dsh-sdk resolved launcher telemetry consent in the finally block, after
startSDK had already loaded the project .env into process.env, so a
project file or project code could grant reporting of its own cordis.yml
and package.json. Freeze the decision from the launching environment
before dispatch and pass it to the reporter; an unsupported mode denies
instead of throwing because telemetry may never change a command result.
Configuration source ownership denies the whole DSH_* namespace to
discovered files, so the launcher must not read a mutated environment.
Replace the non-standard '无条件下报' with '无条件外发' in the default-off
note, and complete the welcome-notice descriptions in the note and the
ui-settings-general READMEs to mention the FULL launcher telemetry
disclosure. Re-record bilingual pairing hashes.
The FULL opt-in also enables dsh-sdk command telemetry (anonymous ID,
command result, redacted project configuration), which the welcome
notice and root README did not disclose. Update onboarding copy, bump
WELCOME_NOTICE_VERSION, sync the welcome and translation-prompt
snapshots, and re-record bilingual pairing hashes. Also de-duplicate
'reported by default' in the default-off Agent Note.
The repo's user-visible copy (root README, welcome notice) still
describes internal testing, so 'entering public beta' was an unrecorded
fact and contradicted this PR's own copy. Problem now states the recorded
facts: internal testing mounted telemetry with a baked-in production
endpoint and both feeds reported by default to help diagnose problems,
so a fresh installation exported without a positive deployment choice.
Consequences returns to the phase-independent statement.
Problem now explains that DSH is entering public beta and default-off is
the appropriate stance for that phase — consistent with internal testing
having default-on for diagnostics. Update Consequences to match.
