diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 909a6f74e..d3d45a01b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -59,6 +59,12 @@ jobs:
         env:
           RELEASE_TAG: ${{ startsWith(github.ref, 'refs/tags/') && github.ref_name || '' }}
 
+      - name: Verify installed collectors and development-only bundles
+        run: |
+          npx nx build growth --skip-nx-cache
+          npx nx run telemetry:test-install-pack --skip-nx-cache
+          npx nx run telemetry:test-development-bundle --skip-nx-cache
+
       # Trusted publishing is configured per-package on npm; no NPM_TOKEN needed.
       # The OIDC token from id-token: write authenticates this workflow as a
       # trusted publisher for each @threadplane/* package. Provenance attestations are
diff --git a/.gitignore b/.gitignore
index 7981f2dee..bbb32f774 100644
--- a/.gitignore
+++ b/.gitignore
@@ -81,6 +81,11 @@ keys/
 # Aborted fixture-record runs strand raw recordings under a committed path
 **/e2e/fixtures/.staging/
 
+# Shared install collector staged before each library is packaged.
+libs/*/.install-collector/*
+!libs/*/.install-collector/development-install.mjs
+!libs/*/.install-collector/development-install.d.ts
+
 # Growth research generated deployment artifacts
 apps/growth-research/.dawn/
 apps/growth-research/.deployment/
diff --git a/apps/website/content/AGENTS.md.template b/apps/website/content/AGENTS.md.template
index d6912c8e6..cb63070dc 100644
--- a/apps/website/content/AGENTS.md.template
+++ b/apps/website/content/AGENTS.md.template
@@ -12,6 +12,30 @@ Supported Angular majors: 20, 21, and 22.
 ## Install
 npm install @threadplane/chat @threadplane/langgraph @langchain/core @langchain/langgraph-sdk marked
 
+The chat, LangGraph, AG-UI, and render packages include automatic install collection
+for local and CI execution: package/environment details, a random installation ID,
+configured Git name/full email, and repository provider/owner hints when available.
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installation to disable
+it. Package-manager script controls are respected. A usable install email can qualify
+for a short founder welcome sequence after linked development-browser use, capped
+at three emails with unsubscribe and reply stops. CI alone does not trigger it.
+The package-local correlation token contains no email; copied/cached packages can
+retain it, so it does not verify a person. No registration is required.
+See https://threadplane.ai/privacy.
+
+
+Supported runtime/browser collection is automatic only in Angular development mode.
+Production builds, SSR, imports, unused construction, and automated browsers
+reporting `navigator.webdriver` are inert. It sends closed
+progress milestones with package/version and random browser-origin/session IDs, never
+conversation content or private URLs. Adapter `telemetry: false` disables it; a custom
+sink replaces the automatic destination, including nested chat JSON rendering. Use
+`setDevelopmentCollectionEnabled(false)` from `@threadplane/telemetry/browser`, or set
+browser localStorage `THREADPLANE_TELEMETRY_DISABLED=1` and reload. Development console
+announcements need no click to acknowledge progress. Linked non-CI install and runtime
+evidence can qualify the install email for the founder sequence described above.
+Standalone render also accepts `provideRender({ telemetry: false })`.
+
 ## Key requirement
 `injectAgent()` MUST be called within an Angular injection context (component constructor or field initializer). Calling it in ngOnInit or any async context throws "NG0203: inject() must be called from an injection context".
 
diff --git a/apps/website/content/CLAUDE.md.template b/apps/website/content/CLAUDE.md.template
index d6912c8e6..cb63070dc 100644
--- a/apps/website/content/CLAUDE.md.template
+++ b/apps/website/content/CLAUDE.md.template
@@ -12,6 +12,30 @@ Supported Angular majors: 20, 21, and 22.
 ## Install
 npm install @threadplane/chat @threadplane/langgraph @langchain/core @langchain/langgraph-sdk marked
 
+The chat, LangGraph, AG-UI, and render packages include automatic install collection
+for local and CI execution: package/environment details, a random installation ID,
+configured Git name/full email, and repository provider/owner hints when available.
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installation to disable
+it. Package-manager script controls are respected. A usable install email can qualify
+for a short founder welcome sequence after linked development-browser use, capped
+at three emails with unsubscribe and reply stops. CI alone does not trigger it.
+The package-local correlation token contains no email; copied/cached packages can
+retain it, so it does not verify a person. No registration is required.
+See https://threadplane.ai/privacy.
+
+
+Supported runtime/browser collection is automatic only in Angular development mode.
+Production builds, SSR, imports, unused construction, and automated browsers
+reporting `navigator.webdriver` are inert. It sends closed
+progress milestones with package/version and random browser-origin/session IDs, never
+conversation content or private URLs. Adapter `telemetry: false` disables it; a custom
+sink replaces the automatic destination, including nested chat JSON rendering. Use
+`setDevelopmentCollectionEnabled(false)` from `@threadplane/telemetry/browser`, or set
+browser localStorage `THREADPLANE_TELEMETRY_DISABLED=1` and reload. Development console
+announcements need no click to acknowledge progress. Linked non-CI install and runtime
+evidence can qualify the install email for the founder sequence described above.
+Standalone render also accepts `provideRender({ telemetry: false })`.
+
 ## Key requirement
 `injectAgent()` MUST be called within an Angular injection context (component constructor or field initializer). Calling it in ngOnInit or any async context throws "NG0203: inject() must be called from an injection context".
 
diff --git a/apps/website/content/docs/ag-ui/api/api-docs.json b/apps/website/content/docs/ag-ui/api/api-docs.json
index e34c99ddf..79757f7df 100644
--- a/apps/website/content/docs/ag-ui/api/api-docs.json
+++ b/apps/website/content/docs/ag-ui/api/api-docs.json
@@ -390,7 +390,7 @@
       {
         "name": "telemetry",
         "type": "false | AgentRuntimeTelemetrySink",
-        "description": "Optional app-owned sink. Supply one to receive runtime lifecycle events.",
+        "description": "Omit to enable automatic development-only collection. Set `false` to disable.\nAn app-owned sink replaces the automatic destination and receives the\nexisting runtime lifecycle callbacks.",
         "optional": true
       },
       {
@@ -540,7 +540,7 @@
       {
         "name": "telemetry",
         "type": "false | AgentRuntimeTelemetrySink",
-        "description": "Optional app-owned sink. Supply one to receive runtime lifecycle events.",
+        "description": "Omit to enable automatic development-only collection. Set `false` to disable.\nAn app-owned sink replaces the automatic destination and receives the\nexisting runtime lifecycle callbacks.",
         "optional": true
       }
     ],
diff --git a/apps/website/content/docs/langgraph/api/api-docs.json b/apps/website/content/docs/langgraph/api/api-docs.json
index 060243860..8b09bb050 100644
--- a/apps/website/content/docs/langgraph/api/api-docs.json
+++ b/apps/website/content/docs/langgraph/api/api-docs.json
@@ -919,7 +919,7 @@
       {
         "name": "telemetry",
         "type": "false | AgentRuntimeTelemetrySink",
-        "description": "Optional app-owned sink. Supply one to receive runtime lifecycle events.",
+        "description": "Omit to enable automatic development-only collection. Set `false` to disable.\nAn app-owned sink replaces the automatic destination and receives the\nexisting runtime lifecycle callbacks.",
         "optional": true
       },
       {
@@ -1061,7 +1061,7 @@
       {
         "name": "telemetry",
         "type": "false | AgentRuntimeTelemetrySink",
-        "description": "Optional app-owned sink. Supply one to receive runtime lifecycle events.",
+        "description": "Omit to enable automatic development-only collection. Set `false` to disable.\nAn app-owned sink replaces the automatic destination and receives the\nexisting runtime lifecycle callbacks.",
         "optional": true
       },
       {
diff --git a/apps/website/content/docs/render/api/api-docs.json b/apps/website/content/docs/render/api/api-docs.json
index b7dfe6057..ae142b4a6 100644
--- a/apps/website/content/docs/render/api/api-docs.json
+++ b/apps/website/content/docs/render/api/api-docs.json
@@ -171,6 +171,12 @@
         "type": "InputSignal<StateStore | undefined>",
         "description": "",
         "optional": false
+      },
+      {
+        "name": "telemetry",
+        "type": "InputSignal<boolean | undefined>",
+        "description": "Disable automatic development collection for this render tree.",
+        "optional": false
       }
     ],
     "methods": [
@@ -276,6 +282,12 @@
         "type": "StateStore",
         "description": "Backing state store that `$bindState` paths read from and interactive elements write to.",
         "optional": true
+      },
+      {
+        "name": "telemetry",
+        "type": "boolean",
+        "description": "Set false to disable automatic development browser collection for this render tree.",
+        "optional": true
       }
     ],
     "examples": []
diff --git a/apps/website/public/AGENTS.md b/apps/website/public/AGENTS.md
index f35ac8aaa..63bdc0450 100644
--- a/apps/website/public/AGENTS.md
+++ b/apps/website/public/AGENTS.md
@@ -12,6 +12,30 @@ Supported Angular majors: 20, 21, and 22.
 ## Install
 npm install @threadplane/chat @threadplane/langgraph @langchain/core @langchain/langgraph-sdk marked
 
+The chat, LangGraph, AG-UI, and render packages include automatic install collection
+for local and CI execution: package/environment details, a random installation ID,
+configured Git name/full email, and repository provider/owner hints when available.
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installation to disable
+it. Package-manager script controls are respected. A usable install email can qualify
+for a short founder welcome sequence after linked development-browser use, capped
+at three emails with unsubscribe and reply stops. CI alone does not trigger it.
+The package-local correlation token contains no email; copied/cached packages can
+retain it, so it does not verify a person. No registration is required.
+See https://threadplane.ai/privacy.
+
+
+Supported runtime/browser collection is automatic only in Angular development mode.
+Production builds, SSR, imports, unused construction, and automated browsers
+reporting `navigator.webdriver` are inert. It sends closed
+progress milestones with package/version and random browser-origin/session IDs, never
+conversation content or private URLs. Adapter `telemetry: false` disables it; a custom
+sink replaces the automatic destination, including nested chat JSON rendering. Use
+`setDevelopmentCollectionEnabled(false)` from `@threadplane/telemetry/browser`, or set
+browser localStorage `THREADPLANE_TELEMETRY_DISABLED=1` and reload. Development console
+announcements need no click to acknowledge progress. Linked non-CI install and runtime
+evidence can qualify the install email for the founder sequence described above.
+Standalone render also accepts `provideRender({ telemetry: false })`.
+
 ## Key requirement
 `injectAgent()` MUST be called within an Angular injection context (component constructor or field initializer). Calling it in ngOnInit or any async context throws "NG0203: inject() must be called from an injection context".
 
diff --git a/apps/website/public/CLAUDE.md b/apps/website/public/CLAUDE.md
index f35ac8aaa..63bdc0450 100644
--- a/apps/website/public/CLAUDE.md
+++ b/apps/website/public/CLAUDE.md
@@ -12,6 +12,30 @@ Supported Angular majors: 20, 21, and 22.
 ## Install
 npm install @threadplane/chat @threadplane/langgraph @langchain/core @langchain/langgraph-sdk marked
 
+The chat, LangGraph, AG-UI, and render packages include automatic install collection
+for local and CI execution: package/environment details, a random installation ID,
+configured Git name/full email, and repository provider/owner hints when available.
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installation to disable
+it. Package-manager script controls are respected. A usable install email can qualify
+for a short founder welcome sequence after linked development-browser use, capped
+at three emails with unsubscribe and reply stops. CI alone does not trigger it.
+The package-local correlation token contains no email; copied/cached packages can
+retain it, so it does not verify a person. No registration is required.
+See https://threadplane.ai/privacy.
+
+
+Supported runtime/browser collection is automatic only in Angular development mode.
+Production builds, SSR, imports, unused construction, and automated browsers
+reporting `navigator.webdriver` are inert. It sends closed
+progress milestones with package/version and random browser-origin/session IDs, never
+conversation content or private URLs. Adapter `telemetry: false` disables it; a custom
+sink replaces the automatic destination, including nested chat JSON rendering. Use
+`setDevelopmentCollectionEnabled(false)` from `@threadplane/telemetry/browser`, or set
+browser localStorage `THREADPLANE_TELEMETRY_DISABLED=1` and reload. Development console
+announcements need no click to acknowledge progress. Linked non-CI install and runtime
+evidence can qualify the install email for the founder sequence described above.
+Standalone render also accepts `provideRender({ telemetry: false })`.
+
 ## Key requirement
 `injectAgent()` MUST be called within an Angular injection context (component constructor or field initializer). Calling it in ngOnInit or any async context throws "NG0203: inject() must be called from an injection context".
 
diff --git a/apps/website/src/app/layout.tsx b/apps/website/src/app/layout.tsx
index fb1422523..d2d5addc7 100644
--- a/apps/website/src/app/layout.tsx
+++ b/apps/website/src/app/layout.tsx
@@ -17,6 +17,8 @@ import {
   SITE_ORIGIN,
 } from '../lib/site-metadata';
 import { getFormPolicy } from '../lib/growth/form-policy';
+import { WebsiteSignals } from '../components/shared/WebsiteSignals';
+import { websiteContentCatalog } from '../lib/growth/website-content';
 
 const garamond = EB_Garamond({
   subsets: ['latin'],
@@ -78,6 +80,7 @@ export default function RootLayout({
           reason — do not mount its component builders individually.
         */}
         <JsonLd data={rootJsonLd()} />
+        <WebsiteSignals catalog={websiteContentCatalog()} />
         <Nav />
         <div id="site-content">
           <main>
diff --git a/apps/website/src/app/privacy/page.spec.tsx b/apps/website/src/app/privacy/page.spec.tsx
index 7b80ea1af..4fd43d405 100644
--- a/apps/website/src/app/privacy/page.spec.tsx
+++ b/apps/website/src/app/privacy/page.spec.tsx
@@ -25,7 +25,7 @@ import PrivacyPage, { metadata } from './page';
 /**
  * One canonical policy replaces the previous scattering of analytics promises.
  * These assertions pin what it must say and, just as importantly, what it must
- * never grow back into: a per-event catalog, an installation-behavior claim, or
+ * never grow back into: a per-event catalog or
  * an absolute guarantee that a future change could quietly falsify.
  */
 describe('privacy policy metadata', () => {
@@ -44,6 +44,21 @@ describe('privacy policy content', () => {
     render(<PrivacyPage />);
     return document.body.textContent ?? '';
   };
+  it('discloses install identity collection and its disable control', () => {
+    const body = text();
+    expect(body).toMatch(/install/i);
+    expect(body).toMatch(/Git.*email/i);
+    expect(body).toContain('DO_NOT_TRACK');
+    expect(body).toMatch(/CI/);
+  });
+  it('explains development-only runtime collection and browser disable controls', () => {
+    const body = text();
+    expect(body).toMatch(/development builds/i);
+    expect(body).toMatch(/production builds.*do not/is);
+    expect(body).toContain('THREADPLANE_TELEMETRY_DISABLED');
+    expect(body).toMatch(/browser-origin identifier/i);
+    expect(body).toMatch(/custom telemetry sink/i);
+  });
 
   it('names the information Threadplane collects', () => {
     const body = text();
@@ -89,7 +104,6 @@ describe('privacy policy content', () => {
   });
 
   it.each([
-    ['an installation behavior claim', /install/i],
     ['a never-collected list', /never collect|we will never|do not collect/i],
     ['an absolute guarantee', /\bguarantee/i],
     ['a per-event catalog', /event name|event catalog|property name/i],
diff --git a/apps/website/src/app/privacy/page.tsx b/apps/website/src/app/privacy/page.tsx
index ec3a47af8..04fd5dfe7 100644
--- a/apps/website/src/app/privacy/page.tsx
+++ b/apps/website/src/app/privacy/page.tsx
@@ -28,7 +28,9 @@ export default function PrivacyPage() {
     <Section surface="canvas" ariaLabelledBy="privacy-heading">
       <Container>
         <div className="privacy-inner">
-          <Eyebrow tone="accent" className="privacy-eyebrow">Legal</Eyebrow>
+          <Eyebrow tone="accent" className="privacy-eyebrow">
+            Legal
+          </Eyebrow>
           <h1 id="privacy-heading" className="privacy-h1">
             Privacy
           </h1>
@@ -51,18 +53,51 @@ export default function PrivacyPage() {
           <p className="privacy-body">
             We record how pages are used — pages viewed, referring source, and
             broad technical details such as browser and approximate region — to
-            understand what people find useful. This is used in aggregate.
+            understand what people find useful. We also record content topics,
+            campaign and referral context, and interactions with setup commands.
+            A short-lived website session can connect this activity to a form
+            you submit, helping us understand your interest and respond in
+            context. We use both aggregate reporting and individual activity
+            history.
           </p>
 
           <h2 className="privacy-h2">Product analytics</h2>
           <p className="privacy-body">
-            Threadplane software may report operational facts about how the
-            product is running so we can see which capabilities work in real
-            deployments. These reports describe activity, not content. We do not
-            want and do not seek the substance of what your application is
-            doing: prompts, messages, tool inputs and outputs, application
-            state, and source code are outside what this reporting is designed
-            to carry.
+            Installing Threadplane chat, LangGraph, AG-UI, or render packages
+            can automatically report package and environment details, a random
+            installation identifier, configured Git name and full email, and the
+            repository hosting provider and owner when available. This includes
+            CI installations, which are labeled as automation. Set
+            DO_NOT_TRACK=1 or TPLANE_TELEMETRY_DISABLED=1 before installation to
+            disable this collection. A usable install-captured email may receive
+            a short founder welcome sequence after the first linked development
+            browser use, with at most three emails and an unsubscribe option. CI
+            installation alone does not trigger this sequence.
+          </p>
+          <p className="privacy-body">
+            In Angular development builds, supported browser runtimes
+            automatically report package versions and progress such as a working
+            connection, completed interaction, restored conversation, or mounted
+            component. Production builds and server-side execution do not run
+            this automatic browser collection. A random browser-origin
+            identifier and a session with a 30-minute inactivity boundary
+            connect these reports; they do not identify a repository or verified
+            person. Storage failures fall back to memory. An opaque
+            package-local token can link development use to an installation; it
+            contains no email. Copied or cached installed packages can retain an
+            earlier token, so this link does not verify who is operating the
+            browser.
+          </p>
+          <p className="privacy-body">
+            Set the browser localStorage key THREADPLANE_TELEMETRY_DISABLED to
+            1, use the programmatic browser disable control, or configure
+            telemetry: false to disable automatic runtime collection. A custom
+            telemetry sink replaces the automatic destination for that runtime.
+            Development announcements may appear in the console; no click is
+            required to record progress. These reports exclude prompts,
+            messages, tool inputs and outputs, application state, source code,
+            private URLs, and credentials. They do not authorize marketing
+            email.
           </p>
 
           <h2 className="privacy-h2">How the information is used</h2>
@@ -95,8 +130,11 @@ export default function PrivacyPage() {
             stops further marketing email. Replying to ask us to stop has the
             same effect. To request deletion of the information we hold about
             you, or to ask what that is, email{' '}
-            <a className="privacy-link" href={`mailto:${CONTACT_EMAIL}`}>{CONTACT_EMAIL}</a> and we will
-            act on it. Some records are kept where we are required to keep them.
+            <a className="privacy-link" href={`mailto:${CONTACT_EMAIL}`}>
+              {CONTACT_EMAIL}
+            </a>{' '}
+            and we will act on it. Some records are kept where we are required
+            to keep them.
           </p>
 
           <h2 className="privacy-h2">Security</h2>
@@ -121,7 +159,10 @@ export default function PrivacyPage() {
           <h2 className="privacy-h2">Contact</h2>
           <p className="privacy-body">
             Questions about this page or about the information we hold:{' '}
-            <a className="privacy-link" href={`mailto:${CONTACT_EMAIL}`}>{CONTACT_EMAIL}</a>.
+            <a className="privacy-link" href={`mailto:${CONTACT_EMAIL}`}>
+              {CONTACT_EMAIL}
+            </a>
+            .
           </p>
         </div>
       </Container>
diff --git a/apps/website/src/components/docs/CopyButton.tsx b/apps/website/src/components/docs/CopyButton.tsx
index 8c70b64ef..ba246f3c4 100644
--- a/apps/website/src/components/docs/CopyButton.tsx
+++ b/apps/website/src/components/docs/CopyButton.tsx
@@ -2,6 +2,7 @@
 import { useState } from 'react';
 import { analyticsEvents } from '../../lib/analytics/events';
 import { track } from '../../lib/analytics/client';
+import { observeInstallCopy } from '../../lib/growth/website-collector';
 
 function CopyIcon() {
   return (
@@ -31,6 +32,7 @@ export function CopyButton({ text }: Props) {
   const handleClick = async () => {
     try {
       await navigator.clipboard.writeText(text);
+      observeInstallCopy(text);
       track(analyticsEvents.docsCopyCodeClick, {
         surface: 'docs',
         cta_id: 'copy_install',
diff --git a/apps/website/src/components/docs/mdx/CodeBlock.tsx b/apps/website/src/components/docs/mdx/CodeBlock.tsx
index 31016a398..2923ef204 100644
--- a/apps/website/src/components/docs/mdx/CodeBlock.tsx
+++ b/apps/website/src/components/docs/mdx/CodeBlock.tsx
@@ -2,6 +2,7 @@
 import { useRef, useState } from 'react';
 import { analyticsEvents } from '../../../lib/analytics/events';
 import { track } from '../../../lib/analytics/client';
+import { observeInstallCopy } from '../../../lib/growth/website-collector';
 
 function CopyIcon() {
   return (
@@ -27,6 +28,7 @@ export function Pre({ children, className, ...props }: React.HTMLAttributes<HTML
   const copy = async () => {
     const text = ref.current?.textContent ?? '';
     await navigator.clipboard.writeText(text);
+    observeInstallCopy(text);
     track(analyticsEvents.docsCopyCodeClick, {
       surface: 'docs',
       cta_id: 'copy_code',
diff --git a/apps/website/src/components/landing/InstallDialog.spec.tsx b/apps/website/src/components/landing/InstallDialog.spec.tsx
index 4c7105115..2fb9d2d81 100644
--- a/apps/website/src/components/landing/InstallDialog.spec.tsx
+++ b/apps/website/src/components/landing/InstallDialog.spec.tsx
@@ -6,6 +6,8 @@ import { INSTALL_OPTIONS } from '../../lib/positioning';
 
 const trackCtaClickMock = vi.hoisted(() => vi.fn());
 const writeTextMock = vi.hoisted(() => vi.fn().mockResolvedValue(undefined));
+const observeCopy = vi.hoisted(() => vi.fn());
+vi.mock('../../lib/growth/website-collector', () => ({ observeInstallCopy: observeCopy }));
 vi.mock('../../lib/analytics/client', () => ({ trackCtaClick: trackCtaClickMock, track: vi.fn() }));
 vi.mock('../ui/Button', () => ({
   Button: ({ children, href, onClick }: { children: React.ReactNode; href?: string; onClick?: () => void }) =>
@@ -15,10 +17,21 @@ vi.mock('../ui/Button', () => ({
 beforeEach(() => {
   trackCtaClickMock.mockClear();
   writeTextMock.mockClear();
+  observeCopy.mockClear();
   Object.assign(navigator, { clipboard: { writeText: writeTextMock } });
 });
 
 describe('InstallDialog', () => {
+  it('records Growth copy evidence only after clipboard success', async () => {
+    const { InstallDialog } = await import('./InstallDialog');
+    render(<InstallDialog open onClose={vi.fn()} />);
+    writeTextMock.mockRejectedValueOnce(new Error('blocked'));
+    fireEvent.click(screen.getByRole('button', {name: 'Copy install command'}));
+    await vi.waitFor(() => expect(writeTextMock).toHaveBeenCalled());
+    expect(observeCopy).not.toHaveBeenCalled();
+    fireEvent.click(screen.getByRole('button', {name: 'Copy install command'}));
+    await vi.waitFor(() => expect(observeCopy).toHaveBeenCalledWith(INSTALL_OPTIONS[0].command));
+  });
   it('opens on the fake-agent variant and shows its command and snippet', async () => {
     const { InstallDialog } = await import('./InstallDialog');
     render(<InstallDialog open onClose={vi.fn()} />);
diff --git a/apps/website/src/components/landing/InstallDialog.tsx b/apps/website/src/components/landing/InstallDialog.tsx
index 09762cb51..8cbe3cad5 100644
--- a/apps/website/src/components/landing/InstallDialog.tsx
+++ b/apps/website/src/components/landing/InstallDialog.tsx
@@ -3,6 +3,7 @@ import { useCallback, useRef, useState, type KeyboardEvent } from 'react';
 import { Modal } from '../ui/Modal';
 import { Button } from '../ui/Button';
 import { trackCtaClick } from '../../lib/analytics/client';
+import { observeInstallCopy } from '../../lib/growth/website-collector';
 import {
   COMPONENT_SNIPPET,
   HERO_PRIMARY_LABEL,
@@ -37,7 +38,9 @@ export function InstallDialog({ open, onClose }: InstallDialogProps) {
   const copy = useCallback(async () => {
     trackCtaClick({ cta_id: 'hero_install', adapter: option.key, track: 'developer', surface: 'home' });
     try {
-      await navigator.clipboard?.writeText(option.command);
+      if (!navigator.clipboard?.writeText) return;
+      await navigator.clipboard.writeText(option.command);
+      observeInstallCopy(option.command);
       setCopied(true);
       setTimeout(() => setCopied(false), COPY_FEEDBACK_MS);
     } catch {
diff --git a/apps/website/src/components/shared/WebsiteSignals.spec.tsx b/apps/website/src/components/shared/WebsiteSignals.spec.tsx
new file mode 100644
index 000000000..1db8b8560
--- /dev/null
+++ b/apps/website/src/components/shared/WebsiteSignals.spec.tsx
@@ -0,0 +1,17 @@
+import { render } from '@testing-library/react';
+const mocks = vi.hoisted(() => ({ path: '/', observe: vi.fn() }));
+vi.mock('next/navigation', () => ({ usePathname: () => mocks.path }));
+vi.mock('../../lib/growth/website-collector', () => ({
+  observeWebsitePath: mocks.observe,
+}));
+import { WebsiteSignals } from './WebsiteSignals';
+it('observes pathname transitions with the server-provided catalog', () => {
+  const catalog = {
+    '/': { contentId: 'home', topic: 'getting_started' as const },
+  };
+  const view = render(<WebsiteSignals catalog={catalog} />);
+  expect(mocks.observe).toHaveBeenLastCalledWith('/', catalog);
+  mocks.path = '/docs';
+  view.rerender(<WebsiteSignals catalog={catalog} />);
+  expect(mocks.observe).toHaveBeenLastCalledWith('/docs', catalog);
+});
diff --git a/apps/website/src/components/shared/WebsiteSignals.tsx b/apps/website/src/components/shared/WebsiteSignals.tsx
new file mode 100644
index 000000000..3342185b3
--- /dev/null
+++ b/apps/website/src/components/shared/WebsiteSignals.tsx
@@ -0,0 +1,12 @@
+'use client';
+import { useEffect } from 'react';
+import { usePathname } from 'next/navigation';
+import { observeWebsitePath } from '../../lib/growth/website-collector';
+import type { WebsiteCatalog } from '../../lib/growth/website-metadata';
+export function WebsiteSignals({ catalog }: { catalog: WebsiteCatalog }) {
+  const pathname = usePathname();
+  useEffect(() => {
+    if (pathname) observeWebsitePath(pathname, catalog);
+  }, [pathname, catalog]);
+  return null;
+}
diff --git a/apps/website/src/lib/growth/acquisition-session.ts b/apps/website/src/lib/growth/acquisition-session.ts
new file mode 100644
index 000000000..5b0a0e337
--- /dev/null
+++ b/apps/website/src/lib/growth/acquisition-session.ts
@@ -0,0 +1,53 @@
+const KEY = 'threadplane_acquisition_session_v1';
+const TTL = 30 * 60 * 1000;
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+type Session = { id: string; expiresAt: number };
+let memory: Session | undefined;
+let memoryOnly = false;
+function valid(value: Session | undefined, now: number): value is Session {
+  return (
+    !!value &&
+    typeof value.id === 'string' &&
+    UUID.test(value.id) &&
+    Number.isFinite(value.expiresAt) &&
+    value.expiresAt > now &&
+    value.expiresAt <= now + TTL
+  );
+}
+export function getAcquisitionSession(now = Date.now()): {
+  id: string;
+  scope: 'session' | 'memory';
+} {
+  let unavailable = false;
+  let serialized: string | null = null;
+  try {
+    serialized = sessionStorage.getItem(KEY);
+  } catch {
+    unavailable = true;
+  }
+  try {
+    const stored = JSON.parse(serialized ?? 'null') as Session | undefined;
+    if (valid(stored, now)) {
+      memory = stored;
+      memoryOnly = false;
+      return { id: stored.id.toLowerCase(), scope: 'session' };
+    }
+  } catch {
+    // Invalid stored JSON is a fresh session, not blocked storage.
+    memoryOnly = false;
+  }
+  if ((unavailable || memoryOnly) && valid(memory, now))
+    return { id: memory.id, scope: 'memory' };
+  const id = globalThis.crypto.randomUUID();
+  if (!UUID.test(id)) throw new Error('A secure UUID generator is required');
+  memory = { id, expiresAt: now + TTL };
+  try {
+    sessionStorage.setItem(KEY, JSON.stringify(memory));
+    memoryOnly = false;
+    return { id, scope: 'session' };
+  } catch {
+    memoryOnly = true;
+    return { id, scope: 'memory' };
+  }
+}
diff --git a/apps/website/src/lib/growth/form-client.spec.ts b/apps/website/src/lib/growth/form-client.spec.ts
index 002b11749..3c04a21d8 100644
--- a/apps/website/src/lib/growth/form-client.spec.ts
+++ b/apps/website/src/lib/growth/form-client.spec.ts
@@ -14,6 +14,39 @@ describe('growth form request snapshots', () => {
     sessionStorage.clear();
     vi.restoreAllMocks();
   });
+  it('replaces malformed readable storage instead of reusing earlier memory', () => {
+    sessionStorage.setItem(
+      SESSION_KEY,
+      JSON.stringify({
+        id: '30000000-0000-4000-8000-000000000003',
+        expiresAt: 2000,
+      })
+    );
+    const prior = getAcquisitionSessionId(1000);
+    sessionStorage.setItem(SESSION_KEY, '{invalid');
+    expect(getAcquisitionSessionId(1000)).not.toBe(prior);
+  });
+  it('keeps a memory session when reads work but storage writes fail', () => {
+    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new Error('read only');
+    });
+    const id = getAcquisitionSessionId();
+    expect(getAcquisitionSessionId()).toBe(id);
+  });
+  it('shares one memory identity between website activity and form snapshots when storage is blocked', () => {
+    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
+      throw new Error('blocked');
+    });
+    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new Error('blocked');
+    });
+    const id = getAcquisitionSessionId();
+    expect(getAcquisitionSessionId()).toBe(id);
+    expect(
+      growthFormRequestSnapshot(null, { email: 'synthetic@example.invalid' })
+        .acquisition_session_id
+    ).toBe(id);
+  });
 
   it('reuses only a valid unexpired acquisition session UUID', () => {
     sessionStorage.setItem(
diff --git a/apps/website/src/lib/growth/form-client.ts b/apps/website/src/lib/growth/form-client.ts
index 3813c3b19..3a243b266 100644
--- a/apps/website/src/lib/growth/form-client.ts
+++ b/apps/website/src/lib/growth/form-client.ts
@@ -1,53 +1,14 @@
-const ACQUISITION_SESSION_KEY = 'threadplane_acquisition_session_v1';
-const ACQUISITION_SESSION_TTL_MS = 30 * 60 * 1_000;
-const UUID_V4 =
-  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu;
+import { getAcquisitionSession } from './acquisition-session';
 
 export const FORM_POLICY_REFRESH_MESSAGE =
   'This form changed. Refresh the page before submitting again.';
 
