Preserve complete chronological notification history

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/ControlCommandCoordinator.swift

@@ -139,6 +139,8 @@ public final class ControlCommandCoordinator {
             return systemIdentify(request.params, context: context)
         case "system.tree":
             return systemTree(request.params, context: context)
+        case "notification.list":
+            return notificationList(context: context)
         case "surface.send_text":
             return surfaceSendText(request.params, context: context)
         case "surface.send_key":

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/Notification/ControlCommandCoordinator+Notification.swift

@@ -22,7 +22,7 @@ extension ControlCommandCoordinator {
         case "notification.create_for_target":
             return notificationCreateForTarget(request.params)
         case "notification.list":
-            return notificationList()
+            return notificationList(context: context)
         case "notification.clear":
             return notificationClear()
         case "notification.dismiss":
@@ -144,10 +144,71 @@ extension ControlCommandCoordinator {
 
     // MARK: - List / clear
 
+    private struct NotificationPayloadRefs: Sendable {
+        let workspace: JSONValue
+        let surface: JSONValue
+    }
+
+    private struct NotificationListHopOutcome: Sendable {
+        let snapshots: [ControlNotificationSnapshot]
+        let refs: [NotificationPayloadRefs]
+    }
+
     /// `notification.list` — every notification, with read state.
-    func notificationList() -> ControlCallResult {
-        let items = (context?.controlNotificationList() ?? []).map {
-            notificationPayload($0, opened: nil, includeReadState: true)
+    ///
+    /// Full-list snapshotting and ref minting take one bounded main hop. Date
+    /// rendering and JSON row construction scale with history size, so both run
+    /// on the calling socket-worker thread with response encoding.
+    nonisolated func notificationList(
+        context: (any ControlCommandContext)?
+    ) -> ControlCallResult {
+        guard let context else {
+            return .ok(.object(["notifications": .array([])]))
+        }
+
+        let outcome: NotificationListHopOutcome = context.controlResolveOnMain { seam in
+            let snapshots = seam.controlNotificationList()
+            var workspaceRefs: [UUID: JSONValue] = [:]
+            var surfaceRefs: [UUID: JSONValue] = [:]
+            var refs: [NotificationPayloadRefs] = []
+            refs.reserveCapacity(snapshots.count)
+            for snapshot in snapshots {
+                let workspaceRef: JSONValue
+                if let cached = workspaceRefs[snapshot.workspaceID] {
+                    workspaceRef = cached
+                } else {
+                    workspaceRef = self.ref(.workspace, snapshot.workspaceID)
+                    workspaceRefs[snapshot.workspaceID] = workspaceRef
+                }
+
+                let surfaceRef: JSONValue
+                if let surfaceID = snapshot.surfaceID {
+                    if let cached = surfaceRefs[surfaceID] {
+                        surfaceRef = cached
+                    } else {
+                        surfaceRef = self.ref(.surface, surfaceID)
+                        surfaceRefs[surfaceID] = surfaceRef
+                    }
+                } else {
+                    surfaceRef = .null
+                }
+                refs.append(NotificationPayloadRefs(
+                    workspace: workspaceRef,
+                    surface: surfaceRef
+                ))
+            }
+            return NotificationListHopOutcome(snapshots: snapshots, refs: refs)
+        }
+
+        let formatter = Self.notificationTimestampFormatter()
+        let items = outcome.snapshots.enumerated().map { index, snapshot in
+            JSONValue.object(Self.notificationPayloadObject(
+                snapshot,
+                createdAtISO8601: formatter.string(from: snapshot.createdAt),
+                refs: outcome.refs[index],
+                opened: nil,
+                includeReadState: true
+            ))
         }
         return .ok(.object(["notifications": .array(items)]))
     }
@@ -332,18 +393,38 @@ extension ControlCommandCoordinator {
         _ snapshot: ControlNotificationSnapshot,
         opened: Bool?,
         includeReadState: Bool
+    ) -> [String: JSONValue] {
+        let formatter = Self.notificationTimestampFormatter()
+        return Self.notificationPayloadObject(
+            snapshot,
+            createdAtISO8601: formatter.string(from: snapshot.createdAt),
+            refs: NotificationPayloadRefs(
+                workspace: ref(.workspace, snapshot.workspaceID),
+                surface: ref(.surface, snapshot.surfaceID)
+            ),
+            opened: opened,
+            includeReadState: includeReadState
+        )
+    }
+
+    private nonisolated static func notificationPayloadObject(
+        _ snapshot: ControlNotificationSnapshot,
+        createdAtISO8601: String,
+        refs: NotificationPayloadRefs,
+        opened: Bool?,
+        includeReadState: Bool
     ) -> [String: JSONValue] {
         var payload: [String: JSONValue] = [
             "id": .string(snapshot.id.uuidString),
             "workspace_id": .string(snapshot.workspaceID.uuidString),
-            "workspace_ref": ref(.workspace, snapshot.workspaceID),
-            "surface_id": orNull(snapshot.surfaceID?.uuidString),
-            "surface_ref": ref(.surface, snapshot.surfaceID),
+            "workspace_ref": refs.workspace,
+            "surface_id": snapshot.surfaceID.map { .string($0.uuidString) } ?? .null,
+            "surface_ref": refs.surface,
             "title": .string(snapshot.title),
             "subtitle": .string(snapshot.subtitle),
             "body": .string(snapshot.body),
-            "created_at": .string(snapshot.createdAtISO8601),
-            "tab_title": orNull(snapshot.tabTitle),
+            "created_at": .string(createdAtISO8601),
+            "tab_title": snapshot.tabTitle.map(JSONValue.string) ?? .null,
         ]
         if includeReadState {
             payload["is_read"] = .bool(snapshot.isRead)
@@ -354,6 +435,13 @@ extension ControlCommandCoordinator {
         return payload
     }
 
