Merge pull request #4809 from deepseek-harness/otel/product-telemetry

feat(telemetry): add explicit product event OTLP exporter
2026-09-21 17:59:21 +08:00
commit c82e40d498
@@ -54,8 +54,10 @@ External packages installed for runtime use or distributed inside the prebuilt b
 | [`@openai/codex`](https://github.com/openai/codex) | Apache-2.0 |
 | [`@opentelemetry/api`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
 | [`@opentelemetry/api-logs`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/core`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
 | [`@opentelemetry/exporter-logs-otlp-http`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
 | [`@opentelemetry/otlp-exporter-base`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
+| [`@opentelemetry/otlp-transformer`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
 | [`@opentelemetry/resources`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
 | [`@opentelemetry/sdk-logs`](https://github.com/open-telemetry/opentelemetry-js) | Apache-2.0 |
 | [`@playwright/mcp`](https://github.com/microsoft/playwright-mcp) | Apache-2.0 |
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/capability-seams.md
-capability-seams.md: 66425afe98bcbefe69912bf130cb72bba9435ec0
-capability-seams.zh.md: faa31be64081a80d58a0f302f91c737c34ed3f38
+capability-seams.md: 072cb47af420136a08ce182cfa341bb42fc068e0
+capability-seams.zh.md: 138fb3241a00cb2f6ab8853dd9cbf1440fe6d490
@@ -3,7 +3,7 @@

 # Capability Seams And Core Services

-A service can be a core spine service, a swappable capability seam, or a bundle/composition point. The graph shows the package that owns the service declaration, known implementation packages, and packages that consume the service directly.
+A service can be a core spine service, a swappable capability seam, a bundle/composition point, or a standalone service. The graph shows the package that owns the service declaration, known implementation packages, and packages that consume the service directly.

 ```mermaid
 flowchart LR
@@ -104,6 +104,8 @@ flowchart LR
  pkg_credentials_local["credentials-local"]
  pkg_authorization["authorization"]
  svc_authorization["ctx.authorization<br/>Authorization flow registry"]
+  pkg_host_product_telemetry_otel["host-product-telemetry-otel"]
+  svc_productTelemetry["ctx.productTelemetry<br/>Product usage event sender"]
  pkg_session_telemetry["session-telemetry"]
  svc_sessionTelemetry["ctx.sessionTelemetry<br/>Session telemetry seam"]
  pkg_session_telemetry_otel["session-telemetry-otel"]
@@ -318,6 +320,7 @@ flowchart LR
  pkg_host_directory_picker --> svc_directoryPicker
  pkg_host_directory_picker_browse --> svc_directoryPicker
  pkg_host_directory_picker_native --> svc_directoryPicker
+  pkg_host_product_telemetry_otel --> svc_productTelemetry
  pkg_host_webserver --> svc_webServer
  pkg_inspector --> svc_inspector
  pkg_invariants --> svc_invariants
@@ -586,6 +589,7 @@ flowchart LR
 | `ctx.subagentModelSelection` | `core` | [`tool-subagent`](../packages/subagent/tool-subagent) | - | [`tool-subagent`](../packages/subagent/tool-subagent) | - | Owns the default-off settings namespace that Agent-scoped delegation tools sample when composing a new top-level Session. |
 | `ctx.credentials` | `seam` | [`credentials`](../packages/credentials/credentials) | [`credentials-local`](../packages/credentials/credentials-local) | [`api-settings-controller`](../packages/api/settings-controller), [`llm-deepseek`](../packages/llm/llm-deepseek), [`llm-pi-ai`](../packages/llm/llm-pi-ai) | - | Configuration carries references to secrets; providers own the values. Consumers resolve per operation, so a rotated credential reaches the very next request; the settings controller exposes value-free views and write-only storage. |
 | `ctx.authorization` | `seam` | [`authorization`](../packages/credentials/authorization) | - | [`llm-pi-ai`](../packages/llm/llm-pi-ai) | - | Flows are registered by the plugin that knows how to obtain one credential and keyed by the record they write; the seam owns the conversation and the one-attempt-per-key lifecycle, never the protocol. |
+| `ctx.productTelemetry` | `service` | [`host-product-telemetry-otel`](../packages/host/product-telemetry-otel) | - | - | - | Exports explicitly submitted analytics events through OTLP/HTTP; mounting alone collects nothing. |
 | `ctx.sessionTelemetry` | `seam` | [`session-telemetry`](../packages/session/session-telemetry) | [`session-telemetry-otel`](../packages/session/session-telemetry-otel) | - | - | The seam captures, redacts, and hands session records to one backend; nothing else consumes the service — its output leaves the process. |
 | `ctx.storage` | `seam` | [`storage`](../packages/storage/storage) | [`storage-json`](../packages/storage/storage-json), [`storage-sqlite`](../packages/storage/storage-sqlite) | [`storage-domain`](../packages/storage/storage-domain) | - | Backends register side by side under names; data forms (domain first) mount on the hub and translate typed operations into opaque KV-unit primitives. |
 | `ctx.storageDomain` | `core` | [`storage-domain`](../packages/storage/storage-domain) | - | [`workspace`](../packages/workspace/workspace) | - | Waits for every configured backend, then publishes the domain form as one lifecycle-bound service for typed durable state. |
@@ -5,7 +5,7 @@

 [English](capability-seams.md) | 中文

-服务可以是核心主干服务、可替换的能力 seam，也可以是组合包／组合点。下图展示了拥有服务声明的包、已知实现包，以及直接消费该服务的包。
+服务可以是核心主干服务、可替换的能力 seam、组合包／组合点或独立服务。下图展示了拥有服务声明的包、已知实现包，以及直接消费该服务的包。

 ```mermaid
 flowchart LR
@@ -106,6 +106,8 @@ flowchart LR
  pkg_credentials_local["credentials-local"]
  pkg_authorization["authorization"]
  svc_authorization["ctx.authorization<br/>Authorization flow registry"]
+  pkg_host_product_telemetry_otel["host-product-telemetry-otel"]
+  svc_productTelemetry["ctx.productTelemetry<br/>Product usage event sender"]
  pkg_session_telemetry["session-telemetry"]
  svc_sessionTelemetry["ctx.sessionTelemetry<br/>Session telemetry seam"]
  pkg_session_telemetry_otel["session-telemetry-otel"]
@@ -320,6 +322,7 @@ flowchart LR
  pkg_host_directory_picker --> svc_directoryPicker
  pkg_host_directory_picker_browse --> svc_directoryPicker
  pkg_host_directory_picker_native --> svc_directoryPicker
+  pkg_host_product_telemetry_otel --> svc_productTelemetry
  pkg_host_webserver --> svc_webServer
  pkg_inspector --> svc_inspector
  pkg_invariants --> svc_invariants
@@ -588,6 +591,7 @@ flowchart LR
 | `ctx.subagentModelSelection` | `core` | [`tool-subagent`](../packages/subagent/tool-subagent) | - | [`tool-subagent`](../packages/subagent/tool-subagent) | - | 拥有默认关闭的设置命名空间；Agent 作用域的委派工具会在组合新顶层 Session 时读取它。 |
 | `ctx.credentials` | `seam` | [`credentials`](../packages/credentials/credentials) | [`credentials-local`](../packages/credentials/credentials-local) | [`api-settings-controller`](../packages/api/settings-controller), [`llm-deepseek`](../packages/llm/llm-deepseek), [`llm-pi-ai`](../packages/llm/llm-pi-ai) | - | 配置携带对机密信息的引用；提供方拥有实际值。消费方按操作解析，因此轮换后的凭据会在紧接着的下一次请求中生效；settings controller 提供不含实际值的视图和只写存储。 |
 | `ctx.authorization` | `seam` | [`authorization`](../packages/credentials/authorization) | - | [`llm-pi-ai`](../packages/llm/llm-pi-ai) | - | flow 由知道如何取得某份凭据的插件注册，并以其写入的记录为键；seam 拥有这段对话与"每个键同时只跑一次尝试"的生命周期，而非协议本身。 |
+| `ctx.productTelemetry` | `service` | [`host-product-telemetry-otel`](../packages/host/product-telemetry-otel) | - | - | - | 通过 OTLP/HTTP 发送显式提交的分析事件；仅挂载插件不会采集信息。 |
 | `ctx.sessionTelemetry` | `seam` | [`session-telemetry`](../packages/session/session-telemetry) | [`session-telemetry-otel`](../packages/session/session-telemetry-otel) | - | - | 该 seam 捕获会话记录、进行脱敏并交给一个后端；没有其他组件消费该服务，其输出会离开当前进程。 |
 | `ctx.storage` | `seam` | [`storage`](../packages/storage/storage) | [`storage-json`](../packages/storage/storage-json), [`storage-sqlite`](../packages/storage/storage-sqlite) | [`storage-domain`](../packages/storage/storage-domain) | - | 各后端以不同名称并列注册；数据形态（领域优先）挂载到枢纽上，并将类型化操作转换为不透明的 KV 单元原语。 |
 | `ctx.storageDomain` | `core` | [`storage-domain`](../packages/storage/storage-domain) | - | [`workspace`](../packages/workspace/workspace) | - | 等待所有已配置后端就绪，然后将领域形态发布为一个受生命周期约束的服务，用于类型化持久状态。 |
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/config-catalog.md
-config-catalog.md: 32faec64e3ece1053430219c6be57a7044308f5a
-config-catalog.zh.md: 08a7b368e0332b917de1f627a22415ede4d18f36
+config-catalog.md: 2225721f4adf3e938da7fa74a3b1cb2b159b0ed4
+config-catalog.zh.md: 21e95ea2a3bbbcf3f4667dd3f26fc10e6f607d7b
@@ -1208,6 +1208,40 @@ export interface Config {

 Source: [`packages/host/open-in-app/src/index.ts:50`](../packages/host/open-in-app/src/index.ts)

