diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 517ed20d..8bbc15c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,6 +46,9 @@ jobs:
       - run: npm ci
       - run: npm run typecheck
       - run: npm run test
+      - name: Test isolated telemetry benchmark transport
+        if: matrix.node-version == '22.22.0'
+        run: npm run benchmark:telemetry:test
       - name: Run evaluator tests
         if: matrix.node-version == '22.22.0'
         run: npm run eval:test
@@ -102,6 +105,11 @@ jobs:
           src/team/workflow/__tests__/repository-team-workflow-port.test.ts
           test/team-inbox-spec-authoring-real.contract.test.ts
           test/capabilities.test.ts
+          test/telemetry.test.ts
+          test/telemetry-delivery.test.ts
+          test/telemetry-context-schema.test.ts
+          test/telemetry-project-context.test.ts
+          test/telemetry-project-capture.test.ts
           src/logging/__tests__/policy.test.ts
           src/wiki/operations/__tests__/durability.test.ts
           src/wiki/operations/__tests__/identity-precision.test.ts
diff --git a/.mex/ROUTER.md b/.mex/ROUTER.md
index 557fbfde..9f2921a8 100644
--- a/.mex/ROUTER.md
+++ b/.mex/ROUTER.md
@@ -152,6 +152,23 @@ Then read this file fully before doing anything else in this session.
   all memory and other limits stay unchanged. A clean enforcing run on the new
   calibrated head remains required. Local same-code memory/latency evidence is
   retained in `docs/design/graph-isolation-diagnostic.json`.
+- Graph performance PR #180 passed the final checks (run `34291831733`) and
+  merged into `codex/0.8.1` as `d64f171`; the preceding calibration notes are
+  historical. Main remains separate.
+- Telemetry v2 is implemented on `codex/0.8.1-telemetry`, based on that merge,
+  and shared in draft PR #188 targeting `codex/0.8.1`. Local verification and
+  latency evidence for `9cbfab8` are retained. The follow-up context additions
+  pass 353 focused tests, typecheck/build and a separate actual-CLI benchmark;
+  fresh full and platform CI remains required. The approved random installation UUID is shared
+  across CLI and Hub. The user additionally approved existing scaffold UUIDs
+  for shared-project estimates and configured AI-tool names from project setup;
+  these cannot establish team size or identify the invoking agent. The bounded
+  reader never creates or repairs project identity. Content, paths, queries,
+  names, repository remotes, and contact data remain outside the event catalog.
+  Namespaced CLI outcomes, explicit Hub actions/pages, and terminal jobs use a
+  bounded per-user queue and cancellable delivery. Pure discovery/read commands
+  remain quiet. CLI feedback uses the existing Hub hosted form without an
+  analytics identity. See `docs/design/telemetry-v2.md` for validation status.
 - Targeted graph get/query/impact consumers use one provenance-bound immutable
   snapshot and discard output if graph or exact source identity changes.
 - The graph half of Checkpoint 2 is working in the Project Hub: grouped symbol
diff --git a/.mex/context/architecture.md b/.mex/context/architecture.md
index be912807..9fc02390 100644
--- a/.mex/context/architecture.md
+++ b/.mex/context/architecture.md
@@ -23,7 +23,7 @@ edges:
 # Broad overview: keep this empty unless a claim depends on a few specific symbols.
 # Entry shape: { node: "function:<tier-1-id>", fingerprint: "mh:64:<hex>" }
 grounds_to: []
-last_updated: 2026-09-06
+last_updated: 2026-09-09
 mex:
   id: mx_01M1M0CJ5C5XQV0HM5VM787WQS
   type: architecture
@@ -99,7 +99,7 @@ revision: 1
   can use Claude Code, Codex, or OpenCode, and prompt-only fallback works with
   any file-reading agent.
 - A local browser connects only to the loopback Project Hub and exchanges a one-use bootstrap token for a private session.
-- **posthog-node** — optional anonymous CLI telemetry; disabled for the development repository and by `DO_NOT_TRACK=1` or `MEX_TELEMETRY=0`.
+- **PostHog ingestion** — optional pseudonymous CLI/Hub events share one random installation UUID. A bounded read-only configuration snapshot can add the existing scaffold UUID for shared-project estimates and known configured AI-tool names; it never identifies the invoking agent or creates project identity. Names, remotes, paths, content, queries, and contact details remain excluded. A bounded per-user outbox and cancellable Node HTTP transport replace the SDK. Development checkouts and opt-out controls disable collection/delivery; see `TELEMETRY.md`.
 
 <!-- mex:entity
 id: mx_01M1M0CJ1E1X7BW1Q7PMGPVCRC
diff --git a/.mex/context/setup.md b/.mex/context/setup.md
index 9d40bb54..92aa990b 100644
--- a/.mex/context/setup.md
+++ b/.mex/context/setup.md
@@ -82,7 +82,7 @@ revision: 1
 ## Environment Variables
 
 - No environment variable is required for normal local CLI/library operation.
-- `MEX_TELEMETRY=0` or `DO_NOT_TRACK=1` (optional) — disable anonymous telemetry; the development repository also disables it automatically.
+- `MEX_TELEMETRY=0` or `DO_NOT_TRACK=1` (optional) — disable pseudonymous CLI/Hub telemetry; the development repository also disables it automatically.
 - `MEX_HOME` (optional) — override the base directory used for global MEX configuration, primarily for isolation in tests.
 - `MEX_DEV` (optional) — force development-repository behavior, including telemetry suppression.
 - `MEX_ENFORCE_RELEASE_BUDGETS=1` (release CI only) — enforce the pinned release resource budgets on the calibrated runner.
diff --git a/.mex/patterns/INDEX.md b/.mex/patterns/INDEX.md
index a2ce532f..266b02e4 100644
--- a/.mex/patterns/INDEX.md
+++ b/.mex/patterns/INDEX.md
@@ -4,6 +4,7 @@ Lookup table for project-specific pattern files.
 
 | Pattern | Use when |
 |---------|----------|
+| [`usage-telemetry.md`](usage-telemetry.md) | Changing CLI/Hub event coverage, opt-out, queue delivery, or usage measurement |
 | [`contract-first-external-adapter.md`](contract-first-external-adapter.md) | Freezing a consumer port before an independently owned implementation is pinned |
 | [`fresh-graph-hub-integration.md`](fresh-graph-hub-integration.md) | Connecting a real graph read or maintenance capability to the local Project Hub |
 | [`local-first-team-state.md`](local-first-team-state.md) | Adding canonical team artifacts, read-only repository observations, or per-user SQLite state |
diff --git a/.mex/patterns/usage-telemetry.md b/.mex/patterns/usage-telemetry.md
new file mode 100644
index 00000000..547dd421
--- /dev/null
+++ b/.mex/patterns/usage-telemetry.md
@@ -0,0 +1,100 @@
+---
+name: usage-telemetry
+description: Extend CLI and Hub usage measurement without leaking product data or delaying command exit.
+triggers:
+  - telemetry
+  - command outcomes
+  - retention analytics
+edges:
+  - target: context/conventions.md
+    condition: Before changing a capture, delivery, or persistence boundary
+  - target: patterns/release-performance-gate.md
+    condition: When evaluating a material command or Hub resource regression
+last_updated: 2026-09-09
+---
+
+# Usage telemetry
+
+## Context
+
+Read `TELEMETRY.md`, `docs/design/telemetry-v2.md`, and the closed catalog in
+`src/telemetry/schema.ts`. The shared random installation ID is approved for
+CLI/Hub repeat-use measurement. The user also approved the existing scaffold
+UUID for shared-project estimates and the project's configured AI-tool names.
+Neither installation counts nor shared scaffold IDs establish team size.
+Contact details belong to the separate voluntary hosted form, with no
+installation or scaffold ID appended.
+
+## Steps
+
+1. State the product question and denominator. Separate attempts, successful
+   completion, previews, applied changes, replay, and background job completion.
+2. Add only fixed names and bounded approved properties to the central catalog.
+   Project context permits an existing UUIDv4 and a sorted, unique selection of
+   at most six known AI-tool names. Never spread config, request bodies,
+   arguments, error objects, URLs, or other IDs.
+3. Capture from registered CLI command ancestry or a validated Hub server action.
+   Derive page categories locally. Pure discovery/read contracts, Hub polling,
+   SSE and idle timers must not manufacture engagement events.
+4. Preserve opt-out checks before capture and send. Keep inspection non-mutating.
+   Revalidate persisted data before transport; wrong schema/unsafe paths fail quiet.
+5. Preserve bounded delivery and cleanup. Test sockets/DNS and actual process
+   close, not only a Promise timeout around a fake sender. Do not introduce a
+   detached sender, unbounded queue, blocking lock, or retry loop.
+
+## Gotchas
+
+- `process.exit()` skips cleanup. Preserve action exit codes using normal return;
+  complete once in postAction or the main error/finally path, never both.
+- Atomic rename alone does not prevent a stale feedback/notice writer from
+  replacing an opt-out preference. Preserve the dedicated opt-out marker,
+  which only explicit enable removes.
+- A started event without completion can mean abrupt termination or delivery
+  loss. It does not prove product failure. Original timestamps/UUIDs survive retry.
+- A CLI command may finish before its final event can be sent. Later eligible use
+  drains the bounded queue. Seven-day expiry is enforced on subsequent access;
+  without a daemon, an untouched disk file may physically remain longer.
+- A request timeout alone is insufficient if unresolved DNS or referenced sockets
+  keep Node alive. Run the built CLI against a real hanging loopback endpoint.
+- For a cancellation test, await the actual loopback request/query before
+  timing the flush. Fixed setup sleeps can put first-use transport initialization
+  inside the cancellation interval. Preserve the production grace and elapsed
+  limit, and assert real cancellation, stopped queries and retained queue data.
+- Fixtures should inject a silent sink. Tests that enable telemetry must isolate
+  `MEX_HOME`, redirect only to loopback, and deny all other egress.
+- Read project metadata through the bounded, non-mutating telemetry reader;
+  never mint a scaffold ID to fill an event. Ordinary CLI operations reuse one
+  snapshot; setup/init can reread at completion after saving configuration.
+  Hub metadata stays fixed from its first enabled event until restart.
+- Match each command's actual project selection. Graph maintenance/status use
+  their exact root with local `--root` before parent `--root`; they must not
+  borrow an ancestor scaffold. Hub capture uses its bound project root exactly.
+  Ordinary commands retain their nearest-Git-root discovery behavior.
+- `configured_ai_tools` describes project setup, not the invoking agent.
+  Allow multiple selected tools without process/account probing. Missing or
+  malformed configuration omits context; unknown tool names never enter events.
+- Count distinct installations per scaffold over a stated window, such as 28
+  completed UTC days, and label two or more as a shared-project estimate.
+  One person's several machines and copied scaffold IDs can inflate it;
+  shared installations can hide it. Anyone with project config access can
+  associate its UUID with that project.
+
+## Verify
+
+Run focused catalog/privacy/outbox/opt-out/CLI/Hub tests, then typecheck and the
+appropriate integrated tests/build. Use `benchmark:telemetry:test` for harness
+safety and `benchmark:telemetry` with a preserved baseline for paired latency.
+Do not run other builds/tests during timing. Keep raw measurements and report
+local timing separately from pinned CI gates.
+
+## Debug
+
+Use `mex telemetry inspect` without creating state. Check opt-out precedence,
+queue availability, catalog rejection, request cancellation and expired claims.
+Do not fix missing events by capturing arguments/content or relaxing bounds.
+
+## Update scaffold
+
+Update the catalog documentation, metric definitions and `.mex/ROUTER.md` when
+coverage or guarantees change. Preserve existing grounding evidence; telemetry
+work does not authorize graph refresh or baseline acceptance.
diff --git a/README.es.md b/README.es.md
index 9972102a..785ac460 100644
--- a/README.es.md
+++ b/README.es.md
@@ -386,17 +386,17 @@ Las estructuras de Markdown existentes siguen siendo válidas y las lecturas del
 
 MEX no sube sus registros canónicos, Graph, índice de la Wiki, borradores, selección de identidad ni sesiones de Hub a un servicio de MEX. No ofrece transporte automático entre miembros del equipo: el contenido se comparte mediante las operaciones habituales de Git que tú realizas. Hub escucha en la interfaz de loopback y la capa de recuperación local de MEX no requiere credenciales de modelos.
 
-MEX tiene **telemetría seudónima de uso de la CLI**, activada por defecto salvo que la desactives. Cada invocación que cumpla las condiciones envía como máximo un evento. Los campos permitidos por MEX son un identificador aleatorio de la máquina, el nombre del comando, la versión de MEX, el sistema operativo, la versión de Node y, cuando existe una identidad disponible, un identificador de la estructura de MEX; el SDK de PostHog también añade metadatos con el nombre y la versión de su biblioteca. MEX no añade argumentos de comandos, rutas de archivos, nombres de repositorios, contenido de archivos ni direcciones IP al contenido enviado, aunque el servicio receptor puede observar los metadatos habituales del transporte.
+MEX tiene **telemetría seudónima de uso de la CLI y del Hub**, activada por defecto salvo que la desactives. Registra nombres de comandos, resultados, acciones explícitas del Hub, categorías de páginas y resultados de trabajos. Ambos usan un UUID aleatorio de instalación para medir el uso recurrente. Cuando están disponibles, también se envían el UUID existente del scaffold para estimar el uso compartido de un proyecto y los nombres de las herramientas de IA seleccionadas en su configuración; estos datos no identifican al agente que ejecuta el comando ni demuestran el tamaño de un equipo. Quien tenga acceso a la configuración puede asociar el UUID del scaffold con ese proyecto. No se envían nombres, remotos de repositorios, argumentos, rutas, contenido, búsquedas ni datos de contacto. El servicio receptor puede observar los metadatos habituales del transporte. Una cola local limitada y una espera breve al terminar la CLI permiten posponer el envío sin cambiar el resultado del comando.
 
 Consulta o desactiva la telemetría con:
 
 ```bash
 mex telemetry inspect
 mex telemetry status
-mex config set telemetry off
+mex telemetry disable
 ```
 
-También puedes desactivarla con `MEX_TELEMETRY=0` o `DO_NOT_TRACK=1`. Consulta la [política de telemetría](https://github.com/mex-memory/mex/blob/v0.8.0/TELEMETRY.md) para conocer los controles y el contenido exacto que se envía. Los agentes de programación conectados a MEX pueden tener su propio comportamiento de red y telemetría; eso depende de esas herramientas, no de MEX.
+También puedes desactivarla con `MEX_TELEMETRY=0` o `DO_NOT_TRACK=1`. Consulta la [política de telemetría](TELEMETRY.md) para conocer los controles y el contenido exacto que se envía. Los agentes de programación conectados a MEX pueden tener su propio comportamiento de red y telemetría; eso depende de esas herramientas, no de MEX.
 
 <a id="what-mex-is-not"></a>
 
diff --git a/README.md b/README.md
index 8c1accd4..234420f0 100644
--- a/README.md
+++ b/README.md
@@ -373,17 +373,17 @@ Existing Markdown scaffolds remain valid, and Graph reads never migrate a store
 
 MEX does not upload its canonical records, Graph, Wiki index, drafts, identity selection, or Hub sessions to a MEX service. It provides no automatic team transport: sharing happens through normal Git actions you perform. The Hub binds to loopback, and MEX's local retrieval layer requires no model credentials.
 
-MEX has **pseudonymous CLI usage telemetry**, enabled by default unless you opt out. An eligible invocation sends at most one event. MEX's allowlisted fields are a random machine identifier, command name, MEX version, operating system, Node version, and—when an existing identity is available—a scaffold identifier; the PostHog SDK also adds its library name/version metadata. MEX does not add command arguments, file paths, repository names, file contents, or IP addresses to the payload, though the ingestion service can observe ordinary transport metadata.
+MEX has **pseudonymous CLI and Hub usage telemetry**, enabled by default unless you opt out. Namespaced commands, outcomes, explicit Hub actions, page categories, and job results help measure feature use and returning installations. Both surfaces reuse one random installation UUID. When available, events also include the existing scaffold UUID to estimate shared-project use and configured AI-tool names from project setup; these do not identify the currently invoking agent or prove team size. Someone with access to project configuration can associate its scaffold UUID with that project. Names, repository remotes, argument values, paths, content, search text, and contact details stay excluded. The ingestion service can observe ordinary transport metadata. Delivery uses a bounded local queue and short CLI cleanup grace; offline telemetry does not change command results.
 
 Check or disable telemetry with:
 
 ```bash
 mex telemetry inspect
 mex telemetry status
-mex config set telemetry off
+mex telemetry disable
 ```
 
-It can also be disabled with `MEX_TELEMETRY=0` or `DO_NOT_TRACK=1`. See the [telemetry policy](https://github.com/mex-memory/mex/blob/v0.8.0/TELEMETRY.md) for the controls and exact payload. Coding agents connected to MEX may have their own network and telemetry behavior; that is governed by those tools, not by MEX.
+It can also be disabled with `MEX_TELEMETRY=0` or `DO_NOT_TRACK=1`. See the [telemetry policy](TELEMETRY.md) for the controls, event catalog, privacy boundary, and delivery limits. Coding agents connected to MEX may have their own network and telemetry behavior; that is governed by those tools, not by MEX.
 
 ## What MEX is not
 
diff --git a/README.pt-BR.md b/README.pt-BR.md
index afb0d6d0..af2e1284 100644
--- a/README.pt-BR.md
+++ b/README.pt-BR.md
@@ -386,17 +386,17 @@ As estruturas existentes em Markdown continuam válidas, e as consultas ao Graph
 
 O MEX não envia seus registros canônicos, Graph, índice da Wiki, rascunhos, seleção de identidade ou sessões do Hub para um serviço MEX. Ele não oferece transporte automático entre integrantes da equipe: o compartilhamento acontece pelas ações normais do Git que você executa. O Hub escuta no endereço de loopback, e a camada local de consulta do MEX não exige credenciais de modelo.
 
-O MEX tem **telemetria pseudônima de uso da CLI**, ativada por padrão, a menos que você a desative. Uma execução elegível envia no máximo um evento. Os campos permitidos pelo MEX são um identificador aleatório da máquina, nome do comando, versão do MEX, sistema operacional, versão do Node e — quando uma identidade existente está disponível — um identificador da estrutura MEX; o SDK do PostHog também acrescenta metadados com o nome e a versão de sua biblioteca. O MEX não inclui argumentos de comandos, caminhos de arquivos, nomes de repositórios, conteúdo de arquivos ou endereços IP nos dados enviados, embora o serviço de ingestão possa observar os metadados normais de transporte.
+O MEX tem **telemetria pseudônima de uso da CLI e do Hub**, ativada por padrão, a menos que você a desative. Registra nomes de comandos, resultados, ações explícitas do Hub, categorias de páginas e resultados de tarefas. Ambos usam um UUID aleatório da instalação para medir o uso recorrente. Quando disponíveis, também são enviados o UUID existente do scaffold para estimar o uso compartilhado de um projeto e os nomes das ferramentas de IA selecionadas na configuração; esses dados não identificam o agente que executa o comando nem comprovam o tamanho da equipe. Quem tem acesso à configuração pode associar o UUID do scaffold àquele projeto. Não são enviados nomes, remotos de repositórios, argumentos, caminhos, conteúdo, pesquisas ou dados de contato. O serviço receptor pode observar metadados normais de transporte. Uma fila local limitada e uma breve espera ao encerrar a CLI permitem adiar o envio sem alterar o resultado do comando.
 
 Confira ou desative a telemetria com:
 
 ```bash
 mex telemetry inspect
 mex telemetry status
-mex config set telemetry off
+mex telemetry disable
 ```
 
-Ela também pode ser desativada com `MEX_TELEMETRY=0` ou `DO_NOT_TRACK=1`. Consulte a [política de telemetria](https://github.com/mex-memory/mex/blob/v0.8.0/TELEMETRY.md) para conhecer os controles e os dados exatos enviados. Os agentes de programação conectados ao MEX podem ter seus próprios comportamentos de rede e telemetria; isso é regido por essas ferramentas, não pelo MEX.
+Ela também pode ser desativada com `MEX_TELEMETRY=0` ou `DO_NOT_TRACK=1`. Consulte a [política de telemetria](TELEMETRY.md) para conhecer os controles e os dados exatos enviados. Os agentes de programação conectados ao MEX podem ter seus próprios comportamentos de rede e telemetria; isso é regido por essas ferramentas, não pelo MEX.
 
 <a id="what-mex-is-not"></a>
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 5b6784d3..b7612f7b 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -386,17 +386,17 @@ mex capabilities --json
 
 MEX 不会将其权威记录、Graph、Wiki 索引、草稿、身份选择或 Hub 会话上传到 MEX 服务。它不提供自动的团队数据传输：共享依靠你执行的常规 Git 操作。Hub 绑定到回环地址，MEX 的本地检索层无需模型凭证。
 
-MEX 具有**使用假名标识的 CLI 使用遥测**，默认启用，除非你选择退出。符合条件的调用最多发送一个事件。MEX 允许发送的字段包括随机机器标识符、命令名、MEX 版本、操作系统、Node 版本，以及在已有身份可用时的基础结构标识符；PostHog SDK 还会添加其库名称和版本元数据。MEX 不会向载荷添加命令参数、文件路径、仓库名、文件内容或 IP 地址，但接收服务可以观察到常规传输元数据。
+MEX 具有**使用假名标识的 CLI 和 Hub 使用遥测**，默认启用，除非你选择退出。遥测记录命令名称和结果、Hub 的明确操作、页面类别及后台任务结果。两者共用一个随机安装 UUID，以衡量重复使用情况。如果配置可用，事件还会包含已有的 scaffold UUID，用于估算项目的共享使用情况，以及项目配置中选定的 AI 工具名称；这些信息不能识别当前调用命令的智能体，也不能确定团队人数。能访问项目配置的人可以将该 scaffold UUID 与项目关联。不会发送名称、仓库远程地址、参数值、路径、内容、搜索文本或联系方式。接收服务可以观察到常规传输元数据。事件使用有大小限制的本地队列；CLI 退出时只短暂等待，离线发送不会改变命令结果。
 
 通过以下命令检查或关闭遥测：
 
 ```bash
 mex telemetry inspect
 mex telemetry status
-mex config set telemetry off
+mex telemetry disable
 ```
 
-也可以通过 `MEX_TELEMETRY=0` 或 `DO_NOT_TRACK=1` 禁用。控制选项和精确载荷见[遥测政策](https://github.com/mex-memory/mex/blob/v0.8.0/TELEMETRY.md)。连接到 MEX 的编程智能体可能有自己的网络和遥测行为；这些由相应工具决定，而非 MEX。
+也可以通过 `MEX_TELEMETRY=0` 或 `DO_NOT_TRACK=1` 禁用。控制选项和精确载荷见[遥测政策](TELEMETRY.md)。连接到 MEX 的编程智能体可能有自己的网络和遥测行为；这些由相应工具决定，而非 MEX。
 
 <a id="what-mex-is-not"></a>
 
diff --git a/TELEMETRY.md b/TELEMETRY.md
index 003ec014..49ffa1b4 100644
--- a/TELEMETRY.md
+++ b/TELEMETRY.md
@@ -1,94 +1,155 @@
 # Telemetry
 
-mex collects **anonymous, opt-out** usage data so the maintainer can see how the
-tool is actually used — which commands matter, roughly how many people use it,
-and whether a project is used by a team. That's the entire purpose. There is no
-advertising, no profiling, and no way to tie any data back to a person.
-
-If you'd rather send nothing, see [How to opt out](#how-to-opt-out) — it's one
-command or one environment variable.
+MEX collects **pseudonymous, opt-out usage events** to understand feature use,
+success rates, and whether installations return. CLI and Hub events share one
+random installation UUID. When available, events also carry the project's
+existing random scaffold UUID and its configured AI-tool names. An installation
+is not a person: two computers have different IDs, and a shared installation
+has one ID. Multiple installations using one scaffold can indicate shared
+project use, but cannot establish a team or its size.
 
 ## What is collected
 
-Every time you run a `mex` command, **one** event is sent containing **exactly**
-these fields and nothing else:
-
-| Field | Example | What it is |
-|-------|---------|------------|
-| `machine_id` | `3f2a…` (random UUID) | A random ID generated once per machine. Not your username, hostname, or anything derived from you. |
-| `scaffold_id` | `9b1c…` (random UUID) | A random ID for the mex scaffold (project). Only present when you run inside a scaffold. Lets us tell "one team on one project" apart from "one person on many machines." |
-| `command` | `check` | The command **name only** — e.g. `check`, `sync`, `log`. |
-| `mex_version` | `0.5.1` | The installed mex version. |
-| `os` | `darwin` | The platform string (`darwin` / `linux` / `win32`). |
-| `node_version` | `v22.17.1` | The Node.js version. |
-
-You can see the literal payload that would be sent, at any time, without sending
-anything:
+Every event has a name from a fixed catalog, an original UTC timestamp, a random
+event UUID for deduplication, and a random installation UUID (`distinct_id` and
+`installation_id`). Common properties are `schema_version: 2`, `source`
+(`cli` or `hub`), MEX version, OS platform, and Node version. Person-profile
+creation and GeoIP enrichment are explicitly disabled. All six events can also
+include these optional properties:
+
+| Property | Source and meaning |
+| --- | --- |
+| `scaffold_id` | The existing UUIDv4 in the project's `.mex/config.json`; telemetry never creates or repairs it. |
+| `configured_ai_tools` | A sorted, unique list of configured tool names: `claude`, `codex`, `copilot`, `cursor`, `opencode`, and/or `windsurf`. This is the project's setup selection, not the agent currently invoking MEX. |
+
+The metadata reader performs a bounded, read-only snapshot of the existing
+project configuration. Ordinary CLI commands reuse one snapshot; `setup` and
+`init` reread it at completion so newly saved configuration can appear in the
+completion event. The Hub keeps its project's snapshot from the first enabled
+event until restart. Missing, malformed, unreadable, or unsafe configuration
+omits this metadata. Invalid scaffold IDs and unknown tool names are excluded.
+An explicitly empty tool selection can appear as `[]`. MEX does not inspect
+running processes or tool accounts to determine which agent is in use.
+
+| Event | Additional fields | Purpose |
+| --- | --- | --- |
+| `cli.command_started` | Namespaced command, stage | Count eligible invocations, including those interrupted before completion |
+| `cli.command_completed` | Command, stage, outcome, duration in ms | Feature use and success/failure rates |
+| `hub.session_started` | None | Count successful Hub starts; not active engagement by itself |
+| `hub.page_viewed` | Fixed page category | Understand navigation without sending URLs |
+| `hub.action_completed` | Fixed action, stage, outcome, duration in ms; optional apply replay flag | Understand explicit actions and distinguish preview from apply |
+| `hub.job_completed` | Fixed job kind, outcome, duration in ms | Understand graph/Wiki job results |
+
+Commands use names such as `wiki.query` and `relay.draft.save`. Stages are
+`preview`, `apply`, or `direct`; the program derives the stage without sending
+argument values. Outcomes are `success`, `failure`, or `cancelled` (for Hub
+jobs). Durations are capped at 24 hours. CLI completion means the command's
+exit status; a successful preview is not a published artifact. For TUI and
+interval-watch launchers, completion describes startup of the interface or
+watcher, not the end of that later session.
+
+Hub pages are categories such as `knowledge_detail`, never a knowledge ID or a
+URL. Validated Hub actions and terminal job results are recorded on the local
+server. Ordinary API reads, polling, SSE, typing, and repeated renders do not
+produce usage events. Page events are capped at 60 per minute per Hub process.
+
+CLI telemetry/configuration controls and explicitly pure discovery/read
+surfaces stay silent: `capabilities`, `logging`, `timeline`, Team list/show/
+contract/target reads, Spec reads, and `skills sync`. Hub bootstrap is counted
+by the Hub event rather than a second CLI event. Explicit Team mutation
+commands are eligible. Unknown commands and invalid options rejected before
+an action starts produce no command event.
+
+Inspect the current catalog, example payloads, queue limits, and existing local
+queue metadata without creating an ID, writing a queue, or sending anything:
 
 ```bash
 mex telemetry inspect
+mex telemetry status
 ```
 
-## What is NEVER collected
-
-- **No personal data** — no name, email, username, hostname, or git identity.
-- **No IP address or location** — geolocation is explicitly disabled.
-- **No command arguments, flags, or paths.**
-- **No file names or file contents.**
-- **No repository name or git remote URL.**
-
-`machine_id` and `scaffold_id` are random UUIDs. They are **not** derived from
-your path, repo, email, or anything identifying — they are just random numbers
-that let counts be de-duplicated.
-
-## Where the data goes
-
-[PostHog](https://posthog.com) Cloud, **US region** (`https://us.i.posthog.com`).
-The ingestion key embedded in mex is write-only — it can send events but cannot
-read any data back.
-
-## When telemetry does NOT run
-
-Telemetry is automatically disabled — no event sent, no ID file created — when:
-
-- any opt-out below is active, **or**
-- mex is run from a clone of the mex repository itself (so the maintainer's own
-  development never pollutes the data).
-
-A telemetry failure (offline, firewall, ad-blocker) never blocks, slows, or
-changes the exit code of any command. It is fire-and-forget and fully ignored on
-error.
-
-## How to opt out
-
-Any **one** of these turns telemetry off completely. When off, no event is ever
-sent and the machine-id file is never created.
-
-| Method | Scope |
-|--------|-------|
-| `DO_NOT_TRACK=1` | The industry-standard env var. Honored everywhere. |
-| `MEX_TELEMETRY=0` | mex-specific env var. |
-| `mex config set telemetry off` | Persisted in `~/.mex/config.json` (per-machine). Re-enable with `mex config set telemetry on`. |
-
-Check the current state and the active opt-out reason any time:
+## What is excluded
+
+MEX does not put names, email addresses, usernames, hostnames, Git identities,
+repository names/remotes, file paths, code, knowledge/log content, search text,
+raw arguments, receipt tokens, or Member/artifact IDs in events. The only
+project identifier is the existing random scaffold UUID described above.
+Unknown event properties and values are rejected, including when reading queued
+events back from disk.
+
+Random IDs allow repeat-use measurement; this is pseudonymous data, not a claim
+of complete anonymity. A scaffold UUID can be linked to its project by anyone
+who also has access to that project's configuration. One person using several
+machines, a shared installation, or copied scaffolds retaining an ID can distort
+estimates of shared use. Requests go to [PostHog Cloud](https://posthog.com), US
+region (`https://us.i.posthog.com/batch/`). MEX does not add an IP address to the
+payload. The receiving service can observe the request's IP and ordinary
+transport metadata; disabling GeoIP is not a promise that transport metadata
+never exists.
+
+## Delivery and performance
+
+Events enter a small local queue. Delivery runs opportunistically while a CLI
+command works and periodically while the Hub is open. CLI cleanup gives network
+delivery a 25 ms grace by default, then cancels outstanding delivery. There is no detached
+sender, retry loop, or telemetry daemon. Hub batching uses an unreferenced
+15-second timer; each request has a 2-second timeout. A request failure does not
+change product output or exit status.
+
+The queue retains at most 256 events, 256 KiB of event payload, in a database
+bounded to 1 MiB. Events older than seven days are discarded on the next queue access and are never sent; without a daemon, an untouched
+queue file may physically remain on disk longer. Batches contain at most 32
+events.
+A busy or unavailable queue drops telemetry instead of waiting on another
+command. Queue and network work still have a small CPU/disk cost; latency is
+measured with the actual CLI, including unreachable and hanging servers.
+
+Delivery is best effort. A short command's final event can remain queued until
+another eligible invocation or Hub session; a final invocation might never be
+sent. Oldest events are evicted at the bounds. Retries retain the original event
+time and UUID. Abrupt termination can leave a start without a completion;
+absence of completion does not prove command failure. Do not interpret the
+resulting counts as an exhaustive audit log. Local queue expiry does not set
+the hosted analytics service's retention period.
+
+## Opt out
+
+Any one of these disables collection and sending:
 
 ```bash
-mex telemetry status
+mex telemetry disable
+# Equivalent persisted preference:
+mex config set telemetry off
+# Or an environment override:
+DO_NOT_TRACK=1 mex check
+MEX_TELEMETRY=0 mex check
 ```
 
-## Files mex writes for telemetry
-
-- `~/.mex/telemetry-id` — your random `machine_id` (mode `0600`). Created only
-  when telemetry is enabled. Delete it any time; a new one is generated on the
-  next enabled run.
-- `~/.mex/config.json` — your global preferences, including the telemetry
-  opt-out flag.
-
-These are separate from a project's `.mex/config.json`, which holds the
-project's `scaffold_id`.
-
-## A note on PostHog metadata
-
-The PostHog client library attaches two of its own fields to each event —
-`$lib` (`posthog-node`) and `$lib_version`. These describe the sending library,
-not you, and contain no personal or usage data.
+`mex telemetry enable` restores the stored preference and removes the local
+opt-out marker; environment overrides still win. The marker prevents unrelated
+concurrent preference writes from silently re-enabling telemetry. An unreadable,
+malformed, or unsafe existing global preference file also keeps telemetry off; a missing file uses the default. Development
+checkouts of MEX and `MEX_DEV` also disable telemetry.
+Opt-out is checked before capture and delivery. Explicit disable cancels this
+process's delivery and attempts to clear the existing bounded queue. A locked
+or damaged queue can prevent cleanup, but the stored opt-out still prevents
+sending on subsequent invocations. Already delivered events are not deleted
+by a local opt-out.
+
+Telemetry uses `~/.mex/telemetry-id` (a random UUID, mode `0600`),
+`~/.mex/telemetry/outbox.db` (inside a directory created with mode `0700`), and
+the global preference in `~/.mex/config.json`. Explicit disable also writes
+`~/.mex/telemetry-disabled`, a small opt-out marker removed only by explicit
+enable. A short-lived SQLite rollback journal may exist during writes. The
+telemetry queue, installation identity, and preferences are local to the user;
+telemetry writes nothing to the project's Git artifacts. The existing scaffold
+UUID and tool selection are read from project configuration, which may already
+be shared through Git. `MEX_HOME` relocates the global `.mex` directory.
+
+## Voluntary feedback and contact
+
+`mex feedback` and the Hub's **Help shape MEX** card open the same
+[hosted feedback form](https://tally.so/r/KYjv4k). MEX does not collect contact
+details in its telemetry or append an installation ID to the form URL. Any
+contact details voluntarily provided to that form are handled separately from
+usage analytics. The form is managed outside this repository.
diff --git a/docs/design/0.8.1-release-plan.md b/docs/design/0.8.1-release-plan.md
index 728844bc..1747a5ae 100644
--- a/docs/design/0.8.1-release-plan.md
+++ b/docs/design/0.8.1-release-plan.md
@@ -4,9 +4,14 @@ Status: Phases 1, 2, 2b, 3, and 4 implemented and locally verified.
 Phase 2b is committed locally as `7f4575f`. Phase 3 (Practical Relays) is
 committed locally as `02eafd4`. Phase 4 is committed as `d554258`.
 Phase 5 is implemented; platform verification is tracked by the draft PR checks.
-Phase 6 has not started.
+Phase 6 is implemented on `codex/0.8.1-telemetry`, based on `d64f171`
+(the graph performance PR merged into `codex/0.8.1`), in draft PR #188.
+The initial `9cbfab8` implementation passed CI. The approved scaffold UUID and
+configured-tool follow-up is locally verified in its separate validation
+addendum; fresh full and platform CI remains required.
 The three Settings heap leaves are calibrated from retained pinned Linux
-evidence; enforcing CI after that correction remains a release gate.
+evidence. Subsequent graph-performance PR #180 passed its final enforcing CI
+and merged into `codex/0.8.1`; each later change still requires its own checks.
 Branch: `codex/0.8.1`, starting from `4942489`.
 Draft PR: [#176](https://github.com/mex-memory/mex/pull/176), targeting `main`.
 
@@ -19,7 +24,8 @@ final change, and isolate Windows changes so their effects can be reviewed.
 
 Phases 1 through 4 were committed locally. Phase 5 implementation and Windows
 verification through the existing GitHub Actions runner are authorized.
-Release publication and telemetry delivery remain outside this checkpoint.
+Release publication remains outside this checkpoint. Phase 6 implementation
+is authorized as a separate branch targeting `codex/0.8.1`; do not merge to main.
 
 ## Phases
 
@@ -31,7 +37,7 @@ Release publication and telemetry delivery remain outside this checkpoint.
 | 3. Practical Relays | Open-to-team audience including future active Members; drafts without recipients; shorter agent/CLI saving; persistent sharing and claim-eligibility information; inactive-member recovery. | An engineer can save context now and an eligible teammate can take it later; local publication is never presented as verified delivery. | Locally verified |
 | 4. Focused corrections and knowledge reuse | Unknown-file migration classification, contribution/evidence provenance, confirmed fresh-install bugs, configurable agent logging and relevant log retrieval, docs/translations. | Identified defects are fixed; logging policy is understandable; prior notes can inform work without treating every note as accepted knowledge. | Locally verified; Settings calibrated; enforcing CI pending |
 | 5. Windows hardening | Two independently reviewable changes: narrow CRLF normalization, then preserve full-width inode identity in affected paths. | Content/revision, preview/recovery, replacement, and lock checks pass, including real Windows coverage. | Implemented; platform results in draft PR checks |
-| 6. Telemetry | Separate final change: namespaced CLI commands and outcomes; server-side allowlisted Hub events excluding IDs, paths, content, search text, and personal data; honor opt-outs. | Payloads, outcomes, opt-outs, and documentation have dedicated verification. | Not started |
+| 6. Telemetry | Separate final change: namespaced CLI commands and outcomes; server-side allowlisted Hub events sharing the approved installation UUID, with optional existing scaffold UUID and configured AI-tool names; exclude names, remotes, Member/artifact IDs, paths, content, search text, and contact details; honor opt-outs. | Payloads, outcomes, opt-outs, and actual CLI latency have dedicated verification. | Initial CI passed; context follow-up locally verified on separate branch, fresh CI required |
 
 ## Phase 1 boundary
 
@@ -630,3 +636,36 @@ pinned Windows/Linux CI evidence before release where local checks cannot
 provide it. Do not widen a budget merely to fit a change.
 
