@vellumai/assistant 0.10.9 → 0.10.10-dev.202607162206.d08e98e

package/src/telemetry/__tests__/config-setting-snapshot.test.ts

@@ -60,6 +60,24 @@ describe("config-setting-snapshot", () => {
     expect(recordedPairs()).toEqual([["memory.v2.enabled", "false"]]);
   });
 
+  test("unknown consent skips entirely — no rows, no memo", () => {
+    setShareAnalytics("unknown");
+    recordConfigSettingSnapshot(makeConfig(true, false));
+
+    // A snapshot is re-derivable state (unlike outbox events), so nothing is
+    // recorded while consent is unresolved...
+    expect(recordedPairs()).toHaveLength(0);
+
+    // ...and nothing was memoized: once consent resolves, the next snapshot
+    // records the complete current set.
+    setShareAnalytics(true);
+    recordConfigSettingSnapshot(makeConfig(true, false));
+    expect(recordedPairs().sort()).toEqual([
+      ["memory.enabled", "true"],
+      ["memory.v2.enabled", "false"],
+    ]);
+  });
+
   test("consent off drops the snapshot without poisoning the memo", () => {
     setShareAnalytics(false);
     recordConfigSettingSnapshot(makeConfig(true, true));

package/src/telemetry/__tests__/outbox-test-harness.ts

@@ -1,6 +1,8 @@
 import { mock, spyOn } from "bun:test";
 
-let shareAnalytics = true;
+import type { ConsentState } from "../../platform/consent-cache.js";
+
+let shareAnalytics: ConsentState = true;
 // Owner's `share_diagnostics` consent + accepted version — a second,
 // independent gate some outbox event types layer on top of
 // `share_analytics` (their payload carries content richer than metadata).
@@ -17,7 +19,7 @@ let shareDiagnosticsVersion = "2999-01-01";
 // imports are as safe as in the test files themselves (AGENTS.md "Test
 // machinery isolation" scopes its no-src/ rule to preload-time machinery).
 mock.module("../../platform/consent-cache.js", () => ({
-  getCachedShareAnalytics: () => shareAnalytics,
+  getRawShareAnalytics: () => shareAnalytics,
   getCachedShareDiagnostics: () => shareDiagnostics,
   getCachedShareDiagnosticsVersion: () => shareDiagnosticsVersion,
 }));
@@ -31,7 +33,7 @@ import { queryTelemetryOutboxBatch } from "../telemetry-events-outbox.js";
 await initializeDb();
 
 /** Flip the mocked share_analytics consent; call with true in beforeEach. */
-export function setShareAnalytics(value: boolean): void {
+export function setShareAnalytics(value: ConsentState): void {
   shareAnalytics = value;
 }
 

package/src/telemetry/config-setting-snapshot.ts

@@ -1,6 +1,6 @@
 import { getConfigReadOnly } from "../config/loader.js";
 import type { AssistantConfig } from "../config/schema.js";
-import { getCachedShareAnalytics } from "../platform/consent-cache.js";
+import { getRawShareAnalytics } from "../platform/consent-cache.js";
 import { getLogger } from "../util/logger.js";
 import { recordConfigSettingEvent } from "./config-setting-events-store.js";
 
