Repository navigation
The handoff now knows whether anybody is on the other side, and the ending is confirmed before the sandbox dies.
Both close gaps this project had written down and lived with: the README's first limitation ("if the human silently closes the tab, the agent can't tell") and the observation logged in every live approval round, where a second viewer of the link saw nothing because the ended lost its race with the kill.
Presence. The relay reports the phone's socket to the agent on every connect, replace and close, and once right after an agent connects, with what an absent agent missed (seen, sinceMs). A human who was there and has been gone for humanGoneGraceMs (default 60 s, floor 5 s) ends the handoff as timeout instead of waiting out timeoutMs. Measured live: an abandoned handoff ended 6 s after the tab closed instead of after a 90 s wait. A phone that comes back inside the grace resets it, which is why 60 s is the default: the preview proxy cuts an idle socket after exactly 60 s and the phone reconnects a second later. An unscanned link waits the full timeoutMs; nobody left.
No new outcome. The wide event tells the two timeouts apart instead: endedEarly: true is somebody who came and left, humanSeen: false is a link that never reached anyone, humanLeftMs says when. ADR 0009 has the argument.
Confirmed endings. The relay acks ended once it has stored it for whoever opens the link next; sendFinal waits up to 2 s (measured ~200 ms), re-sends the ending on a reconnect inside that window, and only then is the sandbox destroyed. Input arriving after the handoff ended never reaches the page.
Also: invalid_option as an eighth error code; HandoffResult.durationMs is the settlement duration, not teardown. Three reviews (two Opus passes, GPT-5.6 Sol), four fix rounds, 322 tests, live e2e green. Full CHANGELOG.