[lawrencecchen]

Summary

Three groups of global state that rose on feat-cmux-next with no reviewed exception become instances made once at the composition root and passed through init. Two small behavior changes (below, "Behavior changes").

Sites fixed

• Packages/macOS/CmuxNext/Sources/CmuxNextDesign/GlassPanelView.swift:289, :291, :293, :295, :296, :395, :426: the seven ActiveLookScope statics (windows, pending, candidate, materialSite, installed, counts, kinds; 1335e10, cmux-next: no window background change when switching apps #25704). They are now one ActiveLookScope instance:
  • The AppKit getter hook captures that instance. The first ActiveLookGlassEffectView installs the hook.
  • AppServices makes the instance once (AppServices.activeLook). It is in no store and no global; review FIX at 723ce04 found the earlier ThemeStore.activeLook slot to be a static by another name, and d535691 removes it.
  • The main window gets it through WindowController -> WindowRootView(activeLook:). Every window-kit window gets it as a required parameter of NSWindow.install(kind:content:scope:activeLook:) and then WindowSurfaceView: browser popups (AppServices -> BrowserPopupWindows -> BrowserPopupWindow), sign-in panels (AppDelegate -> WebAuthSessionWindows -> WebAuthSessionWindow -> BrowserPopupWindow), onboarding (OnboardingService -> OnboardingWindowPresenter -> OnboardingWindowController) and Debug Settings (DebugSettingsService -> DebugSettingsWindowController).
  • DevTools and Page Info are child windows: they read their owner window's scope (NSWindow.backdropActiveLook, the owner's own WindowMaterialView.activeLook), the same way they already take the owner's themeScope. With no owner window they get plain glass.
  • BrowserDebugWindow passes nil: its init is private and nothing outside its file refers to it (dead code).
  • One process-wide once-guard stays: the AppKit getter swizzle is process-wide by nature, so the first install adds a marker method to NSWindow (class_addMethod), and only that install hooks the getter. It replaces the base's private static var installed. The ratchet does not count a method marker, so the -7 here does not mean that all process-wide state is gone: this guard remains, by design. In the app the first and only installing scope is AppServices' (ActiveLookScope() is made only at AppServices.swift:52).
  • The backdrop gets it through WindowMaterialView(activeLook:) and then GlassPanelView(activeLook:), which replaces keepsActiveLook: Bool.
  • The hook does the same thing as before.
• Packages/macOS/CmuxNext/Sources/CmuxNextAppCore/WorkspaceSelectionCloseFlow.swift:25 public private(set) static var running (a439d29, Close a sidebar selection as one batch: one pass, one question, one undo #24341): this is now WorkspaceSelectionCloseFlow.Running. The app has one (AppServices.selectionCloses). It goes to every batch close and Close Workspace reads it. It stays app-wide, as the static was (see the reviewer notes).
• Packages/macOS/CmuxNext/Sources/CmuxNextUpdater/KillSwitchReader.swift:33 static weak var app and start(updater:) (52c918f, cmux NEXT: per-PR kill switches (registry, expiry lint, signed Swift reader) #24212): removed. UpdaterService.startKillSwitchReader() stops the previous reader through its own killSwitchReader property.
• The AppServices wiring is paid for by MainMenu+Placements.swift. It loses helpGroups, groupedItems and otherItems, which nothing has used since feat(cmux-next): trim native app menu bar #24615.

CmuxNextCompat/KillSwitches.swift static let shared stays as it is (an exception candidate).

Ratchet delta

python3 scripts/cmux-next/arch_counts.py --delta origin/feat-cmux-next HEAD:

stateful_singletons                -1 {'CmuxNextUpdater': -1}
global_mutable_statics             -8 {'CmuxNextAppCore': -1, 'CmuxNextDesign': -7}
app_lines                          -22 {'CmuxNextApp': -22}   (against the merge base; against the moved tip it reads lower because of base changes)

No other row changes. arch-ratchet.py --base origin/feat-cmux-next --head HEAD: "no architecture count rises". arch-ratchet.json is not changed (no --update, no exception).

