@@ -61,7 +61,7 @@ We collect the following categories of events:
 | `activation_menu_shown` | The activation menu was (very likely) rendered. `variant` is `warehouse` or `no_data`. **Derived** — see the note below. |
 | `activation_job_selected` / `first_job_completed` | Which activation job the user started and, where observable, finished. Completion is reported only for the job that was actually selected, so the two form a coherent pair. **Derived** — see the note below. |
 | `first_prompt_sent` | The user's first typed message in an onboarding session. Slash commands are excluded, so the hidden `/onboard-connect` submission does not count. |
-| `onboarding_abandoned` | The CLI exited during a first run without connecting. `last_stage` is the furthest point reached: `started`, `model_picker`, `provider_setup`, `big_pickle_confirm`, `gateway_auth`, or `connected`. Only emitted for a genuine first run — opening `/connect` as an existing user does not enter the funnel, and abandonment after setup completes is out of scope by definition. |
+| `onboarding_abandoned` | The CLI exited during a first run without connecting. `last_stage` is the furthest point reached: `started`, `model_picker`, `provider_setup`, `big_pickle_confirm`, or `gateway_auth`. (`connected` is a funnel position but never a `last_stage` — reaching it means the run completed, which is not an abandonment.) Only emitted for a genuine first run — opening `/connect` as an existing user does not enter the funnel, and abandonment after setup completes is out of scope by definition. |
 
 ### A note on the derived activation events
 
 
@@ -103,6 +103,20 @@ export async function OnboardingTelemetryPlugin(_input: PluginInput): Promise<Ho
       }
     },
 
+    "tool.execute.before": async (input, output) => {
+      if (!OnboardingTelemetry.isOnboardingSession(input.sessionID)) return
+      // Selection lands on the first job-shaped tool call, and it is claimed HERE rather than in
+      // tool.execute.after because the docs promise that a job which started and then failed
+      // still counts as selected — the user did choose it. Claiming it after the tool returned
+      // dropped exactly those cases (skill lookup, permission denial, execution error), which are
+      // the ones a funnel most needs to see. Completion detection stays in .after.
+      const job = jobForTool(input.tool, output.args)
+      if (!job) return
+      if (OnboardingTelemetry.claimActivationJobSelected(input.sessionID, job)) {
+        void OnboardingTelemetry.emit({ type: "activation_job_selected", job }, input.sessionID)
+      }
+    },
+
     "tool.execute.after": async (input, output) => {
       if (!OnboardingTelemetry.isOnboardingSession(input.sessionID)) return
 
@@ -126,11 +140,6 @@ export async function OnboardingTelemetryPlugin(_input: PluginInput): Promise<Ho
       const job = jobForTool(input.tool, input.args)
       if (!job) return
 
-      // Selection lands on the first job-shaped tool call. A job that starts and then fails still
-      // counts as selected — the user did choose it.
-      if (OnboardingTelemetry.claimActivationJobSelected(input.sessionID, job)) {
-        void OnboardingTelemetry.emit({ type: "activation_job_selected", job }, input.sessionID)
-      }
       // Only complete the job that was actually selected. Skill-driven jobs stay without a
       // completion event, as the docs already state.
       if (
 
@@ -50,6 +50,21 @@ export namespace Telemetry {
   const MAX_BUFFER_SIZE = 200
   const REQUEST_TIMEOUT_MS = 10_000
 
+  /**
+   * altimate_change — single source of truth for the TUI exit-path flush budget, referenced by
+   * BOTH the `withTimeout(client.call("shutdown", ...))` deadline on the main thread
+   * (cli/cmd/tui.ts) and the worker's remaining-budget computation (cli/tui/worker.ts). They must
+   * agree: the worker's buffer flush exists only because `worker.terminate()` would otherwise
+   * discard it, and if the main thread's deadline were the shorter of the two it would truncate
+   * the flush and silently restore the data loss this guards against.
+   */
+  export const TUI_SHUTDOWN_BUDGET_MS = 5000
+
+  /** Exit-path budget for the MAIN thread's own flush. Strictly smaller than the worker's,
+   *  because it runs after the worker shutdown RPC has already returned and still has to finish
+   *  before `process.exit(0)`. */
+  export const EXIT_FLUSH_BUDGET_MS = 2000
+
   export type Event =
     // altimate_change start — add os/arch/node_version for environment segmentation
     | {
@@ -1446,6 +1461,11 @@ export namespace Telemetry {
 
