path: root/src/detached/server.zig

//! THE DETACHED CORE: one `Pardes` instance in a process with no terminal,
//! serving N frontends over one unix socket.
//!
//! THIS SIDE OWNS THE CORE. `Session` is a `host.Host` implementation whose
//! methods encode wire messages instead of doing IO, and whose
//! `pull_wait_input` is a `poll(2)` over the listener and every attached
//! frontend. The frontends own terminals and nothing else (client.zig). So the
//! `Pardes` is here, `update` is called from here, and the same screen is on
//! every attached frontend at once — `screen -x`, not N sessions.
//!
//! WHAT THIS SIDE SERVES ITSELF. Every method this vtable leaves null falls
//! through to the core's own `host.Fallback`: the embedded source filesystem,
//! the in-process clipboard, silent ptys. host.zig says in as many words that a
//! zero-method host is a complete pardes, and that is exactly what a session
//! with nothing attached is. Everything a real frontend can do BETTER — fork a
//! shell on a real tty, put bytes on a real disk, reach a real desktop
//! clipboard — is asked of a frontend, and the routing table below says which.
//!
//! ROUTING, and it is not "push means broadcast". A push reaches every HOST
//! (host.zig's rule, which `Fanout.isPull` enforces); this is ONE host that
//! happens to be backed by several frontends, and how it spreads a call inside
//! itself is its own business. Three rules, one per kind of side effect:
//!   * BROADCAST — the frame, and `set_clipboard`. Every screen must show the
//!     same thing, and a yank in a shared session is a session-wide fact that
//!     every attached desktop is entitled to.
//!   * PRIMARY ONLY — `spawn`, `pty_write`, `pty_resize`, `write_file`,
//!     `write_dump`, `watch_file`, `watch_theme`, `dump_themes`. Each of these
//!     has ONE real resource behind it, and doing it twice is not doing it
//!     twice as well: two frontends forking a shell for pane 3 gives the pane
//!     two shells, and two frontends writing one path race each other. Primary
//!     is the lowest attached slot, i.e. the oldest surviving attachment — a
//!     rule that is stable while frontends come and go and needs no election.
//!     A pane's shell therefore lives in the frontend that forked it: when that
//!     frontend leaves, its panes stop producing output and the session's text,
//!     files and layout carry on. That is a real limit and it is stated here
//!     rather than papered over, because migrating a live pty between processes
//!     is a different feature.
//!   * ORIGIN, ELSE PRIMARY — `read_clipboard` (the one `pull_` on the wire)
//!     and `open_link`. Both answer a thing a HUMAN just did, and the answer
//!     belongs on that human's machine: the paste must come from the keyboard
//!     that asked for it, and a link must open in front of the person who
//!     clicked it. `origin` is the frontend whose event was applied most
//!     recently. Effects drain after a whole batch of events (pardes.zig
//!     `pump`), so in the rare case where two frontends type in the same
//!     millisecond the second one wins; the fallback to primary covers an
//!     effect that no input caused at all.
//!
//! FAIRNESS, and why no client can stall the core or another client:
//!   * every descriptor is non-blocking, and there is no thread per client. One
//!     `poll(2)` per pump covers the listener and all `max_clients` frontends.
//!   * FRAMES ARE NOT QUEUED. A client with bytes still owed to the kernel is
//!     SKIPPED for this frame and its mirror is left alone, so the next frame
//!     it does get is a diff against what it actually has. A slow frontend
//!     therefore sees fewer, larger frames instead of a growing queue, and
//!     coalescing costs no byte surgery at all.
//!   * what is left in a client's out-queue is control messages, and it is
//!     capped (`out_backlog`). The cap is checked BEFORE an append, so a single
//!     oversized message still goes out whole and what gets refused is a client
//!     that has stopped draining: it is closed. Its session and its peers are
//!     untouched, and it may reattach and be sent a full frame.
//!   * `max_clients` is a REFUSAL, not a queue — the same shape and the same
//!     number as fuse.zig's park table, and for the same reason: the listener
//!     is always accepted from even when the table is full, because a
//!     level-triggered `poll` on a backlog nobody accepts returns ready
//!     forever and spins a core. Bounded per round all the same (`accept`), and
//!     a connection that never says `hello` loses its slot
//!     (`greet_deadline_ms`) — a slot held by silence is the same denial as a
//!     queue, arrived at from the other end.
//!   * the TABLE is accounted, not just each client (`session_backlog`), and a
//!     drained client gives its buffers back (`idle_retain`): 32 slots each
//!     holding one 4 MiB paste is 128 MiB of a daemon nobody is looking at.
//!
//! THE SOCKET follows nested.zig's conventions exactly, and they ARE
//! nested.zig's: `socketDir`, `ensureSocketDir`, `statNoFollow` and
//! `setCloexec` are imported from it rather than copied, because one directory
//! vetted by two predicates is how the two go out of step. `$XDG_RUNTIME_DIR`
//! else `~/.local/state/pardes` created 0700 and vetted (never /tmp),
//! `chmod 0600` before `listen(2)`, CLOEXEC on the listener and on every
//! accepted connection. The NAME differs on purpose:
//! `pardes-detached-<name>.sock` rather than `pardes-<pid>.sock`, so that
//! nested.zig's sweeper — which only recognises all-digit pids — never unlinks
//! a live detached session, and so that a person can say `--detach=work`
//! instead of learning a pid.
//!
//! WHO MAY BIND A NAME, and this side is not allowed to guess. `bind(2)` on a
//! unix socket is an atomic exclusive create, so it decides: a name whose
//! socket ANSWERS is a live session and `listen` refuses rather than taking it
//! (an unconditional unlink-before-bind is how a second `--detach=work` used
//! to steal the socket out from under every frontend attached to the first).
//! The only file this process unlinks is one it proved dead — a connect that
//! was REFUSED — and `alive` is the single place that judgement is made, for
//! `listen` and for the sweep both.
//!
//! ...and both ends do the vetting. `vetted` is the frontend's half: a socket
//! at a path anyone could plant receives every keystroke that frontend
//! collects, so the client checks the directory and the socket before it
//! connects, exactly as this side checks them before it binds.
const std = @import("std");
const libc = std.c;
const pardes = @import("../pardes.zig");
const host_api = @import("../host.zig");
const wire = @import("wire.zig");

/// Diagnostics for whoever is running the daemon. Every one of these is a
/// `debug`, and the level is not a judgement about how bad the thing is:
/// main.zig's logFn drops this scope entirely unless PARDES_LOG is set, so what
/// decides whether a human sees it is that variable and not the level. Reaching
/// for `warn` instead would change exactly one thing — a TEST binary does not
/// go through logFn, and its stderr is the build runner's failure signal.
const log = std.log.scoped(.detached);

/// nested.zig owns the socket conventions this file shares — the directory,
/// its vetting, the stat that will not follow a symlink, CLOEXEC — and its
/// module comment carries the reasoning for each. Imported and not copied:
/// see the module header.
const nested = @import("../nested.zig");

/// `pub` for client.zig, which needs the same platform answer for the same
/// reason: SIGPIPE is per-write on linux and per-socket on darwin.
pub const darwin = nested.darwin;

/// Same two ingredients as nested.zig needs, minus the ancestor walk: unix
/// sockets and a per-user runtime directory. Anywhere else there is no detached
/// session and `listen` says so.
const supported = nested.supported;

