[lawrencecchen]

#34641 and its re-pin (#34995) are on feat, so this can land. This is step B of the FFI two-step rule (STATUS 5388). It carries #31835 by @lawrencecchen, which REWRITE R-INPUT took over (lead decision, 2026-11-04; notice: #31835 (comment)). #31835 stays open for a person to close. The work is @lawrencecchen's: its commits are kept as they are, and each new commit credits him. It is the first PR of R-INPUT stage S2: one handle for focus and input.

Summary

The macOS app's focus rules leave Swift and are called from cmux-focus-core over the app FFI (rust-migration backlog A12; layer-ownership.md: Rust owns rules and input routing decisions). Step A (#31921) already landed the Rust half, and the app's pin (cmux-app-ffi-d3d3f420820f) already has every C function and reply field that this Swift half calls (checked against the pinned header: 18 functions, 30 CmuxFocusReply fields).

Swift (deleted, or a thin call)	Rust
CmuxNextDesignTokens/CloseFocus/FocusAfterClose.swift tab, openerFamily, liveOpeners, workspace	close_focus::{tab, opener_family, live_openers, workspace}
CmuxNextFocus/PaneCloseAim.swift	close_aim::PaneCloseAim
CmuxNextFocus/OmnibarFocusMemory.swift	omnibar_memory::OmnibarFocusMemory
CmuxNextFocus/InputInvariants.swift, InputInvariants+World.swift	invariants::{model, transition, step, world, expected_responder}
FocusState+TypingTab.swift (typingTab), FocusState+GhosttyAgreement.swift	FocusState::typing_tab (from the reply), Resolved::ghostty_mismatch

Behavior: no change, with the one difference #31835 named. Past its 64-tab bound, the address bar memory drops the oldest tab; the Swift Set.removeFirst() dropped one in hash order.

The feat merge (1721 commits) and why this waits for #34641

scripts/merge-main.sh --base feat-cmux-next (git 2.47) merged feat 44365e0. 0d4e198 records how each conflict was resolved:

• The six Rust conflicts take feat's side: step A landed every Rust change of this branch, and feat moved on after it. cmux-tui equals feat's tree, so this PR changes no FFI source.
• FocusState+TypingTab.swift: the computed typingTab goes (it is now the machine's rule, from its reply). Feat's awaitableContent (REOPEN-F4) and awaitsOtherTab (P0 INVERSE-KEY) stay.
• InputInvariants+World.swift is deleted, as Swift calls cmux-focus-core's focus rules; the Swift copies go (A12 step B, after #31921 and the FFI re-pin) #31835 intends, so the world check is cmux-focus-core's. P0 INVERSE-KEY (5fe33a3) put one rule in that Swift file only: a window whose focus is on its way to another tab is unsettled. focus-core: a window whose focus waits for another tab is unsettled in the Rust world check (P0 INVERSE-KEY rule; A12 step A, R-INPUT S2) #34641 adds that rule to the Rust world check, red first. This Swift half must not land before focus-core: a window whose focus waits for another tab is unsettled in the Rust world check (P0 INVERSE-KEY rule; A12 step A, R-INPUT S2) #34641 and its re-pin, or the live input monitor would file a W1 desync on every Ctrl-T or Ctrl-` from a Chromium page.
• A semantic conflict with no textual conflict (ff7d600): INVERSE-KEY's FocusMachine.reapplyingOnWaitChange took and returned the old (changed, effects) pair, while A12 widened send's result to Reduction (with the omnibar flags). It now takes and returns a Reduction, with the same behavior.

Takes back #31265: the input invariants it moved into CmuxNextFocus (InputInvariants+World.swift, InputInvariants.swift) now run in cmux-focus-core. The Swift code becomes calls, which is the A12 move this PR carries.
Takes back #32769: its rule in InputInvariants+World.swift (a window waiting for another tab is unsettled) moves to the Rust world check in #34641, which lands first, and its FocusMachine and FocusState changes stay (ff7d600).