+<a id="deepseek-aidsh-host-product-telemetry-otel"></a>
+
+## `@deepseek-ai/dsh-host-product-telemetry-otel`
+
+```ts config-catalog
+/** Collector routing, application identity, and bounded in-memory batch settings. */
+export interface Config {
+  /** Full HTTP(S) logs URL. */
+  endpoint: string
+  /** Collector routing header. */
+  channel: string
+  /** Resource service.name supplied by the application composition. */
+  serviceName: string
+  /** Resource service.version supplied by the application composition. */
+  serviceVersion: string
+  /** Omit to honor OTEL_EXPORTER_OTLP_LOGS_COMPRESSION / OTEL_EXPORTER_OTLP_COMPRESSION. */
+  compression?: 'none' | 'gzip'
+  /** Maximum records per export; must not exceed maxQueueSize. */
+  maxExportBatchSize: number
+  /** Maximum queued records; the SDK drops new records when full. */
+  maxQueueSize: number
+  /** Delay before exporting a partial batch. */
+  scheduledDelayMillis: number
+  /** Exporter HTTP deadline, including SDK transient-error retries. */
+  timeoutMillis: number
+  /** Processor deadline for one batch export. */
+  exportTimeoutMillis: number
+  /** Outer shutdown wait; pending exports may be lost after this deadline. */
+  shutdownTimeoutMillis: number
+}
+```
+
+Source: [`packages/host/product-telemetry-otel/src/index.ts:37`](../packages/host/product-telemetry-otel/src/index.ts)
+
 <a id="deepseek-aidsh-host-webserver"></a>

 ## `@deepseek-ai/dsh-host-webserver`
@@ -1212,6 +1212,40 @@ export interface Config {

 来源：[`packages/host/open-in-app/src/index.ts:50`](../packages/host/open-in-app/src/index.ts)

+<a id="deepseek-aidsh-host-product-telemetry-otel"></a>
+
+## `@deepseek-ai/dsh-host-product-telemetry-otel`
+
+```ts config-catalog
+/** Collector routing, application identity, and bounded in-memory batch settings. */
+export interface Config {
+  /** Full HTTP(S) logs URL. */
+  endpoint: string
+  /** Collector routing header. */
+  channel: string
+  /** Resource service.name supplied by the application composition. */
+  serviceName: string
+  /** Resource service.version supplied by the application composition. */
+  serviceVersion: string
+  /** Omit to honor OTEL_EXPORTER_OTLP_LOGS_COMPRESSION / OTEL_EXPORTER_OTLP_COMPRESSION. */
+  compression?: 'none' | 'gzip'
+  /** Maximum records per export; must not exceed maxQueueSize. */
+  maxExportBatchSize: number
+  /** Maximum queued records; the SDK drops new records when full. */
+  maxQueueSize: number
+  /** Delay before exporting a partial batch. */
+  scheduledDelayMillis: number
+  /** Exporter HTTP deadline, including SDK transient-error retries. */
+  timeoutMillis: number
+  /** Processor deadline for one batch export. */
+  exportTimeoutMillis: number
+  /** Outer shutdown wait; pending exports may be lost after this deadline. */
+  shutdownTimeoutMillis: number
+}
+```
+
+来源： [`packages/host/product-telemetry-otel/src/index.ts:37`](../packages/host/product-telemetry-otel/src/index.ts)
+
 <a id="deepseek-aidsh-host-webserver"></a>

 ## `@deepseek-ai/dsh-host-webserver`
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/module-graph.md
-module-graph.md: 2e22c198c29bfba5eaa1a548af3bb7a9f190d0c8
-module-graph.zh.md: ce5c445c01b197c260d41af1d991b10fe799873a
+module-graph.md: ae55f2bb2cf29f0f6f4ad3c16df9abb7a3511191
+module-graph.zh.md: cef0a09afb07c4f8ee5392899a1cee3f9cadf3ca
@@ -277,6 +277,7 @@ flowchart TD
    pkg_host_frontend_static["host-frontend-static"]
    pkg_host_open_in_app["host-open-in-app"]
    pkg_host_plugin_inventory["host-plugin-inventory"]
+    pkg_host_product_telemetry_otel["host-product-telemetry-otel"]
    pkg_host_webserver["host-webserver"]
  end
  subgraph group_identity["packages/identity"]
@@ -1427,6 +1428,7 @@ flowchart TD
 | [`host-directory-picker-browse`](../packages/host/directory-picker-browse) | `host` | — |
 | [`host-directory-picker-native`](../packages/host/directory-picker-native) | `host` | — |
 | [`host-open-in-app`](../packages/host/open-in-app) | `host` | — |
+| [`host-product-telemetry-otel`](../packages/host/product-telemetry-otel) | `host` | — |
 | [`host-webserver`](../packages/host/webserver) | `host` | — |
 | [`invariants`](../packages/runtime-diagnostics/invariants) | `runtime-diagnostics` | — |
 | [`session-format`](../packages/session/session-format) | `session` | — |
@@ -279,6 +279,7 @@ flowchart TD
    pkg_host_frontend_static["host-frontend-static"]
    pkg_host_open_in_app["host-open-in-app"]
    pkg_host_plugin_inventory["host-plugin-inventory"]
+    pkg_host_product_telemetry_otel["host-product-telemetry-otel"]
    pkg_host_webserver["host-webserver"]
  end
  subgraph group_identity["packages/identity"]
@@ -1429,6 +1430,7 @@ flowchart TD
 | [`host-directory-picker-browse`](../packages/host/directory-picker-browse) | `host` | — |
 | [`host-directory-picker-native`](../packages/host/directory-picker-native) | `host` | — |
 | [`host-open-in-app`](../packages/host/open-in-app) | `host` | — |
+| [`host-product-telemetry-otel`](../packages/host/product-telemetry-otel) | `host` | — |
 | [`host-webserver`](../packages/host/webserver) | `host` | — |
 | [`invariants`](../packages/runtime-diagnostics/invariants) | `runtime-diagnostics` | — |
 | [`session-format`](../packages/session/session-format) | `session` | — |
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write docs/subsystems/README.md
-README.md: db21e0fe6bea366c4d7efc1d96d247dd255f54da
-README.zh.md: 4b2b28dbf9a39da0c0ce3a062c4de3261501f7d9
+README.md: d2e8dea206e24ae65676ae50596a3f559239cc21
+README.zh.md: 78c97a016a93415ac1fca1afb6658aa623a61f7a
@@ -67,5 +67,6 @@ One page per subsystem of the DeepSeek Harness: what it is, the data structures
 | [conversation.md](conversation.md) | target-neutral Session-event assembly: Context identity, Location data, replay paths, view builders, and target-owned render nodes |
 | [session-projection.md](session-projection.md) | the projection seam: `SessionProjectionMap`, the pure `ProjectionDefinition` unit, `ProjectionSnapshot`'s consistent cut, the change feed |
 | [session-telemetry.md](session-telemetry.md) | the outbound session-reporting capability seam: `SessionTelemetryRecord`/`SessionTelemetrySeverity`, the `SessionTelemetrySink` contract, and the `session-telemetry/record` redact waterfall |
+| [product-telemetry.md](product-telemetry.md) | Explicit product analytics submission and OTLP/HTTP transport |

 > Type declarations and their JSDoc on these pages are source-equivalent and drift-checked by `pnpm run verify-type-equiv` (see [development.md](../development.md#documenting-types-verbatim-ts-type-equiv)). Ordinary blocks preserve complete declarations; `public-api` blocks preserve body-stripped public class declarations. Cordis services and events use each page's generated **Cordis API** section.
@@ -67,5 +67,6 @@
 | [conversation.md](conversation.zh.md) | 目标无关的会话事件组装：上下文标识、位置数据、回放路径、视图构建器与目标自有的渲染节点 |
 | [session-projection.md](session-projection.zh.md) | 投影 seam：`SessionProjectionMap`、纯函数 `ProjectionDefinition` 单元、`ProjectionSnapshot` 的一致切面、变更馈送 |
 | [session-telemetry.md](session-telemetry.zh.md) | 对外会话上报能力 seam：`SessionTelemetryRecord`/`SessionTelemetrySeverity`、`SessionTelemetrySink` 约定和 `session-telemetry/record` 脱敏 waterfall（瀑布式事件） |
+| [product-telemetry.md](product-telemetry.zh.md) | 显式产品分析事件提交与 OTLP/HTTP 传输 |

