From 2df0fea26f7b77a946ddafee575ffe50f82760f5 Mon Sep 17 00:00:00 2001
From: rumblefrog <contact@zhenyangli.me>
Date: Sun, 25 Oct 2026 12:35:55 -0400
Subject: [PATCH 1/4] Skip telemetry pings from the docker dev / CI stack
 (#1604)

The dev stack seeds its DB from data.sql, which ships
telemetry.enabled = 1 and the live cf-analytics endpoint. Every web
request in the dev container runs Telemetry::tickIfDue() at shutdown,
so local `./sbpp.sh up`, the E2E workflow and the CI docs-screenshot
capture each sent a ping from a throwaway install with a fresh
instance_id, polluting the production dataset.

dev-prepend.php (the dev container's auto_prepend_file) now defines
SBPP_SKIP_TELEMETRY for web SAPIs, the same per-request opt-out
/health.php already uses. The CLI is left alone so PHPUnit inside the
container keeps exercising tickIfDue() in TelemetryOptOutTest.

Claude-Session: https://claude.ai/code/session_019E8y1xAnzfbNHQhAkgFyMm

Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit 4d09e4d5822d19ba047ee166734952f84de6fc80)
---
 ARCHITECTURE.md                               |  6 +-
 docker/README.md                              |  2 +-
 docker/php/dev-prepend.php                    | 19 +++++
 web/includes/Telemetry/Telemetry.php          |  5 ++
 .../integration/DevPrependTelemetryTest.php   | 73 +++++++++++++++++++
 5 files changed, 103 insertions(+), 2 deletions(-)
 create mode 100644 web/tests/integration/DevPrependTelemetryTest.php

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index c0416e61c..a7b5fb9e3 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -798,7 +798,11 @@ The tick is the issue #1126 contract:
    calls without flipping the user-facing toggle.
 
 The whole `tickIfDue` body is wrapped in `try { … } catch (\Throwable)`
-so telemetry can NEVER hard-fail the request. Pings are never
+so telemetry can NEVER hard-fail the request. Defining
+`SBPP_SKIP_TELEMETRY` before `init.php` skips the tick for that
+request: `/health.php` does this, and so does the docker dev stack's
+`docker/php/dev-prepend.php` for every web request, which keeps local
+dev, E2E, and CI screenshot runs out of the production dataset. Pings are never
 audit-logged either — a flapping endpoint would otherwise generate
 `sb_log` noise that scares admins. Only the enable/disable
 **transitions** are audit-logged (in
diff --git a/docker/README.md b/docker/README.md
index 6ecbbcf19..e2c351eb5 100644
--- a/docker/README.md
+++ b/docker/README.md
@@ -58,7 +58,7 @@ Dockerfile               php:8.5-apache + pdo_mysql, intl, zip, mbstring, opcach
 docker-compose.yml       web, db, adminer, mailpit
 docker/php/
     web-entrypoint.sh    waits for DB, renders config.php, runs composer install, fixes cache perms
-    dev-prepend.php      normalizes HTTP_HOST so init.php's localhost guard accepts :8080
+    dev-prepend.php      dev-only constants: install-guard bypass + telemetry opt-out (web requests)
 docker/db-init/
     00-render-schema.sh  on first DB init: substitutes {prefix}/{charset}, loads struc/data, seeds admin
 sbpp.sh                  thin wrapper around `docker compose` + common dev tasks
diff --git a/docker/php/dev-prepend.php b/docker/php/dev-prepend.php
index 0d1bffb6f..4e83526c6 100644
--- a/docker/php/dev-prepend.php
+++ b/docker/php/dev-prepend.php
@@ -28,3 +28,22 @@
 if (!defined('SBPP_DEV_KEEP_INSTALL')) {
     define('SBPP_DEV_KEEP_INSTALL', true);
 }
+
+// Keep dev / CI / test traffic out of the production telemetry
+// dataset (#1126). The dev stack seeds the DB from `data.sql`, which
+// ships `telemetry.enabled = 1` + the live cf-analytics endpoint, so
+// without this every `./sbpp.sh up`, every E2E run, and every docs
+// screenshot capture in CI would ping the real Worker from a
+// throwaway install with a fresh `instance_id`. `SBPP_SKIP_TELEMETRY`
+// is the same per-request opt-out `/health.php` uses; it makes
+// `Telemetry::tickIfDue()` return before any DB write or network call.
+//
+// Web SAPIs only: the CLI also loads this file (PHPUnit inside the
+// container via `./sbpp.sh test`), and `TelemetryOptOutTest` drives
+// `tickIfDue()` directly against a dead endpoint to pin the gate.
+// Defining the constant there would short-circuit those tests. The
+// PHPUnit bootstrap never requires `init.php`, so no shutdown tick is
+// registered under the CLI anyway.
+if (PHP_SAPI !== 'cli' && !defined('SBPP_SKIP_TELEMETRY')) {
+    define('SBPP_SKIP_TELEMETRY', true);
+}
diff --git a/web/includes/Telemetry/Telemetry.php b/web/includes/Telemetry/Telemetry.php
index 75f878ee9..03cf8a83f 100644
--- a/web/includes/Telemetry/Telemetry.php
+++ b/web/includes/Telemetry/Telemetry.php
@@ -96,6 +96,11 @@ final class Telemetry
      * cURL POST on every probe, but the per-tick slot-reservation
      * `UPDATE` on `:prefix_settings.last_ping` is still pure noise
      * we'd rather not pay on a 2880-probe-per-day endpoint.
+     *
+     * The docker dev stack (`docker/php/dev-prepend.php`) defines
+     * the same constant on every web request, so local dev, E2E,
+     * and the CI docs-screenshot capture never ping the live
+     * endpoint.
      */
     public static function tickIfDue(): void
     {
diff --git a/web/tests/integration/DevPrependTelemetryTest.php b/web/tests/integration/DevPrependTelemetryTest.php
new file mode 100644
index 000000000..4e8f6b323
--- /dev/null
+++ b/web/tests/integration/DevPrependTelemetryTest.php
@@ -0,0 +1,73 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sbpp\Tests\Integration;
+
+use PHPUnit\Framework\TestCase;
+
+/**
+ * The docker dev stack must never ping the live telemetry endpoint.
+ *
+ * `docker/db-init/00-render-schema.sh` seeds the dev DB from
+ * `data.sql`, which ships `telemetry.enabled = 1` and the production
+ * cf-analytics endpoint. Every web request in the dev container runs
+ * `Telemetry::tickIfDue()` at shutdown, so local `./sbpp.sh up`, the
+ * E2E workflow, and the docs-screenshot capture in CI would each send
+ * a ping from a throwaway install. `docker/php/dev-prepend.php` (the
+ * dev container's `auto_prepend_file`) defines `SBPP_SKIP_TELEMETRY`
+ * for web SAPIs to stop that.
+ *
+ * Two contracts, both pure file / subprocess checks (no DB):
+ *
+ *   1. {@see testDevPrependDefinesSkipTelemetryForWebRequests} — the
+ *      prepend defines the constant behind a non-CLI gate, and the
+ *      dev Dockerfile still wires the prepend in.
+ *   2. {@see testDevPrependLeavesCliAlone} — under the CLI the
+ *      prepend must NOT define it, otherwise `./sbpp.sh test` (PHPUnit
+ *      inside the container, which also loads the prepend) would
+ *      short-circuit `TelemetryOptOutTest`'s direct `tickIfDue()` calls.
+ */
+final class DevPrependTelemetryTest extends TestCase
+{
+    private function prependPath(): string
+    {
+        return ROOT . '../docker/php/dev-prepend.php';
+    }
+
+    public function testDevPrependDefinesSkipTelemetryForWebRequests(): void
+    {
+        $prepend = $this->prependPath();
+        $this->assertFileExists($prepend);
+        $source = (string) file_get_contents($prepend);
+
+        $this->assertMatchesRegularExpression(
+            "/if\s*\(\s*PHP_SAPI\s*!==\s*'cli'\s*&&\s*!defined\('SBPP_SKIP_TELEMETRY'\)\s*\)\s*\{\s*"
+            . "define\('SBPP_SKIP_TELEMETRY',\s*true\);/",
+            $source,
+            'docker/php/dev-prepend.php must define SBPP_SKIP_TELEMETRY for web requests so the '
+            . 'dev / E2E / CI stack never pings the live telemetry endpoint.'
+        );
+
+        $dockerfile = (string) file_get_contents(ROOT . '../docker/Dockerfile');
+        $this->assertStringContainsString(
+            'auto_prepend_file=/usr/local/etc/php/dev-prepend.php',
+            $dockerfile,
+            'docker/Dockerfile must keep loading dev-prepend.php via auto_prepend_file.'
+        );
+    }
+
+    public function testDevPrependLeavesCliAlone(): void
+    {
+        $code = 'require ' . var_export($this->prependPath(), true) . ';'
+            . ' echo defined("SBPP_SKIP_TELEMETRY") ? "defined" : "undefined";';
+        $output = shell_exec(escapeshellarg(PHP_BINARY) . ' -n -r ' . escapeshellarg($code));
+
+        $this->assertSame(
+            'undefined',
+            $output,
+            'dev-prepend.php must not define SBPP_SKIP_TELEMETRY under the CLI; '
+            . 'TelemetryOptOutTest relies on tickIfDue() running inside the container.'
+        );
+    }
+}

From 4cd876018b728a8dbc47cf15242afcd17a793a69 Mon Sep 17 00:00:00 2001
From: rumblefrog <contact@zhenyangli.me>
Date: Sun, 25 Oct 2026 12:53:57 -0400
Subject: [PATCH 2/4] fix(telemetry): send the shared-hosting env signals the
 Worker expects (#1606)

sbpp/cf-analytics#4 extended schema-1 with env.sapi, three env doubles
(memory_limit_mb, max_execution_time, disable_functions_count) and
twelve env bits, and called for a paired panel change. That change
never landed, so every ping arrived without them and the Analytics
Engine rows carried null / 0 in those slots for every install.

Add Sbpp\Telemetry\HostFingerprint, which computes the 16 fields per
cf-analytics#3 (each probe Throwable-guarded; open_basedir value,
DOCUMENT_ROOT and the disable_functions list reduced to a boolean or
count), and merge it into Telemetry::collectEnv(). Extend the vendored
JSON Schema and the parity test to match.

memory_limit_mb is null on unlimited hosts. The Worker's zod schema
rejects an explicit null (whole ping 400s), so send() now drops null
leaves and the Worker sees the key as absent, which it maps to a null
double as intended.

