fix: preserve Codex activity in Dock tabs

.github/swift-warning-budget.tsv

@@ -4,6 +4,7 @@
 1	CLI/cmux.swift	literal value is already handled by previous pattern; consider removing it
 2	CLI/cmux.swift	variable 'groups' was never mutated; consider changing to 'let' constant
 1	Sources/App/TerminalDirectoryOpenSupport.swift	'fullPath(forApplication:)' was deprecated in macOS 11.0: Use -[NSWorkspace URLForApplicationWithBundleIdentifier:] instead.
+2	Sources/AppDelegate+PaneMemoryGuardrail.swift	trailing closure in this context is confusable with the body of the statement; pass as a parenthesized argument to silence this warning
 1	Sources/AppDelegate.swift	'accessibilityAttributeValue' was deprecated in macOS 10.10: Use the NSAccessibility protocol methods instead (see NSAccessibilityProtocols.h)
 5	Sources/AppDelegate.swift	'activateIgnoringOtherApps' was deprecated in macOS 14.0: ignoringOtherApps is deprecated in macOS 14 and will have no effect.
 1	Sources/AppDelegate.swift	add '@preconcurrency' to suppress 'Sendable'-related warnings from module 'Dispatch'
@@ -73,8 +74,12 @@
 2	Sources/SessionIndexStore.swift	main actor-isolated static property 'searchMaxFiles' cannot be accessed from outside of the actor
 1	Sources/SessionIndexStore.swift	main actor-isolated static property 'tailByteCap' cannot be accessed from outside of the actor
 1	Sources/SessionIndexStore.swift	reference to captured var 'self' in concurrently-executing code
+1	Sources/SessionIndexTableController.swift	call to main actor-isolated instance method 'reconcilePresentation(in:)' in a synchronous nonisolated context
+1	Sources/SessionIndexTableController.swift	main actor-isolated property 'isApplyingRows' can not be referenced from a Sendable closure
 2	Sources/SessionIndexView.swift	'onChange(of:perform:)' was deprecated in macOS 14.0: Use `onChange` with a two or zero parameter action closure instead.
 1	Sources/Settings/ConfigSettingsView.swift	'onChange(of:perform:)' was deprecated in macOS 14.0: Use `onChange` with a two or zero parameter action closure instead.
+1	Sources/Surfaces/CmuxTuiSnapshotParser.swift	default will never be executed
+1	Sources/Surfaces/SurfaceCatalogModel.swift	immutable value 'rowID' was never used; consider replacing with '_' or removing it
 17	Sources/TabManager.swift	result of call to 'closePanel(_:force:)' is unused
 1	Sources/TerminalController.swift	'CGWindowListCreateImage' was deprecated in macOS 14.0: Please use ScreenCaptureKit instead.
 2	Sources/TerminalController.swift	'activateIgnoringOtherApps' was deprecated in macOS 14.0: ignoringOtherApps is deprecated in macOS 14 and will have no effect.

.github/test-determinism-allowlist.txt

@@ -7,3 +7,5 @@ Packages/iOS/CmuxMobileShellUI/Tests/CmuxMobileShellUITests/OnboardingMacDiscove
 cmuxTests/WorkspaceForkConversationContextMenuTests.swift	assert-on-duration	grandfathered
 cmuxTests/WorkspaceForkConversationContextMenuTests.swift	sleep-then-assert	grandfathered
 tests/test_ci_sparkle_build_monotonic.sh	live-network-host	release pretag guard intentionally probes the published appcast and soft-passes offline
+Packages/Shared/CMUXMobileCore/Tests/CMUXMobileCoreTests/CmxRetryAfterPolicyTests.swift	sleep-then-assert	virtual-clock injection makes these large delays non-blocking and deterministic
+Packages/iOS/CmuxMobileShell/Tests/CmuxMobileShellTests/MobileTerminalLaneCoordinatorTests.swift	sleep-then-assert	upstream coordinator readiness timing assertion

.github/workflows/agent-notification-tests.yml

@@ -42,4 +42,4 @@ jobs:
       # change: its seeded Stop predates the Codex turn ledger's foreground
       # admission, the mock never answers agent.resolve_delivery_target, and its
       # fixture timestamp has aged past the seven-day session prune.
-      unit_test_suites: AgentNotificationRegressionTests,AgentJournalLifecycleCenterTests,FeedWaiterRegistryTests,ClaudeBackgroundWorkNotifyTests
+      unit_test_suites: AgentNotificationRegressionTests,AgentJournalLifecycleCenterTests,FeedWaiterRegistryTests,ClaudeBackgroundWorkNotifyTests,OpenCodeHookRegressionTests

