[lawrencecchen]

Part of #32408. Fixes the biggest O(session) writer that the classic-import stall still had: each workspace create journaled every workspace.

Cause

WorkspaceCommitIntent::apply (the legacy workspace commit, used by create-workspace, rename, move and close) wrote its rows only when they changed. But its journal record came from normalized_workspace_resource_deltas, which restated every live workspace: an upsert of each one with its name, index, focus and name provenance. So one create journaled the whole workspace list, every session.events subscriber got it, and the record's WAL bytes grew with the session. This path does not use the public fold's pruning (prune_stated_topology_deltas) that the effect paths use.

Measured with the registry WAL frame counter (#34225) on aws-m4pro-7. The create command's own commit took 542 KB per create at 50 workspaces and 3434 KB at 500 (diag step 6f2a2544). In the 512 import, 931 session.events items restated every workspace (up to 1 MB each).

Fix

The commit reads each live workspace's current stored value (name, position, name source and revision) before it rewrites the rows. It then upserts only the workspaces whose value changes: a new one, a rename, an index move, or the focus moving to or from it. Deletes are as before. A create at the end states 1 or 2 workspaces.

This follows R-DURABILITY DESIGN rule C2 (one change, one record of the change's size) and R-DAEMON-STATE rule R5 (every op O(changed)). R-DAEMON-STATE asked me to fix this in my own PR (STATUS 9955) and reviews it for fit with its S3 writer plan.

Regression test

cmux-tui-core mux::tests::workspaces::a_workspace_create_journals_only_the_workspaces_it_changes: 40 workspaces, then one more. That create may journal at most 2 workspace upserts. The journal, replayed from revision 0, must state every workspace's name, index and focus exactly as the session snapshot shows them.

• Red at the test commit 3d16da2 (Actions run 41703378498): one create at 40 workspaces journaled 41 workspace upserts.
• Green at the fix f816caa (run 41703378227).
• fmt green (run 41703603154). Full cmux-tui test suite and clippy at the fix: RESULT (runs 41714755892, 41714755377; the first runs were cancelled by Blacksmith during setup).

End-to-end (macOS, aws-m4pro-7): WindowStateBytesPerCreateTests measures all registry bytes per create, at 50 and 500 workspaces.

	50 workspaces	500 workspaces	ratio
feat (step f80161b0)	762 KB	3798 KB	4.99x
this fix + the counter (step 2b192246, branch wcd-e2e)	418 KB	577 KB	1.38x

The test still fails its 1.10x bound. The rest of the growth is the app's whole-document window-state save, which R-DURABILITY stage S-WS removes next. The end-to-end bound stays as it is.

Observed / Not run

• Observed: the runs and steps above.
• Not run: macOS cargo test of cmux-tui-core (the Mac lane split). The 512-import before/after pair runs after S-WS, so the import sees both fixes.

Changelog

• Fixed: making a workspace in a large session no longer writes (and streams to every client) a record of every workspace.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Fixes workspace creation so it no longer journals every workspace in the session. Each create-workspace commit previously wrote an upsert for the entire workspace list, making the journal record and WAL bytes grow with the session size (542 KB per create at 50 workspaces, 3434 KB at 500). Now the commit reads each live workspace's stored value before rewriting rows and upserts only what changed: a new workspace, a rename, an index move, or the focus moving to or from one.

Adds a regression test that creates 40 workspaces then one more, asserting the create journals at most 2 workspace upserts and that folding the journal from revision 0 still reproduces every workspace's name, index, and focus as the session snapshot shows.

^{Written for commit f816caa. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review f816caa: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34226 -f ref=workspace-commit-deltas -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: green on the base b192896; do not merge until green; see lane-rules

[blacksmith-sh]

Found 8 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpof4xnehg/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpyp8ttw08/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)/ test_every_compile_job_names_its_warm_sources (main.ThisTree.test_every_compile_job _names_its_warm_sources)	View Logs
test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger (main.Workflow Tests.test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger)/ test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger (main.Workflow Tests.test_the_attestation_reserves_budget_and_its_retry_shares_the_ledger)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high, next-review, since=20261103T205956Z): BLOCK at f816caa

BLOCK at f816caa
Visual verdict: no images; Leo tries the build

1. [P1] [blocking] workspace_registry.rs:4562: Preserve upserts for presentation changes. commit_workspace_presentation also uses this path, but changing only color, icon, or title leaves every compared field unchanged. The upsert is dropped before decorate_changes adds the updated presentation fields, so session.events subscribers retain stale metadata. The separate presentation record has no resource revision and is excluded from that stream. Ensure the affected workspace is emitted and verify state::tests::raw_metadata_and_pin_commands_publish_the_same_state_on_session_events, which already checks this behavior. Cargo was unavailable here, so I could not run it.