 > 这些页面上的类型声明及其 JSDoc 与源码等价，并由 `pnpm run verify-type-equiv` 检查漂移（见 [development.md](../development.zh.md#documenting-types-verbatim-ts-type-equiv)）。普通块保留完整声明；`public-api` 块保留去除实现体的公开 class 声明。Cordis 服务与事件使用每页生成的 **Cordis API** 小节。
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write docs/subsystems/product-telemetry.md
+product-telemetry.md: d86540d5a2b75d84f11120b80b7d107788799238
+product-telemetry.zh.md: 52ad1193630fc67f87c9c710027fc1ec5a5db98a
@@ -0,0 +1,60 @@
+# Product telemetry
+
+English | [中文](product-telemetry.zh.md)
+
+The [product telemetry plugin](../../packages/host/product-telemetry-otel/README.md) sends explicitly selected analytics events through OTLP/HTTP. Its `productTelemetry` service owns submission only; product consumers own when an event occurs and which fields are approved. No Session data or identifiers are collected automatically.
+
+`ProductTelemetryRecord` requires an event name, string body, and Unix-millisecond timestamp. Attributes accept scalar strings, numbers, booleans, and one-level objects of those values (`ProductTelemetryScalar`). Optional severity uses OTel severity numbers and defaults to INFO. Observation time is assigned when the record is enqueued.
+
+Enqueue is synchronous and does not acknowledge delivery. The SDK owns batching and retry; local diagnostics report export failures. See the package README for configuration, shutdown, and loss limits.
+
+## Record types
+
+```ts type-equiv
+/** Scalar values accepted by the collector's Arrow attributes map. */
+type ProductTelemetryScalar = string | number | boolean
+```
+
+```ts type-equiv
+/** Explicitly selected analytics fields; object values may contain scalars only. */
+interface ProductTelemetryRecord {
+  /** Product/DA-owned event name. */
+  eventName: string
+  /** Human-readable summary; never a prompt, response, credential, or file contents. */
+  body: string
+  /** Event occurrence time in Unix milliseconds. Observation time is assigned on enqueue. */
+  timestamp: number
+  /** OTel severity; omitted values use INFO. */
+  severityNumber?: SeverityNumber
+  /** Business fields selected by the caller; no automatic device or account identity. */
+  attributes?: Record<string, ProductTelemetryScalar | Record<string, ProductTelemetryScalar>>
+}
+```
+
+Source: [`packages/host/product-telemetry-otel/src/index.ts`](../../packages/host/product-telemetry-otel/src/index.ts)
+
+<!-- BEGIN GENERATED cordis-surface (gen-cordis-catalog.ts) — do not edit between markers -->
+
+<a id="cordis-surface"></a>
+
+## Cordis API
+
+Generated from source by `scripts/gen-cordis-catalog.ts` (verified fresh by `pnpm run verify-cordis-catalog` in doc-sync; regenerate with `pnpm run gen-cordis-catalog`) — the language sides differ only in locale-specific paired document paths. Signature blocks use a `ts cordis-catalog` fence and keep the original source JSDoc; dispatch modes are defined in the [primer](../cordis-primer.md#dispatch-modes), and the framework-inherited `ctx` API lives in [cordis-api/inherited.md](../cordis-api/inherited.md).
+
+<a id="ctxproducttelemetry--producttelemetry"></a>
+
+### `ctx.productTelemetry` — `ProductTelemetry`
+
+Host analytics sender. Mounting alone sends nothing; the owning fiber drains it on unload.
+
+```ts cordis-catalog
+/**
+ * Enqueue one selected product event without waiting for network delivery.
+ * Queue admission and shutdown completion are not collector or warehouse acknowledgements.
+ * @param record - caller-owned event containing only approved analytics fields.
+ */
+emit(record: ProductTelemetryRecord): void
+```
+
+Source: [`packages/host/product-telemetry-otel/src/index.ts`](../../packages/host/product-telemetry-otel/src/index.ts)
+<!-- END GENERATED cordis-surface -->
@@ -0,0 +1,60 @@
+# 产品埋点
+
+[English](product-telemetry.md) | 中文
+
+[产品埋点插件](../../packages/host/product-telemetry-otel/README.zh.md) 通过 OTLP/HTTP 发送明确选定的分析事件。`productTelemetry` 服务仅负责提交；产品消费方决定事件发生时机与获准采集的字段。不自动采集 Session 数据或标识。
+
+`ProductTelemetryRecord` 要求事件名称、字符串 body 和 Unix 毫秒时间戳。属性接受字符串、数字、布尔标量，以及这些值组成的单层对象（`ProductTelemetryScalar`）。可选的严重程度使用 OTel 严重程度数字，默认为 INFO。记录入队时填写观测时间。
+
+入队同步完成，不代表送达确认。SDK 负责批量发送与重试；发送失败会产生本地诊断。配置、退出和丢失限制见包 README。
+
+## 记录类型
+
+```ts type-equiv
+/** Scalar values accepted by the collector's Arrow attributes map. */
+type ProductTelemetryScalar = string | number | boolean
+```
+
+```ts type-equiv
+/** Explicitly selected analytics fields; object values may contain scalars only. */
+interface ProductTelemetryRecord {
+  /** Product/DA-owned event name. */
+  eventName: string
+  /** Human-readable summary; never a prompt, response, credential, or file contents. */
+  body: string
+  /** Event occurrence time in Unix milliseconds. Observation time is assigned on enqueue. */
+  timestamp: number
+  /** OTel severity; omitted values use INFO. */
+  severityNumber?: SeverityNumber
+  /** Business fields selected by the caller; no automatic device or account identity. */
+  attributes?: Record<string, ProductTelemetryScalar | Record<string, ProductTelemetryScalar>>
+}
+```
+
+Source: [`packages/host/product-telemetry-otel/src/index.ts`](../../packages/host/product-telemetry-otel/src/index.ts)
+
+<!-- BEGIN GENERATED cordis-surface (gen-cordis-catalog.ts) — do not edit between markers -->
+
+<a id="cordis-surface"></a>
+
+## Cordis API
+
+Generated from source by `scripts/gen-cordis-catalog.ts` (verified fresh by `pnpm run verify-cordis-catalog` in doc-sync; regenerate with `pnpm run gen-cordis-catalog`) — the language sides differ only in locale-specific paired document paths. Signature blocks use a `ts cordis-catalog` fence and keep the original source JSDoc; dispatch modes are defined in the [primer](../cordis-primer.zh.md#dispatch-modes), and the framework-inherited `ctx` API lives in [cordis-api/inherited.md](../cordis-api/inherited.md).
+
+<a id="ctxproducttelemetry--producttelemetry"></a>
+
+### `ctx.productTelemetry` — `ProductTelemetry`
+
+Host analytics sender. Mounting alone sends nothing; the owning fiber drains it on unload.
+
+```ts cordis-catalog
+/**
+ * Enqueue one selected product event without waiting for network delivery.
+ * Queue admission and shutdown completion are not collector or warehouse acknowledgements.
+ * @param record - caller-owned event containing only approved analytics fields.
+ */
+emit(record: ProductTelemetryRecord): void
+```
+
+Source: [`packages/host/product-telemetry-otel/src/index.ts`](../../packages/host/product-telemetry-otel/src/index.ts)
+<!-- END GENERATED cordis-surface -->
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/README.md
-README.md: 5f759989eda6588e707a0c80c3035d0ba51ec950
-README.zh.md: 8a2784f5a3f99c9842b10d98d89b6d40936380b2
+README.md: 0ce8e9202763a2e974300b83239f02c256a2953e
+README.zh.md: 8e0650d8f6b00112c4fdb4a4dbc11671a2b3f394
@@ -77,7 +77,7 @@ Every package lives in exactly one group; new packages join existing groups, and
 | [`acp/`](acp/README.md) | Automation-only Agent Client Protocol server |
 | [`interaction/`](interaction/README.md) | Human-collaboration plane: approval/interaction seams, permission preset, commands, ask-user tool |
 | [`boot/`](boot/README.md) | Shared app-bin boot glue |
-| [`host/`](host/README.md) | Web-GUI host half: API gateway + HTTP route server |
+| [`host/`](host/README.md) | Web GUI host services, directory picking, application launch, plugin inventory, and product telemetry |
 | [`client/`](client/README.md) | Web-GUI browser half: shell, wire, object services, slots, `ui-*` plugins |
 | [`test-support/`](test-support/README.md) | Test infrastructure (testkits, replay, Loader smokes) |
 | [`runtime-diagnostics/`](runtime-diagnostics/README.md) | Runtime diagnostics: package-owned invariant checks and reports |
@@ -77,7 +77,7 @@ harness 由 `packages/` 下的 npm 包组装而成，按能力系列分组：会
 | [`acp/`](acp/README.zh.md) | 仅面向自动化的 ACP（Agent Client Protocol）服务器 |
 | [`interaction/`](interaction/README.zh.md) | 人机协作平面：批准／交互 seam、权限预设、命令、询问用户的工具 |
 | [`boot/`](boot/README.zh.md) | 共享的 app bin 启动粘合层 |
-| [`host/`](host/README.zh.md) | web GUI 宿主半侧：API 网关 + HTTP 路由服务器 |
+| [`host/`](host/README.zh.md) | Web GUI 宿主服务、目录选择、应用启动、插件清单和产品遥测 |
 | [`client/`](client/README.zh.md) | web GUI 浏览器半侧：shell、协议层、对象服务、slot、`ui-*` 插件 |
 | [`test-support/`](test-support/README.zh.md) | 测试基础设施（testkit、回放、Loader 冒烟测试） |
 | [`runtime-diagnostics/`](runtime-diagnostics/README.zh.md) | 运行时诊断：按包归属的运行时不变式检查与报告 |
@@ -1567,6 +1567,18 @@ export const SERVICE_API: readonly ServiceApiEntry[] = [
      },
    ],
  },
+  {
+    key: 'productTelemetry',
+    summary: 'Host analytics sender.',
+    description: 'Host analytics sender. Mounting alone sends nothing; the owning fiber drains it on unload.',
+    methods: [
+      {
+        signature: 'emit(record: ProductTelemetryRecord): void',
+        description: 'Enqueue one selected product event without waiting for network delivery. Queue admission and shutdown completion are not collector or warehouse acknowledgements.',
+        parameters: [{ name: 'record', description: 'caller-owned event containing only approved analytics fields.' }],
+      },
+    ],
+  },
  {
    key: 'profileContext',
    summary: 'Current profile facts; scheduling and mutation belong to their callers.',
@@ -5582,6 +5594,14 @@ export const TYPE_API: readonly TypeApiEntry[] = [
    name: 'PreToolDecision',
    declaration: 'export type PreToolDecision = {\n    kind: \'allow\';\n} | {\n    kind: \'deny\';\n    reason: string;\n    info?: ToolErrorInfo;\n} | {\n    kind: \'cancel\';\n} | {\n    kind: \'ask\';\n    reason?: string;\n};',
  },
+  {
+    name: 'ProductTelemetryRecord',
+    declaration: 'export interface ProductTelemetryRecord {\n    eventName: string;\n    body: string;\n    timestamp: number;\n    severityNumber?: SeverityNumber;\n    attributes?: Record<string, ProductTelemetryScalar | Record<string, ProductTelemetryScalar>>;\n}',
+  },
+  {
+    name: 'ProductTelemetryScalar',
+    declaration: 'export type ProductTelemetryScalar = string | number | boolean;',
+  },
  {
    name: 'ProfilePnpmInvocation',
    declaration: 'export interface ProfilePnpmInvocation {\n    readonly command: string;\n    readonly args: readonly string[];\n    readonly env: Readonly<Record<string, string>>;\n}',
@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/host/README.md
-README.md: 0b595eb7e63f33ed8e11ec0f39438f5d79b6ab33
-README.zh.md: 6a7507b7d8d2b2d791952783235a80280c8c0408
+README.md: f5e7832539404b8fb1fb856973f08d5dd5c87eb5
+README.zh.md: 402358f4f4097630ba8deda4551d6bc52ff01b11
@@ -1,5 +1,5 @@
 ---
-description: "Package map for the web GUI host half: the HTTP and SPA servers, workspace-directory picking implementations, the open-in-app launch routes, and the plugin inventory projection."
+description: "Package map for the web GUI host half: the HTTP and SPA servers, workspace-directory picking implementations, the open-in-app launch routes, the plugin inventory projection, and explicit product event reporting."
 kind: "package-group"
 ---

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)

 ## Summary

-The `host/` group provides the web GUI's plain HTTP server, the SPA dist server that serves the built Web shell, the workspace-directory picking seam with its native, browse, and adaptive composition packages, the open-in-app application probe and launch routes, and the read-only plugin inventory projection. All eight packages are product packages; the browser transport lives in [`client/`](../client/README.md), and the composed application is [`apps/cli`](../../apps/cli/README.md) booting the [`dsh-base` bundle](../bundle/base/cordis.patch.yml) that serves the web app under `apps/web/`. The picker backends replace one another behind the shared seam.
+The `host/` group provides the web GUI's plain HTTP server, the SPA dist server that serves the built Web shell, the workspace-directory picking seam with its native, browse, and adaptive composition packages, the open-in-app application probe and launch routes, the read-only plugin inventory projection, and explicit product event reporting. These packages are product packages; the browser transport lives in [`client/`](../client/README.md), and the composed application is [`apps/cli`](../../apps/cli/README.md) booting the [`dsh-base` bundle](../bundle/base/cordis.patch.yml) that serves the web app under `apps/web/`. The picker backends replace one another behind the shared seam.

