[futurepaul]

Stacked on #1007. A folder a start set aside (it didn't fit on the disk) was kept and told, but its owner had no way to get it back or remove it.

The change

• Get it back: POST /api/computers/{id}/aside/{record}/back → {back, view}.
  • The computer is woken first, as its owner's wake, if it sleeps.
  • The archive is restored beside the live work, in a folder of its own: /data/work/restored-<work|files>-<YYYY-MM-DD>-<save> (back_dir), so nothing live is replaced and two never meet.
  • Then it's aside no more and its archive is deleted (Aside::release, then Saves::let_go and the forget pass, both rows in one step). Its files are in /data now, and the next save keeps them.
  • A folder that doesn't fit yet (the floor stopped the restore, which wrote nothing) or whose archive will never restore stays aside and answers 409 saying why. So does a second press while one is coming back. None aside by that id is 404.
• Drop it: DELETE /api/computers/{id}/aside/{record} → the view. The folder leaves and its archive is deleted. None aside by that id is 404.
• Shell: the set_aside row gains Get it back and Delete it, each naming its folder when several are aside, with a confirm before delete. The words sit beside the notice's in cell/shell/computer.js.
• Host: entry.mjs's restore takes an optional target directory.
• Docs: docs/api.md (both routes) and docs/computers.md.

Tests

• Core a_folder_aside_comes_back_beside_the_work_or_is_dropped:
  • back_dir's names: two folders never meet, a work folder versus its own files;
  • released once, released again none, and an unknown id;
  • the archive let go of.
• Shell: the buttons' words and the delete confirm (node --test).
• e2e computers lane, ASIDE_OUT_CHECKS:
  • the folder aside_checks set aside comes back, and the agent reads work/restored-work-…/aside.txt there;
  • it's then told no more, its archive deleted, and a second press is 404;
  • another set aside is dropped: by a stranger 404, by its owner 200, again 404, and it's told no more.
• Commands run: cargo xtask check exit 0, and cargo xtask e2e --only computers: 284 passed, 0 failed, both on this head (A folder that will not fit is set aside, never a computer that will not start #1007's bc9e302d9 plus this commit).
• Wasm: 6,485,206 bytes, +19,427 against A folder that will not fit is set aside, never a computer that will not start #1007's 6,465,779. It fits the 6.6 MB budget of The cell's Wasm budget is 6.6 MB #1013.

🤖 Generated with Claude Code

[futurepaul]

Codex review @ cf90904: CHANGES

1. [P1] Do not replace an existing get-back destination — cell/src/computer.rs:1357–1361. back_dir deterministically chooses restored-work-<date>-<save>, but nothing checks or reserves that destination before passing it to DirectoryBackup.restore. The pinned SDK explicitly replaces an existing target directory. A person can already have files at that path; also, if an earlier restore swapped successfully but its response/DO was lost, the archive remains aside and retrying replaces any edits made in the recovered folder. Choose/reserve a fresh destination and publish without replacing an existing directory (or refuse a collision), keeping the archive on conflict. Cover a populated destination and retry after a completed swap with lost acknowledgement.

2. [P1] Keep the archive until the recovered files have a durable save — cell/src/computer.rs:1367–1373. After the SDK writes the folder onto the running container, the handler immediately removes its Aside record and deletes its archive, without taking or verifying a save containing that folder. All currently kept saves therefore still omit the recovered data. A container crash before the next save—potentially while the get-back request is still in forget/tell_owner—loses the restored files and the only archive that could recover them. Retain the source record/archive until a successful save of the same running generation includes the recovered destination; a failed save, crash or interrupted get-back must leave it recoverable. Add a deterministic crash/save-failure case around that boundary.

Reviewed only the diff above #1007. Both routes enforce person identity and ownership; explicit full/unusable/throwing restore failures return before releasing the archive. All 56 core computer tests and 3 shell aside tests passed; no Docker or e2e run. The current tests cover successful return/drop but not the two loss scenarios above.

[futurepaul]

Codex review @ acffb09: PASS

Reviewed this PR's own changes on #1007, including the fixes since cf90904: persisted destination reservations, the non-overwriting final move, marked retries after a lost acknowledgement, and archive retention until a successful save of the same life begun after recovery. Both previous blockers are addressed; the new optional stored fields remain backward-readable, owner routing is unchanged, and lose-back-ack is behind the existing test-fleet guard. Validation: 56 core computer tests, the aside UI test, and a local filesystem probe for destination collisions and preserved edits passed; Docker/e2e were not run.

[futurepaul]

Local proof on acffb099b: cargo xtask check exit 0; cargo xtask e2e --only computers (with #1013's 6.6 MB budget applied locally, this branch predating it) — 287 passed, 0 failed, 1 skipped (the hosted lane's): a person's folder at its name kept, a lost answer retried with edits kept, a crash before any save (saves failing) told again and back again, a save releasing it, drop. Wasm 6,501,103 bytes, +35,324 against #1007.