cmux NEXT: resolve rapid bottom placements from current rows
HOLD: defaults-guard receipt reconciliation remains outstanding. The shared Swift and sidebar dogfood holds are lifted.
Rapid bottom placements can persist in the wrong order when rendered sidebar rows lag the store. Pending placements retain registration order and refresh the normal rows projection once per window. Personal placement plans share one queue across windows: optimistic rows update immediately; each plan uses the store after the preceding placement and any empty-group deletion have applied on the same connection. Failed writes stop dependent queued placements and release command-scope tickets. A placement skipped because its window or workspace is gone settles its pending edit and allows subsequent placements to continue.
Addresses the stale-rendered-row reproduction in #26152. The broader ordering race remains under separate investigation; this PR does not claim to resolve it. The reported example is: “The stale rendered list resolves index 1, producing [k1,k3,k2]; expected [k1,k2,k3].” The empty-rendered-list guard is preserved. Tab drops capture both neighboring row/item identities before their asynchronous create, so a refresh cannot reinterpret a saved numeric gap.
Risk: this changes cross-window personal placement sequencing and group cleanup timing. Captured source group IDs are rechecked after the move; pinned groups and groups with another live member remain. No new timer or observer is introduced. Each queued operation releases its scope ticket on success or failure, and the final completed operation clears the queue tail.
Validation
Current head: 051c630fd560b2961c19fcd893485b68a10c49f2. The last merged base is 8e36e526f9c592b30333ff8d0d1dd506fb6f45e8 (merge commit 9166d799d735b59fda5245dbb6bf899440467a14).
- Exact-head independent correctness review: SHIP after reviewing the skipped-placement repair and full diff. Earlier reviews at
18ae60bcare historical evidence only. - Focused managed native step
2ac597eefc4c1b25f0235566compiled and passed all five suites:PlacementStaleRowsTests,PlacementWriteOrderTests,WorkspaceGapTests,ModelMatrixPersonalOrderTests, andNewWorkspaceInGroupTests, including skipped versus failed queue outcomes. Script exit code was 0; the controller job remains failed because the requested output artifact path did not exist. Test-summary SHA-256:dbf5a61bdc42858477ab71e1b42726113a9882d70c683cec5b92c2ed02a6f34f. This is passing behavioral evidence, not a green controller-job claim. - The pre-fix assertion run
8d3046df5118aca153aba2efat test-onlycf168eaf2dba5c5682e11a89c1cac6d12d8654cccompiled, then failed persisted-order/write-order assertions. It remains the reproduction; its GUI-gated no-result is excluded. - Exact-head app build
811fd5597cf9626d40bb1fd1completed; artifact SHA-256d2a25029d16dc8dfb7bba3416503b6ec5777c71de9b41882bac9530d7c16be6c. A successful build alone is not a structural dogfood interaction result. - Hosted defaults guard remains red after one supported failed-job rerun: run
40785685307, attempt 3, job123715584296. It still reports a missing exact-head review. The existing member SHIP above is accepted by bothreceipt_verdictand completeapprovalreplayed from the trusted base guard against the live review payload. Gate-owner reconciliation is outstanding; no exemption or green hosted result is claimed.
Screenshots
After at the exact head: real native AppKit gallery fixtures exercise production placement with a scripted daemon and stale rendered rows. Managed native suite 2c3bc831ab5d49d3e1a02a0d compiled and passed its one gallery test with no skips. All four captured states paint first/second/third, and the recorded daemon write uses index 2. The PNGs are unedited 300 × 320 transparent fixture captures; light ink has low contrast in viewers that render transparency as black. These are native sidebar fixture screenshots, not whole-app dogfood captures. Tesseract OCR through the shared privacy checker, with the private terms list, passed all four files; its canary was correctly refused.
| Mode / theme | Before (test-only baseline cf168eaf) | After (exact head 051c630f) |
|---|---|---|
| plain / dark |  |  |
| plain / light |  |  |
| mixed / dark |  |  |
| mixed / light |  |  |
Before is the existing native fixture run 64698b493dbe2916a500c4d1 at test-only cf168eaf2dba5c5682e11a89c1cac6d12d8654cc, showing first/third/second with write index 1. Those four published images were re-read with the same privacy/OCR check. Current after artifact SHA-256: d0a6fc1ff7feb82afb18cb72b355a117ecbeeb52da2f0b435d838c49961c9c94. Historical 18ae60bc after images are superseded by the exact-head captures above.