Claude-Session: https://claude.ai/code/session_01Bwe7AmJS69ccciKdc2PPQi

Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit b67c6cdfc495ffbfdddcb9afad314c75cfed7856)
---
 AGENTS.md                                     |   2 +-
 ARCHITECTURE.md                               |  11 +-
 docs/src/content/docs/updating/1-8-to-2-0.mdx |  10 +-
 web/includes/Telemetry/HostFingerprint.php    | 182 ++++++++++++++++++
 web/includes/Telemetry/Telemetry.php          |  26 ++-
 web/includes/Telemetry/schema-1.lock.json     |  92 ++++++++-
 .../integration/TelemetryCollectTest.php      |  19 ++
 .../integration/TelemetrySchemaParityTest.php |  16 ++
 web/tests/unit/HostFingerprintTest.php        |  97 ++++++++++
 9 files changed, 449 insertions(+), 6 deletions(-)
 create mode 100644 web/includes/Telemetry/HostFingerprint.php
 create mode 100644 web/tests/unit/HostFingerprintTest.php

diff --git a/AGENTS.md b/AGENTS.md
index 0fde01985..59d524d1d 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4993,7 +4993,7 @@ the spec, target a 1920px viewport, not 1440px.
 | Render admin-authored Markdown to safe HTML | `web/includes/Markup/IntroRenderer.php` (`Sbpp\Markup`) |
 | Add a "Generate password" button to a password field (or change how passwords are generated) | Put `data-password-generator` + `data-password-targets="<id>[,<confirm-id>]"` on a `<button type="button" class="btn btn--ghost btn--icon">`; the shared dialog in `web/scripts/password-generator.js` (loaded from `core/footer.tpl`) does the rest: calls `Actions.AdminsGeneratePassword`, lets the admin tweak length + character sets, fills every non-disabled target on "Use password" and fires bubbling `input` / `change` events. Never write a page-local generator handler. Generation is server-side in `Sbpp\Security\PasswordGenerator` (`web/includes/Security/PasswordGenerator.php`, `random_int` + one-char-per-enabled-set guarantee + Fisher-Yates shuffle); the JSON action merges per-request options over the owner defaults (`config.password.generator.{length,lowercase,uppercase,digits,symbols,exclude_ambiguous}`, edited in Settings > Main, seeded by `data.sql` + `web/updater/data/813.php`) and clamps length to `[max(8, config.password.minlength), 128]`. The REST `POST /admins` fallback password uses the same class. `SYMBOLS` deliberately excludes quotes / backslash / `;` / space / backtick because values land in `server.cfg` and SourceMod configs. `admins.generate_password` stays `requireAdmin`, so surfaces reachable by non-web-admins gate the button (Your account uses `YourAccountView::$can_generate_password` = `is_admin()`). Regression guards: `web/tests/unit/PasswordGeneratorTest.php` (contract + data.sql / 813.php key and default parity), `AdminsTest::testGeneratePassword*`, `web/tests/e2e/specs/flows/password-generator.spec.ts`. |
 | Write or edit a user-facing string (panel UI text, toast body, docs page) | See "User-facing text style (panel UI + docs)" under Conventions. Three rules: no emdash (`—`), terse, don't over-explain. Applies to `web/themes/default/**/*.tpl`, `\Sbpp\View\Toast::emit` titles + bodies, `echo` output from page handlers, and every `docs/src/content/docs/**/*.{md,mdx}` page. Does NOT apply to `AGENTS.md` / `ARCHITECTURE.md` / contributor docs / code comments / audit-log entries / test fixtures. Anti-pattern entries paired under "Anti-patterns". |
-| Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1-8-to-2-0.mdx` (no first-login modal). |
+| Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/HostFingerprint.php` (`Sbpp\Telemetry\HostFingerprint::collect()`, the shared-hosting `env.*` signals from sbpp/cf-analytics#3; every probe is `Throwable`-guarded and raw paths / lists are reduced to booleans or counts) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1-8-to-2-0.mdx` (no first-login modal). |
 | Add or edit a project announcement (the admin-only banner on the home dashboard) | Edit `docs/public/announcements.json` (the source of truth — Astro publishes it as a static asset at `https://sbpp.github.io/announcements.json`). Each entry: `id` (≤64 chars, **required**), `title` (**required**), `body_md` (CommonMark, optional — rendered through `Sbpp\Markup\IntroRenderer` so raw HTML is escaped + `javascript:` / `data:` URLs are stripped), `url` (optional `http(s)://` only — non-http schemes rejected at the parser), `published_at` (optional ISO-8601 or unix int — drives the sort order; entries without it sort below dated entries), `expires_at` (optional — the parser drops entries past this timestamp). Sorted newest-first by the panel; convention is to also place the newest entry at the top of the array so reviewers see the most relevant change first. The deploy chain is automatic: a push to `main` that touches `docs/` fires `.github/workflows/docs-deploy-trigger.yml` which lands the file at `https://sbpp.github.io/announcements.json` within minutes. The starter file ships as `[]` (empty array). NEVER write to the cache file (`SB_CACHE/announcements.json`) directly — the panel's shutdown hook owns that path. |
 | Add or edit a project sponsor, funding platform, or sponsor tier | Edit `docs/src/data/sponsors.json` (the single source of truth). Three top-level keys: `platforms` (`{id, name, url, description?, icon?}` — the funding channels; GitHub Sponsors today, append Open Collective / Patreon / etc. as they're approved), `tiers` (`{id, name, monthlyMinUsd?, description?}` — ordered list driving the sponsor-roll display order), `sponsors` (`{name, url?, logo?, tier?, since?}` — `tier` matches a `tiers[].id`; missing/empty/unknown places the sponsor in the "Individual supporters" bucket). The component `docs/src/components/Sponsors.astro` renders the file on the canonical `/sponsor/` landing page (`docs/src/content/docs/sponsor.mdx`, `template: splash`, intentionally absent from the sidebar in `astro.config.mjs`); the topbar heart icon, the per-page footer link in `docs/src/components/Footer.astro`, and `.github/FUNDING.yml`'s `custom:` URL all route there. Adding a new platform / sponsor is a one-line append here — no component, config, or template edit needed. Companion issue #1417 will surface the same data on the panel footer; a future README-injector script will read the same file into the main `README.md`'s `<!-- sponsors:start --> ... <!-- sponsors:end -->` markers. The starter file ships with one `platforms` entry (GitHub Sponsors) and empty `tiers` + `sponsors` arrays. Issue #1416. |
 | Embed the sponsor roll on a docs page other than `/sponsor/` (e.g. a future docs index hero) | Import `docs/src/components/Sponsors.astro` and render `<Sponsors showPlatforms={false} />` — the component reads `docs/src/data/sponsors.json` and renders just the tier-grouped roll (with the "Individual supporters" bucket) when `showPlatforms` is false. `showEmptyHint={false}` additionally suppresses the "be the first" line when the roll is empty. The component renders its own `<h2>` headings; the embedding page should not add a parallel `## Our sponsors` heading or the chrome doubles. Issue #1416. |
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index a7b5fb9e3..ffe844447 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -106,7 +106,7 @@ web/
 │   ├── Servers/              Sbpp\Servers\{SourceQueryCache, RconStatusCache} — per-(ip, port) cache around the xPaw A2S probe (#1311) + per-sid cache around the RCON `status` command (#PLAYER_CTX_MENU)
 │   ├── Upload/               Sbpp\Upload\UploadHandler — shared file-upload handler (perm + CSRF + extension allowlist + filename sanitiser + popup chrome) for the demo / icon / mapimage popup pages
 │   ├── Mail/                 Sbpp\Mail\{Mail,Mailer,EmailType} — Symfony Mailer wrapper + enum
-│   ├── Telemetry/            Sbpp\Telemetry\{Telemetry,Schema1} — anonymous opt-out daily ping (#1126); schema-1.lock.json is the vendored cross-repo contract
+│   ├── Telemetry/            Sbpp\Telemetry\{Telemetry,Schema1,HostFingerprint} — anonymous opt-out daily ping (#1126); schema-1.lock.json is the vendored cross-repo contract
 │   ├── Announce/             Sbpp\Announce\{AnnouncementFetcher,Announcement} — anonymous opt-out daily fetch of project news / security advisories from https://sbpp.github.io/announcements.json (source of truth: docs/public/announcements.json); admin-only banner on the home dashboard
 │   ├── Export/               Sbpp\Export\{ManifestBuilder,EntityExporter,BundleWriter,S3PresignedUploader,ExportError,Manifest} — owner-only full data export feature; streamed one-shot ZIP bundle of every row + every uploaded demo; entry point web/export.php (binary wire format, sits at panel-root next to exportbans.php / getdemo.php)
 │   ├── SteamID/              SteamID parsing / vanity-URL resolution
@@ -809,6 +809,15 @@ audit-logged either — a flapping endpoint would otherwise generate
 `web/pages/admin.settings.php`'s features POST handler).
 
