diff --git a/AGENTS.md b/AGENTS.md
index 68687e9c4..09ff44367 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -5036,7 +5036,7 @@ the spec, target a 1920px viewport, not 1440px.
 | Render admin-authored Markdown to safe HTML | `web/includes/Markup/IntroRenderer.php` (`Sbpp\Markup`) |
 | Add a "Generate password" button to a password field (or change how passwords are generated) | Put `data-password-generator` + `data-password-targets="<id>[,<confirm-id>]"` on a `<button type="button" class="btn btn--ghost btn--icon">`; the shared dialog in `web/scripts/password-generator.js` (loaded from `core/footer.tpl`) does the rest: calls `Actions.AdminsGeneratePassword`, lets the admin tweak length + character sets, fills every non-disabled target on "Use password" and fires bubbling `input` / `change` events. Never write a page-local generator handler. Generation is server-side in `Sbpp\Security\PasswordGenerator` (`web/includes/Security/PasswordGenerator.php`, `random_int` + one-char-per-enabled-set guarantee + Fisher-Yates shuffle); the JSON action merges per-request options over the owner defaults (`config.password.generator.{length,lowercase,uppercase,digits,symbols,exclude_ambiguous}`, edited in Settings > Main, seeded by `data.sql` + `web/updater/data/813.php`) and clamps length to `[max(8, config.password.minlength), 128]`. The REST `POST /admins` fallback password uses the same class. `SYMBOLS` deliberately excludes quotes / backslash / `;` / space / backtick because values land in `server.cfg` and SourceMod configs. `admins.generate_password` stays `requireAdmin`, so surfaces reachable by non-web-admins gate the button (Your account uses `YourAccountView::$can_generate_password` = `is_admin()`). Regression guards: `web/tests/unit/PasswordGeneratorTest.php` (contract + data.sql / 813.php key and default parity), `AdminsTest::testGeneratePassword*`, `web/tests/e2e/specs/flows/password-generator.spec.ts`. |
 | Write or edit a user-facing string (panel UI text, toast body, docs page) | See "User-facing text style (panel UI + docs)" under Conventions. Three rules: no emdash (`—`), terse, don't over-explain. Applies to `web/themes/default/**/*.tpl`, `\Sbpp\View\Toast::emit` titles + bodies, `echo` output from page handlers, and every `docs/src/content/docs/**/*.{md,mdx}` page. Does NOT apply to `AGENTS.md` / `ARCHITECTURE.md` / contributor docs / code comments / audit-log entries / test fixtures. Anti-pattern entries paired under "Anti-patterns". |
-| Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1-8-to-2-0.mdx` (no first-login modal). |
+| Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/HostFingerprint.php` (`Sbpp\Telemetry\HostFingerprint::collect()`, the shared-hosting `env.*` signals from sbpp/cf-analytics#3; every probe is `Throwable`-guarded and raw paths / lists are reduced to booleans or counts) + `web/includes/Telemetry/Region.php` (`Sbpp\Telemetry\Region::resolve()`, the `panel.region` continent code from sbpp/cf-analytics#6; derived from the configured timezone name only, never from the request) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1-8-to-2-0.mdx` (no first-login modal). |
 | Add or edit a project announcement (the admin-only banner on the home dashboard) | Edit `docs/public/announcements.json` (the source of truth — Astro publishes it as a static asset at `https://sbpp.github.io/announcements.json`). Each entry: `id` (≤64 chars, **required**), `title` (**required**), `body_md` (CommonMark, optional — rendered through `Sbpp\Markup\IntroRenderer` so raw HTML is escaped + `javascript:` / `data:` URLs are stripped), `url` (optional `http(s)://` only — non-http schemes rejected at the parser), `published_at` (optional ISO-8601 or unix int — drives the sort order; entries without it sort below dated entries), `expires_at` (optional — the parser drops entries past this timestamp). Sorted newest-first by the panel; convention is to also place the newest entry at the top of the array so reviewers see the most relevant change first. The deploy chain is automatic: a push to `main` that touches `docs/` fires `.github/workflows/docs-deploy-trigger.yml` which lands the file at `https://sbpp.github.io/announcements.json` within minutes. The starter file ships as `[]` (empty array). NEVER write to the cache file (`SB_CACHE/announcements.json`) directly — the panel's shutdown hook owns that path. |
 | Add or edit a project sponsor, funding platform, or sponsor tier | Edit `docs/src/data/sponsors.json` (the single source of truth). Three top-level keys: `platforms` (`{id, name, url, description?, icon?}` — the funding channels; GitHub Sponsors today, append Open Collective / Patreon / etc. as they're approved), `tiers` (`{id, name, monthlyMinUsd?, description?}` — ordered list driving the sponsor-roll display order), `sponsors` (`{name, url?, logo?, tier?, since?}` — `tier` matches a `tiers[].id`; missing/empty/unknown places the sponsor in the "Individual supporters" bucket). The component `docs/src/components/Sponsors.astro` renders the file on the canonical `/sponsor/` landing page (`docs/src/content/docs/sponsor.mdx`, `template: splash`, intentionally absent from the sidebar in `astro.config.mjs`); the topbar heart icon, the per-page footer link in `docs/src/components/Footer.astro`, and `.github/FUNDING.yml`'s `custom:` URL all route there. Adding a new platform / sponsor is a one-line append here — no component, config, or template edit needed. Companion issue #1417 will surface the same data on the panel footer; a future README-injector script will read the same file into the main `README.md`'s `<!-- sponsors:start --> ... <!-- sponsors:end -->` markers. The starter file ships with one `platforms` entry (GitHub Sponsors) and empty `tiers` + `sponsors` arrays. Issue #1416. |
 | Embed the sponsor roll on a docs page other than `/sponsor/` (e.g. a future docs index hero) | Import `docs/src/components/Sponsors.astro` and render `<Sponsors showPlatforms={false} />` — the component reads `docs/src/data/sponsors.json` and renders just the tier-grouped roll (with the "Individual supporters" bucket) when `showPlatforms` is false. `showEmptyHint={false}` additionally suppresses the "be the first" line when the roll is empty. The component renders its own `<h2>` headings; the embedding page should not add a parallel `## Our sponsors` heading or the chrome doubles. Issue #1416. |
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index ae533bc80..a0ef75d45 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -107,7 +107,7 @@ web/
 │   ├── Servers/              Sbpp\Servers\{SourceQueryCache, RconStatusCache} — per-(ip, port) cache around the xPaw A2S probe (#1311) + per-sid cache around the RCON `status` command (#PLAYER_CTX_MENU)
 │   ├── Upload/               Sbpp\Upload\UploadHandler — shared file-upload handler (perm + CSRF + extension allowlist + filename sanitiser + popup chrome) for the demo / icon / mapimage popup pages
 │   ├── Mail/                 Sbpp\Mail\{Mail,Mailer,EmailType} — Symfony Mailer wrapper + enum
-│   ├── Telemetry/            Sbpp\Telemetry\{Telemetry,Schema1} — anonymous opt-out daily ping (#1126); schema-1.lock.json is the vendored cross-repo contract
+│   ├── Telemetry/            Sbpp\Telemetry\{Telemetry,Schema1,HostFingerprint,Region} — anonymous opt-out daily ping (#1126); schema-1.lock.json is the vendored cross-repo contract
 │   ├── Announce/             Sbpp\Announce\{AnnouncementFetcher,Announcement} — anonymous opt-out daily fetch of project news / security advisories from https://sbpp.github.io/announcements.json (source of truth: docs/public/announcements.json); admin-only banner on the home dashboard
 │   ├── Export/               Sbpp\Export\{ManifestBuilder,EntityExporter,BundleWriter,S3PresignedUploader,ExportError,Manifest} — owner-only full data export feature; streamed one-shot ZIP bundle of every row + every uploaded demo; entry point web/export.php (binary wire format, sits at panel-root next to exportbans.php / getdemo.php)
 │   ├── SteamID/              SteamID parsing / vanity-URL resolution
@@ -801,13 +801,31 @@ The tick is the issue #1126 contract:
    calls without flipping the user-facing toggle.
 
 The whole `tickIfDue` body is wrapped in `try { … } catch (\Throwable)`
-so telemetry can NEVER hard-fail the request. Pings are never
+so telemetry can NEVER hard-fail the request. Defining
+`SBPP_SKIP_TELEMETRY` before `init.php` skips the tick for that
+request: `/health.php` does this, and so does the docker dev stack's
+`docker/php/dev-prepend.php` for every web request, which keeps local
+dev, E2E, and CI screenshot runs out of the production dataset. Pings are never
 audit-logged either — a flapping endpoint would otherwise generate
 `sb_log` noise that scares admins. Only the enable/disable
 **transitions** are audit-logged (in
 `web/pages/admin.settings.php`'s features POST handler).
