[teamleaderleo]

Leo, 2026-10-31: "and we ofc wanted to have the thing be having snapshots of whatever vms to do the right-sizing... and also austin/lawrence said indeed we wanted 1 workspace per vm for now / i guess they're relatively smol vms / but anyways we ideally also can just hide the machines too and it's just a cloud button"

This PR is the "1 workspace per vm for now" part, in cloud.startChat's pick (Rust, cmux-tui). Spec: leo-workspace design/cloud.md, "One workspace per small machine, snapshots, and a Cloud button".

What changed

• pick::destination: after the pinned-send check (a retry stays on its first try's machine) and the workspace's own machine check, a workspace with no machine, or a send from no workspace, gets Destination::New. An existing machine is never reused for a new workspace.
• pick::claim binds a machine to a workspace only when that workspace has none yet and no other workspace of the account has it; plan and pin go through it, so a machine bound to workspace A is never bound to workspace B (a retry of A's send from B still runs on A's machine but does not give it to B).
• pick() and its ranking (free, marked-for-chats, lane-pool, idle-paused) became dead and are removed, with the Candidate fields only it read (slug, pause_reason, chats; serde ignores them from the App).
• The ledger still holds many workspaces per machine (Ledger::held_by_another added); the one-per-machine limit is the pick's policy, so sharing can come back there alone. Ledgers written under cloud.startChat: a Mac workspace keeps the Cloud machine it picked; workspaces reuse and share machines #29532 that already share a machine across workspaces keep those bindings (their chats are on it).
• New machines keep the cloud-chats-N name (plan has only the workspace id, not its name).

Supersedes the reuse/share behaviour of #29532 and #29582 (merged; Leo's earlier "go arbitrarily many"). Austin's open #26078 does per-workspace VMs for Cmd-N in Swift; this is the chat path in Rust and touches none of his files. Not touched: the create request's team/owner targeting, the composer UI, Swift.

Tests

Updated the tests that asserted reuse; added each_workspace_gets_a_new_machine_and_keeps_it (two workspaces get two New, each keeps its machine across sends, paused or before the list loads), a_free_machine_of_mine_is_not_reused_for_a_new_workspace, and a_machine_bound_to_one_workspace_is_not_taken_by_another.

cmux-ci fleet job 8880d5bb9bad24b949423853 (linux-pool), at 57a00e0: cargo test -p cmux-tui --lib start_chat_cli passed 25 of 25, and cargo clippy -p cmux-tui --all-targets -- -D warnings -A clippy::redundant_closure passed. That one lint is allowed because the base fails it at crates/acpmux/src/hub/processes.rs:256, a file this PR does not touch.

Router review at 6b62dda flagged a P1: two first sends from one workspace can race (both plan New, then both pin). Fixed in 57a00e0. pick::claim binds only while the workspace has no machine, so the first pin wins and the later machine keeps only its own send's chat. A test covers this. The orphaned second machine stays the person's, and pausing or deleting it is a follow-up.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

cloud.startChat now gives each Mac workspace its own small Cloud machine instead of reusing or sharing existing ones.

• A workspace's first send plans a new cloud-chats machine and keeps it across later sends, even paused or before the list loads; sends from no workspace get a new machine too.
• Existing machines are never reused, and pick::claim never binds a machine to a second workspace: a retry of workspace A's send runs on A's machine but does not give it to B.
• A workspace still drops its own machine when it is a fleet VM or failed (cloud.startChat: the machine pick never takes a fleet VM made under the person's account #29959's check is kept), so the next send makes a new one.
• The reuse-by-ranking logic in pick() is removed as dead; the ledger still allows sharing, so the one-per-machine rule can move back there alone.
• Ledgers that already share a machine across workspaces keep those bindings.
• Two first sends of one workspace that race to pin: the first pin wins, and the later machine keeps only its own send's chat.

^{Written for commit ded01ee. Summary will update on new commits.}

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex gpt-6-astra high, router-review on eb89937..57a00e0): SHIP at 57a00e0

No correctness findings.

Follow-ups: none

(Earlier BLOCK at 6b62dda, racing first sends of one workspace, fixed in 57a00e0.)

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): SHIP at ded01ee

Follow-ups:

1. [P1][follow-up] A workspace can lose its machine and then have it reassigned by a retry. Ledger::bind evicts bindings once there are more than 256 workspaces, and workspace_machine drops the binding for a machine that is unavailable. If a kept send from workspace A is then retried from workspace B, claim finds no other owner and binds A's machine to B. Filed as a follow-up issue.

Tests at this head: cmux-ci fleet job ea0aee6536b9acf3611b7bb7, cargo test -p cmux-tui --lib start_chat_cli passed 26/26 and clippy passed.

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review ded01ee: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30020 -f ref=cloud-one-workspace-per-machine -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base 69ac0cc; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4130052256501 (28aa638015)

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_no_runner_picker_returns_a_hosted_mac (main.NoHostedMacInNightlies.test_no_run ner_picker_returns_a_hosted_mac)/ test_no_runner_picker_returns_a_hosted_mac (main.NoHostedMacInNightlies.test_no_run ner_picker_returns_a_hosted_mac)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}