claude-code-session-manager 0.83.0 → 0.85.0

package/src/main/crashDiagnostics.cjs

@@ -26,6 +26,7 @@
 const { app, powerSaveBlocker, powerMonitor, crashReporter } = require('electron');
 const fs = require('node:fs');
 const path = require('node:path');
+const { reportCrash } = require('./lib/crashTelemetry.cjs');
 
 let logs = null;
 let getPowerBlockerId = () => -1;
@@ -139,6 +140,7 @@ function checkPreviousRun() {
   try { prev = JSON.parse(fs.readFileSync(sentinelPath, 'utf8')); } catch { return; }
   if (!prev || prev.open !== true) return;
   const s = prev.lastSample;
+  const lastTop = s && Array.isArray(s.procs) ? [...s.procs].sort((a, b) => b.mb - a.mb).slice(0, 4).map((p) => `${p.type}:${p.mb}MB`) : undefined;
   logs?.writeLine({
     scope: 'crash-diag',
     level: 'error',
@@ -149,11 +151,24 @@ function checkPreviousRun() {
       lastSampleTs: s?.ts,
       lastTotalMb: s?.totalMb,
       lastMainRssMb: s?.main?.rssMb,
-      lastTop: s && Array.isArray(s.procs) ? [...s.procs].sort((a, b) => b.mb - a.mb).slice(0, 4).map((p) => `${p.type}:${p.mb}MB`) : undefined,
+      lastTop,
       powerBlockerHeldAtDeath: s?.powerBlockerHeld,
       hint: 'Check `journalctl -k | grep -i oom` around lastSampleTs to confirm the kernel OOM-killer.',
     },
   });
+  // The unclean-shutdown postmortem is the report most likely to be the ONLY
+  // thing ever received from a machine that just OOM-killed the app — the
+  // dying process couldn't write it itself. See crashTelemetry.cjs header.
+  reportCrash({
+    reason: 'unclean-shutdown',
+    meta: {
+      lastSampleTs: s?.ts,
+      lastTotalMb: s?.totalMb,
+      lastMainRssMb: s?.main?.rssMb,
+      lastTop,
+      powerBlockerHeldAtDeath: s?.powerBlockerHeld,
+    },
+  });
 }
 
 function registerCrashHooks() {
@@ -167,6 +182,10 @@ function registerCrashHooks() {
       message: 'render-process-gone',
       meta: { reason: details?.reason, exitCode: details?.exitCode, lastTotalMb: lastSample?.totalMb },
     });
+    reportCrash({
+      reason: details?.reason || 'unknown',
+      meta: { type: 'render', exitCode: details?.exitCode, lastTotalMb: lastSample?.totalMb },
+    });
   });
 
   // GPU / Utility / Pepper / network-service child death.
@@ -183,6 +202,15 @@ function registerCrashHooks() {
         lastTotalMb: lastSample?.totalMb,
       },
     });
+    reportCrash({
+      reason: details?.reason || 'unknown',
+      meta: {
+        type: details?.type,
+        name: details?.name || details?.serviceName,
+        exitCode: details?.exitCode,
+        lastTotalMb: lastSample?.totalMb,
+      },
+    });
   });
 
   // powerMonitor ties the suspend story to the crash timeline. If we ever log

package/src/main/health.cjs

@@ -16,7 +16,7 @@ const { checkDelegationReadiness } = require('./lib/delegationReadiness.cjs');
 const { resolvePrdsDirs } = require('./lib/prdLocations.cjs');
 const { migratePrds } = require('./lib/prdMigration.cjs');
 const queueStore = require('./lib/queueStore.cjs');
-const { computeStallSummary } = require('./scheduler.cjs');
+const { computeStallSummary, SCHEDULER_STATE_PATH, FAILURE_STREAK_WARN_THRESHOLD, classifyQueueStarvation } = require('./scheduler.cjs');
 const { DEFAULT_RUNS_DIR, computeReport, isRetentionEnabled, liveKeysFromJobs } = require('./lib/runLogRetention.cjs');
 const { allProjectCwds } = require('../../scripts/lib/activeSessions.cjs');
 
@@ -154,6 +154,37 @@ function computeProjectProblemCounts(jobs) {
   return byProject;
 }
 
