corpus_generation_enabledWhether corpus retrieval runs its in-generator answer/faithfulness path. Default OFF (the D3 ruling: generation_enabled=false — the evidence boundary neutralizes on the corpus->harness path instead).
cancel_route_availableWhether the operated tenant exposes POST /api/v1/tasks/{id}/cancel (OQ1). Default OFF — cancel degrades to an honest local-detach until PG3 verifies the route.
live_tenant_enabledWhether the live-tenant legs (real dispatch/round-trip, live deploy smoke) are enabled. Default OFF — every live leg is PG3-gated; the mocked half runs without it.
analytics_enabledWhether the 4.13 product-analytics seam resolves a real vendor adapter. Default OFF — the seam ships no-op/OFF and PG9 flips this config (never hard-coded on). Even ON, the seam stays no-op without a configured vendor+key, session replay is masked + off by default, and identity is the IdP account (never fabricated).
The data-protection posture is pending publication by governance. No retention, PII, or data-handling claim is asserted here until it is published.