@@ -51,13 +51,18 @@ const lastRecorded = new Map<string, string>();
  * Record a `config_setting` event for every tracked setting whose effective
  * value differs from what this process last recorded.
  *
- * Consent-gated with a memo reset on opt-out. While `share_analytics` is off,
- * nothing is recorded and the memo is cleared: the reporter's opt-out flush
- * discards any config_setting rows still pending upload, so a memo entry from
- * before the opt-out no longer corresponds to a delivered row. Clearing it
- * means a later re-opt-in (in the same process, unchanged config) re-records
- * the full current snapshot rather than skipping memoized keys — consumers
- * that expect a complete snapshot after re-opt-in stay correct.
+ * Consent-gated with a memo reset on opt-out. While `share_analytics` is a
+ * confirmed opt-out, nothing is recorded and the memo is cleared: the
+ * reporter's opt-out flush discards any config_setting rows still pending
+ * upload, so a memo entry from before the opt-out no longer corresponds to a
+ * delivered row. Clearing it means a later re-opt-in (in the same process,
+ * unchanged config) re-records the full current snapshot rather than skipping
+ * memoized keys — consumers that expect a complete snapshot after re-opt-in
+ * stay correct. An UNKNOWN consent state skips entirely (no record, no memo,
+ * no clear): unlike outbox events, a snapshot is re-derivable state, so
+ * deferring it loses nothing — while recording it would either memoize a row
+ * a later opt-out purge invalidates, or (without the memo) double-record on
+ * every boot.
  *
  * Retry-friendly when opted in: `recordConfigSettingEvent` returns false when
  * the telemetry DB is momentarily unavailable, and the memo is only advanced
@@ -67,7 +72,11 @@ const lastRecorded = new Map<string, string>();
  * retries on the next invocation.
  */
 export function recordConfigSettingSnapshot(config: AssistantConfig): void {
-  if (!getCachedShareAnalytics()) {
+  const consent = getRawShareAnalytics();
+  if (consent === "unknown") {
+    return;
+  }
+  if (consent === false) {
     lastRecorded.clear();
     return;
   }
@@ -89,6 +98,14 @@ export function recordConfigSettingSnapshot(config: AssistantConfig): void {
 }
 
 let snapshotTimer: ReturnType<typeof setInterval> | null = null;
+let bootRetryTimer: ReturnType<typeof setTimeout> | null = null;
+
+// The boot-time snapshot races the first consent refresh (fire-and-forget in
+// the monitor's startup), so consent is usually still "unknown" on the first
+// call and the snapshot is skipped. Retry on a short timer until consent
+// resolves rather than waiting a full hourly interval for the per-boot
+// assertion.
+const BOOT_RETRY_INTERVAL_MS = 60_000;
 
 function recordSnapshotFromConfig(): void {
   try {
@@ -100,6 +117,19 @@ function recordSnapshotFromConfig(): void {
   }
 }
 
+function recordBootSnapshotOnceConsentKnown(): void {
+  if (getRawShareAnalytics() === "unknown") {
+    bootRetryTimer = setTimeout(
+      recordBootSnapshotOnceConsentKnown,
+      BOOT_RETRY_INTERVAL_MS,
+    );
+    bootRetryTimer.unref?.();
+    return;
+  }
+  bootRetryTimer = null;
+  recordSnapshotFromConfig();
+}
+
 /**
  * Start the config-setting snapshot loop in the resource monitor process:
  * record the tracked settings once at boot, then hourly. No-op in dev mode
@@ -114,7 +144,7 @@ export function startConfigSnapshotReporter(): void {
   if (snapshotTimer) {
     return;
   }
-  recordSnapshotFromConfig();
+  recordBootSnapshotOnceConsentKnown();
   snapshotTimer = setInterval(
     recordSnapshotFromConfig,
     CONFIG_SNAPSHOT_INTERVAL_MS,
@@ -127,6 +157,10 @@ export function stopConfigSnapshotReporter(): void {
     clearInterval(snapshotTimer);
     snapshotTimer = null;
   }
+  if (bootRetryTimer) {
+    clearTimeout(bootRetryTimer);
+    bootRetryTimer = null;
+  }
 }
 
 /** Test-only: clear the per-process last-recorded memo. */

package/src/telemetry/telemetry-event-sources.test.ts

@@ -6,8 +6,8 @@
  */
 import { beforeEach, describe, expect, test } from "bun:test";
 