/// `sun_path` is 108 bytes on linux and 104 on darwin, taken from the struct so
/// that the buffers, the fit checks and the memcpy cannot disagree with the
/// kernel or with each other.
const sun_path_len = nested.sun_path_len;

/// How many frontends may be attached at once. The number and the shape are
/// fuse.zig's park table: 32 slots, and overflow is a refusal rather than a
/// queue. A session with 32 frontends on it is not a session, it is a mistake,
/// and the 33rd gets told so instead of waiting in a backlog nobody drains.
pub const max_clients = 32;

/// Bytes of un-drained CONTROL messages a client may owe before it is closed.
/// Frames are not in here (see the module header), so this is a backlog of
/// ACTIONS — spawns, clipboard mirrors, file writes — and a frontend that has
/// not taken 1 MiB of those has stopped reading its socket. Checked before an
/// append rather than after, so one oversized message is never the thing that
/// trips it.
const out_backlog = 1 << 20;

/// One read per client per poll round (see `receive`). 16 KiB is two orders of
/// magnitude past a keystroke and small enough to sit on the loop's stack; a
/// 4 MiB paste arrives across several rounds, which is the point.
const read_chunk = 16 * 1024;

/// Bytes of client traffic — every in-queue and out-queue together — this
/// session may hold before it starts closing the peers holding it.
/// `out_backlog` bounds ONE slot and this bounds the table, which is not the
/// same ceiling: 32 clients each a byte under their own cap is 32 MiB of a
/// daemon nobody is looking at. 4 MiB is one whole paste in flight plus every
/// frame queue a real session builds, and past it the fattest peer is the peer
/// that stopped reading. The mirrors are NOT in this number: a mirror is this
/// session's own bookkeeping for a client it chose to serve, not something a
/// peer can grow.
const session_backlog = 4 << 20;

/// What a DRAINED client is allowed to keep. `in` grows to hold one whole
/// message, so a single 4 MiB paste otherwise leaves 4 MiB resident in that
/// slot for the life of the session — 128 MiB across a full table, for
/// something that happened once. Anything above one `read_chunk` is handed
/// back the moment the buffer empties, and the next message pays one
/// allocation for it; below that it is kept, so a session of keystrokes never
/// asks the allocator at all.
const idle_retain = read_chunk;

/// How long the listener is left out of the poll set after an `accept` that
/// failed for a reason that persists (EMFILE above all). See `accept`: the
/// alternative was sleeping 100 ms inside the core.
const accept_pause_ms = 100;

/// Why a client's connection ended. Only ever logged (`PARDES_LOG=1`), and
/// spelled out because "connection closed" is the one diagnostic that has never
/// helped anybody.
const Closed = enum { bye, peer, protocol, backlog, silent, write, read, oom, refused, quitting };

const Client = struct {
    fd: c_int = -1,
    /// The `hello` landed and was accepted. Before that the connection exists
    /// but votes on nothing and is sent no frames: its geometry is unknown.
    attached: bool = false,
    /// A `welcome` is owed, and is sent once this round's geometry has settled
    /// so the number in it is the one the next frame will use.
    greet: bool = false,
    /// This frontend's own window, as its last `hello`/`resize` said. One vote
    /// in `reconcile`'s minimum, never the session's grid by itself.
    cols: u16 = 0,
    rows: u16 = 0,
    /// Bytes read and not yet a whole message.
    in: std.ArrayListUnmanaged(u8) = .empty,
    /// Bytes owed to the kernel.
    out: std.ArrayListUnmanaged(u8) = .empty,
    /// What this client's grid holds, so the next frame can be a diff. Advanced
    /// only when a frame is actually queued for it, which is what makes a
    /// skipped frame correct rather than lost.
    mirror: std.ArrayListUnmanaged(pardes.Cell) = .empty,
    /// The next frame must be full: freshly attached, or the session geometry
    /// moved under it.
    need_full: bool = true,
    /// Monotonic milliseconds at `accept`, and the only thing an un-greeted
    /// connection is timed against. See `Session.greet_deadline_ms`.
    accepted_ms: i64 = 0,
};

/// A pane's shell: which frontend was asked to fork it, and where.
///
/// WHY THE SESSION REMEMBERS THIS. A spawn is the one primary-only call that
/// has to survive having no frontend to serve it. Every boot layout creates its
/// panes before the socket exists, so a `--detach` performs its startup spawns
/// with nobody attached — and dropping them meant a session that opened with
/// panes whose shells had never been forked, forever, in silence. So a spawn
/// with no primary is OWED, and asked of whoever attaches next.
///
/// It is also what makes `pty_write` reach the right process. A pane's pty
/// lives in the frontend that forked it, which is not always the primary: A
/// attaches and forks the shells, B attaches, A leaves — the panes are re-owed
/// to B, and then C attaching into A's freed slot becomes primary while the
/// ptys are in B. Routing a pane's bytes by its OWNER rather than by the
/// primary is the difference between typing into a shell and typing into
/// nothing.
const Shell = struct {
    /// The slot that was asked to fork this pane's shell, or null when nobody
    /// has been.
    owner: ?u8 = null,
    /// A spawn owed to whoever attaches next: either it was never asked, or the
    /// frontend holding it left and took the pty with it.
    owed: bool = false,
    /// Copied, because `push_spawn`'s `cwd` borrows the core's memory for the
    /// length of that one call and this outlives it by definition.
    cwd: std.ArrayListUnmanaged(u8) = .empty,
};

pub const Session = struct {
    gpa: std.mem.Allocator,
    core: *pardes.Pardes,
    /// -1 when nothing is bound: an unsupported platform, or a bind that
    /// failed. A session with no listener is a session nobody can attach to,
    /// which still runs.
    listener: c_int = -1,
    /// The bound path, kept so teardown unlinks exactly what was created and
    /// nothing else — guarded on the fd, like nested.zig's `unlisten`.
    path_buf: [sun_path_len]u8 = undefined,
    path_len: usize = 0,
    clients: [max_clients]Client = @splat(.{}),
    /// The session grid: the smallest common one across attached frontends.
    /// Seeded from the core's own startup size so the first attach of an
    /// identically sized frontend posts no resize at all.
    cols: u16,
    rows: u16,
    /// Whose input was applied last, for the two calls that must go back to one
    /// particular frontend. See the module header.
    origin: ?u8 = null,
    /// One encode buffer, reused. Grown to whatever the largest message so far
    /// needed rather than sized from `wire.max_payload`, which would be 16 MiB
    /// of resident memory for a session whose frames are six kilobytes.
    scratch: std.ArrayListUnmanaged(u8) = .empty,
    /// Where each pane's shell lives, and which spawns are still owed. See
    /// `Shell`.
    shells: [pardes.MAX_PANES]Shell = @splat(.{}),
    /// How long a connection may stay silent before the session takes its slot
    /// back. `Client.open` writes its `hello` in the same call that connects,
    /// so a peer that has said nothing for five seconds is not a frontend that
    /// was slow, and thirty-two of them used to fill the table and lock every
    /// real frontend out with a `refuse .full`.
    ///
    /// A field rather than a constant for exactly one reason: the test for that
    /// would otherwise have to sleep five seconds. Nothing else changes it.
    greet_deadline_ms: u32 = 5_000,
    /// Monotonic milliseconds until which the LISTENER is left out of the poll
    /// set, because an `accept` failed for a reason that persists. See `accept`.
    accept_paused_ms: i64 = 0,

