Warn when telemetry consent cannot be saved

[Chris0Jeky]

Outcome

Fixes the GH-2913 privacy-control defect where a telemetry opt-out could take effect only in memory while a stale persisted true value silently enabled telemetry again after reload.

Taskdeck still applies the user's current choice immediately and privacy-first:

• revocation clears buffered events
• stops the flush timer
• rotates the anonymous session ID
• advances the consent epoch so old in-flight failures cannot requeue events

If localStorage refuses the preference write, Taskdeck now leaves a persistent warning receipt explaining that the current-session choice worked but may not survive reload. The same warning contract covers an opt-in that exists only in memory.

Implementation

• telemetryStore.ts
  • uses the existing global toastStore
  • emits a non-expiring warning with an explicit title and privacy-specific copy when consent persistence fails
  • does not throw, retry the storage write, enable a new transport, or weaken in-memory revocation
• telemetryStore.consent.spec.ts
  • preserves the original withdrawal/re-consent/retry/read-failure cases
  • proves a failed revocation write still clears events and timers and leaves the warning
  • proves a failed opt-in write leaves the corresponding reload warning
  • pins the privacy-conservative behavior that an in-flight failed batch is discarded if server telemetry becomes inactive before it settles
• COOKIE_POLICY.md, OBSERVABILITY_SETUP.md, and observatory/README.md
  • describe session rotation, consent-epoch ownership, reload uncertainty, persistent warning behavior, and the fact that already-sent data cannot be recalled

TDD / verification boundary

The focused tests were committed before the implementation change. The resulting suite contains seven consent-ownership cases.

These are supplied regressions, not a claimed local passing result. This connector session has no executable current-main checkout or restored Node 24 dependency tree, so it did not run Vitest, typecheck, build, docs governance, or link checks locally. Keep the PR draft until exact-head hosted qualification completes.

Expected focused command:

cd frontend/taskdeck-web
npx vitest --run --maxWorkers=2 src/store/telemetryStore.consent.spec.ts
npm run typecheck
npm run build

Documentation checks:

node scripts/check-docs-governance.mjs
node scripts/check-doc-links.mjs

Scope and residuals

• No telemetry endpoint, collector, taxonomy, CSP, server enablement, consent default, analytics script, or external Observatory integration change.
• ProfileSettingsView.vue is intentionally unchanged: the checkbox already calls telemetry.setConsent, and the existing global toast host provides the persistent receipt without duplicating a settings-only error channel.
• The old legal draft's parked-status banner is inherited and not re-decided here.
• Telemetry consent: surface unpersistable revocation, and reconcile privacy docs with the consent epoch #2913 remains open for its independent no-timeout and external Observatory-governance residuals.

Part of GH-2913.