#34487 Warm Cloud machine on composer select

Platform #811 (fixing #783) is merged and deployed as 00920efc458418dddd544929cd1cb22a37475fb8. Its signed Worker integration test sends POST /v1/machines/reservations with a valid Stack session and receives 200, while unauthenticated requests receive 401; the reservation route is therefore released from the HOLD.
Latest signed-in proof attempt: Cloud chat proof workflow 41820867139 artifact cloud-chat-proof-evidence (sha256:7b89621d20f926295fa5c4743c577483f4a75e34b3a2d381ad19ca523d230ac6) signed in and created a VM token, but Cloud start-chat remained in machine startup and produced no reply. It does not satisfy the Cloud chat stop condition.

Finding outcome: Fixed at the current head: native pane code consumes a native gesture before authorizing cloud.reserve, enforces one live reservation per pane keyed by compose key, and validates cloud.startChat ownership before bind; Rust now binds the reservation before selecting a new machine and accepts the platform’s lowercase alphanumeric Cloud machine IDs. Ticket lifetime, connection binding, reload identity, and release-on-bypass remain follow-ups.

Cloud proof completed with the supported protected same-harness capture after the reservation API deployment. The merge base and this exact head both reached Cloud machine startup but failed identically before a session connected, so no first-reply timing or reply text can be claimed yet:

• Merge base 4a7517355a0869d0645e33f920662e6e0452bc0b: fleet build a1ee2478b51d8aa07670eb1f, HQ capture run 41814037106.
• Exact head 347776d9c648e0e1e0998785c145830363eb63bd: fleet build 778d39b7dc9d306754bbabe5, HQ capture run 41814098146.
• Both runs signed in, selected Cloud, sent Reply with exactly one word: PONG, reached the machine step, then showed cloud-chats didn't connect. Retry once it's online. for about four minutes; sessionId stayed null and no assistant reply arrived during the 300-second wait.
• The identical base/head failure is a shared Cloud machine-link or image-path blocker, not a regression from this PR. The capture artifacts are retained on the coordinator for rerun after that service is repaired.

Design context: manaflow-ai/cmuxterm-hq#6703, ranked pick 7. Leo:

"the user acquisition has to come, and it has to come FAST aka we need it to work well feel good all that which is gonna entail far more work on the parts people actually see and feel vs the bean counting"

Before, the first Cloud Send starts machine provisioning after the user has finished composing. After, choosing Cloud or typing the first character with Cloud selected starts a speculative machine; Send binds that compose's lease before attaching. Leaving Cloud, clearing the prompt, or closing the page releases unused work, with a 120-second platform expiry as the backstop. Default-image reservations preserve the ordinary path for explicit environments and snapshots.

The shared web controller owns one reserve per compose and cleanup. Rust owns reserve/release/bind, selected-team forwarding, UUID normalization, and retry-safe destination pinning. The Swift changes forward the requests and credentials. The current folder-grant wait is preserved when Send follows a Cloud pick immediately. An uncertain bind fails for a retry with the same Send key rather than creating another machine.

Paired platform change: https://github.com/manaflow-ai/cmux-platform/pull/755 (merged as e6d96b09ad695e06429403ad336e266132573934, deployed by run 41794886963). Classic Cloud, idle-pause policy, acpmux pause-readiness, and the paused-machine UI are outside this diff.

Validation at 347776d9c648e0e1e0998785c145830363eb63bd:

• Remote cmux-ci test run 41807270450: cloudComposeReservation.test.ts and cloudRun.test.ts passed (30 tests, 0 failures).
• The exact-head fleet DEV build completed as job ea20c603222ec5bfaf6d2074, artifact sha256:82c5923bdbb08d372fc79398c1d15e437e145d3567748c1d56c1bc71a7cb1440. It used the documented local-backend fallback, so it is compile evidence only; the protected Cloud captures above are the runtime evidence.
• The independent exact-head review is SHIP; the review found no new blocker. The uncertain-bind persistence observation is a follow-up only.
• The static cmux-next prepush gate and git diff --check pass.

Performance

Metric	Before (base)	After (head)	Delta	Harness or evidence
First Cloud reply, cold vs reserved	No reply: machine link failed	No reply: machine link failed	Not measurable	Same protected harness; base run 41814037106, head run 41814098146

The harness starts timing after provisioning/readiness, so the shared machine-link failure prevents a first-reply comparison. No simulated number is claimed. Once the Cloud machine link is repaired, rerun the same two captures to obtain the cold-versus-reserved first-reply timings and PONG reply text.

The only new page timer is the empty-prompt release grace period; retyping, Send, reset, and abandonment cancel it. Page close/unmount releases unused attempts. There is no polling or refresh loop; platform expiry owns the 120-second backstop.

🤖 Generated with Codex

Agent session: agent session