 `Telemetry::collect()` is the side-effect-free payload builder. The
+shared-hosting signals in the `env` block (SAPI, ini limits,
+`open_basedir`, control-panel dirs, per-user FPM; sbpp/cf-analytics#3)
+come from `Sbpp\Telemetry\HostFingerprint`, which runs every probe
+behind a `Throwable` guard so a host that disables `ini_get` /
+`posix_*` degrades one field instead of losing the ping. Nullable
+fields stay as explicit `null` in `collect()` (stable key set for the
+parity test) and `send()` drops them via `Telemetry::withoutNulls()`,
+because the Worker's validator accepts an absent key but rejects a
+literal `null`. The
 exact wire format is captured in
 `web/includes/Telemetry/schema-1.lock.json` — a Draft-7 JSON Schema
 vendored byte-for-byte from the [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics)
diff --git a/docs/src/content/docs/updating/1-8-to-2-0.mdx b/docs/src/content/docs/updating/1-8-to-2-0.mdx
index b85654c53..7bbbac6f8 100644
--- a/docs/src/content/docs/updating/1-8-to-2-0.mdx
+++ b/docs/src/content/docs/updating/1-8-to-2-0.mdx
@@ -125,7 +125,15 @@ categories:
   `default` or `custom` is reported; fork theme **names are never
   sent**).
 - **env**: PHP `major.minor`, DB engine + `major.minor`, web server
-  family, OS family.
+  family, OS family, plus a hosting fingerprint: PHP SAPI name,
+  `memory_limit` / `max_execution_time`, how many functions
+  `disable_functions` lists, and yes/no flags for thread safety,
+  64-bit PHP, `open_basedir` set, `allow_url_fopen`, OPcache,
+  Suhosin, POSIX, a cPanel / Plesk / DirectAdmin install, a
+  `/home/<user>/public_html`-style document root, and PHP running as
+  the account that owns the panel files. The `open_basedir` value,
+  document root path, and the `disable_functions` list itself are
+  **never sent**, only the yes/no or the count.
 - **scale**: counts of admins, enabled servers, active and total
   bans / comm blocks, 30-day submission / protest counts.
 - **features**: every checkbox under
diff --git a/web/includes/Telemetry/HostFingerprint.php b/web/includes/Telemetry/HostFingerprint.php
new file mode 100644
index 000000000..c6b87688a
--- /dev/null
+++ b/web/includes/Telemetry/HostFingerprint.php
@@ -0,0 +1,182 @@
+<?php
+declare(strict_types=1);
+
+namespace Sbpp\Telemetry;
+
+use Throwable;
+
+/**
+ * Shared-hosting fingerprint signals for the telemetry `env` block
+ * (sbpp/cf-analytics#3).
+ *
+ * There's no single reliable "this is a shared host" indicator, so
+ * the panel ships the raw inputs (SAPI, ini limits, open_basedir,
+ * control-panel dirs, per-user FPM) and the shared / constrained /
+ * unconstrained label is derived query-time on the analytics side.
+ * Keeping the heuristic in SQL means retuning it never needs a panel
+ * release.
+ *
+ * Privacy posture matches the rest of the payload: anything whose
+ * raw value identifies the host or account (the `open_basedir`
+ * value, `DOCUMENT_ROOT`, the `disable_functions` list) is reduced
+ * to a boolean or a count before it leaves this class.
+ *
+ * Every probe runs through `probe()` so a host that disables
+ * `ini_get` / `posix_*` / `fileowner`, or an `open_basedir` that
+ * rejects the `/usr/local/*` checks, degrades that one field to its
+ * fallback instead of throwing and losing the whole ping.
+ */
+final class HostFingerprint
+{
+    /**
+     * UIDs at or above this are treated as regular accounts for
+     * `sapi_per_user`. Distro service accounts (root, www-data,
+     * apache, FreeBSD www, nginx, …) all sit below it.
+     */
+    private const MIN_ACCOUNT_UID = 1000;
+
+    /** `nobody` / `nfsnobody` — above the threshold but never an account. */
+    private const NOBODY_UID = 65534;
+
+    private function __construct()
+    {
+    }
+
+    /**
+     * @return array<string, string|int|bool|null>
+     */
+    public static function collect(): array
+    {
+        $sapi = PHP_SAPI;
+        return [
+            'sapi'                    => $sapi,
+            'memory_limit_mb'         => self::probe(
+                static fn (): ?int => self::parseMemoryLimitMb(self::ini('memory_limit')),
+                null
+            ),
+            'max_execution_time'      => self::probe(
+                static fn (): int => max(0, (int) self::ini('max_execution_time')),
+                0
+            ),
+            'disable_functions_count' => self::probe(
+                static fn (): int => self::countDisabledFunctions(self::ini('disable_functions')),
+                0
+            ),
+            'zts'                     => PHP_ZTS === 1,
+            'php_64bit'               => PHP_INT_SIZE === 8,
+            'open_basedir_set'        => self::probe(static fn (): bool => self::ini('open_basedir') !== '', false),
+            'allow_url_fopen'         => self::probe(static fn (): bool => self::iniBool(self::ini('allow_url_fopen')), false),
+            'opcache_loaded'          => extension_loaded('Zend OPcache'),
+            'suhosin_loaded'          => extension_loaded('suhosin'),
+            'posix_available'         => function_exists('posix_geteuid'),
+            'host_panel_cpanel'       => self::dirExists('/usr/local/cpanel'),
+            'host_panel_plesk'        => self::dirExists('/usr/local/psa'),
+            'host_panel_directadmin'  => self::dirExists('/usr/local/directadmin'),
+            'docroot_user_home'       => self::isUserHomeDocroot((string) ($_SERVER['DOCUMENT_ROOT'] ?? '')),
+            'sapi_per_user'           => self::probe(static fn (): bool => self::isPerUserSapi($sapi), false),
+        ];
+    }
+
+    /**
+     * `memory_limit` shorthand → whole MiB. `-1` (unlimited) and
+     * unparseable values map to `null` so they land as an absent
+     * double rather than a fake small limit.
+     */
+    public static function parseMemoryLimitMb(string $raw): ?int
+    {
+        if (preg_match('/^\s*(-?\d+)\s*([kmg]?)\s*$/i', $raw, $m) !== 1) {
+            return null;
+        }
+        $n = (int) $m[1];
+        if ($n < 0) {
+            return null;
+        }
+        $bytes = match (strtolower($m[2])) {
+            'g'     => $n * 1024 * 1024 * 1024,
+            'm'     => $n * 1024 * 1024,
+            'k'     => $n * 1024,
+            default => $n,
+        };
+        return intdiv($bytes, 1024 * 1024);
+    }
+
+    public static function countDisabledFunctions(string $raw): int
+    {
+        return count(array_filter(
+            array_map('trim', explode(',', $raw)),
+            static fn (string $fn): bool => $fn !== ''
+        ));
+    }
+
+    /**
+     * cPanel (`/home/<user>/public_html`) and DirectAdmin
+     * (`/home/<user>/domains/<domain>/public_html`) docroots.
+     * `/home2`, `/home3`, … cover cPanel's multi-disk layout.
+     */
+    public static function isUserHomeDocroot(string $docroot): bool
+    {
+        return preg_match('~^/home\d*/[^/]+/(public_html|domains/.+/public_html)(/|$)~', $docroot) === 1;
+    }
+
+    /**
+     * Per-user FPM / suEXEC / mod_ruid2: the process runs as the
+     * account that owns the panel's files instead of a shared
+     * service user. Without POSIX we can't tell, so report `false`
+     * rather than guess.
+     */
+    private static function isPerUserSapi(string $sapi): bool
+    {
+        if ($sapi !== 'fpm-fcgi' && $sapi !== 'cgi-fcgi') {
+            return false;
+        }
+        if (!function_exists('posix_geteuid')) {
+            return false;
+        }
+        $euid  = posix_geteuid();
+        $owner = @fileowner(__FILE__);
+        return $owner !== false
+            && $euid === $owner
+            && $euid >= self::MIN_ACCOUNT_UID
+            && $euid !== self::NOBODY_UID;
+    }
+
+    private static function dirExists(string $path): bool
+    {
+        // `@` because an `open_basedir` that excludes /usr/local
+        // warns on every is_dir() call outside it.
+        return self::probe(static fn (): bool => @is_dir($path), false);
+    }
+
+    /**
+     * `ini_get` can itself be in `disable_functions`; treat that the
+     * same as an unset directive.
+     */
+    private static function ini(string $key): string
+    {
+        if (!function_exists('ini_get')) {
+            return '';
+        }
+        $value = ini_get($key);
+        return $value === false ? '' : $value;
+    }
+
+    private static function iniBool(string $raw): bool
+    {
+        return filter_var($raw, FILTER_VALIDATE_BOOLEAN);
+    }
+
+    /**
+     * @template T
+     * @param callable(): T $fn
+     * @param T $fallback
+     * @return T
+     */
+    private static function probe(callable $fn, mixed $fallback): mixed
+    {
+        try {
+            return $fn();
+        } catch (Throwable) {
+            return $fallback;
+        }
+    }
+}
diff --git a/web/includes/Telemetry/Telemetry.php b/web/includes/Telemetry/Telemetry.php
index 03cf8a83f..ed88e2144 100644
--- a/web/includes/Telemetry/Telemetry.php
+++ b/web/includes/Telemetry/Telemetry.php
@@ -146,7 +146,7 @@ public static function send(array $payload, string $endpoint, string $userAgent)
         if ($endpoint === '') {
             return;
         }
-        $body = json_encode($payload, JSON_UNESCAPED_SLASHES);
+        $body = json_encode(self::withoutNulls($payload), JSON_UNESCAPED_SLASHES);
         if ($body === false) {
             return;
         }
@@ -180,6 +180,28 @@ public static function send(array $payload, string $endpoint, string $userAgent)
         unset($ch);
     }
 
+    /**
+     * Drop `null` leaves before encoding. `collect()` keeps nullable
+     * fields (e.g. `env.memory_limit_mb` on an unlimited host) as
+     * explicit `null` so the extractor parity test sees a stable
+     * key set, but the Worker's validator only accepts an absent
+     * key there; a literal `null` would 400 the whole ping.
+     *
+     * @param array<string, mixed> $node
+     * @return array<string, mixed>
+     */
+    public static function withoutNulls(array $node): array
+    {
+        $out = [];
+        foreach ($node as $key => $value) {
+            if ($value === null) {
+                continue;
+            }
+            $out[$key] = is_array($value) ? self::withoutNulls($value) : $value;
+        }
+        return $out;
+    }
+
     /**
      * The actual tick body: opt-out gate → cooldown check →
      * atomic reservation → flush response → POST.
@@ -433,7 +455,7 @@ private static function collectEnv(): array
             'db_version' => self::resolveDbVersion(),
             'web_server' => self::resolveWebServer((string) ($_SERVER['SERVER_SOFTWARE'] ?? '')),
             'os_family'  => self::resolveOsFamily(),
-        ];
+        ] + HostFingerprint::collect();
     }
 
     /**
diff --git a/web/includes/Telemetry/schema-1.lock.json b/web/includes/Telemetry/schema-1.lock.json
index 15f56f730..0ebc742c4 100644
--- a/web/includes/Telemetry/schema-1.lock.json
+++ b/web/includes/Telemetry/schema-1.lock.json
@@ -44,7 +44,29 @@
         "env": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["php", "db_engine", "db_version", "web_server", "os_family"],
+            "required": [
+                "php",
+                "db_engine",
+                "db_version",
+                "web_server",
+                "os_family",
+                "sapi",
+                "memory_limit_mb",
+                "max_execution_time",
+                "disable_functions_count",
+                "zts",
+                "php_64bit",
+                "open_basedir_set",
+                "allow_url_fopen",
+                "opcache_loaded",
+                "suhosin_loaded",
+                "posix_available",
+                "host_panel_cpanel",
+                "host_panel_plesk",
+                "host_panel_directadmin",
+                "docroot_user_home",
+                "sapi_per_user"
+            ],
             "properties": {
                 "php": {
                     "type": "string",
@@ -70,6 +92,74 @@
                     "type": "string",
                     "enum": ["linux", "windows", "mac", "bsd", "other"],
                     "description": "Lowercased `PHP_OS_FAMILY`."
+                },
+                "sapi": {
+                    "type": "string",
+                    "pattern": "^[a-z0-9_-]+$",
+                    "description": "`PHP_SAPI` (e.g. `fpm-fcgi`, `apache2handler`, `cgi-fcgi`, `litespeed`). Bounded set of runtime names, not host-identifying."
+                },
+                "memory_limit_mb": {
+                    "type": ["integer", "null"],
+                    "minimum": 0,
+                    "description": "`ini_get('memory_limit')` parsed to whole MiB (`512M` → `512`, `1G` → `1024`). `null` when unlimited (`-1`) or unparseable; null leaves are dropped from the wire body, so the Worker sees the key as absent."
+                },
+                "max_execution_time": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`(int) ini_get('max_execution_time')`. `0` means no limit."
+                },
+                "disable_functions_count": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "Number of entries in `disable_functions`. The list itself is never sent (it fingerprints the hosting provider)."
+                },
+                "zts": {
+                    "type": "boolean",
+                    "description": "`PHP_ZTS === 1` (thread-safe build)."
+                },
+                "php_64bit": {
+                    "type": "boolean",
+                    "description": "`PHP_INT_SIZE === 8`."
+                },
+                "open_basedir_set": {
+                    "type": "boolean",
+                    "description": "`open_basedir` is non-empty. Boolean only; the value would leak the home directory path."
+                },
+                "allow_url_fopen": {
+                    "type": "boolean",
+                    "description": "`allow_url_fopen` is enabled."
+                },
+                "opcache_loaded": {
+                    "type": "boolean",
+                    "description": "`extension_loaded('Zend OPcache')`."
+                },
+                "suhosin_loaded": {
+                    "type": "boolean",
+                    "description": "`extension_loaded('suhosin')`."
+                },
+                "posix_available": {
+                    "type": "boolean",
+                    "description": "`function_exists('posix_geteuid')`."
+                },
+                "host_panel_cpanel": {
+                    "type": "boolean",
+                    "description": "`/usr/local/cpanel` exists. `false` when `open_basedir` hides it."
+                },
+                "host_panel_plesk": {
+                    "type": "boolean",
+                    "description": "`/usr/local/psa` exists. `false` when `open_basedir` hides it."
+                },
+                "host_panel_directadmin": {
+                    "type": "boolean",
+                    "description": "`/usr/local/directadmin` exists. `false` when `open_basedir` hides it."
+                },
+                "docroot_user_home": {
+                    "type": "boolean",
+                    "description": "`DOCUMENT_ROOT` matches the cPanel / DirectAdmin layout (`/home*/<user>/public_html` or `/home*/<user>/domains/<domain>/public_html`). Boolean only; the path contains the account username."
+                },
+                "sapi_per_user": {
+                    "type": "boolean",
+                    "description": "SAPI is `fpm-fcgi` / `cgi-fcgi` AND the effective uid owns the panel's files AND is a regular account (>= 1000, not `nobody`). Per-user FPM / suEXEC / mod_ruid2 fingerprint. `false` without POSIX."
                 }
             }
         },
diff --git a/web/tests/integration/TelemetryCollectTest.php b/web/tests/integration/TelemetryCollectTest.php
index d29c0563a..64ce49e0f 100644
--- a/web/tests/integration/TelemetryCollectTest.php
+++ b/web/tests/integration/TelemetryCollectTest.php
@@ -80,6 +80,25 @@ public function testCollectShapeMatchesSchemaTreeAndCountsAreCorrect(): void
             $env['os_family'],
             ['linux', 'windows', 'mac', 'bsd', 'other']
         );
+        // sbpp/cf-analytics#3 host fingerprint. Values depend on the
+        // runner's PHP build, so pin types (the analytics side bit-packs
+        // the booleans and treats the ints as doubles).
+        $this->assertSame(PHP_SAPI, $env['sapi']);
+        $this->assertTrue(
+            $env['memory_limit_mb'] === null || (is_int($env['memory_limit_mb']) && $env['memory_limit_mb'] >= 0),
+            'env.memory_limit_mb must be a non-negative int or null'
+        );
+        $this->assertIsInt($env['max_execution_time']);
+        $this->assertIsInt($env['disable_functions_count']);
+        foreach ([
+            'zts', 'php_64bit', 'open_basedir_set', 'allow_url_fopen',
+            'opcache_loaded', 'suhosin_loaded', 'posix_available',
+            'host_panel_cpanel', 'host_panel_plesk', 'host_panel_directadmin',
+            'docroot_user_home', 'sapi_per_user',
+        ] as $flag) {
+            $this->assertArrayHasKey($flag, $env, "env.$flag missing from payload");
+            $this->assertIsBool($env[$flag], "env.$flag must be a bool");
+        }
 