-interface StoredSession {
-  id: string;
-  expiresAt: number;
-}
-
 function newUuid(): string {
   return globalThis.crypto.randomUUID();
 }
 
 export function getAcquisitionSessionId(now = Date.now()): string {
-  try {
-    const raw = sessionStorage.getItem(ACQUISITION_SESSION_KEY);
-    if (raw) {
-      const parsed = JSON.parse(raw) as StoredSession;
-      if (
-        typeof parsed.id === 'string' &&
-        UUID_V4.test(parsed.id) &&
-        typeof parsed.expiresAt === 'number' &&
-        Number.isFinite(parsed.expiresAt) &&
-        parsed.expiresAt > now &&
-        parsed.expiresAt <= now + ACQUISITION_SESSION_TTL_MS
-      ) {
-        return parsed.id.toLowerCase();
-      }
-    }
-  } catch {
-    // Storage availability must not block form submission.
-  }
-
-  const id = newUuid();
-  if (!UUID_V4.test(id)) {
-    throw new Error('A secure UUID generator is required');
-  }
-  try {
-    sessionStorage.setItem(
-      ACQUISITION_SESSION_KEY,
-      JSON.stringify({ id, expiresAt: now + ACQUISITION_SESSION_TTL_MS })
-    );
-  } catch {
-    // The request can still carry the in-memory acquisition identity.
-  }
-  return id;
+  return getAcquisitionSession(now).id;
 }
 
 export type GrowthFormJsonPrimitive = boolean | number | string | null;
diff --git a/apps/website/src/lib/growth/website-collector.spec.ts b/apps/website/src/lib/growth/website-collector.spec.ts
new file mode 100644
index 000000000..fab1b31f6
--- /dev/null
+++ b/apps/website/src/lib/growth/website-collector.spec.ts
@@ -0,0 +1,135 @@
+import { randomUUID } from 'node:crypto';
+import { createWebsiteCollector, sendWebsiteBatch } from './website-collector';
+import type { WebsiteCatalog } from './website-metadata';
+
+function setup(enabled = true) {
+  const send = vi.fn(
+    async (_events: Parameters<typeof sendWebsiteBatch>[0]) => ({ status: 200 })
+  );
+  let time = Date.parse('2026-09-04T12:00:00Z');
+  const schedule = vi.fn();
+  const session = { id: randomUUID(), scope: 'session' as const };
+  const catalog: WebsiteCatalog = Object.fromEntries(
+    Array.from({ length: 80 }, (_, i) => [
+      `/page-${i}`,
+      { contentId: `page-${i}`, topic: 'other' },
+    ])
+  );
+  const collector = createWebsiteCollector({
+    enabled,
+    catalog,
+    session: () => session,
+    now: () => new Date(time),
+    uuid: randomUUID,
+    send,
+    schedule,
+    context: () => ({
+      search: '?utm_source=newsletter&secret=private',
+      referrer: 'https://example.org/private?token=secret',
+    }),
+  });
+  return {
+    collector,
+    send,
+    schedule,
+    session,
+    advance: (ms: number) => {
+      time += ms;
+    },
+  };
+}
+describe('bounded website collection', () => {
+  it('honors Retry-After when a new event queued an immediate timer during the request', async () => {
+    const timers: { callback: () => void; delay: number }[] = [];
+    let resolve!: (value: { status: number; retryAfterMs: number }) => void;
+    const send = vi.fn(
+      () =>
+        new Promise<{ status: number; retryAfterMs: number }>((done) => {
+          resolve = done;
+        })
+    );
+    const collector = createWebsiteCollector({
+      enabled: true,
+      catalog: {
+        '/a': { contentId: 'a', topic: 'other' },
+        '/b': { contentId: 'b', topic: 'other' },
+      },
+      session: () => ({
+        id: '11111111-1111-4111-8111-111111111111',
+        scope: 'session',
+      }),
+      now: () => new Date('2026-09-04T12:00:00Z'),
+      uuid: randomUUID,
+      context: () => ({ search: '', referrer: '' }),
+      send,
+      schedule: (callback, delay) => {
+        timers.push({ callback, delay });
+      },
+    });
+    collector.view('/a');
+    timers.shift()!.callback();
+    collector.view('/b');
+    resolve({ status: 429, retryAfterMs: 60000 });
+    await Promise.resolve();
+    await Promise.resolve();
+    timers.shift()!.callback();
+    expect(send).toHaveBeenCalledTimes(1);
+    expect(timers.at(-1)?.delay).toBe(60000);
+  });
+  it('shares session context, deduplicates page/copy signals and sends only metadata', async () => {
+    const { collector, send, session } = setup();
+    collector.view('/page-0');
+    collector.view('/page-0');
+    collector.copied('npm i @threadplane/chat');
+    collector.copied('npm i @threadplane/chat');
+    await collector.flush();
+    const events = send.mock.calls[0][0];
+    expect(events.map((event) => event.kind)).toEqual([
+      'website.session_started',
+      'website.content_viewed',
+      'website.install_command_copied',
+    ]);
+    expect(events.every((event) => event.subject.id === session.id)).toBe(true);
+    expect(JSON.stringify(events)).not.toMatch(/private|secret|token|npm i/);
+  });
+  it('retains event UUIDs during a bounded retry', async () => {
+    const { collector, send, advance } = setup();
+    send.mockResolvedValueOnce({ status: 503 });
+    collector.view('/page-1');
+    await collector.flush();
+    advance(1000);
+    await collector.flush();
+    expect(send.mock.calls[1][0]).toEqual(send.mock.calls[0][0]);
+    expect(send).toHaveBeenCalledTimes(2);
+  });
+  it('bounds event volume and stops retrying after three attempts', async () => {
+    const { collector, send, advance } = setup();
+    send.mockResolvedValue({ status: 503 });
+    for (let i = 0; i < 80; i++) collector.view(`/page-${i}`);
+    for (let i = 0; i < 10; i++) {
+      await collector.flush();
+      advance(60000);
+    }
+    expect(send).toHaveBeenCalledTimes(6);
+    expect(send.mock.calls.every(([events]) => events.length <= 20)).toBe(true);
+  });
+  it('does nothing while disabled', async () => {
+    const { collector, send, schedule } = setup(false);
+    collector.view('/page-1');
+    collector.copied('npm i @threadplane/chat');
+    await collector.flush();
+    expect(send).not.toHaveBeenCalled();
+    expect(schedule).not.toHaveBeenCalled();
+  });
+  it('treats a malformed acknowledgement as retryable and omits credentials', async () => {
+    const fetcher = vi.fn(
+      async (_input: RequestInfo | URL, _init?: RequestInit) =>
+        new Response('{}', { status: 200 })
+    );
+    expect((await sendWebsiteBatch([], fetcher)).status).toBe(503);
+    expect(fetcher.mock.calls[0][1]).toMatchObject({
+      credentials: 'omit',
+      keepalive: true,
+    });
+  });
+});
diff --git a/apps/website/src/lib/growth/website-collector.ts b/apps/website/src/lib/growth/website-collector.ts
new file mode 100644
index 000000000..64a4b1f7a
--- /dev/null
+++ b/apps/website/src/lib/growth/website-collector.ts
@@ -0,0 +1,220 @@
+// Type-only use of the internal contract does not bundle server code.
+// eslint-disable-next-line @nx/enforce-module-boundaries
+import type { CollectionEventV1 } from '@threadplane-internal/growth';
+import { getAcquisitionSession } from './acquisition-session';
+import {
+  acquisitionProperties,
+  contentForPath,
+  installedPackages,
+  type WebsiteCatalog,
+} from './website-metadata';
+
+type Delivery = { status: number; retryAfterMs?: number };
+interface Dependencies {
+  enabled: boolean;
+  catalog: WebsiteCatalog;
+  session(): { id: string; scope: 'session' | 'memory' };
+  now(): Date;
+  uuid(): string;
+  context(): { search: string; referrer: string };
+  send(events: CollectionEventV1[]): Promise<Delivery>;
+  schedule(callback: () => void, delay: number): void;
+}
+export function createWebsiteCollector(deps: Dependencies) {
+  const queue: CollectionEventV1[] = [];
+  let pending: { events: CollectionEventV1[]; attempts: number } | undefined;
+  let sessionId = '',
+    count = 0,
+    busy = false,
+    scheduled = false;
+  let retryNotBefore = 0;
+  const seen = new Set<string>();
+  function schedule(delay = 0) {
+    if (scheduled) return;
+    scheduled = true;
+    deps.schedule(() => {
+      scheduled = false;
+      void flush();
+    }, delay);
+  }
+  function add(
+    kind: string,
+    properties: Record<string, string>,
+    session: ReturnType<Dependencies['session']>
+  ) {
+    if (count >= 40 || queue.length + (pending?.events.length ?? 0) >= 40)
+      return;
+    queue.push({
+      eventId: deps.uuid(),
+      kind,
+      occurredAt: deps.now().toISOString(),
+      collectorVersion: 'website-v1',
+      subject: {
+        id: session.id,
+        namespace: 'website_session',
+        scope: session.scope,
+      },
+      properties,
+    });
+    count++;
+    schedule();
+  }
+  function record(
+    kind: string,
+    properties: Record<string, string>,
+    key: string
+  ) {
+    if (!deps.enabled) return;
+    try {
+      const session = deps.session();
+      if (sessionId !== session.id) {
+        sessionId = session.id;
+        count = 0;
+        seen.clear();
+        const context = deps.context();
+        add(
+          'website.session_started',
+          acquisitionProperties(context.search, context.referrer),
+          session
+        );
+      }
+      if (seen.has(key)) return;
+      seen.add(key);
+      add(kind, properties, session);
+    } catch {
+      /* Analytics must not interrupt the page or form. */
+    }
+  }
+  async function flush() {
+    if (!deps.enabled || busy) return;
+    const remaining = retryNotBefore - deps.now().getTime();
+    if (remaining > 0) {
+      schedule(remaining);
+      return;
+    }
+    if (!pending && queue.length)
+      pending = { events: queue.splice(0, 20), attempts: 0 };
+    if (!pending) return;
+    busy = true;
+    const delivery = pending;
+    delivery.attempts++;
+    let result: Delivery;
+    try {
+      result = await deps.send(delivery.events);
+    } catch {
+      result = { status: 503 };
+    }
+    busy = false;
+    const retryable = result.status === 429 || result.status >= 500;
+    if (retryable && delivery.attempts < 3) {
+      const delay = Math.max(
+        1000,
+        Math.min(60000, result.retryAfterMs ?? 1000 * delivery.attempts)
+      );
+      retryNotBefore = deps.now().getTime() + delay;
+      schedule(delay);
+    } else {
+      retryNotBefore = 0;
+      pending = undefined;
+      if (queue.length) schedule();
+    }
+  }
+  return {
+    view(pathname: string) {
+      const content = contentForPath(pathname, deps.catalog);
+      if (content)
+        record(
+          'website.content_viewed',
+          { ...content },
+          `content:${content.contentId}`
+        );
+    },
+    copied(command: string) {
+      for (const packageName of installedPackages(command))
+        record(
+          'website.install_command_copied',
+          { packageName },
+          `copy:${packageName}`
+        );
+    },
+    flush,
+  };
+}
+
+export async function sendWebsiteBatch(
+  events: CollectionEventV1[],
+  fetcher: typeof fetch = fetch
+): Promise<Delivery> {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 3000);
+  try {
+    const response = await fetcher('/api/growth/collect/v1/website', {
+      method: 'POST',
+      credentials: 'omit',
+      referrerPolicy: 'no-referrer',
+      keepalive: true,
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ schemaVersion: 1, events }),
+      signal: controller.signal,
+    });
+    if (response.status === 200) {
+      const ack = await response.json();
+      if (
+        ack?.schemaVersion !== 1 ||
+        !Array.isArray(ack.events) ||
+        ack.events.length !== events.length ||
+        ack.events.some(
+          (
+            receipt: { eventId?: string; disposition?: string },
+            index: number
+          ) =>
+            receipt?.eventId !== events[index].eventId ||
+            !['accepted', 'duplicate', 'redacted'].includes(
+              receipt?.disposition ?? ''
+            )
+        )
+      )
+        return { status: 503 };
+    }
+    const retry = Number(response.headers.get('retry-after'));
+    return {
+      status: response.status,
+      ...(Number.isFinite(retry) && retry > 0
+        ? { retryAfterMs: retry * 1000 }
+        : {}),
+    };
+  } catch {
+    return { status: 503 };
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+const browserCatalog: Record<string, WebsiteCatalog[string]> = {};
+let browserCollector: ReturnType<typeof createWebsiteCollector> | undefined;
+function collector() {
+  return (browserCollector ??= createWebsiteCollector({
+    enabled:
+      process.env.NEXT_PUBLIC_GROWTH_WEBSITE_COLLECTION_ENABLED === 'true',
+    catalog: browserCatalog,
+    session: getAcquisitionSession,
+    now: () => new Date(),
+    uuid: () => crypto.randomUUID(),
+    context: () => ({
+      search: window.location.search,
+      referrer: document.referrer,
+    }),
+    send: sendWebsiteBatch,
+    schedule: (callback, delay) => {
+      setTimeout(callback, delay);
+    },
+  }));
+}
+export function observeWebsitePath(pathname: string, catalog: WebsiteCatalog) {
+  if (typeof window === 'undefined') return;
+  Object.assign(browserCatalog, catalog);
+  collector().view(pathname);
+}
+export function observeInstallCopy(command: string) {
+  if (typeof window !== 'undefined') collector().copied(command);
+}
diff --git a/docs/RELEASE.md b/docs/RELEASE.md
index 7aab5a60e..844c3c517 100644
--- a/docs/RELEASE.md
+++ b/docs/RELEASE.md
@@ -2,6 +2,8 @@
 
 The six publishable libraries (`@threadplane/chat`, `@threadplane/langgraph`, `@threadplane/ag-ui`, `@threadplane/render`, `@threadplane/a2ui`, `@threadplane/telemetry`) ship together at a synchronized version via Nx Release. During the `0.0.x` exploratory phase, only patch bumps are used.
 
+Nx updates internal dependency and peer ranges with the synchronized release. `preserveMatchingDependencyRanges` is disabled so a prior `^0.0.x` peer range cannot block the next patch or leave companion packages on incompatible versions. External dependency ranges remain unchanged.
+
 ## Standard release (second release onward)
 
 > First release? See **[First `@threadplane` release](#first-threadplane-release)** below — the flow is different because there's no prior package under the new npm org yet.
@@ -49,10 +51,13 @@ git push origin main --tags
 > Always `--dry-run` step 2 first and check the printed tag URL before
 > committing to it.
 
-Step 4 is what actually ships. You can also publish from your machine with
-`npx nx release publish --groups=publishable`, but preferring the tag-driven
-workflow means no local npm credentials are needed and provenance is attested
-by CI.
+Step 4 is what actually ships. Prefer the tag-driven workflow: it rebuilds the
+versioned sources, runs the package gates, and publishes with provenance without
+local npm credentials. If publishing locally, first rebuild all six packages
+and Growth, then run `telemetry:test-install-pack` and
+`telemetry:test-development-bundle` before `npx nx release publish --groups=publishable`.
+The version command's pre-build embeds the old runtime version; a rebuild after
+versioning is required to align collector payloads with the new package manifests.
 
 ### Check the lockfile before pushing
 
@@ -133,6 +138,6 @@ While the API is still settling we bump only the patch component (`0.0.1` → `0
 
 When the API stabilizes enough to make compatibility promises, transition to `0.1.0` and start using minor/major bumps with conventional-commit-driven semver.
 
-## Why peerDeps use `*` between Threadplane libs
+## Internal peer dependencies
 
-Caret-prefixed ranges (`^0.0.1`) in `0.0.x` don't include subsequent patches because npm semver treats `0.0.x` as breaking. Using `"*"` for inter-Threadplane peerDeps during this phase avoids the range-narrowing problem; the synchronized release group ensures all libs ship the same version anyway. Switch back to `^X.Y.Z` once we hit `0.1.0`.
+Caret-prefixed ranges (`^0.0.1`) do not include subsequent `0.0.x` patches. Nx updates internal peers during each synchronized release so a newly installed package resolves compatible companion APIs. Do not preserve stale narrow ranges or manually restore wildcard peers after versioning.
diff --git a/eslint.config.mjs b/eslint.config.mjs
index ba656ed0c..25c3a9cb4 100644
--- a/eslint.config.mjs
+++ b/eslint.config.mjs
@@ -13,6 +13,7 @@ export default [
       '**/.vercel',
       '**/.vercel/**',
       '**/next-env.d.ts',
+      '**/.install-collector/**',
     ],
   },
   {
diff --git a/libs/ag-ui/.install-collector/development-install.d.ts b/libs/ag-ui/.install-collector/development-install.d.ts
new file mode 100644
index 000000000..873f0eada
--- /dev/null
+++ b/libs/ag-ui/.install-collector/development-install.d.ts
@@ -0,0 +1 @@
+export declare const installationToken: string | null;
diff --git a/libs/ag-ui/.install-collector/development-install.mjs b/libs/ag-ui/.install-collector/development-install.mjs
new file mode 100644
index 000000000..2a0dd3c8b
--- /dev/null
+++ b/libs/ag-ui/.install-collector/development-install.mjs
@@ -0,0 +1 @@
+export const installationToken = null;
diff --git a/libs/ag-ui/README.md b/libs/ag-ui/README.md
index d47a487a2..7c613242d 100644
--- a/libs/ag-ui/README.md
+++ b/libs/ag-ui/README.md
@@ -182,6 +182,70 @@ so there is no adapter-specific mock. See
 
 ---
 
+## Installation collection
+
+This package includes automatic first-party installation collection, including CI.
+It reports the package/version, basic execution environment, a random installation
+identifier, configured Git display name and full email, and a recognized repository
+hosting provider/owner when available. CI is labeled separately; install counts are
+not developer counts, and Git identity is an unverified hint. A usable install email
+can qualify for the generic founder hello after a linked development activation;
+this does not verify email ownership, employment, or account membership. Existing
+unsubscribe, reply, bounce, and suppression controls still apply.
+
+An enabled non-CI install writes a random package-local correlation token to the
+`./development-install` export. It contains no email or Git metadata and is separate
+from the home installation ID. Published packages contain null; development runtime
+events can carry the installed token. Production bundles remove it and do not collect
+runtime events. CI alone cannot create an eligible bridge or trigger a hello.
+
+Disabled and CI lifecycle runs first try to reset an earlier token to null. Copied or
+cached packages can retain tokens: read-only packages may prevent that reset, and
+skipped scripts leave existing files unchanged. A token therefore does not prove a
+unique installation or developer. The independent browser opt-out below still stops
+runtime transmission, including when a stale token remains.
+
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installing to disable
+collection before identity reads, persistence, or network. Package-manager controls
+such as `--ignore-scripts` also prevent the hook from running. Installation succeeds
+independently of collection, with one request and a five-second execution budget.
+
+The random ID is stored at `~/.threadplane/installation-id` where writable; otherwise
+it lasts for one invocation. Git includes, system config, and command/environment
+identity overrides are not inspected. Unsupported checkout/configuration layouts,
+blocked scripts or network, and reused caches can leave gaps or duplicate identities.
+Raw repository URLs/names, local paths, source code, credentials, and application
+content are excluded from install reports. See [Privacy](https://threadplane.ai/privacy).
+
 ## License
 
 MIT. See [LICENSE](../../LICENSE).
+
+## Development browser collection
+
+Supported LangGraph/AG-UI runtime use and real JSON-render component mounts automatically
+report development progress to Threadplane. Angular development mode and browser APIs
+are required. Production builds, SSR, imports, unused adapter construction, and
+automated browsers reporting `navigator.webdriver` are inert.
+Reports contain package/version, integration, closed milestones, timestamps, a random
+browser-origin ID, and a session with a 30-minute inactivity boundary. They exclude
+prompts, messages, application state, private URLs, thread/run IDs, and credentials.
+The IDs describe an origin/session, not a verified person or repository.
+
+Set adapter `telemetry: false` to disable automatic collection; a custom sink replaces
+the automatic destination while preserving its existing callbacks. Chat carries that
+choice into nested JSON renderers. Standalone render supports
+`provideRender({ telemetry: false })` or `<render-spec [telemetry]="false" ... />`.
+
+For a page-wide control, call `setDevelopmentCollectionEnabled(false)` from
+`@threadplane/telemetry/browser` before creating runtimes. From the browser console,
+run `localStorage.setItem('THREADPLANE_TELEMETRY_DISABLED', '1')` and reload.
+Node environment variables do not configure a compiled browser app.
+
+The credential-free announcement exchange records progress before returning optional
+plain-text console announcements. No click or registration is required. It has bounded
+queues/retries and a three-second request deadline; collection failures do not affect
+application use. A linked eligible install email can receive the generic founder hello;
+runtime evidence alone does not approve a contact. See the
+[telemetry controls and collection details](https://github.com/cacheplane/angular-agent-framework/tree/main/libs/telemetry#automatic-development-runtime-collection)
+and [Privacy](https://threadplane.ai/privacy).
diff --git a/libs/ag-ui/install/postinstall.cjs b/libs/ag-ui/install/postinstall.cjs
new file mode 100644
index 000000000..ced868227
--- /dev/null
+++ b/libs/ag-ui/install/postinstall.cjs
@@ -0,0 +1,2 @@
+// Contributor workspace installs are inert. ng-packagr replaces this path in
+// published packages with the shared collector from .install-collector.
diff --git a/libs/ag-ui/ng-package.json b/libs/ag-ui/ng-package.json
index b5a8f5200..197b8bed1 100644
--- a/libs/ag-ui/ng-package.json
+++ b/libs/ag-ui/ng-package.json
@@ -4,5 +4,22 @@
   "lib": {
     "entryFile": "src/public-api.ts"
   },
-  "assets": [{ "input": ".", "glob": "LICENSE.md", "output": "." }]
+  "assets": [
+    {
+      "input": ".install-collector",
+      "glob": "development-install.*",
+      "output": ".install-collector"
+    },
+    {
+      "input": ".",
+      "glob": "LICENSE.md",
+      "output": "."
+    },
+    {
+      "input": ".install-collector",
+      "glob": "*.cjs",
+      "output": "install"
+    }
+  ],
+  "keepLifecycleScripts": true
 }
diff --git a/libs/ag-ui/package.json b/libs/ag-ui/package.json
index e96555e50..c05a4fd35 100644
--- a/libs/ag-ui/package.json
+++ b/libs/ag-ui/package.json
@@ -11,6 +11,7 @@
   ],
   "peerDependencies": {
     "@threadplane/chat": "*",
+    "@threadplane/telemetry": "^0.0.65",
     "@angular/core": "^20.0.0 || ^21.0.0 || ^22.0.0",
     "@ag-ui/client": "*",
     "@ag-ui/core": "*",
@@ -26,5 +27,20 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "exports": {
+    "./development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "./.install-collector/development-install.mjs"
+    }
+  },
+  "imports": {
+    "#development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "@threadplane/ag-ui/development-install"
+    }
+  },
+  "scripts": {
+    "postinstall": "node install/postinstall.cjs"
+  }
 }
diff --git a/libs/ag-ui/project.json b/libs/ag-ui/project.json
index 9bee978a4..3df97734c 100644
--- a/libs/ag-ui/project.json
+++ b/libs/ag-ui/project.json
@@ -30,7 +30,15 @@
         },
         "development": {}
       },
-      "defaultConfiguration": "production"
+      "defaultConfiguration": "production",
+      "inputs": [
+        "production",
+        "^production",
+        "!{projectRoot}/.install-collector/**",
+        "{workspaceRoot}/libs/telemetry/install/*",
+        "!{projectRoot}/src/lib/package-version.ts"
+      ],
+      "dependsOn": ["^build", "prepare-install"]
     },
     "nx-release-publish": {
       "options": {
@@ -44,13 +52,32 @@
       "executor": "@nx/vitest:test",
       "options": {
         "configFile": "libs/ag-ui/vite.config.mts"
-      }
+      },
+      "dependsOn": ["prepare-install"]
     },
     "type-tests": {
       "executor": "nx:run-commands",
       "options": {
         "command": "npx tsc --noEmit -p libs/ag-ui/tsconfig.type-tests.json"
       }
+    },
+    "prepare-install": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": [
+        "{workspaceRoot}/libs/telemetry/install/*.cjs",
+        "{workspaceRoot}/libs/telemetry/install/assemble-package.mjs",
+        "{projectRoot}/package.json"
+      ],
+      "outputs": [
+        "{projectRoot}/.install-collector",
+        "{projectRoot}/src/lib/package-version.ts"
+      ],
+      "options": {
+        "command": "node libs/telemetry/install/assemble-package.mjs ag-ui",
+        "forwardAllArgs": false
+      }
     }
-  }
+  },
+  "implicitDependencies": ["telemetry"]
 }
diff --git a/libs/ag-ui/src/lib/package-version.ts b/libs/ag-ui/src/lib/package-version.ts
new file mode 100644
index 000000000..5fc748ce1
--- /dev/null
+++ b/libs/ag-ui/src/lib/package-version.ts
@@ -0,0 +1,3 @@
+// Generated by the package preparation target from package.json.
+// prettier-ignore
+export const THREADPLANE_PACKAGE_VERSION = "0.0.65";
diff --git a/libs/ag-ui/src/lib/provide-agent.ts b/libs/ag-ui/src/lib/provide-agent.ts
index ae6a659a2..f98c81d90 100644
--- a/libs/ag-ui/src/lib/provide-agent.ts
+++ b/libs/ag-ui/src/lib/provide-agent.ts
@@ -21,7 +21,11 @@ export interface AgentConfig {
   threadId?: string;
   /** Extra HTTP headers sent with every request (e.g. auth tokens). */
   headers?: Record<string, string>;
-  /** Optional app-owned sink. Supply one to receive runtime lifecycle events. */
+  /**
+   * Omit to enable automatic development-only collection. Set `false` to disable.
+   * An app-owned sink replaces the automatic destination and receives the
+   * existing runtime lifecycle callbacks.
+   */
   telemetry?: AgentRuntimeTelemetrySink | false;
 }
 
diff --git a/libs/ag-ui/src/lib/to-agent.spec.ts b/libs/ag-ui/src/lib/to-agent.spec.ts
index 7e95637f9..88ba5432c 100644
--- a/libs/ag-ui/src/lib/to-agent.spec.ts
+++ b/libs/ag-ui/src/lib/to-agent.spec.ts
@@ -9,6 +9,116 @@ import {
   type AgentRuntimeTelemetryPayload,
 } from '@threadplane/chat';
 import { toAgent, ɵtoAgentWithProtectedErrors } from './to-agent';
+import { isDevelopmentRuntimeEnabled } from '@threadplane/telemetry/browser';
+
+const developmentEvidence = vi.hoisted(() => ({ events: [] as string[], touches: 0 }));
+vi.mock('@threadplane/telemetry/browser', async (importOriginal) => ({
+  ...await importOriginal<object>(),
+  createDevelopmentRuntime: (options: { enabled?: () => boolean }) => ({
+    touch: () => { if (options.enabled?.() !== false) developmentEvidence.touches++; },
+    milestone: (kind: string) => { if (options.enabled?.() !== false) developmentEvidence.events.push(kind); },
+    dispose: () => undefined,
+  }),
+}));
+
+describe('automatic development evidence', () => {
+  it.each(['invalid', { type: 'unknown' }])('does not count a malformed RUN_FINISHED outcome: %j', async outcome => {
+    developmentEvidence.events = [];
+    const stub = new StubAgent();
+    const agent = toAgent(stub as unknown as AbstractAgent);
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'RUN_FINISHED', outcome } as unknown as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({});
+    expect(developmentEvidence.events).not.toContain('transport.connected');
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+  });
+  it('propagates the automatic destination policy with the returned agent', () => {
+    for (const telemetry of [undefined, false, vi.fn()] as const) {
+      const agent = toAgent(new StubAgent() as unknown as AbstractAgent, { telemetry });
+      expect(isDevelopmentRuntimeEnabled(agent)).toBe(telemetry === undefined);
+    }
+  });
+  it('requires a current RUN_FINISHED success, and ignores construction and empty close', async () => {
+    developmentEvidence.events = []; developmentEvidence.touches = 0;
+    const stub = new StubAgent();
+    const agent = toAgent(stub as unknown as AbstractAgent);
+    expect(developmentEvidence.touches).toBe(0);
+    await agent.submit({});
+    expect(developmentEvidence.touches).toBe(1);
+    expect(developmentEvidence.events).toEqual([]);
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'UNKNOWN' } as BaseEvent);
+      expect(developmentEvidence.events).toEqual([]);
+      stub.emit({ type: 'RUN_STARTED', runId: 'success' } as BaseEvent);
+      stub.emit({ type: 'RUN_FINISHED', runId: 'success' } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({});
+    expect(developmentEvidence.events).toContain('transport.connected');
+    expect(developmentEvidence.events).toContain('runtime.first_stream_completed');
+    expect(developmentEvidence.events).not.toContain('thread.persisted');
+  });
+
+  it.each([false, vi.fn()] as const)('suppresses automatic events for an explicit sink %s', async telemetry => {
+    developmentEvidence.events = []; developmentEvidence.touches = 0;
+    const stub = new StubAgent();
+    const agent = toAgent(stub as unknown as AbstractAgent, { telemetry });
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'RUN_FINISHED' } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({});
+    expect(developmentEvidence.events).toEqual([]);
+    expect(developmentEvidence.touches).toBe(0);
+    if (telemetry) expect(telemetry).toHaveBeenCalled();
+  });
+
+  it('counts a completed real interrupt resume, but not bare resumes, failures, stops or stale runs', async () => {
+    developmentEvidence.events = [];
+    const stub = new StubAgent();
+    const agent = toAgent(stub as unknown as AbstractAgent);
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'RUN_FINISHED' } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({ resume: true });
+    expect(developmentEvidence.events).not.toContain('interrupt.handled');
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'RUN_STARTED', runId: 'paused' } as BaseEvent);
+      stub.emit({ type: 'RUN_FINISHED', runId: 'paused', outcome: { type: 'interrupt', interrupts: [{ id: 'i', value: {} }] } } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({});
+    developmentEvidence.events = [];
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'RUN_STARTED', runId: 'resumed' } as BaseEvent);
+      stub.emit({ type: 'RUN_FINISHED', runId: 'resumed' } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({ resume: true });
+    expect(developmentEvidence.events).toContain('interrupt.handled');
+    developmentEvidence.events = [];
+    stub.runAgent.mockImplementationOnce(async () => {
+      stub.emit({ type: 'RUN_STARTED', runId: 'failed' } as BaseEvent);
+      stub.emit({ type: 'RUN_FINISHED', runId: 'resumed' } as BaseEvent, 'resumed');
+      stub.emit({ type: 'RUN_ERROR', runId: 'failed', message: 'failed' } as BaseEvent);
+      stub.emit({ type: 'RUN_FINISHED', runId: 'failed' } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({});
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+    developmentEvidence.events = [];
+    stub.runAgent.mockImplementationOnce(async () => {
+      await agent.stop();
+      stub.emit({ type: 'RUN_FINISHED' } as BaseEvent);
+      return { result: undefined, newMessages: [] };
+    });
+    await agent.submit({});
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+  });
+});
 
 /**
  * Minimal concrete subclass of AbstractAgent for unit testing.
diff --git a/libs/ag-ui/src/lib/to-agent.ts b/libs/ag-ui/src/lib/to-agent.ts
index 00448303b..c4dca3210 100644
--- a/libs/ag-ui/src/lib/to-agent.ts
+++ b/libs/ag-ui/src/lib/to-agent.ts
@@ -1,4 +1,9 @@
-import { computed, signal, type Signal } from '@angular/core';
+import { computed, isDevMode, signal, type Signal } from '@angular/core';
+// eslint-disable-next-line @nx/enforce-module-boundaries -- Keep the postinstall module external through ng-packagr.
+import { installationToken } from '#development-install';
+declare const ngDevMode: boolean;
+import { createDevelopmentRuntime, registerDevelopmentRuntimePolicy } from '@threadplane/telemetry/browser';
+import { THREADPLANE_PACKAGE_VERSION as packageVersion } from './package-version';
 import { Subject } from 'rxjs';
 import type { AbstractAgent } from '@ag-ui/client';
 import type { ResumeEntry } from '@ag-ui/core';
@@ -32,7 +37,11 @@ import {
 import { createClientToolsCapability } from './client-tools';
 
 export interface ToAgentOptions {
-  /** Optional app-owned sink. Supply one to receive runtime lifecycle events. */
+  /**
+   * Omit to enable automatic development-only collection. Set `false` to disable.
+   * An app-owned sink replaces the automatic destination and receives the
+   * existing runtime lifecycle callbacks.
+   */
   telemetry?: AgentRuntimeTelemetrySink | false;
   /**
    * A2UI client capabilities (catalog negotiation) to advertise to the agent.
@@ -154,9 +163,15 @@ function createAgentAdapter(
     allocateDeliveryGeneration,
   };
   const telemetryProperties = { transport: 'ag-ui' as const, surface: 'to_agent' };
+  const developmentRuntime = createDevelopmentRuntime({
+    integration: 'ag-ui', packageName: '@threadplane/ag-ui', packageVersion,
+    installationToken: (typeof ngDevMode === 'undefined' || ngDevMode) && isDevMode() ? installationToken : null,
+    enabled: () => options.telemetry === undefined,
+  });
   interface AdapterRun extends ReducerDeliveryRun {
     startedAt: number;
     telemetrySettled: boolean;
+    resumedInterrupt: boolean;
   }
   let activeRun: AdapterRun | null = null;
   const runsByProtocolId = new Map<string, AdapterRun>();
@@ -203,7 +218,8 @@ function createAgentAdapter(
     telemetryProperties,
   );
 
-  function beginRun(requestType: string, allowBaselineTail = false): AdapterRun {
+  function beginRun(requestType: string, allowBaselineTail = false, resumedInterrupt = false): AdapterRun {
+    developmentRuntime.touch();
     if (activeRun && activeRun.outcome === undefined) {
       const supersededRun = activeRun;
       finalizeDeliveryRun(store, supersededRun, 'interrupted');
@@ -221,6 +237,7 @@ function createAgentAdapter(
         : undefined,
       startedAt: Date.now(),
       telemetrySettled: false,
+      resumedInterrupt,
     };
     activeRun = run;
     store.deliveryRun = run;
@@ -280,8 +297,9 @@ function createAgentAdapter(
     requestType: string,
     parameters?: RunParameters,
     allowBaselineTail = false,
+    resumedInterrupt = false,
   ): Promise<void> {
-    const run = beginRun(requestType, allowBaselineTail);
+    const run = beginRun(requestType, allowBaselineTail, resumedInterrupt);
     const tools = clientToolsCap.catalogAsAgUiTools();
     const runParameters = parameters === undefined && tools.length === 0
       ? undefined
@@ -334,12 +352,21 @@ function createAgentAdapter(
         return;
       }
       if (event.type === 'RUN_ERROR' && run.outcome === 'aborted') return;
+      const hasDevelopmentEvidence = event.type !== 'RUN_FINISHED' || hasValidFinishedOutcome(event);
+      if (run.outcome === undefined && hasDevelopmentEvidence && supportedDevelopmentEventTypes.has(event.type)) {
+        developmentRuntime.milestone('transport.connected');
+      }
       if (event.type === 'RUN_ERROR' && options.protectOperationErrors) {
         failRun(run, undefined);
         return;
       }
+      const wasPending = run.outcome === undefined;
       reduceEvent(event, store);
       if (run && event.type === 'RUN_FINISHED' && run.outcome === 'success') {
+        if (wasPending && hasDevelopmentEvidence && !store.interrupt() && !store.error()) {
+          developmentRuntime.milestone('runtime.first_stream_completed', Date.now() - run.startedAt);
+          if (run.resumedInterrupt) developmentRuntime.milestone('interrupt.handled');
+        }
         finishRunTelemetry(run);
       } else if (run && event.type === 'RUN_ERROR' && run.outcome === 'error') {
         failRunTelemetry((event as { message?: unknown }).message ?? event, run);
@@ -410,7 +437,7 @@ function createAgentAdapter(
     return w;
   }
 