+// evaluateWorktreeCapBlocked(jobs, runningCount) → { ok, blocked, capBlockedSlugs? }
+//
+// The worktree cap (gitWorktree.cjs) can genuinely, correctly block every
+// pending job at once — a real out-of-capacity condition, not a bug — but
+// before this check existed that state was invisible to `npm run health`:
+// nothing but a console.log line and a `heldReason` field on the row (see
+// scheduler.cjs's spawnJob preflight). Rows in four separate project queues
+// carried heldReason 'worktree cap reached (5 concurrent)' for 16 hours with
+// zero entries in session-manager-operations/logs/ and nothing non-GREEN
+// here. `runningCount === 0` is the load-bearing condition: while at least
+// one job is running, the cap is doing its job as designed (bounding
+// concurrency), not starving the queue.
+function evaluateWorktreeCapBlocked(jobs, runningCount) {
+  // queueStore.readMergedSync() hands back jobs as an object map (merged
+  // across projects); other callers (tests, scheduler.cjs's own in-memory
+  // state) pass a plain array — accept either rather than forcing every
+  // caller to know this module's federated-storage detail.
+  const jobList = Array.isArray(jobs) ? jobs : Object.values(jobs || {});
+  const capBlocked = jobList.filter(
+    (j) => j.status === 'pending' && /^worktree cap reached\b/.test(j.heldReason || '')
+  );
+  if ((runningCount ?? 0) === 0 && capBlocked.length > 0) {
+    return {
+      ok: false,
+      blocked: true,
+      capBlockedSlugs: capBlocked.map((j) => j.slug),
+    };
+  }
+  return { ok: true, blocked: false };
+}
+
 // evaluatePerProjectStall(stallSummary, lastRunAtIso, now, thresholdMs) →
 // { [cwd]: { stalled, pastThreshold?, ageMs?, caveat? } }
 //
@@ -335,6 +366,113 @@ function evaluateEpicIndexHealth(cwds) {
   return { component: { ok: !anyOrphanRows, byProject }, issues };
 }
 
