fix(cmux-next): keep next-turn pacer alive during tab replacement

[teamleaderleo]

Summary

Opening a second agent tab while the first turn is starting could release the first AgentPaneNextTurnPacer while its next-turn task was queued, or while installTransport() synchronously replaced an unused default pacer. The pacer task now retains its owner until the flush completes, replaced pacers are released on the main actor with an explicit lifetime barrier, and this stateless pacer has executor-independent teardown. Regression tests cover both lifetimes.

Changelog

Fixed next-turn pacer lifetime during agent tab replacement.

Validation

• Red before fix: fleet step f6cdd2fe938a7b95eae14034 on test-only commit c9e37c523183e6b3e38e541eb472da4e9603ddf6; AgentPaneHopOrderTests failed at aQueuedTurnKeepsItsPacerAliveUntilTheFlushCompletes because the weak pacer was already released.
• Green focused run: fleet step 27667ca4fb9f35cc0a06167f on 51bbb6525426184c840433eae1c2c4a6c9fdd4de; all 4 AgentPaneHopOrderTests passed.
• Green exact-head CI: cmux-next swift test passed on 1003995780c3530f6dfbe970950d943d616470fd.
• Fleet compile-only build f978158e724d9d43a6c9e0e8 completed successfully on the exact head, including packaging and dependency readiness.
• python3 scripts/verify-local.py: project, wiring, package groups, feature flags, and migration checks passed; localization is red on the current base with 27,573 pre-existing parity errors.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5cd18d39-ef37-4c64-b62c-d44f5b7b709a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Not verified: macOS jobs did not run: compile and app tests were skipped on 1003995780; ci-status is green without them.

CI passes on 1003995780 (run 37417186365 attempt 1).
macOS jobs did not run: compile and app tests were skipped: Fast static checks skipped (the macos job needs both to succeed). Re-run CI once they pass, before merging.

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way.

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[teamleaderleo]

This crash also happens on a path the PR doesn't cover. I hit it twice on Cmd-T while recording flicker captures on capture minis:

• tag next-flicker-v2 at feat-cmux-next 4db1db1 + cmux-next: keystroke echo no longer waits for vsync (20.5 → 5.4 ms); typing probe #17494-unrelated pane changes;
• tag next-flicker-v4, which has this PR's head (51bbb65) merged in.

The crashed thread in both reports (EXC_BREAKPOINT) is:

swift::TaskLocal::StopLookupScope::~StopLookupScope()
swift_task_deinitOnExecutorImpl
AgentPaneNextTurnPacer.__deallocating_deinit
_swift_release_dealloc
AgentPaneView.installTransport()
AgentPaneView.init(model:source:renderRate:pageHost:)
AgentTabStore.makeView(_:)
AgentTabStore.view(for:)
AgentTabContent.content(_:)
PaneController.content(for:) / showSelected()

The released pacer is the default AgentPaneNextTurnPacer that AgentPaneTransport.init makes (self.pacer = pacer ?? AgentPaneNextTurnPacer()). installTransport() then replaces it with model.transport.pacer = pacer (AgentPaneView+Transport.swift:26). That pacer never scheduled anything, so retaining self in schedule doesn't reach it: the trap is in its deinit, run synchronously during AgentPaneView.init. Chromium Embedded Framework frames sit above ~StopLookupScope in both reports.

The same signature also shows up in another lane's build (op.next.onboarding.close2) on a capture Mac. The crash is intermittent: the same Cmd-T on tags v1 and v3 didn't crash.

cmux-b2 (unregistered)