[addhumal]

The Mac says when it goes to sleep, restarts or shuts down

When the Mac went to sleep, restarted or shut down while a device streamed, the device found out only when its liveness gave up on a Mac gone silent. It then said "‹Mac› disconnected" and started its reconnect at once, dialling a row that a sleep proxy may still list for a Mac asleep (#105).

With this change Sill for Mac tells every connected device why before it goes, and the device says so and reconnects once the Mac is back. From the sleep goodbye until the Mac wakes, no device connects.

Additive on the wire: kind 22 (goodbye) gains four reasons, "sleep", "shutdown", "restart" and "poweroff". Each carries the Mac's words and "reconnect":true. A device from before them shows the Mac's words as it shows any reason it does not know, and reconnects as after any end.

What it does

On the Mac

• Sleep. NSWorkspace's willSleep, under the AppKit loop (Sill.app, and the CLI with --virtual-display). Every device gets "sleep" ("Noah’s MacBook Pro is going to sleep."), handed to the network within 0.1 s. Each connection then closes the way the device gate closes a refused one: the goodbye, this side's end, then what the device still sends is read and dropped until it closes, 1 s at most. Sill.log: "The Mac is going to sleep: 2 devices told." The CLI's default path (dispatchMain) registers nothing: NSWorkspace says nothing there, and a power client nobody answers holds the Mac's sleep up to 30 s.
• No device connects until the Mac wakes. From willSleep until NSWorkspace's didWake, every door (both TLS doors and the CLI's plain one) refuses a session with the same goodbye.
  • The refusal closes as the device gate's refusals close, and the session is never registered: no catalog, no capture, no encoder, and no user activity declared. Wake the host display for active streams #151 declares user activity at every connect, which could light the display of a Mac someone has just put to sleep, or keep it awake.
  • 0.5.1, the App Store build, dials the still-listed row as soon as its session ends, inside the sleep's transition. A source refused five times in a minute hears the next refusal 2 s late, as at the device gate.
  • DisplayWake declares nothing while the window runs.
  • The window ends at didWake, opens again at a willSleep, and lapses ten minutes of the Mac's awake time after willSleep, so a didWake that never comes shuts no door for good.
  • Sill.log: "The Mac is going to sleep: refused a session from … with the same goodbye." (once a source a minute), then "The Mac woke: devices can connect again (2 sessions refused while it slept)."
• Log out, restart, shut down. The first signal is NSWorkspace's willPowerOff. For the next 10 minutes it makes the goodbye Sill's end sends "poweroff", in the words "‹Mac› is shutting down or restarting.". Nothing is sent at willPowerOff itself: it also comes for a log out, and someone may still cancel it.
  • It goes out when Sill goes, by a SIGTERM (where that sent "quit") or by a quit Apple event.
  • That event's kAEQuitReason, read as a parameter or an attribute, decides: a restart says "restart" ("… is restarting."), a shut down "shutdown" ("… is shutting down."), a log out "quit".
  • Sill's own Quit from its menu stays "quit". Without willPowerOff or a reason (a signal alone, another app's quit), it is "quit", byte for byte as before.
• One goodbye per connection, the first, and nothing after it (StreamServer's told): a Quit right after the sleep's goodbye, or after Remove, says nothing more, and no frame, tick, pong, pointer report, state or sound packet follows a goodbye on its connection.
• HostGoodbye and SleepWindow (pure) make the choices and the log lines. Sill.log is flushed before a signal's or the Quit's exit, so the line saying what the devices heard survives a restart's SIGTERM.

