feat(pty): FFI breadcrumbs around the syscalls that wedge (T-434)

The freeze hypothesis is a wedged FFI call — a reader isolate blocked forever
in ReadFile, a waiter in WaitForSingleObject, Isolate.kill unable to interrupt
either. To NAME the wedge after a power-cycle, each backend now drops a
breadcrumb before/after every risky syscall.

- pty_log.dart (new, Flutter-free, tested): PtyLog — an injectable, no-op-by-
  default breadcrumb hook for the MAIN isolate (wired to the kernel Logger,
  source 'conpty'/'pty' = an eager FileLogSink source) — and IsolateCrumbFile,
  which the SPAWNED reader/waiter isolates use to open their OWN append handle
  and flushSync per line, so a wedged isolate's last crumb survives even a
  frozen main isolate (the whole point). Bounded by a truncating size cap.
- native_pty.dart + windows_pty.dart: crumbs around posix_spawn/read and
  CreatePseudoConsole/CreateProcessW/ReadFile/WaitForSingleObject; the reader/
  waiter isolates carry a sendable crumb path + verbose flag. Per-syscall crumbs
  only at debug/trace; lifecycle crumbs always.
- Wiring: startPtySession → PaneRegistry → buildDispatcher build the PtyLog from
  the kernel Logger + a crumb file under logDirectory(); verbose follows the log
  level. Default everywhere is PtyLog.none — zero behaviour change off the wire.

Tested: PtyLog/IsolateCrumbFile units (cap-truncation, append, no-op) + an
end-to-end real-PTY test asserting the reader isolate writes its own crumbs
('reader started' / 'read -> n=' / 'reader exiting'), which validates the
identical Windows structure that can't run here. Coverage gate 95.10%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/src/panes/registry.dart

@@ -12,14 +12,19 @@ import 'dart:io' show Platform;
 import 'dart:typed_data';
 
 import '../ipc/envelope.dart';
+import '../pty/pty_log.dart';
 import '../pty/pty_session.dart';
 import 'event_sink.dart';
 import 'pane.dart';
 
 class PaneRegistry {
-  PaneRegistry({required this.events});
+  PaneRegistry({required this.events, this.ptyLog = PtyLog.none});
 
   final DaemonEventSink events;
+
+  /// Breadcrumb hook handed to every PTY this registry spawns (T-434). Default
+  /// no-op; production wires it to the kernel Logger + a crumb file.
+  final PtyLog ptyLog;
   final Map<String, Pane> _panes = {};
   final Map<String, PtySession> _sessions = {};
   final Map<String, StreamSubscription<Uint8List>> _subs = {};
@@ -55,7 +60,15 @@ class PaneRegistry {
       ...?env,
     };
 
-    final session = startPtySession(executable: executable, arguments: arguments, columns: cols, rows: rows, workingDirectory: cwd, environment: fullEnv);
+    final session = startPtySession(
+      executable: executable,
+      arguments: arguments,
+      columns: cols,
+      rows: rows,
+      workingDirectory: cwd,
+      environment: fullEnv,
+      log: ptyLog,
+    );
     final pane = Pane(id: id, kind: kind, pid: session.pid, argv: argv, cwd: cwd, title: title);
     _panes[id] = pane;
     _sessions[id] = session;

lib/src/pty/native_pty.dart

@@ -25,6 +25,7 @@ import 'dart:typed_data';
 import 'package:ffi/ffi.dart';
 
 import 'errors.dart';
+import 'pty_log.dart';
 import 'pty_size.dart';
 import '../ipc/errno_mapping.dart' show PosixErrno;
 import 'ffi/libc.dart' as libc;
@@ -153,7 +154,12 @@ class NativePty implements PtySession {
   ReceivePort? _readerPort;
   Completer<void>? _readerExited;
 
-  NativePty._(this._fd, this.pid);
+  /// Breadcrumb file path + verbosity threaded into the reader isolate (T-434).
+  /// Plain values so they survive `Isolate.spawn`.
+  final String? _crumbPath;
+  final bool _verbose;
+
+  NativePty._(this._fd, this.pid, this._crumbPath, this._verbose);
 
   /// Byte stream of data produced by the child.
   @override
@@ -177,7 +183,9 @@ class NativePty implements PtySession {
     required int rows,
     String? workingDirectory,
     Map<String, String> environment = const {},
+    PtyLog log = PtyLog.none,
   }) {
+    log.crumb('native: start exe=$executable');
     // Resolve bare command names via PATH (posix_spawn requires an absolute
     // or relative path — posix_spawnp would search PATH for us but we want
     // resolution to be visible/debuggable from Dart).
@@ -296,8 +304,10 @@ class NativePty implements PtySession {
     }
 
     // ---- Spawn -------------------------------------------------------
+    log.crumb('native: posix_spawn enter');
     final spawnRc = _posixSpawn(pidOut, exeN, fa, attr, argvN, envpN);
     final pid = pidOut.value;
+    log.crumb('native: posix_spawn -> rc=$spawnRc pid=$pid');
 
     _faDestroy(fa);
     _spawnattrDestroy(attr);
@@ -318,7 +328,7 @@ class NativePty implements PtySession {
 
     freeAllInputs();
 
-    final pty = NativePty._(masterFd, pid);
+    final pty = NativePty._(masterFd, pid, log.crumbPath, log.verbose);
     pty._spawnReader();
     return pty;
   }
@@ -349,7 +359,7 @@ class NativePty implements PtySession {
       }
     });
     try {
-      _readerIsolate = await Isolate.spawn(_readLoop, (rp.sendPort, _fd));
+      _readerIsolate = await Isolate.spawn(_readLoop, (rp.sendPort, _fd, _crumbPath, _verbose));
     } catch (e) {
       // Surface the spawn failure instead of leaving the PTY in a
       // half-alive state where output never flows but isClosed=false.
@@ -363,8 +373,13 @@ class NativePty implements PtySession {
   }
 
   /// Isolate entry — polls then reads until EOF/error/fd-closed.
-  static void _readLoop((SendPort, int) msg) {
-    final (port, fd) = msg;
+  static void _readLoop((SendPort, int, String?, bool) msg) {
+    final (port, fd, crumbPath, verbose) = msg;
+    // The reader runs in a SPAWNED isolate with no Logger; it opens its own
+    // append handle so a wedge in read()/poll() leaves its last crumb on disk
+    // even if the main isolate is frozen too (T-434).
+    final crumbs = IsolateCrumbFile(crumbPath, 'pty.reader');
+    crumbs.crumb('reader started fd=$fd');
     final dl = ffi.DynamicLibrary.process();
     final rd = dl.lookupFunction<ffi.IntPtr Function(ffi.Int32, ffi.Pointer<ffi.Void>, ffi.IntPtr), int Function(int, ffi.Pointer<ffi.Void>, int)>('read');
     final poll = dl.lookupFunction<ffi.Int32 Function(ffi.Pointer<_Pollfd>, ffi.Uint32, ffi.Int32), int Function(ffi.Pointer<_Pollfd>, int, int)>('poll');
@@ -374,24 +389,36 @@ class NativePty implements PtySession {
     pfd.ref.fd = fd;
     pfd.ref.events = libc.pollin;
 
+    var reason = 'eof';
     try {
       while (true) {
         final ready = poll(pfd, 1, 100);
-        if (ready < 0) break;
+        if (ready < 0) {
+          reason = 'poll<0';
+          break;
+        }
         if (ready == 0) continue;
         // Slave closed (POLLHUP / POLLERR / POLLNVAL) with no buffered
         // bytes left to read — caller loop exits and we send EOF.
         if (pfd.ref.revents & libc.pollAnyErr != 0 && pfd.ref.revents & libc.pollin == 0) {
+          reason = 'pollhup';
           break;
         }
+        if (verbose) crumbs.crumb('read enter fd=$fd');
         final n = rd(fd, buf.cast(), 65536);
-        if (n <= 0) break;
+        if (verbose) crumbs.crumb('read -> n=$n');
+        if (n <= 0) {
+          reason = 'read<=0 ($n)';
+          break;
+        }
         port.send(Uint8List.fromList(buf.asTypedList(n)));
       }
     } finally {
       calloc.free(pfd);
       malloc.free(buf);
     }
+    crumbs.crumb('reader exiting ($reason)');
+    crumbs.close();
     port.send(null);
   }
 