-import { recordOnboardingResearchEvent } from "../onboarding/onboarding-research-events-store.js";
 import {
+  pendingOutboxRows,
   resetOutboxTable,
   setShareAnalytics,
   setShareDiagnostics,
@@ -16,25 +16,72 @@ import {
   ALL_TELEMETRY_EVENT_SOURCES,
   DAEMON_TELEMETRY_EVENT_SOURCES,
   MONITOR_TELEMETRY_EVENT_SOURCES,
+  ORPHAN_OUTBOX_DRAIN_SOURCE_ID,
+  orphanOutboxDrainSource,
 } from "./telemetry-event-sources.js";
-import { OUTBOX_TELEMETRY_EVENT_NAMES } from "./types.js";
+import {
+  insertTelemetryOutboxEvents,
+  recordTelemetryEvent,
+} from "./telemetry-events-outbox.js";
+import { telemetryEventSchema } from "./telemetry-wire.generated.js";
+import type { TelemetryEvent } from "./types.js";
+import {
+  OUTBOX_TELEMETRY_EVENT_NAMES,
+  WATERMARK_TELEMETRY_EVENT_NAMES,
+} from "./types.js";
 
 describe("telemetry event source partition", () => {
   test("the full source list carries every event type in payload order", () => {
+    // Watermark sources first (their ids are the table names, not the wire
+    // discriminants), then outbox events in wire-contract order, then the
+    // synthetic orphan-drain source last.
     expect(ALL_TELEMETRY_EVENT_SOURCES.map((s) => s.id)).toEqual([
       "usage",
       "turns",
+      "tool_executed",
       "lifecycle",
       "onboarding",
       "auth_fallback",
-      "tool_executed",
       "skill_loaded",
       "watchdog",
       "config_setting",
       "onboarding_research",
+      ORPHAN_OUTBOX_DRAIN_SOURCE_ID,
     ]);
   });
 
+  test("every wire event type is partitioned to exactly one flush lane", () => {
+    // The derivation's core guarantee: a new wire event type can't silently go
+    // unflushed. Every discriminant in the generated contract is either
+    // watermark-flushed or (by default) outbox-backed, never both, never
+    // neither — and, ignoring the synthetic orphan-drain source, the counts
+    // line up with one source per type.
+    const wireTypes = new Set(
+      telemetryEventSchema.options.map((o) => o.shape.type.value),
+    );
+    const partitioned = [
+      ...WATERMARK_TELEMETRY_EVENT_NAMES,
+      ...OUTBOX_TELEMETRY_EVENT_NAMES,
+    ];
+    expect(new Set(partitioned)).toEqual(wireTypes);
+    expect(partitioned.length).toBe(wireTypes.size); // disjoint: no double-count
+    const perTypeSources = ALL_TELEMETRY_EVENT_SOURCES.filter(
+      (s) => s.id !== ORPHAN_OUTBOX_DRAIN_SOURCE_ID,
+    );
+    expect(perTypeSources.length).toBe(wireTypes.size);
+  });
+
+  test("every watermark name is a real wire discriminant", () => {
+    // Guards a stale/typo watermark name that would wrongly exclude a live type
+    // from the outbox (and thus from any flush source).
+    const wireTypes = new Set(
+      telemetryEventSchema.options.map((o) => o.shape.type.value),
+    );
+    for (const name of WATERMARK_TELEMETRY_EVENT_NAMES) {
+      expect(wireTypes.has(name)).toBe(true);
+    }
+  });
+
   test("the daemon flushes turns only", () => {
     expect(DAEMON_TELEMETRY_EVENT_SOURCES.map((s) => s.id)).toEqual(["turns"]);
   });
@@ -68,7 +115,7 @@ describe("telemetry event source partition", () => {
   });
 });
 
