write a pane's options in one tmux command list

the watcher wrote @agent_state, then @dingger_hook, as separate tmux
calls. a daemon stopped between them left a done display state next to a
stale "working" hook state, which the restarted daemon trusted: the agent
came back as working. now every changed option of a pane is one command
list, which tmux applies as a unit (and one process instead of several).

tests/kill-race.sh kills the daemon the instant an agent shows done: 24 of
40 kills left the options inconsistent before, 0 of 40 now. e2e step 17
runs it 20 times; the previous binary fails it.

4 files changed, 73 insertions, 39 deletions

diff --git a/crates/dinggerd/src/tmux.rs b/crates/dinggerd/src/tmux.rs
index b1a2d60..182d62f 100644
--- a/crates/dinggerd/src/tmux.rs
+++ b/crates/dinggerd/src/tmux.rs
@@ -229,6 +229,25 @@ pub fn set_pane_option(pane_id: &str, name: &str, value: &str) -> Result<(), Str
     run_tmux(&["set-option", "-p", "-t", pane_id, name, value]).map(|_| ())
 }
 
+/// Set (`Some`) or unset (`None`) several pane options in one tmux command
+/// list, applied as a unit.
+pub fn set_pane_options(pane_id: &str, changes: &[(&str, Option<String>)]) -> Result<(), String> {
+    let mut args: Vec<&str> = Vec::new();
+    for (name, value) in changes {
+        if !args.is_empty() {
+            args.push(";");
+        }
+        match value {
+            Some(value) => args.extend(["set-option", "-p", "-t", pane_id, name, value.as_str()]),
+            None => args.extend(["set-option", "-p", "-u", "-t", pane_id, name]),
+        }
+    }
+    if args.is_empty() {
+        return Ok(());
+    }
+    run_tmux(&args).map(|_| ())
+}
+
 pub fn unset_pane_option(pane_id: &str, name: &str) -> Result<(), String> {
     run_tmux(&["set-option", "-p", "-u", "-t", pane_id, name]).map(|_| ())
 }
diff --git a/crates/dinggerd/src/watcher.rs b/crates/dinggerd/src/watcher.rs
index a2d6dae..91fa332 100644
--- a/crates/dinggerd/src/watcher.rs
+++ b/crates/dinggerd/src/watcher.rs
@@ -294,54 +294,40 @@ impl Watcher {
         Ok(())
     }
 
+    /// Write the pane's options that changed, in one tmux command list:
+    /// tmux applies it as a unit, so a daemon killed mid-write never leaves
+    /// a display state that disagrees with the hook state it came from.
     fn write_pane_options(&self, pane: &tmux::Pane, track: PaneTrack) {
-        let label = track.status().label();
-        if pane.written_state != label {
-            if let Err(err) = tmux::set_pane_option(&pane.pane_id, "@agent_state", label) {
-                warn!(target = %pane.display_target, %err, "failed to write @agent_state");
+        let mut changes: Vec<(&str, Option<String>)> = Vec::new();
+        let mut change = |name: &'static str, written: &str, value: String| {
+            if written != value {
+                changes.push((name, (!value.is_empty()).then_some(value)));
             }
+        };
+        // The authoritative hook state, so a restart keeps it; it goes with
+        // the agent.
+        let hook = match pane.agent {
+            Some(_) => hooks::last_state(&pane.pane_id).map(state_label).unwrap_or_default(),
+            None => "",
+        };
+        if pane.agent.is_none() || !hook.is_empty() {
+            change("@dingger_hook", &pane.written_hook, hook.to_string());
         }
-        let since = track.since.map(|s| s.to_string()).unwrap_or_default();
-        if pane.written_since != since {
-            let _ = if since.is_empty() {
-                tmux::unset_pane_option(&pane.pane_id, "@dingger_since")
-            } else {
-                tmux::set_pane_option(&pane.pane_id, "@dingger_since", &since)
-            };
-        }
-        let agent = pane.agent.map(detect_core::agent_label).unwrap_or("");
-        if pane.written_agent != agent {
-            let _ = tmux::set_pane_option(&pane.pane_id, "@agent", agent);
-        }
+        change("@agent_state", &pane.written_state, track.status().label().to_string());
+        change("@dingger_since", &pane.written_since, track.since.map(|s| s.to_string()).unwrap_or_default());
+        change("@agent", &pane.written_agent, pane.agent.map(detect_core::agent_label).unwrap_or("").to_string());
         let name = crate::names::display_name(pane.agent, &pane.pane_title, &pane.cwd, host_name())
             .unwrap_or_default();
-        if pane.written_name != name {
-            let _ = if name.is_empty() {
-                tmux::unset_pane_option(&pane.pane_id, "@agent_name")
-            } else {
-                tmux::set_pane_option(&pane.pane_id, "@agent_name", &name)
-            };
-        }
-        // Persist the authoritative hook state so a restart keeps it.
-        let hook = hooks::last_state(&pane.pane_id)
-            .map(state_label)
-            .unwrap_or_default();
-        if pane.agent.is_some() && !hook.is_empty() && pane.written_hook != hook {
-            let _ = tmux::set_pane_option(&pane.pane_id, "@dingger_hook", hook);
-        }
-        if pane.agent.is_none() && !pane.written_hook.is_empty() {
-            let _ = tmux::unset_pane_option(&pane.pane_id, "@dingger_hook");
-        }
+        change("@agent_name", &pane.written_name, name);
         // The session reference, for restore; it goes with the agent.
         match (pane.agent, hooks::session(&pane.pane_id)) {
-            (Some(_), Some(session)) if pane.written_session != session => {
-                let _ = tmux::set_pane_option(&pane.pane_id, "@agent_session", &session);
-            }
-            (None, _) if !pane.written_session.is_empty() => {
-                let _ = tmux::unset_pane_option(&pane.pane_id, "@agent_session");
-            }
+            (Some(_), Some(session)) => change("@agent_session", &pane.written_session, session),
+            (None, _) => change("@agent_session", &pane.written_session, String::new()),
             _ => {}
         }
+        if let Err(err) = tmux::set_pane_options(&pane.pane_id, &changes) {
+            warn!(target = %pane.display_target, %err, "failed to write pane options");
+        }
     }
 