 
 `Telemetry::collect()` is the side-effect-free payload builder. The
+shared-hosting signals in the `env` block (SAPI, ini limits,
+`open_basedir`, control-panel dirs, per-user FPM; sbpp/cf-analytics#3)
+come from `Sbpp\Telemetry\HostFingerprint`, which runs every probe
+behind a `Throwable` guard so a host that disables `ini_get` /
+`posix_*` degrades one field instead of losing the ping. Nullable
+fields stay as explicit `null` in `collect()` (stable key set for the
+parity test) and `send()` drops them via `Telemetry::withoutNulls()`,
+because the Worker's validator accepts an absent key but rejects a
+literal `null`. `panel.region` (sbpp/cf-analytics#6) comes from
+`Sbpp\Telemetry\Region`, a hardcoded IANA-zone → continent table fed
+by `config.timezone` (when it's a zone name; pre-2.0 upgrades can
+leave a bare UTC offset there) or else PHP's default timezone; it
+never reads the request. `panel.exported_30d` reads the `Data Export`
+success rows `web/export.php` writes to `:prefix_log`. The
 exact wire format is captured in
 `web/includes/Telemetry/schema-1.lock.json` — a Draft-7 JSON Schema
 vendored byte-for-byte from the [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics)
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a71af651f..fe000f28d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,16 @@ Legend:
 ? = Other stuff
 ```
 
+(26/10/26): Version 2.2.4-srcdslab
+-----------------------
+```
+01. + Telemetry sends the fields the analytics Worker expects: shared-
+        hosting environment signals, 30-day activity, game mix,
+        permission shape, data-export usage and the continent of the
+        panel's timezone (still no hostnames, IPs, names or SteamIDs)
+02. ? The Docker dev / CI stack no longer sends telemetry pings
+```
+
 (26/10/26): Version 2.2.3-srcdslab (**Run updater required**)
 -----------------------
 ```
diff --git a/docker/README.md b/docker/README.md
index dc1c76690..75db5424d 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -60,7 +60,7 @@ docker/apache/
     sbpp-dev.conf        denies direct /demos/ access + sends nosniff (mirrors sbpp-prod.conf)
 docker/php/
     web-entrypoint.sh    waits for DB, renders config.php, runs composer install, fixes cache + demos perms
-    dev-prepend.php      normalizes HTTP_HOST so init.php's localhost guard accepts :8080
+    dev-prepend.php      dev-only constants: install-guard bypass + telemetry opt-out (web requests)
 docker/db-init/
     00-render-schema.sh  on first DB init: substitutes {prefix}/{charset}, loads struc/data, seeds admin
 sbpp.sh                  thin wrapper around `docker compose` + common dev tasks
diff --git a/docker/php/dev-prepend.php b/docker/php/dev-prepend.php
index 0d1bffb6f..4e83526c6 100644
--- a/docker/php/dev-prepend.php
+++ b/docker/php/dev-prepend.php
@@ -28,3 +28,22 @@
 if (!defined('SBPP_DEV_KEEP_INSTALL')) {
     define('SBPP_DEV_KEEP_INSTALL', true);
 }
+
+// Keep dev / CI / test traffic out of the production telemetry
+// dataset (#1126). The dev stack seeds the DB from `data.sql`, which
+// ships `telemetry.enabled = 1` + the live cf-analytics endpoint, so
+// without this every `./sbpp.sh up`, every E2E run, and every docs
+// screenshot capture in CI would ping the real Worker from a
+// throwaway install with a fresh `instance_id`. `SBPP_SKIP_TELEMETRY`
+// is the same per-request opt-out `/health.php` uses; it makes
+// `Telemetry::tickIfDue()` return before any DB write or network call.
+//
+// Web SAPIs only: the CLI also loads this file (PHPUnit inside the
+// container via `./sbpp.sh test`), and `TelemetryOptOutTest` drives
+// `tickIfDue()` directly against a dead endpoint to pin the gate.
+// Defining the constant there would short-circuit those tests. The
+// PHPUnit bootstrap never requires `init.php`, so no shutdown tick is
+// registered under the CLI anyway.
+if (PHP_SAPI !== 'cli' && !defined('SBPP_SKIP_TELEMETRY')) {
+    define('SBPP_SKIP_TELEMETRY', true);
+}
diff --git a/docs/src/content/docs/updating/1-8-to-2-0.mdx b/docs/src/content/docs/updating/1-8-to-2-0.mdx
index b85654c53..a71bc97ac 100644
--- a/docs/src/content/docs/updating/1-8-to-2-0.mdx
+++ b/docs/src/content/docs/updating/1-8-to-2-0.mdx
@@ -123,11 +123,27 @@ categories:
 
 - **panel**: version, short git SHA, dev flag, theme name (only
   `default` or `custom` is reported; fork theme **names are never
-  sent**).
+  sent**), the continent of the panel's configured timezone (for
+  example `eu`; never the timezone itself, and never looked up from
+  your IP), and whether a full data export ran in the last 30 days.
 - **env**: PHP `major.minor`, DB engine + `major.minor`, web server
-  family, OS family.
+  family, OS family, plus a hosting fingerprint: PHP SAPI name,
+  `memory_limit` / `max_execution_time`, how many functions
+  `disable_functions` lists, and yes/no flags for thread safety,
+  64-bit PHP, `open_basedir` set, `allow_url_fopen`, OPcache,
+  Suhosin, POSIX, a cPanel / Plesk / DirectAdmin install, a
+  `/home/<user>/public_html`-style document root, and PHP running as
+  the account that owns the panel files. The `open_basedir` value,
+  document root path, and the `disable_functions` list itself are
+  **never sent**, only the yes/no or the count.
 - **scale**: counts of admins, enabled servers, active and total
-  bans / comm blocks, 30-day submission / protest counts.
+  bans / comm blocks, 30-day submission / protest counts, bans and
+  active admins in the last 30 days, how many months of ban history
+  the panel holds, whether most recent bans were added from the web
+  panel, which games your enabled servers run (TF2, CS:S, CS:GO,
+  Garry's Mod, L4D2, or "other"; other game **names are never
+  sent**), and yes/no flags for web groups, server groups, overrides,
+  and admin immunity.
 - **features**: every checkbox under
   **Admin Panel → Settings → Features**, plus three derived booleans:
   SMTP-configured, Steam API key set, GeoIP DB present.
diff --git a/web/includes/Telemetry/HostFingerprint.php b/web/includes/Telemetry/HostFingerprint.php
new file mode 100644
index 000000000..c6b87688a
--- /dev/null
+++ b/web/includes/Telemetry/HostFingerprint.php
@@ -0,0 +1,182 @@
+<?php
+declare(strict_types=1);
+
+namespace Sbpp\Telemetry;
+
+use Throwable;
+
+/**
+ * Shared-hosting fingerprint signals for the telemetry `env` block
+ * (sbpp/cf-analytics#3).
+ *
+ * There's no single reliable "this is a shared host" indicator, so
+ * the panel ships the raw inputs (SAPI, ini limits, open_basedir,
+ * control-panel dirs, per-user FPM) and the shared / constrained /
+ * unconstrained label is derived query-time on the analytics side.
+ * Keeping the heuristic in SQL means retuning it never needs a panel
+ * release.
+ *
+ * Privacy posture matches the rest of the payload: anything whose
+ * raw value identifies the host or account (the `open_basedir`
+ * value, `DOCUMENT_ROOT`, the `disable_functions` list) is reduced
+ * to a boolean or a count before it leaves this class.
+ *
+ * Every probe runs through `probe()` so a host that disables
+ * `ini_get` / `posix_*` / `fileowner`, or an `open_basedir` that
+ * rejects the `/usr/local/*` checks, degrades that one field to its
+ * fallback instead of throwing and losing the whole ping.
+ */
+final class HostFingerprint
+{
+    /**
+     * UIDs at or above this are treated as regular accounts for
+     * `sapi_per_user`. Distro service accounts (root, www-data,
+     * apache, FreeBSD www, nginx, …) all sit below it.
+     */
+    private const MIN_ACCOUNT_UID = 1000;
+
+    /** `nobody` / `nfsnobody` — above the threshold but never an account. */
+    private const NOBODY_UID = 65534;
+
+    private function __construct()
+    {
+    }
+
+    /**
+     * @return array<string, string|int|bool|null>
+     */
+    public static function collect(): array
+    {
+        $sapi = PHP_SAPI;
+        return [
+            'sapi'                    => $sapi,
+            'memory_limit_mb'         => self::probe(
+                static fn (): ?int => self::parseMemoryLimitMb(self::ini('memory_limit')),
+                null
+            ),
+            'max_execution_time'      => self::probe(
+                static fn (): int => max(0, (int) self::ini('max_execution_time')),
+                0
+            ),
+            'disable_functions_count' => self::probe(
+                static fn (): int => self::countDisabledFunctions(self::ini('disable_functions')),
+                0
+            ),
+            'zts'                     => PHP_ZTS === 1,
+            'php_64bit'               => PHP_INT_SIZE === 8,
+            'open_basedir_set'        => self::probe(static fn (): bool => self::ini('open_basedir') !== '', false),
+            'allow_url_fopen'         => self::probe(static fn (): bool => self::iniBool(self::ini('allow_url_fopen')), false),
+            'opcache_loaded'          => extension_loaded('Zend OPcache'),
+            'suhosin_loaded'          => extension_loaded('suhosin'),
+            'posix_available'         => function_exists('posix_geteuid'),
+            'host_panel_cpanel'       => self::dirExists('/usr/local/cpanel'),
+            'host_panel_plesk'        => self::dirExists('/usr/local/psa'),
+            'host_panel_directadmin'  => self::dirExists('/usr/local/directadmin'),
+            'docroot_user_home'       => self::isUserHomeDocroot((string) ($_SERVER['DOCUMENT_ROOT'] ?? '')),
+            'sapi_per_user'           => self::probe(static fn (): bool => self::isPerUserSapi($sapi), false),
+        ];
+    }
+
+    /**
+     * `memory_limit` shorthand → whole MiB. `-1` (unlimited) and
+     * unparseable values map to `null` so they land as an absent
+     * double rather than a fake small limit.