.github/workflows/cloud-vm-image-contract.yml

@@ -10,6 +10,11 @@ on:
       - web/scripts/derive-devbox-sizes.ts
       - web/scripts/promote-devbox-image.ts
       - web/scripts/validate-devbox-ladder.ts
+      - web/scripts/build-devbox-freestyle.ts
+      - web/scripts/verify-devbox-image.ts
+      - web/scripts/devbox-agent-launch.*
+      - web/tests/devbox-agent-launch-test.py
+      - web/scripts/check-devbox-agent-pins.ts
       - web/services/vms/images/manifest.json
       - web/services/vms/images/sizes.ts
       - web/services/vms/images/devbox/**
@@ -24,6 +29,11 @@ on:
       - web/scripts/derive-devbox-sizes.ts
       - web/scripts/promote-devbox-image.ts
       - web/scripts/validate-devbox-ladder.ts
+      - web/scripts/build-devbox-freestyle.ts
+      - web/scripts/verify-devbox-image.ts
+      - web/scripts/devbox-agent-launch.*
+      - web/tests/devbox-agent-launch-test.py
+      - web/scripts/check-devbox-agent-pins.ts
       - web/services/vms/images/manifest.json
       - web/services/vms/images/sizes.ts
       - web/services/vms/images/devbox/**

.github/workflows/cloud-vm-migrate.yml

@@ -11,6 +11,11 @@ on:
         options:
           - staging
           - production
+      cleanup_iroh_challenges:
+        description: Prune expired, consumed, and duplicate Iroh registration challenges after migration
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -44,6 +49,12 @@ jobs:
       - name: Cloud VM migration preflight
         run: bun run cloud-vm:preflight -- --schema-only .
 
+      - name: Rehearse Iroh cleanup on isolated Postgres
+        if: ${{ inputs.cleanup_iroh_challenges }}
+        # db:test discovers every CMUX_DB_TEST suite, including
+        # iroh-challenge-cleanup-db.test.ts (audit, apply, and rerun).
+        run: bun run cloud-vm:preflight -- .
+
   migrate-staging:
     if: ${{ inputs.target == 'staging' || inputs.target == 'production' }}
     runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
@@ -101,6 +112,10 @@ jobs:
       - name: Apply staging migration
         run: bun run cloud-vm:migrate -- staging
 
+      - name: Clean up staging Iroh challenges
+        if: ${{ inputs.cleanup_iroh_challenges }}
+        run: bun run cloud-vm:cleanup-iroh -- staging --apply
+
   migrate-production:
     if: ${{ inputs.target == 'production' }}
     runs-on: ${{ vars.LINUX_RUNNER || 'blacksmith-4vcpu-ubuntu-2404' }}
@@ -157,3 +172,7 @@ jobs:
 
       - name: Apply production migration
         run: bun run cloud-vm:migrate -- production
+
+      - name: Clean up production Iroh challenges
+        if: ${{ inputs.cleanup_iroh_challenges }}
+        run: bun run cloud-vm:cleanup-iroh -- production --apply

.github/workflows/ios-screenshots.yml

@@ -53,9 +53,18 @@ on:
         required: false
         default: false
         type: boolean
+# Capture-only needs nothing beyond reading the repository: checkout runs with
+# persist-credentials disabled, and artifact uploads use the runner's artifact
+# token rather than GITHUB_TOKEN. Nothing here dispatches, cancels or deletes
+# runs, so `actions: write` was never exercised, and declaring it broke every
+# caller that grants less: GitHub validates a reusable workflow's permissions
+# against the calling job at parse time, and release.yml failed at startup
+# with "is requesting 'actions: write', but is only allowed 'actions: none'"
+# (https://github.com/manaflow-ai/cmux/issues/12149). Keep this block at the
+# minimum the steps use; tests/test_ci_reusable_workflow_permissions.py checks
+# every local caller against it.
 permissions:
   contents: read
-  actions: write
 
 jobs:
   screenshots: