[arrrrny]

Merges upstream/master (4f896118) into master (bcc91654) and resolves the 7 conflicts by hand — no -X theirs, no -s ours, per the fork-upstream-sync policy.

The branch starts from the current upstream tip — one commit newer than the 4dc23bb1 recorded in the sync-conflict comment — so the next scheduled sync is a true no-op. (The issue body is from the 2026-10-06 run; the 2026-10-08 comment raised the conflict set from 5 files to 7. All seven are resolved here.)

How each conflict was resolved

1. src/api/server.rs — keep the Ziki http-push listener, adopt the named accept thread

The fork's http-push listener (resolved_http_push_listen_addr / start_http_push_server, fail-soft) stays, started before the accept loop; upstream's new crate::thread_spawn::spawn_named("herdr-api-accept", …) wraps the accept thread. The ServerHandle keeps owning the listener handle so shutdown still handles it.

2. src/app/api/worktrees/reads.rs — bounds check + restored-worktree gate

Fork's bounds-checked self.state.workspaces.get(ws_idx) else { return Err(...) } and upstream's self.require_restored_worktree_ready(ws_idx)? both run, in that order.

3. src/client/input.rs — keep the fork's idle-flush helper, drop the stale free timeout fn

Fork's flush_unix_input_after_idle helper is kept (both call sites and the tests use it). The fork's free idle_flush_timeout_ms function is dropped: upstream moved that logic onto RawInputByteFramer::idle_flush_timeout_ms, and every merged call site already uses the framer method — keeping the free function would leave dead code referencing methods that no longer exist.

4. src/detect/mod.rs — union of the ziki detection path

identify_agent_for_process(...) (fork) still runs first and yields (agent, candidate, process.pid).

5. src/client/terminal_setup.rs — upstream's host terminal probe, fork's cfg(unix) guards

Upstream's HostTerminalProbe + query_host_escape_disambiguation() (with the ?1016$p SGR pixel-mouse query) is kept, with the fork's deliberate cfg(unix) / #[cfg(not(unix))] split (fork commit 65ef2cb9, which avoids a non-unix build regression) preserved over upstream's broader cfg(not(windows)).

6. src/pane.rs — both tracking fields, split skip conditions

Both task loops carry upstream's agent_job: AgentJobTracker::default() and the fork's last_lifecycle_authority_scan_at. The old combined skip condition splits in two: upstream's background-job skip (agent_job.in_background() && !process_exited) stays, and the fork's every-5s screen scan under lifecycle authority (SCREEN_SCAN_UNDER_LIFECYCLE_AUTHORITY_INTERVAL, driving force_refresh: lifecycle_refresh_due) runs independently.

7. src/platform/mod.rs — re-export union + test-module union

unix_common re-exports keep both sides (fork: check_config_write_target, config_file_link_count, write_existing_config; upstream: begin_cli_output, end_cli_output, forward_remote_bridge_stdio, ignore_server_hangup, local_stream_peer_description, spawn_server_signal_monitor, RemoteBridgeWake). The test module keeps the fork's two live_pane_process_group tests followed by the fork's SHELL_TEST_LOCK static.

8. Semantic conflict that merged cleanly — activate_endpoint on ServerEvent::ClientShellConnected

Not every conflict hits a marker. Fork master (PR #74) added activate_endpoint to ServerEvent::ClientShellConnected, while upstream added a new test (client_shell_requests_host_pixels_for_an_unfocused_pixel_pane, upstream herdrdev#4750) that constructs the same event in src/server/headless/tests/mod.rs. Different hunks merged cleanly, but the tree did not compile (error[E0063]: missing field activate_endpoint, tests/mod.rs:6291). Resolved by passing activate_endpoint: false at that construction site, matching the other ten sites in the file. cargo check --locked --all-targets then compiles every target.