     fn notify(&self, pane: &tmux::Pane, kind: NotificationKind) {
diff --git a/tests/e2e.sh b/tests/e2e.sh
index b79c748..26914f1 100755
--- a/tests/e2e.sh
+++ b/tests/e2e.sh
@@ -519,6 +519,11 @@ sleep 2
 expect "it stays dismissed when a terminal starts tmux" "ls $STATE2/offer.json 2>/dev/null | wc -l | tr -d ' '" 0
 expect "the layout can still be restored by hand" "renv \"$DINGGER\" restore --dry-run | grep -c '^create   keep'" 1
 
+# --- 17. a daemon killed mid-write leaves consistent state -------------------
+echo "17. kill during a write"
+expect "20 kills right after done: hook and display state agree" \
+  "\"$ROOT/tests/kill-race.sh\" \"$DINGGER\" 20 | grep -o '^[^:]*: [0-9]* of' | sed 's/.*: //'" "0 of" 1
+
 # Every daemon this run started must stop with it.
 kill "$DAEMON_PID" "$DAEMON2_PID" 2>/dev/null
 expect "the test daemons stop" "ps -o pid= -p $DAEMON_PID,$DAEMON2_PID | wc -l | tr -d ' '" 0
diff --git a/tests/kill-race.sh b/tests/kill-race.sh
new file mode 100755
index 0000000..388c297
--- /dev/null
+++ b/tests/kill-race.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# A daemon killed mid-write must never leave @agent_state=done next to a
+# stale @dingger_hook (a restart would trust the hook). Kills the daemon the
+# instant "done" appears, N times; prints how many left them inconsistent.
+# usage: kill-race.sh <dingger binary> <rounds>; counts inconsistent (@agent_state done, @dingger_hook not idle) after kill -9
+BIN=$1; N=$2; D=$(mktemp -d /tmp/dingger-race.XXXXXX); R=dingger-race-$$
+r() { tmux -u -L $R "$@"; }
+mkdir -p $D/bin; printf '#!/bin/sh\nexec sleep 100000\n' > $D/bin/pi; chmod +x $D/bin/pi
+r -f /dev/null new-session -d -s a -n w1 $D/bin/pi; r new-session -d -s b -n w2 $D/bin/pi
+P=$(r display -p -t a:w1 '#{pane_id}')
+start() { DINGGER_TMUX_SOCKET=$R DINGGER_AGENT_SOCKET=$D/hook.sock DINGGER_STATE_DIR=$D/state $BIN watch --interval-secs 30 --no-sounds --no-notifications >/dev/null 2>&1 & DP=$!; for _ in $(seq 50); do [ -S $D/hook.sock ] && break; sleep 0.05; done; }
+hook() { python3 -c "
+import json,socket; s=socket.socket(socket.AF_UNIX); s.connect('$D/hook.sock')
+s.sendall((json.dumps({'method':'pane.report_agent','params':{'pane_id':'$P','agent':'pi','state':'$1'}})+'\n').encode())"; }
+bad=0
+for i in $(seq $N); do
+  start; hook working; hook idle
+  for _ in $(seq 400); do [ "$(r show -pv -t $P @agent_state 2>/dev/null)" = done ] && break; done
+  kill -9 $DP; wait $DP 2>/dev/null; rm -f $D/hook.sock
+  h=$(r show -pv -t $P @dingger_hook 2>/dev/null); [ "$h" != idle ] && bad=$((bad+1))
+  r set -p -t $P -u @dingger_hook; r set -p -t $P @agent_state idle
+done
+echo "$(basename $(dirname $BIN))/$(basename $BIN): $bad of $N kills left @agent_state=done with @dingger_hook not idle"
+r kill-server; rm -rf $D