    // ---- lifetime ---------------------------------------------------------

    pub fn deinit(s: *Session) void {
        // Tell everyone the session is over before the socket disappears, so a
        // frontend exits on a `quit` rather than on a read error whose meaning
        // it has to guess. Best effort by construction: these descriptors are
        // non-blocking, so a frontend that is not reading gets the EOF instead
        // — which is a case it has to handle regardless.
        for (&s.clients) |*c| if (c.attached) s.send(c, .quit);
        for (&s.clients) |*c| if (c.fd >= 0) s.close(c, .quitting);
        s.unlisten();
        s.scratch.deinit(s.gpa);
        for (&s.shells) |*sh| sh.cwd.deinit(s.gpa);
    }

    /// Bind and listen. False when there is no socket, and a session without
    /// one is simply one nobody can attach to — the same posture nested.zig
    /// takes, and for the same reason: a failed bind must not cost a launch.
    pub fn listen(s: *Session, name: []const u8) bool {
        if (comptime !supported) return false;
        var dir_buf: [sun_path_len:0]u8 = undefined;
        const dir = nested.socketDir(&dir_buf) orelse return false;
        if (!nested.ensureSocketDir(dir)) return false;
        sweep(dir);
        const path = socketPath(&s.path_buf, dir, name) orelse return false;
        var addr: libc.sockaddr.un = .{ .path = @splat(0) };
        @memcpy(addr.path[0 .. path.len + 1], path[0 .. path.len + 1]);
        const fd = libc.socket(libc.AF.UNIX, libc.SOCK.STREAM, 0);
        if (fd < 0) return false;
        nested.setCloexec(fd);
        // `bind` IS the exclusive create — it fails with EADDRINUSE the moment
        // the path exists — so it, and nothing else, decides who owns a name.
        // There is no unlink before it: unlinking unconditionally is how a
        // second `pardes --detach=work` took the socket away from a live
        // session, leaving every frontend attached to a file no new frontend
        // could reach.
        if (libc.bind(fd, @ptrCast(&addr), @sizeOf(@TypeOf(addr))) != 0) {
            // The one case that is not a collision: a session killed rather
            // than quit ran no teardown, so its file outlived it. `alive` is
            // the only thing that may say so, and it says so only about a
            // connect that was REFUSED.
            if (alive(path)) {
                log.debug("a detached session is already listening on {s}", .{path});
                _ = libc.close(fd);
                return false;
            }
            _ = libc.unlink(path);
            if (libc.bind(fd, @ptrCast(&addr), @sizeOf(@TypeOf(addr))) != 0) {
                _ = libc.close(fd);
                return false;
            }
        }
        // Owner-only, and BEFORE listen(2), which is the first moment anyone
        // could connect. The directory is already private; this is the second
        // wall, and this socket carries keystrokes into a live editor.
        _ = libc.chmod(path, 0o600);
        // A backlog of max_clients: past that the kernel refuses the connect
        // itself, which is the same answer `accept` would give.
        if (libc.listen(fd, max_clients) != 0) {
            _ = libc.close(fd);
            return false;
        }
        setNonblock(fd);
        s.listener = fd;
        s.path_len = path.len;
        return true;
    }

    fn unlisten(s: *Session) void {
        if (s.listener < 0) return;
        _ = libc.close(s.listener);
        s.listener = -1;
        // Guarded on the fd, so a bind that FAILED cannot unlink a path this
        // process never created.
        var z: [sun_path_len:0]u8 = undefined;
        @memcpy(z[0..s.path_len], s.path_buf[0..s.path_len]);
        z[s.path_len] = 0;
        _ = libc.unlink(z[0..s.path_len :0]);
    }

    pub fn host(s: *Session) host_api.Host {
        return .{ .ctx = s, .vtable = &vtable };
    }

    fn of(ctx: ?*anyopaque) *Session {
        return @ptrCast(@alignCast(ctx.?));
    }

    /// Thirteen methods, and the seven that are missing are missing on purpose
    /// — see wire.zig's header for each one's reason. `push_poll_frame` and
    /// `push_post_present` carry no information a frame does not; the four
    /// synchronous or dispatched pulls and `push_fs_reply` belong to whoever
    /// owns the core, which is this process.
    const vtable: host_api.Host.VTable = .{
        .pull_wait_input = waitInput,
        .push_present = present,
        .push_spawn = spawn,
        .push_pty_write = ptyWrite,
        .push_pty_resize = ptyResize,
        .push_write_file = writeFile,
        .push_write_dump = writeDump,
        .push_watch_file = watchFile,
        .push_watch_theme = watchTheme,
        .push_dump_themes = dumpThemes,
        .push_set_clipboard = setClipboard,
        .pull_read_clipboard = readClipboard,
        .push_open_link = openLink,
    };

    // ---- routing ----------------------------------------------------------

    /// The oldest surviving attachment. No election and no state: slots are
    /// filled lowest-first, so the lowest attached one is the oldest that is
    /// still here.
    fn primary(s: *Session) ?*Client {
        for (&s.clients) |*c| if (c.attached) return c;
        return null;
    }

    /// ...and the frontend whose input we are answering, when there is one.
    fn origins(s: *Session) ?*Client {
        if (s.origin) |i| {
            const c = &s.clients[i];
            if (c.attached) return c;
        }
        return s.primary();
    }

    /// The frontend holding pane `pane`'s pty, which is NOT the primary in
    /// general — see `Shell`. Null when no frontend holds it, which is a pane
    /// with no child: the core's own answer to that is silence, and so is this.
    fn holder(s: *Session, pane: u8) ?*Client {
        if (pane >= s.shells.len) return null;
        const owner = s.shells[pane].owner orelse return null;
        const c = &s.clients[owner];
        return if (c.attached) c else null;
    }

    /// Which slot this client is. From the pointer because every caller here
    /// holds a `*Client` and not its index.
    fn slotOf(s: *Session, c: *const Client) u8 {
        return @intCast(@divExact(@intFromPtr(c) - @intFromPtr(&s.clients[0]), @sizeOf(Client)));
    }

    fn broadcast(s: *Session, msg: wire.ServerMsg) void {
        for (&s.clients) |*c| if (c.attached) s.send(c, msg);
    }

    // ---- the host methods -------------------------------------------------

    fn spawn(ctx: ?*anyopaque, pane: u8, cwd: []const u8) void {
        const s = of(ctx);
        if (pane >= s.shells.len) return; // the core indexes its own panes
        const sh = &s.shells[pane];
        // Kept whether or not there is somebody to ask, because the pane now
        // exists either way and the cwd is the only thing that cannot be
        // reconstructed later.
        sh.cwd.clearRetainingCapacity();
        sh.cwd.appendSlice(s.gpa, cwd) catch {};
        if (s.primary()) |c| {
            sh.owner = s.slotOf(c);
            sh.owed = false;
            return s.send(c, .{ .spawn = .{ .pane = pane, .cwd = cwd } });
        }
        // Nobody can fork a shell right now — a startup layout, or every
        // frontend gone. NOT dropped: `reconcile` asks the next arrival.
        sh.owner = null;
        sh.owed = true;
    }

    fn ptyWrite(ctx: ?*anyopaque, pane: u8, bytes: []const u8) void {
        const s = of(ctx);
        // To the frontend that forked this pane's shell, not to the primary:
        // the pty is in that process and nowhere else. A pane whose holder is
        // gone is silent, which is what the core does with a null method.
        if (s.holder(pane)) |c| s.send(c, .{ .pty_write = .{ .pane = pane, .bytes = bytes } });
    }