+    private nonisolated static func notificationTimestampFormatter() -> ISO8601DateFormatter {
+        let formatter = ISO8601DateFormatter()
+        formatter.formatOptions = [.withInternetDateTime]
+        formatter.timeZone = TimeZone(secondsFromGMT: 0)
+        return formatter
+    }
+
     // MARK: - Localized error messages
 
     /// The localized notification messages from the app conformance, or the

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Coordinator/Notification/ControlNotificationSnapshot.swift

@@ -5,11 +5,10 @@ public import Foundation
 /// ``ControlNotificationContext``.
 ///
 /// Mirrors the app target's `TerminalNotification` (plus the two app-resolved
-/// adornments the legacy `notificationPayload` builder added: the ISO-8601
-/// `createdAt` rendering and the workspace's tab title) without the package
-/// importing the app target. The coordinator turns each snapshot into a
-/// notification payload object, byte-identically to the former
-/// `[String: Any]` builder.
+/// adornments the legacy `notificationPayload` builder added: the creation
+/// time and workspace tab title) without the package importing the app target.
+/// The coordinator renders the timestamp while building the wire payload on
+/// the socket worker.
 public struct ControlNotificationSnapshot: Sendable, Equatable {
     /// The notification's stable identifier.
     public let id: UUID
@@ -23,11 +22,9 @@ public struct ControlNotificationSnapshot: Sendable, Equatable {
     public let subtitle: String
     /// The notification body.
     public let body: String
-    /// The creation timestamp pre-rendered exactly as the legacy
-    /// `notificationCreatedAtString` did (`ISO8601DateFormatter` with
-    /// `.withInternetDateTime`, GMT). Carried as a string so the package never
-    /// re-formats the date and the wire bytes stay identical.
-    public let createdAtISO8601: String
+    /// The creation timestamp. Kept as a Sendable value so full-list formatting
+    /// can run after the bounded main-actor snapshot hop.
+    public let createdAt: Date
     /// Whether the notification has been marked read.
     public let isRead: Bool
     /// The workspace's tab title, if the app could resolve one (the legacy
@@ -43,7 +40,7 @@ public struct ControlNotificationSnapshot: Sendable, Equatable {
     ///   - title: The notification title.
     ///   - subtitle: The notification subtitle.
     ///   - body: The notification body.
-    ///   - createdAtISO8601: The pre-rendered ISO-8601 creation timestamp.
+    ///   - createdAt: The creation timestamp.
     ///   - isRead: Whether the notification is read.
     ///   - tabTitle: The owning workspace's tab title, if any.
     public init(
@@ -53,7 +50,7 @@ public struct ControlNotificationSnapshot: Sendable, Equatable {
         title: String,
         subtitle: String,
         body: String,
-        createdAtISO8601: String,
+        createdAt: Date,
         isRead: Bool,
         tabTitle: String?
     ) {
@@ -63,7 +60,7 @@ public struct ControlNotificationSnapshot: Sendable, Equatable {
         self.title = title
         self.subtitle = subtitle
         self.body = body
-        self.createdAtISO8601 = createdAtISO8601
+        self.createdAt = createdAt
         self.isRead = isRead
         self.tabTitle = tabTitle
     }