+     */
+    public static function parseMemoryLimitMb(string $raw): ?int
+    {
+        if (preg_match('/^\s*(-?\d+)\s*([kmg]?)\s*$/i', $raw, $m) !== 1) {
+            return null;
+        }
+        $n = (int) $m[1];
+        if ($n < 0) {
+            return null;
+        }
+        $bytes = match (strtolower($m[2])) {
+            'g'     => $n * 1024 * 1024 * 1024,
+            'm'     => $n * 1024 * 1024,
+            'k'     => $n * 1024,
+            default => $n,
+        };
+        return intdiv($bytes, 1024 * 1024);
+    }
+
+    public static function countDisabledFunctions(string $raw): int
+    {
+        return count(array_filter(
+            array_map('trim', explode(',', $raw)),
+            static fn (string $fn): bool => $fn !== ''
+        ));
+    }
+
+    /**
+     * cPanel (`/home/<user>/public_html`) and DirectAdmin
+     * (`/home/<user>/domains/<domain>/public_html`) docroots.
+     * `/home2`, `/home3`, … cover cPanel's multi-disk layout.
+     */
+    public static function isUserHomeDocroot(string $docroot): bool
+    {
+        return preg_match('~^/home\d*/[^/]+/(public_html|domains/.+/public_html)(/|$)~', $docroot) === 1;
+    }
+
+    /**
+     * Per-user FPM / suEXEC / mod_ruid2: the process runs as the
+     * account that owns the panel's files instead of a shared
+     * service user. Without POSIX we can't tell, so report `false`
+     * rather than guess.
+     */
+    private static function isPerUserSapi(string $sapi): bool
+    {
+        if ($sapi !== 'fpm-fcgi' && $sapi !== 'cgi-fcgi') {
+            return false;
+        }
+        if (!function_exists('posix_geteuid')) {
+            return false;
+        }
+        $euid  = posix_geteuid();
+        $owner = @fileowner(__FILE__);
+        return $owner !== false
+            && $euid === $owner
+            && $euid >= self::MIN_ACCOUNT_UID
+            && $euid !== self::NOBODY_UID;
+    }
+
+    private static function dirExists(string $path): bool
+    {
+        // `@` because an `open_basedir` that excludes /usr/local
+        // warns on every is_dir() call outside it.
+        return self::probe(static fn (): bool => @is_dir($path), false);
+    }
+
+    /**
+     * `ini_get` can itself be in `disable_functions`; treat that the
+     * same as an unset directive.
+     */
+    private static function ini(string $key): string
+    {
+        if (!function_exists('ini_get')) {
+            return '';
+        }
+        $value = ini_get($key);
+        return $value === false ? '' : $value;
+    }
+
+    private static function iniBool(string $raw): bool
+    {
+        return filter_var($raw, FILTER_VALIDATE_BOOLEAN);
+    }
+
+    /**
+     * @template T
+     * @param callable(): T $fn
+     * @param T $fallback
+     * @return T
+     */
+    private static function probe(callable $fn, mixed $fallback): mixed
+    {
+        try {
+            return $fn();
+        } catch (Throwable) {
+            return $fallback;
+        }
+    }
+}
diff --git a/web/includes/Telemetry/Region.php b/web/includes/Telemetry/Region.php
new file mode 100644
index 000000000..9e8e96c4a
--- /dev/null
+++ b/web/includes/Telemetry/Region.php
@@ -0,0 +1,133 @@
+<?php
+declare(strict_types=1);
+
+namespace Sbpp\Telemetry;
+
+use DateTimeZone;
+use Throwable;
+
+/**
+ * Coarse `panel.region` for the telemetry payload
+ * (sbpp/cf-analytics#6): a continent code derived from the panel's
+ * configured timezone name.
+ *
+ * Never derived from the request or the client IP. The only input
+ * is a timezone the operator (or their host) configured, and the
+ * only output is one of six continent codes or `null`.
+ *
+ * The mapping is a hardcoded table over IANA zone names rather than
+ * `DateTimeZone::getLocation()`, because distro PHP builds that use
+ * the system tzdata don't always carry the location table. The
+ * first path segment decides the continent; only `America/`,
+ * `Atlantic/`, `Indian/` and `Pacific/` need per-city overrides.
+ */
+final class Region
+{
+    /** First path segment → continent. `America` / ocean prefixes are handled separately. */
+    private const PREFIXES = [
+        'Africa'    => 'af',
+        'Asia'      => 'as',
+        'Europe'    => 'eu',
+        'Arctic'    => 'eu',
+        'Australia' => 'oc',
+    ];
+
+    /** `America/<city>` zones in South America. Everything else under `America/` is North America. */
+    private const SOUTH_AMERICA = [
+        'Araguaina', 'Asuncion', 'Bahia', 'Belem', 'Boa_Vista', 'Bogota',
+        'Buenos_Aires', 'Campo_Grande', 'Caracas', 'Catamarca', 'Cayenne',
+        'Cordoba', 'Cuiaba', 'Eirunepe', 'Fortaleza', 'Guayaquil', 'Guyana',
+        'Jujuy', 'La_Paz', 'Lima', 'Maceio', 'Manaus', 'Mendoza', 'Montevideo',
+        'Noronha', 'Paramaribo', 'Porto_Acre', 'Porto_Velho', 'Punta_Arenas',
+        'Recife', 'Rio_Branco', 'Rosario', 'Santarem', 'Santiago', 'Sao_Paulo',
+    ];
+
+    /** Ocean-prefixed zones that belong to a continent. Unlisted ones (South Georgia, Kerguelen) are `null`. */
+    private const OCEAN = [
+        'Atlantic/Azores'       => 'eu',
+        'Atlantic/Canary'       => 'eu',
+        'Atlantic/Faeroe'       => 'eu',
+        'Atlantic/Faroe'        => 'eu',
+        'Atlantic/Jan_Mayen'    => 'eu',
+        'Atlantic/Madeira'      => 'eu',
+        'Atlantic/Reykjavik'    => 'eu',
+        'Atlantic/Cape_Verde'   => 'af',
+        'Atlantic/St_Helena'    => 'af',
+        'Atlantic/Bermuda'      => 'na',
+        'Atlantic/Stanley'      => 'sa',
+        'Indian/Antananarivo'   => 'af',
+        'Indian/Comoro'         => 'af',
+        'Indian/Mahe'           => 'af',
+        'Indian/Mauritius'      => 'af',
+        'Indian/Mayotte'        => 'af',
+        'Indian/Reunion'        => 'af',
+        'Indian/Chagos'         => 'as',
+        'Indian/Christmas'      => 'as',
+        'Indian/Cocos'          => 'as',
+        'Indian/Maldives'       => 'as',
+        'Pacific/Easter'        => 'sa',
+        'Pacific/Galapagos'     => 'sa',
+    ];
+
+    private function __construct()
+    {
+    }
+
+    /**
+     * Pick the timezone to classify: `config.timezone` when it holds
+     * a valid zone name (pre-2.0 installs may still carry a numeric
+     * UTC offset there, which can't be mapped), else PHP's default
+     * timezone, which is what the panel renders dates in.
+     */
+    public static function resolve(?string $configured, string $phpDefault): ?string
+    {
+        $configured = trim((string) $configured);
+        if (self::isZoneName($configured)) {
+            return self::fromTimezone($configured);
+        }
+        return self::fromTimezone($phpDefault);
+    }
+
+    /**
+     * Continent code for an IANA zone name, or `null` for `UTC`,
+     * `Etc/*`, Antarctica, offsets, and anything unrecognised.
+     */
+    public static function fromTimezone(string $zone): ?string
+    {
+        $zone = trim($zone);
+        if (!self::isZoneName($zone)) {
+            return null;
+        }
+        if (isset(self::OCEAN[$zone])) {
+            return self::OCEAN[$zone];
+        }
+        $segments = explode('/', $zone);
+        $prefix   = $segments[0];
+        $city     = $segments[count($segments) - 1];
+
+        return match ($prefix) {
+            'America'             => ($segments[1] === 'Argentina' || in_array($city, self::SOUTH_AMERICA, true)) ? 'sa' : 'na',
+            'Pacific'             => 'oc',
+            'Atlantic', 'Indian'  => null,
+            default               => self::PREFIXES[$prefix] ?? null,
+        };
+    }
+
+    /**
+     * True for a `Area/Location` name PHP recognises. Rejects bare
+     * offsets (`-8`, `+01:00`) and abbreviations (`UTC`, `EST`),
+     * which `DateTimeZone` would otherwise accept.