    fn ptyResize(ctx: ?*anyopaque, pane: u8, cols: u16, rows: u16) void {
        const s = of(ctx);
        if (s.holder(pane)) |c| s.send(c, .{ .pty_resize = .{ .pane = pane, .cols = cols, .rows = rows } });
    }

    fn writeFile(ctx: ?*anyopaque, pane: u8, path: []const u8, bytes: []const u8) void {
        const s = of(ctx);
        if (s.primary()) |c| return s.send(c, .{ .write_file = .{ .pane = pane, .path = path, .bytes = bytes } });
        // Nobody attached, and a Put must not evaporate. This method being
        // non-null means the core did NOT reach for its own filesystem, so the
        // obligation a null method would have discharged is discharged here by
        // hand — the same shape `readClipboard` below has, and host.zig's rule
        // that a zero-method host is a complete pardes.
        s.core.fallback.writeFile(path, bytes);
    }

    fn writeDump(ctx: ?*anyopaque, bytes: []const u8) void {
        const s = of(ctx);
        if (s.primary()) |c| return s.send(c, .{ .write_dump = bytes });
        // ...and the same for a Dump, including the part that makes the bytes
        // reachable again: a real host reports where it landed, which is what
        // puts `Restore <path>` in the topbar (pardes.zig `write_dump`).
        s.core.fallback.writeFile(pardes.fallback_dump_path, bytes);
        s.core.setLastDump(pardes.fallback_dump_path);
    }

    fn watchFile(ctx: ?*anyopaque, pane: u8, path: []const u8, on: bool) void {
        const s = of(ctx);
        if (s.primary()) |c| return s.send(c, .{ .watch_file = .{ .pane = pane, .path = path, .on = on } });
        // No frontend to watch a path, so the core's own record of what was
        // asked is the whole of what a watch means here — exactly what a null
        // method leaves behind.
        if (pane < s.core.fallback.watched.len) s.core.fallback.watched[pane] = on;
    }

    fn watchTheme(ctx: ?*anyopaque, generation: u32, on: bool) void {
        const s = of(ctx);
        // Dropped with nobody attached, and that is the whole of it: the core's
        // own `theme_file` effect does nothing for a null method either, so
        // there is no obligation left over. Same for `dump_themes` below.
        if (s.primary()) |c| s.send(c, .{ .watch_theme = .{ .generation = generation, .on = on } });
    }

    fn dumpThemes(ctx: ?*anyopaque, pane: u8) void {
        const s = of(ctx);
        if (s.primary()) |c| s.send(c, .{ .dump_themes = .{ .pane = pane } });
    }

    fn setClipboard(ctx: ?*anyopaque, text: []const u8) void {
        const s = of(ctx);
        // Mirrored into the core's own clipboard ALWAYS, not only when nobody
        // is attached: `readClipboard` answers from it when there is no
        // frontend, and a frontend can leave between the yank and the paste. A
        // yank that a detached session then pasted as the previous yank is the
        // bug this one line is.
        s.core.fallback.setClipboard(text);
        s.broadcast(.{ .set_clipboard = text });
    }

    /// The one `pull_` that crosses the wire, and it stays a pull for exactly
    /// the reason host.zig gives: two frontends answering would paste the
    /// clipboard twice for one Ctrl-V.
    fn readClipboard(ctx: ?*anyopaque) void {
        const s = of(ctx);
        if (s.origins()) |c| return s.send(c, .read_clipboard);
        // Nobody attached. This method being non-null means the core will NOT
        // reach for its own fallback, so an unanswered request would leave
        // `clip_pending` armed forever — host.zig's note that a null method
        // answers immediately is the obligation being met here by hand.
        s.core.update(.{ .paste = s.core.fallback.clipboard.items });
    }

    fn openLink(ctx: ?*anyopaque, url: []const u8) void {
        const s = of(ctx);
        if (s.origins()) |c| return s.send(c, .{ .open_link = url });
        // No desktop in reach, so the link goes where a host with no browser
        // puts it: the core's record of the last one asked for, which is what
        // `Fallback.setLink` is and what the acme filesystem reads back.
        s.core.fallback.setLink(url);
    }

    // ---- the frame --------------------------------------------------------

    fn present(ctx: ?*anyopaque, surface: *const pardes.Surface) void {
        const s = of(ctx);
        for (&s.clients) |*c| {
            if (!c.attached) continue;
            // A client that has not drained what it already owes does not get
            // this frame, and its mirror is deliberately left where it is: the
            // next frame it does get is a diff against what it really has. A
            // slow frontend gets fewer, larger frames rather than a queue.
            if (c.out.items.len != 0) continue;
            s.sendFrame(c, surface);
        }
    }

    fn sendFrame(s: *Session, c: *Client, surface: *const pardes.Surface) void {
        const cells = surface.cells;
        const want = wire.frameBound(surface.cols, surface.rows);
        s.scratch.ensureTotalCapacity(s.gpa, want) catch return s.close(c, .oom);
        // Nothing comparable on the far side is the LATE JOINER and the RESIZE
        // in one test: either way the whole grid has to be described.
        const prev: []const pardes.Cell = if (c.need_full or c.mirror.items.len != cells.len)
            &.{}
        else
            c.mirror.items;
        const cursor: ?wire.Cursor = if (surface.cursor) |cur|
            .{ .x = cur.x, .y = cur.y, .bar = cur.bar }
        else
            null;
        const bytes = wire.encodeFrame(
            s.scratch.allocatedSlice()[0..want],
            surface.cols,
            surface.rows,
            cursor,
            cells,
            prev,
        ) catch |err| {
            // A frame this protocol cannot carry is a grid past `max_cols` /
            // `max_rows`, or a cursor the core placed outside its own surface.
            // Dropping the frame keeps the session alive with a stale screen,
            // which is strictly better than dropping the frontend — a frontend
            // REFUSES such a frame and hangs up — and the log says which.
            log.debug("frame {d}x{d} not encodable: {t}", .{ surface.cols, surface.rows, err });
            return;
        };
        s.queue(c, bytes);
        if (c.fd < 0) return; // the queue closed it; the mirror went with it
        // The mirror advances only now, and only because the bytes are on the
        // wire or in the kernel's buffer for it.
        c.mirror.resize(s.gpa, cells.len) catch return s.close(c, .oom);
        @memcpy(c.mirror.items, cells);
        c.need_full = false;
    }

    // ---- the loop ---------------------------------------------------------

    /// The only place this process sleeps, which is what `pull_wait_input`'s
    /// comment in host.zig requires of whoever serves it. One `poll(2)` covers
    /// the listener and every attached frontend; there is no thread per client
    /// and nothing here blocks on a single peer.
    fn waitInput(ctx: ?*anyopaque, timeout_ms: u32) void {
        const s = of(ctx);
        // Push what the kernel will take before sleeping: a client that becomes
        // writable while we are inside poll(2) would otherwise be a frame late,
        // and a frame late is a frame skipped (see `present`).
        for (&s.clients) |*c| if (c.fd >= 0) s.flush(c);

