d7967ffa

fix: the small ones the review found — a hint, a note, a test, an install

a73x 2026-08-29 02:26

Commit message

fix: the small ones the review found — a hint, a note, a test, an install

The upgrade hint said "a daemon of v0.0.1-15 or older wants…" about any
`version: output mismatch`; nothing on this side knows the daemon's
version, and a new daemon refusing a wrapper script says the same words.
Conditional now, so the sentence is true either way.

`Recipe.deinit` says that Tiles alias both argvs, which is why the arena
frees them once. The spawnPipe copy test dupes its two words and frees
them: literals live for the whole program, so the old body could only
have caught a std that kept `argv.ptr`, never one that kept `argv[i]`.

`make install` removes muxd/muxa/muxweb, and README's upgrade section
says the old names go and that a v0.0.1-15 daemon cannot be upgraded in
place. docs/roadmap.md goes back to what it said — its history was
mass-renamed into claims it never made ("`mux a` — a fourth binary",
a 23MB measurement of `muxd` relabelled `mux`) — under the same epoch
header decisions.md carries.

Makefile

Old		New
@@ -16,7 +16,7 @@ deps:
16	build:	16	build:
17	$(ZIG) build	17	$(ZIG) build
18		18
19	# Only the four user-facing binaries: everything else in zig-out/bin	19	# Only the ONE user-facing binary: everything else in zig-out/bin
20	# (ptyclient, wsclient, rawmode, ...) is a test fixture that would shadow	20	# (ptyclient, wsclient, rawmode, ...) is a test fixture that would shadow
21	# nothing useful on PATH.	21	# nothing useful on PATH.
22	BINDIR ?= $(HOME)/.local/bin	22	BINDIR ?= $(HOME)/.local/bin
@@ -30,11 +30,15 @@ BINDIR ?= $(HOME)/.local/bin
30	# overwrite zig-out/bin, leaving the dev tree's binaries and test fixtures	30	# overwrite zig-out/bin, leaving the dev tree's binaries and test fixtures
31	# silently not the ones `make test` just built — the same trap xversion-build	31	# silently not the ones `make test` just built — the same trap xversion-build
32	# documents below.	32	# documents below.
		33	# The `rm -f` in the recipe takes the three names this binary replaced off
		34	# PATH: a box with an older install keeps them forever otherwise, and a
		35	# `muxd` still answering `--version` is a daemon someone will start.
33	INSTDIR ?= dist/install	36	INSTDIR ?= dist/install
34	install:	37	install:
35	$(ZIG) build -Doptimize=ReleaseSafe -p $(INSTDIR)	38	$(ZIG) build -Doptimize=ReleaseSafe -p $(INSTDIR)
36	install -d $(BINDIR)	39	install -d $(BINDIR)
37	install -m755 $(INSTDIR)/bin/mux $(BINDIR)/	40	install -m755 $(INSTDIR)/bin/mux $(BINDIR)/
		41	rm -f $(BINDIR)/muxd $(BINDIR)/muxa $(BINDIR)/muxweb
38		42
39	# The artifact a release publishes, built the way every release since	43	# The artifact a release publishes, built the way every release since
40	# v0.0.1-4 has been: static musl so one binary runs on any x86_64 Linux,	44	# v0.0.1-4 has been: static musl so one binary runs on any x86_64 Linux,

README.md

Old		New
@@ -560,6 +560,13 @@ and run`. A session in the middle of being ended (`Ctrl-\` `x`, up to half a
560	second while its shell is being hung up) refuses the upgrade with `session	560	second while its shell is being hung up) refuses the upgrade with `session
561	ending, retry` rather than carrying a shell with no master across the exec.	561	ending, retry` rather than carrying a shell with no master across the exec.
562		562
		563	Coming from v0.0.1-15 or older is the one upgrade `mux d upgrade` cannot
		564	do: that daemon probes a candidate for `muxd <version>` and this binary
		565	prints `mux <version>`, so it refuses. `mux d stop` then `mux d start`,
		566	once per box. `make install` deletes `muxd`, `muxa` and `muxweb` from the
		567	install directory on its way in — they are modes of `mux` now, and a
		568	`muxd` left on PATH is a second daemon waiting for someone to start it.
		569
563	Copy and paste work through the session: a mux drag and an application's own	570	Copy and paste work through the session: a mux drag and an application's own
564	OSC 52 write both reach your terminal's clipboard (including from a remote box over QUIC,	571	OSC 52 write both reach your terminal's clipboard (including from a remote box over QUIC,
565	where nothing else can), a paste arrives bracketed when the application	572	where nothing else can), a paste arrives bracketed when the application