Behavior changes

• A DevTools window that opens for a tab not on screen (a handler that targets the tab, or the async undock after a workspace switch), or a Page Info window whose anchor went away, has no owner window. Its glass now follows the key state (it greys when not key); before, every backdrop glass kept the key look. The base already falls back to the .app theme in the same case.
• A WindowMaterialView made with no scope now gives plain glass. All production backdrops that can show glass pass the scope.

Testing

• InactiveWindowTintTests now makes its own ActiveLookScope for the attach, detach, scope and backdrop checks. One new check proves that a WindowMaterialView with no scope keeps plain glass.
• python3 scripts/cmux-next/prepush-gate.py: no new violations.
• ./scripts/lint-ios-package-conventions.sh --namespace-fix: no violations.
• Fleet compile-check of head d535691: job c9e7588261ee59b7a47bd605 passed (CmuxNext, app). The earlier head 723ce04: job 2dcbecc3d48bb5e5a2b2fa51.

Observed / Not run

• Observed: the arch_counts delta above, the arch-ratchet result, the prepush gate and the namespace lint.
• Observed: fleet compile c9e7588261ee59b7a47bd605 passed at d535691.
• Not run: the Swift tests on the fleet (a refactor: an independent review judged that it fixes no user-visible bug, so no red/green proof is needed). There is no live check of an inactive glass window on macOS 26 or later.

Reviewer notes

• With no activeLook, WindowMaterialView(frame:) now makes plain glass. The production backdrops that can show glass (the main window root and WindowSurfaceView) pass the scope. The pane art view is always .translucent (PaneBackdropPlan), so it never makes glass.
• In a test process the hook keeps the first scope that installs it; later scopes do no forcing. No test depends on its own scope's hook (InactiveWindowTintTests check scope state directly). WindowRootView(sidebar:activeLook:) keeps a nil default for 15 test call sites; its one production caller passes the scope.
• Running is app-wide, not per window (the audit proposal said per window). The old static gave dedupe across windows. Also, WorkspaceSelectionClose and Close Workspace can both run with no controller or owner window.
• The hook (unchanged here): on the main thread, every read of NSWindow._hasActiveAppearanceIgnoringKeyFocus calls AppKit's getter. Once the scope is calibrated, a read that answers inactive in a window that holds backdrop glass takes a 16-frame backtrace() plus cached dladdr image lookups. Every other read is one NSMapTable lookup. While the scope calibrates, a read inside that window's glass update takes a 32-frame backtrace(). Off the main thread it does nothing. NSGlassEffectView has no public active-state API. A candidate public route that nobody has checked: draw the backdrop with SwiftUI glassEffect in our own hosting view, with \.appearsActive / \.controlActiveState forced in its environment. Owner: Performance Lead.

Changelog

none

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d535691: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr28266 -f ref=fix/arch-rise-glass-close -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: 3 commit(s) change the sidebar's drawing code without a Sidebar-Look: trailer or an entry in plans/cmux-next/sidebar-owner.md is not red on the base 1d98fce; do not merge until green; see lane-rules
red: cmux-next crash ratchet; NEW: green on the base 1d98fce; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4115488208801 (dd66817742)
• cmux NEXT nightly 1.0.0-nightly.4115755828101 (7c0adaf184)

[blacksmith-sh]

Found 27 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpb6n73plh/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpz67y7uic/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='', primary='success')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='failure')	View Logs
test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')/ test_every_linux_nightly_job_takes_a_runner_set_member (main.NightlyTrustedRouting. test_every_linux_nightly_job_takes_a_runner_set_member) (job='attest-nightly-remote-dae mon', runner='blacksmith-16vcpu-ubuntu-2404', primary='success')	View Logs

...and 17 more test failures. View all on Blacksmith

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

Default changes

This pull request changes 4 defaults at d5356919aca1 (what everyone gets without configuring anything):

