An idle chat on a paired computer can hand its hold to the relay (opt-in idle handoff)

PERF.md

@@ -831,3 +831,21 @@ method and measurements are in [docs/perf/memory-2026-10-24.md](docs/perf/memory
   once a minute. macOS keeps freed pages in a process's resident size until it
   needs them (`MADV_FREE_REUSABLE`), so `ps` RSS shows the peak of a burst while
   the footprint (`vmmap --summary`, Activity Monitor) shows what is held.
+
+## Paired idle save certification
+
+The idle-only `cellstore.SavedState` keeps the first fingerprint for each path
+and stops climbing at an already visited ancestor. A proof admits at most
+20,000 paths and 50,000 directory entries in total, 8 MiB per native output/diagnostic stream,
+and 64 MiB of current/saved chat-file content reads. Directory reads request
+only the remaining entry budget plus one. Native comparison uses its existing
+30-second preparation deadline. Exceeding a budget retains the hold; it never
+certifies a partial scope or limits ordinary saves or transfers.
+
+`TestIdleRelease_R8_WideWorkspaceAndReceiptsAllocateLinearly` measures native
+proofs over 100, 500 and 5,000 workspace files plus as many receipt records.
+It caps retained paths and visited entries at `2*N+100`, and Go allocations at
+`6 MiB + N*32,000` bytes. Before deduplication, 500+500 allocated 106,534,776
+bytes; afterward it allocated 2,505,888 bytes. The 5,000+5,000 proof allocated
+21,807,368 bytes. Bounds tests require refusal for paths, entries, reply size
+and content bytes. Final metadata revalidation remains mandatory.

cmd/codeaf/app.go

@@ -1811,7 +1811,32 @@ func appSendUnsure(err error) bool {
 }
 
 // OpenAgent attaches a conversation to a saved agent and answers it.
-func (b *appBackend) OpenAgent(id string) (appwire.Agent, error) { return b.openAgent(id, false) }
+func (b *appBackend) OpenAgent(id string) (appwire.Agent, error) {
+	// Only a row already read for this paired identity can enable automatic
+	// pull. Ordinary local opens and single-device homes add no relay request.
+	if b.idleHandoffEnabled() {
+		row, found := b.chats.rowFor(id)
+		if found && row.CanOpen && !row.Here {
+			return b.takeAgent(appwire.TakeParams{Cell: row.Cell, Seen: row.Seen}, true)
+		}
+	}
+	return b.openAgent(id, false)
+}
+
+// rowFor is the last listed row for an agent id or a shared chat's cell id.
+func (c *appChats) rowFor(id string) (appwire.ChatRow, bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if row, found := c.byAgent[id]; found {
+		return row, true
+	}
+	for _, row := range c.rows {
+		if row.Cell == id {
+			return row, true
+		}
+	}
+	return appwire.ChatRow{}, false
+}
 
 // WarmAgent is OpenAgent for a window's guess at a view (a hover's prefetch):
 // an agent in Closed or the archive is refused, never taken out again
@@ -2549,7 +2574,7 @@ func (b *appBackend) sendLocked(a *appAgent, text, clientID string, shown *appSe
 func (b *appBackend) knownWorkRefusalGated(a *appAgent) error {
 	a.gate.Lock()
 	defer a.gate.Unlock()
-	return b.knownWorkRefusal(a)
+	return b.idleWorkRefusal(a)
 }
 