+// Pure evaluator over ~/.claude/session-manager/scheduler-state.json's parsed
+// content (the sidecar scheduler.cjs's pollLoop maintains for the billing
+// usage-meter / rate-limit-window poller — see rateLimitPollerStreak tests).
+// `state` null/missing means the poller has never run yet (fresh install) —
+// not a failure, matches evaluatePrdMigrationHealth's fail-open-on-absence
+// spirit. Kept separate from the fs-touching check() call site, same pattern
+// as every other evaluate* helper in this file.
+function evaluateUsagePollerHealth(state, threshold = FAILURE_STREAK_WARN_THRESHOLD) {
+  if (!state || typeof state !== 'object') return { ok: true, applicable: false };
+  const consecutiveFailures = typeof state.consecutiveFailures === 'number' ? state.consecutiveFailures : 0;
+  const backoffMs = typeof state.backoffMs === 'number' ? state.backoffMs : null;
+  const lastPollAt = typeof state.lastPollAt === 'number' ? state.lastPollAt : null;
+  // Trips at the SAME count as scheduler.cjs's shouldWarnFailureStreak
+  // (`consecutiveFailures >= threshold`) — the WARN and this non-GREEN must
+  // fire together, not one failure apart, or an operator sees the log line
+  // while the health dashboard still reads green.
+  const ok = consecutiveFailures < threshold;
+  return {
+    ok,
+    applicable: true,
+    consecutiveFailures,
+    backoffMs,
+    lastPollAt,
+    threshold,
+    ...(ok ? {} : {
+      message: `usage/rate-limit poller has ${consecutiveFailures} consecutive failures `
+        + `(threshold ${threshold}), backoffMs=${backoffMs} — see logs scope=scheduler`,
+    }),
+  };
+}
+
+// Reads + parses a scheduler-state.json-shaped sidecar at `statePath`,
+// classifying the outcome into exactly one of three shapes so the caller
+// never has to distinguish "absent" from "corrupt" itself:
+//   { missing: true }                — ENOENT: never run yet, not a failure
+//   { errorMessage: string }         — unreadable OR unparseable (corrupt)
+//   { state: object }                — parsed successfully
+// Takes an explicit path (rather than reading SCHEDULER_STATE_PATH directly)
+// so it's unit-testable against a real temp file instead of mocking global
+// fs or exercising the full (slow, machine-coupled) check().
+// A DISPATCHABLE pending job (not merely pending) with 0 running and no
+// dispatch attempt in this long is the exact shape of the 2026-09-11
+// incident (27 pending across two projects, 0 running, for days, every
+// other surface reporting healthy). Deliberately much longer than
+// scheduler.cjs's own QUEUE_STARVATION_MS (10 min) — that's the watchdog's
+// OWN forcing threshold; this is the "even the watchdog isn't helping
+// anymore" signal a human needs to see.
+const DISPATCH_STALL_THRESHOLD_MS = 2 * 60 * 60_000;
+
+/**
+ * evaluateQueueDispatchHealth(queueState, runningCount, now, thresholdMs) →
+ * { ok, blocked?, starved?, pending?, dispatchable?, idleMs?, message? }
+ *
+ * Reuses classifyQueueStarvation's own verdict rather than re-deriving a
+ * second "is the queue stuck" heuristic — evaluateTickLiveness above already
+ * has one, but it does not distinguish a genuinely blocked dependsOn chain
+ * (which no amount of ticking can fix) from real dispatchable starvation, so
+ * reusing it here would report a dependency-blocked project as unhealthy
+ * dispatch even though nothing is actually wrong with dispatch itself. A
+ * `blocked` verdict therefore stays `ok: true` (never trips the health gate)
+ * but is still reported by name so it isn't silently invisible either.
+ */
+function evaluateQueueDispatchHealth(queueState, runningCount, now, thresholdMs = DISPATCH_STALL_THRESHOLD_MS) {
+  const verdict = classifyQueueStarvation({
+    jobs: queueState?.jobs,
+    paused: queueState?.paused,
+    runningCount,
+    lastRunAtMs: Date.parse(queueState?.lastDispatchAttemptAt ?? ''),
+    now,
+    thresholdMs,
+  });
+  if (!verdict) return { ok: true };
+  if (verdict.kind === 'blocked') {
+    return {
+      ok: true,
+      blocked: true,
+      pending: verdict.pending,
+      message: `${verdict.pending} pending job(s) behind a blocked dependsOn chain — dispatch cannot help, needs a human`,
+    };
+  }
+  const ageMin = Math.round(verdict.idleMs / 60_000);
+  return {
+    ok: false,
+    starved: true,
+    pending: verdict.pending,
+    dispatchable: verdict.dispatchable,
+    idleMs: verdict.idleMs,
+    message: `${verdict.dispatchable} dispatchable pending job(s), 0 running, no dispatch attempt in ~${ageMin}m `
+      + `(threshold ${Math.round(thresholdMs / 60_000)}m) — dispatch appears stuck`,
+  };
+}
+
+function loadUsagePollerState(statePath) {
+  let raw;
+  try {
+    raw = fs.readFileSync(statePath, 'utf8');
+  } catch (e) {
+    if (e.code === 'ENOENT') return { missing: true };
+    return { errorMessage: `cannot read scheduler-state.json: ${e.message}` };
+  }
+  try {
+    return { state: JSON.parse(raw) };
+  } catch (parseErr) {
+    return { errorMessage: `scheduler-state.json is corrupt: ${parseErr.message}` };
+  }
+}
+
 async function check() {
   const start = Date.now();
   const status = {
@@ -407,6 +545,16 @@ async function check() {
   try {
     queueState = queueStore.readMergedSync();
     if (queueState.unreadable) throw new Error(queueState.unreadable);
+    // A torn scheduler-machine.json is now recovered rather than halting
+    // dispatch (queueStore.cjs's findLongestValidJsonPrefix) — but recovery
+    // happening at all means the file failed to parse moments ago, which is
+    // exactly the "machine-runtime file fails to parse" signal health must
+    // surface as non-GREEN even though scheduling itself kept running.
+    if (queueState.machineStateRecovered) {
+      status.issues.push(
+        `scheduler-machine.json failed to parse and was recovered (mode=${queueState.machineStateRecoveryMode}) — see logs scope=scheduler`
+      );
+    }
     const runningCount = Object.values(queueState.jobs || {}).filter(
       (j) => j.status === 'running'
     ).length;
@@ -440,7 +588,7 @@ async function check() {
       .map(([cwd]) => cwd);
 