 Update this plan with actual results and remaining work as phases finish.
+
+
+## Phase 6: usage telemetry and voluntary feedback
+
+This phase is isolated on `codex/0.8.1-telemetry` from `d64f171`, in draft
+PR #188 targeting `codex/0.8.1`. The user explicitly approved a shared random
+installation UUID across CLI and Hub, superseding the earlier no-IDs-in-Hub
+plan, and subsequently approved restoring existing scaffold UUIDs for
+shared-project estimates and adding configured AI-tool names. No project name,
+repository remote, Member/artifact ID, email, or content enters events. Contact
+collection remains voluntary in the hosted feedback form, without an analytics
+identity in its URL.
+
+Distinct installations using a scaffold during 28 completed UTC days provide
+a shared-project signal, not a verified team count: one person can use several
+machines, and copied scaffold IDs or shared installations can distort it.
+Configured tool names describe project setup rather than the current invoking
+agent. Project config is read in a bounded, non-mutating snapshot without
+minting identity; setup/init can reread at completion, while Hub changes appear
+after restart. Someone with config access can link its UUID to that project.
+
+The implementation and validation record is in
+[`telemetry-v2.md`](telemetry-v2.md). Network delivery stays best effort and
+bounded. Historical local verification for `9cbfab8` passed: 3,500 root tests
+(one skipped), 434 Hub web tests, two browser checks, workspace typecheck/build,
+fresh packed-install smoke, and the actual-CLI latency benchmark. These results
+do not validate the subsequent context additions. Their separate addendum
+records 353 focused tests, typecheck/build, seven benchmark-harness tests and
+the completed actual-CLI comparison. The metadata helper measured below 0.7 ms
+at p95 locally; full-process differences were noisy and are retained without a
+zero-overhead claim. Fresh full and platform CI is required before merge. See
+the linked record for measurements and platform/release gates. The release
+branch and main are not merged as part of this work.
diff --git a/docs/design/telemetry-performance-results.json b/docs/design/telemetry-performance-results.json
new file mode 100644
index 00000000..bff1d91e
--- /dev/null
+++ b/docs/design/telemetry-performance-results.json
@@ -0,0 +1,4499 @@
+{
+  "schemaVersion": 1,
+  "kind": "telemetry-local-performance-characterization",
+  "generatedAt": "2026-09-09T13:35:22.436Z",
+  "environment": {
+    "node": "v22.17.1",
+    "platform": "darwin",
+    "release": "25.0.0",
+    "architecture": "arm64",
+    "cpu": "Apple M4"
+  },
+  "builds": [
+    {
+      "name": "baseline",
+      "cliSha256": "3a6d0d2d6682b011b86d71ebe1d5c9eccead4262f53e85743bcf34cc116d4832"
+    },
+    {
+      "name": "candidate",
+      "cliSha256": "66719ebce3f290134557cfa62533939093d5fa745ee8708a7e4afa1f03b366ea"
+    }
+  ],
+  "methodology": {
+    "samplesPerCondition": 20,
+    "warmupsPerCondition": 5,
+    "commandArguments": [
+      {
+        "name": "success",
+        "args": [
+          "commands"
+        ]
+      },
+      {
+        "name": "failure",
+        "args": [
+          "check",
+          "--json"
+        ]
+      }
+    ],
+    "conditionOrder": "rotated every round; baseline/candidate order alternates",
+    "measuredInterval": "spawn through child close, including loader, CLI, telemetry and natural process cleanup",
+    "transport": "harness-only preload redirects only the fixed PostHog HTTPS batch destination to real loopback HTTP; all other outbound sockets denied; TLS and external network latency excluded",
+    "repeatUse": "isolated preseeded installation identity and notice preferences",
+    "pristineRunsPerCondition": 3,
+    "lifetimeHangGuardMs": 5000,
+    "portablePerformanceGate": false,
+    "quantiles": "Nearest-rank p50/p95; raw samples retain execution order.",
+    "pairedDifferences": "Each sample subtracts the matching round; p95 of paired differences is distinct from subtracting two p95 values.",
+    "overheadTargets": {
+      "captureCallMs": 5,
+      "flushGraceCapMs": 50,
+      "status": "Observed capture p95 and flush maximum satisfy these local characterization targets; these are not cross-machine release budgets."
+    }
+  },
+  "groups": {
+    "baseline.success.disabled": {
+      "processMs": {
+        "samples": [
+          362.41,
+          358.193,
+          371.673,
+          359.724,
+          358.176,
+          357.403,
+          354.806,
+          379.359,
+          362.426,
+          368.501,
+          357.496,
+          370.951,
+          355.841,
+          368.307,
+          359.098,
+          363.083,
+          358.165,
+          356.168,
+          363.233,
+          358.339
+        ],
+        "p50": 359.098,
+        "p95": 371.673,
+        "min": 354.806,
+        "max": 379.359
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3672
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.success.healthy": {
+      "processMs": {
+        "samples": [
+          369.265,
+          367.187,
+          369.468,
+          366.215,
+          367.776,
+          368.019,
+          372.745,
+          373.579,
+          368.205,
+          366.065,
+          369.117,
+          368.857,
+          372.655,
+          367.902,
+          383.412,
+          369.821,
+          368.842,
+          370.436,
+          367.718,
+          372.219
+        ],
+        "p50": 368.857,
+        "p95": 373.579,
+        "min": 366.065,
+        "max": 383.412
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          }
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3672
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "command_run:": 25
+      }
+    },
+    "baseline.success.refused": {
+      "processMs": {
+        "samples": [
+          366.27,
+          370.094,
+          367.574,
+          379.547,
+          368.81,
+          370.803,
+          364.648,
+          367.796,
+          365.207,
+          370.999,
+          369.425,
+          365.463,
+          378.933,
+          371.87,
+          366.165,
+          365.692,
+          377.14,
+          381.442,
+          366.622,
+          371.664
+        ],
+        "p50": 368.81,
+        "p95": 379.547,
+        "min": 364.648,
+        "max": 381.442
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3672
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.success.hanging": {
+      "processMs": {
+        "samples": [
+          1025.125,
+          1029.003,
+          1028.454,
+          1029.53,
+          1019.748,
+          1041.964,
+          1041.955,
+          1024.062,
+          1034.911,
+          1033.47,
+          1026.647,
+          1033.285,
+          1031.96,
+          1028.656,
+          1031.78,
+          1028.87,
+          1033.056,
+          1028.405,
+          1041.108,
+          1033.703
+        ],
+        "p50": 1029.53,
+        "p95": 1041.955,
+        "min": 1019.748,
+        "max": 1041.964
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          },
+          {
+            "command_run:": 1
+          }
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3672
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "command_run:": 25
+      }
+    },
+    "baseline.failure.disabled": {
+      "processMs": {
+        "samples": [
+          349.439,
+          349.505,
+          350.601,
+          349.51,
+          363.477,
+          360.276,
+          348.896,
+          354.077,
+          370.83,
+          349.534,
+          348.042,
+          364.436,
+          363.603,
+          350.949,
+          355.422,
+          347.082,
+          362.865,
+          353.988,
+          352.612,
+          351.548
+        ],
+        "p50": 351.548,
+        "p95": 364.436,
+        "min": 347.082,
+        "max": 370.83
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.failure.healthy": {
+      "processMs": {
+        "samples": [
+          348.494,
+          348.619,
+          350.167,
+          349.808,
+          348.507,
+          352.879,
+          352.212,
+          350.32,
+          351.193,
+          365.214,
+          354.717,
+          351.71,
+          349.433,
+          355.963,
+          347.547,
+          349.456,
+          348.868,
+          349.774,
+          356.424,
+          353.232
+        ],
+        "p50": 350.167,
+        "p95": 356.424,
+        "min": 347.547,
+        "max": 365.214
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.failure.refused": {
+      "processMs": {
+        "samples": [
+          350.563,
+          347.52,
+          351.879,
+          351.615,
+          353.991,
+          363.443,
+          351.888,
+          348.884,
+          363.017,
+          353.045,
+          354.988,
+          347.511,
+          350.717,
+          348.388,
+          355.657,
+          351.444,
+          350.307,
+          346.58,
+          352.82,
+          350.881
+        ],
+        "p50": 351.444,
+        "p95": 363.017,
+        "min": 346.58,
+        "max": 363.443
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.failure.hanging": {
+      "processMs": {
+        "samples": [
+          369.926,
+          356.843,
+          353.634,
+          352.646,
+          358.203,
+          346.837,
+          350.801,
+          355.96,
+          351.155,
+          349.586,
+          349.935,
+          369.472,
+          356.183,
+          363.201,
+          346.591,
+          351.864,
+          361.112,
+          351.296,
+          352.088,
+          348.923
+        ],
+        "p50": 352.088,
+        "p95": 369.472,
+        "min": 346.591,
+        "max": 369.926
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.success.disabled": {
+      "processMs": {
+        "samples": [
+          371.941,
+          349.263,
+          359.335,
+          354.259,
+          357.033,
+          351.393,
+          381.427,
+          353.781,
+          370.784,
+          364.901,
+          368.309,
+          351.588,
+          369.128,
+          352.005,
+          368.16,
+          353.658,
+          366.437,
+          351.668,
+          367.127,
+          352.952
+        ],
+        "p50": 357.033,
+        "p95": 371.941,
+        "min": 349.263,
+        "max": 381.427
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.success.healthy": {
+      "processMs": {
+        "samples": [
+          364.829,
+          359.969,
+          362.419,
+          372.07,
+          361.056,
+          360.336,
+          359.881,
+          359.914,
+          360.396,
+          365.87,
+          362.573,
+          372.76,
+          359.702,
+          360.888,
+          358.509,
+          357.576,
+          358.917,
+          359.95,
+          363.621,
+          364.958
+        ],
+        "p50": 360.396,
+        "p95": 372.07,
+        "min": 357.576,
+        "max": 372.76
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          }
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        }
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 25,
+        "cli.command_completed:success": 25
+      }
+    },
+    "candidate.success.refused": {
+      "processMs": {
+        "samples": [
+          359.184,
+          364.803,
+          363.743,
+          364.208,
+          361.487,
+          356.99,
+          360.776,
+          365.465,
+          360.549,
+          363.775,
+          361.603,
+          359.176,
+          360.253,
+          361.681,
+          359.328,
+          374.244,
+          357.459,
+          444.672,
+          359.846,
+          359.07
+        ],
+        "p50": 360.776,
+        "p95": 374.244,
+        "min": 356.99,
+        "max": 444.672
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22400,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        }
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.success.hanging": {
+      "processMs": {
+        "samples": [
+          376.94,
+          389.217,
+          386.629,
+          392.233,
+          387.368,
+          395.765,
+          375.993,
+          379.174,
+          376.677,
+          395.916,
+          377.959,
+          394.605,
+          374.867,
+          389.988,
+          377.563,
+          393.149,
+          375.324,
+          402.266,
+          377.139,
+          401.836
+        ],
+        "p50": 386.629,
+        "p95": 401.836,
+        "min": 374.867,
+        "max": 402.266
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 6,
+            "cli.command_completed:success": 6
+          },
+          {
+            "cli.command_started:": 7,
+            "cli.command_completed:success": 7
+          },
+          {
+            "cli.command_started:": 8,
+            "cli.command_completed:success": 8
+          },
+          {
+            "cli.command_started:": 9,
+            "cli.command_completed:success": 9
+          },
+          {
+            "cli.command_started:": 10,
+            "cli.command_completed:success": 10
+          },
+          {
+            "cli.command_started:": 11,
+            "cli.command_completed:success": 11
+          },
+          {
+            "cli.command_started:": 12,
+            "cli.command_completed:success": 12
+          },
+          {
+            "cli.command_started:": 13,
+            "cli.command_completed:success": 13
+          },
+          {
+            "cli.command_started:": 14,
+            "cli.command_completed:success": 14
+          },
+          {
+            "cli.command_started:": 15,
+            "cli.command_completed:success": 15
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          }
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22400,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        }
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 16,
+        "cli.command_completed:success": 16
+      }
+    },
+    "candidate.failure.disabled": {
+      "processMs": {
+        "samples": [
+          351.544,
+          351.692,
+          351.907,
+          352.923,
+          351.07,
+          351.24,
+          348.805,
+          351.057,
+          351.435,
+          353.82,
+          355.326,
+          352.845,
+          358.988,
+          364.01,
+          353.479,
+          365.605,
+          358.634,
+          350.073,
+          351.171,
+          354.3
+        ],
+        "p50": 351.907,
+        "p95": 364.01,
+        "min": 348.805,
+        "max": 365.605
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.failure.healthy": {
+      "processMs": {
+        "samples": [
+          359.458,
+          369.714,
+          361.999,
+          359.445,
+          360.66,
+          358.36,
+          364.692,
+          358.863,
+          361.25,
+          360.146,
+          362.149,
+          359.033,
+          359.962,
+          372.446,
+          358.985,
+          356.267,
+          359.87,
+          359.114,
+          363.329,
+          376.76
+        ],
+        "p50": 359.962,
+        "p95": 372.446,
+        "min": 356.267,
+        "max": 376.76
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:failure": 1
+          }
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        }
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 25,
+        "cli.command_completed:failure": 25
+      }
+    },
+    "candidate.failure.refused": {
+      "processMs": {
+        "samples": [
+          364.267,
+          369.547,
+          361.693,
+          357.14,
+          371.899,
+          360.18,
+          374.066,
+          359.741,
+          361.145,
+          356.6,
+          358.709,
+          358.266,
+          359.994,
+          360.965,
+          359.256,
+          358.979,
+          362.363,
+          364.98,
+          375.809,
+          360.677
+        ],
+        "p50": 360.677,
+        "p95": 374.066,
+        "min": 356.6,
+        "max": 375.809
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22250,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        }
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.failure.hanging": {
+      "processMs": {
+        "samples": [
+          373.44,
+          389.113,
+          379.181,
+          378.198,
+          377.171,
+          369.636,
+          377.562,
+          373.853,
+          374.655,
+          378.843,
+          377.619,
+          374.173,
+          380.015,
+          372.743,
+          379.189,
+          377.435,
+          373.696,
+          381.673,
+          374.801,
+          375.492
+        ],
+        "p50": 377.171,
+        "p95": 381.673,
+        "min": 369.636,
+        "max": 389.113
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 6,
+            "cli.command_completed:failure": 6
+          },
+          {
+            "cli.command_started:": 7,
+            "cli.command_completed:failure": 7
+          },
+          {
+            "cli.command_started:": 8,
+            "cli.command_completed:failure": 8
+          },
+          {
+            "cli.command_started:": 9,
+            "cli.command_completed:failure": 9
+          },
+          {
+            "cli.command_started:": 10,
+            "cli.command_completed:failure": 10
+          },
+          {
+            "cli.command_started:": 11,
+            "cli.command_completed:failure": 11
+          },
+          {
+            "cli.command_started:": 12,
+            "cli.command_completed:failure": 12
+          },
+          {
+            "cli.command_started:": 13,
+            "cli.command_completed:failure": 13
+          },
+          {
+            "cli.command_started:": 14,
+            "cli.command_completed:failure": 14
+          },
+          {
+            "cli.command_started:": 15,
+            "cli.command_completed:failure": 15
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          }
+        ]
+      },
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          0
+        ],
+        "stderrBytes": [
+          56
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22250,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        }
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 16,
+        "cli.command_completed:failure": 16
+      }
+    }
+  },
+  "pairedDeltasMs": {
+    "baseline.success.healthy-disabled": {
+      "samples": [
+        6.855,
+        8.994,
+        -2.205,
+        6.49,
+        9.6,
+        10.616,
+        17.939,
+        -5.78,
+        5.78,
+        -2.436,
+        11.621,
+        -2.094,
+        16.813,
+        -0.405,
+        24.315,
+        6.738,
+        10.677,
+        14.269,
+        4.485,
+        13.88
+      ],
+      "p50": 6.855,
+      "p95": 17.939,
+      "min": -5.78,
+      "max": 24.315
+    },
+    "baseline.success.refused-disabled": {
+      "samples": [
+        3.86,
+        11.901,
+        -4.099,
+        19.823,
+        10.634,
+        13.4,
+        9.842,
+        -11.563,
+        2.781,
+        2.499,
+        11.929,
+        -5.488,
+        23.092,
+        3.564,
+        7.067,
+        2.609,
+        18.976,
+        25.274,
+        3.388,
+        13.325
+      ],
+      "p50": 7.067,
+      "p95": 23.092,
+      "min": -11.563,
+      "max": 25.274
+    },
+    "baseline.success.hanging-disabled": {
+      "samples": [
+        662.715,
+        670.81,
+        656.78,
+        669.806,
+        661.571,
+        684.561,
+        687.149,
+        644.702,
+        672.485,
+        664.969,
+        669.151,
+        662.334,
+        676.119,
+        660.35,
+        672.683,
+        665.787,
+        674.892,
+        672.237,
+        677.875,
+        675.364
+      ],
+      "p50": 669.806,
+      "p95": 684.561,
+      "min": 644.702,
+      "max": 687.149
+    },
+    "baseline.failure.healthy-disabled": {
+      "samples": [
+        -0.945,
+        -0.886,
+        -0.434,
+        0.298,
+        -14.969,
+        -7.397,
+        3.316,
+        -3.758,
+        -19.637,
+        15.68,
+        6.675,
+        -12.726,
+        -14.17,
+        5.015,
+        -7.875,
+        2.373,
+        -13.997,
+        -4.214,
+        3.811,
+        1.684
+      ],
+      "p50": -0.945,
+      "p95": 6.675,
+      "min": -19.637,
+      "max": 15.68
+    },
+    "baseline.failure.refused-disabled": {
+      "samples": [
+        1.123,
+        -1.985,
+        1.278,
+        2.106,
+        -9.486,
+        3.167,
+        2.992,
+        -5.193,
+        -7.813,
+        3.51,
+        6.947,
+        -16.925,
+        -12.887,
+        -2.561,
+        0.235,
+        4.361,
+        -12.558,
+        -7.408,
+        0.207,
+        -0.667
+      ],
+      "p50": -0.667,
+      "p95": 4.361,
+      "min": -16.925,
+      "max": 6.947
+    },
+    "baseline.failure.hanging-disabled": {
+      "samples": [
+        20.486,
+        7.337,
+        3.034,
+        3.137,
+        -5.274,
+        -13.439,
+        1.905,
+        1.883,
+        -19.674,
+        0.052,
+        1.893,
+        5.036,
+        -7.421,
+        12.252,
+        -8.83,
+        4.782,
+        -1.754,
+        -2.692,
+        -0.524,
+        -2.625
+      ],
+      "p50": 0.052,
+      "p95": 12.252,
+      "min": -19.674,
+      "max": 20.486
+    },
+    "candidate.success.healthy-disabled": {
+      "samples": [
+        -7.112,
+        10.705,
+        3.084,
+        17.811,
+        4.023,
+        8.943,
+        -21.546,
+        6.132,
+        -10.388,
+        0.97,
+        -5.736,
+        21.171,
+        -9.426,
+        8.883,
+        -9.651,
+        3.918,
+        -7.52,
+        8.282,
+        -3.506,
+        12.006
+      ],
+      "p50": 3.084,
+      "p95": 17.811,
+      "min": -21.546,
+      "max": 21.171
+    },
+    "candidate.success.refused-disabled": {
+      "samples": [
+        -12.757,
+        15.54,
+        4.408,
+        9.949,
+        4.455,
+        5.598,
+        -20.651,
+        11.684,
+        -10.235,
+        -1.126,
+        -6.706,
+        7.588,
+        -8.875,
+        9.676,
+        -8.831,
+        20.586,
+        -8.978,
+        93.004,
+        -7.282,
+        6.118
+      ],
+      "p50": 4.408,
+      "p95": 20.586,
+      "min": -20.651,
+      "max": 93.004
+    },
+    "candidate.success.hanging-disabled": {
+      "samples": [
+        4.998,
+        39.953,
+        27.294,
+        37.974,
+        30.335,
+        44.372,
+        -5.434,
+        25.393,
+        5.893,
+        31.016,
+        9.649,
+        43.016,
+        5.739,
+        37.983,
+        9.404,
+        39.491,
+        8.887,
+        50.598,
+        10.012,
+        48.884
+      ],
+      "p50": 27.294,
+      "p95": 48.884,
+      "min": -5.434,
+      "max": 50.598
+    },
+    "candidate.failure.healthy-disabled": {
+      "samples": [
+        7.914,
+        18.022,
+        10.091,
+        6.523,
+        9.59,
+        7.12,
+        15.887,
+        7.806,
+        9.815,
+        6.325,
+        6.823,
+        6.188,
+        0.974,
+        8.436,
+        5.506,
+        -9.338,
+        1.235,
+        9.041,
+        12.158,
+        22.46
+      ],
+      "p50": 7.806,
+      "p95": 18.022,
+      "min": -9.338,
+      "max": 22.46
+    },
+    "candidate.failure.refused-disabled": {
+      "samples": [
+        12.723,
+        17.855,
+        9.785,
+        4.218,
+        20.829,
+        8.94,
+        25.261,
+        8.685,
+        9.71,
+        2.779,
+        3.384,
+        5.42,
+        1.005,
+        -3.045,
+        5.778,
+        -6.626,
+        3.729,
+        14.908,
+        24.638,
+        6.377
+      ],
+      "p50": 6.377,
+      "p95": 24.638,
+      "min": -6.626,
+      "max": 25.261
+    },
+    "candidate.failure.hanging-disabled": {
+      "samples": [
+        21.895,
+        37.421,
+        27.274,
+        25.275,
+        26.101,
+        18.396,
+        28.756,
+        22.797,
+        23.22,
+        25.023,
+        22.294,
+        21.328,
+        21.027,
+        8.733,
+        25.71,
+        11.83,
+        15.061,
+        31.6,
+        23.63,
+        21.191
+      ],
+      "p50": 22.797,
+      "p95": 31.6,
+      "min": 8.733,
+      "max": 37.421
+    },
+    "candidate-baseline.success.disabled": {
+      "samples": [
+        9.531,
+        -8.93,
+        -12.338,
+        -5.466,
+        -1.143,
+        -6.01,
+        26.621,
+        -25.578,
+        8.358,
+        -3.6,
+        10.813,
+        -19.362,
+        13.287,
+        -16.301,
+        9.062,
+        -9.425,
+        8.273,
+        -4.499,
+        3.894,
+        -5.387
+      ],
+      "p50": -4.499,
+      "p95": 13.287,
+      "min": -25.578,
+      "max": 26.621
+    },
+    "candidate-baseline.success.healthy": {
+      "samples": [
+        -4.436,
+        -7.219,
+        -7.049,
+        5.855,
+        -6.72,
+        -7.684,
+        -12.863,
+        -13.665,
+        -7.81,
+        -0.195,
+        -6.544,
+        3.903,
+        -12.953,
+        -7.014,
+        -24.903,
+        -12.245,
+        -9.924,
+        -10.486,
+        -4.097,
+        -7.261
+      ],
+      "p50": -7.261,
+      "p95": 3.903,
+      "min": -24.903,
+      "max": 5.855
+    },
+    "candidate-baseline.success.refused": {
+      "samples": [
+        -7.086,
+        -5.29,
+        -3.832,
+        -15.34,
+        -7.323,
+        -13.812,
+        -3.872,
+        -2.331,
+        -4.658,
+        -7.224,
+        -7.822,
+        -6.287,
+        -18.68,
+        -10.189,
+        -6.836,
+        8.553,
+        -19.681,
+        63.23,
+        -6.776,
+        -12.594
+      ],
+      "p50": -7.086,
+      "p95": 8.553,
+      "min": -19.681,
+      "max": 63.23
+    },
+    "candidate-baseline.success.hanging": {
+      "samples": [
+        -648.185,
+        -639.786,
+        -641.824,
+        -637.297,
+        -632.38,
+        -646.199,
+        -665.962,
+        -644.888,
+        -658.234,
+        -637.554,
+        -648.688,
+        -638.681,
+        -657.093,
+        -638.668,
+        -654.217,
+        -635.721,
+        -657.732,
+        -626.139,
+        -663.969,
+        -631.867
+      ],
+      "p50": -644.888,
+      "p95": -631.867,
+      "min": -665.962,
+      "max": -626.139
+    },
+    "candidate-baseline.failure.disabled": {
+      "samples": [
+        2.105,
+        2.187,
+        1.307,
+        3.413,
+        -12.406,
+        -9.036,
+        -0.091,
+        -3.02,
+        -19.395,
+        4.286,
+        7.284,
+        -11.591,
+        -4.615,
+        13.061,
+        -1.943,
+        18.523,
+        -4.231,
+        -3.916,
+        -1.442,
+        2.753
+      ],
+      "p50": -1.442,
+      "p95": 13.061,
+      "min": -19.395,
+      "max": 18.523
+    },
+    "candidate-baseline.failure.healthy": {
+      "samples": [
+        10.964,
+        21.095,
+        11.832,
+        9.638,
+        12.153,
+        5.481,
+        12.481,
+        8.543,
+        10.057,
+        -5.068,
+        7.432,
+        7.323,
+        10.529,
+        16.483,
+        11.438,
+        6.812,
+        11.001,
+        9.339,
+        6.905,
+        23.529
+      ],
+      "p50": 10.057,
+      "p95": 21.095,
+      "min": -5.068,
+      "max": 23.529
+    },
+    "candidate-baseline.failure.refused": {
+      "samples": [
+        13.705,
+        22.027,
+        9.814,
+        5.525,
+        17.909,
+        -3.263,
+        22.178,
+        10.857,
+        -1.871,
+        3.555,
+        3.721,
+        10.755,
+        9.277,
+        12.577,
+        3.599,
+        7.535,
+        12.056,
+        18.4,
+        22.989,
+        9.797
+      ],
+      "p50": 9.814,
+      "p95": 22.178,
+      "min": -3.263,
+      "max": 22.989
+    },
+    "candidate-baseline.failure.hanging": {
+      "samples": [
+        3.514,
+        32.271,
+        25.547,
+        25.551,
+        18.968,
+        22.799,
+        26.761,
+        17.893,
+        23.5,
+        29.257,
+        27.684,
+        4.701,
+        23.833,
+        9.542,
+        32.597,
+        25.571,
+        12.584,
+        30.377,
+        22.712,
+        26.569
+      ],
+      "p50": 23.833,
+      "p95": 32.271,
+      "min": 3.514,
+      "max": 32.597
+    }
+  },
+  "pristine": [
+    {
+      "build": "baseline",
+      "condition": "disabled",
+      "elapsedMs": 357.031,
+      "exitCode": 0,
+      "stdoutBytes": 3672,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "baseline",
+      "condition": "healthy",
+      "elapsedMs": 372.936,
+      "exitCode": 0,
+      "stdoutBytes": 3672,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {
+        "command_run:": 1
+      }
+    },
+    {
+      "build": "candidate",
+      "condition": "disabled",
+      "elapsedMs": 351.751,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "candidate",
+      "condition": "healthy",
+      "elapsedMs": 361.629,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "candidate",
+      "condition": "disabled",
+      "elapsedMs": 351.168,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "candidate",
+      "condition": "healthy",
+      "elapsedMs": 363.231,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "baseline",
+      "condition": "disabled",
+      "elapsedMs": 363.139,
+      "exitCode": 0,
+      "stdoutBytes": 3672,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "baseline",
+      "condition": "healthy",
+      "elapsedMs": 381.691,
+      "exitCode": 0,
+      "stdoutBytes": 3672,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {
+        "command_run:": 1
+      }
+    },
+    {
+      "build": "baseline",
+      "condition": "disabled",
+      "elapsedMs": 366.359,
+      "exitCode": 0,
+      "stdoutBytes": 3672,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "baseline",
+      "condition": "healthy",
+      "elapsedMs": 369.855,
+      "exitCode": 0,
+      "stdoutBytes": 3672,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {
+        "command_run:": 1
+      }
+    },
+    {
+      "build": "candidate",
+      "condition": "disabled",
+      "elapsedMs": 352.129,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "candidate",
+      "condition": "healthy",
+      "elapsedMs": 363.715,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    }
+  ],
+  "moduleProbe": {
+    "methodology": "Separately bundled current internal telemetry module; direct synchronous capture-call and awaited flush timings. Module/compiler startup excluded. Each repetition resets transport handles and keeps its isolated durable queue; first capture includes queue initialization. This does not replace built-CLI lifetime measurements.",
+    "bundleSha256": "592f98a3406bd0238400134f5421bebfd83b2ee209e8c2549777e8aac982b751",
+    "conditions": {
+      "disabled": {
+        "captureStartedMs": {
+          "samples": [
+            0.002,
+            0.002,
+            0.001,
+            0.001,
+            0.003,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.002,
+          "min": 0.001,
+          "max": 0.003
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.003,
+            0.002,
+            0.001,
+            0.001,
+            0.002,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.002,
+          "min": 0.001,
+          "max": 0.003
+        },
+        "flushMs": {
+          "samples": [
+            0.001,
+            0.001,
+            0.001,
+            0.043,
+            0.005,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.005,
+          "min": 0.001,
+          "max": 0.043
+        },
+        "firstCaptureStartedMs": 0.096,
+        "queue": {
+          "state": "absent",
+          "events": 0,
+          "bytes": 0
+        },
+        "requests": 0,
+        "redirected": 0,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 0,
+        "responseCompletions": 0
+      },
+      "healthy": {
+        "captureStartedMs": {
+          "samples": [
+            0.504,
+            0.68,
+            0.577,
+            0.647,
+            0.511,
+            0.483,
+            0.576,
+            0.499,
+            0.704,
+            0.543,
+            0.602,
+            0.488,
+            0.508,
+            0.46,
+            0.669,
+            0.527,
+            0.553,
+            0.565,
+            0.487,
+            0.466
+          ],
+          "p50": 0.527,
+          "p95": 0.68,
+          "min": 0.46,
+          "max": 0.704
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.375,
+            0.427,
+            0.408,
+            0.408,
+            0.376,
+            0.398,
+            0.392,
+            0.374,
+            0.428,
+            0.391,
+            0.42,
+            0.36,
+            0.37,
+            0.357,
+            0.438,
+            0.372,
+            0.388,
+            0.367,
+            0.366,
+            0.37
+          ],
+          "p50": 0.376,
+          "p95": 0.428,
+          "min": 0.357,
+          "max": 0.438
+        },
+        "flushMs": {
+          "samples": [
+            1.352,
+            1.325,
+            1.427,
+            1.992,
+            1.069,
+            1.063,
+            1.102,
+            1.199,
+            1.177,
+            1.205,
+            1.099,
+            0.917,
+            0.883,
+            0.916,
+            1.334,
+            1.265,
+            1.099,
+            0.969,
+            0.925,
+            0.959
+          ],
+          "p50": 1.099,
+          "p95": 1.427,
+          "min": 0.883,
+          "max": 1.992
+        },
+        "firstCaptureStartedMs": 3.21,
+        "queue": {
+          "state": "available",
+          "events": 0,
+          "bytes": 0
+        },
+        "requests": 25,
+        "redirected": 25,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 0,
+        "responseCompletions": 25
+      },
+      "refused": {
+        "captureStartedMs": {
+          "samples": [
+            0.505,
+            0.528,
+            0.553,
+            0.617,
+            0.527,
+            0.493,
+            0.486,
+            0.547,
+            0.585,
+            0.488,
+            0.677,
+            0.681,
+            0.586,
+            0.508,
+            0.505,
+            0.542,
+            0.502,
+            0.567,
+            0.606,
+            0.506
+          ],
+          "p50": 0.528,
+          "p95": 0.677,
+          "min": 0.486,
+          "max": 0.681
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.426,
+            0.381,
+            0.383,
+            0.383,
+            0.36,
+            0.373,
+            0.359,
+            0.363,
+            0.402,
+            0.373,
+            0.503,
+            0.51,
+            0.376,
+            0.396,
+            0.383,
+            0.4,
+            0.378,
+            0.385,
+            0.425,
+            0.377
+          ],
+          "p50": 0.383,
+          "p95": 0.503,
+          "min": 0.359,
+          "max": 0.51
+        },
+        "flushMs": {
+          "samples": [
+            0.994,
+            1.28,
+            1.376,
+            1.895,
+            1.216,
+            1.186,
+            1.075,
+            1.278,
+            1.287,
+            1.435,
+            1.532,
+            1.351,
+            1.146,
+            1.204,
+            1.291,
+            1.282,
+            1.183,
+            1.434,
+            1.181,
+            1.122
+          ],
+          "p50": 1.278,
+          "p95": 1.532,
+          "min": 0.994,
+          "max": 1.895
+        },
+        "firstCaptureStartedMs": 2.943,
+        "queue": {
+          "state": "available",
+          "events": 50,
+          "bytes": 22400
+        },
+        "requests": 0,
+        "redirected": 25,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 25,
+        "responseCompletions": 0
+      },
+      "hanging": {
+        "captureStartedMs": {
+          "samples": [
+            1.126,
+            1.42,
+            1.419,
+            1.912,
+            1.683,
+            1.744,
+            2.568,
+            2.119,
+            1.833,
+            1.643,
+            2.079,
+            2.08,
+            1.911,
+            2.05,
+            2.41,
+            1.573,
+            1.417,
+            2.011,
+            1.947,
+            2.082
+          ],
+          "p50": 1.911,
+          "p95": 2.41,
+          "min": 1.126,
+          "max": 2.568
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.773,
+            0.775,
+            0.889,
+            0.97,
+            0.925,
+            0.932,
+            1.227,
+            1.747,
+            1.328,
+            1.292,
+            1.075,
+            1.364,
+            1.861,
+            1.486,
+            1.466,
+            0.9,
+            0.879,
+            0.986,
+            1.383,
+            1.282
+          ],
+          "p50": 1.075,
+          "p95": 1.747,
+          "min": 0.773,
+          "max": 1.861
+        },
+        "flushMs": {
+          "samples": [
+            26.198,
+            28.279,
+            27.975,
+            28.356,
+            27.915,
+            28.268,
+            27.006,
+            27.365,
+            25.831,
+            27.025,
+            27.085,
+            28.019,
+            27.445,
+            27.542,
+            28.312,
+            27.45,
+            28.072,
+            29.114,
+            27.12,
+            27.869
+          ],
+          "p50": 27.542,
+          "p95": 28.356,
+          "min": 25.831,
+          "max": 29.114
+        },
+        "firstCaptureStartedMs": 3.011,
+        "queue": {
+          "state": "available",
+          "events": 50,
+          "bytes": 22400
+        },
+        "requests": 25,
+        "redirected": 25,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 25,
+        "responseCompletions": 0
+      }
+    }
+  },
+  "limitations": [
+    "Single local host; paired differences include scheduler and module-loading noise.",
+    "Server receipt is not client acknowledgement: hanging ingestion receives bodies but never acknowledges them. Client HTTP response completions and durable retained events are reported separately; receipt/retention accounting deduplicates UUIDs in memory and retains no identifiers.",
+    "Local HTTP ingestion does not measure production TLS or Internet latency.",
+    "Candidate offline queues accumulate across the repeated invocations; the queue remains bounded and is inspected only after timed runs.",
+    "First-command runs are bounded observations, not a statistically stable p95.",
+    "This command scenario accumulates up to 50 queued events. Maximum-cap queue performance and production network delivery rates are not measured here.",
+    "The wrapper measures real built-CLI main execution but adds the same preload instrumentation to baseline/candidate and enabled/disabled runs. Embedded Yoga WASM data-URL loading is allowed because it performs no network I/O."
+  ],
+  "provenance": {
+    "baselineCommit": "d64f171054e09149bf79790a91a0077a07975828",
+    "candidate": "working-tree telemetry implementation on codex/0.8.1-telemetry; built CLI SHA-256 is recorded above",
+    "rawReportSha256": "05520b33b65449120a76d0eccf9621165c790e1f625fd3bd287a54d1fd8ea023",
+    "harnessSha256": "857bb371755accb0cbd4567b4e3b1c58f91778c0f3480fa8f2762c883d38de10",
+    "rawReportBytes": 244536,
+    "recording": "Full raw timing and paired-difference samples retained here; repeated server event bodies are replaced by per-run closed event counts. No identifiers, tokens or absolute local paths are retained."
+  },
+  "findings": {
+    "candidateEnabledMinusDisabledMs": {
+      "success": {
+        "healthy": {
+          "p50": 3.084,
+          "p95": 17.811
+        },
+        "refused": {
+          "p50": 4.408,
+          "p95": 20.586
+        },
+        "hanging": {
+          "p50": 27.294,
+          "p95": 48.884
+        }
+      },
+      "failure": {
+        "healthy": {
+          "p50": 7.806,
+          "p95": 18.022
+        },
+        "refused": {
+          "p50": 6.377,
+          "p95": 24.638
+        },
+        "hanging": {
+          "p50": 22.797,
+          "p95": 31.6
+        }
+      }
+    },
+    "candidateMinusBaselineMs": {
+      "success": {
+        "disabled": {
+          "p50": -4.499,
+          "p95": 13.287
+        },
+        "healthy": {
+          "p50": -7.261,
+          "p95": 3.903
+        },
+        "refused": {
+          "p50": -7.086,
+          "p95": 8.553
+        },
+        "hanging": {
+          "p50": -644.888,
+          "p95": -631.867
+        }
+      },
+      "failure": {
+        "disabled": {
+          "p50": -1.442,
+          "p95": 13.061
+        },
+        "healthy": {
+          "p50": 10.057,
+          "p95": 21.095
+        },
+        "refused": {
+          "p50": 9.814,
+          "p95": 22.178
+        },
+        "hanging": {
+          "p50": 23.833,
+          "p95": 32.271
+        }
+      }
+    },
+    "captureCallP95MaxMs": 2.41,
+    "firstCaptureMaxMs": 3.21,
+    "flushObservedMaxMs": 29.114,
+    "healthyOutcomeEvidence": "For each candidate command, all 25 started and 25 completed events reached local ingestion across warmups and measured runs; the queue was empty afterward. Both success and failure outcomes were present. The old failure path sent no event.",
+    "offlineEvidence": "Refused and hanging candidate conditions retained all 50 events per command in a 45,056-byte SQLite store with zero active claims at final inspection. Hanging server receipts were unacknowledged and remain queued; UUID-union accounting avoids double counting.",
+    "isolationAndCleanup": "All disabled runs made zero telemetry requests. All child processes exited naturally with expected output/exit code; no server sockets remained after exit. Disabled pristine homes stayed empty.",
+    "failureCost": "The new failure path now records and attempts delivery of an outcome. Its extra healthy median cost was about 10ms versus the old failure path, which exited without sending an event."
+  }
+}
diff --git a/docs/design/telemetry-project-context-performance.json b/docs/design/telemetry-project-context-performance.json
new file mode 100644
index 00000000..58e31d23
--- /dev/null
+++ b/docs/design/telemetry-project-context-performance.json
@@ -0,0 +1,5388 @@
+{
+  "schemaVersion": 1,
+  "kind": "telemetry-local-performance-characterization",
+  "generatedAt": "2026-09-09T16:11:53.602Z",
+  "environment": {
+    "node": "v22.17.1",
+    "platform": "darwin",
+    "release": "25.0.0",
+    "architecture": "arm64",
+    "cpu": "Apple M4"
+  },
+  "builds": [
+    {
+      "name": "baseline",
+      "cliSha256": "66719ebce3f290134557cfa62533939093d5fa745ee8708a7e4afa1f03b366ea"
+    },
+    {
+      "name": "candidate",
+      "cliSha256": "99ebd1b40c434de47bcfdbe5db74af43a5be27afa84c96d0bc401cbdb52e067b"
+    }
+  ],
+  "methodology": {
+    "samplesPerCondition": 20,
+    "warmupsPerCondition": 5,
+    "commandArguments": [
+      {
+        "name": "success",
+        "args": [
+          "commands"
+        ]
+      },
+      {
+        "name": "failure",
+        "args": [
+          "check",
+          "--json"
+        ]
+      }
+    ],
+    "conditionOrder": "rotated every round; baseline/candidate order alternates",
+    "measuredInterval": "spawn through child close, including loader, CLI, telemetry and natural process cleanup",
+    "transport": "harness-only preload redirects only the fixed PostHog HTTPS batch destination to real loopback HTTP; all other outbound sockets denied; TLS and external network latency excluded",
+    "repeatUse": "isolated preseeded installation identity and notice preferences",
+    "pristineRunsPerCondition": 3,
+    "lifetimeHangGuardMs": 5000,
+    "portablePerformanceGate": false,
+    "quantiles": "Nearest-rank p50/p95; raw samples retain execution order.",
+    "pairedDifferences": "Each sample subtracts the matching round; p95 of paired differences is distinct from subtracting two p95 values.",
+    "overheadTargets": {
+      "captureCallMs": 5,
+      "flushGraceCapMs": 50,
+      "status": "Observed capture p95 and flush maximum satisfy these local characterization targets; these are not cross-machine release budgets."
+    }
+  },
+  "groups": {
+    "baseline.success.disabled": {
+      "processMs": {
+        "samples": [
+          381.749,
+          394.218,
+          374.875,
+          468.532,
+          379.186,
+          379.463,
+          392.565,
+          454.199,
+          420.837,
+          388.333,
+          413.637,
+          479.133,
+          524.278,
+          450.638,
+          437.832,
+          588.772,
+          434.912,
+          473.379,
+          452.505,
+          552.229
+        ],
+        "p50": 434.912,
+        "p95": 552.229,
+        "min": 374.875,
+        "max": 588.772
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.success.healthy": {
+      "processMs": {
+        "samples": [
+          397.438,
+          391.827,
+          398.701,
+          382.17,
+          386.164,
+          387.949,
+          421.567,
+          401.214,
+          432.534,
+          387.22,
+          397.061,
+          435.098,
+          415.658,
+          473.833,
+          443.237,
+          502.709,
+          454.669,
+          491.207,
+          470.762,
+          482.265
+        ],
+        "p50": 415.658,
+        "p95": 491.207,
+        "min": 382.17,
+        "max": 502.709
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "projectContextEventsVerified": 0
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 25,
+        "cli.command_completed:success": 25
+      }
+    },
+    "baseline.success.refused": {
+      "processMs": {
+        "samples": [
+          387.337,
+          483.46,
+          387.895,
+          414.843,
+          383.716,
+          474.494,
+          394.499,
+          396.054,
+          426.897,
+          481.065,
+          413.872,
+          452.867,
+          510.372,
+          507.892,
+          482.983,
+          512.488,
+          452.282,
+          519.586,
+          458.725,
+          526.762
+        ],
+        "p50": 452.867,
+        "p95": 519.586,
+        "min": 383.716,
+        "max": 526.762
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22400,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.success.hanging": {
+      "processMs": {
+        "samples": [
+          398.285,
+          415.227,
+          397.409,
+          421.915,
+          398.69,
+          400.816,
+          405.382,
+          412.766,
+          430.855,
+          412.939,
+          424.385,
+          477.347,
+          546.02,
+          450.868,
+          458.808,
+          497.993,
+          480.399,
+          468.292,
+          466.353,
+          533.278
+        ],
+        "p50": 424.385,
+        "p95": 533.278,
+        "min": 397.409,
+        "max": 546.02
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 6,
+            "cli.command_completed:success": 6
+          },
+          {
+            "cli.command_started:": 7,
+            "cli.command_completed:success": 7
+          },
+          {
+            "cli.command_started:": 8,
+            "cli.command_completed:success": 8
+          },
+          {
+            "cli.command_started:": 9,
+            "cli.command_completed:success": 9
+          },
+          {
+            "cli.command_started:": 10,
+            "cli.command_completed:success": 10
+          },
+          {
+            "cli.command_started:": 11,
+            "cli.command_completed:success": 11
+          },
+          {
+            "cli.command_started:": 12,
+            "cli.command_completed:success": 12
+          },
+          {
+            "cli.command_started:": 13,
+            "cli.command_completed:success": 13
+          },
+          {
+            "cli.command_started:": 14,
+            "cli.command_completed:success": 14
+          },
+          {
+            "cli.command_started:": 15,
+            "cli.command_completed:success": 15
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        12,
+        14,
+        16,
+        18,
+        20,
+        22,
+        24,
+        26,
+        28,
+        30,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22400,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 16,
+        "cli.command_completed:success": 16
+      }
+    },
+    "baseline.failure.disabled": {
+      "processMs": {
+        "samples": [
+          544.698,
+          542.347,
+          551.372,
+          472.746,
+          572.727,
+          548.02,
+          558.014,
+          468.583,
+          551.719,
+          546.939,
+          598.065,
+          531.194,
+          584.268,
+          622.984,
+          615.705,
+          540.988,
+          590.61,
+          596.142,
+          613.101,
+          634.572
+        ],
+        "p50": 551.719,
+        "p95": 622.984,
+        "min": 468.583,
+        "max": 634.572
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.failure.healthy": {
+      "processMs": {
+        "samples": [
+          557.134,
+          540.648,
+          565.097,
+          562.131,
+          550.465,
+          568.89,
+          555.445,
+          576.626,
+          561.079,
+          557.804,
+          576.975,
+          611.5,
+          658.519,
+          632.546,
+          624.525,
+          642.278,
+          604.178,
+          610.791,
+          610.765,
+          651.473
+        ],
+        "p50": 576.626,
+        "p95": 651.473,
+        "min": 540.648,
+        "max": 658.519
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 1,
+        "payloadBytes": 465,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {
+          "cli.command_completed:failure": 1
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "projectContextEventsVerified": 1
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 25,
+        "cli.command_completed:failure": 24
+      }
+    },
+    "baseline.failure.refused": {
+      "processMs": {
+        "samples": [
+          553.14,
+          464.352,
+          546.196,
+          549.468,
+          565.627,
+          481.802,
+          562.028,
+          570.894,
+          574.741,
+          483.371,
+          597.59,
+          604.882,
+          614.221,
+          647.847,
+          625.996,
+          614.221,
+          599.098,
+          576.272,
+          622.939,
+          618.127
+        ],
+        "p50": 574.741,
+        "p95": 625.996,
+        "min": 464.352,
+        "max": 647.847
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22275,
+        "activeClaims": 0,
+        "databaseBytes": 45056,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "baseline.failure.hanging": {
+      "processMs": {
+        "samples": [
+          572.593,
+          542.509,
+          537.749,
+          545.982,
+          569.749,
+          546.688,
+          551.644,
+          547.447,
+          556.141,
+          557.095,
+          583.786,
+          591.709,
+          597.164,
+          682.857,
+          660.847,
+          643.066,
+          595.13,
+          641.491,
+          628.421,
+          630.954
+        ],
+        "p50": 572.593,
+        "p95": 660.847,
+        "min": 537.749,
+        "max": 682.857
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 6,
+            "cli.command_completed:failure": 5
+          },
+          {
+            "cli.command_started:": 7,
+            "cli.command_completed:failure": 6
+          },
+          {
+            "cli.command_started:": 8,
+            "cli.command_completed:failure": 7
+          },
+          {
+            "cli.command_started:": 9,
+            "cli.command_completed:failure": 8
+          },
+          {
+            "cli.command_started:": 10,
+            "cli.command_completed:failure": 9
+          },
+          {
+            "cli.command_started:": 11,
+            "cli.command_completed:failure": 10
+          },
+          {
+            "cli.command_started:": 12,
+            "cli.command_completed:failure": 11
+          },
+          {
+            "cli.command_started:": 13,
+            "cli.command_completed:failure": 12
+          },
+          {
+            "cli.command_started:": 14,
+            "cli.command_completed:failure": 13
+          },
+          {
+            "cli.command_started:": 15,
+            "cli.command_completed:failure": 14
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 15
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        11,
+        13,
+        15,
+        17,
+        19,
+        21,
+        23,
+        25,
+        27,
+        29,
+        31,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 22275,
+        "activeClaims": 0,
+        "databaseBytes": 40960,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 16,
+        "cli.command_completed:failure": 16
+      }
+    },
+    "candidate.success.disabled": {
+      "processMs": {
+        "samples": [
+          369.725,
+          375.531,
+          370.592,
+          365.959,
+          370.085,
+          379.972,
+          396.824,
+          388.924,
+          398.117,
+          380.688,
+          386.893,
+          400.853,
+          539.292,
+          431.809,
+          425.703,
+          483.518,
+          431.409,
+          469.802,
+          444.094,
+          454.043
+        ],
+        "p50": 396.824,
+        "p95": 483.518,
+        "min": 365.959,
+        "max": 539.292
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.success.healthy": {
+      "processMs": {
+        "samples": [
+          455.275,
+          377.021,
+          382.484,
+          468.332,
+          454.433,
+          395.844,
+          397.693,
+          388.31,
+          464.87,
+          398.265,
+          410.155,
+          413.989,
+          501.555,
+          504.164,
+          435.089,
+          634.303,
+          530.903,
+          483.663,
+          455.903,
+          477.22
+        ],
+        "p50": 454.433,
+        "p95": 530.903,
+        "min": 377.021,
+        "max": 634.303
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          },
+          {
+            "cli.command_started:": 1,
+            "cli.command_completed:success": 1
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "projectContextEventsVerified": 0
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 25,
+        "cli.command_completed:success": 25
+      }
+    },
+    "candidate.success.refused": {
+      "processMs": {
+        "samples": [
+          386.837,
+          383.642,
+          385.957,
+          412.05,
+          379.182,
+          384.703,
+          383.893,
+          392.641,
+          400.208,
+          403.237,
+          401.074,
+          439.551,
+          438.504,
+          422.089,
+          452.842,
+          489.627,
+          443.387,
+          436.968,
+          461.486,
+          515.287
+        ],
+        "p50": 403.237,
+        "p95": 489.627,
+        "min": 379.182,
+        "max": 515.287
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 27100,
+        "activeClaims": 0,
+        "databaseBytes": 49152,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.success.hanging": {
+      "processMs": {
+        "samples": [
+          399.589,
+          398.279,
+          474.571,
+          406.769,
+          406.761,
+          407.675,
+          497.89,
+          422.899,
+          409.437,
+          420.913,
+          473.806,
+          473.44,
+          497.039,
+          450.138,
+          525.614,
+          479.444,
+          451.571,
+          496.208,
+          554.965,
+          523.952
+        ],
+        "p50": 451.571,
+        "p95": 525.614,
+        "min": 398.279,
+        "max": 554.965
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 6,
+            "cli.command_completed:success": 6
+          },
+          {
+            "cli.command_started:": 7,
+            "cli.command_completed:success": 7
+          },
+          {
+            "cli.command_started:": 8,
+            "cli.command_completed:success": 8
+          },
+          {
+            "cli.command_started:": 9,
+            "cli.command_completed:success": 9
+          },
+          {
+            "cli.command_started:": 10,
+            "cli.command_completed:success": 10
+          },
+          {
+            "cli.command_started:": 11,
+            "cli.command_completed:success": 11
+          },
+          {
+            "cli.command_started:": 12,
+            "cli.command_completed:success": 12
+          },
+          {
+            "cli.command_started:": 13,
+            "cli.command_completed:success": 13
+          },
+          {
+            "cli.command_started:": 14,
+            "cli.command_completed:success": 14
+          },
+          {
+            "cli.command_started:": 15,
+            "cli.command_completed:success": 15
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:success": 16
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        12,
+        14,
+        16,
+        18,
+        20,
+        22,
+        24,
+        26,
+        28,
+        30,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32
+      ],
+      "output": {
+        "exitCodes": [
+          0
+        ],
+        "stdoutBytes": [
+          3674
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 27100,
+        "activeClaims": 0,
+        "databaseBytes": 49152,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 16,
+        "cli.command_completed:success": 16
+      }
+    },
+    "candidate.failure.disabled": {
+      "processMs": {
+        "samples": [
+          543.24,
+          546.425,
+          548.122,
+          564.943,
+          533.326,
+          560.594,
+          551.136,
+          546.488,
+          562.734,
+          543.658,
+          576.253,
+          594.907,
+          578.136,
+          601.024,
+          607.694,
+          630.521,
+          583.971,
+          596.019,
+          604.316,
+          648.465
+        ],
+        "p50": 564.943,
+        "p95": 630.521,
+        "min": 533.326,
+        "max": 648.465
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id"
+      ],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.failure.healthy": {
+      "processMs": {
+        "samples": [
+          458.952,
+          540.531,
+          545.565,
+          548.27,
+          471.999,
+          546.208,
+          548.082,
+          549.491,
+          482.773,
+          563.361,
+          671.361,
+          590.861,
+          585.543,
+          603.779,
+          624.665,
+          597.03,
+          526.566,
+          606.6,
+          622.41,
+          625.81
+        ],
+        "p50": 549.491,
+        "p95": 625.81,
+        "min": 458.952,
+        "max": 671.361
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "clientHttpResponseCompletions": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          },
+          {
+            "cli.command_completed:failure": 1,
+            "cli.command_started:": 1
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2,
+        2
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 1,
+        "payloadBytes": 559,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {
+          "cli.command_completed:failure": 1
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "projectContextEventsVerified": 1
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 25,
+        "cli.command_completed:failure": 24
+      }
+    },
+    "candidate.failure.refused": {
+      "processMs": {
+        "samples": [
+          548.887,
+          545.376,
+          545.327,
+          540.487,
+          552.872,
+          541.109,
+          549.918,
+          546.458,
+          570.042,
+          552.413,
+          581.315,
+          572.775,
+          625.763,
+          719.889,
+          620.848,
+          621.681,
+          604.701,
+          634.786,
+          598.408,
+          606.254
+        ],
+        "p50": 570.042,
+        "p95": 634.786,
+        "min": 540.487,
+        "max": 719.889
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {},
+          {}
+        ]
+      },
+      "projectContextEventsVerified": [
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0,
+        0
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 26975,
+        "activeClaims": 0,
+        "databaseBytes": 49152,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {}
+    },
+    "candidate.failure.hanging": {
+      "processMs": {
+        "samples": [
+          556.562,
+          541.36,
+          466.252,
+          543.539,
+          547.378,
+          564.167,
+          465.861,
+          545.439,
+          559.561,
+          554.296,
+          498.991,
+          583.034,
+          597.477,
+          670.665,
+          542.954,
+          618.729,
+          591.661,
+          598.53,
+          557.146,
+          610.378
+        ],
+        "p50": 556.562,
+        "p95": 618.729,
+        "min": 465.861,
+        "max": 670.665
+      },
+      "delivery": {
+        "serverReceivedRequests": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "requestErrors": [
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1,
+          1
+        ],
+        "clientHttpResponseCompletions": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "openSocketsAfterExit": [
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0,
+          0
+        ],
+        "serverReceivedEventCountsPerRun": [
+          {
+            "cli.command_started:": 6,
+            "cli.command_completed:failure": 5
+          },
+          {
+            "cli.command_started:": 7,
+            "cli.command_completed:failure": 6
+          },
+          {
+            "cli.command_started:": 8,
+            "cli.command_completed:failure": 7
+          },
+          {
+            "cli.command_started:": 9,
+            "cli.command_completed:failure": 8
+          },
+          {
+            "cli.command_started:": 10,
+            "cli.command_completed:failure": 9
+          },
+          {
+            "cli.command_started:": 11,
+            "cli.command_completed:failure": 10
+          },
+          {
+            "cli.command_started:": 12,
+            "cli.command_completed:failure": 11
+          },
+          {
+            "cli.command_started:": 13,
+            "cli.command_completed:failure": 12
+          },
+          {
+            "cli.command_started:": 14,
+            "cli.command_completed:failure": 13
+          },
+          {
+            "cli.command_started:": 15,
+            "cli.command_completed:failure": 14
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 15
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          },
+          {
+            "cli.command_started:": 16,
+            "cli.command_completed:failure": 16
+          }
+        ]
+      },
+      "projectContextEventsVerified": [
+        11,
+        13,
+        15,
+        17,
+        19,
+        21,
+        23,
+        25,
+        27,
+        29,
+        31,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32,
+        32
+      ],
+      "output": {
+        "exitCodes": [
+          1
+        ],
+        "stdoutBytes": [
+          2031
+        ],
+        "stderrBytes": [
+          0
+        ]
+      },
+      "files": [
+        ".mex/config.json",
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 50,
+        "payloadBytes": 26975,
+        "activeClaims": 0,
+        "databaseBytes": 49152,
+        "eventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "receivedOrQueuedEventCounts": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        },
+        "projectContextEventsVerified": 50
+      },
+      "uniqueServerReceivedEventsIncludingWarmups": {
+        "cli.command_started:": 16,
+        "cli.command_completed:failure": 16
+      }
+    }
+  },
+  "pairedDeltasMs": {
+    "baseline.success.healthy-disabled": {
+      "samples": [
+        15.689,
+        -2.392,
+        23.827,
+        -86.362,
+        6.978,
+        8.486,
+        29.002,
+        -52.985,
+        11.697,
+        -1.112,
+        -16.576,
+        -44.035,
+        -108.62,
+        23.195,
+        5.405,
+        -86.063,
+        19.757,
+        17.828,
+        18.256,
+        -69.964
+      ],
+      "p50": 5.405,
+      "p95": 23.827,
+      "min": -108.62,
+      "max": 29.002
+    },
+    "baseline.success.refused-disabled": {
+      "samples": [
+        5.588,
+        89.242,
+        13.021,
+        -53.689,
+        4.53,
+        95.031,
+        1.935,
+        -58.145,
+        6.06,
+        92.732,
+        0.236,
+        -26.265,
+        -13.906,
+        57.254,
+        45.151,
+        -76.284,
+        17.37,
+        46.207,
+        6.22,
+        -25.466
+      ],
+      "p50": 5.588,
+      "p95": 92.732,
+      "min": -76.284,
+      "max": 95.031
+    },
+    "baseline.success.hanging-disabled": {
+      "samples": [
+        16.536,
+        21.009,
+        22.535,
+        -46.617,
+        19.504,
+        21.353,
+        12.818,
+        -41.434,
+        10.018,
+        24.606,
+        10.748,
+        -1.785,
+        21.742,
+        0.23,
+        20.976,
+        -90.778,
+        45.488,
+        -5.087,
+        13.848,
+        -18.95
+      ],
+      "p50": 12.818,
+      "p95": 24.606,
+      "min": -90.778,
+      "max": 45.488
+    },
+    "baseline.failure.healthy-disabled": {
+      "samples": [
+        12.436,
+        -1.699,
+        13.725,
+        89.384,
+        -22.262,
+        20.869,
+        -2.569,
+        108.043,
+        9.36,
+        10.865,
+        -21.09,
+        80.306,
+        74.25,
+        9.562,
+        8.82,
+        101.29,
+        13.568,
+        14.648,
+        -2.336,
+        16.901
+      ],
+      "p50": 12.436,
+      "p95": 101.29,
+      "min": -22.262,
+      "max": 108.043
+    },
+    "baseline.failure.refused-disabled": {
+      "samples": [
+        8.442,
+        -77.994,
+        -5.175,
+        76.722,
+        -7.1,
+        -66.218,
+        4.013,
+        102.311,
+        23.022,
+        -63.568,
+        -0.475,
+        73.688,
+        29.953,
+        24.863,
+        10.291,
+        73.233,
+        8.488,
+        -19.87,
+        9.838,
+        -16.445
+      ],
+      "p50": 8.442,
+      "p95": 76.722,
+      "min": -77.994,
+      "max": 102.311
+    },
+    "baseline.failure.hanging-disabled": {
+      "samples": [
+        27.895,
+        0.163,
+        -13.623,
+        73.235,
+        -2.978,
+        -1.332,
+        -6.371,
+        78.864,
+        4.423,
+        10.156,
+        -14.279,
+        60.515,
+        12.896,
+        59.873,
+        45.142,
+        102.078,
+        4.52,
+        45.349,
+        15.319,
+        -3.618
+      ],
+      "p50": 10.156,
+      "p95": 78.864,
+      "min": -14.279,
+      "max": 102.078
+    },
+    "candidate.success.healthy-disabled": {
+      "samples": [
+        85.55,
+        1.49,
+        11.892,
+        102.373,
+        84.349,
+        15.872,
+        0.868,
+        -0.615,
+        66.753,
+        17.576,
+        23.262,
+        13.136,
+        -37.736,
+        72.355,
+        9.386,
+        150.784,
+        99.493,
+        13.861,
+        11.809,
+        23.177
+      ],
+      "p50": 15.872,
+      "p95": 102.373,
+      "min": -37.736,
+      "max": 150.784
+    },
+    "candidate.success.refused-disabled": {
+      "samples": [
+        17.112,
+        8.111,
+        15.365,
+        46.091,
+        9.098,
+        4.731,
+        -12.931,
+        3.717,
+        2.091,
+        22.549,
+        14.181,
+        38.698,
+        -100.788,
+        -9.721,
+        27.139,
+        6.109,
+        11.977,
+        -32.834,
+        17.392,
+        61.244
+      ],
+      "p50": 9.098,
+      "p95": 46.091,
+      "min": -100.788,
+      "max": 61.244
+    },
+    "candidate.success.hanging-disabled": {
+      "samples": [
+        29.864,
+        22.747,
+        103.979,
+        40.81,
+        36.676,
+        27.704,
+        101.066,
+        33.975,
+        11.32,
+        40.225,
+        86.913,
+        72.587,
+        -42.253,
+        18.329,
+        99.912,
+        -4.074,
+        20.162,
+        26.406,
+        110.871,
+        69.91
+      ],
+      "p50": 33.975,
+      "p95": 103.979,
+      "min": -42.253,
+      "max": 110.871
+    },
+    "candidate.failure.healthy-disabled": {
+      "samples": [
+        -84.287,
+        -5.894,
+        -2.557,
+        -16.672,
+        -61.327,
+        -14.387,
+        -3.054,
+        3.002,
+        -79.961,
+        19.703,
+        95.108,
+        -4.046,
+        7.407,
+        2.755,
+        16.972,
+        -33.49,
+        -57.405,
+        10.582,
+        18.094,
+        -22.655
+      ],
+      "p50": -4.046,
+      "p95": 19.703,
+      "min": -84.287,
+      "max": 95.108
+    },
+    "candidate.failure.refused-disabled": {
+      "samples": [
+        5.647,
+        -1.049,
+        -2.795,
+        -24.455,
+        19.546,
+        -19.485,
+        -1.217,
+        -0.03,
+        7.308,
+        8.755,
+        5.062,
+        -22.132,
+        47.627,
+        118.865,
+        13.154,
+        -8.839,
+        20.73,
+        38.767,
+        -5.908,
+        -42.211
+      ],
+      "p50": -0.03,
+      "p95": 47.627,
+      "min": -42.211,
+      "max": 118.865
+    },
+    "candidate.failure.hanging-disabled": {
+      "samples": [
+        13.323,
+        -5.065,
+        -81.87,
+        -21.403,
+        14.052,
+        3.572,
+        -85.274,
+        -1.05,
+        -3.172,
+        10.638,
+        -77.262,
+        -11.873,
+        19.342,
+        69.641,
+        -64.739,
+        -11.791,
+        7.69,
+        2.511,
+        -47.171,
+        -38.087
+      ],
+      "p50": -5.065,
+      "p95": 19.342,
+      "min": -85.274,
+      "max": 69.641
+    },
+    "candidate-baseline.success.disabled": {
+      "samples": [
+        -12.024,
+        -18.687,
+        -4.283,
+        -102.573,
+        -9.102,
+        0.509,
+        4.26,
+        -65.275,
+        -22.72,
+        -7.645,
+        -26.744,
+        -78.28,
+        15.013,
+        -18.828,
+        -12.129,
+        -105.253,
+        -3.503,
+        -3.577,
+        -8.411,
+        -98.186
+      ],
+      "p50": -12.129,
+      "p95": 4.26,
+      "min": -105.253,
+      "max": 15.013
+    },
+    "candidate-baseline.success.healthy": {
+      "samples": [
+        57.837,
+        -14.805,
+        -16.217,
+        86.162,
+        68.269,
+        7.895,
+        -23.874,
+        -12.905,
+        32.336,
+        11.044,
+        13.094,
+        -21.109,
+        85.897,
+        30.331,
+        -8.148,
+        131.593,
+        76.234,
+        -7.544,
+        -14.859,
+        -5.045
+      ],
+      "p50": 7.895,
+      "p95": 86.162,
+      "min": -23.874,
+      "max": 131.593
+    },
+    "candidate-baseline.success.refused": {
+      "samples": [
+        -0.5,
+        -99.818,
+        -1.939,
+        -2.793,
+        -4.534,
+        -89.791,
+        -10.606,
+        -3.413,
+        -26.689,
+        -77.828,
+        -12.798,
+        -13.317,
+        -71.868,
+        -85.803,
+        -30.14,
+        -22.861,
+        -8.895,
+        -82.618,
+        2.761,
+        -11.475
+      ],
+      "p50": -13.317,
+      "p95": -0.5,
+      "min": -99.818,
+      "max": 2.761
+    },
+    "candidate-baseline.success.hanging": {
+      "samples": [
+        1.304,
+        -16.948,
+        77.161,
+        -15.147,
+        8.071,
+        6.859,
+        92.508,
+        10.134,
+        -21.418,
+        7.974,
+        49.421,
+        -3.908,
+        -48.982,
+        -0.73,
+        66.807,
+        -18.549,
+        -28.828,
+        27.916,
+        88.612,
+        -9.326
+      ],
+      "p50": 1.304,
+      "p95": 88.612,
+      "min": -48.982,
+      "max": 92.508
+    },
+    "candidate-baseline.failure.disabled": {
+      "samples": [
+        -1.458,
+        4.079,
+        -3.25,
+        92.196,
+        -39.401,
+        12.574,
+        -6.879,
+        77.905,
+        11.015,
+        -3.281,
+        -21.812,
+        63.713,
+        -6.132,
+        -21.96,
+        -8.012,
+        89.533,
+        -6.639,
+        -0.124,
+        -8.785,
+        13.893
+      ],
+      "p50": -3.25,
+      "p95": 89.533,
+      "min": -39.401,
+      "max": 92.196
+    },
+    "candidate-baseline.failure.healthy": {
+      "samples": [
+        -98.182,
+        -0.117,
+        -19.532,
+        -13.86,
+        -78.466,
+        -22.682,
+        -7.364,
+        -27.136,
+        -78.306,
+        5.557,
+        94.386,
+        -20.639,
+        -72.975,
+        -28.768,
+        0.14,
+        -45.248,
+        -77.612,
+        -4.19,
+        11.645,
+        -25.663
+      ],
+      "p50": -22.682,
+      "p95": 11.645,
+      "min": -98.182,
+      "max": 94.386
+    },
+    "candidate-baseline.failure.refused": {
+      "samples": [
+        -4.253,
+        81.024,
+        -0.869,
+        -8.981,
+        -12.755,
+        59.307,
+        -12.109,
+        -24.436,
+        -4.699,
+        69.042,
+        -16.275,
+        -32.106,
+        11.542,
+        72.043,
+        -5.148,
+        7.461,
+        5.603,
+        58.514,
+        -24.531,
+        -11.873
+      ],
+      "p50": -4.699,
+      "p95": 72.043,
+      "min": -32.106,
+      "max": 81.024
+    },
+    "candidate-baseline.failure.hanging": {
+      "samples": [
+        -16.031,
+        -1.149,
+        -71.497,
+        -2.442,
+        -22.371,
+        17.478,
+        -85.782,
+        -2.009,
+        3.42,
+        -2.799,
+        -84.795,
+        -8.675,
+        0.313,
+        -12.191,
+        -117.893,
+        -24.336,
+        -3.469,
+        -42.962,
+        -71.275,
+        -20.576
+      ],
+      "p50": -16.031,
+      "p95": 3.42,
+      "min": -117.893,
+      "max": 17.478
+    }
+  },
+  "pristine": [
+    {
+      "build": "baseline",
+      "condition": "disabled",
+      "elapsedMs": 523.5014999999839,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "projectContextEventsVerified": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "baseline",
+      "condition": "healthy",
+      "elapsedMs": 450.3583749999816,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "projectContextEventsVerified": 2,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {},
+        "projectContextEventsVerified": 0
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "candidate",
+      "condition": "disabled",
+      "elapsedMs": 437.77699999997276,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "projectContextEventsVerified": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "candidate",
+      "condition": "healthy",
+      "elapsedMs": 468.34370800000033,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "projectContextEventsVerified": 2,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {},
+        "projectContextEventsVerified": 0
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "candidate",
+      "condition": "disabled",
+      "elapsedMs": 456.10866699999315,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "projectContextEventsVerified": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "candidate",
+      "condition": "healthy",
+      "elapsedMs": 470.1848330000066,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "projectContextEventsVerified": 2,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {},
+        "projectContextEventsVerified": 0
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "baseline",
+      "condition": "disabled",
+      "elapsedMs": 464.59833300000173,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "projectContextEventsVerified": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "baseline",
+      "condition": "healthy",
+      "elapsedMs": 490.9200420000125,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "projectContextEventsVerified": 2,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {},
+        "projectContextEventsVerified": 0
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "baseline",
+      "condition": "disabled",
+      "elapsedMs": 456.32795899998746,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "projectContextEventsVerified": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "baseline",
+      "condition": "healthy",
+      "elapsedMs": 476.19216599999345,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "projectContextEventsVerified": 2,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {},
+        "projectContextEventsVerified": 0
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    },
+    {
+      "build": "candidate",
+      "condition": "disabled",
+      "elapsedMs": 457.88066699999035,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 0,
+      "openSocketsAfterExit": 0,
+      "redirected": 0,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 0,
+      "projectContextEventsVerified": 0,
+      "files": [],
+      "queue": {
+        "state": "absent",
+        "events": 0,
+        "payloadBytes": 0,
+        "databaseBytes": 0,
+        "activeClaims": 0,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {}
+      },
+      "serverReceivedEventCounts": {}
+    },
+    {
+      "build": "candidate",
+      "condition": "healthy",
+      "elapsedMs": 471.64891700001317,
+      "exitCode": 0,
+      "stdoutBytes": 3674,
+      "stderrBytes": 0,
+      "requests": 1,
+      "openSocketsAfterExit": 0,
+      "redirected": 1,
+      "blocked": 0,
+      "blockedKind": null,
+      "requestErrors": 0,
+      "responseCompletions": 1,
+      "projectContextEventsVerified": 2,
+      "files": [
+        ".mex/telemetry-id",
+        ".mex/telemetry/outbox.db"
+      ],
+      "queue": {
+        "state": "available",
+        "events": 0,
+        "payloadBytes": 0,
+        "activeClaims": 0,
+        "databaseBytes": 12288,
+        "eventCounts": {},
+        "receivedOrQueuedEventCounts": {},
+        "projectContextEventsVerified": 0
+      },
+      "serverReceivedEventCounts": {
+        "cli.command_started:": 1,
+        "cli.command_completed:success": 1
+      }
+    }
+  ],
+  "projectContext": {
+    "configuredAiTools": [
+      "claude",
+      "codex"
+    ],
+    "existingScaffoldUuidMatched": true,
+    "privateSentinelsRejected": true,
+    "canonicalFixtureUnchanged": true,
+    "failureFixture": "ROUTER names one absent source file; check --json must return MISSING_PATH with exit1",
+    "canonicalFixtureSha256": "5313a6ac40febbd60f4d23c3630d54c40f97e188008843b4e7310556d768c3bf",
+    "verification": "Complete received and durable queued event envelopes were checked before projection. Candidate events must match the existing fixture UUID and exactly [claude,codex]; baseline events must omit both restored fields. Unrelated names, URLs, paths, content and email sentinels are rejected. Counts include baseline absence checks, not baseline metadata collection."
+  },
+  "moduleProbe": {
+    "methodology": "Separately bundled current internal telemetry module; direct synchronous capture-call and awaited flush timings. Module/compiler startup excluded. Each repetition resets transport handles and keeps its isolated durable queue; first capture includes queue initialization. This does not replace built-CLI lifetime measurements. The project mode times getProjectTelemetryContext separately once per repetition and reuses its snapshot for both capture calls; this consent-gated helper skips project reads when disabled.",
+    "bundleSha256": "ae53d1c172484fb343f228f614f456766f0cf85a530005ef3a75a8f82ae963d7",
+    "conditions": {
+      "disabled": {
+        "captureStartedMs": {
+          "samples": [
+            0.002,
+            0.001,
+            0.001,
+            0.001,
+            0.003,
+            0.002,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.002,
+          "min": 0.001,
+          "max": 0.003
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.002,
+            0.002,
+            0.002,
+            0.002,
+            0.002,
+            0.002,
+            0.002,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.002,
+            0.002,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.002,
+          "min": 0.001,
+          "max": 0.002
+        },
+        "flushMs": {
+          "samples": [
+            0.001,
+            0.001,
+            0.001,
+            0.054,
+            0.006,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.006,
+          "min": 0.001,
+          "max": 0.054
+        },
+        "firstCaptureStartedMs": 0.1108749999999965,
+        "queue": {
+          "state": "absent",
+          "events": 0,
+          "bytes": 0
+        },
+        "requests": 0,
+        "redirected": 0,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 0,
+        "responseCompletions": 0,
+        "projectContextReadMs": {
+          "samples": [
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.002,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0.001,
+            0,
+            0.001,
+            0.001
+          ],
+          "p50": 0.001,
+          "p95": 0.001,
+          "min": 0,
+          "max": 0.002
+        },
+        "projectContextEventsVerified": 0,
+        "verifiedQueue": {
+          "state": "absent",
+          "events": 0,
+          "payloadBytes": 0,
+          "databaseBytes": 0,
+          "activeClaims": 0,
+          "eventCounts": {},
+          "receivedOrQueuedEventCounts": {}
+        }
+      },
+      "healthy": {
+        "captureStartedMs": {
+          "samples": [
+            0.731,
+            0.655,
+            0.685,
+            0.667,
+            0.707,
+            0.674,
+            0.598,
+            0.859,
+            0.626,
+            0.603,
+            0.616,
+            0.597,
+            0.59,
+            0.654,
+            0.54,
+            0.574,
+            0.633,
+            0.593,
+            0.634,
+            0.574
+          ],
+          "p50": 0.626,
+          "p95": 0.731,
+          "min": 0.54,
+          "max": 0.859
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.49,
+            0.463,
+            0.45,
+            0.435,
+            0.457,
+            0.5,
+            0.434,
+            0.436,
+            0.441,
+            0.414,
+            0.46,
+            0.448,
+            0.412,
+            0.446,
+            0.405,
+            0.532,
+            0.444,
+            0.414,
+            0.435,
+            0.399
+          ],
+          "p50": 0.441,
+          "p95": 0.5,
+          "min": 0.399,
+          "max": 0.532
+        },
+        "flushMs": {
+          "samples": [
+            1.62,
+            1.591,
+            1.829,
+            2.219,
+            1.823,
+            1.336,
+            1.598,
+            1.423,
+            1.218,
+            1.341,
+            1.36,
+            1.369,
+            1.456,
+            1.281,
+            1.224,
+            1.358,
+            1.201,
+            1.147,
+            1.238,
+            1.083
+          ],
+          "p50": 1.358,
+          "p95": 1.829,
+          "min": 1.083,
+          "max": 2.219
+        },
+        "firstCaptureStartedMs": 3.2704169999999984,
+        "queue": {
+          "state": "available",
+          "events": 0,
+          "bytes": 0
+        },
+        "requests": 25,
+        "redirected": 25,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 0,
+        "responseCompletions": 25,
+        "projectContextReadMs": {
+          "samples": [
+            0.204,
+            0.221,
+            0.169,
+            0.246,
+            0.172,
+            0.197,
+            0.211,
+            0.146,
+            0.163,
+            0.168,
+            0.168,
+            0.145,
+            0.153,
+            0.172,
+            0.142,
+            0.15,
+            0.167,
+            0.139,
+            0.149,
+            0.142
+          ],
+          "p50": 0.167,
+          "p95": 0.221,
+          "min": 0.139,
+          "max": 0.246
+        },
+        "projectContextEventsVerified": 50,
+        "verifiedQueue": {
+          "state": "available",
+          "events": 0,
+          "payloadBytes": 0,
+          "activeClaims": 0,
+          "databaseBytes": 12288,
+          "eventCounts": {},
+          "receivedOrQueuedEventCounts": {},
+          "projectContextEventsVerified": 0
+        }
+      },
+      "refused": {
+        "captureStartedMs": {
+          "samples": [
+            0.795,
+            0.679,
+            0.688,
+            0.709,
+            0.699,
+            0.662,
+            0.62,
+            0.603,
+            0.648,
+            0.605,
+            0.649,
+            0.648,
+            0.707,
+            0.618,
+            0.782,
+            0.584,
+            0.698,
+            0.666,
+            0.727,
+            0.725
+          ],
+          "p50": 0.666,
+          "p95": 0.782,
+          "min": 0.584,
+          "max": 0.795
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.53,
+            0.463,
+            0.444,
+            0.445,
+            0.621,
+            0.475,
+            0.421,
+            0.731,
+            0.454,
+            0.436,
+            0.48,
+            0.473,
+            0.461,
+            0.495,
+            0.47,
+            0.439,
+            0.49,
+            0.46,
+            0.482,
+            0.514
+          ],
+          "p50": 0.47,
+          "p95": 0.621,
+          "min": 0.421,
+          "max": 0.731
+        },
+        "flushMs": {
+          "samples": [
+            1.796,
+            1.638,
+            1.944,
+            2.201,
+            2.248,
+            1.378,
+            1.302,
+            1.76,
+            1.57,
+            1.847,
+            1.727,
+            1.83,
+            1.539,
+            2.054,
+            1.484,
+            1.556,
+            1.745,
+            1.516,
+            1.607,
+            1.691
+          ],
+          "p50": 1.691,
+          "p95": 2.201,
+          "min": 1.302,
+          "max": 2.248
+        },
+        "firstCaptureStartedMs": 3.2354579999999977,
+        "queue": {
+          "state": "available",
+          "events": 50,
+          "bytes": 27100
+        },
+        "requests": 0,
+        "redirected": 25,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 25,
+        "responseCompletions": 0,
+        "projectContextReadMs": {
+          "samples": [
+            0.21,
+            0.186,
+            0.158,
+            0.234,
+            0.166,
+            0.195,
+            0.141,
+            0.138,
+            0.157,
+            0.153,
+            0.16,
+            0.145,
+            0.183,
+            0.142,
+            0.173,
+            0.14,
+            0.157,
+            0.143,
+            0.136,
+            0.18
+          ],
+          "p50": 0.157,
+          "p95": 0.21,
+          "min": 0.136,
+          "max": 0.234
+        },
+        "projectContextEventsVerified": 0,
+        "verifiedQueue": {
+          "state": "available",
+          "events": 50,
+          "payloadBytes": 27100,
+          "activeClaims": 0,
+          "databaseBytes": 49152,
+          "eventCounts": {
+            "cli.command_started:": 25,
+            "cli.command_completed:success": 25
+          },
+          "receivedOrQueuedEventCounts": {
+            "cli.command_started:": 25,
+            "cli.command_completed:success": 25
+          },
+          "projectContextEventsVerified": 50
+        }
+      },
+      "hanging": {
+        "captureStartedMs": {
+          "samples": [
+            1.153,
+            1.168,
+            1.246,
+            1.179,
+            1.071,
+            1.188,
+            0.925,
+            1.599,
+            2.466,
+            2.353,
+            1.89,
+            2.64,
+            1.345,
+            1.639,
+            1.117,
+            1.104,
+            1.043,
+            1,
+            0.964,
+            1.058
+          ],
+          "p50": 1.168,
+          "p95": 2.466,
+          "min": 0.925,
+          "max": 2.64
+        },
+        "captureCompletedMs": {
+          "samples": [
+            0.663,
+            0.699,
+            0.735,
+            0.726,
+            0.662,
+            0.702,
+            0.616,
+            0.804,
+            1.347,
+            1.35,
+            1.163,
+            1.376,
+            0.978,
+            1.264,
+            0.561,
+            0.701,
+            0.546,
+            0.562,
+            0.575,
+            0.601
+          ],
+          "p50": 0.701,
+          "p95": 1.35,
+          "min": 0.546,
+          "max": 1.376
+        },
+        "flushMs": {
+          "samples": [
+            27.757,
+            26.781,
+            27.542,
+            27.186,
+            27.287,
+            27.441,
+            25.965,
+            28.886,
+            28.661,
+            27.06,
+            29.13,
+            26.35,
+            27.599,
+            27.784,
+            27.6,
+            28.308,
+            27.451,
+            26.519,
+            26.182,
+            27.686
+          ],
+          "p50": 27.451,
+          "p95": 28.886,
+          "min": 25.965,
+          "max": 29.13
+        },
+        "firstCaptureStartedMs": 3.350625000000001,
+        "queue": {
+          "state": "available",
+          "events": 50,
+          "bytes": 27100
+        },
+        "requests": 25,
+        "redirected": 25,
+        "blocked": 0,
+        "blockedKind": null,
+        "requestErrors": 25,
+        "responseCompletions": 0,
+        "projectContextReadMs": {
+          "samples": [
+            0.314,
+            0.401,
+            0.373,
+            0.418,
+            0.388,
+            0.266,
+            0.347,
+            0.702,
+            0.539,
+            0.577,
+            0.659,
+            0.486,
+            0.578,
+            0.487,
+            0.481,
+            0.326,
+            0.28,
+            0.277,
+            0.258,
+            0.302
+          ],
+          "p50": 0.388,
+          "p95": 0.659,
+          "min": 0.258,
+          "max": 0.702
+        },
+        "projectContextEventsVerified": 560,
+        "verifiedQueue": {
+          "state": "available",
+          "events": 50,
+          "payloadBytes": 27100,
+          "activeClaims": 0,
+          "databaseBytes": 49152,
+          "eventCounts": {
+            "cli.command_started:": 25,
+            "cli.command_completed:success": 25
+          },
+          "receivedOrQueuedEventCounts": {
+            "cli.command_started:": 25,
+            "cli.command_completed:success": 25
+          },
+          "projectContextEventsVerified": 50
+        }
+      }
+    }
+  },
+  "limitations": [
+    "Single local host; paired differences include scheduler and module-loading noise.",
+    "Server receipt is not client acknowledgement: hanging ingestion receives bodies but never acknowledges them. Client HTTP response completions and durable retained events are reported separately; receipt/retention accounting deduplicates UUIDs in memory and retains no identifiers.",
+    "Local HTTP ingestion does not measure production TLS or Internet latency.",
+    "Candidate offline queues accumulate across the repeated invocations; the queue remains bounded and is inspected only after timed runs.",
+    "First-command runs are bounded observations, not a statistically stable p95.",
+    "This comparison restores metadata against commit 9cbfab8. The earlier telemetry report used a different baseline and empty-project failure fixture; do not treat their absolute timings as a matched before/after comparison.",
+    "The initialized project deliberately contains a missing path and an orphaned scaffold document so check --json exercises a real failed validation. The baseline and candidate use the same bytes and both return exit1.",
+    "This scenario accumulates up to 50 queued events. Maximum-cap queue performance, arbitrary ancestor depths/config sizes, and production network delivery rates are not measured here.",
+    "Both builds use the same preload instrumentation. Embedded Yoga WASM data-URL loading is allowed because it performs no network I/O. The metadata module probe measures the actual consent-gated helper once, then reuses its snapshot for both captures; compiler/module startup is excluded from that probe only."
+  ],
+  "provenance": {
+    "baselineCommit": "9cbfab8f694189e79080b4887b42d8e0aa40ea50",
+    "candidate": "Working-tree project telemetry metadata implementation on codex/0.8.1-telemetry; exact built CLI SHA-256 recorded above",
+    "rawReportSha256": "06a2ea70a458fc69701bb979c289c146c31bc1f5b17d2b1ad2af1e1faa76d309",
+    "harnessSha256": "91a4cc6982b3099741314dbe79fd7f30e7615e557f012ab5f229edb89e6ed266",
+    "rawReportBytes": 413010,
+    "baselinePackageSha256": "6799e4bca1c95d89cfa16389194f742a331964ba5a0a2c00accb89ce87867bf5",
+    "baselineLockSha256": "019f993bc923ba6568f26863d2576eab54760b58164048c47f897b601a6d89f0",
+    "recording": "All raw timing and paired-difference samples retained here; repeated received bodies replaced by per-run closed event counts. No identifiers, tokens or absolute local paths are retained. An interrupted run before the final root-attribution fix was discarded."
+  },
+  "findings": {
+    "candidateProcessMs": {
+      "success": {
+        "disabled": {
+          "p50": 396.824,
+          "p95": 483.518
+        },
+        "healthy": {
+          "p50": 454.433,
+          "p95": 530.903
+        },
+        "refused": {
+          "p50": 403.237,
+          "p95": 489.627
+        },
+        "hanging": {
+          "p50": 451.571,
+          "p95": 525.614
+        }
+      },
+      "failure": {
+        "disabled": {
+          "p50": 564.943,
+          "p95": 630.521
+        },
+        "healthy": {
+          "p50": 549.491,
+          "p95": 625.81
+        },
+        "refused": {
+          "p50": 570.042,
+          "p95": 634.786
+        },
+        "hanging": {
+          "p50": 556.562,
+          "p95": 618.729
+        }
+      }
+    },
+    "candidateEnabledMinusDisabledMs": {
+      "success": {
+        "healthy": {
+          "p50": 15.872,
+          "p95": 102.373
+        },
+        "refused": {
+          "p50": 9.098,
+          "p95": 46.091
+        },
+        "hanging": {
+          "p50": 33.975,
+          "p95": 103.979
+        }
+      },
+      "failure": {
+        "healthy": {
+          "p50": -4.046,
+          "p95": 19.703
+        },
+        "refused": {
+          "p50": -0.03,
+          "p95": 47.627
+        },
+        "hanging": {
+          "p50": -5.065,
+          "p95": 19.342
+        }
+      }
+    },
+    "candidateMinusBaselineMs": {
+      "success": {
+        "disabled": {
+          "p50": -12.129,
+          "p95": 4.26
+        },
+        "healthy": {
+          "p50": 7.895,
+          "p95": 86.162
+        },
+        "refused": {
+          "p50": -13.317,
+          "p95": -0.5
+        },
+        "hanging": {
+          "p50": 1.304,
+          "p95": 88.612
+        }
+      },
+      "failure": {
+        "disabled": {
+          "p50": -3.25,
+          "p95": 89.533
+        },
+        "healthy": {
+          "p50": -22.682,
+          "p95": 11.645
+        },
+        "refused": {
+          "p50": -4.699,
+          "p95": 72.043
+        },
+        "hanging": {
+          "p50": -16.031,
+          "p95": 3.42
+        }
+      }
+    },
+    "projectContextReadMs": {
+      "disabled": {
+        "p50": 0.001,
+        "p95": 0.001
+      },
+      "healthy": {
+        "p50": 0.167,
+        "p95": 0.221
+      },
+      "refused": {
+        "p50": 0.157,
+        "p95": 0.21
+      },
+      "hanging": {
+        "p50": 0.388,
+        "p95": 0.659
+      }
+    },
+    "captureCallP95MaxMs": 2.466,
+    "firstCaptureMaxMs": 3.350625000000001,
+    "flushObservedMaxMs": 29.13,
+    "healthyEvidence": {
+      "success": {
+        "uniqueReceivedIncludingWarmups": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        },
+        "retainedQueue": {},
+        "uniqueReceivedOrQueued": {
+          "cli.command_started:": 25,
+          "cli.command_completed:success": 25
+        }
+      },
+      "failure": {
+        "uniqueReceivedIncludingWarmups": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 24
+        },
+        "retainedQueue": {
+          "cli.command_completed:failure": 1
+        },
+        "uniqueReceivedOrQueued": {
+          "cli.command_started:": 25,
+          "cli.command_completed:failure": 25
+        }
+      }
+    },
+    "offlineEvidence": {
+      "success.refused": {
+        "events": 50,
+        "payloadBytes": 27100,
+        "databaseBytes": 49152,
+        "activeClaims": 0,
+        "projectContextEventsVerified": 50
+      },
+      "success.hanging": {
+        "events": 50,
+        "payloadBytes": 27100,
+        "databaseBytes": 49152,
+        "activeClaims": 0,
+        "projectContextEventsVerified": 50
+      },
+      "failure.refused": {
+        "events": 50,
+        "payloadBytes": 26975,
+        "databaseBytes": 49152,
+        "activeClaims": 0,
+        "projectContextEventsVerified": 50
+      },
+      "failure.hanging": {
+        "events": 50,
+        "payloadBytes": 26975,
+        "databaseBytes": 49152,
+        "activeClaims": 0,
+        "projectContextEventsVerified": 50
+      }
+    },
+    "isolationAndCleanup": "All disabled runs made zero telemetry requests. Every measured child exited naturally with its expected output and exit code; no server sockets remained afterward. Disabled pristine homes stayed empty. The canonical project fixture was byte-identical after all commands and probes.",
+    "interpretation": "The consent-gated project lookup remained below 0.7 ms at p95 in this local fixture, with capture-call p95 below 5 ms and observed flush maximum below 50 ms. Whole-process paired tails were noisy, including disabled baseline/candidate runs; the healthy success median increased 7.895 ms and its paired p95 increased 86.162 ms. These data do not establish a portable no-overhead guarantee or a command speedup."
+  }
+}
diff --git a/docs/design/telemetry-v2.md b/docs/design/telemetry-v2.md
new file mode 100644
index 00000000..987b734f
--- /dev/null
+++ b/docs/design/telemetry-v2.md
@@ -0,0 +1,259 @@
+# MEX 0.8.1 telemetry
+
+Branch: `codex/0.8.1-telemetry`, based on release commit `d64f171`.
+This change targets `codex/0.8.1`; it does not authorize merging to main.
+Draft PR: [#188](https://github.com/mex-memory/mex/pull/188).
+The initial implementation and retained measurements are from `9cbfab8`.
+The subsequently approved project-context additions are locally verified in
+their separate addendum below; new full and platform CI remains required.
+
+## Product questions and measurement definitions
+
+The shared random installation UUID is explicitly approved for CLI and Hub.
+The user subsequently approved restoring the existing scaffold UUID and adding
+configured AI-tool names. An installation remains the repeat-use unit; multiple
+installations using one scaffold provide a shared-project signal. This cannot
+establish people, organizations, team membership, or team size. Agent-generated
+command activity is included and cannot be reliably separated from human
+invocations, and configured tools do not identify the invoking agent.
+
+| Question | Definition |
+| --- | --- |
+| Which features get used? | Unique installations and completed invocations by `command`, or explicit Hub `action`; keep CLI/Hub source and stage visible. Report raw volume alongside unique installations so agent loops do not dominate adoption. |
+| Where do operations fail? | Failures / completions for the same command/action/job kind and stage. Report job results separately from successful job-start requests. Invalid input rejected before dispatch is outside this denominator. |
+| Are new installations activated? | First observed meaningful completion or Hub page visit, followed by a successful knowledge/graph use or applied contribution/Relay. “First observed” is not guaranteed first install because delivery is opt-out and best effort. |
+| Do installations return? | UTC day-1/day-7 retention after first meaningful activity: another qualifying activity on that exact later day. Offer a separate rolling-week measure rather than calling both D7 retention. |
+| Is use habitual? | DAU/WAU and DAU/MAU of qualifying installation activity; also active days per installation per week. Use completed calendar windows and original event timestamps. |
+| Is the Hub useful? | Returning installations with page navigation or explicit actions; views by category; successful apply and terminal job outcomes. A session start, idle timer, polling request, or SSE reconnect is not active use. |
+| Does a project appear to be shared? | During the last 28 completed UTC days, count distinct installation IDs with qualifying activity per nonempty `scaffold_id`. Two or more is a shared-project estimate. For an adoption percentage, divide qualifying scaffold IDs with at least two installations by all observed qualifying scaffold IDs; report missing-context coverage separately. |
+| Which AI integrations are configured? | Break down observed project/installation activity by membership in `configured_ai_tools`. Label this configured-tool adoption, not actual agent usage. Selections can overlap, so percentages need not sum to 100%; state whether the denominator is distinct installations or distinct scaffold IDs. |
+
+Qualifying CLI engagement is a completed product operation, including a failed
+attempt. Exclude `commands`, `completion`, `feedback`, `log`, `heartbeat`,
+`doctor`, `check`, `watch`, and launcher-only `mex`/`tui` from the primary
+engagement view; keep them in diagnostic feature-use reports. This is an
+analysis filter, not a claim about whether an action was automated. CLI
+`preview` counts intent but not an applied change. Hub `replayed: true` applies
+count as invocations, not additional mutations. CLI completion does not expose
+replay detail, so CLI invocations must not be presented as unique mutations.
+
+Shared-project estimates can overcount one person's several machines or copied
+scaffolds that retain an ID, and undercount users sharing one installation.
+Reset installation IDs also change the count. A scaffold UUID has no embedded
+name, but anyone with access to a project's config can associate it with that
+project. Do not present the signal as verified team accounts or anonymized
+project identities. Missing context is unknown, not a new or single-user
+project.
+
+`configured_ai_tools` is the saved project selection: `claude`, `codex`,
+`copilot`, `cursor`, `opencode`, and/or `windsurf`. Several selections are valid;
+the payload uses a sorted, unique array of at most six names. No running
+processes, parent shells, editor sessions, or account data are inspected. The
+selection can be stale or differ from the agent actually invoking MEX.
+
+Do not join voluntary research contact details to installation IDs. The CLI
+and Hub open the same hosted form without identifiers in URL parameters.
+The form fields and follow-up consent are managed outside this repository.
+
+## Implementation
+
+- `src/telemetry/schema.ts` defines the complete vocabulary and reconstructs
+  allowlisted payloads. All six events accept optional `scaffold_id` and
+  `configured_ai_tools`; a scaffold ID must be exactly a UUIDv4, and tool values
+  come from the six-name catalog. Stored events are revalidated before delivery.
+  These are additive fields in unreleased schema v2; older queued v2 events
+  without them remain valid.
+- `src/telemetry/project-context.ts` reads bounded existing config bytes through
+  a read-only, file-identity-checked snapshot. It never initializes, repairs, or
+  mints project identity. Missing, malformed, unreadable, or unsafe config omits
+  metadata; invalid IDs and unknown tool names are excluded. Ordinary CLI
+  operations reuse one snapshot, while setup/init reread at completion for newly
+  saved configuration. The Hub binds a snapshot to its project on the first
+  enabled event; subsequent config changes appear after Hub restart. No project
+  names, Git remotes, paths, content, or contact details enter that projection.
+  Graph maintenance/status metadata follows the exact selected root, honoring
+  local `--root` before the parent option; Hub metadata also uses its exact root.
+  A missing nested scaffold never falls back to an unrelated ancestor identity.
+  Other CLI operations retain nearest-Git-root discovery.
+- `src/cli-telemetry.ts` uses registered Commander ancestry, derives a closed
+  stage value, and completes each action once. Action errors retain exit codes
+  and output while allowing bounded telemetry cleanup. TUI/watch launcher
+  completion describes startup, not eventual session termination.
+- `src/hub/telemetry.ts` projects validated server actions. A strict, authenticated
+  page-category POST is capped at 128 bytes and 60 events/minute. Browser requests
+  have one in-flight operation and a two-second timeout. Query/hash changes,
+  polling, normal reads, fixture APIs, and repeated renders stay silent.
+- Owned jobs emit a terminal outcome once after durable terminal-state storage;
+  reading or reconciling historical jobs does not create another completion.
+- The per-user SQLite outbox uses zero busy wait, capped rows/bytes/age/file size,
+  rollback journals, and expiring claims. No graph database is opened or rebuilt.
+  The existing lazy SQLite adapter avoids loading native SQLite for opt-outs.
+- Node HTTP sends fixed-origin batches with no SDK retries or detached process.
+  CLI flush has a default 25 ms grace, capped at 50 ms for internal callers;
+  Hub batches every 15 seconds with a two-second request timeout. Cancellation
+  destroys sockets and cancels the dedicated DNS resolver.
+- Explicit opt-out persists before queue cleanup and reports a busy/unavailable
+  purge honestly. Its dedicated marker survives unrelated stale preference writes;
+  only explicit enable removes it. Inspection never creates identities, repairs queues, or sends.
+
+The complete privacy and delivery contract is [TELEMETRY.md](../../TELEMETRY.md).
+Public package exports, emitted root declaration bytes, graph/Wiki protocols,
+and repository artifact schemas are unchanged. `posthog-node` is removed from
+production dependencies. The published package now includes `TELEMETRY.md`. The transport follows the documented
+[PostHog capture API](https://posthog.com/docs/api/capture).
+
+## Performance verification
+
+The methodology below applies to future comparison runs. The retained results
+are historical evidence for `9cbfab8`, before optional project context. The new
+reader and added payload fields have separate measurements recorded in the
+validation addendum.
+
+The standalone benchmark runs actual built CLI entry points from process spawn
+through natural close. It pairs a preserved release build with this candidate,
+interleaves conditions, and compares telemetry off, healthy loopback delivery,
+connection refusal, and a server that accepts requests but never responds.
+Success (`mex commands`) and failure (`mex check --json` outside a project) are
+both covered, along with pristine-home initialization. Repeated invocations
+verify queued completion accounting, output/exit compatibility, bounded request
+cleanup, and offline retention.
+
+The harness redirects only the fixed telemetry ingestion origin to loopback
+using a test-only Node preload, blocks other egress, and leaves the production
+entry point unchanged. It does not measure internet/TLS latency; a separate
+transport deadline test covers cancellation. These local measurements are
+characterization, not a new portable release budget.
+
+Run after preserving a baseline build and completing other heavy checks:
+
+```sh
+npm run benchmark:telemetry:test
+npm run benchmark:telemetry -- --baseline /absolute/baseline/dist/cli.js --output test-results/telemetry.json
+```
+
+### Historical measured result: `9cbfab8`
+
+[Retained evidence](telemetry-performance-results.json) includes raw samples and
+paired differences. On the local Apple M4 / Node 22.17.1 host, each of 16 CLI
+groups completed five warmups and 20 measured invocations. Times below are
+paired enabled-minus-disabled differences, in milliseconds.
+
+| Command result | Healthy p50 / p95 | Refused p50 / p95 | Hanging p50 / p95 |
+| --- | --- | --- | --- |
+| Success | 3.084 / 17.811 | 4.408 / 20.586 | 27.294 / 48.884 |
+| Failure | 7.806 / 18.022 | 6.377 / 24.638 | 22.797 / 31.600 |
+
+The short successful command's absolute median was 357.033 ms disabled,
+360.396 ms with healthy local ingestion, and 386.629 ms with hanging ingestion.
+The older implementation took 1029.530 ms with hanging ingestion; the paired
+median improvement was 644.888 ms. The new failure path adds outcome capture
+where the old process exited without delivering an event.
+
+Capture-call p95 was at most 2.410 ms, with first queue initialization at most
+3.210 ms. The longest observed flush was 29.114 ms, including local cleanup and
+scheduling around the 25 ms network grace. These observed times are not hard
+wall-clock guarantees on arbitrary disks, hosts, or schedulers.
+
+Every tested healthy candidate command accounted for all 25 starts and 25
+completions across warmups and samples, with an empty queue afterward. Refused
+and hanging conditions retained all 50 events per command in a 45,056-byte
+store, with no active delivery claim left. All processes exited naturally with
+expected output/status, no sockets remained, and disabled pristine homes stayed
+empty. Receipt and acknowledgement are distinguished; UUID set union prevents
+received-but-still-queued events from being counted twice.
+
+Internet/TLS latency and production delivery rates are not measured by the
+loopback benchmark. Short-only usage can defer events repeatedly until enough
+runtime is available for a send or a Hub session drains the queue. The local
+measurements cover backlogs up to 50 events; maximum-cap queue timing is not
+claimed. The initial implementation validation record follows below.
+
+## Historical Verify Checklist: `9cbfab8`
+
+These results belong to the original telemetry implementation, before the
+scaffold/tool follow-up. They remain retained evidence, not a pass for the
+current working tree.
+
+1. **Public surface/declarations — pass.** `src/index.ts` and root emitted declaration bytes are unchanged; telemetry remains internal.
+2. **Read and write safety — pass.** Pure reads skip capture; page input is authenticated and bounded; queued data is revalidated; explicit opt-out owns preference/cleanup.
+3. **Deterministic bounds — pass.** Event vocabulary, request body/rate, queue rows/bytes/age/file size, claim life, requests and network grace are bounded. Tests include malformed data, unsafe paths, large SQLite pages, concurrent writers, active opt-out and real stalled DNS.
+4. **Tests/typecheck — pass.** Final `npm test -- --maxWorkers=2`: 222 files, 3,500 passed, one skipped (657.24 seconds), with no concurrent build. Hub web: 434 passed. Playwright: two passed (Home screenshot/accessibility and production-Hub integration). Workspace typecheck and standalone benchmark harness (four tests) pass. The actual CLI benchmark passes. The first full run exposed two old-API architecture assertions and one aggregate containment timeout; the guard now covers the actual capture boundary, and the five containment fixtures run independently with their original assertions/timeouts.
+5. **Packaging/evaluator — pass.** Full build and fresh packed-install/Project Hub/official-skills smoke pass. The packaged CLI hash matches the retained benchmark candidate. No evaluator or graph protocol change requires a new evaluator run.
+6. **Diff and scope — pass.** `git diff --check` passes. Changes are limited to telemetry, feedback, supporting tests/CI and documentation. Generated indexes, checkout local state and dist remain unstaged; the real graph database hash is unchanged.
+7. **Graph/Wiki protocols — pass.** Existing command, application-adapter, golden protocol, immutable-read and Hub integration suites pass. No graph/Wiki protocol, error, ordering, cursor, or maintenance contract changed. macOS/Windows CI and the pinned release-performance gate remain required before release.
+
+## Project-context validation addendum
+
+The follow-up adds only optional existing scaffold UUID/configured-tool context.
+Its baseline is the initial telemetry revision `9cbfab8`, whose Node 22/24,
+macOS/Windows, browser and release-performance CI all passed in run
+`34361480149`. Those results are historical; the follow-up has separate local
+checks and requires new CI before merge.
+
+[Retained project-context measurements](telemetry-project-context-performance.json)
+compare the preserved `9cbfab8` build against candidate CLI SHA-256
+`99ebd1b40c434de47bcfdbe5db74af43a5be27afa84c96d0bc401cbdb52e067b`.
+The Apple M4 / Node 22.17.1 run used five warmups and 20 samples for each of 16
+groups, plus pristine-home and module probes. Pass `--project-context` to the
+benchmark command above: this creates an isolated existing scaffold/tool
+configuration and uses a deliberate missing source path for the failed check.
+
+The enabled metadata helper measured p95 **0.221 ms** with healthy ingestion,
+**0.210 ms** with refused connections and **0.659 ms** with hanging ingestion.
+Capture-call p95 was at most **2.466 ms**, first capture at most **3.351 ms**,
+and the longest observed flush was **29.130 ms**.
+
+Whole-process timing was noisy, so it does not establish zero overhead or a
+speedup. These are paired candidate-minus-`9cbfab8` differences in milliseconds:
+
+| Command result | Disabled p50 / p95 | Healthy p50 / p95 | Refused p50 / p95 | Hanging p50 / p95 |
+| --- | --- | --- | --- | --- |
+| Success | -12.129 / 4.260 | 7.895 / 86.162 | -13.317 / -0.500 | 1.304 / 88.612 |
+| Failure | -3.250 / 89.533 | -22.682 / 11.645 | -4.699 / 72.043 | -16.031 / 3.420 |
+
+The disabled comparison itself includes a roughly 90 ms p95 difference, where
+project config is not read. Retain this noise rather than treating positive
+tails as measured metadata cost or negative medians as an optimization. The
+module probe isolates the small metadata cost; the full CLI run verifies real
+process cleanup, outputs and delivery under the tested conditions. These are
+local observations, not a portable latency guarantee.
+
+Every received and queued event passed exact existing UUID/tool checks and
+private-field rejection. All processes exited naturally, sockets and delivery
+claims were cleared, disabled pristine homes stayed empty, and canonical
+fixture bytes were unchanged. Healthy success accounted for all 50 events;
+healthy failure received 49 and retained the final completion locally, for a
+50-event union. Refused/hanging queues retained 50 events in 49,152 bytes. This
+also verifies the documented best-effort delivery boundary. All timing samples
+are retained without event/installation/scaffold IDs or private fixture values.
+
+1. **Public surface/declarations — pass.** `src/index.ts` is unchanged, and the final build's root declaration bytes match the preserved `9cbfab8` build. The new reader and metadata types remain internal.
+2. **Read and write safety — pass.** Metadata reads never mint identity or modify project state. Opt-outs skip discovery; unavailable or unsafe config omits context. Tests cover nested projects, exact Graph/Hub roots, parent/local Graph option precedence, read-only inspection, setup completion refresh and independent Hub snapshots.
+3. **Deterministic bounds — pass.** Discovery is capped at 64 ancestors and 64 KiB of config. Only an existing UUIDv4 and at most six known, sorted, unique tool names survive projection. File identity, UTF-8, schema, symlink/junction and hardlink checks remain enforced. Queue and transport bounds are unchanged.
+4. **Tests/typecheck — pass.** This follow-up passed 353 distinct tests across 15 files covering schema, reader, capture, CLI, Hub wiring/actions/jobs, delivery, capabilities, feedback and architecture. The final root-attribution correction was rechecked with 142 tests across six files, followed by workspace typecheck. Seven standalone benchmark-harness tests pass. The previous full regression, web and browser counts above belong to `9cbfab8`; no new full-suite result is claimed here.
+5. **Packaging/evaluator — pass for the changed scope.** Full build passes, and the final built CLI is exercised by the dedicated latency harness. Package layout, dependencies and frontend assets are unchanged by this follow-up; the initial packed-install smoke remains historical evidence. No evaluator or Graph protocol change requires another evaluator run.
+6. **Diff and scope — pass.** `git diff --check` passes, including the retained benchmark report. Source, tests, CI and docs are the intended changes; generated indexes, local state and dist remain excluded. The real graph database still matches its pre-change SHA-256 `0b6dd1f8e161f19e4a15111f125a83d2245f01c01e791f21e38f2c8a4a61af41`.
+7. **Graph/Wiki protocols — pass for the changed scope.** No Graph/Wiki payload, error, ordering, cursor or maintenance implementation changed. The focused CLI/capability/immutable-read regressions pass; the attribution correction changes only which safe telemetry context is selected. Fresh full and platform CI remains required before merge.
+
+## Windows DNS test correction
+
+At `e725551`, CI run `34375530581` passed Node 22/24, macOS portability,
+browser and release-performance checks. Windows passed 522 tests and skipped
+three; one real DNS cancellation test measured 174.8385 ms against its 150 ms
+elapsed limit. The new scaffold/tool tests passed on Windows.
+
+That test used a 10 ms sleep to assume dispatch had reached its loopback DNS
+server. It now waits for the first observed UDP query and confirms it is still
+pending before timing `flush`. This removes setup ambiguity without changing
+the 25 ms production grace, 150 ms elapsed assertion, real `ECANCELLED` result,
+stopped-query assertion or retained-event check. No production code changed.
+The original log does not isolate whether cold setup, scheduling or local
+cleanup caused its elapsed overrun; a fresh Windows run must verify the fix.
+
+1. **Public surface/declarations — pass.** Test/documentation-only correction; public source and built declarations are unchanged.
+2. **Read/write safety — pass.** Real DNS remains pinned to a loopback blackhole. Cancellation and retained queue assertions are preserved.
+3. **Bounds — pass.** Existing runtime and elapsed bounds are unchanged; waiting for the first query has a one-second setup guard.
+4. **Tests/typecheck — pass locally.** All 45 delivery tests and workspace typecheck pass. Windows verification is pending the new CI run.
+5. **Packaging/evaluator — not affected.** No runtime, packaging, asset or evaluator changes; the retained built-CLI measurements remain applicable.
+6. **Diff/scope — pass.** `git diff --check` passes. Only the delivery test, this validation record and the telemetry test guidance changed.
+7. **Graph/Wiki protocols — not affected.** No Graph/Wiki code, database, protocol, error or maintenance change.
diff --git a/package-lock.json b/package-lock.json
index de4ff63a..97e3ff03 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -19,7 +19,6 @@
         "glob": "^13.0.6",
         "hono": "^4.13.3",
         "ink": "^7.0.3",
-        "posthog-node": "^5.21.2",
         "react": "^19.2.6",
         "remark-frontmatter": "^5.0.0",
         "remark-parse": "^11.0.0",
@@ -1216,15 +1215,6 @@
         "node": ">=20"
       }
     },
-    "node_modules/@posthog/core": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-Xk3JQ+cdychsvftrV3G9ZrN9W329lbyFW0pGJXFGKFQf8qr4upw2SgNg9BVorjSrfhoXZRnJGt/uNF4nGFBL5A==",
-      "license": "MIT",
-      "dependencies": {
-        "cross-spawn": "^7.0.6"
-      }
-    },
     "node_modules/@rolldown/pluginutils": {
       "version": "1.0.0-beta.27",
       "resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.0-beta.27.tgz",
@@ -5456,18 +5446,6 @@
         }
       }
     },
-    "node_modules/posthog-node": {
-      "version": "5.21.2",
-      "resolved": "https://registry.npmjs.org/posthog-node/-/posthog-node-5.21.2.tgz",
-      "integrity": "sha512-Jehlu0KguL1LLyUczCt86OtA5INmeStK3zcgbv1BSyMcNxs0HP3GQogBrYhwhqHsk6JopiFFVpJyZEoXOUMhGw==",
-      "license": "MIT",
-      "dependencies": {
-        "@posthog/core": "1.10.0"
-      },
-      "engines": {
-        "node": ">=20"
-      }
-    },
     "node_modules/pretty-format": {
       "version": "27.5.1",
       "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-27.5.1.tgz",
diff --git a/package.json b/package.json
index 6c30a3f3..7b1a24b7 100644
--- a/package.json
+++ b/package.json
@@ -24,6 +24,7 @@
     "templates",
     "LICENSE",
     "README.md",
+    "TELEMETRY.md",
     "COMPATIBILITY.md"
   ],
   "keywords": [
@@ -72,7 +73,9 @@
     "benchmark:graph-status": "npm run build && node scripts/benchmark-graph-status.mjs",
     "benchmark:release": "npm run build && node scripts/release-benchmark/enforce.mjs --output test-results/release-benchmark/report.json",
     "typecheck": "npm run typecheck --workspace @mex/hub-contracts && tsc --noEmit && npm run typecheck --workspace @mex/hub-web",
-    "prepare": "npm run build"
+    "prepare": "npm run build",
+    "benchmark:telemetry": "npm run build && node scripts/benchmark-telemetry.mjs",
+    "benchmark:telemetry:test": "node --test scripts/benchmark-telemetry.test.js"
   },
   "dependencies": {
     "@hono/node-server": "^1.19.17",
@@ -82,7 +85,6 @@
     "glob": "^13.0.6",
     "hono": "^4.13.3",
     "ink": "^7.0.3",
-    "posthog-node": "^5.21.2",
     "react": "^19.2.6",
     "remark-frontmatter": "^5.0.0",
     "remark-parse": "^11.0.0",
diff --git a/packages/hub-web/src/api/client.test.ts b/packages/hub-web/src/api/client.test.ts
index c87a30ac..319fb20b 100644
--- a/packages/hub-web/src/api/client.test.ts
+++ b/packages/hub-web/src/api/client.test.ts
@@ -13,6 +13,7 @@ import {
 } from "./client";
 import type { ActivityResponse, JobSummary, RelayOperationPreviewRequest } from "./types";
 import { createFixtureApi } from "../dev/fixture-api";
+import type { HubTelemetryPage } from "./telemetry";
 
