chore(web): regenerate agent docs for the telemetry send-on-signal wording (CW-8190)

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>

crates/app-server/src/exec_agent.rs

@@ -3115,6 +3115,10 @@ fn write_exec_stdout(text: &str) -> Result<()> {
         .and_then(|()| stdout.flush())
     {
         Err(err) if err.kind() == io::ErrorKind::BrokenPipe => {
+            let _ = codewhale_telemetry::report_termination(
+                codewhale_telemetry::ExitClass::Signal,
+                codewhale_telemetry::SIGNAL_FLUSH_TIMEOUT,
+            );
             // SAFETY: restores the default disposition and re-raises the
             // signal the write would have delivered without SIG_IGN.
             #[cfg(unix)]

crates/telemetry/src/actor.rs

@@ -373,4 +373,39 @@ mod tests {
         };
         assert_eq!(handle.persist_local(), FlushOutcome::TimedOut);
     }
+
+    #[test]
+    fn a_hung_writer_cannot_hold_a_termination_send_past_its_deadline() {
+        let (tx, rx) = sync_channel::<Message>(buffer::MAX_EVENTS + 1);
+        let handle = Handle {
+            tx,
+            pending: Arc::new(AtomicUsize::new(0)),
+            closing: AtomicBool::new(false),
+        };
+        let started = Instant::now();
+        let outcome = handle.shutdown(Duration::from_millis(50));
+        assert_eq!(outcome, FlushOutcome::TimedOut);
+        assert!(started.elapsed() < Duration::from_secs(5));
+        assert!(matches!(rx.try_recv(), Ok(Message::Shutdown(_))));
+    }
+
+    #[test]
+    fn a_second_termination_send_does_not_wait() {
+        let (tx, _rx) = sync_channel::<Message>(buffer::MAX_EVENTS + 1);
+        let handle = Handle {
+            tx,
+            pending: Arc::new(AtomicUsize::new(0)),
+            closing: AtomicBool::new(false),
+        };
+        assert_eq!(
+            handle.shutdown(Duration::from_millis(20)),
+            FlushOutcome::TimedOut
+        );
+        let started = Instant::now();
+        assert_eq!(
+            handle.shutdown(Duration::from_secs(30)),
+            FlushOutcome::TimedOut
+        );
+        assert!(started.elapsed() < Duration::from_secs(5));
+    }
 }

crates/telemetry/src/lib.rs

@@ -46,8 +46,8 @@ pub mod notice;
 mod tests;
 
 use std::sync::OnceLock;
-use std::sync::atomic::{AtomicU8, Ordering};
-use std::time::Duration;
+use std::sync::atomic::{AtomicBool, AtomicU8, AtomicU64, Ordering};
+use std::time::{Duration, Instant};
 
 pub use actor::{BATCH_MAX_BYTES, BATCH_MAX_EVENTS, FlushOutcome};
 pub use counters::{Counter, ErrorCounter, SessionCounters, TurnOutcome, TurnTokens};
@@ -69,11 +69,26 @@ pub use event::{
 /// handshake would hold a user's terminal past exit.
 pub const SHUTDOWN_FLUSH_TIMEOUT: Duration = Duration::from_secs(3);
 
+/// How long the send attempt on a terminating signal or a broken pipe may hold
+/// the process.
+///
+/// Shorter than [`SHUTDOWN_FLUSH_TIMEOUT`] so that, run alongside the runtime's
+/// two second signal drain, it fits inside the two second grace a supervisor
+/// gives SIGTERM before it escalates.
+pub const SIGNAL_FLUSH_TIMEOUT: Duration = Duration::from_millis(1500);
+
+const COLD_START_UNSET: u64 = u64::MAX;
+
+static COLD_START_MS: AtomicU64 = AtomicU64::new(COLD_START_UNSET);
+
 /// Everything a write path needs once the process is armed.
 struct Armed {
     handle: actor::Handle,
     root: std::path::PathBuf,
+    surface: Surface,
+    started: Instant,
     exit_class: AtomicU8,
+    session_end_recorded: AtomicBool,
 }
 
