[compass] Fix: a display change that ends during a stop reports the stopped seat detached

[skulitom]

Report

ANODE-BUGS.md B-039 (filed 2026-10-13 by compass-anode-fixer from #42's final review): a display change that fails while the seat stops can set detached after stopped.

Root cause

Each of these was a check followed by an act that a stop could slip between, outside _lifecycleGate (the lock StopSeatAsync → CancelBringUp takes to set _stopRequested and cancel the bring-up token):

• Display reconnect that strands the viewer (ChangeViewerDisplayAsync): the catch's when (!cancel.IsCancellationRequested) filter ran before await OnViewerAsync(ConnectionState). A stop that ran during that await, even all the way to stopped, was followed by SetState("detached", …). The signed-out seat then said "still running … press Reconnect".
• Lost seat-host connection (ForwardToSeatAsync): !_stopRequested was read outside the lock, then SetState("detached").
• Late success (DisplayAsync): if (!_stopRequested) _display = target. A new start right after the stop clears _stopRequested (PrepareStart), so a change from the stopped seat could carry its display into the new seat's viewer connection. A late failure in the same window set detached during the new start, which ended that start with "Seat startup ended in state 'detached'". Also SetState("ready") ran after the lock was released.

Fix

• DisplayAsync now owns the state after a change. ChangeViewerDisplayAsync only throws ViewerDetachedException (inner exception = why). DisplayAsync reports detached under the gate, and only if the change's own bring-up token (which the stop cancels, and a later start replaces rather than resets) is not cancelled. Otherwise it answers "The seat was stopped while its display was changing." (the reply the cancelled path already gave), with no viewer_detached code, so the seat host doesn't ask for a reconnect.
• The success path checks the same token under the gate before it sets _display, and sets ready inside the gate.
• ForwardToSeatAsync checks ReferenceEquals(_seat, seat) && !_stopRequested and sets detached under the gate (a restarted seat has a new host client, so the reference check covers that generation).
• StopSeatAsync's workaround line from [compass] Fix: a detached seat can't be reconnected by the button its message names, and agents aren't told capture is down #42 (clearing a detached advice that slipped in during the stop) is removed: nothing can set detached after stopping now. stopping still clears the advice of a seat that was detached before the stop (covered by daemon detached viewer).
• CHANGELOG entry under Unreleased.

Tests

• New quick check stop during display change (Cli/DiagnosticsChecks.cs), with injected viewer and display hooks and no live seat. A stranded reconnect reports detached with its advice. One stranded during a stop leaves stopped with no lastError. After a stop and a new start, a late failure or a late success leaves the start connecting and _display unset, and the start still ends at its stop.
• Debug selftest --quick: 109/109. FOCUS test command (scripts\build.ps1 -QuickTest -OutputDirectory artifacts\pkg-build): 109/109, docs consistent.
• Mutations (per-mutation Debug build plus quick checks, byte-exact restore): 6 of 6 caught. They were: no check before detached; _stopRequested instead of the token (detached and success paths); the old if (!_stopRequested) _display = target; no detached at all; no ready on recovery.
• Not covered by a check: the ForwardToSeatAsync window is two adjacent statements, with no seam for a deterministic test. The fix there is by construction: one lock acquisition, which the stop also takes.

Manual check in a real seat

None needed for the fix itself: the race needs a stop at the moment a display reconnect fails. A normal seat_display reconnect, followed later by Stop, should behave as before.

Edge noted, not changed: a Remote Desktop control fatal error during a display change also cancels the token. Such a change now answers "stopped while its display was changing", as the cancelled path already did, and no longer overwrites the error state with detached.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.