[teamleaderleo]

SW-12: pace the guest's outbound prompts so reconnect does not discard its offline backlog

Closes #30777 when merged. The guest composer and browser page have already landed (#30518/#29901); this independent, three-file follow-up touches only the guest tab's outbound queue.

Problem and original test gap. GuestPage.LiveChat previously looped over prompts.unsent() and sent everything synchronously after a snapshot. The room admits 2 prompts/second, burst 2, returning terminal refused: share.rate_limited for the third. That permanently discarded messages the guest had typed while offline. Rapid online sends hit the same error.

Patch.

• Add guestSendQueue.ts: one 600 ms paced sender for live and reconnect traffic, with one-shot timers; current connection's sent IDs are tracked, and a new socket snapshot replays only unacknowledged IDs.
• Treat only share.rate_limited as retryable: schedule the same client_id after 1200 ms. Preserve permanent refusal and owner approval/decline semantics; no new id, no widening permissions.
• GuestPage.tsx uses this queue on send, snapshot, prompt-state, disconnect and share end. No room, daemon, protocol, consent, cookie, UI or owner approval code is changed.
• Fake-clock unit tests cover 5 offline messages drained one by one, three immediate live messages paced, stable-ID retry after share.rate_limited, reconnect replay, and timer cancellation on end.

Review and testing boundaries. Source and new tests committed; no local Bun install/full web suite or deployed two-browser test was available in this GitHub-only session. GitHub CI and owner review should validate the exact head before landing. The pace uses 600 ms against the server's current two-token bucket; if the room changes the rate contract, update both sides together. Independent review should check status races and reconnect lifecycle.

Ownership: SW-12 follow-up to HQ #5599 and sharing flow HQ #4766. Existing held-prompt owner stack (#28859/#29003/#26742) is untouched.

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 2bbce66: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr30790 -f ref=sw12/guest-outbox-pacing-20261101 -f platform=macos -f backend_mode=local

Gallery before/after for 2bbce66: 12 states rendered, 1 images differ. Images are in the run's artifact, not on this public PR; the independent review of this head reads them on its own, so the PR needs no hand-made screenshots of these states.

gh run download 41377487949 -R manaflow-ai/cmux -n gallery-advisory-30790-2bbce664eedb7f3ae5cb08ef41b59dd603e87daa (then read gallery-review.json)

States

State	Theme	Status	Diff	Picked by
guest-page.ended/expired	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.ended/expired	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.ended/revoked	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.ended/revoked	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.ended/removed	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.ended/removed	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.ended/used	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.ended/used	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.join/empty	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.join/empty	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.join/offline	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.join/offline	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.join/bad-link	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.join/bad-link	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.live/working	Apple System Colors Light	changed	7.68%	own GuestPage.tsx
guest-page.live/working	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.live/asking	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.live/asking	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.live/connecting	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.live/connecting	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.waiting/held	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.waiting/held	Apple System Colors	unchanged	0%	own GuestPage.tsx
guest-page.waiting/decided	Apple System Colors Light	unchanged	0%	own GuestPage.tsx
guest-page.waiting/decided	Apple System Colors	unchanged	0%	own GuestPage.tsx

_{Pick other states with a Gallery: entry.id, entry.id/variant line in the PR body.}

Passes: CI passes on 2bbce664ee.

CI passes on 2bbce664ee (run 41377487887 attempt 1).

Written by scripts/ci/classify_failures.py (ci-failure-attribution.yml); signatures are its SIGNATURES table. A machine verdict is the runner's fault, not this PR's; yours means the failing file is one this PR changes, also red on main that main's latest full suite fails the same way, seen on other PRs that it failed on another pull request's run lately.

web and size checks: green

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4138330546501 (b732874bf5)
• cmux NEXT nightly 1.0.0-nightly.4138511422301 (521667e619)
• cmux NEXT nightly 1.0.0-nightly.4138631602601 (86faa171ca)
• cmux NEXT nightly 1.0.0-nightly.4138723445501 (2429d60a67)

[teamleaderleo]

Owned by an agent session · session

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex gpt-6.1-sol xhigh, router-review): BLOCK at c27cfdf

BLOCK at c27cfdf

Visual verdict: no visual regression found across all 16 before/after pairs.

1. [P1] [blocking] webviews/src/agent-session/guest/guestSendQueue.ts:60 — Allow server acceptance to supersede a refusal. The daemon can return agent_session.timeout after five seconds, then receive the delayed queued record and report held and an owner decision. Because decided() includes refused, this guard discards all subsequent updates, including reconnect snapshots. The guest permanently sees “Not sent” even when the owner approves and executes the prompt; base correctly reconciles these updates. Preserve the refusal’s exclusion from automatic retries while accepting later authoritative states, and cover this sequence with a regression test.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[teamleaderleo]

Review (codex, router-review): SHIP at 2bbce66

Reviewer: codex gpt-6-astra high, fast tier.

SHIP at 2bbce66
Visual verdict: no introduced UI regression across 16 compared pairs.

No actionable correctness findings. All six queue tests passed using a Babel/Node assertion shim; Bun and composer integration tests were unavailable.

Follow-ups: none