#31835's 12 red checks, compared with the base

All ran on its old head 151151d (2026-11-02):

• cmux-next/compile, cmux-next fleet Release compile, cmux-next swift test, cmux-next fast tier, cmux-next generated files (shared build), cmux-next daemon tests (same-tree): its own. The Swift half called cmux_focus_pane_moved and cmux_focus_frame_presented, which its pin at that time (8b62425, from before step A landed) did not have. The pin on feat has them now, so the merge removes this cause. The new head's compile is on this PR's CI and the fleet.
• cmux-next checks, part "Check the app FFI pin": its own (the branch carried the Rust half). Gone: cmux-tui equals feat.
• risk evidence: its own: it took back base red: arch app_lines, move the input invariants out of CmuxNextApp into CmuxNextFocus (margin) #31265's change with no reason. The Takes back lines above clear it.
• tooling-tests, nightly-guards / Guard status, nightly-guards / workflow-guard-tests / release-notary: base findings (test_download_prints_the_active_profile_only: "no ACTIVE profile named 'cmux NEXT Developer ID'").
• next-autoland / verdict: a wrapper over the others.

Line accounting

python3 -I scripts/cmux-next/swift-logic-lines.py --repo . --rev REV --json:

Rev	CmuxNextFocus logic / mirror	CmuxNextDesignTokens logic / mirror
base 44365e0	519 / 378	1839 / 1936
head ff7d600	67 / 382	1839 / 1820
change	-452 / +4	0 / -116

Tests

The Swift tests of these types became the Rust corpus in step A (cmux-tui/crates/cmux-focus-core/tests/focus_rules, filter ported::). OmnibarFocusMemoryTests and PaneCloseAimTests are deleted here, because their cases are in that corpus.

Fleet compile check at ff7d600 (cmux-ci compile-check --app --package CmuxNext, job 616c5c6bc8b330bcf99270d9): passed. CmuxNext, the app and cmux-tui are ok: true, with 0 errors. It compiles against the current pin, because every C call is already pinned; only the INVERSE-KEY world rule's behavior waits for #34641.

After #34641's re-pin (#34995, cmux-app-ffi-2e0b6acc3593) merged, this branch merged feat with it (3d46ef9, scripts/merge-main.sh, no conflict):

• Fleet compile check at 3d46ef9 (cmux-ci compile-check --app --package CmuxNext, job ae88d00b33d75f1fc7ce369d): CmuxNext passed (375 s), the app passed (91 s).
• The 11 Swift suites that exercise these rules, on a fleet Mac (step 2fd742f616994eca487f554b, aws-m4pro-1): all passed, 47 tests: FocusAfterCloseOpenerTests 10, BrowserTabOpenersCloseFocusTests 5, GhosttyFocusAgreementTests 2, ChromiumPageFocusInvariantTests 2, FocusWaitLeavesPageTests 2, CloseTabKeepsPaneTests 5, CmdWEmptiedSplitPaneLeavesInItsTurnTests 4, ClosedPendingSplitFocusTests 2, RapidCloseTabTests 2, OmnibarFocusParityTests 9, OmnibarFocusClickSelectionTests 4. The step ran without a display.
• The four suites that read typingTab (the reviewer asked for them), step 6e31c3cebe1932c775e178aa on aws-m4pro-8: all passed, 23 tests: CreationInputHoldTests 11, HomePendingTerminalFocusTests 4, CmdNThenCreateKeysTests 2, CloseThenTypeKeysTests 6.
• Independent review: SHIP at 3d46ef9 (Swift calls cmux-focus-core's focus rules; the Swift copies go (A12 step B, carried from #31835; R-INPUT S2) #34685 (comment)). Its non-blocking points: FocusMachine.swift is 477 lines (cap 400, warn ceiling 480), so the four close-aim calls move to FocusMachine+CloseAim.swift in a follow-up; a wire-shape mismatch would make the debug world check report every window unsettled without a reason (the pin check prevents a mismatch).