[lawrencecchen]

Review (claude-reviewer-rds-owner): FIX at f816caa
reviewer-session: 5a34cc33-d578-427a-94d1-ae7dd178dd23
author-session: a750874ea881f5bfc
R9: pass | plans/cmux-next/layer-ownership.md row "Layout: workspaces, screens, columns, panes, tabs, groups, pins, names, colors" (Rust; single writer: the workspace store, cmux-tui-core::state; v2 ops + state events; store registry + journal). The PR changes only which upserts that writer journals for a legacy workspace commit. It adds no writer and no Swift or TypeScript copy, so there is still one writer.
perf claim: a create journals 1-2 workspace upserts instead of every workspace (before: 542 KB per create at 50 workspaces, 3434 KB at 500); end-to-end registry bytes per create go from 762 KB to 418 KB at 50 and from 3798 KB to 577 KB at 500, still above the test's 1.10x bound.

I read the code at f816caa (git show, gh pr diff) and the CI logs. I built and ran nothing.

Must fix

1. A metadata commit no longer journals the workspace whose title, color or icon it changes.
workspace_commit_intent.rs:231-254 reads stated before the extra write. workspace_registry.rs:4562-4569 then skips each workspace whose name, position, provenance and focus did not change. commit_workspace_presentation (workspace_registry.rs:3471-3501) commits an unchanged registry and writes only the workspace_presentation row, in extra. That row supplies extra.title, extra.color and extra.icon of the journaled workspace value (state/values.rs:39-71). The comment at workspace_commit_intent.rs:248-249 says the restated workspaces carry these fields; after this PR, the changed workspace is not restated at all.

Failure: set-workspace-metadata with color: "red" on workspace K commits a resource revision with changes: []. Before this PR, that record restated K with extra.color: "red". A closed workspace that is reopened with its color, icon or title has the same problem (state/closed_history.rs:1127-1153 calls set_workspace_metadata). session.events streams, resource_events_after pages, journal checkpoints and SDK clients never get the new value. The app sidebar still shows it, because it reads these three fields from the raw tree.

state::tests::raw_metadata_and_pin_commands_publish_the_same_state_on_session_events (state/tests.rs:1619-1648) covers this exact case. It expects K's upsert with extra.color == "red" at line 1644. Reading the code, it should fail on this head; I could not run it here. No CI lane has run it on f816caa: the green run 41703378227 ran only the new test, and the full-suite run 41714755892 was cancelled.

The loss persists. The public fold catches up from the journal, so it keeps K's old value. A later projection restates K without presentation fields (full_projection.rs:145-155). Without extra.key, that value equals the stale folded value (public_fold.rs:63-64), so prune_stated_topology_deltas drops it as well. K's color stays absent from the journal until K's name, index or focus changes. When the fold is at head, the debug cross-check (projection_crosscheck.rs:77-86) can report K, and in test builds it panics (scoped_projection.rs:201-204).

Fix: when an extra write runs, always upsert the commit's workspace_key workspace. Do not restate every workspace when extra is present: the classic import pins each workspace through set-workspace-metadata (AppOnboardingServices+ClassicMigration.swift:434), so that would bring back an O(session) record during the import.

2. The rows are not always what the journal states, so a row diff can skip an upsert the journal needs.
I agree that the row diff must be replaced by a comparison with what the journal states (the public fold). I checked the three paths you named:

• A project_resource: false commit (commit_for_resource_effect, resource_effect_commit.rs:12-69) writes rows with no journal record; its effect journals later. A staged close (tree_close.rs:231-245, used by layout apply in apply_layout.rs and by the interrupted-creation rollback at creation_settlement.rs:415) rewrites the position of every later workspace. A legacy rename or metadata commit takes only the registry lock, not the creation fence, so it can run before the effect's record (or after an effect that never commits). That commit sees those positions as already stated and skips the shifted workspaces. The base restated them.
• set_resource_workspace_order (resource_store.rs:4026-4065) writes positions for the resource paths, and those paths journal their own fold-pruned deltas. The row diff assumes that each of these writers journaled every position it wrote. In the base, the next legacy commit corrected any miss; on the head, a miss stays.
• At every open, migrate_workspace_name_authority (workspace_name_store.rs:47-52, called from workspace_registry.rs:2944) changes a never-renamed workspace-N from user to auto in the rows, with no journal record, so the journal keeps name_source: "user". In the base, the next legacy commit restated it as auto. The head sees (auto, 0) on both sides and skips it until a rename. The older-daemon trigger (workspace_name_store.rs:33-42) has the same effect. One more path of this kind: initialize_compatibility_active_workspace (workspace_registry.rs:4391-4414) seeds meta active_workspace_id at open with no record, and was_active reads that meta key.

The fold version must meet two conditions, or it repeats these defects:

• Compare the value that the journal will state (the decorated value), not the raw upsert. For a workspace with no presentation yet, the raw upsert equals the folded value without extra.key (public_fold.rs:63-64). The first color set through set-workspace-metadata would then be pruned: defect 1 again.
• Seed the fold and keep it at head from this path. Legacy commits never call record_public_fold, and an unseeded fold prunes nothing (public_fold.rs:94). So a session with no full projection since open (for example, an import that only creates workspaces) gets no gain. Do not seed the fold from a restatement of workspaces only: the cross-check reads screen, pane and tab values from it.

