@@ -75,6 +75,9 @@ export function UsageStatisticsNotice({ onDetails }: { onDetails: () => void })
       <p>{zh
         ? "用于改进平台支持与使用体验。发送随机安装标识和环境信息，以及另行汇总的 CLI 使用次数、结果、耗时和 Goal 时长区间；不采集对话、代码、路径或命令参数。可随时关闭。"
         : "Helps improve platform support and usage. Sends a random installation ID and environment information, plus separate CLI usage, result, timing and Goal duration summaries. No conversations, code, paths or command arguments. You can turn it off at any time."}</p>
+      <p>{zh
+        ? "首个已测量的 CLI 结果立即上报，后续由使用活动触发，至少间隔 15 分钟发送一批。CLI 汇总不含安装标识；更频繁的请求仍可能让网络服务通过 IP 和请求时间关联活动。"
+        : "The first measured CLI result is sent immediately; later activity sends buffered counts at most once every 15 minutes. CLI summaries contain no installation ID; more frequent requests may still let network services correlate activity using IP addresses and request timing."}</p>
       <p className="personal-usage-recipient">{zh ? "接收方：" : "Recipient: "}{state.endpoint}</p>
       {error ? <p role="alert">{zh ? "设置未能保存，请打开详情重试。" : "Could not save this setting. Open details to retry."}</p> : null}
     </div>
 
@@ -75,8 +75,9 @@ Additional payload fields and invalid enum combinations are rejected.
 
 Interactive CLI, unattended scripts/agents and the App use the same
 **first disclosure → automatic activation → subsequent measurement** policy.
-The first ordinary CLI command prints the recipient, fields, purpose and
-both disable mechanisms to stderr, records the disclosure, and sends nothing.
+The first ordinary CLI command prints the recipient, fields, purpose, CLI delivery
+cadence, network timing correlation boundary and both disable mechanisms to
+stderr, records the disclosure, and sends nothing.
 This also applies to captured stderr in scripts and Agent tool calls; JSON
 stdout is unaffected. Discarded stderr (the null device) or a failed write
 cannot acknowledge a notice. Background `chat`/`serve-status` services defer
@@ -139,7 +140,12 @@ interactive and unattended CLI lanes; Goal-duration snapshots remain daily.
 
 Counts are capped at 128 distinct rows and 10,000 per row. Buffered counts expire
 after seven UTC days measured from the oldest buffered day. Existing daily
-buffers remain readable on upgrade. Each batch is removed and its attempt time
+buffer shapes remain readable. Notice revision 4 renews disclosure before the
+faster cadence takes effect: old notice state cannot send or consume buffers.
+Acknowledging the renewed notice discards old-scope counters and fences queued
+observations with a new generation; only subsequent measurements can send.
+Explicit disable remains disabled, and acknowledgment cannot replace explicit
+enable under `consent_required`. Each batch is removed and its attempt time
 persisted before the request starts under the same short lock; network waiting
 happens after release. Attempts are spaced even on failure or clock rollback.
 There are no immediate retries, background timers or durable network queues.
 
@@ -66,7 +66,8 @@ ID 随机生成，不绑定账号、不从硬件派生，但能跨天关联，
 ## 告知、设置与升级
 
 交互式 CLI、后台脚本/Agent 和 App 统一采用 **首次告知 → 自动开启 → 后续采集**。
-首次普通 CLI 命令向 stderr 显示接收方、字段、用途和关闭方法，然后记录告知；
+首次普通 CLI 命令向 stderr 显示接收方、字段、用途、CLI 发送频率、网络时序关联
+边界和关闭方法，然后记录告知；
 这一轮不计数、不发送。脚本和 Agent 工具调用捕获的 stderr 也适用，JSON stdout
 保持不变。stderr 指向空设备或输出失败时不记录告知。后台 `chat`/`serve-status`
 服务把首次告知交给 App，不以服务日志代替 App 界面。
@@ -110,8 +111,10 @@ authority provider 备份、公共投影。普通命令只读取很小的本地
 原有的次日发送机制；Goal 时长快照仍按天发送。
 