Packages/macOS/CmuxControlSocket/Sources/CmuxControlSocket/Wire/ControlCommandExecutionPolicy.swift

@@ -220,8 +220,7 @@ public enum ControlCommandExecutionPolicy: Sendable, Equatable {
         "surface.report_shell_state",
         "surface.report_tty",
         "surface.ports_kick",
-        // The notification-create family and workspace.set_auto_title run the
-        // same single-hop worker shape (parse/bridge/encode on the worker, one
+        // Notification creation and workspace.set_auto_title parse/bridge/encode on the worker, with one
         // v2MainSync around the shared main-actor dispatch). The hop stays
         // synchronous so the reply is written only after the hop body ran —
         // matching the legacy main-lane ordering exactly. NOTE: that is NOT
@@ -237,6 +236,7 @@ public enum ControlCommandExecutionPolicy: Sendable, Equatable {
         "notification.create_for_surface",
         "notification.create_for_target",
         "notification.create_for_caller",
+        "notification.list",
         "workspace.set_auto_title",
         // The v2 resolution reads (tranche D of issue #5757) — the implicit
         // handle-normalization reads nearly every CLI invocation pays 1-3 of.
@@ -368,8 +368,10 @@ public enum ControlCommandExecutionPolicy: Sendable, Equatable {
     /// `TerminalController`: parse/format on the worker; `notify_target_async`
     /// and `clear_notifications` are pure mutation-bus enqueues (zero main
     /// hops, hooks nohup them and discard the reply); the synchronous
-    /// notify/list verbs keep one `v2MainSync` hop because their replies
-    /// depend on tab/surface resolution or the delivered store state.
+    /// notify verbs keep one `v2MainSync` hop because their replies depend on
+    /// tab/surface resolution or delivered store state. `list_notifications`
+    /// snapshots on the main actor but formats on the worker and is not safe
+    /// to collapse inline for in-process main-thread callers.
     /// Internal (not private) so the package tests can pin the exact set.
     static let notificationV1Commands: Set<String> = [
         "notify",
@@ -482,14 +484,14 @@ public enum ControlCommandExecutionPolicy: Sendable, Equatable {
         "report_shell_state",
         "report_tty",
         "ports_kick",
-        // The v1 notification family (tranche B2): notify_target_async and
-        // clear_notifications are pure bus enqueues; the synchronous verbs
-        // are one inline-collapsing hop each.
+        // The v1 notification family (tranche B2): clear_notifications is a
+        // pure bus enqueue; synchronous notify verbs are one inline-collapsing
+        // hop each. list_notifications formats the full feed and
+        // notify_target_async can wait for bounded queue capacity, so both
+        // remain worker-only.
         "notify",
         "notify_surface",
         "notify_target",
-        "notify_target_async",
-        "list_notifications",
         "clear_notifications",
         // The v1 resolution reads (tranche D): non-blocking single-hop
         // snapshot reads whose hop collapses inline on a main-thread caller,

