597d8a35

fix: a shell you exited is not brought back by a zoomed tile

a73x 2026-08-26 07:35

Commit message

fix: a shell you exited is not brought back by a zoomed tile

The page owns its re-attach and did it on every `up`, gated only on the
replica being unusable. A zoomed tile attaches at its real size, and a
sized attach is attach-or-create — so typing `exit` in a zoomed tile got
a new shell on the hub's next re-dial, with nothing refused and no birth
asked for. Declining to re-attach an `exited` tile is wallview's ending
reached by a client that cannot end. Found in Chrome; no test in this
repo executes mux.js.

.gitignore

Old		New
@@ -12,4 +12,8 @@ dist/
12	.release/	12	.release/
13		13
14	# Pinned toolchain, vendored (380MB): deps/zig/zig is what the Makefile runs.	14	# Pinned toolchain, vendored (380MB): deps/zig/zig is what the Makefile runs.
15	deps/zig/	15	# No trailing slash, and `deps/quic/quic` beside it: a worktree links both in
		16	# rather than copying them, and a trailing slash matches a directory only —
		17	# which is how the symlinks got swept into two commits.
		18	deps/zig
		19	deps/quic/quic

CLAUDE.md

Old		New
@@ -97,8 +97,11 @@ real pty), `wsclient` (browser stand-in), `rawmode`, `delaypipe`, `render`.
97	restart must not leave the user's own wall a grid of `[refused]`, and a	97	restart must not leave the user's own wall a grid of `[refused]`, and a
98	saved file must not spawn a shell on another host. The hub reaches the	98	saved file must not spawn a shell on another host. The hub reaches the
99	same rule from the other side — it cannot claim a size, so it births the	99	same rule from the other side — it cannot claim a size, so it births the
100	session on a side connection when an attach is refused before any grid,	100	session on a side connection when an attach is refused before any grid.
101	and a session the user ENDED stays ended.	101	"A session the user ENDED stays ended" needs BOTH halves: the hub's
		102	`ended` latch, and `sendAttach` declining to attach an `exited` tile at
		103	all. A zoomed tile's attach carries a size, and a sized attach creates —
		104	so the page can resurrect a shell without the hub involved.
102	- The layout sidecar is derived convenience, not authored intent.	105	- The layout sidecar is derived convenience, not authored intent.
103	`$XDG_STATE_HOME/mux/layout` stores the pane tree on last detach, hydrated	106	`$XDG_STATE_HOME/mux/layout` stores the pane tree on last detach, hydrated
104	walls only (no-argv `mux wall` or post-fold; argv walls and `mux TARGET`	107	walls only (no-argv `mux wall` or post-fold; argv walls and `mux TARGET`

docs/decisions.md

+the daemon never says why: a missing session and a full table refuse with the
+same `exit_status 1`. Most of the time the guess was wrong. It says `refused`
+now — the CLI's word, for the CLI's reason.
+## 2026-08-26 — a zoomed browser tile was resurrecting the shell you exited
+Found in Chrome against a live rig, not by any test here. Type `exit` in a
+ZOOMED browser tile and the session comes back: a new shell, in the tile you
+just closed.
+The chain has nothing to do with the hub's restore rule, which is what made it
+hard to see. The shell exits behind a live grid, so `exit_status` reads as a
+shell exiting and the badge goes `exited` — TERMINAL, and `setStatus` will not
+leave it. The daemon reaps the session and closes the hub's connection; the hub
+redials and sends `up`; mux.js's `up` arm re-attaches, because the browser owns
+its own re-attach and that call was gated only on `dead`/`replayDead`. A zoomed
+tile's attach carries `zoomCols()×zoomRows()` rather than 0×0 — the passivity
+contract exempts the zoom, deliberately, because a zoomed tile IS the client
+looking at the session. And `server.resolveSession` is attach-or-create for any
+attach with a usable size. So the page created it. The hub's `ended` latch never
+came into it: nothing was refused, and no birth was asked for.
+Ruled: the page declines to re-attach a tile whose status is `exited`. That is
+`wallview`'s ending — its pump ends on an `exit_status` and leaves the tile dead
+— reached by a client that cannot end, because it still has a socket and a
+canvas. `exited` exactly, not the TERMINAL set: `refused` must keep re-attaching
+or the hub's restore heal has no second half (refused → birth → re-dial → `up` →
+attach), and `stuck` already refuses inside `sendAttach` via `replayDead`. The
+latch lives in `sendAttach` rather than at the `up` arm that found the bug,
+because there are three callers and the dangerous one is the least obvious:
+`replayFailed`'s retry is a bare `setTimeout` that stores no handle and nothing
+cancels, so a replay failure followed within its wait by the shell exiting lands
+a sized attach on a tile already badged `exited` — the same resurrection by
+another road. It sits beside the `dead` gate rather than beside `replayDead`, so
+the selection and scroll clears below it are skipped: a dead tile's last screen
+is still worth copying text off, and a hub redialing every few seconds would
+otherwise wipe the selection each time. The latch clears through `ws.onopen`'s
+`revive`, so a reload or a hub restart is a new epoch and may create again — a person who reloads the page is asking for the
+wall they saved, which is the restore rule doing its job.
+This predates the browser restore work entirely: any zoomed tile whose shell
+exited has resurrected it since sized attaches existed. It survived because
+nothing in `test/` can see it. `wsclient` stands in for the browser on the wire
+but attaches `0 0` and never executes `mux.js`, so every rule that lives in the
+page — this one, the `up` re-attach, the badge vocabulary — is invisible to the
+e2e suite by construction. Faking a leg with `wsclient` would assert the
+fixture's behavior, not the page's. A real-browser pass is the gate for mux.js
+behavior, and this entry is the reason to keep paying for one.

