[teamleaderleo]

Follow-up to #35159 (the per-machine restore-or-install choice). That choice needs a cold install measured on this machine, so a new Cloud machine always restored, even where its archive is slower to fetch than the install it replaces (bun on a fast link).

This stores a small timing record next to each archive when it is first uploaded: the uploader's cold install time and the archive size, under its own derived key in the same ecosystem. A machine with no local record fetches it (one small request) and decides with Stats::choose_from. If there is no record, it restores, as before.

• remote.rs: Meta, meta_key, fetch_meta (capped at 4 KiB), store_meta.
• warm.rs: the lookup when there is no local cold record. The background machine deps upload gets a new --cold-ms flag and stores the record after an archive is created, and so does --upload-now.
• stats.rs: choose_from, plus ACPMUX_DEPS_LOCAL_STATS=off so the bench can act as a new machine.
• detect.rs: KEY_VERSION becomes v2, so archives from before the timing record don't restore without one.
• deps-bench.sh: a third round per ecosystem, <eco>Fresh, that runs with local stats off.

The expected restore now also counts the install after it. The bench showed Cargo restoring on a fast link (1.15 s fetch + 0.13 s unpack + 1.67 s cargo fetch --offline = 2.98 s) and losing to its 2.75 s cold fetch, because the choice ignored the offline fetch. Stats::after_restore_ms uses this machine's measured share per ecosystem (learned after each restore) or a default share of the cold install (Cargo 0.65, npm/pnpm 0.5, uv 0.3, yarn 0.1, bun 0.05). Mid-download give-up (too_slow) counts it too.

bench=deps-slow failed on the runner kernel ("Specified qdisc kind is unknown": no netem). The prepare step now tries modprobe sch_netem. If netem is still missing, it installs scripts/cmux-next/delay-proxy.py, a local CONNECT proxy that delays each chunk 75 ms each way. The bench routes every tool's HTTPS through it (HTTPS_PROXY), and the evidence records link and proxyHosts.

Cost: on a machine with no local record, the first warm of a key makes one extra small GET.

Risk: normal. No secrets are involved: the record holds two numbers.

Agent session: agent session

🤖 Generated with Claude Code

[teamleaderleo]

Owned by an agent session · session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review d57e786: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr35237 -f ref=lane/dep-cache-meta -f platform=macos -f backend_mode=local

web and size checks: green

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4182499138501 (e0aa712b3b)
• cmux NEXT nightly 1.0.0-nightly.4184087390301 (08052d331e)
• cmux NEXT nightly 1.0.0-nightly.4184224384601 (a3abfc4160)
• cmux NEXT nightly 1.0.0-nightly.4184409870901 (78ee0e108e)

[blacksmith-sh]

Found 9 test failures on Blacksmith runners:

Failures

Test	View Logs
/tmp/tmpazevk4aj/summary-missing.json (live):/summary-missing.json (live):	View Logs
/tmp/tmpxjufpfx3/summary-fail.json (live):/summary-fail.json (live):	View Logs
[new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows/ [new_workspaces] debug.new_workspace timed 0 of 50 new workspace rows	View Logs
[new_workspaces] the window draws no frames/[new_workspaces] the window draws no frames	View Logs
[tabs] debug.tab_switch timed 0 of 40 switches/ [tabs] debug.tab_switch timed 0 of 40 switches	View Logs
[tabs] the window draws no frames/[tabs] the window draws no frames	View Logs
nightly cmux-tui resolve/nightly cmux-tui resolve	View Logs
test_the_committed_contract_is_the_workflows (main.RollupsFromNeeds.test_the_commit ted_contract_is_the_workflows)/ test_the_committed_contract_is_the_workflows (main.RollupsFromNeeds.test_the_commit ted_contract_is_the_workflows)	View Logs
the short nightly decide gate must use the pooled Linux route with a Blacksmith fallbac k/ the short nightly decide gate must use the pooled Linux route with a Blacksmith fallbac k	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Review (codex gpt-6-astra high, router-review): SHIP at d57e786

Visual verdict: unchanged by this diff

• [P2] [follow-up] [category:reliability] [finding:F1] [outcome:pending] cmux-tui/crates/acpmux/src/deps/remote.rs:228 does not enforce the advertised 4 KiB metadata cap before downloading. Remote::fetch only invokes give_up after 300 ms, so a fast or malformed hub response can write an arbitrarily large metadata entry to the temporary file.
• [P2] [follow-up] [category:performance] [finding:F2] [outcome:pending] cmux-tui/crates/acpmux/src/deps/warm.rs:164-183,271-284 fetches metadata on every warm for a machine without a local cold record. A successful metadata-based restore records warm_ms and archive_bytes, but never persists that metadata as a known record, contradicting the stated one-extra-GET cost.

Follow-ups: