carlos / platform Public

Errors tab, step 1 of the errors-and-analytics spec: every app gets an Errors tab, API and carlos errors with zero integration.

Spec: docs/superpowers/specs/2026-09-07-errors-and-analytics-design.md (approved by Paul 2026-09-07, four rulings in §8). Plan: docs/superpowers/plans/2026-09-07-errors-step1-log-and-edge.md.

What lands:

• internal/applog gains chunk families and a generic JSONL codec; logs/ chunks are byte-identical.
• The store door's app write grant becomes a family allow-list: logs, errors, analytics, each segment-exact.
• New leaf package internal/apperr: the error record, sanitisation (emails, credentials, hex/base64 runs; token path segments), fingerprinting (versioned, token-boundary normalisation, frame normalisation), a coalescing sink capped at 1,000 distinct keys per app per hour, the errors/ chunk read, and grouping.
• The agent ships the sink every 10 s and prunes errors/ with log retention.
• The edge's countingWriter now observes status and content type and is installed unconditionally; upstream 5xx become edge errors; the activator marks its own wake-path 503s via edge.MarkAnswered so they are filed once, as the platform log error they already are. Wrapper order unchanged; nothing wakes an instance.
• New internal/telemetry: accounts/<sqid>/telemetry.json and apps/<sqid>/<app>/telemetry.json, resolved app → account → defaults (analytics off, door on, log level error).
• Console: Errors tab (between Logs and Activity), GET /api/cli/apps/{account}/{app}/errors (Instance, Operate), PUT …/telemetry (Operate service; owner person), log-level setting on the app and account Settings pages, page capped at 200 groups/occurrences.
• carlos errors --app X [--since --until --source --level --host --release --fp --set-level] and its docs/site/cli.md heading.

Review record: each task had a fresh implementer and a task review; the final whole-branch review (Sonnet; Opus was rate-limited) approved for merge with no Critical or Important findings. One real defect found by the first final-review pass (the hourly cap re-counted keys after every drain) is fixed in 355aaa3 with a replay test. The rulings the controller made on Paul's behalf are in the job's closing report; the one worth a glance: a member's person token gets 403 on the telemetry PUT, owners 200, matching the owner-only form.

Gate: go build/vet/test ./... green, gofmt clean, darwin/arm64 and windows/amd64 cross-builds clean.

Deferred to follow-ups (not blocking): DELETE …/errors/{fp} tombstones; Group.Level badge when one fingerprint logs at two levels; a ctype sampling note for step 2's pageview tap.