Tools report failure two ways: a few throw, most return `isError: true`.
Only the throwing path reached telemetry, so a returned failure wrote a row
saying the call failed and nothing about why.

Over the last 14 days that left 83% of failures with no diagnostic at all,
including every Test Management failure (1,485 across 50+ groups).

Carry the text the tool already showed the user into `error_message`, and add
`error_kind` to bucket failures as auth / not_found / rate_limited / validation
/ timeout / network / server_error so they can be charted.

The message is shape-redacted and capped at 300 chars. `success`, `outcome`
and the thrown-error path are unchanged, and the row count per call is
unchanged. Applies to every registered tool, local and remote.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Two corrections from review.

error_kind does not survive contact with real data. Run over 30 days of
production error messages the classifier returns "unknown" for 46.7% of them,
and rate_limited — the bucket that motivated it — matches 4 rows in 30 days.
Same failure as error_class: a column that reads mostly "unknown" invites
wrong conclusions. The message itself carries the detail; grouping can be
done in the query once we see what real text looks like.

The 300-character cap contradicted the standing rule not to truncate what we
log. A long error is exactly the one worth reading in full. Removed; a test
now pins that a 1,400-character message is stored whole.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

main had moved 44 commits, including the capability telemetry that added
ctx.extras to the same event object. Both changes belong: error_message and
extras are now spread together.

With redact.ts on main, the local scrub is gone and instrumentation uses the
registry's redact — one source of truth, as review asked. That also inherits
its fail-closed behaviour and its redact-before-truncate ordering.

Fixes a ReDoS in that shared redactor, found by this branch's tests: the
phone rule backtracked on a long digit run, taking 1,020ms for 40KB and
blocking the event loop for every concurrent caller. Quantifiers are bounded
and the scan window is capped; the same input now takes 2ms.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

When the scanner API answers success: false without an errors array, the
thrown message interpolated undefined, and the catch below re-threw it as
"Failed to start scan: Unable to start scan: undefined" -- the exact text
behind roughly half of startAccessibilityScan's recorded failures, with the
real reason discarded. Fall back to the response body, and treat an empty
errors array the same way.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>