feat(app): add crash visibility, memory relief, and clipboard reply work

Squashes the working tree that had accumulated on cloud-agent. Two
strands of work, kept in one commit at the maintainer's request.

Crash and stability (this session):

- Subscribe to MetricKit so crash, hang, CPU, and disk-write diagnostics
  are recorded on device. Keyboard-extension memory kills are the most
  likely way a user loses the keyboard mid-sentence and iOS does not
  classify them as crashes, so they never reach App Store Connect.
- Upload those reports to POST /v1/analytics/diagnostics from internal
  builds only (local Debug and TestFlight), reusing the analytics
  installation identifier and skipping entirely when analytics are off.
  App Store builds keep everything on device.
- Shed the Chinese engine, English lexicon, and in-flight pipeline work
  at the 40 MiB and 48 MiB budget thresholds instead of waiting for a
  system memory warning that jetsam often preempts.
- Install audio taps with the input node's live format through one
  shared adaptive resampler, so an audio-route change mid-recording no
  longer raises an uncatchable format-mismatch exception. Covers the
  dictation preview and the Mac recorder, which still used the pattern
  the Flow capture path had already moved away from.
- Harden the librime bridge: never pass a nil string across a nonnull
  boundary when a user dictionary holds malformed UTF-8, null-check the
  engine API vector, and distrust a candidate count without its array.
- Guard the expanded candidate grid against a list that shrinks while
  the collection view is still laying out against the previous count.
- Resolve localized text without the App Group so the screen shown when
  that container is missing renders its message instead of crashing on
  launch, which is the one situation it exists to handle.
- Gate CI on the App Group and Keychain wiring that the keyboard
  extension hard-depends on, with a self-test proving the check fails.

Clipboard, reply, and semantics (pre-existing working tree):

- Unify the reply center, refresh keyboard AI features, and add native
  event and reminder exporters.
- Expand clipboard semantic routing with authored corpora and a
  product-blind holdout, plus the scripts that build and validate them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

OSGKeyboardExt/KeyboardViewController.swift

@@ -47,6 +47,10 @@ public final class KeyboardViewController: UIInputViewController {
         return created
     }
     private let persistor = AppGroupPersistor()
+    /// Uptime of the most recent key-driven document change. Memory relief uses
+    /// it to tell "the user is mid-sentence" from "the typing surface is merely
+    /// on screen" — see `isMidTypingBurst`.
+    private var lastTypingActivityUptime: TimeInterval = -1
 
