write a pane's options in one tmux command list

the watcher wrote @agent_state, then @dingger_hook, as separate tmux
calls. a daemon stopped between them left a done display state next to a
stale "working" hook state, which the restarted daemon trusted: the agent
came back as working. now every changed option of a pane is one command
list, which tmux applies as a unit (and one process instead of several).

tests/kill-race.sh kills the daemon the instant an agent shows done: 24 of
40 kills left the options inconsistent before, 0 of 40 now. e2e step 17
runs it 20 times; the previous binary fails it.

2 files changed, 29 insertions, 0 deletions

diff --git a/tests/e2e.sh b/tests/e2e.sh
index b79c748..26914f1 100755
--- a/tests/e2e.sh
+++ b/tests/e2e.sh
@@ -519,6 +519,11 @@ sleep 2
 expect "it stays dismissed when a terminal starts tmux" "ls $STATE2/offer.json 2>/dev/null | wc -l | tr -d ' '" 0
 expect "the layout can still be restored by hand" "renv \"$DINGGER\" restore --dry-run | grep -c '^create   keep'" 1
 
+# --- 17. a daemon killed mid-write leaves consistent state -------------------
+echo "17. kill during a write"
+expect "20 kills right after done: hook and display state agree" \
+  "\"$ROOT/tests/kill-race.sh\" \"$DINGGER\" 20 | grep -o '^[^:]*: [0-9]* of' | sed 's/.*: //'" "0 of" 1
+
 # Every daemon this run started must stop with it.
 kill "$DAEMON_PID" "$DAEMON2_PID" 2>/dev/null
 expect "the test daemons stop" "ps -o pid= -p $DAEMON_PID,$DAEMON2_PID | wc -l | tr -d ' '" 0
diff --git a/tests/kill-race.sh b/tests/kill-race.sh
new file mode 100755
index 0000000..388c297
--- /dev/null
+++ b/tests/kill-race.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+# A daemon killed mid-write must never leave @agent_state=done next to a
+# stale @dingger_hook (a restart would trust the hook). Kills the daemon the
+# instant "done" appears, N times; prints how many left them inconsistent.
+# usage: kill-race.sh <dingger binary> <rounds>; counts inconsistent (@agent_state done, @dingger_hook not idle) after kill -9
+BIN=$1; N=$2; D=$(mktemp -d /tmp/dingger-race.XXXXXX); R=dingger-race-$$
+r() { tmux -u -L $R "$@"; }
+mkdir -p $D/bin; printf '#!/bin/sh\nexec sleep 100000\n' > $D/bin/pi; chmod +x $D/bin/pi
+r -f /dev/null new-session -d -s a -n w1 $D/bin/pi; r new-session -d -s b -n w2 $D/bin/pi
+P=$(r display -p -t a:w1 '#{pane_id}')
+start() { DINGGER_TMUX_SOCKET=$R DINGGER_AGENT_SOCKET=$D/hook.sock DINGGER_STATE_DIR=$D/state $BIN watch --interval-secs 30 --no-sounds --no-notifications >/dev/null 2>&1 & DP=$!; for _ in $(seq 50); do [ -S $D/hook.sock ] && break; sleep 0.05; done; }
+hook() { python3 -c "
+import json,socket; s=socket.socket(socket.AF_UNIX); s.connect('$D/hook.sock')
+s.sendall((json.dumps({'method':'pane.report_agent','params':{'pane_id':'$P','agent':'pi','state':'$1'}})+'\n').encode())"; }
+bad=0
+for i in $(seq $N); do
+  start; hook working; hook idle
+  for _ in $(seq 400); do [ "$(r show -pv -t $P @agent_state 2>/dev/null)" = done ] && break; done
+  kill -9 $DP; wait $DP 2>/dev/null; rm -f $D/hook.sock
+  h=$(r show -pv -t $P @dingger_hook 2>/dev/null); [ "$h" != idle ] && bad=$((bad+1))
+  r set -p -t $P -u @dingger_hook; r set -p -t $P @agent_state idle
+done
+echo "$(basename $(dirname $BIN))/$(basename $BIN): $bad of $N kills left @agent_state=done with @dingger_hook not idle"
+r kill-server; rm -rf $D