+     */
+    private static function isZoneName(string $zone): bool
+    {
+        if (preg_match('#^[A-Za-z_]+(?:/[A-Za-z0-9_+\-]+)+$#', $zone) !== 1) {
+            return false;
+        }
+        try {
+            new DateTimeZone($zone);
+            return true;
+        } catch (Throwable) {
+            return false;
+        }
+    }
+}
diff --git a/web/includes/Telemetry/Telemetry.php b/web/includes/Telemetry/Telemetry.php
index 75f878ee9..d1fdb1ee5 100644
--- a/web/includes/Telemetry/Telemetry.php
+++ b/web/includes/Telemetry/Telemetry.php
@@ -70,6 +70,9 @@ final class Telemetry
     /** cURL total-operation timeout. */
     private const TOTAL_TIMEOUT_SECONDS = 5;
 
+    /** `modfolder`s with their own `scale.games` flag; every other folder reports as `other`. */
+    private const TRACKED_GAMES = ['tf', 'cstrike', 'csgo', 'garrysmod', 'left4dead2'];
+
     /**
      * Process-local cache of the instance ID. Settings are loaded
      * once at request start by `Config::init()` and the cache is
@@ -96,6 +99,11 @@ final class Telemetry
      * cURL POST on every probe, but the per-tick slot-reservation
      * `UPDATE` on `:prefix_settings.last_ping` is still pure noise
      * we'd rather not pay on a 2880-probe-per-day endpoint.
+     *
+     * The docker dev stack (`docker/php/dev-prepend.php`) defines
+     * the same constant on every web request, so local dev, E2E,
+     * and the CI docs-screenshot capture never ping the live
+     * endpoint.
      */
     public static function tickIfDue(): void
     {
@@ -141,7 +149,7 @@ public static function send(array $payload, string $endpoint, string $userAgent)
         if ($endpoint === '') {
             return;
         }
-        $body = json_encode($payload, JSON_UNESCAPED_SLASHES);
+        $body = json_encode(self::withoutNulls($payload), JSON_UNESCAPED_SLASHES);
         if ($body === false) {
             return;
         }
@@ -175,6 +183,28 @@ public static function send(array $payload, string $endpoint, string $userAgent)
         unset($ch);
     }
 
+    /**
+     * Drop `null` leaves before encoding. `collect()` keeps nullable
+     * fields (e.g. `env.memory_limit_mb` on an unlimited host) as
+     * explicit `null` so the extractor parity test sees a stable
+     * key set, but the Worker's validator only accepts an absent
+     * key there; a literal `null` would 400 the whole ping.
+     *
+     * @param array<string, mixed> $node
+     * @return array<string, mixed>
+     */
+    public static function withoutNulls(array $node): array
+    {
+        $out = [];
+        foreach ($node as $key => $value) {
+            if ($value === null) {
+                continue;
+            }
+            $out[$key] = is_array($value) ? self::withoutNulls($value) : $value;
+        }
+        return $out;
+    }
+
     /**
      * The actual tick body: opt-out gate → cooldown check →
      * atomic reservation → flush response → POST.
@@ -409,11 +439,17 @@ private static function collectPanel(): array
         /** @var mixed $rawGit */
         $rawGit  = defined('SB_GITREV') ? constant('SB_GITREV') : '';
         $git     = is_string($rawGit) ? $rawGit : '';
+        $timezone = Config::get('config.timezone');
         return [
-            'version' => $version,
-            'git'     => $git,
-            'dev'     => $version === \Sbpp\Version::DEV_SENTINEL,
-            'theme'   => self::resolveTheme(),
+            'version'      => $version,
+            'git'          => $git,
+            'dev'          => $version === \Sbpp\Version::DEV_SENTINEL,
+            'theme'        => self::resolveTheme(),
+            'region'       => Region::resolve(
+                is_string($timezone) ? $timezone : null,
+                date_default_timezone_get()
+            ),
+            'exported_30d' => self::resolveExported30d(),
         ];
     }
 
@@ -428,29 +464,51 @@ private static function collectEnv(): array
             'db_version' => self::resolveDbVersion(),
             'web_server' => self::resolveWebServer((string) ($_SERVER['SERVER_SOFTWARE'] ?? '')),
             'os_family'  => self::resolveOsFamily(),
-        ];
+        ] + HostFingerprint::collect();
     }
 
     /**
-     * @return array<string, int>
+     * @return array<string, mixed>
      */
     private static function collectScale(): array
     {
         $db = self::db();
         if ($db === null) {
             return [
-                'admins'          => 0,
-                'servers_enabled' => 0,
-                'bans_active'     => 0,
-                'bans_total'      => 0,
-                'comms_active'    => 0,
-                'comms_total'     => 0,
-                'submissions_30d' => 0,
-                'protests_30d'    => 0,
+                'admins'                => 0,
+                'servers_enabled'       => 0,
+                'bans_active'           => 0,
+                'bans_total'            => 0,
+                'comms_active'          => 0,
+                'comms_total'           => 0,
+                'submissions_30d'       => 0,
+                'protests_30d'          => 0,
+                'bans_30d'              => 0,
+                'admins_active_30d'     => 0,
+                'ban_history_months'    => null,
+                'web_bans_majority_30d' => false,
+                'games'                 => self::gamesFromModfolders([]),
+                'perms'                 => [
+                    'web_groups'    => false,
+                    'server_groups' => false,
+                    'overrides'     => false,
+                    'immunity'      => false,
+                ],
             ];
         }
 
-        $thirtyDaysAgo = time() - 30 * 86400;
+        $now           = time();
+        $thirtyDaysAgo = $now - 30 * 86400;
+        $bans30d       = self::countWithCutoff(
+            $db,
+            "SELECT COUNT(*) AS c FROM `:prefix_bans` WHERE `created` >= :cutoff",
+            $thirtyDaysAgo
+        );
+        $webBans30d    = self::countWithCutoff(
+            $db,
+            "SELECT COUNT(*) AS c FROM `:prefix_bans` WHERE `created` >= :cutoff AND `sid` = 0",
+            $thirtyDaysAgo
+        );
 
         return [
             'admins'          => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_admins`"),
@@ -477,9 +535,129 @@ private static function collectScale(): array
                 "SELECT COUNT(*) AS c FROM `:prefix_protests` WHERE `datesubmitted` >= :cutoff",
                 $thirtyDaysAgo
             ),
+            'bans_30d'              => $bans30d,
+            'admins_active_30d'     => self::countWithCutoff(
+                $db,
+                "SELECT COUNT(*) AS c FROM `:prefix_admins` WHERE `lastvisit` >= :cutoff",
+                $thirtyDaysAgo
+            ),
+            'ban_history_months'    => self::resolveBanHistoryMonths($db, $now),
+            'web_bans_majority_30d' => $webBans30d * 2 > $bans30d,
+            'games'                 => self::gamesFromModfolders(self::enabledModfolders($db)),
+            'perms'                 => [
+                'web_groups'    => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_groups` WHERE `type` = 1") > 0,
+                'server_groups' => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_srvgroups`") > 0,
+                'overrides'     => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_overrides`") > 0,
+                'immunity'      => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_admins` WHERE `immunity` > 0") > 0,
+            ],
         ];
     }
 
+    /**
+     * Map the `modfolder`s of enabled servers onto the `scale.games`
+     * flags. Anything outside the five tracked games collapses into
+     * `other`; the folder name itself never leaves the panel.
+     *
+     * @param list<string> $modfolders
+     * @return array<string, bool>
+     */
+    public static function gamesFromModfolders(array $modfolders): array
+    {
+        $games = array_fill_keys(self::TRACKED_GAMES, false);
+        $games['other'] = false;
+        foreach ($modfolders as $folder) {
+            $folder = strtolower(trim($folder));
+            $games[in_array($folder, self::TRACKED_GAMES, true) ? $folder : 'other'] = true;
+        }
+        return $games;
+    }
+
+    /**
+     * Distinct `modfolder`s across enabled servers.
+     *
+     * @return list<string>
+     */
+    private static function enabledModfolders(Database $db): array
+    {
+        try {
+            $db->query(
+                "SELECT DISTINCT m.`modfolder` FROM `:prefix_servers` s "
+                . "JOIN `:prefix_mods` m ON m.`mid` = s.`modid` "
+                . "WHERE s.`enabled` = 1"
+            );
+            $folders = [];
+            foreach ($db->resultset() as $row) {
+                $folders[] = (string) ($row['modfolder'] ?? '');
+            }
+            return $folders;
+        } catch (Throwable) {
+            return [];
+        }
+    }
+
+    /**
+     * Whole calendar months between the oldest ban and `$now`, or
+     * `null` when the panel has no bans. `created = 0` rows (the
+     * column default, seen on imported legacy bans) are ignored so
+     * they don't read as a ban from 1970.
