iOS render-grid liveness watchdog: probe before teardown, consume during subscribe ack (fixes the 10.5s false-fire replay loop)

.github/swift-file-length-budget.tsv

@@ -21,7 +21,7 @@
 6071	Sources/TextBoxInput.swift
 5482	cmuxTests/BrowserConfigTests.swift
 5448	Sources/cmuxApp.swift
-4574	Packages/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift
+4827	Packages/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift
 4460	Sources/Panels/FilePreviewPanel.swift
 4400	cmuxTests/BrowserPanelTests.swift
 4227	Sources/BrowserWindowPortal.swift
@@ -41,7 +41,7 @@
 2513	cmuxTests/CommandPaletteSearchEngineTests.swift
 2509	Sources/KeyboardShortcutSettings.swift
 2327	cmuxTests/CJKIMEInputTests.swift
-2326	Sources/Mobile/MobileHostService.swift
+2340	Sources/Mobile/MobileHostService.swift
 2290	Sources/FileExplorerView.swift
 2260	Sources/TerminalWindowPortal.swift
 2138	Sources/SessionPersistence.swift

Packages/CmuxMobileRPC/Sources/CmuxMobileRPC/MobileEventSubscribeResponse.swift

@@ -11,8 +11,20 @@ public struct MobileEventSubscribeResponse: Decodable, Sendable {
     /// Empty or missing when the subscription was not accepted.
     public let streamID: String
 
+    /// Whether the host already had a registration for this `stream_id` on
+    /// this connection before processing the request (`mobile.events.subscribe`
+    /// is idempotent per stream id).
+    ///
+    /// `false` means this acknowledgement INSTALLED the registration, so any
+    /// events emitted while it was absent were never delivered; the liveness
+    /// probe uses that to trigger a catch-up replay. `nil` when the host
+    /// predates the field, which callers must treat as "unknown, assume it was
+    /// already active" so older Macs keep today's behavior.
+    public let alreadySubscribed: Bool?
+
     private enum CodingKeys: String, CodingKey {
         case streamID = "stream_id"
+        case alreadySubscribed = "already_subscribed"
     }
 
     /// Decode a subscribe acknowledgement from raw JSON data.
@@ -30,5 +42,6 @@ public struct MobileEventSubscribeResponse: Decodable, Sendable {
     public init(from decoder: any Decoder) throws {
         let container = try decoder.container(keyedBy: CodingKeys.self)
         streamID = (try container.decodeIfPresent(String.self, forKey: .streamID)) ?? ""
+        alreadySubscribed = try container.decodeIfPresent(Bool.self, forKey: .alreadySubscribed)
     }
 }

Packages/CmuxMobileRPC/Sources/CmuxMobileRPC/MobileSyncRuntime.swift

@@ -30,4 +30,18 @@ public protocol MobileSyncRuntime: Sendable {
     /// skips background subscribe/poll so scripted-transport tests do not
     /// consume responses intended for foreground methods.
     var supportsServerPushEvents: Bool { get }
+    /// Bounded deadline, in nanoseconds, for the render-grid liveness
+    /// watchdog's subscription probe (an idempotent `mobile.events.subscribe`
+    /// re-assert). A healthy idle terminal legitimately pushes no events, so
+    /// the watchdog verifies prolonged silence with this probe before
+    /// declaring the stream dead; the deadline bounds how long a dead
+    /// transport can stall that verdict.
+    var livenessProbeTimeoutNanoseconds: UInt64 { get }
+}
+
+public extension MobileSyncRuntime {
+    /// Default probe deadline: generous against a momentarily loaded Mac,
+    /// while keeping dead-stream recovery within a few seconds of the silence
+    /// threshold instead of the full ``rpcRequestTimeoutNanoseconds``.
+    var livenessProbeTimeoutNanoseconds: UInt64 { 3_000_000_000 }
 }