diff --git a/docs/ISSUES.md b/docs/ISSUES.md
index aefc049b..7422b455 100644
--- a/docs/ISSUES.md
+++ b/docs/ISSUES.md
@@ -24,9 +24,63 @@ What does NOT go here:
 - Every session: scan OPEN issues at start; promote/close anything we touched during the session before ending.
 - Promoting to a Phase: mark as `DONE (promoted to Phase X)` + commit SHA where the Phase entry landed.
 
-## #435 — PARTLY CLOSED: Probe debt: 25 temporary probes outlived their closed investigations, 6 more name no owner
+## #438 — Launcher crash-report bundles (WER dump capture + local bundle, no upload)
 
-**Status:** The 17 orphaned probes from part 1 are DELETED (2026-08-24) —
+**Status:** OPEN — designed, ready to pick up as a launcher slice
+**Severity:** ENHANCEMENT (post-current-queue; owner-approved as upcoming
+work 2026-08-24)
+**Component:** launcher / crash diagnostics
+
+**Problem:** the launcher already records a truthful
+`exited{reason:"crashed", code}` with bounded stderr (#405–#407), but for
+native fail-fasts — #422's `0xC0000374` heap corruption, three sightings,
+zero stacks — no evidence exists anywhere: fail-fast bypasses in-process
+exception filters BY DESIGN, so .NET's own `DOTNET_DbgEnableMiniDump`
+crash handler never fires for this class. Windows' WER LocalDumps is the
+OS-level catcher that still does. Today an alpha user can say "it
+crashed" but never why.
+
+**Design (agreed with the owner):**
+1. **Launcher owns the WER key, with consent.** First-run opt-in ("save
+   crash dumps locally") writes
+   `HKCU\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\AcDream.App.exe`
+   (HKCU — no elevation): `DumpFolder` inside the launcher's data dir,
+   `DumpCount` small (e.g. 3), `DumpType=1` (**minidump**, not full — a
+   minidump carries the faulting stack #422 needs without carrying the
+   process's whole memory). Uninstall removes the key.
+2. **Bundle on next launch.** The launcher already detects the crash exit;
+   it gathers minidump + client log tail + version + the Vulkan capability
+   report into one folder and shows "the client crashed last time — the
+   report is here" with an open-folder button.
+3. **NO auto-upload — this is the deliberate line.** Dumps can contain
+   account names and the plaintext session password in memory; there is no
+   upload endpoint and no privacy story. The user choosing to send the
+   folder is consent by construction. Revisit only with real
+   infrastructure and an explicit consent flow.
+4. **Linux:** set `DOTNET_DbgEnableMiniDump=1` / `DOTNET_DbgMiniDumpType`
+   from the launcher for the non-fail-fast classes; system `core_pattern`
+   is out of scope.
+
+**Prior art / constraints:** the project's stance that the CLIENT never
+writes registry keys stands — this is launcher-owned, opt-in, per-user.
+The owner's dev machine already has the key armed manually (2026-08-24)
+for the #422 hunt; this slice productizes that for alpha users, whose
+crashes are otherwise invisible telemetry.
+
+---
+
+## #435 — CLOSED: Probe debt: temporary probes outlived their closed investigations or named no owner
+
+**Status:** CLOSED 2026-08-24 across two passes (`0c5057c9` part 1,
+`c1e6e3da` part 2 + the `35454a9f`-adjacent doc correction): 24 probes
+deleted, 8 reclassified as standing tools, 1 deleted-and-restored
+(`ACDREAM_DUMP_MOVE_TRUTH`, #437 — the canonical soak hard-gates on it).
+End state: 137 flags (from 161), 31 temporary probes, every one attributed
+to an owning issue or campaign. The default-off invariant is frozen by
+`LaunchOptionsDocumentationTests.OnlyTheFourRetailBehaviorFlagsDefaultOn`.
+Part-1 record follows.
+
+**Status (part 1):** The 17 orphaned probes from part 1 are DELETED (2026-08-24) —
 3,493 lines removed, flag count 161 → 144, temporary probes 64 → 47. Build
 clean; full hermetic suite 15,321 passed / 0 failed (baseline 15,333 minus
 the 12 tests whose only subject was a deleted probe). Four files went