[lawrencecchen]

Summary

Base red on feat: acpmux::subsession_trust_inherit a_full_access_chat_lends_its_folder_trust_to_sub_sessions_under_it fails at subsession_trust_inherit.rs:307 (left: "fake-full-fo", right: "fake-claims"): the failover case never fails over.

Culprit. #27924 (a1fc2c2, "recover turns after limits and gateway outages"). It made a usage limit stay on the current account and wait for its reset; only a sign-in failure fails over to the fallback profile. #27924 moved its own failover fixtures to a sign-in failure (FAKE_AUTH_FAIL, FAKE_CLAUDE_AUTH_FAIL), but this test still triggers failover with the stand-in's limit: prompt, a usage limit. Bisect on Linux; each run compiled its commit:

commit	job	result
38f2772 (#27924's parent)	169c6d2a	pass
a1fc2c2 (#27924)	edb316c8	FAIL at :307
feat 9e3b7ac	99b7691f	FAIL at :307

Fix (test only; the #27924 rule stands). The stand-in's limit: answers a sign-in failure ("Not logged in") under FAKE_AUTH_FAIL=1, as its slow-limit already does. The failover profile fake-full-fo sets FAKE_AUTH_FAIL=1. Without the variable, limit: is a usage limit as before, so every other test that uses it is unchanged.

Testing

run	ref	result
green: the test	head fc658f4	Linux 8cae9c69, 53158fbf, 41a6dcd2: pass
every test named *limit* (166, the other limit: users unchanged)	head	Linux eb5f9d3b: 166 pass

Observed / Not run

Observed: the runs above. Not run: macOS (no platform code).

Changelog

none

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the subsession_trust_inherit failover test, which broke after #27924 made usage limits wait for a reset on the same account instead of failing over.

• Makes the limit: stand-in response return a sign-in failure when FAKE_AUTH_FAIL=1, so the test's failover profile triggers a real failover.
• Only that profile sets FAKE_AUTH_FAIL; all other tests using limit: still exercise the usage-limit path unchanged.

^{Written for commit fc658f4. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review fc658f4: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30408 -f ref=base-red-trust-inherit-auth-failover -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4130052256501 (28aa638015)

[cubic-dev-ai]

No issues found across 2 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[lawrencecchen]

Review (independent review subagent): SHIP at fc658f4

Scope: the 2 test files in git diff origin/feat-cmux-next...fc658f4f (fake_agent.py, subsession_trust_inherit.rs). I did not build or run tests locally (repo rule). I read the code and the fleet logs.

1. Cause: correct.

• In a1fc2c2 (acpmux: recover turns after limits and gateway outages #27924), turn_errors.rs splits is_usage_limit_error out of is_limit_error. In hub/turns.rs the failover target is set only when is_limit_error(msg) && !is_usage_limit_error(msg) && !is_gateway_error(msg) (or the same test on the dead agent's stderr). "Not logged in" matches is_limit_error ("not logged in") and does not match the usage-limit or gateway classifiers, so it fails over. "You've reached your usage limit for this account" matches is_usage_limit_error ("reached your" + "limit"), so it does not fail over, and resume_cause returns capacity (a retry on the same profile).
• acpmux: recover turns after limits and gateway outages #27924 moved slow-limit and limit-then-hang in fake_agent.py to "Not logged in" under FAKE_AUTH_FAIL=1. It did not change limit:, and this test still used limit: to cause the failover.
• Bisect logs (hq runs from linux_pool_overflow.run_id):
  • 169c6d2a: run 41281278922, checkout 38f2772, PASS (1/1) ... a_full_access_chat_lends_its_folder_trust_to_sub_sessions_under_it.
  • edb316c8: run 41281148396, checkout a1fc2c2, FAIL, panicked at subsession_trust_inherit.rs:307:5, left: "fake-full-fo", right: "fake-claims". That is the meta.harness assert after the limit: now prompt, which is the expected effect of the new rule.

