fix: bound the PTY drain, drop the viewer's theme transition, correct the MSRV

[vitorbaptista]

Chasing the E2E break in #198 turned up two more real hangs/races. Both are user-visible, not just CI noise. Not for merge — yours to land when you're happy.

Three commits, each independently coherent.

---

1. build: — declare the MSRV the graph actually requires

rust-version = "1.75" had not been true for a while: idna, via url → reqwest, pulls icu_* 2.x, which declares 1.86. Nothing caught it, because CI builds on stable — so anyone on 1.75–1.85 got a compile error out of rustc rather than cargo's clean "requires a newer rustc".

Declaring the real floor also let clippy apply lints it had been holding back — borrow_as_ptr on the pre-existing raw-mode guard. &raw says what those always meant: take a pointer, without a reference to the terminal settings existing even briefly.

Fixing the number without fixing the mechanism would just let it rot again on the next icu bump, so there's now an msrv job that reads rust-version out of Cargo.toml and builds against exactly that toolchain. It passes, which makes 1.86 verified rather than asserted — the first time this claim has been checked at all.

2. fix: — a silent orphan hangs the client

shellshare exec -- sh -c 'trap "" HUP; (trap "" HUP; sleep 600) & exit 3'
  -> rc=137 (SIGKILL), no {"event":"end"}, immune to SIGTERM

Plain shellshare hangs the same way when you leave a quiet background job and exit the shell.

The command exiting isn't the end of its terminal — anything it left running holds the slave open, so the master never reaches EOF and the reader sits in read(). The drain watchdog was meant to bound that, but it only flips a flag, and a thread parked in a blocking read never returns to the top of the loop to see it.

Worth being precise, because the old comment wasn't wrong about the case it named: ping example.com & exit does work — a chatty orphan's writes keep returning from read(). Silence is what it never survived.

case	before	after
silent HUP-immune orphan	rc=137, killed at 12s, no end	rc=3, 2.1s
interactive TTY, sleep 60 & then exit	hangs >20s	2.1s
chatty orphan	2057ms	2064ms (no regression)
seq 1 50000 room snapshot	—	byte-identical
1.4MB through the PTY	451/484/514/483ms	492/478/492/490ms

Fix: bounded poll before each read. Windows gets the same bound via its only lever — master and slave are two Arcs over one refcounted ConPTY (portable-pty win/conpty.rs:26-38), so drop(pair.slave) releases nothing; the old comment claiming otherwise was wrong.

Bounding the wait also meant no longer discarding what it collected: the sender thread broke wherever it stood when the flag dropped, and shutdown only flushes what already reached the transport. It now waits (deadlined) for the reader's last chunk instead of racing it.

New e2e test pins exit code, a deadline the old code blows through, a well-formed final JSON event, and pre-orphan output surviving the drain both locally and in the room. Verified it fails on the old binary.

One honest gap: the sender-side drain closes a measured ~50ms window (output reaches the room with it, is lost without it), and that window is not covered by the test — the marker is written at t≈0, far outside it. Hitting it would take output timed to land within ~20ms of the deadline, which is the kind of timing-dependent test CLAUDE.md says not to add. The reasoning and the measurement are in the code comment instead.

3. refactor: — drop the viewer's theme transition

The page chrome faded over 200ms on any theme change. But the theme is fixed when the broadcaster connects and stamped into every size message, so the only change a viewer reliably sees is the default chrome becoming the broadcast's — a repaint, not a change, which must not animate. A genuine re-theme needs a second broadcaster reclaiming the room while someone is still watching.

So the transition fired almost exclusively where it was wrong. And it did fire: the terminal is built from the webfont promise, which usually resolves before the first size message, so the paint that armed the transition was the default theme, and the real theme then washed in from the wrong colors. test_page_chrome_follows_theme[light] sampled that wash — failing 5/5 locally, intermittently on macOS CI. (My first framing of this as a rare flake was wrong; terminal-before-size is the normal ordering, and CI's Linux leg just happens to hit the other one.)

I did fix it first, and that is the argument for deleting it: the fix needed a second flag for "a size with usable dimensions has been seen", a third to keep arming idempotent across the two paths that can complete the pair, a two-frame wait to keep the class out of the same style recalculation as the colors that scheduled it (one frame was measured still fading ~24% of loads), and a rule spanning <html> and <body>, since <body> is a centred column and the gutters would otherwise snap while the column faded. All to smooth a case nobody asked to see smoothed. Every theme lands in one step now, in every ordering, and there is nothing left to get the ordering wrong about.

The test's webfont stub went too — with no fade to catch, it was measurably inert (the test fails 5/5 with or without it when the repaint is dropped). Verified the test still fails if the repaint is removed, so it is not vacuous.

Verification

make lint clean · full e2e 260/260 · both fixes confirmed to fail on the pre-fix binary · all 9 CI checks green, including both e2e legs, Windows, and the new msrv job.

Reviewed adversarially across several rounds (subagents + Codex CLI). Findings that changed the code along the way:

• MSRV break: &raw mut needs 1.82 while Cargo.toml said 1.75 — found independently by two reviewers, and the thread that led to commit 1.
• Poll descriptor acquired before spawn_command, so a failure can't strand a running child.
• F_DUPFD_CLOEXEC rather than dup, which drops the flag portable-pty sets.
• A non-EINTR poll failure ends the session, as a failing read always did, rather than falling through to an uninterruptible read or stalling the broadcast silently.
• Drain deadline checked on every pass, not just idle ones.
• The .bin assertion above, after a reviewer showed the sender-side drain had no test at all.
• A comment of mine that overstated what commit 3 deletes — main had one flag and one deferred frame, not the pile my own intermediate work had grown.