Wormhole: continue a chat on another computer (pair, sync, take back)

.gitignore

@@ -41,3 +41,13 @@ internal/manual/pages.pack.gz
 .furrow/
 bench/idle-surface/runs/
 work/
+
+# hosted relay dev install (wrangler, miniflare)
+relay/hosted/node_modules
+relay/hosted/.wrangler/
+
+# External furrow profile measurements keep their build output inside this worktree.
+.cargo-target/
+
+# Native Windows test executables are local acceptance artifacts.
+.wintest/

Makefile

@@ -46,8 +46,9 @@ embed: manual-pack-law
 
 # ── the furrow that rides inside ────────────────────────────────────────────
 #
-# EVERY codeaf IS A codeaf WITH FURROW, so the build fetches furrow before it
-# can produce one. This step downloads the release pinned in
+# Unix builds carry furrow, so the build fetches it before producing codeaf.
+# Windows embeds the native engine through the same artifact door.
+# This step downloads the release pinned in
 # internal/furrowbin/pin.json for whatever platform is being built for, checks
 # it against the sha256 the pin names, keeps it in a gitignored third_party/
 # cache, and stages it gzipped where go:embed picks it up. Six megabytes of
@@ -60,7 +61,7 @@ embed: manual-pack-law
 # build that produced a codeaf without furrow inside it.
 #
 # On a machine with no network, point it at an artifact already on disk — the
-# sha256 is checked either way, so this is an offline road and not a looser one:
+# explicit artifact is a developer override; the normal fetch checks the pin:
 #
 #   make furrow FURROW_ARTIFACT=~/.agentfield/bin/furrow
 #
@@ -72,10 +73,22 @@ embed: manual-pack-law
 FURROW_GOOS := $(shell go env GOOS)
 FURROW_GOARCH := $(shell go env GOARCH)
 
+# Normal builds fetch the pinned release. Explicit artifacts and external source
+# checkouts are deliberate developer overrides, staged through the same door.
+FURROW_SOURCE ?=
+FURROW_SOURCE_TARGET = $(if $(CARGO_TARGET_DIR),$(CARGO_TARGET_DIR),$(FURROW_SOURCE)/target)
+
 furrow:
+ifneq ($(strip $(FURROW_SOURCE)),)
+	cd "$(FURROW_SOURCE)" && cargo build --release --locked -p furrow-cli
+	@env -u GOOS -u GOARCH go run ./internal/furrowbin/cmd/fetch \
+		-goos=$(FURROW_GOOS) -goarch=$(FURROW_GOARCH) \
+		-built "$(FURROW_SOURCE_TARGET)/release/furrow"
+else
 	@env -u GOOS -u GOARCH go run ./internal/furrowbin/cmd/fetch \
 		-goos=$(FURROW_GOOS) -goarch=$(FURROW_GOARCH) \
-		$(if $(FURROW_ARTIFACT),-from "$(FURROW_ARTIFACT)")
+		$(if $(FURROW_ARTIFACT),-built "$(FURROW_ARTIFACT)")
+endif
 
 # The symbol table and DWARF are a third of the shipped binary and nothing at
 # runtime reads them. Stripping costs symbolized panic traces, which is exactly

PERF.md

@@ -318,6 +318,35 @@ and its schema readers the ones sec brought — so the cost is pr-af's own code
 and prompts and the tables that code carries. The budget rises by exactly that
 cost, to 72,395,784.
 
+It was reset a ninth time on 2026-10-21 for paired computers (Wormhole),
+with the owner's approval to pay exactly the measured feature cost and keep
+the existing byte headroom. Measured on linux/amd64 with Go 1.26.5, the packed
+manuals and the stripped, trimmed flags of `make build`:
+
+| source and embedded engine | bytes |
+| --- | --- |
+| `origin/dev` at `428baa65f`, its own pinned furrow v0.1.0 | 70,959,369 |
+| Wormhole with that same v0.1.0 artifact | 74,219,785 |
+| Wormhole with the furrow v0.2.0 candidate | 74,375,433 |
+| Go code, corpora and Go metadata growth | 3,260,416 |
+| embedded engine growth, including alignment | 155,648 |
+| total feature cost | 3,416,064 |
+
+The dev baseline was exported with `git archive origin/dev` and built with its
+normal `make build`, which fetched its own pinned v0.1.0 artifact. The candidate
+uses the supplied prebuilt v0.2.0 artifact through `FURROW_ARTIFACT`; no engine
+was rebuilt. The gzipped engine grows from 3,613,636 to
+3,767,522 bytes. Most of this bill is the Go integration:
+cells and their executor, encrypted transfer and indexing, device pairing,
+engine compatibility and the surface/manual doors. The engine keeps its fast
+profile.
+
+The budget rises from 72,395,784 by exactly 3,416,064, to
+75,811,848. The linux/amd64 headroom remains
+1,436,415 bytes, exactly what the dev baseline had.
+These measurements account for this platform's cost; release measurements on
+other platforms remain part of their own build checks.
+
 ## Adaptive run shutdown grace
 
 `Agent.Close` cancels adaptive runs and their name calls, then gives all accepted
@@ -2965,6 +2994,41 @@ ordering guarantee, not a merge of caches written by separate processes.
 Restart fixtures drain their owned scheduled writes before discarding process
 memory. No timeout, response limit or request/retry budget changes.
 
