An idle chat on a paired computer hands its hold to the relay, and opening it elsewhere takes it - #2287

An idle chat on a paired computer now hands its hold to the relay. Opening it on another paired computer takes it over without the Continue-here step, even when the first computer is off. A running chat still asks, so you can watch it without taking it.

Base is app/v3, not dev. The take-back path this builds on exists only on app/v3: ConfirmWork reacquire (#2186, #2180, #1991) and the desktop engine. This change reaches dev at the next app/v3 ↔ dev merge.

What changes

• Release when idle. A chat on a computer in a paired set (two or more computers on one identity) lets go of its hold about 2 seconds after it goes idle, once everything is on the relay: turns, settings saved after the last turn, workspace and vault. Work keeps the hold exactly as today. That covers a running turn, queued or steering work, a task that is starting or parked, jobs, title and memory writers, and unsent turns. Uploads run outside the admission lock, the final release step is short and bounded, and Close cancels and joins an attempt.
• Take back in place. New work in the window that released (a send, queue, steer, retry, task or ! shell) retakes the hold through the existing work gate. There is no restore, no setup question, and local files such as node_modules stay. If another computer took the chat, the work gets today's held-elsewhere refusal and nothing is written.
• Open a free chat directly. Chat rows carry an optional can_open. It is set only for paired homes, and only from the directory's own lease expiry. Opening such a chat in the terminal, or through agents.open with its id, fetches the newest saved head and takes it with a non-forcing conditional acquire, checked again at acquisition. A live hold keeps the Continue-here choice. Rebuildable files are not carried, as today.
• Copy folder name (pre-existing, now frequent). The copy bucket was copy- plus the origin's full encoded path, so a chat moving back and forth nested the name and failed with file name too long on the third hop. Existing roots are kept, a copy origin reuses its own name, and longer names are capped at 240 bytes with a stable hash. Existing short names are unchanged.

Nothing changes for anyone else

• This is opt-in by pairing. A home with sync off or a single device makes no new requests and keeps the same renewal cadence. A test counts every request type over a full 30 s renewal period.
• Old builds keep working. An old holder never releases, so a new computer shows Continue here as before. An old reader sees a released chat the way it sees a lapsed hold today. can_open is optional and omitempty, and the lease rules and wire are unchanged.

Validation contract

C1. A paired, idle chat with its turns uploaded is released within a few seconds; the directory shows no live holder.
C2. A running turn, queued work, a running, starting or parked task or job, or unsent turns keep the hold, renewed as today.
C3. New work in the released window, when nobody else took the chat, retakes it before any write or model call, with no prompt.
C4. If another computer took it, new work gets the held-elsewhere refusal and nothing is written locally.
C5. Nothing is lost. Turns, journal, workspace (minus rebuildable files), memory and settings are on the relay before the release, and a failed upload keeps the hold.
C6. Opening a released or lapsed chat on another paired computer pulls and takes it with no Continue-here prompt; its state matches the last save.
C7. Opening a chat another computer holds behaves as today: you can watch, and Continue here stays the person's choice.
C8. C6 works while the first computer is stopped.
C9. Rebuildable files are not part of the hand-off.
C10. Unpaired and single-device homes behave exactly as before.
C11. Old builds on either side keep working.
C12. A send racing an open ends with exactly one owner under today's fencing.

Each item maps to TestIdleRelease_C* / TestIdleOpen_C* tests in cellsync, cellstore, session, syncsetup, chatlist, handoff, tui3 and cmd/codeaf. All run five times.

Verification

• Focused packages are green. All contract tests passed 5×, and the cellsync/handoff/syncsetup selection passed -race -count=3. Build, vet, gofmt, the manual gates, carried help and belt pages also pass.
• make test-laws: the lock-defer law caught three new sections, now fixed. The remaining reds fail identically on the base f7422fb8e and name no file in this change (commentlaw on factory copy, session complexity rows, taxonomy in factory).
• Two independent review rounds and two real two-home hand walks on Linux, using real binaries, a self-hosted relay and a model stub:
  • Release timing: seal to release took 2.0–2.9 s.
  • Stopped source: the chat moved while A was stopped, with the journal exact, files present and node_modules excluded.
  • Running chat: not taken.
  • Held elsewhere: A got the refusal after B took the chat.
  • Sync-off home: unchanged.
  • The first walk found three defects: a same-window send that restored, a stale viewer that didn't pull, and the copy-folder name length. All three are fixed above with regressions. The second walk on the fixed head is in progress; results will be added here.
• Known red on the base too: TestOwnershipCheckThatFindsAnotherHolderKeepsUnsentTurns fails on clean f7422fb8e.

Not in this PR

• Desktop: the desktop preview needs a small change to open a can_open row directly. That will be a separate codeaf-desk PR. Until then the desktop keeps showing Continue here, which still works.
• Mac check: pending on the exact head.

🤖 Generated with Claude Code