-  return {
+  return registerDevelopmentRuntimePolicy<AgUiAgent>({
     messages:  store.messages,
     status:    store.status,
     isLoading: store.isLoading,
@@ -448,6 +475,7 @@ function createAgentAdapter(
           'resume',
           buildResumeRunParameters(input.resume, pendingInterrupt),
           true,
+          pendingInterrupt !== undefined,
         );
         return;
       }
@@ -527,7 +555,26 @@ function createAgentAdapter(
 
       await executeRun('regenerate');
     },
-  };
+  }, () => options.telemetry === undefined);
+}
+
+const supportedDevelopmentEventTypes = new Set([
+  'RUN_STARTED', 'RUN_FINISHED', 'RUN_ERROR', 'TEXT_MESSAGE_START', 'TEXT_MESSAGE_CONTENT',
+  'TEXT_MESSAGE_END', 'REASONING_MESSAGE_START', 'REASONING_MESSAGE_CONTENT', 'REASONING_MESSAGE_CHUNK',
+  'REASONING_MESSAGE_END', 'TOOL_CALL_START', 'TOOL_CALL_ARGS', 'TOOL_CALL_END', 'TOOL_CALL_RESULT',
+  'STATE_SNAPSHOT', 'STATE_DELTA', 'MESSAGES_SNAPSHOT', 'CUSTOM', 'SUBAGENT_STARTED',
+  'SUBAGENT_FINISHED', 'SUBAGENT_ERROR', 'ACTIVITY_SNAPSHOT', 'ACTIVITY_DELTA',
+]);
+
+/** A malformed outcome must not turn the reducer's legacy fallback into evidence. */
+function hasValidFinishedOutcome(event: object): boolean {
+  const outcome = (event as { outcome?: unknown }).outcome;
+  // The AG-UI schema explicitly accepts absent/null outcomes for older servers.
+  if (outcome == null) return true;
+  if (typeof outcome !== 'object' || Array.isArray(outcome)) return false;
+  const value = outcome as Record<string, unknown>;
+  if (value['type'] === 'success') return true;
+  return value['type'] === 'interrupt' && Array.isArray(value['interrupts']);
 }
 
 function protectedAgentError(): AgentError {
diff --git a/libs/ag-ui/src/test-setup.ts b/libs/ag-ui/src/test-setup.ts
index ca3d8a2b3..a9d981b17 100644
--- a/libs/ag-ui/src/test-setup.ts
+++ b/libs/ag-ui/src/test-setup.ts
@@ -1,4 +1,6 @@
 import { getTestBed } from '@angular/core/testing';
+// Unit tests never send automatic development collection to a live destination.
+(window as Window & { __THREADPLANE_TELEMETRY_DISABLED__?: boolean }).__THREADPLANE_TELEMETRY_DISABLED__ = true;
 import {
   BrowserTestingModule,
   platformBrowserTesting,
diff --git a/libs/chat/.install-collector/development-install.d.ts b/libs/chat/.install-collector/development-install.d.ts
new file mode 100644
index 000000000..873f0eada
--- /dev/null
+++ b/libs/chat/.install-collector/development-install.d.ts
@@ -0,0 +1 @@
+export declare const installationToken: string | null;
diff --git a/libs/chat/.install-collector/development-install.mjs b/libs/chat/.install-collector/development-install.mjs
new file mode 100644
index 000000000..2a0dd3c8b
--- /dev/null
+++ b/libs/chat/.install-collector/development-install.mjs
@@ -0,0 +1 @@
+export const installationToken = null;
diff --git a/libs/chat/README.md b/libs/chat/README.md
index a8d190d4c..236a86d82 100644
--- a/libs/chat/README.md
+++ b/libs/chat/README.md
@@ -322,6 +322,70 @@ Full API reference, capability matrix, and examples: [threadplane.ai/docs/chat](
 
 ---
 
+## Installation collection
+
+This package includes automatic first-party installation collection, including CI.
+It reports the package/version, basic execution environment, a random installation
+identifier, configured Git display name and full email, and a recognized repository
+hosting provider/owner when available. CI is labeled separately; install counts are
+not developer counts, and Git identity is an unverified hint. A usable install email
+can qualify for the generic founder hello after a linked development activation;
+this does not verify email ownership, employment, or account membership. Existing
+unsubscribe, reply, bounce, and suppression controls still apply.
+
+An enabled non-CI install writes a random package-local correlation token to the
+`./development-install` export. It contains no email or Git metadata and is separate
+from the home installation ID. Published packages contain null; development runtime
+events can carry the installed token. Production bundles remove it and do not collect
+runtime events. CI alone cannot create an eligible bridge or trigger a hello.
+
+Disabled and CI lifecycle runs first try to reset an earlier token to null. Copied or
+cached packages can retain tokens: read-only packages may prevent that reset, and
+skipped scripts leave existing files unchanged. A token therefore does not prove a
+unique installation or developer. The independent browser opt-out below still stops
+runtime transmission, including when a stale token remains.
+
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installing to disable
+collection before identity reads, persistence, or network. Package-manager controls
+such as `--ignore-scripts` also prevent the hook from running. Installation succeeds
+independently of collection, with one request and a five-second execution budget.
+
+The random ID is stored at `~/.threadplane/installation-id` where writable; otherwise
+it lasts for one invocation. Git includes, system config, and command/environment
+identity overrides are not inspected. Unsupported checkout/configuration layouts,
+blocked scripts or network, and reused caches can leave gaps or duplicate identities.
+Raw repository URLs/names, local paths, source code, credentials, and application
+content are excluded from install reports. See [Privacy](https://threadplane.ai/privacy).
+
 ## License
 
 MIT. See [LICENSE.md](./LICENSE.md).
+
+## Development browser collection
+
+Supported LangGraph/AG-UI runtime use and real JSON-render component mounts automatically
+report development progress to Threadplane. Angular development mode and browser APIs
+are required. Production builds, SSR, imports, unused adapter construction, and
+automated browsers reporting `navigator.webdriver` are inert.
+Reports contain package/version, integration, closed milestones, timestamps, a random
+browser-origin ID, and a session with a 30-minute inactivity boundary. They exclude
+prompts, messages, application state, private URLs, thread/run IDs, and credentials.
+The IDs describe an origin/session, not a verified person or repository.
+
+Set adapter `telemetry: false` to disable automatic collection; a custom sink replaces
+the automatic destination while preserving its existing callbacks. Chat carries that
+choice into nested JSON renderers. Standalone render supports
+`provideRender({ telemetry: false })` or `<render-spec [telemetry]="false" ... />`.
+
+For a page-wide control, call `setDevelopmentCollectionEnabled(false)` from
+`@threadplane/telemetry/browser` before creating runtimes. From the browser console,
+run `localStorage.setItem('THREADPLANE_TELEMETRY_DISABLED', '1')` and reload.
+Node environment variables do not configure a compiled browser app.
+
+The credential-free announcement exchange records progress before returning optional
+plain-text console announcements. No click or registration is required. It has bounded
+queues/retries and a three-second request deadline; collection failures do not affect
+application use. A linked eligible install email can receive the generic founder hello;
+runtime evidence alone does not approve a contact. See the
+[telemetry controls and collection details](https://github.com/cacheplane/angular-agent-framework/tree/main/libs/telemetry#automatic-development-runtime-collection)
+and [Privacy](https://threadplane.ai/privacy).
diff --git a/libs/chat/install/postinstall.cjs b/libs/chat/install/postinstall.cjs
new file mode 100644
index 000000000..ced868227
--- /dev/null
+++ b/libs/chat/install/postinstall.cjs
@@ -0,0 +1,2 @@
+// Contributor workspace installs are inert. ng-packagr replaces this path in
+// published packages with the shared collector from .install-collector.
diff --git a/libs/chat/ng-package.json b/libs/chat/ng-package.json
index 9cd362bd6..e6be1075e 100644
--- a/libs/chat/ng-package.json
+++ b/libs/chat/ng-package.json
@@ -4,12 +4,46 @@
   "lib": {
     "entryFile": "src/public-api.ts"
   },
-  "allowedNonPeerDependencies": ["@cacheplane/partial-json", "@cacheplane/partial-markdown"],
+  "allowedNonPeerDependencies": [
+    "@cacheplane/partial-json",
+    "@cacheplane/partial-markdown"
+  ],
   "assets": [
-    { "input": "src/lib/styles", "glob": "chat.css", "output": "." },
-    { "input": "src/themes", "glob": "*.css", "output": "themes" },
-    { "input": ".", "glob": "LICENSE.md", "output": "." },
-    { "input": ".", "glob": "NOTICE.md", "output": "." },
-    { "input": ".", "glob": "CHANGELOG.md", "output": "." }
-  ]
+    {
+      "input": ".install-collector",
+      "glob": "development-install.*",
+      "output": ".install-collector"
+    },
+    {
+      "input": "src/lib/styles",
+      "glob": "chat.css",
+      "output": "."
+    },
+    {
+      "input": "src/themes",
+      "glob": "*.css",
+      "output": "themes"
+    },
+    {
+      "input": ".",
+      "glob": "LICENSE.md",
+      "output": "."
+    },
+    {
+      "input": ".",
+      "glob": "NOTICE.md",
+      "output": "."
+    },
+    {
+      "input": ".",
+      "glob": "CHANGELOG.md",
+      "output": "."
+    },
+    {
+      "input": ".install-collector",
+      "glob": "*.cjs",
+      "output": "install"
+    }
+  ],
+  "keepLifecycleScripts": true
 }
diff --git a/libs/chat/package.json b/libs/chat/package.json
index d544294d4..73f4739f3 100644
--- a/libs/chat/package.json
+++ b/libs/chat/package.json
@@ -7,13 +7,18 @@
     "./themes/default-dark.css": "./themes/default-dark.css",
     "./themes/default-light.css": "./themes/default-light.css",
     "./themes/material-dark.css": "./themes/material-dark.css",
-    "./themes/material-light.css": "./themes/material-light.css"
+    "./themes/material-light.css": "./themes/material-light.css",
+    "./development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "./.install-collector/development-install.mjs"
+    }
   },
   "dependencies": {
     "@cacheplane/partial-json": ">=0.1.1 <0.3.0",
     "@cacheplane/partial-markdown": "0.5.8"
   },
   "peerDependencies": {
+    "@threadplane/telemetry": "^0.0.65",
     "zod": "^3.25.0",
     "@angular/core": "^20.0.0 || ^21.0.0 || ^22.0.0",
     "@angular/common": "^20.0.0 || ^21.0.0 || ^22.0.0",
@@ -46,5 +51,14 @@
     "**/chat-tokens.ts",
     "./fesm2022/threadplane-chat.mjs",
     "**/*.css"
-  ]
+  ],
+  "imports": {
+    "#development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "@threadplane/chat/development-install"
+    }
+  },
+  "scripts": {
+    "postinstall": "node install/postinstall.cjs"
+  }
 }
diff --git a/libs/chat/project.json b/libs/chat/project.json
index 1e4abc10b..2ef4dfdb2 100644
--- a/libs/chat/project.json
+++ b/libs/chat/project.json
@@ -30,7 +30,15 @@
         },
         "development": {}
       },
-      "defaultConfiguration": "production"
+      "defaultConfiguration": "production",
+      "inputs": [
+        "production",
+        "^production",
+        "!{projectRoot}/.install-collector/**",
+        "{workspaceRoot}/libs/telemetry/install/*",
+        "!{projectRoot}/src/lib/package-version.ts"
+      ],
+      "dependsOn": ["^build", "prepare-install"]
     },
     "nx-release-publish": {
       "options": {
@@ -44,13 +52,32 @@
       "executor": "@nx/vitest:test",
       "options": {
         "configFile": "libs/chat/vite.config.mts"
-      }
+      },
+      "dependsOn": ["prepare-install"]
     },
     "type-tests": {
       "executor": "nx:run-commands",
       "options": {
         "command": "npx tsc --project libs/chat/tsconfig.type-tests.json --noEmit"
       }
+    },
+    "prepare-install": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": [
+        "{workspaceRoot}/libs/telemetry/install/*.cjs",
+        "{workspaceRoot}/libs/telemetry/install/assemble-package.mjs",
+        "{projectRoot}/package.json"
+      ],
+      "outputs": [
+        "{projectRoot}/.install-collector",
+        "{projectRoot}/src/lib/package-version.ts"
+      ],
+      "options": {
+        "command": "node libs/telemetry/install/assemble-package.mjs chat",
+        "forwardAllArgs": false
+      }
     }
-  }
+  },
+  "implicitDependencies": ["telemetry"]
 }
diff --git a/libs/chat/src/lib/compositions/chat/chat.component.spec.ts b/libs/chat/src/lib/compositions/chat/chat.component.spec.ts
index 310bfc207..e32d927af 100644
--- a/libs/chat/src/lib/compositions/chat/chat.component.spec.ts
+++ b/libs/chat/src/lib/compositions/chat/chat.component.spec.ts
@@ -6,6 +6,7 @@ import { signal, effect, DestroyRef, inject, Injector, runInInjectionContext } f
 import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
 import { HumanMessage, AIMessage } from '@langchain/core/messages';
 import { ChatComponent } from './chat.component';
+import { DEVELOPMENT_COLLECTION_POLICY, registerDevelopmentRuntimePolicy } from '@threadplane/telemetry/browser';
 import { messageContent } from '../shared/message-utils';
 import { createContentClassifier, type ContentClassifier } from '../../streaming/content-classifier';
 import { mockAgent } from '../../testing/mock-agent';
@@ -28,6 +29,24 @@ import {
   type Message,
 } from '../../agent';
 
+describe('ChatComponent development collection destination policy', () => {
+  it('passes the current adapter policy to descendants and keeps app-owned agents disabled', () => {
+    TestBed.configureTestingModule({});
+    const fx = TestBed.createComponent(ChatComponent);
+    const appOwned = mockAgent();
+    fx.componentRef.setInput('agent', appOwned);
+    const policy = fx.debugElement.injector.get(DEVELOPMENT_COLLECTION_POLICY, null);
+    expect(policy).toBeTypeOf('function');
+    expect(policy?.()).toBe(false);
+    const enabled = registerDevelopmentRuntimePolicy(mockAgent(), () => true);
+    fx.componentRef.setInput('agent', enabled);
+    expect(policy?.()).toBe(true);
+    const customSink = registerDevelopmentRuntimePolicy(mockAgent(), () => false);
+    fx.componentRef.setInput('agent', customSink);
+    expect(policy?.()).toBe(false);
+  });
+});
+
 describe('markdownDocument', () => {
   it('maps streaming delivery generation, phase, and content', () => {
     expect(markdownDocument('partial', streamingDelivery('attempt-1'))).toEqual({
diff --git a/libs/chat/src/lib/compositions/chat/chat.component.ts b/libs/chat/src/lib/compositions/chat/chat.component.ts
index 9457288bc..586119e37 100644
--- a/libs/chat/src/lib/compositions/chat/chat.component.ts
+++ b/libs/chat/src/lib/compositions/chat/chat.component.ts
@@ -4,6 +4,7 @@ import {
   DestroyRef, inject, Injector, runInInjectionContext,
 } from '@angular/core';
 import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { DEVELOPMENT_COLLECTION_POLICY, isDevelopmentRuntimeEnabled } from '@threadplane/telemetry/browser';
 import { KeyValuePipe } from '@angular/common';
 import type { Agent, Message, MessageDelivery } from '../../agent';
 import { ChatReasoningComponent } from '../../primitives/chat-reasoning/chat-reasoning.component';
@@ -105,6 +106,14 @@ export function isPinned(
   changeDetection: ChangeDetectionStrategy.OnPush,
   providers: [
     { provide: CHAT_LIFECYCLE, useFactory: createChatLifecycle },
+    {
+      provide: DEVELOPMENT_COLLECTION_POLICY,
+      useFactory: () => {
+        const host = inject(ChatComponent);
+        const parent = inject(DEVELOPMENT_COLLECTION_POLICY, { optional: true, skipSelf: true });
+        return () => (parent?.() ?? true) && isDevelopmentRuntimeEnabled(host.agent());
+      },
+    },
   ],
   styles: [CHAT_HOST_TOKENS, `
     :host {
diff --git a/libs/chat/src/lib/package-version.ts b/libs/chat/src/lib/package-version.ts
new file mode 100644
index 000000000..5fc748ce1
--- /dev/null
+++ b/libs/chat/src/lib/package-version.ts
@@ -0,0 +1,3 @@
+// Generated by the package preparation target from package.json.
+// prettier-ignore
+export const THREADPLANE_PACKAGE_VERSION = "0.0.65";
diff --git a/libs/chat/src/test-setup.ts b/libs/chat/src/test-setup.ts
index ca3d8a2b3..f421e3280 100644
--- a/libs/chat/src/test-setup.ts
+++ b/libs/chat/src/test-setup.ts
@@ -1,4 +1,7 @@
 import { getTestBed } from '@angular/core/testing';
+// Default tests never submit automatic collector traffic; dedicated integration tests use controlled sinks.
+if (typeof window !== 'undefined')
+  (window as Window & { __THREADPLANE_TELEMETRY_DISABLED__?: boolean }).__THREADPLANE_TELEMETRY_DISABLED__ = true;
 import {
   BrowserTestingModule,
   platformBrowserTesting,
diff --git a/libs/growth/src/lib/observability/install-collector.spec.ts b/libs/growth/src/lib/observability/install-collector.spec.ts
new file mode 100644
index 000000000..b42389475
--- /dev/null
+++ b/libs/growth/src/lib/observability/install-collector.spec.ts
@@ -0,0 +1,46 @@
+import { createRequire } from 'node:module';
+import { resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { parseCollectionBatch } from './contracts.ts';
+const { collectInstall } = createRequire(import.meta.url)(
+  resolve('libs/telemetry/install/collector.cjs')
+);
+describe('published install collector contract', () => {
+  it('accepts the real synthetic collector payload with explicit consumer context', async () => {
+    let payload: unknown;
+    await collectInstall({
+      packageRoot: 'unused',
+      env: { CI: '1' },
+      getHome: () => '/synthetic',
+      readPackage: async () => ({
+        name: '@threadplane/chat',
+        version: '0.0.65',
+      }),
+      identify: async () => ({ id: randomUUID(), scope: 'memory' }),
+      discover: async () => ({
+        consumerContext: 'checkout',
+        identity: {
+          gitEmail: 'synthetic@example.invalid',
+          gitDisplayName: 'Synthetic',
+          gitConfigOrigin: 'local',
+          repositoryProvider: 'github',
+          repositoryOwner: 'synthetic',
+        },
+      }),
+      send: async (value: unknown) => {
+        payload = value;
+      },
+    });
+    expect(
+      parseCollectionBatch('install', payload, new Date()).events[0].properties
+        .consumerContext
+    ).toBe('checkout');
+    const invalid = structuredClone(payload) as {
+      events: { properties: Record<string, string> }[];
+    };
+    invalid.events[0].properties.consumerContext = '/private/checkouts';
+    expect(() =>
+      parseCollectionBatch('install', invalid, new Date())
+    ).toThrow();
+  });
+});
diff --git a/libs/langgraph/.install-collector/development-install.d.ts b/libs/langgraph/.install-collector/development-install.d.ts
new file mode 100644
index 000000000..873f0eada
--- /dev/null
+++ b/libs/langgraph/.install-collector/development-install.d.ts
@@ -0,0 +1 @@
+export declare const installationToken: string | null;
diff --git a/libs/langgraph/.install-collector/development-install.mjs b/libs/langgraph/.install-collector/development-install.mjs
new file mode 100644
index 000000000..2a0dd3c8b
--- /dev/null
+++ b/libs/langgraph/.install-collector/development-install.mjs
@@ -0,0 +1 @@
+export const installationToken = null;
diff --git a/libs/langgraph/README.md b/libs/langgraph/README.md
index fc00cfb3a..0337d75c9 100644
--- a/libs/langgraph/README.md
+++ b/libs/langgraph/README.md
@@ -210,6 +210,70 @@ transport, never mock `injectAgent()` itself.
 - [Testing with `MockAgentTransport`](https://threadplane.ai/docs/langgraph/guides/testing)
 - [Choosing an adapter (LangGraph vs AG-UI)](https://threadplane.ai/docs/choosing-an-adapter)
 
+## Installation collection
+
+This package includes automatic first-party installation collection, including CI.
+It reports the package/version, basic execution environment, a random installation
+identifier, configured Git display name and full email, and a recognized repository
+hosting provider/owner when available. CI is labeled separately; install counts are
+not developer counts, and Git identity is an unverified hint. A usable install email
+can qualify for the generic founder hello after a linked development activation;
+this does not verify email ownership, employment, or account membership. Existing
+unsubscribe, reply, bounce, and suppression controls still apply.
+
+An enabled non-CI install writes a random package-local correlation token to the
+`./development-install` export. It contains no email or Git metadata and is separate
+from the home installation ID. Published packages contain null; development runtime
+events can carry the installed token. Production bundles remove it and do not collect
+runtime events. CI alone cannot create an eligible bridge or trigger a hello.
+
+Disabled and CI lifecycle runs first try to reset an earlier token to null. Copied or
+cached packages can retain tokens: read-only packages may prevent that reset, and
+skipped scripts leave existing files unchanged. A token therefore does not prove a
+unique installation or developer. The independent browser opt-out below still stops
+runtime transmission, including when a stale token remains.
+
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installing to disable
+collection before identity reads, persistence, or network. Package-manager controls
+such as `--ignore-scripts` also prevent the hook from running. Installation succeeds
+independently of collection, with one request and a five-second execution budget.
+
+The random ID is stored at `~/.threadplane/installation-id` where writable; otherwise
+it lasts for one invocation. Git includes, system config, and command/environment
+identity overrides are not inspected. Unsupported checkout/configuration layouts,
+blocked scripts or network, and reused caches can leave gaps or duplicate identities.
+Raw repository URLs/names, local paths, source code, credentials, and application
+content are excluded from install reports. See [Privacy](https://threadplane.ai/privacy).
+
 ## License
 
 MIT. See [LICENSE](../../LICENSE).
+
+## Development browser collection
+
+Supported LangGraph/AG-UI runtime use and real JSON-render component mounts automatically
+report development progress to Threadplane. Angular development mode and browser APIs
+are required. Production builds, SSR, imports, unused adapter construction, and
+automated browsers reporting `navigator.webdriver` are inert.
+Reports contain package/version, integration, closed milestones, timestamps, a random
+browser-origin ID, and a session with a 30-minute inactivity boundary. They exclude
+prompts, messages, application state, private URLs, thread/run IDs, and credentials.
+The IDs describe an origin/session, not a verified person or repository.
+
+Set adapter `telemetry: false` to disable automatic collection; a custom sink replaces
+the automatic destination while preserving its existing callbacks. Chat carries that
+choice into nested JSON renderers. Standalone render supports
+`provideRender({ telemetry: false })` or `<render-spec [telemetry]="false" ... />`.
+
+For a page-wide control, call `setDevelopmentCollectionEnabled(false)` from
+`@threadplane/telemetry/browser` before creating runtimes. From the browser console,
+run `localStorage.setItem('THREADPLANE_TELEMETRY_DISABLED', '1')` and reload.
+Node environment variables do not configure a compiled browser app.
+
+The credential-free announcement exchange records progress before returning optional
+plain-text console announcements. No click or registration is required. It has bounded
+queues/retries and a three-second request deadline; collection failures do not affect
+application use. A linked eligible install email can receive the generic founder hello;
+runtime evidence alone does not approve a contact. See the
+[telemetry controls and collection details](https://github.com/cacheplane/angular-agent-framework/tree/main/libs/telemetry#automatic-development-runtime-collection)
+and [Privacy](https://threadplane.ai/privacy).
diff --git a/libs/langgraph/install/postinstall.cjs b/libs/langgraph/install/postinstall.cjs
new file mode 100644
index 000000000..ced868227
--- /dev/null
+++ b/libs/langgraph/install/postinstall.cjs
@@ -0,0 +1,2 @@
+// Contributor workspace installs are inert. ng-packagr replaces this path in
+// published packages with the shared collector from .install-collector.
diff --git a/libs/langgraph/ng-package.json b/libs/langgraph/ng-package.json
index 133ee1eb0..feb14b2b7 100644
--- a/libs/langgraph/ng-package.json
+++ b/libs/langgraph/ng-package.json
@@ -4,5 +4,22 @@
   "lib": {
     "entryFile": "src/public-api.ts"
   },
-  "assets": [{ "input": ".", "glob": "LICENSE.md", "output": "." }]
+  "assets": [
+    {
+      "input": ".install-collector",
+      "glob": "development-install.*",
+      "output": ".install-collector"
+    },
+    {
+      "input": ".",
+      "glob": "LICENSE.md",
+      "output": "."
+    },
+    {
+      "input": ".install-collector",
+      "glob": "*.cjs",
+      "output": "install"
+    }
+  ],
+  "keepLifecycleScripts": true
 }
diff --git a/libs/langgraph/package.json b/libs/langgraph/package.json
index 99d741708..9e28e1714 100644
--- a/libs/langgraph/package.json
+++ b/libs/langgraph/package.json
@@ -12,6 +12,7 @@
   ],
   "peerDependencies": {
     "@threadplane/chat": "*",
+    "@threadplane/telemetry": "^0.0.65",
     "@angular/core": "^20.0.0 || ^21.0.0 || ^22.0.0",
     "@langchain/core": "^1.1.33",
     "@langchain/langgraph-sdk": "^1.7.4",
@@ -27,5 +28,20 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "exports": {
+    "./development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "./.install-collector/development-install.mjs"
+    }
+  },
+  "imports": {
+    "#development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "@threadplane/langgraph/development-install"
+    }
+  },
+  "scripts": {
+    "postinstall": "node install/postinstall.cjs"
+  }
 }
diff --git a/libs/langgraph/project.json b/libs/langgraph/project.json
index 6b4240742..762264ce5 100644
--- a/libs/langgraph/project.json
+++ b/libs/langgraph/project.json
@@ -30,7 +30,15 @@
         },
         "development": {}
       },
-      "defaultConfiguration": "production"
+      "defaultConfiguration": "production",
+      "inputs": [
+        "production",
+        "^production",
+        "!{projectRoot}/.install-collector/**",
+        "{workspaceRoot}/libs/telemetry/install/*",
+        "!{projectRoot}/src/lib/package-version.ts"
+      ],
+      "dependsOn": ["^build", "prepare-install"]
     },
     "nx-release-publish": {
       "options": {
@@ -44,13 +52,32 @@
       "executor": "@nx/vitest:test",
       "options": {
         "configFile": "libs/langgraph/vite.config.mts"
-      }
+      },
+      "dependsOn": ["prepare-install"]
     },
     "type-tests": {
       "executor": "nx:run-commands",
       "options": {
         "command": "npx tsc --noEmit -p libs/langgraph/tsconfig.type-tests.json"
       }
+    },
+    "prepare-install": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": [
+        "{workspaceRoot}/libs/telemetry/install/*.cjs",
+        "{workspaceRoot}/libs/telemetry/install/assemble-package.mjs",
+        "{projectRoot}/package.json"
+      ],
+      "outputs": [
+        "{projectRoot}/.install-collector",
+        "{projectRoot}/src/lib/package-version.ts"
+      ],
+      "options": {
+        "command": "node libs/telemetry/install/assemble-package.mjs langgraph",
+        "forwardAllArgs": false
+      }
     }
-  }
+  },
+  "implicitDependencies": ["telemetry"]
 }
diff --git a/libs/langgraph/src/lib/agent.fn.spec.ts b/libs/langgraph/src/lib/agent.fn.spec.ts
index f748d164a..98e7fd02c 100644
--- a/libs/langgraph/src/lib/agent.fn.spec.ts
+++ b/libs/langgraph/src/lib/agent.fn.spec.ts
@@ -14,6 +14,7 @@ import {
 import { LANGGRAPH_CLIENT_OPTIONS } from './client/client-options';
 import { AGENT_CONFIG } from './agent.provider';
 import { AgentError } from '@threadplane/chat';
+import { isDevelopmentRuntimeEnabled } from '@threadplane/telemetry/browser';
 import { ɵLANGGRAPH_RUNTIME_OPERATION_REPORTER } from './runtime-operation-reporter';
 
 vi.mock('./client/create-langgraph-client', async (importOriginal) => {
@@ -61,6 +62,13 @@ function threadState(
 describe('agent', () => {
   beforeEach(() => TestBed.configureTestingModule({}));
 
+  it('propagates automatic collection policy to consumers of the returned agent', () => {
+    for (const telemetry of [undefined, false, vi.fn()] as const) {
+      const ref = withInjectionContext(() => agent({ assistantId: 'test', transport: new MockAgentTransport(), telemetry }));
+      expect(isDevelopmentRuntimeEnabled(ref)).toBe(telemetry === undefined);
+    }
+  });
+
   it('returns a ref with initial idle status', () => {
     const transport = new MockAgentTransport();
     const ref = withInjectionContext(() =>
diff --git a/libs/langgraph/src/lib/agent.fn.ts b/libs/langgraph/src/lib/agent.fn.ts
index 749a2a2b5..a5f5a7f06 100644
--- a/libs/langgraph/src/lib/agent.fn.ts
+++ b/libs/langgraph/src/lib/agent.fn.ts
@@ -3,6 +3,7 @@ import {
   isSignal, signal, Signal,
 } from '@angular/core';
 import { AGENT_CONFIG } from './agent.provider';
+import { registerDevelopmentRuntimePolicy } from '@threadplane/telemetry/browser';
 import type { AgentLifecycle } from './lifecycle';
 import { AgentLifecycleRegistry } from './agent-lifecycle-registry';
 import { toSignal, toObservable } from '@angular/core/rxjs-interop';
@@ -485,7 +486,7 @@ export function agent<
     if (outcome === 'success') batch?.acknowledge();
   }
 
-  return {
+  return registerDevelopmentRuntimePolicy<LangGraphAgent<T, InferBag<T, Bag>>>({
     // ── Runtime-neutral surface (AgentWithHistory) ────────────────────────
     messages:  messagesNeutral,
     status:    statusNeutral,
@@ -656,7 +657,7 @@ export function agent<
         ? []
         : toolCalls$.value.filter(tc => (tc.aiMessage as unknown as Record<string, unknown>)['id'] === id);
     },
-  };
+  }, () => options.telemetry === undefined);
 }
 