         $scale = $payload['scale'];
         $this->assertIsArray($scale);
diff --git a/web/tests/integration/TelemetrySchemaParityTest.php b/web/tests/integration/TelemetrySchemaParityTest.php
index c05fe3b32..d2784909f 100644
--- a/web/tests/integration/TelemetrySchemaParityTest.php
+++ b/web/tests/integration/TelemetrySchemaParityTest.php
@@ -61,11 +61,27 @@ public function testCollectMatchesLockFileInBothDirections(): void
     public function testSchemaPayloadFieldNamesIsExpectedSet(): void
     {
         $expected = [
+            'env.allow_url_fopen',
             'env.db_engine',
             'env.db_version',
+            'env.disable_functions_count',
+            'env.docroot_user_home',
+            'env.host_panel_cpanel',
+            'env.host_panel_directadmin',
+            'env.host_panel_plesk',
+            'env.max_execution_time',
+            'env.memory_limit_mb',
+            'env.opcache_loaded',
+            'env.open_basedir_set',
             'env.os_family',
             'env.php',
+            'env.php_64bit',
+            'env.posix_available',
+            'env.sapi',
+            'env.sapi_per_user',
+            'env.suhosin_loaded',
             'env.web_server',
+            'env.zts',
             'features.adminrehashing',
             'features.comms',
             'features.exportpublic',
diff --git a/web/tests/unit/HostFingerprintTest.php b/web/tests/unit/HostFingerprintTest.php
new file mode 100644
index 000000000..80851be83
--- /dev/null
+++ b/web/tests/unit/HostFingerprintTest.php
@@ -0,0 +1,97 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sbpp\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Sbpp\Telemetry\HostFingerprint;
+use Sbpp\Telemetry\Telemetry;
+
+/**
+ * Pure-function coverage for the telemetry host fingerprint
+ * (sbpp/cf-analytics#3). The integration side (every key present,
+ * every value the right type) lives in `TelemetryCollectTest`; this
+ * pins the parsers whose output the analytics `host_kind` heuristic
+ * thresholds against.
+ */
+final class HostFingerprintTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{string, ?int}>
+     */
+    public static function memoryLimits(): iterable
+    {
+        yield 'megabytes'          => ['256M', 256];
+        yield 'lowercase suffix'   => ['128m', 128];
+        yield 'gigabytes'          => ['1G', 1024];
+        yield 'kilobytes'          => ['524288K', 512];
+        yield 'raw bytes'          => ['134217728', 128];
+        yield 'surrounding spaces' => [' 64M ', 64];
+        yield 'unlimited'          => ['-1', null];
+        yield 'empty'              => ['', null];
+        yield 'garbage'            => ['lots', null];
+    }
+
+    #[DataProvider('memoryLimits')]
+    public function testParseMemoryLimitMb(string $raw, ?int $expected): void
+    {
+        $this->assertSame($expected, HostFingerprint::parseMemoryLimitMb($raw));
+    }
+
+    public function testCountDisabledFunctionsIgnoresBlanksAndWhitespace(): void
+    {
+        $this->assertSame(0, HostFingerprint::countDisabledFunctions(''));
+        $this->assertSame(3, HostFingerprint::countDisabledFunctions('exec, passthru ,shell_exec,'));
+    }
+
+    /**
+     * @return iterable<string, array{string, bool}>
+     */
+    public static function docroots(): iterable
+    {
+        yield 'cpanel'                => ['/home/alice/public_html', true];
+        yield 'cpanel subdir'         => ['/home/alice/public_html/sourcebans', true];
+        yield 'cpanel multi-disk'     => ['/home3/alice/public_html', true];
+        yield 'directadmin'           => ['/home/alice/domains/example.com/public_html', true];
+        yield 'docker / vps'          => ['/var/www/html', false];
+        yield 'public_html lookalike' => ['/home/alice/public_html_old', false];
+        yield 'not under home'        => ['/srv/home/alice/public_html', false];
+        yield 'empty'                 => ['', false];
+    }
+
+    #[DataProvider('docroots')]
+    public function testIsUserHomeDocroot(string $docroot, bool $expected): void
+    {
+        $this->assertSame($expected, HostFingerprint::isUserHomeDocroot($docroot));
+    }
+
+    public function testCollectNeverLeaksRawDocroot(): void
+    {
+        $saved = $_SERVER['DOCUMENT_ROOT'] ?? null;
+        $_SERVER['DOCUMENT_ROOT'] = '/home/canary-user-7f3a/public_html';
+        try {
+            $env = HostFingerprint::collect();
+        } finally {
+            if ($saved === null) {
+                unset($_SERVER['DOCUMENT_ROOT']);
+            } else {
+                $_SERVER['DOCUMENT_ROOT'] = $saved;
+            }
+        }
+        $this->assertTrue($env['docroot_user_home']);
+        $this->assertStringNotContainsString('canary-user-7f3a', (string) json_encode($env));
+    }
+
+    public function testWithoutNullsDropsNullLeavesRecursively(): void
+    {
+        $this->assertSame(
+            ['schema' => 1, 'env' => ['php' => '8.5', 'zts' => false, 'max_execution_time' => 0]],
+            Telemetry::withoutNulls([
+                'schema' => 1,
+                'env'    => ['php' => '8.5', 'memory_limit_mb' => null, 'zts' => false, 'max_execution_time' => 0],
+            ])
+        );
+    }
+}

From 3e4838725fc034d9495a7d6ba9ed94f07ea9c9c3 Mon Sep 17 00:00:00 2001
From: rumblefrog <contact@zhenyangli.me>
Date: Sun, 25 Oct 2026 13:33:35 -0400
Subject: [PATCH 3/4] feat(telemetry): send the scale activity, game mix,
 permission shape, region and export signals (#1609)

sbpp/cf-analytics#7 appended these slots to schema-1 for
sbpp/cf-analytics#6. Mirror them in the vendored JSON Schema and add
the matching extractors so the parity test stays green:

- scale.bans_30d / admins_active_30d: 30-day counts from
  :prefix_bans.created and :prefix_admins.lastvisit.
- scale.ban_history_months: whole calendar months since the oldest
  ban (created = 0 legacy rows ignored); null without bans, so it is
  dropped from the wire body.
- scale.web_bans_majority_30d: more than half of last-30d bans have
  sid = 0.
- scale.games.*: tf / cstrike / csgo / garrysmod / left4dead2 / other
  over enabled servers' modfolders. Other folder names never leave
  the panel.
- scale.perms.*: any web group (type 1), server group, override, or
  admin with immunity > 0.
- panel.exported_30d: a Data Export success row in :prefix_log in the
  last 30 days.
- panel.region: continent code via the new Sbpp\Telemetry\Region,
  from config.timezone when it holds a zone name, else PHP's default
  timezone. Fresh 2.0 installs have no config.timezone and pre-2.0
  upgrades can hold a bare UTC offset there, so the fallback is what
  most installs will use. Never derived from the request.

Operator docs and the Features help text list the new fields.

Refs sbpp/cf-analytics#6

Claude-Session: https://claude.ai/code/session_01XsiwAF3BzPy1aMBEuQcGZe

Co-authored-by: Claude <noreply@anthropic.com>
(cherry picked from commit 1917e0a125d10e067256f9c13134344c60177389)
---
 AGENTS.md                                     |   2 +-
 ARCHITECTURE.md                               |   9 +-
 docs/src/content/docs/updating/1-8-to-2-0.mdx |  12 +-
 web/includes/Telemetry/Region.php             | 133 +++++++++++++
 web/includes/Telemetry/Telemetry.php          | 179 ++++++++++++++++--
 web/includes/Telemetry/schema-1.lock.json     |  92 ++++++++-
 .../integration/TelemetryCollectTest.php      | 126 ++++++++++++
 .../integration/TelemetrySchemaParityTest.php |  16 ++
 web/tests/unit/TelemetryRegionTest.php        | 101 ++++++++++
 .../default/page_admin_settings_features.tpl  |   2 +-
 10 files changed, 650 insertions(+), 22 deletions(-)
 create mode 100644 web/includes/Telemetry/Region.php
 create mode 100644 web/tests/unit/TelemetryRegionTest.php

