[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

What changed

Cloud administrators can use the existing Settings > Deployment > Privacy > Anonymous analytics switch. Their choice persists, setup honors an explicit opt-out, and the shared browser/server decision no longer overrides it in Cloud mode.

Anonymous event delivery rechecks consent before sending a queued batch. The current browser authorization context refreshes after the choice changes. Public privacy/configuration guidance and a patch changeset are included.

Why this change was made

Issue #992 remains reproducible: current develop hides the Cloud control, and submitting false returns and stores true. A real-database/HTTP regression also showed an already queued anonymous event being delivered after opt-out; delivery now drops that batch.

Impact

The existing deployment-wide choice applies to both self-hosted and Cloud deployments. Unset remains enabled. Admin authorization, unrelated metadata, Cloud Memory defaults, diagnostics, completion webhooks and version checks retain their existing behavior. Separate consent-gated PostHog/Intercom behavior is outside this change.

There is no schema, new tracking system, dependency or provider change. The implementation removes the Cloud override and reuses the existing setting/control and telemetry pipeline.

How it was tested

• Cloud-control and real-Postgres persistence regressions failed before the fix. A queued-before-opt-out HTTP delivery regression failed before the dispatch-time recheck. All 61 focused tests pass: 22 web/control/setup/database-protocol, 2 shared flag and 37 telemetry tests. Singleton deployment-metadata tests run in the existing serialized project to avoid cross-suite state races.
• All 27 repository typecheck tasks were force-run successfully; lint, Knip and pre-push gates passed. Docs validation and broken-link checks passed. The optional local Judgement evaluator could not collect evidence; hosted review/evaluation determines final readiness.
• Genuine local development with Cloud mode enabled, authenticated UI/tRPC, real database and a verified loopback Ping recorder: false persists/reloads; enabled browser events delivered 20/20 and server events 1/1; disabled and queued-after-opt-out markers delivered 0. Unset remained enabled, with browser 20/20 and server 1/1 positive controls. Automatic browser relay counts were 0 off, 1 after enabling, then 0 after disabling/reload.
• Actual failed-write rollback/cause removal/retry preserved the choice and a sibling unsaved webhook draft. Final cold-preview desktop/mobile UI taps settled correctly with API/SQL reporting false. The committed full diff exactly matches the inspected capture snapshot.
• All temporary runtime/configuration/recorder/data probes were removed and the original web process/setting restored before commit. Hosted Cloud, OS screen-reader narration, mobile software keyboard and live third-party services were not exercised. Screenshots prove off-state appearance and rendered copy, not protocol outcomes. Existing missing provider icons in the local environment-docs sidebar are outside this diff.

Checklist

• The PR title follows the repo convention: [Fix], [Feat], [Improve], [Refactor], [Docs], or [Chore] followed by a user-facing description
• This PR is small and scoped to one change
• pnpm lint and pnpm check-types pass locally — recommended fast gates passed, with all typecheck tasks force-run
• I added tests or included a clear manual validation note above
• I removed secrets, tokens, private keys, and customer data from code, logs, and screenshots
• A patch changeset is included for the public changelog

Related PRs

• Provider configuration read recovery
• Environment setup mobile actions
• Contextual model-search names

Screenshots

Actual local development with the Cloud feature flag enabled; the diagnostics environment remains development. No generated UI/store responses or source simulation. The final source and committed head match.

[roomote-community]

No code issues found. See session

Reviewed all 15 changed files and related consent, authorization, browser tracking, setup, and delivery paths. Current-head lint, typecheck, Knip, CodeQL, and docs checks passed; tests and the app Docker build were still running at review completion. Repository validation suites were left to CI.

_{Reviewed ca38a38}