docs/roadmap.md

src/cli/main.zig

Old		New
@@ -883,14 +883,18 @@ fn upgradeCmd(alloc: std.mem.Allocator, sock_path: []const u8, allow_same: bool)
883	// One refusal gets a translation, because the daemon saying it	883	// One refusal gets a translation, because the daemon saying it
884	// cannot know why. v0.0.1-15 and older probe the candidate for	884	// cannot know why. v0.0.1-15 and older probe the candidate for
885	// `muxd <version>` and this binary answers `mux <version>` —	885	// `muxd <version>` and this binary answers `mux <version>` —
886	// the four binaries became one. If that daemon's wording ever	886	// the four binaries became one. Conditional wording, because
887	// changes the hint simply stops appearing; the verbatim line	887	// nothing here knows the daemon's version: a NEW daemon says
888	// above is what the user acts on either way.	888	// the same words about a candidate that prints anything else,
		889	// and telling that user about v15 would be a wrong diagnosis.
		890	// If the daemon's wording ever changes the hint simply stops
		891	// appearing; the verbatim line above is what the user acts on.
889	if (std.mem.eql(u8, frame.payload[1..], "version: output mismatch"))	892	if (std.mem.eql(u8, frame.payload[1..], "version: output mismatch"))
890	std.debug.print(	893	std.debug.print(
891	"mux d upgrade: a daemon of v0.0.1-15 or older wants a candidate that " ++	894	"mux d upgrade: if that daemon is v0.0.1-15 or older, it wants a " ++
892	"prints `muxd <version>`; this one is `mux`. There is no in-place " ++	895	"candidate that prints `muxd <version>` and this one is `mux`. " ++
893	"path across that: `mux d stop` then `mux d start`, once.\n",	896	"There is no in-place path across that rename: `mux d stop` then " ++
		897	"`mux d start`, once.\n",
894	.{},	898	.{},
895	);	899	);
896	return 1;	900	return 1;

src/client/client.zig

Old		New
@@ -1414,16 +1414,24 @@ test "spawnPipe: the child is exec'd from a copy — an argv freed after spawn s
1414	// duplicating it, that free would be a use-after-free nothing else here	1414	// duplicating it, that free would be a use-after-free nothing else here
1415	// would catch — the child would have exec'd correctly already.	1415	// would catch — the child would have exec'd correctly already.
1416	const alloc = std.testing.allocator;	1416	const alloc = std.testing.allocator;
		1417	// The WORDS are duped as well as the array. String literals live for
		1418	// the whole program, so freeing an array of them would only have caught
		1419	// a std that kept `argv.ptr` — never one that kept `argv[i].ptr`, which
		1420	// is the same bug one level down and the one this claim also makes.
1417	const argv = try alloc.alloc([]const u8, 2);	1421	const argv = try alloc.alloc([]const u8, 2);
1418	argv[0] = "/bin/echo";	1422	argv[0] = try alloc.dupe(u8, "/bin/echo");
1419	argv[1] = "copied";	1423	argv[1] = try alloc.dupe(u8, "copied");
1420	var child = try Transport.spawnPipe(alloc, argv);	1424	var child = try Transport.spawnPipe(alloc, argv);
		1425	for (argv) \|w\| alloc.free(w);
1421	alloc.free(argv);	1426	alloc.free(argv);
1422	// Reuse the freed pages before reading, so a std that kept the pointer	1427	// Reuse the freed pages before reading, so a std that kept the pointer
1423	// is reading somebody else's bytes rather than its own stale ones.	1428	// is reading somebody else's bytes rather than its own stale ones.
1424	const churn = try alloc.alloc([]const u8, 2);	1429	const churn = try alloc.alloc([]const u8, 2);
1425	@memset(churn, "xxxxxxx");	1430	@memset(churn, "xxxxxxx");
1426	alloc.free(churn);	1431	alloc.free(churn);
		1432	const wchurn = try alloc.alloc(u8, 16);
		1433	@memset(wchurn, 'x');
		1434	alloc.free(wchurn);
1427		1435
1428	var buf: [64]u8 = undefined;	1436	var buf: [64]u8 = undefined;
1429	const n = try std.posix.read(child.stdout.?.handle, &buf);	1437	const n = try std.posix.read(child.stdout.?.handle, &buf);

src/client/handoff.zig

Old		New
@@ -179,6 +179,11 @@ pub const Recipe = struct {
179	cache_path: ?[]const u8,	179	cache_path: ?[]const u8,
180		180
181	pub fn deinit(self: Recipe, alloc: std.mem.Allocator) void {	181	pub fn deinit(self: Recipe, alloc: std.mem.Allocator) void {
		182	// Exactly once, by the arena that built it: the wall hands one
		183	// recipe to every Tile of a host and a Tile ALIASES both argvs
		184	// rather than copying them (`webhub.copyTarget` is the one caller
		185	// that dupes). Two levels deep, so a future non-arena owner has two
		186	// levels to free and a per-Tile free would be a double one.
182	freeArgv(alloc, self.ssh_argv);	187	freeArgv(alloc, self.ssh_argv);
183	freeArgv(alloc, self.start_argv);	188	freeArgv(alloc, self.start_argv);
184	if (self.cache_path) \|c\| alloc.free(c);	189	if (self.cache_path) \|c\| alloc.free(c);

