[rumblefrog]

Description

docker/php/dev-prepend.php (the dev container's auto_prepend_file) now defines SBPP_SKIP_TELEMETRY for web SAPIs. This is the same per-request opt-out /health.php already uses: Telemetry::tickIfDue() returns before any DB write or network call.

The CLI is deliberately left alone. PHPUnit inside the container (./sbpp.sh test) also loads the prepend, and TelemetryOptOutTest calls tickIfDue() directly against a dead endpoint to pin the gate. The PHPUnit bootstrap never requires init.php, so the CLI never registers a shutdown tick anyway.

Also:

• web/tests/integration/DevPrependTelemetryTest.php: checks that the prepend defines the constant behind the non-CLI gate and that docker/Dockerfile still wires the prepend in. It also loads the prepend in a php -n subprocess and asserts the constant stays undefined under the CLI.
• Short doc notes in Telemetry.php, ARCHITECTURE.md and docker/README.md. The README line about dev-prepend.php was also out of date (it still described the pre-Post-#1332 install-wizard human-flow audit: panel-takeover paths via localhost host-check bypass + /install/ replayable on installed panels, plus 8 UX gaps #1335 HTTP_HOST shim).

Motivation and Context

The dev stack seeds its DB from data.sql, which ships telemetry.enabled = 1 and the live cf-analytics endpoint. Every web request in the dev container runs the shutdown tick. So each of these sent a real ping from a throwaway install with a fresh instance_id, which polluted the production dataset:

• the E2E workflow (e2e.yml)
• the docs screenshot capture (docs-screenshots-capture.yml)
• every local ./sbpp.sh up

PHPUnit in test.yml was already safe: it never boots init.php, and the telemetry tests point at 127.0.0.1:1 or ''. The prod image workflow only builds and pushes; it never runs the panel. On the cf-analytics side, the Worker tests run against local miniflare, so nothing there needs to change.

How Has This Been Tested?

• php -l on the changed PHP files.
• I couldn't run PHPUnit in this sandbox because composer can't fetch GitHub dists here. Instead I ran the new test's three assertions by hand with plain PHP: the regex matches the prepend source, the Dockerfile still has the auto_prepend_file line, and a php -n subprocess that requires the prepend reports undefined. CI's PHPUnit job is the full check.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.

---

Generated by Claude Code

[github-actions]

Thanks for the PR! This change touches web/** (the SourceBans++ web panel),
which is covered by the project's Contributor License Agreement.

To sign, comment exactly the following line on this PR:

I have read the CLA Document and I hereby sign the CLA

You only need to sign once — your signature applies to every future
web-panel PR you open against this repo. Plugin-only PRs
(game/addons/sourcemod/**) don't need a signature.

See CONTRIBUTING.md
for the rationale.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}