write a pane's options in one tmux command list

the watcher wrote @agent_state, then @dingger_hook, as separate tmux
calls. a daemon stopped between them left a done display state next to a
stale "working" hook state, which the restarted daemon trusted: the agent
came back as working. now every changed option of a pane is one command
list, which tmux applies as a unit (and one process instead of several).

tests/kill-race.sh kills the daemon the instant an agent shows done: 24 of
40 kills left the options inconsistent before, 0 of 40 now. e2e step 17
runs it 20 times; the previous binary fails it.

2 files changed, 44 insertions, 39 deletions

diff --git a/crates/dinggerd/src/tmux.rs b/crates/dinggerd/src/tmux.rs
index b1a2d60..182d62f 100644
--- a/crates/dinggerd/src/tmux.rs
+++ b/crates/dinggerd/src/tmux.rs
@@ -229,6 +229,25 @@ pub fn set_pane_option(pane_id: &str, name: &str, value: &str) -> Result<(), Str
     run_tmux(&["set-option", "-p", "-t", pane_id, name, value]).map(|_| ())
 }
 
+/// Set (`Some`) or unset (`None`) several pane options in one tmux command
+/// list, applied as a unit.
+pub fn set_pane_options(pane_id: &str, changes: &[(&str, Option<String>)]) -> Result<(), String> {
+    let mut args: Vec<&str> = Vec::new();
+    for (name, value) in changes {
+        if !args.is_empty() {
+            args.push(";");
+        }
+        match value {
+            Some(value) => args.extend(["set-option", "-p", "-t", pane_id, name, value.as_str()]),
+            None => args.extend(["set-option", "-p", "-u", "-t", pane_id, name]),
+        }
+    }
+    if args.is_empty() {
+        return Ok(());
+    }
+    run_tmux(&args).map(|_| ())
+}
+
 pub fn unset_pane_option(pane_id: &str, name: &str) -> Result<(), String> {
     run_tmux(&["set-option", "-p", "-u", "-t", pane_id, name]).map(|_| ())
 }
diff --git a/crates/dinggerd/src/watcher.rs b/crates/dinggerd/src/watcher.rs
index a2d6dae..91fa332 100644
--- a/crates/dinggerd/src/watcher.rs
+++ b/crates/dinggerd/src/watcher.rs
@@ -294,54 +294,40 @@ impl Watcher {
         Ok(())
     }
 
+    /// Write the pane's options that changed, in one tmux command list:
+    /// tmux applies it as a unit, so a daemon killed mid-write never leaves
+    /// a display state that disagrees with the hook state it came from.
     fn write_pane_options(&self, pane: &tmux::Pane, track: PaneTrack) {
-        let label = track.status().label();
-        if pane.written_state != label {
-            if let Err(err) = tmux::set_pane_option(&pane.pane_id, "@agent_state", label) {
-                warn!(target = %pane.display_target, %err, "failed to write @agent_state");
+        let mut changes: Vec<(&str, Option<String>)> = Vec::new();
+        let mut change = |name: &'static str, written: &str, value: String| {
+            if written != value {
+                changes.push((name, (!value.is_empty()).then_some(value)));
             }
+        };
+        // The authoritative hook state, so a restart keeps it; it goes with
+        // the agent.
+        let hook = match pane.agent {
+            Some(_) => hooks::last_state(&pane.pane_id).map(state_label).unwrap_or_default(),
+            None => "",
+        };
+        if pane.agent.is_none() || !hook.is_empty() {
+            change("@dingger_hook", &pane.written_hook, hook.to_string());
         }
-        let since = track.since.map(|s| s.to_string()).unwrap_or_default();
-        if pane.written_since != since {
-            let _ = if since.is_empty() {
-                tmux::unset_pane_option(&pane.pane_id, "@dingger_since")
-            } else {
-                tmux::set_pane_option(&pane.pane_id, "@dingger_since", &since)
-            };
-        }
-        let agent = pane.agent.map(detect_core::agent_label).unwrap_or("");
-        if pane.written_agent != agent {
-            let _ = tmux::set_pane_option(&pane.pane_id, "@agent", agent);
-        }
+        change("@agent_state", &pane.written_state, track.status().label().to_string());
+        change("@dingger_since", &pane.written_since, track.since.map(|s| s.to_string()).unwrap_or_default());
+        change("@agent", &pane.written_agent, pane.agent.map(detect_core::agent_label).unwrap_or("").to_string());
         let name = crate::names::display_name(pane.agent, &pane.pane_title, &pane.cwd, host_name())
             .unwrap_or_default();
-        if pane.written_name != name {
-            let _ = if name.is_empty() {
-                tmux::unset_pane_option(&pane.pane_id, "@agent_name")
-            } else {
-                tmux::set_pane_option(&pane.pane_id, "@agent_name", &name)
-            };
-        }
-        // Persist the authoritative hook state so a restart keeps it.
-        let hook = hooks::last_state(&pane.pane_id)
-            .map(state_label)
-            .unwrap_or_default();
-        if pane.agent.is_some() && !hook.is_empty() && pane.written_hook != hook {
-            let _ = tmux::set_pane_option(&pane.pane_id, "@dingger_hook", hook);
-        }
-        if pane.agent.is_none() && !pane.written_hook.is_empty() {
-            let _ = tmux::unset_pane_option(&pane.pane_id, "@dingger_hook");
-        }
+        change("@agent_name", &pane.written_name, name);
         // The session reference, for restore; it goes with the agent.
         match (pane.agent, hooks::session(&pane.pane_id)) {
-            (Some(_), Some(session)) if pane.written_session != session => {
-                let _ = tmux::set_pane_option(&pane.pane_id, "@agent_session", &session);
-            }
-            (None, _) if !pane.written_session.is_empty() => {
-                let _ = tmux::unset_pane_option(&pane.pane_id, "@agent_session");
-            }
+            (Some(_), Some(session)) => change("@agent_session", &pane.written_session, session),
+            (None, _) => change("@agent_session", &pane.written_session, String::new()),
             _ => {}
         }
+        if let Err(err) = tmux::set_pane_options(&pane.pane_id, &changes) {
+            warn!(target = %pane.display_target, %err, "failed to write pane options");
+        }
     }
 
     fn notify(&self, pane: &tmux::Pane, kind: NotificationKind) {