[2026-09-21] eagle: work/projects/cpm-m3-telemetry-privacy-triage.md

work/projects/cpm-m3-telemetry-privacy-triage.md

@@ -53,9 +53,9 @@ Unavailable optional facts are omitted. The first nine parameters are booleans (
 | `bg_view_creations` | Creations since context load: `0`, `1`, `2`, `3_to_5`, `over_5`. |
 | `bg_view_leaked_count` | Retained views beyond the expected current view; same buckets. Not proof of a leak. |
 | `context_errors` | `none` or accumulated error descriptors: raw domain/code pairs, including the immediate underlying error. No localized text; no explicit payload cap. |
-| `bg_events` | Recent lifecycle sequence with relative ages in whole seconds. |
+| `bg_events` | Recent lifecycle sequence with bucketed ages relative to the snapshot. |
 
-The recorder keeps 40 events. `bg_events` sends up to the last 12, within 255 characters, dropping older entries first. Format: `event_name@-seconds` before the snapshot.
+The recorder keeps 40 events. `bg_events` sends up to the last 12, within 255 characters, dropping older entries first. Format: `event_name@age_bucket`. Buckets: `30s` (<30s), `1m` (30–<60s), `2m` (1–<2 min), `5m` (2–<5 min), `15m` (5–<15 min), `over_15` (≥15 min). Events remain oldest first; order and repeated events within a bucket are preserved. Exact ages are not sent.
 
 Events: `load`, `view`, `dealloc`, `unresponsive`, `responsive`, `proxy_on`, `proxy_off`, `died_<reason>`, `error_<descriptor>`, `context_unload_failed_<descriptor>`, `extension_files_remove_failed_<descriptor>`.
 
@@ -63,7 +63,7 @@ Termination reasons: `memory`, `cpu`, `client`, `crash`, `crash_limit`, `unknown
 
 Timeline labels are lowercased, character-filtered and truncated to 64 characters, which can cut off error codes. `context_errors` and reload error fields preserve raw domain/code pairs.
 
-Example: `view@-60,died_crash@-42` means the view was created 60 seconds before the snapshot and its process crashed 42 seconds before it.
+Example: `view@2m,died_crash@1m` means the view was created 1–<2 minutes before the snapshot and its process crashed 30–<60 seconds before it.
 
 ### Reload-failure parameters
 
@@ -88,13 +88,13 @@ Localized descriptions, file paths and other userInfo contents are not serialize
 
 - Unit tests: parameter serialization, buckets, timeline limits, attachment to failure/stuck pixels, reload-error mapping, delegate forwarding, ownership and runtime flag changes.
 - Integration validation on iOS/macOS: force background-process termination, check the emitted diagnostics, test proxy on/off and extension reload failures. Confirm unknown SPI values are omitted.
-- Privacy validation: inspect actual payloads and run both platform schema validators. Confirm URLs, identifiers and error messages are absent. Review exact-second timelines and error-domain/code values before release.
+- Privacy validation: inspect actual payloads and run both platform schema validators. Confirm URLs, identifiers and error messages are absent. Verify age-bucket boundaries and event order; review error-domain/code values before release.
 
 ## Additional Considerations (if applicable)
 
 **Privacy**
 
-New pixel and additional parameters require Privacy Triage. These payloads do not intentionally collect browsing URLs, search queries, page content, message payloads, tab/context IDs or PIDs. Exact-second timelines and unrestricted domain/code pairs create many distinct values; Privacy Triage must decide whether to bucket or restrict them. `data_clearing` discloses the operation preceding a failed reload.
+New pixel and additional parameters require Privacy Triage. These payloads do not intentionally collect browsing URLs, search queries, page content, message payloads, tab/context IDs or PIDs. Event ages are bucketed; unrestricted domain/code pairs still require Privacy Triage review. `data_clearing` discloses the operation preceding a failed reload.
 
 Local context-error diagnostics log only original and immediate underlying error domains/codes, without localized descriptions or other userInfo contents.