 const json = (body: unknown, status = 200) => new Response(JSON.stringify(body), {
   status,
@@ -51,6 +52,34 @@ afterEach(() => {
   vi.unstubAllGlobals();
 });
 
+describe("local page telemetry transport", () => {
+  it("sends only a category with session CSRF to the exact local endpoint and bounds in-flight work", async () => {
+    let complete!: (response: Response) => void;
+    const pending = new Promise<Response>(resolve => { complete = resolve; });
+    const fetch = vi.fn().mockResolvedValueOnce(json(session)).mockReturnValueOnce(pending);
+    vi.stubGlobal("fetch", fetch);
+    const api = new HttpHubApi();
+    await api.recordPageView("home");
+    expect(fetch).not.toHaveBeenCalled();
+    await api.getSession();
+    await api.recordPageView("/Users/private" as HubTelemetryPage);
+    expect(fetch).toHaveBeenCalledOnce();
+    const sent = api.recordPageView("knowledge_detail");
+    await api.recordPageView("code");
+    expect(fetch).toHaveBeenCalledTimes(2);
+    expect(fetch.mock.calls[1]).toEqual(["/api/v1/telemetry/page", {
+      method: "POST", headers: { "Content-Type": "application/json", "X-MEX-CSRF": session.csrfToken },
+      body: '{"page":"knowledge_detail"}', credentials: "same-origin", redirect: "error",
+      referrerPolicy: "no-referrer", signal: expect.any(AbortSignal),
+    }]);
+    complete(new Response(null, { status: 204 }));
+    await sent;
+    fetch.mockRejectedValueOnce(new Error("local connection lost"));
+    await expect(api.recordPageView("jobs")).resolves.toBeUndefined();
+    expect(fetch).toHaveBeenCalledTimes(3);
+  });
+});
+
 describe("bootstrap fragment handling", () => {
   it.each([
     ["#token=secret-token", "secret-token"],
diff --git a/packages/hub-web/src/api/client.ts b/packages/hub-web/src/api/client.ts
index 1af3bde9..107030e9 100644
--- a/packages/hub-web/src/api/client.ts
+++ b/packages/hub-web/src/api/client.ts
@@ -107,6 +107,7 @@ import type {
   WikiRelationsResponse,
 } from "./types";
 import type { RelayTransport } from "./relay-client";
+import { isHubTelemetryPage, type HubTelemetryPage } from "./telemetry";
 
 const API_ROOT = "/api/v1";
 