        const now = monotonicMs();
        var fds: [max_clients + 1]libc.pollfd = undefined;
        var slots: [max_clients + 1]u8 = undefined;
        var n: usize = 0;
        // The listener is left OUT of the set while accepting is paused, which
        // is how an EMFILE is waited out without the core sleeping (see
        // `accept`). Every frontend already attached goes on being served.
        const watching_listener = s.listener >= 0 and now >= s.accept_paused_ms;
        if (watching_listener) {
            fds[n] = .{ .fd = s.listener, .events = poll_in, .revents = 0 };
            slots[n] = 0;
            n += 1;
        }
        for (&s.clients, 0..) |*c, i| {
            if (c.fd < 0) continue;
            fds[n] = .{
                .fd = c.fd,
                .events = if (c.out.items.len != 0) poll_in | poll_out else poll_in,
                .revents = 0,
            };
            slots[n] = @intCast(i);
            n += 1;
        }
        // A detached session with no listener and no clients has no event
        // source at all. Returning immediately would spin the outer
        // `while (!core.quit)` at full speed, so sleep the interval the core
        // offered and, when it offered none, a frame's worth.
        if (n == 0) return nap(if (timeout_ms == 0) 16 else timeout_ms);
        // Zero is the core's word for "sleep until something happens" (see
        // pardes.zig `pump`: it passes a frame interval only while an animation
        // is running). poll spells that -1.
        var timeout: c_int = if (timeout_ms == 0) -1 else @intCast(@min(timeout_ms, std.math.maxInt(c_int)));
        // Two things here are due on a CLOCK rather than on a descriptor: a
        // handshake that has to expire, and a paused listener that has to come
        // back. An indefinite poll would sit through both — and thirty-two
        // peers that connect and then say nothing, with the session otherwise
        // idle, IS the denial `greet_deadline_ms` exists to answer — so the
        // wait is clamped to whichever is due first.
        if (s.nextWake(now)) |due| timeout = if (timeout < 0) due else @min(timeout, due);
        const ready = libc.poll(&fds, @intCast(n), timeout);
        // Expired unconditionally: a slot held by silence comes back on a
        // timeout exactly as it does on a wakeup, and a poll that returned
        // nothing is the ordinary way this deadline is reached.
        s.expire(monotonicMs());
        // A timeout is an ordinary frame boundary and EINTR is a signal we do
        // not handle here; both simply come back next pump.
        if (ready <= 0) return;

        var k: usize = 0;
        if (watching_listener) {
            if (fds[0].revents != 0) s.accept();
            k = 1;
        }
        while (k < n) : (k += 1) {
            const c = &s.clients[slots[k]];
            // A slot closed earlier in this same pass (its peer hung up, a
            // decode failed, its handshake expired) must not be touched
            // through a stale revents.
            if (c.fd < 0) continue;
            if (fds[k].revents & poll_out != 0) s.flush(c);
            if (c.fd < 0) continue;
            if (fds[k].revents & poll_in != 0) {
                s.receive(c, slots[k]);
            } else if (fds[k].revents & (poll_hup | poll_err | poll_nval) != 0) {
                // POLLIN wins when both are set: a peer that wrote and then
                // closed has bytes still worth reading.
                s.close(c, .peer);
            }
        }
        s.reconcile();
    }

    /// Milliseconds until the next deadline that is kept by the CLOCK rather
    /// than by a descriptor, or null when there is none. Floored at zero, so a
    /// deadline already past polls once without blocking instead of blocking
    /// forever on a negative timeout.
    fn nextWake(s: *const Session, now: i64) ?c_int {
        if (now == 0) return null; // no clock; see `monotonicMs`
        var due: ?i64 = null;
        for (&s.clients) |*c| {
            if (c.fd < 0 or c.attached) continue;
            const at = c.accepted_ms + @as(i64, s.greet_deadline_ms);
            due = if (due) |d| @min(d, at) else at;
        }
        if (s.listener >= 0 and s.accept_paused_ms > now)
            due = if (due) |d| @min(d, s.accept_paused_ms) else s.accept_paused_ms;
        const at = due orelse return null;
        return @intCast(@max(0, @min(at - now, std.math.maxInt(c_int))));
    }

    /// Take the slots of connections that never said `hello` back. A connection
    /// that holds a slot in silence denies a real frontend exactly as a queue
    /// would, and `Client.open` writes its hello in the same call that
    /// connects, so there is nothing legitimate to wait for.
    fn expire(s: *Session, now: i64) void {
        if (now == 0) return; // no clock: enforce nothing rather than everything
        for (&s.clients) |*c| {
            if (c.fd < 0 or c.attached) continue;
            if (now - c.accepted_ms >= s.greet_deadline_ms) s.close(c, .silent);
        }
    }

    /// Always accept, even with a full table: the tempting alternative — stop
    /// accepting and let the kernel hold the surplus — is a spin, because
    /// `poll` is level triggered and an unaccepted backlog reports ready
    /// forever. fuse.zig's park table learned that as a deadlock; here it is
    /// 100% of a core.
    ///
    /// BOUNDED all the same. `max_clients + 1` is enough to fill an empty table
    /// and refuse one more, and past that the surplus waits in the backlog for
    /// the next round — one pump later, with every frontend drawn in between.
    /// The `while (true)` this replaces let a peer dialling in a loop hold the
    /// core inside `accept` for as long as it kept dialling, and the core is
    /// what draws every other frontend's screen.
    fn accept(s: *Session) void {
        for (0..max_clients + 1) |_| {
            const fd = libc.accept(s.listener, null, null);
            if (fd < 0) {
                switch (libc.errno(fd)) {
                    // The backlog is empty, which is this loop's ordinary exit.
                    .AGAIN, .INTR, .CONNABORTED => return,
                    // Anything else — EMFILE above all — persists until some
                    // other descriptor is freed, and `poll` is LEVEL
                    // triggered: coming straight back means poll reports the
                    // listener ready again immediately and the core spins at
                    // 100% until the condition clears. The old answer was a
                    // 100 ms nanosleep, which parks the CORE — every attached
                    // frontend stops being drawn for a tenth of a second
                    // because a descriptor ran out. So the LISTENER is dropped
                    // from the poll set for that beat instead, and the session
                    // goes on serving the frontends it has.
                    else => {
                        s.accept_paused_ms = monotonicMs() + accept_pause_ms;
                        return;
                    },
                }
            }
            nested.setCloexec(fd);
            setNonblock(fd);
            if (comptime darwin) {
                // linux says MSG_NOSIGNAL per write; darwin says it once per
                // socket. Either way a frontend that dies mid-frame must not
                // take the session down with SIGPIPE.
                const on: c_int = 1;
                _ = libc.setsockopt(fd, libc.SOL.SOCKET, libc.SO.NOSIGPIPE, &on, @sizeOf(c_int));
            }
            const slot = for (&s.clients, 0..) |*c, i| {
                if (c.fd < 0) break i;
            } else {
                // Refused, and told why, on a connection accepted purely so
                // that the listener stays quiet.
                s.refuseFd(fd, .full);
                _ = libc.close(fd);
                continue;
            };
            s.clients[slot] = .{ .fd = fd, .accepted_ms = monotonicMs() };
        }
    }