 ## Table of Contents

@@ -22,7 +22,7 @@ The `host/` group provides the web GUI's plain HTTP server, the SPA dist server
 <a id="packages"></a>
 ## Packages

-Eight packages play the host roles; each package README owns its contract and configuration.
+The packages play the host roles; each package README owns its contract and configuration.

 | Package | Role | ctx key |
 |---|---|---|
@@ -34,6 +34,7 @@ Eight packages play the host roles; each package README owns its contract and co
 | [`directory-picker-auto/`](directory-picker-auto/README.md) | Host-adaptive chooser that mounts the matching backend at boot | mounts a backend |
 | [`open-in-app/`](open-in-app/README.md) | Application probe, icon, and launch routes opening the workspace directory in an installed application | consumes `ctx.webServer` |
 | [`plugin-inventory/`](plugin-inventory/README.md) | Read-only projection of current Loader entries | Remote `pluginInventory/list` |
+| [`product-telemetry-otel/`](product-telemetry-otel/README.md) | Explicit product usage events over OTLP/HTTP | `ctx.productTelemetry` |

 -----

@@ -45,6 +46,7 @@ Start with the subsystem references for the transport and the workspace records,
 - [HTTP server subsystem](../../docs/subsystems/web-server.md) — the webserver's routes, matching order, and config.
 - [Workspace subsystem](../../docs/subsystems/workspace.md) — the workspace records the directory picker feeds.
 - [Web config-tree boot and transport layering](../../.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.md) — ownership of the Web transport layers.
+- [Product telemetry](../../docs/subsystems/product-telemetry.md) — explicit analytics event submission.

 <a id="dev-note"></a>
 ## Dev Note
@@ -1,5 +1,5 @@
 ---
-description: "Web GUI Host 侧的包映射：HTTP 与 SPA 服务器、工作区目录选择实现、open-in-app 启动路由和插件清单投影。"
+description: "Web GUI Host 侧的包映射：HTTP 与 SPA 服务器、工作区目录选择实现、open-in-app 启动路由、插件清单投影和显式产品事件上报。"
 kind: "package-group"
 ---

@@ -9,7 +9,7 @@ kind: "package-group"

 ## 概述

-`host/` 组提供 Web GUI 的普通 HTTP 服务器、服务已构建 Web 壳的 SPA dist 服务器、带原生／浏览／自适应组合包的工作区目录选择 seam、open-in-app 的应用探测与启动路由，以及只读的插件清单投影。这八个包都是产品包；浏览器传输位于 [`client/`](../client/README.zh.md)，组合应用是 [`apps/cli`](../../apps/cli/README.zh.md)，它启动 [`dsh-base` 组合包](../bundle/base/cordis.patch.yml) 来提供 `apps/web/` 下的 Web 应用。选择器后端可在共享 seam 后互相替换。
+`host/` 组提供 Web GUI 的普通 HTTP 服务器、服务已构建 Web 壳的 SPA dist 服务器、带原生／浏览／自适应组合包的工作区目录选择 seam、open-in-app 的应用探测与启动路由，只读的插件清单投影以及显式产品事件上报。这些包都是产品包；浏览器传输位于 [`client/`](../client/README.zh.md)，组合应用是 [`apps/cli`](../../apps/cli/README.zh.md)，它启动 [`dsh-base` 组合包](../bundle/base/cordis.patch.yml) 来提供 `apps/web/` 下的 Web 应用。选择器后端可在共享 seam 后互相替换。

 ## 目录

@@ -22,7 +22,7 @@ kind: "package-group"
 <a id="packages"></a>
 ## 包

-八个包分别承担 Host 角色；各包的 README 拥有自己的约定与配置。
+各包分别承担 Host 角色；各包的 README 拥有自己的约定与配置。

 | 包 | 职责 | ctx 键 |
 |---|---|---|
@@ -34,6 +34,7 @@ kind: "package-group"
 | [`directory-picker-auto/`](directory-picker-auto/README.zh.md) | 在启动时挂载匹配后端的宿主自适应选择器 | 挂载一个后端 |
 | [`open-in-app/`](open-in-app/README.zh.md) | 在已安装应用中打开 workspace 目录的应用探测、图标与启动路由 | 消费 `ctx.webServer` |
 | [`plugin-inventory/`](plugin-inventory/README.zh.md) | 当前 Loader 条目的只读投影 | Remote `pluginInventory/list` |
+| [`product-telemetry-otel/`](product-telemetry-otel/README.zh.md) | 通过 OTLP/HTTP 显式上报产品使用事件 | `ctx.productTelemetry` |

 -----

@@ -45,6 +46,7 @@ kind: "package-group"
 - [HTTP 服务器子系统](../../docs/subsystems/web-server.zh.md)——webserver 的路由、匹配顺序与配置。
 - [工作区子系统](../../docs/subsystems/workspace.zh.md)——目录选择器所喂给的工作区记录。
 - [Web 配置树启动与传输分层](../../.agents/notes/implemented/architecture/2026-07-24-web-config-tree-boot-and-transport-layering.zh.md)——Web 传输各层的所有权。
+- [产品埋点](../../docs/subsystems/product-telemetry.zh.md)——显式提交分析事件。

