[ymote]

Stacked on #185, the makepad bcb0583b repin. Review and merge that first, then retarget this PR to main. Part of #179, the Phase 1 item "hosted close path skips the running-job confirmation".

Problem

makepad#65 gave AppModule a close-veto hook: close_requested(cx, root) -> CloseDecision and ModuleCloseAction::Confirmed. The shell still dropped a module instance at once. So closing an in-process Terminal tile, or quitting OctoSense, sent SIGHUP to its running jobs without asking.

Design

• module_host::CloseGate (owned by ModuleHost) tracks each pending close as client → root widget_uid, plus whether a quit is waiting.
  • ModuleHost::ask_close calls close_requested outside the isolate under contain_outside, as the executor calls are. A panic there is contained and treated as Allow.
  • A failed instance, or one that is not a module, is always Allow.
  • teardown and release_failed forget the instance's pending mark.
• App::request_close, which the tile close button, Super+W, the bar, Alt+F4, the assistant's close tool and a Recents swipe all go through:
  • Allow: tears the instance down as before.
  • Veto: keeps the tile and the instance and calls activate_client so the tile comes to the front with its question. It logs asks before closing.
• handle_actions: a ModuleCloseAction::Confirmed from a pending root's uid calls remove_client. A Confirmed from any other uid is ignored. A cancel emits nothing, so nothing changes.
• Quit: the shell menu's Quit, Event::QuitRequested (Cmd+Q, /quit) and Event::WindowCloseRequested (the window's close button, /close) call ask_before_quit.
  • It asks every instance. If any refuses, the quit waits, and the first instance that refused comes to the front.
  • shell_handle_event calls cx.quit() once the last refusing instance confirms, or fails.
  • QuitReason::Signal, a crash and a module fault never ask.
  • If the person closes one app while a quit is waiting, the waiting quit is dropped. Saying yes later then closes only that app, not the shell.
• The assistant's close tool answers "asks the person before closing". A Recents swipe on an app that refuses opens that app instead of staying on Recents.

Tests

crates/shell/src/module_close_tests.rs, 11 new tests:

• CloseGate:
  • Allow tears down.
  • Veto keeps the instance and records it as pending.
  • Only the pending root's uid confirms.
  • A second or stale Confirmed does nothing.
  • A quit nobody refuses goes ahead.
  • A quit waits for every refusal.
  • A failed instance does not hold a quit.
  • Closing one app drops a waiting quit.
• ModuleHost, with real probe instances:
  • Allow versus Veto.
  • A Confirmed from another instance's root is ignored.
  • A module that panics in close_requested is let go.
  • The shell quit waits for two refusing instances and ignores one that allows.

Results:

• cd phone && cargo test --locked --features mobile-apps -p octosense-shell: 595 passed (584 + 11).
• ... --features mobile-apps,app-terminal -p octosense-shell terminal: 14 passed.
• cargo check --locked -p octosense: ok.

Instrument evidence (macOS)

The run was MAKEPAD_HIDE_WINDOWS=1 MAKEPAD_REMOTE=8471 octosense --module terminal --test-action launch-terminal, release build, with a temp OCTOSENSE_HOME, OCTOSENSE_APP_DATA and OCTOS_APP_CORE_DIR.

Step	Result
sleep 300, then click the tile's close button	The tile stays. Its bar reads Closing the terminal ends "sleep". Close anyway? with Close (Enter) and Cancel (Esc). Log: terminal (client 1) asks before closing
Esc	The prompt goes away. The tile and sleep are still there
/quit	Same prompt. The shell is still up. Log: quit waits: clients [1]
Esc, then /close?w=0	{"ok":1,"refused":1} and the same prompt
Esc, click close again, then Enter	client 1 confirmed its close, then terminal.1 torn down. The tile is gone, sleep has ended and the shell stays up, because the earlier waiting quit was dropped
A new Terminal with sleep 301, /quit, then Enter	client 2 confirmed its close, then every instance confirmed; quitting. The shell exits and sleep has ended

No panics in the log.

Not covered here

• The macOS desktop Terminal runs as a process by default (native-apps.json hosting). Only --module terminal, or a terminal: Module line, hosts it in-process, which is where this change applies.
• For a process client, request_close still sends WmEvent::CloseRequested and Kill back to back. The process terminal's veto on CloseRequested is therefore overridden, and its jobs still end without asking. This is the same gap makepad#65 notes for the in-tree WM. Fixing it needs the shell to wait for the app's answer, or for its exit, before it kills. That should be a separate change.

🤖 Generated with Claude Code