Analytics and diagnostics

Analytics is opt-in and has no default remote destination. The approved application ID is unreal_sdk; host user identity is separate from stable install identity. A native host injects a store and supplies an immutable opaque partition for the credential/user/destination tuple.

AnalyticsDispatcher assigns session sequence/context and deterministic 32-bit FNV-1a install sampling. DurableQueue uses exclusive partition ownership, atomic fsync/rename snapshots, bounded records/bytes and seven-day retention. A complete prefix survives a truncated tail. Maximum total storage is 5,000,000 bytes per partition; reads/batches are bounded to 50 records. This adapts segmented reference storage to atomic snapshot files.

FGraffityAnalyticsStore serializes disk access and host upload callbacks on one worker. Pending appends are bounded. Supply FGraffityAnalyticsOptions::Upload only after selecting the approved destination, authentication and payload mapping. The callback must have its own network timeout and return an HTTP status. Localization pauses uploads; periodic/manual flush uses 5–600 s retry backoff, HTTP 413 splitting and permanent-rejection handling. Uploader authentication failure does not stop localization.

The local envelope includes event ID, shared event name, sequence, session, timestamp, application/OS/engine/SDK context and safe properties. Host mapping to the destination’s complete required property schema and actual ingestion remain deferred. Console activities, webviews and mandatory presentation events are excluded. Camera images, raw pose/GPS, tokens and signed queries are not recorded.

Provide IDiagnostics for host event sinks; public errors use fixed safe messages. Capture/runtime metrics expose bounded counters and timing, not payloads. Do not include credentials, signed URLs, camera data or precise location in host logs. Session/world shutdown drains worker work; upload completion after OS kill is never guaranteed.