+     */
+    private static function resolveBanHistoryMonths(Database $db, int $now): ?int
+    {
+        try {
+            $db->query("SELECT MIN(`created`) AS m FROM `:prefix_bans` WHERE `created` > 0");
+            $row = $db->single();
+            $oldest = is_array($row) ? (int) ($row['m'] ?? 0) : 0;
+        } catch (Throwable) {
+            return null;
+        }
+        if ($oldest <= 0) {
+            return null;
+        }
+        return self::monthsBetween($oldest, $now);
+    }
+
+    /**
+     * Whole calendar months from `$from` to `$to` (both unix
+     * seconds, compared in UTC). `0` when `$from` is in the future.
+     */
+    public static function monthsBetween(int $from, int $to): int
+    {
+        if ($from >= $to) {
+            return 0;
+        }
+        $utc  = new \DateTimeZone('UTC');
+        $diff = (new \DateTimeImmutable('@' . $from))->setTimezone($utc)
+            ->diff((new \DateTimeImmutable('@' . $to))->setTimezone($utc));
+        return $diff->y * 12 + $diff->m;
+    }
+
+    /**
+     * True iff `web/export.php` logged a successful full data
+     * export (ZIP delivered or S3 upload OK, both `LogType::Message`
+     * under the `Data Export` title) in the last 30 days. Failures
+     * and permission denials log as `Error` / `Warning` and don't
+     * count. An operator who clears the audit log resets this.
+     */
+    private static function resolveExported30d(): bool
+    {
+        $db = self::db();
+        if ($db === null) {
+            return false;
+        }
+        try {
+            $db->query(
+                "SELECT COUNT(*) AS c FROM `:prefix_log` "
+                . "WHERE `type` = :type AND `title` = 'Data Export' AND `created` >= :cutoff"
+            );
+            $db->bind(':type', \LogType::Message->value);
+            $db->bind(':cutoff', time() - 30 * 86400);
+            $row = $db->single();
+            return is_array($row) && (int) ($row['c'] ?? 0) > 0;
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
     /**
      * @return array<string, bool>
      */
diff --git a/web/includes/Telemetry/schema-1.lock.json b/web/includes/Telemetry/schema-1.lock.json
index 15f56f730..8fe50fd93 100644
--- a/web/includes/Telemetry/schema-1.lock.json
+++ b/web/includes/Telemetry/schema-1.lock.json
@@ -20,7 +20,7 @@
         "panel": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["version", "git", "dev", "theme"],
+            "required": ["version", "git", "dev", "theme", "region", "exported_30d"],
             "properties": {
                 "version": {
                     "type": "string",
@@ -38,13 +38,44 @@
                     "type": "string",
                     "enum": ["default", "custom"],
                     "description": "`'default'` if the active theme is the panel's shipped default; `'custom'` otherwise. The actual fork theme name is never reported (would leak community names)."
+                },
+                "region": {
+                    "type": ["string", "null"],
+                    "enum": ["af", "as", "eu", "na", "oc", "sa", null],
+                    "description": "Continent code derived from the panel's configured timezone: `config.timezone` when it holds an IANA zone name, else PHP's default timezone (`date.timezone`). Never derived from the request or the client IP. `null` for `UTC` / `Etc/*` / Antarctica / unparseable values; null leaves are dropped from the wire body, so the Worker sees the key as absent."
+                },
+                "exported_30d": {
+                    "type": "boolean",
+                    "description": "True iff a full data export bundle was delivered (ZIP download or S3 upload) in the last 30 days, read from the `Data Export` success rows in `:prefix_log`."
                 }
             }
         },
         "env": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["php", "db_engine", "db_version", "web_server", "os_family"],
+            "required": [
+                "php",
+                "db_engine",
+                "db_version",
+                "web_server",
+                "os_family",
+                "sapi",
+                "memory_limit_mb",
+                "max_execution_time",
+                "disable_functions_count",
+                "zts",
+                "php_64bit",
+                "open_basedir_set",
+                "allow_url_fopen",
+                "opcache_loaded",
+                "suhosin_loaded",
+                "posix_available",
+                "host_panel_cpanel",
+                "host_panel_plesk",
+                "host_panel_directadmin",
+                "docroot_user_home",
+                "sapi_per_user"
+            ],
             "properties": {
                 "php": {
                     "type": "string",
@@ -70,6 +101,74 @@
                     "type": "string",
                     "enum": ["linux", "windows", "mac", "bsd", "other"],
                     "description": "Lowercased `PHP_OS_FAMILY`."
+                },
+                "sapi": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9_-]+$",
+                    "description": "`PHP_SAPI` (e.g. `fpm-fcgi`, `apache2handler`, `cgi-fcgi`, `litespeed`). Bounded set of runtime names, not host-identifying."
+                },
+                "memory_limit_mb": {
+                    "type": ["integer", "null"],
+                    "minimum": 0,
+                    "description": "`ini_get('memory_limit')` parsed to whole MiB (`512M` → `512`, `1G` → `1024`). `null` when unlimited (`-1`) or unparseable; null leaves are dropped from the wire body, so the Worker sees the key as absent."
+                },
+                "max_execution_time": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`(int) ini_get('max_execution_time')`. `0` means no limit."
+                },
+                "disable_functions_count": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Number of entries in `disable_functions`. The list itself is never sent (it fingerprints the hosting provider)."
+                },
+                "zts": {
+                    "type": "boolean",
+                    "description": "`PHP_ZTS === 1` (thread-safe build)."
+                },
+                "php_64bit": {
+                    "type": "boolean",
+                    "description": "`PHP_INT_SIZE === 8`."
+                },
+                "open_basedir_set": {
+                    "type": "boolean",
+                    "description": "`open_basedir` is non-empty. Boolean only; the value would leak the home directory path."
+                },
+                "allow_url_fopen": {
+                    "type": "boolean",
+                    "description": "`allow_url_fopen` is enabled."
+                },
+                "opcache_loaded": {
+                    "type": "boolean",
+                    "description": "`extension_loaded('Zend OPcache')`."
+                },
+                "suhosin_loaded": {
+                    "type": "boolean",
+                    "description": "`extension_loaded('suhosin')`."
+                },
+                "posix_available": {
+                    "type": "boolean",
+                    "description": "`function_exists('posix_geteuid')`."
+                },
+                "host_panel_cpanel": {
+                    "type": "boolean",
+                    "description": "`/usr/local/cpanel` exists. `false` when `open_basedir` hides it."
+                },
+                "host_panel_plesk": {
+                    "type": "boolean",
+                    "description": "`/usr/local/psa` exists. `false` when `open_basedir` hides it."
+                },
+                "host_panel_directadmin": {
+                    "type": "boolean",
+                    "description": "`/usr/local/directadmin` exists. `false` when `open_basedir` hides it."
+                },
+                "docroot_user_home": {
+                    "type": "boolean",
+                    "description": "`DOCUMENT_ROOT` matches the cPanel / DirectAdmin layout (`/home*/<user>/public_html` or `/home*/<user>/domains/<domain>/public_html`). Boolean only; the path contains the account username."
+                },
+                "sapi_per_user": {
+                    "type": "boolean",
+                    "description": "SAPI is `fpm-fcgi` / `cgi-fcgi` AND the effective uid owns the panel's files AND is a regular account (>= 1000, not `nobody`). Per-user FPM / suEXEC / mod_ruid2 fingerprint. `false` without POSIX."
                 }
             }
         },
@@ -84,7 +183,13 @@
                 "comms_active",
                 "comms_total",
                 "submissions_30d",
-                "protests_30d"
+                "protests_30d",
+                "bans_30d",
+                "admins_active_30d",
+                "ban_history_months",
+                "web_bans_majority_30d",
+                "games",
+                "perms"
             ],
             "properties": {
                 "admins": {
@@ -126,6 +231,79 @@
                     "type": "integer",
                     "minimum": 0,
                     "description": "`SELECT COUNT(*) FROM :prefix_protests WHERE datesubmitted >= UNIX_TIMESTAMP() - 2592000`."
+                },
+                "bans_30d": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`SELECT COUNT(*) FROM :prefix_bans WHERE created >= UNIX_TIMESTAMP() - 2592000`."
+                },
+                "admins_active_30d": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`SELECT COUNT(*) FROM :prefix_admins WHERE lastvisit >= UNIX_TIMESTAMP() - 2592000`."
+                },
+                "ban_history_months": {
+                    "type": ["integer", "null"],
+                    "minimum": 0,
+                    "description": "Whole calendar months since `MIN(:prefix_bans.created)` (rows with `created = 0` ignored). `null` when there are no bans; null leaves are dropped from the wire body, so the Worker sees the key as absent."
+                },
+                "web_bans_majority_30d": {
+                    "type": "boolean",
+                    "description": "True iff more than half of the bans created in the last 30 days have `sid = 0` (added from the web panel rather than a game server). `false` when there were none."
+                },
+                "games": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["tf", "cstrike", "csgo", "garrysmod", "left4dead2", "other"],
+                    "properties": {
+                        "tf": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'tf'`."
+                        },
+                        "cstrike": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'cstrike'`."
+                        },
+                        "csgo": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'csgo'`."
+                        },
+                        "garrysmod": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'garrysmod'`."
+                        },
+                        "left4dead2": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'left4dead2'`."
