Default-on, user-disableable anonymous product usage counting for Codewhale.

The whole of what this crate may ever send is [event]. The whole of what decides whether it may send anything is [decision]. Nothing else in the tree is permitted to construct a payload or to reach the wire, and nothing in here reads a prompt, a completion, a tool argument, a file, a path, a git remote, a branch, a model id, a provider table name, an MCP server name, an approval rule, an error body, a panic message, or a credential.

The shape of the guarantee

Permission is a value, not a convention. [decide] is the only constructor of [TelemetryConsent]; [init] takes one by value and there is no bool-taking sibling. Six init sites cannot each drift from the predicate, because they never see the predicate.

Arming is a OnceLock, consulted by every write path including [record_blocking]. This matters because the process panic hook is installed before the command line is even parsed, long before any config resolution: it cannot consult a resolved value, but it can consult a lock that is by construction empty until resolution completes. A disabled user's panic therefore writes nothing and creates no directory.

Arming also truncates any stale buffer before a newly permitted process begins recording.

Failure posture

Fail-open is absolute. Every fallible step ends in .ok()? or let _ =. Nothing here returns an error to a caller, blocks a turn, blocks a tool, or blocks process exit. Telemetry that costs a user their session is worse than no telemetry.