Default-Deny by Construction: A Two-Channel Sensing Layer for Behaviour Analytics on an Interactive Teaching Board

An online teaching board is a rich source of behaviour signals, but the same board holds answer keys, teacher notes, learner dossiers and unpublished drafts, and many learners are minors. Two channels leave the board: what the learner sees and what goes to analytics. We present a sensing layer that closes both channels by construction: a default-deny projection of the board for learners, and a filter with a key and value allow-list followed by a coalescing write pipeline for telemetry. We state the properties of both channels and evaluate them with an emulator that runs the unmodified production code of a deployed platform against PostgreSQL. Coalescing cuts telemetry statements per event from 2 to between 0.08 and 0.002 without changing median board save latency, but near its nominal capacity it lost up to a quarter of events and stalled saves; we characterise this failure and make it observable. Canary-based fuzzing found no leak in either channel after two fixes it motivated, while the built-in leak check detected only 1 of 8 injected projection faults against 8 for the canary oracle.