From cbc5019a10d138c0e3603dee59e0977bf3afb644 Mon Sep 17 00:00:00 2001 From: Alexey Martemyanov Date: Mon, 21 Sep 2026 16:50:13 +0600 Subject: [PATCH] [2026-09-21] eagle: work/projects/cpm-m3-telemetry-privacy-triage.md --- work/projects/cpm-m3-telemetry-privacy-triage.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/work/projects/cpm-m3-telemetry-privacy-triage.md b/work/projects/cpm-m3-telemetry-privacy-triage.md index 1d5cfb7f..35fceca6 100644 --- a/work/projects/cpm-m3-telemetry-privacy-triage.md +++ b/work/projects/cpm-m3-telemetry-privacy-triage.md @@ -53,9 +53,9 @@ Unavailable optional facts are omitted. The first nine parameters are booleans ( | `bg_view_creations` | Creations since context load: `0`, `1`, `2`, `3_to_5`, `over_5`. | | `bg_view_leaked_count` | Retained views beyond the expected current view; same buckets. Not proof of a leak. | | `context_errors` | `none` or accumulated error descriptors: raw domain/code pairs, including the immediate underlying error. No localized text; no explicit payload cap. | -| `bg_events` | Recent lifecycle sequence with relative ages in whole seconds. | +| `bg_events` | Recent lifecycle sequence with bucketed ages relative to the snapshot. | -The recorder keeps 40 events. `bg_events` sends up to the last 12, within 255 characters, dropping older entries first. Format: `event_name@-seconds` before the snapshot. +The recorder keeps 40 events. `bg_events` sends up to the last 12, within 255 characters, dropping older entries first. Format: `event_name@age_bucket`. Buckets: `30s` (<30s), `1m` (30–<60s), `2m` (1–<2 min), `5m` (2–<5 min), `15m` (5–<15 min), `over_15` (≥15 min). Events remain oldest first; order and repeated events within a bucket are preserved. Exact ages are not sent. Events: `load`, `view`, `dealloc`, `unresponsive`, `responsive`, `proxy_on`, `proxy_off`, `died_`, `error_`, `context_unload_failed_`, `extension_files_remove_failed_`. @@ -63,7 +63,7 @@ Termination reasons: `memory`, `cpu`, `client`, `crash`, `crash_limit`, `unknown Timeline labels are lowercased, character-filtered and truncated to 64 characters, which can cut off error codes. `context_errors` and reload error fields preserve raw domain/code pairs. -Example: `view@-60,died_crash@-42` means the view was created 60 seconds before the snapshot and its process crashed 42 seconds before it. +Example: `view@2m,died_crash@1m` means the view was created 1–<2 minutes before the snapshot and its process crashed 30–<60 seconds before it. ### Reload-failure parameters @@ -88,13 +88,13 @@ Localized descriptions, file paths and other userInfo contents are not serialize - Unit tests: parameter serialization, buckets, timeline limits, attachment to failure/stuck pixels, reload-error mapping, delegate forwarding, ownership and runtime flag changes. - Integration validation on iOS/macOS: force background-process termination, check the emitted diagnostics, test proxy on/off and extension reload failures. Confirm unknown SPI values are omitted. -- Privacy validation: inspect actual payloads and run both platform schema validators. Confirm URLs, identifiers and error messages are absent. Review exact-second timelines and error-domain/code values before release. +- Privacy validation: inspect actual payloads and run both platform schema validators. Confirm URLs, identifiers and error messages are absent. Verify age-bucket boundaries and event order; review error-domain/code values before release. ## Additional Considerations (if applicable) **Privacy** -New pixel and additional parameters require Privacy Triage. These payloads do not intentionally collect browsing URLs, search queries, page content, message payloads, tab/context IDs or PIDs. Exact-second timelines and unrestricted domain/code pairs create many distinct values; Privacy Triage must decide whether to bucket or restrict them. `data_clearing` discloses the operation preceding a failed reload. +New pixel and additional parameters require Privacy Triage. These payloads do not intentionally collect browsing URLs, search queries, page content, message payloads, tab/context IDs or PIDs. Event ages are bucketed; unrestricted domain/code pairs still require Privacy Triage review. `data_clearing` discloses the operation preceding a failed reload. Local context-error diagnostics log only original and immediate underlying error domains/codes, without localized descriptions or other userInfo contents.