 /// The one gate. Unset means every write path is a hard no-op.
@@ -120,7 +135,10 @@ pub fn init(consent: TelemetryConsent) {
     let _ = ARMED.set(Armed {
         handle: actor::Handle::spawn(context),
         root: root.clone(),
+        surface: consent.surface(),
+        started: Instant::now(),
         exit_class: AtomicU8::new(ExitClass::Clean.as_u8()),
+        session_end_recorded: AtomicBool::new(false),
     });
 
     record_install_or_upgrade(&root);
@@ -266,6 +284,105 @@ pub fn exit_class() -> ExitClass {
     })
 }
 
+/// Report how long the interactive event loop took to start. The terminal UI is
+/// the only caller; every other surface leaves the cold-start bucket absent.
+pub fn set_cold_start_ms(millis: u64) {
+    let _ = COLD_START_MS.compare_exchange(
+        COLD_START_UNSET,
+        millis,
+        Ordering::Relaxed,
+        Ordering::Relaxed,
+    );
+}
+
+/// Build `session_end` from what this process actually accumulated.
+///
+/// The exit class is read from the process-wide atomic and never derived from
+/// an exit code. Building the event writes nothing; an unarmed process reports a
+/// zero duration and nothing reaches a sink.
+#[must_use]
+pub fn session_end_event() -> Event {
+    let counters = session_counters();
+    let cold_start = COLD_START_MS.load(Ordering::Relaxed);
+    Event::SessionEnd {
+        duration_bucket: DurationBucket::from_secs(
+            ARMED
+                .get()
+                .map_or(0, |armed| armed.started.elapsed().as_secs()),
+        ),
+        exit_class: exit_class(),
+        cold_start_bucket: (cold_start != COLD_START_UNSET)
+            .then(|| ColdStartBucket::from_millis(cold_start)),
+        providers: counters.providers(),
+        counters: counters.counters(),
+        errors: counters.errors(),
+        turn_wall: counters.turn_wall(),
+    }
+}
+
+/// Queue this session's usage rows and `session_end` once.
+///
+/// Whichever of the clean path, the signal path or a broken pipe gets here
+/// first reports; later callers do nothing, so one session never ends twice.
+/// A no-op when unarmed.
+pub fn record_session_end() {
+    let Some(armed) = ARMED.get() else {
+        return;
+    };
+    if armed.session_end_recorded.swap(true, Ordering::AcqRel) {
+        return;
+    }
+    for event in session_counters().usage_events() {
+        record(event);
+    }
+    record(session_end_event());
+}
+
+/// Close the session synchronously, for a path that cannot wait for the writer.
+///
+/// States `class`, then appends the usage rows and `session_end` to the local
+/// buffer with the same lock-free-for-the-caller write as [`record_blocking`].
+/// A no-op when unarmed, and a no-op for the events when the session already
+/// ended.
+pub fn record_session_end_blocking(class: ExitClass) {
+    let Some(armed) = ARMED.get() else {
+        return;
+    };
+    set_exit_class(class);
+    if armed.session_end_recorded.swap(true, Ordering::AcqRel) {
+        return;
+    }
+    for event in session_counters().usage_events() {
+        record_blocking(event);
+    }
+    record_blocking(session_end_event());
+}
+
+/// One bounded network attempt for a process that is being terminated.
+///
+/// Runs the ordinary flush, so consent, the opt-out tombstone and the run kill
+/// switch are re-checked immediately beforehand and a person who has opted out
+/// sends nothing. Short CLI commands stay disk-only. Never retried, and the
+/// caller is released after `deadline` whether or not the request finished.
+#[must_use]
+pub fn flush_for_termination(deadline: Duration) -> FlushOutcome {
+    let Some(armed) = ARMED.get() else {
+        return FlushOutcome::Empty;
+    };
+    if armed.surface == Surface::Cli {
+        return FlushOutcome::Buffered;
+    }
+    armed.handle.shutdown(deadline)
+}
+
+/// Record the session end and make the one bounded send attempt, for a process
+/// that is about to be ended by a signal. Returns [`FlushOutcome::Empty`] when
+/// unarmed.
+pub fn report_termination(class: ExitClass, deadline: Duration) -> FlushOutcome {
+    record_session_end_blocking(class);
+    flush_for_termination(deadline)
+}
+
 /// Final flush, then stop the writer thread.
 ///
 /// Returns [`FlushOutcome::Empty`] when unarmed.