 本地汇总最多 128 种计数组合，每项封顶 10,000；以最早积压日期计算，超过七个 UTC
-日的计数丢弃。升级可继续读取旧的按日缓冲。每批在发送前持久化认领时间、移除对应
-计数，并在同一短锁内发起请求，网络等待不占锁。失败或时钟回拨也不能绕过间隔。
+日的计数丢弃。旧按日缓冲格式仍可读取。告知版本 4 要求在新频率生效前重新告知：
+确认前不发送、不消费缓存；确认后丢弃旧范围计数并更新 generation，阻止旧排队
+观测补发，后续新测量才可发送。明确关闭继续生效，`consent_required` 仍须明确启用。
+每批在发送前持久化认领时间、移除对应计数，并在同一短锁内发起请求，网络等待不占锁。失败或时钟回拨也不能绕过间隔。
 不会立即重试，不增加后台定时器或持久网络队列。间隔内停止使用仍可能丢失未发送的
 尾部计数；优化减少对次日回访的依赖，但不承诺完整采集。锁竞争、进程退出和网络
 故障也可能丢数。这是有损诊断，不能当账单或审计日志。
 
@@ -16,7 +16,7 @@ import type { CycleObservation } from "./usage_statistics_cycles.ts";
 
 export const STATE_SCHEMA = "loopx_usage_ping_state_v1";
 export const DEFAULT_ENDPOINT = "https://loopx-usage-collector.huangrt01.workers.dev/v1/ping";
-export const NOTICE_VERSION = 3;
+export const NOTICE_VERSION = 4;
 const AGGREGATE_INTERVAL_MS = 15 * 60 * 1000;
 export type Env = Record<string, string | undefined>;
 export type Context = { env: Env; version: string; python: string; channel: string; now?: Date };
@@ -105,7 +105,7 @@ export async function inspect(path: string, ctx: Context) {
     aggregate_preview: state.consent === "disabled" || !state.counters?.length ? null : { schema: AGGREGATE_SCHEMA, counters: state.counters },
     goal_preview: state.consent === "disabled" ? null : await goalPreview(path + ".goals", state.generation).catch(() => null),
     aggregate_day: state.day ?? null,
-    disclosure: "LoopX basic usage statistics are on by default after this notice. Daily heartbeats send a random installation ID, version, OS, CPU architecture, Python version and install channel to the configured LoopX collector (Cloudflare). Fixed CLI feature/result/duration/error counts are sent separately without an ID. Goal span/duration buckets and fixed Host labels are aggregated without Goal or installation IDs. Common quota-to-spend cycles cover every Host using the quota CLI; bound Codex tasks add local timing-event reads; managed Turns and regular owner Goal chat add direct Host-call timing. These overlapping measurements are separate, partial and not completion or billing evidence. Raw session content is never uploaded. No prompts, code, paths, arguments, Goal contents or raw errors. Disable all with loopx usage-ping disable or LOOPX_USAGE_PING=0; inspect with loopx usage-ping status. Consent-required distributions wait for explicit enable. Recipient: " + (endpoint(ctx.env) || "not configured") };
+    disclosure: "LoopX basic usage statistics are on by default after this notice. Daily heartbeats send a random installation ID, version, OS, CPU architecture, Python version and install channel to the configured LoopX collector (Cloudflare). Fixed CLI feature/result/duration/error counts are sent separately without an ID. The first measured CLI result is sent immediately; later activity sends buffered counts at most once every 15 minutes. More frequent requests can make network timing correlation easier: network services may observe IP addresses and request times even though CLI summaries have no installation ID. Goal span/duration buckets and fixed Host labels are aggregated without Goal or installation IDs. Common quota-to-spend cycles cover every Host using the quota CLI; bound Codex tasks add local timing-event reads; managed Turns and regular owner Goal chat add direct Host-call timing. These overlapping measurements are separate, partial and not completion or billing evidence. Raw session content is never uploaded. No prompts, code, paths, arguments, Goal contents or raw errors. Disable all with loopx usage-ping disable or LOOPX_USAGE_PING=0; inspect with loopx usage-ping status. Consent-required distributions wait for explicit enable. Recipient: " + (endpoint(ctx.env) || "not configured") };
 }
 export async function configure(path: string, ctx: Context, action: "enable" | "disable" | "acknowledge", expectedNotice?: unknown) {
   await withFileMutationLock(path, async () => {
 
