6b789ff fix(snapshot): enforce strict async lifecycle · vev

M internal/usecase/daemon/daemon.go +4 -2


@@ -103,11 +103,13 @@ type Daemon struct {
103	103		snaps ports.SnapshotStore
104	104		snapsEnabled bool
105	105		snapshotMarshal func(snapcodec.Session) ([]byte, error)
106		-	snapshotJobs chan snapshotCapture
	106	+	snapshotJobs chan *snapshotCapture
107	107		snapshotWorkerMu sync.Mutex
	108	+	snapshotWorkerID uint64
108	109		snapshotWorkerCtx context.Context
109	110		snapshotWorkerCancel context.CancelFunc
110	111		snapshotWorkerDone chan struct{}
	112	+	snapshotWorkerInFlight *snapshotCapture
111	113		restoreDone chan struct{}
112	114		restoreOnce sync.Once
113	115		procCwd func(int) (string, error)

@@ -293,7 +295,7 @@ func New(ptys ports.PTYFactory, clock ports.Clock, log *slog.Logger, opts ...Opt
293	295		restoreDone: make(chan struct{}),
294	296		animWake: make(chan struct{}, 1),
295	297		snapshotMarshal: snapcodec.Marshal,
296		-	snapshotJobs: make(chan snapshotCapture, snapshotQueueCapacity),
	298	+	snapshotJobs: make(chan *snapshotCapture, snapshotQueueCapacity),
297	299		resumeParkGrace: defaultResumeParkGrace,
298	300		barScripts: &barScriptState{
299	301		cfg: barConfigFromDomain(domain.Defaults().Bar),

 	snaps                   ports.SnapshotStore
 	snapsEnabled            bool
 	snapshotMarshal         func(snapcodec.Session) ([]byte, error)
-	snapshotJobs            chan snapshotCapture
+	snapshotJobs            chan *snapshotCapture
 	snapshotWorkerMu        sync.Mutex
+	snapshotWorkerID        uint64
 	snapshotWorkerCtx       context.Context
 	snapshotWorkerCancel    context.CancelFunc
 	snapshotWorkerDone      chan struct{}
+	snapshotWorkerInFlight  *snapshotCapture
 	restoreDone             chan struct{}
 	restoreOnce             sync.Once
 	procCwd                 func(int) (string, error)
 		restoreDone:     make(chan struct{}),
 		animWake:        make(chan struct{}, 1),
 		snapshotMarshal: snapcodec.Marshal,
-		snapshotJobs:    make(chan snapshotCapture, snapshotQueueCapacity),
+		snapshotJobs:    make(chan *snapshotCapture, snapshotQueueCapacity),
 		resumeParkGrace: defaultResumeParkGrace,
 		barScripts: &barScriptState{
 			cfg:         barConfigFromDomain(domain.Defaults().Bar),

M internal/usecase/daemon/snapshot.go +71 -39


@@ -4,6 +4,7 @@ import (
4	4		"context"
5	5		"fmt"
6	6		"math"
	7	+	"sync"
7	8		"time"
8	9
9	10		"github.com/bnema/vev/internal/domain"

@@ -24,6 +25,7 @@ type snapshotCapture struct {
24	25		createdAt uint64
25	26		active uint16
26	27		tabs []snapshotCaptureTab
	28	+	finishOnce sync.Once
27	29		}
28	30
29	31		type snapshotCaptureTab struct {

@@ -245,24 +247,19 @@ func markSnapshotDirty(sess *session) {
245	247		}
246	248
247	249		func restorePaneTerminal(p *pane, snap snapcodec.Pane) error {
	250	+	if len(snap.Tail) == 0 {
	251	+	return fmt.Errorf("snapshot history: missing tail blob")
	252	+	}
	253	+	if len(snap.Visible) == 0 {
	254	+	return fmt.Errorf("snapshot visible: missing visible blob")
	255	+	}
248	256		p.mu.Lock()
249	257		defer p.mu.Unlock()
250		-	// Unmarshal requires both blobs. The empty fallback only supports direct
251		-	// in-process construction used by restore callers; it is unreachable for a
252		-	// durable snapshot because the v3 manifest rejects missing blobs.
253		-	tail := snap.Tail
254		-	if len(tail) == 0 {
255		-	tail, _ = vt.MarshalEmptyHistoryTail()
256		-	}
257		-	visible := snap.Visible
258		-	if len(visible) == 0 {
259		-	visible, _ = vt.MarshalVisible(p.screen.PrimaryVisibleFrame())
260		-	}
261		-	history, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: defaultScrollbackRows}, snap.SealedChunks, tail)
	258	+	history, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: defaultScrollbackRows}, snap.SealedChunks, snap.Tail)
262	259		if err != nil {
263	260		return fmt.Errorf("snapshot history: %w", err)
264	261		}
265		-	if err := p.screen.RestorePrimaryVisible(visible); err != nil {
	262	+	if err := p.screen.RestorePrimaryVisible(snap.Visible); err != nil {
266	263		return fmt.Errorf("snapshot visible: %w", err)
267	264		}
268	265		p.history = history

@@ -305,7 +302,7 @@ func (d Daemon) scheduleSnapshot(sess session) bool {
305	302
306	303		capture, ok := d.captureSnapshotState(sess, generation)
307	304		if !ok {
308		-	d.finishSnapshotCapture(sess, generation, false)
	305	+	d.finishSnapshotCapture(capture, false)
309	306		return false
310	307		}
311	308		if d.enqueueSnapshotCapture(capture) {

@@ -313,14 +310,14 @@ func (d Daemon) scheduleSnapshot(sess session) bool {
313	310		}
314	311		// Coalesce under saturation or shutdown: the latest state stays dirty and
315	312		// will be captured on a later tick once an active worker has room.
316		-	d.finishSnapshotCapture(sess, generation, false)
	313	+	d.finishSnapshotCapture(capture, false)
317	314		return false
318	315		}
319	316
320	317		// enqueueSnapshotCapture serializes worker shutdown with the non-blocking
321	318		// queue send. The queue is deliberately never closed: producers can race
322	319		// shutdown without risking a send-on-closed panic.
323		-	func (d *Daemon) enqueueSnapshotCapture(capture snapshotCapture) bool {
	320	+	func (d Daemon) enqueueSnapshotCapture(capture snapshotCapture) bool {
324	321		d.snapshotWorkerMu.Lock()
325	322		defer d.snapshotWorkerMu.Unlock()
326	323		if d.snapshotWorkerCancel == nil \|\| d.snapshotWorkerCtx == nil \|\| d.snapshotWorkerCtx.Err() != nil {

@@ -337,9 +334,9 @@ func (d *Daemon) enqueueSnapshotCapture(capture snapshotCapture) bool {
337	334		// captureSession rotates history tails and clones visible frames while holding
338	335		// each pane lock. The returned capture contains only immutable state; encoding
339	336		// and persistence are deliberately deferred to snapshotEncodeWorker.
340		-	func (d Daemon) captureSnapshotState(sess session, generation uint64) (snapshotCapture, bool) {
	337	+	func (d Daemon) captureSnapshotState(sess session, generation uint64) (*snapshotCapture, bool) {
341	338		sess.mu.Lock()
342		-	capture := snapshotCapture{
	339	+	capture := &snapshotCapture{
343	340		session: sess,
344	341		generation: generation,
345	342		name: sess.name,

@@ -351,7 +348,7 @@ func (d Daemon) captureSnapshotState(sess session, generation uint64) (snapsho
351	348		tabs := append([]*tab(nil), sess.tabs...)
352	349		sess.mu.Unlock()
353	350		if ephemeral \|\| capture.name == "" {
354		-	return snapshotCapture{}, false
	351	+	return capture, false
355	352		}
356	353
357	354		capture.tabs = make([]snapshotCaptureTab, 0, len(tabs))

@@ -409,7 +406,7 @@ func (d Daemon) captureSession(sess session) bool {
409	406		return d.scheduleSnapshot(sess)
410	407		}
411	408
412		-	func (d *Daemon) encodeSnapshotCapture(capture snapshotCapture) ([]byte, error) {
	409	+	func (d Daemon) encodeSnapshotCapture(capture snapshotCapture) ([]byte, error) {
413	410		snap := snapcodec.Session{Name: capture.name, CreatedAt: capture.createdAt, Active: capture.active, Tabs: make([]snapcodec.Tab, 0, len(capture.tabs))}
414	411		for _, tabCapture := range capture.tabs {
415	412		tabSnap := snapcodec.Tab{