Packages/macOS/CmuxControlSocket/Tests/CmuxControlSocketTests/ControlCommandCoordinatorNotificationTests.swift

@@ -0,0 +1,84 @@
+import Foundation
+import Testing
+@testable import CmuxControlSocket
+
+@MainActor
+private final class NotificationListControlCommandContext: ControlCommandContext {
+    private(set) var resolveOnMainCallCount = 0
+    var notifications: [ControlNotificationSnapshot] = []
+
+    nonisolated func controlResolveOnMain<T: Sendable>(
+        _ body: @MainActor (any ControlCommandContext) -> T
+    ) -> T {
+        MainActor.assumeIsolated {
+            resolveOnMainCallCount += 1
+            return body(self)
+        }
+    }
+
+    func controlNotificationList() -> [ControlNotificationSnapshot] {
+        notifications
+    }
+}
+
+@MainActor
+@Suite("ControlCommandCoordinator notification domain")
+struct ControlCommandCoordinatorNotificationTests {
+    @Test func notificationListWorkerHandlerUsesOneMainHop() {
+        let context = NotificationListControlCommandContext()
+        let coordinator = ControlCommandCoordinator(context: context)
+        let request = ControlRequest(id: .int(1), method: "notification.list", params: [:])
+
+        guard case .ok(.object(let payload))? = coordinator.handleSocketWorkerV2(
+            request,
+            context: context
+        ), case .array(let notifications) = payload["notifications"] else {
+            Issue.record("notification.list worker handler did not return its list payload")
+            return
+        }
+
+        #expect(context.resolveOnMainCallCount == 1)
+        #expect(notifications.isEmpty)
+    }
+
+    @Test func notificationListPreservesLargeSnapshotOrderAndWireShape() throws {
+        let context = NotificationListControlCommandContext()
+        let coordinator = ControlCommandCoordinator(context: context)
+        let workspaceID = UUID()
+        let surfaceID = UUID()
+        let snapshots = (0..<10_500).reversed().map { index in
+            ControlNotificationSnapshot(
+                id: UUID(),
+                workspaceID: workspaceID,
+                surfaceID: surfaceID,
+                title: "Notification \(index)",
+                subtitle: "Subtitle",
+                body: "Body",
+                createdAt: Date(timeIntervalSince1970: TimeInterval(index)),
+                isRead: index.isMultiple(of: 2),
+                tabTitle: "Workspace"
+            )
+        }
+        context.notifications = snapshots
+        let request = ControlRequest(id: .int(1), method: "notification.list", params: [:])
+
+        guard case .ok(.object(let payload))? = coordinator.handleSocketWorkerV2(
+            request,
+            context: context
+        ), case .array(let notifications) = payload["notifications"],
+        case .object(let first) = notifications.first,
+        case .object(let last) = notifications.last else {
+            Issue.record("notification.list worker handler returned an unexpected payload")
+            return
+        }
+
+        #expect(context.resolveOnMainCallCount == 1)
+        #expect(notifications.count == snapshots.count)
+        #expect(first["id"] == .string(try #require(snapshots.first).id.uuidString))
+        #expect(first["created_at"] == .string("1970-01-01T02:54:59Z"))
+        #expect(first["workspace_ref"] == .string("workspace:1"))
+        #expect(first["surface_ref"] == .string("surface:1"))
+        #expect(last["id"] == .string(try #require(snapshots.last).id.uuidString))
+        #expect(last["created_at"] == .string("1970-01-01T00:00:00Z"))
+    }
+}