Add protected interaction evidence and measured debugging phases

docs/browser-diagnostics.md

@@ -34,7 +34,9 @@ The privileged browser instruments fixed operation families: IPC, local agent ac
 
 Attributes are explicitly typed and allowlisted: registered operation/component enums, UUID session/device IDs, policy version, bounded byte/count fields, duration, decision, request type and status. Failure spans receive a status and a fixed exception category (`Error`, `TypeError` or `RangeError`), never an exception message or stack. Arbitrary operation names are not recorded. Returned model answers, credential values and inspected content are never inferred as diagnostic attributes.
 
-Detailed timing within Python parsing, OCR, YARA or model inference is not yet exported as its own child spans; the browser records the local-inspector call boundary. Renderer paint/layout and Chromium internal tracing are also separate future work. This is explicit application instrumentation, not a claim to trace every Chromium function.
+Signed debug mode imports validated private-pipe timing records as inspector child spans: inspection, parsing, OCR, OCR model initialization, YARA, macro extraction, semantic inference and semantic model initialization. Operational mode retains the call boundary. Renderer paint/layout, individual model kernels and Chromium internal tracing remain separate future work. This is explicit application instrumentation, not a claim to trace every Chromium function.
+
+Protected evidence delivery has separate capture, challenge, encryption, send and acknowledgement stages, correlated with backend decrypt/store spans. Startup before enrollment or before a verified diagnostics policy cannot export telemetry; local smoke fixtures record bounded startup phase, window loading state and resource snapshots without URLs or credentials. Do not attribute an early startup timeout to a model or CPU pressure without measurements.
 
 ## Lifecycle and security behavior
 
@@ -42,6 +44,16 @@ Only verified policy configures the provider. Reconfiguration immediately invali
 
 Export failure never repeats the protected operation, changes its result or authorizes blocked data. Successful and failing functions retain their original results/errors. Normal shutdown attempts a bounded flush; diagnostics are intentionally nondurable and can be lost in a crash. Durable audit and forensic evidence require their separate pipelines.
 
+Local status distinguishes current-generation `failedExports` from process-lifetime
+`lifetimeFailedExports`. Disabling or changing policy resets the former but retains
+the latter until process restart. This counter does not export after disable.
+
+Policy reconciliation now names signature verification, bookmark verification,
+agent reconciliation, page configuration and durable audit phases. Same-version
+refreshes preserve correlated child spans under the policy request. A new policy
+deliberately disables the previous provider during proxy/DNS changes; only phases
+after verified new diagnostics activation can export. That gap is intentional.
+
 ## Verification
 
 `node --test tests/diagnostics.test.mjs` exercises a real local OTLP receiver: parent/child traces, measured durations, correlated logs, typed attributes, password/token/URL/error sentinels absent, environment headers/resources excluded, disable/reconfigure queue invalidation, expiry, bounded batches and failed export without operation retry.