     status.components.scheduler_queue = {
-      ok: !liveness.stalled && projectsPastThreshold.length === 0,
+      ok: !liveness.stalled && projectsPastThreshold.length === 0 && !queueState.machineStateRecovered,
       path: queuePath,
       jobs: Object.keys(queueState.jobs || {}).length,
       running: runningCount,
@@ -450,6 +598,8 @@ async function check() {
       byProject: computeProjectProblemCounts(queueState.jobs),
       perProjectStall,
       tickLiveness: liveness.reason,
+      machineStateRecovered: queueState.machineStateRecovered ?? false,
+      machineStateRecoveryMode: queueState.machineStateRecoveryMode ?? null,
       // Informational only (PRD 1085): current 1-min loadavg per core vs the
       // launch-gate threshold, so a "nothing is launching" report can be
       // read next to the reason without opening the app.
@@ -485,6 +635,25 @@ async function check() {
         );
       }
     }
+    status.components.queue_dispatch = evaluateQueueDispatchHealth(queueState, runningCount, now);
+    if (!status.components.queue_dispatch.ok || status.components.queue_dispatch.blocked) {
+      status.issues.push(`Queue dispatch: ${status.components.queue_dispatch.message}`);
+    }
+
+    // Worktree cap blocking every dispatchable pending job with nothing
+    // running (see evaluateWorktreeCapBlocked's header) — a distinct
+    // condition from generic tick/dispatch staleness above, since a leaked
+    // cap count can hold a row `pending` with a fresh heldReason on every
+    // single tick (tickQueue keeps reaching spawnJob, per PRD 1141/1144's
+    // live evidence), never tripping evaluateTickLiveness's staleness check.
+    const worktreeCapBlocked = evaluateWorktreeCapBlocked(queueState.jobs, runningCount);
+    status.components.scheduler_queue.worktreeCapBlocked = worktreeCapBlocked;
+    if (!worktreeCapBlocked.ok) {
+      status.components.scheduler_queue.ok = false;
+      status.issues.push(
+        `Worktree cap is blocking dispatch with 0 jobs running: ${worktreeCapBlocked.capBlockedSlugs.join(', ')}`
+      );
+    }
   } catch (e) {
     if (e.code !== 'ENOENT') {
       status.issues.push(`Scheduler queue unreadable: ${e.message}`);
@@ -495,6 +664,26 @@ async function check() {
       exists: false,
       error: e.code === 'ENOENT' ? 'not yet created' : e.message,
     };
+    status.components.queue_dispatch = { ok: true };
+  }
+
+  // 3.5. Usage/rate-limit poller (scheduler.cjs pollLoop) — a distinct
+  // subsystem from scheduler_queue above: it can be alive (lastPollAt keeps
+  // advancing) while failing every single poll, silently, with nothing else
+  // surfacing it (the 57-consecutive-failure incident this check exists to
+  // catch). Missing state file means the poller hasn't run yet — not a
+  // failure. A CORRUPT file (the torn-write class fixed for the sibling
+  // scheduler-machine.json in f56bdc0) is NOT the same as missing — surfaced
+  // as non-GREEN rather than fail-open, via loadUsagePollerState below.
+  const loaded = loadUsagePollerState(SCHEDULER_STATE_PATH);
+  if (loaded.missing) {
+    status.components.usage_poller = { ok: true, applicable: false };
+  } else if (loaded.errorMessage) {
+    status.components.usage_poller = { ok: false, applicable: true, error: loaded.errorMessage };
+    status.issues.push(`Usage/rate-limit poller: ${loaded.errorMessage}`);
+  } else {
+    status.components.usage_poller = evaluateUsagePollerHealth(loaded.state);
+    if (status.components.usage_poller.message) status.issues.push(status.components.usage_poller.message);
   }
 
