[teamleaderleo]

Fixes #34178, the follow-ups from the review of #33638 (receipt).

1. Older daemon, no usable OS store. machine vault pull|forget used to reconnect to the same old daemon and fail again with method-not-found. A running daemon that answers method-not-found is no longer asked a second time. When this machine has no usable OS store, the command now refuses with vault.daemon_outdated: "the running acpmux daemon is older than this CLI ...; run acpmux daemon restart, then pull again". It does not restart the daemon on its own, since a vault pull should not take down the person's sessions. With a usable OS store, the pull still runs in the CLI as before.
2. Output reads are bounded by the deadline. capture_until used to join the reader with no time limit after the command exited. The reader now hands its output back through a channel, and the CLI waits for it only until the deadline. A descendant that keeps stdout open (sh -c 'sleep 20 & exit 0') now ends as vault.secret_store_timeout at the deadline. Tests cover that case and a normal exit that returns its whole output.
3. status reports the daemon's store. A new local-only _acpmux/vault_status returns {store} from the daemon's own selection. machine vault status reads it from the daemon, and falls back to the CLI's own probe only when no daemon is running or the daemon is too old to answer. The protocol IR and the generated web methods are updated, and the method is listed under machine.vault.pull.v1.

Panic ratchet. The ratchet job on #33638 (run 41682517900) was already red on base: acpmux indexing_slicing was 714 > 686 on #34058's run, plus non-deny counts across many crates this code doesn't touch. #33638 added 1 indexing hit and 9 arithmetic hits on top of that. This PR removes every ratchet hit in the vault code: it replaces Value indexing in cli/host_vault.rs with .get(), and uses saturating or checked arithmetic in vault/wire.rs, vault/store.rs and vault.rs. The base's other hits are not ours and are left alone.

Checks (fleet cmux-ci, job 5fbfeade7bc49191ce418e35):

• cargo test -p acpmux --lib vault, protocol_ir, capability and host_vault tests: 55 passed.
• cargo clippy -p acpmux --lib --bins --tests: clean in the touched files.
• The ratchet's lint set over vault* and cli/host_vault.rs: no hits.
• tests/test_send_path_caps.py: OK.

No value is printed, logged or put in argv.

Agent session: agent session

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes the follow-ups from the vault pull review (#33638): pulling and forgetting against an older daemon no longer retries and fails twice, output reads from store commands are bounded by the command deadline, and machine vault status reports the store the running daemon uses.

Changes

• A running daemon answering method-not-found is not asked again; without a usable OS store the command refuses with vault.daemon_outdated and tells you to run acpmux daemon restart.
• capture_until hands output back through a channel and waits only until the deadline, so a descendant keeping stdout open ends as vault.secret_store_timeout.
• New local-only _acpmux/vault_status returns {store} from the daemon's own selection, with fallback to the CLI's own probe when no daemon runs or it is too old; protocol IR and generated web methods are updated.
• Replaces Value indexing with .get() and uses saturating or checked arithmetic in vault code, clearing this PR's panic-ratchet hits.

^{Written for commit c653b99. Summary will update on new commits.}

[teamleaderleo]

Owned by an agent session · session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review c653b99: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34190 -f ref=fix/acpmux-vault-followups -f platform=macos -f backend_mode=local

Gallery before/after for c653b99: 16 states rendered, 0 images differ, 3373 more touched states not rendered. Images are in the run's artifact, not on this public PR; the independent review of this head reads them on its own, so the PR needs no hand-made screenshots of these states.

gh run download 41717349770 -R manaflow-ai/cmux -n gallery-advisory-34190-c653b99ae3716d7c8c0ec080dffae7576a46b0d9 (then read gallery-review.json)

States

State	Theme	Status	Diff	Picked by
agent-pane.live-chat-watch/choice-alone	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/choice-alone	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/view-only	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/take-over-refused	Apple System Colors Light	unchanged	0%	imports methods.ts (1 hops)
agent-pane.live-chat-watch/take-over-refused	Apple System Colors	unchanged	0%	imports methods.ts (1 hops)
agent-pane.approval-edits/single	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-multiedit	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-multiedit	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-multiedit	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-multiedit	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-long	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/single-long	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-long	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.approval-edits/grouped-long	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-in	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/signed-out	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/expired	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.auth-health/unknown	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/standard	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/standard	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide-blocks	Apple System Colors Light	unchanged	0%	imports methods.ts (2 hops)
agent-pane.chat-width/wide-blocks	Apple System Colors	unchanged	0%	imports methods.ts (2 hops)

_{Pick other states with a Gallery: entry.id, entry.id/variant line in the PR body.}

web and size checks: green

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4173568006501 (cb6b71feab)
• cmux NEXT nightly 1.0.0-nightly.4173689456801 (4c71330ed9)
• cmux NEXT nightly 1.0.0-nightly.4173805520001 (cf0fddef88)

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger (main.Workflow Tests.test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger)/ test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger (main.Workflow Tests.test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high, next-review, since=20261103T202138Z): SHIP at 8003f9f

SHIP at 8003f9f

Visual verdict: unchanged by this diff.

1. [P2][follow-up] cmux-tui/crates/acpmux/src/cli/host_vault.rs:216 — status_cmd now calls daemon::connect(false) without a deadline. If a stale daemon socket accepts connections but never answers initialize, machine vault status can hang indefinitely. Bound this connection/request or use the existing bounded running-daemon connector.

Follow-ups:

• [P2][follow-up] Bound the daemon connection used by store_kind.

[teamleaderleo]

Review (codex gpt-6-astra high, next-review, since=20261103T210538Z): SHIP at c653b99

SHIP at c653b99
Visual verdict: unchanged by this diff

No actionable findings. All 16 supplied image pairs are identical; Rust tests could not run without Cargo, and the Python guard requires Git metadata absent from this snapshot.

Follow-ups: none