web/mux.js

Old		New
@@ -611,6 +611,31 @@ class Tile {
611	// A shut-down tile has no wall to talk for: replayFailed's retry may	611	// A shut-down tile has no wall to talk for: replayFailed's retry may
612	// already be scheduled, and would otherwise repaint a detached node.	612	// already be scheduled, and would otherwise repaint a detached node.
613	if (this.dead) return;	613	if (this.dead) return;
		614	// A session the user ENDED stays ended — wallview's pump ends on an
		615	// exit_status and leaves the tile dead, and this is that ruling on
		616	// the page's side of the wire. Not decoration: a ZOOMED tile attaches
		617	// at its real size below, and a sized attach CREATES (server.zig
		618	// resolveSession is attach-or-create for any usable size), so without
		619	// this typing `exit` in a zoomed tile spawns a fresh shell. Unzoomed
		620	// tiles were always safe by the passivity contract; the zoom is what
		621	// carries the size.
		622	//
		623	// Here rather than at the callers, because there are three and the
		624	// dangerous one is the least obvious: replayFailed's retry is a bare
		625	// setTimeout that nothing cancels, so a replay failure followed
		626	// within its wait by the shell exiting lands a sized attach on a tile
		627	// already badged exited. Beside `dead` rather than beside
		628	// `replayDead` so the clears below are skipped: a dead tile's last
		629	// screen is still worth selecting text off, and a hub that redials
		630	// every few seconds would otherwise wipe the selection each time.
		631	//
		632	// Exactly 'exited', not the whole TERMINAL set. 'refused' MUST keep
		633	// re-attaching — the hub's restore heal is refused → it births the
		634	// session → re-dial → `up` → this attach — and 'stuck' is what
		635	// `replayDead` below already answers. The latch is cleared by
		636	// ws.onopen's revive: a browser-leg reconnect (reload, hub restart)
		637	// is a new epoch and may recreate, which is the deliberate escape.
		638	if (this.status === 'exited') return;
614	this.cancelScrollRequest();	639	this.cancelScrollRequest();
615	this.clearSelection();	640	this.clearSelection();
616	if (this.replayDead) return;	641	if (this.replayDead) return;
@@ -716,7 +741,8 @@ class Tile {
716	// The hub speaks about the DAEMON leg, which is not the whole of	741	// The hub speaks about the DAEMON leg, which is not the whole of
717	// this tile: setStatus withholds the badge while the tile holds a	742	// this tile: setStatus withholds the badge while the tile holds a
718	// terminal state of its own. The bookkeeping below runs regardless	743	// terminal state of its own. The bookkeeping below runs regardless
719	// — sendAttach has its own gate (replayDead) and keeps it.	744	// — sendAttach has its own gates (dead, exited, replayDead) and
		745	// keeps them.
720	if (state !== 'up') {	746	if (state !== 'up') {
721	this.cancelScrollRequest();	747	this.cancelScrollRequest();
722	this.clearSelection();	748	this.clearSelection();