 <a id="dev-note"></a>
 ## 开发备注
@@ -0,0 +1,6 @@
+# Bilingual-pair consistency record (docs/i18n/README.md): the git blob hash of each
+# side as of the last confirmed-consistent state. Both languages carry equal authority;
+# after editing either side, bring the other along and re-record with:
+#   pnpm run verify-translation-pairing --write packages/host/product-telemetry-otel/README.md
+README.md: af1f2c415fc21db874abc7bb0d9e25c7149fcabf
+README.zh.md: ffdb682d9a8a0a4bf406f71322e062f14b666cf2
@@ -0,0 +1,108 @@
+---
+description: "Configure explicit product usage events, OTLP/HTTP routing, batching, and shutdown limits."
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-host-product-telemetry-otel
+
+English | [中文](README.zh.md)
+
+## Summary
+
+Send selected product usage events to an OTLP/HTTP collector. Events carry a name, string summary, occurrence time, and scalar or one-level object attributes. Mounting the plugin collects nothing automatically; applications explicitly submit each event. Delivery is best effort and does not confirm warehouse ingestion.
+
+## Table of Contents
+
+- [Use this package](#use-this-package)
+- [Understand the implementation](#understand-the-implementation)
+- [Further Exploration](#further-exploration)
+- [Model Experience](#model-experience)
+- [Known Limitations and Deferred Work](#known-limitations-and-deferred-work)
+- [Dev Note](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## Use this package
+
+Mount the plugin in a Cordis composition with the application identity; override the collector endpoint when needed. The shipped profiles do not mount it. Set `DSH_APP_VERSION` to the running application release version in the launcher environment; the schema rejects an absent version.
+
+```yaml
+- name: '@deepseek-ai/dsh-host-product-telemetry-otel'
+  config:
+    endpoint: https://dsh-otel-collector.deepseeksvc.com/v1/logs
+    serviceName: deepseek-harness
+    serviceVersion: !!js process.env.DSH_APP_VERSION
+    compression: gzip
+    scheduledDelayMillis: 30000
+```
+
+| Field | Default | Meaning |
+|---|---|---|
+| `endpoint` | `https://dsh-otel-collector.deepseeksvc.com/v1/logs` | Full HTTP(S) logs URL |
+| `serviceName`, `serviceVersion` | required | Application identity on the OTel resource |
+| `channel` | `dsh_otel_report` | Collector `x-channel` header |
+| `compression` | SDK environment | `gzip` or `none`; omission honors OTel compression environment variables |
+| `maxExportBatchSize`, `maxQueueSize` | `512`, `2048` | Record-count limits; batch size cannot exceed queue size |
+| `scheduledDelayMillis` | `30000` | Partial-batch export interval |
+| `timeoutMillis` | `15000` | Exporter HTTP and retry deadline |
+| `exportTimeoutMillis` | `20000` | Processor batch export deadline |
+| `shutdownTimeoutMillis` | `21000` | Outer wait for shutdown; expiry reports possible loss |
+
+The default endpoint routes explicitly submitted events to the production product collector. Test and custom deployments must override it. Only `x-channel` and SDK protocol headers reach the collector; ambient OTel headers and client certificates are not inherited.
+
+The 30-second interval batches product events; the exporter has a 15-second retry window inside the processor’s 20-second batch deadline. The outer 21-second wait bounds plugin disposal, including SDK `forceFlush()` work that the processor deadline does not cover. An unreachable collector can delay disposal for the full 21 seconds. A full 2,048-record queue requires four 512-record batches and may not drain before that deadline. Interactive compositions needing a shorter exit should override these budgets; neither configuration guarantees delivery.
+
+Consumers inject `productTelemetry` and call `emit()` with explicitly selected analytics fields. Event names and field semantics belong to their product and analytics owners. The plugin reads no Session, account, credential, or device identifier. Callers must exclude prompts, responses, file contents, credentials, and other unapproved values.
+
+The collector expects a string body and attributes containing strings, numbers, booleans, or objects of those scalars. Callers supply occurrence time in milliseconds; the plugin assigns observation time and defaults severity to INFO. Invalid transport configuration fails at activation. Export failures produce local warnings without making event submission wait for the network.
+
+-----
+
+<a id="understand-the-implementation"></a>
+## Understand the implementation
+
+<details>
+<summary>Implementation internals — click to expand</summary>
+
+A private OTel logger feeds `BatchLogRecordProcessor` and the SDK HTTP delegate with its JSON log serializer. The delegate receives explicit headers and an HTTP agent; only shared timeout and compression settings use SDK environment resolution. The direct `@opentelemetry/core` dependency matches `sdk-logs` at 2.9.0 so exporter result enums share one TypeScript identity. The SDK owns queueing, transient-error retries, and compression; plugin disposal drains pending records with a bounded wait. Export completion is observed separately because SDK shutdown can resolve after a rejected export. No global OTel provider is installed.
+
+[`src/index.ts`](src/index.ts) owns configuration and submission. No runtime invariant companion is published: delivery has no independent local acknowledgement to compare with the SDK's queue.
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## Further Exploration
+
+- [Product telemetry](../../../docs/subsystems/product-telemetry.md) — consumer types and service reference.
+- [Session telemetry](../../session/session-telemetry-otel/README.md) — separate feedback-authorized Session reporting.
+- [Testing policy](../../../docs/testing.md) — Loader composition and network fixtures.
+
+-----
+
+<a id="model-experience"></a>
+## Model Experience
+
+None, as the plugin exports explicit analytics records without contributing model context.
+
+#### KV Cache effect
+
+None; event submission does not change model requests.
+
+## Known Limitations and Deferred Work
+
+<a id="known-limitations-and-deferred-work"></a>
+
+Delivery and collection remain limited to the following capabilities.
+
+- Callers own event selection, renderer-to-host transport, and any permitted identity attributes.
+- The queue is memory-only; overflow, network failure, and process exit can lose events. There is no durable outbox or warehouse acknowledgement.
+- The SDK batches by record count, not encoded bytes. Callers must keep records within the collector's 4 MB limit and choose batch sizes appropriate to the receiver.
+- Caller-selected strings are not redacted automatically. This package does not decide product disclosure or consent policy.
+
+<a id="dev-note"></a>
+### Dev Note
+
+None.
@@ -0,0 +1,108 @@
+---
+description: "配置显式产品使用事件、OTLP/HTTP 路由、批量发送与退出等待上限。"
+kind: "package-reference"
+---
+
+# @deepseek-ai/dsh-host-product-telemetry-otel
+
+[English](README.md) | 中文
+
+## 概述
+
+将选定的产品使用事件发送到 OTLP/HTTP 接收服务。事件包含名称、字符串摘要、发生时间，以及标量或单层对象属性。挂载插件不会自动采集信息；应用需要显式提交每个事件。发送采用尽力而为方式，不代表数据已入仓。
+
+## 目录
+
+- [使用本包](#use-this-package)
+- [理解实现](#understand-the-implementation)
+- [延伸阅读](#further-exploration)
+- [模型体验](#model-experience)
+- [已知限制与待办工作](#known-limitations-and-deferred-work)
+- [开发备注](#dev-note)
+
+-----
+
+<a id="use-this-package"></a>
+## 使用本包
+
+在 Cordis 组合中挂载插件并提供应用标识；需要时可覆盖接收地址。内置 profile 不挂载本插件。启动器环境须将 `DSH_APP_VERSION` 设为运行中应用的发布版本；缺少版本时 schema 会拒绝配置。
+
+```yaml
+- name: '@deepseek-ai/dsh-host-product-telemetry-otel'
+  config:
+    endpoint: https://dsh-otel-collector.deepseeksvc.com/v1/logs
+    serviceName: deepseek-harness
+    serviceVersion: !!js process.env.DSH_APP_VERSION
+    compression: gzip
+    scheduledDelayMillis: 30000
+```
+
+| 字段 | 默认值 | 含义 |
+|---|---|---|
+| `endpoint` | `https://dsh-otel-collector.deepseeksvc.com/v1/logs` | 完整 HTTP(S) 日志地址 |
+| `serviceName`, `serviceVersion` | 必填 | OTel resource 中的应用标识 |
+| `channel` | `dsh_otel_report` | 接收服务的 `x-channel` 请求头 |
+| `compression` | SDK 环境变量 | `gzip` 或 `none`；省略时遵循 OTel 压缩环境变量 |
+| `maxExportBatchSize`, `maxQueueSize` | `512`, `2048` | 记录条数上限；批次大小不能超过队列大小 |
+| `scheduledDelayMillis` | `30000` | 不满批次时的发送间隔 |
+| `timeoutMillis` | `15000` | Exporter HTTP 发送与重试的超时时间 |
+| `exportTimeoutMillis` | `20000` | Processor 批次导出的超时时间 |
+| `shutdownTimeoutMillis` | `21000` | 退出时的等待上限；超时会提示可能丢失数据 |
+
+默认接收地址将显式提交的事件发送到生产产品 collector，测试和自定义部署必须覆盖该地址。只向 collector 发送 `x-channel` 和 SDK 协议请求头，不继承宿主 OTel 请求头或客户端证书。
+
+30 秒间隔用于批量发送产品事件；exporter 的 15 秒重试窗口位于 processor 的 20 秒批次期限内。外层 21 秒等待限制插件卸载时间，包括 processor 期限未覆盖的 SDK `forceFlush()`。collector 不可达时，卸载可能等待完整的 21 秒。2,048 条满队列需要四个 512 条批次，可能无法在期限前排空。要求更快退出的交互式应用组合应覆盖这些时间配置；两种配置都不保证送达。
+
+消费方注入 `productTelemetry`，调用 `emit()` 提交明确选定的分析字段。事件名称与字段含义由产品和数据分析负责人定义。插件不读取 Session、账号、凭证或设备标识。调用方必须排除提示词、回答、文件内容、凭证及其他未经批准的数据。
+
+接收服务要求 body 为字符串，attributes 的值为字符串、数字、布尔值或由这些标量组成的对象。调用方以毫秒提供发生时间；插件填写观测时间，默认严重程度为 INFO。无效传输配置在激活时报错。发送失败产生本地警告，事件提交不等待网络。
+
+-----
+
+<a id="understand-the-implementation"></a>
+## 理解实现
+
+<details>
+<summary>实现细节——点击展开</summary>
+
+私有 OTel logger 将记录交给 `BatchLogRecordProcessor`，再由 SDK HTTP delegate 和 JSON 日志序列化器发送。delegate 使用显式请求头和 HTTP agent，只有共享的超时与压缩配置使用 SDK 环境变量解析。直接依赖的 `@opentelemetry/core` 与 `sdk-logs` 对齐为 2.9.0，使导出结果枚举共享同一个 TypeScript 类型身份。SDK 负责队列、临时错误重试与压缩；插件卸载时在限定时间内发送剩余记录。发送完成结果单独观测，因为 SDK 在发送被拒绝后仍可能正常完成退出。不安装全局 OTel provider。
+
+[`src/index.ts`](src/index.ts) 负责配置与提交。不发布运行时不变量伴随模块：本地没有独立的送达确认可与 SDK 队列比较。
+
+</details>
+
+-----
+
+<a id="further-exploration"></a>
+## 延伸阅读
+
+- [产品埋点](../../../docs/subsystems/product-telemetry.zh.md)——消费方类型与服务参考。
+- [会话上报](../../session/session-telemetry-otel/README.zh.md)——独立的、由反馈授权的 Session 上报。
+- [测试策略](../../../docs/testing.zh.md)——Loader 组合与网络测试夹具。
+
+-----
+
+<a id="model-experience"></a>
+## 模型体验
+
+无，因为插件仅发送显式分析记录，不提供模型上下文。
+
+#### KV Cache 影响
+
+无；提交事件不会改变模型请求。
+
+## 已知限制与待办工作
+
+<a id="known-limitations-and-deferred-work"></a>
+
+发送和采集受以下能力限制。
+
+- 调用方拥有事件选择、渲染进程到宿主的传输以及获准使用的标识属性。
+- 队列仅存在于内存；队列溢出、网络故障和进程退出可能丢失事件。没有持久发件箱或入仓确认。
+- SDK 按记录条数而非编码字节数分批。调用方必须确保记录不超过接收服务的 4 MB 限制，并选择接收服务适用的批次大小。
+- 不自动脱敏调用方选择的字符串。本包不决定产品告知或同意策略。
+
+<a id="dev-note"></a>
+### 开发备注
+
+无。
@@ -0,0 +1,48 @@
+{
+  "name": "@deepseek-ai/dsh-host-product-telemetry-otel",
+  "description": "Explicit product usage events exported through OpenTelemetry HTTP logs",
+  "version": "0.1.6-alpha.2",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/deepseek-ai/deepseek-harness.git",
+    "directory": "packages/host/product-telemetry-otel"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./lib/types/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./src/*": "./src/*",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib/index.js",
+    "lib/types/**/*.d.ts"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@deepseek-ai/schemastery": "workspace:^",
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/api-logs": "^0.220.0",
+    "@opentelemetry/core": "2.9.0",