diff --git a/AGENTS.md b/AGENTS.md
index 59d524d1d..688a305f2 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -4993,7 +4993,7 @@ the spec, target a 1920px viewport, not 1440px.
 | Render admin-authored Markdown to safe HTML | `web/includes/Markup/IntroRenderer.php` (`Sbpp\Markup`) |
 | Add a "Generate password" button to a password field (or change how passwords are generated) | Put `data-password-generator` + `data-password-targets="<id>[,<confirm-id>]"` on a `<button type="button" class="btn btn--ghost btn--icon">`; the shared dialog in `web/scripts/password-generator.js` (loaded from `core/footer.tpl`) does the rest: calls `Actions.AdminsGeneratePassword`, lets the admin tweak length + character sets, fills every non-disabled target on "Use password" and fires bubbling `input` / `change` events. Never write a page-local generator handler. Generation is server-side in `Sbpp\Security\PasswordGenerator` (`web/includes/Security/PasswordGenerator.php`, `random_int` + one-char-per-enabled-set guarantee + Fisher-Yates shuffle); the JSON action merges per-request options over the owner defaults (`config.password.generator.{length,lowercase,uppercase,digits,symbols,exclude_ambiguous}`, edited in Settings > Main, seeded by `data.sql` + `web/updater/data/813.php`) and clamps length to `[max(8, config.password.minlength), 128]`. The REST `POST /admins` fallback password uses the same class. `SYMBOLS` deliberately excludes quotes / backslash / `;` / space / backtick because values land in `server.cfg` and SourceMod configs. `admins.generate_password` stays `requireAdmin`, so surfaces reachable by non-web-admins gate the button (Your account uses `YourAccountView::$can_generate_password` = `is_admin()`). Regression guards: `web/tests/unit/PasswordGeneratorTest.php` (contract + data.sql / 813.php key and default parity), `AdminsTest::testGeneratePassword*`, `web/tests/e2e/specs/flows/password-generator.spec.ts`. |
 | Write or edit a user-facing string (panel UI text, toast body, docs page) | See "User-facing text style (panel UI + docs)" under Conventions. Three rules: no emdash (`—`), terse, don't over-explain. Applies to `web/themes/default/**/*.tpl`, `\Sbpp\View\Toast::emit` titles + bodies, `echo` output from page handlers, and every `docs/src/content/docs/**/*.{md,mdx}` page. Does NOT apply to `AGENTS.md` / `ARCHITECTURE.md` / contributor docs / code comments / audit-log entries / test fixtures. Anti-pattern entries paired under "Anti-patterns". |
-| Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/HostFingerprint.php` (`Sbpp\Telemetry\HostFingerprint::collect()`, the shared-hosting `env.*` signals from sbpp/cf-analytics#3; every probe is `Throwable`-guarded and raw paths / lists are reduced to booleans or counts) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1-8-to-2-0.mdx` (no first-login modal). |
+| Build / extend the anonymous opt-out daily telemetry payload (#1126) | `web/includes/Telemetry/Telemetry.php` (`Sbpp\Telemetry\Telemetry` — `tickIfDue`, `collect`, `send`) + `web/includes/Telemetry/Schema1.php` (`Sbpp\Telemetry\Schema1::payloadFieldNames()`, drives the extractor parity test) + `web/includes/Telemetry/HostFingerprint.php` (`Sbpp\Telemetry\HostFingerprint::collect()`, the shared-hosting `env.*` signals from sbpp/cf-analytics#3; every probe is `Throwable`-guarded and raw paths / lists are reduced to booleans or counts) + `web/includes/Telemetry/Region.php` (`Sbpp\Telemetry\Region::resolve()`, the `panel.region` continent code from sbpp/cf-analytics#6; derived from the configured timezone name only, never from the request) + `web/includes/Telemetry/schema-1.lock.json` (vendored from [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics) — manual sync via `make sync-telemetry-schema`). Tick is registered at the tail of `init.php` via `register_shutdown_function`; on FPM, `fastcgi_finish_request()` flushes the response BEFORE the cURL POST so telemetry never delays a panel page. Slot reservation is atomic (`UPDATE :prefix_settings WHERE CAST(value AS UNSIGNED) <= :threshold`) at the START of the attempt, so a flapping endpoint costs one ping/day, not one ping/request. Audit-log only enable/disable transitions, never individual pings. The in-panel disclosure surface is the help-icon copy in `page_admin_settings_features.tpl`; the upgrade-time disclosure lives in `docs/src/content/docs/updating/1-8-to-2-0.mdx` (no first-login modal). |
 | Add or edit a project announcement (the admin-only banner on the home dashboard) | Edit `docs/public/announcements.json` (the source of truth — Astro publishes it as a static asset at `https://sbpp.github.io/announcements.json`). Each entry: `id` (≤64 chars, **required**), `title` (**required**), `body_md` (CommonMark, optional — rendered through `Sbpp\Markup\IntroRenderer` so raw HTML is escaped + `javascript:` / `data:` URLs are stripped), `url` (optional `http(s)://` only — non-http schemes rejected at the parser), `published_at` (optional ISO-8601 or unix int — drives the sort order; entries without it sort below dated entries), `expires_at` (optional — the parser drops entries past this timestamp). Sorted newest-first by the panel; convention is to also place the newest entry at the top of the array so reviewers see the most relevant change first. The deploy chain is automatic: a push to `main` that touches `docs/` fires `.github/workflows/docs-deploy-trigger.yml` which lands the file at `https://sbpp.github.io/announcements.json` within minutes. The starter file ships as `[]` (empty array). NEVER write to the cache file (`SB_CACHE/announcements.json`) directly — the panel's shutdown hook owns that path. |
 | Add or edit a project sponsor, funding platform, or sponsor tier | Edit `docs/src/data/sponsors.json` (the single source of truth). Three top-level keys: `platforms` (`{id, name, url, description?, icon?}` — the funding channels; GitHub Sponsors today, append Open Collective / Patreon / etc. as they're approved), `tiers` (`{id, name, monthlyMinUsd?, description?}` — ordered list driving the sponsor-roll display order), `sponsors` (`{name, url?, logo?, tier?, since?}` — `tier` matches a `tiers[].id`; missing/empty/unknown places the sponsor in the "Individual supporters" bucket). The component `docs/src/components/Sponsors.astro` renders the file on the canonical `/sponsor/` landing page (`docs/src/content/docs/sponsor.mdx`, `template: splash`, intentionally absent from the sidebar in `astro.config.mjs`); the topbar heart icon, the per-page footer link in `docs/src/components/Footer.astro`, and `.github/FUNDING.yml`'s `custom:` URL all route there. Adding a new platform / sponsor is a one-line append here — no component, config, or template edit needed. Companion issue #1417 will surface the same data on the panel footer; a future README-injector script will read the same file into the main `README.md`'s `<!-- sponsors:start --> ... <!-- sponsors:end -->` markers. The starter file ships with one `platforms` entry (GitHub Sponsors) and empty `tiers` + `sponsors` arrays. Issue #1416. |
 | Embed the sponsor roll on a docs page other than `/sponsor/` (e.g. a future docs index hero) | Import `docs/src/components/Sponsors.astro` and render `<Sponsors showPlatforms={false} />` — the component reads `docs/src/data/sponsors.json` and renders just the tier-grouped roll (with the "Individual supporters" bucket) when `showPlatforms` is false. `showEmptyHint={false}` additionally suppresses the "be the first" line when the roll is empty. The component renders its own `<h2>` headings; the embedding page should not add a parallel `## Our sponsors` heading or the chrome doubles. Issue #1416. |
diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index ffe844447..2b1d3fdd8 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -106,7 +106,7 @@ web/
 │   ├── Servers/              Sbpp\Servers\{SourceQueryCache, RconStatusCache} — per-(ip, port) cache around the xPaw A2S probe (#1311) + per-sid cache around the RCON `status` command (#PLAYER_CTX_MENU)
 │   ├── Upload/               Sbpp\Upload\UploadHandler — shared file-upload handler (perm + CSRF + extension allowlist + filename sanitiser + popup chrome) for the demo / icon / mapimage popup pages
 │   ├── Mail/                 Sbpp\Mail\{Mail,Mailer,EmailType} — Symfony Mailer wrapper + enum
-│   ├── Telemetry/            Sbpp\Telemetry\{Telemetry,Schema1,HostFingerprint} — anonymous opt-out daily ping (#1126); schema-1.lock.json is the vendored cross-repo contract
+│   ├── Telemetry/            Sbpp\Telemetry\{Telemetry,Schema1,HostFingerprint,Region} — anonymous opt-out daily ping (#1126); schema-1.lock.json is the vendored cross-repo contract
 │   ├── Announce/             Sbpp\Announce\{AnnouncementFetcher,Announcement} — anonymous opt-out daily fetch of project news / security advisories from https://sbpp.github.io/announcements.json (source of truth: docs/public/announcements.json); admin-only banner on the home dashboard
 │   ├── Export/               Sbpp\Export\{ManifestBuilder,EntityExporter,BundleWriter,S3PresignedUploader,ExportError,Manifest} — owner-only full data export feature; streamed one-shot ZIP bundle of every row + every uploaded demo; entry point web/export.php (binary wire format, sits at panel-root next to exportbans.php / getdemo.php)
 │   ├── SteamID/              SteamID parsing / vanity-URL resolution
@@ -817,7 +817,12 @@ behind a `Throwable` guard so a host that disables `ini_get` /
 fields stay as explicit `null` in `collect()` (stable key set for the
 parity test) and `send()` drops them via `Telemetry::withoutNulls()`,
 because the Worker's validator accepts an absent key but rejects a
-literal `null`. The
+literal `null`. `panel.region` (sbpp/cf-analytics#6) comes from
+`Sbpp\Telemetry\Region`, a hardcoded IANA-zone → continent table fed
+by `config.timezone` (when it's a zone name; pre-2.0 upgrades can
+leave a bare UTC offset there) or else PHP's default timezone; it
+never reads the request. `panel.exported_30d` reads the `Data Export`
+success rows `web/export.php` writes to `:prefix_log`. The
 exact wire format is captured in
 `web/includes/Telemetry/schema-1.lock.json` — a Draft-7 JSON Schema
 vendored byte-for-byte from the [sbpp/cf-analytics](https://github.com/sbpp/cf-analytics)
diff --git a/docs/src/content/docs/updating/1-8-to-2-0.mdx b/docs/src/content/docs/updating/1-8-to-2-0.mdx
index 7bbbac6f8..a71bc97ac 100644
--- a/docs/src/content/docs/updating/1-8-to-2-0.mdx
+++ b/docs/src/content/docs/updating/1-8-to-2-0.mdx
@@ -123,7 +123,9 @@ categories:
 