   // 4. Check PRDs directories — one per active project
@@ -688,7 +877,7 @@ async function check() {
   // Critical: nodejs, config dir, typescript, build artifact, test infrastructure.
   // Non-fatal: scheduler/transcripts dirs may not exist on fresh install.
   // Informational: app log age (shows if app is running, but not blocking).
-  const criticalComponents = ['nodejs', 'config_dir', 'typescript', 'build_artifact', 'test_infrastructure', 'scheduler_queue', 'prd_migration', 'claude_md_budget', 'delegation_chain'];
+  const criticalComponents = ['nodejs', 'config_dir', 'typescript', 'build_artifact', 'test_infrastructure', 'scheduler_queue', 'queue_dispatch', 'usage_poller', 'prd_migration', 'claude_md_budget', 'delegation_chain'];
   status.ok = criticalComponents.every((c) => status.components[c]?.ok !== false);
 
   status.elapsedMs = Date.now() - start;
@@ -713,9 +902,14 @@ module.exports = {
   computeEpicIndexDrift,
   evaluateEpicIndexHealth,
   computeProjectProblemCounts,
+  evaluateWorktreeCapBlocked,
   evaluatePerProjectStall,
   parseClaudeMdBudget,
   evaluateClaudeMdBudget,
+  evaluateUsagePollerHealth,
+  loadUsagePollerState,
+  evaluateQueueDispatchHealth,
+  DISPATCH_STALL_THRESHOLD_MS,
   TICK_STALL_THRESHOLD_MS,
   HEARTBEAT_STALE_MS,
 };

package/src/main/index.cjs

@@ -37,7 +37,7 @@ const epicWorktreeMint = require('./lib/epicWorktreeMint.cjs');
 const epicWorktreeMerge = require('./lib/epicWorktreeMerge.cjs');
 const epicWorktreeProjectConfig = require('./lib/epicWorktreeProjectConfig.cjs');
 const agentLibrary = require('./agentLibrary.cjs');
-const { checkDelegationReadiness, installPrdWriteGuard, installDestructiveGitGuard } = require('./lib/delegationReadiness.cjs');
+const { checkDelegationReadiness, installPrdWriteGuard, installDestructiveGitGuard, installInlineImplementationGuard } = require('./lib/delegationReadiness.cjs');
 const { MCP_TOOL_CATALOG, MCP_RECIPES } = require('./lib/mcpToolCatalog.cjs');
 const { sendIfAlive } = require('./lib/sendToRenderer.cjs');
 const { resolveBuildTarget } = require('./lib/buildTarget.cjs');
@@ -63,6 +63,10 @@ const { seedSchedulerMcp } = require('./seedSchedulerMcp.cjs');
 const { getSeedStatus } = require('./seedStatus.cjs');
 const otel = require('./otel.cjs');
 const otelSettings = require('./otelSettings.cjs');
+const telemetrySettings = require('./lib/telemetrySettings.cjs');
+const telemetryClient = require('./lib/telemetryClient.cjs');
+const telemetryBacklog = require('./lib/telemetryBacklog.cjs');
+const telemetryConsent = require('./lib/telemetryConsent.cjs');
 const { registerHistoryAggregatorHandlers, finalizeClosedDays, refreshIntradayToday } = require('./historyAggregator.cjs');
 const runLogRetention = require('./lib/runLogRetention.cjs');
 const { registerHistoryDashboardHandlers } = require('./historyDashboard.cjs');
@@ -391,6 +395,16 @@ function createWindow() {
     if (firstPaintTimer) { clearTimeout(firstPaintTimer); firstPaintTimer = null; }
     mainWindow.maximize();
     mainWindow.show();
+
+    // Backlog drain: ships the pre-existing errors-<date>.jsonl backlog every
+    // known project has already accumulated, marking exactly what's
+    // CONFIRMED delivered. Fired after the window is shown (never blocks
+    // startup) and yields between files internally. See telemetryBacklog.cjs.
+    require('./lib/telemetryBacklog.cjs')
+      .bootDrain({ appVersion: app.getVersion() })
+      .catch((e) => {
+        logs.writeLine({ scope: 'telemetry', level: 'warn', message: 'telemetryBacklog.bootDrain failed', meta: { error: e?.message } });
+      });
   });
 