Performance
The following Classic rows are observed assertion issue counts, not failing-pass counts or causal performance improvements. Both jobs ran scripts/ci/package-test-lane.sh suite Packages/macOS/CmuxNext Classic for ten consecutive iterations (24 suites / 107 tests, default Swift Testing parallelism, class light, CPU 6). There was no deliberate load generator; concurrent work is unknown. Base c8f95c77c316d7112c56c59712e36074edd7c7b8 used a cold worker and locally built daemon tree 68640f91; head 051c630 used a different warm worker and published daemon tree 181771c0. Both jobs failed. These observations are not a controlled A/B experiment and do not establish that this PR fixes terminal parking or the remaining ordering race. A paired run with matched worker, filters and concurrency is pending separately.
| Metric | Before | After | Delta | Harness or run link |
|---|---|---|---|---|
| backgroundWorkspacesStartTheirTerminalsWhenFirstShown :266, “not parked” issues | 13 | 1 | -12 issues | Classic ×10; base 73b29c197a211e4357bba2f4 / head c2f69b2d0bc5e369cb9e202b |
| backgroundWorkspacesStartTheirTerminalsWhenFirstShown :281 issues | 10 | 0 | -10 issues | same Classic jobs |
| Above two assertions combined | 23 | 1 | -22 issues | same Classic jobs; uncontrolled observation |
| huge :70, ordering issues | 127 | 120 | -7 issues | same Classic jobs; ordering remains |
| FirstLaunch :56 issues | 35 | 30 | -5 issues | same Classic jobs; ordering remains |
| FirstLaunch :49 issues | 31 | 19 | -12 issues | same Classic jobs; ordering remains |
| onlyPreviousCopy :133 issues | 2 | 0 | -2 issues | same Classic jobs; too few observations for a conclusion |
Separate timing receipts used scripts/measure/instant-new-surfaces.sh --runs=12, class exclusive: base e275db3f6916daa1bf86e1e2b45d8927b9194f11, job 6d54e43cc5e8a83312a72af9, and exact head 051c630, job 29709636a3a301b0e19c25cf, both completed with exit 0. They ran on different hardware (14 versus 10 logical CPUs), and source/daemon trees differ. These are adjacent interaction timings from the same harness, not a controlled placement-latency comparison; positive and negative deltas must not be attributed to this fix. Head timing artifact SHA-256: 293eb1f3637186f4e3168bc1fdaabfa1001c5b268709d40f828213b65d477143.
| Metric (p50 milliseconds) | Before (e275) | After (051c) | Delta | Harness or run link |
|---|---|---|---|---|
| idle/split_right / visible_p50 | 21.860 | 24.707 | +2.847 | instant-new-surfaces, 12 runs |
| idle/split_right / confirmed_p50 | 64.612 | 68.108 | +3.496 | instant-new-surfaces, 12 runs |
| idle/split_down / visible_p50 | 23.525 | 26.860 | +3.335 | instant-new-surfaces, 12 runs |
| idle/split_down / confirmed_p50 | 48.427 | 65.300 | +16.873 | instant-new-surfaces, 12 runs |
| idle/new_tab / visible_p50 | 13.175 | 15.045 | +1.870 | instant-new-surfaces, 12 runs |
| idle/new_tab / confirmed_p50 | 43.914 | 40.418 | -3.496 | instant-new-surfaces, 12 runs |
| idle/new_terminal / visible_p50 | 22.517 | 25.656 | +3.139 | instant-new-surfaces, 12 runs |
| idle/new_terminal / confirmed_p50 | 60.124 | 66.995 | +6.871 | instant-new-surfaces, 12 runs |
| idle/new_workspace / visible_p50 | 65.090 | 55.450 | -9.641 | instant-new-surfaces, 12 runs |
| idle/new_workspace / confirmed_p50 | 141.014 | 126.930 | -14.084 | instant-new-surfaces, 12 runs |
| load/split_right / visible_p50 | 25.942 | 34.888 | +8.946 | instant-new-surfaces, 12 runs |
| load/split_right / confirmed_p50 | 160.891 | 146.407 | -14.484 | instant-new-surfaces, 12 runs |
| load/split_down / visible_p50 | 33.417 | 28.434 | -4.983 | instant-new-surfaces, 12 runs |
| load/split_down / confirmed_p50 | 158.339 | 147.251 | -11.087 | instant-new-surfaces, 12 runs |
| load/new_tab / visible_p50 | 35.600 | 38.381 | +2.781 | instant-new-surfaces, 12 runs |
| load/new_tab / confirmed_p50 | 115.871 | 145.138 | +29.267 | instant-new-surfaces, 12 runs |
| load/new_terminal / visible_p50 | 29.457 | 33.770 | +4.313 | instant-new-surfaces, 12 runs |
| load/new_terminal / confirmed_p50 | 149.054 | 160.544 | +11.490 | instant-new-surfaces, 12 runs |
| load/new_workspace / visible_p50 | 110.987 | 118.168 | +7.181 | instant-new-surfaces, 12 runs |
| load/new_workspace / confirmed_p50 | 390.492 | 436.515 | +46.023 | instant-new-surfaces, 12 runs |
Duplicate #26947 is closed as superseded by this canonical PR.
Agent session: agent session