fix: recover interrupted Cloud vm run creates

[teamleaderleo]

Closes #15644

cmux vm run used a fresh idempotency key for every pool-machine create and only recorded pool membership after the create response. If the process was interrupted, timed out, or lost its socket after the backend accepted the request, the machine finished provisioning but became invisible to the local pool. The next run then sent a new key and could create another paid machine.

This persists one pool-create idempotency key under ~/.cmuxterm, protected by an advisory lock. Concurrent routers converge on the same key; transport failures and vm_create_in_progress preserve it for recovery, while definite backend failures clear it. The key is cleared only after the created machine is recorded in the pool, so a local persistence failure can still be retried against the same backend create.

Validation:

• swiftc -parse on the changed CLI and regression test
• scripts/sync-test-wiring --check
• scripts/lint-pbxproj-test-wiring.sh
• git diff --check
• Regression covers retry key reuse after an unknown outcome and fresh-key allocation after completion.

Native app/CLI execution was not run on the MacBook Air.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Closes #15644. cmux vm run used a fresh idempotency key for every pool-machine create, so an interrupted, timed-out, or dropped-socket run after the backend accepted the request left a provisioned machine invisible to the local pool, and the next run created another paid machine.

This persists one pool-create idempotency key under ~/.cmuxterm, guarded by an advisory lock. Concurrent routers converge on the same key; transport failures and vm_create_in_progress keep it for recovery, while definite backend failures clear it. The key clears only after the created machine is recorded in the pool, so a local persistence failure can retry against the same backend create. A regression test, run against an isolated temporary store, covers key reuse after an unknown outcome and fresh-key allocation after completion.

^{Written for commit 74b8871. Summary will update on new commits.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: b1c42751-be05-4bfc-9c89-a6a0d2c73fd6

📥 Commits

Reviewing files that changed from the base of the PR and between 8840999 and 74b8871.

📒 Files selected for processing (1)

• cmuxTests/CLIVMTransferTests.swift

 ____________________________________________
< Forcing bugs to surrender unconditionally. >
 --------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

CI failure attribution

CI failed on cff70ed21c (run 36775477178 attempt 2): 1 code.

Job	Verdict	Why
macos / macOS compile admission	code	a compile error

Matched log lines

macos / macOS compile admission: /tmp/cmux-ci/src/Sources/CmuxConfig.swift:2816:51: error: missing argument for parameter 'actionReferenceID' in call

Not re-run automatically: macos / macOS compile admission is not a machine failure.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's.

[github-actions]

Merge receipt for 74b8871106, merged 2026-10-01 14:36:23 UTC

• Not verified at merge: ci-status (not reported), CI fast guards (in progress), GhosttyKit release check (in progress), guards (6) (in progress)
• Verified: Fast static checks, Web complexity, web-validation
• Skipped by policy: admission-placement, browser, Claude wrapper regressions, Dogfood build #​${{ github.event.pull_request.number }}, full-suite-coverage, remote-daemon, suite-coverage, swift-package-tests, web, web-build, web-database-tests, web-tests
• Full suite: runs on main after merge.

Labeled merged-unverified: if main breaks near this merge, look here first.