+    "@opentelemetry/otlp-exporter-base": "^0.220.0",
+    "@opentelemetry/otlp-transformer": "^0.220.0",
+    "@opentelemetry/resources": "^2.9.0",
+    "@opentelemetry/sdk-logs": "^0.220.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "workspace:^"
+  },
+  "devDependencies": {
+    "@deepseek-ai/cordis": "workspace:^",
+    "@deepseek-ai/cordis-plugin-loader": "workspace:^",
+    "@deepseek-ai/dsh-app-boot": "workspace:^",
+    "@deepseek-ai/dsh-loader-smoke": "workspace:^"
+  }
+}
@@ -0,0 +1,171 @@
+/** Explicit product usage events over OTLP/HTTP; no automatic collection or Session access. */
+import { Context, Service } from '@deepseek-ai/cordis'
+import z from '@deepseek-ai/schemastery'
+import { SeverityNumber, type Logger } from '@opentelemetry/api-logs'
+import { validateHeaderValue } from 'node:http'
+import { JsonLogsSerializer } from '@opentelemetry/otlp-transformer'
+import { createOtlpHttpExportDelegate, getSharedConfigurationFromEnvironment, httpAgentFactoryFromOptions } from '@opentelemetry/otlp-exporter-base/node-http'
+import { CompressionAlgorithm, getSharedConfigurationDefaults, mergeOtlpSharedConfigurationWithDefaults, OTLPExporterBase } from '@opentelemetry/otlp-exporter-base'
+import { ExportResultCode } from '@opentelemetry/core'
+import { resourceFromAttributes } from '@opentelemetry/resources'
+import { BatchLogRecordProcessor, LoggerProvider } from '@opentelemetry/sdk-logs'
+
+declare module '@deepseek-ai/cordis' {
+  interface Context {
+    productTelemetry: ProductTelemetry
+  }
+}
+
+/** Scalar values accepted by the collector's Arrow attributes map. */
+export type ProductTelemetryScalar = string | number | boolean
+
+/** Explicitly selected analytics fields; object values may contain scalars only. */
+export interface ProductTelemetryRecord {
+  /** Product/DA-owned event name. */
+  eventName: string
+  /** Human-readable summary; never a prompt, response, credential, or file contents. */
+  body: string
+  /** Event occurrence time in Unix milliseconds. Observation time is assigned on enqueue. */
+  timestamp: number
+  /** OTel severity; omitted values use INFO. */
+  severityNumber?: SeverityNumber
+  /** Business fields selected by the caller; no automatic device or account identity. */
+  attributes?: Record<string, ProductTelemetryScalar | Record<string, ProductTelemetryScalar>>
+}
+
+/** Collector routing, application identity, and bounded in-memory batch settings. */
+export interface Config {
+  /** Full HTTP(S) logs URL. */
+  endpoint: string
+  /** Collector routing header. */
+  channel: string
+  /** Resource service.name supplied by the application composition. */
+  serviceName: string
+  /** Resource service.version supplied by the application composition. */
+  serviceVersion: string
+  /** Omit to honor OTEL_EXPORTER_OTLP_LOGS_COMPRESSION / OTEL_EXPORTER_OTLP_COMPRESSION. */
+  compression?: 'none' | 'gzip'
+  /** Maximum records per export; must not exceed maxQueueSize. */
+  maxExportBatchSize: number
+  /** Maximum queued records; the SDK drops new records when full. */
+  maxQueueSize: number
+  /** Delay before exporting a partial batch. */
+  scheduledDelayMillis: number
+  /** Exporter HTTP deadline, including SDK transient-error retries. */
+  timeoutMillis: number
+  /** Processor deadline for one batch export. */
+  exportTimeoutMillis: number
+  /** Outer shutdown wait; pending exports may be lost after this deadline. */
+  shutdownTimeoutMillis: number
+}
+
+const positiveInteger = () => z.number().step(1).min(1).max(2_147_483_647)
+
+/** Loader validation and defaults for application compositions. */
+export const Config: z<Partial<Config>, Config> = z.object({
+  endpoint: z.string().default('https://dsh-otel-collector.deepseeksvc.com/v1/logs'),
+  channel: z.string().min(1).default('dsh_otel_report'),
+  serviceName: z.string().required(),
+  serviceVersion: z.string().required(),
+  compression: z.union(['none', 'gzip']),
+  maxExportBatchSize: positiveInteger().default(512),
+  maxQueueSize: positiveInteger().default(2048),
+  scheduledDelayMillis: positiveInteger().default(30000),
+  timeoutMillis: positiveInteger().default(15000),
+  exportTimeoutMillis: positiveInteger().default(20000),
+  shutdownTimeoutMillis: positiveInteger().default(21000),
+})
+
+/** Host analytics sender. Mounting alone sends nothing; the owning fiber drains it on unload. */
+export default class ProductTelemetry extends Service {
+  static Config = Config
+  private readonly logger: Logger
+
+  constructor(ctx: Context, config: Config) {
+    let endpoint: URL
+    try {
+      endpoint = new URL(config.endpoint)
+    } catch (cause) {
+      throw new Error('product-telemetry-otel: endpoint must be a valid HTTP(S) URL', { cause })
+    }
+    try {
+      validateHeaderValue('x-channel', config.channel)
+    } catch (cause) {
+      throw new Error('product-telemetry-otel: channel must be a valid HTTP header value', { cause })
+    }
+    if (!['http:', 'https:'].includes(endpoint.protocol)) {
+      throw new Error('product-telemetry-otel: endpoint must use HTTP or HTTPS')
+    }
+    if (config.maxExportBatchSize > config.maxQueueSize) {
+      throw new Error('product-telemetry-otel: maxExportBatchSize must not exceed maxQueueSize')
+    }
+    super(ctx, 'productTelemetry')
+    const shared = mergeOtlpSharedConfigurationWithDefaults({
+      timeoutMillis: config.timeoutMillis,
+      ...(config.compression === undefined ? {} : {
+        compression: config.compression === 'gzip' ? CompressionAlgorithm.GZIP : CompressionAlgorithm.NONE,
+      }),
+    }, getSharedConfigurationFromEnvironment('LOGS'), getSharedConfigurationDefaults())
+    const transport = {
+      ...shared,
+      url: config.endpoint,
+      // This collector must not inherit another endpoint's headers or TLS client identity.
+      headers: () => Promise.resolve({ 'Content-Type': 'application/json', 'x-channel': config.channel }),
+      agentFactory: httpAgentFactoryFromOptions({ keepAlive: true }),
+    }
+    const exporter = new OTLPExporterBase(createOtlpHttpExportDelegate(transport, JsonLogsSerializer))
+    const provider = new LoggerProvider({
+      resource: resourceFromAttributes({
+        'service.name': config.serviceName,
+        'service.version': config.serviceVersion,
+      }),
+      processors: [new BatchLogRecordProcessor({
+        maxExportBatchSize: config.maxExportBatchSize,
+        maxQueueSize: config.maxQueueSize,
+        scheduledDelayMillis: config.scheduledDelayMillis,
+        exportTimeoutMillis: config.exportTimeoutMillis,
+        exporter: {
+          export: (records, callback) => {
+            exporter.export(records, (result) => {
+              // SDK flush/shutdown can resolve after export failure; observe the actual completion.
+              if (result.code !== ExportResultCode.SUCCESS) ctx.logger.warn('Product telemetry export failed', result.error)
+              callback(result)
+            })
+          },
+          forceFlush: () => exporter.forceFlush(),
+          shutdown: () => exporter.shutdown(),
+        },
+      })],
+    })
+    this.logger = provider.getLogger('@deepseek-ai/dsh-host-product-telemetry-otel')
+    ctx.effect(() => async () => {
+      let timer!: ReturnType<typeof setTimeout>
+      const deadline = new Promise<void>((resolve) => {
+        timer = setTimeout(() => {
+          ctx.logger.warn('Product telemetry shutdown deadline exceeded; pending events may be lost')
+          resolve()
+        }, config.shutdownTimeoutMillis)
+      })
+      try {
+        await Promise.race([provider.shutdown(), deadline])
+      } finally {
+        clearTimeout(timer)
+      }
+    })
+  }
+
+  /**
+   * Enqueue one selected product event without waiting for network delivery.
+   * Queue admission and shutdown completion are not collector or warehouse acknowledgements.
+   * @param record - caller-owned event containing only approved analytics fields.
+   */
+  emit(record: ProductTelemetryRecord): void {
+    const severityNumber = record.severityNumber ?? SeverityNumber.INFO
+    this.logger.emit({
+      ...record,
+      observedTimestamp: Date.now(),
+      severityNumber,
+      severityText: SeverityNumber[severityNumber],
+    })
+  }
+}
@@ -0,0 +1,43 @@
+/** Loader composition with a loopback collector and one explicit synthetic event. */
+import { createServer } from 'node:http'
+import { once } from 'node:events'
+import { gunzipSync } from 'node:zlib'
+import { writeFile } from 'node:fs/promises'
+import type {} from '@deepseek-ai/dsh-host-product-telemetry-otel'
+import { bootProductionProfile } from '../../../../test-support/loader-smoke/tests/fixtures/production-profile.ts'
+
+const configPath = process.argv[2]
+if (configPath === undefined) throw new Error('product telemetry fixture requires an overlay')
+const captures: unknown[] = []
+const server = createServer((req, res) => {
+  const chunks: Buffer[] = []
+  req.on('data', chunk => chunks.push(chunk as Buffer))
+  req.on('end', () => {
+    const bytes = Buffer.concat(chunks)
+    const body: unknown = JSON.parse(gunzipSync(bytes).toString())
+    captures.push({ channel: req.headers['x-channel'], compression: req.headers['content-encoding'], body })
+    res.writeHead(200, { 'content-type': 'application/json' }).end('{}')
+  })
+})
+try {
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('collector has no port')
+  process.env.DSH_APP_VERSION = 'synthetic-release'
+  process.env.DSH_PRODUCT_TELEMETRY_TEST_ENDPOINT = `http://127.0.0.1:${address.port}/v1/logs`
+  const ctx = await bootProductionProfile({ binName: 'product-telemetry-test', profile: 'headless', overlayPaths: [configPath] })
+  try {
+    const telemetry = ctx.get('productTelemetry')
+    if (telemetry === undefined) throw new Error('product telemetry did not activate')
+    telemetry.emit({ eventName: 'telemetry.synthetic', timestamp: 1_800_000_000_000, body: 'Synthetic test', attributes: { synthetic: true } })
+  } finally {
+    await ctx.fiber.dispose()
+  }
+  await writeFile('captures.json', JSON.stringify(captures))
+} finally {
+  const closed = once(server, 'close')
+  server.close()
+  server.closeAllConnections()
+  await closed
+}
@@ -0,0 +1,15 @@
+- id: session-telemetry-otel
+  disabled: true
+- id: headless-startup
+  disabled: true
+- id: headless-runner
+  disabled: true
+- insert:
+    - id: product-telemetry-otel
+      name: '@deepseek-ai/dsh-host-product-telemetry-otel'
+      config:
+        endpoint: !!js process.env.DSH_PRODUCT_TELEMETRY_TEST_ENDPOINT
+        serviceName: dsh-telemetry-test
+        serviceVersion: !!js process.env.DSH_APP_VERSION
+        compression: gzip
+        scheduledDelayMillis: 60000
@@ -0,0 +1,23 @@
+import { readFile } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { expect, it } from 'vitest'
+import { runLoaderSmoke, LOADER_SMOKE_TEST_TIMEOUT_MS } from '@deepseek-ai/dsh-loader-smoke'
+
