "outcome" | "reason">) => {
+    const known = attempt as Attempt | null
+    if (known === null) return
+    fleetEvents.install({
+      packageName: known.packageName,
+      operation: known.previousVersion ? "update" : "install",
+      source,
+      ...(known.previousVersion ? {fromVersion: known.previousVersion} : {}),
+      toVersion: known.version,
+      ...fields,
+    } as FleetInstallEvent)
+  }
+  try {
+    const result = await installer(url, resolved)
+    if (result.status === "installed") report({outcome: "succeeded"})
+    else if (result.status === "deferred") report({outcome: "deferred", reason: "unknown"})
+    return result
+  } catch (error) {
+    const reason = error instanceof InstallMiniappError ? FLEET_INSTALL_REASON[error.code] : "unknown"
+    report({outcome: reason === "user_cancelled" ? "deferred" : "failed", reason})
+    throw error
+  }
+}

package/src/services/miniappReleaseInstall.ts

@@ -333,7 +333,7 @@ export function classifyManagedInstallError(error: unknown): {kind: ManagedInsta
 
 /** Uninstall a withdrawn miniapp. Its data stays in its partition for a later reinstall. */
 export async function uninstallManagedMiniapp(packageName: string): Promise<void> {
-  const result = await useAppStatusStore.getState().uninstall(packageName)
+  const result = await useAppStatusStore.getState().uninstall(packageName, undefined, {fleetSource: "assignment"})
   if (result.is_error()) throw result.error
 }
 

package/src/stores/apps.ts

@@ -14,6 +14,7 @@ import {useMemo} from "react"
 import {AppState} from "react-native"
 import {AsyncResult, Result, result as Res} from "typesafe-ts"
 import {create} from "zustand"
+import type {FleetLaunchFailureReason} from "@mentra/cloud-protocol"
 
 import type {ClientApp} from "../types/applet"
 import {DeviceTypes} from "../types/enums"
@@ -364,7 +365,7 @@ function reportingLaunches(
   return async (clientApp, opts) => {
     let attempted = false
     let started = false
-    const claim: {release?: () => void} = {}
+    const claim: {release?: () => FleetLaunchFailureReason | undefined} = {}
     try {
       started = await launch(clientApp, opts, {
         begin: () => {
@@ -374,6 +375,8 @@ function reportingLaunches(
       })
       return started
     } finally {
+      // The launcher classified any spawn failure it held back for this start; this report carries it.
+      const failureReason = claim.release?.()
       if (attempted) {
         fleetEvents.launch({
           packageName: clientApp.packageName,
@@ -381,9 +384,9 @@ function reportingLaunches(
           versionName: clientApp.version,
           start: opts?.trigger ?? "automatic",
           outcome: started ? "started" : "failed",
+          ...(!started && failureReason ? {failureReason} : {}),
         })
       }
-      claim.release?.()
     }
   }
 }
@@ -699,7 +702,21 @@ export const useAppStatusStore = create<AppStatusState>((set, get) => ({
       if (uninstallingPackages.has(packageName)) throw new Error(`${packageName} is already being uninstalled`)
       uninstallingPackages.add(packageName)
       try {
+        // Only for Fleet's record: a lookup that fails (or throws) never stops the removal.
+        const removed =
+          version ??
+          (await Promise.resolve()
+            .then(() => appRegistry.getActiveVersion(packageName))
+            .catch(() => undefined))
         const res = await appRegistry.uninstall(packageName, version, options)
+        // Fleet (Phase 12): every removal attempt, and how it went. The reason of a failed one is not known here.
+        fleetEvents.install({
+          packageName,
+          operation: "remove",
+          source: options?.fleetSource ?? "url",
+          ...(removed ? {fromVersion: removed} : {}),
+          ...(res.is_error() ? {outcome: "failed" as const, reason: "unknown" as const} : {outcome: "succeeded" as const}),
+        })
         if (res.is_error()) throw res.error
         set((s) => ({apps: s.apps.filter((a) => a.packageName !== packageName)}))
       } finally {