• tunable-source.CmuxNextApp/AppActions+Workspaces.swift:closeWorkspace: "2839d35bf7ba2b4667d410b011c4de1fa3a81a711f5b2f61b2f423e426ce9c05" -> "7061f4bdaf558471bf741d7f4215d73532870775ff46a0d52d1f1bad1fb610e7"
• tunable-source.CmuxNextAppCore/WorkspaceSelectionCloseFlow.swift:canStart: "4407331d447be9be757d4a319e9662f5b0db1c02f8dcb730e8ac52089f9ae774" -> (none)
• tunable-source.CmuxNextAppCore/WorkspaceSelectionCloseFlow.swift:running: "b8abf5f1508482a8fab3b51c7dc6760e5300228d3a3f897b7b31baf791593619" -> (none)
• tunable-source.CmuxNextDaemonService/WorkspaceCloseFlow.swift:running: "b8abf5f1508482a8fab3b51c7dc6760e5300228d3a3f897b7b31baf791593619" -> (none)

Needs a review. It passes with an independent review receipt on this commit: a comment or review whose first line is Review (<reviewer>): SHIP at d5356919aca1425fd855b458298f0bae47e06094, from a member, not a self-review (the newest verdict naming the head decides; a later BLOCK beats an earlier SHIP), or with an approving review on this commit from @austinywang or @teamleaderleo (the call owners in .github/defaults-call-owners.json, never the author). A receipt posted as a review re-runs this check; after a plain comment, re-run it. The needs a call label alone does not pass, and a new push needs a new receipt.

Merge receipt: merged as 346c50a0d1fa with these defaults changed, WITHOUT a SHIP receipt or an approving call owner review on its head.

Regenerate the snapshot with python3 scripts/ci/defaults_guard.py snapshot.

[lawrencecchen]

Review (independent review subagent, arch-rise): SHIP at d535691
perf claim: none
compile: c9e7588261ee59b7a47bd605 passed

Summary:

• AppServices.activeLook is an instance on the composition root, passed through init. ThemeStore.activeLook is removed.
• All 7 install(kind:content:scope:activeLook:) sites pass a scope. The main window and WindowSurfaceView are the only production backdrops that can show glass. Pane art is always .translucent.
• BrowserDebugWindow is dead code: its init is private and nothing outside its file refers to it.
• NSWindow.backdropActiveLook is a lookup by context: it reads the owner window's own injected scope, the same way owner.themeScope is read. It is not a hidden global.
• The class_addMethod marker is a process-wide once-guard for a swizzle that is process-wide by nature. It replaces the base's static var installed. The PR body discloses it.
• In the app, the first and only scope that installs the hook is the AppServices scope: ActiveLookScope() is made only at AppServices.swift:52, and the hook installs only from ActiveLookGlassEffectView.init(scope:).
• No test depends on the hook of its own scope.
• The behavior changes are limited to DevTools or Page Info with no owner window. They are rare and only cosmetic, and the PR body names them.
• This is a refactor, so it needs no red/green proof.
• I read every call site of each changed init and API, including the tests. Access levels and imports are correct.
• arch_counts --delta: stateful_singletons -1, global_mutable_statics -8. No row rises. arch-ratchet: no rise. prepush-gate: no new violations.
• The PR adds no CI job, step or gate.

Not blocking: WindowRootView(sidebar:activeLook:) keeps = nil for test call sites. A later production caller could forget to pass the scope.

[lawrencecchen]

Base red from this PR: the feat-cmux-next "Crash safety" step (check-crash-safety.sh) is red since 346c50a. The new NSSelectorFromString("cmux_activeLookScopeInstalled") in CmuxNextDesign/GlassPanelView.swift has a reviewed crash-allow, but the waiver was not recorded (CmuxNextDesign: dynamic_dispatch.waived 5 -> 6). #28783 records it with crash_ratchet.py --record-waivers. Next time, run that in the same PR as a new crash-allow.