 // ── Private translation helpers (moved from to-agent.ts) ─────────────────────
diff --git a/libs/langgraph/src/lib/agent.provider.ts b/libs/langgraph/src/lib/agent.provider.ts
index 9d2bf7a57..adda63c06 100644
--- a/libs/langgraph/src/lib/agent.provider.ts
+++ b/libs/langgraph/src/lib/agent.provider.ts
@@ -47,7 +47,11 @@ export interface AgentConfig<
   transport?: AgentTransport;
   /** Tuning options for the default transport's LangGraph SDK client (e.g. retry budget). */
   clientOptions?: LangGraphClientOptions;
-  /** Optional app-owned sink. Supply one to receive runtime lifecycle events. */
+  /**
+   * Omit to enable automatic development-only collection. Set `false` to disable.
+   * An app-owned sink replaces the automatic destination and receives the
+   * existing runtime lifecycle callbacks.
+   */
   telemetry?: AgentRuntimeTelemetrySink | false;
   /** Tool names that indicate a subagent invocation. */
   subagentToolNames?: string[];
diff --git a/libs/langgraph/src/lib/agent.types.ts b/libs/langgraph/src/lib/agent.types.ts
index 25eed31aa..bada53524 100644
--- a/libs/langgraph/src/lib/agent.types.ts
+++ b/libs/langgraph/src/lib/agent.types.ts
@@ -289,7 +289,11 @@ export interface AgentOptions<T, _ResolvedBag extends BagTemplate> {
   transport?: AgentTransport;
   /** Tuning options for the default transport's LangGraph SDK client (e.g. retry budget). */
   clientOptions?: LangGraphClientOptions;
-  /** Optional app-owned sink. Supply one to receive runtime lifecycle events. */
+  /**
+   * Omit to enable automatic development-only collection. Set `false` to disable.
+   * An app-owned sink replaces the automatic destination and receives the
+   * existing runtime lifecycle callbacks.
+   */
   telemetry?: AgentRuntimeTelemetrySink | false;
   /** Tool names that indicate a subagent invocation. */
   subagentToolNames?: string[];
diff --git a/libs/langgraph/src/lib/internals/stream-manager.bridge.spec.ts b/libs/langgraph/src/lib/internals/stream-manager.bridge.spec.ts
index 2b99b05ae..6cb1bdc57 100644
--- a/libs/langgraph/src/lib/internals/stream-manager.bridge.spec.ts
+++ b/libs/langgraph/src/lib/internals/stream-manager.bridge.spec.ts
@@ -12,6 +12,150 @@ import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+const developmentEvidence = vi.hoisted(() => ({ events: [] as string[], touches: 0, disposed: 0 }));
+vi.mock('@threadplane/telemetry/browser', async (importOriginal) => ({
+  ...await importOriginal<object>(),
+  createDevelopmentRuntime: (options: { enabled?: () => boolean }) => ({
+    touch: () => { if (options.enabled?.() !== false) developmentEvidence.touches++; },
+    milestone: (kind: string) => { if (options.enabled?.() !== false) developmentEvidence.events.push(kind); },
+    dispose: () => { developmentEvidence.disposed++; },
+  }),
+}));
+
+describe('automatic development evidence', () => {
+  function setup(telemetry?: false | ReturnType<typeof vi.fn>) {
+    developmentEvidence.events = []; developmentEvidence.touches = 0; developmentEvidence.disposed = 0;
+    const transport = new MockAgentTransport();
+    const subjects = makeSubjects();
+    const destroy$ = new Subject<void>();
+    const bridge = createStreamManagerBridge({ options: { apiUrl: '', assistantId: 'test', transport, telemetry }, subjects, threadId$: of(null), destroy$ });
+    return { transport, subjects, destroy$, bridge };
+  }
+
+  it('requires root terminal evidence and disposes with the bridge', async () => {
+    const { transport, bridge, destroy$ } = setup();
+    expect(developmentEvidence.touches).toBe(0);
+    const run = bridge.submit({});
+    transport.emit([{ type: 'values', data: { done: true } }]); transport.close();
+    await run;
+    expect(developmentEvidence.touches).toBeGreaterThan(0);
+    expect(developmentEvidence.events).toContain('transport.connected');
+    expect(developmentEvidence.events).toContain('runtime.first_stream_completed');
+    destroy$.next();
+    expect(developmentEvidence.disposed).toBe(1);
+  });
+
+  it.each([
+    [],
+    [{ type: 'unknown' }],
+    [{ type: 'values', data: {}, namespace: ['child:1'] }],
+    [{ type: 'values', data: {} }, { type: 'error', error: new Error('failed') }],
+    [{ type: 'values', data: { __interrupt__: [{ value: {} }] } }],
+    [{ type: 'messages/partial', data: [{ id: 'ai', type: 'ai', content: 'unfinished' }] }],
+  ])('does not complete on an unqualified close %j', async (...events) => {
+    const { transport, bridge, destroy$ } = setup();
+    const run = bridge.submit({});
+    transport.emit(events as StreamEvent[]); transport.close(); await run;
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+    destroy$.next();
+  });
+
+  it.each([false, vi.fn()] as const)('respects explicit sinks %s', async telemetry => {
+    const { transport, bridge, destroy$ } = setup(telemetry);
+    const run = bridge.submit({}); transport.emit([{ type: 'values', data: { done: true } }]); transport.close(); await run;
+    expect(developmentEvidence.events).toEqual([]); expect(developmentEvidence.touches).toBe(0);
+    if (telemetry) expect(telemetry).toHaveBeenCalled();
+    destroy$.next();
+  });
+
+  it.each([
+    { type: 'messages/complete', data: { unexpected: true } },
+    { type: 'messages/complete', data: [123] },
+    { type: 'messages/complete' },
+    { type: 'values', data: null },
+    { type: 'values', data: null, namespace: [] },
+    { type: 'values', data: 'invalid' },
+    { type: 'values' },
+    { type: 'checkpoints', data: null },
+  ])('does not treat malformed known terminal payloads as development evidence: %j', async event => {
+    const { transport, bridge, destroy$ } = setup();
+    const run = bridge.submit({});
+    transport.emit([event as StreamEvent]); transport.close();
+    await run;
+    expect(developmentEvidence.events).not.toContain('transport.connected');
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+    destroy$.next();
+  });
+
+  it('records restored nonempty remote state, excluding empty history and run refresh', async () => {
+    const { transport, bridge, destroy$ } = setup();
+    bridge.switchThread('empty'); await Promise.resolve(); await Promise.resolve();
+    expect(developmentEvidence.events).not.toContain('thread.persisted');
+    transport.history = [makeThreadState('checkpoint')];
+    bridge.switchThread('restored'); await Promise.resolve(); await Promise.resolve();
+    expect(developmentEvidence.events).toContain('thread.persisted');
+    developmentEvidence.events = [];
+    const run = bridge.submit({}); transport.emit([{ type: 'values', data: { done: true } }]); transport.close(); await run;
+    expect(developmentEvidence.events).not.toContain('thread.persisted');
+    destroy$.next();
+  });
+
+  it('counts only real pending interrupt resumes that finish successfully', async () => {
+    const { transport, bridge, destroy$ } = setup();
+    let invocation = 0;
+    transport.stream = async function* () {
+      yield ++invocation === 1
+        ? { type: 'values', data: { __interrupt__: [{ value: {} }] } }
+        : { type: 'values', data: { done: true } };
+    };
+    await bridge.submit({});
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+    await bridge.submit(null, { command: { resume: true } });
+    expect(developmentEvidence.events).toContain('interrupt.handled');
+    developmentEvidence.events = [];
+    await bridge.submit(null, { command: { resume: true } });
+    expect(developmentEvidence.events).not.toContain('interrupt.handled');
+    destroy$.next();
+  });
+
+  it.each(['stop', 'dispose', 'thread switch', 'external abort'])('excludes completion after %s', async action => {
+    const { transport, bridge, destroy$ } = setup();
+    const external = new AbortController();
+    const run = bridge.submit({}, action === 'external abort' ? { signal: external.signal } : undefined);
+    transport.emit([{ type: 'values', data: { done: true } }]);
+    await vi.waitFor(() => expect(developmentEvidence.events).toContain('transport.connected'));
+    if (action === 'stop') await bridge.stop();
+    else if (action === 'dispose') destroy$.next();
+    else if (action === 'thread switch') bridge.switchThread(null);
+    else external.abort();
+    transport.close(); await run;
+    expect(developmentEvidence.events).not.toContain('runtime.first_stream_completed');
+    expect(developmentEvidence.events).not.toContain('interrupt.handled');
+    if (action !== 'dispose') destroy$.next();
+  });
+
+  it('records successful joined runs through the same evidence rules', async () => {
+    const { bridge, destroy$ } = setup();
+    bridge.switchThread('joined');
+    await bridge.joinStream('run-1');
+    expect(developmentEvidence.events).toContain('transport.connected');
+    expect(developmentEvidence.events).toContain('runtime.first_stream_completed');
+    destroy$.next();
+  });
+
+  it('does not call a history load prior state when a run began while it was pending', async () => {
+    const { transport, bridge, destroy$ } = setup();
+    let resolveHistory!: (history: ThreadState[]) => void;
+    transport.getHistory = () => new Promise(resolve => { resolveHistory = resolve; });
+    bridge.switchThread('pending');
+    const run = bridge.submit({});
+    resolveHistory([makeThreadState('current-run-state')]);
+    await Promise.resolve(); await Promise.resolve();
+    expect(developmentEvidence.events).not.toContain('thread.persisted');
+    destroy$.next(); transport.close(); await run;
+  });
+});
+
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const FIXTURE = JSON.parse(
   readFileSync(
diff --git a/libs/langgraph/src/lib/internals/stream-manager.bridge.ts b/libs/langgraph/src/lib/internals/stream-manager.bridge.ts
index 0e4b00318..b1979846a 100644
--- a/libs/langgraph/src/lib/internals/stream-manager.bridge.ts
+++ b/libs/langgraph/src/lib/internals/stream-manager.bridge.ts
@@ -1,4 +1,9 @@
-import { signal, type Signal } from '@angular/core';
+import { isDevMode, signal, type Signal } from '@angular/core';
+// eslint-disable-next-line @nx/enforce-module-boundaries -- Keep the postinstall module external through ng-packagr.
+import { installationToken } from '#development-install';
+declare const ngDevMode: boolean;
+import { createDevelopmentRuntime } from '@threadplane/telemetry/browser';
+import { THREADPLANE_PACKAGE_VERSION as packageVersion } from '../package-version';
 import { Observable, takeUntil } from 'rxjs';
 import {
   ResourceStatus,
@@ -140,6 +145,11 @@ export interface StreamManagerBridge {
 export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = BagTemplate>(
   { options, subjects, threadId$, destroy$, reportOperationFailure }: StreamManagerBridgeOptions<T, ResolvedBag>
 ): StreamManagerBridge {
+  const developmentRuntime = createDevelopmentRuntime({
+    integration: 'langgraph', packageName: '@threadplane/langgraph', packageVersion,
+    installationToken: (typeof ngDevMode === 'undefined' || ngDevMode) && isDevMode() ? installationToken : null,
+    enabled: () => options.telemetry === undefined,
+  });
   // Intercept onThreadId so currentThreadId tracks a thread the DEFAULT
   // transport auto-creates. Without this, each submit() would create a new
   // thread because currentThreadId stays null. This wrapper only reaches the
@@ -179,6 +189,10 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
   const messageDeliveries = new Map<string, MessageDelivery>();
   const deliveryRevision = signal(0);
   type DeliveryAttempt = {
+    startedAt: number;
+    rootTerminalEvidence: boolean;
+    resumedInterrupt: boolean;
+    externalSignal?: AbortSignal;
     generation: string;
     messageIds: Set<string>;
     finalizedMessageIds: Set<string>;
@@ -214,6 +228,7 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
   );
 
   function captureRuntimeRequestTelemetry(requestType: string): void {
+    developmentRuntime.touch();
     captureAgentRuntimeTelemetry(options.telemetry, 'tplane:runtime_request_created', {
       ...telemetryProperties,
       requestType,
@@ -246,6 +261,9 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
     }
     attemptSequence += 1;
     const attempt: DeliveryAttempt = {
+      startedAt: Date.now(),
+      rootTerminalEvidence: false,
+      resumedInterrupt: false,
       generation: `attempt-${attemptSequence}-${Math.random().toString(36).slice(2, 10)}`,
       messageIds: new Set(),
       finalizedMessageIds: new Set(),
@@ -323,6 +341,12 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
 
     if (!isCurrentExecution(controller, attempt)) return null;
     if (!attempt.terminalOutcome) finalizeAttempt(attempt, outcome);
+    if (attempt.terminalOutcome === 'success' && attempt.rootTerminalEvidence
+      && !controller.signal.aborted && !attempt.externalSignal?.aborted
+      && !subjects.error$.value && !subjects.interrupt$.value && subjects.interrupts$.value.length === 0) {
+      developmentRuntime.milestone('runtime.first_stream_completed', Date.now() - attempt.startedAt);
+      if (attempt.resumedInterrupt) developmentRuntime.milestone('interrupt.handled');
+    }
     return attempt.terminalOutcome ?? outcome;
   }
 
@@ -358,6 +382,7 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
       attempt.currentAssistantMessageId = id;
       attempt.messageIds.add(id);
       attempt.sawAssistantChunk = true;
+      attempt.rootTerminalEvidence = false;
       setDelivery(id, streamingDelivery(attempt.generation));
     }
   }
@@ -372,7 +397,6 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
     if (
       !attempt
       || attempt.terminalOutcome
-      || !attempt.sawAssistantChunk
       || (getEventNamespace(event)?.length ?? 0) > 0
     ) return;
     const baseType = getBaseEventType(event.type);
@@ -381,7 +405,8 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
     // evidence: after assistant chunks, a close without one of these markers
     // is classified as interrupted.
     if (baseType === 'values' || baseType === 'messages/complete' || baseType === 'checkpoints') {
-      attempt.currentStepHasTerminalEvidence = true;
+      if (hasDevelopmentEventPayload(event)) attempt.rootTerminalEvidence = true;
+      if (attempt.sawAssistantChunk) attempt.currentStepHasTerminalEvidence = true;
     }
   }
 
@@ -439,6 +464,7 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
   });
 
   destroy$.subscribe(() => {
+    developmentRuntime.dispose();
     invalidateQueueDrain();
     abortController?.abort();
     historyAbortController?.abort();
@@ -454,6 +480,7 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
   async function refreshHistory(force = false, isRelevant: () => boolean = () => true): Promise<void> {
     const getHistory = transport.getHistory?.bind(transport);
     if (!currentThreadId || !getHistory) return;
+    developmentRuntime.touch();
 
     historyAbortController?.abort();
     const controller = new AbortController();
@@ -487,6 +514,9 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
           delete (restoredValues as { messages?: unknown }).messages;
           subjects.messages$.next(preserveIds(subjects.messages$.value, restoredMessages));
           subjects.values$.next(restoredValues);
+          if (!force && !activeAttempt && (restoredMessages.length > 0 || Object.keys(restoredValues as object).length > 0)) {
+            developmentRuntime.milestone('thread.persisted');
+          }
           // Rebuild derived subjects from the new authoritative messages$.
           // Tool-call results displayed by chat-tool-calls come from
           // toolCalls$, which is built from messages$; without this, the
@@ -695,6 +725,9 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
     const attempt = beginAttempt(
       requestType === 'resubmit' || (isRecord(opts?.command) && 'resume' in opts.command),
     );
+    attempt.externalSignal = opts?.signal;
+    attempt.resumedInterrupt = isRecord(opts?.command) && 'resume' in opts.command
+      && (!!subjects.interrupt$.value || subjects.interrupts$.value.length > 0);
     const startedAt = Date.now();
     captureRuntimeRequestTelemetry(requestType);
     captureAgentRuntimeTelemetry(options.telemetry, 'tplane:stream_started', telemetryProperties);
@@ -812,6 +845,9 @@ export function createStreamManagerBridge<T, ResolvedBag extends BagTemplate = B
   function processEvent(event: StreamEvent): void {
     const baseType = getBaseEventType(event.type);
     const namespace = getEventNamespace(event);
+    if (hasDevelopmentEventPayload(event)) {
+      developmentRuntime.milestone('transport.connected');
+    }
 
     if (baseType === 'checkpoints' || baseType === 'messages/complete') {
       markNormalTerminal(event);
@@ -1393,6 +1429,45 @@ function hydrateInterruptsFromHistory<T, B extends BagTemplate>(
   }
 }
 
+/** Growth evidence is stricter than the legacy stream projection fallbacks. */
+function hasDevelopmentEventPayload(event: StreamEvent): boolean {
+  const baseType = getBaseEventType(event.type);
+  if (isMessagesEvent(event.type)) {
+    const payload = Array.isArray(event.messages) ? event.messages : event['data'];
+    if (Array.isArray(payload)) {
+      return payload.length === 0 || (normalizeMessages(event)?.length ?? 0) > 0;
+    }
+    // Older custom transports flatten arrays into numeric event properties.
+    return Object.keys(event).some(key => /^\d+$/.test(key))
+      && (normalizeMessages(event)?.length ?? 0) > 0;
+  }
+  // An explicitly malformed SDK payload cannot borrow namespace/metadata keys
+  // from extractEventData's compatibility fallback as proof of decoded state.
+  const payload = 'data' in event ? event['data']
+    : baseType in event ? event[baseType]
+    : Object.fromEntries(Object.entries(event).filter(([key]) =>
+        !['type', 'namespace', 'messageMetadata'].includes(key)));
+  switch (baseType) {
+    case 'values':
+    case 'updates':
+    case 'checkpoints':
+    case 'metadata':
+      return isRecord(payload) && ('data' in event || baseType in event || Object.keys(payload).length > 0);
+    case 'error':
+      return safeReadEventError(event) !== undefined;
+    case 'interrupt':
+      return isRecord(event['interrupt']);
+    case 'interrupts':
+      return Array.isArray(event['interrupts']) && event['interrupts'].every(isRecord);
+    case 'custom':
+      return 'data' in event;
+    case 'tools':
+      return isRecord(payload) && typeof payload['event'] === 'string' && typeof payload['name'] === 'string';
+    default:
+      return false;
+  }
+}
+
 function extractEventData(event: StreamEvent): unknown {
   // Try event['data'] first (SDK format from normalizeSdkEvent)
   const d = event['data'];
diff --git a/libs/langgraph/src/lib/package-version.ts b/libs/langgraph/src/lib/package-version.ts
new file mode 100644
index 000000000..5fc748ce1
--- /dev/null
+++ b/libs/langgraph/src/lib/package-version.ts
@@ -0,0 +1,3 @@
+// Generated by the package preparation target from package.json.
+// prettier-ignore
+export const THREADPLANE_PACKAGE_VERSION = "0.0.65";
diff --git a/libs/langgraph/src/test-setup.ts b/libs/langgraph/src/test-setup.ts
index ca3d8a2b3..a9d981b17 100644
--- a/libs/langgraph/src/test-setup.ts
+++ b/libs/langgraph/src/test-setup.ts
@@ -1,4 +1,6 @@
 import { getTestBed } from '@angular/core/testing';
+// Unit tests never send automatic development collection to a live destination.
+(window as Window & { __THREADPLANE_TELEMETRY_DISABLED__?: boolean }).__THREADPLANE_TELEMETRY_DISABLED__ = true;
 import {
   BrowserTestingModule,
   platformBrowserTesting,
diff --git a/libs/render/.install-collector/development-install.d.ts b/libs/render/.install-collector/development-install.d.ts
new file mode 100644
index 000000000..873f0eada
--- /dev/null
+++ b/libs/render/.install-collector/development-install.d.ts
@@ -0,0 +1 @@
+export declare const installationToken: string | null;
diff --git a/libs/render/.install-collector/development-install.mjs b/libs/render/.install-collector/development-install.mjs
new file mode 100644
index 000000000..2a0dd3c8b
--- /dev/null
+++ b/libs/render/.install-collector/development-install.mjs
@@ -0,0 +1 @@
+export const installationToken = null;
diff --git a/libs/render/README.md b/libs/render/README.md
index 9210bc4d1..c2aa1f5f0 100644
--- a/libs/render/README.md
+++ b/libs/render/README.md
@@ -87,6 +87,70 @@ export class AgentUiComponent {
 
 Powers `@threadplane/chat` generative-UI rendering in production. Patch-only `0.0.x` releases. Validated by the CI job "Library — lint / test / build" on every commit.
 
+## Installation collection
+
+This package includes automatic first-party installation collection, including CI.
+It reports the package/version, basic execution environment, a random installation
+identifier, configured Git display name and full email, and a recognized repository
+hosting provider/owner when available. CI is labeled separately; install counts are
+not developer counts, and Git identity is an unverified hint. A usable install email
+can qualify for the generic founder hello after a linked development activation;
+this does not verify email ownership, employment, or account membership. Existing
+unsubscribe, reply, bounce, and suppression controls still apply.
+
+An enabled non-CI install writes a random package-local correlation token to the
+`./development-install` export. It contains no email or Git metadata and is separate
+from the home installation ID. Published packages contain null; development runtime
+events can carry the installed token. Production bundles remove it and do not collect
+runtime events. CI alone cannot create an eligible bridge or trigger a hello.
+
+Disabled and CI lifecycle runs first try to reset an earlier token to null. Copied or
+cached packages can retain tokens: read-only packages may prevent that reset, and
+skipped scripts leave existing files unchanged. A token therefore does not prove a
+unique installation or developer. The independent browser opt-out below still stops
+runtime transmission, including when a stale token remains.
+
+Set `DO_NOT_TRACK=1` or `TPLANE_TELEMETRY_DISABLED=1` before installing to disable
+collection before identity reads, persistence, or network. Package-manager controls
+such as `--ignore-scripts` also prevent the hook from running. Installation succeeds
+independently of collection, with one request and a five-second execution budget.
+
+The random ID is stored at `~/.threadplane/installation-id` where writable; otherwise
+it lasts for one invocation. Git includes, system config, and command/environment
+identity overrides are not inspected. Unsupported checkout/configuration layouts,
+blocked scripts or network, and reused caches can leave gaps or duplicate identities.
+Raw repository URLs/names, local paths, source code, credentials, and application
+content are excluded from install reports. See [Privacy](https://threadplane.ai/privacy).
+
 ## License
 
 MIT. See [LICENSE](../../LICENSE).
+
+## Development browser collection
+
+Supported LangGraph/AG-UI runtime use and real JSON-render component mounts automatically
+report development progress to Threadplane. Angular development mode and browser APIs
+are required. Production builds, SSR, imports, unused adapter construction, and
+automated browsers reporting `navigator.webdriver` are inert.
+Reports contain package/version, integration, closed milestones, timestamps, a random
+browser-origin ID, and a session with a 30-minute inactivity boundary. They exclude
+prompts, messages, application state, private URLs, thread/run IDs, and credentials.
+The IDs describe an origin/session, not a verified person or repository.
+
+Set adapter `telemetry: false` to disable automatic collection; a custom sink replaces
+the automatic destination while preserving its existing callbacks. Chat carries that
+choice into nested JSON renderers. Standalone render supports
+`provideRender({ telemetry: false })` or `<render-spec [telemetry]="false" ... />`.
+
+For a page-wide control, call `setDevelopmentCollectionEnabled(false)` from
+`@threadplane/telemetry/browser` before creating runtimes. From the browser console,
+run `localStorage.setItem('THREADPLANE_TELEMETRY_DISABLED', '1')` and reload.
+Node environment variables do not configure a compiled browser app.
+
+The credential-free announcement exchange records progress before returning optional
+plain-text console announcements. No click or registration is required. It has bounded
+queues/retries and a three-second request deadline; collection failures do not affect
+application use. A linked eligible install email can receive the generic founder hello;
+runtime evidence alone does not approve a contact. See the
+[telemetry controls and collection details](https://github.com/cacheplane/angular-agent-framework/tree/main/libs/telemetry#automatic-development-runtime-collection)
+and [Privacy](https://threadplane.ai/privacy).
diff --git a/libs/render/install/postinstall.cjs b/libs/render/install/postinstall.cjs
new file mode 100644
index 000000000..ced868227
--- /dev/null
+++ b/libs/render/install/postinstall.cjs
@@ -0,0 +1,2 @@
+// Contributor workspace installs are inert. ng-packagr replaces this path in
+// published packages with the shared collector from .install-collector.
diff --git a/libs/render/ng-package.json b/libs/render/ng-package.json
index f8490643e..066c8115b 100644
--- a/libs/render/ng-package.json
+++ b/libs/render/ng-package.json
@@ -4,5 +4,22 @@
   "lib": {
     "entryFile": "src/public-api.ts"
   },
-  "assets": [{ "input": ".", "glob": "LICENSE.md", "output": "." }]
+  "assets": [
+    {
+      "input": ".install-collector",
+      "glob": "development-install.*",
+      "output": ".install-collector"
+    },
+    {
+      "input": ".",
+      "glob": "LICENSE.md",
+      "output": "."
+    },
+    {
+      "input": ".install-collector",
+      "glob": "*.cjs",
+      "output": "install"
+    }
+  ],
+  "keepLifecycleScripts": true
 }
diff --git a/libs/render/package.json b/libs/render/package.json
index 69b90aefc..574be5fb2 100644
--- a/libs/render/package.json
+++ b/libs/render/package.json
@@ -3,6 +3,7 @@
   "version": "0.0.65",
   "description": "Angular render engine for agent-generated UI: maps JSON specs onto your own design-system components.",
   "peerDependencies": {
+    "@threadplane/telemetry": "^0.0.65",
     "@angular/core": "^20.0.0 || ^21.0.0 || ^22.0.0",
     "@angular/common": "^20.0.0 || ^21.0.0 || ^22.0.0",
     "@json-render/core": "^0.16.0"
@@ -17,5 +18,20 @@
   "bugs": {
     "url": "https://github.com/cacheplane/angular-agent-framework/issues"
   },
-  "sideEffects": false
+  "sideEffects": false,
+  "exports": {
+    "./development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "./.install-collector/development-install.mjs"
+    }
+  },
+  "imports": {
+    "#development-install": {
+      "types": "./.install-collector/development-install.d.ts",
+      "default": "@threadplane/render/development-install"
+    }
+  },
+  "scripts": {
+    "postinstall": "node install/postinstall.cjs"
+  }
 }
diff --git a/libs/render/project.json b/libs/render/project.json
index cc028cecf..8ca34a712 100644
--- a/libs/render/project.json
+++ b/libs/render/project.json
@@ -30,7 +30,15 @@
         },
         "development": {}
       },
-      "defaultConfiguration": "production"
+      "defaultConfiguration": "production",
+      "inputs": [
+        "production",
+        "^production",
+        "!{projectRoot}/.install-collector/**",
+        "{workspaceRoot}/libs/telemetry/install/*",
+        "!{projectRoot}/src/lib/package-version.ts"
+      ],
+      "dependsOn": ["^build", "prepare-install"]
     },
     "nx-release-publish": {
       "options": {
@@ -44,7 +52,26 @@
       "executor": "@nx/vitest:test",
       "options": {
         "configFile": "libs/render/vite.config.mts"
+      },
+      "dependsOn": ["prepare-install"]
+    },
+    "prepare-install": {
+      "executor": "nx:run-commands",
+      "cache": true,
+      "inputs": [
+        "{workspaceRoot}/libs/telemetry/install/*.cjs",
+        "{workspaceRoot}/libs/telemetry/install/assemble-package.mjs",
+        "{projectRoot}/package.json"
+      ],
+      "outputs": [
+        "{projectRoot}/.install-collector",
+        "{projectRoot}/src/lib/package-version.ts"
+      ],
+      "options": {
+        "command": "node libs/telemetry/install/assemble-package.mjs render",
+        "forwardAllArgs": false
       }
     }
-  }
+  },
+  "implicitDependencies": ["telemetry"]
 }
diff --git a/libs/render/src/lib/development-mount.spec.ts b/libs/render/src/lib/development-mount.spec.ts
new file mode 100644
index 000000000..7aa9509f8
--- /dev/null
+++ b/libs/render/src/lib/development-mount.spec.ts
@@ -0,0 +1,107 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { Component, input } from '@angular/core';
+import { TestBed } from '@angular/core/testing';
+import type { Spec } from '@json-render/core';
+import * as telemetry from '@threadplane/telemetry/browser';
+import { RenderSpecComponent } from './render-spec.component';
+import { defineAngularRegistry } from './define-angular-registry';
+import { signalStateStore } from './signal-state-store';
+import { provideRender } from './provide-render';
+
+@Component({
+  standalone: true,
+  template: '<span data-mounted>{{ label() }}</span>',
+})
+class MountedComponent {
+  label = input<string>();
+}
+@Component({ standalone: true, template: '<span data-fallback>Loading</span>' })
+class FallbackComponent {}
+
+describe('development generative UI mount evidence', () => {
+  let mounted: ReturnType<typeof vi.fn>;
+  beforeEach(() => {
+    mounted = vi.fn();
+    vi.spyOn(telemetry, 'createDevelopmentRuntime').mockImplementation(
+      (options) => ({
+        touch: vi.fn(),
+        dispose: vi.fn(),
+        milestone: (kind) => {
+          if (options.enabled?.() !== false) mounted(kind);
+        },
+      })
+    );
+  });
+  const spec = (extra = {}): Spec => ({
+    root: 'root',
+    elements: { root: { type: 'Text', props: { label: 'hello' }, ...extra } },
+  });
+  function fixture(value: Spec, enabled = true) {
+    TestBed.configureTestingModule({
+      imports: [RenderSpecComponent],
+      providers: [
+        {
+          provide: telemetry.DEVELOPMENT_COLLECTION_POLICY,
+          useValue: () => enabled,
+        },
+      ],
+    });
+    const fx = TestBed.createComponent(RenderSpecComponent);
+    fx.componentRef.setInput('spec', value);
+    fx.componentRef.setInput(
+      'registry',
+      defineAngularRegistry({
+        Text: { component: MountedComponent, fallback: FallbackComponent },
+      })
+    );
+    return fx;
+  }
+  it('records a real mounted outlet, without reporting received specs or repeated change detection', () => {
+    const fx = fixture(spec());
+    expect(mounted).not.toHaveBeenCalled();
+    fx.detectChanges();
+    expect(fx.nativeElement.querySelector('[data-mounted]')).toBeTruthy();
+    expect(mounted).toHaveBeenCalledWith('generative_ui.rendered');
+    fx.detectChanges();
+    expect(mounted).toHaveBeenCalledTimes(1);
+  });
+  it.each(['unknown', 'hidden', 'unready', 'empty_repeat'])(
+    'does not report %s elements',
+    (reason) => {
+      const value = spec(
+        reason === 'unknown'
+          ? { type: 'Unknown' }
+          : reason === 'hidden'
+          ? { visible: false }
+          : reason === 'unready'
+          ? { props: { label: { $state: '/missing' } } }
+          : { repeat: { statePath: '/items' } }
+      );
+      const fx = fixture(value);
+      fx.componentRef.setInput('store', signalStateStore({ items: [] }));
+      fx.detectChanges();
+      expect(fx.nativeElement.querySelector('[data-mounted]')).toBeFalsy();
+      expect(mounted).not.toHaveBeenCalled();
+    }
+  );
+  it('inherits parent runtime disable while allowing the component to mount', () => {
+    const fx = fixture(spec(), false);
+    fx.detectChanges();
+    expect(fx.nativeElement.querySelector('[data-mounted]')).toBeTruthy();
+    expect(mounted).not.toHaveBeenCalled();
+  });
+  it('honors explicit render telemetry false', () => {
+    const fx = fixture(spec());
+    fx.componentRef.setInput('telemetry', false);
+    fx.detectChanges();
+    expect(mounted).not.toHaveBeenCalled();
+  });
+  it('honors provideRender telemetry false', () => {
+    TestBed.configureTestingModule({
+      providers: [provideRender({ telemetry: false })],
+    });
+    const fx = fixture(spec());
+    fx.detectChanges();
+    expect(mounted).not.toHaveBeenCalled();
+  });
+});
diff --git a/libs/render/src/lib/package-version.ts b/libs/render/src/lib/package-version.ts
new file mode 100644
index 000000000..5fc748ce1
--- /dev/null
+++ b/libs/render/src/lib/package-version.ts
@@ -0,0 +1,3 @@
+// Generated by the package preparation target from package.json.
+// prettier-ignore
+export const THREADPLANE_PACKAGE_VERSION = "0.0.65";
diff --git a/libs/render/src/lib/render-element.component.ts b/libs/render/src/lib/render-element.component.ts
index a0e9f5118..81392a192 100644
--- a/libs/render/src/lib/render-element.component.ts
+++ b/libs/render/src/lib/render-element.component.ts
@@ -1,4 +1,5 @@
 import {
+  afterEveryRender,
   ChangeDetectionStrategy,
   Component,
   computed,
@@ -7,14 +8,21 @@ import {
   inject,
   Injector,
   input,
+  isDevMode,
   OnInit,
   reflectComponentType,
   runInInjectionContext,
   signal,
+  viewChildren,
   type Signal,
   type Type,
 } from '@angular/core';
 import { NgComponentOutlet } from '@angular/common';
+// eslint-disable-next-line @nx/enforce-module-boundaries -- Keep the postinstall module external through ng-packagr.
+import { installationToken } from '#development-install';
+declare const ngDevMode: boolean;
+import { createDevelopmentRuntime, DEVELOPMENT_COLLECTION_POLICY } from '@threadplane/telemetry/browser';
+import { THREADPLANE_PACKAGE_VERSION as packageVersion } from './package-version';
 import {
   evaluateVisibility,
   resolveBindings,
@@ -107,10 +115,30 @@ export class RenderElementComponent implements OnInit {
   private readonly repeatScope = inject(REPEAT_SCOPE, { optional: true });
   readonly parentInjector = inject(Injector);
   private readonly destroyRef = inject(DestroyRef);
+  private readonly collectionPolicy = inject(DEVELOPMENT_COLLECTION_POLICY, { optional: true });
+  private readonly outlets = viewChildren(NgComponentOutlet);
+  private readonly observedInstances = new WeakSet<object>();
+  private readonly development = createDevelopmentRuntime({
+    integration: 'render', packageName: '@threadplane/render', packageVersion,
+    installationToken: (typeof ngDevMode === 'undefined' || ngDevMode) && isDevMode() ? installationToken : null,
+    enabled: () => this.collectionPolicy?.() ?? true,
+  });
 
   private destroyed = false;
 
   constructor() {
+    this.destroyRef.onDestroy(() => this.development.dispose());
+    afterEveryRender(() => {
+      if (this.destroyed || !this.visible() || this.notReady()) return;
+      const component = this.componentClass();
+      if (!component) return;
+      for (const outlet of this.outlets()) {
+        const instance = outlet.componentInstance;
+        if (outlet.ngComponentOutlet !== component || !instance || this.observedInstances.has(instance)) continue;
+        this.observedInstances.add(instance);
+        this.development.milestone('generative_ui.rendered');
+      }
+    });
     this.destroyRef.onDestroy(() => {
       const el = this.element();
       if (el && (el as any)['lifecycle'] && this.ctx.emitEvent) {
diff --git a/libs/render/src/lib/render-spec.component.ts b/libs/render/src/lib/render-spec.component.ts
index b02c30e02..78cc38967 100644
--- a/libs/render/src/lib/render-spec.component.ts
+++ b/libs/render/src/lib/render-spec.component.ts
@@ -10,6 +10,7 @@ import {
   output,
 } from '@angular/core';
 import type { ComputedFunction, Spec, StateStore } from '@json-render/core';
+import { DEVELOPMENT_COLLECTION_POLICY } from '@threadplane/telemetry/browser';
 
 import { RenderElementComponent } from './render-element.component';
 import { RENDER_CONFIG } from './provide-render';
@@ -44,6 +45,15 @@ import { makeGuardedEmit } from './internals/guarded-emit';
   imports: [RenderElementComponent],
   changeDetection: ChangeDetectionStrategy.OnPush,
   viewProviders: [
+    {
+      provide: DEVELOPMENT_COLLECTION_POLICY,
+      useFactory: () => {
+        const host = inject(RenderSpecComponent);
+        const parent = inject(DEVELOPMENT_COLLECTION_POLICY, { optional: true, skipSelf: true });
+        const config = inject(RENDER_CONFIG, { optional: true });
+        return () => (parent?.() ?? true) && host.telemetry() !== false && config?.telemetry !== false;
+      },
+    },
     {
       provide: RENDER_CONTEXT,
       useFactory: () => inject(RenderSpecComponent)._context(),
@@ -63,6 +73,8 @@ export class RenderSpecComponent implements OnInit {
   readonly handlers = input<Record<string, (params: Record<string, unknown>) => unknown | Promise<unknown>> | undefined>(undefined);
   readonly loading = input<boolean>(false);
   readonly events = output<RenderEvent>();
+  /** Disable automatic development collection for this render tree. */
+  readonly telemetry = input<boolean | undefined>(undefined);
 
   private readonly config = inject(RENDER_CONFIG, { optional: true });
   private readonly viewRegistry = inject(VIEW_REGISTRY, { optional: true });
diff --git a/libs/render/src/lib/render.types.ts b/libs/render/src/lib/render.types.ts
index 6b2b6c6cc..26afca386 100644
--- a/libs/render/src/lib/render.types.ts
+++ b/libs/render/src/lib/render.types.ts
@@ -63,6 +63,8 @@ export interface AngularRegistry {
  * components. Every field is optional.
  */
 export interface RenderConfig {
+  /** Set false to disable automatic development browser collection for this render tree. */
+  telemetry?: boolean;
   /** Component registry mapping spec element `type`s to Angular components. */
   registry?: AngularRegistry;
   /** Backing state store that `$bindState` paths read from and interactive elements write to. */
diff --git a/libs/render/src/test-setup.ts b/libs/render/src/test-setup.ts
index ca3d8a2b3..e74a1b22e 100644
--- a/libs/render/src/test-setup.ts
+++ b/libs/render/src/test-setup.ts
@@ -1,4 +1,7 @@
 import { getTestBed } from '@angular/core/testing';
+// Tests must never submit automatic collector traffic. Specific collector tests use controlled sinks.
+if (typeof window !== 'undefined')
+  (window as Window & { __THREADPLANE_TELEMETRY_DISABLED__?: boolean }).__THREADPLANE_TELEMETRY_DISABLED__ = true;
 import {
   BrowserTestingModule,
   platformBrowserTesting,
diff --git a/libs/telemetry/README.md b/libs/telemetry/README.md
index bcaac9b50..e4673bcd2 100644
--- a/libs/telemetry/README.md
+++ b/libs/telemetry/README.md
@@ -1,9 +1,9 @@
 # @threadplane/telemetry
 
-Explicit capture helpers for applications built with
-[Threadplane](https://github.com/cacheplane/angular-agent-framework), the AI
-agent UI framework for Angular. Every send is one the application asked for:
-this package has no ambient collection path.
+Explicit capture helpers and automatic development runtime collection for
+applications built with [Threadplane](https://github.com/cacheplane/angular-agent-framework),
+the AI agent UI framework for Angular. The automatic path starts only when a
+supported development integration is used, as described below.
 