@@ -435,15 +432,20 @@ func (d *Daemon) encodeSnapshotCapture(capture snapshotCapture) ([]byte, error)
435	432		return d.snapshotMarshal(snap)
436	433		}
437	434
438		-	func (d Daemon) finishSnapshotCapture(sess session, generation uint64, succeeded bool) {
439		-	sess.snapshotMu.Lock()
440		-	sess.snapshotPending = false
441		-	if succeeded && sess.snapshotGeneration == generation {
442		-	sess.snapDirty.Store(false)
443		-	} else if !succeeded {
444		-	sess.snapDirty.Store(true)
	435	+	func (d Daemon) finishSnapshotCapture(capture snapshotCapture, succeeded bool) {
	436	+	if capture == nil {
	437	+	return
445	438		}
446		-	sess.snapshotMu.Unlock()
	439	+	capture.finishOnce.Do(func() {
	440	+	capture.session.snapshotMu.Lock()
	441	+	capture.session.snapshotPending = false
	442	+	if succeeded && capture.session.snapshotGeneration == capture.generation {
	443	+	capture.session.snapDirty.Store(false)
	444	+	} else if !succeeded {
	445	+	capture.session.snapDirty.Store(true)
	446	+	}
	447	+	capture.session.snapshotMu.Unlock()
	448	+	})
447	449		}
448	450
449	451		func (d *Daemon) startSnapshotEncodeWorker(ctx context.Context) {

@@ -456,9 +458,12 @@ func (d *Daemon) startSnapshotEncodeWorker(ctx context.Context) {
456	458		return
457	459		}
458	460		workerCtx, cancel := context.WithCancel(ctx)
	461	+	d.snapshotWorkerID++
	462	+	workerID := d.snapshotWorkerID
459	463		d.snapshotWorkerCtx = workerCtx
460	464		d.snapshotWorkerCancel = cancel
461	465		d.snapshotWorkerDone = make(chan struct{})
	466	+	d.snapshotWorkerInFlight = nil
462	467		done := d.snapshotWorkerDone
463	468		d.snapshotWorkerMu.Unlock()
464	469		go func() {

@@ -469,45 +474,72 @@ func (d *Daemon) startSnapshotEncodeWorker(ctx context.Context) {
469	474		return
470	475		case capture := <-d.snapshotJobs:
471	476		// A queued capture must not begin persistence after shutdown.
472		-	if workerCtx.Err() != nil {
473		-	d.finishSnapshotCapture(capture.session, capture.generation, false)
	477	+	if workerCtx.Err() != nil \|\| !d.setSnapshotWorkerInFlight(workerID, capture) {
	478	+	d.finishSnapshotCapture(capture, false)
474	479		return
475	480		}
476	481		data, err := d.encodeSnapshotCapture(capture)
477		-	if err == nil {
	482	+	if err == nil && workerCtx.Err() == nil {
478	483		err = d.snaps.Write(capture.name, data)
479	484		}
480		-	if err != nil {
	485	+	d.clearSnapshotWorkerInFlight(workerID, capture)
	486	+	if err != nil && workerCtx.Err() == nil {
481	487		d.log.Warn("writing session snapshot failed", "err", err, "session", capture.name)
482	488		}
483		-	d.finishSnapshotCapture(capture.session, capture.generation, err == nil)
	489	+	d.finishSnapshotCapture(capture, err == nil && workerCtx.Err() == nil)
484	490		}
485	491		}
486	492		}()
487	493		}
488	494
	495	+	func (d Daemon) setSnapshotWorkerInFlight(workerID uint64, capture snapshotCapture) bool {
	496	+	d.snapshotWorkerMu.Lock()
	497	+	defer d.snapshotWorkerMu.Unlock()
	498	+	if d.snapshotWorkerID != workerID \|\| d.snapshotWorkerCancel == nil \|\| d.snapshotWorkerCtx == nil \|\| d.snapshotWorkerCtx.Err() != nil {
	499	+	return false
	500	+	}
	501	+	d.snapshotWorkerInFlight = capture
	502	+	return true
	503	+	}
	504	+
	505	+	func (d Daemon) clearSnapshotWorkerInFlight(workerID uint64, capture snapshotCapture) {
	506	+	d.snapshotWorkerMu.Lock()
	507	+	defer d.snapshotWorkerMu.Unlock()
	508	+	if d.snapshotWorkerID == workerID && d.snapshotWorkerInFlight == capture {
	509	+	d.snapshotWorkerInFlight = nil
	510	+	}
	511	+	}
	512	+
489	513		func (d *Daemon) stopSnapshotEncodeWorker() {
490	514		if d == nil {
491	515		return
492	516		}
493	517		d.snapshotWorkerMu.Lock()
494		-	defer d.snapshotWorkerMu.Unlock()
495		-	cancel, done := d.snapshotWorkerCancel, d.snapshotWorkerDone
	518	+	cancel := d.snapshotWorkerCancel
496	519		if cancel == nil {
	520	+	d.snapshotWorkerMu.Unlock()
497	521		return
498	522		}
499		-	// Keep workerMu held until the old worker has exited and its queue has been
500		-	// drained, so a concurrent restart cannot consume a stale capture.
	523	+	// The queue stays open, so producers can safely race teardown. Detach an
	524	+	// in-flight uncancellable Write instead of waiting for it; the process owns
	525	+	// that goroutine until the store returns.
	526	+	inFlight := d.snapshotWorkerInFlight
501	527		d.snapshotWorkerCtx = nil
502	528		d.snapshotWorkerCancel = nil
503	529		d.snapshotWorkerDone = nil
	530	+	d.snapshotWorkerInFlight = nil
504	531		cancel()
505		-	<-done
	532	+	queued := make([]*snapshotCapture, 0, len(d.snapshotJobs))
506	533		for {
507	534		select {
508	535		case capture := <-d.snapshotJobs:
509		-	d.finishSnapshotCapture(capture.session, capture.generation, false)
	536	+	queued = append(queued, capture)
510	537		default:
	538	+	d.snapshotWorkerMu.Unlock()
	539	+	d.finishSnapshotCapture(inFlight, false)
	540	+	for _, capture := range queued {
	541	+	d.finishSnapshotCapture(capture, false)
	542	+	}
511	543		return
512	544		}
513	545		}