@@ -165,6 +166,7 @@ export interface FixtureApiOptions {
 }
 
 export interface HubApi {
+  recordPageView?(page: HubTelemetryPage): Promise<void>;
   getLoggingPolicy(): Promise<AgentLoggingPolicy>;
   setLoggingPolicy(request: AgentLoggingUpdateRequest): Promise<AgentLoggingPolicy>;
   bootstrap(token: string): Promise<BootstrapResponse>;
@@ -320,6 +322,24 @@ export function clearBootstrapFragment(): void {
 
 export class HttpHubApi implements HubApi {
   #csrfToken: string | null = null;
+  #pageViewPending = false;
+
+  async recordPageView(page: HubTelemetryPage): Promise<void> {
+    if (!this.#csrfToken || this.#pageViewPending || !isHubTelemetryPage(page)) return;
+    this.#pageViewPending = true;
+    try {
+      await fetch(`${API_ROOT}/telemetry/page`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-MEX-CSRF": this.#csrfToken },
+        body: JSON.stringify({ page }),
+        credentials: "same-origin",
+        redirect: "error",
+        referrerPolicy: "no-referrer",
+        signal: AbortSignal.timeout(2_000),
+      });
+    } catch { /* A dropped local usage event must never disturb navigation. */ }
+    finally { this.#pageViewPending = false; }
+  }
   #relayTransport: RelayTransport = {
     request: (path, schema, init, mutation) => this.#request(path, schema, init, mutation),
     invalidIdentifier: (detail) => {
diff --git a/packages/hub-web/src/api/telemetry.ts b/packages/hub-web/src/api/telemetry.ts
new file mode 100644
index 00000000..27aafbf9
--- /dev/null
+++ b/packages/hub-web/src/api/telemetry.ts
@@ -0,0 +1,25 @@
+const PAGE_ROUTES = {
+  "/": "home", "/search": "search", "/knowledge": "knowledge", "/code": "code",
+  "/workstreams": "workstreams", "/specs": "specs", "/playbooks": "playbooks",
+  "/catch-up": "catch_up", "/inbox": "inbox", "/relays": "relays", "/members": "members",
+  "/activity": "activity", "/jobs": "jobs", "/health": "health", "/settings": "settings",
+} as const;
+
+export type HubTelemetryPage = typeof PAGE_ROUTES[keyof typeof PAGE_ROUTES]
+  | "knowledge_detail" | "code_symbol" | "spec_detail" | "not_found";
+
+const PAGES = new Set<string>([...Object.values(PAGE_ROUTES), "knowledge_detail", "code_symbol", "spec_detail", "not_found"]);
+
+export function isHubTelemetryPage(page: unknown): page is HubTelemetryPage {
+  return typeof page === "string" && PAGES.has(page);
+}
+
+/** Reduce locally before serialization; identifiers never enter the payload. */
+export function hubPageCategory(pathname: string): HubTelemetryPage {
+  const path = pathname.replace(/\/+$/, "") || "/";
+  if (Object.hasOwn(PAGE_ROUTES, path)) return PAGE_ROUTES[path as keyof typeof PAGE_ROUTES];
+  if (/^\/knowledge\/[^/]+$/.test(path)) return "knowledge_detail";
+  if (/^\/code\/symbols\/[^/]+$/.test(path)) return "code_symbol";
+  if (/^\/specs\/[^/]+$/.test(path)) return "spec_detail";
+  return "not_found";
+}
diff --git a/packages/hub-web/src/app/HubLayout.tsx b/packages/hub-web/src/app/HubLayout.tsx
index cc73b849..f257a828 100644
--- a/packages/hub-web/src/app/HubLayout.tsx
+++ b/packages/hub-web/src/app/HubLayout.tsx
@@ -8,6 +8,7 @@ import { Button } from "../components/primitives/button";
 import { formatTime, StatePanel, StatusPill } from "../components/ui";
 import styles from "../styles/shell.module.css";
 import { JobLifecycleObserver } from "./JobLifecycleObserver";
+import { PageViewObserver } from "./PageViewObserver";
 import { HubSidebar } from "./HubSidebar";
 
 /**
@@ -181,6 +182,7 @@ export function HubLayout({
 
   return (
     <div className={styles.viewportFrame}>
+      <PageViewObserver />
       {isOverview ? null : <JobLifecycleObserver channelScope={session.expiresAt} />}
       <a className={styles.skipLink} href="#main-content">Skip to main content</a>
       <HubSidebar capabilities={capabilities} home={trustedHome} />
diff --git a/packages/hub-web/src/app/PageViewObserver.test.tsx b/packages/hub-web/src/app/PageViewObserver.test.tsx
new file mode 100644
index 00000000..1614a9aa
--- /dev/null
+++ b/packages/hub-web/src/app/PageViewObserver.test.tsx
@@ -0,0 +1,46 @@
+import { act, render, waitFor } from "@testing-library/react";
+import { StrictMode } from "react";
+import { createMemoryRouter, RouterProvider } from "react-router-dom";
+import { describe, expect, it, vi } from "vitest";
+import { HubApiProvider } from "../api/context";
+import { createFixtureApi } from "../dev/fixture-api";
+import { PageViewObserver } from "./PageViewObserver";
+
+describe("Hub page views", () => {
+  it("records route categories once, omitting query/hash/identifiers and idle renders", async () => {
+    const recordPageView = vi.fn(async () => undefined);
+    const api = { ...createFixtureApi(), recordPageView };
+    const router = createMemoryRouter([{ path: "*", element: <PageViewObserver /> }], {
+      initialEntries: ["/knowledge/mx_private?query=private%40example.test#private-token"],
+    });
+    const rendered = render(<StrictMode><HubApiProvider api={api}><RouterProvider router={router} /></HubApiProvider></StrictMode>);
+    await waitFor(() => expect(recordPageView).toHaveBeenCalledOnce());
+    await act(() => router.navigate("/knowledge/mx_private?query=another-secret#another-token"));
+    expect(recordPageView).toHaveBeenCalledOnce();
+    await act(() => router.navigate("/code/symbols/private-source-id?view=callers"));
+    await act(() => router.navigate("/code/symbols/another-source-id?view=callers"));
+    await act(() => router.navigate("/relays?relay=relay_private"));
+    await act(() => router.navigate("/unknown/private/path"));
+    rendered.rerender(<StrictMode><HubApiProvider api={api}><RouterProvider router={router} /></HubApiProvider></StrictMode>);
+    expect(recordPageView.mock.calls).toEqual([
+      ["knowledge_detail"], ["code_symbol"], ["code_symbol"], ["relays"], ["not_found"],
+    ]);
+    expect(JSON.stringify(recordPageView.mock.calls)).not.toMatch(/private|query|token|view|source-id/);
+  });
+
+  it("leaves fixtures quiet and ignores optional observer delivery failure", async () => {
+    const fetch = vi.spyOn(globalThis, "fetch");
+    const router = createMemoryRouter([{ path: "*", element: <PageViewObserver /> }]);
+    const rendered = render(<HubApiProvider api={createFixtureApi()}><RouterProvider router={router} /></HubApiProvider>);
+    await act(() => router.navigate("/jobs"));
+    expect(fetch).not.toHaveBeenCalled();
+    rendered.unmount();
+    fetch.mockRestore();
+    const recordPageView = vi.fn(async () => { throw new Error("local transport failed"); });
+    const failingRouter = createMemoryRouter([{ path: "*", element: <PageViewObserver /> }]);
+    render(<HubApiProvider api={{ ...createFixtureApi(), recordPageView }}><RouterProvider router={failingRouter} /></HubApiProvider>);
+    await waitFor(() => expect(recordPageView).toHaveBeenCalledOnce());
+    await act(() => failingRouter.navigate("/settings"));
+    expect(recordPageView).toHaveBeenLastCalledWith("settings");
+  });
+});
diff --git a/packages/hub-web/src/app/PageViewObserver.tsx b/packages/hub-web/src/app/PageViewObserver.tsx
new file mode 100644
index 00000000..67610f5c
--- /dev/null
+++ b/packages/hub-web/src/app/PageViewObserver.tsx
@@ -0,0 +1,17 @@
+import { useEffect, useRef } from "react";
+import { useLocation } from "react-router-dom";
+import { useHubApi } from "../api/context";
+import { hubPageCategory } from "../api/telemetry";
+
+/** Navigation only: query edits, hash changes, polling, and renders stay quiet. */
+export function PageViewObserver() {
+  const api = useHubApi();
+  const { pathname } = useLocation();
+  const previousPath = useRef<string | null>(null);
+  useEffect(() => {
+    if (!api.recordPageView || previousPath.current === pathname) return;
+    previousPath.current = pathname;
+    void api.recordPageView(hubPageCategory(pathname)).catch(() => undefined);
+  }, [api, pathname]);
+  return null;
+}
diff --git a/packages/hub-web/src/pages/HomeOverview.tsx b/packages/hub-web/src/pages/HomeOverview.tsx
index 88099be6..91c433f6 100644
--- a/packages/hub-web/src/pages/HomeOverview.tsx
+++ b/packages/hub-web/src/pages/HomeOverview.tsx
@@ -513,18 +513,7 @@ function ActivityRow({ item }: { item: ActivityItem }) {
   );
 }
 
-/**
- * Where the signup lives, and why the Hub never sees the address.
- *
- * The form is hosted; this card only opens it. That is not a shortcut — the Hub
- * serves itself under a policy that permits neither an outbound `fetch` nor a
- * cross-origin form post (`src/hub/app.ts`, `connect-src 'self'`,
- * `form-action 'self'`), so an input here could not submit anywhere without
- * loosening the rule that makes "Runs locally" in the sidebar true. Opening a
- * link is a navigation rather than a connection, so it stays inside the policy.
- *
- * The consequence worth stating: **no email address ever passes through mex.**
- */
+/** Hosted voluntary feedback; no address or installation ID passes through the Hub. */
 const UPDATES_FORM = "https://tally.so/r/KYjv4k";
 
 /**
@@ -538,12 +527,12 @@ function UpdatesSignupCard() {
     <Card className={homeStyles.updatesCard} role="region" aria-labelledby="overview-updates-heading">
       <CardHeader className={homeStyles.panelHeader}>
         <div>
-          <CardTitle><h2 id="overview-updates-heading">Help make MEX better</h2></CardTitle>
+          <CardTitle><h2 id="overview-updates-heading">Help shape MEX</h2></CardTitle>
         </div>
       </CardHeader>
       <CardContent className={homeStyles.updatesContent}>
         <p className={homeStyles.updatesBody}>
-          A short form about how you&rsquo;re using it. Your answers help shape mex :)
+          Tell us how you use MEX and what we should improve.
         </p>
         <div className={homeStyles.updatesActions}>
           {/*
@@ -556,7 +545,7 @@ function UpdatesSignupCard() {
             size="sm"
             variant="outline"
           >
-            Open the form
+            Share feedback
             <ExternalLink aria-hidden="true" data-icon="inline-end" />
           </Button>
         </div>
diff --git a/scripts/benchmark-telemetry.mjs b/scripts/benchmark-telemetry.mjs
new file mode 100644
index 00000000..eaed3955
--- /dev/null
+++ b/scripts/benchmark-telemetry.mjs
@@ -0,0 +1,476 @@
+#!/usr/bin/env node
+
+// Local characterization, never a portable release budget. The built CLI runs
+// its normal main entry; only its fixed telemetry destination is redirected.
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { once } from "node:events";
+import { createServer } from "node:http";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { cpus, platform, release, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { performance } from "node:perf_hooks";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { gunzipSync } from "node:zlib";
+
+const CONDITIONS = ["disabled", "healthy", "refused", "hanging"];
+const COMMANDS = [
+  { name: "success", args: ["commands"], exitCode: 0 },
+  { name: "failure", args: ["check", "--json"], exitCode: 1 },
+];
+const MAX_OUTPUT_BYTES = 64 * 1024;
+const MAX_BODY_BYTES = 128 * 1024;
+const MAX_REPORT_BYTES = 512 * 1024;
+const CHILD_TIMEOUT_MS = 5_000;
+
+export function createProjectContextFixture(root) {
+  const scaffoldId = randomUUID();
+  const sentinel = `MEX_PRIVATE_BENCHMARK_${randomUUID()}`;
+  const tools = ["claude", "codex"];
+  mkdirSync(join(root, ".git"));
+  mkdirSync(join(root, ".mex"));
+  mkdirSync(join(root, "src"));
+  writeFileSync(join(root, ".mex", "ROUTER.md"), `# Fixture\nThe runtime entry is \`src/runtime-entry.ts\`.\nPrivate note: ${sentinel}\n`);
+  writeFileSync(join(root, ".mex", "config.json"), JSON.stringify({
+    scaffold_id: scaffoldId, aiTools: tools,
+    scaffold_name: sentinel, origin: `https://example.invalid/${sentinel}`, upstream: sentinel,
+    private_metadata: { email: `${sentinel}@example.invalid`, path: `/private/${sentinel}`, content: sentinel },
+  }) + "\n");
+  return { scaffoldId, sentinel, tools };
+}
+
+/** Check complete transport/queue bytes before projecting anonymous test evidence. */
+export function assertProjectContextEvent(event, expected) {
+  if (!expected) return;
+  if (JSON.stringify(event).includes(expected.sentinel)) throw new Error("Project privacy sentinel escaped into telemetry.");
+  if (Object.keys(event).sort().join() !== "distinct_id,event,properties,timestamp,uuid") throw new Error("Unexpected project telemetry envelope.");
+  const properties = event.properties;
+  const allowed = new Set(["schema_version", "source", "installation_id", "mex_version", "os", "node_version", "$process_person_profile", "$geoip_disable", "command", "stage", "outcome", "duration_ms", "scaffold_id", "configured_ai_tools"]);
+  if (!properties || Object.keys(properties).some((key) => !allowed.has(key))) throw new Error("Unexpected project telemetry property.");
+  if (expected.required) {
+    if (properties.scaffold_id !== expected.scaffoldId || JSON.stringify(properties.configured_ai_tools) !== JSON.stringify(expected.tools)) throw new Error("Existing project metadata was not preserved exactly.");
+  } else if (Object.hasOwn(properties, "scaffold_id") || Object.hasOwn(properties, "configured_ai_tools")) {
+    throw new Error("The retained baseline unexpectedly contains project metadata.");
+  }
+}
+
+function fixtureDigest(root) {
+  const digest = createHash("sha256");
+  for (const file of homeInventory(root)) digest.update(file).update(readFileSync(join(root, file)));
+  return digest.digest("hex");
+}
+
+export function summarizeSamples(samples) {
+  if (!samples.length || !samples.every(Number.isFinite)) throw new Error("Invalid timing samples.");
+  const sorted = [...samples].sort((a, b) => a - b);
+  const round = (value) => Math.round(value * 1000) / 1000;
+  return { samples: samples.map(round), p50: round(sorted[Math.ceil(sorted.length * 0.5) - 1]), p95: round(sorted[Math.ceil(sorted.length * 0.95) - 1]), min: round(sorted[0]), max: round(sorted.at(-1)) };
+}
+
+export function telemetryPreloadSource(endpoint) {
+  const target = new URL(endpoint);
+  if (target.protocol !== "http:" || target.hostname !== "127.0.0.1" || !target.port || target.pathname !== "/batch/" || target.search || target.hash || target.username || target.password) {
+    throw new Error("Benchmark endpoint must be exact IPv4 loopback /batch/.");
+  }
+  return `
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import dns from 'node:dns';
+import dgram from 'node:dgram';
+import { syncBuiltinESMExports } from 'node:module';
+import { urlToHttpOptions } from 'node:url';
+import { writeSync } from 'node:fs';
+const target = new URL(${JSON.stringify(target.href)});
+const diagnostics = { redirected: 0, blocked: 0, blockedKind: null, requestErrors: 0, responseCompletions: 0 };
+const originalRequest = http.request;
+const originalConnect = net.Socket.prototype.connect;
+const originalFetch = globalThis.fetch;
+function deny(kind) { diagnostics.blocked++; diagnostics.blockedKind = kind; throw new Error('Benchmark blocked an unexpected outbound destination.'); }
+for (const owner of [dns, dns.Resolver.prototype, dns.promises, dns.promises.Resolver.prototype]) {
+  for (const key of Object.getOwnPropertyNames(owner)) if ((key.startsWith('resolve') || key === 'lookup') && typeof owner[key] === 'function') owner[key] = () => deny('dns');
+}
+dgram.Socket.prototype.send = () => deny('udp');
+function allow(url) {
+  if (url.origin !== 'https://us.i.posthog.com' || url.pathname !== '/batch/' || url.username || url.password) deny('https-origin');
+  diagnostics.redirected++;
+}
+net.Socket.prototype.connect = function (...args) {
+  const first = Array.isArray(args[0]) ? args[0] : args;
+  const options = typeof first[0] === 'object' ? first[0] : { port: first[0], host: first[1] };
+  if (String(options.port) !== target.port || options.host !== '127.0.0.1' || options.path) deny('socket');
+  return originalConnect.apply(this, args);
+};
+https.request = function (input, options, callback) {
+  const base = typeof input === 'string' || input instanceof URL ? urlToHttpOptions(new URL(input)) : input;
+  const merged = { ...base, ...(typeof options === 'object' ? options : {}) };
+  const original = new URL((merged.protocol ?? 'https:') + '//' + (merged.hostname ?? merged.host) + (merged.port ? ':' + merged.port : '') + (merged.path ?? '/'));
+  allow(original);
+  const request = originalRequest({ ...merged, protocol: 'http:', hostname: target.hostname, host: target.hostname, port: target.port, path: target.pathname, agent: false, lookup: undefined }, typeof options === 'function' ? options : callback);
+  request.on('error', () => { diagnostics.requestErrors++; });
+  request.on('response', (response) => response.on('end', () => { diagnostics.responseCompletions++; }));
+  return request;
+};
+https.get = (...args) => { const request = https.request(...args); request.end(); return request; };
+http.request = () => deny('http-origin');
+http.get = () => deny('http-origin');
+globalThis.fetch = async (input, options) => {
+  // Yoga loads its embedded WASM through fetch(data:). This performs no I/O.
+  if (typeof input === 'string' && input.startsWith('data:application/octet-stream;base64,') && input.length <= 2 * 1024 * 1024) return originalFetch(input, options);
+  const url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url);
+  allow(url);
+  try { return await originalFetch(target, options); }
+  catch (error) { diagnostics.requestErrors++; throw error; }
+};
+syncBuiltinESMExports();
+process.on('exit', () => { try { writeSync(3, JSON.stringify(diagnostics)); } catch {} });
+`;
+}
+
+export async function startLocalIngestion() {
+  const sockets = new Set();
+  let current = null;
+  const server = createServer((request, response) => {
+    const record = current;
+    if (!record) { request.destroy(); return; }
+    record.requests++;
+    const chunks = [];
+    let bytes = 0;
+    request.on("data", (chunk) => {
+      bytes += chunk.length;
+      if (bytes > MAX_BODY_BYTES) { record.invalidBodies++; request.destroy(); }
+      else chunks.push(chunk);
+    });
+    request.on("end", () => {
+      try {
+        let body = Buffer.concat(chunks);
+        if (request.headers["content-encoding"] === "gzip") body = gunzipSync(body, { maxOutputLength: MAX_BODY_BYTES });
+        const payload = JSON.parse(body.toString("utf8"));
+        if (!Array.isArray(payload.batch) || payload.batch.length > 64) throw new Error("Invalid batch.");
+        for (const event of payload.batch) {
+          assertProjectContextEvent(event, record.projectContext);
+          if (record.projectContext) record.projectContextEventsVerified++;
+          // Retain only the closed aggregate dimensions used by this fixture.
+          record.events.push({
+            uuid: typeof event.uuid === "string" && event.uuid.length <= 64 ? event.uuid : null,
+            event: typeof event.event === "string" && event.event.length <= 64 ? event.event : "invalid",
+            command: typeof event.properties?.command === "string" && event.properties.command.length <= 64 ? event.properties.command : null,
+            outcome: typeof event.properties?.outcome === "string" && event.properties.outcome.length <= 32 ? event.properties.outcome : null,
+          });
+        }
+      } catch { record.invalidBodies++; }
+      if (record.mode === "healthy") { response.writeHead(200, { "content-type": "application/json", connection: "close" }); response.end('{"status":1}'); }
+    });
+    request.on("error", () => {});
+    response.on("error", () => {});
+  });
+  server.on("connection", (socket) => { sockets.add(socket); socket.on("close", () => sockets.delete(socket)); });
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  return {
+    endpoint: `http://127.0.0.1:${server.address().port}/batch/`,
+    begin(mode, projectContext) { current = { mode, requests: 0, invalidBodies: 0, events: [], projectContext, projectContextEventsVerified: 0 }; return current; },
+    async finish() {
+      // Measured child close has already happened. Let the parent observe its
+      // socket close before checking cleanup; this wait is outside the sample.
+      const deadline = performance.now() + 500;
+      while (sockets.size && performance.now() < deadline) await new Promise((done) => setTimeout(done, 5));
+      const openSockets = sockets.size;
+      current = null;
+      return openSockets;
+    },
+    async close() { for (const socket of sockets) socket.destroy(); await new Promise((done) => server.close(done)); },
+  };
+}
+
+export async function runBoundedProcess({ cli, args, preload, cwd, env, timeoutMs = CHILD_TIMEOUT_MS }) {
+  const started = performance.now();
+  const child = spawn(process.execPath, ["--import", preload, cli, ...args], { cwd, env, stdio: ["ignore", "pipe", "pipe", "pipe"], windowsHide: true });
+  let timedOut = false;
+  let outputOverflow = false;
+  let spawnError = null;
+  const chunks = [[], [], []];
+  const sizes = [0, 0, 0];
+  child.on("error", (error) => { spawnError = error; });
+  for (const [index, stream] of [child.stdout, child.stderr, child.stdio[3]].entries()) {
+    stream.on("data", (chunk) => {
+      sizes[index] += chunk.length;
+      if (sizes[index] > MAX_OUTPUT_BYTES) { outputOverflow = true; child.kill("SIGKILL"); }
+      else chunks[index].push(chunk);
+    });
+  }
+  const timer = setTimeout(() => { timedOut = true; child.kill("SIGKILL"); }, timeoutMs);
+  const result = await new Promise((done) => child.once("close", (code, signal) => done({ code, signal, elapsedMs: performance.now() - started })));
+  clearTimeout(timer);
+  if (spawnError) throw spawnError;
+  if (timedOut) throw new Error("Benchmark child exceeded its bounded lifetime.");
+  if (outputOverflow) throw new Error("Benchmark child exceeded its output cap.");
+  const [stdout, stderr, rawDiagnostics] = chunks.map((parts) => Buffer.concat(parts).toString("utf8"));
+  const diagnostics = JSON.parse(rawDiagnostics);
+  if (diagnostics.blocked) throw new Error(`Benchmark detected unexpected outbound networking (${diagnostics.blockedKind}).`);
+  return { ...result, stdout, stderr, diagnostics };
+}
+
+function childEnvironment(mexHome, disabled) {
+  const env = { ...process.env, MEX_HOME: mexHome, MEX_TELEMETRY: disabled ? "0" : "1", NO_COLOR: "1", LANG: "C", LC_ALL: "C" };
+  for (const name of Object.keys(env)) {
+    if (name === "DO_NOT_TRACK" || name === "MEX_DEV" || name.startsWith("NODE_") || name.startsWith("GIT_") || /^(https?|all|no)_proxy$/iu.test(name)) delete env[name];
+  }
+  return env;
+}
+
+function prepareHome(path, pristine = false) {
+  mkdirSync(path, { recursive: true });
+  if (!pristine) {
+    mkdirSync(join(path, ".mex"));
+    writeFileSync(join(path, ".mex", "config.json"), JSON.stringify({ firstRunNoticeShown: true, feedbackDismissed: true }));
+    writeFileSync(join(path, ".mex", "telemetry-id"), randomUUID() + "\n", { mode: 0o600 });
+  }
+}
+
+function homeInventory(root) {
+  const output = [];
+  function visit(dir, prefix = "") {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (output.length > 64) throw new Error("Unexpected unbounded local telemetry state.");
+      const relative = prefix + entry.name;
+      if (entry.isDirectory()) visit(join(dir, entry.name), relative + "/");
+      else output.push(relative);
+    }
+  }
+  visit(root);
+  return output.sort();
+}
+
+export async function inspectQueue(mexHome, receivedById = new Map(), projectContext) {
+  const path = join(mexHome, ".mex", "telemetry", "outbox.db");
+  if (!existsSync(path)) return { state: "absent", events: 0, payloadBytes: 0, databaseBytes: 0, activeClaims: 0, eventCounts: {}, receivedOrQueuedEventCounts: {} };
+  // The child has closed; read-only inspection is outside its timed lifetime.
+  const { DatabaseSync } = await import("node:sqlite");
+  const database = new DatabaseSync(path, { readOnly: true });
+  try {
+    const row = database.prepare("SELECT count(*) AS events, coalesce(sum(length(CAST(payload AS BLOB))),0) AS payloadBytes, coalesce(sum(CASE WHEN lease_until > ? THEN 1 ELSE 0 END),0) AS activeClaims FROM events").get(Date.now());
+    const databaseBytes = statSync(path).size;
+    if (row.events > 256 || row.payloadBytes > 256 * 1024 || databaseBytes > 1024 * 1024 || row.activeClaims) throw new Error("Telemetry queue bounds or released claims failed.");
+    const eventCounts = {};
+    const receivedOrQueued = new Map(receivedById);
+    for (const item of database.prepare("SELECT payload FROM events LIMIT 256").all()) {
+      const event = JSON.parse(item.payload);
+      assertProjectContextEvent(event, projectContext);
+      const key = event.event + ":" + (event.properties?.outcome ?? "");
+      if (!["cli.command_started:", "cli.command_completed:success", "cli.command_completed:failure"].includes(key)) throw new Error("Unexpected benchmark queue event.");
+      eventCounts[key] = (eventCounts[key] ?? 0) + 1;
+      if (typeof event.uuid !== "string" || event.uuid.length > 64) throw new Error("Invalid benchmark queue identity.");
+      receivedOrQueued.set(event.uuid, key);
+    }
+    const receivedOrQueuedEventCounts = {};
+    for (const key of receivedOrQueued.values()) receivedOrQueuedEventCounts[key] = (receivedOrQueuedEventCounts[key] ?? 0) + 1;
+    return { state: "available", ...row, databaseBytes, eventCounts, receivedOrQueuedEventCounts, ...(projectContext ? { projectContextEventsVerified: row.events } : {}) };
+  } finally { database.close(); }
+}
+
+async function prepareModuleProbe(workspace, projectContext = false) {
+  const source = resolve(dirname(fileURLToPath(import.meta.url)), "../src/telemetry/index.ts");
+  const output = join(workspace, "module", "dist", "probe.mjs");
+  mkdirSync(dirname(output), { recursive: true });
+  const packageJson = JSON.parse(readFileSync(resolve(dirname(source), "../../package.json"), "utf8"));
+  writeFileSync(join(workspace, "module", "package.json"), JSON.stringify({ type: "module", version: packageJson.version, private: true }));
+  const esbuild = await import("esbuild");
+  try {
+    await esbuild.build({
+      stdin: { contents: `
+import {captureEvent,flush,getTelemetryInspection,__resetTelemetryForTest${projectContext ? ",getProjectTelemetryContext" : ""}} from ${JSON.stringify(source)};
+import {performance} from 'node:perf_hooks';
+const warmups=Number(process.argv[2]), samples=Number(process.argv[3]);
+const results={started:[],completed:[],flush:[],firstStartedMs:null,${projectContext ? "contextRead:[]," : ""}};
+for(let index=0;index<warmups+samples;index++) {
+  __resetTelemetryForTest();
+  ${projectContext ? "const readStarted=performance.now(); const context=getProjectTelemetryContext(process.cwd()); const readEnded=performance.now();" : "const context={};"}
+  const start=performance.now();
+  captureEvent('cli.command_started',{...context,command:'commands',stage:'direct'});
+  const middle=performance.now();
+  captureEvent('cli.command_completed',{...context,command:'commands',stage:'direct',outcome:'success',duration_ms:0});
+  const end=performance.now();
+  await flush();
+  const closed=performance.now();
+  if(index===0) results.firstStartedMs=middle-start;
+  if(index>=warmups) {results.started.push(middle-start);results.completed.push(end-middle);results.flush.push(closed-end);}
+  ${projectContext ? "if(index>=warmups) results.contextRead.push(readEnded-readStarted);" : ""}
+}
+results.queue=getTelemetryInspection().queue;
+await flush({deadlineMs:0});
+__resetTelemetryForTest();
+process.stdout.write(JSON.stringify(results));
+`, sourcefile: "telemetry-module-probe.ts", resolveDir: resolve(dirname(source), "../..") },
+      outfile: output, bundle: true, packages: "external", platform: "node", target: "node22", format: "esm", logLevel: "silent",
+    });
+  } finally { await esbuild.stop(); }
+  return output;
+}
+
+export async function runTelemetryBenchmark({ cli, baseline, samples = 20, warmups = 5, projectContext = false, progress = () => {} }) {
+  if (!Number.isInteger(samples) || samples < 20 || samples > 100 || !Number.isInteger(warmups) || warmups < 0 || warmups > 20) throw new Error("Expected 20–100 samples and 0–20 warmups.");
+  const builds = [{ name: "baseline", cli: resolve(baseline) }, { name: "candidate", cli: resolve(cli) }];
+  for (const build of builds) if (!existsSync(build.cli)) throw new Error("Built CLI missing.");
+  const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-benchmark-"));
+  let ingestion;
+  try {
+    const fixture = join(workspace, "fixture");
+    mkdirSync(fixture);
+    writeFileSync(join(fixture, "package.json"), '{"name":"telemetry-benchmark-fixture","private":true}\n');
+    const project = projectContext ? createProjectContextFixture(fixture) : undefined;
+    const canonicalBefore = project ? fixtureDigest(fixture) : undefined;
+    const expectedContext = (build) => project ? { ...project, required: build === "candidate" } : undefined;
+    ingestion = await startLocalIngestion();
+    const refused = await startLocalIngestion();
+    const refusedEndpoint = refused.endpoint;
+    await refused.close();
+    const preloads = {};
+    for (const condition of CONDITIONS) {
+      preloads[condition] = join(workspace, `${condition}.mjs`);
+      writeFileSync(preloads[condition], telemetryPreloadSource(condition === "refused" ? refusedEndpoint : ingestion.endpoint));
+    }
+    // Compile the private source-module probe and stop its compiler service
+    // before any timing loop. This is distinct from the unchanged built CLI.
+    const moduleProbePath = await prepareModuleProbe(workspace, projectContext);
+    const records = {};
+    for (const build of builds) {
+      build.sha256 = createHash("sha256").update(readFileSync(build.cli)).digest("hex");
+      for (const command of COMMANDS) {
+        for (const condition of CONDITIONS) {
+          const key = `${build.name}.${command.name}.${condition}`;
+          const mexHome = join(workspace, key);
+          prepareHome(mexHome);
+          records[key] = { build: build.name, command: command.name, condition, mexHome, runs: [], receivedById: new Map(), receivedEventCounts: {} };
+        }
+      }
+    }
+    async function measure(build, command, condition, mexHome, ledger = { receivedById: new Map(), receivedEventCounts: {} }) {
+      const received = ingestion.begin(condition === "healthy" || condition === "disabled" ? "healthy" : "hanging", expectedContext(build.name));
+      let result;
+      try { result = await runBoundedProcess({ cli: build.cli, args: command.args, preload: preloads[condition], cwd: fixture, env: childEnvironment(mexHome, condition === "disabled") }); }
+      catch (error) { throw new Error(`${build.name}.${command.name}.${condition}: ${error.message}`); }
+      const openSockets = await ingestion.finish();
+      if (result.code !== command.exitCode || result.signal || openSockets || received.invalidBodies) throw new Error(`Invalid process/delivery result for ${build.name}.${command.name}.${condition}.`);
+      if (condition === "disabled" && (received.requests || result.diagnostics.redirected)) throw new Error("Disabled telemetry touched the network.");
+      if (condition === "refused" && received.requests) throw new Error("Refused condition reached ingestion.");
+      if (command.name === "success" && (!result.stdout.includes("CLI Commands") || result.stderr.includes("Unhandled"))) throw new Error("Success command output changed.");
+      if (command.name === "failure") {
+        if (project) {
+          const report = JSON.parse(result.stdout);
+          if (!Array.isArray(report.issues) || !report.issues.some((issue) => issue.code === "MISSING_PATH" && issue.severity === "error")) throw new Error("Project fixture did not report its deliberate missing path.");
+        } else if (!result.stderr.trim() || result.stdout.trim()) throw new Error("Failure command output contract changed.");
+      }
+      for (const event of received.events) {
+        if (!event.uuid || !ledger.receivedById.has(event.uuid)) {
+          const key = event.event + ":" + (event.outcome ?? "");
+          if (event.uuid) ledger.receivedById.set(event.uuid, key);
+          ledger.receivedEventCounts[key] = (ledger.receivedEventCounts[key] ?? 0) + 1;
+        }
+      }
+      if (ledger.receivedById.size > 512) throw new Error("Unexpected unbounded delivery evidence.");
+      return { elapsedMs: result.elapsedMs, exitCode: result.code, stdoutBytes: Buffer.byteLength(result.stdout), stderrBytes: Buffer.byteLength(result.stderr), requests: received.requests, events: received.events.map(({ uuid: _uuid, ...event }) => event), openSocketsAfterExit: openSockets, ...result.diagnostics, ...(project ? { projectContextEventsVerified: received.projectContextEventsVerified } : {}) };
+    }
+    for (let round = 0; round < warmups + samples; round++) {
+      const order = round % 2 ? [...builds].reverse() : builds;
+      const conditions = [...CONDITIONS.slice(round % CONDITIONS.length), ...CONDITIONS.slice(0, round % CONDITIONS.length)];
+      for (const command of COMMANDS) {
+        for (const condition of conditions) {
+          for (const build of order) {
+            const record = records[`${build.name}.${command.name}.${condition}`];
+            const result = await measure(build, command, condition, record.mexHome, record);
+            if (round >= warmups) record.runs.push(result);
+          }
+        }
+      }
+      progress({ round: round + 1, totalRounds: warmups + samples, phase: round < warmups ? "warmup" : "measured" });
+    }
+    const pristine = [];
+    for (let round = 0; round < 3; round++) {
+      for (const build of round % 2 ? [...builds].reverse() : builds) {
+        for (const condition of ["disabled", "healthy"]) {
+          const mexHome = join(workspace, `pristine-${round}-${build.name}-${condition}`);
+          prepareHome(mexHome, true);
+          const result = await measure(build, COMMANDS[0], condition, mexHome);
+          const queue = await inspectQueue(mexHome, undefined, expectedContext(build.name));
+          if (condition === "disabled" && homeInventory(mexHome).length) throw new Error("Disabled first command created local telemetry state.");
+          pristine.push({ build: build.name, condition, ...result, files: homeInventory(mexHome), queue });
+        }
+      }
+    }
+    const groups = Object.fromEntries(await Promise.all(Object.entries(records).map(async ([key, record]) => [key, {
+      processMs: summarizeSamples(record.runs.map((run) => run.elapsedMs)),
+      delivery: { serverReceivedRequests: record.runs.map((run) => run.requests), serverReceivedEventsPerRun: record.runs.map((run) => run.events), requestErrors: record.runs.map((run) => run.requestErrors), clientHttpResponseCompletions: record.runs.map((run) => run.responseCompletions), openSocketsAfterExit: record.runs.map((run) => run.openSocketsAfterExit) },
+      ...(project ? { projectContextEventsVerified: record.runs.map((run) => run.projectContextEventsVerified) } : {}),
+      output: { exitCodes: [...new Set(record.runs.map((run) => run.exitCode))], stdoutBytes: [...new Set(record.runs.map((run) => run.stdoutBytes))], stderrBytes: [...new Set(record.runs.map((run) => run.stderrBytes))] },
+      files: homeInventory(record.mexHome),
+      queue: await inspectQueue(record.mexHome, record.receivedById, expectedContext(record.build)),
+      uniqueServerReceivedEventsIncludingWarmups: record.receivedEventCounts,
+    }])));
+    for (const command of COMMANDS) {
+      const healthy = groups[`candidate.${command.name}.healthy`];
+      const completionKey = "cli.command_completed:" + command.name;
+      if (!(healthy.uniqueServerReceivedEventsIncludingWarmups[completionKey] > 0)) throw new Error("Healthy ingestion never received a command outcome.");
+      for (const key of ["cli.command_started:", completionKey]) {
+        if ((healthy.queue.receivedOrQueuedEventCounts[key] ?? 0) !== warmups + samples) throw new Error("Healthy command event receipt/retention accounting failed.");
+      }
+      for (const condition of ["refused", "hanging"]) if (!groups[`candidate.${command.name}.${condition}`].queue.events) throw new Error("Offline candidate did not preserve queued events.");
+    }
+    const pairedDeltasMs = {};
+    for (const build of builds) for (const command of COMMANDS) {
+      const disabled = records[`${build.name}.${command.name}.disabled`].runs;
+      for (const condition of CONDITIONS.slice(1)) pairedDeltasMs[`${build.name}.${command.name}.${condition}-disabled`] = summarizeSamples(records[`${build.name}.${command.name}.${condition}`].runs.map((run, index) => run.elapsedMs - disabled[index].elapsedMs));
+    }
+    for (const command of COMMANDS) for (const condition of CONDITIONS) {
+      const before = records[`baseline.${command.name}.${condition}`].runs;
+      pairedDeltasMs[`candidate-baseline.${command.name}.${condition}`] = summarizeSamples(records[`candidate.${command.name}.${condition}`].runs.map((run, index) => run.elapsedMs - before[index].elapsedMs));
+    }
+    const moduleProbe = {};
+    for (const condition of CONDITIONS) {
+      const mexHome = join(workspace, `module-${condition}`);
+      prepareHome(mexHome);
+      const received = ingestion.begin(condition === "healthy" || condition === "disabled" ? "healthy" : "hanging", expectedContext("candidate"));
+      const processResult = await runBoundedProcess({ cli: moduleProbePath, args: [String(warmups), String(samples)], preload: preloads[condition], cwd: fixture, env: childEnvironment(mexHome, condition === "disabled") });
+      if (processResult.code !== 0 || processResult.signal || received.invalidBodies || await ingestion.finish()) throw new Error("Module probe did not exit and clean up normally.");
+      const result = JSON.parse(processResult.stdout);
+      if (result.started.length !== samples || result.completed.length !== samples || result.flush.length !== samples) throw new Error("Module probe sample count mismatch.");
+      moduleProbe[condition] = { captureStartedMs: summarizeSamples(result.started), captureCompletedMs: summarizeSamples(result.completed), flushMs: summarizeSamples(result.flush), firstCaptureStartedMs: result.firstStartedMs, queue: result.queue, requests: received.requests, ...processResult.diagnostics };
+      if (project) {
+        moduleProbe[condition].projectContextReadMs = summarizeSamples(result.contextRead);
+        moduleProbe[condition].projectContextEventsVerified = received.projectContextEventsVerified;
+        moduleProbe[condition].verifiedQueue = await inspectQueue(mexHome, undefined, expectedContext("candidate"));
+      }
+    }
+    if (project && fixtureDigest(fixture) !== canonicalBefore) throw new Error("Project fixture changed during ordinary reads.");
+    return {
+      schemaVersion: 1, kind: "telemetry-local-performance-characterization", generatedAt: new Date().toISOString(),
+      environment: { node: process.version, platform: platform(), release: release(), architecture: process.arch, cpu: cpus()[0]?.model ?? "unknown" },
+      builds: builds.map(({ name, sha256 }) => ({ name, cliSha256: sha256 })),
+      methodology: { samplesPerCondition: samples, warmupsPerCondition: warmups, commandArguments: COMMANDS.map(({ name, args }) => ({ name, args })), conditionOrder: "rotated every round; baseline/candidate order alternates", measuredInterval: "spawn through child close, including loader, CLI, telemetry and natural process cleanup", transport: "harness-only preload redirects only the fixed PostHog HTTPS batch destination to real loopback HTTP; all other outbound sockets denied; TLS and external network latency excluded", repeatUse: "isolated preseeded installation identity and notice preferences", pristineRunsPerCondition: 3, lifetimeHangGuardMs: CHILD_TIMEOUT_MS, portablePerformanceGate: false },
+      groups, pairedDeltasMs, pristine,
+      ...(project ? { projectContext: { configuredAiTools: project.tools, existingScaffoldUuidMatched: true, privateSentinelsRejected: true, canonicalFixtureUnchanged: true, failureFixture: "ROUTER names one absent source file; check --json must return MISSING_PATH with exit1", canonicalFixtureSha256: canonicalBefore } } : {}),
+      moduleProbe: { methodology: "Separately bundled current internal telemetry module; direct synchronous capture-call and awaited flush timings. Module/compiler startup excluded. Each repetition resets transport handles and keeps its isolated durable queue; first capture includes queue initialization. This does not replace built-CLI lifetime measurements." + (project ? " The project mode times getProjectTelemetryContext separately once per repetition and reuses its snapshot for both capture calls; this consent-gated helper skips project reads when disabled." : ""), bundleSha256: createHash("sha256").update(readFileSync(moduleProbePath)).digest("hex"), conditions: moduleProbe },
+      limitations: ["Single local host; paired differences include scheduler and module-loading noise.", "Server receipt is not client acknowledgement: hanging ingestion receives bodies but never acknowledges them. Client HTTP response completions and durable retained events are reported separately; receipt/retention accounting deduplicates UUIDs in memory and retains no identifiers.", "Local HTTP ingestion does not measure production TLS or Internet latency.", "Candidate offline queues accumulate across the repeated invocations; the queue remains bounded and is inspected only after timed runs.", "First-command runs are bounded observations, not a statistically stable p95."]
+    };
+  } finally { await ingestion?.close(); rmSync(workspace, { recursive: true, force: true }); }
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const options = {};
+  for (let index = 0; index < args.length; index++) {
+    if (args[index] === "--project-context") { options.projectContext = true; continue; }
+    if (!["--cli", "--baseline", "--output", "--samples", "--warmups"].includes(args[index]) || !args[index + 1]) throw new Error("Usage: node scripts/benchmark-telemetry.mjs --baseline <built-cli> --output <json> [--cli dist/cli.js] [--samples 20] [--warmups 5] [--project-context]");
+    options[args[index].slice(2)] = args[++index];
+  }
+  if (!options.baseline || !options.output) throw new Error("A preserved baseline CLI and report output path are required.");
+  const report = await runTelemetryBenchmark({ cli: options.cli ?? resolve(dirname(fileURLToPath(import.meta.url)), "../dist/cli.js"), baseline: options.baseline, samples: Number(options.samples ?? 20), warmups: Number(options.warmups ?? 5), projectContext: options.projectContext === true, progress: (value) => process.stderr.write(JSON.stringify(value) + "\n") });
+  const json = JSON.stringify(report, null, 2) + "\n";
+  if (Buffer.byteLength(json) > MAX_REPORT_BYTES) throw new Error("Benchmark report exceeded its output cap.");
+  writeFileSync(resolve(options.output), json);
+  process.stdout.write(JSON.stringify({ result: "complete", groups: Object.keys(report.groups).length, samplesPerCondition: report.methodology.samplesPerCondition }) + "\n");
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  main().catch((error) => { console.error(error.message); process.exitCode = 1; });
+}
diff --git a/scripts/benchmark-telemetry.test.js b/scripts/benchmark-telemetry.test.js
new file mode 100644
index 00000000..bcd17dde
--- /dev/null
+++ b/scripts/benchmark-telemetry.test.js
@@ -0,0 +1,195 @@
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { request } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { assertProjectContextEvent, createProjectContextFixture, inspectQueue, runBoundedProcess, startLocalIngestion, summarizeSamples, telemetryPreloadSource } from "./benchmark-telemetry.mjs";
+
+function projectEvent(expected) {
+  return {
+    event: "cli.command_completed", uuid: "9fef46b1-cb38-4fda-a166-a6f2395d4c14",
+    distinct_id: "311a9850-3dc7-41e1-bc5e-8b10e0df8d19", timestamp: "2026-09-09T00:00:00.000Z",
+    properties: { command: "commands", outcome: "success", scaffold_id: expected.scaffoldId, configured_ai_tools: expected.tools },
+  };
+}
+
+const requestFixture = `
+import { request } from 'node:https';
+const req = request('https://us.i.posthog.com/batch/', {method:'POST',agent:false,headers:{'content-type':'application/json'}}, (response) => response.resume());
+req.on('error', () => {});
+req.setTimeout(500, () => req.destroy(new Error('Fixture request timeout')));
+req.end(JSON.stringify({batch:[{event:'command_finished',properties:{command:'commands',outcome:'success'}}]}));
+`;
+const fetchFixture = `
+try {
+  await fetch('https://us.i.posthog.com/batch/', {method:'POST',signal:AbortSignal.timeout(500),headers:{'content-type':'application/json'},body:JSON.stringify({batch:[{event:'command_run',properties:{command:'commands'}}]})});
+} catch {}
+`;
+
+describe("isolated telemetry benchmark", () => {
+  it("creates existing project identity and rejects missing, altered, or private event metadata", () => {
+    const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-project-test-"));
+    try {
+      const expected = { ...createProjectContextFixture(workspace), required: true };
+      const config = JSON.parse(readFileSync(join(workspace, ".mex", "config.json"), "utf8"));
+      assert.equal(config.scaffold_id, expected.scaffoldId);
+      assert.deepEqual(config.aiTools, ["claude", "codex"]);
+      assert.equal(config.private_metadata.content, expected.sentinel);
+      assert.doesNotThrow(() => assertProjectContextEvent(projectEvent(expected), expected));
+      for (const change of [
+        { scaffold_id: "311a9850-3dc7-41e1-bc5e-8b10e0df8d19" },
+        { scaffold_id: undefined },
+        { configured_ai_tools: ["codex", "claude"] },
+        { configured_ai_tools: undefined },
+        { scaffold_name: "Unexpected project name" },
+        { command: expected.sentinel },
+      ]) {
+        const event = projectEvent(expected);
+        Object.assign(event.properties, change);
+        assert.throws(() => assertProjectContextEvent(event, expected), /metadata|property|sentinel/u);
+      }
+      const extra = projectEvent(expected);
+      extra.private = "unexpected envelope field";
+      assert.throws(() => assertProjectContextEvent(extra, expected), /envelope/u);
+      const baseline = projectEvent(expected);
+      assert.throws(() => assertProjectContextEvent(baseline, { ...expected, required: false }), /baseline/u);
+      delete baseline.properties.scaffold_id;
+      delete baseline.properties.configured_ai_tools;
+      assert.doesNotThrow(() => assertProjectContextEvent(baseline, { ...expected, required: false }));
+      assert.doesNotThrow(() => assertProjectContextEvent({ arbitrary: "legacy fixture" }));
+    } finally { rmSync(workspace, { recursive: true, force: true }); }
+  });
+
+  it("validates raw queued metadata before retaining anonymous evidence", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-project-test-"));
+    try {
+      const expected = { ...createProjectContextFixture(workspace), required: true };
+      const directory = join(workspace, ".mex", "telemetry");
+      mkdirSync(directory);
+      const { DatabaseSync } = await import("node:sqlite");
+      const path = join(directory, "outbox.db");
+      const database = new DatabaseSync(path);
+      const event = projectEvent(expected);
+      try {
+        database.exec("CREATE TABLE events(uuid TEXT,payload TEXT,lease_until INTEGER)");
+        database.prepare("INSERT INTO events VALUES(?,?,0)").run(event.uuid, JSON.stringify(event));
+      } finally { database.close(); }
+      const state = await inspectQueue(workspace, undefined, expected);
+      assert.equal(state.projectContextEventsVerified, 1);
+      assert.equal(JSON.stringify(state).includes(expected.scaffoldId), false);
+      const writer = new DatabaseSync(path);
+      try {
+        event.properties.scaffold_name = expected.sentinel;
+        writer.prepare("UPDATE events SET payload=?").run(JSON.stringify(event));
+      } finally { writer.close(); }
+      await assert.rejects(inspectQueue(workspace, undefined, expected), /sentinel/u);
+    } finally { rmSync(workspace, { recursive: true, force: true }); }
+  });
+
+  it("validates the full received payload before projecting permitted dimensions", async () => {
+    const ingestion = await startLocalIngestion();
+    const expected = { scaffoldId: "d4fddfda-a319-43a0-999f-d0f14d33976b", tools: ["claude", "codex"], sentinel: "PRIVATE_SENTINEL", required: true };
+    try {
+      for (const privateValue of [false, true]) {
+        const record = ingestion.begin("healthy", expected);
+        const event = projectEvent(expected);
+        if (privateValue) event.properties.scaffold_name = expected.sentinel;
+        await new Promise((resolve, reject) => {
+          const post = request(ingestion.endpoint, { method: "POST", agent: false }, (response) => { response.resume(); response.on("end", resolve); });
+          post.on("error", reject);
+          post.setTimeout(1_000, () => post.destroy(new Error("Fixture request timeout")));
+          post.end(JSON.stringify({ batch: [event] }));
+        });
+        assert.equal(record.invalidBodies, privateValue ? 1 : 0);
+        assert.equal(record.projectContextEventsVerified, privateValue ? 0 : 1);
+        assert.equal(record.events.length, privateValue ? 0 : 1);
+        assert.equal(JSON.stringify(record.events).includes(expected.scaffoldId), false);
+        assert.equal(await ingestion.finish(), 0);
+      }
+    } finally { await ingestion.close(); }
+  });
+
+  it("counts a received but unacknowledged queued UUID only once", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-harness-test-"));
+    try {
+      const directory = join(workspace, ".mex", "telemetry");
+      mkdirSync(directory, { recursive: true });
+      const { DatabaseSync } = await import("node:sqlite");
+      const database = new DatabaseSync(join(directory, "outbox.db"));
+      const uuid = "9fef46b1-cb38-4fda-a166-a6f2395d4c14";
+      try {
+        database.exec("CREATE TABLE events(uuid TEXT,payload TEXT,lease_until INTEGER)");
+        database.prepare("INSERT INTO events VALUES(?,?,0)").run(uuid, JSON.stringify({ uuid, event: "cli.command_completed", properties: { outcome: "success" } }));
+      } finally { database.close(); }
+      const state = await inspectQueue(workspace, new Map([[uuid, "cli.command_completed:success"]]));
+      assert.equal(state.events, 1);
+      assert.deepEqual(state.eventCounts, { "cli.command_completed:success": 1 });
+      assert.deepEqual(state.receivedOrQueuedEventCounts, { "cli.command_completed:success": 1 });
+      assert.equal(JSON.stringify(state).includes(uuid), false);
+    } finally { rmSync(workspace, { recursive: true, force: true }); }
+  });
+
+  it("redirects real HTTPS requests to loopback and leaves no socket after healthy, refused or hanging runs", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-harness-test-"));
+    const ingestion = await startLocalIngestion();
+    try {
+      const fixture = join(workspace, "fixture.mjs");
+      const preload = join(workspace, "preload.mjs");
+      const refused = await startLocalIngestion();
+      const refusedEndpoint = refused.endpoint;
+      await refused.close();
+      for (const source of [requestFixture, fetchFixture]) for (const mode of ["healthy", "refused", "hanging"]) {
+        writeFileSync(fixture, source);
+        writeFileSync(preload, telemetryPreloadSource(mode === "refused" ? refusedEndpoint : ingestion.endpoint));
+        const received = ingestion.begin(mode);
+        const result = await runBoundedProcess({ cli: fixture, args: [], preload, cwd: workspace, env: { ...process.env, NODE_OPTIONS: "" } });
+        assert.equal(result.code, 0);
+        assert.equal(result.signal, null);
+        assert.equal(result.diagnostics.redirected, 1);
+        assert.equal(result.diagnostics.blocked, 0);
+        assert.equal(result.diagnostics.requestErrors, mode === "healthy" ? 0 : 1);
+        assert.equal(received.requests, mode === "refused" ? 0 : 1);
+        assert.equal(received.invalidBodies, 0);
+        assert.equal(await ingestion.finish(), 0);
+      }
+    } finally { await ingestion.close(); rmSync(workspace, { recursive: true, force: true }); }
+  });
+
+  it("fails closed for another destination and rejects non-loopback harness endpoints", async () => {
+    assert.throws(() => telemetryPreloadSource("https://us.i.posthog.com/batch/"), /loopback/u);
+    assert.throws(() => telemetryPreloadSource("http://127.0.0.1:1234/other/"), /loopback/u);
+    const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-harness-test-"));
+    try {
+      const preload = join(workspace, "preload.mjs");
+      const fixture = join(workspace, "fixture.mjs");
+      writeFileSync(preload, telemetryPreloadSource("http://127.0.0.1:1/batch/"));
+      for (const source of [
+        "import {request} from 'node:https'; request('https://example.invalid/');",
+        "import net from 'node:net'; net.connect({host:'203.0.113.1',port:443});",
+        "import {Resolver} from 'node:dns'; new Resolver().resolve4('example.invalid',()=>{});",
+        "import dgram from 'node:dgram'; dgram.createSocket('udp4').send('blocked',1234,'203.0.113.1');",
+      ]) {
+        writeFileSync(fixture, source);
+        await assert.rejects(runBoundedProcess({ cli: fixture, args: [], preload, cwd: workspace, env: { ...process.env, NODE_OPTIONS: "" } }), /unexpected outbound/u);
+      }
+      writeFileSync(fixture, "const response=await fetch('data:application/octet-stream;base64,AGFzbQ==');if((await response.arrayBuffer()).byteLength!==4)process.exitCode=1;");
+      const embedded = await runBoundedProcess({ cli: fixture, args: [], preload, cwd: workspace, env: { ...process.env, NODE_OPTIONS: "" } });
+      assert.equal(embedded.code, 0);
+      assert.equal(embedded.diagnostics.blocked, 0);
+      assert.equal(embedded.diagnostics.redirected, 0);
+    } finally { rmSync(workspace, { recursive: true, force: true }); }
+  });
+
+  it("bounds child lifetime without turning a killed process into a measurement", async () => {
+    const workspace = mkdtempSync(join(tmpdir(), "mex-telemetry-harness-test-"));
+    try {
+      const preload = join(workspace, "preload.mjs");
+      const fixture = join(workspace, "fixture.mjs");
+      writeFileSync(preload, telemetryPreloadSource("http://127.0.0.1:1/batch/"));
+      writeFileSync(fixture, "setInterval(() => {},1000);");
+      await assert.rejects(runBoundedProcess({ cli: fixture, args: [], preload, cwd: workspace, env: { ...process.env, NODE_OPTIONS: "" }, timeoutMs: 150 }), /bounded lifetime/u);
+    } finally { rmSync(workspace, { recursive: true, force: true }); }
+    assert.deepEqual(summarizeSamples([-1, 0, 4, 2]), { samples: [-1, 0, 4, 2], p50: 0, p95: 4, min: -1, max: 4 });
+  });
+});
diff --git a/src/cli-telemetry.ts b/src/cli-telemetry.ts
new file mode 100644
index 00000000..f94aeb7a
--- /dev/null
+++ b/src/cli-telemetry.ts
@@ -0,0 +1,79 @@
+import type { Command } from "commander";
+import { TELEMETRY_COMMANDS, type TelemetryAttributes, type TelemetryEventName, type TelemetryProjectContext } from "./telemetry/schema.js";
+
+/** Only names registered by Commander enter telemetry; argument values never do. */
+export function telemetryCommandPath(command: Command): string {
+  const parts: string[] = [];
+  for (let node: Command | null = command; node?.parent; node = node.parent) parts.unshift(node.name());
+  return parts.join(".") || "mex";
+}
+
+/** Match the command's project selection; option values never enter events. */
+export function telemetryProjectLocation(command: Command, cwd = process.cwd()): { root: string; discovery: "git-root" | "exact" } {
+  const path = telemetryCommandPath(command);
+  if (["graph", "graph.status", "graph.refresh", "graph.rebuild", "graph.repair"].includes(path)) {
+    const root = command.opts().root ?? (path === "graph" ? undefined : command.parent?.opts().root);
+    return { root: typeof root === "string" ? root : cwd, discovery: "exact" };
+  }
+  return { root: cwd, discovery: "git-root" };
+}
+
+export function isTelemetryExemptCommand(commandName: string, parentName?: string, fullPath?: string): boolean {
+  const path = fullPath ?? (parentName && parentName !== "mex" ? `${parentName}.${commandName}` : commandName);
+  return !(TELEMETRY_COMMANDS as readonly string[]).includes(path);
+}
+
+function telemetryStage(command: Command, path: string): TelemetryAttributes["stage"] {
+  const options = command.opts();
+  if (path === "relay.draft.save" && options.from !== undefined) return "direct";
+  if (command.options.some((option) => option.attributeName() === "apply")) {
+    return options.apply === undefined ? "preview" : "apply";
+  }
+  return options.dryRun === true ? "preview" : "direct";
+}
+
+/** One active invocation, completed once even when the action throws. */
+export function createCliTelemetry(
+  capture: (name: TelemetryEventName, attributes: TelemetryAttributes) => void,
+  flush: () => Promise<void>,
+  now: () => number = () => performance.now(),
+  readProjectContext?: (command: Command) => TelemetryProjectContext,
+) {
+  let active: {
+    command: string; stage: TelemetryAttributes["stage"]; started: number;
+    context: TelemetryProjectContext; refreshContext?: () => TelemetryProjectContext;
+  } | undefined;
+  return {
+    start(command: Command): void {
+      try {
+        const path = telemetryCommandPath(command);
+        if (isTelemetryExemptCommand(command.name(), command.parent?.name(), path)) return;
+        const context = (): TelemetryProjectContext => {
+          try { return readProjectContext?.(command) ?? {}; } catch { return {}; }
+        };
+        active = {
+          command: path, stage: telemetryStage(command, path), started: now(), context: context(),
+          // Setup/init may create the first identity and tool selection after
+          // preAction. Ordinary commands reuse one snapshot for both events.
+          ...(["setup", "init"].includes(path) ? { refreshContext: context } : {}),
+        };
+        capture("cli.command_started", { ...active.context, command: active.command, stage: active.stage });
+      } catch { /* Telemetry cannot change command behavior. */ }
+    },
+    async finish(exitCode: string | number | null | undefined): Promise<void> {
+      const invocation = active;
+      active = undefined;
+      if (!invocation) return;
+      try {
+        capture("cli.command_completed", {
+          ...(invocation.refreshContext?.() ?? invocation.context),
+          command: invocation.command,
+          stage: invocation.stage,
+          outcome: exitCode == null || Number(exitCode) === 0 ? "success" : "failure",
+          duration_ms: Math.min(86_400_000, Math.max(0, Math.floor(now() - invocation.started))),
+        });
+        await flush();
+      } catch { /* Preserve the command's result and output if telemetry fails. */ }
+    },
+  };
+}
diff --git a/src/cli.ts b/src/cli.ts
index 4af74bd8..600d0bb9 100644
--- a/src/cli.ts
+++ b/src/cli.ts
@@ -3,11 +3,13 @@ import { Command, InvalidArgumentError } from "commander";
 import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
-import { findConfig, getScaffoldIdentity, readScaffoldId } from "./config.js";
+import { findConfig, getScaffoldIdentity } from "./config.js";
 import { reportConsole, reportQuiet, reportJSON, reportVerbose } from "./reporter.js";
 import { VERSION } from "./version.js";
-import { captureCommand, flush, isEnabled, getPayloadPreview, showFirstRunNotice } from "./telemetry/index.js";
-import { readMachineId, setGlobalConfigKey } from "./global-config.js";
+import { captureEvent, flush, isEnabled, getProjectTelemetryContext, getTelemetryInspection, disableTelemetry, showFirstRunNotice } from "./telemetry/index.js";
+import { setGlobalConfigKey } from "./global-config.js";
+import { createCliTelemetry, telemetryProjectLocation } from "./cli-telemetry.js";
+export { isTelemetryExemptCommand } from "./cli-telemetry.js";
 import { buildLoggingCommand } from "./logging/cli.js";
 import { runFeedback, maybeShowInvite, dismissInvite, enableInvite } from "./feedback/index.js";
 import type { MexConfig } from "./types.js";
@@ -146,30 +148,11 @@ export function createHubRunOptions(
 