lib/src/pty/pty_log.dart

@@ -0,0 +1,111 @@
+/// Breadcrumb logging for the PTY backends (T-434, under the T-425 epic).
+///
+/// The Windows freeze hypothesis is a wedged FFI call — a reader isolate
+/// blocked forever in `ReadFile`, a waiter stuck in `WaitForSingleObject`,
+/// `Isolate.kill` unable to interrupt either (dart-lang/sdk#46680). To NAME
+/// the wedge after a power-cycle, each backend drops a breadcrumb before and
+/// after every risky syscall. There are two delivery paths because the
+/// reader/waiter run in SPAWNED isolates that cannot see the main isolate's
+/// [Logger] — only sendable values cross `Isolate.spawn`:
+///
+///   - Main isolate → [PtyLog.crumb], a callback the kernel wires to its
+///     Logger (source `pty`/`conpty`, an eager FileLogSink source, so each
+///     crumb is fsynced).
+///   - Spawned isolates → [IsolateCrumbFile], opened from a plain file path
+///     (sendable) so the isolate writes with its OWN append handle and
+///     flushSync per line. That is the whole point: a reader wedged in
+///     `ReadFile` leaves its last "ReadFile enter" crumb on disk even though
+///     the main isolate (and its Logger) may be frozen too.
+///
+/// Default is fully no-op: callers that pass nothing ([PtyLog.none]) get
+/// exactly today's behaviour and zero I/O. Everything swallows its own errors
+/// — a logging failure must never perturb the PTY it is observing.
+library;
+
+import 'dart:convert';
+import 'dart:io';
+
+/// Main-isolate breadcrumb hook handed to a PTY backend.
+class PtyLog {
+  const PtyLog({this.onCrumb, this.crumbPath, this.verbose = false});
+
+  /// Called on the main isolate for each lifecycle/syscall breadcrumb. The
+  /// kernel wires this to `(m) => logger.trace('pty', m)`.
+  final void Function(String message)? onCrumb;
+
+  /// File path the SPAWNED reader/waiter isolates open for their own crumbs.
+  /// A String (not a closure/Logger) so it survives `Isolate.spawn`. Null
+  /// disables isolate crumbs.
+  final String? crumbPath;
+
+  /// When true, the high-frequency per-syscall crumbs fire too (debug/trace
+  /// level). When false, only low-frequency lifecycle crumbs are written, so
+  /// production wiring stays cheap.
+  final bool verbose;
+
+  /// The no-op default — zero I/O, today's behaviour.
+  static const none = PtyLog();
+
+  /// Emit a main-isolate breadcrumb. Never throws.
+  void crumb(String message) {
+    final cb = onCrumb;
+    if (cb == null) return;
+    try {
+      cb(message);
+    } catch (_) {}
+  }
+}
+
+/// An append-only breadcrumb file for use INSIDE a spawned isolate, where no
+/// [Logger] is reachable. Opens [path] once and flushSync per line so a wedge
+/// leaves its last crumb on disk. Bounded: truncates back to empty once it
+/// passes [capBytes] (we only ever need the tail before a wedge), so a chatty
+/// session can't grow it without limit. Every operation swallows its own error.
+class IsolateCrumbFile {
+  IsolateCrumbFile(String? path, this.source, {int capBytes = 256 * 1024}) : _capBytes = capBytes {
+    if (path == null) return;
+    try {
+      final raf = File(path).openSync(mode: FileMode.append);
+      _raf = raf;
+      _size = raf.lengthSync();
+    } catch (_) {
+      _raf = null; // a disk problem must never perturb the reader/waiter
+    }
+  }
+
+  final String source;
+  final int _capBytes;
+  RandomAccessFile? _raf;
+  int _size = 0;
+
+  bool get enabled => _raf != null;
+
+  /// Append one breadcrumb line, fsynced immediately.
+  void crumb(String message) {
+    final raf = _raf;
+    if (raf == null) return;
+    try {
+      if (_size >= _capBytes) {
+        // Reset to empty: truncate AND rewind. truncateSync alone leaves the
+        // write position at the old high-water mark, so the next write would
+        // land past the hole and the file would keep growing (sparse) instead
+        // of shrinking — rewind to 0 so we actually reclaim the space.
+        raf.truncateSync(0);
+        raf.setPositionSync(0);
+        _size = 0;
+      }
+      final bytes = utf8.encode('${DateTime.now().toUtc().toIso8601String()} [$source] $message\n');
+      raf.writeFromSync(bytes);
+      raf.flushSync();
+      _size += bytes.length;
+    } catch (_) {}
+  }
+
+  void close() {
+    try {
+      _raf?.flushSync();
+      _raf?.closeSync();
+    } catch (_) {}
+    _raf = null;
+  }
+}

