Bound Cloud refreshes and prevent local terminal fallback

Packages/Shared/CmuxIrxTransport/Sources/CmuxIrxTransport/IrxPeerEngine.swift

@@ -84,7 +84,7 @@ public actor IrxPeerEngine {
     /// clear or adopt anything.
     private var dialGeneration: UInt64 = 0
     private var redialTimer: Task<Void, Never>?
-    private var terminationWatcher: Task<Void, Never>?
+    private(set) var terminationWatcher: Task<Void, Never>?
     private var foregroundTask: Task<Void, Never>?
     private var activityGeneration: UInt64 = 0
     private var applicationActive: Bool

Packages/Shared/CmuxIrxTransport/Tests/CmuxIrxTransportTests/IrxLiveQUICTests.swift

@@ -685,21 +685,19 @@ struct IrxLiveQUICTests {
         #expect(await registry.activeSessionCount == 1)
 
         let retired = try #require(recovered)
-        let dialStartsBeforeRetirement =
-            journal.counterSnapshot()["dial-started"] ?? 0
-        #expect(
-            await engine.retire(
-                connection: retired.connection,
-                code: .explicitRedial
-            )
-        )
+        // Capture the watcher before retirement clears its slot, then join its completion.
+        let terminationWatcher = try #require(await engine.terminationWatcher)
+        let dialStartsBeforeRetirement = journal.counterSnapshot()["dial-started"] ?? 0
+        let autoRedialsBeforeRetirement = journal.counterSnapshot()["auto-redial"] ?? 0
+        #expect(await engine.retire(connection: retired.connection, code: .explicitRedial))
         await retired.connection.close(code: .explicitRedial, origin: .local)
-        _ = await retired.connection.termination()
+        await terminationWatcher.value
         #expect(await engine.currentSession() == nil)
         #expect(
             journal.counterSnapshot()["dial-started"] ?? 0
                 == dialStartsBeforeRetirement
         )
+        #expect(journal.counterSnapshot()["auto-redial"] ?? 0 == autoRedialsBeforeRetirement)
 
         await engine.stop()
         serverLoop.cancel()

Packages/macOS/CmuxTerminal/Sources/CmuxTerminal/Surface/TerminalSurface+Renderer.swift

@@ -18,13 +18,11 @@ extension TerminalSurface {
     public func setRenderHealthChangeHandler(_ handler: (@Sendable (TerminalSurfaceRenderHealth) -> Void)?) {
         onRenderHealthChanged = handler
     }
-
     /// Re-applies the active window background through the surface view.
     @MainActor
     public func applyWindowBackgroundIfActive() {
         surfaceView.applyWindowBackgroundIfActive()
     }
-
     /// Keep `desiredFocusState` in sync when the hosted view's responder chain
     /// calls `ghostty_surface_set_focus` directly (bypassing `setFocus`).
     /// Without this, `createSurface` would replay a stale state on recreation.
@@ -368,6 +366,10 @@ extension TerminalSurface {
         guard rendererPortalVisible,
               hasLiveSurface,
               (rendererPresentationPhase != .presented || renderHealth != .rendering) else { return }
+        // Later activity is a new opportunity after a failed probe.
+        if renderHealth == .notRendering {
+            rendererPresentationState.recoveryAttempted = false
+        }
         ensureRendererPresented(presentationReady: presentationReady)
     }
 

Packages/macOS/CmuxTerminal/Tests/CmuxTerminalTests/TerminalSurface+RendererTestCallbacks.swift