On the device

• The words (GoodbyePolicy):
  • "‹Mac› went to sleep. This ‹iPad› reconnects when it wakes."
  • "‹Mac› is shutting down. This ‹iPad› reconnects when it’s back."
  • "‹Mac› is restarting. This ‹iPad› reconnects when it’s back."
  • "‹Mac› is shutting down or restarting. This ‹iPad› reconnects when it’s back." ("poweroff")
  • The device closes its end as soon as one of these comes, so the session ends at once even from a Mac already asleep.
• The reconnect's waits (DiscoveryPolicy):
  • After "sleep", a row listed at the goodbye counts as asleep, as Find the Mac again after hours idle: the browsers made again, the reconnect kept alive (#69) #77's dials would have found after three tries. Its first dial comes 20 s later, then one every 30 s, with Couldn't get the app to work after sitting dormant for a few hours. Had to login to my Mac and close and restart the app on my iPad before it would reconnect. #69's lines from that dial on, and the goodbye's words until then. A row listed afresh (the Mac awake) is dialled at once. A refusal while the Mac is asleep is the same goodbye, so it starts that count again, at either door.
  • After "shutdown", "restart" or "poweroff", a row listed since before the goodbye is the registration on its way out. It is left alone until the first of: listed afresh (the Mac back with Sill open), listed by the browser made again at a return from the background, or 10 minutes. Then it is dialled, with the words kept until that dial.
  • A goodbye read only as the app came back is dated at the return, though the Mac may have said it long before (it waited in the connection while the app was suspended). So what the browser made at that return lists counts as listed afresh, after "sleep" too, and is dialled at once.
  • Remote dials happen only after a session that came through the remote door, and not before 20 s.
• The first ping tick after the app runs again judges nothing. A suspended app's ping timer fires once, overdue, as it runs again, and its liveness check used to run before the return's reset reached the session's queue, ending the session as "connection silent … lost" before a goodbye that waited in the connection could be read. Now a tick a second or more after the one before counts the silence afresh (DiscoveryPolicy.liveness). A connection iOS reclaimed while the app was suspended still loses its goodbye: "‹Mac› disconnected…" and a dial at once, as before.
• A goodbye belongs to its connection. StreamClient keeps it only for the connection it came on: a move's hand-over drops it, a rescue is refused only for that connection, and a new session starts without one.

A wire decision for Noah: "poweroff"

willPowerOff's goodbye used to be "shutdown" in the words "… is shutting down or restarting.", so "shutdown" meant two things, and this build worded even a known shut down "is shutting down or restarting". The compatibility floor would freeze that once it shipped. The maintainer's default: a reason of its own for the case Sill cannot tell, "poweroff", so "shutdown" is only ever a shut down Sill knows. An older device shows the Mac's message as it is. To go back to one reason for both, it is one line in Remote.swift's shuttingDownOrRestarting, before any release ships either.

Restart and shut down: what was seen, what is inferred

• Seen. A restart begun from another account, while Sill.app ran in this one, ended Sill.app with SIGTERM during the system shutdown. launchd logged "exited due to exit(143) during system shutdown", and there was no log out in Sill's own session, so its goodbye was "quit".
• Seen in loginwindow's log and strings. loginwindow quits a menu bar (UI-element) app only after the point of no return: a kill attempt, then a quit Apple event to an app it could not kill.
• Seen in a probe on this Mac. AppKit posts willPowerOff as it handles a quit Apple event whose kAEQuitReason is an attribute, just before applicationShouldTerminate. With the reason as a parameter, or with no reason, it posts nothing.
• Inferred, not seen. A log out, restart or shut down begun in Sill's own session sends Sill.app such a quit event, since Sill turns sudden termination off and so cannot simply be killed. Only Noah's real Restart and Shut Down can settle this, which is why they are this pull request's merge gate. If Sill.log shows only "Shutting down: …", with no willPowerOff line and no "Quit: macOS asked Sill to quit for …", the inference is wrong.
• Not known. Whether a dark wake (a Bonjour Sleep Proxy waking the Mac for a device's dial, Power Nap) posts didWake. If it does not, the window holds through it and the dial is refused; if it does, the dial is admitted and Wake the host display for active streams #151 may light the display. Noah's sleep-proxy item says which.

Changed from the pull request as opened

The contributor's commits are untouched; these are on top.