Old		New
@@ -1,5 +1,10 @@
1	# Roadmap	1	# Roadmap
2		2
		3	Entries before 2026-08-28 predate the one-binary move and name `muxd`,
		4	`muxa` and `muxweb`, which are now the `d`, `a` and `web` modes of `mux`;
		5	paths they cite as `src/X.zig` live under a domain folder. They are the
		6	record of what was decided and are left as written.
		7
3	> The wall became a list of DAEMONS on 2026-08-28 (decisions.md, same date):	8	> The wall became a list of DAEMONS on 2026-08-28 (decisions.md, same date):
4	> every wall-file item below describes the old attach-history file and is	9	> every wall-file item below describes the old attach-history file and is
5	> closed. The hub's move onto `hosts` is phase 2 and is the live item.	10	> closed. The hub's move onto `hosts` is phase 2 and is the live item.
@@ -24,7 +29,7 @@ being predicted, and shipped as M13.
24	Target, stated 2026-08-15: replace tmux as a daily driver. An agent	29	Target, stated 2026-08-15: replace tmux as a daily driver. An agent
25	driving a session is a nice-to-have behind that, not a peer. The first	30	driving a session is a nice-to-have behind that, not a peer. The first
26	consequence was immediate — shell integration became opt-in, because its	31	consequence was immediate — shell integration became opt-in, because its
27	two known costs land on the human's shell and only `mux a` reads what they	32	two known costs land on the human's shell and only `muxa` reads what they
28	buy (decisions.md, 2026-08-15). The queue below is ranked against the old	33	buy (decisions.md, 2026-08-15). The queue below is ranked against the old
29	framing and is being re-ranked against this one; the tracker	34	framing and is being re-ranked against this one; the tracker
30	(`git-collab issue list`) carries the live order.	35	(`git-collab issue list`) carries the live order.
@@ -54,14 +59,14 @@ proven so by a mutation that fired immediately.
54	## M10 — QUIC ergonomics — complete	59	## M10 — QUIC ergonomics — complete
55		60
56	Verdict: cleared on the real box. The whole QUIC story is four	61	Verdict: cleared on the real box. The whole QUIC story is four
57	commands — `mux d keygen`, one ssh line placing the key, `ssh HOST 'mux d	62	commands — `muxd keygen`, one ssh line placing the key, `ssh HOST 'muxd
58	start --quic 0.0.0.0'`, `mux quic://HOST` — no port or key path typed	63	start --quic 0.0.0.0'`, `mux quic://HOST` — no port or key path typed
59	anywhere, trust posture unchanged. Kill criterion held on the LAN box:	64	anywhere, trust posture unchanged. Kill criterion held on the LAN box:
60	first-attach success from a clean slate, a marker surviving full ssh	65	first-attach success from a clean slate, a marker surviving full ssh
61	logout, ten attach/detach cycles with exactly one daemon counted by	66	logout, ten attach/detach cycles with exactly one daemon counted by
62	tracked pid (decisions.md, M10). systemd is deleted, not deferred: the	67	tracked pid (decisions.md, M10). systemd is deleted, not deferred: the
63	contrib/ units and `LISTEN_FDS` activation are gone, with the removal	68	contrib/ units and `LISTEN_FDS` activation are gone, with the removal
64	commit as the resurrection reference. En route: a panic on `mux d	69	commit as the resurrection reference. En route: a panic on `muxd
65	start`'s own first-run-mistake path, two plan mutation gates that could	70	start`'s own first-run-mistake path, two plan mutation gates that could
66	not fail, and a third cross-binary constant drift — all fixed, all with	71	not fail, and a third cross-binary constant drift — all fixed, all with
67	the rule recorded ("assert the literal, never the constant the code	72	the rule recorded ("assert the literal, never the constant the code
@@ -108,13 +113,13 @@ failing with the mutation's own signature — and the rule extracted is
108	**an assertion about order must be an assertion the bytes can actually	113	**an assertion about order must be an assertion the bytes can actually
109	carry**.	114	carry**.
110		115
111	## M13 — trial friction: auto-start, `mux d stop`, error audit — complete	116	## M13 — trial friction: auto-start, `muxd stop`, error audit — complete
112		117