@@ -15,6 +15,8 @@
 from .paths import DEFAULT_RUNTIME_ROOT
 
 STATE_FILENAME = "usage-ping.json"
+# Scheduling hint only; keep aligned with the TypeScript notice revision.
+_NOTICE_VERSION = 4
 _ENTRY = Path(__file__).parent / "control_plane/runtime/usage_statistics_cli.ts"
 
 
@@ -71,7 +73,7 @@ def begin(command: str) -> tuple[str, float] | None:
         state = json.loads(path.read_text(encoding="utf-8")) if path.exists() else {}
         if state.get("consent") == "disabled":
             return None
-        if (state.get("notice") or {}).get("version") != 3:
+        if (state.get("notice") or {}).get("version") != _NOTICE_VERSION:
             # App services defer disclosure to the visible frontend. Ordinary
             # script/Agent calls disclose on stderr too; JSON stdout stays clean.
             stream = sys.stderr
 
@@ -311,7 +311,7 @@ def test_source_first_usage_disclosure_keeps_json_pure_and_does_not_send(tmp_pat
     assert json.loads(result.stdout)["ok"] is True
     assert "random installation ID" in result.stderr
     stored = json.loads((state / "usage-ping.json").read_text())
-    assert stored["notice"]["version"] == 3
+    assert stored["notice"]["version"] == 4
     assert "last_attempt_day" not in stored and "counters" not in stored
 
 
 
@@ -54,7 +54,7 @@ test("midnight and high call volume cannot bypass 15-minute spacing; each batch
   assert.equal(batches.length, 3, "no empty periodic requests");
 });
 