-describe("onboarding_research source: flush-time diagnostics gate", () => {
+describe("onboarding_research source: flushes via the default outbox source", () => {
   beforeEach(() => {
     setShareAnalytics(true);
     setShareDiagnostics(true);
@@ -86,43 +133,90 @@ describe("onboarding_research source: flush-time diagnostics gate", () => {
   }
 
   function recordSample(): void {
-    recordOnboardingResearchEvent({
-      conversationId: "conv-x",
-      status: "done",
-      claims: [],
-      suggestions: [],
-      plugins: [],
-      installedPlugins: [],
-    });
+    recordTelemetryEvent(
+      "onboarding_research",
+      {
+        conversation_id: "conv-x",
+        status: "done",
+        claims: [],
+        claim_count: 0,
+        claims_confident: 0,
+        claims_maybe: 0,
+        claims_guessing: 0,
+        suggestions: [],
+        suggestion_count: 0,
+        plugins: [],
+        installed_plugins: [],
+      },
+      { conversationId: "conv-x" },
+    );
   }
 
-  test("ships normally when diagnostics consent is eligible", () => {
+  test("ships pending rows regardless of diagnostics consent, like every other outbox event", () => {
+    // No flush-time diagnostics gate: the daemon rides `share_analytics`
+    // only and leaves the diagnostics decision to the platform's
+    // authoritative server-side ingest gate. Diagnostics off (and even a
+    // stale accepted version) must not hold the row back.
+    setShareDiagnostics(false, "2000-01-01");
     recordSample();
+
     const batch = onboardingResearchSource().collect(0, undefined, 100);
     expect(batch.events).toHaveLength(1);
   });
+});
 
-  test("purges pending rows outright once diagnostics consent is revoked before flush, rather than shipping them", () => {
-    recordSample();
-    // Consent was on at record time — the row is already pending — then
-    // revoked before the reporter gets to flush it.
-    setShareDiagnostics(false);
+describe("orphan-drain source", () => {
+  beforeEach(() => {
+    resetOutboxTable();
+    setShareAnalytics(true);
+  });
 
-    const batch = onboardingResearchSource().collect(0, undefined, 100);
-    expect(batch.events).toHaveLength(0);
+  function insertOutboxRow(name: string, id: string): void {
+    insertTelemetryOutboxEvents([
+      {
+        id,
+        name,
+        createdAt: 1,
+        event: {
+          type: name,
+          daemon_event_id: id,
+          recorded_at: 1,
+          assistant_version: "1.2.3",
+        } as unknown as TelemetryEvent,
+      },
+    ]);
+  }
 
-    // Purged, not merely skipped: a later collect (e.g. consent flips back
-    // on) must never resurrect the stale pre-revocation row.
-    setShareDiagnostics(true);
-    const secondBatch = onboardingResearchSource().collect(0, undefined, 100);
-    expect(secondBatch.events).toHaveLength(0);
-  });
+  test("drains rows for a type no longer in the wire contract, then self-heals on ack", () => {
+    // A row whose name isn't a current outbox event type — e.g. recorded before
+    // the platform removed the type. No per-type source queries it.
+    const orphanName = "removed_legacy_event";
+    insertOutboxRow(orphanName, "orphan-row-1");
 
-  test("purges pending rows when the accepted diagnostics-consent version becomes stale before flush", () => {
-    recordSample();
-    setShareDiagnostics(true, "2000-01-01");
+    const source = orphanOutboxDrainSource();
+    const batch = source.collect(0, undefined, 500);
+    expect(batch.events).toHaveLength(1);
+    expect((batch.events[0] as { type: string }).type).toBe(orphanName);
+    expect(batch.rowIds).toEqual(["orphan-row-1"]);
 
-    const batch = onboardingResearchSource().collect(0, undefined, 100);
+    // Send-then-ack: the reporter deletes the row after a 2xx, so it self-heals.
+    source.ack?.acknowledge(batch.rowIds ?? []);
+    expect(pendingOutboxRows(orphanName)).toHaveLength(0);
+  });
+
+  test("ignores rows for a current outbox event type", () => {
+    // Known types drain through their own per-type source, not this one.
+    const knownName = OUTBOX_TELEMETRY_EVENT_NAMES[0];
+    insertOutboxRow(knownName, "known-row-1");
+    const batch = orphanOutboxDrainSource().collect(0, undefined, 500);
     expect(batch.events).toHaveLength(0);
   });
+
+  test("is registered in the monitor partition", () => {
+    expect(
+      MONITOR_TELEMETRY_EVENT_SOURCES.some(
+        (s) => s.id === ORPHAN_OUTBOX_DRAIN_SOURCE_ID,
+      ),
+    ).toBe(true);
+  });
 });