    /// One read per client per round. A frontend that never stops talking gets
    /// one turn and then the loop moves on to the others and to the frame —
    /// which is fuse.zig's `retry` rule (one attempt per parked request per
    /// frame) applied to sockets.
    fn receive(s: *Session, c: *Client, slot: u8) void {
        var buf: [read_chunk]u8 = undefined;
        const got = libc.read(c.fd, &buf, buf.len);
        if (got == 0) return s.close(c, .peer); // clean EOF: the frontend left
        if (got < 0) return switch (libc.errno(got)) {
            .INTR, .AGAIN => {},
            else => s.close(c, .read),
        };
        c.in.appendSlice(s.gpa, buf[0..@intCast(got)]) catch return s.close(c, .oom);
        // The table's own ceiling, checked where the table grows: a peer that
        // sends the first half of a 16 MiB message and stops is holding memory
        // no per-message check can see. See `session_backlog`.
        s.account();
        if (c.fd < 0) return; // it was this one
        s.consume(c, slot);
    }

    fn consume(s: *Session, c: *Client, slot: u8) void {
        var off: usize = 0;
        while (true) {
            const found = wire.framed(c.in.items[off..]) catch return s.close(c, .protocol);
            const msg = found orelse break;
            // The decoded Event BORROWS these bytes, so the buffer is not
            // compacted until every message already in it has been applied —
            // the same borrow window the tty host gives a pty chunk.
            s.apply(c, slot, msg.tag, msg.payload) catch return s.close(c, .protocol);
            if (c.fd < 0) return; // apply closed it, buffers and all
            off += msg.total;
        }
        if (off == 0) return;
        if (off == c.in.items.len) {
            c.in.clearRetainingCapacity();
            return retire(s.gpa, &c.in);
        }
        std.mem.copyForwards(u8, c.in.items, c.in.items[off..]);
        c.in.items.len -= off;
    }

    fn apply(s: *Session, c: *Client, slot: u8, tag: u8, payload: []const u8) wire.Error!void {
        var scratch: wire.Scratch = .{};
        switch (try wire.decodeClient(tag, payload, &scratch)) {
            .hello => |h| {
                // A second hello on one connection is not a resize; it is a
                // peer that is not speaking this protocol.
                if (c.attached) return error.BadValue;
                if (h.version != wire.version) {
                    log.debug("frontend speaks protocol {d}, this session speaks {d}", .{ h.version, wire.version });
                    return s.refuse(c, .version);
                }
                if (s.core.quit) return s.refuse(c, .quitting);
                c.cols = h.cols;
                c.rows = h.rows;
                c.attached = true;
                c.need_full = true;
                // Greeted after `reconcile`, so the geometry in the welcome is
                // the one this client's first frame will actually use.
                c.greet = true;
            },
            .bye => s.close(c, .bye),
            .event => |ev| {
                // Input before a handshake has no geometry behind it and no
                // version agreement either.
                if (!c.attached) return error.BadValue;
                switch (ev) {
                    // A frontend's resize is about ITS window. The core only
                    // ever sees the smallest common grid, which `reconcile`
                    // posts once per round when it moves — forwarding this raw
                    // would let whichever frontend resized last win.
                    .resize => |r| {
                        c.cols = r.cols;
                        c.rows = r.rows;
                    },
                    else => {
                        s.origin = slot;
                        s.core.update(ev);
                    },
                }
            },
        }
    }

    /// Settle the session grid and greet whoever arrived, once per poll round
    /// rather than once per message: three frontends attaching in the same
    /// round are one resize, not three reflows of every pane.
    fn reconcile(s: *Session) void {
        var cols: u16 = 0;
        var rows: u16 = 0;
        for (&s.clients) |*c| {
            if (!c.attached) continue;
            cols = if (cols == 0) c.cols else @min(cols, c.cols);
            rows = if (rows == 0) c.rows else @min(rows, c.rows);
        }
        // Nobody attached: keep the grid we had. A detached session is not a
        // session of no size, it is one nobody is looking at, and reflowing
        // every pane to nothing for zero readers is work with no reader.
        if (cols != 0 and (cols != s.cols or rows != s.rows)) {
            s.cols = cols;
            s.rows = rows;
            // Every mirror is now the wrong shape. `encodeFrame` reaches the
            // same conclusion from the cell count alone, but saying it here is
            // what makes a reshape with the SAME cell count (80x24 -> 48x40)
            // safe too.
            for (&s.clients) |*c| c.need_full = true;
            s.core.update(.{ .resize = .{ .cols = cols, .rows = rows } });
        }
        for (&s.clients, 0..) |*c, i| {
            if (!c.greet) continue;
            c.greet = false;
            s.send(c, .{ .welcome = .{ .slot = @intCast(i), .cols = s.cols, .rows = s.rows } });
        }
        s.flushOwed();
    }

    /// Hand every owed spawn to the frontend that can serve it. Runs at the end
    /// of a poll round, so a frontend that has just been greeted is asked for
    /// its panes' shells in the same round it arrived — and a session that was
    /// started with panes and no frontend (which is every `--detach`) is a
    /// session whose panes get their shells from the first attach rather than
    /// never. See `Shell`.
    fn flushOwed(s: *Session) void {
        const c = s.primary() orelse return;
        const slot = s.slotOf(c);
        for (&s.shells, 0..) |*sh, pane| {
            if (!sh.owed) continue;
            sh.owed = false;
            sh.owner = slot;
            s.send(c, .{ .spawn = .{ .pane = @intCast(pane), .cwd = sh.cwd.items } });
            // The send closed it, and `close` put its panes back on the owed
            // list; the ones this loop has not reached are still owed anyway.
            if (c.fd < 0) return;
        }
    }

    // ---- bytes ------------------------------------------------------------

    fn send(s: *Session, c: *Client, msg: wire.ServerMsg) void {
        const want = wire.serverBound(msg);
        s.scratch.ensureTotalCapacity(s.gpa, want) catch return s.close(c, .oom);
        const bytes = wire.encodeServer(s.scratch.allocatedSlice()[0..want], msg) catch |err| {
            // The only reachable case is a payload past `max_payload`: a save
            // of a pane holding more text than this protocol carries. The
            // session keeps it (the core's own filesystem already has it) and
            // the frontend's copy does not happen — said out loud rather than
            // silently.
            log.debug("message {t} not encodable: {t}", .{ msg, err });
            return;
        };
        s.queue(c, bytes);
    }

    fn queue(s: *Session, c: *Client, bytes: []const u8) void {
        // BEFORE the append, so one oversized message always goes out whole and
        // what this refuses is a client that has stopped draining.
        if (c.out.items.len > out_backlog) return s.close(c, .backlog);
        // ...and the table as a whole, which `out_backlog` does not bound: 32
        // slots one byte under it each is 32 MiB. See `session_backlog`.
        s.account();
        if (c.fd < 0) return; // the fattest peer was this one
        c.out.appendSlice(s.gpa, bytes) catch return s.close(c, .oom);
        // Try immediately: on a local socket this empties the queue in one
        // write, and `present` skips a client whose queue is not empty.
        s.flush(c);
    }

    /// Close the peer holding the most of the table when the table as a whole
    /// is over `session_backlog`. One peer per call, and the fattest one,
    /// because this is only ever asked when the total is already over and the
    /// peer holding the most of it is the peer that stopped reading. The next
    /// append asks again, so a second offender is closed a message later rather
    /// than in a loop that could empty the table on one bad frame.
    fn account(s: *Session) void {
        var total: usize = 0;
        var worst: ?*Client = null;
        var worst_bytes: usize = 0;
        for (&s.clients) |*c| {
            if (c.fd < 0) continue;
            const held = c.in.capacity + c.out.capacity;
            total += held;
            if (held > worst_bytes) {
                worst_bytes = held;
                worst = c;
            }
        }
        if (total <= session_backlog) return;
        if (worst) |c| s.close(c, .backlog);
    }

    fn flush(s: *Session, c: *Client) void {
        var off: usize = 0;
        while (off < c.out.items.len) {
            const n = libc.send(c.fd, c.out.items.ptr + off, c.out.items.len - off, nosignal);
            if (n < 0) switch (libc.errno(n)) {
                .INTR => continue,
                // The kernel's buffer is full: the rest waits for POLLOUT, and
                // this client is skipped for frames until it drains.
                .AGAIN => break,
                else => return s.close(c, .write),
            };
            if (n == 0) break;
            off += @intCast(n);
        }
        if (off == 0) return;
        if (off == c.out.items.len) {
            c.out.clearRetainingCapacity();
            return retire(s.gpa, &c.out);
        }
        std.mem.copyForwards(u8, c.out.items, c.out.items[off..]);
        c.out.items.len -= off;
    }

