iOS: quiet reconnecting UX — title-bar spinner, interactive terminal, no connection-driven pops

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift

@@ -1543,6 +1543,57 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         )
     }
 
+    /// Whether `row` is served by the foreground RPC connection — the same
+    /// device/build matching as ``selectedWorkspaceUsesForegroundConnection``,
+    /// but for an explicit last-known row, used when the row has already
+    /// vanished from ``workspaces`` and the selection-based lookup can no
+    /// longer see it.
+    private func workspaceRowIsForegroundServed(_ row: MobileWorkspacePreview) -> Bool {
+        guard let macID = row.macDeviceID, !macID.isEmpty,
+              macID != Self.foregroundAnonymousKey else {
+            return true
+        }
+        guard let ownerDeviceID = foregroundMacDeviceID ?? recoveryTargetMacDeviceID else {
+            return false
+        }
+        guard cmxCanonicalDeviceID(macID) == cmxCanonicalDeviceID(ownerDeviceID) else {
+            return false
+        }
+        let ownerTag = foregroundMacDeviceID != nil
+            ? activeMacInstanceTag
+            : recoveryTargetInstanceTag
+        return macInstanceTagAuthority.sameStoredAuthority(row.macInstanceTag, ownerTag)
+    }
+
+    /// Whether a workspace's absence from the freshly derived list is
+    /// authoritative (deleted, closed, or unpaired — selection may retarget
+    /// and the mounted detail may pop) rather than a transient hole from a
+    /// degraded connection (the selection holds so the user is never pushed
+    /// out of the detail for connection reasons). See
+    /// ``WorkspaceAbsenceAuthority``.
+    func workspaceAbsenceIsAuthoritative(
+        lastKnownRow row: MobileWorkspacePreview?
+    ) -> Bool {
+        let foregroundIsHealthy = macConnectionStatus == .connected
+            && !isRecoveringConnection
+            && !connectionRecoveryFailed
+        let ownerStatus: MobileMacConnectionStatus? = row.flatMap { row in
+            guard let macID = row.macDeviceID, !macID.isEmpty,
+                  macID != Self.foregroundAnonymousKey else {
+                return workspacesByMac[.anonymousForeground]?.status
+            }
+            return workspacesByMac[
+                MacPairingKey(macDeviceID: macID, instanceTag: row.macInstanceTag)
+            ]?.status
+        }
+        return WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: row != nil,
+            rowIsForegroundServed: row.map(workspaceRowIsForegroundServed) ?? false,
+            foregroundIsHealthy: foregroundIsHealthy,
+            ownerStatus: ownerStatus
+        )
+    }
+
     /// Resolve a UI row id back to the Mac-local workspace id expected by RPC.
     ///
     /// Multi-Mac aggregation scopes row ids by Mac to avoid collisions, while
@@ -7502,7 +7553,15 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
                         )
                 }
             }
-            self.selectedWorkspaceID = remapped?.id ?? derived.first?.id
+            if let remapped {
+                self.selectedWorkspaceID = remapped.id
+            } else if workspaceAbsenceIsAuthoritative(lastKnownRow: previousSelection) {
+                self.selectedWorkspaceID = derived.first?.id
+            }
+            // Otherwise keep the selection: a degraded connection made the
+            // row vanish, and the mounted detail keeps rendering its
+            // last-known snapshot until the reconnect restores the row or a
+            // healthy list confirms the deletion (which retargets above).
         }
         if selectedWorkspaceID != nil { syncSelectedTerminalForWorkspace() }
         let derivedGroups = workspaceAggregation.derivedGroups(
@@ -8055,7 +8114,14 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
                 startedAt: diagnosticStartedAt,
                 failure: .superseded
             )
-            if selectedWorkspaceID == id {
+            // Clear the selection (popping the mounted detail) only when the
+            // absence is authoritative. A detail remount can re-enter here
+            // during a reconnect window whose list transiently lacks the row;
+            // popping then would eject the user for a connection reason, so
+            // hold the selection and let the reconnect restore the row or a
+            // healthy list confirm the deletion.
+            if selectedWorkspaceID == id,
+               workspaceAbsenceIsAuthoritative(lastKnownRow: workspace) {
                 setSelectedWorkspaceID(nil)
             }
             return
@@ -8903,7 +8969,10 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         #if DEBUG
         mobileShellLog.debug("enqueue raw terminal input byteCount=\(text.utf8.count, privacy: .public)")
         #endif
-        guard let workspaceID = selectedWorkspace?.id,
+        // The explicit selection id, not `selectedWorkspace`: its first-row
+        // fallback would pair a foreign workspace id with the held terminal
+        // id when the selected row is transiently absent mid-reconnect.
+        guard let workspaceID = selectedWorkspaceID ?? workspaces.first?.id,
               let terminalID = selectedTerminalID else {
             #if DEBUG
             mobileShellLog.info("skip raw terminal input enqueue selectedWorkspace=\(self.selectedWorkspace == nil ? 0 : 1, privacy: .public) selectedTerminal=\(self.selectedTerminalID == nil ? 0 : 1, privacy: .public)")
@@ -11097,6 +11166,14 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
     }
 