• Background and lock wording. 8aee786's wording for an end in the background or while locked is out (7425327), for a pull request of its own read with Keep active streams responsive briefly in the background #152 (git cherry-pick 8aee786).
• One goodbye per connection, the right reason. The Quit's "quit" used to overwrite a "shutdown" on the same connection 45 ms later; now every connection gets only its first goodbye.
• The sleep closes the session. The connection used to stream on after the sleep goodbye; now it closes as the gate's refusals close, with no reset.
• The reconnect waits as the Mac said. The listed row used to be redialled at once.
• willPowerOff is the first signal, refined by the quit's reason. A SIGTERM after it keeps its goodbye.
• The holds are bounded. A device that missed the old registration's removal used to wait for good after a restart.
• After the review of 2026-10-26:
  • No session from the sleep goodbye until the wake (697e6c0). The doors used to admit a session until the Mac actually slept, and on until it woke, each declaring user activity (Wake the host display for active streams #151).
  • main merged in at 74d099c (7789575), 76bc100 (a921209) and b4caa91 (ff82939), and no sound after a goodbye (e1e73cf): The Mac's sound on the device: Send Audio, kind 43, AAC-ELD (#83) #94's sound has a send path of its own, which checked no told.
  • The first ping tick after the app runs again judges nothing (02fd5f7).
  • "poweroff" (aed225a), above.
  • Docs (66d7121): what Sill does when the last device leaves can come at the wake with 0.5.1, which waits for the Mac's close (a 1 s timer whose clock stops while the Mac sleeps); §7.3's outcome signature.

Docs

• docs/update-notice-plan.md §7.3: the four rows, how the host sends them, the window, the first tick after a return, what was seen and what is inferred, and the words that wait for a device.
  • README's Good to know, the support page and the next What's New say nothing of these goodbyes until Noah's test passes. §7.3 has their lines, to go in then.
  • When they go in, the site's line goes between <!-- Goodbye markers, with a perl line in docs/release-checklist.md part 1 §3, as the Clipboard's does.
• docs/DEVELOPMENT.md: Sill.app's goodbyes, the window and their log lines, the device's waits, and the TEST ONLY hooks:
  • -SillSleepAfter <s>
  • -SillWakeAfter <s>: what didWake does
  • -SillPowerOffAfter <s>: willPowerOff posted to the bare app alone
  • -SillQuitAfter '<s> restart|shutdown|logout[ parameter]': a quit Apple event to itself
• CLAUDE.md's entry, with Noah's list, and the compatibility floor, which keeps kind 22's reasons with their meanings; Tests/checks/README.md.

Verified

This is the tree merged with main at 74d099c (#94, Send Audio as a beta), then at 76bc100 (#157, the pairing window to screen sharing) and at b4caa91 (#147, Chinese input and dictation; #233, capture at the display's own scale). At 74d099c only CLAUDE.md (two Current-step entries), StreamServer.swift's Client fields (told beside #94's audio fields) and Tests/checks/README.md (two neighbouring rows) conflicted, and at 76bc100 and b4caa91 only CLAUDE.md; both sides were kept whole each time. #233's capture paths in StreamCoordinator and #147's caret handling in StreamClient merged by themselves and meet none of this pull request's code. Every check and build ran under nice and started only while the Mac's load was under 20 (the mutant runs' compiles were stopped while it was above). Every host ran on 127.0.0.1 with the software encoder, no router and no screen.