crates/telemetry/src/tests.rs

@@ -1434,6 +1434,21 @@ fn completed_wipe_blocks_identity_and_state_recreation() {
 
 // ------------------------------------------------------------ unarmed gate --
 
+#[test]
+fn termination_reporting_is_a_noop_when_unarmed() {
+    assert!(!crate::is_armed());
+    crate::record_session_end();
+    crate::record_session_end_blocking(ExitClass::Signal);
+    assert_eq!(
+        crate::report_termination(ExitClass::Signal, Duration::from_millis(10)),
+        crate::FlushOutcome::Empty
+    );
+    assert_eq!(
+        crate::flush_for_termination(Duration::from_millis(10)),
+        crate::FlushOutcome::Empty
+    );
+}
+
 #[test]
 fn record_blocking_is_a_noop_when_unarmed() {
     // The process panic hook is installed before the command line is parsed, so

crates/tui/src/lib.rs

@@ -862,6 +862,10 @@ fn spawn_signal_cleanup_task() {
     let mut signals = TerminatingSignals::register();
     tokio::spawn(async move {
         let exit_code = signals.wait().await;
+        codewhale_telemetry::record_session_end_blocking(codewhale_telemetry::ExitClass::Signal);
+        let telemetry_send = tokio::task::spawn_blocking(|| {
+            codewhale_telemetry::flush_for_termination(codewhale_telemetry::SIGNAL_FLUSH_TIMEOUT)
+        });
         // Persistence and a serving Runtime API share a bounded window to
         // flush queued saves and end open streams with a typed `stream.end`.
         // A second signal skips both waits.
@@ -870,6 +874,9 @@ fn spawn_signal_cleanup_task() {
                 tokio::join!(
                     codewhale_app_server::runtime_api::drain_for_signal_exit(),
                     crate::tui::persistence_actor::flush_for_signal_exit(),
+                    async {
+                        let _ = telemetry_send.await;
+                    },
                 )
             } => {}
             _ = signals.wait() => {}
@@ -885,66 +892,11 @@ fn spawn_signal_cleanup_task() {
             #[cfg(unix)]
             codewhale_runtime::process_tree::kill_contained_trees_for_exit();
             crate::tui::ui::emergency_restore_terminal();
-            // Nothing async survives the `exit` below, so this is the last
-            // chance to say how the session ended. `record_blocking` is one
-            // `O_APPEND` write with no lock: taking the compaction lock here
-            // would let a second Codewhale process sharing CODEWHALE_HOME hang
-            // Ctrl-C, and the second-signal short-circuit below has to stay
-            // reachable. A no-op unless this process was armed.
-            //
-            // The class is stated, not derived: `RunTerminationReason::Canceled`
-            // also exits 130, so `exit_code` cannot tell a signal from an
-            // Esc-cancelled turn.
-            record_signal_session_end();
         }
         std::process::exit(exit_code);
     });
 }
 
-/// When this process's armed telemetry session began. Set once, at arming, and
-/// read from both the ordinary teardown and the signal path.
-static TELEMETRY_SESSION_START: std::sync::OnceLock<std::time::Instant> =
-    std::sync::OnceLock::new();
-
-/// Build `session_end` from what this process actually accumulated.
-///
-/// The exit class is read from the process-wide atomic and never derived from
-/// an exit code: `RunTerminationReason::Canceled` maps to 130, the same value
-/// the SIGINT path uses, so a code-based derivation would report every
-/// Esc-cancelled turn as a signal.
-///
-/// The cold-start bucket is `None` unless the interactive event loop actually
-/// began, which is what keeps it absent rather than invented on the surfaces
-/// that have no event loop.
-fn telemetry_session_end() -> codewhale_telemetry::Event {
-    let counters = codewhale_telemetry::session_counters();
-    codewhale_telemetry::Event::SessionEnd {
-        duration_bucket: codewhale_telemetry::DurationBucket::from_secs(
-            TELEMETRY_SESSION_START
-                .get()
-                .map_or(0, |start| start.elapsed().as_secs()),
-        ),
-        exit_class: codewhale_telemetry::exit_class(),
-        cold_start_bucket: codewhale_runtime::startup_trace::cold_start_ms()
-            .map(codewhale_telemetry::ColdStartBucket::from_millis),
-        providers: counters.providers(),
-        counters: counters.counters(),
-        errors: counters.errors(),
-        turn_wall: counters.turn_wall(),
-    }
-}
-
-/// Close the session synchronously, from the signal handler.
-///
-/// A no-op unless this process was armed.
-fn record_signal_session_end() {
-    codewhale_telemetry::set_exit_class(codewhale_telemetry::ExitClass::Signal);
-    for event in codewhale_telemetry::session_counters().usage_events() {
-        codewhale_telemetry::record_blocking(event);
-    }
-    codewhale_telemetry::record_blocking(telemetry_session_end());
-}
-
 /// Terminating-signal streams, registered up front and awaited later.
 ///
 /// Splitting registration from the await is the point: the OS disposition
@@ -2514,7 +2466,6 @@ fn arm_telemetry_with_setup(
         return;
     };
     codewhale_telemetry::init(consent.with_config_path(Some(store.path().to_path_buf())));
-    let _ = TELEMETRY_SESSION_START.set(std::time::Instant::now());
     codewhale_telemetry::record(codewhale_telemetry::Event::SessionStart { source });
 }
 
