[teamleaderleo]

Summary

Moves the pure NEXT tab-drag index conversion and drop-reveal policy into the existing app FFI crate, with no Swift call-site changes. The API accepts caller-owned UInt32 tab ids, preserves Swift clamping and same-pane wire-index rules, and maps every TabDragOutcome explicitly to reveal flags.

This is the prerequisite Rust-only step for the later TabDrag consumer shards. Reverting this PR leaves the existing Swift implementation unchanged.

Validation

• Added Rust unit coverage for same/cross-pane wire indices, clamped pane/group indices, null-array rejection, representative reveal outcomes, and reveal guards.
• git diff --check passed.
• Fleet check at 98f47e48ba366fbf7baf5021903132d2fe914047: run 41759609604, checks job 126345277544 passed cargo fmt --check, Clippy with -D warnings, and all 84 tests in the standalone FFI crate, including four tab-drag tests. No local build was used.
• The previous own CI failure was two missing FFI # Safety sections; both are fixed and the same Clippy command is green at this head.

Performance

Metric	Before	After	Delta	Harness
Migrated rule families covered by Rust tests	0	4	+4	cmux-layout-reducer-ffi test target

No runtime benchmark is claimed: this step only adds pure decision APIs and preserves the current Swift behavior until its consumer shards land.

Changelog

none

Source-only release order

This prerequisite adds four Rust/C entry points and a direct CCmuxAppFFI target dependency. No Swift source imports or calls the new symbols in this PR, so the currently pinned binary continues to build and behave as before.

The release sequence is mandated by docs/ci/app-ffi-release.md: source lands on feat-cmux-next, .github/workflows/app-ffi-release.yml publishes the landed SHA, then its generated app-ffi-repin PR updates the URL and real checksum. That workflow runs only at refs/heads/feat-cmux-next and its protected release environment accepts only that branch. The source-freshness check is expected to report the intermediate drift. This lane owns the release and generated pin through merge; the two Swift consumer shards wait for that pin.

Please evaluate the prior review's pin finding against that documented two-stage publication order; no consumer uses these symbols before the matching binary exists.

🤖 Generated with Codex

Agent session: agent session

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Adds the NEXT tab-drag index conversion and drop-reveal policy to the app FFI crate, with no Swift call-site changes. The API takes caller-owned UInt32 tab ids, keeps Swift clamping and same-pane wire-index rules, and maps every TabDragOutcome to reveal flags. CmuxNextBridge now links CCmuxAppFFI to reach the new entry points. Reverting this change leaves the existing Swift implementation unchanged.

Validation

• Added Rust unit coverage for same/cross-pane wire indices, clamped pane/group indices, null-array rejection, representative reveal outcomes, and reveal guards.
• Negative index values are preserved against Swift's wider Int64 before clamping, and each non-empty array pointer carries an explicit validity contract.

^{Written for commit 98f47e4. Summary will update on new commits.}

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 98f47e4: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34507 -f ref=lane/tab-drag-rust-ffi -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: Check the app FFI pin is not red on the base 1bfb47c; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4177134165301 (4a7517355a)
• cmux NEXT nightly 1.0.0-nightly.4177399658201 (443d56f95d)
• cmux NEXT nightly 1.0.0-nightly.4177479261801 (0df62819ad)

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): BLOCK at 1dbf47d

BLOCK at 1dbf47d

Visual verdict: unchanged by this diff

1. [P1][blocking] The new FFI code is not included in the pinned CCmuxAppFFI binary. Package.swift:178 still pins release d3d3f420…, while cmux-layout-reducer-ffi/src/tab_drag.rs changes a crate reachable by cmux-app-ffi. The existing check-app-ffi-pin.sh gate will therefore fail, and the shipped binary will not export these symbols. Publish a matching app-FFI release and update its URL/checksum before landing.

[teamleaderleo]

Review (claude opus 5.5 medium): SHIP at 98f47e4

Visual verdict: unchanged by this diff. No UI code or Swift consumer calls change.

Compared the Rust/C implementation line by line with the production Swift index and reveal rules. The terminal fleet run 41759609604 / checks 126345277544 supplies fmt, Clippy -D warnings, and 84 passing tests; the reviewer did not execute tests.

The old-head pin BLOCK is resolved by the documented additive-source publication order in docs/ci/app-ffi-release.md: landed source → release → generated pin. The release runs only on feat-cmux-next, and this PR adds no Swift imports or calls to new symbols. Existing behavior and linkage keep using the pinned binary until the pin moves. No blocking source finding.

Follow-ups:

• Check Bridge-dependent test targets on the fleet for duplicate Rust runtime linkage.
• Complete the owned release and generated-pin merge before either consumer shard lands.
• Consumer shards must use one lossless String interner per call, explicit UInt8 flag conversion, and exhaustive outcome mapping.
• Clarify the header's null-pointer error sentence so it names only pointer-taking index functions.

Reviewed by a separate Claude Opus 5.5 medium session from immutable base/head diff and source objects. The final source head is unchanged after review.

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmp08_ioi5f/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmp624t_wze/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}