fix(swift-ios): refresh passive environments independently

[saphid]

A slow or unreachable passive environment (a paired computer that isn't the active one) held up refreshes for every other passive environment, because the aggregate loop fetched all passive shells in one batch and waited for the slowest.

Each enabled passive environment now gets its own bounded refresh worker (shell poll plus a one-shot catalogue probe). A topology loop reconciles workers against the saved environments. Workers are cancelled when their environment is removed, disabled, edited, or becomes active, or when the owning session changes, and they check membership again after every suspension so a late response can't bring back a removed row. Cached rows stay visible while a peer is unreachable, keeping its failure detail, and failures back off to the configured failure interval without slowing healthy peers. A peer whose pairing was rejected stops probing its catalogue (each probe mints a WebSocket ticket) until it is paired again. The managed connection is published before passive refresh starts.

This PR is stacked on t3code/rebuild-mobile-app-swift (#5178): the SwiftUI client only exists on that branch, so this targets it rather than main. Rebased onto the base tip 157476f1fb.

No UI changes, so there's no before/after media.

Verification

• Focused XCTest on iOS Simulator at 2691d2fd5a (isolated DerivedData): NativeMultiEnvironmentTests 33 passed and NativePassiveThreadRefreshTests 7 passed, including new cases for failure-backoff isolation, healthy publishes while a peer shell and catalogue are held, stale-generation rejection, removal cancelling a held peer, and a rejected peer minting no catalogue tickets. That last test times out against the previous code.
• Independent cross-provider review of the rebased change: devin -p --model swe-2-max, exit 0. No correctness defects. Its low-severity notes (the catalogue's own failure retry uses Task.sleep rather than the injected per-peer sleep; one snapshot build per peer wake, deduplicated on publish) were left as they are.

Coordination trace: T3 thread 31463569-aace-46fd-a6e8-1a56ad2a35a7

Model and harness: GPT-6 / Codex (original), Claude Opus 5 / Claude Code (refresh and simplification), Claude Opus 5.5 / Claude Code (rebase onto 157476f1fb and rejected-peer fix), SWE-2 High / Cursor via T3 Code (base verification, independent review, and PR upkeep).

🤖 Generated with Claude Code

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The production refresh subsystem is substantially reworked from one aggregate loop into per-environment workers with new cancellation, topology reconciliation, snapshot publication, and rejected-credential behavior. This changes existing network and state-management behavior across passive environments and warrants human review.

^{You can add or adjust custom eligibility rules. Learn more.}

[saphid]

@t3dotgg Could you review this SwiftUI reliability/performance fix? It will refresh passive environments independently so one stalled peer does not block healthy peers. It does not change the visible interface. This can be reviewed independently against your SwiftUI branch.

[juliusmarminge]

Note

This comment is posted by Julius' dot

Closing under the prior approval rule. The slow-peer stall is documented and covered by focused tests. This fix replaces the aggregate refresh lifecycle with separate shell and catalogue workers, topology reconciliation, and cancellation. A substantial bug fix needs a maintainer-triaged issue establishing the failure and intended behavior; this PR, #5178, and #10761 provide no such decision. Please get that maintainer decision, agree on the scope, link it here, and request reconsideration.