   // Native right-click menu — Copy / Paste / Select All everywhere. Roles
@@ -513,17 +527,23 @@ ipcMain.handle('app:delegation-readiness', validated(schemas.delegationReadiness
   checkDelegationReadiness(payload)
 ));
 
-// The two readiness checks with a sanctioned one-press install. Session Manager
-// standardizes on the REFERENCE approach (absolute path to this repo's guard
-// script, never a vendored copy) — see installPrdWriteGuard's header. They stay
-// two handlers (and two PreToolUse entries) because the hooks have different
-// matchers: Write|Edit|NotebookEdit vs Bash — installDestructiveGitGuard's header.
+// The three readiness checks with a sanctioned one-press install. Session
+// Manager standardizes on the REFERENCE approach (absolute path to this
+// repo's guard script, never a vendored copy) — see installPrdWriteGuard's
+// header. prd-write-guard and destructive-git-guard stay separate handlers
+// (and separate PreToolUse entries) because those two hooks have different
+// matchers: Write|Edit|NotebookEdit vs Bash — installDestructiveGitGuard's
+// header. inline-implementation-guard shares prd-write-guard's matcher, so
+// its installer appends into that SAME matcher's `hooks` array instead.
 ipcMain.handle('app:install-prd-write-guard', validated(schemas.delegationReadinessCwd, (payload) =>
   installPrdWriteGuard(payload)
 ));
 ipcMain.handle('app:install-destructive-git-guard', validated(schemas.delegationReadinessCwd, (payload) =>
   installDestructiveGitGuard(payload)
 ));
+ipcMain.handle('app:install-inline-implementation-guard', validated(schemas.delegationReadinessCwd, (payload) =>
+  installInlineImplementationGuard(payload)
+));
 
 ipcMain.handle('app:engage-rules-path', () => process.env.SESSION_MANAGER_ENGAGE_RULES || null);
 
@@ -896,6 +916,23 @@ ipcMain.handle('otel:set-config', async (_e, cfg) => {
 ipcMain.handle('otel:status', () => otel.status());
 ipcMain.handle('otel:config-path', () => otelSettings.storePath());
 
+// Product telemetry (bilko.run) — anonymous, on-by-default, opt-out consent
+// UX + inspector over the client PRDs above wired. Settings > Telemetry's
+// "Product telemetry" section is the sole UI surface for this; see
+// session-manager-operations/architecture/telemetry.md for the data model.
+ipcMain.handle('telemetry:get-config', async () => telemetrySettings.load());
+ipcMain.handle('telemetry:set-config', validated(schemas.telemetrySetConfig, async (cfg) => {
+  const saved = await telemetryConsent.applyConsentUpdate(cfg, { telemetrySettings, telemetryClient });
+  return { ok: true, config: saved, status: telemetryClient.status() };
+}));
+ipcMain.handle('telemetry:status', () => ({
+  ...telemetryClient.status(),
+  backlog: telemetryBacklog.lastRunSummary(),
+}));
+ipcMain.handle('telemetry:config-path', () => telemetrySettings.storePath());
+ipcMain.handle('telemetry:recent-records', () => telemetryClient.recentRecords());
+ipcMain.handle('telemetry:flush-now', () => telemetryClient.flush('manual'));
+
 // Diagnostic-only renderer heap snapshot. No-op unless SM_HEAP_SNAPSHOT=1 —
 // see heapSnapshot.cjs for why this stays off by default.
 heapSnapshot.registerIpc({ ipcMain, getWindow: () => mainWindow });
@@ -1019,13 +1056,31 @@ app.whenReady().then(async () => {
   }
 
   process.on('uncaughtException', (err) => {
+    try {
+      require('./lib/telemetryClient.cjs').reportError({ name: 'uncaughtException', msg: err?.message, stack: err?.stack });
+    } catch { /* telemetry must never break the existing handling below */ }
     logs.writeLine({ scope: 'main', level: 'error', message: 'uncaughtException', meta: { error: err?.message, stack: err?.stack } });
   });
   process.on('unhandledRejection', (reason) => {
     const r = reason instanceof Error ? { error: reason.message, stack: reason.stack } : { reason: String(reason) };
+    try {
+      require('./lib/telemetryClient.cjs').reportError({ name: 'unhandledRejection', msg: r.error || r.reason, stack: r.stack });
+    } catch { /* telemetry must never break the existing handling below */ }
     logs.writeLine({ scope: 'main', level: 'error', message: 'unhandledRejection', meta: r });
   });
 