 export const program = new Command();
 
-export function isTelemetryExemptCommand(
-  commandName: string,
-  parentName?: string,
-): boolean {
-  return parentName === "telemetry"
-    || parentName === "config"
-    || parentName === "member"
-    || parentName === "activity"
-    || parentName === "workstream"
-    || parentName === "inbox"
-    || actionCommandHasAncestor(parentName, "inbox")
-    || parentName === "relay"
-    || actionCommandHasAncestor(parentName, "relay")
-    || parentName === "spec"
-    || parentName === "skills"
-    || commandName === "hub"
-    || commandName === "logging"
-    || commandName === "timeline"
-    || commandName === "capabilities";
-}
-
 /** Commands whose machine/read-only contract must precede any global notice. */
 export function isFirstRunNoticeExemptCommand(commandName?: string): boolean {
   return commandName === "hub"
+    || commandName === "telemetry"
+    || commandName === "config"
     || commandName === "logging"
     || commandName === "timeline"
     || commandName === "capabilities"
@@ -182,13 +165,6 @@ export function isFirstRunNoticeExemptCommand(commandName?: string): boolean {
     || commandName === "skills";
 }
 
-function actionCommandHasAncestor(parentName: string | undefined, expected: string): boolean {
-  // Commander exposes only the immediate parent here. Inbox and Relay have
-  // nested Team-only groups, so those leaves remain telemetry exempt.
-  return (expected === "inbox" || expected === "relay")
-    && (parentName === "draft" || parentName === "proposal");
-}
-
 async function runTuiCommand(): Promise<void> {
   const { launchTui } = await import("./tui.js");
   launchTui();
@@ -196,43 +172,12 @@ async function runTuiCommand(): Promise<void> {
 
 // ── Telemetry hooks ──
 
-// preAction: fire the event at the START of the command. Two reasons:
-//  - the async request gets the whole command runtime to land in the background
-//  - commands that call process.exit() (e.g. `check` on drift) are still
-//    counted; a postAction hook would never run after process.exit and would
-//    systematically miss every error/drift outcome.
-// scaffold_id is resolved read-only (never mints). Telemetry never throws here.
-program.hook("preAction", (_thisCommand, actionCommand) => {
-  try {
-    // Never count the telemetry/config meta-commands. In particular,
-    // `telemetry inspect` must have zero side effects — no event sent, no
-    // machine-id file created — so it stays a pure audit surface.
-    const parentName = actionCommand.parent?.name();
-    if (isTelemetryExemptCommand(actionCommand.name(), parentName)) return;
-
-    let scaffoldId: string | undefined;
-    try {
-      scaffoldId = readScaffoldId(findConfig().scaffoldRoot);
-    } catch {
-      // No scaffold (or not in one) — omit scaffold_id.
-    }
-    captureCommand(actionCommand.name(), scaffoldId);
-  } catch {
-    // Telemetry must never affect command behaviour.
-  }
-});
-
-// postAction: best-effort bounded flush for commands that exit naturally.
-// Commands that process.exit() skip this, but their event was already sent
-// from preAction (flushAt:1 fires the request immediately).
-program.hook("postAction", async (_thisCommand, actionCommand) => {
-  if (isTelemetryExemptCommand(actionCommand.name(), actionCommand.parent?.name())) return;
-  try {
-    await flush();
-  } catch {
-    // Telemetry must never affect command behaviour.
-  }
+const cliTelemetry = createCliTelemetry(captureEvent, flush, undefined, (command) => {
+  const { root, discovery } = telemetryProjectLocation(command);
+  return getProjectTelemetryContext(root, discovery);
 });
+program.hook("preAction", (_thisCommand, actionCommand) => cliTelemetry.start(actionCommand));
+program.hook("postAction", () => cliTelemetry.finish(process.exitCode));
 
 program
   .name("mex")
@@ -362,7 +307,8 @@ program
       await runSetup({ dryRun: opts.dryRun, mode: opts.mode });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -466,14 +412,18 @@ program
         return;
       }
 
-      if (hasErrors) process.exit(1);
+      if (hasErrors) {
+        process.exitCode = 1;
+        return;
+      }
 
       // Warm moment — a clean check just gave the user value. Quietly invite
       // feedback (only on success, never right before an error exit).
       maybeShowInvite();
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -495,7 +445,8 @@ program
       }
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -511,7 +462,8 @@ const graphCommand = program
       await runGraph({ root: opts.root, json: opts.json });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -529,7 +481,8 @@ graphCommand
       });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -547,7 +500,8 @@ graphCommand
       });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -565,7 +519,8 @@ graphCommand
       });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -884,7 +839,8 @@ graphCommand
       });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -899,7 +855,8 @@ graphCommand
       await runGraphGround(config, opts);
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -930,7 +887,8 @@ program
       await runLog(config, message, { kind: opts.type, files: opts.file, source: opts.source, status: opts.status });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -962,7 +920,8 @@ program
       });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -977,7 +936,8 @@ program
       await runHeartbeat(config, { json: opts.json });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -991,7 +951,8 @@ program
       await runDoctor(config);
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1009,7 +970,8 @@ program
       maybeShowInvite();
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1028,7 +990,8 @@ patternCmd
       await runPatternAdd(config, name);
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1050,7 +1013,8 @@ program
       await manageHook(config, { uninstall: opts.uninstall, intervalMinutes });
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1062,7 +1026,8 @@ program
       console.log(buildCompletion(shell));
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1090,7 +1055,9 @@ function describeTelemetryReason(reason: string | undefined): string {
     case "dev":
       return "This is a mex development checkout; telemetry never runs from one.";
     case "config":
-      return "Stored in ~/.mex/config.json. Re-enable with `mex telemetry enable`.";
+      return "A stored global preference or opt-out marker disables telemetry. Re-enable with `mex telemetry enable`.";
+    case "config_unavailable":
+      return "The existing global preference file is unreadable, malformed, or unsafe. Telemetry stays off until that file is repaired.";
     default:
       return "";
   }
@@ -1106,12 +1073,19 @@ function describeTelemetryReason(reason: string | undefined): string {
  * anyone looks for it. An alias costs nothing; a user who cannot find the
  * opt-out costs trust.
  */
+function disableTelemetryWithNotice(): void {
+  const result = disableTelemetry();
+  if (!result.purged) console.log("Telemetry is off; the local queue could not be cleared because it is busy or unavailable.");
+}
+
 function setTelemetryEnabled(enabled: boolean): void {
   try {
-    setGlobalConfigKey("telemetry", enabled ? "on" : "off");
+    if (enabled) setGlobalConfigKey("telemetry", "on");
+    else disableTelemetryWithNotice();
   } catch (err) {
     console.error((err as Error).message);
-    process.exit(1);
+    process.exitCode = 1;
+    return;
   }
   console.log(`Telemetry ${enabled ? "enabled" : "disabled"} in ~/.mex/config.json`);
 
@@ -1140,25 +1114,14 @@ telemetryCmd
 
 telemetryCmd
   .command("inspect")
-  .description("Print the exact JSON payload that would be sent (without sending it)")
+  .description("Inspect event examples, privacy fields, and local queue limits (without sending)")
   .action(() => {
     try {
-      // Read-only: use readScaffoldId (never mints), not getScaffoldIdentity
-      let scaffoldId: string | undefined;
-      try {
-        const config = findConfig();
-        scaffoldId = readScaffoldId(config.scaffoldRoot);
-      } catch { /* no scaffold — omit scaffold_id */ }
-
-      // Read-only: show the machine_id only if it already exists. Auditing the
-      // payload must never plant the tracking file on disk.
-      const machineId = readMachineId();
-
-      const payload = getPayloadPreview("inspect", scaffoldId, machineId);
-      console.log(JSON.stringify(payload, null, 2));
+      console.log(JSON.stringify(getTelemetryInspection(), null, 2));
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1190,14 +1153,17 @@ configCmd
       if (key === "telemetry") {
         if (value !== "on" && value !== "off") {
           console.error(`Invalid value "${value}" for telemetry. Use "on" or "off".`);
-          process.exit(1);
+          process.exitCode = 1;
+          return;
         }
-        setGlobalConfigKey("telemetry", value);
+        if (value === "off") disableTelemetryWithNotice();
+        else setGlobalConfigKey("telemetry", "on");
         console.log(`Telemetry set to "${value}" in ~/.mex/config.json`);
       } else if (key === "feedback") {
         if (value !== "on" && value !== "off") {
           console.error(`Invalid value "${value}" for feedback. Use "on" or "off".`);
-          process.exit(1);
+          process.exitCode = 1;
+          return;
         }
         // "off" hides the invite; "on" re-enables it.
         if (value === "off") dismissInvite();
@@ -1205,11 +1171,13 @@ configCmd
         console.log(`Feedback invite ${value === "off" ? "hidden" : "re-enabled"}.`);
       } else {
         console.error(`Unknown config key "${key}". Supported keys: telemetry, feedback`);
-        process.exit(1);
+        process.exitCode = 1;
+        return;
       }
     } catch (err) {
       console.error((err as Error).message);
-      process.exit(1);
+      process.exitCode = 1;
+      return;
     }
   });
 
@@ -1275,7 +1243,7 @@ program
     console.log("  mex watch --interval   Run heartbeat every 30 minutes (or config value)");
     console.log("  mex watch --uninstall  Remove the post-commit hook");
     console.log("  mex telemetry disable  Turn telemetry off (or DO_NOT_TRACK=1 / MEX_TELEMETRY=0)");
-    console.log("  mex telemetry inspect  Show the exact telemetry payload (without sending)");
+    console.log("  mex telemetry inspect  Inspect telemetry events and queue (without sending)");
     console.log("  mex telemetry status   Show telemetry enabled/disabled and reason");
     console.log("  mex config set <k> <v> Set a global config value (e.g. telemetry off)");
     console.log("  mex feedback           Open the feedback form (the maintainer does user calls)");
@@ -1326,7 +1294,7 @@ if (isMainModule) {
       }
       console.error(err.message);
       process.exitCode = 1;
-    });
+    }).finally(() => cliTelemetry.finish(process.exitCode));
   }
 }
 
diff --git a/src/feedback/index.ts b/src/feedback/index.ts
index 96756304..8d70297c 100644
--- a/src/feedback/index.ts
+++ b/src/feedback/index.ts
@@ -13,7 +13,7 @@ import { platform } from "node:os";
 import { readGlobalConfig, setGlobalConfigKey } from "../global-config.js";
 
 /** Hosted form the maintainer uses for user-research sign-ups. */
-export const FEEDBACK_FORM_URL = "https://tally.so/r/KYGGbK";
+export const FEEDBACK_FORM_URL = "https://tally.so/r/KYjv4k";
 
 /** One-line nudge surfaced at warm moments. Points at the command, never asks for data. */
 export const INVITE_TEXT =
diff --git a/src/global-config.ts b/src/global-config.ts
index bb365659..3e52c378 100644
--- a/src/global-config.ts
+++ b/src/global-config.ts
@@ -1,13 +1,13 @@
 /**
  * Global (per-machine) config under `~/.mex/`.
  *
- * Owns: `~/.mex/telemetry-id` (machine UUID) and `~/.mex/config.json`
- * (global preferences like telemetry opt-out).
+ * Owns: `~/.mex/telemetry-id` (installation UUID), `~/.mex/config.json`
+ * (global preferences), and the durable `~/.mex/telemetry-disabled` opt-out.
  *
  * Completely separate from the per-scaffold config in `src/config.ts`.
  */
 
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, lstatSync, openSync, closeSync, fstatSync, readSync, renameSync, unlinkSync, constants } from "node:fs";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { homedir } from "node:os";
@@ -16,6 +16,7 @@ import { homedir } from "node:os";
 
 const MEX_HOME_DIR_NAME = ".mex";
 const TELEMETRY_ID_FILE = "telemetry-id";
+const TELEMETRY_DISABLED_FILE = "telemetry-disabled";
 const GLOBAL_CONFIG_FILE = "config.json";
 
 /**
@@ -36,8 +37,15 @@ export function mexHomeDir(): string {
 export function ensureMexHomeDir(): void {
   const dir = mexHomeDir();
   if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
   }
+  const stat = lstatSync(dir);
+  if (!stat.isDirectory() || stat.isSymbolicLink()) throw new Error("Unsafe MEX preference directory");
+}
+
+/** Installation IDs are generated UUIDs, never caller-supplied names or paths. */
+export function isTelemetryId(value: unknown): value is string {
+  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
 }
 
 // ── Machine ID ──
@@ -51,8 +59,18 @@ export function readMachineId(): string | undefined {
   const filePath = join(mexHomeDir(), TELEMETRY_ID_FILE);
   if (!existsSync(filePath)) return undefined;
   try {
-    const existing = readFileSync(filePath, "utf-8").trim();
-    return existing.length > 0 ? existing : undefined;
+    const parent = lstatSync(mexHomeDir());
+    if (!parent.isDirectory() || parent.isSymbolicLink()) return undefined;
+    const before = lstatSync(filePath, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.size > 64n) return undefined;
+    const fd = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+      const opened = fstatSync(fd, { bigint: true });
+      if (before.dev !== opened.dev || before.ino !== opened.ino || opened.size > 64n) return undefined;
+      const bytes = Buffer.alloc(64);
+      const existing = bytes.subarray(0, readSync(fd, bytes, 0, bytes.length, 0)).toString("utf8").trim();
+      return isTelemetryId(existing) ? existing : undefined;
+    } finally { closeSync(fd); }
   } catch {
     return undefined;
   }
@@ -62,7 +80,7 @@ export function readMachineId(): string | undefined {
  * Read or create `~/.mex/telemetry-id`. Mode `0600` so only the owner can read.
  *
  * **Caller must guarantee telemetry is enabled before calling.** When disabled,
- * this file must not exist.
+ * telemetry must not create this file while disabled (an existing ID may remain).
  */
 export function getMachineId(): string {
   const existing = readMachineId();
@@ -70,8 +88,16 @@ export function getMachineId(): string {
 
   ensureMexHomeDir();
   const id = randomUUID();
-  writeFileSync(join(mexHomeDir(), TELEMETRY_ID_FILE), id + "\n", { mode: 0o600 });
-  return id;
+  // Exclusive creation means two first invocations cannot replace one
+  // another's identity. A partial/invalid file is left alone and capture drops.
+  try {
+    writeFileSync(join(mexHomeDir(), TELEMETRY_ID_FILE), id + "\n", { mode: 0o600, flag: "wx" });
+    return id;
+  } catch {
+    const concurrent = readMachineId();
+    if (concurrent) return concurrent;
+    throw new Error("Telemetry identity unavailable");
+  }
 }
 
 // ── Global config ──
@@ -84,31 +110,114 @@ interface GlobalConfig {
   [key: string]: unknown;
 }
 
-/**
- * Read `~/.mex/config.json`. Returns `{}` if missing or malformed — tolerant
- * parse matching the style of `loadPersistedConfig` in `src/config.ts`.
- */
-export function readGlobalConfig(): GlobalConfig {
+const MAX_GLOBAL_CONFIG_BYTES = 64 * 1024;
+
+function globalConfigResult(): { config: GlobalConfig; available: boolean } {
   const filePath = join(mexHomeDir(), GLOBAL_CONFIG_FILE);
-  if (!existsSync(filePath)) return {};
   try {
-    const raw = JSON.parse(readFileSync(filePath, "utf-8"));
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {};
-    return raw as GlobalConfig;
-  } catch {
-    return {};
+    const parent = lstatSync(mexHomeDir());
+    if (!parent.isDirectory() || parent.isSymbolicLink()) throw new Error("Unsafe preference directory");
+    const before = lstatSync(filePath, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.size > MAX_GLOBAL_CONFIG_BYTES) throw new Error("Unsafe preference file");
+    const fd = openSync(filePath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+      const opened = fstatSync(fd, { bigint: true });
+      if (before.dev !== opened.dev || before.ino !== opened.ino || opened.size > MAX_GLOBAL_CONFIG_BYTES) throw new Error("Preference file changed");
+      const bytes = Buffer.alloc(Number(opened.size) + 1);
+      const length = readSync(fd, bytes, 0, bytes.length, 0);
+      const after = fstatSync(fd, { bigint: true });
+      if (BigInt(length) !== opened.size || after.size !== opened.size || after.mtimeNs !== opened.mtimeNs) throw new Error("Preference file changed");
+      const raw: unknown = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length)));
+      if (typeof raw !== "object" || raw === null || Array.isArray(raw)) throw new Error("Invalid preference object");
+      return { config: raw as GlobalConfig, available: true };
+    } finally { closeSync(fd); }
+  } catch (error) {
+    return { config: {}, available: (error as NodeJS.ErrnoException).code === "ENOENT" };
   }
 }
 
+/** Feedback callers retain their tolerant empty-config fallback. */
+export function readGlobalConfig(): GlobalConfig { return globalConfigResult().config; }
+
+/** Missing preferences use the documented default; unreadable existing ones fail closed. */
+export function readTelemetryPreference(): "on" | "off" | "unavailable" {
+  // Every existing marker fails closed, including a malformed file or link.
+  // Unrelated config writers cannot erase this independent opt-out.
+  try { lstatSync(join(mexHomeDir(), TELEMETRY_DISABLED_FILE)); return "off"; }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") return "unavailable"; }
+  const result = globalConfigResult();
+  if (!result.available) return "unavailable";
+  if (result.config.telemetry === undefined || result.config.telemetry === "on") return "on";
+  return result.config.telemetry === "off" ? "off" : "unavailable";
+}
+
+interface DisabledMarker { dev: bigint; ino: bigint; }
+function inspectDisabledMarker(): DisabledMarker | undefined {
+  try {
+    const marker = lstatSync(join(mexHomeDir(), TELEMETRY_DISABLED_FILE), { bigint: true });
+    if (!marker.isFile() || marker.isSymbolicLink() || marker.nlink !== 1n || marker.size !== 0n) throw new Error("Unsafe MEX telemetry opt-out marker");
+    return { dev: marker.dev, ino: marker.ino };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+
+function createDisabledMarker(): void {
+  try { closeSync(openSync(join(mexHomeDir(), TELEMETRY_DISABLED_FILE), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
+  // Repeated disable leaves the same marker intact. No caller follows a link.
+  if (!inspectDisabledMarker()) throw new Error("MEX telemetry opt-out marker changed");
+}
+
+function removeDisabledMarker(expected: DisabledMarker | undefined): void {
+  const current = inspectDisabledMarker();
+  if (!current) return;
+  if (!expected || expected.dev !== current.dev || expected.ino !== current.ino) throw new Error("MEX telemetry opt-out changed while enabling; it remains disabled");
+  unlinkSync(join(mexHomeDir(), TELEMETRY_DISABLED_FILE));
+}
+
 /**
  * Set a single key in `~/.mex/config.json`, preserving all other keys.
  */
 export function setGlobalConfigKey(key: string, value: unknown): void {
   ensureMexHomeDir();
+  // Only explicit telemetry preference changes own this marker. Create it first
+  // on disable; remove it only after an explicit enable's JSON write succeeds.
+  // This survives an unrelated process publishing an older merged config later.
+  if (key === "telemetry" && value === "off") createDisabledMarker();
+  const enabling = key === "telemetry" && value === "on";
+  const disabledMarker = enabling ? inspectDisabledMarker() : undefined;
   const filePath = join(mexHomeDir(), GLOBAL_CONFIG_FILE);
   const existing = readGlobalConfig();
   existing[key] = value;
-  writeFileSync(filePath, JSON.stringify(existing, null, 2) + "\n");
+  const serialized = JSON.stringify(existing, null, 2) + "\n";
+  if (Buffer.byteLength(serialized) > MAX_GLOBAL_CONFIG_BYTES) throw new Error("MEX preference file exceeds its limit");
+  const parent = lstatSync(mexHomeDir(), { bigint: true });
+  const temp = join(mexHomeDir(), `.config-${randomUUID()}.tmp`);
+  let owned: { dev: bigint; ino: bigint } | undefined;
+  try {
+    // Refuse links rather than following an existing config into another file.
+    try {
+      const target = lstatSync(filePath, { bigint: true });
+      if (!target.isFile() || target.isSymbolicLink() || target.nlink !== 1n || target.size > MAX_GLOBAL_CONFIG_BYTES) throw new Error("Unsafe MEX preference file");
+    } catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+    writeFileSync(temp, serialized, { flag: "wx", mode: 0o600 });
+    owned = lstatSync(temp, { bigint: true });
+    const current = lstatSync(mexHomeDir(), { bigint: true });
+    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== parent.dev || current.ino !== parent.ino) throw new Error("MEX preference directory changed");
+    // Atomic replacement avoids a partially written opt-out being read as a
+    // default-on configuration. Rename replaces a leaf link without following it.
+    renameSync(temp, filePath);
+    if (enabling) removeDisabledMarker(disabledMarker);
+  } finally {
+    if (owned) {
+      try {
+        const current = lstatSync(temp, { bigint: true });
+        if (current.dev === owned.dev && current.ino === owned.ino) unlinkSync(temp);
+      } catch { /* Already renamed or independently removed. */ }
+    }
+  }
 }
 
 // ── Dev-repo guard ──
diff --git a/src/hub/__tests__/command-telemetry.test.ts b/src/hub/__tests__/command-telemetry.test.ts
new file mode 100644
index 00000000..cb28899c
--- /dev/null
+++ b/src/hub/__tests__/command-telemetry.test.ts
@@ -0,0 +1,75 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  events: vi.fn(), createCapture: vi.fn(), startTelemetry: vi.fn(), stopTelemetry: vi.fn(async () => undefined),
+  startServer: vi.fn(), closeServer: vi.fn(async () => undefined),
+  createApp: vi.fn(), initializeJobs: vi.fn(), shutdownJobs: vi.fn(async () => undefined),
+  jobOptions: vi.fn(), order: [] as string[],
+}));
+vi.mock("../../telemetry/index.js", () => ({ createProjectTelemetryCapture: mocks.createCapture, startHubTelemetry: mocks.startTelemetry }));
+vi.mock("../static/assets.js", () => ({ HubAssetManifest: class {} }));
+vi.mock("../security/session.js", () => ({ createBootstrapToken: () => "private-bootstrap-token", HubSessionManager: class {} }));
+vi.mock("../app.js", () => ({ createHubApp: mocks.createApp }));
+vi.mock("../jobs/index.js", () => ({ HubJobManager: class {
+  constructor(options: unknown) { mocks.jobOptions(options); }
+  initialize = mocks.initializeJobs;
+  shutdown = mocks.shutdownJobs;
+} }));
+vi.mock("../jobs/graph.js", () => ({ createGraphJobExecutors: () => ({}) }));
+vi.mock("../jobs/wiki.js", () => ({ createWikiJobExecutors: () => ({}) }));
+vi.mock("../node-server.js", () => ({ startHubNodeServer: mocks.startServer }));
+vi.mock("../services.js", () => ({ createLocalHubReadServices: () => ({}) }));
+vi.mock("../../team/local-state/index.js", () => ({ TeamLocalState: class {} }));
+vi.mock("../../graph/application-adapter.js", () => ({ createRepositoryGraphPort: () => ({}) }));
+vi.mock("../../wiki/application-adapter.js", () => ({ createRepositoryWikiPort: () => ({}) }));
+vi.mock("../../team/workflow/repository-team-workflow-port.js", () => ({
+  createRepositoryTeamWorkflowPort: async () => ({ initializeIdentityActivitySigner() {} }),
+}));
+vi.mock("../../team/specs/index.js", () => ({ createSpecReadService: () => ({}) }));
+
+import { runHubCommand } from "../command.js";
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  mocks.order.length = 0;
+  mocks.closeServer.mockImplementation(async () => { mocks.order.push("http"); });
+  mocks.shutdownJobs.mockImplementation(async () => { mocks.order.push("jobs"); });
+  mocks.stopTelemetry.mockImplementation(async () => { mocks.order.push("telemetry"); });
+  mocks.startTelemetry.mockReturnValue(mocks.stopTelemetry);
+  mocks.createCapture.mockReturnValue(mocks.events);
+  vi.spyOn(process.stdout, "write").mockReturnValue(true);
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe("Hub production telemetry lifecycle", () => {
+  it("starts one session only after readiness and stops after HTTP intake and jobs", async () => {
+    let ready!: (server: { origin: string; close: typeof mocks.closeServer }) => void;
+    mocks.startServer.mockReturnValue(new Promise(resolve => { ready = resolve; }));
+    const priorListeners = new Set(process.listeners("SIGTERM"));
+    const running = runHubCommand({ projectRoot: "/Users/private/project", scaffoldId: "private-scaffold", openBrowser: false });
+    await vi.waitFor(() => expect(mocks.startServer).toHaveBeenCalledOnce());
+    expect(mocks.events).not.toHaveBeenCalled();
+    expect(mocks.createCapture).toHaveBeenCalledWith("/Users/private/project");
+    expect(mocks.startTelemetry).not.toHaveBeenCalled();
+    ready({ origin: "http://127.0.0.1:48123", close: mocks.closeServer });
+    await vi.waitFor(() => expect(mocks.events).toHaveBeenCalledOnce());
+    const stop = process.listeners("SIGTERM").find(listener => !priorListeners.has(listener));
+    if (!stop) throw new Error("Hub did not install its shutdown handler.");
+    stop("SIGTERM");
+    await running;
+    expect(mocks.events.mock.calls).toEqual([["hub.session_started", {}]]);
+    expect(mocks.startTelemetry).toHaveBeenCalledOnce();
+    expect(mocks.order).toEqual(["http", "jobs", "telemetry"]);
+    expect(mocks.createApp).toHaveBeenCalledWith(expect.objectContaining({ telemetry: mocks.events }));
+    expect(mocks.jobOptions).toHaveBeenCalledWith(expect.objectContaining({ telemetry: mocks.events }));
+    expect(process.listeners("SIGTERM").filter(listener => !priorListeners.has(listener))).toEqual([]);
+  });
+
+  it("does not count a failed listener startup as a Hub session", async () => {
+    mocks.startServer.mockRejectedValue(new Error("listener failed"));
+    await expect(runHubCommand({ projectRoot: "/private", scaffoldId: "private", openBrowser: false })).rejects.toThrow("listener failed");
+    expect(mocks.events).not.toHaveBeenCalled();
+    expect(mocks.startTelemetry).not.toHaveBeenCalled();
+    expect(mocks.shutdownJobs).toHaveBeenCalledOnce();
+  });
+});
diff --git a/src/hub/__tests__/telemetry.test.ts b/src/hub/__tests__/telemetry.test.ts
new file mode 100644
index 00000000..52df03d8
--- /dev/null
+++ b/src/hub/__tests__/telemetry.test.ts
@@ -0,0 +1,69 @@
+import { mkdtempSync, readdirSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { describe, expect, it, vi } from "vitest";
+import { boundedHubDuration, HubTelemetry } from "../telemetry.js";
+import { captureEvent } from "../../telemetry/index.js";
+
+describe("Hub telemetry projection", () => {
+  it("bounds page events with one counter and resumes in the next minute", () => {
+    const sink = vi.fn();
+    let now = 100_000;
+    const telemetry = new HubTelemetry(sink, () => now);
+    for (let i = 0; i < 100; i += 1) telemetry.pageViewed("knowledge");
+    expect(sink).toHaveBeenCalledTimes(60);
+    expect(sink.mock.calls.every(([name, attributes]) => name === "hub.page_viewed"
+      && JSON.stringify(attributes) === '{"page":"knowledge"}')).toBe(true);
+    now += 60_000;
+    telemetry.pageViewed("relays");
+    expect(sink).toHaveBeenCalledTimes(61);
+  });
+
+  it("records safe outcome metadata without changing results or propagating delivery errors", async () => {
+    const sink = vi.fn(() => { throw new Error("delivery failed"); });
+    let now = 500;
+    const telemetry = new HubTelemetry(sink, () => now);
+    const result = { privatePath: "/Users/private/project", idempotentReplay: true };
+    await expect(telemetry.action("member.select", "apply", () => {
+      now = 12;
+      return result;
+    }, value => value.idempotentReplay)).resolves.toBe(result);
+    expect(sink).toHaveBeenLastCalledWith("hub.action_completed", {
+      action: "member.select", stage: "apply", outcome: "success", duration_ms: 0, replayed: true,
+    });
+    const failure = new Error("private@example.test /Users/private/source.ts");
+    await expect(telemetry.action("relay.publish", "apply", () => { throw failure; })).rejects.toBe(failure);
+    expect(sink).toHaveBeenLastCalledWith("hub.action_completed", {
+      action: "relay.publish", stage: "apply", outcome: "failure", duration_ms: 0,
+    });
+    expect(JSON.stringify(sink.mock.calls)).not.toContain("private");
+  });
+
+  it("has no delivery or clock side effects when embedded without a sink", async () => {
+    const now = vi.fn();
+    const telemetry = new HubTelemetry(undefined, now);
+    telemetry.pageViewed("home");
+    await expect(telemetry.action("job.start", "direct", () => 42)).resolves.toBe(42);
+    expect(now).not.toHaveBeenCalled();
+  });
+
+  it("keeps the production sink non-persisting for an opted-out Hub", async () => {
+    const directory = mkdtempSync(join(tmpdir(), "mex-hub-telemetry-optout-"));
+    vi.stubEnv("MEX_HOME", directory);
+    vi.stubEnv("MEX_TELEMETRY", "0");
+    try {
+      const telemetry = new HubTelemetry(captureEvent);
+      telemetry.pageViewed("home");
+      await expect(telemetry.action("settings.logging.update", "direct", () => "done")).resolves.toBe("done");
+      expect(readdirSync(directory)).toEqual([]);
+    } finally {
+      vi.unstubAllEnvs();
+      rmSync(directory, { recursive: true, force: true });
+    }
+  });
+
+  it("clamps durations to finite nonnegative whole milliseconds", () => {
+    expect([NaN, Infinity, -Infinity, -100, 12.7, 1e15].map(boundedHubDuration))
+      .toEqual([0, 0, 0, 0, 13, 86_400_000]);
+  });
+});
diff --git a/src/hub/app.ts b/src/hub/app.ts
index d6c9eb5a..5b9d0391 100644
--- a/src/hub/app.ts
+++ b/src/hub/app.ts
@@ -151,6 +151,7 @@ import {
   validationFailed,
 } from "./http/errors.js";
 import { readBoundedJson, readStrictQuery } from "./http/request.js";
+import { HUB_PAGE_EVENT_BODY_BYTES, HubPageViewSchema, HubTelemetry, type HubTelemetrySink } from "./telemetry.js";
 import {
   type HubSession,
   HubSessionManager,
@@ -283,12 +284,14 @@ export interface CreateHubAppOptions {
   readonly assets?: HubAssetManifest;
   readonly requestId?: () => string;
   readonly now?: () => number;
+  readonly telemetry?: HubTelemetrySink;
 }
 
 export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment> {
   const app = new Hono<HubEnvironment>();
   const requestId = options.requestId ?? createRequestId;
   const now = options.now ?? Date.now;
+  const telemetry = new HubTelemetry(options.telemetry, now);
   const subscribers = new SseSubscriberTracker();
 
   app.onError((error, context) => {
@@ -366,6 +369,15 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     },
   ));
 
+  app.post("/api/v1/telemetry/page", async (context) => {
+    readStrictQuery(context.req.raw, []);
+    const request = parseInput(HubPageViewSchema, await readBoundedJson(context.req.raw, HUB_PAGE_EVENT_BODY_BYTES));
+    telemetry.pageViewed(request.page);
+    // Accepted locally is not a delivery promise. Opt-out and rate-limited
+    // events take the same quiet path without queuing or persisting anything.
+    return new Response(null, { status: 204 });
+  });
+
   app.get("/api/v1/capabilities", async () => resourceResponse(
     HubCapabilitiesSchema,
     await options.services.capabilities(),
@@ -479,7 +491,8 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     );
     const preview = options.services.previewInboxOperation;
     if (preview === undefined) throw unavailable("Inbox mutations are not connected in this build.");
-    return resourceResponse(InboxOperationPreviewResponseSchema, await preview(request));
+    return telemetry.action(request.action.kind, "preview", async () =>
+      resourceResponse(InboxOperationPreviewResponseSchema, await preview(request)));
   });
 
   app.post("/api/v1/inbox/operations/apply", async (context) => {
@@ -489,7 +502,11 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     );
     const apply = options.services.applyInboxOperation;
     if (apply === undefined) throw unavailable("Inbox mutations are not connected in this build.");
-    return resourceResponse(InboxOperationApplyResponseSchema, await apply(request));
+    const completed = await telemetry.action(request.request.action.kind, "apply", async () => {
+      const result = await apply(request);
+      return { result, response: resourceResponse(InboxOperationApplyResponseSchema, result) };
+    }, ({ result }) => result.idempotentReplay);
+    return completed.response;
   });
 
   app.get("/api/v1/relays/drafts", async (context) => {
@@ -536,7 +553,8 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     );
     const preview = options.services.previewRelayOperation;
     if (preview === undefined) throw unavailable("Relay mutations are not connected in this build.");
-    return resourceResponse(RelayOperationPreviewResponseSchema, await preview(request));
+    return telemetry.action(request.action.kind, "preview", async () =>
+      resourceResponse(RelayOperationPreviewResponseSchema, await preview(request)));
   });
 
   app.post("/api/v1/relays/operations/apply", async (context) => {
@@ -546,7 +564,11 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     );
     const apply = options.services.applyRelayOperation;
     if (apply === undefined) throw unavailable("Relay mutations are not connected in this build.");
-    return resourceResponse(RelayOperationApplyResponseSchema, await apply(request));
+    const completed = await telemetry.action(request.request.action.kind, "apply", async () => {
+      const result = await apply(request);
+      return { result, response: resourceResponse(RelayOperationApplyResponseSchema, result) };
+    }, ({ result }) => result.idempotentReplay);
+    return completed.response;
   });
 
   app.get("/api/v1/specs", async (context) => {
@@ -585,7 +607,8 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     if (preview === undefined) {
       throw unavailable("Member and Activity mutations are not connected in this build.");
     }
-    return resourceResponse(TeamOperationPreviewResponseSchema, await preview(request));
+    return telemetry.action(request.action.kind, "preview", async () =>
+      resourceResponse(TeamOperationPreviewResponseSchema, await preview(request)));
   });
 
   app.post("/api/v1/team/operations/apply", async (context) => {
@@ -597,7 +620,11 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     if (apply === undefined) {
       throw unavailable("Member and Activity mutations are not connected in this build.");
     }
-    return resourceResponse(TeamOperationApplyResponseSchema, await apply(request));
+    const completed = await telemetry.action(request.request.action.kind, "apply", async () => {
+      const result = await apply(request);
+      return { result, response: resourceResponse(TeamOperationApplyResponseSchema, result) };
+    }, ({ result }) => result.idempotentReplay);
+    return completed.response;
   });
 
   app.get("/api/v1/activity", async (context) => {
@@ -725,7 +752,8 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     readStrictQuery(context.req.raw, []);
     if (!options.services.setLoggingPolicy) throw unavailable("Agent logging preferences are unavailable in this build.");
     const request = parseInput(AgentLoggingUpdateRequestSchema, await readBoundedJson(context.req.raw));
-    return resourceResponse(AgentLoggingPolicySchema, await options.services.setLoggingPolicy(request));
+    return telemetry.action("settings.logging.update", "direct", async () =>
+      resourceResponse(AgentLoggingPolicySchema, await options.services.setLoggingPolicy!(request)));
   });
 
   app.get("/api/v1/health", async () => resourceResponse(
@@ -752,8 +780,10 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
       JobStartRequestSchema,
       await readBoundedJson(context.req.raw),
     );
-    await options.services.assertJobStartAllowed?.(request.kind);
-    return resourceResponse(HubJobSnapshotSchema, await jobs.start(request), 202);
+    return telemetry.action("job.start", "direct", async () => {
+      await options.services.assertJobStartAllowed?.(request.kind);
+      return resourceResponse(HubJobSnapshotSchema, await jobs.start(request), 202);
+    });
   });
 
   app.get("/api/v1/jobs/:id", async (context) => {
@@ -768,7 +798,8 @@ export function createHubApp(options: CreateHubAppOptions): Hono<HubEnvironment>
     const jobs = requireJobs(options.jobs);
     const id = parseJobId(context.req.param("id"));
     parseInput(JobCancelRequestSchema, await readBoundedJson(context.req.raw));
-    return resourceResponse(HubJobSnapshotSchema, await jobs.cancel(id));
+    return telemetry.action("job.cancel", "direct", async () =>
+      resourceResponse(HubJobSnapshotSchema, await jobs.cancel(id)));
   });
 
   app.get("/api/v1/jobs/:id/events", async (context) => {
diff --git a/src/hub/command.ts b/src/hub/command.ts
index 4e91d591..16e87c82 100644
--- a/src/hub/command.ts
+++ b/src/hub/command.ts
@@ -12,6 +12,8 @@ import { createRepositoryGraphPort } from "../graph/application-adapter.js";
 import { createRepositoryWikiPort } from "../wiki/application-adapter.js";
 import { createRepositoryTeamWorkflowPort } from "../team/workflow/repository-team-workflow-port.js";
 import { createSpecReadService } from "../team/specs/index.js";
+import { createProjectTelemetryCapture, startHubTelemetry } from "../telemetry/index.js";
+import { emitHubTelemetry } from "./telemetry.js";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -29,6 +31,7 @@ export interface RunHubCommandOptions {
  * boundary for local schema migration and interrupted-job reconciliation.
  */
 export async function runHubCommand(options: RunHubCommandOptions): Promise<void> {
+  const captureEvent = createProjectTelemetryCapture(options.projectRoot);
   // Bind and verify the tracked scaffold identity before the explicit Hub
   // startup boundary creates or migrates any local state.
   const team = await createRepositoryTeamWorkflowPort(options.projectRoot);
@@ -49,9 +52,11 @@ export async function runHubCommand(options: RunHubCommandOptions): Promise<void
       ...createWikiJobExecutors(wiki),
     },
     shutdownTimeoutMs: 60_000,
+    telemetry: captureEvent,
   });
   jobs.initialize();
   let server: Awaited<ReturnType<typeof startHubNodeServer>> | undefined;
+  let stopTelemetry: (() => Promise<void>) | undefined;
   try {
     const bootstrapToken = createBootstrapToken();
     let expectedOrigin: string | null = null;
@@ -73,10 +78,12 @@ export async function runHubCommand(options: RunHubCommandOptions): Promise<void
       wiki,
     });
     const assets = new HubAssetManifest(resolveHubAssetRoot());
-    const app = createHubApp({ security, services, jobs, assets });
+    const app = createHubApp({ security, services, jobs, assets, telemetry: captureEvent });
 
     server = await startHubNodeServer({ app, port: options.port });
     expectedOrigin = server.origin;
+    stopTelemetry = startHubTelemetry();
+    emitHubTelemetry(captureEvent, "hub.session_started", {});
     const bootstrapUrl = `${server.origin}/#token=${encodeURIComponent(bootstrapToken)}`;
 
     process.stdout.write(`\nProject Hub running at ${server.origin}\n`);
@@ -89,7 +96,11 @@ export async function runHubCommand(options: RunHubCommandOptions): Promise<void
     try {
       await server?.close();
     } finally {
-      await jobs.shutdown();
+      try {
+        await jobs.shutdown();
+      } finally {
+        await stopTelemetry?.();
+      }
     }
   }
 }
diff --git a/src/hub/http/__tests__/app.test.ts b/src/hub/http/__tests__/app.test.ts
index 203a58fa..c4eb61f0 100644
--- a/src/hub/http/__tests__/app.test.ts
+++ b/src/hub/http/__tests__/app.test.ts
@@ -40,6 +40,7 @@ import {
 } from "../../app.js";
 import { HubSessionManager } from "../../security/session.js";
 import { HubAssetManifest } from "../../static/assets.js";
+import type { HubTelemetrySink } from "../../telemetry.js";
 
 const ORIGIN = "http://127.0.0.1:48123";
 const HOST = "127.0.0.1:48123";
@@ -58,6 +59,82 @@ const TEAM_NOW = "2026-08-27T04:05:06.000Z";
 const RELAY_DIRTY_PUBLICATION_WARNING = "MEX recorded that local changes existed when this Relay was published; it did not record their paths, diff, or contents.";
 
 describe("Project Hub HTTP application", () => {
+  it("accepts only authenticated bounded page categories and never treats reads as telemetry", async () => {
+    const telemetry = vi.fn();
+    const app = fixtureApp({ telemetry });
+    const path = `${ORIGIN}/api/v1/telemetry/page`;
+    expect((await app.request(path, mutation({ page: "home" }))).status).toBe(401);
+    const { cookie, csrfToken } = await authenticatedSession(app);
+    const headers = { ...mutationHeaders(), cookie, "x-mex-csrf": csrfToken };
+    for (const endpoint of ["session", "home", "health"]) {
+      expect((await app.request(`${ORIGIN}/api/v1/${endpoint}`, { headers })).status).toBe(200);
+    }
+    expect(telemetry).not.toHaveBeenCalled();
+    const post = (body: unknown, overrides: Record<string, string> = {}) => app.request(path, {
+      method: "POST", headers: { ...headers, ...overrides }, body: JSON.stringify(body),
+    });
+    expect((await post({ page: "home" }, { origin: "https://outside.example" })).status).toBe(403);
+    expect((await post({ page: "home" }, { "x-mex-csrf": "wrong" })).status).toBe(403);
+    expect((await post({ page: "home" }, { "content-type": "text/plain" })).status).toBe(400);
+    for (const body of [{ page: "/private/source.ts" }, { page: "home", url: "/secret" },
+      { page: "home", memberId: TEAM_MEMBER_ID }, { event: "hub.session_started" }, { page: null }]) {
+      expect((await post(body)).status).toBe(400);
+    }
+    expect((await app.request(path, { method: "POST", headers,
+      body: JSON.stringify({ page: "home" }) + " ".repeat(128) })).status).toBe(400);
+    expect((await app.request(`${path}?query=private`, {
+      method: "POST", headers, body: JSON.stringify({ page: "home" }),
+    })).status).toBe(400);
+    expect(telemetry).not.toHaveBeenCalled();
+    const accepted = await post({ page: "knowledge_detail" });
+    expect(accepted.status).toBe(204);
+    expect(await accepted.text()).toBe("");
+    expect(accepted.headers.get("cache-control")).toContain("no-store");
+    expect(telemetry.mock.calls).toEqual([["hub.page_viewed", { page: "knowledge_detail" }]]);
+  });
+
+  it.each(["team", "inbox", "relays"] as const)(
+    "projects validated %s actions, trusted replay outcomes, and failures without payload data",
+    async (family) => {
+      const telemetry = vi.fn();
+      const services = family === "team" ? teamReadServices() : family === "inbox" ? inboxReadServices() : relayReadServices();
+      const request = family === "team" ? teamPreviewRequest() : family === "inbox" ? inboxPreviewRequest() : relayPreviewRequest();
+      let replayed = false;
+      let fail = false;
+      const apply = async () => {
+        if (fail) throw new Error("private@example.test /Users/private/project");
+        const result = family === "team" ? teamApplyResult() : family === "inbox" ? inboxApplyResult() : relayApplyResult();
+        return { ...result, idempotentReplay: replayed };
+      };
+      const applyKey = family === "team" ? "applyTeamOperation" : family === "inbox" ? "applyInboxOperation" : "applyRelayOperation";
+      // The existing independently validated family fixtures supply each exact
+      // response shape; the wrapper changes only the trusted replay outcome.
+      const app = fixtureApp({ telemetry, services: { ...services, [applyKey]: apply } });
+      const { cookie, csrfToken } = await authenticatedSession(app);
+      const headers = { ...mutationHeaders(), cookie, "x-mex-csrf": csrfToken };
+      const post = (stage: string, body: unknown) => app.request(`${ORIGIN}/api/v1/${family}/operations/${stage}`, {
+        method: "POST", headers, body: JSON.stringify(body),
+      });
+      expect((await post("preview", { ...request, actor: "private" })).status).toBe(400);
+      expect(telemetry).not.toHaveBeenCalled();
+      const preview = await post("preview", request);
+      expect(preview.status).toBe(200);
+      const envelope = await preview.json();
+      expect((await post("apply", envelope)).status).toBe(200);
+      replayed = true;
+      expect((await post("apply", envelope)).status).toBe(200);
+      fail = true;
+      expect((await post("apply", envelope)).status).toBe(500);
+      expect(telemetry.mock.calls).toEqual([
+        ["hub.action_completed", { action: request.action.kind, stage: "preview", outcome: "success", duration_ms: expect.any(Number) }],
+        ["hub.action_completed", { action: request.action.kind, stage: "apply", outcome: "success", duration_ms: expect.any(Number), replayed: false }],
+        ["hub.action_completed", { action: request.action.kind, stage: "apply", outcome: "success", duration_ms: expect.any(Number), replayed: true }],
+        ["hub.action_completed", { action: request.action.kind, stage: "apply", outcome: "failure", duration_ms: expect.any(Number) }],
+      ]);
+      expect(JSON.stringify(telemetry.mock.calls)).not.toMatch(/private|Ada|@|member_|proposal_|receipt|operationId|revision|\.mex/);
+    },
+  );
+
   it("exchanges the bootstrap once and protects every ordinary API route", async () => {
     const app = fixtureApp();
     const unauthenticated = await app.request(`${ORIGIN}/api/v1/home`, {
@@ -1682,6 +1759,7 @@ function fixtureApp(overrides: {
   sessionTtlMs?: number;
   sessionCookieSuffix?: string;
   randomStart?: number;
+  telemetry?: HubTelemetrySink;
 } = {}) {
   let random = overrides.randomStart ?? 20;
   return createHubApp({
@@ -1699,6 +1777,7 @@ function fixtureApp(overrides: {
     }),
     services: overrides.services ?? readServices(),
     jobs: overrides.jobs,
+    telemetry: overrides.telemetry,
     assets: overrides.assets,
     requestId: () => "00000000-0000-4000-8000-000000000001",
     ...(overrides.now === undefined ? {} : { now: overrides.now }),
diff --git a/src/hub/http/request.ts b/src/hub/http/request.ts
index 74513f93..fb10c1c2 100644
--- a/src/hub/http/request.ts
+++ b/src/hub/http/request.ts
@@ -1,7 +1,11 @@
 import { HUB_LIMITS } from "@mex/hub-contracts";
 import { invalidRequest } from "./errors.js";
 
