Found by the seventh review of #84, pre-existing on main's attach path and untouched by that PR.
Interleaving
Peer A has been told something (so displace owes it a notice). A's client stops draining. The notice takes A's announce hold uncontended and dies inside its own write when the handoff step's deadline expires. The stream deliberately does not close a socket whose caller's deadline expired (so one take-over cannot disconnect a client reading scrollback), and the post-write correction loop in announceAs is gated on the caller's context, so it never turns. Result: the plane has A at view@N, A's client still believes attached control N-1, its stdin is dropped at the plane, its heartbeat is inert for a viewer, and its take-control key sends no claim because the client believes it controls. Only detaching recovers it.
Reproduced by a probe on the review's throwaway copy; no shipped test pins it.
Fix direction
Record that a peer is owed a notice when announceAs returns without landing one (send error, or the early return when the hold could not be taken in time), and retry it on the existing heartbeat tick, extended to cover a viewer whose last announce was dropped. Add the probe as the regression test.
Acceptance
The probe passes; the stress set and the mutation battery from the #84 reviews stay clean; no new unbounded wait on any handoff path.
Found by the seventh review of #84, pre-existing on
main's attach path and untouched by that PR.Interleaving
Peer A has been told something (so
displaceowes it a notice). A's client stops draining. The notice takes A's announce hold uncontended and dies inside its own write when the handoff step's deadline expires. The stream deliberately does not close a socket whose caller's deadline expired (so one take-over cannot disconnect a client reading scrollback), and the post-write correction loop inannounceAsis gated on the caller's context, so it never turns. Result: the plane has A atview@N, A's client still believesattached control N-1, its stdin is dropped at the plane, its heartbeat is inert for a viewer, and its take-control key sends no claim because the client believes it controls. Only detaching recovers it.Reproduced by a probe on the review's throwaway copy; no shipped test pins it.
Fix direction
Record that a peer is owed a notice when
announceAsreturns without landing one (send error, or the early return when the hold could not be taken in time), and retry it on the existing heartbeat tick, extended to cover a viewer whose last announce was dropped. Add the probe as the regression test.Acceptance
The probe passes; the stress set and the mutation battery from the #84 reviews stay clean; no new unbounded wait on any handoff path.