-test("upgrade flushes retained legacy counts; expired counts are dropped before a new result", async t => {
+test("current-notice legacy buffer shape remains readable; expired counts are dropped before a new result", async t => {
   for (const [bufferDay, count] of [["2026-09-27", 8], ["2026-09-20", 1]] as const) {
     const { path, ctx, state, generation, batches, post } = await fixture(t);
     await writeFile(path, JSON.stringify({ ...await state(), day: bufferDay, counters: [{ ...row, count: 7 }], last_attempt_day: "2026-09-28" }));
@@ -131,3 +131,60 @@ test("a malformed legacy buffer cannot bypass outgoing aggregate validation", as
   await observe(path, ctx, generation, null, post);
   assert.deepEqual(batches, [], "duplicate counter keys are not a valid wire payload");
 });
+
+test("v3 upgrade waits for renewed notice, preserves pre-ack state and fences old observations", async t => {
+  for (const consent of ["default", "enabled"] as const) {
+    const { path, ctx, state, generation, batches, post } = await fixture(t);
+    await writeFile(path, JSON.stringify({ ...await state(), consent,
+      notice: { version: 3, endpoint: ctx.env.LOOPX_USAGE_PING_ENDPOINT, policy: "opt_out" },
+      day: "2026-09-28", counters: [{ ...row, count: 7 }] }));
+    const before = await readFile(path, "utf8");
+    const status = await inspect(path, ctx);
+    assert.equal(status.notice.version, 4);
+    assert.equal(status.blocked_by, "notice_required");
+    assert.equal(status.automatic_notice_required, true);
+    let attempts = 0;
+    for (const counter of [null, row]) {
+      await observe(path, ctx, generation, counter, async () => { attempts++; return 204; });
+    }
+    assert.equal(attempts, 0, "neither heartbeat nor aggregate can start before renewed notice");
+    assert.equal(await readFile(path, "utf8"), before, "unacknowledged buffers remain untouched");
+    await assert.rejects(configure(path, ctx, "acknowledge", { ...status.notice, version: 3 }), /usage_notice_changed/);
+    await configure(path, ctx, "acknowledge", status.notice);
+    const renewed = await state();
+    assert.notEqual(renewed.generation, generation);
+    assert.deepEqual(renewed.counters, [], "existing notice migration discards old-scope counts");
+    await observe(path, ctx, generation, row, post);
+    assert.deepEqual(batches, [], "queued old-generation work cannot send after acknowledgment");
+    await observe(path, ctx, renewed.generation, row, post);
+    assert.deepEqual(batches, [{ schema: AGGREGATE_SCHEMA, counters: [row] }]);
+  }
+});
+
+test("v3 renewal cannot undo disable or replace explicit consent", async t => {
+  for (const [consent, policy, reason] of [
+    ["disabled", "opt_out", "disabled"],
+    ["default", "consent_required", "consent_required"],
+  ] as const) {
+    const { path, ctx, state, generation } = await fixture(t);
+    const restricted = { ...ctx, env: { ...ctx.env, LOOPX_USAGE_POLICY: policy } };
+    await writeFile(path, JSON.stringify({ ...await state(), consent,
+      notice: { version: 3, endpoint: ctx.env.LOOPX_USAGE_PING_ENDPOINT, policy },
+      day: "2026-09-28", counters: [{ ...row, count: 7 }] }));
+    const before = await readFile(path, "utf8");
+    const status = await inspect(path, restricted);
+    assert.equal(status.blocked_by, reason);
+    assert.equal(status.automatic_notice_required, false);
+    await configure(path, restricted, "acknowledge", status.notice);
+    let attempts = 0;
+    await observe(path, restricted, generation, row, async () => { attempts++; return 204; });
+    assert.equal(attempts, 0);
+    assert.equal(await readFile(path, "utf8"), before);
+    assert.equal((await inspect(path, restricted)).sending, false);
+    if (policy === "consent_required") {
+      await configure(path, restricted, "enable");
+      await observe(path, restricted, (await state()).generation, row, async () => { attempts++; return 204; });
+      assert.ok(attempts > 0, "only explicit enable authorizes consent-required collection");
+    }
+  }
+});
@@ -163,7 +163,7 @@ test("scope expansion renews disclosure and fences old observations without undo
   assert.equal((await inspect(path,ctx)).blocked_by,"notice_required");
   await observe(path,ctx,prior.generation,null,async()=>{throw new Error("unexpected send");},undefined,cycle("start",at));
   await assert.rejects(readFile(path+".cycles"),/ENOENT/);
-  const enabled=await configure(path,ctx,"enable"); assert.equal(enabled.notice.version,3);
+  const enabled=await configure(path,ctx,"enable"); assert.equal(enabled.notice.version,4);
   const current=JSON.parse(await readFile(path,"utf8")); assert.notEqual(current.generation,prior.generation);
   await configure(path,ctx,"disable");
   assert.equal((await inspect(path,ctx)).consent,"disabled");
 
@@ -141,7 +141,7 @@ def test_absent_stderr_keeps_real_cli_json_pure_until_a_stream_discloses(isolate
     assert main(['version', '--format', 'json']) == 0
     assert 'random installation ID' in stderr.getvalue()
     assert json.loads(capsys.readouterr().out)['ok'] is True
-    assert json.loads(usage_ping.state_path().read_text())['notice']['version'] == 3
+    assert json.loads(usage_ping.state_path().read_text())['notice']['version'] == 4
 
 
 @pytest.mark.parametrize('setting,value', [
@@ -257,7 +257,15 @@ def test_detached_sender_honors_proxy_and_no_proxy(isolated, collector, monkeypa
     release.set()
 