 	"context"
 	"fmt"
 	"math"
+	"sync"
 	"time"
 	"github.com/bnema/vev/internal/domain"
 	createdAt  uint64
 	active     uint16
 	tabs       []snapshotCaptureTab
+	finishOnce sync.Once
 }
 type snapshotCaptureTab struct {
 }
 func restorePaneTerminal(p *pane, snap snapcodec.Pane) error {
+	if len(snap.Tail) == 0 {
+		return fmt.Errorf("snapshot history: missing tail blob")
+	}
+	if len(snap.Visible) == 0 {
+		return fmt.Errorf("snapshot visible: missing visible blob")
+	}
 	p.mu.Lock()
 	defer p.mu.Unlock()
-	// Unmarshal requires both blobs. The empty fallback only supports direct
+	history, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: defaultScrollbackRows}, snap.SealedChunks, snap.Tail)
-	// in-process construction used by restore callers; it is unreachable for a
-	// durable snapshot because the v3 manifest rejects missing blobs.
-	tail := snap.Tail
-	if len(tail) == 0 {
-		tail, _ = vt.MarshalEmptyHistoryTail()
-	}
-	visible := snap.Visible
-	if len(visible) == 0 {
-		visible, _ = vt.MarshalVisible(p.screen.PrimaryVisibleFrame())
-	}
-	history, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: defaultScrollbackRows}, snap.SealedChunks, tail)
 	if err != nil {
 		return fmt.Errorf("snapshot history: %w", err)
 	}
-	if err := p.screen.RestorePrimaryVisible(visible); err != nil {
+	if err := p.screen.RestorePrimaryVisible(snap.Visible); err != nil {
 		return fmt.Errorf("snapshot visible: %w", err)
 	}
 	p.history = history
 	capture, ok := d.captureSnapshotState(sess, generation)
 	if !ok {
-		d.finishSnapshotCapture(sess, generation, false)
+		d.finishSnapshotCapture(capture, false)
 		return false
 	}
 	if d.enqueueSnapshotCapture(capture) {
 	}
 	// Coalesce under saturation or shutdown: the latest state stays dirty and
 	// will be captured on a later tick once an active worker has room.
-	d.finishSnapshotCapture(sess, generation, false)
+	d.finishSnapshotCapture(capture, false)
 	return false
 }
 // enqueueSnapshotCapture serializes worker shutdown with the non-blocking
 // queue send. The queue is deliberately never closed: producers can race
 // shutdown without risking a send-on-closed panic.
-func (d *Daemon) enqueueSnapshotCapture(capture snapshotCapture) bool {
+func (d *Daemon) enqueueSnapshotCapture(capture *snapshotCapture) bool {
 	d.snapshotWorkerMu.Lock()
 	defer d.snapshotWorkerMu.Unlock()
 	if d.snapshotWorkerCancel == nil || d.snapshotWorkerCtx == nil || d.snapshotWorkerCtx.Err() != nil {
 // captureSession rotates history tails and clones visible frames while holding
 // each pane lock. The returned capture contains only immutable state; encoding
 // and persistence are deliberately deferred to snapshotEncodeWorker.
-func (d *Daemon) captureSnapshotState(sess *session, generation uint64) (snapshotCapture, bool) {
+func (d *Daemon) captureSnapshotState(sess *session, generation uint64) (*snapshotCapture, bool) {
 	sess.mu.Lock()
-	capture := snapshotCapture{
+	capture := &snapshotCapture{
 		session:    sess,
 		generation: generation,
 		name:       sess.name,
 	tabs := append([]*tab(nil), sess.tabs...)
 	sess.mu.Unlock()
 	if ephemeral || capture.name == "" {
-		return snapshotCapture{}, false
+		return capture, false
 	}
 	capture.tabs = make([]snapshotCaptureTab, 0, len(tabs))
 	return d.scheduleSnapshot(sess)
 }
-func (d *Daemon) encodeSnapshotCapture(capture snapshotCapture) ([]byte, error) {
+func (d *Daemon) encodeSnapshotCapture(capture *snapshotCapture) ([]byte, error) {
 	snap := snapcodec.Session{Name: capture.name, CreatedAt: capture.createdAt, Active: capture.active, Tabs: make([]snapcodec.Tab, 0, len(capture.tabs))}
 	for _, tabCapture := range capture.tabs {
 		tabSnap := snapcodec.Tab{
 	return d.snapshotMarshal(snap)
 }
-func (d *Daemon) finishSnapshotCapture(sess *session, generation uint64, succeeded bool) {
+func (d *Daemon) finishSnapshotCapture(capture *snapshotCapture, succeeded bool) {
-	sess.snapshotMu.Lock()
+	if capture == nil {
-	sess.snapshotPending = false
+		return
-	if succeeded && sess.snapshotGeneration == generation {
-		sess.snapDirty.Store(false)
-	} else if !succeeded {
-		sess.snapDirty.Store(true)
 	}
-	sess.snapshotMu.Unlock()
+	capture.finishOnce.Do(func() {
+		capture.session.snapshotMu.Lock()
+		capture.session.snapshotPending = false
+		if succeeded && capture.session.snapshotGeneration == capture.generation {
+			capture.session.snapDirty.Store(false)
+		} else if !succeeded {
+			capture.session.snapDirty.Store(true)
+		}
+		capture.session.snapshotMu.Unlock()
+	})
 }
 func (d *Daemon) startSnapshotEncodeWorker(ctx context.Context) {
 		return
 	}
 	workerCtx, cancel := context.WithCancel(ctx)
+	d.snapshotWorkerID++
+	workerID := d.snapshotWorkerID
 	d.snapshotWorkerCtx = workerCtx
 	d.snapshotWorkerCancel = cancel
 	d.snapshotWorkerDone = make(chan struct{})
+	d.snapshotWorkerInFlight = nil
 	done := d.snapshotWorkerDone
 	d.snapshotWorkerMu.Unlock()
 	go func() {
 				return
 			case capture := <-d.snapshotJobs:
 				// A queued capture must not begin persistence after shutdown.
-				if workerCtx.Err() != nil {
+				if workerCtx.Err() != nil || !d.setSnapshotWorkerInFlight(workerID, capture) {
-					d.finishSnapshotCapture(capture.session, capture.generation, false)
+					d.finishSnapshotCapture(capture, false)
 					return
 				}
 				data, err := d.encodeSnapshotCapture(capture)
-				if err == nil {
+				if err == nil && workerCtx.Err() == nil {
 					err = d.snaps.Write(capture.name, data)
 				}
-				if err != nil {
+				d.clearSnapshotWorkerInFlight(workerID, capture)
+				if err != nil && workerCtx.Err() == nil {
 					d.log.Warn("writing session snapshot failed", "err", err, "session", capture.name)
 				}
-				d.finishSnapshotCapture(capture.session, capture.generation, err == nil)
+				d.finishSnapshotCapture(capture, err == nil && workerCtx.Err() == nil)
 			}
 		}
 	}()
 }
+func (d *Daemon) setSnapshotWorkerInFlight(workerID uint64, capture *snapshotCapture) bool {
+	d.snapshotWorkerMu.Lock()
+	defer d.snapshotWorkerMu.Unlock()
+	if d.snapshotWorkerID != workerID || d.snapshotWorkerCancel == nil || d.snapshotWorkerCtx == nil || d.snapshotWorkerCtx.Err() != nil {
+		return false
+	}
+	d.snapshotWorkerInFlight = capture
+	return true
+}
+func (d *Daemon) clearSnapshotWorkerInFlight(workerID uint64, capture *snapshotCapture) {
+	d.snapshotWorkerMu.Lock()
+	defer d.snapshotWorkerMu.Unlock()
+	if d.snapshotWorkerID == workerID && d.snapshotWorkerInFlight == capture {
+		d.snapshotWorkerInFlight = nil
+	}
+}
 func (d *Daemon) stopSnapshotEncodeWorker() {
 	if d == nil {
 		return
 	}
 	d.snapshotWorkerMu.Lock()
-	defer d.snapshotWorkerMu.Unlock()
+	cancel := d.snapshotWorkerCancel
-	cancel, done := d.snapshotWorkerCancel, d.snapshotWorkerDone
 	if cancel == nil {
+		d.snapshotWorkerMu.Unlock()
 		return
 	}
-	// Keep workerMu held until the old worker has exited and its queue has been
+	// The queue stays open, so producers can safely race teardown. Detach an
-	// drained, so a concurrent restart cannot consume a stale capture.
+	// in-flight uncancellable Write instead of waiting for it; the process owns
+	// that goroutine until the store returns.
+	inFlight := d.snapshotWorkerInFlight
 	d.snapshotWorkerCtx = nil
 	d.snapshotWorkerCancel = nil
 	d.snapshotWorkerDone = nil
+	d.snapshotWorkerInFlight = nil
 	cancel()
-	<-done
+	queued := make([]*snapshotCapture, 0, len(d.snapshotJobs))
 	for {
 		select {
 		case capture := <-d.snapshotJobs:
-			d.finishSnapshotCapture(capture.session, capture.generation, false)
+			queued = append(queued, capture)
 		default:
+			d.snapshotWorkerMu.Unlock()
+			d.finishSnapshotCapture(inFlight, false)
+			for _, capture := range queued {
+				d.finishSnapshotCapture(capture, false)
+			}
 			return
 		}
 	}