+                        },
+                        "other": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has any other `modfolder`. The folder name itself is never sent."
+                        }
+                    }
+                },
+                "perms": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["web_groups", "server_groups", "overrides", "immunity"],
+                    "properties": {
+                        "web_groups": {
+                            "type": "boolean",
+                            "description": "At least one web admin group (`:prefix_groups` with `type = 1`)."
+                        },
+                        "server_groups": {
+                            "type": "boolean",
+                            "description": "At least one server admin group (`:prefix_srvgroups`)."
+                        },
+                        "overrides": {
+                            "type": "boolean",
+                            "description": "At least one row in `:prefix_overrides`."
+                        },
+                        "immunity": {
+                            "type": "boolean",
+                            "description": "At least one admin with `immunity > 0`."
+                        }
+                    }
                 }
             }
         },
diff --git a/web/tests/integration/DevPrependTelemetryTest.php b/web/tests/integration/DevPrependTelemetryTest.php
new file mode 100644
index 000000000..4e8f6b323
--- /dev/null
+++ b/web/tests/integration/DevPrependTelemetryTest.php
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sbpp\Tests\Integration;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The docker dev stack must never ping the live telemetry endpoint.
+ *
+ * `docker/db-init/00-render-schema.sh` seeds the dev DB from
+ * `data.sql`, which ships `telemetry.enabled = 1` and the production
+ * cf-analytics endpoint. Every web request in the dev container runs
+ * `Telemetry::tickIfDue()` at shutdown, so local `./sbpp.sh up`, the
+ * E2E workflow, and the docs-screenshot capture in CI would each send
+ * a ping from a throwaway install. `docker/php/dev-prepend.php` (the
+ * dev container's `auto_prepend_file`) defines `SBPP_SKIP_TELEMETRY`
+ * for web SAPIs to stop that.
+ *
+ * Two contracts, both pure file / subprocess checks (no DB):
+ *
+ *   1. {@see testDevPrependDefinesSkipTelemetryForWebRequests} — the
+ *      prepend defines the constant behind a non-CLI gate, and the
+ *      dev Dockerfile still wires the prepend in.
+ *   2. {@see testDevPrependLeavesCliAlone} — under the CLI the
+ *      prepend must NOT define it, otherwise `./sbpp.sh test` (PHPUnit
+ *      inside the container, which also loads the prepend) would
+ *      short-circuit `TelemetryOptOutTest`'s direct `tickIfDue()` calls.
+ */
+final class DevPrependTelemetryTest extends TestCase
+{
+    private function prependPath(): string
+    {
+        return ROOT . '../docker/php/dev-prepend.php';
+    }
+
+    public function testDevPrependDefinesSkipTelemetryForWebRequests(): void
+    {
+        $prepend = $this->prependPath();
+        $this->assertFileExists($prepend);
+        $source = (string) file_get_contents($prepend);
+
+        $this->assertMatchesRegularExpression(
+            "/if\s*\(\s*PHP_SAPI\s*!==\s*'cli'\s*&&\s*!defined\('SBPP_SKIP_TELEMETRY'\)\s*\)\s*\{\s*"
+            . "define\('SBPP_SKIP_TELEMETRY',\s*true\);/",
+            $source,
+            'docker/php/dev-prepend.php must define SBPP_SKIP_TELEMETRY for web requests so the '
+            . 'dev / E2E / CI stack never pings the live telemetry endpoint.'
+        );
+
+        $dockerfile = (string) file_get_contents(ROOT . '../docker/Dockerfile');
+        $this->assertStringContainsString(
+            'auto_prepend_file=/usr/local/etc/php/dev-prepend.php',
+            $dockerfile,
+            'docker/Dockerfile must keep loading dev-prepend.php via auto_prepend_file.'
+        );
+    }
+
+    public function testDevPrependLeavesCliAlone(): void
+    {
+        $code = 'require ' . var_export($this->prependPath(), true) . ';'
+            . ' echo defined("SBPP_SKIP_TELEMETRY") ? "defined" : "undefined";';
+        $output = shell_exec(escapeshellarg(PHP_BINARY) . ' -n -r ' . escapeshellarg($code));
+
+        $this->assertSame(
+            'undefined',
+            $output,
+            'dev-prepend.php must not define SBPP_SKIP_TELEMETRY under the CLI; '
+            . 'TelemetryOptOutTest relies on tickIfDue() running inside the container.'
+        );
+    }
+}
diff --git a/web/tests/integration/TelemetryCollectTest.php b/web/tests/integration/TelemetryCollectTest.php
index d29c0563a..e1d6a3e92 100644
--- a/web/tests/integration/TelemetryCollectTest.php
+++ b/web/tests/integration/TelemetryCollectTest.php
@@ -66,6 +66,10 @@ public function testCollectShapeMatchesSchemaTreeAndCountsAreCorrect(): void
         $this->assertArrayHasKey('theme', $panel);
         $this->assertSame('default', $panel['theme'], 'shipped default theme is reported as "default", not "custom"');
         $this->assertIsBool($panel['dev']);
+        // sbpp/cf-analytics#6. Region depends on the runner's
+        // timezone, so pin the domain only.
+        $this->assertContains($panel['region'], ['af', 'as', 'eu', 'na', 'oc', 'sa', null]);
+        $this->assertFalse($panel['exported_30d'], 'no Data Export rows in the fixture log');
 
         $env = $payload['env'];
         $this->assertIsArray($env);
@@ -80,6 +84,25 @@ public function testCollectShapeMatchesSchemaTreeAndCountsAreCorrect(): void
             $env['os_family'],
             ['linux', 'windows', 'mac', 'bsd', 'other']
         );
+        // sbpp/cf-analytics#3 host fingerprint. Values depend on the
+        // runner's PHP build, so pin types (the analytics side bit-packs
+        // the booleans and treats the ints as doubles).
+        $this->assertSame(PHP_SAPI, $env['sapi']);
+        $this->assertTrue(
+            $env['memory_limit_mb'] === null || (is_int($env['memory_limit_mb']) && $env['memory_limit_mb'] >= 0),
+            'env.memory_limit_mb must be a non-negative int or null'
+        );
+        $this->assertIsInt($env['max_execution_time']);
+        $this->assertIsInt($env['disable_functions_count']);
+        foreach ([
+            'zts', 'php_64bit', 'open_basedir_set', 'allow_url_fopen',
+            'opcache_loaded', 'suhosin_loaded', 'posix_available',
+            'host_panel_cpanel', 'host_panel_plesk', 'host_panel_directadmin',
+            'docroot_user_home', 'sapi_per_user',
+        ] as $flag) {
+            $this->assertArrayHasKey($flag, $env, "env.$flag missing from payload");
+            $this->assertIsBool($env[$flag], "env.$flag must be a bool");
+        }
 
         $scale = $payload['scale'];
         $this->assertIsArray($scale);
@@ -91,6 +114,20 @@ public function testCollectShapeMatchesSchemaTreeAndCountsAreCorrect(): void
         $this->assertSame(2, $scale['comms_total']);
         $this->assertSame(2, $scale['submissions_30d'], 'recent submissions inside the 30-day window');
         $this->assertSame(1, $scale['protests_30d']);
+        $this->assertSame(4, $scale['bans_30d'], 'every seeded ban is inside the 30-day window');
+        $this->assertIsInt($scale['admins_active_30d']);
+        $this->assertSame(0, $scale['ban_history_months'], 'oldest seeded ban is ~2 days old');
+        $this->assertFalse($scale['web_bans_majority_30d'], 'every seeded ban came from sid 1');
+        $this->assertSame(
+            ['tf' => true, 'cstrike' => false, 'csgo' => false, 'garrysmod' => false, 'left4dead2' => false, 'other' => false],
+            $scale['games'],
+            'only TF2 (modid 12) servers are enabled'
+        );
+        $this->assertSame(
+            ['web_groups' => false, 'server_groups' => false, 'overrides' => false, 'immunity' => true],
+            $scale['perms'],
+            'fixture admin carries immunity 100; no groups or overrides seeded'
+        );
 
         $features = $payload['features'];
         $this->assertIsArray($features);
@@ -135,6 +172,114 @@ public function testCollectedPayloadContainsNoSeededPii(): void
         }
     }
 
+    /**
+     * sbpp/cf-analytics#6 slots against a panel shaped differently
+     * from the main universe: mixed games, mostly web bans, a long
+     * ban history, groups + overrides, and a recent export.
+     */
+    public function testScaleActivityGameMixPermissionShapeAndExport(): void
+    {
+        $pdo = Fixture::rawPdo();
+        $now = time();
+
+        $pdo->prepare(sprintf('UPDATE `%s_admins` SET `lastvisit` = ? WHERE `aid` = ?', DB_PREFIX))
+            ->execute([$now - 100, Fixture::adminAid()]);
+        $hash = password_hash('whatever', PASSWORD_BCRYPT);
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_admins` (`user`, `authid`, `password`, `gid`, `email`, `validate`, `extraflags`, `immunity`, `lastvisit`)
+             VALUES (?, ?, ?, -1, ?, NULL, 0, 0, ?)',
+            DB_PREFIX
+        ))->execute(['stale-admin', 'STEAM_0:1:444', $hash, 'stale@example.test', $now - 40 * 86400]);
+
+        // CS:GO (21) + HL2DM (1, folds into "other") enabled; L4D2 (16) disabled.
