[Operations] Build redacted diagnostics, crash evidence and an offline support bundle #963

Parent: #958
Baseline: #968

Buyer-visible gap

A desktop analysis product will fail on unfamiliar codecs, devices, permissions, CPU/GPU environments, malformed local files, and interrupted workflows. The live queue includes useful narrow redaction and workflow-evidence PRs—such as #826, #895, #941, #949, #950, #951, and #956—but no single typed diagnostics contract or privacy-safe offline support bundle owns the complete failure journey.

Scattered log hardening is necessary; it is not a supportability architecture.

Product outcome

BandScope emits bounded, typed, redacted local diagnostic events and can generate a deterministic, user-previewable support bundle containing enough environment/configuration evidence to diagnose a failure while excluding audio, project payloads, credentials, and unnecessary PII.

Required scope

Typed diagnostics contract

• Define stable event IDs, severity, stage, component, retryability, next-action code, correlation ID, monotonic sequence, and bounded fields.
• Derive buyer-facing explanation and developer evidence from the same typed error rather than separately assembled strings.
• Allowlist permitted fields instead of applying broad post-hoc regex masking to arbitrary logs.
• Represent local files through opaque references and bounded metadata; never emit absolute paths, raw URLs, usernames, home directories, audio, or project content.
• Version the event schema and support parsing of retained historical schemas.

Local-first observability

• Keep a bounded local ring buffer with explicit retention and size limits.
• Capture analysis-stage latency, queue depth, cancellation, backend/device selection, peak resource observations, and result state without user content.
• Provide an OpenTelemetry-compatible projection for authorized operator use, while remote export remains disabled by default.
• Require explicit enablement, purpose, tenant, retention, and egress controls for any remote diagnostics adapter.

Crash and hang evidence

• Record clean/unclean shutdown markers, exact app/source/build identity, OS/architecture, active stage, last successful checkpoint, and non-sensitive symbol/stack evidence where platform policy permits.
• Coordinate source maps/symbols with [Security] Rebuild cross-platform filesystem path containment boundary #852 and the signed release pipeline in [Release] Ship signed, notarized, auto-updatable desktop builds with rollback evidence #960.
• Detect stalled analysis/player operations through a bounded watchdog and preserve project recovery before any restart/termination action.

Support bundle

• Generate the bundle offline only after explicit user action.
• Preview every included category and allow exclusion of optional categories.
• Include a manifest, schema version, checksums, exact build identity, environment/capability summary, bounded diagnostic events, migration/recovery receipts, and recent failed-stage evidence.
• Exclude audio, score PDFs, project JSON, lyrics, handoff payloads, credentials, environment variables, raw URLs, and absolute paths.
• Use safe archive paths, bounded entry count/size/compression, deterministic ordering where feasible, and a signed or hashed manifest.
• Generate human-readable and machine-readable reports from the same source model.

Live PR convergence

• 🧪 [테스트 개선] TemporalAnalyzer 분석 오류 테스트 추가 #826, fix(security): redact key detector dependency failures #949, fix(security): redact temporal detector failure logs #950, fix(security): redact range-analysis failure logs #951, and fix(security): redact articulation failure logs #956 are current failure/redaction slices and must converge on one shared error/log contract rather than five permanent helpers.
• 🛡️ Sentinel: CSV 수식 주입 NUL·전각 연산자 우회 차단 #941 remains a bounded export-security slice and must feed support evidence only through typed events.
• fix(workflows): audit orphaned Actions registry identities #895 concerns GitHub Actions registry evidence; it belongs to release/operations metadata, not desktop runtime authority.
• Preserve each valid narrow security regression while eliminating duplicate logging/redaction implementations.

Acceptance criteria

• Every production failure crossing UI, Tauri/Rust, Python/analysis, player, project, updater, and export boundaries maps to a typed event and customer next action.
• Static and runtime tests prove forbidden content cannot enter ordinary logs or support bundles.
• The support bundle is generated without network access and previews every included artifact/category.
• The same input evidence generates a stable manifest and semantically equivalent human/machine reports.
• Bundle size, event count, string length, archive entries, compression ratio, and generation time are bounded before allocation/write.
• Crash, forced termination, Python failure, GPU/backend fallback, decoder failure, device loss, migration failure, and updater failure produce actionable evidence.
• Diagnostics never mutate project state or weaken recovery.
• Remote telemetry is disabled by default and clearly disclosed when enabled.
• Repository-owned production statement/branch coverage and public API documentation remain 100%.
• Fuzz, property, redaction, archive-safety, concurrent-event, and platform tests pass on the exact head.
• Existing redaction PRs have a canonical succession map and duplicate helpers are removed or closed.
• Current-head checks, qualifying independent approval, zero unresolved actionable threads, and branch protection pass without bypass.

Adversarial tests

• Windows UNC and macOS home paths; non-UTF-8 filenames;
• URL userinfo, query secrets, fragments, and encoded credentials;
• exception text containing API keys, bearer tokens, emails, and raw subprocess arguments;
• very long, multiline, and control-character error messages;
• symlinked bundle destination and archive traversal names;
• event flood during repeated decoder failure;
• crash during bundle generation;
• old-schema logs and partial/corrupt evidence;
• user excludes an optional category;
• bundle inspection on a machine without BandScope.

Non-goals

• No automatic support upload.
• No full-memory dump or raw user-content collection.
• No broad regex masking as the primary safety boundary.
• No claim that sampled observability data is a billing or product-data source of truth.