stdiod: truthful state.json server states + token-based version-close matching

[Miyamura80]

Stack 2/3 (base: #37). First daemon behavior change in the stack.

• state.json can now actually report crashed: Supervisor::snapshot_entries previously hardcoded running for every live child. Crash publication now happens from the pump path itself (nothing else wakes the supervisor when a child dies alone), guarded by name+pid so a late report can't mark a same-named respawned replacement. starting stays reserved with the rationale documented: a stdio child is silent until the backend lazily opens a session, so there is no honest signal separating it from idle-running.
• Version-close matching widened from prefix to token: needs_upgrade now triggers on any 1008 close whose reason contains protocol_version (was: exact-prefix match), so the backend can reword its close reason without silently turning upgrade-required into an infinite retry loop. server_hello version differences are informational per T-13.
• PROTOCOL.md T-09/T-13/T-62/T-69/T-72 updated to match; new error-code table (server_offline, spawn_failed, server_unresponsive, stdio_tunnel_disabled, device_offline).

Consumer check done: the desktop tray's ServerRunState union already declares 'starting' | 'running' | 'crashed' and both consumers bucket non-running states correctly (packages/desktop/src/main/stdiod/types.ts, trayMenu.ts, StdiodEnableCard.tsx) — this PR makes an already-designed state reachable.

Verified: fmt/clippy/cargo test --workspace (112 tests), including a load-bearing check that reverting the snapshot fix fails the new crashed test.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NgN7YdfLT41kWnWqe1MPZa

---

Generated by Claude Code

---

Summary by cubic

Make state.json truthful and ordered: mark a server crashed only after an observed process exit, and write updates under the mutex to prevent out-of-order snapshots. Version handling now matches the backend’s supported window; any 1008 that mentions protocol_version triggers needs_upgrade, and differing server_hello versions are informational.

• Bug Fixes

  • Publish crashed once when an exit is observed (from pumps or a reap), addressed by name+pid; live-but-unreachable children still emit server_offline and stay running until respawn.
  • StateWriter::update writes while holding the lock so generations stay monotonic under concurrent updates.
  • Treat any 1008 containing protocol_version as upgrade-required; log server_hello.protocol_version differences at info and continue.

• Refactors

  • Split desired-state reconcile and per-child diagnostics into daemon_reconcile.rs and child_diagnostics.rs. Added tests for truthful state.json, broken-stdin behavior, and concurrent update ordering.

^{Written for commit cee91eb. Summary will update on new commits.}

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

[cubic-dev-ai]

1 issue found across 9 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/stdiod/crates/edison-stdiod/src/daemon.rs">

<violation number="1" location="crates/stdiod/crates/edison-stdiod/src/daemon.rs:721">
P2: The tray can retain a stale `running` or `crashed` child entry after a crash or respawn. Passing the writer into child pumps makes these updates concurrent with `Supervisor::publish_state`, but the writer only serializes state mutation—not the subsequent file write—so the write should also be serialized (or protected by a dedicated I/O mutex).</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P2: The tray can retain a stale running or crashed child entry after a crash or respawn. Passing the writer into child pumps makes these updates concurrent with Supervisor::publish_state, but the writer only serializes state mutation—not the subsequent file write—so the write should also be serialized (or protected by a dedicated I/O mutex).

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/stdiod/crates/edison-stdiod/src/daemon.rs, line 721:

<comment>The tray can retain a stale `running` or `crashed` child entry after a crash or respawn. Passing the writer into child pumps makes these updates concurrent with `Supervisor::publish_state`, but the writer only serializes state mutation—not the subsequent file write—so the write should also be serialized (or protected by a dedicated I/O mutex).</comment>

<file context>
@@ -688,6 +718,7 @@ impl Supervisor {
             &enriched,
             self.tunnel_outgoing.clone(),
             sensitive_arg_values,
+            Some(self.state.clone()),
         ) {
             Ok(child) => {
</file context>

[Miyamura80]

Fixed in 223b93d: StateWriter::update now performs the file write while still holding the state mutex, so mutation + write are a single critical section and a stale snapshot can no longer be written last. (Cubic's re-review didn't self-mark this thread, hence the manual note.)