 
-def test_real_chat_settings_share_cli_choice_and_reject_cross_origin(isolated):
+@pytest.mark.parametrize('upgrade', [False, True])
+def test_real_chat_settings_share_cli_choice_and_reject_cross_origin(isolated, upgrade):
+    if upgrade:
+        usage_ping.control('enable')
+        prior = json.loads(usage_ping.state_path().read_text())
+        prior['consent'] = 'default'
+        prior['notice']['version'] = 3
+        usage_ping.state_path().write_text(json.dumps(prior))
+        before = usage_ping.state_path().read_bytes()
     import http.client
     from loopx.chat_server import ChatHTTPServer, ChatRequestHandler
     server = ChatHTTPServer(('127.0.0.1', 0), ChatRequestHandler)
@@ -270,7 +278,11 @@ def test_real_chat_settings_share_cli_choice_and_reject_cross_origin(isolated):
         response = connection.getresponse()
         initial = json.loads(response.read())
         assert response.status == 200 and initial['automatic_notice_required']
-        assert not usage_ping.state_path().exists()
+        if upgrade:
+            assert usage_ping.state_path().read_bytes() == before
+        else:
+            assert not usage_ping.state_path().exists()
+        assert initial['notice']['version'] == 4
         connection.request('POST', path, json.dumps({'notice': initial['notice']}), {'Content-Type': 'application/json'})
         response = connection.getresponse()
         acknowledged = json.loads(response.read())
@@ -320,3 +332,41 @@ def test_goal_observer_does_not_wait_for_unresponsive_collector(isolated, collec
     assert not release.is_set(), 'host returned before collector released HTTP response'
     usage_ping.control('disable')
     release.set()
+
+
+def test_v3_cli_upgrade_requires_visible_renewal_before_real_http(isolated, collector, monkeypatch):
+    endpoint, received, accepted, release = collector
+    release.set()
+    monkeypatch.setenv('LOOPX_USAGE_PING_ENDPOINT', endpoint)
+    usage_ping.control('enable')
+    path = usage_ping.state_path()
+    old = json.loads(path.read_text())
+    old.update(consent='default', day='2026-09-28', counters=[{
+        'feature': 'todo', 'outcome': 'ok', 'duration': 'lt_1s', 'error': 'none', 'count': 7,
+    }])
+    old['notice']['version'] = 3
+    path.write_text(json.dumps(old))
+    before = path.read_bytes()
+    setup = 'import sys; from pathlib import Path; from loopx import usage_ping; usage_ping.DEFAULT_RUNTIME_ROOT=Path(sys.argv[1]); from loopx.cli_runtime import main; '
+    command = [sys.executable, '-c', setup + 'raise SystemExit(main(["version", "--format", "json"]))', str(isolated)]
+    hidden = subprocess.run(command, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True, timeout=30)
+    assert hidden.returncode == 0 and json.loads(hidden.stdout)['ok']
+    assert path.read_bytes() == before
+    assert not accepted.wait(0.3) and received == []
+    visible = subprocess.run(command, capture_output=True, text=True, timeout=30)
+    assert visible.returncode == 0 and json.loads(visible.stdout)['ok']
+    assert 'first measured CLI result' in visible.stderr and '15 minutes' in visible.stderr
+    assert 'network timing' in visible.stderr
+    current = json.loads(path.read_text())
+    assert current['notice']['version'] == 4
+    assert current['generation'] != old['generation']
+    assert current['counters'] == []
+    assert not accepted.wait(0.3) and received == []
+    subsequent = subprocess.run(command, capture_output=True, text=True, timeout=30)
+    assert subsequent.returncode == 0 and subsequent.stderr == ''
+    assert accepted.wait(5)
+    deadline = time.monotonic() + 5
+    while not any(item.get('schema') == 'loopx_usage_aggregate_v1' for item in received) and time.monotonic() < deadline:
+        time.sleep(0.02)
+    batches = [item for item in received if item.get('schema') == 'loopx_usage_aggregate_v1']
+    assert len(batches) == 1 and sum(row['count'] for row in batches[0]['counters']) == 1