M internal/usecase/daemon/snapshot_restore_test.go +72 -43


@@ -38,6 +38,27 @@ func terminalPane(t *testing.T, id, stableID, cwd string, historyRows, visibleRo
38	38		return snapcodec.Pane{ID: layout.PaneID(id), StableID: stableID, Cwd: cwd, SealedChunks: sealed, Tail: tail, Visible: visible}
39	39		}
40	40
	41	+	func TestRestorePaneTerminalRejectsMissingOrMalformedCanonicalBlobs(t *testing.T) {
	42	+	valid := terminalPane(t, "pane", "p", "/work", nil, nil)
	43	+	tests := []struct {
	44	+	name string
	45	+	mutate func(*snapcodec.Pane)
	46	+	}{
	47	+	{name: "missing tail", mutate: func(p *snapcodec.Pane) { p.Tail = nil }},
	48	+	{name: "missing visible", mutate: func(p *snapcodec.Pane) { p.Visible = nil }},
	49	+	{name: "malformed tail", mutate: func(p *snapcodec.Pane) { p.Tail = []byte("bad") }},
	50	+	{name: "malformed visible", mutate: func(p *snapcodec.Pane) { p.Visible = []byte("bad") }},
	51	+	}
	52	+	for _, tt := range tests {
	53	+	t.Run(tt.name, func(t *testing.T) {
	54	+	snap := valid
	55	+	tt.mutate(&snap)
	56	+	p := newPane("pane", newRestorePTY(), domain.Size{Cols: 40, Rows: 24})
	57	+	require.Error(t, restorePaneTerminal(p, snap))
	58	+	})
	59	+	}
	60	+	}
	61	+
41	62		func TestRestoreSnapshotsRestoresLayoutCwdAndRows(t *testing.T) {
42	63		store := &restoreSnapshotStore{}
43	64		store.blobs = []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{

@@ -126,8 +147,8 @@ func TestRestoreSnapshotsRestoresLayoutCwdAndRows(t *testing.T) {
126	147		func TestRestoreSnapshotsLeavesFloatingUninitializedAndInactiveTabsCold(t *testing.T) {
127	148		store := &restoreSnapshotStore{blobs: []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{
128	149		Name: "work", Active: 0, Tabs: []snapcodec.Tab{
129		-	{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/one"}}},
130		-	{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/two"}}},
	150	+	{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/one")}},
	151	+	{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/two")}},
131	152		},
132	153		})}}}
133	154		factory := &restorePTYFactory{}

@@ -156,17 +177,15 @@ func TestRestoreSnapshotsLeavesFloatingUninitializedAndInactiveTabsCold(t *testi
156	177
157	178		func processRestoreTestStore(t testing.T, name string, proc snapcodec.Process) *restoreSnapshotStore {
158	179		t.Helper()
	180	+	pane := emptyTerminalPane(t, "pane-1", "/tmp")
	181	+	pane.Process = proc
159	182		return &restoreSnapshotStore{blobs: []ports.SnapshotBlob{{Name: name, Data: mustSnapshotBytes(t, snapcodec.Session{
160	183		Name: name,
161	184		Tabs: []snapcodec.Tab{{
162		-	Cols: 80,
163		-	Rows: 24,
164		-	Tree: layout.NewTree("pane-1"),
165		-	Panes: []snapcodec.Pane{{
166		-	ID: "pane-1",
167		-	Cwd: "/tmp",
168		-	Process: proc,
169		-	}},
	185	+	Cols: 80,
	186	+	Rows: 24,
	187	+	Tree: layout.NewTree("pane-1"),
	188	+	Panes: []snapcodec.Pane{pane},
170	189		}},
171	190		})}}}
172	191		}

@@ -203,20 +222,17 @@ func TestRestoreSnapshotsProcessRestoreCommands(t *testing.T) {
203	222		Cols: 80,
204	223		Rows: 24,
205	224		Tree: layout.NewTree("pane-1"),
206		-	Panes: []snapcodec.Pane{{
207		-	ID: "pane-1",
208		-	Cwd: "/one",
209		-	Process: lessProc,
210		-	}},
	225	+	Panes: func() []snapcodec.Pane {
	226	+	pane := emptyTerminalPane(t, "pane-1", "/one")
	227	+	pane.Process = lessProc
	228	+	return []snapcodec.Pane{pane}
	229	+	}(),
211	230		},
212	231		{
213		-	Cols: 80,
214		-	Rows: 24,
215		-	Tree: layout.NewTree("pane-1"),
216		-	Panes: []snapcodec.Pane{{
217		-	ID: "pane-1",
218		-	Cwd: "/two",
219		-	}},
	232	+	Cols: 80,
	233	+	Rows: 24,
	234	+	Tree: layout.NewTree("pane-1"),
	235	+	Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/two")},
220	236		},
221	237		},
222	238		})}}},

@@ -264,7 +280,9 @@ func TestRestoreSnapshotsProcessCommandWriteFailureIsNonFatal(t *testing.T) {
264	280		d := newTestDaemon(t, factory, stubClock{})
265	281		d.ApplyConfig(domain.Config{Snapshot: domain.SnapshotConfig{RestoreProcessesSet: true, RestoreProcesses: []string{"pi"}}})
266	282
267		-	require.NoError(t, d.restoreSession(context.Background(), snapcodec.Session{Name: "agent", Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/tmp", Process: proc}}}}}))
	283	+	pane := emptyTerminalPane(t, "pane-1", "/tmp")
	284	+	pane.Process = proc
	285	+	require.NoError(t, d.restoreSession(context.Background(), snapcodec.Session{Name: "agent", Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{pane}}}}))
268	286		require.Len(t, factory.opens, 1)
269	287		require.Equal(t, []string{"pi --resume abc123\n"}, factory.opens[0].pty.writes)
270	288		}

@@ -276,7 +294,7 @@ func TestRestoreSessionPassesRestoreContextToPTYOpen(t *testing.T) {
276	294		defer cancel()
277	295
278	296		require.NoError(t, d.restoreSession(ctx, snapcodec.Session{Name: "restore-context", Tabs: []snapcodec.Tab{{
279		-	Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/tmp"}},
	297	+	Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/tmp")},
280	298		}}}))
281	299		require.Len(t, factory.opens, 1)
282	300		require.Same(t, ctx, factory.opens[0].ctx)

@@ -291,7 +309,11 @@ func TestRestoreSnapshotsOpensCollapsedStackPanesWithValidPTYSize(t *testing.T)
291	309		Tree: &layout.Tree{Focus: "b", Root: &layout.Node{Kind: layout.Stack, Expanded: "b", Children: []*layout.Node{
292	310		layout.NewLeaf("a"), layout.NewLeaf("b"), layout.NewLeaf("c"),
293	311		}}},
294		-	Panes: []snapcodec.Pane{{ID: "a", Cwd: "/a"}, {ID: "b", Cwd: "/b"}, {ID: "c", Cwd: "/c"}},
	312	+	Panes: []snapcodec.Pane{
	313	+	emptyTerminalPane(t, "a", "/a"),
	314	+	emptyTerminalPane(t, "b", "/b"),
	315	+	emptyTerminalPane(t, "c", "/c"),
	316	+	},
295	317		}},
296	318		})}}}
297	319		factory := &restorePTYFactory{}

@@ -321,7 +343,16 @@ func TestRestoreSnapshotsOpensCollapsedStackPanesWithValidPTYSize(t *testing.T)
321	343		}
322	344
323	345		func TestRestoreSnapshotsSkipsLiveCorruptAndEmpty(t *testing.T) {
324		-	valid := mustSnapshotBytes(t, snapcodec.Session{Name: "live", CreatedAt: 1, Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/ok"}}}}})
	346	+	valid := mustSnapshotBytes(t, snapcodec.Session{
	347	+	Name: "live",
	348	+	CreatedAt: 1,
	349	+	Tabs: []snapcodec.Tab{{
	350	+	Cols: 80,
	351	+	Rows: 24,
	352	+	Tree: layout.NewTree("pane-1"),
	353	+	Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/ok")},
	354	+	}},
	355	+	})
325	356		badVersion := append([]byte(nil), valid...)
326	357		binary.BigEndian.PutUint16(badVersion[4:6], 1)
327	358		tests := []struct {

@@ -358,7 +389,7 @@ func TestRestoreSnapshotsSkipsCreatedAtOverflow(t *testing.T) {
358	389		Cols: 80,
359	390		Rows: 24,
360	391		Tree: layout.NewTree("pane-1"),
361		-	Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/bad"}},
	392	+	Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/bad")},
362	393		}},
363	394		})}}}
364	395		factory := &restorePTYFactory{}

@@ -384,7 +415,15 @@ func TestNamedRouteWaitsForRestoreBarrier(t *testing.T) {
384	415		loadFn: func() ([]ports.SnapshotBlob, error) {
385	416		close(loaded)
386	417		<-releaseLoad
387		-	return []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{Name: "work", Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/restored"}}}}})}}, nil
	418	+	return []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{
	419	+	Name: "work",
	420	+	Tabs: []snapcodec.Tab{{
	421	+	Cols: 80,
	422	+	Rows: 24,
	423	+	Tree: layout.NewTree("pane-1"),
	424	+	Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/restored")},
	425	+	}},
	426	+	})}}, nil
388	427		},
389	428		}
390	429		factory := &restorePTYFactory{}