     private var hosting: UIHostingController<KeyboardSurfaceRoot>?
     private var keyboardHeightConstraint: NSLayoutConstraint?
@@ -199,6 +203,11 @@ public final class KeyboardViewController: UIInputViewController {
         )
         configSync.installDarwinObservers()
         flowCoordinator.refreshSessionState()
+        // Installed last: the handler tears down surfaces, so it must not be
+        // reachable until the whole controller is wired up.
+        KeyboardExtensionMemoryTelemetry.reliefHandler = { [weak self] level in
+            self?.shedHeavyResources(level: level, reason: "budget") ?? false
+        }
         recordMemory(
             "KVC.viewDidLoad.done",
             details: "sessionActive=\(FlowSessionBridge.isSessionActive() ? 1 : 0) "
@@ -234,6 +243,8 @@ public final class KeyboardViewController: UIInputViewController {
             details: "preserve=\(flowCoordinator.preservesLifecycleOnDisappear ? 1 : 0)"
         )
         heightPhase = .idle
+        // A hidden keyboard cannot grow; stop waking the process to sample it.
+        KeyboardExtensionMemoryTelemetry.stopSampling()
         flowCoordinator.stopSessionMonitor()
         // Remember what the user left on, then pre-position a reused
         // extension instance for the next open policy (no first-frame jump).
@@ -295,6 +306,10 @@ public final class KeyboardViewController: UIInputViewController {
         }
         clipboardCapture.keyboardDidAppear()
         recordMemory("KVC.viewWillAppear.afterClipboard")
+        // Re-presented keyboards reuse the same process, so resume pressure
+        // polling here. No-ops while the first-launch boot burst is still
+        // running, so the startup samples are never cut short.
+        KeyboardExtensionMemoryTelemetry.startSustainedSamplingIfIdle()
         recordMemory("KVC.viewWillAppear.done")
         OSGDiag.log(
             "KVC.viewWillAppear done surface=\(state.surface.rawValue) \(OSGDiag.memoryTag())",
@@ -405,12 +420,79 @@ public final class KeyboardViewController: UIInputViewController {
             "KVC.didReceiveMemoryWarning surface=\(state.surface.rawValue) \(OSGDiag.memoryTag())",
             category: "boot"
         )
-        flowCoordinator.cancelPipelineUnlessAwaitingResult()
-        if state.surface == .typing {
-            applySurface(.voice)
-        } else {
-            deactivateTypingSurface()
+        // The system signal is not an advance warning — jetsam may be moments
+        // away — so this path sheds even mid-composition.
+        _ = shedHeavyResources(level: .critical, reason: "systemWarning", force: true)
+    }
+
+    /// Whether the user is actively composing right now. A non-empty preedit is
+    /// an unfinished Pinyin syllable, and a keystroke within the last window
+    /// means a burst is in progress even between syllables.
+    private var isMidTypingBurst: Bool {
+        if let session = typingSessionStorage, !session.composition.preedit.isEmpty {
+            return true
         }
+        guard lastTypingActivityUptime >= 0 else { return false }
+        return ProcessInfo.processInfo.systemUptime - lastTypingActivityUptime
+            < Self.typingBurstWindow
+    }
+
+    /// How long after a keystroke the keyboard still counts as "being typed on".
+    private static let typingBurstWindow: TimeInterval = 1.5
+
+    /// Releases the keyboard's heavy caches (Rime engine, English lexicon,
+    /// in-flight pipeline work).
+    ///
+    /// Two callers: the system memory warning above, and — crucially, *earlier*
+    /// — `KeyboardExtensionMemoryTelemetry.reliefHandler`. Jetsam kills
+    /// keyboards at the ~60 MiB boundary without reliably delivering a warning
+    /// first, so waiting for the system signal means the keyboard simply
+    /// vanishes mid-sentence. Our own 40 / 48 MiB thresholds fire while there
+    /// is still headroom to recover.
+    /// Returns whether relief actually happened, so a declined attempt keeps the
+    /// level armed for the next poll instead of counting as a completed shed.
+    @discardableResult
+    private func shedHeavyResources(
+        level: KeyboardExtensionMemoryBudget.Level,
+        reason: String,
+        force: Bool = false
+    ) -> Bool {
+        // Relief can be requested from the boot sampler before `installServices`
+        // has run; nothing below is safe to touch until the view is loaded.
+        guard isViewLoaded, flowCoordinator != nil else { return false }
+        OSGDiag.log(
+            "KVC.shed level=\(level.rawValue) reason=\(reason) "
+                + "surface=\(state.surface.rawValue) \(OSGDiag.memoryTag())",
+            category: "memory"
+        )
+        flowCoordinator.cancelPipelineUnlessAwaitingResult()
+        guard level == .critical else {
+            // `.high`: release only what the user is not looking at. Yanking an
+            // active typing surface at 40 MiB would be more disruptive than the
+            // risk it avoids.
+            if state.surface != .typing {
+                deactivateTypingSurface()
+            }
+            recordMemory("KVC.shed.soft", details: "reason=\(reason)")
+            return true
+        }
+        guard state.surface == .typing else {
+            deactivateTypingSurface()
+            recordMemory("KVC.shed.hard", details: "reason=\(reason)")
+            return true
+        }
+        // Swapping the surface out from under someone mid-syllable loses the
+        // composition and drops them into voice mode with no explanation. A
+        // jetsam kill costs the same composition but reads as "the keyboard
+        // crashed", which is the lesser of the two for the user's trust in the
+        // keyboard — and the poll comes back in a second to try again.
+        guard force || !isMidTypingBurst else {
+            recordMemory("KVC.shed.deferred", details: "reason=\(reason) cause=typing")
+            return false
+        }
+        applySurface(.voice)
+        recordMemory("KVC.shed.hard", details: "reason=\(reason)")
+        return true
     }
 
     public override func viewDidLayoutSubviews() {
@@ -623,6 +705,9 @@ public final class KeyboardViewController: UIInputViewController {
             SettingsDeepLink.setPending(.clipboard)
             self?.openHostApp(path: "settings/clipboard")
         }
+        state.tryAutoReplyFromGuide = { [weak self] in
+            self?.clipboardCapture.confirmAutoReplyGuide()
+        }
         state.openClipboardPanel = { [weak self] in
             self?.clipboardCapture.openPanelFromTopButton()
         }
@@ -887,6 +972,7 @@ public final class KeyboardViewController: UIInputViewController {
         source: KeyboardTextInsertionSource
     ) {
         guard !text.isEmpty else { return }
+        lastTypingActivityUptime = ProcessInfo.processInfo.systemUptime
         textDocumentProxy.insertText(text)
         if source.contributesToKeyboardUsage {
             let counts = KeyboardUsageCharacterClassifier.classify(text)
@@ -902,6 +988,7 @@ public final class KeyboardViewController: UIInputViewController {
     }
 
     private func deleteBackwardFromDocument() {
+        lastTypingActivityUptime = ProcessInfo.processInfo.systemUptime
         textDocumentProxy.deleteBackward()
         refreshAssistantFieldAction()
         scheduleAssistantFieldActionRefresh()