fix: setup_complete missing scanners_run/scanners_failed + extra test coverage

Verification audit found that the setup_complete payload was missing two
required spec fields and that the mcp_tool error category was wired
nowhere. Also expanded test coverage to validate all Phase 1 + Phase 2
payload shapes against the spec.

## Bugs fixed

1. setup_complete missing scanners_run/scanners_failed (src/cli.ts, src/tools/init.ts)
   The spec requires both fields. InitResult interface gained the two
   counters, initProjectWithLLM now increments scannersRun on every
   non-skipped scanner Promise.allSettled result and scannersFailed on
   every rejection. cli.ts setup handler reads them from the result and
   threads into the sendSetupTelemetry payload.

2. mcp_tool error category not wired anywhere (src/server.ts)
   reportError("mcp_tool", ...) was reserved in the bounded category
   enum but no call site existed. Wrapped server.tool() with a single
   monkey-patch right after McpServer construction so every registered
   tool handler is auto-wrapped in a try/catch that fires reportError
   with category="mcp_tool", classifyError(err), fatal=true on throw.
   Verified end-to-end via smoke test: forcing axme_save_memory to throw
   EACCES on a non-existent path produces a single mcp_tool error event
   with error_class=permission_denied.

## Tests added (test/telemetry.test.ts)

- lifecycle strict counts: first run sends exactly 1 install + 1 startup
- lifecycle strict counts: second run sends only 1 startup, no install
- update event: previous_version field present when version changed
- processStartupSent guard: 3 sendStartupEvents calls = 1 startup
- ci=true detection in real sent payload
- ci=false default in real sent payload
- audit_complete payload shape: all 10 spec fields present
- setup_complete payload shape: all 9 spec fields present
- offline queue cap at 100 events with oldest-dropped semantics
- classifyError extra slugs: api_error, disk_full, permission_denied
- reportError payload contains only bounded fields, no message/stack

## Verification

- npm test: 475 tests, 104 suites, 0 failures
- npm run lint: clean
- npm run build: clean
- npx tsc --noEmit: clean
- E2E staging: 7/7 scenarios passed against
  axme-gateway-staging Cloud Run URL (install + startup, rerun no
  install, update with previous_version, opt-out AXME_TELEMETRY_DISABLED
  + DO_NOT_TRACK leaves no state, offline queue + flush, setup_complete
  on auth-fail fast path)
- E2E Scenario D real audit: ran live LLM audit-session subprocess
  against staging endpoint on session d5e6391c (15.5MB transcript,
  verify-only mode). Result: outcome=success, durationMs=574371,
  promptTokens=130731, costUsd=1.0232553, chunks=1, decisions_saved=1,
  memories_saved=0, safety_saved=0, dropped_count=0. audit_complete
  event landed on staging, telemetry-queue.jsonl absent post-run.
- Anti-spam check: full MCP boot lifecycle (initialize + tools/list +
  3 tool calls + shutdown) produces exactly 1 install + 1 startup. No
  duplicates from subprocess paths.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: George-iam

src/cli.ts

@@ -298,6 +298,8 @@ async function main() {
       let setupMethod: "llm" | "deterministic" = "deterministic";
       let setupPhaseFailed: string | null = null;
       let setupPresetsApplied = 0;
+      let setupScannersRun = 0;
+      let setupScannersFailed = 0;
       // Use the blocking variant so the event lands BEFORE process.exit() runs.
       // The fire-and-forget sendTelemetry uses setImmediate, which is killed
       // by process.exit() before the network request is even started.
@@ -308,6 +310,8 @@ async function main() {
             outcome: setupOutcome,
             duration_ms: Date.now() - setupStartMs,
             method: setupMethod,
+            scanners_run: setupScannersRun,
+            scanners_failed: setupScannersFailed,
             phase_failed: setupPhaseFailed,
             presets_applied: setupPresetsApplied,
             is_workspace: isWorkspace,
@@ -354,6 +358,9 @@ async function main() {
           const anyLlm = projectResults.some(r => r.oracle.llm) || workspaceResult.decisions.fromScan > 0;
           setupMethod = anyLlm ? "llm" : "deterministic";
           setupPresetsApplied = projectResults.reduce((s, r) => s + (r.decisions.fromPresets || 0), 0);
+          // Sum scanner counts across workspace + all projects
+          setupScannersRun = workspaceResult.scannersRun + projectResults.reduce((s, r) => s + r.scannersRun, 0);
+          setupScannersFailed = workspaceResult.scannersFailed + projectResults.reduce((s, r) => s + r.scannersFailed, 0);
         } else {
           const result = await initProjectWithLLM(projectPath, { onProgress: console.log, force: forceSetup });
           if (!result.created && result.durationMs === 0) {
@@ -370,6 +377,8 @@ async function main() {
           // Track telemetry: oracle.llm tells us whether LLM path was used
           setupMethod = result.oracle.llm ? "llm" : "deterministic";
           setupPresetsApplied = (result.decisions.fromPresets || 0);
+          setupScannersRun = result.scannersRun;
+          setupScannersFailed = result.scannersFailed;
         }
       } catch (err) {
         setupOutcome = "failed";

src/server.ts

@@ -232,6 +232,35 @@ const server = new McpServer(
   { instructions: buildInstructions() },
 );
 
