[AbirAbbas]

Stacked on #2009 (merge of dev into app/v3). Once that merges, this PR's base becomes app/v3.

Summary

Gives the desktop app (codeaf app) what it needs to set up the relay, pair computers, list chats on your other computers, and Continue here. Then fixes what a live two-computer test turned up: a Windows desktop and a Mac codeaf app syncing through one relay, over many rounds.

New app wire (features devices.pair, chats.take, sync.relay)

• Methods:
  • pair.start/get/answer/cancel, with desktop wording and labelled choices;
  • devices.*;
  • chats.list (a versioned inventory with Location and ChatRow);
  • agents.take (Continue here with a seen consent);
  • sync.get.
• Events: pair.changed, chat.changed, chat.removed, devices.changed, sync.changed, settings.changed (now also sent for synced settings).
• Documentation: docs/design/app-v3/PROTOCOL.md and internal/manual/chat/desktop-sync.md describe both.

Fixes from the live test

• Chats and rows

  • Chats made before pairing are published at start and after pairing.
  • A row says a computer is offline only when presence says so. Unknown presence is omitted, never sent as false.
  • saved_at is the saved turn's time, not the publish time. The takeover line has no absolute timestamp; the desktop formats time locally.
  • chat.changed / devices.changed are sent only for a real change: never from chats.list, never for a reconnect that changed nothing, never as a partial list.

• Ownership

  • A failed take leaves the chat free, and its source can write again. Fences never roll back.
  • A holder's fence moves only when ownership changes: no extra acquire per take, none at startup for a live hold, none on watch reconnects. An open chat keeps its hold with heartbeats instead of being retired and re-acquired every ten minutes.
  • A take is not refused when the same holder only renewed its fence and the saved head is unchanged.
  • A take either completes or moves nothing: a chat whose model this computer can't use, with no usable default
    either, is taken; its first send then says plainly to set up a model, without calling a provider.
  • A background chat is not reopened (and its lease taken) at start or after the idle sweep because of a job whose
    ending its checkpoint already holds; that check only reads.

• Relay outages

  • A computer whose own lease lapsed while the relay was unreachable renews it when the relay answers, keeps the chat writable meanwhile, and publishes the work saved during the outage.
  • It never tells itself that it continued the chat elsewhere.
  • The startup quiet release is no longer refused (401) by the native relay.
  • A relay that just (re)started reports computers it has not heard from yet as unknown, not offline, for one
    presence window (native and hosted relays).

• Settings and models

  • Synced settings reach the desktop (settings.changed).
  • A model choice syncs only to computers that can use its provider; a local Ollama model no longer becomes the other computer's default.
  • A taken chat whose model this computer can't use continues on the local default, with one notice.
  • The chat's model choice (main and fallback) travels with the chat in the sealed session truth, so taking a chat
    back no longer reverts it to the model this computer remembered.
  • A model that refuses reasoning is not sent reasoning, and that 400 is not retried later.

• Windows: Continue here onto Windows. Three fixes:

  1. the store daemon kept a directory watch on the staging tree, so the rename was refused;
  2. the engine was spawned in a working directory past MAX_PATH;
  3. receipts were restored past MAX_PATH.

  Verified with native Windows test runs and live.

Relay protocol (backward compatible)

• Codeaf-Saved-Turn-Times: 1. A cell can carry the saved-turn time. Older relays still accept a publish without it.
• Codeaf-Head-Takes: 1. A head-guarded take accepts a newer fence by the same holder when the head is unchanged. Older relays keep exact-fence checks.
• Presence. Queries use the same reconnect grace as watch events, and last-seen never moves backwards. After a
  relay starts, unobserved computers are omitted (unknown) for one presence window.
• Both relays. The native relay (relayserve) and the hosted relay (relay/hosted) both implement these.

Verification

• Tests: each fix has focused regression tests named by its contract item (E-, R, S*, F*, P*, O*, C1, W*, I*). Loopback relays with two homes and real app processes drive takes, outages (a relay stopped past the lease TTL and restarted), presence across reconnects and model sync. Native Windows runs cover the take round trip with the shared daemon, plus long paths.
• Live, Windows desktop and a Mac app through a relay:
  • pairing; chats syncing both ways;
  • Continue here in both directions, including Mac-origin chats onto Windows;
  • turns after each take; the held view on the other computer;
  • one fence move per take;
  • a deliberate 4-minute relay outage: turns kept running, the lease was renewed afterwards, the backlog published;
  • recovery of a chat stuck by an earlier outage;
  • a relay restart with both computers running: no offline flash on either side;
  • an open idle chat keeping one fence across sweeps (heartbeats only);
  • a chat whose model isn't set up: the setup sentence without a provider call, then the new default with one line;
  • model sync skipped on a computer without the provider (recorded, not applied).
• CI: the PR gate fails the same tests, with the same content, as Merge dev (through #2002) into app/v3: relay, two-computer fixes, quit saving #2009's gate (repo law tests and existing
  failures). The full check fails the same tests as app/v3 runs, except TestR25ArchivedPreconditionalClient, which
  builds an archived client offline and fails on a module the runner's cache lacks (golang.org/x/sys@v0.6.0 under
  GOPROXY=off); this branch changes no module and adds no module import to that client's packages. Failures the
  branch had introduced (two tests, two repo laws) are fixed in later commits.
  Runs on the last commit: PR gate 40697998349 (re-run once for a temp-dir cleanup race that passes 30/30 locally),
  Full check 40698002131. This branch's PRs into a merge/ branch trigger no checks, so these were dispatched by hand.

Follow-ups (not in this PR)

• Taken chats live under copy-<encoded origin>, so a very deep Windows home or project can still pass 260 characters for git/shell working directories. Typical homes stay well under. Options: shorter, hash-based copy folder names; or a long-path-aware manifest with LongPathsEnabled, though that still doesn't let git or a shell start in a long working directory.
• The desktop's ChatRow.crew is not filled yet.

🤖 Generated with Claude Code