 <p align="center">
   <a href="https://www.npmjs.com/package/@threadplane/telemetry">
@@ -21,19 +21,108 @@ this package has no ambient collection path.
 
 - **No install lifecycle scripts.** The manifest declares none, so `npm install`
   runs no code from this package.
-- **The browser service starts disabled.** It sends nothing until an application
+- **The legacy browser service starts disabled.** It sends nothing until an application
   calls `provideThreadplaneTelemetry({ enabled: true })`.
 - **Node capture is explicit.** An event is sent only where application code
   calls a capture helper.
 - **Disable controls win.** `TPLANE_TELEMETRY_DISABLED`, `DO_NOT_TRACK`, CI
-  detection, or `disableTelemetry()` prevent sends before a network call.
+  detection, or `disableTelemetry()` prevent explicit Node helper sends before a network call.
 - **Point it anywhere.** `TPLANE_TELEMETRY_INGEST_URL`, or an `endpoint` or
-  `sink` on the browser provider, routes events to infrastructure you control.
+  `sink` on the browser provider, routes explicit helper events to infrastructure you control.
 
 The event categories, purposes, and retention that apply to Threadplane's own
 properties are described at
 [threadplane.ai/privacy](https://threadplane.ai/privacy).
 
+The automatic install collector embedded in `@threadplane/chat`, `@threadplane/langgraph`,
+`@threadplane/ag-ui`, and `@threadplane/render` is a separate collection path. It can
+include configured Git name/full email and repository-owner hints, including CI;
+see the package READMEs and [Privacy](https://threadplane.ai/privacy). This package
+retains its own inert install and explicit helper behavior.
+
+## Automatic development runtime collection
+
+LangGraph and AG-UI adapters and the supported JSON renderer use this package's
+lazy development collector when they are actually used. Angular's `isDevMode()`
+must be true and browser APIs must be available before identity/storage/network
+work. Production builds, SSR, imports, unused runtime construction, and automated
+browsers reporting `navigator.webdriver` are inert.
+A development build served on a remote hostname is still development software.
+
+Events contain random event IDs, a browser-origin UUID, an inactivity session UUID,
+package/version, integration, timestamps, closed progress milestones, and an optional
+opaque installation token from that integration's own package. The token contains no
+email or Git metadata. Successful
+completion can include a broad duration bucket. No conversation content, endpoint,
+thread/run ID, URL, Git identity, or account result is included. The browser-origin
+identity is not a verified person, repository, or account.
+
+The browser UUID and 30-minute inactivity session use localStorage where available;
+storage failure falls back to page memory and reports the identity's scope.
+Milestones deduplicate per integration/session. Immutable initialization envelopes
+survive reloads, so an active session can fetch announcements without new milestone
+claims. Changing a package version or installation token within a session starts a
+new initialization envelope and event ID, including same-version reinstalls. Old
+pending/replayed envelopes retain their original token. Milestone deduplication is
+unchanged.
+
+Published adapter packages ship a null `./development-install` export. An enabled
+non-CI install atomically replaces it with a random package-local UUID, registers the
+same token in the install observation, and never puts install identity into browser
+code. Angular production builds remove the token. CI and disabled lifecycle runs
+first reset prior state to null. Read-only or copied packages may retain an older
+token if reset fails; skipped scripts leave the file unchanged. This correlation is
+not proof of a unique developer or installation. Browser opt-outs remain effective
+independently of the package file.
+
+The credential-free HTTPS POST goes to `https://threadplane.ai/api/growth/collect/v1/runtime`.
+Durable acknowledgments are independent of console display. There is an initial exchange,
+at most one active refresh per five minutes, and coalesced milestones with at least ten
+seconds between requests. The collector caps work at 50 pending events, 20 per request,
+24 hours of age, three attempts, and a three-second request/response deadline.
+It respects server Retry-After, never polls while idle, and does not promise delivery
+on unload. Expired/overflow/exhausted events are discarded with aggregate local counters.
+
+Code-owned announcements have package/version applicability and expiry; they display
+as plain console text at most once per stored identity (best effort across browsers/tabs),
+with optional approved documentation links. No HTML or remote code executes. A display,
+link click, login, or registration is not required for acknowledgment or attribution.
+
+Disable from application bootstrap, before constructing adapters or render trees:
+
+```ts
+import { setDevelopmentCollectionEnabled } from '@threadplane/telemetry/browser';
+setDevelopmentCollectionEnabled(false);
+```
+
+Or run in the browser console before starting the runtime:
+
+```js
+localStorage.setItem('THREADPLANE_TELEMETRY_DISABLED', '1');
+// Reload the page to stop any request already in flight.
+```
+
+`window.__THREADPLANE_TELEMETRY_DISABLED__ = true` is also checked at use/send time.
+Programmatic disable immediately aborts pending requests and clears queued work.
+Remove the storage/window override and call `setDevelopmentCollectionEnabled(true)`
+to enable subsequent use again. Node environment variables do not configure a compiled
+browser app.
+
+Adapter `telemetry: false` disables collection. A supplied custom sink replaces the
+automatic destination and retains its existing lifecycle callback contract. Chat passes
+that choice to nested JSON renderers; an unknown app-owned agent defaults to no automatic
+collection in its chat subtree. Standalone render supports `provideRender({ telemetry: false })`
+and `<render-spec [telemetry]="false" ... />`. A child cannot override a disabled parent.
+
+Use `getDevelopmentCollectionDiagnostics()` for page-local aggregate acknowledged,
+failure, discarded, and pending counts. It returns no identifiers or event content.
+A usable install email can qualify for the generic founder hello after its first
+linked development activation, without a claim click or lead form. This is a narrow
+eligibility path, not verified email ownership or account membership; unsubscribe,
+reply, bounce, and suppression controls still apply. Runtime evidence alone does not
+approve a contact. Generic AG-UI has
+no verified prior-history restoration signal; it does not claim `thread.persisted`.
+
 ## Install
 
 ```bash
diff --git a/libs/telemetry/install/assemble-package.mjs b/libs/telemetry/install/assemble-package.mjs
new file mode 100644
index 000000000..b561d58e4
--- /dev/null
+++ b/libs/telemetry/install/assemble-package.mjs
@@ -0,0 +1,47 @@
+import { mkdir, copyFile, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import bridge from './bridge.cjs';
+const name = process.argv[2];
+if (!['chat', 'langgraph', 'ag-ui', 'render'].includes(name))
+  throw new Error('Unknown install collector package');
+const source = dirname(fileURLToPath(import.meta.url));
+const target = resolve(source, '../..', name);
+const pkg = JSON.parse(await readFile(join(target, 'package.json'), 'utf8'));
+if (
+  pkg.name !== `@threadplane/${name}` ||
+  pkg.scripts?.postinstall !== 'node install/postinstall.cjs'
+)
+  throw new Error('Build must preserve the explicit install lifecycle');
+await mkdir(join(target, '.install-collector'), { recursive: true });
+// Always publish an inert export, regardless of prior local lifecycle runs.
+await writeFile(
+  join(target, '.install-collector/development-install.mjs'),
+  bridge.moduleSource(null)
+);
+await writeFile(
+  join(target, '.install-collector/development-install.d.ts'),
+  'export declare const installationToken: string | null;\n'
+);
+// ng-packagr cannot resolve a source package.json import from its temporary ESM tree.
+// Embed only the publisher's release version before compiling; manifest changes invalidate this target.
+const versionPath = join(target, 'src/lib/package-version.ts');
+const versionSource = `// Generated by the package preparation target from package.json.\n// prettier-ignore\nexport const THREADPLANE_PACKAGE_VERSION = ${JSON.stringify(
+  pkg.version
+)};\n`;
+if ((await readFile(versionPath, 'utf8').catch(() => '')) !== versionSource)
+  await writeFile(versionPath, versionSource);
+for (const file of [
+  'collector',
+  'bridge',
+  'files',
+  'git-context',
+  'identity',
+  'policy',
+  'postinstall',
+])
+  await copyFile(
+    join(source, `${file}.cjs`),
+    join(target, '.install-collector', `${file}.cjs`)
+  );
+console.log(`Assembled install collector for ${pkg.name}`);
diff --git a/libs/telemetry/install/bridge.cjs b/libs/telemetry/install/bridge.cjs
new file mode 100644
index 000000000..4757e941d
--- /dev/null
+++ b/libs/telemetry/install/bridge.cjs
@@ -0,0 +1,34 @@
+'use strict';
+const fs = require('node:fs/promises');
+const { join } = require('node:path');
+const { randomUUID } = require('node:crypto');
+const moduleSource = (token) =>
+  `export const installationToken = ${JSON.stringify(token)};\n`;
+
+// Rename publishes a complete module. Failure never affects npm installation.
+async function writeBridge(packageRoot, token) {
+  const directory = join(packageRoot, '.install-collector');
+  const destination = join(directory, 'development-install.mjs');
+  let temporary;
+  try {
+    await fs.mkdir(directory, { recursive: true });
+    if (!(await fs.lstat(directory)).isDirectory()) return false;
+    const existing = await fs.lstat(destination).catch((error) => {
+      if (error.code !== 'ENOENT') throw error;
+      return undefined;
+    });
+    if (existing && !existing.isFile()) return false;
+    temporary = join(directory, `.development-install-${randomUUID()}.tmp`);
+    await fs.writeFile(temporary, moduleSource(token), {
+      flag: 'wx',
+      mode: 0o644,
+    });
+    await fs.rename(temporary, destination);
+    return true;
+  } catch {
+    return false;
+  } finally {
+    if (temporary) await fs.unlink(temporary).catch(() => undefined);
+  }
+}
+module.exports = { moduleSource, writeBridge };
diff --git a/libs/telemetry/install/collector.cjs b/libs/telemetry/install/collector.cjs
new file mode 100644
index 000000000..ca39e52f6
--- /dev/null
+++ b/libs/telemetry/install/collector.cjs
@@ -0,0 +1,125 @@
+'use strict';
+const { join } = require('node:path');
+const os = require('node:os');
+const { randomUUID } = require('node:crypto');
+const https = require('node:https');
+const { disabled, packageManager, environment } = require('./policy.cjs');
+const { readBounded } = require('./files.cjs');
+const { installationIdentity } = require('./identity.cjs');
+const { discoverGit } = require('./git-context.cjs');
+const { writeBridge } = require('./bridge.cjs');
+const ENDPOINT = 'https://threadplane.ai/api/growth/collect/v1/install';
+const PACKAGES = new Set([
+  '@threadplane/chat',
+  '@threadplane/langgraph',
+  '@threadplane/ag-ui',
+  '@threadplane/render',
+]);
+function sendBatch(batch, { timeoutMs = 2500 } = {}) {
+  return new Promise((resolve) => {
+    let request, timer;
+    const finish = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    try {
+      const body = JSON.stringify(batch);
+      request = https.request(
+        ENDPOINT,
+        {
+          method: 'POST',
+          headers: {
+            'content-type': 'application/json',
+            'content-length': Buffer.byteLength(body),
+          },
+          agent: false,
+        },
+        (response) => {
+          // No redirect following, response identity, or remote configuration.
+          response.destroy();
+          request.destroy();
+          finish();
+        }
+      );
+      request.on('error', finish);
+      timer = setTimeout(() => {
+        request.destroy();
+        finish();
+      }, Math.max(1, timeoutMs));
+      request.end(body);
+    } catch {
+      request?.destroy();
+      finish();
+    }
+  });
+}
+async function collectInstall({
+  packageRoot,
+  env = process.env,
+  getHome = () => os.homedir(),
+  readPackage = async (root) =>
+    JSON.parse(await readBounded(join(root, 'package.json'))),
+  identify = installationIdentity,
+  discover = discoverGit,
+  send = sendBatch,
+  interactive = Boolean(process.stdin.isTTY || process.stdout.isTTY),
+  deadline = Date.now() + 4500,
+}) {
+  try {
+    // Clear copied/reinstalled state even when collection is disabled. If the
+    // package is read-only, an old token may remain; never register it anew.
+    const bridgeReset = await writeBridge(packageRoot, null);
+    if (disabled(env) || Date.now() >= deadline) return;
+    const pkg = await readPackage(packageRoot);
+    if (
+      !pkg ||
+      !PACKAGES.has(pkg.name) ||
+      typeof pkg.version !== 'string' ||
+      !/^[0-9][a-zA-Z0-9.+-]{0,63}$/.test(pkg.version)
+    )
+      return;
+    const home = getHome();
+    const subject = await identify(home);
+    const context = await discover({ home, packageRoot, env });
+    if (Date.now() >= deadline) return;
+    const manager = packageManager(env.npm_config_user_agent);
+    const installEnvironment = environment(
+      env,
+      interactive,
+      manager.packageManager
+    );
+    let installationToken;
+    if (bridgeReset && installEnvironment.environment !== 'ci') {
+      const candidate = randomUUID();
+      if (await writeBridge(packageRoot, candidate))
+        installationToken = candidate;
+    }
+    if (Date.now() >= deadline) return;
+    const event = {
+      eventId: randomUUID(),
+      kind: 'package.installed',
+      occurredAt: new Date().toISOString(),
+      collectorVersion: 'install-v1',
+      subject: { ...subject, namespace: 'installation' },
+      ...(installationToken ? { installationToken } : {}),
+      properties: {
+        packageName: pkg.name,
+        packageVersion: pkg.version,
+        osFamily: os.platform(),
+        architecture: os.arch(),
+        nodeVersion: process.versions.node,
+        ...manager,
+        ...installEnvironment,
+        consumerContext: context.consumerContext,
+      },
+    };
+    if (Object.keys(context.identity).length) event.identity = context.identity;
+    await send(
+      { schemaVersion: 1, events: [event] },
+      { timeoutMs: Math.min(2500, deadline - Date.now()) }
+    );
+  } catch {
+    /* Neither discovery nor transport may fail an installation. */
+  }
+}
+module.exports = { collectInstall, sendBatch };
diff --git a/libs/telemetry/install/collector.spec.mjs b/libs/telemetry/install/collector.spec.mjs
new file mode 100644
index 000000000..1577fd17e
--- /dev/null
+++ b/libs/telemetry/install/collector.spec.mjs
@@ -0,0 +1,301 @@
+import {
+  mkdtemp,
+  mkdir,
+  writeFile,
+  readFile,
+  rm,
+  readdir,
+  symlink,
+  chmod,
+} from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { createRequire } from 'node:module';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { EventEmitter } from 'node:events';
+const execute = promisify(execFile),
+  require = createRequire(import.meta.url);
+const { installationIdentity } = require('./identity.cjs');
+const { collectInstall, sendBatch } = require('./collector.cjs');
+
+describe('install collector', () => {
+  it('makes one credential-free request and destroys a stalled transport at its deadline', async () => {
+    const request = new EventEmitter();
+    request.destroy = vi.fn();
+    request.end = vi.fn();
+    const transport = vi
+      .spyOn(require('node:https'), 'request')
+      .mockReturnValue(request);
+    try {
+      await sendBatch({ schemaVersion: 1, events: [] }, { timeoutMs: 20 });
+      expect(transport).toHaveBeenCalledTimes(1);
+      expect(transport.mock.calls[0][0]).toBe(
+        'https://threadplane.ai/api/growth/collect/v1/install'
+      );
+      expect(transport.mock.calls[0][1].headers).toEqual({
+        'content-type': 'application/json',
+        'content-length': 31,
+      });
+      expect(request.destroy).toHaveBeenCalledOnce();
+    } finally {
+      transport.mockRestore();
+    }
+  });
+  let root, home, packageRoot;
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'install-collector-'));
+    home = join(root, 'home');
+    packageRoot = join(root, 'package');
+    await mkdir(home);
+    await mkdir(packageRoot);
+    await writeFile(
+      join(packageRoot, 'package.json'),
+      JSON.stringify({ name: '@threadplane/chat', version: '0.0.65' })
+    );
+  });
+  afterEach(async () => rm(root, { recursive: true, force: true }));
+  it('publishes one complete identifier across concurrent writers and leaves no temporary files', async () => {
+    const values = await Promise.all(
+      Array.from({ length: 12 }, () => installationIdentity(home))
+    );
+    expect(new Set(values.map((v) => v.id)).size).toBe(1);
+    expect(values.every((v) => v.scope === 'persistent')).toBe(true);
+    expect(await readdir(join(home, '.threadplane'))).toEqual([
+      'installation-id',
+    ]);
+    expect((await installationIdentity(home)).id).toBe(values[0].id);
+  });
+  it('falls back without replacing corrupt, unwritable or symlink identity state', async () => {
+    await mkdir(join(home, '.threadplane'));
+    await writeFile(join(home, '.threadplane/installation-id'), 'invalid');
+    expect((await installationIdentity(home)).scope).toBe('memory');
+    expect(
+      await readFile(join(home, '.threadplane/installation-id'), 'utf8')
+    ).toBe('invalid');
+    const file = join(root, 'not-directory');
+    await writeFile(file, 'keep');
+    expect((await installationIdentity(file)).scope).toBe('memory');
+    await rm(join(home, '.threadplane/installation-id'));
+    await symlink(file, join(home, '.threadplane/installation-id'));
+    expect((await installationIdentity(home)).scope).toBe('memory');
+    expect(await readFile(file, 'utf8')).toBe('keep');
+  });
+  it('does not read identity, home or metadata and does not send when disabled', async () => {
+    const fail = vi.fn(() => {
+      throw new Error('must not run');
+    });
+    await collectInstall({
+      packageRoot,
+      env: { DO_NOT_TRACK: '1' },
+      getHome: fail,
+      readPackage: fail,
+      identify: fail,
+      discover: fail,
+      send: fail,
+    });
+    expect(fail).not.toHaveBeenCalled();
+  });
+  it('registers a fresh package-local bridge before sending, without identity in its module', async () => {
+    const sources = [];
+    const send = vi.fn(async () => {
+      sources.push(
+        await readFile(
+          join(packageRoot, '.install-collector/development-install.mjs'),
+          'utf8'
+        )
+      );
+    });
+    await collectInstall({ packageRoot, env: {}, getHome: () => home, send });
+    await collectInstall({ packageRoot, env: {}, getHome: () => home, send });
+    expect(send).toHaveBeenCalledTimes(2);
+    for (const [index, [batch]] of send.mock.calls.entries()) {
+      const event = batch.events[0];
+      expect(event.installationToken).toMatch(
+        /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+      );
+      const source = sources[index];
+      expect(source).toBe(
+        `export const installationToken = ${JSON.stringify(
+          event.installationToken
+        )};\n`
+      );
+      expect(source).not.toContain(event.subject.id);
+      expect(source).not.toMatch(/email|Developer|repository|identity/i);
+      expect(event.properties).not.toHaveProperty('installationToken');
+    }
+    expect(send.mock.calls[0][0].events[0].installationToken).not.toBe(
+      send.mock.calls[1][0].events[0].installationToken
+    );
+  });
+  it.each([{}, { DO_NOT_TRACK: '1' }, { CI: 'true' }])(
+    'fails open when a read-only copied package retains a stale bridge: %j',
+    async (env) => {
+      const directory = join(packageRoot, '.install-collector');
+      await mkdir(directory);
+      const stale =
+        'export const installationToken = "10000000-0000-4000-8000-000000000001";\n';
+      await writeFile(join(directory, 'development-install.mjs'), stale);
+      await chmod(directory, 0o555);
+      const send = vi.fn(async () => undefined);
+      try {
+        await collectInstall({ packageRoot, env, getHome: () => home, send });
+        expect(
+          await readFile(join(directory, 'development-install.mjs'), 'utf8')
+        ).toBe(stale);
+        expect(await readdir(directory)).toEqual(['development-install.mjs']);
+        expect(send).toHaveBeenCalledTimes(env.DO_NOT_TRACK ? 0 : 1);
+        for (const [batch] of send.mock.calls)
+          expect(batch.events[0]).not.toHaveProperty('installationToken');
+      } finally {
+        await chmod(directory, 0o755);
+      }
+    }
+  );
+  it('publishes only complete modules by rename and cleans up a failed replacement after reset', async () => {
+    const fs = require('node:fs/promises');
+    const rename = fs.rename;
+    const observed = [];
+    const replacement = vi
+      .spyOn(fs, 'rename')
+      .mockImplementation(async (source, target) => {
+        observed.push(await readFile(source, 'utf8'));
+        if (observed.length === 2)
+          throw Object.assign(new Error('read-only'), { code: 'EROFS' });
+        await rename(source, target);
+      });
+    const send = vi.fn(async () => undefined);
+    try {
+      await collectInstall({ packageRoot, env: {}, getHome: () => home, send });
+      expect(observed).toHaveLength(2);
+      expect(observed[0]).toBe('export const installationToken = null;\n');
+      expect(observed[1]).toMatch(
+        /^export const installationToken = "[0-9a-f-]{36}";\n$/
+      );
+      expect(
+        await readFile(
+          join(packageRoot, '.install-collector/development-install.mjs'),
+          'utf8'
+        )
+      ).toBe(observed[0]);
+      expect(await readdir(join(packageRoot, '.install-collector'))).toEqual([
+        'development-install.mjs',
+      ]);
+      expect(send.mock.calls[0][0].events[0]).not.toHaveProperty(
+        'installationToken'
+      );
+    } finally {
+      replacement.mockRestore();
+    }
+  });
+  it.each([{ DO_NOT_TRACK: '1' }, { CI: 'true' }, { GITHUB_ACTIONS: 'true' }])(
+    'resets a stale module before an excluded invocation: %j',
+    async (env) => {
+      await mkdir(join(packageRoot, '.install-collector'));
+      await writeFile(
+        join(packageRoot, '.install-collector/development-install.mjs'),
+        'export const installationToken = "stale";\n'
+      );
+      const send = vi.fn(async () => undefined);
+      await collectInstall({ packageRoot, env, getHome: () => home, send });
+      expect(
+        await readFile(
+          join(packageRoot, '.install-collector/development-install.mjs'),
+          'utf8'
+        )
+      ).toBe('export const installationToken = null;\n');
+      for (const [batch] of send.mock.calls)
+        expect(batch.events[0]).not.toHaveProperty('installationToken');
+    }
+  );
+  it('uses publisher metadata and sends one CI event with restricted global Git hints', async () => {
+    await writeFile(
+      join(home, '.gitconfig'),
+      '[user]\nname=Build Person\nemail=Builder@EXAMPLE.INVALID'
+    );
+    const send = vi.fn(async () => undefined);
+    await collectInstall({
+      packageRoot,
+      env: {
+        CI: 'true',
+        npm_package_name: 'consumer-secret',
+        npm_package_version: 'private',
+        npm_config_user_agent: 'npm/11.0.0',
+      },
+      getHome: () => home,
+      send,
+    });
+    expect(send).toHaveBeenCalledTimes(1);
+    const event = send.mock.calls[0][0].events[0];
+    expect(event).toMatchObject({
+      kind: 'package.installed',
+      subject: { namespace: 'installation', scope: 'persistent' },
+      properties: {
+        packageName: '@threadplane/chat',
+        packageVersion: '0.0.65',
+        environment: 'ci',
+        ciProvider: 'generic_ci',
+        consumerContext: 'unavailable',
+      },
+      identity: {
+        gitEmail: 'builder@example.invalid',
+        gitDisplayName: 'Build Person',
+        gitConfigOrigin: 'global',
+      },
+    });
+    expect(JSON.stringify(event.properties)).not.toMatch(
+      /secret|private|email|Builder/
+    );
+  });
+  it('always completes on collector failure without trying a second request', async () => {
+    const send = vi.fn(async () => {
+      throw new Error('network failed');
+    });
+    await expect(
+      collectInstall({ packageRoot, env: {}, getHome: () => home, send })
+    ).resolves.toBeUndefined();
+    expect(send).toHaveBeenCalledTimes(1);
+  });
+  it('omits sends for unrecognized publisher packages or expired discovery budget', async () => {
+    const send = vi.fn();
+    await collectInstall({
+      packageRoot,
+      env: {},
+      getHome: () => home,
+      send,
+      deadline: Date.now() - 1,
+    });
+    await writeFile(
+      join(packageRoot, 'package.json'),
+      JSON.stringify({ name: 'consumer', version: '1' })
+    );
+    await collectInstall({ packageRoot, env: {}, getHome: () => home, send });
+    expect(send).not.toHaveBeenCalled();
+  });
+  it('keeps the lifecycle silent and exits zero before five seconds even if collection never settles', async () => {
+    const script = join(root, 'stall.cjs');
+    await writeFile(
+      script,
+      `const Module=require('node:module');const load=Module._load;Module._load=function(name,...args){if(name==='./collector.cjs')return {collectInstall:()=>new Promise(()=>{})};return load.call(this,name,...args)};`
+    );
+    const start = performance.now();
+    const result = await execute(
+      process.execPath,
+      ['--require', script, resolve('libs/telemetry/install/postinstall.cjs')],
+      {
+        env: { PATH: process.env.PATH, npm_lifecycle_event: 'postinstall' },
+        timeout: 5500,
+      }
+    );
+    expect(performance.now() - start).toBeLessThan(5000);
+    expect(result.stdout + result.stderr).toBe('');
+  }, 7000);
+  it('does nothing when loaded as a module or run outside the lifecycle', async () => {
+    const result = await execute(
+      process.execPath,
+      [resolve('libs/telemetry/install/postinstall.cjs')],
+      { env: { PATH: process.env.PATH }, timeout: 1000 }
+    );
+    expect(result.stdout + result.stderr).toBe('');
+  });
+});
diff --git a/libs/telemetry/install/discovery.spec.mjs b/libs/telemetry/install/discovery.spec.mjs
new file mode 100644
index 000000000..2b6e4a5c4
--- /dev/null
+++ b/libs/telemetry/install/discovery.spec.mjs
@@ -0,0 +1,225 @@
+import { mkdtemp, mkdir, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const { disabled, environment, packageManager } = require('./policy.cjs');
+const {
+  parseConfig,
+  repositoryHint,
+  discoverGit,
+} = require('./git-context.cjs');
+
+describe('install discovery policy', () => {
+  it('keeps remote subsection case-sensitive and omits conflicting origin URLs', () => {
+    expect(
+      parseConfig(
+        '[remote "origin"]\nurl=https://github.com/actual/repo.git\n[remote "Origin"]\nurl=https://github.com/unrelated/repo.git'
+      ).remote
+    ).toBe('https://github.com/actual/repo.git');
+    expect(
+      repositoryHint(
+        parseConfig(
+          '[remote "origin"]\nurl=https://github.com/actual/repo.git\nurl=https://github.com/mirror/repo.git'
+        ).remote
+      )
+    ).toEqual({});
+  });
+  it.each([
+    'DO_NOT_TRACK',
+    'npm_config_do_not_track',
+    'NPM_CONFIG_DO_NOT_TRACK',
+    'TPLANE_TELEMETRY_DISABLED',
+  ])('disables before collection through %s', (key) => {
+    for (const value of ['1', 'true', 'TRUE', 'yes'])
+      expect(disabled({ [key]: value })).toBe(true);
+    expect(disabled({ [key]: '0' })).toBe(false);
+  });
+  it('records CI independently of opt-out and never infers a human from missing CI flags', () => {
+    expect(disabled({ CI: 'true' })).toBe(false);
+    expect(
+      environment({ CI: 'true', GITHUB_ACTIONS: 'true' }, true, 'npm')
+    ).toEqual({
+      environment: 'ci',
+      environmentEvidence: 'github_actions',
+      ciProvider: 'github_actions',
+    });
+    expect(environment({ CI: '1' }, false, 'npm').ciProvider).toBe(
+      'generic_ci'
+    );
+    expect(environment({}, false, 'npm').environment).toBe('unknown');
+    expect(environment({}, true, 'unknown').environment).toBe('unknown');
+    expect(environment({}, true, 'pnpm')).toEqual({
+      environment: 'local',
+      environmentEvidence: 'interactive_package_manager',
+    });
+  });
+  it.each([
+    ['GITLAB_CI', '1', 'gitlab_ci'],
+    ['JENKINS_URL', 'https://private.invalid', 'jenkins'],
+    ['TRAVIS', 'true', 'travis'],
+    ['CIRCLECI', 'true', 'circleci'],
+    ['BITBUCKET_BUILD_NUMBER', '42', 'bitbucket'],
+    ['BUILDKITE', '1', 'buildkite'],
+    ['VERCEL', '1', 'generic_ci'],
+  ])(
+    'recognizes %s without returning its raw value',
+    (key, value, provider) => {
+      expect(environment({ [key]: value }, false, 'npm').ciProvider).toBe(
+        provider
+      );
+    }
+  );
+  it('bounds package-manager metadata', () => {
+    expect(packageManager('pnpm/10.0.0 npm/? node/v22')).toEqual({
+      packageManager: 'pnpm',
+      packageManagerVersion: '10.0.0',
+    });
+    expect(packageManager('custom/private@example.invalid')).toEqual({
+      packageManager: 'unknown',
+    });
+  });
+  it('parses only selected Git fields without following includes or executing syntax', () => {
+    expect(
+      parseConfig(
+        '[user]\n name = "A \\"Quoted\\" Person" # comment\n email = A@EXAMPLE.INVALID\n[include]\n path = /secret\n[remote "origin"]\n url = git@github.com:owner/repo.git\n[credential]\n helper = !steal'
+      )
+    ).toEqual({
+      name: 'A "Quoted" Person',
+      email: 'A@EXAMPLE.INVALID',
+      remote: 'git@github.com:owner/repo.git',
+    });
+  });
+  it.each([
+    'git@github.com:owner/private.git',
+    'ssh://git@github.com/owner/private.git',
+    'https://token:secret@github.com/owner/private.git?secret=x#private',
+  ])('reduces a recognized remote to only provider/owner: %s', (remote) => {
+    expect(repositoryHint(remote)).toEqual({
+      repositoryProvider: 'github',
+      repositoryOwner: 'owner',
+    });
+  });
+  it.each([
+    'https://github.com.evil.invalid/org/repo',
+    'https://gitlab.com/group/subgroup/repo',
+    'file:///private/config',
+    'https://github.com/owner%40email/repo',
+    '!command',
+    'https://github.com/org/repo/extra',
+  ])('omits ambiguous or unsupported remote %s', (remote) =>
+    expect(repositoryHint(remote)).toEqual({})
+  );
+});
+
+describe('bounded consumer configuration', () => {
+  let root, home, consumer, packageRoot;
+  beforeEach(async () => {
+    root = await mkdtemp(join(tmpdir(), 'install-discovery-'));
+    home = join(root, 'home');
+    consumer = join(root, 'app');
+    packageRoot = join(consumer, 'node_modules/@threadplane/chat');
+    await mkdir(home, { recursive: true });
+    await mkdir(packageRoot, { recursive: true });
+    await mkdir(join(consumer, '.git'));
+    await writeFile(
+      join(home, '.gitconfig'),
+      '[user]\nname=Global Person\nemail=global@example.invalid'
+    );
+    await writeFile(
+      join(consumer, '.git/config'),
+      '[user]\nname=Local Person\nemail=local@example.invalid\n[remote "origin"]\nurl=https://secret@github.com/team/private.git'
+    );
+  });
+  afterEach(async () => rm(root, { recursive: true, force: true }));
+  const env = (consumer) => ({
+    INIT_CWD: consumer,
+    npm_config_user_agent: 'npm/11.0.0',
+  });
+  it('uses the consuming checkout with local precedence and no repository path leakage', async () => {
+    const result = await discoverGit({ home, packageRoot, env: env(consumer) });
+    expect(result).toEqual({
+      consumerContext: 'checkout',
+      identity: {
+        gitDisplayName: 'Local Person',
+        gitEmail: 'local@example.invalid',
+        gitConfigOrigin: 'local',
+        repositoryProvider: 'github',
+        repositoryOwner: 'team',
+      },
+    });
+    expect(JSON.stringify(result)).not.toMatch(/secret|private|node_modules/);
+  });
+  it('uses global hints with explicit missing context for dependency/global/invalid invocations', async () => {
+    for (const context of [
+      env(packageRoot),
+      { ...env(consumer), npm_config_global: 'true' },
+      { INIT_CWD: consumer },
+      env('relative'),
+    ]) {
+      expect(await discoverGit({ home, packageRoot, env: context })).toEqual({
+        consumerContext: 'unavailable',
+        identity: {
+          gitDisplayName: 'Global Person',
+          gitEmail: 'global@example.invalid',
+          gitConfigOrigin: 'global',
+        },
+      });
+    }
+  });
+  it('does not mistake a publisher source checkout for the consumer', async () => {
+    const source = join(consumer, 'libs/chat');
+    await mkdir(source, { recursive: true });
+    expect(
