[devigned]

User workflow

Add bug and feature-request forms, a short reporting guide, and direct application/documentation links. Users can save one diagnostic ZIP through Save diagnostic report... in the native tray or VX Bridge Diagnostics in Start even if the host is missing, unstarted or refused. The distinct control client also supports --diagnostics <new-absolute-local-file.zip> and --diagnostics-dialog.

Save/cancel/saved/partial/failure states are explicit. Reports are saved locally for review and optional manual attachment. Nothing is uploaded or submitted by the bridge; a failed exporter does not block a bug report.

Implementation

• Share one read-only Go exporter across all entry points. ZIP schema 1 has exactly summary.txt, manifest.json, report.json and events.jsonl.
• Include structured release/source/toolchain/architecture identity, numeric Windows build facts, approved settings/endpoints, bounded status and recent events/counters/log-loss health, typed installer-result fields and six-file checks against the local receipt. Keep reporter, running host and installed receipt identity separate. Retain the legacy composite/prototype identity for compatibility.
• Revalidate allowlisted fields from untrusted/malformed logs and metadata. Exclude raw MSI/vendor logs, shot/player/device/license/account data, local shot aliases, credentials, private paths and raw OS error text. Missing, refused, corrupt or truncated sources remain explicit.
• Bound collection waiting to eight seconds with a one-second status-only query, one source worker per process, fixed input byte limits, 2,048 exported log events and a 2 MiB ZIP cap. A blocked source cannot accumulate workers. Existing logs are never cleared, rotated or flushed for export.
• Reuse managed receipt and Windows pin checks, reject unsafe source/output links, exclusively create a new local output, and report write/sync/close failures. Keep collection/save/dialog work off engine and native tray owner threads and independent of ordinary desktop actions.
• Author and statically inspect the nonadvertised support shortcut, check exact ownership before maintenance, require it before usable completion, and include it in upgrade/uninstall inventory and absence checks. Preserve the six-file installed payload and public EXE-plus-checksum release contract.
• Document normal submission, no-host/partial cases, privacy, command semantics and practical maintainer triage.

Validation

Hosted CI passed for this signed head: portable source/race/lint checks, pinned native-input builds, Windows unit tests and static MSI/self-contained installer/package integrity. These checks do not install or launch the product.

Local make ci, Windows amd64 cross-vet, exact clean signed-commit application packaging and independent archive verification also pass. Focused fixtures cover running/unavailable hosts, corrupt/missing inputs, private strings in exported surfaces, source/ZIP budgets, concurrent log rotation, cancellation, bounded/busy workers, existing/unsafe output refusal, write/sync/close failures and blocked-report responsiveness. Issue YAML parses with minimal required fields; changed Markdown links/anchors and patch whitespace checks pass. The commit signature was verified against the user's existing configured signing identity before pushing.

Remaining qualification boundary

Interactive native save/cancel/accessibility/DPI behavior and real install/repair/upgrade/uninstall have not been qualified by this change. No simulator, Labs/game, vendor/account, sign-in, reboot, private installer qualification or research probe was run. No merge, tag or release is requested.