3. Clippy fails because of this PR.
mux/tests/workspaces.rs:554:59 fails unused_qualifications (serde_json::Value must be Value). This failed in the CI clippy run 41715114470 on this head and in hq run 41714755377. The other red checks (Script tests, the release-notary guard, fast-gates "resolve head and base") are in files that this PR does not change.

Points 1 and 2: what the diff compares

• session_id does not change, and active_screen is not part of the workspace value. Name provenance is compared.
• The decorated fields are not compared: presentation (defect 1), the ephemeral flag and home kind from workspace_state, the agent folder, and the key. Of these, a legacy commit with stated set can write only the presentation. The ephemeral flag and kind are written only by staged project_resource: false commits, where stated is None. The agent folder is written only on the state path.
• focused uses the correct "before": was_active is meta active_workspace_id, read at prepare while the registry is held, and every writer of meta that journals also states the focus in the same transaction. The exception is the open-time seed (defect 2).
• Tombstoned rows are filtered out, and their deletes still come from before.active_screens. A NULL position compares as changed. A staged create has no resource_workspaces row, so it is not in stated. Each of these cases falls back to an upsert, so they are safe.

Point 3: consumers

I found no reader that treats one workspace batch as the full list, or that gets the order from sequence:

• The Swift mirror applies each change by id (SessionStreamItem.swift:268-271, SessionStateMirror.swift:116-126).
• cmux agents events handles each change separately (cli/agents/events.rs:467-476).
• The checkpoint reducer folds upserts and sorts by index (journal_checkpoint.rs:793-803).
• The Python SDK parses sequence and does nothing else with it. I did not check every SDK.
• prune_stated_topology_deltas and drain_pending_changes already renumber sequence.
• iOS and the mobile core do not read these records.

A move or a close restates every workspace whose index changes, because each shifted row's stored position differs from its new index (workspace_rows_commit.rs:84-103). Defect 2 is the exception.

Point 4: the test

It is red at 3d16da2 ("journaled 41 workspace upserts", hq run 41703378498) and green at f816caa (hq run 41703378227, filtered to this test). It covers only a create at the end. The fold-from-start check is sound for creates: it reads one page (41 records; the page size is 1024) and is not vacuous. But it compares only name, index and focused, not extra, so it cannot find defect 1. Please add a move from index 0 to the end, a close in the middle, a rename, a set-workspace-metadata color, and a reopen after the open-time provenance rewrite. Then compare the full decorated value with the snapshot.

Point 5: fit with R-DAEMON-STATE S3

No, this PR does not keep one source for the change set. It adds a third way to decide what changed: the rows before the write, compared with the desired list. The two that already exist are the fold (prune_stated_topology_deltas, which compares with the journal) and prune_unchanged_resource_changes (which compares the patch with the rows). R5 says that a delta is the batch's change set, never a diff of two trees, and S5 makes the delta that change set.

A row diff is a weak bridge. It is correct only if the rows equal the journal and the compared columns cover the whole decorated value; defects 1 and 2 show that neither is true today. A comparison of decorated values against the fold is an acceptable bridge: it compares with the journal itself, and the effect paths already use it, so one method stays in use until S5.

What S3 and S5 should carry over:

1. The rule, as a test. A workspace batch journals exactly these workspaces: new ones, renamed ones (name or provenance), every workspace in a shifted index range, both workspaces of a focus change, deleted ones, and every workspace whose decorated fields (workspace_presentation, workspace_state, home kind, agent folder) the batch writes.
2. This regression test, extended as in point 4, as one case of the S5 property test (snapshot N plus the deltas equals snapshot N+k, compared on decorated values).
3. Decoration as part of the change set. A command that writes a table that decorate_value reads adds that entity to Tx.changes.
4. A record for each open-time migration and staged commit, so the model and the journal agree from the first batch.

S5 removes StatedWorkspaces, the fold pruning and the projection cross-check.

Point 6: cost

The new SELECT reads each live workspace once (an indexed join) and adds no journal bytes. That is acceptable for now. The same transaction already reads every live row (workspace_rows_commit.rs:47-67), and you could reuse that map. A larger O(session) read stays on this path: prepare_workspace_commit loads the full resource topology (every screen, pane and tab) into previous_topology on each create (workspace_commit_intent.rs:89-91).

Point 7: ratchets

Pass. The new product code uses ?, try_from(..).ok() and .context(..)?, and it adds no unwrap, expect, indexing, unchecked arithmetic or panic.

[lawrencecchen]

Superseded by #34959 (the fold version that R-DAEMON-STATE asked for in its FIX review). Force pushes are refused here, so it is on a new branch. This PR can close; I close it after #34959 has its review.

[lawrencecchen]

Closed: superseded by #34959.