   let cachedLaunchId: string | undefined
 
+  /** Test seam — the cache is intentionally process-lifetime, so shutdown() does not clear it. */
+  export function resetLaunchIdForTest() {
+    cachedLaunchId = undefined
+  }
+
   export function launchId(): string {
     // The worker reads the value the TUI handed it through WorkerOptions.env; the main thread
     // generates it. Cached in module scope rather than written back to process.env — the worker
@@ -1557,12 +1577,19 @@ export namespace Telemetry {
     // Chaining onto shutdownPromise keeps the generations separate: callers arriving mid-shutdown
     // wait for the new init rather than joining the dying one.
     if (shutdownPromise) {
-      return (reinitPromise ??= shutdownPromise
-        .catch(() => {})
-        .then(doInit)
-        .finally(() => {
-          reinitPromise = undefined
-        }))
+      if (!reinitPromise) {
+        reinitPromise = shutdownPromise
+          .catch(() => {})
+          .then(doInit)
+          .finally(() => {
+            reinitPromise = undefined
+          })
+        // Publish it as initPromise too. Without this, a caller arriving after the shutdown had
+        // settled — but before this chained doInit() finished — saw an empty initPromise and
+        // started a SECOND one, replacing the flush timer and racing over the buffer.
+        initPromise = reinitPromise
+      }
+      return reinitPromise
     }
     return (initPromise ??= doInit())
     // altimate_change end
@@ -1803,7 +1830,19 @@ export namespace Telemetry {
     }
     // altimate_change — drain any flush already running before the final one, so a timer batch
     // in mid-request is not abandoned and cannot write back into a buffer we are about to clear.
-    if (inFlightFlush) await inFlightFlush.catch(() => {})
+    if (inFlightFlush) {
+      // Bounded: a flush already in flight uses the DEFAULT request timeout, so awaiting it
+      // unbounded could burn 10s before the bounded flush below even starts — well past the 5s
+      // the TUI allows the whole shutdown RPC.
+      let drainTimer: ReturnType<typeof setTimeout> | undefined
+      await Promise.race([
+        inFlightFlush.catch(() => {}),
+        new Promise<void>((resolve) => {
+          drainTimer = setTimeout(resolve, timeoutMs ?? REQUEST_TIMEOUT_MS)
+        }),
+      ])
+      if (drainTimer) clearTimeout(drainTimer)
+    }
     await flush(timeoutMs)
     inFlightFlush = undefined
     enabled = false
@@ -1813,9 +1852,10 @@ export namespace Telemetry {
     sessionId = ""
     projectId = ""
     machineId = ""
-    // altimate_change — the launch id is per process, but tests re-init the module in one process;
-    // leaving it cached made a second lifecycle inherit the first one's id.
-    cachedLaunchId = undefined
+    // NOTE: cachedLaunchId is deliberately NOT cleared here. session/prompt.ts shuts telemetry
+    // down at the end of every session, so clearing it would mint a fresh launch_id per prompt in
+    // a long-lived `serve` process and shatter the per-launch correlation it exists to provide.
+    // Tests use resetLaunchIdForTest() instead.
     // altimate_change — only clear initPromise if it is still the one this shutdown began with.
     // init() can set `initPromise = shutdownPromise.then(doInit)`; nulling that unconditionally
     // discards a doInit() which has not run yet, so the next init() starts a second one.
 
@@ -32,6 +32,9 @@ export const ONBOARDING_STAGES = [
   "provider_setup",
   "big_pickle_confirm",
   "gateway_auth",
+  // NOTE: reaching this stage means the run completed, and emitAbandonedIfIncomplete() returns
+  // early on `completed`. So "connected" is a valid funnel position but never a `last_stage` on
+  // an abandonment — see the enum note in docs/docs/reference/telemetry.md.
   "connected",
 ] as const
 
@@ -150,11 +153,6 @@ export function markStage(stage: OnboardingStage) {
   advance(stage)
 }
 
-/** True once `onboarding_completed` has been emitted on this thread. */
-export function isCompleted() {
-  return completed
-}
-
 /**
  * Emit `onboarding_abandoned` if the user got somewhere in the funnel and never completed.
  * Call on the exit path, before the final flush. No-ops when the user never started (a
 
@@ -936,9 +936,6 @@ export const ProjectScanTool = Tool.define("project_scan", {
     // for. Deliberately separate from `environment_census` above, which stays the richer
     // dbt/warehouse fingerprint; this one answers "did the scan find the user a working setup".
     //
-    // Fires on every project_scan, not just the onboarding one — the tool is also reachable via
-    // /discover and any model-initiated call.
-    //
     // has_warehouse and connections_found both come from totalConnections, NOT
     // connections.alreadyConfigured: connections discovered from dbt profiles, docker, and env
     // vars are counted separately, and a user whose only warehouse was auto-discovered would
 