+it('exports the explicitly submitted event through the headless Loader composition', async () => {
+  let captures: unknown
+  const driver = resolve(import.meta.dirname, 'fixtures/driver.ts')
+  await runLoaderSmoke({
+    label: 'product telemetry composition',
+    tempDirPrefix: 'product-telemetry-',
+    binScript: driver,
+    libBinScript: driver,
+    configPath: resolve(import.meta.dirname, 'fixtures/telemetry.patch.yml'),
+    tsconfigPath: resolve(import.meta.dirname, '../../../../tsconfig.base.json'),
+    inspect: async (cwd) => { captures = JSON.parse(await readFile(resolve(cwd, 'captures.json'), 'utf8')) },
+  })
+  expect(captures).toMatchObject([{
+    channel: 'dsh_otel_report', compression: 'gzip',
+    body: { resourceLogs: [{ scopeLogs: [{ logRecords: [{ eventName: 'telemetry.synthetic', body: { stringValue: 'Synthetic test' } }] }] }] },
+  }])
+  expect(JSON.stringify(captures).match(/"eventName"/g)).toHaveLength(1)
+}, LOADER_SMOKE_TEST_TIMEOUT_MS)
@@ -0,0 +1,203 @@
+import { createServer, type IncomingHttpHeaders } from 'node:http'
+import { once } from 'node:events'
+import { gunzipSync } from 'node:zlib'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { Context } from '@deepseek-ai/cordis'
+import { LoggerProvider } from '@opentelemetry/sdk-logs'
+import { SeverityNumber } from '@opentelemetry/api-logs'
+import ProductTelemetry, { Config } from '../src/index.ts'
+
+interface Capture {
+  headers: IncomingHttpHeaders
+  body: { resourceLogs: { resource: unknown; scopeLogs: { logRecords: Record<string, unknown>[] }[] }[] }
+}
+const cleanup: (() => Promise<void>)[] = []
+afterEach(async () => {
+  try {
+    for (const dispose of cleanup.splice(0).reverse()) await dispose()
+  } finally {
+    vi.unstubAllEnvs()
+    vi.restoreAllMocks()
+    vi.useRealTimers()
+  }
+})
+
+beforeEach(() => {
+  vi.stubEnv('OTEL_EXPORTER_OTLP_COMPRESSION', undefined)
+  vi.stubEnv('OTEL_EXPORTER_OTLP_LOGS_COMPRESSION', undefined)
+})
+
+async function collector(statuses = [200]) {
+  const captures: Capture[] = []
+  const server = createServer((req, res) => {
+    const chunks: Buffer[] = []
+    req.on('data', chunk => chunks.push(chunk as Buffer))
+    req.on('end', () => {
+      const raw = Buffer.concat(chunks)
+      const bytes = req.headers['content-encoding'] === 'gzip' ? gunzipSync(raw) : raw
+      captures.push({ headers: req.headers, body: JSON.parse(bytes.toString()) as Capture['body'] })
+      res.writeHead(statuses.shift() ?? 200, { 'content-type': 'application/json' }).end('{}')
+    })
+  })
+  cleanup.push(async () => {
+    const closed = once(server, 'close')
+    server.close()
+    server.closeAllConnections()
+    await closed
+  })
+  server.listen(0, '127.0.0.1')
+  await once(server, 'listening')
+  const address = server.address()
+  if (address === null || typeof address === 'string') throw new Error('collector has no port')
+  return { captures, endpoint: `http://127.0.0.1:${address.port}/v1/logs` }
+}
+
+function config(endpoint: string, overrides: Partial<Config> = {}): Config {
+  return Config({ endpoint, serviceName: 'synthetic-test', serviceVersion: '1', scheduledDelayMillis: 60_000, ...overrides })
+}
+
+function context() {
+  const ctx = new Context()
+  cleanup.push(() => ctx.fiber.dispose())
+  return ctx
+}
+
+const event = { eventName: 'telemetry.synthetic', body: 'Synthetic test', timestamp: 1_800_000_000_000 }
+
+describe('explicit product telemetry', () => {
+  it.each(['gzip', 'none', undefined] as const)('drains typed events with %s compression and removes the service', async (compression) => {
+    const target = await collector()
+    const ctx = context()
+    const fiber = await ctx.plugin(ProductTelemetry, config(target.endpoint, compression === undefined ? {} : { compression }))
+    const service = ctx.productTelemetry
+    expect(target.captures).toEqual([])
+    service.emit({ ...event, attributes: { text: 'test', count: 2, duration: 1.5, synthetic: true, model: { provider: 'test', count: 1, enabled: false } } })
+    service.emit({ ...event, severityNumber: SeverityNumber.ERROR })
+    await fiber.dispose()
+    expect(ctx.get('productTelemetry')).toBeUndefined()
+    service.emit(event)
+    expect(target.captures).toHaveLength(1)
+    const [capture] = target.captures
+    expect(capture?.headers['x-channel']).toBe('dsh_otel_report')
+    expect(capture?.headers['content-encoding']).toBe(compression === 'gzip' ? 'gzip' : undefined)
+    const logs = capture?.body.resourceLogs.flatMap(r => r.scopeLogs.flatMap(s => s.logRecords))
+    expect(logs).toHaveLength(2)
+    expect(logs?.[0]).toMatchObject({
+      eventName: event.eventName, body: { stringValue: event.body }, severityNumber: 9,
+      timeUnixNano: '1800000000000000000',
+    })
+    expect(logs?.[0]?.['attributes']).toEqual(expect.arrayContaining([
+      { key: 'text', value: { stringValue: 'test' } },
+      { key: 'count', value: { intValue: 2 } },
+      { key: 'duration', value: { doubleValue: 1.5 } },
+      { key: 'synthetic', value: { boolValue: true } },
+      { key: 'model', value: { kvlistValue: { values: [{ key: 'provider', value: { stringValue: 'test' } }, { key: 'count', value: { intValue: 1 } }, { key: 'enabled', value: { boolValue: false } }] } } },
+    ]))
+    expect(Number(logs?.[0]?.['observedTimeUnixNano'])).toBeGreaterThan(0)
+    expect(logs?.[1]?.['severityNumber']).toBe(17)
+    expect(JSON.stringify(capture)).not.toContain('user.id')
+  })
+
+  it('isolates collector headers from ambient OpenTelemetry credentials', async () => {
+    vi.stubEnv('OTEL_EXPORTER_OTLP_HEADERS', 'Authorization=Bearer%20synthetic-secret,x-user-id=synthetic-user')
+    vi.stubEnv('OTEL_EXPORTER_OTLP_LOGS_HEADERS', 'x-log-token=synthetic-token,x-channel=other-collector')
+    const target = await collector()
+    const ctx = context()
+    const fiber = await ctx.plugin(ProductTelemetry, config(target.endpoint))
+    ctx.productTelemetry.emit(event)
+    await fiber.dispose()
+    expect(target.captures).toHaveLength(1)
+    expect(target.captures[0]?.headers).toMatchObject({ 'x-channel': 'dsh_otel_report' })
+    expect(target.captures[0]?.headers).not.toHaveProperty('authorization')
+    expect(target.captures[0]?.headers).not.toHaveProperty('x-user-id')
+    expect(target.captures[0]?.headers).not.toHaveProperty('x-log-token')
+    expect(process.env['OTEL_EXPORTER_OTLP_HEADERS']).toContain('synthetic-secret')
+  })
+
+  it('does not export on mount or empty shutdown', async () => {
+    const target = await collector()
+    const fiber = await context().plugin(ProductTelemetry, config(target.endpoint))
+    await fiber.dispose()
+    expect(target.captures).toEqual([])
+  })
+
+  it('exports at the batch threshold and retries a transient rejection', async () => {
+    const target = await collector([503, 200])
+    const ctx = context()
+    await ctx.plugin(ProductTelemetry, config(target.endpoint, { maxExportBatchSize: 1 }))
+    ctx.productTelemetry.emit(event)
+    await vi.waitFor(() => { expect(target.captures).toHaveLength(2) }, { timeout: 10_000 })
+    expect(target.captures[0]?.body).toEqual(target.captures[1]?.body)
+  })
+
+  it('exports a partial batch on its configured interval', async () => {
+    const target = await collector()
+    const ctx = context()
+    await ctx.plugin(ProductTelemetry, config(target.endpoint, { scheduledDelayMillis: 10 }))
+    ctx.productTelemetry.emit(event)
+    await vi.waitFor(() => { expect(target.captures).toHaveLength(1) })
+  })
+
+  it('reports a permanent export rejection without failing the caller', async () => {
+    const target = await collector([400])
+    const ctx = context()
+    const warn = vi.spyOn(ctx.logger, 'warn')
+    const fiber = await ctx.plugin(ProductTelemetry, config(target.endpoint))
+    expect(() => { ctx.productTelemetry.emit(event) }).not.toThrow()
+    await fiber.dispose()
+    expect(target.captures).toHaveLength(1)
+    expect(warn).toHaveBeenCalledWith('Product telemetry export failed', expect.any(Error))
+  })
+
+  it.each([
+    { endpoint: 'broken' }, { endpoint: 'ftp://collector.test/logs' },
+    { channel: '' }, { channel: 'bad\nchannel' }, { channel: '中文' }, { timeoutMillis: 0 },
+    { maxExportBatchSize: 0 }, { maxExportBatchSize: 2, maxQueueSize: 1 },
+    { maxQueueSize: -1 }, { scheduledDelayMillis: 0 }, { exportTimeoutMillis: Infinity },
+    { shutdownTimeoutMillis: 2_147_483_648 },
+  ])('rejects invalid configuration %j before exposing the service', (invalid) => {
+    const ctx = context()
+    expect(() => new ProductTelemetry(ctx, config('http://collector.test/v1/logs', invalid))).toThrow()
+    expect(ctx.get('productTelemetry')).toBeUndefined()
+  })
+
+  it.each([
+    [{ endpoint: 'broken' }, 'endpoint must be a valid HTTP(S) URL'],
+    [{ channel: 'bad\nchannel' }, 'channel must be a valid HTTP header value'],
+  ] as const)('names invalid transport fields before registering the service', (invalid, message) => {
+    const ctx = context()
+    expect(() => new ProductTelemetry(ctx, config('http://collector.test/v1/logs', invalid)))
+      .toThrow(`product-telemetry-otel: ${message}`)
+    expect(ctx.get('productTelemetry')).toBeUndefined()
+  })
+
+  it.each([
+    ['OTEL_EXPORTER_OTLP_COMPRESSION', 'gzip'],
+    ['OTEL_EXPORTER_OTLP_LOGS_COMPRESSION', 'gzip'],
+  ])('honors %s when compression is omitted', async (name, value) => {
+    vi.stubEnv(name, value)
+    const target = await collector()
+    const ctx = context()
+    const fiber = await ctx.plugin(ProductTelemetry, config(target.endpoint))
+    ctx.productTelemetry.emit(event)
+    await fiber.dispose()
+    expect(target.captures[0]?.headers['content-encoding']).toBe('gzip')
+  })
+
+  it('bounds a stalled shutdown and observes its later settlement', async () => {
+    const target = await collector()
+    const ctx = context()
+    const warn = vi.spyOn(ctx.logger, 'warn')
+    const fiber = await ctx.plugin(ProductTelemetry, config(target.endpoint, { shutdownTimeoutMillis: 20 }))
+    const pending = Promise.withResolvers<undefined>()
+    vi.spyOn(LoggerProvider.prototype, 'shutdown').mockReturnValue(pending.promise)
+    vi.useFakeTimers()
+    const disposal = fiber.dispose()
+    await vi.advanceTimersByTimeAsync(20)
+    await disposal
+    expect(warn).toHaveBeenCalledWith('Product telemetry shutdown deadline exceeded; pending events may be lost')
+    pending.resolve(undefined)
+    await pending.promise
+    await vi.advanceTimersByTimeAsync(0)
+  })
+})
@@ -0,0 +1,21 @@
+{
+  "extends": "../../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "src",
+    "outDir": "lib/types"
+  },
+  "include": [
+    "src"
+  ],
+  "references": [
+    {
+      "path": "../../../vendor/cosmokit"
+    },
+    {
+      "path": "../../../vendor/cordis"
+    },
+    {
+      "path": "../../../vendor/schemastery"
+    }
+  ]
+}
@@ -8436,6 +8436,46 @@ importers:
        specifier: workspace:^
        version: link:../../typert/protocol