    /// Say why, then hang up. The refusal is written with a plain blocking
    /// write on a socket nobody has sent anything on yet: it is six bytes, and
    /// queueing it would mean keeping a slot for a connection being rejected.
    fn refuse(s: *Session, c: *Client, why: wire.Refusal) void {
        s.refuseFd(c.fd, why);
        s.close(c, .refused);
    }

    /// Writes only. The descriptor belongs to the caller — `refuse` hands it to
    /// `close`, and the full-table path in `accept` closes it itself — because
    /// closing here as well is a double close, and the number is reusable the
    /// instant the first one lands.
    fn refuseFd(_: *Session, fd: c_int, why: wire.Refusal) void {
        var buf: [wire.header_len + 1]u8 = undefined;
        const bytes = wire.encodeServer(&buf, .{ .refuse = why }) catch unreachable;
        var off: usize = 0;
        while (off < bytes.len) {
            const n = libc.send(fd, bytes.ptr + off, bytes.len - off, nosignal);
            if (n < 0 and libc.errno(n) == .INTR) continue;
            if (n <= 0) break; // it left before hearing why; nothing to do
            off += @intCast(n);
        }
    }

    /// Free one slot. A frontend dying takes NOTHING with it: not the core, not
    /// the listener, not another frontend's frames. Its buffers go back and the
    /// slot is reusable on the next connect.
    fn close(s: *Session, c: *Client, why: Closed) void {
        if (c.fd < 0) return;
        log.debug("frontend detached: {t}", .{why});
        _ = libc.close(c.fd);
        c.in.deinit(s.gpa);
        c.out.deinit(s.gpa);
        c.mirror.deinit(s.gpa);
        const gone = s.slotOf(c);
        // Which slot this is, so a departing frontend cannot leave `origin`
        // pointing at it and send the next `read_clipboard` to a stranger.
        if (s.origin) |i| if (i == gone) {
            s.origin = null;
        };
        // ...and its panes' shells died with the process that forked them. They
        // go back on the owed list, so the frontend that replaces this one is
        // asked to fork them again in the directory they were forked in: the
        // alternative — which is what this did — is a pane that looks alive,
        // produces nothing, and swallows everything typed into it. Migrating a
        // live pty between processes is the other answer and is a different
        // feature; a fresh shell is the one this transport can keep.
        for (&s.shells) |*sh| {
            const owner = sh.owner orelse continue;
            if (owner != gone) continue;
            sh.owner = null;
            sh.owed = true;
        }
        c.* = .{};
    }
};

// ---------------------------------------------------------------------------
// the process
// ---------------------------------------------------------------------------

/// `pardes --detach[=<name>]`: one core, no terminal, a socket. The loop is the
/// core's own `pump`, exactly as the tty and gui shells run it — this frontend
/// simply has no window of its own.
///
/// The pre-loop effect drain is here for the same reason tty.zig has one: the
/// startup spawns are already queued, and they have to be PERFORMED before the
/// loop rather than left in the queue. They reach no frontend — there is none
/// yet — and are remembered instead, then asked of the first attach; `Shell`
/// says why that is the only shape that works for a session whose panes exist
/// before its socket does.
pub fn run(init: std.process.Init, opts: pardes.Options, name: []const u8) !void {
    const gpa = init.gpa;
    const allocs = pardes.allocators.init(gpa);
    defer pardes.allocators.deinit();
    var options = opts;
    options.image_allocator = allocs.image;
    options.pdf_allocator = allocs.pdf;
    options.tree_sitter_allocator = allocs.tree_sitter;
    options.frame_allocator = allocs.frame;

    // The core's own subsystems, not host work: a detached session syntax
    // highlights and decodes images exactly like an attached one.
    pardes.image.start(init.io, allocs.image);
    if (comptime pardes.pdf_enabled) pardes.pdf.start(allocs.pdf);
    pardes.syntax.start(allocs.tree_sitter);
    defer {
        pardes.image.stop();
        if (comptime pardes.pdf_enabled) pardes.pdf.stop();
        pardes.syntax.stop();
    }

    const core = if (options.load_path) |lp| blk: {
        const bytes = try @import("../look.zig").readFile(gpa, lp);
        defer gpa.free(bytes);
        break :blk try pardes.Pardes.initFromDump(allocs.pardes, options, bytes);
    } else try pardes.Pardes.init(allocs.pardes, options);
    defer core.deinit();

    var session: Session = .{ .gpa = gpa, .core = core, .cols = options.cols, .rows = options.rows };
    defer session.deinit();
    if (!session.listen(name)) {
        // Loud, and on stderr rather than through the log: a `--detach` whose
        // socket did not bind is a session nobody will ever find, and exiting
        // is the only honest answer.
        try std.Io.File.stderr().writeStreamingAll(init.io, "pardes: could not bind a detached session socket\n");
        return error.NoSocket;
    }

    const h = session.host();
    core.host = h;
    while (core.nextEffect()) |effect| core.perform(effect);
    while (!core.quit) try core.pump(h);
}

// ---------------------------------------------------------------------------
// the socket, nested.zig's way
// ---------------------------------------------------------------------------

/// Re-exported so the frontend half of this transport (client.zig) has ONE
/// import for the socket conventions, and so that the file which owns the
/// convention is the file it asks. The definition and its reasoning are
/// nested.zig's.
pub const setCloexec = nested.setCloexec;

/// Every descriptor in this transport is non-blocking, on both sides: the core
/// must never park on a peer (`waitInput`), and a frontend must never park on
/// the session (client.zig `wait`). `pub` for that second caller.
pub fn setNonblock(fd: c_int) void {
    const flags = libc.fcntl(fd, libc.F.GETFL, @as(c_int, 0));
    if (flags < 0) return;
    var o: libc.O = @bitCast(@as(u32, @bitCast(flags)));
    o.NONBLOCK = true;
    _ = libc.fcntl(fd, libc.F.SETFL, @as(c_int, @bitCast(@as(u32, @bitCast(o)))));
}

/// A dead peer must never kill this process, and that is as true of a frontend
/// whose session ended as of a session whose frontend died — so client.zig
/// takes this one too. linux says it per write, darwin once per socket (see
/// `accept`); the `if (darwin)` is what keeps `MSG.NOSIGNAL`, which darwin's
/// headers do not have, out of that build.
pub const nosignal: u32 = if (darwin) 0 else libc.MSG.NOSIGNAL;

pub const poll_in: i16 = @intCast(libc.POLL.IN);
pub const poll_out: i16 = @intCast(libc.POLL.OUT);
pub const poll_hup: i16 = @intCast(libc.POLL.HUP);
pub const poll_err: i16 = @intCast(libc.POLL.ERR);
pub const poll_nval: i16 = @intCast(libc.POLL.NVAL);