lib/src/pty/pty_session.dart

@@ -12,6 +12,7 @@ import 'dart:io' show Platform;
 import 'dart:typed_data';
 
 import 'native_pty.dart';
+import 'pty_log.dart';
 import 'windows_pty.dart';
 
 abstract interface class PtySession {
@@ -49,6 +50,7 @@ PtySession startPtySession({
   required int rows,
   String? workingDirectory,
   Map<String, String> environment = const {},
+  PtyLog log = PtyLog.none,
 }) {
   if (Platform.isWindows) {
     return WindowsPty.start(
@@ -58,6 +60,7 @@ PtySession startPtySession({
       rows: rows,
       workingDirectory: workingDirectory,
       environment: environment,
+      log: log,
     );
   }
   return NativePty.start(
@@ -67,5 +70,6 @@ PtySession startPtySession({
     rows: rows,
     workingDirectory: workingDirectory,
     environment: environment,
+    log: log,
   );
 }

lib/src/pty/windows_pty.dart

@@ -45,6 +45,7 @@ import 'dart:typed_data';
 import 'package:ffi/ffi.dart';
 
 import 'errors.dart';
+import 'pty_log.dart';
 import 'pty_session.dart';
 import 'pty_size.dart';
 
@@ -259,6 +260,11 @@ class WindowsPty implements PtySession {
   Completer<void>? _readerExited;
   ReceivePort? _waiterPort;
 
+  /// Breadcrumb file path + verbosity threaded into the reader/waiter isolates
+  /// (T-434). Plain values so they survive `Isolate.spawn`.
+  String? _crumbPath;
+  bool _verbose = false;
+
   @override
   Stream<Uint8List> get output => _out.stream;
 
@@ -277,7 +283,9 @@ class WindowsPty implements PtySession {
     required int rows,
     String? workingDirectory,
     Map<String, String> environment = const {},
+    PtyLog log = PtyLog.none,
   }) {
+    log.crumb('conpty: start exe=$executable');
     executable = resolveExecutable(executable, environment);
 
     // ---- Pipes + pseudo console ---------------------------------------
@@ -308,7 +316,9 @@ class WindowsPty implements PtySession {
       ..ref.x = clampPtyDimension(columns)
       ..ref.y = clampPtyDimension(rows);
     final hpcOut = calloc<_Handle>();
+    log.crumb('conpty: CreatePseudoConsole enter');
     final hr = _createPseudoConsole(size.ref, inRead, outWrite, 0, hpcOut);
+    log.crumb('conpty: CreatePseudoConsole -> hr=$hr');
     calloc.free(size);
     if (hr != 0) {
       _closeHandle(inRead);
@@ -375,6 +385,7 @@ class WindowsPty implements PtySession {
       ..ref.lpAttributeList = attrList;
     final pi = calloc<_ProcessInformation>();
 
+    log.crumb('conpty: CreateProcessW enter');
     final ok = _createProcessW(
       ffi.nullptr,
       cmdLine,
@@ -388,6 +399,7 @@ class WindowsPty implements PtySession {
       pi,
     );
     final spawnErr = ok == 0 ? _getLastError() : 0;
+    log.crumb('conpty: CreateProcessW -> ok=$ok err=$spawnErr');
 
     _deleteAttrList(attrList);
     freeAttrs();
@@ -411,7 +423,10 @@ class WindowsPty implements PtySession {
     final childPid = pi.ref.dwProcessId;
     calloc.free(pi);
 
-    final pty = WindowsPty._(hpc, hProcess, hThread, inWrite, outRead, inRead, outWrite, childPid);
+    final pty = WindowsPty._(hpc, hProcess, hThread, inWrite, outRead, inRead, outWrite, childPid)
+      .._crumbPath = log.crumbPath
+      .._verbose = log.verbose;
+    log.crumb('conpty: spawned pid=$childPid');
     pty._spawnReader();
     pty._spawnWaiter();
     return pty;
@@ -439,7 +454,7 @@ class WindowsPty implements PtySession {
       }
     });
     try {
-      _readerIsolate = await Isolate.spawn(_readLoop, (rp.sendPort, _outRead.address));
+      _readerIsolate = await Isolate.spawn(_readLoop, (rp.sendPort, _outRead.address, _crumbPath, _verbose));
     } catch (e) {
       _dead = true;
       if (!_out.isClosed) _out.addError(PtyException('reader-spawn', '$e'));
@@ -450,8 +465,15 @@ class WindowsPty implements PtySession {
   }
 