@@ -433,23 +472,13 @@ func TestNamedRouteRestoreBarrierReturnsShutdown(t *testing.T) {
433	472		require.Equal(t, ports.ErrServerShutdown, perr.code)
434	473		}
435	474
	475	+	func emptyTerminalPane(t *testing.T, id, cwd string) snapcodec.Pane {
	476	+	t.Helper()
	477	+	return terminalPane(t, id, "", cwd, nil, nil)
	478	+	}
	479	+
436	480		func mustSnapshotBytes(t *testing.T, s snapcodec.Session) []byte {
437	481		t.Helper()
438		-	for ti := range s.Tabs {
439		-	for pi := range s.Tabs[ti].Panes {
440		-	p := &s.Tabs[ti].Panes[pi]
441		-	if len(p.Tail) != 0 {
442		-	continue
443		-	}
444		-	h := vt.NewHistory(vt.HistoryConfig{MaxRows: defaultScrollbackRows})
445		-	sealed, tail, err := vt.MarshalSealedHistory(h.SealAndView())
446		-	require.NoError(t, err)
447		-	frame := renderer.NewFrame(int(s.Tabs[ti].Cols), int(s.Tabs[ti].Rows))
448		-	visible, err := vt.MarshalVisible(frame)
449		-	require.NoError(t, err)
450		-	p.SealedChunks, p.Tail, p.Visible = sealed, tail, visible
451		-	}
452		-	}
453	482		b, err := snapcodec.Marshal(s)
454	483		require.NoError(t, err)
455	484		return b

 	return snapcodec.Pane{ID: layout.PaneID(id), StableID: stableID, Cwd: cwd, SealedChunks: sealed, Tail: tail, Visible: visible}
 }
+func TestRestorePaneTerminalRejectsMissingOrMalformedCanonicalBlobs(t *testing.T) {
+	valid := terminalPane(t, "pane", "p", "/work", nil, nil)
+	tests := []struct {
+		name   string
+		mutate func(*snapcodec.Pane)
+	}{
+		{name: "missing tail", mutate: func(p *snapcodec.Pane) { p.Tail = nil }},
+		{name: "missing visible", mutate: func(p *snapcodec.Pane) { p.Visible = nil }},
+		{name: "malformed tail", mutate: func(p *snapcodec.Pane) { p.Tail = []byte("bad") }},
+		{name: "malformed visible", mutate: func(p *snapcodec.Pane) { p.Visible = []byte("bad") }},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			snap := valid
+			tt.mutate(&snap)
+			p := newPane("pane", newRestorePTY(), domain.Size{Cols: 40, Rows: 24})
+			require.Error(t, restorePaneTerminal(p, snap))
+		})
+	}
+}
 func TestRestoreSnapshotsRestoresLayoutCwdAndRows(t *testing.T) {
 	store := &restoreSnapshotStore{}
 	store.blobs = []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{
 func TestRestoreSnapshotsLeavesFloatingUninitializedAndInactiveTabsCold(t *testing.T) {
 	store := &restoreSnapshotStore{blobs: []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{
 		Name: "work", Active: 0, Tabs: []snapcodec.Tab{
-			{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/one"}}},
+			{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/one")}},
-			{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/two"}}},
+			{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/two")}},
 		},
 	})}}}
 	factory := &restorePTYFactory{}
 func processRestoreTestStore(t *testing.T, name string, proc *snapcodec.Process) *restoreSnapshotStore {
 	t.Helper()
+	pane := emptyTerminalPane(t, "pane-1", "/tmp")
+	pane.Process = proc
 	return &restoreSnapshotStore{blobs: []ports.SnapshotBlob{{Name: name, Data: mustSnapshotBytes(t, snapcodec.Session{
 		Name: name,
 		Tabs: []snapcodec.Tab{{
-			Cols: 80,
+			Cols:  80,
-			Rows: 24,
+			Rows:  24,
-			Tree: layout.NewTree("pane-1"),
+			Tree:  layout.NewTree("pane-1"),
-			Panes: []snapcodec.Pane{{
+			Panes: []snapcodec.Pane{pane},
-				ID:      "pane-1",
-				Cwd:     "/tmp",
-				Process: proc,
-			}},
 		}},
 	})}}}
 }
 						Cols: 80,
 						Rows: 24,
 						Tree: layout.NewTree("pane-1"),
-						Panes: []snapcodec.Pane{{
+						Panes: func() []snapcodec.Pane {
-							ID:      "pane-1",
+							pane := emptyTerminalPane(t, "pane-1", "/one")
-							Cwd:     "/one",
+							pane.Process = lessProc
-							Process: lessProc,
+							return []snapcodec.Pane{pane}
-						}},
+						}(),
 					},
 					{
-						Cols: 80,
+						Cols:  80,
-						Rows: 24,
+						Rows:  24,
-						Tree: layout.NewTree("pane-1"),
+						Tree:  layout.NewTree("pane-1"),
-						Panes: []snapcodec.Pane{{
+						Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/two")},
-							ID:  "pane-1",
-							Cwd: "/two",
-						}},
 					},
 				},
 			})}}},
 	d := newTestDaemon(t, factory, stubClock{})
 	d.ApplyConfig(domain.Config{Snapshot: domain.SnapshotConfig{RestoreProcessesSet: true, RestoreProcesses: []string{"pi"}}})
-	require.NoError(t, d.restoreSession(context.Background(), snapcodec.Session{Name: "agent", Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/tmp", Process: proc}}}}}))
+	pane := emptyTerminalPane(t, "pane-1", "/tmp")
+	pane.Process = proc
+	require.NoError(t, d.restoreSession(context.Background(), snapcodec.Session{Name: "agent", Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{pane}}}}))
 	require.Len(t, factory.opens, 1)
 	require.Equal(t, []string{"pi --resume abc123\n"}, factory.opens[0].pty.writes)
 }
 	defer cancel()
 	require.NoError(t, d.restoreSession(ctx, snapcodec.Session{Name: "restore-context", Tabs: []snapcodec.Tab{{
-		Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/tmp"}},
+		Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/tmp")},
 	}}}))
 	require.Len(t, factory.opens, 1)
 	require.Same(t, ctx, factory.opens[0].ctx)
 			Tree: &layout.Tree{Focus: "b", Root: &layout.Node{Kind: layout.Stack, Expanded: "b", Children: []*layout.Node{
 				layout.NewLeaf("a"), layout.NewLeaf("b"), layout.NewLeaf("c"),
 			}}},
-			Panes: []snapcodec.Pane{{ID: "a", Cwd: "/a"}, {ID: "b", Cwd: "/b"}, {ID: "c", Cwd: "/c"}},
+			Panes: []snapcodec.Pane{
+				emptyTerminalPane(t, "a", "/a"),
+				emptyTerminalPane(t, "b", "/b"),
+				emptyTerminalPane(t, "c", "/c"),
+			},
 		}},
 	})}}}
 	factory := &restorePTYFactory{}
 }
 func TestRestoreSnapshotsSkipsLiveCorruptAndEmpty(t *testing.T) {
-	valid := mustSnapshotBytes(t, snapcodec.Session{Name: "live", CreatedAt: 1, Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/ok"}}}}})
+	valid := mustSnapshotBytes(t, snapcodec.Session{
+		Name:      "live",
+		CreatedAt: 1,
+		Tabs: []snapcodec.Tab{{
+			Cols:  80,
+			Rows:  24,
+			Tree:  layout.NewTree("pane-1"),
+			Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/ok")},
+		}},
+	})
 	badVersion := append([]byte(nil), valid...)
 	binary.BigEndian.PutUint16(badVersion[4:6], 1)
 	tests := []struct {
 			Cols:  80,
 			Rows:  24,
 			Tree:  layout.NewTree("pane-1"),
-			Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/bad"}},
+			Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/bad")},
 		}},
 	})}}}
 	factory := &restorePTYFactory{}
 		loadFn: func() ([]ports.SnapshotBlob, error) {
 			close(loaded)
 			<-releaseLoad
-			return []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{Name: "work", Tabs: []snapcodec.Tab{{Cols: 80, Rows: 24, Tree: layout.NewTree("pane-1"), Panes: []snapcodec.Pane{{ID: "pane-1", Cwd: "/restored"}}}}})}}, nil
+			return []ports.SnapshotBlob{{Name: "work", Data: mustSnapshotBytes(t, snapcodec.Session{
+				Name: "work",
+				Tabs: []snapcodec.Tab{{
+					Cols:  80,
+					Rows:  24,
+					Tree:  layout.NewTree("pane-1"),
+					Panes: []snapcodec.Pane{emptyTerminalPane(t, "pane-1", "/restored")},
+				}},
+			})}}, nil
 		},
 	}
 	factory := &restorePTYFactory{}
 	require.Equal(t, ports.ErrServerShutdown, perr.code)
 }
+func emptyTerminalPane(t *testing.T, id, cwd string) snapcodec.Pane {
+	t.Helper()
+	return terminalPane(t, id, "", cwd, nil, nil)
+}
 func mustSnapshotBytes(t *testing.T, s snapcodec.Session) []byte {
 	t.Helper()
-	for ti := range s.Tabs {
-		for pi := range s.Tabs[ti].Panes {
-			p := &s.Tabs[ti].Panes[pi]
-			if len(p.Tail) != 0 {
-				continue
-			}
-			h := vt.NewHistory(vt.HistoryConfig{MaxRows: defaultScrollbackRows})
-			sealed, tail, err := vt.MarshalSealedHistory(h.SealAndView())
-			require.NoError(t, err)
-			frame := renderer.NewFrame(int(s.Tabs[ti].Cols), int(s.Tabs[ti].Rows))
-			visible, err := vt.MarshalVisible(frame)
-			require.NoError(t, err)
-			p.SealedChunks, p.Tail, p.Visible = sealed, tail, visible
-		}
-	}
 	b, err := snapcodec.Marshal(s)
 	require.NoError(t, err)
 	return b