@@ -2580,10 +2531,7 @@ async fn finish_telemetry(outcome: &Result<()>, surface: codewhale_telemetry::Su
     {
         codewhale_telemetry::set_exit_class(codewhale_telemetry::ExitClass::Error);
     }
-    for event in codewhale_telemetry::session_counters().usage_events() {
-        codewhale_telemetry::record(event);
-    }
-    codewhale_telemetry::record(telemetry_session_end());
+    codewhale_telemetry::record_session_end();
     if surface == codewhale_telemetry::Surface::Cli {
         let persistence = codewhale_telemetry::persist_local_blocking();
         logging::info(format!(

crates/tui/src/tests/telemetry_surface.rs

@@ -227,7 +227,7 @@ fn the_session_source_distinguishes_resume_and_fork_from_a_fresh_launch() {
 
 #[test]
 fn a_session_end_built_without_arming_writes_nothing() {
-    let event = telemetry_session_end();
+    let event = codewhale_telemetry::session_end_event();
     assert!(matches!(
         event,
         codewhale_telemetry::Event::SessionEnd { .. }

crates/tui/src/tui/ui/event_loop.rs

@@ -1418,6 +1418,9 @@ pub async fn run_tui(
     // than through it. Only this path calls it, which is what keeps the
     // cold-start bucket absent on surfaces with no event loop.
     codewhale_runtime::startup_trace::mark_cold_start();
+    if let Some(millis) = codewhale_runtime::startup_trace::cold_start_ms() {
+        codewhale_telemetry::set_cold_start_ms(millis);
+    }
     let result = run_event_loop(
         &mut terminal,
         &mut app,

docs/TELEMETRY.md

@@ -126,7 +126,7 @@ claim one.
 ## When anything is sent, and where
 
 Nothing is collected or sent when a persistent opt-out or run-scoped kill
-switch is in force, or when privacy state is unreadable. TUI and `exec` sessions have exactly one network flush point: an attempt
+switch is in force, or when privacy state is unreadable. TUI and `exec` sessions have one network flush point at a normal end: an attempt
 during shutdown, bounded at three seconds. Short CLI commands such as `config`,
 `doctor`, and `auth` do not wait for that network request. They record
 `session_end`, seal the event to the local buffer with a much shorter bound, and
@@ -134,10 +134,21 @@ return; a configured endpoint sends those buffered events with the next
 interactive shutdown flush. An explicitly empty endpoint finalizes its local
 dry-run batch immediately.
 
+A session that is ended early makes one more bounded attempt, so its usage is
+not lost with it. When a terminating signal (interrupt, terminate, hang-up, or
+console close) reaches a TUI, `exec` or `serve` session, and when `exec` ends
+because the program reading its output has closed the pipe, the session records
+`session_end` with exit class `signal`, then makes one send attempt bounded at
+one and a half seconds, alongside the process's own shutdown work. A second
+signal ends the process at once without waiting. This is the same single `POST`
+of the same fields, never retried. Short CLI commands stay local-only on this
+path too.
+
 There is no startup flush, mid-session flush, per-turn flush, or per-tool-call
-flush. Every network shutdown flush re-resolves your setting from disk
+flush. Every network flush re-resolves your setting from disk
 immediately beforehand, so `codewhale config set telemetry false` written from
-another terminal stops the flush of a session that is already running.
+another terminal stops the flush of a session that is already running, including
+one that is being terminated.
 
