Auto-attach: restore manual-supersede under main's validation split; enable presence-online-preferred via live presence (#5792)

Two post-rebase changes:

1. Manual pairing must supersede an in-flight auto-attach at the TOP of
   connectPairingURLResult, before validation, so even an invalid code
   parks the background attempt (the documented invariant the
   manualPairingSupersedes* / invalidManualHost* tests assert). Main's
   #6028 refactor split the post-validation beginPairingAttempt(method:
   "qr") out of the early path, so the supersede no longer rode on it.
   Call supersedeInFlightAutoAttach() explicitly; it is guarded on
   autoAttachInFlight, so it is a no-op when nothing is parked.

2. Presence #5792 has landed, so wire its live signal into auto-attach
   target selection (deferred when the PR was opened). The shell already
   owns a live PresenceMap from the device-tree subscription; derive
   online device ids from it (new PresenceMap.onlineDeviceIDs, same
   rollup rule as deviceSummary) when no explicit MobileAutoAttachPresence
   provider is injected and presence data exists. The external provider
   seam still wins if set, and an empty map (no presence yet) keeps the
   recency-only path unchanged, so existing behavior and tests are
   preserved. This stays behind the auto-attach flag.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lawrencecchen

Packages/CmuxMobileShell/Sources/CmuxMobileShell/MobileShellComposite.swift

@@ -1665,7 +1665,19 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         await loadRegistryDevices()
         guard stillCurrent() else { return false }
 
-        let presenceOnline = await autoAttachPresence?.onlineDeviceIDs()
+        // Prefer an explicitly injected presence provider; otherwise fall back to
+        // the shell's own live presence stream (#5792), which the device tree
+        // already subscribes. Either way the selector prefers a single online Mac
+        // and treats multiple online Macs as ambiguous. `nil` (no provider AND no
+        // presence data yet) keeps the recency-only path unchanged.
+        let presenceOnline: Set<String>?
+        if let provided = await autoAttachPresence?.onlineDeviceIDs() {
+            presenceOnline = provided
+        } else if !presenceMap.isEmpty {
+            presenceOnline = presenceMap.onlineDeviceIDs()
+        } else {
+            presenceOnline = nil
+        }
         guard stillCurrent() else { return false }
 
         // On a physical phone, reject loopback routes: a `127.0.0.1` route names
@@ -2530,9 +2542,13 @@ public final class MobileShellComposite: MobileTerminalOutputSinking {
         _ rawValue: String? = nil,
         acceptedVersionWarning: Bool
     ) async -> MobilePairingURLConnectionResult {
-        // `beginPairingAttempt` below supersedes any in-flight auto-attach (and
-        // resolves its restoring gate), so a background attempt that resumes
-        // mid-pairing cannot invalidate this manual attempt.
+        // A user-initiated manual pairing supersedes any in-flight auto-attach
+        // (and resolves its restoring gate) here at the top, BEFORE validation, so
+        // even an invalid code parks the background attempt and a later resume
+        // cannot invalidate this manual attempt. (Main split the post-validation
+        // `beginPairingAttempt(method: "qr")` out of this early path, so the
+        // supersede no longer rides on it and must fire explicitly.)
+        supersedeInFlightAutoAttach()
         let rawURL = Self.normalizedPairingURL(rawValue ?? pairingCode)
         _ = beginPairingValidationAttempt()
         connectionAttemptGeneration = UUID()

Packages/CmuxMobileShell/Sources/CmuxMobileShell/PresenceMap.swift

@@ -86,4 +86,19 @@ public struct PresenceMap: Equatable, Sendable {
             lastSeenAt: Date(timeIntervalSince1970: lastSeenMs / 1000)
         )
     }
+
+    /// The device ids the live presence stream currently reports online (any
+    /// instance online), using the same rollup rule as ``deviceSummary``. This
+    /// is the auto-attach target selector's presence signal: it prefers a single
+    /// live Mac and treats 2+ live Macs as ambiguous instead of guessing on
+    /// recency. Empty when no presence data has streamed yet, which the caller
+    /// distinguishes from "data exists, nobody online" via ``isEmpty``.
+    public func onlineDeviceIDs() -> Set<String> {
+        var ids: Set<String> = []
+        for (deviceId, instances) in instancesByDevice
+        where instances.values.contains(where: { $0.online }) {
+            ids.insert(deviceId)
+        }
+        return ids
+    }
 }

Packages/CmuxMobileShell/Tests/CmuxMobileShellTests/PresenceMapTests.swift

@@ -116,4 +116,21 @@ import Testing
         #expect(map.instance(deviceId: "mac-a", tag: "ghost") == nil)
         #expect(map.deviceSummary(deviceId: "mac-z") == nil)
     }
+
+    @Test func onlineDeviceIDsRollsUpAnyOnlineInstancePerDevice() {
+        var map = PresenceMap()
+        // mac-a: one online instance; mac-b: only offline instances; mac-c: a
+        // mix (offline default + online build tag) so the device counts as online.
+        map.apply(snapshot([
+            instance(deviceId: "mac-a", tag: "default", online: true),
+            instance(deviceId: "mac-b", tag: "default", online: false),
+            instance(deviceId: "mac-c", tag: "default", online: false),
+            instance(deviceId: "mac-c", tag: "beta", online: true),
+        ]))
+        #expect(map.onlineDeviceIDs() == ["mac-a", "mac-c"])
+        // An empty map yields no online ids; the auto-attach caller distinguishes
+        // this "no presence data yet" case from "data exists, nobody online" via
+        // `isEmpty`, so it can fall back to recency only when truly unseeded.
+        #expect(PresenceMap().onlineDeviceIDs().isEmpty)
+    }
 }