2. Fix: correct. The test still tests its claim.

• fake-full-fo now sets FAKE_AUTH_FAIL=1, so limit: now gives "Not logged in" and the session fails over to fake-claims. The assertions after that did not change: harness is fake-claims, the mode is full-access (the fallback's own mode, FAKE_SET_MODE_FAIL refuses cmux's change), and start_on_waits_on_a_card(..., "fake-full") must show a card. So the test still proves that a failover to a profile which claims full access by itself lends no folder trust.
• fake-claims does not set FAKE_AUTH_FAIL. The re-sent limit: now on the fallback is now a usage limit, so it schedules a same-profile capacity retry and does not fail the turn. No assertion depends on that turn, and the 3 green runs show it does not disturb the card check. No action needed.
• Other limit: users: hub_integration.rs:934 (limit_error_stays_on_the_current_profile), hub_integration/agent_revive.rs:92 (a_limit_is_resumed_even_when_the_agent_dies_of_it), routes_rpc.rs:298 (a_chat_switches_from_proxy_a_to_proxy_b_without_a_restart). None of their profiles set FAKE_AUTH_FAIL. The 4 profiles that set it (stop_settles_tests.rs, turns_copy_stop_tests.rs, stalled_turn.rs, this test) send no limit: except this test. git grep finds no other way to set the variable.
• Default limit: behavior: with no FAKE_AUTH_FAIL, the message is the same string as before. The change uses the same ternary as slow-limit and limit-then-hang.

3. Evidence: confirmed on the head. Each job checked out fc658f4f and compiled it:

• 8cae9c69 (run 41283908700), 53158fbf (run 41284023419), 41a6dcd2 (run 41284148224): PASS (1/1) acpmux::subsession_trust_inherit a_full_access_chat_lends_its_folder_trust_to_sub_sessions_under_it in each.
• eb5f9d3b (run 41282813020): 166 tests run: 166 passed. This includes limit_error_stays_on_the_current_profile, a_limit_is_resumed_even_when_the_agent_dies_of_it and the auto_resume::limits::* tests.
• Not covered by a run: routes_rpc::a_chat_switches_from_proxy_a_to_proxy_b_without_a_restart (not in the limit filter). It is not affected, because it sends the same bytes as before.

Product code does not change, and the #27924 rule stays. I found no problems.

[lawrencecchen]

Check classification at head fc658f4:

• clippy (changed cmux-tui packages) (job 124785026871): base finding. "this if statement can be collapsed" at crates/acpmux/src/agent_tools.rs:590 and crates/acpmux/src/cloud_repo_mcp.rs:155. This PR changes only two test files (tests/fake_agent.py, tests/subsession_trust_inherit.rs).
• rerun (run 41285334312): the defaults-guard review rerun, infrastructure/cancelled, no check of this change.

Fleet at the head (Linux): the test passes 3 of 3 (8cae9c69, 53158fbf, 41a6dcd2); 166 *limit* tests pass (eb5f9d3b).
Review: SHIP at the head (issuecomment-6555028205).

[blacksmith-sh]

Found 8 test failures on Blacksmith runners:

Failures

Test	View Logs
main.DeveloperIdAppTests.test_download_prints_the_active_profile_only/ test_download_prints_the_active_profile_only	View Logs
nightly must build and hand off the macOS 26 helper and Xcode 26.5 app before publishin g/ nightly must build and hand off the macOS 26 helper and Xcode 26.5 app before publishin g	View Logs
stubs: /System/Library/Frameworks/Security.framework/Versions/A/Security has no stub/ Security has no stub	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_CFRetain']/ CoreFoundation, missing 1: ['_CFRetain']	View Logs
stubs: CoreFoundation.tbd: install-name /System/Library/Frameworks/ CoreFoundation.framework/Versions/A/CoreFoundation, missing 1: ['_log2']/ CoreFoundation, missing 1: ['_log2']	View Logs
test_helper_never_takes_a_hosted_mac_and_skips_compile_on_hit (main.WorkflowTests.t est_helper_never_takes_a_hosted_mac_and_skips_compile_on_hit)/ test_helper_never_takes_a_hosted_mac_and_skips_compile_on_hit (main.WorkflowTests.t est_helper_never_takes_a_hosted_mac_and_skips_compile_on_hit)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs
test_under_githubs_limit_with_headroom (main.NightlyWorkflowSize.test_under_githubs _limit_with_headroom)/ test_under_githubs_limit_with_headroom (main.NightlyWorkflowSize.test_under_githubs _limit_with_headroom)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}