- doctor: resolve the workspace/Nix runtime before the native path, honour
multi-entry XDG_DATA_DIRS, raise the kernel minimum to 5.14, and redact
home/prefix/workspace paths by default (--no-redact opts out). Reports are
written mode 0600.
- crash-report: drop the whole-process table from the default bundle
(--all-processes opts in), mask credentials in argv, strip window titles,
validate --label, find the workspace launcher log, bound the log tail,
describe missing logs, write the archive 0600 without owner metadata, and
keep --json output pure JSON.
- perf-baseline: reject non-finite times and absurd frame times, count
--last by usable match, include the last sample interval in duration,
record only the log basename, and rename p50/p95/p99 to sample_p* to make
clear they are ten-second samples.
- docs: correct the metric descriptions, flag names and shader-cache sign.