M internal/usecase/daemon/snapshot_test.go +70 -6


@@ -44,14 +44,17 @@ func TestSnapshotEncodeWorkerDefersMarshalUntilAfterCapture(t *testing.T) {
44	44		require.True(t, d.scheduleSnapshot(sess))
45	45		<-entered
46	46
47		-	paneUnlocked := make(chan struct{})
	47	+	paneLocked := make(chan struct{})
	48	+	releasePane := make(chan struct{})
48	49		go func() {
49	50		p := sess.tabs[0].panes["pane-1"]
50	51		p.mu.Lock()
	52	+	close(paneLocked)
	53	+	<-releasePane
51	54		p.mu.Unlock()
52		-	close(paneUnlocked)
53	55		}()
54		-	<-paneUnlocked
	56	+	<-paneLocked
	57	+	close(releasePane)
55	58		close(release)
56	59		<-store.writes
57	60		}

@@ -111,13 +114,16 @@ func exerciseBlockedSnapshotWorker(t *testing.T, blockEncode bool) {
111	114		require.True(t, d.scheduleSnapshot(sess))
112	115		<-store.entered
113	116
114		-	paneUnlocked := make(chan struct{})
	117	+	paneLocked := make(chan struct{})
	118	+	releasePane := make(chan struct{})
115	119		go func() {
116	120		p.mu.Lock()
	121	+	close(paneLocked)
	122	+	<-releasePane
117	123		p.mu.Unlock()
118		-	close(paneUnlocked)
119	124		}()
120		-	<-paneUnlocked
	125	+	<-paneLocked
	126	+	close(releasePane)
121	127
122	128		reader := portsmocks.NewMockPTY(t)
123	129		var reads atomic.Int32

@@ -146,6 +152,46 @@ func exerciseBlockedSnapshotWorker(t *testing.T, blockEncode bool) {
146	152		require.True(t, sess.snapDirty.Load(), "PTY output published while blocked must remain retryable")
147	153		}
148	154
	155	+	func TestStopSnapshotEncodeWorkerDoesNotWaitForUncancellableWrite(t *testing.T) {
	156	+	store := newNeverReturningSnapshotStore()
	157	+	d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})
	158	+	WithSnapshotStore(store)(d)
	159	+	ctx, cancel := context.WithCancel(t.Context())
	160	+	defer cancel()
	161	+	d.startSnapshotEncodeWorker(ctx)
	162	+
	163	+	sess := newSnapshotTestSession(t, "stuck-write", false, "/work")
	164	+	require.True(t, d.captureSession(sess))
	165	+	<-store.entered
	166	+
	167	+	stopped := make(chan struct{})
	168	+	go func() {
	169	+	d.stopSnapshotEncodeWorker()
	170	+	close(stopped)
	171	+	}()
	172	+	select {
	173	+	case <-stopped:
	174	+	case <-time.After(time.Second):
	175	+	t.Fatal("snapshot worker shutdown waited for uncancellable Write")
	176	+	}
	177	+	awaitSnapshotIdle(t, sess)
	178	+	require.True(t, sess.snapDirty.Load(), "an abandoned write must remain retryable")
	179	+	require.NotPanics(t, func() { require.False(t, d.scheduleSnapshot(sess)) })
	180	+	}
	181	+
	182	+	func TestRejectedSnapshotCaptureLeavesSessionRetryable(t *testing.T) {
	183	+	d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})
	184	+	WithSnapshotStore(&channelSnapshotStore{writes: make(chan []byte, 1)})(d)
	185	+	sess := newSnapshotTestSession(t, "rejected", false, "/work")
	186	+	sess.name = ""
	187	+	sess.snapEligible.Store(true)
	188	+
	189	+	markSnapshotDirty(sess)
	190	+	require.False(t, d.scheduleSnapshot(sess))
	191	+	awaitSnapshotIdle(t, sess)
	192	+	require.True(t, sess.snapDirty.Load())
	193	+	}
	194	+
149	195		func TestStoppedSnapshotWorkerLeavesCaptureRetryable(t *testing.T) {
150	196		store := &channelSnapshotStore{writes: make(chan []byte, 1)}
151	197		d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})

@@ -758,6 +804,24 @@ func (s *gatedSnapshotStore) Write(_ string, _ []byte) error {
758	804		func (*gatedSnapshotStore) Load() ([]ports.SnapshotBlob, error) { return nil, nil }
759	805		func (*gatedSnapshotStore) Delete(string) error { return nil }
760	806
	807	+	type neverReturningSnapshotStore struct {
	808	+	entered chan struct{}
	809	+	once sync.Once
	810	+	block chan struct{}
	811	+	}
	812	+
	813	+	func newNeverReturningSnapshotStore() *neverReturningSnapshotStore {
	814	+	return &neverReturningSnapshotStore{entered: make(chan struct{}), block: make(chan struct{})}
	815	+	}
	816	+
	817	+	func (s *neverReturningSnapshotStore) Write(string, []byte) error {
	818	+	s.once.Do(func() { close(s.entered) })
	819	+	<-s.block
	820	+	return nil
	821	+	}
	822	+	func (*neverReturningSnapshotStore) Load() ([]ports.SnapshotBlob, error) { return nil, nil }
	823	+	func (*neverReturningSnapshotStore) Delete(string) error { return nil }
	824	+
761	825		type channelSnapshotStore struct {
762	826		writes chan []byte
763	827		}


@@ -44,14 +44,17 @@ func TestSnapshotEncodeWorkerDefersMarshalUntilAfterCapture(t *testing.T) {
44		require.True(t, d.scheduleSnapshot(sess))	44		require.True(t, d.scheduleSnapshot(sess))
45		<-entered	45		<-entered
46			46
47	-	paneUnlocked := make(chan struct{})	47	+	paneLocked := make(chan struct{})
			48	+	releasePane := make(chan struct{})
48		go func() {	49		go func() {
49		p := sess.tabs[0].panes["pane-1"]	50		p := sess.tabs[0].panes["pane-1"]
50		p.mu.Lock()	51		p.mu.Lock()
			52	+	close(paneLocked)
			53	+	<-releasePane
51		p.mu.Unlock()	54		p.mu.Unlock()
52	-	close(paneUnlocked)
53		}()	55		}()
54	-	<-paneUnlocked	56	+	<-paneLocked
			57	+	close(releasePane)
55		close(release)	58		close(release)
56		<-store.writes	59		<-store.writes
57		}	60		}