package/src/telemetry/telemetry-event-sources.ts

@@ -20,6 +20,7 @@ import { APP_VERSION } from "../version.js";
 import {
   deleteTelemetryOutboxEvents,
   discardPendingTelemetryOutboxEvents,
+  queryDistinctOutboxEventNames,
   queryTelemetryOutboxBatch,
 } from "./telemetry-events-outbox.js";
 import { queryUnreportedToolExecutedEvents } from "./tool-executed-events-store.js";
@@ -31,6 +32,7 @@ import type {
   TelemetryEvent,
   TurnTelemetryClientInfo,
 } from "./types.js";
+import { OUTBOX_TELEMETRY_EVENT_NAMES } from "./types.js";
 
 const log = getLogger("usage-telemetry");
 
@@ -130,13 +132,48 @@ function simpleSource<Row extends { id: string; createdAt: number }>(
   };
 }
 
+/**
+ * Query one outbox event name and parse each stored payload into its wire
+ * event, accumulating into `events`/`rowIds`. A row whose payload does not
+ * parse to an object is collected into `corruptIds` for immediate purge: an
+ * early empty-batch return in the reporter would otherwise strand it at the
+ * head of the queue forever. Shared by {@link outboxSource} and the
+ * orphan-drain source.
+ */
+function collectOutboxName(
+  name: string,
+  limit: number,
+  into: { events: TelemetryEvent[]; rowIds: string[]; corruptIds: string[] },
+): { queried: number } {
+  const rows = queryTelemetryOutboxBatch(name, limit);
+  for (const row of rows) {
+    let event: TelemetryEvent | null = null;
+    try {
+      const parsed = JSON.parse(row.payload) as unknown;
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        event = parsed as TelemetryEvent;
+      }
+    } catch {
+      // Fall through to the purge below.
+    }
+    if (event) {
+      into.events.push(event);
+      into.rowIds.push(row.id);
+    } else {
+      into.corruptIds.push(row.id);
+      log.warn(
+        { name, rowId: row.id, payloadLength: row.payload.length },
+        "Telemetry outbox: unparseable payload — purging row",
+      );
+    }
+  }
+  return { queried: rows.length };
+}
+
 /**
  * Build an ack-mode source over the generic `telemetry_events` outbox for one
  * event name. `collect` ignores the cursor args — acknowledged rows are
- * deleted, so the head of the queue is always the next batch — and parses
- * each stored payload into its wire event. A row whose payload does not parse
- * to an object is purged immediately with a warn: an early empty-batch return
- * in the reporter would otherwise strand it at the head of the queue forever.
+ * deleted, so the head of the queue is always the next batch.
  */
 export function outboxSource(
   name: OutboxTelemetryEventName,
@@ -144,39 +181,20 @@ export function outboxSource(
   return {
     id: name,
     collect(_afterCreatedAt, _afterId, limit) {
-      const rows = queryTelemetryOutboxBatch(name, limit);
-      const events: TelemetryEvent[] = [];
-      const rowIds: string[] = [];
-      const corruptIds: string[] = [];
-      for (const row of rows) {
-        let event: TelemetryEvent | null = null;
-        try {
-          const parsed = JSON.parse(row.payload) as unknown;
-          if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-            event = parsed as TelemetryEvent;
-          }
-        } catch {
-          // Fall through to the purge below.
-        }
-        if (event) {
-          events.push(event);
-          rowIds.push(row.id);
-        } else {
-          corruptIds.push(row.id);
-          log.warn(
-            { name, rowId: row.id, payloadLength: row.payload.length },
-            "Telemetry outbox: unparseable payload — purging row",
-          );
-        }
-      }
-      if (corruptIds.length > 0) {
-        deleteTelemetryOutboxEvents(corruptIds);
+      const acc = {
+        events: [] as TelemetryEvent[],
+        rowIds: [] as string[],
+        corruptIds: [] as string[],
+      };
+      const { queried } = collectOutboxName(name, limit, acc);
+      if (acc.corruptIds.length > 0) {
+        deleteTelemetryOutboxEvents(acc.corruptIds);
       }
       return {
-        events,
-        rowIds,
+        events: acc.events,
+        rowIds: acc.rowIds,
         lastCursor: null,
-        fullBatch: rows.length === limit,
+        fullBatch: queried === limit,
       };
     },
     ack: {
@@ -186,44 +204,60 @@ export function outboxSource(
   };
 }
 
