feat(mobile): instrument startup timing

[iscekic]

Summary

What

• Add one-shot app_startup PostHog timing telemetry for mobile bootstrap gates and outcomes.
• Enable consent-gated Sentry performance tracing at 10%; declined consent remains 0%.
• Remove the failing-open min-version network fetch from the splash gate while preserving its terminal force-update route.

Why

• Production startup phase data is needed before changing the remaining signed-in getMe and consent gates.
• Signed-out and first-launch users no longer wait for a min-version HTTP round trip before first paint; signed-in users remove that round trip while retaining the deliberate getMe and consent waits.

How

• Capture first-wins timing marks and send exactly one consented PostHog event after startup finishes.
• Keep the analytics drain after PostHog initialization with explicit dependencies, so a consent or splash transition cannot consume and drop the payload.
• Keep use-force-update.ts unchanged; updateRequired still redirects to the existing terminal screen once the check resolves.

Consent-gated Sentry tracing does not sample the launch on which consent resolves. The app_startup PostHog event measures that launch instead.

Verification

• iOS E2E round: S1 500 fail-open → Home; S2 required update → terminal Update required / Update now; S3 normal version → Home; S4 signed-out → Login. The shared min-version row was restored to 1.0.0.
• Mobile: pnpm format && pnpm typecheck && pnpm lint && pnpm check:unused && pnpm test — 2,581 tests passed.
• Root: pnpm typecheck and git diff --check.

S2 iOS force-update evidence:

Visual Changes

N/A — no visual component changed; the existing force-update screen is untouched. The verification section contains an iOS S2 runtime evidence frame.

Reviewer Notes

• startup-timing.ts deliberately has no imports, and the drain effect's exact dependency list is load-bearing.
• E2E covers behavioral force-update paths. Telemetry is production-only because PostHog is disabled in __DEV__ and Sentry trace intake requires a real project plus consent.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of eaee5f0 → 00fc3ef found no code changes (the only new commit, 00fc3ef "chore: retrigger review", is empty), so no new findings were raised; the three previously reported findings were explicitly rejected by the author as approved-plan trade-offs and are not carried forward.

Files Reviewed (0 files)

No files changed since the previous review at eaee5f0.

Assumptions: git diff eaee5f0..00fc3ef is empty, so unchanged files were not re-analyzed. Prior discussion on apps/mobile/src/app/_layout.tsx:156, apps/mobile/src/lib/startup-timing.ts:20, and apps/mobile/src/lib/sentry-consent.ts:34 remains visible in the inline threads for human adjudication.

Previous Review Summary (commit eaee5f0)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit eaee5f0)

Status: 3 Issues Found | Recommendation: Address before merge

Executive Summary

Removing the min-version check from the first-paint gate in _layout.tsx lets a below-minimum build render and accept user input for the duration of the /api/app/min-version round trip, and also makes the force-update startup outcome unreachable.

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
apps/mobile/src/app/_layout.tsx	156	Outdated clients now render and are interactive until the min-version fetch resolves; force-update outcome loses to the earlier app/login outcome

SUGGESTION

File	Line	Issue
apps/mobile/src/lib/startup-timing.ts	20	login, user-error, consent-error, and force-update outcomes can never be sent because the drain requires consented analytics
apps/mobile/src/lib/sentry-consent.ts	34	Non-zero tracesSampleRate enables trace-header propagation to all hosts; tracePropagationTargets is unset

Verified as correct (no comment posted)

• Effect ordering for the drain: useAnalyticsConsentGate is invoked before the drain effect and shares the same three consent inputs, so initPostHog() always runs before captureEvent, and the one-shot payload cannot be consumed while the client is null.
• user_ready: useQuery's optimistic result marks the query as fetching on the render where enabled flips true, so userIdLoading does not read false before getMe starts.
• Double-invoked effects (dev StrictMode) cannot double-send: takeStartupTimings() returns null on the second call.
• No new memory leaks: the module keeps at most six Map entries and adds no listeners, timers, or subscriptions.

Files Reviewed (6 files)

• apps/mobile/src/app/_layout.tsx - 1 issue
• apps/mobile/src/lib/startup-timing.ts - 1 issue
• apps/mobile/src/lib/sentry-consent.ts - 1 issue
• apps/mobile/src/lib/analytics/posthog.ts - 0 issues
• apps/mobile/src/lib/startup-timing.test.ts - 0 issues
• apps/mobile/src/lib/sentry-consent.test.ts - 0 issues

Assumptions: dependencies are not installed in this environment, so the @sentry/react-native and @tanstack/react-query behaviours above were reasoned from the pinned versions (7.x and 5.100.10) rather than executed; no tests were run.

Fix these issues in Kilo Cloud

---

_{Reviewed by claude-opus-5 · Input: 20 · Output: 3.2K · Cached: 351.3K}

_{Review guidance: REVIEW.md from base branch main}