@@ -111,13 +114,16 @@ func exerciseBlockedSnapshotWorker(t *testing.T, blockEncode bool) {
111		require.True(t, d.scheduleSnapshot(sess))	114		require.True(t, d.scheduleSnapshot(sess))
112		<-store.entered	115		<-store.entered
113			116
114	-	paneUnlocked := make(chan struct{})	117	+	paneLocked := make(chan struct{})
			118	+	releasePane := make(chan struct{})
115		go func() {	119		go func() {
116		p.mu.Lock()	120		p.mu.Lock()
			121	+	close(paneLocked)
			122	+	<-releasePane
117		p.mu.Unlock()	123		p.mu.Unlock()
118	-	close(paneUnlocked)
119		}()	124		}()
120	-	<-paneUnlocked	125	+	<-paneLocked
			126	+	close(releasePane)
121			127
122		reader := portsmocks.NewMockPTY(t)	128		reader := portsmocks.NewMockPTY(t)
123		var reads atomic.Int32	129		var reads atomic.Int32

@@ -146,6 +152,46 @@ func exerciseBlockedSnapshotWorker(t *testing.T, blockEncode bool) {
146		require.True(t, sess.snapDirty.Load(), "PTY output published while blocked must remain retryable")	152		require.True(t, sess.snapDirty.Load(), "PTY output published while blocked must remain retryable")
147		}	153		}
148			154
			155	+	func TestStopSnapshotEncodeWorkerDoesNotWaitForUncancellableWrite(t *testing.T) {
			156	+	store := newNeverReturningSnapshotStore()
			157	+	d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})
			158	+	WithSnapshotStore(store)(d)
			159	+	ctx, cancel := context.WithCancel(t.Context())
			160	+	defer cancel()
			161	+	d.startSnapshotEncodeWorker(ctx)
			162	+
			163	+	sess := newSnapshotTestSession(t, "stuck-write", false, "/work")
			164	+	require.True(t, d.captureSession(sess))
			165	+	<-store.entered
			166	+
			167	+	stopped := make(chan struct{})
			168	+	go func() {
			169	+	d.stopSnapshotEncodeWorker()
			170	+	close(stopped)
			171	+	}()
			172	+	select {
			173	+	case <-stopped:
			174	+	case <-time.After(time.Second):
			175	+	t.Fatal("snapshot worker shutdown waited for uncancellable Write")
			176	+	}
			177	+	awaitSnapshotIdle(t, sess)
			178	+	require.True(t, sess.snapDirty.Load(), "an abandoned write must remain retryable")
			179	+	require.NotPanics(t, func() { require.False(t, d.scheduleSnapshot(sess)) })
			180	+	}
			181	+
			182	+	func TestRejectedSnapshotCaptureLeavesSessionRetryable(t *testing.T) {
			183	+	d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})
			184	+	WithSnapshotStore(&channelSnapshotStore{writes: make(chan []byte, 1)})(d)
			185	+	sess := newSnapshotTestSession(t, "rejected", false, "/work")
			186	+	sess.name = ""
			187	+	sess.snapEligible.Store(true)
			188	+
			189	+	markSnapshotDirty(sess)
			190	+	require.False(t, d.scheduleSnapshot(sess))
			191	+	awaitSnapshotIdle(t, sess)
			192	+	require.True(t, sess.snapDirty.Load())
			193	+	}
			194	+
149		func TestStoppedSnapshotWorkerLeavesCaptureRetryable(t *testing.T) {	195		func TestStoppedSnapshotWorkerLeavesCaptureRetryable(t *testing.T) {
150		store := &channelSnapshotStore{writes: make(chan []byte, 1)}	196		store := &channelSnapshotStore{writes: make(chan []byte, 1)}
151		d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})	197		d := newTestDaemon(t, portsmocks.NewMockPTYFactory(t), stubClock{})

@@ -758,6 +804,24 @@ func (s *gatedSnapshotStore) Write(_ string, _ []byte) error {
758		func (*gatedSnapshotStore) Load() ([]ports.SnapshotBlob, error) { return nil, nil }	804		func (*gatedSnapshotStore) Load() ([]ports.SnapshotBlob, error) { return nil, nil }
759		func (*gatedSnapshotStore) Delete(string) error { return nil }	805		func (*gatedSnapshotStore) Delete(string) error { return nil }
760			806
			807	+	type neverReturningSnapshotStore struct {
			808	+	entered chan struct{}
			809	+	once sync.Once
			810	+	block chan struct{}
			811	+	}
			812	+
			813	+	func newNeverReturningSnapshotStore() *neverReturningSnapshotStore {
			814	+	return &neverReturningSnapshotStore{entered: make(chan struct{}), block: make(chan struct{})}
			815	+	}
			816	+
			817	+	func (s *neverReturningSnapshotStore) Write(string, []byte) error {
			818	+	s.once.Do(func() { close(s.entered) })
			819	+	<-s.block
			820	+	return nil
			821	+	}
			822	+	func (*neverReturningSnapshotStore) Load() ([]ports.SnapshotBlob, error) { return nil, nil }
			823	+	func (*neverReturningSnapshotStore) Delete(string) error { return nil }
			824	+
761		type channelSnapshotStore struct {	825		type channelSnapshotStore struct {
762		writes chan []byte	826		writes chan []byte
763		}	827		}

M internal/usecase/snapshot/codec.go +0 -1


@@ -17,7 +17,6 @@ var (
17	17		ErrBadCRC = errors.New("snapshot: bad crc")
18	18		ErrShortPayload = errors.New("snapshot: payload too short")
19	19		ErrTrailingBytes = errors.New("snapshot: trailing bytes")
20		-	ErrStyleOOB = errors.New("snapshot: style index out of range")
21	20		ErrUnknownPane = errors.New("snapshot: tree references unknown pane")
22	21		ErrInvalidData = errors.New("snapshot: invalid data")
23	22		)


@@ -17,7 +17,6 @@ var (
17		ErrBadCRC = errors.New("snapshot: bad crc")	17	ErrBadCRC = errors.New("snapshot: bad crc")
18		ErrShortPayload = errors.New("snapshot: payload too short")	18	ErrShortPayload = errors.New("snapshot: payload too short")
19		ErrTrailingBytes = errors.New("snapshot: trailing bytes")	19	ErrTrailingBytes = errors.New("snapshot: trailing bytes")
20	-	ErrStyleOOB = errors.New("snapshot: style index out of range")
21		ErrUnknownPane = errors.New("snapshot: tree references unknown pane")	20	ErrUnknownPane = errors.New("snapshot: tree references unknown pane")
22		ErrInvalidData = errors.New("snapshot: invalid data")	21	ErrInvalidData = errors.New("snapshot: invalid data")
23		)	22	)

M internal/usecase/snapshot/codec_test.go +25 -2

@@ -1,6 +1,7 @@
1	1		package snapshot
2	2
3	3		import (
	4	+	"bytes"
4	5		"encoding/binary"
5	6		"errors"
6	7		"hash/crc32"

@@ -24,7 +25,12 @@ func TestV3SnapshotRoundTripPreservesExactTerminalData(t *testing.T) {
24	25		rgb.UnderlineStyle, rgb.HasUnderlineColorRGB, rgb.UnderlineColorRGB = renderer.UnderlineDashed, true, renderer.RGB{R: 7, G: 8, B: 9}
25	26		sealed, tail := historyBlobs(t, [][]renderer.Cell{{{Rune: 'I', Style: indexed}, {Rune: '好', Style: rgb}, {Continuation: true, Style: rgb}}})
26	27		visible := visibleBlob(t, [][]renderer.Cell{{{Rune: 'V', Style: rgb}, {Rune: '界', Style: indexed}, {Continuation: true, Style: indexed}}})
27		-	want := Session{Name: "v3 exact", Tabs: []Tab{{Focus: "p", Tree: layout.NewTree("p"), Panes: []Pane{{ID: "p", SealedChunks: sealed, Tail: tail, Visible: visible}}}}}
	28	+	sealed2, tail2 := historyBlobs(t, [][]renderer.Cell{{{Rune: 'S', Style: rgb}}, {{Rune: '2', Style: indexed}}})
	29	+	visible2 := visibleBlob(t, [][]renderer.Cell{{{Rune: 'P', Style: indexed}, {Rune: '2', Style: rgb}}})
	30	+	want := Session{Name: "v3 exact", Tabs: []Tab{{Focus: "p", Tree: &layout.Tree{Focus: "p", Root: &layout.Node{Kind: layout.Split, Dir: layout.Horizontal, Children: []*layout.Node{layout.NewLeaf("p"), layout.NewLeaf("p2")}}}, Panes: []Pane{
	31	+	{ID: "p", SealedChunks: sealed, Tail: tail, Visible: visible},
	32	+	{ID: "p2", SealedChunks: sealed2, Tail: tail2, Visible: visible2},
	33	+	}}}}
28	34		encoded, err := Marshal(want)
29	35		if err != nil {
30	36		t.Fatal(err)

