[Privacy] Telemetry opt-out does not stop already-queued uploads #54

Disposition: Privacy / consent — MSRC Moderate (no external attacker) · Metalama analogue: metalama/Metalama#1670

Affected code

• UserInterface/PostSharp.Settings/Ceip/UploadManager.cs:46-71,323-387 — PerformMaintenance/Upload have no opt-out check
• opt-out enforced only at collection time: MetricsUtilities.FlushFeatureUsage, Hosting/Program.cs:959
• CeipOptionsControl.Save sets the flag but does not purge the queue
• Metrics.Flush(bool canUpload, ...) ignores canUpload; the crash path (ExceptionPackagerHelper → Metrics.CompilerUsage.Flush(false)) re-queues + uploads

Description

Upload()/PerformMaintenance() perform no opt-out check — they package and upload every file in the queue. Disabling CEIP neither clears the queue nor blocks the uploader, so files queued while telemetry was on still upload after opt-out; and a compiler crash both queues fresh usage metrics and triggers an upload even when usage reporting is off (Metrics.Flush ignores its canUpload argument). This is the PostSharp analogue of Metalama metalama/Metalama#1670.

Recommendation

Gate Upload()/PerformMaintenance() on the current opt-out state and purge the queue on opt-out; honor canUpload in Metrics.Flush. Treat any contractually-required per-usage license audit as a distinct consent category rather than blanket-suppressing it.

Backward compatibility

Internal tooling behavior change; no public API/IL/MSBuild/pipe impact.

Part of #56.