first run: a worker's codeaf is the running one, the usage notice is read on screen, no raw log lines, the receipt names devaf

[AbirAbbas]

Four first-run defects found by a fresh-install check of the published dev build, installed as devaf through the real installer.

1. A worker's codeaf reached the wrong binary. The worker is taught to edit with codeaf patch, but only a plandb shim was on its PATH. On any install not named codeaf, the call was command not found, or it reached an older codeaf (there is no \codeaf patch`). Now armShimalso writesbin/codeaf, which execs the binary the codeaf command registered at start (session.SetRunningCLI). A process that registered nothing gets a one-line refusal with exit 127, and never another codeaf. The landing reads bin/codeafas the harness's own file. Found during the hand check: the plan CLI's plandb statusprobe hitdatabase is lockedbeside the live store, which failed a whole task withno plandb CLI found. The registered codeaf is now the worker's plandb` without a probe.

2. The telemetry notice was hidden under the full-screen UI. It was printed on the normal screen and marked seen at once, so it was read only after quitting, and that exit had already sent the counts. This is a design choice (option b of three): a chat now owes the notice to the surface. The first conversation's screen draws all six lines, dim, under the starting points. It is marked seen from the update loop only after a frame drew it. A frame too short for the whole notice, or the setup in front, leaves it owed, and nothing is flushed before the mark. Task commands and chat --once still print it to stderr.

3. Raw log lines appeared on a first launch. A keyless first launch logged media: no generation endpoint … provider API key is required onto the terminal. Keyless media is now an absent capability, with no line. The Model Pool judge kept the boot's keyless settings, so every landing in the first session failed with no API key and was marked judged for good. The judge now reads the process's live account when it asks. A judge with no key at all stops without a reason line or a judged marker, which leaves the landing for the next start.

4. The installer receipt named the wrong command. A devaf install said installed codeaf dev-…. It now says installed devaf · codeaf dev-… built …, and a default install is unchanged. The manual and GUIDE no longer say the installer prints the telemetry notice.

Validation contract

• Whatever the running binary is named, and with a codeaf that prints WRONG first on PATH, a worker's codeaf … and plandb … reach the running binary: first word, after cd, and command -v. With no running codeaf registered, codeaf refuses with exit 127 and never prints WRONG. (internal/session/codeaf_shim_test.go)
• A chat on a terminal marks the notice seen only after a surface frame drew it, and hands the surface the exact notice. A task still prints and marks it. A short frame, or setup in front, draws none of it and marks nothing. (cmd/codeaf/telemetry_notice_surface_test.go, internal/tui3/telemetrynotice_test.go)
• A keyless first launch writes nothing to the standard logger, while a media fault that has a key still logs. The judge asks with the key pasted after boot. A keyless judge leaves no judged marker. (cmd/codeaf/firstrun_quiet_test.go)
• A --name devaf install, from the flag or the environment, prints installed devaf · codeaf <tag> …, and no line starts installed codeaf. (internal/release/install_test.go)

Each test was shown failing on the pre-fix behaviour before the fix.

By hand

make build gave bin/codeaf, which was installed as ~/.codeaf/bin/devaf on a throwaway HOME. A stale codeaf script printing WRONG was first on PATH, and every seat was pinned to deepseek/deepseek-v4-flash.

• The normal screen under the alt screen held nothing after launch or after the task (no notice, no media: line). chat.log was empty.
• The first conversation drew the six notice lines, and telemetry/notice_seen appeared only after that.
• A /task worker ran codeaf patch calc.py --old 'a - b' --new 'a + b', which answered patched calc.py. The run's bin/codeaf was exec …/devaf "$@".
• The judge half could not be driven by hand: the chat's default /task road (the run engine) does not reach the pool judge, and quick_task was not on the belt. The unit tests prove it.

Follows #1429 / #1485 / #1494 / #1436 review

🤖 Generated with Claude Code