+// Wrap every tool handler with a try/catch that reports caught exceptions to
+// telemetry under the `mcp_tool` category. We monkey-patch server.tool() once
+// here instead of touching all 19 individual tool registrations below. The
+// MCP SDK still receives any thrown error and returns it to the client, so
+// no behavior changes — we only add an extra observability hook.
+//
+// Why fatal=true: an exception that bubbles out of a tool handler means the
+// tool call did not complete its intended work — the user-visible operation
+// has aborted. That matches our "fatal vs degraded" definition.
+const _origRegisterTool: any = server.tool.bind(server);
+(server as any).tool = function (...args: any[]): any {
+  // Last argument is always the handler function
+  const handler = args[args.length - 1];
+  if (typeof handler === "function") {
+    args[args.length - 1] = async (...handlerArgs: any[]): Promise<any> => {
+      try {
+        return await handler(...handlerArgs);
+      } catch (err) {
+        try {
+          const { reportError, classifyError } = await import("./telemetry.js");
+          reportError("mcp_tool", classifyError(err), true);
+        } catch { /* never throw from telemetry */ }
+        throw err;
+      }
+    };
+  }
+  return _origRegisterTool.apply(server, args);
+};
+
 // --- Helper: resolve paths with defaults from server state ---
 
 function pp(project_path?: string): string {

src/tools/init.ts

@@ -34,6 +34,10 @@ export interface InitResult {
   cost: CostInfo;
   durationMs: number;
   errors: string[];
+  /** Number of LLM scanners that actually executed (max 4: oracle/decision/safety/deploy). 0 in deterministic-only fallback. Used for telemetry. */
+  scannersRun: number;
+  /** Number of LLM scanners that failed (rejected or returned an error). Used for telemetry. */
+  scannersFailed: number;
 }
 
 /**
@@ -61,6 +65,7 @@ export async function initProjectWithLLM(projectPath: string, opts?: {
         memories: { count: listMemories(projectPath).length, fromPresets: 0 },
         safety: { created: false, llm: true, summary: "already initialized" },
         config: false, cost: zeroCost(), durationMs: 0, errors: [],
+        scannersRun: 0, scannersFailed: 0,
       };
     }
   }
@@ -77,6 +82,7 @@ export async function initProjectWithLLM(projectPath: string, opts?: {
       memories: { count: 0, fromPresets: 0 },
       safety: { created: false, llm: false, summary: "setup already running" },
       config: false, cost: zeroCost(), durationMs: 0, errors: ["Setup already in progress"],
+      scannersRun: 0, scannersFailed: 0,
     };
   }
   atomicWrite(lockPath, new Date().toISOString());
@@ -172,8 +178,14 @@ export async function initProjectWithLLM(projectPath: string, opts?: {
 
   // Process results
   log(`  [${projectName}] Scanners complete, processing results...`);
+  // Telemetry counters: how many of the 4 scanners actually ran (non-skipped)
+  // and how many failed (rejected). Used by setup_complete telemetry payload.
+  let scannersRun = 0;
+  let scannersFailed = 0;
   for (const settled of scanners) {
     if (settled.status === "rejected") {
+      scannersFailed++;
+      scannersRun++;
       const err = settled.reason;
       const msg = err?.message ?? String(err);
       const stack = err?.stack ? `\n${err.stack.split("\n").slice(0, 3).join("\n")}` : "";
@@ -182,6 +194,7 @@ export async function initProjectWithLLM(projectPath: string, opts?: {
     }
     const val = settled.value;
     if ("skipped" in val) continue;
+    scannersRun++;
 
     if (val.type === "oracle" && val.result) {
       writeOracleFiles(projectPath, val.result.files);
@@ -263,6 +276,8 @@ export async function initProjectWithLLM(projectPath: string, opts?: {
     cost: totalCost,
     durationMs: Date.now() - startTime,
     errors,
+    scannersRun,
+    scannersFailed,
   };
 }
 
@@ -352,6 +367,8 @@ export async function initWorkspaceWithLLM(workspacePath: string, opts?: {
             cost: zeroCost(),
             durationMs: 0,
             errors: [`Init failed: ${settled.reason?.message ?? settled.reason}`],
+            scannersRun: 0,
+            scannersFailed: 4,
           });
         }
       }
@@ -420,5 +437,6 @@ export function initProjectDeterministic(projectPath: string, opts?: { presets?:
     memories: { count: listMemories(projectPath).length, fromPresets: presetsMemoryCount },
     safety: { created: true, llm: false, summary: "" },
     config: configCreated, cost: zeroCost(), durationMs: Date.now() - startTime, errors: [],
+    scannersRun: 0, scannersFailed: 0,
   };
 }