Merge dev (through #2002) into app/v3: relay, two-computer fixes, quit saving

.gitignore

@@ -2,7 +2,9 @@ bin/
 # The furrow the build fetches, and the copy it stages for go:embed. Both are
 # six megabytes of somebody else's release; internal/furrowbin/pin.json is the
 # committed, auditable half and these are rebuilt from it by `make furrow`.
-third_party/
+third_party/*
+!third_party/raft/
+!third_party/raft-patch/
 internal/furrowbin/cache/furrow-*.gz
 .obs/
 *.log
@@ -54,3 +56,6 @@ relay/hosted/.wrangler/
 
 # Native Windows test executables are local acceptance artifacts.
 .wintest/
+
+# The hosted reactor is generated from the shared, pinned Go core.
+/relay/hosted/src/raft/core.wasm

CLAUDE.md

@@ -10,6 +10,11 @@ former names only in a manual section whose heading contains “old name”.
 
 ## Repository map
 
+Start with the [contributor guide](CONTRIBUTING.md), the
+[current architecture map](docs/ARCHITECTURE.md) and
+[documentation ownership](docs/DOCUMENTATION.md). Product answers belong in the
+shipped manual; developer knowledge and historical designs have separate indexes.
+
 - `internal/tui3`: the live chat surface, entered through `cmd/codeaf/chatv3.go`.
 - `internal/session`: the chat engine, turn loop, tools and tasks.
 - `internal/tui2`: shared components used by the current surface.

CONTRIBUTING.md

@@ -0,0 +1,40 @@
+# Contributing to codeaf
+
+Start from `dev` and open a pull request back to `dev`. Read [AGENTS.md](AGENTS.md)
+for repository-wide engineering rules; it shares its contents with `CLAUDE.md`.
+
+## Choose a starting point
+
+| Work | Read first |
+| --- | --- |
+| Implement or fix a feature | [Developer architecture](docs/ARCHITECTURE.md), recent [change entries](docs/changes/README.md), and the relevant source tests |
+| Explain product behavior | [Manual authoring](internal/manual/README.md) |
+| Improve developer documentation | [Documentation ownership](docs/DOCUMENTATION.md) and [documentation map](docs/README.md) |
+| Report a defect | [Defect template](.github/ISSUE_TEMPLATE/defect.md) with a reproducible example |
+
+## Prepare a contribution
+
+1. Create a contribution branch from current `dev`; follow the [branch rules](docs/rules/branching.md).
+2. Use the Go version declared in [go.mod](go.mod). Run `make build` for `bin/codeaf`; build preparation is described in the [Makefile](Makefile).
+3. Make a focused change with observable acceptance. Follow the testing, naming, manual and design rules in [AGENTS.md](AGENTS.md).
+4. Update the matching documentation and add a [change entry](docs/rules/changelog.md).
+5. Run the required [local checks](docs/rules/ci.md#local-verification), review your diff, and open the PR against `dev` with validation and honest limitations.
+
+## Validate the affected behavior
+
+Use `make test-focus PKGS=./internal/pkg RUN='^TestRegression$$'` while editing,
+substituting the package and test you changed. Run `make test-quick`, then
+`make pr-ready` before opening the PR. The latter selects touched packages from
+the committed diff; commit Go/module edits before relying on that selection.
+Manual changes also need the [manual checks](internal/manual/README.md#validate-a-manual-change).
+
+A skipped live-provider or Docker test does not prove that path works. State what
+ran, what skipped and what remains unverified. See [CI guidance](docs/rules/ci.md)
+for the exact gate and failure diagnosis; this guide does not define another one.
+
+## Review and release
+
+Stage explicit paths and keep unrelated work out of the PR. Never push feature
+work directly to `dev`, `staging` or `main`. Reviewers need the concrete problem,
+resulting behavior and validation. Maintainers follow the [promotion rules](docs/rules/promotion.md)
+for staging and release; opening a contribution does not authorize a merge.

PERF.md

@@ -49,6 +49,13 @@ is diagnostic; regression gates count deterministic work, bytes, allocations,
 request fanout, retained data and cache reuse. Do not gate on wall-clock thresholds.
 Use scripted providers and explicit synchronization rather than real sleeps.
 
+Keyed vault restores read the sealed vault at most twice when no selection
+policy is needed, and at most three times when incoming model choices need
+provider and revision checks. These caps are independent of the number of keys;
+`TestARestoreOpensTheVaultAFixedNumberOfTimes` and
+`TestSelectiveRestoreM1BoundedVaultReads` exercise 16 and 256 keys. A model's
+optional provider metadata is backfilled without advancing its choice clock.
+
 Activity layout lines share immutable task records instead of copying both task
 and conversation payloads into every line. Conversation overlays keep their own
 copy, so live titles do not mutate the held reading. Paint scratch still expires
@@ -63,13 +70,80 @@ memberships; the batch trades temporary indexed storage for repeated scans.
 `TestTeamsDisbandScaleTerminalLatency` measures confirmation through the visible
 saved result, including persistence and redraw work.
 