@@ -109,13 +109,16 @@ export const SampleSetupTool = Tool.define("sample_setup", {
         `Could not locate the shipped starter sample source. This usually means the CLI ` +
         `was installed without its wrapper package assets. Reinstall with: ` +
         `\`npm i -g @altimateai/altimate-code@latest\`\n\n` +
-        `Underlying error: ${message}`
+        // Redacted for the same reason as the materialize_failed branch below: sample-manifest
+        // read/resolve errors embed absolute install paths, and `output` is what the model sees
+        // and what gets replayed to the provider on later turns.
+        `Underlying error: ${redactPaths(message)}`
       // altimate_change — onboarding funnel: a broken install (sample assets missing) is a
       // sample-setup failure too. Without this the failure count only covers materialization
       // errors and silently under-reports the "CLI shipped without its assets" case.
       if (OnboardingTelemetry.isOnboardingSession(ctx.sessionID))
         void OnboardingTelemetry.emit({
-            type: "sample_setup_completed",
+          type: "sample_setup_completed",
           success: false,
           models: 0,
           tables: 0,
@@ -176,7 +179,7 @@ export const SampleSetupTool = Tool.define("sample_setup", {
       const sampleContents = countSampleContents(sampleSource.path)
       if (OnboardingTelemetry.isOnboardingSession(ctx.sessionID))
         void OnboardingTelemetry.emit({
-            type: "sample_setup_completed",
+          type: "sample_setup_completed",
           success: true,
           models: sampleContents.models,
           tables: sampleContents.tables,
@@ -207,7 +210,7 @@ export const SampleSetupTool = Tool.define("sample_setup", {
       // paths (unsafe HOME, unwritable parent), so it is not sent — only the boolean.
       if (OnboardingTelemetry.isOnboardingSession(ctx.sessionID))
         void OnboardingTelemetry.emit({
-            type: "sample_setup_completed",
+          type: "sample_setup_completed",
           success: false,
           models: 0,
           tables: 0,
 
@@ -153,7 +153,7 @@ export const TuiThreadCommand = cmd({
         if (stopped) return
         stopped = true
         process.off("SIGUSR2", reload)
-        await withTimeout(client.call("shutdown", undefined), 5000).catch(() => {})
+        await withTimeout(client.call("shutdown", undefined), Telemetry.TUI_SHUTDOWN_BUDGET_MS).catch(() => {})
         worker.terminate()
       }
 
@@ -285,13 +285,23 @@ export const TuiThreadCommand = cmd({
       // flush() would otherwise block for REQUEST_TIMEOUT_MS (10s) on a blackholed network — a
       // visible hang between the user quitting and the shell prompt returning.
       try {
-        // Ask whether gateway credentials landed. The success events are emitted on the worker
-        // thread and this state is main-thread-owned, so without this a browser sign-in that
-        // completed just before the user quit is reported as an abandonment in the same launch
-        // that already reported instance_connected.
-        const connected = await AltimateApi.isConfigured().catch(() => false)
-        await OnboardingTelemetry.emitAbandonedIfIncomplete({ connected })
-        await Telemetry.shutdown({ timeoutMs: 2000 })
+        // The inner bound covers the flush only. Two things ahead of it can also stall — the
+        // credential read, and shutdown()'s await of an initialization the request middleware
+        // started — so the whole finalizer is raced too. Racing is safe HERE (unlike inside
+        // flush, per the note above) because the only thing after it is process.exit(0): nothing
+        // resumes to observe module state a straggler might still be mutating.
+        await withTimeout(
+          (async () => {
+            // Ask whether gateway credentials landed. The success events are emitted on the
+            // worker thread and this state is main-thread-owned, so without this a browser
+            // sign-in that completed just before the user quit is reported as an abandonment in
+            // the same launch that already reported instance_connected.
+            const connected = await AltimateApi.isConfigured().catch(() => false)
+            await OnboardingTelemetry.emitAbandonedIfIncomplete({ connected })
+            await Telemetry.shutdown({ timeoutMs: Telemetry.EXIT_FLUSH_BUDGET_MS })
+          })(),
+          Telemetry.EXIT_FLUSH_BUDGET_MS + 1000,
+        )
       } catch {
         // Never let telemetry delay or break exit.
       }
 
@@ -27,8 +27,9 @@ import { Instance } from "@/project/instance"
 // altimate_change — onboarding telemetry: flush this thread's buffer in rpc.shutdown()
 import { Telemetry } from "@/altimate/telemetry"
 
-// altimate_change — must match the withTimeout budget in cli/cmd/tui.ts stop().
-const SHUTDOWN_BUDGET_MS = 5000
+// altimate_change — shared with the withTimeout budget in cli/cmd/tui.ts stop(), so the coupling
+// is enforced by the compiler rather than by a comment.
+const SHUTDOWN_BUDGET_MS = Telemetry.TUI_SHUTDOWN_BUDGET_MS
 
 Heap.start()
 
 
@@ -1124,9 +1124,16 @@ export namespace SessionPrompt {
         //   - `consumeCommandSubmission` excludes slash commands, because the scan gate submits
         //     a hidden `/onboard-connect` as an ordinary user message: it would otherwise be
         //     recorded as the user's first typed prompt in every fresh onboarding.
+        //   - a real text part, because a message carrying only attachments (a dragged-in file,
+        //     a pasted image) reached this block too and was recorded as the user's first typed
+        //     prompt before they had typed anything. Same filter as the intent classifier above.
         const fromCommand = OnboardingTelemetry.consumeCommandSubmission(sessionID)
+        const hasUserText = !!userMsg?.parts.some(
+          (p) => p.type === "text" && !p.ignored && !p.synthetic && p.text.trim().length > 0,
+        )
         if (
           !fromCommand &&
+          hasUserText &&
           OnboardingTelemetry.isOnboardingSession(sessionID) &&
           OnboardingTelemetry.claimFirstPrompt(sessionID)
         ) {