W-557: stop a hung frontmost app from dropping keystrokes (+ deterministic freeze harness)

[wr]

Problem

W-555 moved Arc's URL AppleScript off the synchronous CGEventTap path, but the same tap callback (AppContextDetector.current(), on the main thread) still made other synchronous cross-process IPC to the frontmost app — the cold-cache system-wide AX query, the focused-field secure/editable attribute reads, and the non-Arc browser AX URL walk. When that app is slow or hung, the IPC blocks the tap past the ~1s system timeout and macOS drops the keystroke — the same class as W-547 (Safari lag) and W-555 (Arc), via the AX path.

Found while validating the W-556 harness on a real Arc install: freezing the frontmost app (SIGSTOP) and typing reproduced the drop deterministically — and it reproduced on a non-browser (TextEdit) too, proving it's the AX queries, not anything Arc-specific.

Fix

Make the tap callback unable to block on a hung app:

1. Bound every tap-path AX query to a tight 0.1s messaging timeout (early-abort the browser walk on the first miss). Real local AX answers in single-digit ms, so this only bites a genuinely unresponsive app.
2. Cache the focused-field classification (secure/editable) in FocusedElementCache, keyed to the focused element, invalidated on any focus change. current() now does the role/settable/range IPC at most once per focus and reads cached booleans on every subsequent keystroke — bounding alone wasn't enough, because per-word calls still stacked cumulative main-thread block on a long typing burst.
3. Move Arc's URL AppleScript refresh off the main thread — an osascript subprocess on a background queue, killed after an 800ms budget. The W-555 design ran NSAppleScript on the main thread, so a frozen Arc would wedge Mojito's whole main thread (tap + UI) until the Apple Event timed out (~2 min); off-thread + bounded, a hung Arc stalls only that worker.

Harness (replaces the W-556 one)

The old arc-typing-regression.sh typed into fresh Arc tabs and asserted zero tapLost — but on fast, idle hardware Arc answers in ms, so it passed whether or not the bug was present (a false green, confirmed on a real Arc install). Replaced with hung-app-typing-regression.sh, which SIGSTOPs the frontmost app so it cannot answer IPC, types, then SIGCONTs. A blocking build drops keystrokes every time (RED); a correct build never does (GREEN). Targets Arc (AppleScript + AX) and TextEdit (AX-only control). Keeps the warmup/probe, build-from-worktree, hard-fail-on-driver-error, and always-thaw guardrails.

Test plan

• Unit suite green (updated BrowserURLCacheTests for the now-off-main resolver).
• Harness RED against the pre-W-557 build (Arc and TextEdit both drop), GREEN against this fix — verified on a real Arc install (built both, A/B'd).
• Measured: 12-word burst into a frozen Arc drops 0 keystrokes on the fix, ≥1 pre-fix.

Refs: W-557, W-555, W-556, W-547

[linear-code]

W-557

W-555

W-556

W-547

[wr-claude-reviewer]

CI is still in-progress (ssot pipeline) — not blocking this review, diff analysis is independent.

---

Blocking

1. Multi-line comment blocks + W-ticket references in AppContext.swift (CLAUDE.md violation)

Two new blocks in this file break the rule "Never write multi-line comment blocks — one short line max" and "Don't reference the current task, fix, or callers (W-NN) — that belongs in commit messages / PR descriptions and rots as the codebase evolves."

Block 1 — top of AppContextDetector (lines 25–34): The 10-line /// comment explains the timing constraint. The constraint is non-obvious and worth a comment, but should be one line, no ticket refs:

// Tight bound: a slow/hung app's AX calls block this main-thread tap callback past macOS's ~1s timeout, dropping keystrokes.
static let tapAXTimeout: Float = 0.1

Block 2 — inside current(), "Classify the field…" (5 lines): Same issue, trim to:

// Cached per focus to avoid repeated AX IPC on the tap thread; invalidated on any focus change.

2. Multi-line comment block + W-ticket reference in FocusedElementCache.swift (CLAUDE.md violation)

The new 8-line /// block on haveFieldInfo (lines 30–37) has the same violations. Suggestion:

// Cached per focus to skip repeated AX IPC on the tap thread; reset whenever element changes.
private(set) var haveFieldInfo = false

3. Multi-line comment block in BrowserURL.swift osascriptURL (CLAUDE.md violation)

The new 4-line // block inside osascriptURL ("This DFS walk runs on the tap thread…") should be one line:

// Tight timeout: a hung browser can't stall the tap past its ~1s limit via this AX walk.
AXUIElementSetMessagingTimeout(app, AppContextDetector.tapAXTimeout)

---

Question

drive hotkey command l for TextEdit in run_target — For Arc this correctly opens the URL bar. For TextEdit, Cmd+L isn't a standard text-focus shortcut (there's no URL bar). The text area should already be focused after make new document. Does this hotkey do anything useful for TextEdit, or is it a harmless leftover from the Arc-centric design? If it opens the character panel or triggers some other side effect it could skew the freeze test.