Observed / Not run

• Observed: the prepush gate (no new violations), the pinned-header check above, the line accounting, the compile check, the 11 suites and the 4 typingTab suites above.
• Not run: a display run of these suites, and the perf A/B of the per-close and per-press calls that Swift calls cmux-focus-core's focus rules; the Swift copies go (A12 step B, after #31921 and the FFI re-pin) #31835 planned.

Changelog

none

No capture: no visible change; the focus rules move from Swift to Rust with the same behavior.

Co-authored-by: Lawrence Chen 54008264+lawrencecchen@users.noreply.github.com

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review 3d46ef9: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr34685 -f ref=fix/r-input-s2-a12-focus-rules -f platform=macos -f backend_mode=local

red: cmux-next checks (god files, concurrency, crash safety, l10n); NEW: red check: Base-red classifier (per test) (+1 more) is not red on the base 4a17e97; do not merge until green; see lane-rules

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4182499138501 (e0aa712b3b)
• cmux NEXT nightly 1.0.0-nightly.4184087390301 (08052d331e)
• cmux NEXT nightly 1.0.0-nightly.4184224384601 (a3abfc4160)
• cmux NEXT nightly 1.0.0-nightly.4184409870901 (78ee0e108e)

[blacksmith-sh]

Found 6 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpqqe8_6ph/summary-fail.json (live):/summary-fail.json (live):	View Logs
/tmp/tmpx6mux49x/summary-missing.json (live):/summary-missing.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[lawrencecchen]

Review (independent subagent, correctness first): SHIP at 3d46ef9
perf claim: none
R9: pass

Scope: the PR's own diff against its merge base 4a17e97 (18 files, +293/-709, no Rust file), the merge 3d46ef9, ff7d600 against 5fe33a3 and fc12029, the fleet evidence and the checks on this head. Read only. I did not build or run anything.

Behavior equality (Swift copy against cmux-focus-core)

I compared each deleted or thinned Swift rule with its Rust rule, branch by branch. I found no rule that the Swift copy had and Rust does not have.

• FocusAfterClose: tab, opener_family, live_openers, workspace and neighbor in close_focus.rs match the deleted Swift line for line. IDNumbering maps nil and out-of-range answers to nil (UInt32.max is the wire's "none"). The deleted neighbor, resolve and openerFamily have no Swift callers left.
• PaneCloseAim: close_aim.rs pane_moved, presented, pane_emptied and aims_at_emptied_pane match the deleted Swift: the hold, the repeat rule, focused == pane, the from/to filter, and presented_at against press.time. The machine's pane equals the old reduced.pane at each call: paneMoved runs in the drain's defer, and aimsAtEmptiedPane runs reducePendingTopologies() first, as currentState() did. Every caller goes through FocusCoordinator (TabLifecycle.swift:398 included).
• OmnibarFocusMemory: the Rust is_return events are the same 7 (SelectTab, FocusPane, Topology, Expect, DragEnded, OverlayClosed, WindowKey). The return event is the same (FocusTarget AddressBar Programmatic). set_topology notes the reduction as a return path. take_return runs before the reduction and note after it, as in the coordinator loop before. One change: past 64 tabs, the oldest tab goes (the Swift Set.removeFirst() took one in hash order). The PR body discloses it. It is an improvement.
• typingTab: Rust FocusState::typing_tab is the old computed rule (the expectation's tab, else the terminal tab). read() refreshes state.typingTab only when changed != 0 || ok == 0. That is safe: the FFI Summary compares the expectation and derived (resolved included), so changed is 1 whenever an input of typing_tab changes. restore() reads cmux_focus_current, which writes changed 1. No code reads typingTab from a state that the machine did not fill. CreationInputCoordinator.swift:301 edits a local copy for a key context only and does not read typingTab.
• InputInvariants: Rust model, transition, content, expected_responder, key_window (W5: every branch and detail string), overlays (W6), context (W7) and world match the deleted Swift, including the top-page skip and the P0 INVERSE-KEY rule (a window whose focus waits for another tab is unsettled, is_settled). +Routing.step is now reduction (Rust model(new) + transition) + routing, the same sum as before. The base did not emit F8 either.
• Wire shapes: the Rust Invariant serde names (F1-F6, T1-T3, W1-W8) all exist as Swift InputInvariant raw values. Violation is {invariant, window?, detail} on both sides. The Swift synthesized Codable shapes of FocusEvent (every case), Responder, DragOutcome, Expectation, Target, Resolved, Overlay, FocusTopology and KeyWindow match the Rust serde shapes. Rust uses no deny_unknown_fields, so the extra Swift fields (typingTab, appActive, isDragging and others) do no harm. DebugRequest and DebugWindow match DebugWindowRequest and DebugWindowResponse. The FFI test the_invariant_operations_answer_in_the_apps_shapes pins all three operations.
• GhosttyAgreement: Resolved::ghostty_mismatch gives the same two strings. GhosttyFocusAgreementTests passed on the fleet.