 A flush is **one `POST`** to the resolved endpoint — by default
 `https://telemetry.codewhale.net/v1/telemetry`. The request carries a
@@ -317,7 +328,7 @@ The workhorse. Everything a session accumulated ships here, once.
 
 **`duration_bucket`** — `chrono` delta from `app.session_started_at` (`crates/tui/src/tui/app.rs:1889`). Half-open, seconds: `lt_1m` (`d < 60`), `1m_10m` (`60 ≤ d < 600`), `10m_60m` (`600 ≤ d < 3600`), `gt_60m` (`d ≥ 3600`).
 
-**`exit_class`** — `clean | signal | panic | error`. **Derived from an explicit `AtomicU8`, never from an exit code.** `RunTerminationReason::Canceled` maps to exit 130 (`crates/engine/src/core/runtime_contract/termination.rs:53`), the same value the signal task uses (`crates/tui/src/lib.rs:682`, 128+SIGINT), so a code-based derivation would report every Esc-cancelled turn as a signal. The atomic is set by the panic hook (`crates/tui/src/lib.rs:1582`), by the signal task (`:678-696`) before `std::process::exit`, and on the clean path from `RunTerminationReason::is_success()` (`crates/engine/src/core/runtime_contract/termination.rs:44-46`) — `error` otherwise. Exit codes remain insufficient: an approval-required exit (3) and a terminal exec failure (1) need their actual termination classification.
+**`exit_class`** — `clean | signal | panic | error`. **Derived from an explicit `AtomicU8`, never from an exit code.** `RunTerminationReason::Canceled` maps to exit 130 (`crates/engine/src/core/runtime_contract/termination.rs:53`), the same value the signal task uses (`crates/tui/src/lib.rs:682`, 128+SIGINT), so a code-based derivation would report every Esc-cancelled turn as a signal. The atomic is set by the panic hook (`crates/tui/src/lib.rs:1582`), by the signal task when the first signal arrives, by `exec` when its output pipe closes, and on the clean path from `RunTerminationReason::is_success()` (`crates/engine/src/core/runtime_contract/termination.rs:44-46`) — `error` otherwise. Exit codes remain insufficient: an approval-required exit (3) and a terminal exec failure (1) need their actual termination classification.
 
 **`cold_start_bucket`** — from `startup_trace::elapsed_ms()`, which reads `PROCESS_START` directly and is independent of the startup summary's buffer clear (`crates/runtime/src/startup_trace.rs:39-45`). Boundaries: `lt_250`, `250_1000`, `1000_3000`, `gte_3000`. Absent on non-TUI surfaces.
 

