[teamleaderleo]

Question-card Other keyboard answers require proof that the exact question is still pending. Historical permission keys and nonces cannot establish current membership. This prerequisite adds a connection-scoped native ledger, with no renderer binding or gesture ticket.

An acknowledged _acpmux/watch supplies unfiltered settlement coverage. Attach snapshots and permission_pending notifications cannot open keyboard membership before that native-correlated ACK: eventStream/kinds can hide lifecycle events while still delivering pending. Watch-off immediately revokes coverage and all entries. Attach replacement cannot create coverage. The shipped SessionPager awaits _acpmux/watch {enabled:true} replies.

Only live daemon pending notifications and complete pending snapshots can open entries under that watch coverage. Normal watch summaries contain pendingPermissions rather than request identities: zero may retire, a positive count cannot reopen. Watcher settlements retire current entries and invalidate earlier reads; a genuinely newer pending notification can open the next question on the same continuously watched connection.

Lag and peer stale/purge retire entries and require a fresh native-correlated complete read. Peer lifecycle invalidation is handled before event sequence checks because the daemon emits those notices at seq zero. Stale summaries/snapshots and delayed pre-gap replies cannot restore membership. Highest observed event sequence survives recovery; history never opens a question.

Each Question retains its exact canonical native request, nonce, daemon instance, and generation. Later integration must redeem the private renderer snapshot and recheck the exact Question after the await and at ticket consumption. This ledger does not repair Other Enter by itself.

Stacked base: pure read-epoch prerequisite #26851, branch lane/nx-question-read-epochs-1028, exact ab9124d2e998b8443489850394334b21d17983aa.
That prerequisite stacks on pure validator #26837, exact 0812231ec3dae1b370726bbd530fb4a5b0f73b8a (original feat base 8424d05bf9324f6f60a8f0c7c40b01f8a3e085b9).

Lawrence, via Leo:

leo i think this ui can be better / also needs to be keyboard navigable (i didnt check yet) / leo this needs to work with keyboard shortcuts like up arrow ctrl n/p etc / clicking enter doesnt work

Head: 01b2c36233d1c3b6684052745712e3ed10a6356e.
Complete ledger-only diff over the stacked base: 853 added / 7 removed lines in eight files (860 changed lines). All 439 lines of lifecycle source tests remain; the coordinator accepted this coherent about-800-line boundary.

Validation:

• git diff --check and python3 scripts/cmux-next/prepush-gate.py pass at this exact head.
• Same-watermark recovery regression source was committed first as f57505a3e9b: watch-off/detach recover only current identities from a fresh read, while delayed pre-gap responses, uninterrupted absence, and settled retirement floors still refuse.
• Source-first lifecycle/repair regressions cover actual watch summary/settlement shapes, relay-token replay/cancel/lag races, filtered attachments, watch ACK and watch-off races, A→settlement→B continuity without a watch toggle, seq-zero peer purge/stale, stale snapshots, and fresh recovery.
• Native compilation and tests are UNVERIFIED under Swift HOLD26809. No executed red/green result is claimed.
• Intended fleet command after release: swift test --package-path Packages/macOS/CmuxNext --filter AcpmuxPendingQuestionsTests.

The question_other_answer lane owns final verification with the root coordinator. This remains draft pending prerequisites, fresh exact-head security review, and required native verification. No merge is requested.

Changelog

none

Agent session: agent session

[github-actions]

Default changes

This pull request changes 1 default at a7a0439561bb (what everyone gets without configuring anything):

• tunable-source.CmuxNextAgentPane/AcpmuxPendingQuestions.swift:sequence: (none) -> "1ec4bc0d657d58554b82274c370c5d4e3e2c527e8f3fcd258eeb554bb9c3b195"

Needs a review. It passes with an independent review receipt on this commit: a comment or review whose first line is Review (<reviewer>): SHIP at a7a0439561bbf2f0a07a5684393a3d44ef6423c8, from a member, not a self-review (the newest verdict naming the head decides; a later BLOCK beats an earlier SHIP), or with an approving review on this commit from @lawrencecchen or @austinywang (the call owners in .github/defaults-call-owners.json, never the author). A receipt posted as a review re-runs this check; after a plain comment, re-run it. The needs a call label alone does not pass, and a new push needs a new receipt.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

[teamleaderleo]

Bead cx-pmx33p created for this PR by the cmux coordinator.

[blacksmith-sh]

Found 11 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmphip3hspw/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmppg_ya5tw/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build/ build_only must be a conjunctive exclusion on the helper, signing, and publication jobs , and must not gate the unsigned app build	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_prepare_runs_on_linux_and_executes_no_mach_o (main.NightlyPooledRoutingTests.t est_prepare_runs_on_linux_and_executes_no_mach_o)/ test_prepare_runs_on_linux_and_executes_no_mach_o (main.NightlyPooledRoutingTests.t est_prepare_runs_on_linux_and_executes_no_mach_o)	View Logs
test_the_next_feed_keeps_its_newest_nightly_item_before_it_goes_live (main.Workflow Tests.test_the_next_feed_keeps_its_newest_nightly_item_before_it_goes_live)/ test_the_next_feed_keeps_its_newest_nightly_item_before_it_goes_live (main.Workflow Tests.test_the_next_feed_keeps_its_newest_nightly_item_before_it_goes_live)	View Logs

...and 1 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cmux-bot]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Passes: CI passes on 01b2c36233.

CI passes on 01b2c36233 (run 40679554966 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

red: cmux-next checks (god files, concurrency, crash safety, l10n); no finished base run on 8546434 to compare; do not merge until green; see lane-rules

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Closing: this was stacked on #26851, which was closed as abandoned on 2026-11-01 (a standalone correlation primitive with an open P1, and nothing calling it). Whatever needs live-question tracking should build it where the question reads live (acpmux), against the current base.

(pr-backlog-sweep)