Merge origin/main: the operator's upload ceiling beside the disk-thread work

One conflict, in §15.3's open list, and it was two changes agreeing rather than
disagreeing: this side removed the rows for the third-party search bound and the
node-announcement bound because both are now built (AV27, AV28), while the other
side kept them and added a new one. Resolved by keeping what is genuinely still
open — per-device revocation having no CLI — and leaving the two closed.

`webrtc_server.py` merged without conflict but the two sides met inside one
function: `_upload_chunk` gained the operator's `max_upload_gb` ceiling from
there and the per-group lock and `off_disk` calls from here. Read back rather
than trusted: the operator's ceiling now sits inside the critical section that
keeps chunk ordering, and the unlink beside it goes to the disk thread with
everything else.

2893 passed. The twelve `test_sticky_header.py[firefox]` setup errors are the
open Firefox on this machine, as before.

1 files changed, 8 insertions, 0 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 65ca668..9aac263 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -13,6 +13,14 @@ optional hub feature and are off on the reference deployment.
 `docs/` is either an operational guide, or a superseded document kept for its
 cross-references and carrying a banner that says so.
 
+**`docs/QUICKSTART.md` and `docs/USERGUIDE.md` are the user documentation** —
+written for somebody who is not a developer, Linux and the browser only. They
+name CLI verbs, default values, setting names and interface labels, so a change
+to any of those is a change to them: the previous user guide was retired
+because it had drifted past the point where a reader could tell which half was
+still true. What keeps them honest is that they state what is *not* built as
+readily as what is (§15.2, §15.3); a feature that lands deletes its line there.
+
 ## Repository structure
 
 ```