 - **panel**: version, short git SHA, dev flag, theme name (only
   `default` or `custom` is reported; fork theme **names are never
-  sent**).
+  sent**), the continent of the panel's configured timezone (for
+  example `eu`; never the timezone itself, and never looked up from
+  your IP), and whether a full data export ran in the last 30 days.
 - **env**: PHP `major.minor`, DB engine + `major.minor`, web server
   family, OS family, plus a hosting fingerprint: PHP SAPI name,
   `memory_limit` / `max_execution_time`, how many functions
@@ -135,7 +137,13 @@ categories:
   document root path, and the `disable_functions` list itself are
   **never sent**, only the yes/no or the count.
 - **scale**: counts of admins, enabled servers, active and total
-  bans / comm blocks, 30-day submission / protest counts.
+  bans / comm blocks, 30-day submission / protest counts, bans and
+  active admins in the last 30 days, how many months of ban history
+  the panel holds, whether most recent bans were added from the web
+  panel, which games your enabled servers run (TF2, CS:S, CS:GO,
+  Garry's Mod, L4D2, or "other"; other game **names are never
+  sent**), and yes/no flags for web groups, server groups, overrides,
+  and admin immunity.
 - **features**: every checkbox under
   **Admin Panel → Settings → Features**, plus three derived booleans:
   SMTP-configured, Steam API key set, GeoIP DB present.
diff --git a/web/includes/Telemetry/Region.php b/web/includes/Telemetry/Region.php
new file mode 100644
index 000000000..9e8e96c4a
--- /dev/null
+++ b/web/includes/Telemetry/Region.php
@@ -0,0 +1,133 @@
+<?php
+declare(strict_types=1);
+
+namespace Sbpp\Telemetry;
+
+use DateTimeZone;
+use Throwable;
+
+/**
+ * Coarse `panel.region` for the telemetry payload
+ * (sbpp/cf-analytics#6): a continent code derived from the panel's
+ * configured timezone name.
+ *
+ * Never derived from the request or the client IP. The only input
+ * is a timezone the operator (or their host) configured, and the
+ * only output is one of six continent codes or `null`.
+ *
+ * The mapping is a hardcoded table over IANA zone names rather than
+ * `DateTimeZone::getLocation()`, because distro PHP builds that use
+ * the system tzdata don't always carry the location table. The
+ * first path segment decides the continent; only `America/`,
+ * `Atlantic/`, `Indian/` and `Pacific/` need per-city overrides.
+ */
+final class Region
+{
+    /** First path segment → continent. `America` / ocean prefixes are handled separately. */
+    private const PREFIXES = [
+        'Africa'    => 'af',
+        'Asia'      => 'as',
+        'Europe'    => 'eu',
+        'Arctic'    => 'eu',
+        'Australia' => 'oc',
+    ];
+
+    /** `America/<city>` zones in South America. Everything else under `America/` is North America. */
+    private const SOUTH_AMERICA = [
+        'Araguaina', 'Asuncion', 'Bahia', 'Belem', 'Boa_Vista', 'Bogota',
+        'Buenos_Aires', 'Campo_Grande', 'Caracas', 'Catamarca', 'Cayenne',
+        'Cordoba', 'Cuiaba', 'Eirunepe', 'Fortaleza', 'Guayaquil', 'Guyana',
+        'Jujuy', 'La_Paz', 'Lima', 'Maceio', 'Manaus', 'Mendoza', 'Montevideo',
+        'Noronha', 'Paramaribo', 'Porto_Acre', 'Porto_Velho', 'Punta_Arenas',
+        'Recife', 'Rio_Branco', 'Rosario', 'Santarem', 'Santiago', 'Sao_Paulo',
+    ];
+
+    /** Ocean-prefixed zones that belong to a continent. Unlisted ones (South Georgia, Kerguelen) are `null`. */
+    private const OCEAN = [
+        'Atlantic/Azores'       => 'eu',
+        'Atlantic/Canary'       => 'eu',
+        'Atlantic/Faeroe'       => 'eu',
+        'Atlantic/Faroe'        => 'eu',
+        'Atlantic/Jan_Mayen'    => 'eu',
+        'Atlantic/Madeira'      => 'eu',
+        'Atlantic/Reykjavik'    => 'eu',
+        'Atlantic/Cape_Verde'   => 'af',
+        'Atlantic/St_Helena'    => 'af',
+        'Atlantic/Bermuda'      => 'na',
+        'Atlantic/Stanley'      => 'sa',
+        'Indian/Antananarivo'   => 'af',
+        'Indian/Comoro'         => 'af',
+        'Indian/Mahe'           => 'af',
+        'Indian/Mauritius'      => 'af',
+        'Indian/Mayotte'        => 'af',
+        'Indian/Reunion'        => 'af',
+        'Indian/Chagos'         => 'as',
+        'Indian/Christmas'      => 'as',
+        'Indian/Cocos'          => 'as',
+        'Indian/Maldives'       => 'as',
+        'Pacific/Easter'        => 'sa',
+        'Pacific/Galapagos'     => 'sa',
+    ];
+
+    private function __construct()
+    {
+    }
+
+    /**
+     * Pick the timezone to classify: `config.timezone` when it holds
+     * a valid zone name (pre-2.0 installs may still carry a numeric
+     * UTC offset there, which can't be mapped), else PHP's default
+     * timezone, which is what the panel renders dates in.
+     */
+    public static function resolve(?string $configured, string $phpDefault): ?string
+    {
+        $configured = trim((string) $configured);
+        if (self::isZoneName($configured)) {
+            return self::fromTimezone($configured);
+        }
+        return self::fromTimezone($phpDefault);
+    }
+
+    /**
+     * Continent code for an IANA zone name, or `null` for `UTC`,
+     * `Etc/*`, Antarctica, offsets, and anything unrecognised.
+     */
+    public static function fromTimezone(string $zone): ?string
+    {
+        $zone = trim($zone);
+        if (!self::isZoneName($zone)) {
+            return null;
+        }
+        if (isset(self::OCEAN[$zone])) {
+            return self::OCEAN[$zone];
+        }
+        $segments = explode('/', $zone);
+        $prefix   = $segments[0];
+        $city     = $segments[count($segments) - 1];
+
+        return match ($prefix) {
+            'America'             => ($segments[1] === 'Argentina' || in_array($city, self::SOUTH_AMERICA, true)) ? 'sa' : 'na',
+            'Pacific'             => 'oc',
+            'Atlantic', 'Indian'  => null,
+            default               => self::PREFIXES[$prefix] ?? null,
+        };
+    }
+
+    /**
+     * True for a `Area/Location` name PHP recognises. Rejects bare
+     * offsets (`-8`, `+01:00`) and abbreviations (`UTC`, `EST`),
+     * which `DateTimeZone` would otherwise accept.
+     */
+    private static function isZoneName(string $zone): bool
+    {
+        if (preg_match('#^[A-Za-z_]+(?:/[A-Za-z0-9_+\-]+)+$#', $zone) !== 1) {
+            return false;
+        }
+        try {
+            new DateTimeZone($zone);
+            return true;
+        } catch (Throwable) {
+            return false;
+        }
+    }
+}
diff --git a/web/includes/Telemetry/Telemetry.php b/web/includes/Telemetry/Telemetry.php
index ed88e2144..d1fdb1ee5 100644
--- a/web/includes/Telemetry/Telemetry.php
+++ b/web/includes/Telemetry/Telemetry.php
@@ -70,6 +70,9 @@ final class Telemetry
     /** cURL total-operation timeout. */
     private const TOTAL_TIMEOUT_SECONDS = 5;
 
+    /** `modfolder`s with their own `scale.games` flag; every other folder reports as `other`. */
+    private const TRACKED_GAMES = ['tf', 'cstrike', 'csgo', 'garrysmod', 'left4dead2'];
+
     /**
      * Process-local cache of the instance ID. Settings are loaded
      * once at request start by `Config::init()` and the cache is
@@ -436,11 +439,17 @@ private static function collectPanel(): array
         /** @var mixed $rawGit */
         $rawGit  = defined('SB_GITREV') ? constant('SB_GITREV') : '';
         $git     = is_string($rawGit) ? $rawGit : '';
+        $timezone = Config::get('config.timezone');
         return [
-            'version' => $version,
-            'git'     => $git,
-            'dev'     => $version === \Sbpp\Version::DEV_SENTINEL,
-            'theme'   => self::resolveTheme(),
+            'version'      => $version,
+            'git'          => $git,
+            'dev'          => $version === \Sbpp\Version::DEV_SENTINEL,
+            'theme'        => self::resolveTheme(),
+            'region'       => Region::resolve(
+                is_string($timezone) ? $timezone : null,
+                date_default_timezone_get()
+            ),
+            'exported_30d' => self::resolveExported30d(),
         ];
     }
 
@@ -459,25 +468,47 @@ private static function collectEnv(): array
     }
 
     /**
-     * @return array<string, int>
+     * @return array<string, mixed>
      */
     private static function collectScale(): array
     {
         $db = self::db();
         if ($db === null) {
             return [
-                'admins'          => 0,
-                'servers_enabled' => 0,
-                'bans_active'     => 0,
-                'bans_total'      => 0,
-                'comms_active'    => 0,
-                'comms_total'     => 0,
-                'submissions_30d' => 0,
-                'protests_30d'    => 0,
+                'admins'                => 0,
+                'servers_enabled'       => 0,
+                'bans_active'           => 0,
+                'bans_total'            => 0,
+                'comms_active'          => 0,
+                'comms_total'           => 0,
+                'submissions_30d'       => 0,
+                'protests_30d'          => 0,
+                'bans_30d'              => 0,
+                'admins_active_30d'     => 0,
+                'ban_history_months'    => null,
+                'web_bans_majority_30d' => false,
+                'games'                 => self::gamesFromModfolders([]),
+                'perms'                 => [
+                    'web_groups'    => false,
+                    'server_groups' => false,
+                    'overrides'     => false,
+                    'immunity'      => false,
+                ],
             ];
         }
 
-        $thirtyDaysAgo = time() - 30 * 86400;
+        $now           = time();
+        $thirtyDaysAgo = $now - 30 * 86400;
+        $bans30d       = self::countWithCutoff(
+            $db,
+            "SELECT COUNT(*) AS c FROM `:prefix_bans` WHERE `created` >= :cutoff",
+            $thirtyDaysAgo
+        );
+        $webBans30d    = self::countWithCutoff(
+            $db,
+            "SELECT COUNT(*) AS c FROM `:prefix_bans` WHERE `created` >= :cutoff AND `sid` = 0",
+            $thirtyDaysAgo
+        );
 
         return [
             'admins'          => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_admins`"),
@@ -504,9 +535,129 @@ private static function collectScale(): array
                 "SELECT COUNT(*) AS c FROM `:prefix_protests` WHERE `datesubmitted` >= :cutoff",
                 $thirtyDaysAgo
             ),
+            'bans_30d'              => $bans30d,
+            'admins_active_30d'     => self::countWithCutoff(
+                $db,
+                "SELECT COUNT(*) AS c FROM `:prefix_admins` WHERE `lastvisit` >= :cutoff",
+                $thirtyDaysAgo
+            ),
+            'ban_history_months'    => self::resolveBanHistoryMonths($db, $now),
+            'web_bans_majority_30d' => $webBans30d * 2 > $bans30d,
+            'games'                 => self::gamesFromModfolders(self::enabledModfolders($db)),
+            'perms'                 => [
+                'web_groups'    => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_groups` WHERE `type` = 1") > 0,
+                'server_groups' => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_srvgroups`") > 0,
+                'overrides'     => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_overrides`") > 0,
+                'immunity'      => self::countSimple($db, "SELECT COUNT(*) AS c FROM `:prefix_admins` WHERE `immunity` > 0") > 0,
+            ],
         ];
     }
 