@@ -34,9 +40,26 @@ func TestV3SnapshotRoundTripPreservesExactTerminalData(t *testing.T) {
34	40		if err != nil {
35	41		t.Fatal(err)
36	42		}
37		-	if len(got.Tabs) != 1 \|\| len(got.Tabs[0].Panes) != 1 \|\| got.Tabs[0].Panes[0].ID != "p" {
	43	+	if len(got.Tabs) != 1 \|\| len(got.Tabs[0].Panes) != 2 \|\| got.Tabs[0].Panes[0].ID != "p" \|\| got.Tabs[0].Panes[1].ID != "p2" {
38	44		t.Fatalf("manifest round trip = %#v", got)
39	45		}
	46	+	for i, wantPane := range want.Tabs[0].Panes {
	47	+	gotPane := got.Tabs[0].Panes[i]
	48	+	if len(gotPane.SealedChunks) != len(wantPane.SealedChunks) {
	49	+	t.Fatalf("pane %q sealed chunks = %d, want %d", wantPane.ID, len(gotPane.SealedChunks), len(wantPane.SealedChunks))
	50	+	}
	51	+	for j := range wantPane.SealedChunks {
	52	+	if !bytes.Equal(gotPane.SealedChunks[j], wantPane.SealedChunks[j]) {
	53	+	t.Fatalf("pane %q sealed chunk %d changed during round trip", wantPane.ID, j)
	54	+	}
	55	+	}
	56	+	if !bytes.Equal(gotPane.Tail, wantPane.Tail) {
	57	+	t.Fatalf("pane %q tail changed during round trip", wantPane.ID)
	58	+	}
	59	+	if !bytes.Equal(gotPane.Visible, wantPane.Visible) {
	60	+	t.Fatalf("pane %q visible blob changed during round trip", wantPane.ID)
	61	+	}
	62	+	}
40	63		if _, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: 8, ChunkRows: 2}, got.Tabs[0].Panes[0].SealedChunks, got.Tabs[0].Panes[0].Tail); err != nil {
41	64		t.Fatalf("history decode: %v", err)
42	65		}

@@ -1,6 +1,7 @@
1		package snapshot	1		package snapshot
2			2
3		import (	3		import (
			4	+	"bytes"
4		"encoding/binary"	5		"encoding/binary"
5		"errors"	6		"errors"
6		"hash/crc32"	7		"hash/crc32"

@@ -24,7 +25,12 @@ func TestV3SnapshotRoundTripPreservesExactTerminalData(t *testing.T) {
24		rgb.UnderlineStyle, rgb.HasUnderlineColorRGB, rgb.UnderlineColorRGB = renderer.UnderlineDashed, true, renderer.RGB{R: 7, G: 8, B: 9}	25		rgb.UnderlineStyle, rgb.HasUnderlineColorRGB, rgb.UnderlineColorRGB = renderer.UnderlineDashed, true, renderer.RGB{R: 7, G: 8, B: 9}
25		sealed, tail := historyBlobs(t, [][]renderer.Cell{{{Rune: 'I', Style: indexed}, {Rune: '好', Style: rgb}, {Continuation: true, Style: rgb}}})	26		sealed, tail := historyBlobs(t, [][]renderer.Cell{{{Rune: 'I', Style: indexed}, {Rune: '好', Style: rgb}, {Continuation: true, Style: rgb}}})
26		visible := visibleBlob(t, [][]renderer.Cell{{{Rune: 'V', Style: rgb}, {Rune: '界', Style: indexed}, {Continuation: true, Style: indexed}}})	27		visible := visibleBlob(t, [][]renderer.Cell{{{Rune: 'V', Style: rgb}, {Rune: '界', Style: indexed}, {Continuation: true, Style: indexed}}})
27	-	want := Session{Name: "v3 exact", Tabs: []Tab{{Focus: "p", Tree: layout.NewTree("p"), Panes: []Pane{{ID: "p", SealedChunks: sealed, Tail: tail, Visible: visible}}}}}	28	+	sealed2, tail2 := historyBlobs(t, [][]renderer.Cell{{{Rune: 'S', Style: rgb}}, {{Rune: '2', Style: indexed}}})
			29	+	visible2 := visibleBlob(t, [][]renderer.Cell{{{Rune: 'P', Style: indexed}, {Rune: '2', Style: rgb}}})
			30	+	want := Session{Name: "v3 exact", Tabs: []Tab{{Focus: "p", Tree: &layout.Tree{Focus: "p", Root: &layout.Node{Kind: layout.Split, Dir: layout.Horizontal, Children: []*layout.Node{layout.NewLeaf("p"), layout.NewLeaf("p2")}}}, Panes: []Pane{
			31	+	{ID: "p", SealedChunks: sealed, Tail: tail, Visible: visible},
			32	+	{ID: "p2", SealedChunks: sealed2, Tail: tail2, Visible: visible2},
			33	+	}}}}
28		encoded, err := Marshal(want)	34		encoded, err := Marshal(want)
29		if err != nil {	35		if err != nil {
30		t.Fatal(err)	36		t.Fatal(err)

@@ -34,9 +40,26 @@ func TestV3SnapshotRoundTripPreservesExactTerminalData(t *testing.T) {
34		if err != nil {	40		if err != nil {
35		t.Fatal(err)	41		t.Fatal(err)
36		}	42		}
37	-	if len(got.Tabs) != 1 \|\| len(got.Tabs[0].Panes) != 1 \|\| got.Tabs[0].Panes[0].ID != "p" {	43	+	if len(got.Tabs) != 1 \|\| len(got.Tabs[0].Panes) != 2 \|\| got.Tabs[0].Panes[0].ID != "p" \|\| got.Tabs[0].Panes[1].ID != "p2" {
38		t.Fatalf("manifest round trip = %#v", got)	44		t.Fatalf("manifest round trip = %#v", got)
39		}	45		}
			46	+	for i, wantPane := range want.Tabs[0].Panes {
			47	+	gotPane := got.Tabs[0].Panes[i]
			48	+	if len(gotPane.SealedChunks) != len(wantPane.SealedChunks) {
			49	+	t.Fatalf("pane %q sealed chunks = %d, want %d", wantPane.ID, len(gotPane.SealedChunks), len(wantPane.SealedChunks))
			50	+	}
			51	+	for j := range wantPane.SealedChunks {
			52	+	if !bytes.Equal(gotPane.SealedChunks[j], wantPane.SealedChunks[j]) {
			53	+	t.Fatalf("pane %q sealed chunk %d changed during round trip", wantPane.ID, j)
			54	+	}
			55	+	}
			56	+	if !bytes.Equal(gotPane.Tail, wantPane.Tail) {
			57	+	t.Fatalf("pane %q tail changed during round trip", wantPane.ID)
			58	+	}
			59	+	if !bytes.Equal(gotPane.Visible, wantPane.Visible) {
			60	+	t.Fatalf("pane %q visible blob changed during round trip", wantPane.ID)
			61	+	}
			62	+	}
40		if _, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: 8, ChunkRows: 2}, got.Tabs[0].Panes[0].SealedChunks, got.Tabs[0].Panes[0].Tail); err != nil {	63		if _, err := vt.HistoryFromBlobs(vt.HistoryConfig{MaxRows: 8, ChunkRows: 2}, got.Tabs[0].Panes[0].SealedChunks, got.Tabs[0].Panes[0].Tail); err != nil {
41		t.Fatalf("history decode: %v", err)	64		t.Fatalf("history decode: %v", err)
42		}	65		}