Validation

On this host (Intel macOS 15.7.9, repo-pinned Rust 1.96.1, Zig 0.16.0, MSVC cross SDK at ~/.local/share/herdr/windows-cross/), run on the merge staged for this PR:

Stage	Result
cargo fmt --check	pass
cargo clippy --all-targets --locked -- -D warnings	pass
cargo nextest run --locked --no-fail-fast	3902/3904 pass, 12 skipped (195 s) — the 2 failures below
just maintenance-test	196 py + 13 bun, pass
just ui-hot-path-architecture-test	6 pass
just integration-assets-test	55 pass across 3 files
just windows-lint (MSVC cross)	pass (3m58s)
just docs-contract-test	7 pass
scripts/fork_owned_guard.py	68 entries intact
scripts/generated_snapshot_guard.py	69 files clean

Pre-existing local failure: server_stop_request_logs_its_caller

server_stop_request_logs_its_caller (tests/server_headless.rs:636) fails
deterministically on this host — assertion failed: wait_for_exit(&mut spawned.child, Duration::from_secs(10)).
It is not a merge regression:

• The server's own log shows a complete, correct shutdown in ~77 ms (server shutdown initiated →
  completing server shutdown → headless server exiting → herdr exiting); only the child reap lags.

• The test is brand new here: it arrives with upstream c4653a4f (fix: keep the server running on hangup and log why it stops herdrdev/herdr#4965) and exists on neither the
  fork's master (bcc91654) nor the merge base — this merge is its first exposure.

• Upstream 4f896118 passes it in ~2 s on this same host.

• Standalone pty harness (spawn herdr server with stdout/stderr on a pty whose master is never
  read — exactly what the test harness does — then send server.stop):

  Binary	Behaviour after server.stop
  upstream 4f896118	exits on its own at ~1.0 s (?NEs → ZN), 0 bytes drained
  merged tree (this PR)	wedged in ?NEs for 20 s+, exits the instant the master is drained (476 bytes pending)
  installed pre-merge fork binary (herdr 0.9.3, built 2026-10-08 06:43)	identical wedge (472 bytes pending)

• So the fork's exit path has always waited on the unread pty; upstream's does not. This is a
  pre-existing fork-side trait, not something the merge changed — the merge only adds the first
  test that spawns the server on a never-read pty and asserts reaping.

• It is not generic unread-pty behaviour: a C program writing ≤900 pending bytes to an unread pty
  exits normally (only a literally full 1024-byte queue blocks, and that blocks the write, not
  the exit). A precise root-cause patch is out of scope for a sync PR; the wedged process is
  un-inspectable from userland (ps -M empty; sample and lldb refuse), and the fix belongs
  with the fork's exit path. Follow-up: harden the fork exit path against an undrained pty.

Load-sensitive failure: server_survives_hangup_and_logs_why_it_stops

server_survives_hangup_and_logs_why_it_stops fails only in the full parallel run (under 3904
concurrent tests it misses its "server shutdown initiated" log deadline) and passes in isolation
on the same binary (cargo nextest run -E 'test(server_survives_hangup_and_logs_why_it_stops)'
→ PASS [1.758s]). A local load-sensitive timing flake, not a merge artifact. Both this test
and the stop test arrive with upstream c4653a4f (herdrdev#4965); neither exists on the merge base.

Closes #72

[zuraffa-review]

Walkthrough

Note

A clean, hand-resolved upstream sync: upstream/master (4f896118) merged into fork master (bcc91654) at merge base e35f3937 — 136 files, +11,259/-3,662. All seven conflicts plus one semantic seam resolve as faithful unions: the fork's ziki detection path, http-push listener, idle-flush helper, cfg(unix) guards, pane lifecycle tracking and platform re-exports all survive intact, while upstream's named thread spawn, restored-worktree gate, framer-timeout refactor, host terminal probe and pixel-pane tests land cleanly. Guardrails are green at 3e0260d7 (68/68 fork-owned entries, 69/69 generated files, cargo fmt --check clean); the only red CI is the documented pre-existing macOS exit-path trait that a new upstream test now exercises — not a merge regression.

Merge-resolution verification (at 3e0260d7)