-export async function readBoundedJson(request: Request): Promise<unknown> {
+export async function readBoundedJson(
+  request: Request,
+  maximumBytes: number = HUB_LIMITS.maxMutationBodyBytes,
+): Promise<unknown> {
+  const limitDescription = maximumBytes === HUB_LIMITS.maxMutationBodyBytes ? "64 KiB" : `${maximumBytes} byte`;
   const contentType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
   if (contentType !== "application/json") {
     throw invalidRequest("Mutations require an application/json request body.");
@@ -12,8 +16,8 @@ export async function readBoundedJson(request: Request): Promise<unknown> {
     if (!/^\d+$/.test(contentLength)) {
       throw invalidRequest("The Content-Length header is invalid.");
     }
-    if (Number(contentLength) > HUB_LIMITS.maxMutationBodyBytes) {
-      throw invalidRequest("The request body exceeds the 64 KiB limit.");
+    if (Number(contentLength) > maximumBytes) {
+      throw invalidRequest(`The request body exceeds the ${limitDescription} limit.`);
     }
   }
 
@@ -29,9 +33,9 @@ export async function readBoundedJson(request: Request): Promise<unknown> {
       const { done, value } = await reader.read();
       if (done) break;
       byteLength += value.byteLength;
-      if (byteLength > HUB_LIMITS.maxMutationBodyBytes) {
+      if (byteLength > maximumBytes) {
         await reader.cancel();
-        throw invalidRequest("The request body exceeds the 64 KiB limit.");
+        throw invalidRequest(`The request body exceeds the ${limitDescription} limit.`);
       }
       chunks.push(value);
     }
diff --git a/src/hub/jobs/__tests__/job-manager.test.ts b/src/hub/jobs/__tests__/job-manager.test.ts
index 19fcfff8..dc9bc4cb 100644
--- a/src/hub/jobs/__tests__/job-manager.test.ts
+++ b/src/hub/jobs/__tests__/job-manager.test.ts
@@ -7,7 +7,7 @@ import {
 } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import { MexPortError } from "../../../team/contracts/shared.js";
 import { TeamLocalState } from "../../../team/local-state/index.js";
 import {
@@ -84,6 +84,68 @@ afterEach(() => {
 });
 
 describe("HubJobManager", () => {
+  it.each(["success", "failure", "cancelled", "shutdown"] as const)(
+    "reports one durable %s outcome without subscribers, progress, or historical replay",
+    async (outcome) => {
+      const root = tempProject();
+      const telemetry = vi.fn();
+      let now = NOW;
+      let finish!: () => void;
+      const pending = new Promise<void>(resolve => { finish = resolve; });
+      const manager = new HubJobManager({
+        localState: localState(root), telemetry, now: () => now, generateId: () => JOB_A,
+        executors: { graph_refresh: async ({ reportProgress, signal }) => {
+          reportProgress({ phase: "parse", completed: 4, total: 4 });
+          signal.addEventListener("abort", finish, { once: true });
+          await pending;
+          if (outcome === "failure") throw new Error("/private/source.ts private@example.test");
+        } },
+      });
+      manager.initialize();
+      const job = manager.start({ kind: "graph_refresh" });
+      await waitForState(manager, job.id, "running");
+      expect(telemetry).not.toHaveBeenCalled();
+      now = LATER;
+      if (outcome === "shutdown") await manager.shutdown();
+      else {
+        if (outcome === "cancelled") manager.cancel(job.id);
+        finish();
+        await waitForState(manager, job.id, outcome === "success" ? "succeeded" : outcome === "failure" ? "failed" : "interrupted");
+        manager.cancel(job.id);
+        const unsubscribe = manager.subscribe(job.id, () => undefined);
+        unsubscribe();
+        manager.list();
+        await manager.shutdown();
+      }
+      expect(telemetry.mock.calls).toEqual([["hub.job_completed", {
+        job_kind: "graph_refresh", outcome: outcome === "shutdown" ? "cancelled" : outcome, duration_ms: 60_000,
+      }]]);
+      expect(JSON.stringify(telemetry.mock.calls)).not.toMatch(/private|job_01|scaffold|revision/);
+      const restarted = new HubJobManager({ localState: localState(root), telemetry, now: () => LATER });
+      restarted.initialize();
+      restarted.get(job.id);
+      restarted.list();
+      await restarted.shutdown();
+      expect(telemetry).toHaveBeenCalledOnce();
+    },
+  );
+
+  it("reports queued cancellation once even when the queued executor never starts", async () => {
+    const telemetry = vi.fn();
+    const execute = vi.fn(async () => undefined);
+    const manager = new HubJobManager({ localState: localState(tempProject()), telemetry,
+      now: () => NOW, executors: { wiki_refresh: execute } });
+    manager.initialize();
+    const job = manager.start({ kind: "wiki_refresh" });
+    manager.cancel(job.id);
+    manager.cancel(job.id);
+    await manager.shutdown();
+    expect(execute).not.toHaveBeenCalled();
+    expect(telemetry.mock.calls).toEqual([["hub.job_completed", {
+      job_kind: "wiki_refresh", outcome: "cancelled", duration_ms: 0,
+    }]]);
+  });
+
   it("generates standard job-prefixed ULIDs", () => {
     expect(generateHubJobId(0, new Uint8Array(10))).toBe(
       "job_00000000000000000000000000",
diff --git a/src/hub/jobs/index.ts b/src/hub/jobs/index.ts
index 9a7c4766..d4da84e5 100644
--- a/src/hub/jobs/index.ts
+++ b/src/hub/jobs/index.ts
@@ -1,6 +1,7 @@
 import { randomBytes } from "node:crypto";
 import { MexPortError } from "../../team/contracts/shared.js";
 import { TeamLocalState } from "../../team/local-state/index.js";
+import { boundedHubDuration, emitHubTelemetry, type HubTelemetrySink } from "../telemetry.js";
 import {
   HUB_JOB_KINDS,
   HUB_JOB_PROGRESS_PHASES,
@@ -28,6 +29,7 @@ interface ActiveExecution {
   shutdownRequested: boolean;
   failureRequested: boolean;
   settled: boolean;
+  terminalReported: boolean;
   promise?: Promise<void>;
 }
 
@@ -51,6 +53,7 @@ export interface HubJobManagerOptions {
   processId?: number;
   leaseToken?: string;
   shutdownTimeoutMs?: number;
+  telemetry?: HubTelemetrySink;
 }
 
 export interface HubJobService {
@@ -77,6 +80,7 @@ export class HubJobManager implements HubJobService {
   private readonly processId: number;
   private readonly leaseToken: string;
   private readonly shutdownTimeoutMs: number;
+  private readonly telemetry?: HubTelemetrySink;
   private readonly executions = new Map<string, ActiveExecution>();
   private readonly listeners = new Map<string, Set<HubJobListener>>();
   private lifecycle: ManagerLifecycle = "new";
@@ -84,6 +88,7 @@ export class HubJobManager implements HubJobService {
 
   constructor(options: HubJobManagerOptions) {
     this.localState = options.localState;
+    this.telemetry = options.telemetry;
     this.executors = Object.freeze({ ...(options.executors ?? {}) });
     this.now = options.now ?? (() => new Date().toISOString());
     this.generateId = options.generateId ?? generateHubJobId;
@@ -166,6 +171,7 @@ export class HubJobManager implements HubJobService {
       shutdownRequested: false,
       failureRequested: false,
       settled: false,
+      terminalReported: false,
     };
     this.executions.set(queued.id, execution);
     execution.promise = Promise.resolve()
@@ -600,6 +606,18 @@ export class HubJobManager implements HubJobService {
   }
 
   private publish(job: HubJobSnapshot, type: HubJobEventType): void {
+    const execution = this.executions.get(job.id);
+    if (type === "terminal" && isTerminal(job) && execution
+      && execution.generation === job.generation && !execution.terminalReported) {
+      execution.terminalReported = true;
+      emitHubTelemetry(this.telemetry, "hub.job_completed", {
+        job_kind: job.kind,
+        // Orderly shutdown and user cancellation both interrupt active work.
+        // Historical startup reconciliation is deliberately not reported.
+        outcome: job.state === "succeeded" ? "success" : job.state === "failed" ? "failure" : "cancelled",
+        duration_ms: boundedHubDuration(Date.parse(job.finishedAt!) - Date.parse(job.startedAt ?? job.createdAt)),
+      });
+    }
     const listeners = this.listeners.get(job.id);
     if (!listeners) return;
     for (const listener of [...listeners]) callListener(listener, { type, job });
diff --git a/src/hub/telemetry.ts b/src/hub/telemetry.ts
new file mode 100644
index 00000000..e57e52e9
--- /dev/null
+++ b/src/hub/telemetry.ts
@@ -0,0 +1,80 @@
+import { z } from "zod";
+import type { TelemetryAttributes } from "../telemetry/schema.js";
+
+// Browser input is deliberately a category, never a URL, identifier, or event
+// payload. The transport performs its own independent final allowlist check.
+export const HubPageViewSchema = z.object({
+  page: z.enum([
+    "home", "search", "knowledge", "knowledge_detail", "code", "code_symbol",
+    "workstreams", "specs", "spec_detail", "playbooks", "catch_up", "inbox",
+    "relays", "members", "activity", "jobs", "health", "settings", "not_found",
+  ]),
+}).strict();
+
+export type HubTelemetrySink = (
+  name: "hub.session_started" | "hub.page_viewed" | "hub.action_completed" | "hub.job_completed",
+  attributes: TelemetryAttributes,
+) => void;
+
+export const HUB_PAGE_EVENT_BODY_BYTES = 128;
+const PAGE_EVENTS_PER_MINUTE = 60;
+const MAX_DURATION_MS = 86_400_000;
+
+/** Optional sink keeps embedded apps, fixtures, and ordinary read tests quiet. */
+export class HubTelemetry {
+  private pageWindowStart = 0;
+  private pageWindowCount = 0;
+
+  constructor(
+    private readonly sink?: HubTelemetrySink,
+    private readonly now: () => number = Date.now,
+  ) {}
+
+  pageViewed(page: z.infer<typeof HubPageViewSchema>["page"]): void {
+    if (!this.sink) return;
+    const now = this.now();
+    if (now < this.pageWindowStart || now - this.pageWindowStart >= 60_000) {
+      this.pageWindowStart = now;
+      this.pageWindowCount = 0;
+    }
+    // One process-wide counter: no session, user, URL, or growing key map.
+    if (this.pageWindowCount >= PAGE_EVENTS_PER_MINUTE) return;
+    this.pageWindowCount += 1;
+    emitHubTelemetry(this.sink, "hub.page_viewed", { page });
+  }
+
+  async action<T>(
+    action: string,
+    stage: "preview" | "apply" | "direct",
+    run: () => T | Promise<T>,
+    replayed?: (result: T) => boolean,
+  ): Promise<T> {
+    if (!this.sink) return run();
+    const started = this.now();
+    try {
+      const result = await run();
+      emitHubTelemetry(this.sink, "hub.action_completed", {
+        action, stage, outcome: "success", duration_ms: boundedHubDuration(this.now() - started),
+        ...(stage === "apply" && replayed ? { replayed: replayed(result) } : {}),
+      });
+      return result;
+    } catch (error) {
+      emitHubTelemetry(this.sink, "hub.action_completed", {
+        action, stage, outcome: "failure", duration_ms: boundedHubDuration(this.now() - started),
+      });
+      throw error;
+    }
+  }
+}
+
+export function boundedHubDuration(duration: number): number {
+  return Number.isFinite(duration) ? Math.min(MAX_DURATION_MS, Math.max(0, Math.round(duration))) : 0;
+}
+
+export function emitHubTelemetry(
+  sink: HubTelemetrySink | undefined,
+  name: Parameters<HubTelemetrySink>[0],
+  attributes: Parameters<HubTelemetrySink>[1],
+): void {
+  try { sink?.(name, attributes); } catch { /* Observability never changes Hub behavior. */ }
+}
diff --git a/src/telemetry/index.ts b/src/telemetry/index.ts
index 769d2cff..745deb5b 100644
--- a/src/telemetry/index.ts
+++ b/src/telemetry/index.ts
@@ -1,310 +1,218 @@
-/**
- * Anonymous, opt-out telemetry — PostHog counting layer.
- *
- * Trust constraint: a developer who reads this file must trust it.
- * - Only 6 whitelisted fields are ever sent (see `buildPayload`).
- * - No PII, no args, no paths, no file contents, no repo names.
- * - Failures are swallowed — telemetry never affects command behaviour.
- * - The PostHog client is the only network-touching code in this module.
- *
- * All PostHog-specific code lives behind this interface so the backend can
- * be swapped to a self-hosted endpoint in one file.
- */
-
-import { PostHog } from "posthog-node";
-import { getMachineId, readGlobalConfig, setGlobalConfigKey, isDevRepo } from "../global-config.js";
-import { VERSION } from "../version.js";
-import { platform } from "node:os";
-
-// ── Constants ──
-
-const TELEMETRY_KEY = "phc_wdwbBPQMrM6vKWMzz5yqWT357i2hSjMhnAvCuofJdMpg";
-const HOST = "https://us.i.posthog.com";
-const EVENT = "command_run";
-const FLUSH_TIMEOUT_MS = 800;
-// A short-lived CLI must never inherit the SDK's 10 second request timeout.
-// Keep the network attempt inside the command-level flush deadline so an
-// offline endpoint cannot dominate graph/eval latency.
-const REQUEST_TIMEOUT_MS = 650;
-
-// ── Opt-out check ──
-
-export interface EnabledResult {
-  enabled: boolean;
-  reason?: string;
-}
-
-/**
- * Determine whether telemetry is enabled.
- *
- * Precedence (first match wins):
- * 1. `DO_NOT_TRACK=1` → off
- * 2. `MEX_TELEMETRY=0` → off
- * 3. Dev repo / `MEX_DEV` → off
- * 4. `~/.mex/config.json` `telemetry === "off"` → off
- * 5. else → on
- *
- * Env + dev checks run before any disk read.
- */
+/** Pseudonymous, opt-out usage analytics. No content, names or raw arguments. */
+import { getMachineId, readMachineId, readGlobalConfig, readTelemetryPreference, setGlobalConfigKey, isDevRepo, mexHomeDir } from "../global-config.js";
+import { claimBatch, closeOutbox, enqueue, finishBatch, inspectOutbox, OUTBOX_LIMITS, purgeOutbox } from "./outbox.js";
+import { eventAttributes, makeEvent, previewEvent, TELEMETRY_ACTIONS, TELEMETRY_COMMANDS, TELEMETRY_EVENTS,
+  TELEMETRY_JOB_KINDS, TELEMETRY_PAGES, TELEMETRY_AI_TOOLS, type TelemetryAttributes,
+  type TelemetryEventName, type TelemetryProjectContext } from "./schema.js";
+import { readTelemetryProjectContext } from "./project-context.js";
+import { sendBatch, setEndpointForTest, TELEMETRY_ENDPOINT, type BatchRequest } from "./transport.js";
+export type { TelemetryAttributes, TelemetryEventName, TelemetryEvent } from "./schema.js";
+export { TELEMETRY_ACTIONS, TELEMETRY_COMMANDS, TELEMETRY_EVENTS, TELEMETRY_JOB_KINDS, TELEMETRY_PAGES } from "./schema.js";
+
+export const TELEMETRY_FLUSH_GRACE_MS = 25;
+export const HUB_TELEMETRY_INTERVAL_MS = 15_000;
+export interface EnabledResult { enabled: boolean; reason?: string; }
 export function isEnabled(): EnabledResult {
-  // 1. Industry-standard opt-out
-  if (process.env.DO_NOT_TRACK === "1") {
-    return { enabled: false, reason: "DO_NOT_TRACK" };
-  }
-
-  // 2. mex-specific env opt-out
-  if (process.env.MEX_TELEMETRY === "0") {
-    return { enabled: false, reason: "MEX_TELEMETRY" };
-  }
-
-  // 3. Dev-repo guard (no disk read for global config yet)
-  if (isDevRepo()) {
-    return { enabled: false, reason: "dev" };
-  }
-
-  // 4. Global config opt-out
-  try {
-    const globalConfig = readGlobalConfig();
-    if (globalConfig.telemetry === "off") {
-      return { enabled: false, reason: "config" };
-    }
-  } catch { /* tolerate read failure — default to enabled */ }
-
-  // 5. Default: enabled
+  if (process.env.DO_NOT_TRACK === "1") return { enabled: false, reason: "DO_NOT_TRACK" };
+  if (process.env.MEX_TELEMETRY === "0") return { enabled: false, reason: "MEX_TELEMETRY" };
+  if (isDevRepo()) return { enabled: false, reason: "dev" };
+  const preference = readTelemetryPreference();
+  if (preference === "off") return { enabled: false, reason: "config" };
+  if (preference === "unavailable") return { enabled: false, reason: "config_unavailable" };
   return { enabled: true };
 }
 
-// ── Payload construction ──
-
-/**
- * The single place the payload shape is defined. Exactly 6 keys — nothing else.
- *
- * PII firewall: `scaffold_id` is a **string** (random UUID). Never pass the
- * full `ScaffoldIdentity` object — it contains `scaffold_name` (directory
- * basename), `origin`, and `upstream` which must never reach PostHog.
- */
-export function buildPayload(
-  command: string,
-  scaffold_id?: string,
-): Record<string, string> {
-  const payload: Record<string, string> = {
-    machine_id: "", // placeholder — filled by capture() when actually sending
-    command,
-    mex_version: VERSION,
-    os: platform(),
-    node_version: process.version,
-  };
-  if (scaffold_id) {
-    payload.scaffold_id = scaffold_id;
-  }
-  return payload;
-}
-
-/**
- * Build the payload that *would* be sent, for `mex telemetry inspect`.
- *
- * Uses a read-only identity lookup — never mints a scaffold_id on disk.
- * Does NOT send anything or touch the network.
- *
- * `scaffoldId` is passed in by the CLI after a read-only config lookup.
- */
-export function getPayloadPreview(
-  command: string,
-  scaffoldId?: string,
-  machineId?: string,
-): Record<string, string> {
-  const payload = buildPayload(command, scaffoldId);
-  payload.machine_id = machineId ?? "(not generated — telemetry disabled or inspect-only)";
-  return payload;
-}
-
-// ── PostHog client (lazy, with test seam) ──
-
 type TransportFn = (event: string, properties: Record<string, unknown>) => void;
-type TelemetryClient = Pick<PostHog, "captureImmediate" | "flush" | "shutdown">;
-
-let client: TelemetryClient | null = null;
 let customTransport: TransportFn | null = null;
-const pendingCaptures = new Set<Promise<void>>();
-
-function getClient(): TelemetryClient {
-  if (!client) {
-    client = new PostHog(TELEMETRY_KEY, {
-      host: HOST,
-      flushAt: 1,       // flush after every event (short-lived CLI)
-      flushInterval: 0, // don't auto-flush on interval — we call flush() explicitly
-      requestTimeout: REQUEST_TIMEOUT_MS,
-      // Retries are appropriate for a daemon, but their default three-second
-      // backoff keeps a one-shot CLI alive after our flush deadline. A future
-      // invocation is the retry for anonymous command-count telemetry.
-      fetchRetryCount: 0,
-      fetchRetryDelay: 0,
-    });
+let active: BatchRequest | undefined;
+let activeDone: Promise<void> | undefined;
+let scheduled: ReturnType<typeof setImmediate> | undefined;
+let cliBatchAttempted = false;
+let stateHome: string | undefined;
+let hubUsers = 0;
+let hubTimer: ReturnType<typeof setInterval> | undefined;
+
+function abortActive(): void { active?.abort(); }
+function checkEnabled(): boolean {
+  if (isEnabled().enabled) return true;
+  abortActive();
+  return false;
+}
+function synchronizeHome(): void {
+  const home = mexHomeDir();
+  if (stateHome !== home) {
+    abortActive();
+    closeOutbox();
+    cliBatchAttempted = false;
+    stateHome = home;
   }
-  return client;
 }
 
-/**
- * Test seam: inject a fake transport so tests never hit the network.
- * Pass `null` to restore the real PostHog client.
- */
-export function __setTransport(fn: TransportFn | null): void {
-  customTransport = fn;
+/** Projected and validated before identity, disk, or network work. */
+export function captureEvent(name: TelemetryEventName, attributes: TelemetryAttributes = {}): void {
+  try {
+    if (!eventAttributes(name, attributes) || !checkEnabled()) return;
+    synchronizeHome();
+    const event = makeEvent(name, attributes, getMachineId());
+    if (!event) return;
+    if (customTransport) { customTransport(event.event, event.properties); return; }
+    // Recheck immediately before enqueue, then again at the actual send boundary.
+    if (!checkEnabled() || !enqueue(event)) return;
+    if (!hubUsers && !cliBatchAttempted && !scheduled) {
+      scheduled = setImmediate(() => { scheduled = undefined; dispatch(); });
+      scheduled.unref();
+    }
+  } catch { /* Analytics never changes command results or writes to stdout/stderr. */ }
 }
 
-/** Test seam for proving a non-responsive SDK client cannot hold the CLI open. */
-export function __setClientForTest(next: TelemetryClient | null): void {
-  client = next;
-  pendingCaptures.clear();
+/** Opt-outs never trigger project discovery for ordinary telemetry captures. */
+export function getProjectTelemetryContext(startDir: string, discovery: "git-root" | "exact" = "git-root"): TelemetryProjectContext {
+  try { return checkEnabled() ? readTelemetryProjectContext(startDir, discovery) : {}; }
+  catch { return {}; }
 }
 
-// ── Capture + flush ──
+/** Each Hub binds one lazy context snapshot to its own project, not process cwd. */
+export function createProjectTelemetryCapture(startDir: string): typeof captureEvent {
+  let context: TelemetryProjectContext | undefined;
+  return (name, attributes = {}) => {
+    try {
+      if (!eventAttributes(name, attributes) || !checkEnabled()) return;
+      context ??= readTelemetryProjectContext(startDir, "exact");
+      captureEvent(name, { ...attributes, ...context });
+    } catch { /* Metadata must never change the result of a Hub operation. */ }
+  };
+}
 
-/**
- * Capture a telemetry event. Enqueues synchronously — no await needed.
- *
- * If telemetry is disabled, returns immediately.
- * All errors are swallowed — telemetry must never affect command behaviour.
- */
-export function capture(event: string, command: string, scaffoldId?: string): void {
+function dispatch(): void {
   try {
-    const { enabled } = isEnabled();
-    if (!enabled) return;
-
-    const machineId = getMachineId();
-    const payload = buildPayload(command, scaffoldId);
-    payload.machine_id = machineId;
-
-    if (customTransport) {
-      customTransport(event, payload);
-      return;
-    }
+    if (active || customTransport || !checkEnabled()) return;
+    synchronizeHome();
+    if (!hubUsers && cliBatchAttempted) return;
+    const batch = claimBatch();
+    if (!batch) return;
+    if (!checkEnabled()) { finishBatch(batch, false); return; }
+    cliBatchAttempted = true;
+    const request = sendBatch(batch.events);
+    active = request;
+    activeDone = request.done.then((delivered) => {
+      finishBatch(batch, delivered);
+    }).catch(() => undefined).finally(() => {
+      if (active === request) { active = undefined; activeDone = undefined; }
+    });
+  } catch { /* Busy/malformed stores or failed sends simply drop/defer telemetry. */ }
+}
 
-    const ph = getClient();
-    // captureImmediate returns the delivery promise to us, so we can swallow
-    // failures ourselves. The SDK's queued/background flush path logs rejected
-    // requests to console.error before callers can catch them, corrupting JSONL.
-    const pending = ph.captureImmediate({
-      distinctId: machineId,
-      event,
-      properties: payload,
-      // Anonymous: tell PostHog not to derive geolocation from the request IP.
-      // Without this, the server attaches IP-based geo — PII that would NOT
-      // show up in `mex telemetry inspect`, breaking the whitelist promise.
-      // (posthog-node still adds $lib / $lib_version library metadata — not
-      // user data; disclosed in TELEMETRY.md.)
-      disableGeoip: true,
-    }).catch(() => undefined);
-    pendingCaptures.add(pending);
-    void pending.finally(() => pendingCaptures.delete(pending));
-  } catch {
-    // Swallow everything — telemetry must never throw.
+/** Relative grace, capped at 50ms. Abort cancels socket AND DNS work at its end. */
+export async function flush(options: { deadlineMs?: number } = {}): Promise<void> {
+  const value = options.deadlineMs;
+  const grace = typeof value === "number" && Number.isFinite(value) ? Math.max(0, Math.min(50, value)) : TELEMETRY_FLUSH_GRACE_MS;
+  const deadline = performance.now() + grace;
+  try {
+    if (scheduled) { clearImmediate(scheduled); scheduled = undefined; }
+    if (!checkEnabled()) return;
+    dispatch();
+    if (activeDone) await settleByDeadline(activeDone, deadline);
+  } catch { /* best effort */ }
+  finally {
+    abortActive();
+    // Abort settles the request immediately; finish local acknowledgement cleanup
+    // without opening another request or extending the network deadline.
+    await Promise.resolve();
+    if (!hubUsers) closeOutbox();
   }
 }
 
-/**
- * Capture a `command_run` event. This is the main entry point from CLI hooks.
- *
- * `scaffoldId` is the **string** scaffold_id only — never the full
- * ScaffoldIdentity object. This is the PII firewall.
- */
-export function captureCommand(command: string, scaffoldId?: string): void {
-  capture(EVENT, command, scaffoldId);
+async function settleByDeadline(work: Promise<unknown>, deadline: number): Promise<void> {
+  const safe = work.then(() => undefined, () => undefined);
+  const remaining = deadline - performance.now();
+  if (remaining <= 0) { void safe; return; }
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try { await Promise.race([safe, new Promise<void>((resolve) => { timer = setTimeout(resolve, remaining); })]); }
+  finally { if (timer) clearTimeout(timer); }
 }
 
-/**
- * Best-effort, time-bounded flush + unconditional shutdown.
- *
- * After the flush (or timeout), `posthog.shutdown()` clears the internal
- * interval timer so the Node.js process can exit promptly.
- */
-export async function flush(): Promise<void> {
-  const activeClient = client;
-  const deadline = Date.now() + FLUSH_TIMEOUT_MS;
-  try {
-    if (customTransport || !activeClient) {
-      // No real client to flush — nothing to do.
-      return;
+/** A long-running Hub amortizes sending. Idle sessions do not manufacture events. */
+export function startHubTelemetry(): () => Promise<void> {
+  hubUsers++;
+  if (!hubTimer) {
+    hubTimer = setInterval(() => { dispatch(); }, HUB_TELEMETRY_INTERVAL_MS);
+    hubTimer.unref();
+  }
+  let stopped = false;
+  return async () => {
+    if (stopped) return;
+    stopped = true;
+    if (--hubUsers === 0) {
+      if (hubTimer) clearInterval(hubTimer);
+      hubTimer = undefined;
+      // A final Hub batch is permitted even if an earlier batch was delivered.
+      cliBatchAttempted = false;
+      await flush();
     }
+  };
+}
 
-    await settleByDeadline(
-      Promise.allSettled([...pendingCaptures]).then(() => activeClient.flush()),
-      deadline,
-    );
-  } catch {
-    // Swallow — delivery is best-effort.
-  } finally {
-    try {
-      if (activeClient) {
-        // PostHog otherwise defaults shutdown to 30 seconds. Pass the remaining
-        // command deadline to the SDK *and* guard it ourselves so alternate or
-        // future clients cannot make telemetry command-blocking.
-        const remaining = Math.max(1, deadline - Date.now());
-        await settleByDeadline(Promise.resolve(activeClient.shutdown(remaining)), deadline);
-      }
-    } catch {
-      // Swallow shutdown errors too.
-    } finally {
-      if (client === activeClient) client = null;
-      pendingCaptures.clear();
-    }
-  }
+/** Called by explicit disable/config-off actions, not by ordinary opt-out reads. */
+export function disableTelemetry(): { purged: boolean } {
+  abortActive();
+  if (scheduled) { clearImmediate(scheduled); scheduled = undefined; }
+  // Preference errors reach the explicit config command; never silently report
+  // that a failed opt-out worked. Sending has already been aborted.
+  setGlobalConfigKey("telemetry", "off");
+  return { purged: purgeOutbox() };
 }
 
-async function settleByDeadline(work: Promise<unknown>, deadline: number): Promise<void> {
-  // Attach the rejection handler even when the deadline has already elapsed.
-  // The SDK's own bounded shutdown rejects on timeout; leaving that late
-  // rejection detached would corrupt JSONL commands with an unhandled error.
-  const settled = work.then(() => undefined, () => undefined);
-  const remaining = deadline - Date.now();
-  if (remaining <= 0) {
-    void settled;
-    return;
-  }
-  let timer: ReturnType<typeof setTimeout> | undefined;
-  try {
-    await Promise.race([
-      settled,
-      new Promise<void>((resolve) => { timer = setTimeout(resolve, remaining); }),
-    ]);
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
+/** No captures, identity creation, database repair, configuration writes, or sends. */
+export function getTelemetryInspection(): Record<string, unknown> {
+  const id = readMachineId();
+  const context = readTelemetryProjectContext(process.cwd());
+  return {
+    schema_version: 2, ...isEnabled(), endpoint: TELEMETRY_ENDPOINT,
+    installation_id: id ?? null, project_context: context, queue: inspectOutbox(), limits: OUTBOX_LIMITS,
+    catalog: { events: TELEMETRY_EVENTS, commands: TELEMETRY_COMMANDS, pages: TELEMETRY_PAGES,
+      actions: TELEMETRY_ACTIONS, job_kinds: TELEMETRY_JOB_KINDS, configured_ai_tools: TELEMETRY_AI_TOOLS },
+    batch_example: { api_key: "<public MEX project token>", batch: [
+      previewEvent("cli.command_started", { ...context, command: "wiki.query", stage: "direct" }, id),
+      previewEvent("cli.command_completed", { ...context, command: "wiki.query", stage: "direct", outcome: "success", duration_ms: 12 }, id),
+      previewEvent("hub.page_viewed", { ...context, page: "knowledge" }, id),
+    ] },
+  };
 }
 
-// ── First-run notice ──
+/** Compatibility for old hooks; context comes from the bounded config reader. */
+export function captureCommand(command: string, _scaffoldId?: string): void {
+  captureEvent("cli.command_started", { command: command.replaceAll(" ", ".") });
+}
+export function capture(_event: string, command: string, _scaffoldId?: string): void { captureCommand(command); }
+export function buildPayload(command: string, _scaffoldId?: string): Record<string, unknown> {
+  return previewEvent("cli.command_started", { command: command.replaceAll(" ", ".") }).properties as Record<string, unknown>;
+}
+export function getPayloadPreview(command: string, _scaffoldId?: string, machineId?: string): Record<string, unknown> {
+  return previewEvent("cli.command_started", { command: TELEMETRY_COMMANDS.includes(command as typeof TELEMETRY_COMMANDS[number]) ? command : "wiki.query" }, machineId).properties as Record<string, unknown>;
+}
 