+/** Source id of the synthetic orphan-drain source (not a wire event type). */
+export const ORPHAN_OUTBOX_DRAIN_SOURCE_ID = "__orphan_outbox_drain";
+
 /**
- * Build an ack-mode source like {@link outboxSource}, but additionally
- * re-checks `share_diagnostics` eligibility (at an eligible accepted
- * version) on every collect, not just at record time. A writer's record-
- * time gate only covers the moment the row is recorded — if the owner
- * revokes diagnostics consent after that but before the next flush, a
- * still-pending row must not ship anyway (unlike `turnSource`'s trace,
- * which is assembled fresh at flush time and so re-evaluates consent for
- * free, a pre-built outbox payload has no such natural re-check point).
- * Ineligible pending rows are purged outright rather than held for a later
- * re-check, mirroring the corrupt-payload purge above — consent revocation
- * calls for dropping the backlog, not retrying it.
+ * Synthetic ack-mode source that drains outbox rows whose `name` is no longer a
+ * current outbox event type — e.g. rows recorded before the platform removed or
+ * renamed a type, still pending on a client that has since upgraded. The
+ * derived per-type sources ({@link OUTBOX_TELEMETRY_EVENT_NAMES}) never query
+ * those names, so without this the rows would sit in the outbox forever.
+ *
+ * Draining is send-then-ack: the platform skips an unknown event type but still
+ * returns 2xx, after which the row is deleted. This is safe against a stale
+ * local wire copy — a name merely missing from a lagging wire still ships and
+ * lands rather than being purged and lost — and rides `share_analytics` like
+ * every other outbox event (no outbox type is diagnostics-gated at flush).
  */
-function diagnosticsGatedOutboxSource(
-  name: OutboxTelemetryEventName,
-): TelemetryEventSource {
-  const base = outboxSource(name);
+export function orphanOutboxDrainSource(): TelemetryEventSource {
+  const known = new Set<string>(OUTBOX_TELEMETRY_EVENT_NAMES);
+  const orphanNames = (): string[] =>
+    queryDistinctOutboxEventNames().filter((name) => !known.has(name));
   return {
-    id: base.id,
-    collect(afterCreatedAt, afterId, limit) {
-      if (
-        !getCachedShareDiagnostics() ||
-        !isDiagnosticsConsentVersionEligible(getCachedShareDiagnosticsVersion())
-      ) {
-        const rows = queryTelemetryOutboxBatch(name, limit);
-        if (rows.length > 0) {
-          deleteTelemetryOutboxEvents(rows.map((row) => row.id));
+    id: ORPHAN_OUTBOX_DRAIN_SOURCE_ID,
+    collect(_afterCreatedAt, _afterId, limit) {
+      const acc = {
+        events: [] as TelemetryEvent[],
+        rowIds: [] as string[],
+        corruptIds: [] as string[],
+      };
+      for (const name of orphanNames()) {
+        if (acc.events.length >= limit) {
+          break;
         }
-        return {
-          events: [],
-          rowIds: [],
-          lastCursor: null,
-          fullBatch: rows.length === limit,
-        };
+        collectOutboxName(name, limit - acc.events.length, acc);
+      }
+      if (acc.corruptIds.length > 0) {
+        deleteTelemetryOutboxEvents(acc.corruptIds);
       }
-      return base.collect(afterCreatedAt, afterId, limit);
+      return {
+        events: acc.events,
+        rowIds: acc.rowIds,
+        lastCursor: null,
+        // Conservative: never signals more-behind, so orphan draining spreads
+        // across flush cycles instead of monopolizing one. Rare by nature.
+        fullBatch: false,
+      };
+    },
+    ack: {
+      acknowledge: (rowIds) => deleteTelemetryOutboxEvents(rowIds),
+      discardPending: () => {
+        for (const name of orphanNames()) {
+          discardPendingTelemetryOutboxEvents(name);
+        }
+      },
     },
-    ack: base.ack,
   };
 }
 