+        $stmt = $pdo->prepare(sprintf(
+            'INSERT INTO `%s_servers` (`ip`, `port`, `rcon`, `modid`, `enabled`) VALUES (?, ?, ?, ?, ?)',
+            DB_PREFIX
+        ));
+        $stmt->execute(['10.0.1.1', 27015, '', 21, 1]);
+        $stmt->execute(['10.0.1.2', 27015, '', 1, 1]);
+        $stmt->execute(['10.0.1.3', 27015, '', 16, 0]);
+
+        // Last 30 days: 3 web bans (sid 0) + 1 server ban. Plus one
+        // 400-day-old ban (13 calendar months whatever the date) and a
+        // `created = 0` legacy row that must not read as 1970.
+        $stmt = $pdo->prepare(sprintf(
+            'INSERT INTO `%s_bans` (`ip`, `authid`, `name`, `created`, `ends`, `length`, `reason`, `aid`, `adminIp`, `sid`, `type`)
+             VALUES (?, ?, ?, ?, 0, 0, ?, 1, ?, ?, 0)',
+            DB_PREFIX
+        ));
+        $stmt->execute(['', 'STEAM_0:1:1', 'a', $now - 100, 'r', '127.0.0.1', 0]);
+        $stmt->execute(['', 'STEAM_0:1:2', 'b', $now - 200, 'r', '127.0.0.1', 0]);
+        $stmt->execute(['', 'STEAM_0:1:3', 'c', $now - 300, 'r', '127.0.0.1', 0]);
+        $stmt->execute(['', 'STEAM_0:1:4', 'd', $now - 400, 'r', '127.0.0.1', 1]);
+        $stmt->execute(['', 'STEAM_0:1:5', 'e', $now - 400 * 86400, 'r', '127.0.0.1', 1]);
+        $stmt->execute(['', 'STEAM_0:1:6', 'f', 0, 'r', '127.0.0.1', 1]);
+
+        $pdo->prepare(sprintf('INSERT INTO `%s_groups` (`type`, `name`, `flags`) VALUES (1, ?, 0)', DB_PREFIX))
+            ->execute(['web-group']);
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_srvgroups` (`flags`, `immunity`, `name`, `groups_immune`) VALUES (?, 0, ?, ?)',
+            DB_PREFIX
+        ))->execute(['b', 'srv-group', ' ']);
+        $pdo->prepare(sprintf('INSERT INTO `%s_overrides` (`type`, `name`, `flags`) VALUES (?, ?, ?)', DB_PREFIX))
+            ->execute(['command', 'sm_ban', 'd']);
+
+        $this->insertLog('m', 'Data Export', $now - 1000);
+
+        $payload = Telemetry::collect();
+        $scale   = $payload['scale'];
+
+        $this->assertTrue($payload['panel']['exported_30d']);
+        $this->assertSame(4, $scale['bans_30d']);
+        $this->assertSame(1, $scale['admins_active_30d'], 'fixture admin active, stale admin 40 days out, CONSOLE never');
+        $this->assertSame(13, $scale['ban_history_months']);
+        $this->assertTrue($scale['web_bans_majority_30d'], '3 of 4 recent bans are web bans');
+        $this->assertSame(
+            ['tf' => false, 'cstrike' => false, 'csgo' => true, 'garrysmod' => false, 'left4dead2' => false, 'other' => true],
+            $scale['games']
+        );
+        $this->assertSame(
+            ['web_groups' => true, 'server_groups' => true, 'overrides' => true, 'immunity' => true],
+            $scale['perms']
+        );
+    }
+
+    public function testBanHistoryIsNullWithoutBans(): void
+    {
+        $payload = Telemetry::collect();
+        $this->assertNull($payload['scale']['ban_history_months']);
+        $this->assertFalse($payload['scale']['web_bans_majority_30d']);
+        $this->assertArrayNotHasKey(
+            'ban_history_months',
+            Telemetry::withoutNulls($payload)['scale'],
+            'a null leaf must be dropped from the wire body, not sent as null'
+        );
+    }
+
+    /**
+     * Only a successful export inside the window counts: failures log
+     * as `e`, and an export from 31 days ago is out of range.
+     */
+    public function testExportedFlagIgnoresFailuresAndOldExports(): void
+    {
+        $now = time();
+        $this->insertLog('e', 'Data Export', $now - 1000);
+        $this->insertLog('w', 'Data Export', $now - 1000);
+        $this->insertLog('m', 'Data Export', $now - 31 * 86400);
+        $this->insertLog('m', 'Group Created', $now - 1000);
+
+        $this->assertFalse(Telemetry::collect()['panel']['exported_30d']);
+    }
+
+    private function insertLog(string $type, string $title, int $created): void
+    {
+        Fixture::rawPdo()->prepare(sprintf(
+            'INSERT INTO `%s_log` (`type`, `title`, `message`, `function`, `query`, `aid`, `host`, `created`)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+            DB_PREFIX
+        ))->execute([$type, $title, 'test', 'test', '', 0, '', $created]);
+    }
+
     /**
      * Calling `collect()` twice in the same request must NOT mint a
      * new instance ID — the persisted value (or the freshly-minted +
diff --git a/web/tests/integration/TelemetrySchemaParityTest.php b/web/tests/integration/TelemetrySchemaParityTest.php
index c05fe3b32..dc1988f12 100644
--- a/web/tests/integration/TelemetrySchemaParityTest.php
+++ b/web/tests/integration/TelemetrySchemaParityTest.php
@@ -61,11 +61,27 @@ public function testCollectMatchesLockFileInBothDirections(): void
     public function testSchemaPayloadFieldNamesIsExpectedSet(): void
     {
         $expected = [
+            'env.allow_url_fopen',
             'env.db_engine',
             'env.db_version',
+            'env.disable_functions_count',
+            'env.docroot_user_home',
+            'env.host_panel_cpanel',
+            'env.host_panel_directadmin',
+            'env.host_panel_plesk',
+            'env.max_execution_time',
+            'env.memory_limit_mb',
+            'env.opcache_loaded',
+            'env.open_basedir_set',
             'env.os_family',
             'env.php',
+            'env.php_64bit',
+            'env.posix_available',
+            'env.sapi',
+            'env.sapi_per_user',
+            'env.suhosin_loaded',
             'env.web_server',
+            'env.zts',
             'features.adminrehashing',
             'features.comms',
             'features.exportpublic',
@@ -82,17 +98,33 @@ public function testSchemaPayloadFieldNamesIsExpectedSet(): void
             'features.submit',
             'instance_id',
             'panel.dev',
+            'panel.exported_30d',
             'panel.git',
+            'panel.region',
             'panel.theme',
             'panel.version',
             'scale.admins',
+            'scale.admins_active_30d',
+            'scale.ban_history_months',
+            'scale.bans_30d',
             'scale.bans_active',
             'scale.bans_total',
             'scale.comms_active',
             'scale.comms_total',
+            'scale.games.csgo',
+            'scale.games.cstrike',
+            'scale.games.garrysmod',
+            'scale.games.left4dead2',
+            'scale.games.other',
+            'scale.games.tf',
+            'scale.perms.immunity',
+            'scale.perms.overrides',
+            'scale.perms.server_groups',
+            'scale.perms.web_groups',
             'scale.protests_30d',
             'scale.servers_enabled',
             'scale.submissions_30d',
+            'scale.web_bans_majority_30d',
             'schema',
         ];
         $actual = Schema1::payloadFieldNames();
diff --git a/web/tests/unit/HostFingerprintTest.php b/web/tests/unit/HostFingerprintTest.php
new file mode 100644
index 000000000..80851be83
--- /dev/null
+++ b/web/tests/unit/HostFingerprintTest.php
@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sbpp\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Sbpp\Telemetry\HostFingerprint;
+use Sbpp\Telemetry\Telemetry;
+
+/**
+ * Pure-function coverage for the telemetry host fingerprint
+ * (sbpp/cf-analytics#3). The integration side (every key present,
+ * every value the right type) lives in `TelemetryCollectTest`; this
+ * pins the parsers whose output the analytics `host_kind` heuristic
+ * thresholds against.