+The All teams overview retains offscreen card heights and keyboard targets,
+but skips their border composition and grid padding. Latest-message ordering
+walks current and former memberships without copying their records.
+`TestTeamsOverviewPaintAllocationBudget` measures five complete frames at 200
+teams and 40,000 memberships against an 8 MiB per-frame allocation limit.
+`TestTeamsOverviewViewportMatchesFullCards` compares scrolled narrow and wide
+viewports with the complete rendering; hierarchy and fold tests preserve
+keyboard and pointer reachability.
+
+## Startup and interaction audit
+
+Build the baseline and candidate through `make build` with the same Go version,
+platform and pinned engine. Keep distinct executable files, and run the same
+test binary and fixture against each. Prepare platform-specific embedded engine
+artifacts serially: the staging step replaces the prior platform's artifact.
+An absent engine is a failed measurement, not a faster startup.
+
+```sh
+CODEAF_E2E_MODEL=deepseek/deepseek-v4.1-flash go test -tags=e2e ./internal/e2e \
+  -run '^(TestStartupWhileStorageCaptureIsPending|TestTabAndEngineAttachmentLatency)$' \
+  -count=3 -v -timeout=5m
+```
+
+The capture test uses real movable chats and a real storage daemon behind a
+transparent proxy. It withholds capture-plan requests, checks that history and
+the composer appear and accept typing, then verifies saving completes after
+release. Both in-process and newly hosted launches run. Tools and movement keep
+their capture barriers; recorder regressions check those independently.
+
+The tab test measures fresh-engine startup, attachment to an existing engine,
+opening another saved chat, twelve alternating tab selections and typed drafts
+with 2,001 message records in each chat. It pauses only its own identified engine
+for 1,200 ms while opening the resume picker, then measures picker and filter
+response separately from the engine's response. No model request belongs in
+these measurements; the fixture rejects and counts any that occurs.
+
+Start clocks before input delivery. A process ID, terminal-mode change, existing
+tab title or old frame cannot satisfy readiness: require destination-only
+history and a composer, followed by an echoed unique draft. Observation includes
+5 ms polling plus terminal command overhead. Keep every sample and timeout,
+report sample counts and maxima, and separate first process launches from later
+ones. Fresh profiles and engines do not imply cold operating-system caches.
+Report live-provider completion and recorded model identities separately; a
+scripted provider cannot establish live model acceptance.
+
 Store reopening probes distinct nonempty session IDs through the existing
 message index before checking for missing session rows. It still scans message
 IDs, and still discovers older writers' missing rows on a later open; no cached
 migration flag skips that check. `BenchmarkOpenSettledSessions` measures the
 whole public open/close operation. `TestSettledStoreTerminalStartup` separates
 fixture construction from the first interactive frame of the running terminal.
 
+Furrow detection stays off the hello path. The belt reads the remembered answer
+(`furrow.PeekTools`); the session asks furrow from a goroutine joined at close
+and appends the four workspace tools through `armFamily` if the folder is
+watched. Measured on Spark linux-arm64 with a cold engine per workspace and the
+owner profile, first frame fell from 3.87 s to about 0.5 s with the furrow
+that was embedded then; with furrow 0.3.3's fast status the unfixed tree is already
+at about 0.43 s, and this change keeps the build from depending on furrow's speed. The gate is
+`TestBuildingASessionDoesNotWaitForFurrow`, which holds `furrow status` open and
+asserts the build came back while that process was still alive; no clock decides it.
+
+Native peer acknowledgements reuse the validated routing view only for the same
+store and durably applied index. Every applied change, including revocation,
+invalidates that view. `TestR11R27UnchangedPeerAcknowledgementWork` exercises the
+real transport and caps an unchanged acknowledgement at 1,000 allocations with
+no application append; the measured cost fell from 3,273 allocations to 192.
+
+An authenticated native directory read with already durable ingress time uses a
+fresh quorum view and the normal state evaluator before omitting an identical
+append. New time and changed records still commit before inspection.
+`TestR4R26R27ReadCommitsOnlyChangedTime` counts applied entries for unchanged,
+advanced and repeated time, and requires invalid original authority to fail.
+
 ## Live tool approval settings
 
 Tool decisions refresh through the existing approval gate. The config readers
@@ -271,3 +345,12 @@ bounded to 2000 bytes. This adds no model call, polling timer or unbounded retry
 the existing GitHub read retry and factory poll remain the only retry owners.
 Policy capability failures are not cached, so subsequent polls observe plan or
 permission changes. Readiness keys are issued only for complete snapshots.
+
+## Raft coordination binary size
+
+Every build links the Raft coordination core: the modified Raft copy, protobuf,
+the signed state machine and its SQLite snapshot host. The relay and devices
+always coordinate through it, so no build leaves it out. On linux/amd64 it adds
+3,379,200 bytes to the stripped binary (75,755,785 to 79,134,985 on the same dev
+base), and the cap moves by the same amount, from 75,811,848 to 79,191,048, so
+the 56,063 bytes of headroom the base had are kept.

README.md

@@ -286,7 +286,8 @@ Sixteen of ours fit in half a gigabyte; claude's fourth tab alone needs more.
 
 - `codeaf manual`, or `alt+.` for the key map. The manual ships in the binary and the chat reads it too.
 - [Guide](docs/GUIDE.md): every flag, key, slash command and exit code.
-- [docs/](docs/README.md): architecture, headless, remote, limits.
+- [Documentation map](docs/README.md): product manuals, developer architecture, contracts and history.
+- [Contributing](CONTRIBUTING.md): setup, validation and pull requests.
 
 ## Telemetry
 

SIZE-BUDGET

@@ -1 +1 @@
-75811848
+79191048