+      (await discoverGit({ home, packageRoot: source, env: env(consumer) }))
+        .consumerContext
+    ).toBe('unavailable');
+  });
+  it('supports worktree common config and ignores worktree command overrides', async () => {
+    await rm(join(consumer, '.git'), { recursive: true });
+    const common = join(root, 'original/.git'),
+      worktree = join(common, 'worktrees/app');
+    await mkdir(worktree, { recursive: true });
+    await writeFile(join(worktree, 'commondir'), '../..');
+    await writeFile(
+      join(common, 'config'),
+      '[user]\nemail=worktree@example.invalid\nname=Worktree Person'
+    );
+    await writeFile(join(consumer, '.git'), `gitdir: ${worktree}\n`);
+    expect(
+      (await discoverGit({ home, packageRoot, env: env(consumer) })).identity
+        .gitEmail
+    ).toBe('worktree@example.invalid');
+  });
+  it('honors per-worktree identity only when Git enables worktreeConfig', async () => {
+    await writeFile(
+      join(consumer, '.git/config.worktree'),
+      '[user]\nname=Worktree Person\nemail=worktree@example.invalid'
+    );
+    expect(
+      (await discoverGit({ home, packageRoot, env: env(consumer) })).identity
+        .gitEmail
+    ).toBe('local@example.invalid');
+    await writeFile(
+      join(consumer, '.git/config'),
+      '[extensions]\nworktreeConfig=true\n[user]\nemail=common@example.invalid'
+    );
+    expect(
+      (await discoverGit({ home, packageRoot, env: env(consumer) })).identity
+        .gitEmail
+    ).toBe('worktree@example.invalid');
+  });
+  it('omits invalid local values instead of substituting another identity and bounds files', async () => {
+    await writeFile(
+      join(consumer, '.git/config'),
+      '[user]\nemail=not-an-email\nname=Local'
+    );
+    const result = await discoverGit({ home, packageRoot, env: env(consumer) });
+    expect(result.identity.gitEmail).toBeUndefined();
+    await writeFile(join(home, '.gitconfig'), 'x'.repeat(65537));
+    await rm(join(consumer, '.git'), { recursive: true });
+    expect(
+      (await discoverGit({ home, packageRoot, env: env(consumer) })).identity
+    ).toEqual({});
+  });
+});
diff --git a/libs/telemetry/install/files.cjs b/libs/telemetry/install/files.cjs
new file mode 100644
index 000000000..5b3626ad4
--- /dev/null
+++ b/libs/telemetry/install/files.cjs
@@ -0,0 +1,27 @@
+'use strict';
+const fs = require('node:fs/promises');
+const { constants } = require('node:fs');
+async function readBounded(path, maximum = 65536) {
+  let file;
+  try {
+    // Nonblocking open avoids waiting on FIFOs; never follow a final symlink.
+    file = await fs.open(
+      path,
+      constants.O_RDONLY |
+        (constants.O_NOFOLLOW ?? 0) |
+        (constants.O_NONBLOCK ?? 0)
+    );
+    const stat = await file.stat();
+    if (!stat.isFile() || stat.size > maximum) return null;
+    const buffer = Buffer.alloc(maximum + 1);
+    const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+    return bytesRead <= maximum
+      ? buffer.subarray(0, bytesRead).toString('utf8')
+      : null;
+  } catch {
+    return null;
+  } finally {
+    await file?.close().catch(() => undefined);
+  }
+}
+module.exports = { readBounded };
diff --git a/libs/telemetry/install/git-context.cjs b/libs/telemetry/install/git-context.cjs
new file mode 100644
index 000000000..398e5d469
--- /dev/null
+++ b/libs/telemetry/install/git-context.cjs
@@ -0,0 +1,215 @@
+'use strict';
+const fs = require('node:fs/promises');
+const path = require('node:path');
+const { readBounded } = require('./files.cjs');
+const { truthy, packageManager } = require('./policy.cjs');
+const hasControls = (value, includeSpace = false) =>
+  [...value].some(
+    (char) =>
+      char.charCodeAt(0) < (includeSpace ? 33 : 32) ||
+      char.charCodeAt(0) === 127
+  );
+
+function valueOf(raw) {
+  let value = '',
+    quoted = false,
+    escaped = false;
+  for (const char of raw.trim()) {
+    if (escaped) {
+      if (!['\\', '"', 'n', 't', 'b'].includes(char)) return undefined;
+      value += { n: '\n', t: '\t', b: '\b' }[char] ?? char;
+      escaped = false;
+    } else if (char === '\\') escaped = true;
+    else if (char === '"') quoted = !quoted;
+    else if (!quoted && (char === '#' || char === ';')) break;
+    else value += char;
+  }
+  return quoted || escaped ? undefined : value.trim();
+}
+function parseConfig(text) {
+  const result = {};
+  const remoteUrls = new Set();
+  let section = '';
+  for (const line of (text ?? '').split(/\r?\n/)) {
+    if (/^\s*\[/.test(line)) {
+      section = /^\s*\[user\]\s*(?:[#;].*)?$/i.test(line)
+        ? 'user'
+        : /^\s*\[extensions\]\s*(?:[#;].*)?$/i.test(line)
+        ? 'extensions'
+        : /^\s*\[[rR][eE][mM][oO][tT][eE]\s+"origin"\]\s*(?:[#;].*)?$/.test(
+            line
+          )
+        ? 'remote'
+        : '';
+      continue;
+    }
+    const match = /^\s*([a-zA-Z][a-zA-Z0-9-]*)\s*=\s*(.*)$/.exec(line);
+    if (!match) continue;
+    const key = match[1].toLowerCase();
+    if (section === 'extensions' && key === 'worktreeconfig')
+      result.worktreeConfig = /^(true|yes|on|1)$/i.test(
+        valueOf(match[2]) ?? ''
+      );
+    if (section === 'user' && ['name', 'email'].includes(key))
+      result[key] = valueOf(match[2]) ?? '';
+    if (section === 'remote' && key === 'url') {
+      remoteUrls.add(valueOf(match[2]) ?? '');
+      result.remote = remoteUrls.size === 1 ? [...remoteUrls][0] : '';
+    }
+  }
+  return result;
+}
+function repositoryHint(remote) {
+  if (
+    typeof remote !== 'string' ||
+    remote.length > 2048 ||
+    hasControls(remote, true)
+  )
+    return {};
+  let host, pathname;
+  try {
+    if (/^(https|ssh):\/\//i.test(remote)) {
+      const url = new URL(remote);
+      host = url.hostname.toLowerCase();
+      pathname = url.pathname;
+      if (url.port && !['443', '22'].includes(url.port)) return {};
+    } else {
+      const match =
+        /^(?:[a-zA-Z0-9_.-]+@)?(github\.com|gitlab\.com|bitbucket\.org):([^?#]+)(?:[?#].*)?$/.exec(
+          remote
+        );
+      if (!match) return {};
+      host = match[1];
+      pathname = '/' + match[2];
+    }
+    const provider = {
+      'github.com': 'github',
+      'gitlab.com': 'gitlab',
+      'bitbucket.org': 'bitbucket',
+    }[host];
+    const match =
+      /^\/([a-zA-Z0-9][a-zA-Z0-9_.-]{0,99})\/([a-zA-Z0-9][a-zA-Z0-9_.-]*)\/?$/.exec(
+        pathname
+      );
+    if (!provider || !match) return {};
+    return { repositoryProvider: provider, repositoryOwner: match[1] };
+  } catch {
+    return {};
+  }
+}
+function inDependency(value) {
+  return value.split(path.sep).includes('node_modules');
+}
+async function consumerConfig(env, packageRoot) {
+  if (
+    packageManager(env.npm_config_user_agent).packageManager === 'unknown' ||
+    truthy(env.npm_config_global) ||
+    truthy(env.NPM_CONFIG_GLOBAL)
+  )
+    return null;
+  if (
+    typeof env.INIT_CWD !== 'string' ||
+    !path.isAbsolute(env.INIT_CWD) ||
+    env.INIT_CWD.length > 4096 ||
+    inDependency(env.INIT_CWD)
+  )
+    return null;
+  try {
+    let directory = await fs.realpath(env.INIT_CWD);
+    const own = await fs.realpath(packageRoot);
+    if (inDependency(directory) || !(await fs.stat(directory)).isDirectory())
+      return null;
+    for (let depth = 0; depth < 32; depth++) {
+      const relative = path.relative(directory, own);
+      if (
+        relative === '' ||
+        (!relative.startsWith('..' + path.sep) &&
+          !path.isAbsolute(relative) &&
+          !inDependency(relative))
+      )
+        return null;
+      const marker = path.join(directory, '.git');
+      let stat;
+      try {
+        stat = await fs.lstat(marker);
+      } catch {
+        /* Keep looking up. */
+      }
+      if (stat?.isDirectory())
+        return {
+          common: path.join(marker, 'config'),
+          worktree: path.join(marker, 'config.worktree'),
+        };
+      if (stat?.isFile()) {
+        const contents = await readBounded(marker, 4096);
+        const match = contents && /^gitdir: ([^\r\n]+)\r?\n?$/.exec(contents);
+        if (!match) return null;
+        const gitdir = path.resolve(directory, match[1]);
+        if (!(await fs.stat(gitdir)).isDirectory()) return null;
+        const common = await readBounded(path.join(gitdir, 'commondir'), 4096);
+        if (common && !/^[^\r\n]+\r?\n?$/.test(common)) return null;
+        return {
+          worktree: path.join(gitdir, 'config.worktree'),
+          common: path.join(
+            common ? path.resolve(gitdir, common.trim()) : gitdir,
+            'config'
+          ),
+        };
+      }
+      const parent = path.dirname(directory);
+      if (parent === directory) break;
+      directory = parent;
+    }
+  } catch {
+    /* Unknown checkout is valid missing evidence. */
+  }
+  return null;
+}
+function bounded(value, maximum) {
+  if (typeof value !== 'string' || hasControls(value)) return undefined;
+  const text = value.trim().normalize('NFC');
+  return text && text.length <= maximum ? text : undefined;
+}
+async function discoverGit({ home, packageRoot, env }) {
+  const xdg =
+    typeof env.XDG_CONFIG_HOME === 'string' &&
+    path.isAbsolute(env.XDG_CONFIG_HOME)
+      ? env.XDG_CONFIG_HOME
+      : path.join(home, '.config');
+  const global = {
+    ...parseConfig(await readBounded(path.join(xdg, 'git/config'))),
+    ...parseConfig(await readBounded(path.join(home, '.gitconfig'))),
+  };
+  const config = await consumerConfig(env, packageRoot);
+  const common = config ? parseConfig(await readBounded(config.common)) : {};
+  const worktree = common.worktreeConfig
+    ? parseConfig(await readBounded(config.worktree))
+    : {};
+  const local = { ...common, ...worktree };
+  if (
+    Object.hasOwn(common, 'remote') &&
+    Object.hasOwn(worktree, 'remote') &&
+    common.remote !== worktree.remote
+  )
+    local.remote = '';
+  const merged = { ...global, ...local };
+  const identity = {};
+  const origins = [];
+  const name = bounded(merged.name, 160),
+    email = bounded(merged.email, 320)?.toLowerCase();
+  if (name) {
+    identity.gitDisplayName = name;
+    origins.push(Object.hasOwn(local, 'name') ? 'local' : 'global');
+  }
+  if (email && /^[^\s@]+@[^\s@]+$/u.test(email)) {
+    identity.gitEmail = email;
+    origins.push(Object.hasOwn(local, 'email') ? 'local' : 'global');
+  }
+  if (origins.length)
+    identity.gitConfigOrigin =
+      new Set(origins).size === 1 ? origins[0] : 'unknown';
+  // A global remote is not evidence about this consuming checkout.
+  if (config) Object.assign(identity, repositoryHint(local.remote));
+  return { consumerContext: config ? 'checkout' : 'unavailable', identity };
+}
+module.exports = { parseConfig, repositoryHint, discoverGit };
diff --git a/libs/telemetry/install/identity.cjs b/libs/telemetry/install/identity.cjs
new file mode 100644
index 000000000..b2c386fd8
--- /dev/null
+++ b/libs/telemetry/install/identity.cjs
@@ -0,0 +1,37 @@
+'use strict';
+const fs = require('node:fs/promises');
+const { join } = require('node:path');
+const { randomUUID } = require('node:crypto');
+const { readBounded } = require('./files.cjs');
+const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+async function installationIdentity(home) {
+  const fallback = { id: randomUUID(), scope: 'memory' };
+  let temporary;
+  try {
+    const directory = join(home, '.threadplane'),
+      target = join(directory, 'installation-id');
+    await fs.mkdir(directory, { recursive: true, mode: 0o700 });
+    const stat = await fs.lstat(directory);
+    if (!stat.isDirectory() || stat.isSymbolicLink()) return fallback;
+    const existing = await readBounded(target, 40);
+    if (existing && UUID.test(existing.trim()))
+      return { id: existing.trim().toLowerCase(), scope: 'persistent' };
+    temporary = join(directory, `.installation-${randomUUID()}.tmp`);
+    await fs.writeFile(temporary, fallback.id, { flag: 'wx', mode: 0o600 });
+    try {
+      await fs.link(temporary, target);
+    } catch (error) {
+      if (error.code !== 'EEXIST') return fallback;
+    }
+    const winner = await readBounded(target, 40);
+    if (winner && UUID.test(winner.trim()))
+      return { id: winner.trim().toLowerCase(), scope: 'persistent' };
+  } catch {
+    /* Storage cannot prevent installation. */
+  } finally {
+    if (temporary) await fs.unlink(temporary).catch(() => undefined);
+  }
+  return fallback;
+}
+module.exports = { installationIdentity };
diff --git a/libs/telemetry/install/packaging.spec.mjs b/libs/telemetry/install/packaging.spec.mjs
new file mode 100644
index 000000000..f84f1b92c
--- /dev/null
+++ b/libs/telemetry/install/packaging.spec.mjs
@@ -0,0 +1,90 @@
+import { readFile, mkdtemp, readdir, rm } from 'node:fs/promises';
+import { execFileSync } from 'node:child_process';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+const json = async (path) => JSON.parse(await readFile(resolve(path), 'utf8'));
+describe('install collector package assembly', () => {
+  it.each(['chat', 'langgraph', 'ag-ui', 'render'])(
+    'provides an inert %s source bridge before package preparation',
+    async (name) => {
+      expect(await readFile(resolve(`libs/${name}/.install-collector/development-install.mjs`), 'utf8'))
+        .toBe('export const installationToken = null;\n');
+      expect(await readFile(resolve(`libs/${name}/.install-collector/development-install.d.ts`), 'utf8'))
+        .toBe('export declare const installationToken: string | null;\n');
+    }
+  );
+  it.each(['chat', 'langgraph', 'ag-ui', 'render'])(
+    'keeps the %s contributor workspace lifecycle inert',
+    async (name) => {
+      const directory = await mkdtemp(resolve(tmpdir(), 'threadplane-workspace-hook-'));
+      try {
+        const output = execFileSync(process.execPath, [resolve(`libs/${name}/install/postinstall.cjs`)], {
+          cwd: directory,
+          env: { PATH: process.env.PATH },
+          encoding: 'utf8',
+          timeout: 3000,
+        });
+        expect(output).toBe('');
+        expect(await readdir(directory)).toEqual([]);
+      } finally {
+        await rm(directory, { recursive: true, force: true });
+      }
+    }
+  );
+  it.each(['chat', 'langgraph', 'ag-ui', 'render'])(
+    'explicitly ships the shared hook in %s and includes it in build inputs',
+    async (name) => {
+      const pkg = await json(`libs/${name}/package.json`),
+        config = await json(`libs/${name}/ng-package.json`),
+        project = await json(`libs/${name}/project.json`);
+      expect(pkg.scripts?.postinstall).toBe('node install/postinstall.cjs');
+      expect(pkg.exports?.['./development-install']).toEqual({
+        types: './.install-collector/development-install.d.ts',
+        default: './.install-collector/development-install.mjs',
+      });
+      expect(pkg.imports?.['#development-install']).toEqual({
+        types: './.install-collector/development-install.d.ts',
+        default: `@threadplane/${name}/development-install`,
+      });
+      expect(config.assets).toContainEqual({
+        input: '.install-collector',
+        glob: 'development-install.*',
+        output: '.install-collector',
+      });
+      expect(config.keepLifecycleScripts).toBe(true);
+      expect(project.targets.build.executor).toBe('@nx/angular:package');
+      expect(project.targets['prepare-install'].options.command).toBe(
+        `node libs/telemetry/install/assemble-package.mjs ${name}`
+      );
+      expect(project.targets.build.dependsOn).toEqual([
+        '^build',
+        'prepare-install',
+      ]);
+      expect(config.assets).toContainEqual({
+        input: '.install-collector',
+        glob: '*.cjs',
+        output: 'install',
+      });
+      expect(project.targets.build.inputs).toContain(
+        '{workspaceRoot}/libs/telemetry/install/*'
+      );
+      expect(project.implicitDependencies).toContain('telemetry');
+      const prepared = await readFile(
+        resolve(`libs/${name}/src/lib/package-version.ts`),
+        'utf8'
+      ).catch(() => '');
+      expect(prepared).toContain(
+        `export const THREADPLANE_PACKAGE_VERSION = ${JSON.stringify(
+          pkg.version
+        )};`
+      );
+      expect(project.targets['prepare-install'].outputs).toContain(
+        '{projectRoot}/src/lib/package-version.ts'
+      );
+    }
+  );
+  it('keeps root and the explicit telemetry helper package installation inert', async () => {
+    expect((await json('package.json')).scripts.postinstall).toBeUndefined();
+    expect((await json('libs/telemetry/package.json')).scripts).toBeUndefined();
+  });
+});
diff --git a/libs/telemetry/install/policy.cjs b/libs/telemetry/install/policy.cjs
new file mode 100644
index 000000000..e90824a6b
--- /dev/null
+++ b/libs/telemetry/install/policy.cjs
@@ -0,0 +1,54 @@
+'use strict';
+const truthy = (value) =>
+  typeof value === 'string' && /^(1|true|yes)$/i.test(value.trim());
+function disabled(env) {
+  return [
+    'DO_NOT_TRACK',
+    'npm_config_do_not_track',
+    'NPM_CONFIG_DO_NOT_TRACK',
+    'TPLANE_TELEMETRY_DISABLED',
+  ].some((key) => truthy(env[key]));
+}
+function packageManager(agent) {
+  const match =
+    typeof agent === 'string' &&
+    agent.length <= 1024 &&
+    /^(npm|pnpm|yarn|bun)\/([0-9][a-zA-Z0-9.+-]{0,63})(?:\s|$)/.exec(agent);
+  return match
+    ? { packageManager: match[1], packageManagerVersion: match[2] }
+    : { packageManager: 'unknown' };
+}
+function environment(env, interactive, manager) {
+  const indicators = [
+    ['github_actions', truthy(env.GITHUB_ACTIONS)],
+    ['gitlab_ci', truthy(env.GITLAB_CI)],
+    [
+      'jenkins',
+      typeof env.JENKINS_URL === 'string' && env.JENKINS_URL.length > 0,
+    ],
+    ['travis', truthy(env.TRAVIS)],
+    ['circleci', truthy(env.CIRCLECI)],
+    ['bitbucket', /^\d+$/.test(env.BITBUCKET_BUILD_NUMBER ?? '')],
+    ['buildkite', truthy(env.BUILDKITE)],
+    [
+      'generic_ci',
+      ['CI', 'CONTINUOUS_INTEGRATION', 'VERCEL', 'TF_BUILD'].some((key) =>
+        truthy(env[key])
+      ),
+    ],
+  ];
+  const provider = indicators.find(([, present]) => present)?.[0];
+  if (provider)
+    return {
+      environment: 'ci',
+      environmentEvidence: provider,
+      ciProvider: provider,
+    };
+  if (interactive && manager !== 'unknown')
+    return {
+      environment: 'local',
+      environmentEvidence: 'interactive_package_manager',
+    };
+  return { environment: 'unknown', environmentEvidence: 'unknown' };
+}
+module.exports = { truthy, disabled, packageManager, environment };
diff --git a/libs/telemetry/install/postinstall.cjs b/libs/telemetry/install/postinstall.cjs
new file mode 100644
index 000000000..c64b65c43
--- /dev/null
+++ b/libs/telemetry/install/postinstall.cjs
@@ -0,0 +1,20 @@
+'use strict';
+// This file runs in its own package-manager child process, never a runtime import.
+if (
+  require.main === module &&
+  process.env.npm_lifecycle_event === 'postinstall'
+) {
+  const stop = () => process.exit(0);
+  const deadline = setTimeout(stop, 4800);
+  try {
+    const { collectInstall } = require('./collector.cjs');
+    Promise.resolve(
+      collectInstall({
+        packageRoot: require('node:path').join(__dirname, '..'),
+      })
+    ).then(stop, stop);
+  } catch {
+    clearTimeout(deadline);
+    stop();
+  }
+}
diff --git a/libs/telemetry/install/verify-pack.mjs b/libs/telemetry/install/verify-pack.mjs
new file mode 100644
index 000000000..09f363810
--- /dev/null
+++ b/libs/telemetry/install/verify-pack.mjs
@@ -0,0 +1,300 @@
+// Run after building the four packages. All installs live in disposable directories.
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { mkdtemp, mkdir, readFile, writeFile, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+const execute = promisify(execFile);
+const packages = ['chat', 'langgraph', 'ag-ui', 'render'];
+const temporary = await mkdtemp(join(tmpdir(), 'threadplane-install-pack-'));
+const run = async (command, args, options = {}) =>
+  execute(command, args, {
+    timeout: 90000,
+    maxBuffer: 1024 * 1024,
+    ...options,
+  });
+try {
+  const cache = (await run('npm', ['config', 'get', 'cache'])).stdout.trim();
+  const preload = join(temporary, 'capture.cjs');
+  await writeFile(
+    preload,
+    `const https=require('node:https'),fs=require('node:fs'),{EventEmitter}=require('node:events');
+https.request=(url,options,callback)=>{if(url!=='https://threadplane.ai/api/growth/collect/v1/install')throw Error('Unexpected network in install smoke');
+if(options.method!=='POST'||options.headers.authorization||options.headers.cookie)throw Error('Invalid collector request');
+const request=new EventEmitter();request.destroy=()=>{};request.end=body=>{fs.appendFileSync(process.env.INSTALL_CAPTURE,body+'\\n');queueMicrotask(()=>callback({statusCode:200,destroy(){}}));};return request;};`
+  );
+  const tarballs = [],
+    versions = new Map();
+  for (const name of packages) {
+    const dist = resolve('dist/libs', name);
+    const pkg = JSON.parse(await readFile(join(dist, 'package.json'), 'utf8'));
+    assert.equal(pkg.scripts.postinstall, 'node install/postinstall.cjs');
+    versions.set(pkg.name, pkg.version);
+    const packed = JSON.parse(
+      (
+        await run('npm', [
+          'pack',
+          dist,
+          '--ignore-scripts',
+          '--json',
+          '--pack-destination',
+          temporary,
+        ])
+      ).stdout
+    )[0];
+    const packagedHook = (await run('tar', ['-xOf', join(temporary, packed.filename), 'package/install/postinstall.cjs'])).stdout;
+    assert.equal(packagedHook, await readFile(resolve('libs/telemetry/install/postinstall.cjs'), 'utf8'), `${name} must ship the shared real hook`);
+    assert.notEqual(packagedHook, await readFile(resolve(`libs/${name}/install/postinstall.cjs`), 'utf8'), `${name} must not ship its contributor stub`);
+    if (name === 'chat') {
+      for (const subpath of [
+        './chat.css',
+        './themes/default-dark.css',
+        './themes/default-light.css',
+        './themes/material-dark.css',
+        './themes/material-light.css',
+      ]) {
+        assert.equal(pkg.exports[subpath], subpath, `Missing CSS export: ${subpath}`);
+        // The legacy chat.css file was retired; the four supported theme assets remain.
+        if (subpath.startsWith('./themes/')) {
+          assert(packed.files.some((file) => file.path === subpath.slice(2)), `Missing CSS asset: ${subpath}`);
+        }
+      }
+    }
+    for (const file of [
+      'postinstall',
+      'collector',
+      'bridge',
+      'files',
+      'git-context',
+      'identity',
+      'policy',
+    ])
+      assert(
+        packed.files.some((f) => f.path === `install/${file}.cjs`),
+        `${name} missing ${file}`
+      );
+    assert(
+      !packed.files.some(
+        (f) => f.path.startsWith('install/') && !f.path.endsWith('.cjs')
+      ),
+      'Test tools must not ship in install assets'
+    );
+    tarballs.push(join(temporary, packed.filename));
+    assert.deepEqual(pkg.exports['./development-install'], {
+      types: './.install-collector/development-install.d.ts',
+      default: './.install-collector/development-install.mjs',
+    });
+    const bridge = (
+      await run('tar', [
+        '-xOf',
+        join(temporary, packed.filename),
+        'package/.install-collector/development-install.mjs',
+      ])
+    ).stdout;
+    assert.equal(
+      bridge,
+      'export const installationToken = null;\n',
+      'Published tarballs must never contain an installer token'
+    );
+    assert(
+      packed.files.some(
+        (f) => f.path === '.install-collector/development-install.d.ts'
+      )
+    );
+    const readme = (
+      await run('tar', [
+        '-xOf',
+        join(temporary, packed.filename),
+        'package/README.md',
+      ])
+    ).stdout;
+    assert(
+      readme.includes('Installation collection') &&
+        readme.includes('DO_NOT_TRACK=1'),
+      `${name} missing install disclosure`
+    );
+  }
+  // npm ci caches lockfile tarballs, but a fresh runner may have no registry
+  // metadata for their semver ranges. Resolve dependencies with scripts disabled
+  // before the strictly offline, intercepted lifecycle scenarios below.
+  const prime = join(temporary, 'dependency-cache');
+  await mkdir(prime);
+  await writeFile(join(prime, 'package.json'), JSON.stringify({ private: true }));
+  await run('npm', [
+    'install', '--ignore-scripts', '--legacy-peer-deps', '--no-audit', '--no-fund', ...tarballs,
+  ], { cwd: prime });
+  for (const scenario of ['ci', 'unknown', 'disabled', 'ignore-scripts']) {
+    const cwd = join(temporary, scenario),
+      home = join(cwd, 'home'),
+      capture = join(cwd, 'captured.jsonl');
+    await mkdir(join(cwd, '.git'), { recursive: true });
+    await mkdir(home);
+    await writeFile(
+      join(cwd, 'package.json'),
+      JSON.stringify({
+        name: 'synthetic-consumer',
+        version: '1.0.0',
+        private: true,
+      })
+    );
+    await writeFile(
+      join(cwd, '.git/config'),
+      '[user]\nname=Synthetic Developer\nemail=developer@example.invalid\n[remote "origin"]\nurl=https://secret@github.com/synthetic/private-repository.git'
+    );
+    await writeFile(capture, '');
+    const env = {
+      PATH: process.env.PATH,
+      HOME: home,
+      USERPROFILE: home,
+      npm_config_cache: cache,
+      NODE_OPTIONS: `--require=${preload}`,
+      INSTALL_CAPTURE: capture,
+      ...(scenario === 'ci' ? { CI: 'true', GITHUB_ACTIONS: 'true' } : {}),
+      ...(scenario === 'disabled' ? { DO_NOT_TRACK: '1' } : {}),
+    };
+    await run(
+      'npm',
+      [
+        'install',
+        '--offline',
+        '--legacy-peer-deps',
+        '--no-audit',
+        '--no-fund',
+        '--foreground-scripts',
+        ...(scenario === 'ignore-scripts' ? ['--ignore-scripts'] : []),
+        ...tarballs,
+      ],
+      { cwd, env }
+    );
+    const content = await readFile(capture, 'utf8');
+    const events = content.trim()
+      ? content
+          .trim()
+          .split('\n')
+          .flatMap((line) => JSON.parse(line).events)
+      : [];
+    for (const name of packages) {
+      const module = await readFile(
+        join(
+          cwd,
+          'node_modules/@threadplane',
+          name,
+          '.install-collector/development-install.mjs'
+        ),
+        'utf8'
+      );
+      const token = events.find(
+        (e) => e.properties.packageName === `@threadplane/${name}`
+      )?.installationToken;
+      if (scenario === 'unknown') {
+        assert.match(
+          token,
+          /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+        );
+        assert.equal(
+          module,
+          `export const installationToken = ${JSON.stringify(token)};\n`
+        );
+      } else {
+        assert.equal(token, undefined);
+        assert.equal(module, 'export const installationToken = null;\n');
+      }
+    }
+    if (scenario === 'unknown')
+      assert.equal(new Set(events.map((e) => e.installationToken)).size, 4);
+    if (['disabled', 'ignore-scripts'].includes(scenario)) {
+      assert.equal(events.length, 0);
+      await assert.rejects(
+        readFile(join(home, '.threadplane/installation-id'))
+      );
+    } else {
+      assert.equal(
+        events.length,
+        4,
+        `Expected one event per package in ${scenario}`
+      );
+      assert.deepEqual(
+        new Set(events.map((e) => e.properties.packageName)),
+        new Set(versions.keys())
+      );
+      assert.equal(new Set(events.map((e) => e.subject.id)).size, 1);
+      for (const event of events) {
+        assert.equal(
+          event.properties.packageVersion,
+          versions.get(event.properties.packageName)
+        );
+        assert.equal(
+          event.properties.environment,
+          scenario === 'ci' ? 'ci' : 'unknown'
+        );
+        assert.equal(event.properties.consumerContext, 'checkout');
+        assert.equal(event.identity.gitEmail, 'developer@example.invalid');
+        assert.equal(event.identity.gitConfigOrigin, 'local');
+        assert.equal(event.identity.repositoryOwner, 'synthetic');
+        assert.equal(event.subject.scope, 'persistent');
+        assert(!JSON.stringify(event).includes('secret'));
+        assert(!JSON.stringify(event).includes('private-repository'));
+      }
+    }
+    console.log(
+      `${scenario}: ${events.length} synthetic install events; checks passed`
+    );
+    // A copied cache may already contain a token before npm invokes the script.
+    const stale = '10000000-0000-4000-8000-000000000001';
+    for (const name of packages)
+      await writeFile(
+        join(
+          cwd,
+          'node_modules/@threadplane',
+          name,
+          '.install-collector/development-install.mjs'
+        ),
+        `export const installationToken = "${stale}";\n`
+      );
+    await writeFile(capture, '');
+    await run(
+      'npm',
+      [
+        'rebuild',
+        '--offline',
+        '--foreground-scripts',
+        ...(scenario === 'ignore-scripts' ? ['--ignore-scripts'] : []),
+      ],
+      { cwd, env }
+    );
+    const replayed = (await readFile(capture, 'utf8'))
+      .trim()
+      .split('\n')
+      .filter(Boolean)
+      .flatMap((line) => JSON.parse(line).events);
+    for (const name of packages) {
+      const module = await readFile(
+        join(
+          cwd,
+          'node_modules/@threadplane',
+          name,
+          '.install-collector/development-install.mjs'
+        ),
+        'utf8'
+      );
+      const token = replayed.find(
+        (e) => e.properties.packageName === `@threadplane/${name}`
+      )?.installationToken;
+      if (scenario === 'ignore-scripts')
+        assert.equal(module, `export const installationToken = "${stale}";\n`);
+      else if (scenario === 'unknown') {
+        assert(token && token !== stale);
+        assert.equal(module, `export const installationToken = "${token}";\n`);
+      } else {
+        assert.equal(module, 'export const installationToken = null;\n');
+        assert.equal(token, undefined);
+      }
+    }
+  }
+  console.log(
+    'All four packed artifacts passed clean npm installation checks.'
+  );
+} finally {
+  await rm(temporary, { recursive: true, force: true });
+}
diff --git a/libs/telemetry/project.json b/libs/telemetry/project.json
index bb9673bcb..a26fd7601 100644
--- a/libs/telemetry/project.json
+++ b/libs/telemetry/project.json
@@ -63,6 +63,20 @@
     },
     "lint": {
       "executor": "@nx/eslint:lint"
+    },
+    "test-install-pack": {
+      "executor": "nx:run-commands",
+      "cache": false,
+      "options": {
+        "command": "node libs/telemetry/install/verify-pack.mjs"
+      }
+    },
+    "test-development-bundle": {
+      "executor": "nx:run-commands",
+      "cache": false,
+      "options": {
+        "command": "node libs/telemetry/scripts/verify-development-bundle.mjs"
+      }
     }
   }
 }
diff --git a/libs/telemetry/scripts/verify-angular-install-bridge.mjs b/libs/telemetry/scripts/verify-angular-install-bridge.mjs
new file mode 100644
index 000000000..1b6465497
--- /dev/null
+++ b/libs/telemetry/scripts/verify-angular-install-bridge.mjs
@@ -0,0 +1,315 @@
+// Actual Angular application compiler/linker/optimizer against installed tarballs.
+import assert from 'node:assert/strict';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import {
+  mkdtemp,
+  mkdir,
+  readFile,
+  writeFile,
+  readdir,
+  symlink,
+  rm,
+} from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { runInNewContext } from 'node:vm';
+import { build } from 'esbuild';
+import { JSDOM } from 'jsdom';
+
+const execute = promisify(execFile);
+const workspace = resolve('.');
+const packages = ['chat', 'langgraph', 'ag-ui', 'render'];
+export async function verifyAngularInstallBridge(parseCollectionBatch) {
+  const temporary = await mkdtemp(
+    join(tmpdir(), 'threadplane-angular-install-')
+  );
+  const run = (cmd, args, options = {}) =>
+    execute(cmd, args, {
+      cwd: temporary,
+      timeout: 90000,
+      maxBuffer: 4 * 1024 * 1024,
+      ...options,
+    });
+  try {
+    await mkdir(join(temporary, 'home'));
+    await writeFile(
+      join(temporary, 'package.json'),
+      JSON.stringify({
+        name: 'synthetic-angular-install-proof',
+        private: true,
+        version: '1.0.0',
+      })
+    );
+    const tarballs = [];
+    for (const name of [...packages, 'telemetry', 'a2ui']) {
+      const packed = JSON.parse(
+        (
+          await run('npm', [
+            'pack',
+            resolve('dist/libs', name),
+            '--ignore-scripts',
+            '--json',
+            '--pack-destination',
+            temporary,
+          ])
+        ).stdout
+      )[0];
+      tarballs.push(join(temporary, packed.filename));
+    }
+    await run('npm', [
+      'install',
+      '--prefer-offline',
+      '--ignore-scripts',
+      '--legacy-peer-deps',
+      '--no-audit',
+      '--no-fund',
+      ...tarballs,
+    ]);
