[teamleaderleo]

Follow-up 2 of #35652, from the Codex review that gave SHIP on #34604.

What it fixes

retire_finished in cmux-tui-core/src/blob_fetch.rs kept at most 32 finished fetch jobs and dropped the oldest, whether or not they had written files. Say a client dies after its fetch commits but before it saves its manifest. The only record of those files is then the job, which the next push to the folder reads through blob.fetch.cancel and status written_from. Once more than 32 other jobs finished, that record was gone, and a later push could leave behind fetched files its tree had dropped.

Now a finished job that committed at least one file is never evicted. It stays until a push forgets it (blob.fetch.forget, after its manifest names the files). Finished jobs that wrote nothing are still capped at 32. This is the second fix the issue suggested ("never evict a job that wrote files until it is forgotten"). It needs no new state on disk.

A job's written list is final once it has left Running: a cancel marks it failed and waits for any commit in progress to finish, and a commit checks cancelled under the same lock. So reading written.is_empty() while retiring is stable.

Memory: a job that wrote and was never forgotten now stays until the next push to its folder forgets it, or the daemon restarts. Each such job holds its (path, revision) list, which is what a push needs to recover.

Test

cargo test -p cmux-tui-core --lib a_job_that_wrote_is_kept_until_forgotten (hosted, ./scripts/verify-cmux-tui-hosted.sh --filter). One job writes, then 40 jobs under another folder fail with nothing written. The cancel under the first folder must still name the job that wrote, and its written list must still be readable. The 40 empty jobs are still capped at 32, and once forgotten the job goes.

• Red on the test-only commit bf296ad (run 41878247406): the cancel answered "jobs": [], but the test expects the job that wrote.
• Green on the head: the hosted blob_fetch run (result in a comment below).

Observed / Not run

• Observed: the red above, from the hosted run's log.
• Not run: the end-to-end link_sync_store test, which runs fewer than 32 jobs and does not reach this path.

risk: normal (machine daemon retention policy).

Changelog

none

Agent session: agent session

🤖 Generated with Claude Code

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review b9c5da2: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr35823 -f ref=blob-sync-keep-fetch-records -f platform=macos -f backend_mode=local

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4190094575701 (036f8aa538)
• cmux NEXT nightly 1.0.0-nightly.4191131679101 (e01bbae5c9)

[teamleaderleo]

Owned by an agent session · session

[teamleaderleo]

Review (codex, router-review): SHIP at b9c5da2

Reviewer: codex gpt-6.1-sol xhigh, fast tier.

SHIP at b9c5da2

Visual verdict: unchanged by this diff

The retention and commit/cancel locking logic is consistent; no correctness or regression findings. Cargo was unavailable locally, so I relied on static review and the reported hosted test.

Follow-ups: none

[blacksmith-sh]

Found 1 test failure on Blacksmith runners:

Failure

Test	View Logs
test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)/ test_every_listed_hook_is_one_glaeda_released_with_the_check (main.SigningHooksInSt epWithGlaedaTests.test_every_listed_hook_is_one_glaeda_released_with_the_check)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[cmux-bot]

cmux-bot approves b9c5da2: an independent review passed this exact head (router-review receipt by teamleaderleo). A push needs a new review; a later BLOCK at this head dismisses this approval.