Workspaces 5/10: hold derived events in the transfer gap; drift cleanup

[nedtwigg]

terminal:semanticEvents / terminal:protocolEvents landing while an id is suppressed are held in Rust and delivered behind the replay, instead of dropped. Stale updater comments and the updater:* vs updater:default spec mismatch corrected; a source test pins that main.js hands pty-core the shared sliceSince.

Based on workspaces-dor.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PkPyEFCxiPo5UFeju5Ya9u

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	4a2e75f
Status:	✅  Deploy successful!
Preview URL:	https://dfe403e5.mouseterm.pages.dev
Branch Preview URL:	https://workspaces-harden.mouseterm.pages.dev

View logs

[dormouse-bot]

Feedback on work in progress, not a merge verdict — mark it ready when you want the full review.

The routing change rests on the premise that these events are in no replay. For terminal:semanticEvents in the standalone host that isn't true: the replay carries the raw OSC bytes and tauri-adapter.ts re-derives the semantic events from them itself, so the flushed queue applies them a second time. Mechanism and the narrower fix are in the thread on routing.rs. The other threads are the held queue's lifecycle and two spec claims.

[dormouse-bot]

Feedback on work in progress, not a merge verdict — mark it ready when you want the full review.

The semantic-events half of the fix doesn't survive the arrival path it was written for: planArrival calls alertSeed for every transferred pane right after collectLivePtys resolves, and AlertManager.seed nulls commandExitWatch, so the WATCHING state the replay just rebuilt is gone a turn later. Mechanism, and why this is a regression against the previous Hold, are in the thread on standalone/src/tauri-adapter.ts. The other thread is the hand-back comment against the spec line it cites.

Everything else from the last round reads as addressed — the routing split, the lift_suppression consolidation, the HELD_EVENTS_MAX bound in the table, and the layout.md reorder line.

[dormouse-bot]

Feedback on work in progress, not a merge verdict — mark it ready when you want the full review.

The reorder does close last round's thread: alertSeed now runs before adopt_ready, so the replay listener's applyTerminalSemanticEvents is the last writer of alert state on the arrival path, and alert.md -> "Public State" already guarantees the pre-registration seed survives (Must retain host Activity before xterm initialization). One decision the reorder raises, plus the thread on workspace-move.ts.

The seed now runs before the point where planArrival can still throw. On the live.timedOut path the Workspace is handed back and handleArrivalFailed only clears the source's transferring mark, so this window keeps an AlertManager entry — and, through onStateChange -> setTerminalActivity, an activity-store entry — for panes that stay with the source and never mount here. Nothing renders them that I can find: getLivePersistedAlertState returns null for an unregistered id so they are not persisted, and a second arrival of the same ids seeds over them. So it is retained state rather than a wrong display, but it is new with this commit — previously the throw came first. Either clear it on the throw, or say in standalone.md -> "Arrival queue" that a refused arrival leaves its seeded alerts behind, so the next reader does not have to re-derive that it is harmless.

[dormouse-bot]

nedtwigg's replies on the two open threads landed a few minutes before this review and
my snapshot predated them, so an earlier version of this body listed them as
outstanding. Withdrawn: both are deferred to #630 / 3c5fc72c, which does touch
standalone/src-tauri/src/lib.rs and standalone/src/workspace-move.ts.

The seed-before-throw point from the last pass — planArrival seeding before the
live.timedOut throw, so a refused arrival leaves an AlertManager entry, and through
onStateChange an activity-store entry, for panes that stay with the source — reads as
falling under the same consolidation. Say so if it does and it is closed with them.

That leaves the one new point inline, on the held queue's remaining escape hatch. The
verdict is comment rather than approval on that alone.

[dormouse-bot]

Both open points check out against #630's head (8708519b), and one narrow case of the seed-before-throw point survives there.

Held queue — closed. sweep_awaiting now takes held, releases through lift_suppression, and returns each (id, queue); the compensating held.remove loop in dispatch_sidecar_event is gone, so it is the one exit from both maps.

Seed before throw — consolidated there too; the live.timedOut branch now clears alert, activity and pane state. It walks a different set than the seed, though: the seed loop is over payload.workspace.session.panes, which includes browser panes — browserPersistedPane in lib/src/lib/session-types.ts carries an alert — while the cleanup walks ptyIds, i.e. terminalIds = allIds.filter(hasTerminal) plus helpers, which excludes them by construction. So a refused arrival of a Workspace holding a browser pane with a persisted TODO leaves that seed in the target's AlertManager, and the source still holds its own — commit() only runs on success. Iterating the set the seed iterated would close it.