     func syncSelectedTerminalForWorkspace() {
+        // A selection held across a degraded-connection window has no live
+        // row, and ``selectedWorkspace`` would fall back to an arbitrary
+        // first row: re-deriving from that would clobber the held terminal
+        // selection (and swap its composer draft). Keep both selections for
+        // the row's return instead.
+        if selectedWorkspaceID != nil, explicitlySelectedWorkspace == nil {
+            return
+        }
         guard let selectedWorkspace else {
             selectedTerminalID = nil
             return
@@ -11404,7 +11481,10 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
     }
 
     private func sendRemoteTerminalInput(_ text: String) async {
-        guard let workspaceID = selectedWorkspace?.id,
+        // Explicit selection id first, mirroring `sendTerminalRawInput`: the
+        // `selectedWorkspace` first-row fallback would mispair ids when the
+        // selected row is transiently absent mid-reconnect.
+        guard let workspaceID = selectedWorkspaceID ?? workspaces.first?.id,
               let terminalID = selectedTerminalID else {
             #if DEBUG
             mobileShellLog.info("skip remote terminal input selectedWorkspace=\(self.selectedWorkspace == nil ? 0 : 1, privacy: .public) selectedTerminal=\(self.selectedTerminalID == nil ? 0 : 1, privacy: .public)")

Packages/iOS/CmuxMobileShell/Sources/CmuxMobileShell/WorkspaceAbsenceAuthority.swift

@@ -0,0 +1,41 @@
+import CmuxMobileShellModel
+
+/// Decides whether a workspace's absence from a freshly derived list is
+/// authoritative — the workspace genuinely ceased to exist (deleted, closed,
+/// or its Mac was unpaired/hidden) — or a transient hole opened by a degraded
+/// connection (drop, redial, secondary-snapshot purge on foreground death).
+///
+/// Selection and navigation may retarget or pop the mounted detail only on an
+/// authoritative absence. A transient absence keeps the selection so the
+/// detail's last-known snapshot stays mounted until the connection resolves;
+/// the next healthy list then either restores the row or confirms the
+/// deletion, which retargets normally.
+enum WorkspaceAbsenceAuthority {
+    /// - Parameters:
+    ///   - hasLastKnownRow: Whether the caller still holds the vanished
+    ///     workspace's last-known row. Without one the owner cannot be
+    ///     attributed, so only the foreground's health can gate the decision.
+    ///   - rowIsForegroundServed: Whether that row is served by the
+    ///     foreground RPC connection (device and build tag match the live or
+    ///     recovering pairing).
+    ///   - foregroundIsHealthy: Live foreground authority — connected with no
+    ///     recovery in flight and no failed recovery.
+    ///   - ownerStatus: The owning Mac's per-entry status, or `nil` when its
+    ///     entry is gone entirely. A missing entry is an authoritative
+    ///     removal (unpair/hide) when the foreground is healthy, and the
+    ///     foreground-death purge of secondary snapshots otherwise.
+    static func absenceIsAuthoritative(
+        hasLastKnownRow: Bool,
+        rowIsForegroundServed: Bool,
+        foregroundIsHealthy: Bool,
+        ownerStatus: MobileMacConnectionStatus?
+    ) -> Bool {
+        guard hasLastKnownRow, !rowIsForegroundServed else {
+            return foregroundIsHealthy
+        }
+        guard let ownerStatus else {
+            return foregroundIsHealthy
+        }
+        return ownerStatus == .connected
+    }
+}

Packages/iOS/CmuxMobileShell/Tests/CmuxMobileShellTests/WorkspaceAbsenceAuthorityTests.swift