@@ -480,27 +514,47 @@ const toolExecutedSource = simpleSource(
 export const TOOL_EXECUTED_SOURCE_ID = toolExecutedSource.id;
 
 /**
- * Every telemetry event source, in payload order. The order is part of the
- * observable wire behavior (events of different types appear in this order
- * within one batch), so keep it stable. This is the test/reference list;
- * production reporters run the daemon/monitor partitions below.
+ * Watermark-flushed sources — the high-volume events on their own SQLite
+ * tables (`WATERMARK_TELEMETRY_EVENT_NAMES`), read forward by a `(createdAt,
+ * id)` cursor rather than the generic outbox.
  */
-export const ALL_TELEMETRY_EVENT_SOURCES: readonly TelemetryEventSource[] = [
+const WATERMARK_TELEMETRY_EVENT_SOURCES: readonly TelemetryEventSource[] = [
   usageSource,
   turnSource,
-  outboxSource("lifecycle"),
-  outboxSource("onboarding"),
-  outboxSource("auth_fallback"),
   toolExecutedSource,
-  outboxSource("skill_loaded"),
-  outboxSource("watchdog"),
-  outboxSource("config_setting"),
-  // Onboarding research-turn results are client-orchestrated (the web
-  // client reports the settled `{claims, suggestions, plugins}` payload
-  // once via POST /v1/telemetry/onboarding-research) but land in the same
-  // outbox as every other event type. Diagnostics-gated at flush time (not
-  // just record time) since the payload carries raw inferred claims.
-  diagnosticsGatedOutboxSource("onboarding_research"),
+];
+
+/**
+ * Per-outbox-event flush-source override. The default for every outbox event is
+ * the plain {@link outboxSource}; list only the exceptions here. A new outbox
+ * event type therefore needs no edit — it flushes through `outboxSource`
+ * automatically. There are currently no exceptions: every outbox event,
+ * including `onboarding_research`, flushes through the default source and is
+ * gated only by the `share_analytics` consent enforced at record time.
+ */
+const OUTBOX_SOURCE_FACTORY: Partial<
+  Record<
+    OutboxTelemetryEventName,
+    (name: OutboxTelemetryEventName) => TelemetryEventSource
+  >
+> = {};
+
+/**
+ * Every telemetry event source, in payload order (watermark sources first, then
+ * outbox events in wire-contract order). Derived from the wire contract via
+ * {@link OUTBOX_TELEMETRY_EVENT_NAMES}, so a new event type gets a flush source
+ * with no edit here. Intra-batch ordering is not load-bearing downstream
+ * (events are typed and deduped on `daemon_event_id`, not positional). This is
+ * the test/reference list; production reporters run the daemon/monitor
+ * partitions below.
+ */
+export const ALL_TELEMETRY_EVENT_SOURCES: readonly TelemetryEventSource[] = [
+  ...WATERMARK_TELEMETRY_EVENT_SOURCES,
+  ...OUTBOX_TELEMETRY_EVENT_NAMES.map((name) =>
+    (OUTBOX_SOURCE_FACTORY[name] ?? outboxSource)(name),
+  ),
+  // Not a wire event type — drains rows for types the wire no longer declares.
+  orphanOutboxDrainSource(),
 ];
 
 /**