[lawrencecchen]

Summary

BackgroundAccessoryPolicyTests.aWindowClosedBeforeTheRestoreFinishesStaysClosed failed 1 run in 3 on cmux12s (job 691124a2e9b4323980de7e07). It is a product race from the WindowManager restore (#23695), not a test fault: a window the person closed during the launch comes back.

Cause: the restore creates its first workspace (FirstWorkspaceLaunch.create). The create's reply can come before the store applies the event that lists the workspace (the store drains once per frame; the reply resumes the restore at once). The restore then ended and cleared closedDuringRestore and closedLaunchWindowID (WindowManager.swift:246-249). The late report's reconcileMembership (WindowManager+Membership.swift:497) found no window and no memory, registered a new fallback window and presented it.

Fix: the memory of what the person closed during the restore is now one value next to WindowRegistry, RestoreClosedWindows (CmuxNextLayout). The restore records the workspace it asked for that the store does not list yet, with the event sequence taken after the create's reply (DaemonConnection.eventSequence, a write barrier). When the person closed the launch window, that window is remembered past the restore: reconcile still gives a late workspace the closed launch window as its fallback and keeps it closed in the same registry step (no sync ever opens it), and the memory ends once each such workspace is in a window, or the store applied past the barrier without listing it (gone). Reconcile settles it before it picks the fallback, so a memory with nothing left to wait for never takes an unrelated workspace. The check is O(the restore's workspaces), runs only in reconcile, and adds no main-thread wait or action-path work.

Test seam: DaemonStore.eventHold (nil in the app) keeps buffered events unapplied while it returns true, and asks for no frame meanwhile; releaseHeldEvents() applies them in that turn. The new test holds the batch with the new workspace until the restore ended, so the failing order is certain, not a race.

Testing

cmux-ci run --class light --display --script scripts/ci/package-test-lane.sh --ref <sha> --arg=suite --arg=Packages/macOS/CmuxNext --arg=<suites> --env CMUX_TEST_REQUIRE_GUI=1 --env CMUX_CI_XCODE_APP=/Applications/Xcode_26.6.app

• Red, test commit fb2ff7e (seam + test, no fix): job 68c59e5646b0d7ed72ed12d6 (cmuxs-Mac-mini-3): aWorkspaceTheRestoreAskedForReportedAfterItEndedStaysInTheClosedLaunchWindow failed at BackgroundAccessoryPolicyTests.swift:170-172: a window was presented, one controller open, the workspace not in a closed window. Its preconditions held (the store listed nothing at the restore's end; the hold caught the report).
• Green, head ae9ad32: job 0b1e36cfdd8800c4ceebc9db (cmux12s, one host): RestoreClosedWindowsTests once, then BackgroundAccessoryPolicyTests 5 times in a row: all 6 suites passed (each run: the new test, aWindowClosedBeforeTheRestoreFinishesStaysClosed, noWindowIsAMenuBarApp…).

Observed / Not run

• Observed: the fleet runs above; the prepush gate (no new violations; CmuxNextApp lines -2).
• Not run: a full CmuxNextAppTests run; the original 1-in-3 race was not re-run at volume (the new test makes that order deterministic instead).

Owner: no OWNERS.md row covers WindowManager (CmuxNextApp/Windows/WindowManager*.swift), CmuxNextLayout/Windows/ or the Swift DaemonStore (not listed).

Changelog

• Fixed: a window closed while cmux was still starting no longer opens again when the first workspace arrives late.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes a race where a window the person closed while cmux was still launching could open again when the restore's first workspace was reported late. The closed window now stays closed.

The restore's first workspace create can reply before the store applies the event that lists the workspace; the restore then ended and forgot the closed window, so the late report's membership reconcile opened a new fallback window.

Bug Fixes

• Replaces closedDuringRestore and closedLaunchWindowID with RestoreClosedWindows, which keeps the closed launch window remembered until the late workspaces land in a window or the store shows them gone.
• Reconcile settles the memory before picking a fallback, so each late workspace goes to the closed launch window and stays closed in the same registry step.
• Adds a DaemonStore.eventHold/releaseHeldEvents() test seam and tests that hold the workspace report until the restore ends, making the failing order deterministic instead of a race.

^{Written for commit ae9ad32. Summary will update on new commits.}

[lawrencecchen]

Review (independent review subagent, Opus 5.5 claude-opus-5-5, read-only): SHIP at ae9ad32

The reviewer confirmed:

• The memory cannot last for ever. It ends when the workspace is placed, or when the store applies past the barrier without it (RestoreClosedWindows.swift:60). Sequences carry the connection serial (EventGate.swift:62), so a reconnect's first snapshot passes the old barrier.
• Reopen is handled. reopened drops the window, and restoreEnded guards it with windows.contains(launch).
• The barrier is correct. Events and replies come on one ordered socket, and the routed event count matches the event index (LineTransport.swift:421-439).
• Main thread: settle is O(1) and runs only in reconcile. There is one nil check per drain and no new singleton.
• Red 68c59e5646b0: lines 170-172 fail, and the preconditions held. Green 0b1e36cfdd88: RestoreClosedWindowsTests 4/4 and BackgroundAccessoryPolicyTests 5×. The test is deterministic, through the event hold.

Low follow-ups, not blocking:

• WindowManager.swift:265: with no connection the barrier is ?? 0, so the old bug can return in that rare edge case.
• A workspace that no window claims (for example, one created directly on the daemon) can go into the closed launch window for slightly longer than before.
• The seam DaemonStore.eventHold / releaseHeldEvents() is public. Make it internal and use @testable import CmuxNextDaemon, as cloudList does. Only the test sets it today.
• Test: use defer { store.releaseHeldEvents() } instead of eventHold = nil, and the 500 ms sleep at :166 can be a state wait.

Owners: no OWNERS row covers WindowManager, CmuxNextLayout/Windows or the Swift DaemonStore. Lawrence (DaemonStore+Driver), Leo (recent WindowManager work) and PL-switch (WindowRegistry+Selection, WindowState, WindowController) should be told.

[blacksmith-sh]

Found 7 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpi6zxbh8a/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpj8v_aupm/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_runtime_added_app_capabilities_are_runtime_only (main.StaticCapabilityRuntimeO nlyTests.test_runtime_added_app_capabilities_are_runtime_only)/ test_runtime_added_app_capabilities_are_runtime_only (main.StaticCapabilityRuntimeO nlyTests.test_runtime_added_app_capabilities_are_runtime_only)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review ae9ad32: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr31155 -f ref=fix/restore-closed-launch-window -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); base red: the same failure on the base ba68875; does not block

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4133598742701 (1e1948befb)
• cmux NEXT nightly 1.0.0-nightly.4133716725501 (d30463325c)
• cmux NEXT nightly 1.0.0-nightly.4133769596201 (0272db645e)
• cmux NEXT nightly 1.0.0-nightly.4133822529301 (68e3df851b)
• cmux NEXT nightly 1.0.0-nightly.4133907849701 (c2ef233b76)
• cmux NEXT nightly 1.0.0-nightly.4133963836301 (48e4448d11)
• cmux NEXT nightly 1.0.0-nightly.4134024448601 (94322a6ccf)