@@ -0,0 +1,77 @@
+import CmuxMobileShellModel
+import Testing
+@testable import CmuxMobileShell
+
+@Suite struct WorkspaceAbsenceAuthorityTests {
+    @Test func foregroundRowAbsenceIsAuthoritativeOnlyWhileHealthy() {
+        // Deleted while the foreground connection is live: retarget/pop.
+        #expect(WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: true,
+            foregroundIsHealthy: true,
+            ownerStatus: .connected
+        ))
+        // Vanished mid-recovery: a transient hole, hold the selection.
+        #expect(!WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: true,
+            foregroundIsHealthy: false,
+            ownerStatus: .connected
+        ))
+    }
+
+    @Test func secondaryRowAbsenceFollowsItsOwnEntryStatus() {
+        // A secondary Mac's live list omitted the workspace: deletion.
+        #expect(WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: false,
+            ownerStatus: .connected
+        ))
+        // The secondary went offline or is redialing: hold the selection.
+        #expect(!WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: true,
+            ownerStatus: .unavailable
+        ))
+        #expect(!WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: true,
+            ownerStatus: .reconnecting
+        ))
+    }
+
+    @Test func missingOwnerEntryIsAuthoritativeOnlyWhileForegroundIsHealthy() {
+        // Unpair/hide removes the entry while the shell is healthy: pop.
+        #expect(WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: true,
+            ownerStatus: nil
+        ))
+        // Foreground death purges secondary snapshots: hold the selection.
+        #expect(!WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: true,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: false,
+            ownerStatus: nil
+        ))
+    }
+
+    @Test func unknownRowFallsBackToForegroundHealth() {
+        #expect(WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: false,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: true,
+            ownerStatus: nil
+        ))
+        #expect(!WorkspaceAbsenceAuthority.absenceIsAuthoritative(
+            hasLastKnownRow: false,
+            rowIsForegroundServed: false,
+            foregroundIsHealthy: false,
+            ownerStatus: nil
+        ))
+    }
+}

Packages/iOS/CmuxMobileShellModel/Sources/CmuxMobileShellModel/MobileWorkspaceAggregation.swift

@@ -282,7 +282,9 @@ public struct MobileWorkspaceAggregation: Sendable {
                     // Empty headers have no workspace row to namespace; use
                     // the already-namespaced group id only as a stable UI row
                     // identity, never as a workspace capability.
-                    stamped.anchorWorkspaceID = stamped.id
+                    stamped.anchorWorkspaceID = MobileWorkspacePreview.ID(
+                        rawValue: stamped.id.rawValue
+                    )
                 }
                 result.append(stamped)
             }

Packages/iOS/CmuxMobileShellUI/Sources/CmuxMobileShellUI/MobileMacConnectionStatusPill.swift

@@ -3,19 +3,18 @@ import CmuxMobileSupport
 import SwiftUI
 
 /// A compact connection-status pill overlaid on the terminal view, shown only
-/// for problem states (reconnecting / offline). A healthy connection shows no
-/// chrome.
+/// when the connection is down and reconnect attempts have stopped. A healthy
+/// connection shows no chrome, and reconnecting surfaces as the quieter
+/// title-bar spinner (`WorkspaceToolbarTitleView`) instead of a pill.
 struct MobileMacConnectionStatusPill: View {
     let host: String
     let status: MobileMacConnectionStatus
     var reconnect: (() -> Void)?
 
     @ViewBuilder
     var body: some View {
-        // Only surface the pill for problem states (reconnecting / offline).
-        // A healthy connection shows no chrome.
-        if status != .connected {
-            if let reconnect, status == .unavailable {
+        if status == .unavailable {
+            if let reconnect {
                 Button(action: reconnect) {
                     pill
                 }
@@ -37,17 +36,9 @@ struct MobileMacConnectionStatusPill: View {
 
     private var pill: some View {
         HStack(spacing: 7) {
-            if status == .reconnecting {
-                ProgressView()
-                    .controlSize(.mini)
-                    .tint(.white)
-                    .frame(width: 10, height: 10)
-                    .accessibilityHidden(true)
-            } else {
-                Circle()
-                    .fill(status.tintColor)
-                    .frame(width: 8, height: 8)
-            }
+            Circle()
+                .fill(status.tintColor)
+                .frame(width: 8, height: 8)
 
             Text(status.label)
                 .font(.caption.weight(.semibold))

Packages/iOS/CmuxMobileShellUI/Sources/CmuxMobileShellUI/WorkspaceDetailView+Surfaces.swift

@@ -75,8 +75,9 @@ extension WorkspaceDetailView {
                     // dark theme (and vice versa).
                     .environment(\.colorScheme, store.activeTerminalTheme.terminalColorScheme)
                     // Same recovery chrome as the terminal: the last synced
-                    // surface stays visible underneath while the pill shows
-                    // reconnect progress (it renders nothing when connected).
+                    // surface stays visible underneath, the title bar spinner
+                    // covers reconnecting, and the pill appears only once
+                    // reconnect attempts stop (unavailable).
                     .overlay(alignment: .topLeading) {
                         MobileMacConnectionStatusPill(
                             host: host,