[AbirAbbas]

Ported from app/v3 onto dev after app/v3 landed (#2561). This branch keeps the original commits in its history; the last commit is the port onto today's dev.

Off by default

The new behaviour sits behind one setting, idle handoff (idle_handoff in Settings → General, or CODEAF_IDLE_HANDOFF=1). It is off by default. With it unset, a paired computer behaves exactly as on dev today:

• an open idle chat keeps renewing its computer's hold;
• a released remote chat still asks Continue here;
• agents.open never acquires a shared chat on its own.

With it on (and hosted sync storage allowed):

• an idle chat in a paired set releases its hold to the relay once everything it saved has been uploaded;
• a free shared chat opens and acquires on terminal Home and through agents.open (can_open) without a Continue-here step.

A live hold or a lapsed hold still asks in both cases.

What stays on by default

These change dev's behaviour only where dev was wrong:

• Refused sends keep their words. A send or ! command the engine refuses puts the words back in the box.
• Refused owed replies keep their question. Opening a chat whose owed reply is refused keeps the question and shows only the refusal.
• Offline sends say why. An offline send names the unreachable sync service and keeps the words.
• A chat whose own hold lapsed in an outage sends again. On dev its window refused every Enter until restart. Now the first Enter takes the chat back at a new fence, with no card, when no other computer holds it.
• Take conflicts name the right computer. A desktop take conflict caused by a newer hold from the same computer now says that computer picked the chat up again.

Three defects from the hand tests, fixed here

• P9-X.1. A ! shell line now runs the same ownership check as a plain message. If it is refused, the line stays in the box and one line explains why.
• P9-X.2. After orphaned turns are kept in a branch, Enter on the original chat reopens the original chat. The branch stays a kept copy. Every refused Enter prints one line.
• P9-X.3. A turn running when its own hold lapses reacquires the hold in place (fence + 1) when no other computer holds the chat. It clears the outage notice and keeps working on the original chat, with no copy branch.

#2381's behaviour on dev is intact. ConfirmWork still retires a noticed expired hold, and a recovering batcher still heartbeats before it publishes. #2643's owed-upload wrap is kept. Dev's storage-off rules (#2509, #2536) gate both new behaviours.

Existing deployments

• Protocol. appwire gains one field, can_open, which is omitempty. An older desktop client ignores it. The desktop companion is not part of this change.
• Defaults. Default behaviour is unchanged apart from the corrections listed above. The change entry's invalidates: lines each say whether they need idle handoff on.
• Deploy and rollback. Nothing deploys from this change beyond the usual dev channel build. To roll back, revert this squash commit on dev. The setting has no effect on a build that does not know it.

Verification

Every pass below was rerun by the driver after the last edit, not taken from the porting run.

• Real terminal. The six real-terminal tests (cmd/codeaf/idle_*terminal*_test.go) pass twice, with the setting switched on by the tests themselves and nothing exported, as CI runs them.
• Default off. TestIdleRelease_DefaultOff_* (syncsetup), TestIdleOpen_DefaultOff_* (tui3) and TestIdleHandoff_DefaultOff_* (cmd/codeaf) prove that unset behaves like dev.
• P9-X fixes. Each has a regression test: TestIdleOpen_P9X1_*, TestIdleRelease_P9X2_*, TestIdleOpen_P9X2_* and TestIdleRelease_P9X3_*.
• sync: a late save after a noticed expiry is kept as a copy #2381 and cellsync: a recovering heartbeat that fails is an owed upload #2643 intact. TestLateSealOnExpiredUnacquiredHoldDoesNotRenewLease, TestAppRelayOutage* and the TestL4Hosted* / TestHosted* quit tests pass unchanged.
• Packages. internal/syncsetup passes in full, as do internal/cellsync, internal/config (see below), internal/manual, internal/chatlist and internal/appwire. make test-quick passes.
• Attributed by name. Every test that failed in a local make pr-ready was rerun by name on this branch and on dev 6a5f28744. Each one now either fails on dev too or passes on both.
  • Fails on dev too: this machine's factory and memory-pause tests, and TestRegistryCoversEveryUserFacingEnvironmentPin, which Build-then-review pipelines, completion time, watched-run usage, queue refresh, control sockets #2609 broke on dev.
  • Passes on both: it fails only under the eight-shard local load.

The driver's reruns also found three defects in the port, all fixed here:

• R9 matrix cleanup race. One new matrix cell returned before the drive's background notice step finished, so its temporary folder was still in use (3 failures in 40). The test now waits for that notice, and the cell passes 100 of 100.
• Settings search. The new row's hint and alias said "paired", so a settings search for "pair" landed on General instead of Devices. The row now says "your other computers".
• Storage-off sends. With hosted storage off, the new pre-send check waited for an uploading writer that never starts, and the words disappeared. Separately, a changed saved head continued without asking. Both now behave as on dev unless the setting is on, which restores four dev tests in storage_off_lifetime_test.go.

🤖 Generated with Claude Code