 // Retry sends the words of the agent's last failed turn again.
@@ -4225,7 +4250,13 @@ func (b *appBackend) SetModel(id, model string) (appwire.Agent, error) {
 	if live.conn.Lent {
 		return appwire.Agent{}, errLentStage("model")
 	}
-	live.conn.Conv.SetModel(model)
+	if checked, ok := live.conn.Conv.(interface{ SetModelChecked(string) error }); ok {
+		if err := checked.SetModelChecked(model); err != nil {
+			return appwire.Agent{}, appEngineError(err)
+		}
+	} else {
+		live.conn.Conv.SetModel(model)
+	}
 	if now := live.conn.Conv.Model(); now != "" {
 		model = now
 	}
@@ -4270,7 +4301,18 @@ func (b *appBackend) SetEffort(id, word string) (appwire.Agent, error) {
 		SetConversationEffort(string) bool
 		ConversationEffort() string
 	})
-	if !ok || !dial.SetConversationEffort(rung.String()) {
+	took := false
+	if ok {
+		if checked, yes := dial.(interface{ SetConversationEffortChecked(string) (bool, error) }); yes {
+			took, err = checked.SetConversationEffortChecked(rung.String())
+			if err != nil {
+				return appwire.Agent{}, appEngineError(err)
+			}
+		} else {
+			took = dial.SetConversationEffort(rung.String())
+		}
+	}
+	if !ok || !took {
 		return appwire.Agent{}, appwire.Errorf(appwire.CodeEngine, "this conversation has no thinking dial; update the engine and reconnect")
 	}
 	chosen := dial.ConversationEffort()
@@ -5040,6 +5082,9 @@ func appEngineError(err error) error {
 	}
 	var refusal *executor.WorkRefusal
 	if errors.As(err, &refusal) {
+		if refusal.Retryable {
+			return &appwire.Error{Code: appwire.CodeUnreachable, Message: refusal.Line}
+		}
 		location := &appwire.Location{Here: false, Line: refusal.Line}
 		if refusal.HolderID != "" {
 			location.Holder = &appwire.LocationHolder{ID: refusal.HolderID, Name: refusal.HolderName}

cmd/codeaf/app_chats.go

@@ -14,7 +14,9 @@ import (
 	"github.com/Agent-Field/codeaf/internal/appwire"
 	"github.com/Agent-Field/codeaf/internal/cell"
 	"github.com/Agent-Field/codeaf/internal/chatlist"
+	"github.com/Agent-Field/codeaf/internal/config"
 	"github.com/Agent-Field/codeaf/internal/dirwatch"
+	"github.com/Agent-Field/codeaf/internal/env"
 	"github.com/Agent-Field/codeaf/internal/guard"
 	"github.com/Agent-Field/codeaf/internal/handoff"
 	"github.com/Agent-Field/codeaf/internal/pair"
@@ -406,6 +408,7 @@ func (b *appBackend) readChats(parent context.Context, s *syncsetup.Sync, feed d
 		_, installed := local[r.Cell]
 		here := r.Mine && (r.Status == chatlist.Here || installed)
 		row := appwire.ChatRow{Cell: r.Cell, Title: r.Title, Here: here, Status: string(r.Status), Seen: appwire.Seen{Device: r.DeviceID, Fence: r.Fence, Head: r.Head}, CanTake: !here && r.Head != ""}
+		row.CanOpen = s.IdleHandoffAllowed() && r.AutoOpen && r.Head != ""
 		if service, ok := s.Dir.(interface{ HeadTakes() bool }); ok && !service.HeadTakes() {
 			row.Seen.Head = ""
 		}
@@ -760,6 +763,17 @@ func (b *appBackend) cachedChatLocation(id string) *appwire.Location {
 	return chatLocation(row)
 }
 
+func (b *appBackend) idleHandoffEnabled() bool {
+	profile := strings.TrimSpace(b.profileDir)
+	if profile == "" {
+		profile = strings.TrimSpace(env.Get(config.ProfileDirEnv))
+	}
+	if profile == "" {
+		profile = b.relayHome()
+	}
+	return config.IdleHandoffAt(profile) && syncsetup.StorageForHome(b.relayHome()) != "off"
+}
+
 func (b *appBackend) dressChatLocation(view *appwire.Agent) {
 	fresh := b.cachedChatLocation(view.ID)
 	if fresh == nil {

cmd/codeaf/app_lend.go

@@ -152,6 +152,13 @@ func endsAView(door session.StopDoor) bool {
 // model change has no error to return.
 func (l lentAgent) SetModel(string) {}
 
