chat: onboarding answers the pointer and a second enter, no telemetry notice or command, and free models only on a low account

[ZeroPoint95]

First-run fixes, plus the owner's follow-ups on the same screen. Every item below is in docs/changes/unreleased/1720-onboarding-ux-cleanups.md as an invalidates line; the manual's getting-started, openrouter-credits and running-from-the-terminal pages follow it.

New UX looks like this

1. The interactive menus

• The welcome screen's starting points took every enter. The first enter filled the box; the second, the one that sends, was still taken by the list and sent nothing. With words in the box, enter is the composer's: ↓ enter enter sends.
• The setup's controls screen swallowed every mouse press. Rows now answer a press the way the key would (limit focuses, chat model opens the list, a model in the list is taken, Start a conversation leaves); the wheel scrolls the open list.
• Enter goes on. After a model is taken the focus moves to the next row, so enter alone walks the whole form.

2. Telemetry

• The usage-counts notice no longer appears on the first conversation's screen, ahead of --once, or ahead of a task; the "nothing sent until shown" gate goes with it.
• codeaf telemetry (status, info, show, on, off) is removed. The disclosure is the README's Telemetry section and docs/TELEMETRY.md, held to the switches by the telemetry package's doc test. The switches are unchanged: /settings telemetry toggle, CODEAF_TELEMETRY=off, DO_NOT_TRACK=1, the project file, an empty endpoint.

3. OpenRouter account state

• Low balance: the setup's model list is cut to free rows (:free ids and zero-priced catalog rows) and says free only; the model in use stays on the list. The warning stands right-aligned on the frame's last row, where the keys row carries it outside the setup.
• Expired key (new): a balance read answered API key expired is a reading of its own (credits.Reading.Expired, kept beside low in credits.json). Your OpenRouter key has expired — make a new one at openrouter.ai/settings/keys stands under the message box in a conversation and on Home for every OpenRouter model, free included; the setup says it on its last row; a turn refused as expired asks for a fresh read through provider.APIError.KeyExpired (the taxonomy law forbids reading the status in the surface); the free defaults are not used for it.

4. The controls screen itself (owner's follow-ups)

• One column: the example panel on top (up to 92 cells, whole or not at all), two blank rows, the heading Basic settings, the keys line directly under it, then the rows. The old two-column layout, Models and spending + lead sentence, and the panel's An illustration… foot line are gone.
• The panel's edge carries the example's title; a fifth example, Hand off complex coding tasks, asks /senior-dev …; commands in requests, explanations and the note wear the composer's chip.
• The panel turns on its own clock: opens on 1/5, next every 3 s round the ring; ←/→ browse; any key holds the clock 3 s; the focus never moves it; the screen-reader tier never turns by itself.
• Row names: body ink until answered, accent while focused, dim once enter has acted. Keys line: enter sets the limit · ↑↓ moves · …, no tab moves, no ←→ examples. The loose enter beside Start a conversation is gone.
• The review row (Other settings use defaults · review) is removed; a dim note Everything else is in /settings stands under the way out.
• The model list is a flat list of exact ids. The limit's explanation names /budget, the model's /model; ? on the limit explains the day's and the conversation's ceilings and how they meet.

Proof

• Tests cover every item above (internal/tui3, internal/credits, internal/config, internal/provider, internal/telemetry, cmd/codeaf), the manual gate has new probes, the untagged internal/e2e needle gate and make test-laws are green, and make test-quick is green on the branch head.
• Verified by hand in tmux against a fresh home: clicks on every row, the welcome without the notice, ↓ enter enter sending, the one-column layout at 130×40 and its fallback at 120×24, the panel turning on its clock and holding on keys, the chips in the capture's escape bytes, and the expired-key warning on the welcome screen against a local stub.
• Not seen by hand: the low-credits and expired-key lines on the setup's last row (the paste-a-key road needs a reachable OpenRouter); their placement is pinned by unit tests.
• make pr-ready has not been run on this branch.

Open question left to the owner: the ←/→ glyphs read as asymmetric in the terminal font; every mirror-image alternative is a vocabulary glyph with another meaning, so they were left as they are.

A Linux arm64 build of the head is packaged as a Docker image for first-run trials (docker run -it --rm codeaf-onboarding); the Dockerfile lives outside the repository.

🤖 Generated with Claude Code

[AbirAbbas]

Taking over: @ZeroPoint95, I walked the first run by hand on an empty home at 130x40, 120x24 and 80x24 (clicks on every row, wheel on the list, enter walking the form, ↓ enter enter sending, the panel clock and its hold), drove the low-credits and expired-key states against a local stub of the credits/key routes on both codeaf and codeaf chat --no-host, and checked every telemetry off switch against a local listener. Everything in the body held except the items below, which are fixed on the branch.

• bc251605e tui3: What does '/task' do? started a task with the brief What does ' ' do? (quote boundaries reached the send scan). Quotes now count for painting only; the quoted sentence sends as prose and its /task is drawn plain.
• f54715667 credits: an expired reading no longer moves an untouched conversation from the free default to the paid one; the engine text spelling of an expired 401 is recognised in provider.
• 3138850d0 credits: on plain codeaf (engine road) a turn refused as expired never asked for a balance read, because the wire carries the session's your key was not accepted for this model ending rather than the typed refusal. That sentence is now one exported constant and the surface asks for the read on it (same 30 s debounce; the read decides).
• 6d15cc327 tui3: enter with nothing matches closed the list, marked the row answered and moved on; it now stays. Every key armed a fresh 3 s timer (100 keys, 101 timers); one timer with a hold deadline now. The low-balance filter builds its free set once instead of rescanning the catalog per row.
• d89822a36 telemetry: turning the /settings switch off kept the running process sending usage_delta and session_ended (seen on a local listener). Off now stops at once; on lands at the next start. codeaf telemetry … still exits 1 and now names CODEAF_TELEMETRY=off, DO_NOT_TRACK=1, the /settings switch and docs/TELEMETRY.md. The doc says counts are on by default and its test holds all five switches.
• f070cb520 pool: a judge already running when the switch went off still posted its row; the pool now reads the live switches before recording outgoing rows and before each request.
• 3a7e1fa2e, 8c9c9594e manual and change entry: the 6,600-character setup section is split into self-contained topics with probes; the entry drops the removed review row, the ←→ examples contradiction and the branch-only states, and its title is under 100 characters.
• 544f8e07a merges today's dev.

Left for later, not changed here: a custom CODEAF_BASE_URL is still named OpenRouter, so a 401 saying "expired" from another OpenAI-compatible endpoint would show the OpenRouter line; switching telemetry off and back on mid-session resumes Model Pool rows before the restart the docs describe; crew/task endings do not ask for the balance read; the welcome hint still reads enter fills the box once the box is full.

[AbirAbbas]

One more: d9dab5c57 pool — the live off check added in f070cb520 re-resolved the whole pool config from the process environment, so under CI=true it refused every send and TestPoolPushPostsPendingRowsUnderTheInstallNonce went red on CI. It now re-reads only the two switches that can change while codeaf runs (the profile row and the project file) on top of the caller's own config. CI is green on d9dab5c57.

[AbirAbbas]

Verified and taken over; merging.