+    /**
+     * Map the `modfolder`s of enabled servers onto the `scale.games`
+     * flags. Anything outside the five tracked games collapses into
+     * `other`; the folder name itself never leaves the panel.
+     *
+     * @param list<string> $modfolders
+     * @return array<string, bool>
+     */
+    public static function gamesFromModfolders(array $modfolders): array
+    {
+        $games = array_fill_keys(self::TRACKED_GAMES, false);
+        $games['other'] = false;
+        foreach ($modfolders as $folder) {
+            $folder = strtolower(trim($folder));
+            $games[in_array($folder, self::TRACKED_GAMES, true) ? $folder : 'other'] = true;
+        }
+        return $games;
+    }
+
+    /**
+     * Distinct `modfolder`s across enabled servers.
+     *
+     * @return list<string>
+     */
+    private static function enabledModfolders(Database $db): array
+    {
+        try {
+            $db->query(
+                "SELECT DISTINCT m.`modfolder` FROM `:prefix_servers` s "
+                . "JOIN `:prefix_mods` m ON m.`mid` = s.`modid` "
+                . "WHERE s.`enabled` = 1"
+            );
+            $folders = [];
+            foreach ($db->resultset() as $row) {
+                $folders[] = (string) ($row['modfolder'] ?? '');
+            }
+            return $folders;
+        } catch (Throwable) {
+            return [];
+        }
+    }
+
+    /**
+     * Whole calendar months between the oldest ban and `$now`, or
+     * `null` when the panel has no bans. `created = 0` rows (the
+     * column default, seen on imported legacy bans) are ignored so
+     * they don't read as a ban from 1970.
+     */
+    private static function resolveBanHistoryMonths(Database $db, int $now): ?int
+    {
+        try {
+            $db->query("SELECT MIN(`created`) AS m FROM `:prefix_bans` WHERE `created` > 0");
+            $row = $db->single();
+            $oldest = is_array($row) ? (int) ($row['m'] ?? 0) : 0;
+        } catch (Throwable) {
+            return null;
+        }
+        if ($oldest <= 0) {
+            return null;
+        }
+        return self::monthsBetween($oldest, $now);
+    }
+
+    /**
+     * Whole calendar months from `$from` to `$to` (both unix
+     * seconds, compared in UTC). `0` when `$from` is in the future.
+     */
+    public static function monthsBetween(int $from, int $to): int
+    {
+        if ($from >= $to) {
+            return 0;
+        }
+        $utc  = new \DateTimeZone('UTC');
+        $diff = (new \DateTimeImmutable('@' . $from))->setTimezone($utc)
+            ->diff((new \DateTimeImmutable('@' . $to))->setTimezone($utc));
+        return $diff->y * 12 + $diff->m;
+    }
+
+    /**
+     * True iff `web/export.php` logged a successful full data
+     * export (ZIP delivered or S3 upload OK, both `LogType::Message`
+     * under the `Data Export` title) in the last 30 days. Failures
+     * and permission denials log as `Error` / `Warning` and don't
+     * count. An operator who clears the audit log resets this.
+     */
+    private static function resolveExported30d(): bool
+    {
+        $db = self::db();
+        if ($db === null) {
+            return false;
+        }
+        try {
+            $db->query(
+                "SELECT COUNT(*) AS c FROM `:prefix_log` "
+                . "WHERE `type` = :type AND `title` = 'Data Export' AND `created` >= :cutoff"
+            );
+            $db->bind(':type', \LogType::Message->value);
+            $db->bind(':cutoff', time() - 30 * 86400);
+            $row = $db->single();
+            return is_array($row) && (int) ($row['c'] ?? 0) > 0;
+        } catch (Throwable) {
+            return false;
+        }
+    }
+
     /**
      * @return array<string, bool>
      */
diff --git a/web/includes/Telemetry/schema-1.lock.json b/web/includes/Telemetry/schema-1.lock.json
index 0ebc742c4..8fe50fd93 100644
--- a/web/includes/Telemetry/schema-1.lock.json
+++ b/web/includes/Telemetry/schema-1.lock.json
@@ -20,7 +20,7 @@
         "panel": {
             "type": "object",
             "additionalProperties": false,
-            "required": ["version", "git", "dev", "theme"],
+            "required": ["version", "git", "dev", "theme", "region", "exported_30d"],
             "properties": {
                 "version": {
                     "type": "string",
@@ -38,6 +38,15 @@
                     "type": "string",
                     "enum": ["default", "custom"],
                     "description": "`'default'` if the active theme is the panel's shipped default; `'custom'` otherwise. The actual fork theme name is never reported (would leak community names)."
+                },
+                "region": {
+                    "type": ["string", "null"],
+                    "enum": ["af", "as", "eu", "na", "oc", "sa", null],
+                    "description": "Continent code derived from the panel's configured timezone: `config.timezone` when it holds an IANA zone name, else PHP's default timezone (`date.timezone`). Never derived from the request or the client IP. `null` for `UTC` / `Etc/*` / Antarctica / unparseable values; null leaves are dropped from the wire body, so the Worker sees the key as absent."
+                },
+                "exported_30d": {
+                    "type": "boolean",
+                    "description": "True iff a full data export bundle was delivered (ZIP download or S3 upload) in the last 30 days, read from the `Data Export` success rows in `:prefix_log`."
                 }
             }
         },
@@ -174,7 +183,13 @@
                 "comms_active",
                 "comms_total",
                 "submissions_30d",
-                "protests_30d"
+                "protests_30d",
+                "bans_30d",
+                "admins_active_30d",
+                "ban_history_months",
+                "web_bans_majority_30d",
+                "games",
+                "perms"
             ],
             "properties": {
                 "admins": {
@@ -216,6 +231,79 @@
                     "type": "integer",
                     "minimum": 0,
                     "description": "`SELECT COUNT(*) FROM :prefix_protests WHERE datesubmitted >= UNIX_TIMESTAMP() - 2592000`."
+                },
+                "bans_30d": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`SELECT COUNT(*) FROM :prefix_bans WHERE created >= UNIX_TIMESTAMP() - 2592000`."
+                },
+                "admins_active_30d": {
+                    "type": "integer",
+                    "minimum": 0,
+                    "description": "`SELECT COUNT(*) FROM :prefix_admins WHERE lastvisit >= UNIX_TIMESTAMP() - 2592000`."
+                },
+                "ban_history_months": {
+                    "type": ["integer", "null"],
+                    "minimum": 0,
+                    "description": "Whole calendar months since `MIN(:prefix_bans.created)` (rows with `created = 0` ignored). `null` when there are no bans; null leaves are dropped from the wire body, so the Worker sees the key as absent."
+                },
+                "web_bans_majority_30d": {
+                    "type": "boolean",
+                    "description": "True iff more than half of the bans created in the last 30 days have `sid = 0` (added from the web panel rather than a game server). `false` when there were none."
+                },
+                "games": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["tf", "cstrike", "csgo", "garrysmod", "left4dead2", "other"],
+                    "properties": {
+                        "tf": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'tf'`."
+                        },
+                        "cstrike": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'cstrike'`."
+                        },
+                        "csgo": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'csgo'`."
+                        },
+                        "garrysmod": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'garrysmod'`."
+                        },
+                        "left4dead2": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has `modfolder = 'left4dead2'`."
+                        },
+                        "other": {
+                            "type": "boolean",
+                            "description": "At least one enabled server whose mod has any other `modfolder`. The folder name itself is never sent."
+                        }
+                    }
+                },
+                "perms": {
+                    "type": "object",
+                    "additionalProperties": false,
+                    "required": ["web_groups", "server_groups", "overrides", "immunity"],
+                    "properties": {
+                        "web_groups": {
+                            "type": "boolean",
+                            "description": "At least one web admin group (`:prefix_groups` with `type = 1`)."
+                        },
+                        "server_groups": {
+                            "type": "boolean",
+                            "description": "At least one server admin group (`:prefix_srvgroups`)."
+                        },
+                        "overrides": {
+                            "type": "boolean",
+                            "description": "At least one row in `:prefix_overrides`."
+                        },
+                        "immunity": {
+                            "type": "boolean",
+                            "description": "At least one admin with `immunity > 0`."
+                        }
+                    }
                 }
             }
         },
diff --git a/web/tests/integration/TelemetryCollectTest.php b/web/tests/integration/TelemetryCollectTest.php
index 64ce49e0f..e1d6a3e92 100644
--- a/web/tests/integration/TelemetryCollectTest.php
+++ b/web/tests/integration/TelemetryCollectTest.php
@@ -66,6 +66,10 @@ public function testCollectShapeMatchesSchemaTreeAndCountsAreCorrect(): void
         $this->assertArrayHasKey('theme', $panel);
         $this->assertSame('default', $panel['theme'], 'shipped default theme is reported as "default", not "custom"');
         $this->assertIsBool($panel['dev']);
+        // sbpp/cf-analytics#6. Region depends on the runner's
+        // timezone, so pin the domain only.
+        $this->assertContains($panel['region'], ['af', 'as', 'eu', 'na', 'oc', 'sa', null]);
+        $this->assertFalse($panel['exported_30d'], 'no Data Export rows in the fixture log');
 
         $env = $payload['env'];
         $this->assertIsArray($env);
@@ -110,6 +114,20 @@ public function testCollectShapeMatchesSchemaTreeAndCountsAreCorrect(): void
         $this->assertSame(2, $scale['comms_total']);
         $this->assertSame(2, $scale['submissions_30d'], 'recent submissions inside the 30-day window');
         $this->assertSame(1, $scale['protests_30d']);
+        $this->assertSame(4, $scale['bans_30d'], 'every seeded ban is inside the 30-day window');
+        $this->assertIsInt($scale['admins_active_30d']);
+        $this->assertSame(0, $scale['ban_history_months'], 'oldest seeded ban is ~2 days old');
+        $this->assertFalse($scale['web_bans_majority_30d'], 'every seeded ban came from sid 1');
+        $this->assertSame(
+            ['tf' => true, 'cstrike' => false, 'csgo' => false, 'garrysmod' => false, 'left4dead2' => false, 'other' => false],
+            $scale['games'],
+            'only TF2 (modid 12) servers are enabled'
+        );
+        $this->assertSame(
+            ['web_groups' => false, 'server_groups' => false, 'overrides' => false, 'immunity' => true],
+            $scale['perms'],
+            'fixture admin carries immunity 100; no groups or overrides seeded'
+        );
 
         $features = $payload['features'];
         $this->assertIsArray($features);
@@ -154,6 +172,114 @@ public function testCollectedPayloadContainsNoSeededPii(): void
         }
     }
 
