diff --git a/work/projects/cpm-m3-telemetry-privacy-triage.md b/work/projects/cpm-m3-telemetry-privacy-triage.md
index c02bfde3..c0e05b39 100644
--- a/work/projects/cpm-m3-telemetry-privacy-triage.md
+++ b/work/projects/cpm-m3-telemetry-privacy-triage.md
@@ -20,9 +20,9 @@ This proposal covers diagnostic collection only; it does not change recovery beh
 
 ## Recommended Approach
 
-Keep the existing CPM failure/stuck detection. A shared in-memory recorder collects lifecycle events, critical-memory-pressure notifications and current WebKit/tab state. When a failure or stuck pixel fires, attach a best-effort snapshot. No additional JavaScript probes or periodic telemetry uploads are introduced.
+Keep the existing CPM failure/stuck detection. A shared in-memory recorder collects lifecycle events, critical-memory-pressure notifications and current WebKit/tab state. When a failure or stuck pixel fires, capture native state synchronously on the main actor and attach a best-effort snapshot. Callbacks from an earlier context load cannot enter the current timeline. No additional JavaScript probes or periodic telemetry uploads are introduced.
 
-A forwarding delegate proxy observes background-process termination and responsiveness callbacks. The original delegate owns the proxy; the proxy references it weakly. A remote flag enables/disables proxy installation, not the entire diagnostics recorder.
+A forwarding delegate proxy observes background-process termination and responsiveness callbacks. The original delegate owns the proxy; the proxy references it weakly. A remote flag enables proxy installation on the current view; disabling restores the original delegates on all surviving observed views, including views retained after unload. It does not disable the entire diagnostics recorder.
 
 | Pixel | Trigger | Frequency |
 |---|---|---|
@@ -92,7 +92,7 @@ Original domains/codes are preserved without category mapping. Localized descrip
 
 New pixel and additional parameters require Privacy Triage. No intentional collection of browsing URLs, search queries, page content, message payloads, tab/context IDs or PIDs in these payloads. Exact-second timelines and unrestricted error-domain/code combinations can be high-cardinality; bucketing/allowlisting needs a decision. `data_clearing` discloses the operation preceding a failed reload.
 
-Current local diagnostics logs separately include raw errors with `privacy: .public`; remove/redact these before production. Pixel approval does not approve those logs.
+Local context-error diagnostics log only original and immediate underlying error domains/codes, without localized descriptions or other userInfo contents.
 
 **Security**
 
@@ -108,7 +108,7 @@ None. Recovery changes and experiments are outside this proposal.
 
 **Operational**
 
-Update the existing CPM Grafana board for the new fields and reload failures. Agree a diagnostic removal/review date; none is enforced currently. Failure-only snapshots do not provide a denominator of all process deaths or prove an all-tabs outage. Rolling timelines can lose the trigger; deferred snapshots can observe newer state.
+Update the existing CPM Grafana board for the new fields and reload failures. Agree a diagnostic removal/review date; none is enforced currently. Failure-only snapshots do not provide a denominator of all process deaths or prove an all-tabs outage. Rolling timelines can lose the trigger; snapshots are captured synchronously at failure time.
 
 **Localization / Internationalization**