   /// Isolate entry — blocking ReadFile until the ConPTY side closes.
-  static void _readLoop((SendPort, int) msg) {
-    final (port, handleAddr) = msg;
+  static void _readLoop((SendPort, int, String?, bool) msg) {
+    final (port, handleAddr, crumbPath, verbose) = msg;
+    // This isolate is the prime suspect for the freeze: ReadFile blocks
+    // forever if the ConPTY host never closes the pipe, and Isolate.kill
+    // can't interrupt the FFI (dart-lang/sdk#46680). It opens its OWN append
+    // handle so its last "ReadFile enter" crumb survives even a frozen main
+    // isolate — the breadcrumb that NAMES the wedge after a power-cycle (T-434).
+    final crumbs = IsolateCrumbFile(crumbPath, 'conpty.reader');
+    crumbs.crumb('reader started handle=$handleAddr');
     final handle = ffi.Pointer<ffi.Void>.fromAddress(handleAddr);
     final k32 = ffi.DynamicLibrary.open('kernel32.dll');
     final readFile = k32
@@ -462,20 +484,31 @@ class WindowsPty implements PtySession {
 
     final buf = malloc<ffi.Uint8>(65536);
     final nRead = calloc<ffi.Uint32>();
+    var reason = 'eof';
     try {
       while (true) {
         // Blocks until data, broken pipe (ConPTY closed), or invalid
         // handle (close() already released it).
+        if (verbose) crumbs.crumb('ReadFile enter');
         final ok = readFile(handle, buf, 65536, nRead, ffi.nullptr);
-        if (ok == 0) break;
+        if (verbose) crumbs.crumb('ReadFile -> ok=$ok n=${nRead.value}');
+        if (ok == 0) {
+          reason = 'broken-pipe/invalid';
+          break;
+        }
         final n = nRead.value;
-        if (n == 0) break;
+        if (n == 0) {
+          reason = 'n=0';
+          break;
+        }
         port.send(Uint8List.fromList(buf.asTypedList(n)));
       }
     } finally {
       calloc.free(nRead);
       malloc.free(buf);
     }
+    crumbs.crumb('reader exiting ($reason)');
+    crumbs.close();
     port.send(null);
   }
 
@@ -490,7 +523,7 @@ class WindowsPty implements PtySession {
       _waiterPort = null;
       _closeConsole();
     });
-    Isolate.spawn(_waitLoop, (wp.sendPort, _hProcess.address)).catchError((Object e) {
+    Isolate.spawn(_waitLoop, (wp.sendPort, _hProcess.address, _crumbPath)).catchError((Object e) {
       // Fall back to close()-driven teardown; the child just won't be
       // auto-reaped on self-exit.
       wp.close();
@@ -499,11 +532,15 @@ class WindowsPty implements PtySession {
     });
   }
 
-  static void _waitLoop((SendPort, int) msg) {
-    final (port, handleAddr) = msg;
+  static void _waitLoop((SendPort, int, String?) msg) {
+    final (port, handleAddr, crumbPath) = msg;
+    final crumbs = IsolateCrumbFile(crumbPath, 'conpty.waiter');
+    crumbs.crumb('waiter started; WaitForSingleObject(INFINITE) enter');
     final k32 = ffi.DynamicLibrary.open('kernel32.dll');
     final wait = k32.lookupFunction<ffi.Uint32 Function(_Handle, ffi.Uint32), int Function(_Handle, int)>('WaitForSingleObject');
-    wait(ffi.Pointer<ffi.Void>.fromAddress(handleAddr), _kInfinite);
+    final r = wait(ffi.Pointer<ffi.Void>.fromAddress(handleAddr), _kInfinite);
+    crumbs.crumb('WaitForSingleObject -> $r (child exited)');
+    crumbs.close();
     port.send(null);
   }