web/data/agent-docs.generated.json

@@ -259,8 +259,8 @@
       },
       {
         "path": "docs/TELEMETRY.md",
-        "sha256": "0ac65dbd0e1d9d196d1c4421116852c3ab6a855062c375c25b09db993084c563",
-        "content": "# Codewhale product telemetry\n\n> 阅读简体中文版：[zh_hans/TELEMETRY.md](zh_hans/TELEMETRY.md)\n\n**Usage analytics are on by default in the current source.** The first\ninteractive launch gives a localized, nonblocking disclosure naming **Codewhale\nand PostHog**, with a direct route to turn counting off. Notice version `6`\ndescribes this policy; displaying it is not recorded as human acceptance.\nMissing an older acceptance record does not turn a fresh installation off.\nExisting explicit opt-outs remain off across upgrades, and unreadable privacy\nstate fails closed. Environment and CLI kill switches still take precedence.\n\nRead the disclosure with `codewhale config telemetry`. Turn usage off in\n`/settings` or run `codewhale config set telemetry false`. Turning it back on\nin Settings or with `codewhale config set telemetry true` updates the existing\ndurable preference and privacy records for new sessions. The compatibility\ncommand `codewhale config telemetry --accept-notice 5` remains available, but\nis not required for a fresh installation. Collection never includes work content or credentials.\n\nThe PostHog sink is optional and inert until the ingest operator explicitly\nconfigures a project token and approved regional host, and records staging\nproof that the actual egress path does not forward the original client IP.\nSource readiness does not establish a deployment, an activated processor,\nan egress receipt, or a retention setting.\n\nCodewhale does not collect conversations, code, prompts, files, file/repo/branch\nnames, model content, or credentials. It sends no per-turn or per-tool timeline.\nIt does send the closed, aggregate schema below: version and platform classes,\nsession duration/outcome, feature/error counters, and a random install id that\nrotates every 90 days.\n\n**There is now a real endpoint.** An enabled session sends its batches to the\nfirst-party ingest service at `https://telemetry.codewhale.net/v1/telemetry`,\nwhich is the shipped default for `telemetry_endpoint`. What that service is,\nwhat it stores, and what it structurally cannot store is spelled out in \"What\nthe endpoint does\" below.\n\n**To send nothing anywhere, turn telemetry off** (see \"Turning it off\"). To stay\nenabled but contact nobody, set `telemetry_endpoint = \"\"`: batches are then\nappended to `$CODEWHALE_HOME/telemetry/dryrun.jsonl` on your own machine, byte\nfor byte what the server would have received, and no HTTP client is ever\nconstructed. That file is how you audit this document against reality.\n\nThis document is the schema. It is not a summary of the schema: a test in\n`crates/telemetry` parses the field names out of this file and asserts set\nequality against the structs the serializer actually uses, so a field that is\nhere and not in the code — or in the code and not here — fails the build.\n\nLocal saved sessions and `codewhale metrics` remain available with telemetry\ndisabled and require no account or hosted reporting service. Disabling telemetry\ndoes not disable local usage receipts.\n\n## Turning it off\n\nThere are two off switches and they do different things. Both stop collection\ncompletely; only one of them erases anything.\n\n```sh\ncodewhale config set telemetry false     # opt out: stops collection and erases state\nCODEWHALE_TELEMETRY=0 codewhale          # kill switch: stops collection, erases nothing\nDO_NOT_TRACK=1 codewhale                 # the same kill switch, by the common convention\ncodewhale --telemetry false              # the same kill switch, for one command\n```\n\n**`telemetry = false` in the config file is the opt-out.** It is a floor:\n`--telemetry true` and `CODEWHALE_TELEMETRY=1` both lose to it, because a\nsetting you can undo by accident from a wrapper script is not a setting. It\ndeletes the random install id, truncates every buffered event and every dry-run\nrecord, and writes a tombstone. Appends, identity/state writes, and delivery all\nshare the wipe's ordering lock, so once opt-out returns no pre-opt-out write or\nPOST remains in flight. If any part of that wipe fails, the tombstone is still\nthere and the buffer is undrainable — a failed wipe fails closed. Every later\nrun re-asserts the same tombstone for as long as the setting stands, so it\nsurvives. Turning telemetry back on in `/settings` records that explicit preference\nin both existing privacy registers; a fresh launch can then clear the tombstone. Nothing buffered before that point is\never sent.\n\n**The environment variable and the flag are kill switches, not opt-outs.**\nTelemetry is off for the run, nothing is written, nothing is sent — and\nnothing on disk is touched or deleted. That is deliberate: a harness or agent\nthat sets `CODEWHALE_TELEMETRY=0` for one command must not silently discard the\ninstall id and the dry-run records of the person who owns the machine. If you\nwant the erasing kind, use the config file.\n\n`CODEWHALE_TELEMELine truncated