---

Nits

• eval "$activate" in run_target works fine for hard-coded strings, but eval is unnecessarily powerful here — passing the app name and constructing the osascript call inside the function would be a safer idiom.
• The --phrase flag (useful for manual debugging) was present in arc-typing-regression.sh but dropped from the new harness; the phrase is now hard-coded. Minor flexibility loss.

Superseded by fix commit(s) from claude[bot] (pr-fix, trace=223a1d53).

[wr-claude-reviewer]

Round 2 follow-up — prior findings partially addressed; key CLAUDE.md violations persist and one new correctness bug introduced.

CI: ssot pipeline still in-progress — not blocking this review; diff analysis is independent.

---

Blocking

1. AppContext.swift lines 24–38 — multi-line /// block + W-ticket refs (new)

CLAUDE.md: "Never write multi-line comment blocks — one short line max" and "Don't reference the current task, fix, or callers (W-NN)." This 15-line /// block above current() violates both. The commit 71f9ae0 addressed some earlier instances; this block was added in their place.

The constraint is non-obvious and worth a comment — but one line, no ticket refs:

// Tap callback: all reads must be cache-hits — no synchronous cross-process IPC; a hung app stalls past the ~1s timeout and macOS drops the keystroke.
static func current() -> ActiveContext {

2. FocusedElementCache.swift lines 30–39 — multi-line /// block + W-ticket ref (repeat from prior review #2)

The prior review flagged this as blocking. 71f9ae0 claims to trim it, but this 10-line block with a W-557 reference is still present. Suggested:

// Cached per focus to skip repeated AX IPC on the tap thread; reset on any element change (see element.didSet).
private(set) var focusedIsSecure = false
private(set) var focusedIsEditable = false
private(set) var haveFieldInfo = false

3. BrowserURL.swift lines 33–40 — multi-line // block + W-ticket ref in detect() (new)

8-line // block with a W-557 reference. The "why both bounds are needed" is non-obvious and worth a comment, but one line:

// Per-object timeout + total deadline: either bound alone can be beaten (one slow node vs. many fast ones).

4. BrowserURL.swift lines 200–204 — multi-line /// block + W-ticket ref on BrowserURLResolution (new)

6-line /// with W-557 on a new type. One line:

/// `.unavailable` means the resolve timed out — callers must keep the last good value, not overwrite it with nil.
enum BrowserURLResolution: Sendable {

5. BrowserURL.swift lines 359–368 — multi-line /// block on osascriptURL (repeat from prior review #3)

The prior review flagged this as blocking. Still an 11-line /// block. One line:

// osascript subprocess so it can be killed; temp file instead of Pipe to avoid the 64 KB buffer deadlock.
private nonisolated static func osascriptURL(bundleID: String) -> BrowserURLResolution {

6. BrowserURL.swift lines 372–374 — temp file not cleaned up on FileHandle failure (correctness bug, new)

The defer on line 374 registers after the guard on line 373. If FileHandle(forWritingTo: outURL) fails, execution returns .unavailable before the defer runs, leaving the file created on line 372 in /tmp. Fix: move the defer above the guard:

FileManager.default.createFile(atPath: outURL.path, contents: nil)
defer { try? FileManager.default.removeItem(at: outURL) }   // always runs now
guard let outHandle = try? FileHandle(forWritingTo: outURL) else { return .unavailable }

---

Question

scripts/e2e/hung-app-typing-regression.sh line 177 — drive hotkey command l for TextEdit (repeat from prior review, not addressed)

For Arc, Cmd+L focuses the URL bar. For TextEdit there is no URL bar; Cmd+L may open a Go-to-Line dialog or do nothing. Either way the tapLost signal is still valid (the test is about IPC blocking, not about where the text lands), but if Cmd+L opens a dialog that intercepts the typed phrase it could confuse a developer debugging a failure. Intentional ("just focus something")? If so, a comment here would help; if not, a TextEdit-specific harmless action (or nothing at all, since the text area is already focused after make new document) would be cleaner.

---

Nits

• AppContext.swift lines 52–54 (3-line // inside current()), 68–71 (4-line /// for classify()), 76–78 (3-line /// for isSecure()) — all still violate the one-line rule.
• FocusedElementCache.swift lines 23–25 (3-line /// for element), 44–46 (3-line /// for publishFieldInfo), 53–55 (3-line /// for reclassify) — same.
• BrowserURL.swift lines 57–59 (3-line /// for walkAXTimeout/walkBudget), 183–185 (3-line // in copyAttribute with W-557 ref), 246–247 (2-line /// for resolveBudget), 210–229 (the BrowserURLCache class doc comment — 20 lines with multiple W-ticket refs, modified in this PR) — same.