• Builds.
  • swift build -c release from a clean git archive of the head: "Build complete! (49.42 sec)", only the known CaptureProbe warning.
  • The iOS app as CI builds it (Xcode 27.1 27A9275, Debug, generic simulator, arm64, unsigned, fresh derived data): ** BUILD SUCCEEDED **, only the known StreamClient capture warning (StreamClient.swift:3962, the autoDesktop closure).
  • The CLI against main's at b4caa91 (--synthetic on loopback, masked and sorted): idle 30 s identical; with a Desktop client 15 s identical in three alternating runs but for cursor.shape, which follows this Mac's own cursor and came in both builds' runs.
• Checks.
  • goodbye: 169 checks; run.sh --mutants: every mutant caught (116 of 116).
  • policy: ALL PASS (526); run.sh --mutants: every mutant caught (211 of 211).
  • display-wake: 211 checks; run.sh --mutants: every mutant caught (67 of 67).
  • door-policy: ALL PASS (128); DoorPolicy and Door are unchanged.
  • main's capture-scale (79), pairing-sharing (18) and text-composition (178).
  • Tests/checks/run-all.sh: "All passed.", all 54 on the head.
  • The mutants ran on 697e6c0 (display-wake), aed225a (goodbye) and 66d7121 (policy); nothing those checks compile has changed since.
• The bare app on loopback, two TLS clients paired through a pairing window (SillMenuBar --synthetic, the identity in a scratch SILL_TEST_REMOTE_DIR, sillclient.py --tls --identity=…):
  • The sleep window. -SillSleepAfter 6 -SillWakeAfter 12, both clients streaming the Desktop with sound: each got "sleep" and nothing more; "The Mac is going to sleep: 2 devices told.". A third client that dialled 0.3 s after the goodbye, and a fourth 2 s after, got only the sleep goodbye, with no window list, settings, kind 18 or frame; no "Client connected", no disp.wakeDry and no capture start between the goodbye and the wake; "The Mac woke: devices can connect again (2 sessions refused while it slept)."; a client 0.5 s after the wake was admitted and streamed. On 697e6c0's build, aed225a's, a921209's and the head's, alike.
  • No sound after a goodbye (-sendAudio 1, clients with --audio, one counting every message after its goodbye). The sleep's goodbye, three runs: none on aed225a's build (nor on the head's, in its sleep run); the merge's own build (7789575) sent 100 sound packets on each connection in the second until the cancel, 600 in all. The Quit's goodbye: none over 22 connections on 697e6c0's and aed225a's builds; the merge's build sent a packet after it on 3 of 22. The told rule and the sound's send path are unchanged since.
  • The goodbyes at Sill's end. -SillPowerOffAfter 3, then SIGTERM: exit 143, "poweroff" ("… is shutting down or restarting.") and "The Mac is shutting down or restarting: 2 devices told.". -SillQuitAfter '5 shutdown': "shutdown" ("… is shutting down."), after willPowerOff's line, "Quit: macOS asked Sill to quit for a shut down." and "The Mac is shutting down: 2 devices told."; as a parameter, the same without willPowerOff's line. -SillQuitAfter '5 restart': "restart".
• Earlier rounds (on b9ec80e, and after the review of 2026-10-20 with main at 9a8e30c), on private iPad simulators (iOS 27.0, deleted after) against the bare app under the test service type: a sleep mid-session, the words at once, the dial 20 s later and the session back; a restart held, then a return from the background dialling at once; a paired Mac back after a restart dialled at once.
• Not done: no simulator this round (the review's run pushed the Mac's load past 90), so the first tick after a return is checked by the policy check's model of the session's queue, not live. CI has not run on this head. No real Mac sleep, restart or shut down, and no device.

For Noah: the merge gate

With Sill.app from this branch (release-signed with the embedded profile) and the iPad on this build:

• Sleep (Apple menu › Sleep, and the lid) while streaming:

  • "‹Mac› went to sleep…" at once, and "The Mac is going to sleep: 1 device told." in Sill.log.
  • After waking it, the session back by itself, and "The Mac woke: devices can connect again." in Sill.log.
  • Close the lid for a few seconds with a window picked (Aa set, and once with Virtual Display on). Every sleep ends every session, so what Sill does when the last device leaves runs as the Mac sleeps: capture stops, a sized window goes back, the virtual display goes and its window home. With 0.5.1 it can come at the wake instead. Note what the Mac's window does and what the device shows after.