---

Generated by Claude Code

[cubic-dev-ai]

All reported issues were addressed across 6 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 7 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/stdiod/crates/edison-stdiod/src/proc.rs">

<violation number="1" location="crates/stdiod/crates/edison-stdiod/src/proc.rs:468">
P3: This supplementary crash-publication path in `ChildServer::take_terminal_error` uses a single `try_wait()` to detect the child's exit, whereas the primary pump path (`report_terminal`) polls via `child_exit_status`, which retries up to 10 times over ~100ms precisely because a child's pipes close a moment before it becomes reapable. In the dead-but-not-yet-reapable window the supervisor's `take_terminal_error` will see `status == None`, so `mark_observed_exit`/`publish_crashed` here are skipped. The pumps still cover this window (and `crash_published` makes the write one-shot), so it isn't a visible failure today, but the new path claims to publish crashed on the supervisor reap and won't reliably do so in exactly the timing gap the existing poll helper was added to close. Reusing `child_exit_status` here keeps the two observers consistent.</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P3: This supplementary crash-publication path in ChildServer::take_terminal_error uses a single try_wait() to detect the child's exit, whereas the primary pump path (report_terminal) polls via child_exit_status, which retries up to 10 times over ~100ms precisely because a child's pipes close a moment before it becomes reapable. In the dead-but-not-yet-reapable window the supervisor's take_terminal_error will see status == None, so mark_observed_exit/publish_crashed here are skipped. The pumps still cover this window (and crash_published makes the write one-shot), so it isn't a visible failure today, but the new path claims to publish crashed on the supervisor reap and won't reliably do so in exactly the timing gap the existing poll helper was added to close. Reusing child_exit_status here keeps the two observers consistent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/stdiod/crates/edison-stdiod/src/proc.rs, line 468:

<comment>This supplementary crash-publication path in `ChildServer::take_terminal_error` uses a single `try_wait()` to detect the child's exit, whereas the primary pump path (`report_terminal`) polls via `child_exit_status`, which retries up to 10 times over ~100ms precisely because a child's pipes close a moment before it becomes reapable. In the dead-but-not-yet-reapable window the supervisor's `take_terminal_error` will see `status == None`, so `mark_observed_exit`/`publish_crashed` here are skipped. The pumps still cover this window (and `crash_published` makes the write one-shot), so it isn't a visible failure today, but the new path claims to publish crashed on the supervisor reap and won't reliably do so in exactly the timing gap the existing poll helper was added to close. Reusing `child_exit_status` here keeps the two observers consistent.</comment>

<file context>
@@ -690,6 +462,10 @@ impl ChildServer {
+            // This reap may be the first (or only) observation of the exit,
+            // so state.json has to hear about it from here too, not just from
+            // the stdout pump's death path.
+            self.diagnostics.publish_crashed(&self.server_id).await;
         }
         self.diagnostics
</file context>

[Miyamura80]

Declining the swap to child_exit_status here — the single try_wait is deliberate, because this call site sits on the supervisor's dispatch loop, not on a dying child's pump:

• take_terminal_error is reached for every frame routed at a child whose has_exited() latch is set, and that includes the broken-stdin child whose process is alive by design (the T-72 self-healing case). try_wait can't distinguish "alive" from "dead but not yet reapable" — both return None — so child_exit_status would burn its full ~100ms poll budget on the supervisor's single event loop for every frame routed at a live child until reconciliation replaces it. That trades a real, repeated dispatch-loop stall for a window the pumps already own.
• This path is the late observer by construction: it runs in reaction to the pump's terminal report, i.e. after report_terminal has already done the bounded poll right at the moment of death. If that poll got the status, crashed is already published; if it timed out, the process has almost certainly become reapable by the time frames route here, so the single try_wait succeeds. The residual gap is exactly the one the pump path covers, and crash_published makes the overlap one-shot.

So: pumps stay the primary observer with the poll; this reap stays an opportunistic, zero-latency secondary.

---

Generated by Claude Code