+        "sha256": "486afaa17e4ec77776aeb1e0c1c6da1fddd91cba05738d813c90deec54e7caa2",
+        "content": "# Codewhale product telemetry\n\n> 阅读简体中文版：[zh_hans/TELEMETRY.md](zh_hans/TELEMETRY.md)\n\n**Usage analytics are on by default in the current source.** The first\ninteractive launch gives a localized, nonblocking disclosure naming **Codewhale\nand PostHog**, with a direct route to turn counting off. Notice version `6`\ndescribes this policy; displaying it is not recorded as human acceptance.\nMissing an older acceptance record does not turn a fresh installation off.\nExisting explicit opt-outs remain off across upgrades, and unreadable privacy\nstate fails closed. Environment and CLI kill switches still take precedence.\n\nRead the disclosure with `codewhale config telemetry`. Turn usage off in\n`/settings` or run `codewhale config set telemetry false`. Turning it back on\nin Settings or with `codewhale config set telemetry true` updates the existing\ndurable preference and privacy records for new sessions. The compatibility\ncommand `codewhale config telemetry --accept-notice 5` remains available, but\nis not required for a fresh installation. Collection never includes work content or credentials.\n\nThe PostHog sink is optional and inert until the ingest operator explicitly\nconfigures a project token and approved regional host, and records staging\nproof that the actual egress path does not forward the original client IP.\nSource readiness does not establish a deployment, an activated processor,\nan egress receipt, or a retention setting.\n\nCodewhale does not collect conversations, code, prompts, files, file/repo/branch\nnames, model content, or credentials. It sends no per-turn or per-tool timeline.\nIt does send the closed, aggregate schema below: version and platform classes,\nsession duration/outcome, feature/error counters, and a random install id that\nrotates every 90 days.\n\n**There is now a real endpoint.** An enabled session sends its batches to the\nfirst-party ingest service at `https://telemetry.codewhale.net/v1/telemetry`,\nwhich is the shipped default for `telemetry_endpoint`. What that service is,\nwhat it stores, and what it structurally cannot store is spelled out in \"What\nthe endpoint does\" below.\n\n**To send nothing anywhere, turn telemetry off** (see \"Turning it off\"). To stay\nenabled but contact nobody, set `telemetry_endpoint = \"\"`: batches are then\nappended to `$CODEWHALE_HOME/telemetry/dryrun.jsonl` on your own machine, byte\nfor byte what the server would have received, and no HTTP client is ever\nconstructed. That file is how you audit this document against reality.\n\nThis document is the schema. It is not a summary of the schema: a test in\n`crates/telemetry` parses the field names out of this file and asserts set\nequality against the structs the serializer actually uses, so a field that is\nhere and not in the code — or in the code and not here — fails the build.\n\nLocal saved sessions and `codewhale metrics` remain available with telemetry\ndisabled and require no account or hosted reporting service. Disabling telemetry\ndoes not disable local usage receipts.\n\n## Turning it off\n\nThere are two off switches and they do different things. Both stop collection\ncompletely; only one of them erases anything.\n\n```sh\ncodewhale config set telemetry false     # opt out: stops collection and erases state\nCODEWHALE_TELEMETRY=0 codewhale          # kill switch: stops collection, erases nothing\nDO_NOT_TRACK=1 codewhale                 # the same kill switch, by the common convention\ncodewhale --telemetry false              # the same kill switch, for one command\n```\n\n**`telemetry = false` in the config file is the opt-out.** It is a floor:\n`--telemetry true` and `CODEWHALE_TELEMETRY=1` both lose to it, because a\nsetting you can undo by accident from a wrapper script is not a setting. It\ndeletes the random install id, truncates every buffered event and every dry-run\nrecord, and writes a tombstone. Appends, identity/state writes, and delivery all\nshare the wipe's ordering lock, so once opt-out returns no pre-opt-out write or\nPOST remains in flight. If any part of that wipe fails, the tombstone is still\nthere and the buffer is undrainable — a failed wipe fails closed. Every later\nrun re-asserts the same tombstone for as long as the setting stands, so it\nsurvives. Turning telemetry back on in `/settings` records that explicit preference\nin both existing privacy registers; a fresh launch can then clear the tombstone. Nothing buffered before that point is\never sent.\n\n**The environment variable and the flag are kill switches, not opt-outs.**\nTelemetry is off for the run, nothing is written, nothing is sent — and\nnothing on disk is touched or deleted. That is deliberate: a harness or agent\nthat sets `CODEWHALE_TELEMETRY=0` for one command must not silently discard the\ninstall id and the dry-run records of the person who owns the machine. If you\nwant the erasing kind, use the config file.\n\n`CODEWHALE_TELEMELine truncated
       },
       {
         "path": "docs/public-surface-facts.json",