+  // Telemetry boot sequence: flush('boot') always, flush('version-change')
+  // when detected, and the once-per-machine install upsert (app_installs) when
+  // due (version bump or 30-day liveness heartbeat). See telemetryBoot.cjs.
+  require('./lib/telemetryBoot.cjs')
+    .bootSequence({
+      appVersion: app.getVersion(),
+      installChannel: require('./lib/machineProfile.cjs').resolveInstallChannel({ appPath: app.getAppPath() }),
+    })
+    .catch((e) => {
+      logs.writeLine({ scope: 'telemetry', level: 'warn', message: 'bootSequence failed', meta: { error: e?.message } });
+    });
+
   // Inject Content-Security-Policy for all renderer responses.
   // frame-src / frame-ancestors locked to 'none' — the app is a top-level
   // Electron BrowserWindow; iframes/embedding have no legitimate use.
@@ -1376,4 +1431,8 @@ app.on('before-quit', () => {
   // Best-effort flush of any pending OTEL spans. shutdown() has its own 2s
   // ceiling so a wedged exporter can't hold quit.
   otel.shutdown().catch(() => {});
+  // Best-effort delivery attempt for whatever telemetry accumulated this run.
+  // flush() only removes records it actually delivered — an interrupted or
+  // failed attempt leaves the queue file intact for the next boot's flush.
+  require('./lib/telemetryClient.cjs').flush('quit').catch(() => {});
 });

package/src/main/ipcSchemas.cjs

@@ -610,8 +610,9 @@ const projectBriefCwd = z.object({
 }).strict();
 
 // ──────────────────────────────────────────── Delegation readiness
-// Shared by app:delegation-readiness, app:install-prd-write-guard and
-// app:install-destructive-git-guard — all three take exactly { cwd }.
+// Shared by app:delegation-readiness, app:install-prd-write-guard,
+// app:install-destructive-git-guard and app:install-inline-implementation-guard
+// — all four take exactly { cwd }.
 const delegationReadinessCwd = z.object({
   cwd: z.string().min(1).max(4096),
 }).strict();
@@ -975,6 +976,21 @@ const pluginsAbort = z.object({
   slug: z.string().regex(PLUGIN_SLUG_RE).min(1).max(128),
 }).passthrough();
 
+// ──────────────────────────────────────────── Product telemetry (bilko.run)
+// Mirrors telemetrySettings.cjs's own isValid() shape — the renderer always
+// round-trips a full config object it got from telemetry:get-config, same
+// pattern as otel:set-config / OtelConfig.
+const telemetrySetConfig = z.object({
+  enabled: z.boolean(),
+  installId: z.string().max(200),
+  endpoint: z.string().min(1).max(2048),
+  noticeAckedAt: z.string().max(64).nullable(),
+  lastMachineReportAt: z.string().max(64).nullable(),
+  lastMachineReportVersion: z.string().max(64),
+  lastDailyFlushAt: z.string().max(64).nullable(),
+  schemaVersion: z.literal(1),
+});
+
 /**
  * Wrap an IPC handler with schema validation. Returns a new handler that
  * parses the payload before calling the original. On invalid payload throws
@@ -1093,6 +1109,7 @@ module.exports = {
     agentsSavePersona,
     agentsGetPersonaBody,
     delegationReadinessCwd,
+    telemetrySetConfig,
   },
   validated,
 };

