What

Follow-up to #3978. Crash reports tell us what broke; this adds the "for whom / how many" half, still entirely on our Cloudflare account.

Anonymous launch ping

One POST per desktop start to crash.reasonix.io/v1/ping: a random install id (16 bytes from crypto/rand, stored next to the global config, tied to nothing else), version, GOOS/GOARCH, and OS version string. That is the complete payload — no conversations, keys, paths, or hardware serials.

Consent posture, since the client is open source and the community rightly cares:

• New desktop.telemetry config (default on), toggle in Settings → Updates → Anonymous usage ping, disclosed in desktop/README.md.
• Dev builds (version == "dev") never ping, so local hacking stays silent.
• Ping failures are silently dropped — telemetry must never surface to the user.

Device facts on crash reports

ReportCrash now attaches coarse machine info — OS version, CPU model, logical cores, RAM — so "only crashes on Windows 11 ARM" patterns become visible. Windows reads RtlGetVersion/registry/kernel32, macOS shells out to sysctl/sw_vers, Linux parses /proc + /etc/os-release; the parsers are portable and unit-tested.

/stats page on the worker

Basic-auth (password in a worker secret), zero external assets, renders straight from D1: daily active installs + opens (30d), version and platform breakdown (7d distinct installs), recent crash groups. Day-to-day reading needs no SQL; per-day install dedup happens in SQL via ON CONFLICT (date, install_id) with an opens counter.

Already deployed and verified live

D1 migrated (device column, pings table), worker deployed with the second rate-limit binding (30/min for pings vs 5/min for reports), STATS_PASSWORD secret set. Verified on production: ping dedup (two pings → one row, opens = 2), device JSON stored, /stats 200 with auth and 401 without/with wrong password. Smoke rows cleaned.

Verification

• Root internal/config tests pass (round-trip includes the new telemetry key); desktop go vet + new unit tests pass (install-id stability, ping POST round-trip, dev-build skip, devinfo parsers).
• Frontend tsc --noEmit: zero new errors vs baseline. Worker package typechecks clean.

Notes

• The launch ping is desktop-only for now; a CLI ping would follow the same endpoint if we want it later.
• crash_app.go shows as a whole-file diff locally under gofmt -l due to CRLF checkout; committed content is LF like the rest of the tree.