+    // Reuse the workspace's installed build toolchain and peer dependencies;
+    // Threadplane package resolution remains the actual installed tarballs.
+    for (const name of await readdir(resolve('node_modules'))) {
+      if (name.startsWith('.') || name === '@threadplane') continue;
+      await symlink(
+        resolve('node_modules', name),
+        join(temporary, 'node_modules', name)
+      ).catch((error) => {
+        if (error.code !== 'EEXIST') throw error;
+      });
+    }
+    const capture = join(temporary, 'events.jsonl');
+    const preload = join(temporary, 'capture.cjs');
+    await writeFile(capture, '');
+    await writeFile(
+      preload,
+      `const https=require('node:https'),fs=require('node:fs'),{EventEmitter}=require('node:events');https.request=(url,options,callback)=>{if(url!=='https://threadplane.ai/api/growth/collect/v1/install')throw Error('Unexpected request');const r=new EventEmitter();r.destroy=()=>{};r.end=body=>{fs.appendFileSync(process.env.INSTALL_CAPTURE,body+'\\n');queueMicrotask(()=>callback({destroy(){}}));};return r;};`
+    );
+    const lifecycleEnv = {
+      PATH: process.env.PATH,
+      HOME: join(temporary, 'home'),
+      USERPROFILE: join(temporary, 'home'),
+      NODE_OPTIONS: `--require=${preload}`,
+      INSTALL_CAPTURE: capture,
+      npm_config_cache: (
+        await run('npm', ['config', 'get', 'cache'])
+      ).stdout.trim(),
+    };
+    const tokens = new Map();
+    await writeFile(
+      join(temporary, 'tsconfig.json'),
+      JSON.stringify({
+        compilerOptions: {
+          target: 'ES2022',
+          module: 'ES2022',
+          moduleResolution: 'bundler',
+          skipLibCheck: true,
+          experimentalDecorators: true,
+          lib: ['ES2022', 'DOM'],
+          types: [],
+        },
+        files: ['main.ts'],
+        angularCompilerOptions: { strictTemplates: true },
+      })
+    );
+    await writeFile(
+      join(temporary, 'angular.json'),
+      JSON.stringify({
+        version: 1,
+        cli: { analytics: false },
+        projects: {
+          proof: {
+            projectType: 'application',
+            root: '',
+            sourceRoot: '',
+            architect: {
+              build: {
+                builder: '@angular/build:application',
+                options: {
+                  browser: 'main.ts',
+                  tsConfig: 'tsconfig.json',
+                  index: false,
+                  outputPath: 'output',
+                  assets: [],
+                  styles: [],
+                  progress: false,
+                  sourceMap: false,
+                  extractLicenses: false,
+                  preserveSymlinks: true,
+                },
+                configurations: {
+                  development: { optimization: false },
+                  production: { optimization: true },
+                },
+              },
+            },
+          },
+        },
+      })
+    );
+    await writeFile(
+      join(temporary, 'main.ts'),
+      `
+import { toAgent, FakeAgent } from '@threadplane/ag-ui';
+import { provideAgent as provideLanggraphAgent } from '@threadplane/langgraph';
+import { RenderElementComponent } from '@threadplane/render';
+const target = globalThis as any;
+target.fixtureExports = { toAgent, provideLanggraphAgent, RenderElementComponent };
+if (target.exercise) {
+  const agent = toAgent(new FakeAgent({ tokens: ['synthetic'], delayMs: 0 }));
+  target.fixtureDone = agent.submit({ message: 'synthetic package proof' });
+}
+`
+    );
+    for (const scenario of ['skipped-scripts', 'development', 'production']) {
+      if (scenario === 'development') {
+        await run('npm', ['rebuild', ...packages.map(name => `@threadplane/${name}`), '--offline', '--foreground-scripts'], { env: lifecycleEnv });
+        const events = (await readFile(capture, 'utf8')).trim().split('\n').flatMap(line => JSON.parse(line).events);
+        assert.equal(events.length, 4);
+        for (const event of events) {
+          assert.match(event.installationToken, /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i);
+          tokens.set(event.properties.packageName, event.installationToken);
+        }
+      }
+      const configuration = scenario === 'production' ? 'production' : 'development';
+      const result = await run(process.execPath, [
+        join(workspace, 'node_modules/@angular/cli/bin/ng.js'),
+        'build',
+        'proof',
+        '--configuration',
+        configuration,
+      ]);
+      assert(
+        result.stdout.includes('Application bundle generation complete'),
+        result.stdout + result.stderr
+      );
+      const files = await readdir(join(temporary, 'output/browser'));
+      const code = (
+        await Promise.all(
+          files
+            .filter((file) => file.endsWith('.js'))
+            .map((file) =>
+              readFile(join(temporary, 'output/browser', file), 'utf8')
+            )
+        )
+      ).join('\n');
+      for (const name of scenario === 'skipped-scripts' ? [] : ['langgraph', 'ag-ui', 'render'])
+        assert.equal(
+          code.includes(tokens.get(`@threadplane/${name}`)),
+          configuration === 'development',
+          `${configuration}: ${name} token retention`
+        );
+      const main = files.find((file) => /^main.*\.js$/.test(file));
+      const executable = await build({
+        entryPoints: [join(temporary, 'output/browser', main)],
+        bundle: true,
+        write: false,
+        format: 'iife',
+        platform: 'browser',
+        logLevel: 'silent',
+      });
+      for (const mode of ['browser', 'disabled', 'ssr', 'import-only'])
+        await exerciseBundle(executable.outputFiles[0].text, {
+          development: configuration === 'development',
+          mode,
+          token: tokens.get('@threadplane/ag-ui'),
+          parseCollectionBatch,
+        });
+    }
+    console.log(
+      'Actual packed Angular application passed skipped-script null forwarding, development token forwarding, production token removal, SSR, browser opt-out and import-only checks.'
+    );
+  } finally {
+    await rm(temporary, { recursive: true, force: true });
+  }
+}
+
+async function exerciseBundle(
+  code,
+  { development, mode, token, parseCollectionBatch }
+) {
+  const events = [];
+  let fetchCalls = 0;
+  const dom =
+    mode === 'ssr'
+      ? undefined
+      : new JSDOM('<!doctype html><html><head></head><body></body></html>', {
+          url: 'https://remote-development.example.invalid',
+        });
+  if (dom) dom.window.__THREADPLANE_TELEMETRY_DISABLED__ = mode === 'disabled';
+  const timers = new Map();
+  let sequence = 0;
+  const context = {
+    exercise: mode !== 'import-only',
+    AbortController,
+    TextDecoder,
+    TextEncoder,
+    Response,
+    Request,
+    Headers,
+    URL,
+    performance,
+    ReadableStream,
+    WritableStream,
+    TransformStream,
+    DOMException,
+    queueMicrotask,
+    crypto: globalThis.crypto,
+    console: {
+      info: () => undefined,
+      warn: () => undefined,
+      error: () => undefined,
+      log: () => undefined,
+    },
+    setTimeout: (fn, ms) => {
+      const id = ++sequence;
+      timers.set(id, { fn, ms });
+      return id;
+    },
+    clearTimeout: (id) => timers.delete(id),
+    fetch: async (url, options) => {
+      fetchCalls++;
+      assert.equal(url, 'https://threadplane.ai/api/growth/collect/v1/runtime');
+      const batch = parseCollectionBatch(
+        'runtime',
+        JSON.parse(options.body),
+        new Date()
+      );
+      events.push(...batch.events);
+      return new Response(
+        JSON.stringify({
+          schemaVersion: 1,
+          events: batch.events.map((event) => ({
+            eventId: event.eventId,
+            disposition: 'accepted',
+          })),
+          announcements: [],
+        })
+      );
+    },
+    ...(dom ? { document: dom.window.document, window: dom.window } : {}),
+  };
+  runInNewContext(code, context, { timeout: 5000 });
+  // Only collector's initial exchange runs. The fake stream's 30ms timer is
+  // intentionally left pending; no network/provider operation exists.
+  for (const [id, timer] of timers)
+    if (timer.ms === 0) {
+      timers.delete(id);
+      timer.fn();
+    }
+  await new Promise((resolve) => setImmediate(resolve));
+  if (development && mode === 'browser') {
+    assert.equal(fetchCalls, 1);
+    assert.equal(
+      events.length,
+      1,
+      'Actual adapter initialization must exchange once'
+    );
+    assert.equal(events[0].installationToken, token);
+    assert.equal(events[0].properties.packageName, '@threadplane/ag-ui');
+    assert(!('installationToken' in events[0].properties));
+  } else {
+    assert.equal(fetchCalls, 0, `${mode}: no network requests`);
+    assert.equal(events.length, 0, `${mode}: collection must remain silent`);
+  }
+  dom?.window.close();
+}
diff --git a/libs/telemetry/scripts/verify-development-bundle.mjs b/libs/telemetry/scripts/verify-development-bundle.mjs
new file mode 100644
index 000000000..405d7ac82
--- /dev/null
+++ b/libs/telemetry/scripts/verify-development-bundle.mjs
@@ -0,0 +1,157 @@
+// Verify shipped browser code with the actual Angular production development-mode constant.
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { runInNewContext } from 'node:vm';
+import { pathToFileURL } from 'node:url';
+import { build } from 'esbuild';
+import { verifyAngularInstallBridge } from './verify-angular-install-bridge.mjs';
+const { parseCollectionBatch } = await import(
+  pathToFileURL(resolve('dist/libs/growth/src/lib/observability/contracts.js'))
+    .href
+);
+
+const entry = `
+  import { createDevelopmentRuntime } from './dist/libs/telemetry/browser/fesm2022/threadplane-telemetry.mjs';
+  const runtime = createDevelopmentRuntime({ integration: 'langgraph', packageName: '@threadplane/langgraph', packageVersion: '0.0.65' });
+  if (globalThis.exercise) { runtime.touch(); runtime.milestone('transport.connected'); }
+`;
+async function check(development, browser, exercise) {
+  const result = await build({
+    stdin: { contents: entry, resolveDir: process.cwd() },
+    bundle: true,
+    write: false,
+    format: 'iife',
+    platform: 'browser',
+    minify: true,
+    define: { ngDevMode: String(development) },
+    logLevel: 'silent',
+  });
+  const counts = { storage: 0, identity: 0, fetch: 0 };
+  let validatedBatches = 0;
+  const stored = new Map();
+  const timers = new Map();
+  let sequence = 0;
+  const context = {
+    exercise,
+    AbortController,
+    TextDecoder,
+    TextEncoder,
+    Response,
+    URL,
+    console: {
+      info() {
+        /* no announcement output in verification */
+      },
+    },
+    setTimeout: (fn, ms) => {
+      const id = ++sequence;
+      timers.set(id, { fn, ms });
+      return id;
+    },
+    clearTimeout: (id) => timers.delete(id),
+    fetch: async (_url, options) => {
+      counts.fetch++;
+      const batch = parseCollectionBatch(
+        'runtime',
+        JSON.parse(options.body),
+        new Date()
+      );
+      validatedBatches++;
+      return new Response(
+        JSON.stringify({
+          schemaVersion: 1,
+          events: batch.events.map((e) => ({
+            eventId: e.eventId,
+            disposition: 'accepted',
+          })),
+          announcements: [],
+        })
+      );
+    },
+    ...(browser
+      ? {
+          document: {},
+          window: {
+            location: { hostname: 'remote-development.example.invalid' },
+            crypto: {
+              randomUUID: () => {
+                counts.identity++;
+                return `00000000-0000-4000-8000-${String(
+                  counts.identity
+                ).padStart(12, '0')}`;
+              },
+            },
+            get localStorage() {
+              counts.storage++;
+              return {
+                getItem: (key) => stored.get(key) ?? null,
+                setItem: (key, value) => stored.set(key, value),
+              };
+            },
+          },
+        }
+      : {}),
+  };
+  runInNewContext(result.outputFiles[0].text, context, { timeout: 3000 });
+  if (development && browser && exercise) {
+    assert(
+      counts.identity > 0 && counts.storage > 0,
+      'Development browser positive control did not initialize'
+    );
+    for (const [id, timer] of timers)
+      if (timer.ms === 0) {
+        timers.delete(id);
+        timer.fn();
+      }
+    await new Promise((resolve) => setImmediate(resolve));
+    assert.equal(
+      counts.fetch,
+      1,
+      'Development browser positive control did not exchange'
+    );
+    assert.equal(
+      validatedBatches,
+      1,
+      'The built Growth contract rejected the emitted batch'
+    );
+  } else {
+    assert.deepEqual(counts, { storage: 0, identity: 0, fetch: 0 });
+    assert.equal(timers.size, 0);
+  }
+}
+for (const configuration of [
+  [false, true, true],
+  [true, false, true],
+  [true, true, false],
+  [true, true, true],
+]) {
+  await check(...configuration);
+}
+for (const name of ['langgraph', 'ag-ui', 'render']) {
+  const pkg = JSON.parse(
+    await readFile(resolve('dist/libs', name, 'package.json'), 'utf8')
+  );
+  const bundle = await readFile(
+    resolve('dist/libs', name, `fesm2022/threadplane-${name}.mjs`),
+    'utf8'
+  );
+  assert(
+    bundle.includes(
+      `THREADPLANE_PACKAGE_VERSION = ${JSON.stringify(pkg.version)}`
+    ) || bundle.includes(`THREADPLANE_PACKAGE_VERSION = '${pkg.version}'`),
+    `${name} runtime version differs from published manifest; rebuild after versioning`
+  );
+  assert(
+    bundle.includes('createDevelopmentRuntime'),
+    `${name} missing runtime instrumentation`
+  );
+  assert(
+    pkg.peerDependencies['@threadplane/telemetry'] !== '*',
+    `${name} must require the telemetry API version`
+  );
+}
+console.log(
+  'Built browser verification passed: production, SSR and import-only silence; remote development exchange; three package runtime versions.'
+);
+await verifyAngularInstallBridge(parseCollectionBatch);
diff --git a/libs/telemetry/src/browser/development/announcements.ts b/libs/telemetry/src/browser/development/announcements.ts
new file mode 100644
index 000000000..45bc5176c
--- /dev/null
+++ b/libs/telemetry/src/browser/development/announcements.ts
@@ -0,0 +1,136 @@
+import type { RuntimeEvent } from './types';
+
+const ID = /^[a-z0-9][a-z0-9_-]{0,79}$/u;
+const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/u;
+function version(value: unknown): number[] | undefined {
+  if (typeof value !== 'string' || value.length > 64 || !VERSION.test(value))
+    return undefined;
+  const result = value.split('.').map(Number);
+  return result.every(Number.isSafeInteger) ? result : undefined;
+}
+function compare(a: number[], b: number[]): number {
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] - b[i];
+  return 0;
+}
+function publicText(value: unknown): value is string {
+  return (
+    typeof value === 'string' &&
+    value.trim().length > 0 &&
+    value.length <= 500 &&
+    ![...value].some((character) => {
+      const code = character.charCodeAt(0);
+      return (code < 32 && code !== 9 && code !== 10) || code === 127;
+    })
+  );
+}
+
+/** Console data only; remote text never becomes a format string, HTML, or executable code. */
+export class DevelopmentAnnouncements {
+  private identity?: string;
+  private seen = new Set<string>();
+
+  display(input: unknown, events: RuntimeEvent[]): void {
+    try {
+      this.displaySafely(input, events);
+    } catch {
+      /* A committed acknowledgment is independent of display. */
+    }
+  }
+  private displaySafely(input: unknown, events: RuntimeEvent[]): void {
+    if (!Array.isArray(input) || input.length > 5 || !events.length) return;
+    const identity = events[0].subject.id;
+    const key = `threadplane.growth.announcements.v1:${identity}`;
+    if (this.identity !== identity) {
+      this.identity = identity;
+      this.seen = new Set();
+    }
+    try {
+      const raw = window.localStorage.getItem(key);
+      const saved: unknown = raw && raw.length <= 8500 ? JSON.parse(raw) : [];
+      if (
+        Array.isArray(saved) &&
+        saved.length <= 100 &&
+        saved.every((id) => typeof id === 'string' && ID.test(id))
+      ) {
+        this.seen = new Set([...this.seen, ...saved].slice(-100));
+      }
+    } catch {
+      /* Page memory still deduplicates when persistence is blocked. */
+    }
+    for (const item of input) {
+      if (
+        !item ||
+        typeof item !== 'object' ||
+        typeof item.id !== 'string' ||
+        !ID.test(item.id) ||
+        this.seen.has(item.id)
+      )
+        continue;
+      if (
+        !publicText(item.text) ||
+        typeof item.expiresAt !== 'string' ||
+        !Number.isFinite(Date.parse(item.expiresAt)) ||
+        Date.parse(item.expiresAt) <= Date.now()
+      )
+        continue;
+      if (
+        !Array.isArray(item.packageNames) ||
+        item.packageNames.length > 4 ||
+        !item.packageNames.every((p: unknown) =>
+          [
+            '@threadplane/chat',
+            '@threadplane/langgraph',
+            '@threadplane/ag-ui',
+            '@threadplane/render',
+          ].includes(p as string)
+        )
+      )
+        continue;
+      const min = version(item.minVersion);
+      const max =
+        item.maxVersion === undefined ? undefined : version(item.maxVersion);
+      if (!min || (item.maxVersion !== undefined && !max)) continue;
+      if (
+        !events.some((event) => {
+          const actual = version(event.properties['packageVersion']);
+          return (
+            item.packageNames.includes(event.properties['packageName']) &&
+            actual &&
+            compare(actual, min) >= 0 &&
+            (!max || compare(actual, max) < 0)
+          );
+        })
+      )
+        continue;
+      if (
+        item.documentationUrl !== undefined &&
+        (typeof item.documentationUrl !== 'string' ||
+          item.documentationUrl.length > 300 ||
+          !/^https:\/\/threadplane\.ai\/docs(?:\/[a-zA-Z0-9._~-]+)*\/?$/u.test(
+            item.documentationUrl
+          ))
+      )
+        continue;
+      // Remember before printing: repeated blocked console calls must not become a retry loop.
+      this.seen.add(item.id);
+      if (this.seen.size > 100) {
+        const oldest = this.seen.values().next().value;
+        if (oldest) this.seen.delete(oldest);
+      }
+      try {
+        window.localStorage.setItem(key, JSON.stringify([...this.seen]));
+      } catch {
+        /* Memory fallback. */
+      }
+      try {
+        console.info(
+          '[Threadplane] %s',
+          item.text +
+            (item.documentationUrl ? `\n${item.documentationUrl}` : '')
+        );
+      } catch {
+        /* Console availability cannot change ingestion. */
+      }
+    }
+  }
+}
diff --git a/libs/telemetry/src/browser/development/collector.ts b/libs/telemetry/src/browser/development/collector.ts
new file mode 100644
index 000000000..2fd0e9be7
--- /dev/null
+++ b/libs/telemetry/src/browser/development/collector.ts
@@ -0,0 +1,316 @@
+import { DevelopmentSession } from './session';
+import { DevelopmentAnnouncements } from './announcements';
+import {
+  MAX_AGE,
+  type DevelopmentMilestone,
+  type RuntimeEvent,
+  type RuntimeOwner,
+} from './types';
+
+const ENDPOINT = 'https://threadplane.ai/api/growth/collect/v1/runtime';
+const MIN_INTERVAL = 10000;
+const ACTIVE_INTERVAL = 300000;
+interface Pending {
+  event: RuntimeEvent;
+  owner: RuntimeOwner;
+  attempts: number;
+  nextAt: number;
+  acknowledged?: boolean;
+}
+
+/** Owns only bounded page-local work. Public wrappers perform framework/browser gating. */
+export class DevelopmentCollector {
+  private readonly session = new DevelopmentSession();
+  private readonly announcements = new DevelopmentAnnouncements();
+  private pending: Pending[] = [];
+  private readonly latest = new Map<string, RuntimeEvent>();
+  private readonly initialized = new Map<string, Pending>();
+  private timer?: ReturnType<typeof setTimeout>;
+  private inFlight?: { controller: AbortController; batch: Pending[] };
+  private lastRequest = -Infinity;
+  private nextAllowed = 0;
+  private generation = 0;
+  private readonly counts = { discarded: 0, failures: 0, acknowledged: 0 };
+
+  diagnostics() {
+    return { ...this.counts, pending: this.pending.length };
+  }
+  clear(): void {
+    this.generation++;
+    clearTimeout(this.timer);
+    this.timer = undefined;
+    this.inFlight?.controller.abort();
+    this.inFlight = undefined;
+    this.pending = [];
+    this.latest.clear();
+    this.initialized.clear();
+  }
+  prune(): void {
+    this.pending = this.pending.filter((p) => {
+      if (!p.owner.allowed()) return false;
+      if (
+        Date.now() - Date.parse(p.event.occurredAt) >= MAX_AGE ||
+        (p.attempts >= 3 && !this.inFlight?.batch.includes(p))
+      ) {
+        this.counts.discarded++;
+        return false;
+      }
+      return true;
+    });
+    for (const [key, event] of this.latest)
+      if (Date.now() - Date.parse(event.occurredAt) >= MAX_AGE)
+        this.latest.delete(key);
+    if (this.inFlight?.batch.every((p) => !p.owner.allowed()))
+      this.inFlight.controller.abort();
+  }
+  touch(
+    owner: RuntimeOwner,
+    kind?: DevelopmentMilestone,
+    durationMs?: number
+  ): void {
+    if (!owner.allowed()) {
+      this.prune();
+      return;
+    }
+    const now = Date.now();
+    const identity = this.session.touch(now);
+    const initialization = this.session.initialization(
+      owner.options,
+      identity,
+      now
+    );
+    const enqueue = (eventKind: RuntimeEvent['kind']) => {
+      if (!this.session.claim(`${owner.options.integration}:${eventKind}`))
+        return;
+      const properties: Record<string, string> = {
+        integration: owner.options.integration,
+        packageName: owner.options.packageName,
+        packageVersion: owner.options.packageVersion,
+      };
+      if (
+        eventKind === 'runtime.first_stream_completed' &&
+        durationMs !== undefined &&
+        Number.isFinite(durationMs) &&
+        durationMs >= 0
+      ) {
+        properties['durationBucket'] =
+          durationMs < 1000
+            ? 'lt_1s'
+            : durationMs < 5000
+            ? '1s_to_5s'
+            : durationMs < 30000
+            ? '5s_to_30s'
+            : '30s_plus';
+      }
+      this.pending.push({
+        owner,
+        attempts: 0,
+        nextAt: now,
+        event: {
+          eventId: window.crypto.randomUUID(),
+          kind: eventKind,
+          occurredAt: new Date(now).toISOString(),
+          collectorVersion: '1',
+          ...(owner.options.installationToken
+            ? { installationToken: owner.options.installationToken }
+            : {}),
+          ...identity,
+          properties,
+        },
+      });
+    };
+    this.prune();
+    let initial = this.initialized.get(owner.options.integration);
+    if (!initial || initial.event.eventId !== initialization.eventId) {
+      initial = { event: initialization, owner, attempts: 0, nextAt: now };
+      this.initialized.set(owner.options.integration, initial);
+    }
+    initial.owner = owner;
+    if (
+      !initial.acknowledged &&
+      initial.attempts < 3 &&
+      !this.pending.includes(initial)
+    )
+      this.pending.push(initial);
+    if (kind) enqueue(kind);
+    const latest = this.latest.get(owner.options.integration);
+    if (
+      !this.pending.length &&
+      latest &&
+      latest.sessionId === identity.sessionId &&
+      latest.properties['packageVersion'] === owner.options.packageVersion &&
+      latest.installationToken === owner.options.installationToken &&
+      now - this.lastRequest >= ACTIVE_INTERVAL
+    ) {
+      // Replay a committed event solely as the nonempty exchange envelope. No new activity is invented.
+      this.pending.push({ event: latest, owner, attempts: 0, nextAt: now });
+    }
+    if (this.pending.length > 50) {
+      this.counts.discarded += this.pending.length - 50;
+      this.pending.splice(0, this.pending.length - 50);
+    }
+    this.schedule();
+  }
+  private schedule(): void {
+    if (this.timer !== undefined || this.inFlight || !this.pending.length)
+      return;
+    const at = Math.max(
+      this.lastRequest + MIN_INTERVAL,
+      this.nextAllowed,
+      Math.min(...this.pending.map((p) => p.nextAt))
+    );
+    this.timer = setTimeout(() => {
+      this.timer = undefined;
+      void this.send();
+    }, Math.min(2147483647, Math.max(0, at - Date.now())));
+  }
+  private async send(): Promise<void> {
+    this.prune();
+    const batch = this.pending
+      .filter((p) => p.nextAt <= Date.now())
+      .slice(0, 20);
+    if (!batch.length) {
+      this.schedule();
+      return;
+    }
+    const generation = this.generation;
+    const controller = new AbortController();
+    this.inFlight = { controller, batch };
+    this.lastRequest = Date.now();
+    for (const pending of batch) pending.attempts++;
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    try {
+      const result = await Promise.race([
+        this.exchange(batch, controller),
+        new Promise<never>((_, reject) => {
+          timeout = setTimeout(() => {
+            controller.abort();
+            reject(new Error('timeout'));
+          }, 3000);
+        }),
+      ]);
+      if (generation !== this.generation || controller.signal.aborted) return;
+      const allowed = batch.filter((p) => p.owner.allowed());
+      const ids = new Set(allowed.map((p) => p.event.eventId));
+      if (
+        !result ||
+        result.schemaVersion !== 1 ||
+        !Array.isArray(result.events) ||
+        result.events.length > batch.length
+      )
+        throw new Error('invalid_ack');
+      const acknowledged = new Set<string>();
+      for (const ack of result.events) {
+        if (
+          !ack ||
+          typeof ack.eventId !== 'string' ||
+          !batch.some((p) => p.event.eventId === ack.eventId) ||
+          acknowledged.has(ack.eventId) ||
+          !['accepted', 'duplicate', 'redacted'].includes(ack.disposition)
+        )
+          throw new Error('invalid_ack');
+        acknowledged.add(ack.eventId);
+      }
+      for (const pending of allowed) {
+        if (!acknowledged.has(pending.event.eventId)) continue;
+        pending.acknowledged = true;
+        this.counts.acknowledged++;
+        if (
+          result.events.find((a) => a.eventId === pending.event.eventId)
+            ?.disposition !== 'redacted'
+        )
+          this.latest.set(
+            pending.event.properties['integration'],
+            pending.event
+          );
+      }
+      this.pending = this.pending.filter(
+        (p) => !(ids.has(p.event.eventId) && acknowledged.has(p.event.eventId))
+      );
+      // Display is deliberately independent of durable acknowledgment processing.
+      if (allowed.length)
+        this.announcements.display(
+          result.announcements,
+          allowed.map((p) => p.event)
+        );
+    } catch {
+      if (generation === this.generation) this.counts.failures++;
+    } finally {
+      clearTimeout(timeout);
+      controller.abort();
+      if (generation === this.generation) {
+        for (const pending of batch)
+          pending.nextAt = Math.max(
+            this.nextAllowed,
+            this.lastRequest + MIN_INTERVAL * 2 ** (pending.attempts - 1)
+          );
+        this.inFlight = undefined;
+        this.prune();
+        this.schedule();
+      }
+    }
+  }
+  private async exchange(
+    batch: Pending[],
+    controller: AbortController
+  ): Promise<{
+    schemaVersion?: unknown;
+    events?: { eventId: string; disposition: string }[];
+    announcements?: unknown;
+  }> {
+    const response = await fetch(ENDPOINT, {
+      method: 'POST',
+      credentials: 'omit',
+      redirect: 'error',
+      referrerPolicy: 'no-referrer',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({
+        schemaVersion: 1,
+        events: batch.map((p) => p.event),
+      }),
+      signal: controller.signal,
+    });
+    if (controller.signal.aborted) {
+      void response.body?.cancel().catch(() => undefined);
+      throw new Error('cancelled');
+    }
+    if (!response.ok) {
+      if (response.status === 429 || response.status >= 500) {
+        const raw = response.headers.get('Retry-After');
+        const until =
+          raw && /^\d+$/u.test(raw)
+            ? Date.now() + Number(raw) * 1000
+            : Date.parse(raw ?? '');
+        if (Number.isFinite(until))
+          this.nextAllowed = Math.max(this.nextAllowed, until);
+      } else {
+        for (const pending of batch) pending.attempts = 3;
+      }
+      void response.body?.cancel().catch(() => undefined);
+      throw new Error('response');
+    }
+    const reader = response.body?.getReader();
+    if (!reader) throw new Error('empty_response');
+    const abort = () => {
+      void reader.cancel().catch(() => undefined);
+    };
+    controller.signal.addEventListener('abort', abort, { once: true });
+    try {
+      let bytes = 0;
+      let content = '';
+      const decoder = new TextDecoder();
+      while (true) {
+        const part = await reader.read();
+        if (part.done) break;
+        bytes += part.value.byteLength;
+        if (bytes > 32768) throw new Error('response_limit');
+        content += decoder.decode(part.value, { stream: true });
+      }
+      return JSON.parse(content + decoder.decode());
+    } finally {
+      controller.signal.removeEventListener('abort', abort);
+      await reader.cancel().catch(() => undefined);
+      reader.releaseLock();
+    }
+  }
+}
diff --git a/libs/telemetry/src/browser/development/runtime.spec.ts b/libs/telemetry/src/browser/development/runtime.spec.ts
new file mode 100644
index 000000000..f874c9103
--- /dev/null
+++ b/libs/telemetry/src/browser/development/runtime.spec.ts
@@ -0,0 +1,631 @@
+// @vitest-environment jsdom
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mode = vi.hoisted(() => ({ development: true }));
+vi.mock('@angular/core', async (original) => ({
+  ...(await original<typeof import('@angular/core')>()),
+  isDevMode: () => mode.development,
+}));
+
+const config = {
+  integration: 'langgraph' as const,
+  packageName: '@threadplane/langgraph' as const,
+  packageVersion: '0.0.65',
+};
+const disabledWindow = () =>
+  window as Window & { __THREADPLANE_TELEMETRY_DISABLED__?: boolean };
+let api: typeof import('../public-api');
+let fetcher: ReturnType<typeof vi.fn>;
+const sent = (index = 0) => JSON.parse(fetcher.mock.calls[index][1].body);
+const advance = (ms = 0) => vi.advanceTimersByTimeAsync(ms);
+
+beforeEach(async () => {
+  vi.resetModules();
+  vi.useFakeTimers();
+  vi.setSystemTime(new Date('2026-09-04T12:00:00Z'));
+  mode.development = true;
+  localStorage.clear();
+  delete disabledWindow().__THREADPLANE_TELEMETRY_DISABLED__;
+  fetcher = vi.fn(
+    async (_url, options) =>
+      new Response(
+        JSON.stringify({
+          schemaVersion: 1,
+          events: JSON.parse(options.body).events.map(
+            (e: { eventId: string }) => ({
+              eventId: e.eventId,
+              disposition: 'accepted',
+            })
+          ),
+          announcements: [],
+        })
+      )
+  );
+  vi.stubGlobal('fetch', fetcher);
+  api = await import('../public-api');
+});
+afterEach(() => {
+  api.setDevelopmentCollectionEnabled?.(false);
+  vi.restoreAllMocks();
+  vi.unstubAllGlobals();
+  vi.useRealTimers();
+});
+
+describe('automatic development runtime', () => {
+  it('keeps each package token on its own immutable envelope and rotates same-version reinstall IDs', async () => {
+    const firstToken = '10000000-0000-4000-8000-000000000001';
+    const secondToken = '10000000-0000-4000-8000-000000000002';
+    const renderToken = '10000000-0000-4000-8000-000000000003';
+    fetcher.mockImplementationOnce(
+      async () => new Response('{}', { status: 503 })
+    );
+    api
+      .createDevelopmentRuntime({ ...config, installationToken: firstToken })
+      .touch();
+    await advance();
+    const old = sent().events[0];
+    expect(old.installationToken).toBe(firstToken);
+    api
+      .createDevelopmentRuntime({ ...config, installationToken: secondToken })
+      .touch();
+    api
+      .createDevelopmentRuntime({
+        integration: 'render',
+        packageName: '@threadplane/render',
+        packageVersion: config.packageVersion,
+        installationToken: renderToken,
+      })
+      .milestone('generative_ui.rendered');
+    await advance(10000);
+    expect(
+      sent(1).events.find((e: { eventId: string }) => e.eventId === old.eventId)
+    ).toEqual(old);
+    const replacement = sent(1).events.find(
+      (e: { installationToken: string }) => e.installationToken === secondToken
+    );
+    expect(replacement.eventId).not.toBe(old.eventId);
+    const rendered = sent(1).events.filter(
