docs: add ADRs for vault-root navigation and safe analytics events (guard — from commits ec83e9b, 18b4f9d)

docs/adr/0100-synthetic-vault-root-folder-row.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0100"
+title: "Synthetic vault-root row in folder navigation"
+status: active
+date: 2026-04-30
+---
+
+## Context
+
+ADR-0033 introduced subfolder scanning and a collapsible folder tree backed by `list_vault_folders`, but the sidebar still had no first-class way to select the vault root itself. That left root-level files outside the folder-navigation model and pushed the UI toward one-off handling for the opened vault path.
+
+The new sidebar behavior needs to show root-level files when the user clicks the vault name, while preserving the existing folder rename/delete model for real folders only.
+
+## Decision
+
+**Represent the vault root in the sidebar as a synthetic frontend-owned folder row rather than as a mutable backend folder.**
+
+- `FolderTree` wraps backend folder nodes in a root row with `path: ""` and `rootPath` set to the opened vault path.
+- `SidebarSelection` keeps using `kind: 'folder'`, but root selection is encoded as the empty folder path plus `rootPath` metadata.
+- Root-level file filtering is handled in note-list helpers as a dedicated root case instead of pretending the vault root is an ordinary folder.
+- Rename/delete remain available only for real folders; the vault root row is navigable, not mutable.
+
+## Options considered
+
+- **Option A** (chosen): Synthetic vault-root row in the renderer — keeps `list_vault_folders` focused on real folders, avoids backend schema churn, and reuses the existing folder-selection mental model.
+- **Option B**: Add a pseudo-folder to backend folder results — would couple presentation-only root behavior to command data and blur the distinction between the vault itself and mutable folders.
+- **Option C**: Keep root files outside folder navigation entirely — simpler, but leaves the sidebar with an incomplete navigation model and special cases elsewhere in the UI.
+
+## Consequences
+
+- Folder navigation now has a single model for root and nested folder browsing.
+- Backend folder APIs stay unchanged: they describe actual folders, not UI-only rows.
+- Selection handling must treat `path: ""` as the vault-root case and use `rootPath` when computing direct-root file membership.
+- Re-evaluate if folder actions ever need to operate on the vault root itself, because that would likely require a separate command model instead of extending the synthetic row.

docs/adr/0101-categorical-product-analytics-events.md

@@ -0,0 +1,35 @@
+---
+type: ADR
+id: "0101"
+title: "Categorical product analytics events"
+status: active
+date: 2026-04-30
+---
+
+## Context
+
+ADR-0016 established opt-in PostHog analytics and Sentry crash reporting, but new feature telemetry now spans file previews, inline image lightbox opens, AI agent session lifecycle events, and All Notes visibility toggles. Instrumenting those flows ad hoc would make it easy to leak vault-specific data such as note paths, filenames, prompt text, or image URLs.
+
+Tolaria needs richer product telemetry for feature behavior while preserving the privacy bar expected from a local-first notes app.
+
+## Decision
+
+**Route product analytics through dedicated helper functions that emit only coarse categorical metadata.**
+
+- Product events live behind `src/lib/productAnalytics.ts` instead of scattering raw `trackEvent()` payloads across feature code.
+- Allowed payloads are constrained to categories and counts such as preview kind, action kind, AI agent id, permission mode, response/tool counts, status, and All Notes visibility category/enabled state.
+- Product events must not include vault content, note titles, file paths, filenames, image URLs, prompt text, or other user-authored data.
+- When a feature needs telemetry, it should add or extend a typed helper rather than sending free-form payloads inline.
+
+## Options considered
+
+- **Option A** (chosen): Typed categorical wrappers for product events — preserves useful product signals while keeping privacy constraints explicit and reviewable in one place.
+- **Option B**: Let each feature call `trackEvent()` directly with whatever fields seem useful — faster short term, but inconsistent and too easy to let sensitive data leak into analytics.
+- **Option C**: Avoid new product events entirely — safest from a privacy standpoint, but leaves the team blind to whether preview, AI, and list-visibility features are actually being used or failing.
+
+## Consequences
+
+- Telemetry reviews become easier because the allowed product-event surface is centralized.
+- Future product analytics work should start by defining categorical event helpers, not by attaching raw note/file context.
+- Some debugging detail is intentionally sacrificed; deep diagnosis should rely on consented crash reporting and local reproduction rather than richer analytics payloads.
+- Re-evaluate if Tolaria ever needs a broader telemetry taxonomy or stronger compile-time guarantees around event schemas.

docs/adr/README.md

@@ -152,3 +152,5 @@ proposed → active → superseded
 | [0097](0097-gemini-cli-agent-adapter.md) | Gemini CLI agent adapter | active |
 | [0098](0098-in-app-image-and-pdf-file-previews.md) | In-app image and PDF previews for binary vault files | active |
 | [0099](0099-cumulative-vault-asset-scope.md) | Cumulative vault asset scope for previews | active |
+| [0100](0100-synthetic-vault-root-folder-row.md) | Synthetic vault-root row in folder navigation | active |
+| [0101](0101-categorical-product-analytics-events.md) | Categorical product analytics events | active |