+## Local Worker conformance bounds
+
+The local Worker proof runs tracks and suites sequentially and defaults to two
+Go test cases at a time; watch cases run alone so the thousand-socket case has
+the proxy to itself. Its test-only HTTP transport admits two requests at once,
+releasing the request slot when an upgraded watch's headers arrive. The canonical
+WebSocket dialler and the signed HTTP client share this same bound. The shared
+policy is `relay/hosted/test/proxy-env.sh`; the canonical assertions and their
+internal concurrency stay unchanged. Authorization cases keep the normal
+mailbox lifetime. A separate four-second mailbox service runs the canonical
+expiry case, and a third service remains capped at two mailboxes for RelayFull.
+The runner refuses a skipped expiry case, so these fixtures preserve all the
+original assertions under local proxy load.
+
+The thousand-socket watch case uses an isolated local runtime with the same
+limits. Its original cap, refusal and freed-place assertions all run. Stopping
+that fixture after the watch suite prevents its bulk socket teardown from
+stalling another identity's five-second dial on the shared development proxy.
+
+Each local Wrangler gets a private package copy under the run's temporary state.
+Only that copy's development proxy retries the exact transport exception
+`Network connection lost.`, at most twice. It clones the request so each attempt
+keeps the same body and signed headers. An application response, including a 500
+with those words in its body, is never retried; EOF and other exceptions retain
+their failures. Preparation refuses an unknown proxy structure. The production
+Worker, installed dependencies and production clients are unchanged.
+
+Each retry is reported at the proxy itself, before HTTP can turn the lost
+connection into an indistinguishable 500. The proof table counts retries per
+suite and prints the total including startup; the operator smoke checks print
+their own counts. Tests exercise the actual pinned proxy with scripted fetches
+and an immediate timer, covering request bytes, unchanged application responses,
+exact retry exhaustion and refusal of an unknown runtime. The Go request-bound
+fixture uses held channels and cancellation rather than sleeps.
+
 ## Navigation and first-message response
 
 Home paints its last completed reading and refreshes the world, memory ledger,

SIZE-BUDGET

@@ -1 +1 @@
-72395784
+75811848

THIRD-PARTY-NOTICES.md

@@ -2,6 +2,8 @@
 
 This file covers every third-party Go module compiled into the codeaf binary, plus the two copied components carried in this repository's own tree. It ships beside the binaries in every release. Regenerate it with `go run ./cmd/codeaf-notices generate`.
 
+The embedded furrow engine is a separate Apache-2.0 project from [Agent-Field/furrow](https://github.com/Agent-Field/furrow), copyright 2026 furrow contributors. Its source is maintained upstream; codeaf records its release and artifact hashes in `internal/furrowbin/pin.json`. See [furrow's licence](https://github.com/Agent-Field/furrow/blob/main/LICENSE). Explicit developer artifacts and `FURROW_SOURCE` checkouts replace that pinned engine. Native Windows builds omit it.
+
 ## charm.land/bubbletea/v2
 
 - Version: v2.0.8
@@ -877,6 +879,29 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
+## github.com/coder/websocket
+
+- Version: v1.8.15
+- Licence: not determined
+
+### LICENSE.txt
+
+```text
+Copyright (c) 2025 Coder
+
+Permission to use, copy, modify, and distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+```
+
 ## github.com/dlclark/regexp2/v2
 
 - Version: v2.5.2

cmd/codeaf-notices/notices.go

@@ -326,6 +326,7 @@ func renderNotices(components []component) []byte {
 	var out bytes.Buffer
 	out.WriteString("# Third-party notices\n\n")
 	out.WriteString("This file covers every third-party Go module compiled into the codeaf binary, plus the two copied components carried in this repository's own tree. It ships beside the binaries in every release. Regenerate it with `go run ./cmd/codeaf-notices generate`.\n")
+	out.WriteString("\nThe embedded furrow engine is a separate Apache-2.0 project from [Agent-Field/furrow](https://github.com/Agent-Field/furrow), copyright 2026 furrow contributors. Its source is maintained upstream; codeaf records its release and artifact hashes in `internal/furrowbin/pin.json`. See [furrow's licence](https://github.com/Agent-Field/furrow/blob/main/LICENSE). Explicit developer artifacts and `FURROW_SOURCE` checkouts replace that pinned engine. Native Windows builds omit it.\n")
 	for _, component := range components {
 		fmt.Fprintf(&out, "\n## %s\n\n", component.Identifier)
 		// THE THREE FACTS ARE A LIST because consecutive plain lines are one

cmd/codeaf/approvalrecord.go

@@ -0,0 +1,23 @@
+package main
+
+import (
+	"context"
+
+	"github.com/Agent-Field/codeaf/internal/pair"
+)
+
+// withApprovalRecord moves the terminal's own-record write ahead of granting
+// the request. The new device can read the grant immediately, before this
+// terminal prints its receipt, so a write after approval was already too late.
+func (d pairDoor) withApprovalRecord() pairDoor {
+	makeApprover, record := d.approver, d.ownRecord
+	d.approver = func(route pair.Mailbox) (pair.Approver, error) {
+		who, err := makeApprover(route)
+		if err == nil && record != nil {
+			who.BeforeApprove = func(ctx context.Context) error { return record(ctx, route) }
+		}
+		return who, err
+	}
+	d.ownRecord = nil
+	return d
+}