fix(cmux-next): track live questions and fence stale recovery

Draft
TE
1d ago
+853-7

Question-card Other keyboard answers require proof that the exact question is still pending. Historical permission keys and nonces cannot establish current membership. This prerequisite adds a connection-scoped native ledger, with no renderer binding or gesture ticket.

An acknowledged _acpmux/watch supplies unfiltered settlement coverage. Attach snapshots and permission_pending notifications cannot open keyboard membership before that native-correlated ACK: eventStream/kinds can hide lifecycle events while still delivering pending. Watch-off immediately revokes coverage and all entries. Attach replacement cannot create coverage. The shipped SessionPager awaits _acpmux/watch {enabled:true} replies.

Only live daemon pending notifications and complete pending snapshots can open entries under that watch coverage. Normal watch summaries contain pendingPermissions rather than request identities: zero may retire, a positive count cannot reopen. Watcher settlements retire current entries and invalidate earlier reads; a genuinely newer pending notification can open the next question on the same continuously watched connection.

Lag and peer stale/purge retire entries and require a fresh native-correlated complete read. Peer lifecycle invalidation is handled before event sequence checks because the daemon emits those notices at seq zero. Stale summaries/snapshots and delayed pre-gap replies cannot restore membership. Highest observed event sequence survives recovery; history never opens a question.

Each Question retains its exact canonical native request, nonce, daemon instance, and generation. Later integration must redeem the private renderer snapshot and recheck the exact Question after the await and at ticket consumption. This ledger does not repair Other Enter by itself.

Stacked base: pure read-epoch prerequisite #26851, branch lane/nx-question-read-epochs-1028, exact ab9124d2e998b8443489850394334b21d17983aa.
That prerequisite stacks on pure validator #26837, exact 0812231ec3dae1b370726bbd530fb4a5b0f73b8a (original feat base 8424d05bf9324f6f60a8f0c7c40b01f8a3e085b9).

Lawrence, via Leo:

leo i think this ui can be better / also needs to be keyboard navigable (i didnt check yet) / leo this needs to work with keyboard shortcuts like up arrow ctrl n/p etc / clicking enter doesnt work

Head: 01b2c36233d1c3b6684052745712e3ed10a6356e.
Complete ledger-only diff over the stacked base: 853 added / 7 removed lines in eight files (860 changed lines). All 439 lines of lifecycle source tests remain; the coordinator accepted this coherent about-800-line boundary.

Validation:

  • git diff --check and python3 scripts/cmux-next/prepush-gate.py pass at this exact head.
  • Same-watermark recovery regression source was committed first as f57505a3e9b: watch-off/detach recover only current identities from a fresh read, while delayed pre-gap responses, uninterrupted absence, and settled retirement floors still refuse.
  • Source-first lifecycle/repair regressions cover actual watch summary/settlement shapes, relay-token replay/cancel/lag races, filtered attachments, watch ACK and watch-off races, A→settlement→B continuity without a watch toggle, seq-zero peer purge/stale, stale snapshots, and fresh recovery.
  • Native compilation and tests are UNVERIFIED under Swift HOLD26809. No executed red/green result is claimed.
  • Intended fleet command after release: swift test --package-path Packages/macOS/CmuxNext --filter AcpmuxPendingQuestionsTests.

The question_other_answer lane owns final verification with the root coordinator. This remains draft pending prerequisites, fresh exact-head security review, and required native verification. No merge is requested.

Changelog

none

Agent session: agent session