@@ -0,0 +1,41 @@
+import GhosttyKit
+import GhosttyRuntimeTestStubs
+import Testing
+@testable import CmuxTerminal
+
+extension TerminalSurface {
+    /// Synthetic runtimes still use the native token/callback handshake. The
+    /// fixture owns the surface until releaseSurfaceForTesting clears callbacks.
+    @MainActor
+    func installRendererTestCallbacks(_ runtime: UnsafeMutableRawPointer) {
+        let userdata = Unmanaged.passUnretained(self).toOpaque()
+        let presented = ghostty_surface_set_render_presented_callback(runtime, { userdata, token in
+            guard let userdata else { return }
+            MainActor.assumeIsolated {
+                Unmanaged<TerminalSurface>.fromOpaque(userdata).takeUnretainedValue().rendererFrameDidPresent(token: token)
+            }
+        }, userdata)
+        #expect(presented)
+        let failed = ghostty_surface_set_render_failed_callback(runtime, { userdata, token, status in
+            guard let userdata else { return }
+            MainActor.assumeIsolated {
+                Unmanaged<TerminalSurface>.fromOpaque(userdata).takeUnretainedValue().rendererFrameDidFail(
+                    token: token, status: status
+                )
+            }
+        }, userdata)
+        #expect(failed)
+    }
+
+    @MainActor
+    func acknowledgeRendererTestPresentation() {
+        guard rendererPresentationState.inFlightToken != nil, let surface else { return }
+        #expect(cmux_test_ghostty_renderer_present(surface))
+    }
+
+    @MainActor
+    func failRendererTestPresentation() {
+        guard let surface else { Issue.record("expected a runtime surface"); return }
+        #expect(cmux_test_ghostty_renderer_fail(surface, Int32(GHOSTTY_RENDER_PRESENTATION_BACKEND_FAILED.rawValue)))
+    }
+}

Packages/macOS/CmuxTerminal/Tests/CmuxTerminalTests/TerminalSurfaceRendererCallbackTests.swift

@@ -11,7 +11,7 @@ import Testing
 @MainActor
 @Suite(.serialized) struct TerminalSurfaceRendererCallbackTests {
     @Test func registeredPresentationCallbackAcknowledgesThePendingToken() {
-        let fixture = PresentedSurfaceFixture()
+        let fixture = PresentedSurfaceFixture(configureRendererCallbacks: false)
         defer { fixture.tearDown() }
         let surface = fixture.surface
 
@@ -23,7 +23,7 @@ import Testing
     }
 
     @Test func registeredFailureCallbackForwardsTokenAndTriggersOneRecoveryProbe() {
-        let fixture = PresentedSurfaceFixture()
+        let fixture = PresentedSurfaceFixture(configureRendererCallbacks: false)
         defer { fixture.tearDown() }
         let surface = fixture.surface
 
@@ -40,8 +40,44 @@ import Testing
         #expect(surface.renderHealth == .notRendering)
     }
 
+    @Test func laterRendererActivityRetriesAfterRecoveryProbeExhaustion() {
+        let fixture = PresentedSurfaceFixture(configureRendererCallbacks: false)
+        defer { fixture.tearDown() }
+        let surface = fixture.surface
+        let context = installCallbackContext(on: surface)
+        #expect(ghostty_surface_set_render_presented_callback(
+            fixture.runtimeSurface,
+            terminalRendererPresentedCallback,
+            context.toOpaque()
+        ))
+        #expect(ghostty_surface_set_render_failed_callback(
+            fixture.runtimeSurface,
+            terminalRendererFailedCallback,
+            context.toOpaque()
+        ))
+
+        surface.rendererRuntimeSurfaceDidCreate(presentationReady: true)
+        #expect(cmux_test_ghostty_renderer_fail(
+            fixture.runtimeSurface,
+            Int32(GHOSTTY_RENDER_PRESENTATION_BACKEND_FAILED.rawValue)
+        ))
+        #expect(cmux_test_ghostty_renderer_fail(
+            fixture.runtimeSurface,
+            Int32(GHOSTTY_RENDER_PRESENTATION_DISCARDED.rawValue)
+        ))
+        #expect(surface.renderHealth == .notRendering)
+
+        // A later activity edge must be allowed to arm a fresh probe. Before
+        // this regression fix, the one-shot recovery latch made this a no-op.
+        surface.retryRendererPresentationAfterActivity(presentationReady: true)
+        #expect(surface.renderHealth == .awaitingFrame)
+        #expect(cmux_test_ghostty_renderer_present(fixture.runtimeSurface))
+        #expect(surface.renderHealth == .rendering)
+        #expect(surface.isRendererPresented)
+    }
+
     @Test func shellExitHealthSurvivesRendererRebuildAndPresentation() {
-        let fixture = PresentedSurfaceFixture()
+        let fixture = PresentedSurfaceFixture(configureRendererCallbacks: false)
         defer { fixture.tearDown() }
         let surface = fixture.surface