-/**
- * Show a one-time first-run notice to stderr if telemetry is enabled.
- * Returns true if the notice was shown.
- */
 export function showFirstRunNotice(): boolean {
   try {
-    const { enabled } = isEnabled();
-    if (!enabled) return false;
-
-    const config = readGlobalConfig();
-    if (config.firstRunNoticeShown) return false;
-
-    // Skip in non-TTY to avoid noise in pipes
-    if (!process.stderr.isTTY) return false;
-
-    process.stderr.write(
-      "\n" +
-      "  mex collects anonymous usage data (command name, version, OS) to\n" +
-      "  understand how the tool is used. No file contents, paths, or personal\n" +
-      "  data are ever collected. Run `mex telemetry inspect` to see the exact\n" +
-      "  payload sent.\n" +
-      "\n" +
-      "  To opt out: mex config set telemetry off\n" +
-      "  Or set DO_NOT_TRACK=1 or MEX_TELEMETRY=0\n" +
-      "\n",
-    );
-
+    if (!isEnabled().enabled || readGlobalConfig().firstRunNoticeShown || !process.stderr.isTTY) return false;
+    process.stderr.write("\n  MEX collects pseudonymous feature usage and outcomes using a random\n"
+      + "  installation ID shared by this CLI and local Hub. Events may include\n"
+      + "  an existing random scaffold UUID and configured AI-tool names. No\n"
+      + "  content, paths, queries, member identities or contact details. Events are\n"
+      + "  queued locally; entries older than 7 days are dropped on next use.\n"
+      + "  Inspect: mex telemetry inspect\n"
+      + "  Opt out: mex telemetry disable, DO_NOT_TRACK=1 or MEX_TELEMETRY=0.\n\n");
     setGlobalConfigKey("firstRunNoticeShown", true);
     return true;
-  } catch {
-    // Never let the notice break a command.
-    return false;
-  }
+  } catch { return false; }
+}
+
+/** Offline seams are internal, never configurable by product input. */
+export function __setTransport(next: TransportFn | null): void { customTransport = next; }
+export function __setTelemetryEndpointForTest(endpoint: string | null): void { setEndpointForTest(endpoint); }
+export function __resetTelemetryForTest(): void {
+  abortActive(); active = undefined; activeDone = undefined;
+  if (scheduled) clearImmediate(scheduled);
+  if (hubTimer) clearInterval(hubTimer);
+  scheduled = undefined; hubTimer = undefined; hubUsers = 0; cliBatchAttempted = false; stateHome = undefined;
+  customTransport = null; closeOutbox(); setEndpointForTest(null);
 }
diff --git a/src/telemetry/outbox.ts b/src/telemetry/outbox.ts
new file mode 100644
index 00000000..750e822f
--- /dev/null
+++ b/src/telemetry/outbox.ts
@@ -0,0 +1,193 @@
+/** Small per-user queue. SQLite's OS locks disappear on process exit; no lockfiles. */
+import { closeSync, constants, lstatSync, mkdirSync, openSync, readSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+import { ensureMexHomeDir, mexHomeDir } from "../global-config.js";
+import { openSqlite, type SqliteDatabase } from "../graph/db/sqlite.js";
+import { type TelemetryEvent, validateStoredEvent } from "./schema.js";
+
+export const OUTBOX_LIMITS = Object.freeze({
+  events: 256, bytes: 256 * 1024, eventBytes: 2048, databaseBytes: 1024 * 1024,
+  ageMs: 7 * 24 * 60 * 60 * 1000, batchEvents: 32, leaseMs: 5000,
+});
+const TABLE_SQL = "CREATE TABLE events (uuid TEXT PRIMARY KEY, occurred INTEGER NOT NULL, payload TEXT NOT NULL, lease TEXT, lease_until INTEGER NOT NULL DEFAULT 0)";
+interface FileIdentity { dev: bigint; ino: bigint; }
+interface QueueHandle { path: string; db: SqliteDatabase; identity: FileIdentity; directory: FileIdentity; }
+export interface DeliveryBatch { token: string; events: TelemetryEvent[]; queue: QueueHandle; }
+let cached: QueueHandle | undefined;
+
+function identity(path: string, directory = false): FileIdentity {
+  const stat = lstatSync(path, { bigint: true });
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1n)) throw new Error("Unsafe telemetry path");
+  if (!directory && stat.size > BigInt(OUTBOX_LIMITS.databaseBytes)) throw new Error("Telemetry store too large");
+  return { dev: stat.dev, ino: stat.ino };
+}
+function same(a: FileIdentity, b: FileIdentity): boolean { return a.dev === b.dev && a.ino === b.ino; }
+function validSchema(db: SqliteDatabase, allowEmpty = false): boolean {
+  const rows = db.prepare("SELECT name,type,sql FROM sqlite_schema WHERE name NOT GLOB 'sqlite_*' ORDER BY name LIMIT 3").all() as Array<{ name: string; type: string; sql: string }>;
+  return (allowEmpty && rows.length === 0) || (rows.length === 1 && rows[0].name === "events" && rows[0].type === "table" && rows[0].sql === TABLE_SQL);
+}
+function safeStorePath(create: boolean): string | undefined {
+  const base = mexHomeDir();
+  try {
+    if (create) ensureMexHomeDir();
+    identity(base, true);
+    const directory = join(base, "telemetry");
+    if (create) {
+      try { mkdirSync(directory, { mode: 0o700 }); }
+      catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
+    }
+    identity(directory, true);
+    const path = join(directory, "outbox.db");
+    for (const suffix of ["-journal", "-wal", "-shm"]) {
+      try { identity(path + suffix); }
+      catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+    }
+    if (create) {
+      try { closeSync(openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o600)); }
+      catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
+    }
+    identity(path);
+    // Reject obviously non-SQLite files before handing a filename to native code.
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+    try {
+      const header = Buffer.alloc(16);
+      const count = readSync(fd, header, 0, header.length, 0);
+      if (count !== 0 && (count !== 16 || header.toString("binary") !== "SQLite format 3\0")) throw new Error("Invalid telemetry store");
+      if (!create && count === 0) return undefined;
+    } finally { closeSync(fd); }
+    return path;
+  } catch { return undefined; }
+}
+function validHandle(queue: QueueHandle): boolean {
+  try { return queue.db.open && same(queue.identity, identity(queue.path)) && same(queue.directory, identity(join(mexHomeDir(), "telemetry"), true)); }
+  catch { return false; }
+}
+
+export function closeOutbox(): void {
+  try { cached?.db.close(); } catch { /* best effort */ }
+  cached = undefined;
+}
+
+function getQueue(create = true): QueueHandle | undefined {
+  const path = safeStorePath(create);
+  if (!path) { closeOutbox(); return undefined; }
+  if (cached && cached.path === path && validHandle(cached)) return cached;
+  closeOutbox();
+  let db: SqliteDatabase | undefined;
+  try {
+    const file = identity(path);
+    const directory = identity(join(mexHomeDir(), "telemetry"), true);
+    db = openSqlite(path);
+    // Never wait on another invocation or fsync product execution for analytics.
+    // DELETE journals recover interrupted transactions; a power failure may lose
+    // telemetry (synchronous=OFF). No WAL/shm growth or background checkpointing.
+    db.exec("PRAGMA busy_timeout=0; PRAGMA trusted_schema=OFF;");
+    if (!validSchema(db, create)) throw new Error("Unknown telemetry schema");
+    const page = db.prepare("PRAGMA page_size").get() as { page_size: number };
+    if (!Number.isSafeInteger(page.page_size) || page.page_size < 512 || page.page_size > 65536) throw new Error("Invalid telemetry page size");
+    db.exec(`PRAGMA journal_mode=DELETE; PRAGMA synchronous=OFF; PRAGMA secure_delete=ON; PRAGMA max_page_count=${Math.floor(OUTBOX_LIMITS.databaseBytes / page.page_size)};`);
+    if (!same(file, identity(path)) || !same(directory, identity(join(mexHomeDir(), "telemetry"), true))) throw new Error("Telemetry store replaced");
+    db.exec("BEGIN IMMEDIATE");
+    try {
+      const rows = db.prepare("SELECT name, type, sql FROM sqlite_schema WHERE name NOT GLOB 'sqlite_*' ORDER BY name LIMIT 3").all() as Array<{ name: string; type: string; sql: string }>;
+      if (rows.length === 0) db.exec(TABLE_SQL);
+      else if (rows.length !== 1 || rows[0].name !== "events" || rows[0].type !== "table" || rows[0].sql !== TABLE_SQL) throw new Error("Unknown telemetry schema");
+      db.exec("COMMIT");
+    } catch (error) { db.exec("ROLLBACK"); throw error; }
+    cached = { path, db, identity: file, directory };
+    return cached;
+  } catch { try { db?.close(); } catch { /* best effort */ } return undefined; }
+}
+
+function transaction<T>(queue: QueueHandle, body: () => T): T | undefined {
+  try {
+    if (!validHandle(queue) || !validSchema(queue.db)) return undefined;
+    queue.db.exec("BEGIN IMMEDIATE");
+    try { const result = body(); queue.db.exec("COMMIT"); return result; }
+    catch { queue.db.exec("ROLLBACK"); }
+  } catch { /* A busy queue drops work instead of blocking a command. */ }
+  return undefined;
+}
+
+export function enqueue(event: TelemetryEvent, now = Date.now()): boolean {
+  if (!validateStoredEvent(event)) return false;
+  const serialized = JSON.stringify(event);
+  const bytes = Buffer.byteLength(serialized);
+  if (bytes > OUTBOX_LIMITS.eventBytes) return false;
+  const queue = getQueue();
+  if (!queue) return false;
+  return transaction(queue, () => {
+    queue.db.prepare("DELETE FROM events WHERE occurred < ? OR occurred > ? OR length(CAST(payload AS BLOB)) > ?")
+      .run(now - OUTBOX_LIMITS.ageMs, now + 60_000, OUTBOX_LIMITS.eventBytes);
+    queue.db.prepare("INSERT OR IGNORE INTO events(uuid,occurred,payload) VALUES(?,?,?)").run(event.uuid, Date.parse(event.timestamp), serialized);
+    // Bound both retained events and serialized payload bytes, in one transaction.
+    queue.db.prepare("DELETE FROM events WHERE rowid NOT IN (SELECT rowid FROM events ORDER BY occurred DESC,rowid DESC LIMIT ?)").run(OUTBOX_LIMITS.events);
+    const rows = queue.db.prepare("SELECT uuid,length(CAST(payload AS BLOB)) AS bytes FROM events ORDER BY occurred DESC, rowid DESC LIMIT ?").all(OUTBOX_LIMITS.events) as Array<{ uuid: string; bytes: number }>;
+    let total = 0;
+    for (let i = 0; i < rows.length; i++) {
+      total += rows[i].bytes;
+      if (i >= OUTBOX_LIMITS.events || total > OUTBOX_LIMITS.bytes) queue.db.prepare("DELETE FROM events WHERE uuid=?").run(rows[i].uuid);
+    }
+    return true;
+  }) === true;
+}
+
+export function claimBatch(now = Date.now()): DeliveryBatch | undefined {
+  const queue = getQueue(false);
+  if (!queue) return undefined;
+  return transaction(queue, () => {
+    queue.db.prepare("DELETE FROM events WHERE occurred < ? OR occurred > ? OR length(CAST(payload AS BLOB)) > ?")
+      .run(now - OUTBOX_LIMITS.ageMs, now + 60_000, OUTBOX_LIMITS.eventBytes);
+    // A crash releases the SQLite lock. Its delivery claim expires independently.
+    queue.db.prepare("UPDATE events SET lease=NULL, lease_until=0 WHERE lease_until > ?").run(now + OUTBOX_LIMITS.leaseMs);
+    const rows = queue.db.prepare("SELECT uuid,occurred,payload FROM events WHERE lease_until<=? ORDER BY occurred,rowid LIMIT ?")
+      .all(now, OUTBOX_LIMITS.batchEvents) as Array<{ uuid: string; occurred: number; payload: string }>;
+    const events: TelemetryEvent[] = [];
+    const token = randomUUID();
+    for (const row of rows) {
+      let value: unknown;
+      try { value = JSON.parse(row.payload); } catch { /* invalid local data */ }
+      if (!validateStoredEvent(value) || value.uuid !== row.uuid || Date.parse(value.timestamp) !== row.occurred) { queue.db.prepare("DELETE FROM events WHERE uuid=?").run(row.uuid); continue; }
+      events.push(value);
+      queue.db.prepare("UPDATE events SET lease=?,lease_until=? WHERE uuid=?").run(token, now + OUTBOX_LIMITS.leaseMs, row.uuid);
+    }
+    return events.length ? { token, events, queue } : undefined;
+  });
+}
+
+export function finishBatch(batch: DeliveryBatch, delivered: boolean): void {
+  transaction(batch.queue, () => {
+    if (delivered) batch.queue.db.prepare("DELETE FROM events WHERE lease=?").run(batch.token);
+    else batch.queue.db.prepare("UPDATE events SET lease=NULL,lease_until=0 WHERE lease=?").run(batch.token);
+  });
+}
+
+/** Explicit opt-out only. Never initializes a missing store. */
+export function purgeOutbox(): boolean {
+  const queue = getQueue(false);
+  const cleared = queue ? transaction(queue, () => { queue.db.exec("DELETE FROM events"); return true; }) === true : inspectOutbox().state === "absent";
+  closeOutbox();
+  return cleared;
+}
+
+export interface OutboxInspection { state: "absent" | "available" | "unavailable"; events: number | null; bytes: number | null; }
+export function inspectOutbox(): OutboxInspection {
+  const path = safeStorePath(false);
+  if (!path) {
+    try { lstatSync(join(mexHomeDir(), "telemetry", "outbox.db")); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return { state: "absent", events: 0, bytes: 0 }; }
+    return { state: "unavailable", events: null, bytes: null };
+  }
+  let db: SqliteDatabase | undefined;
+  try {
+    // immutable=1 prevents journal recovery or sidecar creation on an audit read.
+    db = openSqlite(path, { readOnly: true, immutable: true });
+    db.exec("PRAGMA trusted_schema=OFF;");
+    if (!validSchema(db)) throw new Error("Unknown telemetry schema");
+    const row = db.prepare("SELECT count(*) AS events,coalesce(sum(length(CAST(payload AS BLOB))),0) AS bytes FROM events").get() as { events: number; bytes: number };
+    if (row.events > OUTBOX_LIMITS.events || row.bytes > OUTBOX_LIMITS.bytes) throw new Error("Invalid telemetry queue bounds");
+    return { state: "available", events: row.events, bytes: row.bytes };
+  } catch { return { state: "unavailable", events: null, bytes: null }; }
+  finally { try { db?.close(); } catch { /* best effort */ } }
+}
diff --git a/src/telemetry/project-context.ts b/src/telemetry/project-context.ts
new file mode 100644
index 00000000..21d94b2d
--- /dev/null
+++ b/src/telemetry/project-context.ts
@@ -0,0 +1,88 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
+import type { BigIntStats } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { TELEMETRY_AI_TOOLS } from "./schema.js";
+import type { TelemetryAiTool, TelemetryProjectContext } from "./schema.js";
+
+const MAX_CONFIG_BYTES = 64 * 1024;
+const MAX_ANCESTORS = 64;
+const CONFIGURED_AI_TOOLS = new Set<string>(TELEMETRY_AI_TOOLS);
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+
+function sameIdentity(left: BigIntStats, right: BigIntStats): boolean {
+  return left.dev === right.dev && left.ino === right.ino;
+}
+
+function sameFile(left: BigIntStats, right: BigIntStats): boolean {
+  return right.isFile() && right.nlink === 1n && sameIdentity(left, right)
+    && left.size === right.size && left.mtimeNs === right.mtimeNs && left.ctimeNs === right.ctimeNs;
+}
+
+/** Match either the supplied Graph/Hub root or findConfig's nearest Git root. */
+function projectRoot(startDir: string, discovery: "git-root" | "exact"): string | undefined {
+  const start = realpathSync(resolve(startDir));
+  if (start.split(/[\\/]/).includes(".mex")) return undefined;
+  if (discovery === "exact") return start;
+  let current = start;
+  for (let visited = 0; visited < MAX_ANCESTORS; visited++) {
+    try {
+      const marker = lstatSync(join(current, ".git"));
+      // A worktree/submodule .git file is sufficient; its contents are private.
+      return marker.isDirectory() || marker.isFile() ? current : undefined;
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") return undefined;
+    }
+    const parent = dirname(current);
+    if (parent === current) return start;
+    current = parent;
+  }
+  return undefined;
+}
+
+/**
+ * Read a bounded snapshot of existing project metadata. Callers own snapshot
+ * lifetime (one eligible CLI invocation or Hub server); no cache or project
+ * state is created here. Every unavailable/unsafe observation quietly omits it.
+ */
+export function readTelemetryProjectContext(startDir: string, discovery: "git-root" | "exact" = "git-root"): TelemetryProjectContext {
+  try {
+    const root = projectRoot(startDir, discovery);
+    if (!root) return {};
+    const rootBefore = lstatSync(root, { bigint: true });
+    if (!rootBefore.isDirectory() || rootBefore.isSymbolicLink()) return {};
+    const scaffold = join(root, ".mex");
+    const scaffoldBefore = lstatSync(scaffold, { bigint: true });
+    if (!scaffoldBefore.isDirectory() || scaffoldBefore.isSymbolicLink() || realpathSync(scaffold) !== scaffold) return {};
+
+    const path = join(scaffold, "config.json");
+    const before = lstatSync(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1n || before.size > MAX_CONFIG_BYTES) return {};
+    const fd = openSync(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
+    try {
+      const opened = fstatSync(fd, { bigint: true });
+      if (!sameFile(before, opened) || opened.size > MAX_CONFIG_BYTES) return {};
+      const bytes = Buffer.alloc(Number(opened.size) + 1);
+      const length = readSync(fd, bytes, 0, bytes.length, 0);
+      if (BigInt(length) !== opened.size || !sameFile(opened, fstatSync(fd, { bigint: true }))) return {};
+      if (!sameFile(opened, lstatSync(path, { bigint: true }))) return {};
+      if (!sameIdentity(rootBefore, lstatSync(root, { bigint: true }))
+        || !sameIdentity(scaffoldBefore, lstatSync(scaffold, { bigint: true }))
+        || realpathSync(scaffold) !== scaffold) return {};
+
+      const raw: unknown = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes.subarray(0, length)));
+      if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return {};
+      const config = raw as Record<string, unknown>;
+      const result: TelemetryProjectContext = {};
+      if (typeof config.scaffold_id === "string" && config.scaffold_id.length === 36 && UUID_V4.test(config.scaffold_id)) {
+        result.scaffold_id = config.scaffold_id;
+      }
+      if (Array.isArray(config.aiTools)) {
+        const tools = [...new Set(config.aiTools.filter((tool): tool is TelemetryAiTool => typeof tool === "string" && CONFIGURED_AI_TOOLS.has(tool)))].sort();
+        if (tools.length > 0 || config.aiTools.length === 0) result.configured_ai_tools = tools;
+      }
+      return result;
+    } finally { closeSync(fd); }
+  } catch {
+    return {};
+  }
+}
diff --git a/src/telemetry/schema.ts b/src/telemetry/schema.ts
new file mode 100644
index 00000000..605b36df
--- /dev/null
+++ b/src/telemetry/schema.ts
@@ -0,0 +1,161 @@
+/** The entire telemetry vocabulary. No caller data is spread into an event. */
+import { platform } from "node:os";
+import { randomUUID } from "node:crypto";
+import { VERSION } from "../version.js";
+import { isTelemetryId } from "../global-config.js";
+
+export const TELEMETRY_EVENTS = [
+  "cli.command_started", "cli.command_completed", "hub.session_started",
+  "hub.page_viewed", "hub.action_completed", "hub.job_completed",
+] as const;
+export type TelemetryEventName = typeof TELEMETRY_EVENTS[number];
+export const TELEMETRY_COMMANDS = [
+  "mex", "setup", "init", "check", "graph", "graph.status", "graph.refresh", "graph.rebuild",
+  "graph.query", "graph.scope", "graph.get", "graph.repair", "graph.ground",
+  "wiki.list", "wiki.show", "wiki.query", "wiki.related", "wiki.backlinks", "wiki.validate",
+  "wiki.graph", "wiki.rebuild-index", "wiki.regenerate-views", "wiki.migrate", "wiki.apply",
+  "wiki.build", "wiki.prepare", "wiki.propose", "wiki.for-code", "impact", "log", "heartbeat",
+  "doctor", "sync", "pattern.add", "watch", "completion", "feedback", "commands", "tui",
+  "member.add", "member.update", "member.deactivate", "member.reactivate", "member.select",
+  "activity.record", "workstream.create", "workstream.update", "workstream.archive",
+  "inbox.draft.save", "inbox.draft.delete", "inbox.publish", "inbox.proposal.approve",
+  "inbox.proposal.reject", "inbox.proposal.withdraw", "inbox.proposal.mark-stale", "inbox.proposal.repair",
+  "relay.draft.save", "relay.draft.delete", "relay.publish", "relay.acknowledge", "relay.close",
+] as const;
+export const TELEMETRY_PAGES = [
+  "home", "search", "knowledge", "knowledge_detail", "code", "code_symbol", "workstreams",
+  "specs", "spec_detail", "playbooks", "catch_up", "inbox", "relays", "members", "activity",
+  "jobs", "health", "settings", "not_found",
+] as const;
+export const TELEMETRY_ACTIONS = [
+  "member.add", "member.update", "member.deactivate", "member.reactivate", "member.select", "member.clear",
+  "workstream.create", "workstream.update", "workstream.archive", "activity.record",
+  "inbox.draft.save", "inbox.draft.delete", "inbox.publish", "inbox.approve", "inbox.reject",
+  "inbox.withdraw", "inbox.mark-stale", "inbox.repair", "relay.draft.save", "relay.draft.delete",
+  "relay.publish", "relay.acknowledge", "relay.close", "job.start", "job.cancel", "settings.logging.update",
+] as const;
+export const TELEMETRY_JOB_KINDS = ["graph_refresh", "graph_rebuild", "wiki_refresh", "wiki_rebuild"] as const;
+export const TELEMETRY_OUTCOMES = ["success", "failure", "cancelled"] as const;
+export const TELEMETRY_STAGES = ["preview", "apply", "direct"] as const;
+/** Persisted tool selections, never a claim about the agent invoking a command. */
+export const TELEMETRY_AI_TOOLS = ["claude", "codex", "copilot", "cursor", "opencode", "windsurf"] as const;
+export type TelemetryAiTool = typeof TELEMETRY_AI_TOOLS[number];
+export interface TelemetryProjectContext {
+  scaffold_id?: string;
+  configured_ai_tools?: TelemetryAiTool[];
+}
+
+/** Strings are checked against the catalog at runtime, including data read from disk. */
+export interface TelemetryAttributes extends TelemetryProjectContext {
+  command?: string;
+  page?: string;
+  action?: string;
+  job_kind?: string;
+  outcome?: "success" | "failure" | "cancelled";
+  stage?: "preview" | "apply" | "direct";
+  duration_ms?: number;
+  replayed?: boolean;
+}
+export type TelemetryProperties = Record<string, string | number | boolean | string[]>;
+export interface TelemetryEvent {
+  event: TelemetryEventName;
+  uuid: string;
+  timestamp: string;
+  distinct_id: string;
+  properties: TelemetryProperties;
+}
+
+const includes = (values: readonly string[], value: unknown): value is string =>
+  typeof value === "string" && values.includes(value);
+const plain = (value: unknown): value is Record<string, unknown> =>
+  value !== null && typeof value === "object" && !Array.isArray(value)
+  && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+
+function configuredAiTools(value: unknown): value is TelemetryAiTool[] {
+  if (!Array.isArray(value) || value.length > TELEMETRY_AI_TOOLS.length) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    if (!Object.hasOwn(value, index) || !includes(TELEMETRY_AI_TOOLS, value[index])
+      || (index > 0 && value[index - 1] >= value[index])) return false;
+  }
+  return true;
+}
+
+export function eventAttributes(name: string, value: unknown): TelemetryAttributes | undefined {
+  if (!includes(TELEMETRY_EVENTS, name) || !plain(value)) return undefined;
+  let required: string[];
+  let optional: string[] = [];
+  if (name === "cli.command_started") { required = ["command"]; optional = ["stage"]; }
+  else if (name === "cli.command_completed") { required = ["command", "outcome", "duration_ms"]; optional = ["stage"]; }
+  else if (name === "hub.page_viewed") required = ["page"];
+  else if (name === "hub.action_completed") { required = ["action", "stage", "outcome", "duration_ms"]; optional = ["replayed"]; }
+  else if (name === "hub.job_completed") required = ["job_kind", "outcome", "duration_ms"];
+  else required = [];
+  optional.push("scaffold_id", "configured_ai_tools");
+  if (Object.keys(value).some((key) => !required.includes(key) && !optional.includes(key))) return undefined;
+  if (required.some((key) => !Object.hasOwn(value, key) || value[key] === undefined)) return undefined;
+  if (value.scaffold_id !== undefined && (!isTelemetryId(value.scaffold_id) || value.scaffold_id.length !== 36)) return undefined;
+  if (value.configured_ai_tools !== undefined && !configuredAiTools(value.configured_ai_tools)) return undefined;
+  if (value.command !== undefined && !includes(TELEMETRY_COMMANDS, value.command)) return undefined;
+  if (value.page !== undefined && !includes(TELEMETRY_PAGES, value.page)) return undefined;
+  if (value.action !== undefined && !includes(TELEMETRY_ACTIONS, value.action)) return undefined;
+  if (value.job_kind !== undefined && !includes(TELEMETRY_JOB_KINDS, value.job_kind)) return undefined;
+  if (value.outcome !== undefined && !includes(TELEMETRY_OUTCOMES, value.outcome)) return undefined;
+  if (value.stage !== undefined && !includes(TELEMETRY_STAGES, value.stage)) return undefined;
+  if (value.replayed !== undefined && (typeof value.replayed !== "boolean" || value.stage !== "apply")) return undefined;
+  if (value.duration_ms !== undefined && (typeof value.duration_ms !== "number"
+    || !Number.isFinite(value.duration_ms) || value.duration_ms < 0 || value.duration_ms > 86_400_000)) return undefined;
+  const projected: TelemetryProperties = {};
+  for (const key of [...required, ...optional]) {
+    const item = value[key];
+    if (item === undefined) continue;
+    if (key === "configured_ai_tools") projected[key] = [...item as TelemetryAiTool[]];
+    else projected[key] = key === "duration_ms" ? Math.floor(item as number) : item as string | boolean;
+  }
+  return projected as TelemetryAttributes;
+}
+
+function properties(name: TelemetryEventName, attributes: TelemetryAttributes, installationId: string): TelemetryProperties {
+  return {
+    schema_version: 2,
+    source: name.startsWith("cli.") ? "cli" : "hub",
+    installation_id: installationId,
+    mex_version: VERSION,
+    os: platform(),
+    node_version: process.version,
+    // API events default to identified; explicitly disable profile creation and GeoIP.
+    $process_person_profile: false,
+    $geoip_disable: true,
+    ...attributes,
+  };
+}
+
+export function makeEvent(name: TelemetryEventName, value: unknown, installationId: string, now = Date.now()): TelemetryEvent | undefined {
+  const attributes = eventAttributes(name, value);
+  if (!attributes || !isTelemetryId(installationId)) return undefined;
+  return { event: name, uuid: randomUUID(), timestamp: new Date(now).toISOString(), distinct_id: installationId,
+    properties: properties(name, attributes, installationId) };
+}
+
+/** Revalidate every persisted byte before sending. Invalid/extra fields never escape. */
+export function validateStoredEvent(value: unknown): value is TelemetryEvent {
+  if (!plain(value) || Object.keys(value).sort().join() !== "distinct_id,event,properties,timestamp,uuid"
+    || !includes(TELEMETRY_EVENTS, value.event) || !isTelemetryId(value.uuid) || !isTelemetryId(value.distinct_id)
+    || typeof value.timestamp !== "string" || !/^\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d\.\d{3}Z$/.test(value.timestamp)
+    || !Number.isFinite(Date.parse(value.timestamp)) || !plain(value.properties)) return false;
+  const p = value.properties;
+  const base = ["schema_version", "source", "installation_id", "mex_version", "os", "node_version", "$process_person_profile", "$geoip_disable"];
+  if (p.schema_version !== 2 || p.source !== (value.event.startsWith("cli.") ? "cli" : "hub")
+    || p.installation_id !== value.distinct_id || p.$process_person_profile !== false || p.$geoip_disable !== true
+    || typeof p.mex_version !== "string" || !/^\d+\.\d+\.\d+(?:-[a-z0-9.-]+)?$/.test(p.mex_version)
+    || typeof p.node_version !== "string" || !/^v\d+\.\d+\.\d+$/.test(p.node_version)
+    || !includes(["aix", "android", "darwin", "freebsd", "linux", "openbsd", "sunos", "win32"], p.os)) return false;
+  const attributes = Object.fromEntries(Object.entries(p).filter(([key]) => !base.includes(key)));
+  return eventAttributes(value.event, attributes) !== undefined;
+}
+
+/** Symbolic examples intentionally do not generate a UUID or read/write identity. */
+export function previewEvent(name: TelemetryEventName, attributes: TelemetryAttributes, installationId?: string): Record<string, unknown> {
+  const id = isTelemetryId(installationId) ? installationId : "<installation UUID; not created by inspect>";
+  return { event: name, uuid: "<event UUID>", timestamp: "<original event time in UTC>", distinct_id: id,
+    properties: properties(name, eventAttributes(name, attributes) ?? {}, id) };
+}
diff --git a/src/telemetry/transport.ts b/src/telemetry/transport.ts
new file mode 100644
index 00000000..b8086785
--- /dev/null
+++ b/src/telemetry/transport.ts
@@ -0,0 +1,95 @@
+/** Fixed PostHog ingestion only; no SDK timers, retries, console output or redirects. */
+import { request as httpsRequest } from "node:https";
+import { request as httpRequest, type ClientRequest, type IncomingMessage } from "node:http";
+import { Resolver } from "node:dns";
+import type { LookupFunction } from "node:net";
+import type { TelemetryEvent } from "./schema.js";
+
+const PROJECT_TOKEN = "phc_wdwbBPQMrM6vKWMzz5yqWT357i2hSjMhnAvCuofJdMpg";
+export const TELEMETRY_ENDPOINT = "https://us.i.posthog.com/batch/";
+export const REQUEST_TIMEOUT_MS = 2000;
+let testEndpoint: URL | undefined;
+
+/** Programmatic test seam only; never controlled by command arguments or config. */
+export function setEndpointForTest(value: string | null): void {
+  if (value === null) { testEndpoint = undefined; return; }
+  const url = new URL(value);
+  if (url.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(url.hostname)
+    || !url.port || url.username || url.password || url.pathname !== "/batch/" || url.search || url.hash) {
+    throw new Error("Telemetry tests require an explicit loopback batch endpoint");
+  }
+  testEndpoint = url;
+}
+
+export interface BatchRequest { done: Promise<boolean>; abort(): void; }
+export function sendBatch(events: readonly TelemetryEvent[]): BatchRequest {
+  let request: ClientRequest | undefined;
+  let response: IncomingMessage | undefined;
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  let resolver: Resolver | undefined;
+  let settle!: (delivered: boolean) => void;
+  let settled = false;
+  const done = new Promise<boolean>((resolve) => { settle = resolve; });
+  const finish = (delivered: boolean): void => {
+    if (settled) return;
+    settled = true;
+    if (timer) clearTimeout(timer);
+    resolver?.cancel();
+    response?.destroy();
+    request?.destroy();
+    settle(delivered);
+  };
+  try {
+    const endpoint = testEndpoint ?? new URL(TELEMETRY_ENDPOINT);
+    const payload = JSON.stringify({ api_key: PROJECT_TOKEN, batch: events });
+    // A dedicated cancellable resolver avoids an outstanding OS getaddrinfo job
+    // keeping a short-lived CLI alive after its HTTP request has been destroyed.
+    // Failure to resolve IPv4 simply retains the batch for a later invocation.
+    let lookup: LookupFunction | undefined;
+    if (endpoint.protocol === "https:") {
+      resolver = new Resolver({ timeout: REQUEST_TIMEOUT_MS, tries: 1 });
+      lookup = (hostname, _options, callback) => {
+        resolver!.resolve4(hostname, (error, addresses) => {
+          if (error || !addresses?.length) callback(error ?? new Error("No telemetry address"), "", 4);
+          else callback(null, addresses[0], 4);
+        });
+      };
+    }
+    const send = endpoint.protocol === "http:" ? httpRequest : httpsRequest;
+    request = send(endpoint, {
+      method: "POST", agent: false, family: 4, lookup,
+      headers: { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(payload) },
+    }, (incoming) => {
+      response = incoming;
+      let size = 0;
+      let body = "";
+      incoming.setEncoding("utf8");
+      incoming.on("data", (part: string) => {
+        size += Buffer.byteLength(part);
+        if (size > 4096) { finish(false); return; }
+        body += part;
+      });
+      incoming.on("end", () => {
+        // 2xx acknowledges the batch. PostHog currently returns {status:1};
+        // a body explicitly reporting failure must never discard queued events.
+        let rejected = false;
+        try {
+          const result: unknown = body ? JSON.parse(body) : undefined;
+          rejected = typeof result === "object" && result !== null && "status" in result
+            && ![1, "1"].includes((result as { status: number | string }).status);
+        } catch { /* HTTP status remains the delivery acknowledgement. */ }
+        finish((incoming.statusCode ?? 0) >= 200 && (incoming.statusCode ?? 0) < 300 && !rejected);
+      });
+      incoming.on("error", () => finish(false));
+      incoming.on("aborted", () => finish(false));
+    });
+    request.on("error", () => finish(false));
+    // Requests may progress while the command works, but are never a reason to
+    // keep an otherwise finished process alive. flush() supplies its own grace.
+    request.on("socket", (socket) => socket.unref());
+    timer = setTimeout(() => finish(false), REQUEST_TIMEOUT_MS);
+    timer.unref();
+    request.end(payload);
+  } catch { finish(false); }
+  return { done, abort: () => finish(false) };
+}
diff --git a/test/capabilities.test.ts b/test/capabilities.test.ts
index efe0eaf8..1fb88f77 100644
--- a/test/capabilities.test.ts
+++ b/test/capabilities.test.ts
@@ -1259,13 +1259,15 @@ describe("mex capabilities manifest", () => {
     expect(capabilities?.options.map((option) => option.long)).toEqual(["--json"]);
     expect(isTelemetryExemptCommand("capabilities", "mex")).toBe(true);
     expect(isTelemetryExemptCommand("list", "member")).toBe(true);
-    expect(isTelemetryExemptCommand("record", "activity")).toBe(true);
+    expect(isTelemetryExemptCommand("record", "activity")).toBe(false);
     expect(isTelemetryExemptCommand("list", "workstream")).toBe(true);
     expect(isTelemetryExemptCommand("save", "draft")).toBe(true);
     expect(isTelemetryExemptCommand("approve", "proposal")).toBe(true);
     expect(isTelemetryExemptCommand("list", "relay")).toBe(true);
     expect(isTelemetryExemptCommand("list", "spec")).toBe(true);
     expect(isTelemetryExemptCommand("sync", "skills")).toBe(true);
+    expect(isFirstRunNoticeExemptCommand("telemetry")).toBe(true);
+    expect(isFirstRunNoticeExemptCommand("config")).toBe(true);
     expect(isFirstRunNoticeExemptCommand("capabilities")).toBe(true);
     expect(isFirstRunNoticeExemptCommand("member")).toBe(true);
     expect(isFirstRunNoticeExemptCommand("activity")).toBe(true);
diff --git a/test/cli-telemetry.test.ts b/test/cli-telemetry.test.ts
new file mode 100644
index 00000000..b4188768
--- /dev/null
+++ b/test/cli-telemetry.test.ts
@@ -0,0 +1,145 @@
+import { Command } from "commander";
+import { describe, expect, it, vi } from "vitest";
+import { createCliTelemetry, isTelemetryExemptCommand, telemetryProjectLocation } from "../src/cli-telemetry.js";
+
+describe("CLI invocation telemetry", () => {
+  it.each(["status", "refresh", "rebuild", "repair"])("honors parent and local --root for graph %s", async (name) => {
+    for (const [args, expected] of [
+      [["graph", "--root", "/parent", name], "/parent"],
+      [["graph", "--root", "/parent", name, "--root", "/selected"], "/selected"],
+      [["graph", name], "/cwd"],
+    ] as const) {
+      const root = new Command("mex");
+      const command = root.command("graph").option("--root <dir>").command(name).option("--root <dir>").action(() => {});
+      await root.parseAsync([...args], { from: "user" });
+      expect(telemetryProjectLocation(command, "/cwd")).toEqual({ root: expected, discovery: "exact" });
+    }
+  });
+
+  it("uses exact cwd for legacy graph but ordinary Git discovery for query commands", async () => {
+    const root = new Command("mex");
+    const graph = root.command("graph").option("--root <dir>");
+    const query = graph.command("query").action(() => {});
+    expect(telemetryProjectLocation(graph, "/cwd")).toEqual({ root: "/cwd", discovery: "exact" });
+    await root.parseAsync(["graph", "--root", "/unused", "query"], { from: "user" });
+    expect(telemetryProjectLocation(query, "/cwd")).toEqual({ root: "/cwd", discovery: "git-root" });
+    expect(telemetryProjectLocation(graph, "/cwd")).toEqual({ root: "/unused", discovery: "exact" });
+  });
+
+  it("uses the registered namespaced command and excludes input and output", async () => {
+    const capture = vi.fn();
+    const flush = vi.fn(async () => {});
+    let now = 100;
+    const telemetry = createCliTelemetry(capture, flush, () => now);
+    const root = new Command("mex");
+    const command = root.command("wiki").command("query <text>").option("--json").action(() => { now = 137.9; });
+    root.hook("preAction", (_, action) => telemetry.start(action));
+    root.hook("postAction", () => telemetry.finish(0));
+    await root.parseAsync(["wiki", "query", "private customer@example.com query", "--json"], { from: "user" });
+    expect(command.args).toHaveLength(1);
+    expect(capture.mock.calls).toEqual([
+      ["cli.command_started", { command: "wiki.query", stage: "direct" }],
+      ["cli.command_completed", { command: "wiki.query", stage: "direct", outcome: "success", duration_ms: 37 }],
+    ]);
+    await telemetry.finish(0);
+    expect(flush).toHaveBeenCalledTimes(1);
+  });
+
+  it("records a thrown action once during cleanup without capturing the error", async () => {
+    const capture = vi.fn();
+    const telemetry = createCliTelemetry(capture, async () => {}, () => 0);
+    const root = new Command("mex");
+    root.command("check").action(() => { throw new Error("secret path /Users/private"); });
+    root.hook("preAction", (_, action) => telemetry.start(action));
+    root.hook("postAction", () => telemetry.finish(0));
+    await expect(root.parseAsync(["check"], { from: "user" })).rejects.toThrow();
+    await telemetry.finish(1);
+    await telemetry.finish(1);
+    expect(capture.mock.calls).toEqual([
+      ["cli.command_started", { command: "check", stage: "direct" }],
+      ["cli.command_completed", { command: "check", stage: "direct", outcome: "failure", duration_ms: 0 }],
+    ]);
+  });
+
+  it.each([
+    [[], "preview"],
+    [["--apply", "/private/receipt.json"], "apply"],
+    [["--from", "/private/draft.json"], "direct"],
+  ])("distinguishes Relay preview, approved apply, and quick local save: %j", async (args, stage) => {
+    const capture = vi.fn();
+    const telemetry = createCliTelemetry(capture, async () => {}, () => 0);
+    const root = new Command("mex");
+    root.command("relay").command("draft").command("save")
+      .option("--apply <receipt>").option("--from <draft>").action(() => {});
+    root.hook("preAction", (_, action) => telemetry.start(action));
+    root.hook("postAction", () => telemetry.finish(0));
+    await root.parseAsync(["relay", "draft", "save", ...args], { from: "user" });
+    expect(capture.mock.calls[1]).toEqual(["cli.command_completed", {
+      command: "relay.draft.save", stage, outcome: "success", duration_ms: 0,
+    }]);
+  });
+
+  it.each(["capabilities", "logging", "timeline", "hub", "telemetry.inspect", "member.list", "inbox.contract", "relay.draft.show", "new-private-command"])(
+    "keeps pure discovery, Hub bootstrap, meta and unknown commands silent: %s", async (path) => {
+      const root = new Command("mex");
+      const command = path.split(".").reduce((parent, name) => parent.command(name), root);
+      const capture = vi.fn();
+      const flush = vi.fn(async () => {});
+      const telemetry = createCliTelemetry(capture, flush);
+      telemetry.start(command);
+      await telemetry.finish(0);
+      expect(capture).not.toHaveBeenCalled();
+      expect(flush).not.toHaveBeenCalled();
+      expect(isTelemetryExemptCommand(command.name(), command.parent?.name(), path)).toBe(true);
+    },
+  );
+
+  it("reads one context snapshot for both events of an ordinary invocation", async () => {
+    const command = new Command("mex").command("wiki").command("query");
+    const readContext = vi.fn(() => ({ configured_ai_tools: ["codex" as const] }));
+    const capture = vi.fn();
+    const telemetry = createCliTelemetry(capture, async () => {}, () => 0, readContext);
+    telemetry.start(command);
+    await telemetry.finish(0);
+    expect(readContext).toHaveBeenCalledExactlyOnceWith(command);
+    expect(capture.mock.calls.map(([, attributes]) => attributes.configured_ai_tools)).toEqual([["codex"], ["codex"]]);
+  });
+
+  it.each(["setup", "init"])("observes newly saved configuration when %s completes", async (name) => {
+    const command = new Command("mex").command(name);
+    const readContext = vi.fn().mockReturnValueOnce({}).mockReturnValueOnce({ configured_ai_tools: ["claude", "codex"] });
+    const capture = vi.fn();
+    const telemetry = createCliTelemetry(capture, async () => {}, () => 0, readContext);
+    telemetry.start(command);
+    await telemetry.finish(0);
+    expect(readContext).toHaveBeenCalledTimes(2);
+    expect(capture.mock.calls[0][1]).not.toHaveProperty("configured_ai_tools");
+    expect(capture.mock.calls[1][1].configured_ai_tools).toEqual(["claude", "codex"]);
+  });
+
+  it("does not discover project metadata for exempt commands", async () => {
+    const readContext = vi.fn();
+    const capture = vi.fn();
+    const telemetry = createCliTelemetry(capture, async () => {}, undefined, readContext);
+    telemetry.start(new Command("mex").command("telemetry").command("inspect"));
+    await telemetry.finish(0);
+    expect(readContext).not.toHaveBeenCalled();
+    expect(capture).not.toHaveBeenCalled();
+  });
+
+  it("keeps base events when optional metadata lookup throws", async () => {
+    const capture = vi.fn();
+    const telemetry = createCliTelemetry(capture, async () => {}, () => 0, () => { throw new Error("unreadable config"); });
+    telemetry.start(new Command("mex").command("check"));
+    await telemetry.finish(1);
+    expect(capture.mock.calls[1][1]).toEqual({ command: "check", stage: "direct", outcome: "failure", duration_ms: 0 });
+  });
+
+  it("preserves command behavior if capture or delivery fails", async () => {
+    const root = new Command("mex");
+    const command = root.command("commands");
+    const telemetry = createCliTelemetry(() => { throw new Error("disk full"); }, async () => { throw new Error("offline"); });
+    expect(() => telemetry.start(command)).not.toThrow();
+    await expect(telemetry.finish(0)).resolves.toBeUndefined();
+  });
+});
diff --git a/test/cli.test.ts b/test/cli.test.ts
index 0157e448..a241ce6c 100644
--- a/test/cli.test.ts
+++ b/test/cli.test.ts
@@ -338,6 +338,7 @@ describe("built CLI main-module guard", () => {
         env: {
           ...process.env,
           HOME: userHome,
+          MEX_HOME: userHome,
           MEX_TELEMETRY: "1",
           NO_COLOR: "1",
         },
@@ -370,7 +371,7 @@ describe("built CLI main-module guard", () => {
         const result = spawnSync(process.execPath, [cliPath, ...args], {
           cwd: project,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
         });
         expect(result.status, args.join(" ")).toBe(2);
         expect(result.stderr, args.join(" ")).toBe("");
@@ -977,7 +978,7 @@ describe("built CLI main-module guard", () => {
       ].map((entry) => JSON.stringify({ timestamp: "2026-05-14T00:00:00.000Z", cwd: ".", ...entry })).join("\n") + "\n");
       const before = [configPath, historyPath].map((path) => ({ bytes: readFileSync(path), mtime: lstatSync(path, { bigint: true }).mtimeNs }));
       const result = spawnSync(process.execPath, [cliPath, "timeline", "--json", "--type", "risk", "--query", "AUTH", "--file", "src/auth.ts", "--limit", "10"], {
-        cwd: fixture, encoding: "utf8", env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", DO_NOT_TRACK: "0", NO_COLOR: "1" },
+        cwd: fixture, encoding: "utf8", env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", DO_NOT_TRACK: "0", NO_COLOR: "1" },
       });
       expect(result.status).toBe(0);
       expect(JSON.parse(result.stdout)).toEqual({
@@ -988,7 +989,7 @@ describe("built CLI main-module guard", () => {
       expect(readdirSync(mexPath).sort()).toEqual(["ROUTER.md", "config.json", "events"]);
       expect(readdirSync(userHome)).toEqual([]);
       const invalid = spawnSync(process.execPath, [cliPath, "timeline", "--type", "checkpoint", "--json"], {
-        cwd: fixture, encoding: "utf8", env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", DO_NOT_TRACK: "0", NO_COLOR: "1" },
+        cwd: fixture, encoding: "utf8", env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", DO_NOT_TRACK: "0", NO_COLOR: "1" },
       });
       expect(invalid.status).toBe(1);
       expect(invalid.stderr).toContain("Unknown event type");
@@ -1133,7 +1134,7 @@ Canonical read-only release requirements.
         {
           cwd: fixture,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
         },
       );
       expect(rebuilt.status, rebuilt.stderr).toBe(0);
@@ -1148,7 +1149,7 @@ Canonical read-only release requirements.
         {
           cwd: fixture,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
         },
       );
       expect(capabilityResult.status, capabilityResult.stderr).toBe(0);
@@ -1166,7 +1167,7 @@ Canonical read-only release requirements.
         {
           cwd: fixture,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
         },
       );
       expect(listed.status, listed.stderr).toBe(0);
@@ -1456,7 +1457,7 @@ Canonical read-only release requirements.
         const result = spawnSync(process.execPath, [cliPath, ...args], {
           cwd: fixture,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
         });
         expect(result.status, `${args.join(" ")}\n${result.stderr}`).toBe(0);
         expect(JSON.parse(result.stdout)).toMatchObject({ schemaVersion: 1, ok: true });
@@ -1476,13 +1477,15 @@ Canonical read-only release requirements.
         },
         expectedRevisions: [],
       }));
+      // Explicit mutation previews now have opt-out telemetry. This assertion
+      // isolates Team provisioning; enabled delivery is covered by telemetry tests.
       const preview = spawnSync(
         process.execPath,
         [cliPath, "activity", "record", requestPath, "--json"],
         {
           cwd: fixture,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "0", NO_COLOR: "1" },
         },
       );
       expect(preview.status, preview.stderr).toBe(0);
@@ -1544,7 +1547,7 @@ Canonical read-only release requirements.
         const result = spawnSync(process.execPath, [cliPath, ...testCase.args], {
           cwd: outsideRepository,
           encoding: "utf8",
-          env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
+          env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
         });
         expect(result.status, testCase.args.join(" ")).toBe(2);
         expect(result.stderr, testCase.args.join(" ")).toBe("");
@@ -1567,7 +1570,7 @@ Canonical read-only release requirements.
       const unavailable = spawnSync(process.execPath, [cliPath, "member", "list", "--json"], {
         cwd: outsideRepository,
         encoding: "utf8",
-        env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
+        env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
       });
       expect(unavailable.status).toBe(3);
       expect(unavailable.stderr).toBe("");
@@ -1610,7 +1613,7 @@ Canonical read-only release requirements.
           const result = spawnSync(process.execPath, [cliPath, "activity", "list", "--json"], {
             cwd: fixture,
             encoding: "utf8",
-            env: { ...process.env, HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
+            env: { ...process.env, HOME: userHome, MEX_HOME: userHome, MEX_TELEMETRY: "1", NO_COLOR: "1" },
           });
           expect(result.status).toBe(fixtureKind === "symlink" ? 5 : 1);
           expect(result.stderr).toBe("");
diff --git a/test/contracts/team-inbox-spec-authoring.contract.ts b/test/contracts/team-inbox-spec-authoring.contract.ts
index 6ef1773b..c882fb4d 100644
--- a/test/contracts/team-inbox-spec-authoring.contract.ts
+++ b/test/contracts/team-inbox-spec-authoring.contract.ts
@@ -1329,8 +1329,9 @@ export function defineTeamInboxSpecAuthoringContract(
       });
     });
 
-    it("fails closed across every canonical/local containment boundary and root swap", async () => {
-      for (const target of ["local", "proposal", "activity", "spec"] as const) {
+    it.each(["local", "proposal", "activity", "spec"] as const)(
+      "fails closed across the %s containment boundary",
+      async (target) => {
         await withHarness(factory, "empty", async (harness) => {
           const envelope = await harness.prepareContainmentEnvelope(target);
           await harness.installEscapingAncestor(target);
@@ -1340,8 +1341,10 @@ export function defineTeamInboxSpecAuthoringContract(
           });
           expect((await harness.snapshot()).outsideDigest).toBe(before.outsideDigest);
         });
-      }
+      },
+    );
 
+    it("fails closed after a project root swap", async () => {
       await withHarness(factory, "empty", async (harness) => {
         const envelope = await harness.port.previewInbox(command(
           "inbox_contract_root_swap",
diff --git a/test/feedback.test.ts b/test/feedback.test.ts
index 8c110d1a..a58b8ccd 100644
--- a/test/feedback.test.ts
+++ b/test/feedback.test.ts
@@ -35,7 +35,7 @@ afterEach(async () => {
 describe("FEEDBACK_FORM_URL", () => {
   it("points at the maintainer's hosted form", async () => {
     const { FEEDBACK_FORM_URL } = await import("../src/feedback/index.js");
-    expect(FEEDBACK_FORM_URL).toBe("https://tally.so/r/KYGGbK");
+    expect(FEEDBACK_FORM_URL).toBe("https://tally.so/r/KYjv4k");
   });
 });
 
@@ -46,7 +46,7 @@ describe("mex feedback", () => {
     __setOpener((url) => opened.push(url));
     vi.spyOn(console, "log").mockImplementation(() => {});
     runFeedback();
-    expect(opened).toEqual(["https://tally.so/r/KYGGbK"]);
+    expect(opened).toEqual(["https://tally.so/r/KYjv4k"]);
   });
 
   it("swallows opener errors (no browser / no DISPLAY)", async () => {
diff --git a/test/graph-cli-agent.test.ts b/test/graph-cli-agent.test.ts
index 9f8a2246..08ab994c 100644
--- a/test/graph-cli-agent.test.ts
+++ b/test/graph-cli-agent.test.ts
@@ -2,11 +2,12 @@ import { describe, expect, it, vi } from "vitest";
 import { runGraphQuery, runGraphScope, runImpact, type AgentCommandDeps } from "../src/graph/cli-agent.js";
 import type { GraphEngine } from "../src/graph/engine.js";
 import type { GraphEdge, GraphNode } from "../src/graph/types.js";
-import { __setClientForTest, __setTransport, captureCommand, flush } from "../src/telemetry/index.js";
+import { __resetTelemetryForTest, __setTelemetryEndpointForTest, __setTransport, captureCommand, flush, getTelemetryInspection } from "../src/telemetry/index.js";
 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { createServer } from "node:http";
 
 function node(id: string, name: string, file = "src/a.ts", line = 1): GraphNode {
   return { id, name, kind: "function", qualifiedName: name, filePath: file, language: "typescript", startLine: line, endLine: line + 1, startColumn: 0, endColumn: 1, updatedAt: 1 };
@@ -226,12 +227,9 @@ describe("agent graph commands", () => {
 
   it("bounds offline telemetry for a machine-facing graph command", async () => {
     const fixture = deps();
-    const never = new Promise<void>(() => undefined);
-    const offlineClient = {
-      captureImmediate: vi.fn(() => never),
-      flush: vi.fn(() => never),
-      shutdown: vi.fn(() => never),
-    };
+    const server = createServer(() => { /* Deliberately never respond. */ });
+    await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const address = server.address() as { port: number };
     const cwd = process.cwd();
     const home = process.env.MEX_HOME;
     const env = { dnt: process.env.DO_NOT_TRACK, telemetry: process.env.MEX_TELEMETRY, dev: process.env.MEX_DEV };
@@ -242,22 +240,23 @@ describe("agent graph commands", () => {
       delete process.env.DO_NOT_TRACK;
       delete process.env.MEX_TELEMETRY;
       delete process.env.MEX_DEV;
-      __setClientForTest(offlineClient);
+      __resetTelemetryForTest();
+      __setTelemetryEndpointForTest(`http://127.0.0.1:${address.port}/batch/`);
 
       const started = Date.now();
       captureCommand("graph scope");
       runGraphScope("leaf", "/repo", fixture.deps, { detail: "minimal" });
       await flush();
 