[claude]

Pushed fixes addressing the blocking findings on PR #177. (trace: 223a1d53)

Superseded by fix commit(s) from claude[bot] (pr-fix, trace=223a1d53).

[wr-claude-reviewer]

Round 3 follow-up — previous findings partially addressed; blocking comment-style violations still present (some newly introduced by the aa75418 Codex pass).

CI: ssot pipeline still in-progress — not blocking this review; diff analysis is independent.

---

Fixed ✓

• R2 #1 (AppContext.swift multi-line above current()) — trimmed to one line in 492772a. ✓
• R2 #6 (temp file leak on FileHandle failure in osascriptURL) — defer is now placed before the guard let outHandle so a failed open can't leave a file in /tmp. ✓

---

Blocking — still unresolved

1. FocusedElementCache.swift lines 39–48 — 10-line /// block with W-557 reference (new in aa75418)

CLAUDE.md: "Never write multi-line comment blocks — one short line max" + "Don't reference the current task, fix, or callers (W-NN)."

The block above focusedIsSecure/focusedIsEditable/haveFieldInfo is 10 lines and contains a W-557 reference. Suggested one-liner:

// Cached per focus to skip AX IPC on the tap thread; reset on element change (see element.didSet), fail-closed until set.
private(set) var focusedIsSecure = false
private(set) var focusedIsEditable = false
private(set) var haveFieldInfo = false

2. FocusedElementCache.swift lines 62–74 — 14-line /// block on reclassify (new in aa75418)

Same rules. The "inherent limit" note at lines 66–74 is non-obvious and worth keeping, but as one line:

// Classifies off-thread; publishes iff focus hasn't moved. AX-opaque apps that miss within-app moves rely on the exclusion list as backstop.
private nonisolated func reclassify(_ element: AXUIElement) {

3. BrowserURL.swift lines 33–40 — 8-line // block with W-557 in detect() (repeat from R2 #3)

Prior review flagged this as blocking; still present. Suggested:

// Two bounds: per-object timeout (does not propagate to descendants) + total deadline (caps a deep tree of fast-but-numerous nodes).
let deadline = Date().addingTimeInterval(Self.walkBudget)

4. BrowserURL.swift lines 204–208 — 5-line /// block with W-557 on BrowserURLResolution (repeat from R2 #4)

Prior review flagged this as blocking; still present. Suggested:

/// `.unavailable` means the resolve timed out — callers must keep the last good value, not overwrite it with nil.
enum BrowserURLResolution: Sendable {

5. BrowserURL.swift lines 363–372 — 11-line /// block on osascriptURL (repeat from R1 and R2 #5)

Flagged as blocking in both prior rounds; still 11 lines. Suggested:

// osascript subprocess: runs off main, killable if Arc hangs. Temp file instead of Pipe avoids the 64 KB buffer deadlock.
private nonisolated static func osascriptURL(bundleID: String) -> BrowserURLResolution {

---

Question (repeat from R2, still unanswered)

hung-app-typing-regression.sh run_target — drive hotkey command l for TextEdit.

For Arc, Cmd+L focuses the URL bar. TextEdit has no URL bar; the key may open the Go-to-Line dialog or do nothing. The tapLost signal is still valid regardless (the test is about IPC blocking, not where the text lands), but if Cmd+L opens a modal it could confuse a developer debugging a failure. Intentional as "just invoke a hotkey before freezing"? If so, a comment at the call site would help; if not, skipping it for the TextEdit target (or substituting a harmless key) would be cleaner.

---

Nits (same class — not re-filed as blocking)

• AppContext.swift: classify 4-line /// (lines ~47–50), isSecure 3-line ///, 3-line // inside current() — all one-liner violations (carried over from R2 nit list).
• FocusedElementCache.swift: element 3-line /// (lines 23–25), fieldGeneration 4-line /// (lines 33–36), publishFieldInfo 3-line /// (lines 53–55) — same.
• BrowserURL.swift: walkAXTimeout/walkBudget 3-line /// (lines 57–59), copyAttribute 3-line // with W-557 ref (lines 187–189), resolveBudget 2-line /// (lines 250–251), scheduleRefresh 5-line /// (lines 326–330), BrowserURLCache class doc 20-line /// with W-ticket refs (lines 214–233) — same.

[claude]

Pushed fixes addressing the blocking findings on PR #177. (trace: 223a1d53)

Superseded by fix commit(s) from claude[bot] (pr-fix, trace=223a1d53).