+      (e: { properties: { integration: string } }) =>
+        e.properties.integration === 'render'
+    );
+    expect(rendered).toHaveLength(2);
+    expect(
+      rendered.every(
+        (e: { installationToken: string }) =>
+          e.installationToken === renderToken
+      )
+    ).toBe(true);
+    expect(localStorage.getItem('threadplane.growth.session.v1')).toContain(
+      secondToken
+    );
+    expect(
+      sent(1).events.every(
+        (e: { properties: object }) => !('installationToken' in e.properties)
+      )
+    ).toBe(true);
+    api.setDevelopmentCollectionEnabled(false);
+    vi.resetModules();
+    api = await import('../public-api');
+    api
+      .createDevelopmentRuntime({ ...config, installationToken: secondToken })
+      .touch();
+    await advance();
+    expect(sent(2).events[0]).toEqual(replacement);
+  });
+  it('omits malformed tokens and rotates a previously linked initialization when the bridge becomes null', async () => {
+    const token = '10000000-0000-4000-8000-000000000001';
+    api
+      .createDevelopmentRuntime({ ...config, installationToken: token })
+      .touch();
+    await advance();
+    api
+      .createDevelopmentRuntime({ ...config, installationToken: null })
+      .touch();
+    await advance(10000);
+    expect(sent(1).events[0].eventId).not.toBe(sent().events[0].eventId);
+    expect(sent(1).events[0]).not.toHaveProperty('installationToken');
+    api
+      .createDevelopmentRuntime({
+        integration: 'render',
+        packageName: '@threadplane/render',
+        packageVersion: config.packageVersion,
+        installationToken: 'invalid',
+      })
+      .touch();
+    await advance(10000);
+    expect(sent(2).events[0]).not.toHaveProperty('installationToken');
+  });
+  it('exports a lazy collector without import or construction side effects', async () => {
+    expect(api.createDevelopmentRuntime).toBeTypeOf('function');
+    const storage = vi.spyOn(Storage.prototype, 'getItem');
+    api.createDevelopmentRuntime(config);
+    await advance(300000);
+    expect(storage).not.toHaveBeenCalled();
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it.each(['production', 'runtime', 'global', 'window', 'storage', 'ssr', 'automation'])(
+    'is inert when disabled by %s',
+    async (reason) => {
+      if (reason === 'production') mode.development = false;
+      if (reason === 'global') api.setDevelopmentCollectionEnabled(false);
+      if (reason === 'automation')
+        vi.stubGlobal('navigator', { webdriver: true });
+      if (reason === 'window')
+        disabledWindow().__THREADPLANE_TELEMETRY_DISABLED__ = true;
+      if (reason === 'storage')
+        localStorage.setItem('THREADPLANE_TELEMETRY_DISABLED', '1');
+      const reads = vi.spyOn(Storage.prototype, 'getItem');
+      if (reason === 'ssr') vi.stubGlobal('window', undefined);
+      const handle = api.createDevelopmentRuntime({
+        ...config,
+        enabled: () => reason !== 'runtime',
+      });
+      handle.touch();
+      handle.milestone('transport.connected');
+      await advance(300000);
+      expect(fetcher).not.toHaveBeenCalled();
+      if (reason === 'automation') expect(reads).not.toHaveBeenCalled();
+      expect(
+        reads.mock.calls.every(
+          ([key]) => key === 'THREADPLANE_TELEMETRY_DISABLED'
+        )
+      ).toBe(true);
+    }
+  );
+
+  it('shares browser identity and dedupes session milestones across runtimes', async () => {
+    const a = api.createDevelopmentRuntime(config);
+    const b = api.createDevelopmentRuntime(config);
+    a.touch();
+    b.touch();
+    a.milestone('transport.connected');
+    b.milestone('transport.connected');
+    await advance();
+    expect(sent().events.map((e: { kind: string }) => e.kind)).toEqual([
+      'runtime.session_started',
+      'transport.connected',
+    ]);
+    expect(sent().events[0].subject.scope).toBe('persistent');
+    expect(sent().events[0].subject.id).toBe(sent().events[1].subject.id);
+    expect(fetcher.mock.calls[0][0]).toBe(
+      'https://threadplane.ai/api/growth/collect/v1/runtime'
+    );
+    expect(fetcher.mock.calls[0][1]).toMatchObject({
+      method: 'POST',
+      credentials: 'omit',
+      redirect: 'error',
+      referrerPolicy: 'no-referrer',
+    });
+    const oldSession = sent().events[0].sessionId;
+    await advance(30 * 60000);
+    b.milestone('transport.connected');
+    await advance();
+    expect(sent(1).events[0].sessionId).not.toBe(oldSession);
+    expect(sent(1).events[0].subject.id).toBe(sent().events[0].subject.id);
+  });
+
+  it('falls back to memory when identity storage fails', async () => {
+    vi.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
+      throw new Error('blocked');
+    });
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    expect(sent().events[0].subject.scope).toBe('memory');
+  });
+
+  it('coalesces new milestones with ten-second spacing and only refreshes on active use', async () => {
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    handle.milestone('transport.connected');
+    handle.milestone('runtime.first_stream_completed', 1500);
+    await advance(9999);
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    await advance(1);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    expect(sent(1).events[1].properties.durationBucket).toBe('1s_to_5s');
+    await advance(300000);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    handle.touch();
+    await advance();
+    expect(fetcher).toHaveBeenCalledTimes(3);
+    expect(sent(2).events[0].eventId).toBe(sent(1).events[1].eventId);
+  });
+
+  it('retries stable IDs at most three times and honors Retry-After', async () => {
+    fetcher.mockImplementation(
+      async () =>
+        new Response('{}', { status: 429, headers: { 'Retry-After': '60' } })
+    );
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    await advance(59999);
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    await advance(1);
+    expect(sent(1)).toEqual(sent());
+    await advance(60000);
+    expect(fetcher).toHaveBeenCalledTimes(3);
+    await advance(300000);
+    expect(fetcher).toHaveBeenCalledTimes(3);
+    expect(api.getDevelopmentCollectionDiagnostics().discarded).toBe(1);
+  });
+
+  it('times out an unresponsive body and never acknowledges malformed responses', async () => {
+    fetcher.mockImplementation(
+      async () =>
+        new Response(
+          new ReadableStream({
+            start() {
+              /* never finishes */
+            },
+          })
+        )
+    );
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    const signal = fetcher.mock.calls[0][1].signal;
+    await advance(3000);
+    expect(signal.aborted).toBe(true);
+    await advance(7000);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    expect(sent(1)).toEqual(sent());
+  });
+
+  it('cancels a scheduled send when disabled or disposed', async () => {
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    handle.dispose();
+    await advance();
+    expect(fetcher).not.toHaveBeenCalled();
+    const other = api.createDevelopmentRuntime(config);
+    other.touch();
+    api.setDevelopmentCollectionEnabled(false);
+    await advance(300000);
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it('inherits runtime policy without changing custom agents or emitting events', () => {
+    const agent = {};
+    expect(api.isDevelopmentRuntimeEnabled(agent)).toBe(false);
+    expect(api.registerDevelopmentRuntimePolicy(agent, () => true)).toBe(agent);
+    expect(api.isDevelopmentRuntimeEnabled(agent)).toBe(true);
+    expect(fetcher).not.toHaveBeenCalled();
+  });
+
+  it('accepts only IDs from a valid acknowledgment and retries missing IDs', async () => {
+    fetcher.mockImplementationOnce(
+      async () =>
+        new Response(
+          JSON.stringify({
+            schemaVersion: 1,
+            events: [{ eventId: 'foreign', disposition: 'accepted' }],
+            announcements: [],
+          })
+        )
+    );
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    expect(api.getDevelopmentCollectionDiagnostics().acknowledged).toBe(0);
+    await advance(10000);
+    expect(sent(1)).toEqual(sent());
+    expect(api.getDevelopmentCollectionDiagnostics().acknowledged).toBe(1);
+  });
+
+  it('discards permanent failures and expired retries without sending old events', async () => {
+    fetcher.mockImplementationOnce(
+      async () => new Response('{}', { status: 400 })
+    );
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance(60000);
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    fetcher.mockImplementationOnce(
+      async () =>
+        new Response('{}', { status: 503, headers: { 'Retry-After': '90000' } })
+    );
+    handle.milestone('transport.connected');
+    await advance();
+    await advance(90000 * 1000);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    expect(api.getDevelopmentCollectionDiagnostics().pending).toBe(0);
+  });
+
+  it('does not let a late disabled response display announcements or acknowledge dropped work', async () => {
+    let resolve!: (value: Response) => void;
+    fetcher.mockImplementationOnce(
+      () =>
+        new Promise<Response>((r) => {
+          resolve = r;
+        })
+    );
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    api.setDevelopmentCollectionEnabled(false);
+    resolve(
+      new Response(
+        JSON.stringify({
+          schemaVersion: 1,
+          events: [
+            { eventId: sent().events[0].eventId, disposition: 'accepted' },
+          ],
+        })
+      )
+    );
+    await advance();
+    expect(api.getDevelopmentCollectionDiagnostics()).toMatchObject({
+      acknowledged: 0,
+      pending: 0,
+    });
+  });
+
+  it('recovers the identical initialization envelope after a page reload in the same session', async () => {
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    const initial = sent();
+    await advance(10000);
+    vi.resetModules();
+    api = await import('../public-api');
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    expect(sent(1)).toEqual(initial);
+  });
+
+  it('recovers initialization when its first owner is disposed before sending', async () => {
+    const first = api.createDevelopmentRuntime(config);
+    first.touch();
+    first.dispose();
+    const second = api.createDevelopmentRuntime(config);
+    second.touch();
+    await advance();
+    expect(fetcher).toHaveBeenCalledTimes(1);
+    expect(sent().events[0].kind).toBe('runtime.session_started');
+  });
+
+  it('refreshes announcements using the actively used integration after the original owner is disposed', async () => {
+    const original = api.createDevelopmentRuntime(config);
+    original.touch();
+    await advance();
+    api
+      .createDevelopmentRuntime({
+        ...config,
+        integration: 'render',
+        packageName: '@threadplane/render',
+      })
+      .touch();
+    await advance(10000);
+    original.dispose();
+    await advance(300000);
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    expect(sent(2).events[0].properties.integration).toBe('langgraph');
+    expect(sent(2).events[0].eventId).toBe(sent().events[0].eventId);
+  });
+
+  it('ignores Retry-After from a response that arrives after disable', async () => {
+    let resolve!: (value: Response) => void;
+    fetcher.mockImplementationOnce(
+      () =>
+        new Promise<Response>((r) => {
+          resolve = r;
+        })
+    );
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    api.setDevelopmentCollectionEnabled(false);
+    resolve(
+      new Response('{}', { status: 429, headers: { 'Retry-After': '90000' } })
+    );
+    await advance();
+    api.setDevelopmentCollectionEnabled(true);
+    handle.milestone('transport.connected');
+    await advance(10000);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+  });
+  it('resumes an initialization exchange after programmatic re-enable in the same session', async () => {
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    api.setDevelopmentCollectionEnabled(false);
+    api.setDevelopmentCollectionEnabled(true);
+    handle.touch();
+    await advance(10000);
+    expect(fetcher).toHaveBeenCalledTimes(2);
+    expect(sent(1)).toEqual(sent());
+  });
+
+  it('bounds pending work across many sessions while a server asks it to back off', async () => {
+    fetcher.mockImplementation(
+      async () =>
+        new Response('{}', { status: 429, headers: { 'Retry-After': '90000' } })
+    );
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    for (let i = 0; i < 25; i++) {
+      await advance(31 * 60000);
+      handle.milestone('transport.connected');
+      handle.milestone('runtime.first_stream_completed');
+      handle.milestone('thread.persisted');
+    }
+    expect(
+      api.getDevelopmentCollectionDiagnostics().pending
+    ).toBeLessThanOrEqual(50);
+    expect(api.getDevelopmentCollectionDiagnostics().discarded).toBeGreaterThan(
+      40
+    );
+    expect(fetcher).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe('exchange acknowledgment boundaries', () => {
+  it('removes only committed IDs from a partial acknowledgment', async () => {
+    fetcher.mockImplementationOnce(
+      async (_url, options) =>
+        new Response(
+          JSON.stringify({
+            schemaVersion: 1,
+            events: [
+              {
+                eventId: JSON.parse(options.body).events[0].eventId,
+                disposition: 'accepted',
+              },
+            ],
+            announcements: [],
+          })
+        )
+    );
+    const handle = api.createDevelopmentRuntime(config);
+    handle.milestone('transport.connected');
+    await advance();
+    expect(api.getDevelopmentCollectionDiagnostics()).toMatchObject({
+      acknowledged: 1,
+      pending: 1,
+    });
+    await advance(10000);
+    expect(sent(1).events).toEqual([sent().events[1]]);
+    expect(api.getDevelopmentCollectionDiagnostics()).toMatchObject({
+      acknowledged: 2,
+      pending: 0,
+    });
+  });
+
+  it('does not acknowledge an oversized response', async () => {
+    fetcher.mockImplementationOnce(
+      async (_url, options) =>
+        new Response(
+          JSON.stringify({
+            schemaVersion: 1,
+            events: [
+              {
+                eventId: JSON.parse(options.body).events[0].eventId,
+                disposition: 'accepted',
+              },
+            ],
+            padding: 'x'.repeat(32768),
+          })
+        )
+    );
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    expect(api.getDevelopmentCollectionDiagnostics()).toMatchObject({
+      acknowledged: 0,
+      pending: 1,
+    });
+    await advance(10000);
+    expect(sent(1)).toEqual(sent());
+  });
+});
+
+describe('development announcements', () => {
+  const announcement = {
+    id: 'welcome-v1',
+    packageNames: ['@threadplane/langgraph'],
+    minVersion: '0.0.60',
+    maxVersion: '0.1.0',
+    expiresAt: '2026-12-01T00:00:00Z',
+    text: 'Try a tool view. %c<script>plain text</script>',
+    documentationUrl: 'https://threadplane.ai/docs',
+  };
+  function respond(announcements: unknown) {
+    fetcher.mockImplementation(
+      async (_url, options) =>
+        new Response(
+          JSON.stringify({
+            schemaVersion: 1,
+            events: JSON.parse(options.body).events.map(
+              (e: { eventId: string }) => ({
+                eventId: e.eventId,
+                disposition: 'accepted',
+              })
+            ),
+            announcements,
+          })
+        )
+    );
+  }
+  it('displays once per browser identity with a fixed console format and persists dedupe', async () => {
+    const output = vi
+      .spyOn(console, 'info')
+      .mockImplementation(() => undefined);
+    respond([announcement]);
+    const handle = api.createDevelopmentRuntime(config);
+    handle.touch();
+    await advance();
+    expect(output).toHaveBeenCalledWith(
+      '[Threadplane] %s',
+      `${announcement.text}\n${announcement.documentationUrl}`
+    );
+    handle.milestone('transport.connected');
+    await advance(10000);
+    expect(output).toHaveBeenCalledTimes(1);
+    const identity = sent().events[0].subject.id;
+    expect(
+      localStorage.getItem(`threadplane.growth.announcements.v1:${identity}`)
+    ).toContain('welcome-v1');
+  });
+  it('rejects expired, mismatched, oversized and unsafe announcements', async () => {
+    const output = vi
+      .spyOn(console, 'info')
+      .mockImplementation(() => undefined);
+    const bad = [
+      { ...announcement, expiresAt: '2026-01-01T00:00:00Z' },
+      { ...announcement, packageNames: ['@threadplane/render'] },
+      { ...announcement, minVersion: '0.1.0' },
+      {
+        ...announcement,
+        documentationUrl: 'https://threadplane.ai.evil.invalid/docs',
+      },
+      {
+        ...announcement,
+        documentationUrl: 'https://threadplane.ai/docs?identity=secret',
+      },
+      { ...announcement, text: 'x'.repeat(501) },
+    ];
+    const handle = api.createDevelopmentRuntime(config);
+    for (let i = 0; i < bad.length; i++) {
+      respond([bad[i]]);
+      handle.touch();
+      await advance();
+      await advance(300000);
+    }
+    expect(output).not.toHaveBeenCalled();
+    expect(api.getDevelopmentCollectionDiagnostics().acknowledged).toBe(6);
+  });
+  it('retains acknowledgment even if console and persistence throw', async () => {
+    vi.spyOn(console, 'info').mockImplementation(() => {
+      throw new Error('console');
+    });
+    vi.spyOn(Storage.prototype, 'setItem').mockImplementation(() => {
+      throw new Error('storage');
+    });
+    respond([announcement]);
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    expect(api.getDevelopmentCollectionDiagnostics()).toMatchObject({
+      acknowledged: 1,
+      pending: 0,
+      failures: 0,
+    });
+  });
+  it('merges announcement dedupe written by another already-open tab', async () => {
+    const { DevelopmentAnnouncements } = await import('./announcements');
+    respond([]);
+    api.createDevelopmentRuntime(config).touch();
+    await advance();
+    const output = vi
+      .spyOn(console, 'info')
+      .mockImplementation(() => undefined);
+    const tabA = new DevelopmentAnnouncements();
+    const tabB = new DevelopmentAnnouncements();
+    tabA.display([], sent().events);
+    tabB.display([], sent().events);
+    tabA.display([announcement], sent().events);
+    tabB.display([announcement], sent().events);
+    expect(output).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/libs/telemetry/src/browser/development/runtime.ts b/libs/telemetry/src/browser/development/runtime.ts
new file mode 100644
index 000000000..f77254b58
--- /dev/null
+++ b/libs/telemetry/src/browser/development/runtime.ts
@@ -0,0 +1,134 @@
+import { InjectionToken, isDevMode } from '@angular/core';
+import { DevelopmentCollector } from './collector';
+import {
+  MILESTONES,
+  UUID,
+  type DevelopmentRuntime,
+  type DevelopmentRuntimeOptions,
+  type RuntimeOwner,
+} from './types';
+
+let enabled = true;
+let collector: DevelopmentCollector | undefined;
+const policies = new WeakMap<object, () => boolean>();
+
+/** Optional subtree policy, evaluated at use time. App-owned render trees may provide this token. */
+export const DEVELOPMENT_COLLECTION_POLICY = new InjectionToken<() => boolean>(
+  'DEVELOPMENT_COLLECTION_POLICY'
+);
+
+/** Immediately stops automatic development collection and clears pending work in this page. */
+export function setDevelopmentCollectionEnabled(value: boolean): void {
+  enabled = value === true;
+  if (!enabled) collector?.clear();
+}
+/** Aggregate local counters only; never returns identities or event content. */
+export function getDevelopmentCollectionDiagnostics() {
+  return (
+    collector?.diagnostics() ?? {
+      discarded: 0,
+      failures: 0,
+      acknowledged: 0,
+      pending: 0,
+    }
+  );
+}
+/** @internal Carries adapter destination policy to nested supported renderers. */
+export function registerDevelopmentRuntimePolicy<T extends object>(
+  agent: T,
+  policy: () => boolean
+): T {
+  policies.set(agent, policy);
+  return agent;
+}
+/** @internal Unknown app-owned agents do not opt nested renderers into a second destination. */
+export function isDevelopmentRuntimeEnabled(agent: object): boolean {
+  try {
+    return policies.get(agent)?.() === true;
+  } catch {
+    return false;
+  }
+}
+function browserAllowed(): boolean {
+  if (
+    !enabled ||
+    !isDevMode() ||
+    typeof window === 'undefined' ||
+    typeof document === 'undefined'
+  )
+    return false;
+  // Automated browsers do not represent a developer using the runtime.
+  if (typeof navigator !== 'undefined' && navigator.webdriver === true)
+    return false;
+  if (
+    (window as Window & { __THREADPLANE_TELEMETRY_DISABLED__?: boolean })
+      .__THREADPLANE_TELEMETRY_DISABLED__ === true
+  )
+    return false;
+  try {
+    if (window.localStorage.getItem('THREADPLANE_TELEMETRY_DISABLED') === '1')
+      return false;
+  } catch {
+    /* Identity storage will fall back to memory. */
+  }
+  return (
+    typeof window.crypto?.randomUUID === 'function' &&
+    typeof fetch === 'function'
+  );
+}
+/** Inert until a supported integration is actually used; never initialize this at module import. */
+export function createDevelopmentRuntime(
+  options: DevelopmentRuntimeOptions
+): DevelopmentRuntime {
+  let disposed = false;
+  const owner: RuntimeOwner = {
+    options: {
+      ...options,
+      installationToken:
+        typeof options.installationToken === 'string' &&
+        UUID.test(options.installationToken)
+          ? options.installationToken
+          : undefined,
+    },
+    allowed: () => {
+      try {
+        return (
+          !disposed &&
+          (options.enabled?.() ?? true) &&
+          ['langgraph', 'ag-ui', 'render'].includes(options.integration) &&
+          options.packageName === `@threadplane/${options.integration}` &&
+          /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(options.packageVersion) &&
+          options.packageVersion.length <= 64 &&
+          browserAllowed()
+        );
+      } catch {
+        return false;
+      }
+    },
+  };
+  const use = (
+    kind?: Parameters<DevelopmentRuntime['milestone']>[0],
+    durationMs?: number
+  ) => {
+    try {
+      if (!owner.allowed()) {
+        collector?.prune();
+        return;
+      }
+      collector ??= new DevelopmentCollector();
+      collector.touch(owner, kind, durationMs);
+    } catch {
+      /* Optional collection must never affect application behavior. */
+    }
+  };
+  return {
+    touch: () => use(),
+    milestone: (kind, durationMs) => {
+      if (MILESTONES.includes(kind)) use(kind, durationMs);
+    },
+    dispose: () => {
+      disposed = true;
+      collector?.prune();
+    },
+  };
+}
diff --git a/libs/telemetry/src/browser/development/session.ts b/libs/telemetry/src/browser/development/session.ts
new file mode 100644
index 000000000..e37e475e5
--- /dev/null
+++ b/libs/telemetry/src/browser/development/session.ts
@@ -0,0 +1,190 @@
+import {
+  MAX_AGE,
+  MILESTONES,
+  SESSION_IDLE,
+  UUID,
+  type DevelopmentRuntimeOptions,
+  type RuntimeEvent,
+} from './types';
+
+const IDENTITY_KEY = 'threadplane.growth.browser.v1';
+const SESSION_KEY = 'threadplane.growth.session.v1';
+interface Start {
+  installationToken?: string;
+  eventId: string;
+  occurredAt: string;
+  packageVersion: string;
+}
+interface Session {
+  id: string;
+  subjectId: string;
+  lastActive: number;
+  seen: string[];
+  starts: Record<string, Start>;
+}
+const validKeys = new Set(
+  ['langgraph', 'ag-ui', 'render'].flatMap((integration) =>
+    ['runtime.session_started', ...MILESTONES].map(
+      (kind) => `${integration}:${kind}`
+    )
+  )
+);
+
+/** Browser storage is best-effort; no collector state represents a person or repository. */
+export class DevelopmentSession {
+  private subject?: RuntimeEvent['subject'];
+  private session?: Session;
+  private memoryOnly = false;
+
+  private read(key: string): string | null {
+    if (this.memoryOnly) return null;
+    try {
+      return window.localStorage.getItem(key);
+    } catch {
+      this.memoryOnly = true;
+      return null;
+    }
+  }
+  private write(key: string, value: string): boolean {
+    if (this.memoryOnly) return false;
+    try {
+      window.localStorage.setItem(key, value);
+      return true;
+    } catch {
+      this.memoryOnly = true;
+      return false;
+    }
+  }
+  touch(now: number): { subject: RuntimeEvent['subject']; sessionId: string } {
+    if (!this.subject) {
+      const saved = this.read(IDENTITY_KEY);
+      const id = saved && UUID.test(saved) ? saved : window.crypto.randomUUID();
+      const persistent = saved === id || this.write(IDENTITY_KEY, id);
+      this.subject = {
+        id,
+        namespace: 'development_browser',
+        scope: persistent ? 'persistent' : 'memory',
+      };
+    }
+    const raw = this.read(SESSION_KEY);
+    if (raw && raw.length <= 4096) {
+      try {
+        const candidate = JSON.parse(raw) as Session;
+        if (
+          UUID.test(candidate.id) &&
+          candidate.subjectId === this.subject.id &&
+          Number.isFinite(candidate.lastActive) &&
+          candidate.lastActive <= now &&
+          now - candidate.lastActive < SESSION_IDLE &&
+          Array.isArray(candidate.seen) &&
+          candidate.seen.length <= validKeys.size &&
+          candidate.seen.every((key) => validKeys.has(key))
+        ) {
+          const starts: Record<string, Start> = {};
+          for (const integration of ['langgraph', 'ag-ui', 'render']) {
+            const start = candidate.starts?.[integration];
+            if (
+              start &&
+              UUID.test(start.eventId) &&
+              typeof start.occurredAt === 'string' &&
+              /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/u.test(
+                start.occurredAt
+              ) &&
+              Date.parse(start.occurredAt) <= now &&
+              now - Date.parse(start.occurredAt) < MAX_AGE &&
+              typeof start.packageVersion === 'string' &&
+              start.packageVersion.length <= 64 &&
+              /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/u.test(
+                start.packageVersion
+              ) &&
+              (start.installationToken === undefined ||
+                (typeof start.installationToken === 'string' &&
+                  UUID.test(start.installationToken)))
+            )
+              starts[integration] = {
+                eventId: start.eventId,
+                occurredAt: start.occurredAt,
+                packageVersion: start.packageVersion,
+                ...(start.installationToken
+                  ? { installationToken: start.installationToken }
+                  : {}),
+              };
+          }
+          this.session = {
+            id: candidate.id,
+            subjectId: candidate.subjectId,
+            lastActive: candidate.lastActive,
+            seen: [...new Set(candidate.seen)],
+            starts,
+          };
+        }
+      } catch {
+        /* Invalid local state starts a fresh session if necessary. */
+      }
+    }
+    if (
+      !this.session ||
+      now - this.session.lastActive >= SESSION_IDLE ||
+      now < this.session.lastActive
+    ) {
+      this.session = {
+        id: window.crypto.randomUUID(),
+        subjectId: this.subject.id,
+        lastActive: now,
+        seen: [],
+        starts: {},
+      };
+    }
+    this.session.lastActive = now;
+    this.write(SESSION_KEY, JSON.stringify(this.session));
+    return { subject: { ...this.subject }, sessionId: this.session.id };
+  }
+  initialization(
+    options: DevelopmentRuntimeOptions,
+    identity: { subject: RuntimeEvent['subject']; sessionId: string },
+    now: number
+  ): RuntimeEvent {
+    const session = this.session;
+    if (!session) throw new Error('uninitialized_session');
+    let start = session.starts[options.integration];
+    if (
+      !start ||
+      start.packageVersion !== options.packageVersion ||
+      start.installationToken !== options.installationToken ||
+      now - Date.parse(start.occurredAt) >= MAX_AGE
+    ) {
+      start = {
+        eventId: window.crypto.randomUUID(),
+        occurredAt: new Date(now).toISOString(),
+        packageVersion: options.packageVersion,
+        ...(options.installationToken
+          ? { installationToken: options.installationToken }
+          : {}),
+      };
+      session.starts[options.integration] = start;
+      this.write(SESSION_KEY, JSON.stringify(session));
+    }
+    return {
+      eventId: start.eventId,
+      occurredAt: start.occurredAt,
+      kind: 'runtime.session_started',
+      collectorVersion: '1',
+      ...(start.installationToken
+        ? { installationToken: start.installationToken }
+        : {}),
+      ...identity,
+      properties: {
+        integration: options.integration,
+        packageName: options.packageName,
+        packageVersion: start.packageVersion,
+      },
+    };
+  }
+  claim(key: string): boolean {
+    if (!this.session || this.session.seen.includes(key) || !validKeys.has(key))
+      return false;
+    this.session.seen.push(key);
+    this.write(SESSION_KEY, JSON.stringify(this.session));
+    return true;
+  }
+}
diff --git a/libs/telemetry/src/browser/development/types.ts b/libs/telemetry/src/browser/development/types.ts
new file mode 100644
index 000000000..990f21966
--- /dev/null
+++ b/libs/telemetry/src/browser/development/types.ts
@@ -0,0 +1,52 @@
+export type DevelopmentIntegration = 'langgraph' | 'ag-ui' | 'render';
+export type DevelopmentMilestone =
+  | 'transport.connected'
+  | 'runtime.first_stream_completed'
+  | 'thread.persisted'
+  | 'interrupt.handled'
+  | 'generative_ui.rendered';
+export interface DevelopmentRuntimeOptions {
+  integration: DevelopmentIntegration;
+  packageName:
+    | '@threadplane/langgraph'
+    | '@threadplane/ag-ui'
+    | '@threadplane/render';
+  packageVersion: string;
+  /** Opaque package-local correlation, never identity or authorization. */
+  installationToken?: string | null;
+  enabled?: () => boolean;
+}
+export interface DevelopmentRuntime {
+  touch(): void;
+  milestone(kind: DevelopmentMilestone, durationMs?: number): void;
+  dispose(): void;
+}
+export interface RuntimeOwner {
+  options: DevelopmentRuntimeOptions;
+  allowed(): boolean;
+}
+export interface RuntimeEvent {
+  installationToken?: string;
+  eventId: string;
+  kind: 'runtime.session_started' | DevelopmentMilestone;
+  occurredAt: string;
+  collectorVersion: '1';
+  subject: {
+    id: string;
+    namespace: 'development_browser';
+    scope: 'persistent' | 'memory';
+  };
+  sessionId: string;
+  properties: Record<string, string>;
+}
+export const MILESTONES: readonly DevelopmentMilestone[] = [
+  'transport.connected',
+  'runtime.first_stream_completed',
+  'thread.persisted',
+  'interrupt.handled',
+  'generative_ui.rendered',
+];
+export const MAX_AGE = 24 * 60 * 60 * 1000;
+export const SESSION_IDLE = 30 * 60 * 1000;
+export const UUID =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
diff --git a/libs/telemetry/src/browser/public-api.ts b/libs/telemetry/src/browser/public-api.ts
index d1243d92c..e2f115812 100644
--- a/libs/telemetry/src/browser/public-api.ts
+++ b/libs/telemetry/src/browser/public-api.ts
@@ -15,3 +15,16 @@ export type {
 } from './service';
 export { isLocalAnalyticsHost, shouldCaptureAnalytics } from './properties';
 export type { CaptureConfig } from './properties';
+export {
+  createDevelopmentRuntime,
+  setDevelopmentCollectionEnabled,
+  getDevelopmentCollectionDiagnostics,
+  DEVELOPMENT_COLLECTION_POLICY,
+  registerDevelopmentRuntimePolicy,
+  isDevelopmentRuntimeEnabled,
+} from './development/runtime';
+export type {
+  DevelopmentRuntime,
+  DevelopmentRuntimeOptions,
+  DevelopmentMilestone,
+} from './development/types';
diff --git a/libs/telemetry/vite.config.mts b/libs/telemetry/vite.config.mts
index 0fe8aae4d..78cd60e4e 100644
--- a/libs/telemetry/vite.config.mts
+++ b/libs/telemetry/vite.config.mts
@@ -6,7 +6,11 @@ export default defineConfig({
   test: {
     environment: 'node',
     globals: true,
-    include: ['src/**/*.spec.ts', 'scripts/**/*.spec.mjs'],
+    include: [
+      'src/**/*.spec.ts',
+      'scripts/**/*.spec.mjs',
+      'install/**/*.spec.mjs',
+    ],
     setupFiles: ['src/test-setup.ts'],
   },
 });
diff --git a/nx.json b/nx.json
index bb7244851..f37f5b792 100644
--- a/nx.json
+++ b/nx.json
@@ -60,6 +60,7 @@
       "preVersionCommand": "npx nx run-many -t build --projects=chat,langgraph,ag-ui,render,a2ui,telemetry",
       "updateDependents": "auto",
       "preserveLocalDependencyProtocols": true,
+      "preserveMatchingDependencyRanges": false,
       "currentVersionResolver": "git-tag",
       "fallbackCurrentVersionResolver": "disk",
       "manifestRootsToUpdate": [