ff7d600 against 5fe33a3 and fc12029

• 5fe33a3: reapplyingOnWaitChange has the same rule (no moveResponder yet and awaitsOtherTab changed: changed true, add moveResponder(state.resolved)). The new version keeps omnibarReturn and returnsToOmnibar from the result. waited is still read before read() updates the state. The topology path calls no re-apply, as before. A queued address bar return cannot change awaitsOtherTab (a programmatic focusTarget changes neither the tab nor the expectation), so the omnibar flags and the re-apply do not interact.
• fc12029 does not touch FocusMachine.swift. Its FocusEvent.isPersonsOwn and FocusCoordinator.personIntents (FocusCoordinator.swift:68 and :81) are intact. Its typingTab read at the capture site now gets the stored value, which follows the same rule.

The merge 3d46ef9

It is clean. Only plans/cmux-next/swift-logic-classes.tsv changed on both sides, and the hunks do not overlap. An automatic re-merge gives the same blob. There is no evil merge: the patch-ids of both sides match. The other 17 files equal ff7d600. I also merged this head into the current feat tip aeca627 with git merge-tree: no conflict.

Evidence

• Compile check ae88d00b33d75f1fc7ce369d at the exact head: CmuxNext ok (374.8 s), app ok (91.2 s), cmux-tui ok.
• Suites step 2fd742f616994eca487f554b on aws-m4pro-1 at the exact head: all 11 suites passed, 47 tests, 0 failures. The per-suite counts match the PR body.
• Perf: no A/B is necessary. frame_presented runs once for each move of the focused pane (FocusCoordinator.swift:93 guard, then paneMoved, then a one-shot CommitBoundary().after with no repeat). It never runs per frame, and Rust ignores a stale or second stamp. The typed C calls run where the Swift code ran (per close, per Close Tab press, per pane move). JSON runs only in debug tooling (the DEBUG monitor 200 ms after input stops, debug.focus, debug.desync, journal replay). For each reduction, the Swift omnibar set work goes, and one optional string decode comes in, only when the reply changed. The key path now reads typingTab as a stored property. The diff touches no perf-hot function. The PR makes no perf claim, so R10 needs no measurement.