+    /**
+     * sbpp/cf-analytics#6 slots against a panel shaped differently
+     * from the main universe: mixed games, mostly web bans, a long
+     * ban history, groups + overrides, and a recent export.
+     */
+    public function testScaleActivityGameMixPermissionShapeAndExport(): void
+    {
+        $pdo = Fixture::rawPdo();
+        $now = time();
+
+        $pdo->prepare(sprintf('UPDATE `%s_admins` SET `lastvisit` = ? WHERE `aid` = ?', DB_PREFIX))
+            ->execute([$now - 100, Fixture::adminAid()]);
+        $hash = password_hash('whatever', PASSWORD_BCRYPT);
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_admins` (`user`, `authid`, `password`, `gid`, `email`, `validate`, `extraflags`, `immunity`, `lastvisit`)
+             VALUES (?, ?, ?, -1, ?, NULL, 0, 0, ?)',
+            DB_PREFIX
+        ))->execute(['stale-admin', 'STEAM_0:1:444', $hash, 'stale@example.test', $now - 40 * 86400]);
+
+        // CS:GO (21) + HL2DM (1, folds into "other") enabled; L4D2 (16) disabled.
+        $stmt = $pdo->prepare(sprintf(
+            'INSERT INTO `%s_servers` (`ip`, `port`, `rcon`, `modid`, `enabled`) VALUES (?, ?, ?, ?, ?)',
+            DB_PREFIX
+        ));
+        $stmt->execute(['10.0.1.1', 27015, '', 21, 1]);
+        $stmt->execute(['10.0.1.2', 27015, '', 1, 1]);
+        $stmt->execute(['10.0.1.3', 27015, '', 16, 0]);
+
+        // Last 30 days: 3 web bans (sid 0) + 1 server ban. Plus one
+        // 400-day-old ban (13 calendar months whatever the date) and a
+        // `created = 0` legacy row that must not read as 1970.
+        $stmt = $pdo->prepare(sprintf(
+            'INSERT INTO `%s_bans` (`ip`, `authid`, `name`, `created`, `ends`, `length`, `reason`, `aid`, `adminIp`, `sid`, `type`)
+             VALUES (?, ?, ?, ?, 0, 0, ?, 1, ?, ?, 0)',
+            DB_PREFIX
+        ));
+        $stmt->execute(['', 'STEAM_0:1:1', 'a', $now - 100, 'r', '127.0.0.1', 0]);
+        $stmt->execute(['', 'STEAM_0:1:2', 'b', $now - 200, 'r', '127.0.0.1', 0]);
+        $stmt->execute(['', 'STEAM_0:1:3', 'c', $now - 300, 'r', '127.0.0.1', 0]);
+        $stmt->execute(['', 'STEAM_0:1:4', 'd', $now - 400, 'r', '127.0.0.1', 1]);
+        $stmt->execute(['', 'STEAM_0:1:5', 'e', $now - 400 * 86400, 'r', '127.0.0.1', 1]);
+        $stmt->execute(['', 'STEAM_0:1:6', 'f', 0, 'r', '127.0.0.1', 1]);
+
+        $pdo->prepare(sprintf('INSERT INTO `%s_groups` (`type`, `name`, `flags`) VALUES (1, ?, 0)', DB_PREFIX))
+            ->execute(['web-group']);
+        $pdo->prepare(sprintf(
+            'INSERT INTO `%s_srvgroups` (`flags`, `immunity`, `name`, `groups_immune`) VALUES (?, 0, ?, ?)',
+            DB_PREFIX
+        ))->execute(['b', 'srv-group', ' ']);
+        $pdo->prepare(sprintf('INSERT INTO `%s_overrides` (`type`, `name`, `flags`) VALUES (?, ?, ?)', DB_PREFIX))
+            ->execute(['command', 'sm_ban', 'd']);
+
+        $this->insertLog('m', 'Data Export', $now - 1000);
+
+        $payload = Telemetry::collect();
+        $scale   = $payload['scale'];
+
+        $this->assertTrue($payload['panel']['exported_30d']);
+        $this->assertSame(4, $scale['bans_30d']);
+        $this->assertSame(1, $scale['admins_active_30d'], 'fixture admin active, stale admin 40 days out, CONSOLE never');
+        $this->assertSame(13, $scale['ban_history_months']);
+        $this->assertTrue($scale['web_bans_majority_30d'], '3 of 4 recent bans are web bans');
+        $this->assertSame(
+            ['tf' => false, 'cstrike' => false, 'csgo' => true, 'garrysmod' => false, 'left4dead2' => false, 'other' => true],
+            $scale['games']
+        );
+        $this->assertSame(
+            ['web_groups' => true, 'server_groups' => true, 'overrides' => true, 'immunity' => true],
+            $scale['perms']
+        );
+    }
+
+    public function testBanHistoryIsNullWithoutBans(): void
+    {
+        $payload = Telemetry::collect();
+        $this->assertNull($payload['scale']['ban_history_months']);
+        $this->assertFalse($payload['scale']['web_bans_majority_30d']);
+        $this->assertArrayNotHasKey(
+            'ban_history_months',
+            Telemetry::withoutNulls($payload)['scale'],
+            'a null leaf must be dropped from the wire body, not sent as null'
+        );
+    }
+
+    /**
+     * Only a successful export inside the window counts: failures log
+     * as `e`, and an export from 31 days ago is out of range.
+     */
+    public function testExportedFlagIgnoresFailuresAndOldExports(): void
+    {
+        $now = time();
+        $this->insertLog('e', 'Data Export', $now - 1000);
+        $this->insertLog('w', 'Data Export', $now - 1000);
+        $this->insertLog('m', 'Data Export', $now - 31 * 86400);
+        $this->insertLog('m', 'Group Created', $now - 1000);
+
+        $this->assertFalse(Telemetry::collect()['panel']['exported_30d']);
+    }
+
+    private function insertLog(string $type, string $title, int $created): void
+    {
+        Fixture::rawPdo()->prepare(sprintf(
+            'INSERT INTO `%s_log` (`type`, `title`, `message`, `function`, `query`, `aid`, `host`, `created`)
+             VALUES (?, ?, ?, ?, ?, ?, ?, ?)',
+            DB_PREFIX
+        ))->execute([$type, $title, 'test', 'test', '', 0, '', $created]);
+    }
+
     /**
      * Calling `collect()` twice in the same request must NOT mint a
      * new instance ID — the persisted value (or the freshly-minted +
diff --git a/web/tests/integration/TelemetrySchemaParityTest.php b/web/tests/integration/TelemetrySchemaParityTest.php
index d2784909f..dc1988f12 100644
--- a/web/tests/integration/TelemetrySchemaParityTest.php
+++ b/web/tests/integration/TelemetrySchemaParityTest.php
@@ -98,17 +98,33 @@ public function testSchemaPayloadFieldNamesIsExpectedSet(): void
             'features.submit',
             'instance_id',
             'panel.dev',
+            'panel.exported_30d',
             'panel.git',
+            'panel.region',
             'panel.theme',
             'panel.version',
             'scale.admins',
+            'scale.admins_active_30d',
+            'scale.ban_history_months',
+            'scale.bans_30d',
             'scale.bans_active',
             'scale.bans_total',
             'scale.comms_active',
             'scale.comms_total',
+            'scale.games.csgo',
+            'scale.games.cstrike',
+            'scale.games.garrysmod',
+            'scale.games.left4dead2',
+            'scale.games.other',
+            'scale.games.tf',
+            'scale.perms.immunity',
+            'scale.perms.overrides',
+            'scale.perms.server_groups',
+            'scale.perms.web_groups',
             'scale.protests_30d',
             'scale.servers_enabled',
             'scale.submissions_30d',
+            'scale.web_bans_majority_30d',
             'schema',
         ];
         $actual = Schema1::payloadFieldNames();
diff --git a/web/tests/unit/TelemetryRegionTest.php b/web/tests/unit/TelemetryRegionTest.php
new file mode 100644
index 000000000..cd67958ea
--- /dev/null
+++ b/web/tests/unit/TelemetryRegionTest.php
@@ -0,0 +1,101 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Sbpp\Tests\Unit;
+
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\TestCase;
+use Sbpp\Telemetry\Region;
+use Sbpp\Telemetry\Telemetry;
+
+/**
+ * Pure-function coverage for the sbpp/cf-analytics#6 telemetry
+ * slots: the `panel.region` timezone → continent table, and the
+ * `scale.games` / `scale.ban_history_months` helpers. The DB-backed
+ * side lives in `TelemetryCollectTest`.
+ */
+final class TelemetryRegionTest extends TestCase
+{
+    /**
+     * @return iterable<string, array{string, ?string}>
+     */
+    public static function zones(): iterable
+    {
+        yield 'europe'               => ['Europe/Berlin', 'eu'];
+        yield 'asia'                 => ['Asia/Tokyo', 'as'];
+        yield 'africa'               => ['Africa/Lagos', 'af'];
+        yield 'australia'            => ['Australia/Sydney', 'oc'];
+        yield 'pacific'              => ['Pacific/Auckland', 'oc'];
+        yield 'north america'        => ['America/New_York', 'na'];
+        yield 'central america'      => ['America/Mexico_City', 'na'];
+        yield 'south america'        => ['America/Sao_Paulo', 'sa'];
+        yield 'argentina subzone'    => ['America/Argentina/Buenos_Aires', 'sa'];
+        yield 'atlantic europe'      => ['Atlantic/Canary', 'eu'];
+        yield 'atlantic africa'      => ['Atlantic/Cape_Verde', 'af'];
+        yield 'atlantic unmapped'    => ['Atlantic/South_Georgia', null];
+        yield 'indian africa'        => ['Indian/Mauritius', 'af'];
+        yield 'indian asia'          => ['Indian/Maldives', 'as'];
+        yield 'pacific south america' => ['Pacific/Galapagos', 'sa'];
+        yield 'antarctica'           => ['Antarctica/McMurdo', null];
+        yield 'etc'                  => ['Etc/GMT+5', null];
+        yield 'utc'                  => ['UTC', null];
+        yield 'numeric offset'       => ['-8', null];
+        yield 'iso offset'           => ['+01:00', null];
+        yield 'unknown zone'         => ['Europe/Atlantis', null];
+        yield 'empty'                => ['', null];
+    }
+
+    #[DataProvider('zones')]
+    public function testFromTimezone(string $zone, ?string $expected): void
+    {
+        $this->assertSame($expected, Region::fromTimezone($zone));
+    }
+
+    public function testResolvePrefersConfiguredZoneName(): void
+    {
+        $this->assertSame('as', Region::resolve('Asia/Seoul', 'Europe/Paris'));
+    }
+
+    public function testResolveFallsBackToPhpDefaultForLegacyOffsets(): void
+    {
+        // Pre-2.0 upgrades can leave a bare UTC offset in config.timezone.
+        $this->assertSame('eu', Region::resolve('1', 'Europe/Paris'));
+        $this->assertSame('eu', Region::resolve(null, 'Europe/Paris'));
+        $this->assertNull(Region::resolve('', 'UTC'));
+    }
+
+    /**
+     * @return iterable<string, array{list<string>, array<string, bool>}>
+     */
+    public static function modfolders(): iterable
+    {
+        $none = ['tf' => false, 'cstrike' => false, 'csgo' => false, 'garrysmod' => false, 'left4dead2' => false, 'other' => false];
+        yield 'no servers'     => [[], $none];
+        yield 'tracked only'   => [['tf', 'csgo'], array_merge($none, ['tf' => true, 'csgo' => true])];
+        yield 'untracked only' => [['dod'], array_merge($none, ['other' => true])];
+        yield 'case folded'    => [['GarrysMod'], array_merge($none, ['garrysmod' => true])];
+        yield 'l4d1 is other'  => [['left4dead'], array_merge($none, ['other' => true])];
+        yield 'literal other'  => [['other'], array_merge($none, ['other' => true])];
+    }
+
+    /**
+     * @param list<string> $folders
+     * @param array<string, bool> $expected
+     */
+    #[DataProvider('modfolders')]
+    public function testGamesFromModfolders(array $folders, array $expected): void
+    {
+        $this->assertSame($expected, Telemetry::gamesFromModfolders($folders));
+    }
+
+    public function testMonthsBetweenCountsWholeCalendarMonths(): void
+    {
+        $at = static fn (string $date): int => (new \DateTimeImmutable($date, new \DateTimeZone('UTC')))->getTimestamp();
+
+        $this->assertSame(0, Telemetry::monthsBetween($at('2026-01-31'), $at('2026-02-28')));
+        $this->assertSame(1, Telemetry::monthsBetween($at('2026-01-15'), $at('2026-02-15')));
+        $this->assertSame(74, Telemetry::monthsBetween($at('2020-08-01'), $at('2026-10-25')));
+        $this->assertSame(0, Telemetry::monthsBetween($at('2026-10-25'), $at('2020-01-01')), 'future oldest ban clamps to 0');
+    }
+}
diff --git a/web/themes/default/page_admin_settings_features.tpl b/web/themes/default/page_admin_settings_features.tpl
index ba9ee00f0..a5af689ba 100644
--- a/web/themes/default/page_admin_settings_features.tpl
+++ b/web/themes/default/page_admin_settings_features.tpl
@@ -201,7 +201,7 @@
                                     <span class="text-sm font-medium">Anonymous telemetry</span>
                                 </label>
                                 <p class="settings-fieldset__help" id="telemetry_enabled_help" data-testid="setting-help-telemetry.enabled">
-                                    Sends one anonymous ping per day with panel version, PHP / DB / OS family, counts (admins, servers, bans, comms, 30-day submissions / protests), and which features are turned on. <strong>No</strong> hostnames, IPs, admin names, SteamIDs, or ban reasons are sent. A random install ID is included so pings can be deduplicated.
+                                    Sends one anonymous ping per day with panel version, PHP / DB / OS family, the continent of your timezone, counts (admins, servers, bans, comms, 30-day activity), which games your servers run, and which features are turned on. <strong>No</strong> hostnames, IPs, admin names, SteamIDs, or ban reasons are sent. A random install ID is included so pings can be deduplicated.
                                     <a href="https://sbpp.github.io/updating/1-8-to-2-0/#anonymous-telemetry" target="_blank" rel="noopener noreferrer">See the full payload</a>.
                                     Disabling clears the random ID; turning it back on issues a fresh one.
                                 </p>

From 93ae1144deb3fb1b7aae761481943c2b3e2fc9e3 Mon Sep 17 00:00:00 2001
From: Rushaway <rushaway@hotmail.fr>
Date: Mon, 26 Oct 2026 08:46:17 +0100
Subject: [PATCH 4/4] chore(changelog): 2.2.4-srcdslab telemetry signals

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 028484ccc..8a3b05fb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,16 @@ Legend:
 ? = Other stuff
 ```
 
+(26/10/26): Version 2.2.4-srcdslab
+-----------------------
+```
+01. + Telemetry sends the fields the analytics Worker expects: shared-
+        hosting environment signals, 30-day activity, game mix,
+        permission shape, data-export usage and the continent of the
+        panel's timezone (still no hostnames, IPs, names or SteamIDs)
+02. ? The Docker dev / CI stack no longer sends telemetry pings
+```
+
 (22/10/26): Version 2.1.26-srcdslab
 -----------------------
 ```