[aroff]

What

AppBuilder::without_end_user_telemetry() (feature telemetry). On an
end-user install it ships no telemetry:

• no telemetry command group;
• no telemetry doctor checks (the six telemetry.* ones);
• no telemetry variables (<APP>_TELEMETRY_*, OTEL_*, DO_NOT_TRACK) in
  root help, since nothing reads them;
• no first-run notice;
• no export, because the startup sequence does not run. That also means a
  stored consent from an earlier version is not read; the policy stays at the
  build-time resolution, which is Off for an end user.

A Deployment::Service process is unaffected: its telemetry stays the
operator's decision, through OTEL_* and the kill switches.

Why

Some binaries are both a service and a program a person runs. Pauta is the
first one: pauta serve runs as an Instance in the cluster, where traces
should go to the collector; on a laptop the same binary is the CLI, with
pauta self (which ADR 0080 keeps end-user only). The app picks its
Deployment per process. Without this opt-out, the laptop process tells the
person "usage statistics are off. Turn them on with pauta telemetry set usage", and adds a telemetry group and six doctor checks, for an app whose
author never meant to collect anything from it. With Service on every
process, self is gone.

What could leak or be bypassed

The change only removes paths: when the flag is set and the process is an
end user, startup returns a no-op guard before opening the store or building
an exporter. Nothing new is sent.

• stored_consent_does_not_turn_an_opted_out_end_user_back_on: a settings
  file that says usage turns the control app on, and leaves the opted-out
  app at Off.
• a_service_keeps_its_telemetry_under_the_opt_out: a Service still has all
  six telemetry checks.

Tests

tests/unit/end_user_telemetry_opt_out.rs, six tests. Each one has a control
(the same app without the opt-out). With the method made a no-op, the five
end-user tests fail; the Service test passes either way by design. The help
test also fails with only the help gate removed.

• cargo fmt --check: clean.
• cargo clippy --all-features -- -D warnings: clean.
• cargo check --no-default-features and default features: clean.
• cargo test --all-features (before the help gate commit): 1796 passed,
  0 failed, 138 test binaries. After it, the opt-out file: 6 passed.

Docs: docs/telemetry.md "Declaring the deployment" and the CHANGELOG
(Unreleased → Added).

🤖 Generated with Claude Code