+ */
+final class HostFingerprintTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{string, ?int}>
+     */
+    public static function memoryLimits(): iterable
+    {
+        yield 'megabytes'          => ['256M', 256];
+        yield 'lowercase suffix'   => ['128m', 128];
+        yield 'gigabytes'          => ['1G', 1024];
+        yield 'kilobytes'          => ['524288K', 512];
+        yield 'raw bytes'          => ['134217728', 128];
+        yield 'surrounding spaces' => [' 64M ', 64];
+        yield 'unlimited'          => ['-1', null];
+        yield 'empty'              => ['', null];
+        yield 'garbage'            => ['lots', null];
+    }
+
+    #[DataProvider('memoryLimits')]
+    public function testParseMemoryLimitMb(string $raw, ?int $expected): void
+    {
+        $this->assertSame($expected, HostFingerprint::parseMemoryLimitMb($raw));
+    }
+
+    public function testCountDisabledFunctionsIgnoresBlanksAndWhitespace(): void
+    {
+        $this->assertSame(0, HostFingerprint::countDisabledFunctions(''));
+        $this->assertSame(3, HostFingerprint::countDisabledFunctions('exec, passthru ,shell_exec,'));
+    }
+
+    /**
+     * @return iterable<string, array{string, bool}>
+     */
+    public static function docroots(): iterable
+    {
+        yield 'cpanel'                => ['/home/alice/public_html', true];
+        yield 'cpanel subdir'         => ['/home/alice/public_html/sourcebans', true];
+        yield 'cpanel multi-disk'     => ['/home3/alice/public_html', true];
+        yield 'directadmin'           => ['/home/alice/domains/example.com/public_html', true];
+        yield 'docker / vps'          => ['/var/www/html', false];
+        yield 'public_html lookalike' => ['/home/alice/public_html_old', false];
+        yield 'not under home'        => ['/srv/home/alice/public_html', false];
+        yield 'empty'                 => ['', false];
+    }
+
+    #[DataProvider('docroots')]
+    public function testIsUserHomeDocroot(string $docroot, bool $expected): void
+    {
+        $this->assertSame($expected, HostFingerprint::isUserHomeDocroot($docroot));
+    }
+
+    public function testCollectNeverLeaksRawDocroot(): void
+    {
+        $saved = $_SERVER['DOCUMENT_ROOT'] ?? null;
+        $_SERVER['DOCUMENT_ROOT'] = '/home/canary-user-7f3a/public_html';
+        try {
+            $env = HostFingerprint::collect();
+        } finally {
+            if ($saved === null) {
+                unset($_SERVER['DOCUMENT_ROOT']);
+            } else {
+                $_SERVER['DOCUMENT_ROOT'] = $saved;
+            }
+        }
+        $this->assertTrue($env['docroot_user_home']);
+        $this->assertStringNotContainsString('canary-user-7f3a', (string) json_encode($env));
+    }
+
+    public function testWithoutNullsDropsNullLeavesRecursively(): void
+    {
+        $this->assertSame(
+            ['schema' => 1, 'env' => ['php' => '8.5', 'zts' => false, 'max_execution_time' => 0]],
+            Telemetry::withoutNulls([
+                'schema' => 1,
+                'env'    => ['php' => '8.5', 'memory_limit_mb' => null, 'zts' => false, 'max_execution_time' => 0],
+            ])
+        );
+    }
+}
diff --git a/web/tests/unit/TelemetryRegionTest.php b/web/tests/unit/TelemetryRegionTest.php
new file mode 100644
index 000000000..cd67958ea
--- /dev/null
+++ b/web/tests/unit/TelemetryRegionTest.php
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sbpp\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Sbpp\Telemetry\Region;
+use Sbpp\Telemetry\Telemetry;
+
+/**
+ * Pure-function coverage for the sbpp/cf-analytics#6 telemetry
+ * slots: the `panel.region` timezone → continent table, and the
+ * `scale.games` / `scale.ban_history_months` helpers. The DB-backed
+ * side lives in `TelemetryCollectTest`.
+ */
+final class TelemetryRegionTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{string, ?string}>
+     */
+    public static function zones(): iterable
+    {
+        yield 'europe'               => ['Europe/Berlin', 'eu'];
+        yield 'asia'                 => ['Asia/Tokyo', 'as'];
+        yield 'africa'               => ['Africa/Lagos', 'af'];
+        yield 'australia'            => ['Australia/Sydney', 'oc'];
+        yield 'pacific'              => ['Pacific/Auckland', 'oc'];
+        yield 'north america'        => ['America/New_York', 'na'];
+        yield 'central america'      => ['America/Mexico_City', 'na'];
+        yield 'south america'        => ['America/Sao_Paulo', 'sa'];
+        yield 'argentina subzone'    => ['America/Argentina/Buenos_Aires', 'sa'];
+        yield 'atlantic europe'      => ['Atlantic/Canary', 'eu'];
+        yield 'atlantic africa'      => ['Atlantic/Cape_Verde', 'af'];
+        yield 'atlantic unmapped'    => ['Atlantic/South_Georgia', null];
+        yield 'indian africa'        => ['Indian/Mauritius', 'af'];
+        yield 'indian asia'          => ['Indian/Maldives', 'as'];
+        yield 'pacific south america' => ['Pacific/Galapagos', 'sa'];
+        yield 'antarctica'           => ['Antarctica/McMurdo', null];
+        yield 'etc'                  => ['Etc/GMT+5', null];
+        yield 'utc'                  => ['UTC', null];
+        yield 'numeric offset'       => ['-8', null];
+        yield 'iso offset'           => ['+01:00', null];
+        yield 'unknown zone'         => ['Europe/Atlantis', null];
+        yield 'empty'                => ['', null];
+    }
+
+    #[DataProvider('zones')]
+    public function testFromTimezone(string $zone, ?string $expected): void
+    {
+        $this->assertSame($expected, Region::fromTimezone($zone));
+    }
+
+    public function testResolvePrefersConfiguredZoneName(): void
+    {
+        $this->assertSame('as', Region::resolve('Asia/Seoul', 'Europe/Paris'));
+    }
+
+    public function testResolveFallsBackToPhpDefaultForLegacyOffsets(): void
+    {
+        // Pre-2.0 upgrades can leave a bare UTC offset in config.timezone.
+        $this->assertSame('eu', Region::resolve('1', 'Europe/Paris'));
+        $this->assertSame('eu', Region::resolve(null, 'Europe/Paris'));
+        $this->assertNull(Region::resolve('', 'UTC'));
+    }
+
+    /**
+     * @return iterable<string, array{list<string>, array<string, bool>}>
+     */
+    public static function modfolders(): iterable
+    {
+        $none = ['tf' => false, 'cstrike' => false, 'csgo' => false, 'garrysmod' => false, 'left4dead2' => false, 'other' => false];
+        yield 'no servers'     => [[], $none];
+        yield 'tracked only'   => [['tf', 'csgo'], array_merge($none, ['tf' => true, 'csgo' => true])];
+        yield 'untracked only' => [['dod'], array_merge($none, ['other' => true])];
+        yield 'case folded'    => [['GarrysMod'], array_merge($none, ['garrysmod' => true])];
+        yield 'l4d1 is other'  => [['left4dead'], array_merge($none, ['other' => true])];
+        yield 'literal other'  => [['other'], array_merge($none, ['other' => true])];
+    }
+
+    /**
+     * @param list<string> $folders
+     * @param array<string, bool> $expected
+     */
+    #[DataProvider('modfolders')]
+    public function testGamesFromModfolders(array $folders, array $expected): void
+    {
+        $this->assertSame($expected, Telemetry::gamesFromModfolders($folders));
+    }
+
+    public function testMonthsBetweenCountsWholeCalendarMonths(): void
+    {
+        $at = static fn (string $date): int => (new \DateTimeImmutable($date, new \DateTimeZone('UTC')))->getTimestamp();
+
+        $this->assertSame(0, Telemetry::monthsBetween($at('2026-01-31'), $at('2026-02-28')));
+        $this->assertSame(1, Telemetry::monthsBetween($at('2026-01-15'), $at('2026-02-15')));
+        $this->assertSame(74, Telemetry::monthsBetween($at('2020-08-01'), $at('2026-10-25')));
+        $this->assertSame(0, Telemetry::monthsBetween($at('2026-10-25'), $at('2020-01-01')), 'future oldest ban clamps to 0');
+    }
+}
diff --git a/web/themes/default/page_admin_settings_features.tpl b/web/themes/default/page_admin_settings_features.tpl
index ba9ee00f0..a5af689ba 100644
--- a/web/themes/default/page_admin_settings_features.tpl
+++ b/web/themes/default/page_admin_settings_features.tpl
@@ -201,7 +201,7 @@
                                     <span class="text-sm font-medium">Anonymous telemetry</span>
                                 </label>
                                 <p class="settings-fieldset__help" id="telemetry_enabled_help" data-testid="setting-help-telemetry.enabled">
-                                    Sends one anonymous ping per day with panel version, PHP / DB / OS family, counts (admins, servers, bans, comms, 30-day submissions / protests), and which features are turned on. <strong>No</strong> hostnames, IPs, admin names, SteamIDs, or ban reasons are sent. A random install ID is included so pings can be deduplicated.
+                                    Sends one anonymous ping per day with panel version, PHP / DB / OS family, the continent of your timezone, counts (admins, servers, bans, comms, 30-day activity), which games your servers run, and which features are turned on. <strong>No</strong> hostnames, IPs, admin names, SteamIDs, or ban reasons are sent. A random install ID is included so pings can be deduplicated.
                                     <a href="https://sbpp.github.io/updating/1-8-to-2-0/#anonymous-telemetry" target="_blank" rel="noopener noreferrer">See the full payload</a>.
                                     Disabling clears the random ID; turning it back on issues a fresh one.
                                 </p>