package/src/main/lib/__tests__/crashTelemetry.test.cjs

@@ -0,0 +1,103 @@
+/**
+ * crashTelemetry.test.cjs — unit tests for the electron-free crash-report tap
+ * crashDiagnostics.cjs's render-process-gone / child-process-gone hooks and
+ * unclean-shutdown postmortem call into.
+ *
+ * Run: timeout 120 npx vitest run src/main/lib/__tests__/crashTelemetry.test.cjs
+ */
+'use strict';
+
+import { test, expect, afterEach } from 'vitest';
+const fsp = require('node:fs/promises');
+const os = require('node:os');
+const path = require('node:path');
+
+const { reportCrash } = require('../crashTelemetry.cjs');
+
+const tmpDirs = [];
+let originalHome;
+let originalSmTelemetrySpool;
+
+afterEach(async () => {
+  if (originalHome !== undefined) process.env.HOME = originalHome;
+  if (originalSmTelemetrySpool === undefined) delete process.env.SM_TELEMETRY_SPOOL; else process.env.SM_TELEMETRY_SPOOL = originalSmTelemetrySpool;
+  while (tmpDirs.length) {
+    const d = tmpDirs.pop();
+    await fsp.rm(d, { recursive: true, force: true });
+  }
+});
+
+async function mkHome() {
+  originalHome = process.env.HOME;
+  originalSmTelemetrySpool = process.env.SM_TELEMETRY_SPOOL;
+  const dir = await fsp.mkdtemp(path.join(os.tmpdir(), 'sm-crash-telemetry-home-'));
+  tmpDirs.push(dir);
+  process.env.HOME = dir;
+  // Explicit opt-in: overrides the test-environment no-op guard so this
+  // suite's real telemetryClient calls actually persist into an isolated dir.
+  process.env.SM_TELEMETRY_SPOOL = path.join(dir, '.config', 'session-manager');
+  return dir;
+}
+
+function freshClient() {
+  for (const p of ['../telemetryClient.cjs', '../../config.cjs', '../telemetrySettings.cjs', '../machineProfile.cjs']) {
+    const resolved = require.resolve(p);
+    delete require.cache[resolved];
+  }
+  const client = require('../telemetryClient.cjs');
+  client._setMachineProfileBuilder(async () => ({
+    appVersion: '0.83.0', platform: 'linux', arch: 'x64', machineDigest: 'deadbeefcafe',
+  }));
+  return client;
+}
+
+async function readQueueLines(client) {
+  const fs = require('node:fs/promises');
+  try {
+    const raw = await fs.readFile(client.queuePath(), 'utf8');
+    return raw.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+  } catch (e) {
+    if (e.code === 'ENOENT') return [];
+    throw e;
+  }
+}
+
+test('reportCrash names the record "crash.<reason>"', async () => {
+  await mkHome();
+  const client = freshClient();
+  await reportCrash({ reason: 'oom', meta: { type: 'render' }, deps: { telemetryClient: client } });
+  const [rec] = await readQueueLines(client);
+  expect(rec.wire.name).toBe('crash.oom');
+  client.shutdown();
+});
+
+test('a crash record carries the full attribution stamp: appVersion, platform, arch, machineDigest', async () => {
+  await mkHome();
+  const client = freshClient();
+  await reportCrash({ reason: 'killed', meta: { type: 'child', name: 'gpu' }, deps: { telemetryClient: client } });
+  const [rec] = await readQueueLines(client);
+  expect(rec.wire.version).toBe('0.83.0');
+  expect(rec.wire.context.platform).toBeTruthy();
+  expect(rec.wire.context.arch).toBeTruthy();
+  expect(rec.wire.context.machineDigest).toBeTruthy();
+  client.shutdown();
+});
+
+test('the unclean-shutdown postmortem is reported as crash.unclean-shutdown with the last memory sample', async () => {
+  await mkHome();
+  const client = freshClient();
+  await reportCrash({
+    reason: 'unclean-shutdown',
+    meta: { lastTotalMb: 1800, lastMainRssMb: 900, lastTop: ['renderer:900MB'] },
+    deps: { telemetryClient: client },
+  });
+  const [rec] = await readQueueLines(client);
+  expect(rec.wire.name).toBe('crash.unclean-shutdown');
+  expect(rec.wire.context.lastTotalMb).toBe(1800);
+  client.shutdown();
+});
+
+test('reportCrash never throws even when the injected telemetryClient throws', () => {
+  const throwingClient = { reportError: () => { throw new Error('telemetry boom'); } };
+  expect(() => reportCrash({ reason: 'oom', meta: {}, deps: { telemetryClient: throwingClient } })).not.toThrow();
+});