+// SetModelChecked preserves the legacy wrapper's model policy at the checked
+// RPC door; the embedded agent's promoted setter must not bypass it.
+func (l lentAgent) SetModelChecked(model string) error {
+	l.SetModel(model)
+	return nil
+}
+
 // SetSpendRail refuses: the stage's rail is the factory's.
 func (l lentAgent) SetSpendRail(float64) error { return errLentStage("spend limit") }
 

cmd/codeaf/app_take.go

@@ -67,13 +67,19 @@ var (
 	appTakeSeen = func(ctx context.Context, s *syncsetup.Sync, id string, seen *directory.LeaseExpectation, onMove func(syncsetup.MoveProgress)) (syncsetup.Continued, error) {
 		return chatMover(s, onMove).TakeSeen(ctx, id, seen)
 	}
-	appTakeOpen = (*appBackend).OpenAgent
+	appTakeOpen = func(b *appBackend, id string) (appwire.Agent, error) {
+		return b.openAgent(id, false)
+	}
 )
 
 // TakeAgent moves a chat here. Its row says the move is queued, then how far
 // it has got, and, when it did not move the chat, how it ended, so a client
 // that stopped waiting still learns the outcome.
-func (b *appBackend) TakeAgent(p appwire.TakeParams) (agent appwire.Agent, err error) {
+func (b *appBackend) TakeAgent(p appwire.TakeParams) (appwire.Agent, error) {
+	return b.takeAgent(p, false)
+}
+
+func (b *appBackend) takeAgent(p appwire.TakeParams, available bool) (agent appwire.Agent, err error) {
 	if p.Cell == "" || p.Seen.Device == "" {
 		return appwire.Agent{}, appwire.Errorf(appwire.CodeBadParams, "a chat and its seen computer are required")
 	}
@@ -131,8 +137,11 @@ func (b *appBackend) TakeAgent(p appwire.TakeParams) (agent appwire.Agent, err e
 		return appwire.Agent{}, err
 	}
 	seen := &directory.LeaseExpectation{Device: p.Seen.Device, Fence: p.Seen.Fence, Head: p.Seen.Head}
+	if available && view.Cell.Lease.Expires != 0 {
+		return appwire.Agent{}, appAvailableRefusal(ctx, s, view.Cell.Lease)
+	}
 	if !seen.Matches(view.Cell) {
-		return appwire.Agent{}, appTakeError(directory.ErrLeaseHeld)
+		return appwire.Agent{}, appTakeRefusal(ctx, s, p.Cell, seen, directory.ErrLeaseHeld)
 	}
 	if view.Cell.Archived || view.Cell.ParentCell != "" {
 		return appwire.Agent{}, appwire.Errorf(appwire.CodeNotFound, "that chat is not available")
@@ -159,7 +168,7 @@ func (b *appBackend) TakeAgent(p appwire.TakeParams) (agent appwire.Agent, err e
 			if busy {
 				return appwire.Errorf(appwire.CodeBusy, "Finish this chat's work before continuing it here.")
 			}
-			if moved {
+			if available || moved {
 				b.release(existing)
 			}
 			return nil
@@ -169,17 +178,27 @@ func (b *appBackend) TakeAgent(p appwire.TakeParams) (agent appwire.Agent, err e
 		}
 	}
 	report, stopReport := b.moveReporter(p.Cell, move)
-	got, err := appTakeSeen(ctx, s, p.Cell, seen, report)
+	var got syncsetup.Continued
+	if available {
+		got, err = chatMover(s, report).OpenAvailable(ctx, p.Cell, seen)
+	} else {
+		got, err = appTakeSeen(ctx, s, p.Cell, seen, report)
+	}
 	stopReport()
 	if err != nil {
-		return appwire.Agent{}, err
+		if available && (errors.Is(err, directory.ErrLeaseHeld) || errors.Is(err, directory.ErrFenceStale)) {
+			if fresh, readErr := s.Dir.Cell(ctx, p.Cell); readErr == nil && fresh.Cell.Lease.Expires > fresh.Now {
+				return appwire.Agent{}, appAvailableRefusal(ctx, s, fresh.Cell.Lease)
+			}
+		}
+		return appwire.Agent{}, appTakeRefusal(ctx, s, p.Cell, seen, err)
 	}
 	// The chat is this computer's from here on, even if opening it fails.
 	b.chats.landTake(p.Cell, got.Taken.Driving.Fence)
 	// The continuer's already-here shortcut may observe a local acquisition
 	// that happened after our preflight read. It must not accept older consent.
 	if got.AlreadyHere && (p.Seen.Device != s.Device.ID() || !seen.Matches(directory.Cell{Head: got.Taken.Driving.Head, Lease: directory.Lease{Device: s.Device.ID(), Fence: got.Taken.Driving.Fence}})) {
-		return appwire.Agent{}, appTakeError(directory.ErrLeaseHeld)
+		return appwire.Agent{}, appTakeRefusal(ctx, s, p.Cell, seen, directory.ErrLeaseHeld)
 	}
 	root := got.Taken.Cell.Root
 	meta, err := session.LoadMeta(root)
@@ -193,7 +212,7 @@ func (b *appBackend) TakeAgent(p appwire.TakeParams) (agent appwire.Agent, err e
 	}
 	b.remember(session.SessionRow{ID: id, Dir: root, Transcript: transcript, Workspace: meta.Workspace, Title: meta.Title, Created: meta.Created, Model: meta.Model, ModelIdentity: meta.ModelIdentity})
 	a := b.agent(id)
-	b.installTaken(a, transcript, meta, !got.AlreadyHere, moved)
+	b.installTaken(a, transcript, meta, !got.AlreadyHere, available || moved)
 	location := &appwire.Location{Here: true, Cell: p.Cell, Seen: &appwire.Seen{Device: s.Device.ID(), Fence: got.Taken.Driving.Fence, Head: got.Taken.Driving.Head}, Holder: &appwire.LocationHolder{ID: s.Device.ID(), Name: got.Device}}
 	if service, ok := s.Dir.(interface{ HeadTakes() bool }); ok && !service.HeadTakes() {
 		location.Seen.Head = ""
@@ -231,6 +250,35 @@ func (b *appBackend) TakeAgent(p appwire.TakeParams) (agent appwire.Agent, err e
 	return agent, nil
 }
 