/// Give a drained buffer's memory back, and only a big one's: see
/// `idle_retain`. Called where a queue empties rather than on a timer, because
/// that is the one moment the capacity is provably unused.
fn retire(gpa: std.mem.Allocator, list: *std.ArrayListUnmanaged(u8)) void {
    if (list.items.len != 0 or list.capacity <= idle_retain) return;
    list.clearAndFree(gpa);
}

/// Monotonic milliseconds, the clock macos.zig's fling already times with and
/// for its reason: MONOTONIC and not REALTIME, because a handshake that expired
/// because NTP stepped the wall clock backwards is a bug nobody reproduces.
///
/// Zero on failure, and every caller treats zero as "no clock" and enforces no
/// deadline at all — a session that cannot read a clock keeps every slot rather
/// than dropping every slot.
fn monotonicMs() i64 {
    var ts: libc.timespec = undefined;
    if (libc.clock_gettime(.MONOTONIC, &ts) != 0) return 0;
    return @as(i64, ts.sec) * std.time.ms_per_s + @divTrunc(ts.nsec, std.time.ns_per_ms);
}

/// Sleep, for the one case that has no descriptor to wait on (see `waitInput`).
fn nap(ms: u32) void {
    var ts: libc.timespec = .{
        .sec = @intCast(ms / 1000),
        .nsec = @intCast((ms % 1000) * std.time.ns_per_ms),
    };
    _ = libc.nanosleep(&ts, null);
}

/// `<dir>/pardes-detached-<name>.sock`. The prefix differs from nested.zig's
/// `pardes-<pid>.sock` on purpose: that file's sweeper unlinks the socket of any
/// name whose digits name a dead pid, and a session called `work` must never
/// look like one. The buffer is sun_path-sized, so a name that does not fit is
/// no address at all rather than a truncated one pointing somewhere else.
pub fn socketPath(buf: *[sun_path_len]u8, dir: []const u8, name: []const u8) ?[:0]const u8 {
    // A name is one path component and nothing clever: a `/` would put the
    // socket somewhere else entirely, and a NUL would truncate the address.
    if (name.len == 0) return null;
    if (std.mem.indexOfAny(u8, name, "/\x00") != null) return null;
    return std.fmt.bufPrintSentinel(buf, "{s}/" ++ prefix ++ "{s}.sock", .{ dir, name }, 0) catch null;
}

const prefix = "pardes-detached-";

/// The path a FRONTEND connects to for a session called `name`. Derived here
/// rather than in client.zig because this file owns the convention, and the
/// side that binds and the side that connects must not be able to disagree
/// about it. `path_max` is the buffer a caller has to supply.
pub const path_max = sun_path_len;

pub fn sessionPath(buf: *[path_max]u8, name: []const u8) ?[:0]const u8 {
    if (comptime !supported) return null;
    var dir_buf: [sun_path_len:0]u8 = undefined;
    const dir = nested.socketDir(&dir_buf) orelse return null;
    return socketPath(buf, dir, name);
}

/// The FRONTEND's half of the vetting this file does before it binds, and the
/// reason it is here rather than in client.zig: one convention, one predicate,
/// one file that owns both.
///
/// Until this, the server refused a directory anyone else could write and a
/// socket anyone else could talk to, and the client connected to whatever it
/// found at the path it derived — which is the asymmetry this module's header
/// condemns in as many words. A socket planted at a path a frontend derives
/// from `$XDG_RUNTIME_DIR` receives every keystroke that frontend collects, and
/// answers with frames of its choosing.
///
/// Checked and then connected, in that order, which is a TOCTOU only for
/// somebody who can already write the directory — and the directory is the
/// first thing this refuses.
pub fn vetted(path: [:0]const u8) bool {
    if (comptime !supported) return false;
    var dir_buf: [sun_path_len:0]u8 = undefined;
    const dir = nested.socketDir(&dir_buf) orelse return false;
    if (!ours(nested.statNoFollow(dir) orelse return false, s_ifdir)) return false;
    return ours(nested.statNoFollow(path) orelse return false, s_ifsock);
}

const s_ifmt: u32 = 0o170000;
const s_ifdir: u32 = 0o040000;
const s_ifsock: u32 = 0o140000;

/// Is this a `kind` we own, with nothing granted to group or other? The three
/// questions `nested.ensureSocketDir` asks of the directory, asked of the
/// SOCKET too: the two walls are the directory's mode and the file's, and a
/// frontend that checks only one of them has checked neither.
fn ours(st: nested.DirFacts, kind: u32) bool {
    if (st.mode & s_ifmt != kind) return false;
    if (st.uid != libc.getuid()) return false;
    return st.mode & 0o077 == 0;
}

/// Is something LISTENING at `path`? The one place this file decides whether a
/// socket file is a corpse, asked by `listen` before it takes a name over and
/// by `sweep` before it unlinks anything.
///
/// nested.zig can ask `kill(0)` because its filenames carry a pid; a detached
/// session is named by a PERSON, so the question is put to the socket: a
/// connect to a bound path with no listener is refused (ECONNREFUSED), and that
/// refusal is the ONLY evidence of death this accepts. Everything else is life,
/// including the case a blocking connect used to turn into a hang — a live
/// session busy inside the core has a full backlog and answers EAGAIN, which is
/// why this socket is NON-BLOCKING. EPERM, a socket() that failed and a path
/// that no longer fits are all "not proven dead" too, and leave the file alone.
///
/// THE WINDOW THIS CANNOT SEE, stated because it is real: a session between its
/// own `bind` and its `listen(2)` also answers ECONNREFUSED and is alive. It is
/// two syscalls wide, it is only ever entered by another `pardes --detach`
/// starting in the same instant, and what the loser loses is a NAME (its
/// `listen` fails and it says so) rather than a session. Closing it needs a
/// lock file per session, which is a second thing to leak.
///
/// The successful-connect case costs the live session one slot for one round:
/// closing this descriptor immediately turns the pending connection into an
/// EOF, which `receive` reads as a frontend that left.
fn alive(path: [:0]const u8) bool {
    var addr: libc.sockaddr.un = .{ .path = @splat(0) };
    if (path.len + 1 > addr.path.len) return true;
    @memcpy(addr.path[0 .. path.len + 1], path[0 .. path.len + 1]);
    const fd = libc.socket(libc.AF.UNIX, libc.SOCK.STREAM, 0);
    if (fd < 0) return true;
    defer _ = libc.close(fd);
    nested.setCloexec(fd);
    setNonblock(fd);
    const rc = libc.connect(fd, @ptrCast(&addr), @sizeOf(@TypeOf(addr)));
    if (rc == 0) return true;
    return libc.errno(rc) != .CONNREFUSED;
}

/// Unlink the sockets of detached sessions that are gone — our own litter,
/// which `--attach`'s "the one session there is" would otherwise count as a
/// session (tty.zig `sessionName`). `alive` is the whole of the judgement.
///
/// Bounded: one readdir of a directory only we write to, one connect each.
fn sweep(dir: [:0]const u8) void {
    const d = libc.opendir(dir) orelse return;
    defer _ = libc.closedir(d);
    while (libc.readdir(d)) |ent| {
        const name = std.mem.sliceTo(&ent.name, 0);
        if (!std.mem.startsWith(u8, name, prefix) or !std.mem.endsWith(u8, name, ".sock")) continue;
        var path_buf: [sun_path_len:0]u8 = undefined;
        const path = std.fmt.bufPrintSentinel(&path_buf, "{s}/{s}", .{ dir, name }, 0) catch continue;
        if (!alive(path)) _ = libc.unlink(path);
    }
}