feat(serve): keepalive pings + stdout write watchdog #143

Merged

hexajon merged 2 commits from refs/pull/143/head into main

2026-07-16 01:00:39 +00:00

hexajon commented

2026-07-16 01:00:15 +00:00

(Migrated from codeberg.org)

Summary

Hardens madtea serve against the mid-session connection drops tracked in #4 (Refs #4 - the issue stays open as the tracker until a live occurrence confirms the root cause). Two pieces: (1) go-sdk KeepAlive enabled at 45s in the production ServerOptions with the SDK's keepalive-failure close logged durably to serve.log - closes the client-alive-but-unresponsive case. (2) A write watchdog wraps the stdout protocol writer on the real serve path: any single protocol write blocked past 120s logs a write_watchdog cause line durably (stderr + serve.log, never the blocked stdout) and exits nonzero - converting the silent lingering-blocked-process failure mode into a loud diagnosable death. The 120s bar is a deliberate tradeoff: a spurious fire needs a single framed message over the ~64KB pipe buffer AND a client that stays alive without draining for two minutes. The diagnostic fork is documented at the watchdog definition: if the next real drop self-terminates with a write_watchdog line, the backpressure theory is confirmed; if it never fires, investigation moves client-side. Existing instrumentation (panic recovery, crash file, lifecycle logging, getppid reaper) untouched; hermetically tested including under race.

## Summary Hardens madtea serve against the mid-session connection drops tracked in #4 (Refs #4 - the issue stays open as the tracker until a live occurrence confirms the root cause). Two pieces: (1) go-sdk KeepAlive enabled at 45s in the production ServerOptions with the SDK's keepalive-failure close logged durably to serve.log - closes the client-alive-but-unresponsive case. (2) A write watchdog wraps the stdout protocol writer on the real serve path: any single protocol write blocked past 120s logs a write_watchdog cause line durably (stderr + serve.log, never the blocked stdout) and exits nonzero - converting the silent lingering-blocked-process failure mode into a loud diagnosable death. The 120s bar is a deliberate tradeoff: a spurious fire needs a single framed message over the ~64KB pipe buffer AND a client that stays alive without draining for two minutes. The diagnostic fork is documented at the watchdog definition: if the next real drop self-terminates with a write_watchdog line, the backpressure theory is confirmed; if it never fires, investigation moves client-side. Existing instrumentation (panic recovery, crash file, lifecycle logging, getppid reaper) untouched; hermetically tested including under race.