+// appTakeRefusal reads ownership again because the observed computer may have
+// reclaimed its own idle release while this take was on the way.
+func appTakeRefusal(ctx context.Context, s *syncsetup.Sync, id string, seen *directory.LeaseExpectation, err error) error {
+	if !errors.Is(err, directory.ErrLeaseHeld) && !errors.Is(err, directory.ErrFenceStale) {
+		return err
+	}
+	wire := appTakeError(err).(*appwire.Error)
+	if seen != nil && seen.Fence > 0 {
+		if fresh, readErr := s.Dir.Cell(ctx, id); readErr == nil && fresh.Cell.Lease.Device == seen.Device && fresh.Cell.Lease.Fence > seen.Fence {
+			wire.Message = fmt.Sprintf(chatlist.PickedUpAgain, appHolderName(ctx, s, fresh.Cell.Lease.Device))
+		}
+	}
+	return wire
+}
+
+func appHolderName(ctx context.Context, s *syncsetup.Sync, device string) string {
+	name := chatlist.DeviceName(nil, device, nil)
+	if listing, err := s.Dir.List(ctx); err == nil {
+		key := directory.MetadataKey(s.Identity.CellKey())
+		name = chatlist.DeviceName(listing.Devices, device, func(sealed string) (string, error) { return directory.OpenName(key, sealed) })
+	}
+	return name
+}
+
+func appAvailableRefusal(ctx context.Context, s *syncsetup.Sync, lease directory.Lease) error {
+	name := appHolderName(ctx, s, lease.Device)
+	return appLocationRefusal(&appwire.Location{Holder: &appwire.LocationHolder{ID: lease.Device, Name: name}, Line: chatlist.Superseded(name)})
+}
+
 // installTaken points the agent at the chat a take installed. installed: the
 // take replaced the saved conversation; moved: another computer held it.
 // Under the agent's gate, as releaseForTake: a send waits for the reset