-      // Leave scheduler headroom for loaded CI workers while still proving the
-      // SDK's former multi-second retry/shutdown path cannot return.
+      // Allow scheduler headroom in CI while requiring the request to be cancelled
+      // and its event retained. Whole-process timing is measured by the benchmark.
       expect(Date.now() - started).toBeLessThan(2_000);
-      expect(offlineClient.captureImmediate).toHaveBeenCalledOnce();
-      expect(offlineClient.shutdown).toHaveBeenCalledOnce();
-      expect(offlineClient.shutdown.mock.calls[0][0]).toBeLessThanOrEqual(800);
+      expect(getTelemetryInspection().queue).toMatchObject({ state: "available", events: 1 });
       expect(fixture.output.some((line) => JSON.parse(line).type === "summary")).toBe(true);
     } finally {
-      __setClientForTest(null);
+      __resetTelemetryForTest();
+      server.closeAllConnections();
+      await new Promise<void>((resolve) => server.close(() => resolve()));
       process.chdir(cwd);
       if (home === undefined) delete process.env.MEX_HOME;
       else process.env.MEX_HOME = home;
diff --git a/test/hub-e2e/__screenshots__/darwin/hub-home.png b/test/hub-e2e/__screenshots__/darwin/hub-home.png
index 29a1d290..177c5999 100644
Binary files a/test/hub-e2e/__screenshots__/darwin/hub-home.png and b/test/hub-e2e/__screenshots__/darwin/hub-home.png differ
diff --git a/test/telemetry-context-schema.test.ts b/test/telemetry-context-schema.test.ts
new file mode 100644
index 00000000..ee0245d3
--- /dev/null
+++ b/test/telemetry-context-schema.test.ts
@@ -0,0 +1,108 @@
+import { describe, expect, it } from "vitest";
+import {
+  TELEMETRY_AI_TOOLS,
+  eventAttributes,
+  makeEvent,
+  previewEvent,
+  validateStoredEvent,
+  type TelemetryAttributes,
+  type TelemetryEventName,
+} from "../src/telemetry/schema.js";
+
+const INSTALLATION_ID = "11111111-1111-4111-8111-111111111111";
+const SCAFFOLD_ID = "22222222-2222-4222-8222-222222222222";
+const CASES: Array<[TelemetryEventName, TelemetryAttributes]> = [
+  ["cli.command_started", { command: "wiki.query", stage: "direct" }],
+  ["cli.command_completed", { command: "wiki.query", outcome: "success", duration_ms: 12 }],
+  ["hub.session_started", {}],
+  ["hub.page_viewed", { page: "knowledge" }],
+  ["hub.action_completed", { action: "relay.publish", stage: "apply", outcome: "success", duration_ms: 12 }],
+  ["hub.job_completed", { job_kind: "graph_refresh", outcome: "success", duration_ms: 12 }],
+];
+
+describe("optional project context in the telemetry catalog", () => {
+  it.each(CASES)("round-trips approved context on %s", (name, attributes) => {
+    const event = makeEvent(name, {
+      ...attributes,
+      scaffold_id: SCAFFOLD_ID,
+      configured_ai_tools: ["claude", "codex"],
+    }, INSTALLATION_ID);
+
+    expect(event).toBeDefined();
+    expect(event!.properties).toEqual({
+      ...makeEvent(name, attributes, INSTALLATION_ID)!.properties,
+      scaffold_id: SCAFFOLD_ID,
+      configured_ai_tools: ["claude", "codex"],
+    });
+    expect(event!.distinct_id).toBe(INSTALLATION_ID);
+    expect(event!.properties.schema_version).toBe(2);
+    expect(event!.properties.$process_person_profile).toBe(false);
+    expect(event!.properties.$geoip_disable).toBe(true);
+    expect(validateStoredEvent(JSON.parse(JSON.stringify(event)))).toBe(true);
+  });
+
+  it.each(CASES)("preserves previously queued v2 events without project fields: %s", (name, attributes) => {
+    const event = makeEvent(name, attributes, INSTALLATION_ID)!;
+    expect(event.properties).not.toHaveProperty("scaffold_id");
+    expect(event.properties).not.toHaveProperty("configured_ai_tools");
+    expect(validateStoredEvent(JSON.parse(JSON.stringify(event)))).toBe(true);
+  });
+
+  it("allows either optional field independently and preserves an explicit empty selection", () => {
+    expect(eventAttributes("hub.session_started", { scaffold_id: SCAFFOLD_ID })).toEqual({ scaffold_id: SCAFFOLD_ID });
+    expect(eventAttributes("hub.session_started", { configured_ai_tools: [] })).toEqual({ configured_ai_tools: [] });
+    expect(eventAttributes("hub.session_started", { configured_ai_tools: [...TELEMETRY_AI_TOOLS] }))
+      .toEqual({ configured_ai_tools: [...TELEMETRY_AI_TOOLS] });
+  });
+
+  it("copies tool selections at capture and preview so later caller mutations cannot change an event", () => {
+    const tools = ["claude", "codex"];
+    const attributes = { command: "wiki.query", configured_ai_tools: tools };
+    const projected = eventAttributes("cli.command_started", attributes)!;
+    const event = makeEvent("cli.command_started", attributes, INSTALLATION_ID)!;
+    const preview = previewEvent("cli.command_started", projected, INSTALLATION_ID);
+    tools.push("sensitive-freeform-value");
+    projected.configured_ai_tools!.push("cursor");
+
+    expect(event.properties.configured_ai_tools).toEqual(["claude", "codex"]);
+    expect(preview.properties).toHaveProperty("configured_ai_tools", ["claude", "codex"]);
+    expect(validateStoredEvent(event)).toBe(true);
+  });
+
+  it.each([
+    null, 42, [], {}, "private-project-name", "11111111111141118111111111111111",
+    "22222222-2222-1222-8222-222222222222", "22222222-2222-4222-7222-222222222222",
+    "22222222-2222-4222-8222-222222222222/private/path",
+    "22222222-2222-4222-8222-222222222222\n",
+  ].map((scaffold_id) => ({ scaffold_id })))("rejects invalid scaffold identity $scaffold_id at capture and persisted boundaries", ({ scaffold_id }) => {
+    expect(makeEvent("hub.session_started", { scaffold_id }, INSTALLATION_ID)).toBeUndefined();
+    const event = makeEvent("hub.session_started", {}, INSTALLATION_ID)!;
+    expect(validateStoredEvent({ ...event, properties: { ...event.properties, scaffold_id } })).toBe(false);
+  });
+
+  it.each([
+    null, "codex", { tool: "codex" }, [null], [42], [[]], [{ name: "codex" }],
+    ["Claude"], ["claude-code"], ["/private/tool/path"], ["codex", "unknown"],
+    ["codex", "claude"], ["claude", "claude"], ["codex", "codex"],
+    [...TELEMETRY_AI_TOOLS, "windsurf"], new Array(2),
+  ].map((configured_ai_tools) => ({ configured_ai_tools })))("rejects malformed, unsorted, duplicate, or unbounded selections $configured_ai_tools", ({ configured_ai_tools }) => {
+    expect(makeEvent("hub.session_started", { configured_ai_tools }, INSTALLATION_ID)).toBeUndefined();
+    const event = makeEvent("hub.session_started", {}, INSTALLATION_ID)!;
+    expect(validateStoredEvent({ ...event, properties: { ...event.properties, configured_ai_tools } })).toBe(false);
+  });
+
+  it.each(["scaffold_name", "project_path", "origin", "upstream", "ai_tool", "prompt", "email"])(
+    "continues rejecting unapproved field %s even with approved context", (key) => {
+      const attributes = { scaffold_id: SCAFFOLD_ID, configured_ai_tools: ["codex"], [key]: "private-value" };
+      expect(makeEvent("hub.session_started", attributes, INSTALLATION_ID)).toBeUndefined();
+      const event = makeEvent("hub.session_started", {}, INSTALLATION_ID)!;
+      expect(validateStoredEvent({ ...event, properties: { ...event.properties, ...attributes } })).toBe(false);
+    },
+  );
+
+  it("does not let optional context bypass the event-specific property allowlist", () => {
+    const attributes = { scaffold_id: SCAFFOLD_ID, configured_ai_tools: ["codex"], command: "wiki.query" };
+    expect(eventAttributes("hub.session_started", attributes)).toBeUndefined();
+    expect(eventAttributes("cli.command_started", { ...attributes, command: "private command" })).toBeUndefined();
+  });
+});
diff --git a/test/telemetry-delivery.test.ts b/test/telemetry-delivery.test.ts
new file mode 100644
index 00000000..234fd864
--- /dev/null
+++ b/test/telemetry-delivery.test.ts
@@ -0,0 +1,460 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, statSync, symlinkSync, writeFileSync } from "node:fs";
+import { createServer, type Server } from "node:http";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { once } from "node:events";
+import { Resolver } from "node:dns";
+import { createSocket } from "node:dgram";
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { build, stop as stopEsbuild } from "esbuild";
+import { openSqlite } from "../src/graph/db/sqlite.js";
+import { getMachineId, readMachineId, readGlobalConfig, setGlobalConfigKey } from "../src/global-config.js";
+import { __resetTelemetryForTest, __setTelemetryEndpointForTest, __setTransport, captureEvent, disableTelemetry,
+  flush, getTelemetryInspection, isEnabled, startHubTelemetry } from "../src/telemetry/index.js";
+import { claimBatch, closeOutbox, enqueue, finishBatch, inspectOutbox, OUTBOX_LIMITS, purgeOutbox } from "../src/telemetry/outbox.js";
+import { eventAttributes, makeEvent, validateStoredEvent, type TelemetryAttributes, type TelemetryEvent } from "../src/telemetry/schema.js";
+
+let root: string;
+let cwd: string;
+let prior: Record<string, string | undefined>;
+const servers: Server[] = [];
+const pause = (ms = 0) => new Promise<void>((resolve) => setTimeout(resolve, ms));
+beforeEach(() => {
+  cwd = process.cwd();
+  prior = Object.fromEntries(["MEX_HOME", "MEX_TELEMETRY", "DO_NOT_TRACK", "MEX_DEV"].map((key) => [key, process.env[key]]));
+  root = mkdtempSync(join(tmpdir(), "mex-telemetry-delivery-"));
+  process.chdir(root);
+  process.env.MEX_HOME = root;
+  delete process.env.MEX_TELEMETRY; delete process.env.DO_NOT_TRACK; delete process.env.MEX_DEV;
+  __resetTelemetryForTest();
+  // Even an accidentally enabled capture can only reach a refused LOOPBACK port.
+  __setTelemetryEndpointForTest("http://127.0.0.1:1/batch/");
+});
+afterEach(async () => {
+  __resetTelemetryForTest();
+  await pause();
+  for (const server of servers.splice(0)) {
+    server.closeAllConnections();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+  vi.useRealTimers();
+  vi.restoreAllMocks();
+  process.chdir(cwd);
+  for (const [key, value] of Object.entries(prior)) {
+    if (value === undefined) delete process.env[key]; else process.env[key] = value;
+  }
+  rmSync(root, { recursive: true, force: true });
+});
+async function endpoint(handler: Parameters<typeof createServer>[0]): Promise<string> {
+  const server = createServer(handler);
+  servers.push(server);
+  server.listen(0, "127.0.0.1");
+  await once(server, "listening");
+  const address = server.address();
+  if (!address || typeof address === "string") throw new Error("Missing loopback address");
+  const url = `http://127.0.0.1:${address.port}/batch/`;
+  __setTelemetryEndpointForTest(url);
+  return url;
+}
+function event(now = Date.now()): TelemetryEvent {
+  return makeEvent("cli.command_completed", { command: "wiki.query", outcome: "success", duration_ms: 3 }, getMachineId(), now)!;
+}
+const dbPath = () => join(root, ".mex", "telemetry", "outbox.db");
+
+describe("closed event schema", () => {
+  it.each([
+    ["cli.command_started", { command: "wiki.query", query: "PRIVATE" }],
+    ["cli.command_started", { command: "/private/path" }],
+    ["cli.command_started", { command: undefined }],
+    ["cli.command_completed", { command: "check", outcome: undefined, duration_ms: 1 }],
+    ["cli.command_completed", { command: "check", outcome: "success", duration_ms: undefined }],
+    ["cli.command_completed", { command: "check", outcome: "success", duration_ms: Infinity }],
+    ["cli.command_completed", { command: "check", outcome: "success", duration_ms: -1 }],
+    ["hub.page_viewed", { page: "knowledge/secret" }],
+    ["hub.action_completed", { action: "relay.publish", stage: "preview", outcome: "success", duration_ms: 1, replayed: true }],
+    ["private.event", {}],
+  ])("rejects untrusted or incomplete %s attributes before identity creation", (name, attrs) => {
+    expect(eventAttributes(name, attrs)).toBeUndefined();
+    const captured = vi.fn(); __setTransport(captured);
+    captureEvent(name as "cli.command_started", attrs as TelemetryAttributes);
+    expect(captured).not.toHaveBeenCalled();
+    expect(existsSync(join(root, ".mex"))).toBe(false);
+  });
+  it("uses the same installation ID for CLI and Hub, without project or person fields", () => {
+    const calls: Record<string, unknown>[] = [];
+    __setTransport((_name, attrs) => { calls.push(attrs); });
+    captureEvent("cli.command_started", { command: "wiki.query", stage: "direct" });
+    captureEvent("hub.page_viewed", { page: "knowledge" });
+    expect(calls).toHaveLength(2);
+    expect(calls[0].installation_id).toBe(calls[1].installation_id);
+    expect(calls[0]).toMatchObject({ schema_version: 2, source: "cli", $process_person_profile: false, $geoip_disable: true });
+    expect(calls[1].source).toBe("hub");
+    expect(JSON.stringify(calls)).not.toMatch(/scaffold_id|machine_id|member_id|email|session_id/);
+  });
+  it("rechecks persisted property values and envelope keys, not just live callers", () => {
+    const item = event();
+    expect(validateStoredEvent(item)).toBe(true);
+    expect(validateStoredEvent({ ...item, properties: { ...item.properties, command: "private project" } })).toBe(false);
+    expect(validateStoredEvent({ ...item, properties: { ...item.properties, path: "private" } })).toBe(false);
+    expect(validateStoredEvent({ ...item, unexpected: "private" })).toBe(false);
+  });
+  it("never sends malformed identity bytes or overwrites the identity file", () => {
+    mkdirSync(join(root, ".mex"));
+    const file = join(root, ".mex", "telemetry-id");
+    writeFileSync(file, "person@example.com");
+    const captured = vi.fn(); __setTransport(captured);
+    captureEvent("hub.page_viewed", { page: "knowledge" });
+    expect(captured).not.toHaveBeenCalled();
+    expect(readMachineId()).toBeUndefined();
+    expect(readFileSync(file, "utf8")).toBe("person@example.com");
+    expect(JSON.stringify(getTelemetryInspection())).not.toContain("person@example.com");
+  });
+});
+
+describe("bounded persistent outbox", () => {
+  it("retains events through reopening, with their original timestamp and deduplication UUID", () => {
+    const item = event(Date.now() - 10_000);
+    expect(enqueue(item)).toBe(true);
+    closeOutbox();
+    const batch = claimBatch();
+    expect(batch?.events).toEqual([item]);
+    finishBatch(batch!, false);
+    closeOutbox();
+    const retry = claimBatch();
+    expect(retry?.events).toEqual([item]);
+    finishBatch(retry!, true);
+    expect(inspectOutbox()).toEqual({ state: "available", events: 0, bytes: 0 });
+  });
+  it("caps rows, payload bytes and actual database size; drops oldest and expires old data", () => {
+    const now = Date.now();
+    const expired = event(now - OUTBOX_LIMITS.ageMs - 1);
+    enqueue(expired, now - OUTBOX_LIMITS.ageMs - 1);
+    for (let i = 0; i < OUTBOX_LIMITS.events + 8; i++) expect(enqueue(event(now + i), now + i)).toBe(true);
+    const status = inspectOutbox();
+    expect(status.events).toBe(OUTBOX_LIMITS.events);
+    expect(status.bytes).toBeLessThanOrEqual(OUTBOX_LIMITS.bytes);
+    expect(statSync(dbPath()).size).toBeLessThanOrEqual(OUTBOX_LIMITS.databaseBytes);
+    const batch = claimBatch(now + 1000)!;
+    expect(batch.events).toHaveLength(OUTBOX_LIMITS.batchEvents);
+    expect(batch.events.some((row) => row.uuid === expired.uuid)).toBe(false);
+    expect(batch.events[0].timestamp).toBe(new Date(now + 8).toISOString());
+  });
+  it("uses disjoint delivery claims and recovers a crashed sender's expired claim", () => {
+    const now = Date.now();
+    for (let i = 0; i < 40; i++) enqueue(event(now), now);
+    const first = claimBatch(now)!;
+    closeOutbox();
+    const second = claimBatch(now)!;
+    expect(first.events).toHaveLength(32); expect(second.events).toHaveLength(8);
+    expect(second.events.some((item) => first.events.some((earlier) => item.uuid === earlier.uuid))).toBe(false);
+    closeOutbox();
+    const afterCrash = claimBatch(now + OUTBOX_LIMITS.leaseMs + 1)!;
+    expect(afterCrash.events).toEqual(first.events);
+  });
+  it("drops a contended enqueue immediately, preserving the other writer's events", () => {
+    const first = event(); enqueue(first); closeOutbox();
+    const owner = openSqlite(dbPath()); owner.exec("BEGIN IMMEDIATE");
+    const started = performance.now();
+    try {
+      expect(enqueue(event())).toBe(false);
+      expect(performance.now() - started).toBeLessThan(100);
+      expect(purgeOutbox()).toBe(false);
+    } finally { owner.exec("ROLLBACK"); owner.close(); }
+    expect(claimBatch()?.events).toEqual([first]);
+  });
+  it("never sends malformed on-disk payloads", () => {
+    enqueue(event()); closeOutbox();
+    const db = openSqlite(dbPath());
+    db.exec("UPDATE events SET payload='{}'"); db.close();
+    expect(claimBatch()).toBeUndefined();
+    expect(inspectOutbox().events).toBe(0);
+  });
+  it("does not send an expired payload hidden behind a fresh occurred column", () => {
+    const old = event(Date.now() - OUTBOX_LIMITS.ageMs - 1000);
+    enqueue(event()); closeOutbox();
+    const db = openSqlite(dbPath());
+    db.prepare("UPDATE events SET uuid=?,payload=?").run(old.uuid, JSON.stringify(old)); db.close();
+    expect(claimBatch()).toBeUndefined();
+    expect(inspectOutbox().events).toBe(0);
+  });
+  it("rejects user triggers whose names resemble SQLite internal objects", () => {
+    enqueue(event()); closeOutbox();
+    const db = openSqlite(dbPath());
+    db.exec("CREATE TRIGGER sqliteXunexpected AFTER INSERT ON events BEGIN DELETE FROM events; END"); db.close();
+    const before = readFileSync(dbPath());
+    expect(enqueue(event())).toBe(false);
+    expect(inspectOutbox().state).toBe("unavailable");
+    expect(readFileSync(dbPath())).toEqual(before);
+  });
+  it("retains every acknowledged enqueue from concurrent real processes", async () => {
+    const first = event(); enqueue(first); closeOutbox();
+    const directory = join(root, "worker-dist"); mkdirSync(directory);
+    const worker = join(directory, "queue-worker.mjs");
+    writeFileSync(join(root, "package.json"), JSON.stringify({ name: "telemetry-worker-fixture", version: JSON.parse(readFileSync(join(cwd, "package.json"), "utf8")).version }));
+    try {
+      await build({ stdin: { contents: `
+        import {enqueue,closeOutbox} from ${JSON.stringify(join(cwd, "src/telemetry/outbox.ts"))};
+        import {makeEvent} from ${JSON.stringify(join(cwd, "src/telemetry/schema.ts"))};
+        import {getMachineId} from ${JSON.stringify(join(cwd, "src/global-config.ts"))};
+        const ids=[];
+        for(let i=0;i<10;i++) {
+          const event=makeEvent('cli.command_started',{command:'check'},getMachineId());
+          if(enqueue(event)) ids.push(event.uuid);
+        }
+        closeOutbox(); process.stdout.write(JSON.stringify(ids));
+      `, sourcefile: "queue-worker.ts", resolveDir: cwd }, outfile: worker, bundle: true,
+        packages: "external", platform: "node", format: "esm", target: "node22", logLevel: "silent" });
+    } finally { await stopEsbuild(); }
+    const results = await Promise.all(Array.from({ length: 3 }, () => promisify(execFile)(process.execPath, [worker], {
+      cwd: root, env: { ...process.env, MEX_TELEMETRY: "0" }, timeout: 5000, maxBuffer: 32768,
+    })));
+    const accepted = results.flatMap((result) => JSON.parse(result.stdout) as string[]);
+    expect(accepted.length).toBeGreaterThan(0);
+    const retained = claimBatch()!.events.map((item) => item.uuid);
+    expect(new Set(retained)).toEqual(new Set([first.uuid, ...accepted]));
+  });
+  it("rejects arbitrary schemas on inspect without evaluating a recursive view or modifying bytes", () => {
+    mkdirSync(join(root, ".mex", "telemetry"), { recursive: true });
+    const db = openSqlite(dbPath());
+    db.exec("CREATE VIEW events AS WITH RECURSIVE counter(n) AS (VALUES(1) UNION ALL SELECT n+1 FROM counter) SELECT n AS payload FROM counter"); db.close();
+    const before = readFileSync(dbPath());
+    expect(inspectOutbox().state).toBe("unavailable");
+    expect(enqueue(event())).toBe(false);
+    expect(readFileSync(dbPath())).toEqual(before);
+  });
+  it("derives its page-count cap from large SQLite pages", () => {
+    mkdirSync(join(root, ".mex", "telemetry"), { recursive: true });
+    const db = openSqlite(dbPath()); db.exec("PRAGMA page_size=65536"); db.exec("VACUUM"); db.close();
+    expect(enqueue(event())).toBe(true);
+    // This cap belongs to the live writer connection, not the database header.
+    const batch = claimBatch()!;
+    expect(batch.queue.db.prepare("PRAGMA max_page_count").get()).toMatchObject({ max_page_count: 16 });
+    expect(statSync(dbPath()).size).toBeLessThanOrEqual(OUTBOX_LIMITS.databaseBytes);
+  });
+});
+
+describe("noninitializing audit and filesystem containment", () => {
+  it("keeps explicit opt-out after a stale unrelated writer restores telemetry:on in JSON", () => {
+    setGlobalConfigKey("telemetry", "on");
+    const stale = { ...readGlobalConfig(), feedbackInviteCount: 1 };
+    expect(disableTelemetry()).toEqual({ purged: true });
+    // Reproduce the final step of a different process that read before disable:
+    // atomically publish its stale merged preferences AFTER disable returned.
+    const temp = join(root, ".mex", "stale-writer.tmp");
+    writeFileSync(temp, JSON.stringify(stale)); renameSync(temp, join(root, ".mex", "config.json"));
+    expect(readGlobalConfig().telemetry).toBe("on");
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config" });
+    const captured = vi.fn(); __setTransport(captured);
+    captureEvent("cli.command_started", { command: "check" });
+    expect(captured).not.toHaveBeenCalled();
+    const marker = join(root, ".mex", "telemetry-disabled");
+    const before = statSync(marker, { bigint: true });
+    setGlobalConfigKey("feedbackDismissed", true);
+    setGlobalConfigKey("telemetry", "off");
+    const after = statSync(marker, { bigint: true });
+    expect(after.ino).toBe(before.ino); expect(after.dev).toBe(before.dev);
+    expect(after.size).toBe(0n);
+    if (process.platform !== "win32") expect(Number(after.mode & 0o777n)).toBe(0o600);
+    setGlobalConfigKey("telemetry", "on");
+    expect(existsSync(marker)).toBe(false); expect(isEnabled().enabled).toBe(true);
+  });
+  it("does not reinterpret malformed UTF-8 as an absent telemetry preference", () => {
+    mkdirSync(join(root, ".mex"));
+    // A replacement decoder would silently turn this invalid key into an
+    // unrelated property and use the default-on telemetry preference.
+    const bytes = Buffer.concat([Buffer.from('{"telemetr'), Buffer.from([0xff]), Buffer.from('y":"off"}')]);
+    writeFileSync(join(root, ".mex", "config.json"), bytes);
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config_unavailable" });
+    expect(readFileSync(join(root, ".mex", "config.json"))).toEqual(bytes);
+  });
+  it("fails closed on an unexpected opt-out marker and refuses to erase it on enable", () => {
+    mkdirSync(join(root, ".mex"));
+    const marker = join(root, ".mex", "telemetry-disabled"); mkdirSync(marker);
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config" });
+    expect(() => setGlobalConfigKey("telemetry", "on")).toThrow("Unsafe MEX telemetry opt-out marker");
+    expect(statSync(marker).isDirectory()).toBe(true);
+  });
+  it("retains the marker when a preference-write failure prevents enable", () => {
+    disableTelemetry();
+    const config = join(root, ".mex", "config.json"); rmSync(config); mkdirSync(config);
+    expect(() => setGlobalConfigKey("telemetry", "on")).toThrow();
+    expect(existsSync(join(root, ".mex", "telemetry-disabled"))).toBe(true);
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config" });
+  });
+  it.runIf(process.platform !== "win32")("never follows or removes a linked opt-out marker", () => {
+    mkdirSync(join(root, ".mex"));
+    const target = join(root, "keep"); writeFileSync(target, "private");
+    const marker = join(root, ".mex", "telemetry-disabled"); symlinkSync(target, marker);
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config" });
+    expect(() => setGlobalConfigKey("telemetry", "on")).toThrow();
+    expect(() => setGlobalConfigKey("telemetry", "off")).toThrow();
+    expect(readFileSync(target, "utf8")).toBe("private");
+    expect(existsSync(marker)).toBe(true);
+  });
+  it.each(["{bad json", "[]", '{"telemetry":"unexpected"}', "x".repeat(65537)])("fails closed on invalid existing preferences without replacing them", (contents) => {
+    mkdirSync(join(root, ".mex"));
+    const config = join(root, ".mex", "config.json"); writeFileSync(config, contents);
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config_unavailable" });
+    captureEvent("cli.command_started", { command: "check" });
+    expect(existsSync(join(root, ".mex", "telemetry-id"))).toBe(false);
+    expect(readFileSync(config, "utf8")).toBe(contents);
+  });
+  it("atomically updates the opt-out while preserving other preferences", () => {
+    setGlobalConfigKey("feedbackDismissed", true);
+    const config = join(root, ".mex", "config.json");
+    const before = statSync(config, { bigint: true });
+    expect(disableTelemetry()).toEqual({ purged: true });
+    const after = statSync(config, { bigint: true });
+    expect(before.ino === after.ino && before.dev === after.dev).toBe(false);
+    expect(readGlobalConfig()).toEqual({ feedbackDismissed: true, telemetry: "off" });
+    expect(readdirSync(join(root, ".mex"))).toEqual(["config.json", "telemetry-disabled"]);
+  });
+  it.runIf(process.platform !== "win32")("refuses a linked global config on both capture and explicit disable", () => {
+    mkdirSync(join(root, ".mex"));
+    const target = join(root, "original.json"); writeFileSync(target, '{"private":"keep"}');
+    symlinkSync(target, join(root, ".mex", "config.json"));
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config_unavailable" });
+    expect(() => disableTelemetry()).toThrow("Unsafe MEX preference file");
+    expect(readFileSync(target, "utf8")).toBe('{"private":"keep"}');
+  });
+  it("inspect never creates files, even with telemetry enabled", () => {
+    expect(getTelemetryInspection()).toMatchObject({ enabled: true, installation_id: null, queue: { state: "absent", events: 0 } });
+    expect(readdirSync(root)).toEqual([]);
+  });
+  it("inspect leaves existing database bytes and directory entries unchanged", () => {
+    enqueue(event()); closeOutbox();
+    const before = readFileSync(dbPath()); const files = readdirSync(join(root, ".mex", "telemetry"));
+    getTelemetryInspection();
+    expect(readFileSync(dbPath())).toEqual(before);
+    expect(readdirSync(join(root, ".mex", "telemetry"))).toEqual(files);
+  });
+  it.runIf(process.platform !== "win32")("refuses linked store directories, databases and identity files", () => {
+    const outside = join(root, "outside"); mkdirSync(outside);
+    mkdirSync(join(root, ".mex"));
+    symlinkSync(outside, join(root, ".mex", "telemetry"), "dir");
+    expect(enqueue(event())).toBe(false);
+    expect(readdirSync(outside)).toEqual([]);
+    rmSync(join(root, ".mex", "telemetry")); mkdirSync(join(root, ".mex", "telemetry"));
+    const other = join(outside, "other"); writeFileSync(other, "do not change");
+    symlinkSync(other, dbPath());
+    expect(enqueue(event())).toBe(false);
+    expect(readFileSync(other, "utf8")).toBe("do not change");
+    rmSync(join(root, ".mex", "telemetry-id")); symlinkSync(other, join(root, ".mex", "telemetry-id"));
+    expect(readMachineId()).toBeUndefined();
+    expect(() => getMachineId()).toThrow();
+    expect(readFileSync(other, "utf8")).toBe("do not change");
+  });
+});
+
+describe("silent bounded delivery", () => {
+  it("cancels a real DNS lookup sent only to a loopback UDP blackhole", async () => {
+    const blackhole = createSocket("udp4");
+    blackhole.bind(0, "127.0.0.1"); await once(blackhole, "listening");
+    const address = blackhole.address();
+    let queries = 0; blackhole.on("message", () => { queries++; });
+    const original = Resolver.prototype.resolve4;
+    const callbacks: string[] = [];
+    const resolve = vi.spyOn(Resolver.prototype, "resolve4").mockImplementation(function(this: Resolver, hostname: string, callback: any) {
+      expect(hostname).toBe("us.i.posthog.com");
+      this.setServers([`127.0.0.1:${address.port}`]);
+      return original.call(this, hostname, (error, values) => { callbacks.push(error?.code ?? "resolved"); callback(error, values); });
+    });
+    const cancel = vi.spyOn(Resolver.prototype, "cancel");
+    try {
+      // DNS is hard-pinned to the blackhole above before any resolver call; no
+      // PostHog address can be resolved and no production connection can start.
+      __setTelemetryEndpointForTest(null);
+      const firstQuery = once(blackhole, "message", { signal: AbortSignal.timeout(1000) });
+      captureEvent("cli.command_started", { command: "check" });
+      // Observe an in-flight query before measuring cancellation. A fixed sleep
+      // can leave scheduled dispatch and cold HTTPS setup inside this interval.
+      await firstQuery;
+      expect(callbacks).toEqual([]); expect(cancel).not.toHaveBeenCalled();
+      const started = performance.now(); await flush({ deadlineMs: 25 });
+      expect(performance.now() - started).toBeLessThan(150);
+      await pause(10);
+      expect(resolve).toHaveBeenCalledOnce(); expect(cancel).toHaveBeenCalled();
+      expect(queries).toBeGreaterThan(0); expect(callbacks).toEqual(["ECANCELLED"]);
+      const count = queries; await pause(25); expect(queries).toBe(count);
+      expect(inspectOutbox().events).toBe(1);
+    } finally {
+      __setTelemetryEndpointForTest("http://127.0.0.1:1/batch/");
+      resolve.mockRestore(); cancel.mockRestore();
+      await new Promise<void>((done) => blackhole.close(() => done()));
+    }
+  });
+  it("explicit disable aborts an in-flight request and clears its queued claim", async () => {
+    let started!: () => void; const received = new Promise<void>((resolve) => { started = resolve; });
+    await endpoint((request) => { request.resume(); started(); });
+    captureEvent("cli.command_started", { command: "check" }); await received;
+    expect(disableTelemetry()).toEqual({ purged: true });
+    await flush(); expect(inspectOutbox().events).toBe(0);
+    expect(isEnabled()).toEqual({ enabled: false, reason: "config" });
+  });
+  it("sends one correct batch, then removes only acknowledged events", async () => {
+    const bodies: Array<{ batch: TelemetryEvent[] }> = [];
+    await endpoint((request, response) => {
+      let body = ""; request.on("data", (part) => { body += part; });
+      request.on("end", () => { bodies.push(JSON.parse(body)); response.end('{"status":1}'); });
+    });
+    captureEvent("cli.command_started", { command: "wiki.query", stage: "direct" });
+    captureEvent("cli.command_completed", { command: "wiki.query", stage: "direct", outcome: "success", duration_ms: 5 });
+    await flush({ deadlineMs: 50 });
+    expect(bodies).toHaveLength(1);
+    expect(bodies[0].batch.map((item) => item.event)).toEqual(["cli.command_started", "cli.command_completed"]);
+    expect(bodies[0].batch.every(validateStoredEvent)).toBe(true);
+    expect(inspectOutbox().events).toBe(0);
+    captureEvent("cli.command_started", { command: "check" });
+    await flush({ deadlineMs: 50 });
+    expect(bodies).toHaveLength(1);
+    expect(inspectOutbox().events).toBe(1);
+  });
+  it("retains an unavailable batch and aborts a hung request within the flush grace", async () => {
+    await endpoint((request) => { request.resume(); });
+    const stderr = vi.spyOn(process.stderr, "write").mockImplementation(() => true);
+    captureEvent("cli.command_started", { command: "check" });
+    await pause(5);
+    const started = performance.now();
+    await flush({ deadlineMs: 25 });
+    expect(performance.now() - started).toBeLessThan(150); // scheduler headroom; whole-process harness owns performance gate
+    expect(inspectOutbox().events).toBe(1);
+    expect(stderr).not.toHaveBeenCalled();
+  });
+  it("never follows an ingestion redirect", async () => {
+    let calls = 0;
+    await endpoint((_request, response) => { calls++; response.writeHead(302, { Location: "https://example.com/private" }); response.end(); });
+    captureEvent("cli.command_started", { command: "check" }); await flush({ deadlineMs: 50 });
+    expect(calls).toBe(1); expect(inspectOutbox().events).toBe(1);
+  });
+  it("checks opt-out again before scheduled send; explicit disable clears queued events", async () => {
+    let calls = 0;
+    await endpoint((_request, response) => { calls++; response.end('{"status":1}'); });
+    captureEvent("cli.command_started", { command: "check" });
+    process.env.DO_NOT_TRACK = "1";
+    await flush();
+    expect(calls).toBe(0); expect(inspectOutbox().events).toBe(1);
+    expect(disableTelemetry()).toEqual({ purged: true });
+    expect(inspectOutbox().events).toBe(0);
+    captureEvent("cli.command_started", { command: "check" });
+    expect(inspectOutbox().events).toBe(0);
+  });
+  it("batches Hub activity at lifecycle shutdown without counting idle timer ticks", async () => {
+    const batches: TelemetryEvent[][] = [];
+    await endpoint((request, response) => {
+      let body = ""; request.on("data", (part) => { body += part; });
+      request.on("end", () => { batches.push(JSON.parse(body).batch); response.end('{"status":1}'); });
+    });
+    const stop = startHubTelemetry();
+    captureEvent("hub.session_started"); captureEvent("hub.page_viewed", { page: "knowledge" });
+    await pause(5); expect(batches).toHaveLength(0);
+    await stop(); await stop();
+    expect(batches).toHaveLength(1); expect(batches[0]).toHaveLength(2);
+  });
+  it("the test endpoint seam cannot be directed to a remote origin or arbitrary path", () => {
+    for (const value of ["https://us.i.posthog.com/batch/", "http://example.com:80/batch/", "http://127.0.0.1:80/private", "http://user@127.0.0.1:80/batch/"]) {
+      expect(() => __setTelemetryEndpointForTest(value)).toThrow();
+    }
+  });
+});
diff --git a/test/telemetry-project-capture.test.ts b/test/telemetry-project-capture.test.ts
new file mode 100644
index 00000000..db5629c9
--- /dev/null
+++ b/test/telemetry-project-capture.test.ts
@@ -0,0 +1,127 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import * as reader from "../src/telemetry/project-context.js";
+import { __resetTelemetryForTest, __setTransport, createProjectTelemetryCapture, getProjectTelemetryContext, getTelemetryInspection } from "../src/telemetry/index.js";
+
+const SCAFFOLD_A = "8c2215bb-bb35-48bc-8f6d-ff8ca8b7fd99";
+const SCAFFOLD_B = "670c15cc-cf05-414f-9b24-841d6e646914";
+let root: string;
+let cwd: string;
+let prior: Record<string, string | undefined>;
+const capture = vi.fn();
+function project(name: string, config: unknown): string {
+  const path = join(root, name);
+  mkdirSync(join(path, ".git"), { recursive: true });
+  mkdirSync(join(path, ".mex"));
+  writeFileSync(join(path, ".mex", "config.json"), JSON.stringify(config));
+  return path;
+}
+beforeEach(() => {
+  cwd = process.cwd();
+  prior = Object.fromEntries(["MEX_HOME", "MEX_DEV", "MEX_TELEMETRY", "DO_NOT_TRACK"].map(key => [key, process.env[key]]));
+  root = mkdtempSync(join(tmpdir(), "mex-project-telemetry-"));
+  process.chdir(root);
+  process.env.MEX_HOME = join(root, "user");
+  delete process.env.MEX_DEV; delete process.env.MEX_TELEMETRY; delete process.env.DO_NOT_TRACK;
+  __resetTelemetryForTest();
+  capture.mockReset();
+  __setTransport(capture);
+});
+afterEach(() => {
+  __resetTelemetryForTest();
+  vi.restoreAllMocks();
+  process.chdir(cwd);
+  for (const [key, value] of Object.entries(prior)) {
+    if (value === undefined) delete process.env[key]; else process.env[key] = value;
+  }
+  rmSync(root, { recursive: true, force: true });
+});
+
+describe("project metadata capture boundary", () => {
+  it("binds one immutable snapshot to the Hub's project even when cwd differs", () => {
+    const selected = project("selected", { scaffold_id: SCAFFOLD_A, aiTools: ["codex", "claude"], origin: "PRIVATE_REMOTE" });
+    project("unrelated", { scaffold_id: SCAFFOLD_B, aiTools: ["cursor"] });
+    const read = vi.spyOn(reader, "readTelemetryProjectContext");
+    const sink = createProjectTelemetryCapture(selected);
+    expect(read).not.toHaveBeenCalled();
+    sink("hub.session_started", {});
+    writeFileSync(join(selected, ".mex", "config.json"), JSON.stringify({ scaffold_id: SCAFFOLD_B, aiTools: ["cursor"] }));
+    sink("hub.page_viewed", { page: "knowledge" });
+    expect(read).toHaveBeenCalledExactlyOnceWith(selected, "exact");
+    for (const [, attrs] of capture.mock.calls) {
+      expect(attrs).toMatchObject({ scaffold_id: SCAFFOLD_A, configured_ai_tools: ["claude", "codex"] });
+      expect(JSON.stringify(attrs)).not.toContain("PRIVATE_REMOTE");
+    }
+  });
+
+  it("keeps different Hubs independent while sharing installation identity", () => {
+    const left = createProjectTelemetryCapture(project("left", { scaffold_id: SCAFFOLD_A, aiTools: ["claude"] }));
+    const right = createProjectTelemetryCapture(project("right", { scaffold_id: SCAFFOLD_B, aiTools: ["codex"] }));
+    left("hub.page_viewed", { page: "inbox" });
+    right("hub.page_viewed", { page: "relays" });
+    expect(capture.mock.calls[0][1].installation_id).toBe(capture.mock.calls[1][1].installation_id);
+    expect(capture.mock.calls.map(([, attrs]) => [attrs.scaffold_id, attrs.configured_ai_tools])).toEqual([
+      [SCAFFOLD_A, ["claude"]], [SCAFFOLD_B, ["codex"]],
+    ]);
+  });
+
+  it("uses the Hub's exact nested project instead of an ancestor scaffold", () => {
+    const parent = project("parent", { scaffold_id: SCAFFOLD_A, aiTools: ["claude"] });
+    const nested = join(parent, "package");
+    mkdirSync(join(nested, ".mex"), { recursive: true });
+    writeFileSync(join(nested, ".mex", "config.json"), JSON.stringify({ scaffold_id: SCAFFOLD_B, aiTools: ["codex"] }));
+    createProjectTelemetryCapture(nested)("hub.page_viewed", { page: "home" });
+    expect(capture.mock.calls[0][1]).toMatchObject({ scaffold_id: SCAFFOLD_B, configured_ai_tools: ["codex"] });
+  });
+
+  it("does not read project config while disabled and discovers it on later enable", () => {
+    const path = project("selected", { scaffold_id: SCAFFOLD_A, aiTools: ["codex"] });
+    const read = vi.spyOn(reader, "readTelemetryProjectContext");
+    process.env.DO_NOT_TRACK = "1";
+    const sink = createProjectTelemetryCapture(path);
+    sink("hub.page_viewed", { page: "home" });
+    expect(getProjectTelemetryContext(path)).toEqual({});
+    expect(read).not.toHaveBeenCalled();
+    expect(capture).not.toHaveBeenCalled();
+    expect(existsSync(join(root, "user", ".mex"))).toBe(false);
+    delete process.env.DO_NOT_TRACK;
+    sink("hub.page_viewed", { page: "knowledge" });
+    expect(read).toHaveBeenCalledOnce();
+    expect(capture.mock.calls[0][1].scaffold_id).toBe(SCAFFOLD_A);
+  });
+
+  it("rejects unknown event input before project discovery", () => {
+    const read = vi.spyOn(reader, "readTelemetryProjectContext");
+    createProjectTelemetryCapture(root)("hub.page_viewed", { page: "knowledge", secret: "PRIVATE" } as never);
+    expect(read).not.toHaveBeenCalled();
+    expect(capture).not.toHaveBeenCalled();
+  });
+
+  it("retains the base event when project metadata is absent or malformed", () => {
+    createProjectTelemetryCapture(root)("hub.page_viewed", { page: "home" });
+    const path = project("malformed", {});
+    writeFileSync(join(path, ".mex", "config.json"), "not JSON PRIVATE");
+    createProjectTelemetryCapture(path)("hub.page_viewed", { page: "home" });
+    expect(capture).toHaveBeenCalledTimes(2);
+    for (const [, attrs] of capture.mock.calls) {
+      expect(attrs).not.toHaveProperty("scaffold_id");
+      expect(attrs).not.toHaveProperty("configured_ai_tools");
+    }
+  });
+
+  it("inspects the actual safe project metadata without minting any identity or writing", () => {
+    const path = project("inspect", { scaffold_id: SCAFFOLD_A, aiTools: ["codex"], scaffold_name: "PRIVATE_NAME", origin: "PRIVATE_REMOTE" });
+    process.chdir(path);
+    const configPath = join(path, ".mex", "config.json");
+    const before = readFileSync(configPath);
+    const result = getTelemetryInspection();
+    expect(result.project_context).toEqual({ scaffold_id: SCAFFOLD_A, configured_ai_tools: ["codex"] });
+    expect(JSON.stringify(result)).not.toContain("PRIVATE");
+    expect(readFileSync(configPath)).toEqual(before);
+    expect(readdirSync(join(path, ".mex"))).toEqual(["config.json"]);
+    expect(existsSync(join(root, "user", ".mex"))).toBe(false);
+    expect(capture).not.toHaveBeenCalled();
+  });
+});
diff --git a/test/telemetry-project-context.test.ts b/test/telemetry-project-context.test.ts
new file mode 100644
index 00000000..140df561
--- /dev/null
+++ b/test/telemetry-project-context.test.ts
@@ -0,0 +1,198 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { linkSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, relative } from "node:path";
+import { readTelemetryProjectContext } from "../src/telemetry/project-context.js";
+
+const SCAFFOLD_ID = "685f71c3-b91b-4fe1-8376-c8944829cacd";
+let directory: string;
+
+beforeEach(() => { directory = mkdtempSync(join(tmpdir(), "mex-telemetry-context-")); });
+afterEach(() => { rmSync(directory, { recursive: true, force: true }); });
+
+function project(name: string, config?: unknown, git: "directory" | "file" | false = "directory"): string {
+  const root = join(directory, name);
+  mkdirSync(join(root, ".mex"), { recursive: true });
+  if (git === "directory") mkdirSync(join(root, ".git"));
+  if (git === "file") writeFileSync(join(root, ".git"), "gitdir: /private/worktree/metadata\n");
+  if (config !== undefined) writeFileSync(join(root, ".mex", "config.json"), JSON.stringify(config));
+  return root;
+}
+
+function snapshot(root: string): unknown[] {
+  const entries: unknown[] = [];
+  function walk(path: string): void {
+    for (const name of readdirSync(path).sort()) {
+      const child = join(path, name);
+      const info = lstatSync(child, { bigint: true });
+      entries.push([relative(root, child), info.mode, info.ino, info.size, info.mtimeNs, info.ctimeNs,
+        info.isFile() ? readFileSync(child).toString("base64") : null]);
+      if (info.isDirectory()) walk(child);
+    }
+  }
+  walk(root);
+  return entries;
+}
+
+describe("bounded read-only project telemetry context", () => {
+  it("projects only an existing UUID and sorted unique configured tool names", () => {
+    const root = project("complete", {
+      scaffold_id: SCAFFOLD_ID, scaffold_name: "private-project", origin: "git@private/repository",
+      aiTools: ["windsurf", "cursor", "codex", "claude", "copilot", "opencode", "codex", "private-agent", { email: "private@example.com" }, 8],
+      identity: { name: "private-person" }, arbitrary: "private-context",
+    });
+    expect(readTelemetryProjectContext(root)).toEqual({
+      scaffold_id: SCAFFOLD_ID,
+      configured_ai_tools: ["claude", "codex", "copilot", "cursor", "opencode", "windsurf"],
+    });
+  });
+
+  it("reads the nearest Git project from nested directories, ignoring a nested loose scaffold", () => {
+    const root = project("parent", { scaffold_id: SCAFFOLD_ID, aiTools: ["codex"] });
+    const nested = join(root, "src", "feature");
+    mkdirSync(join(nested, ".mex"), { recursive: true });
+    writeFileSync(join(nested, ".mex", "config.json"), JSON.stringify({ aiTools: ["cursor"] }));
+    expect(readTelemetryProjectContext(nested)).toEqual({ scaffold_id: SCAFFOLD_ID, configured_ai_tools: ["codex"] });
+    mkdirSync(join(nested, ".git"));
+    expect(readTelemetryProjectContext(nested)).toEqual({ configured_ai_tools: ["cursor"] });
+  });
+
+  it("reads only the supplied root in exact mode even inside another Git project", () => {
+    const root = project("exact-parent", { scaffold_id: SCAFFOLD_ID, aiTools: ["codex"] });
+    const nested = join(root, "nested");
+    mkdirSync(join(nested, ".mex"), { recursive: true });
+    writeFileSync(join(nested, ".mex", "config.json"), JSON.stringify({ aiTools: ["cursor"] }));
+    expect(readTelemetryProjectContext(nested)).toEqual({ scaffold_id: SCAFFOLD_ID, configured_ai_tools: ["codex"] });
+    expect(readTelemetryProjectContext(nested, "exact")).toEqual({ configured_ai_tools: ["cursor"] });
+  });
+
+  it("omits missing exact-root configuration instead of falling back to the containing project", () => {
+    const root = project("exact-missing", { scaffold_id: SCAFFOLD_ID, aiTools: ["codex"] });
+    const nested = join(root, "src");
+    mkdirSync(nested);
+    expect(readTelemetryProjectContext(nested, "exact")).toEqual({});
+    mkdirSync(join(nested, ".mex"));
+    expect(readTelemetryProjectContext(nested, "exact")).toEqual({});
+    expect(readTelemetryProjectContext(nested)).toEqual({ scaffold_id: SCAFFOLD_ID, configured_ai_tools: ["codex"] });
+  });
+
+  it("recognizes a worktree .git file without following or exposing its content", () => {
+    const root = project("worktree", { aiTools: ["claude"] }, "file");
+    expect(readTelemetryProjectContext(root)).toEqual({ configured_ai_tools: ["claude"] });
+  });
+
+  it("supports a non-Git scaffold at the supplied directory without searching ancestor scaffolds", () => {
+    const root = project("loose", { aiTools: ["codex"] }, false);
+    expect(readTelemetryProjectContext(root)).toEqual({ configured_ai_tools: ["codex"] });
+    const nested = join(root, "src");
+    mkdirSync(nested);
+    expect(readTelemetryProjectContext(nested)).toEqual({});
+  });
+
+  it("keeps explicit empty selections distinct from missing or unsupported selections", () => {
+    expect(readTelemetryProjectContext(project("empty", { aiTools: [] }))).toEqual({ configured_ai_tools: [] });
+    expect(readTelemetryProjectContext(project("unknown", { aiTools: ["custom-agent", "CODEX"] }))).toEqual({});
+    expect(readTelemetryProjectContext(project("missing", {}))).toEqual({});
+  });
+
+  it.each([null, "codex", 1, { tool: "codex" }])("omits malformed selection %j independently of a valid UUID", (aiTools) => {
+    const root = project("invalid-tools", { scaffold_id: SCAFFOLD_ID, aiTools });
+    expect(readTelemetryProjectContext(root)).toEqual({ scaffold_id: SCAFFOLD_ID });
+  });
+
+  it.each([null, "private@example.com", "/private/repository", "685f71c3-b91b-1fe1-8376-c8944829cacd", `${SCAFFOLD_ID}\n`, 42])(
+    "omits invalid identity %j independently of valid tools", (scaffold_id) => {
+      const root = project("invalid-id", { scaffold_id, aiTools: ["codex"] });
+      expect(readTelemetryProjectContext(root)).toEqual({ configured_ai_tools: ["codex"] });
+    },
+  );
+
+  it.each(["{", "null", "[]", '"codex"', '{"aiTools":["codex"]}\ntrailing', Buffer.from([0x7b, 0xff, 0x7d])])(
+    "quietly omits malformed JSON or non-UTF8 configuration %#", (bytes) => {
+      const root = project("invalid-json");
+      writeFileSync(join(root, ".mex", "config.json"), bytes);
+      expect(readTelemetryProjectContext(root)).toEqual({});
+    },
+  );
+
+  it("accepts the byte limit and rejects even one excess byte", () => {
+    const root = project("bounded");
+    const path = join(root, ".mex", "config.json");
+    const raw = JSON.stringify({ aiTools: ["codex"] });
+    writeFileSync(path, raw.padEnd(64 * 1024, " "));
+    expect(readTelemetryProjectContext(root)).toEqual({ configured_ai_tools: ["codex"] });
+    writeFileSync(path, raw.padEnd(64 * 1024 + 1, " "));
+    expect(readTelemetryProjectContext(root)).toEqual({});
+  });
+
+  it("bounds ancestor discovery and avoids misattributing a deeper project", () => {
+    const root = project("deep", { aiTools: ["codex"] });
+    const nested = join(root, ...Array.from({ length: 64 }, () => "d"));
+    mkdirSync(nested, { recursive: true });
+    expect(readTelemetryProjectContext(nested)).toEqual({});
+  });
+
+  it("does not create, mint, repair, or modify configuration or scaffold files", () => {
+    const present = project("present", { aiTools: ["codex"] });
+    const absent = project("absent");
+    const missingScaffold = join(directory, "uninitialized");
+    mkdirSync(join(missingScaffold, ".git"), { recursive: true });
+    const before = snapshot(directory);
+    expect(readTelemetryProjectContext(present)).toEqual({ configured_ai_tools: ["codex"] });
+    expect(readTelemetryProjectContext(absent)).toEqual({});
+    expect(readTelemetryProjectContext(missingScaffold)).toEqual({});
+    expect(readTelemetryProjectContext(join(directory, "missing"))).toEqual({});
+    expect(snapshot(directory)).toEqual(before);
+  });
+
+  it("returns fresh snapshots without caching or sharing mutable selections", () => {
+    const root = project("refresh", { aiTools: ["codex"] });
+    const first = readTelemetryProjectContext(root);
+    first.configured_ai_tools?.push("claude");
+    expect(readTelemetryProjectContext(root)).toEqual({ configured_ai_tools: ["codex"] });
+    writeFileSync(join(root, ".mex", "config.json"), JSON.stringify({ aiTools: ["cursor"] }));
+    expect(readTelemetryProjectContext(root)).toEqual({ configured_ai_tools: ["cursor"] });
+  });
+
+  it("rejects non-regular and multiply-linked configuration files", () => {
+    const root = project("file-shape");
+    const path = join(root, ".mex", "config.json");
+    mkdirSync(path);
+    expect(readTelemetryProjectContext(root)).toEqual({});
+    rmSync(path, { recursive: true });
+    const outside = join(directory, "shared-config.json");
+    writeFileSync(outside, JSON.stringify({ aiTools: ["codex"] }));
+    linkSync(outside, path);
+    expect(readTelemetryProjectContext(root)).toEqual({});
+  });
+
+  it("rejects a symlinked configuration file", (context) => {
+    const root = project("file-link");
+    const outside = join(directory, "external-config.json");
+    writeFileSync(outside, JSON.stringify({ aiTools: ["codex"] }));
+    try { symlinkSync(outside, join(root, ".mex", "config.json"), "file"); }
+    catch (error) {
+      if (process.platform === "win32" && (error as NodeJS.ErrnoException).code === "EPERM") { context.skip(); return; }
+      throw error;
+    }
+    expect(readTelemetryProjectContext(root)).toEqual({});
+  });
+
+  it("rejects an escaping scaffold symlink or junction", () => {
+    const root = project("scaffold-link");
+    rmSync(join(root, ".mex"), { recursive: true });
+    const outside = join(directory, "outside");
+    mkdirSync(outside);
+    writeFileSync(join(outside, "config.json"), JSON.stringify({ aiTools: ["codex"] }));
+    symlinkSync(outside, join(root, ".mex"), process.platform === "win32" ? "junction" : "dir");
+    const before = snapshot(outside);
+    expect(readTelemetryProjectContext(root)).toEqual({});
+    expect(snapshot(outside)).toEqual(before);
+  });
+
+  it("omits context when invoked inside the scaffold itself", () => {
+    const root = project("inside", { aiTools: ["codex"] });
+    expect(readTelemetryProjectContext(join(root, ".mex"))).toEqual({});
+    expect(readTelemetryProjectContext(join(root, ".mex"), "exact")).toEqual({});
+  });
+});
diff --git a/test/telemetry.test.ts b/test/telemetry.test.ts
index fe3f2eb4..f1bd5909 100644
--- a/test/telemetry.test.ts
+++ b/test/telemetry.test.ts
@@ -59,7 +59,7 @@ afterEach(async () => {
 
   // Reset module state between tests
   const tel = await import("../src/telemetry/index.js");
-  tel.__setTransport(null);
+  tel.__resetTelemetryForTest();
 
   rmSync(tempHome, { recursive: true, force: true });
   vi.restoreAllMocks();
@@ -123,24 +123,28 @@ describe("opt-out precedence (AC1)", () => {
   });
 });
 
-// ── AC2: payload whitelist — exactly 6 keys, PII fields absent ──
+// ── AC2: payload whitelist — v2 excludes project identity ──
 
 describe("payload whitelist (AC2)", () => {
-  it("buildPayload returns exactly the 6 whitelisted keys", async () => {
+  it("buildPayload shows the v2 allowlist including transport privacy flags", async () => {
     const { buildPayload } = await import("../src/telemetry/index.js");
     const payload = buildPayload("check", "test-scaffold-id");
 
     const keys = Object.keys(payload).sort();
     expect(keys).toEqual([
+      "$geoip_disable",
+      "$process_person_profile",
       "command",
-      "machine_id",
+      "installation_id",
       "mex_version",
       "node_version",
       "os",
-      "scaffold_id",
+      "schema_version",
+      "source",
     ]);
     expect(payload.command).toBe("check");
-    expect(payload.scaffold_id).toBe("test-scaffold-id");
+    expect(payload).not.toHaveProperty("scaffold_id");
+    expect(payload.schema_version).toBe(2);
   });
 
   it("omits scaffold_id when not provided", async () => {
@@ -149,11 +153,15 @@ describe("payload whitelist (AC2)", () => {
 
     const keys = Object.keys(payload).sort();
     expect(keys).toEqual([
+      "$geoip_disable",
+      "$process_person_profile",
       "command",
-      "machine_id",
+      "installation_id",
       "mex_version",
       "node_version",
       "os",
+      "schema_version",
+      "source",
     ]);
   });
 
@@ -177,9 +185,10 @@ describe("getPayloadPreview (AC3)", () => {
 
     const payload = getPayloadPreview("inspect", "scaffold-123", "machine-456");
 
-    expect(payload.command).toBe("inspect");
-    expect(payload.scaffold_id).toBe("scaffold-123");
-    expect(payload.machine_id).toBe("machine-456");
+    expect(payload.command).toBe("wiki.query");
+    expect(payload).not.toHaveProperty("scaffold_id");
+    expect(payload).not.toHaveProperty("machine_id");
+    expect(JSON.stringify(payload)).not.toContain("machine-456");
     expect(events).toHaveLength(0); // no send
   });
 });
@@ -332,7 +341,8 @@ describe("first-run notice (AC9)", () => {
 
       // Check it contains opt-out instructions
       const output = stderrSpy.mock.calls.map(c => c[0]).join("");
-      expect(output).toContain("mex config set telemetry off");
+      expect(output).toContain("mex telemetry disable");
+      expect(output).toContain("pseudonymous");
       expect(output).toContain("DO_NOT_TRACK");
     } finally {
       Object.defineProperty(process.stderr, "isTTY", { value: originalIsTTY, configurable: true });
@@ -392,7 +402,7 @@ describe("no I/O at import time (AC10)", () => {
 // ── captureCommand: PII firewall ──
 
 describe("captureCommand PII firewall", () => {
-  it("sends only the scaffold_id string, not identity object fields", async () => {
+  it("ignores all project identity and emits a namespaced event", async () => {
     exitDevRepo(); // need telemetry enabled
     const { captureCommand, __setTransport } = await import("../src/telemetry/index.js");
     const events: Array<{ event: string; properties: Record<string, unknown> }> = [];
@@ -402,7 +412,8 @@ describe("captureCommand PII firewall", () => {
 
     expect(events).toHaveLength(1);
     const props = events[0].properties;
-    expect(props.scaffold_id).toBe("some-uuid-here");
+    expect(events[0].event).toBe("cli.command_started");
+    expect(props).not.toHaveProperty("scaffold_id");
     expect(props.command).toBe("check");
     expect(props).not.toHaveProperty("scaffold_name");
     expect(props).not.toHaveProperty("origin");
diff --git a/test/wiki-architecture.test.ts b/test/wiki-architecture.test.ts
index beb1ba52..ec017ad7 100644
--- a/test/wiki-architecture.test.ts
+++ b/test/wiki-architecture.test.ts
@@ -2,6 +2,7 @@ import { describe, it, expect } from "vitest";
 import { mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, relative, dirname, resolve } from "node:path";
+import { eventAttributes } from "../src/telemetry/schema.js";
 
 /**
  * Architectural lint for the wiki engine.
@@ -416,64 +417,64 @@ function allTypeScriptFiles(): string[] {
 }
 
 /**
- * Telemetry sees a command name and a scaffold id. Never an argument.
- *
- * §19 says wiki content does not leave the device. Every phase before this one
- * shipped no commands, so nothing the wiki owned had arguments at all; P9 is
- * the first surface whose arguments *are* user content — a query string, an
- * entity id, a file path, an operation payload. `captureCommand(command,
- * scaffoldId)` takes only those two and its own comment calls the second the
- * PII firewall, so the rule is already right; what was missing is anything
- * asserting a later command cannot widen it.
- *
- * Checked over the source rather than by running a command, because the
- * property is "there is no code path that can", and a behavioural test only
- * covers the paths someone thought to exercise.
+ * Product modules cannot bypass the CLI/Hub projection with direct captures.
+ * Only their composition roots import the capture entry point. Runtime schema
+ * checks complement this dependency guard: command names are a closed catalog,
+ * and no event accepts query text, paths, artifact IDs, or arbitrary properties.
  */
+const TELEMETRY_COMPOSITION_ROOTS = ["src/cli.ts", "src/hub/command.ts"];
+
 function findTelemetryLeaks(path: string, source: string): string[] {
+  if (path.startsWith("src/telemetry/")) return [];
   const code = withoutComments(source);
   const violations: string[] = [];
-  // The declaration itself is not a call site.
-  // One level of nesting is allowed inside the argument list, because the
-  // legitimate call passes `actionCommand.name()` and a pattern that stopped
-  // at the first `)` would read that as a truncated argument.
-  for (const match of code.matchAll(/(function\s+)?captureCommand\s*\((?:\s*)((?:[^()]|\([^()]*\))*)\)/g)) {
-    if (match[1] !== undefined) continue;
-    const args = (match[2] ?? "").split(",").map((part) => part.trim()).filter((part) => part.length > 0);
-    if (args.length > 2) {
-      violations.push(`${path}: captureCommand takes a command name and a scaffold id, not ${args.length} arguments`);
-      continue;
-    }
-    // The first argument must be the command's own name, never a value the
-    // user typed. Anything else is a leak whatever it is called.
-    const first = args[0] ?? "";
-    if (!/name\(\)$/.test(first) && !/^"[a-z][a-z -]*"$/.test(first)) {
-      violations.push(`${path}: captureCommand's first argument is ${first}, which is not a command name`);
+  for (const specifier of importSpecifiers(code)) {
+    const resolved = resolveSpecifier(path, specifier);
+    if (!resolved.startsWith("src/telemetry/") || resolved === "src/telemetry/schema.js") continue;
+    if (resolved !== "src/telemetry/index.js" || !TELEMETRY_COMPOSITION_ROOTS.includes(path)) {
+      violations.push(`${path} imports ${resolved}; telemetry must use the CLI/Hub projection`);
     }
   }
+  // Composition roots pass the capture function to the projection; they never
+  // call it with command arguments themselves. Legacy hooks stay inside core.
+  if (/\b(?:captureEvent|captureCommand)\s*\(/.test(code)) {
+    violations.push(`${path} captures directly instead of using the CLI/Hub projection`);
+  }
   return violations;
 }
 
-describe("telemetry never receives an argument", () => {
+describe("telemetry keeps Wiki arguments behind the shared projection", () => {
   it("holds across every shipped module", () => {
-    // `sourceFiles()` rather than the whole tree: telemetry is called from
-    // `src/`, and this file's own planted violations are string literals that
-    // a walk over `test/` would read as real ones.
     expect(FILES.flatMap((path) => findTelemetryLeaks(path, read(path)))).toEqual([]);
   });
 
-  it("checks a file that actually calls it", () => {
-    const callers = FILES.filter((path) => withoutComments(read(path)).includes("captureCommand("));
-    expect(callers).toContain("src/cli.ts");
-    expect(callers.length).toBeGreaterThan(0);
+  it("checks the real production capture entry points", () => {
+    const callers = FILES.filter((path) => importSpecifiers(withoutComments(read(path)))
+      .some((specifier) => resolveSpecifier(path, specifier) === "src/telemetry/index.js"));
+    expect(callers.sort()).toEqual([...TELEMETRY_COMPOSITION_ROOTS].sort());
+    expect(read("src/cli.ts")).toContain("createCliTelemetry(captureEvent, flush,");
   });
 
-  it("catches a wiki command that passed its argument along", () => {
-    expect(
-      findTelemetryLeaks("src/cli.ts", 'captureCommand("wiki query", queryText, scaffoldId);'),
-    ).toHaveLength(1);
-    expect(findTelemetryLeaks("src/cli.ts", "captureCommand(userQuery, scaffoldId);")).toHaveLength(1);
-    expect(findTelemetryLeaks("src/cli.ts", "captureCommand(actionCommand.name(), scaffoldId);")).toEqual([]);
+  it("rejects bypasses, including aliased imports and direct transport access", () => {
+    expect(findTelemetryLeaks("src/cli.ts", 'captureCommand("wiki query", queryText, scaffoldId);')).toHaveLength(1);
+    expect(findTelemetryLeaks("src/cli.ts", 'captureEvent("cli.command_started", { command: userQuery });')).toHaveLength(1);
+    expect(findTelemetryLeaks("src/wiki/cli/query.ts",
+      'import { captureEvent as send } from "../../telemetry/index.js";')).toHaveLength(1);
+    expect(findTelemetryLeaks("src/cli.ts",
+      'import { sendBatch } from "./telemetry/transport.js";')).toHaveLength(1);
+    expect(findTelemetryLeaks("src/wiki/query/query.ts",
+      'export { captureEvent } from "../../telemetry/index.js";')).toHaveLength(1);
+    expect(findTelemetryLeaks("src/cli.ts",
+      'import { captureEvent, flush } from "./telemetry/index.js"; createCliTelemetry(captureEvent, flush);')).toEqual([]);
+  });
+
+  it("rejects Wiki input values and extra properties at the final schema boundary", () => {
+    const event = "cli.command_started";
+    expect(eventAttributes(event, { command: "wiki.query" })).toEqual({ command: "wiki.query" });
+    for (const value of ["private query text", "component:private-id", "/private/project/file.ts"]) {
+      expect(eventAttributes(event, { command: value })).toBeUndefined();
+      expect(eventAttributes(event, { command: "wiki.query", argument: value })).toBeUndefined();
+    }
   });
 });
 
diff --git a/vitest.config.ts b/vitest.config.ts
index 4a26743e..e879a5f5 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -13,6 +13,7 @@ export default defineConfig({
       // `npm run eval:compare:test`, so Vitest must not collect the same files.
       "evaluate/compare/test/**",
       "evaluate/graph/test/**",
+      "scripts/benchmark-telemetry.test.js",
       // The Hub web workspace supplies its own jsdom/CSS configuration and the
       // browser suite is collected by Playwright, not the root Node test run.
       "packages/hub-web/**",