Conflict (per PR body)	Verified result
1. src/api/server.rs	✅ Fork's fail-soft http-push listener retained (resolved_http_push_listen_addr / start_http_push_server, :127-128) and started before the accept loop; upstream's named accept thread adopted (spawn_named("herdr-api-accept", …), :138); ServerHandle still owns the listener handle.
2. src/app/api/worktrees/reads.rs	✅ Fork's bounds-checked get(ws_idx) else { return Err(...) } runs before upstream's require_restored_worktree_ready(ws_idx)? (:129); the second site keeps the fork's get + return false.
3. src/client/input.rs	✅ Fork's flush_unix_input_after_idle helper kept (:339; call sites :131, :220) and now waits on upstream's RawInputByteFramer::idle_flush_timeout_ms (:129, :216); the fork's stale free timeout fn is gone.
4. src/detect/mod.rs	✅ Fork's Agent::Ziki survives the union (variant :67, ALL :96, SCREEN_MANIFEST_AGENTS :122, label/executable :152/:188, lookup :229); upstream's identify_agent_process_in_job keeps the pid via the fork's identify_agent_for_process (:259, called :283/:291).
5. src/client/terminal_setup.rs	✅ Upstream's HostTerminalProbe + query_host_escape_disambiguation() kept (:76-86) with the fork's deliberate cfg(unix)/#[cfg(not(unix))] split preserved over upstream's broader cfg(not(windows)) (:4, :147-152).
6. src/pane.rs	✅ Both loops carry upstream's agent_job: AgentJobTracker (:991) and the fork's last_lifecycle_authority_scan_at (:992); the combined skip splits into upstream's background-job skip (:1159) and the fork's 5s screen scan (SCREEN_SCAN_UNDER_LIFECYCLE_AUTHORITY_INTERVAL, :425).
7. src/platform/mod.rs	✅ unix_common re-exports keep both sides (fork: check_config_write_target, config_file_link_count, write_existing_config; upstream: begin_cli_output, end_cli_output, forward_remote_bridge_stdio, …); test module keeps the fork's live_pane_process_group tests + SHELL_TEST_LOCK (:701).
8. Semantic — activate_endpoint	✅ Upstream's new client_shell_requests_host_pixels_for_an_unfocused_pixel_pane (src/server/headless/tests/mod.rs:6265) constructs ServerEvent::ClientShellConnected with the fork's activate_endpoint: false (:6305), matching all 11 sites in the file.

Changes

Layer / File(s)	Summary
Conflict seams (7 files + 1 semantic)	Hand-resolved unions — see the verification table above.
src/client/shell/tests/input_conformance.rs (+1,641), src/client/shell/tests/input.rs, src/raw_input.rs, src/client/input/windows_vti.rs	Upstream input-framing arrival: new conformance suite and framer-timeout work.
src/plugin_installations.rs (+470), src/cli/plugin.rs, src/app/api/plugins/**, tests/cli/plugins.rs (+594/-378)	Upstream plugin-system work.
src/pane.rs (+678/-70), src/pane/terminal.rs, src/pane/background_agent.rs, src/pane/input.rs	Upstream pane / background-agent tracking work.
src/platform/windows.rs, tests/windows_server_security.rs (+262), src/platform/ssh_agent.rs	Upstream Windows + ssh-agent platform work.
src/app/git_refresh.rs, src/app/agent_suspend_tests.rs, tests/session_restore.rs	Upstream app-layer arrival.
src/server/headless/tests/mod.rs (+321)	Headless test additions, incl. the activate_endpoint semantic seam.
distribution/*, docs snapshots	Generated release surfaces — snapshot guard clean.

Estimated Review Effort: 3 (30 minutes)

Category of Change	Complexity
Merge-conflict seams (7 files + activate_endpoint)	🔨 Medium
Upstream code arrival (136 files, +11,259/-3,662)	⚡ Low — reviewed upstream, spot-checked here
Guardrails / CI	⚡ Low

Pre-Merge Checks

Check	Status
cargo fmt --check @ 3e0260d7	✅ Clean (run in this review)
scripts/fork_owned_guard.py @ 3e0260d7	✅ 68 entries intact (run in this review)
scripts/generated_snapshot_guard.py @ 3e0260d7	✅ 69 files clean (run in this review)
Maintenance suites (fork guard, snapshot guard, sync-resolve-generated, agent-detection manifest, docs translation parity, changelog, config reference)	✅ Green
check (ubuntu-latest) / check (windows-latest) / Windows ConPTY package / validate / flake check / conventional-commits	✅ Pass
check (macos-latest)	❌ server_stop_request_logs_its_caller — pre-existing fork-side exit-path trait (documented in PR body; upstream 4f896118 passes it, fork binary wedges identically) — not a merge regression
Mergeability	✅ MERGEABLE (base master)

🧸 Poetry

🐰 Seven seams stitched paw to paw,
   the fork's own flags survive it all.
   Guardrails green, the tide complete —
   one red check that predates this feat. 🥕

[zuraffa-review]

Clean upstream sync — zero actionable findings. Full merge-fidelity audit in the walkthrough comment. 🐰

[arrrrny]

Merge task

merged as 262e780