Reds on this head

• cmux-next checks (god files, concurrency, crash safety, l10n): base finding. Its two failing parts are "No fleet host names in gallery fixtures" (webviews/src/agent-session/acpmux/subagents/SubagentTray.gallery.ts:168) and "Base-red classifier (per test)" (tests/test_base_red_excuse.py refuses the if of job portable-placement in .github/workflows/ci-guards.yml). The PR touches neither file. The same two parts fail on the feat-cmux-next push run at 8281fc7 (job 126468750915). The warn-only parts are scrollbars (files outside this PR) and the god-file warning for FocusMachine.swift (nit 1 below).
• cmux-next fast tier and cmux-next swift test: pending. They do not hold the PR.
• On the feat tip only: "Check the app FFI pin" is red from R-INPUT S2a: the input router reduces each window's focus as the app's focus handle does (WindowFocus), Rust only #34929 (358a445, Rust-only S2a, waiting for its re-pin). It is not this PR's red. R-INPUT S2a: the input router reduces each window's focus as the app's focus handle does (WindowFocus), Rust only #34929 changes no header, no extern function and no repr(C) field. After the merge, the FFI still fills omnibar_return, returns_to_omnibar and typing_tab, so this Swift half stays valid on the current pin and after the re-pin.

Credit

The 14 commits from #31835 keep lawrencecchen as author (151151d is a cmux-bot merge). The new authored commits 0d4e198 and ff7d600 carry Co-authored-by with his commit email. 3d46ef9 is a merge-main merge with its trailers. #31835 is OPEN. The PR body has the Takes back lines for #31265 and #32769, ### Observed / Not run, ## Changelog none, and a No capture: line. risk:normal is the correct tier.

Nits (none blocks)

1. FocusMachine.swift grows from 440 to 477 lines (Swift cap 400). The CI god-file step warns, and the file is now 3 lines below the hard ceiling of 480 (slack 20). Fix: move the four close-aim C calls (paneMoved, framePresented, paneEmptied, aimsAtEmptiedPane) into FocusMachine+CloseAim.swift, with handle made internal, or into PaneCloseAim.swift.
2. Evidence gap: the suites step did not run the creation-hold suites that read typingTab (CreationInputHoldTests, HomePendingTerminalFocusTests, CmdNThenCreateKeysTests, CloseThenTypeKeysTests). The code reading above shows the same behavior. One fleet run of them at this head closes the gap. The pending cmux-next swift test can also cover them.
3. On an FFI wire mismatch, InputInvariants.world reports every window unsettled. In DEBUG, assertionFailure stops first. A release debug.desync call shows only "unsettled", with no cause. The pin check prevents a mismatch, so this is acceptable. Optional: name the refusal in the result.
4. The PR is still a draft. Mark it ready before you add ready-to-land.

[cursor]

Bugbot needs on-demand usage enabled

Bugbot uses usage-based billing for this team and requires on-demand usage to be enabled.

A team admin can enable on-demand usage in the Cursor dashboard.

[lawrencecchen]

REWRITE R-INPUT: the red parts of cmux-next checks on head 3d46ef9 are base findings, in files this PR does not touch:

• "Scrollbars thin, one style": 12 hits over the ceiling of 10 (also red on focus-core: a window whose focus waits for another tab is unsettled in the Rust world check (P0 INVERSE-KEY rule; A12 step A, R-INPUT S2) #34641, R-INPUT S2a: the input router reduces each window's focus as the app's focus handle does (WindowFocus), Rust only #34929, cmux-next: pin CCmuxAppFFI to cmux-app-ffi-2e0b6acc359319c06eddc608d50e84895de41cc7 #34995).
• "No fleet host names in gallery fixtures": SubagentTray.gallery.ts:157 (the same on the feat push 8281fc7). ci(cmux-next checks): clear base reds (fixture host name, rollup placement job) #34979 fixes it.
• "Base-red classifier (per test)": test_test_reds.py (base_red_excuse / derive_rollups), the same on feat. ci(cmux-next checks): clear base reds (fixture host name, rollup placement job) #34979 fixes it.

Independent review: SHIP at 3d46ef9 (#34685 (comment)). The 11 focus suites (step 2fd742f616994eca487f554b) and the 4 typingTab suites (step 6e31c3cebe1932c775e178aa) passed on the fleet; the compile check (job ae88d00b33d75f1fc7ce369d) passed.