• 0.5.1 streaming, Apple menu › Sleep: the Mac stays asleep, its display dark. 0.5.1 dials again as soon as its session ends; Sill.log may show "The Mac is going to sleep: refused a session from …" before the Mac sleeps.

• Behind an Apple TV or HomePod sleep proxy, the Mac left asleep: whether the device's dials (the first 20 s after the goodbye, then every 30 s) wake it, and what Sill.log says then. "refused a session" means a dark wake posts no didWake and the window held, so the Mac should go back to sleep with its display dark. "The Mac woke" then "Woke the display for …, which connected." means a dark wake posts didWake and Wake the host display for active streams #151 lit the display: send the lines.

• Restart and Shut Down from the Apple menu while streaming. Sill.log should have:

  • "macOS says the Mac is about to log out, restart or shut down."
  • "Quit: macOS asked Sill to quit for a restart."
  • "The Mac is restarting: 1 device told."
  • For Shut Down, "… for a shut down." and "The Mac is shutting down: 1 device told."

  Only "Shutting down: …" means the inference is wrong: send the lines. Then check the device's words ("is restarting", "is shutting down"), and the session back once the Mac is up with Sill open.

• A restart begun from another account: "quit", as seen. Log Out: "quit".

• The iPad locked, or Sill in the background, through a sleep and through a restart, back a minute later: the Mac's own words, not "disconnected" ("disconnected" means iOS reclaimed Sill's connection while it was suspended, the known limit), and the Mac dialled as soon as it is listed, not after 10 minutes.

• 0.5.1 from the App Store against this Sill.app: the Mac's message, then its own Reconnecting.

• Through Tailscale, a sleep: the remote dials from 20 s on.

• A decision: willPowerOff's goodbye keeps its own reason, "poweroff", or goes back to "shutdown" for both.

🤖 Generated with Claude Code

Towards #105

[addhumal]

Now that #77 is on main, pushed 8aee786 (and merged main in 485149e) with the device's own reasons: when a session ends without a goodbye after Sill went to the background (or the device locked: protectedDataWillBecomeUnavailable) before a pong for a ping sent since the return (GoodbyePolicy.AwaySpell, enteredBackground, heardPong), the status line says "The connection to ‹Mac› ended while Sill was in the background." or "…while this iPad was locked.", and the "Reconnecting to ‹Mac›…" lines carry "(the connection ended while …)" until the session is back or the line moves on to "…isn’t answering". goodbye is now 70 checks and 34 of 34 mutants, policy 448 and 160.

[Saffsanity]

From a pass over all the open pull requests (nothing is decided yet): #117 also adds a line to StreamClient.tearDown right after resetHomeMove() (its preview save, beside this PR's awaySpell = nil), so whichever lands second keeps both, and #158 edits StreamClient.swift as well. #66 (and #72 and #73, built on it) compiles StreamClient.swift into a Mac client, where the new UIApplication.protectedDataWillBecomeUnavailableNotification observer would need its ClientPlatform layer or a guard, and #128's viewer shims lack that notification too. The rest (#94, #124, #158, #159) is rows of Tests/checks/README.md; separately, #152 keeps a session alive for a while in the background, which changes when the new background wording would show, so the two are worth reading together.

[addhumal]

Thanks. Wrapped the UIApplication.protectedDataWillBecomeUnavailableNotification observer in #if canImport(UIKit) (9b59e0d), so Mac client targets (#66, #128) that compile StreamClient.swift need no shim for it, and pushed 34872a5 so goodbyeBeforeSleep closes the connections once the goodbye is handed over (preventing shutdownForExit from sending a second "quit" goodbye on top of "shutdown") and endWithNotice keeps the sleep/shutdown reason on the "Reconnecting…" line (goodbye: 76 checks, 38 of 38 mutants). Also noted on #117 (tearDown keeps both lines) and #152 (with a background task keeping the session alive briefly, the background wording only appears if the session still ends before a post-return pong arrives).