+  packages/host/product-telemetry-otel:
+    dependencies:
+      '@deepseek-ai/schemastery':
+        specifier: link:../../../vendor/schemastery
+        version: link:../../../vendor/schemastery
+      '@opentelemetry/api':
+        specifier: ^1.9.1
+        version: 1.9.1
+      '@opentelemetry/api-logs':
+        specifier: ^0.220.0
+        version: 0.220.0
+      '@opentelemetry/core':
+        specifier: 2.9.0
+        version: 2.9.0(@opentelemetry/[email protected])
+      '@opentelemetry/otlp-exporter-base':
+        specifier: ^0.220.0
+        version: 0.220.0(@opentelemetry/[email protected])
+      '@opentelemetry/otlp-transformer':
+        specifier: ^0.220.0
+        version: 0.220.0(@opentelemetry/[email protected])
+      '@opentelemetry/resources':
+        specifier: ^2.9.0
+        version: 2.10.0(@opentelemetry/[email protected])
+      '@opentelemetry/sdk-logs':
+        specifier: ^0.220.0
+        version: 0.220.0(@opentelemetry/[email protected])
+    devDependencies:
+      '@deepseek-ai/cordis':
+        specifier: workspace:^
+        version: link:../../../vendor/cordis
+      '@deepseek-ai/cordis-plugin-loader':
+        specifier: workspace:^
+        version: link:../../../vendor/loader
+      '@deepseek-ai/dsh-app-boot':
+        specifier: workspace:^
+        version: link:../../boot/app-boot
+      '@deepseek-ai/dsh-loader-smoke':
+        specifier: workspace:^
+        version: link:../../test-support/loader-smoke
+
  packages/host/webserver:
    dependencies:
      '@deepseek-ai/schemastery':
@@ -56,6 +56,7 @@ export { REGION_BEGIN, REGION_END }
 export const SERVICE_PAGE: Record<string, string> = {
  speechToText: 'voice-input.md',
  speechController: 'voice-input.md',
+  productTelemetry: 'product-telemetry.md',
  connection: 'web-server.md',
  pluginManager: 'boot.md',
  profileContext: 'boot.md',
@@ -266,6 +267,8 @@ export const EVENT_WALK_EXEMPTIONS: Record<string, string> = {
 * appear on more than one page.
 */
 export const LINK_MAP: Readonly<Record<string, string>> = {
+  ProductTelemetryRecord: 'product-telemetry.md',
+  ProductTelemetryScalar: 'product-telemetry.md',
  WorkspaceChangesSummary: 'deliverables.md',
  WorkspaceFileDiff: 'deliverables.md',
  Reload: 'boot.md',
@@ -31,7 +31,7 @@ interface ServiceRole {
  key: string
  pkg: string
  title: string
-  mode: 'core' | 'seam' | 'bundle'
+  mode: 'core' | 'seam' | 'bundle' | 'service'
  implementations?: string[]
  consumers?: string[]
  companions?: string[]
@@ -373,6 +373,14 @@ const SERVICE_ROLES: ServiceRole[] = [
    consumers: ['llm-pi-ai'],
    note: 'Flows are registered by the plugin that knows how to obtain one credential and keyed by the record they write; the seam owns the conversation and the one-attempt-per-key lifecycle, never the protocol.',
  },
+  {
+    key: 'productTelemetry',
+    pkg: 'host-product-telemetry-otel',
+    title: 'Product usage event sender',
+    mode: 'service',
+    note: 'Exports explicitly submitted analytics events through OTLP/HTTP; mounting alone collects nothing.',
+  },
+
  {
    key: 'sessionTelemetry',
    pkg: 'session-telemetry',
@@ -863,7 +871,7 @@ function renderCapabilitySeams(pkgs: Pkg[], services: readonly ServiceEntry[]):
  const addEdge = (from: string, to: string): void => { edges.add(`  ${from} --> ${to}`) }
  const lines = generatedHeader('Capability Seams And Core Services')
  lines.push(
-    'A service can be a core spine service, a swappable capability seam, or a bundle/composition point. The graph shows the package that owns the service declaration, known implementation packages, and packages that consume the service directly.',
+    'A service can be a core spine service, a swappable capability seam, a bundle/composition point, or a standalone service. The graph shows the package that owns the service declaration, known implementation packages, and packages that consume the service directly.',
    '',
    '```mermaid',
    'flowchart LR',
@@ -2256,6 +2256,16 @@
      "doc": "docs/subsystems/deliverables.md",
      "symbol": "WorkspaceChanges",
      "source": "packages/deliverables/workspace-changes/src/types.ts"
+    },
+    {
+      "doc": "docs/subsystems/product-telemetry.md",
+      "symbol": "ProductTelemetryScalar",
+      "source": "packages/host/product-telemetry-otel/src/index.ts"
+    },
+    {
+      "doc": "docs/subsystems/product-telemetry.md",
+      "symbol": "ProductTelemetryRecord",
+      "source": "packages/host/product-telemetry-otel/src/index.ts"
    }
  ]
 }
@@ -49,6 +49,7 @@ const SENTENCE_MODEL_EXPERIENCE: Readonly<Record<string, SentenceContract>> = {
  'packages/experimental/speech-to-text-sensevoice': { kind: 'none', reason: 'Local recognition returns transient text without modifying model context.' },
  'packages/experimental/client-ui-voice-input': { kind: 'none', reason: 'Inserts reviewable text into the unsent draft without submitting to the Agent.' },
  'packages/experimental/voice-input-bundle': { kind: 'none', reason: 'Composes dictation and preparation plugins without adding any model-facing contribution.' },
+  'packages/host/product-telemetry-otel': { kind: 'none', reason: 'The plugin exports explicit analytics records without contributing model context.' },
  'packages/api/terminal-controller': { kind: 'none', reason: 'User-owned terminal processes and screen streams never enter model requests or Session events.' },
  'packages/client/ui-sidebar-terminal': { kind: 'none', reason: 'The browser renders user terminal screens without exposing them to the model.' },
  'packages/ssh/ssh': { kind: 'none', reason: 'The connection owner transports private provider operations; consumers own all model-facing content.' },
@@ -187,6 +187,7 @@
      "@deepseek-ai/dsh-host-directory-picker-native/*": ["./packages/host/directory-picker-native/src/*"],
      "@deepseek-ai/dsh-host-directory-picker-auto": ["./packages/host/directory-picker-auto/src"],
      "@deepseek-ai/dsh-host-directory-picker-auto/*": ["./packages/host/directory-picker-auto/src/*"],
+      "@deepseek-ai/dsh-host-product-telemetry-otel": ["./packages/host/product-telemetry-otel/src"],
      "@deepseek-ai/dsh-host-open-in-app": ["./packages/host/open-in-app/src"],
      "@deepseek-ai/dsh-host-open-in-app/shared": ["./packages/host/open-in-app/src/shared.ts"],
      "@deepseek-ai/dsh-host-webserver": ["./packages/host/webserver/src"],
@@ -177,6 +177,7 @@
    { "path": "./packages/experimental/api-speech-to-text" },
    { "path": "./packages/experimental/voice-input-bundle" },

+    { "path": "./packages/host/product-telemetry-otel" },
    { "path": "./packages/client/connection/tsconfig.host.json" },
    { "path": "./packages/skill/skill-office" },
    { "path": "./packages/skill/tool-workspace-dependencies" },