Prevent update from using stale latest release

.github/workflows/ci.yml

@@ -86,6 +86,39 @@ jobs:
             target/dosh-release/dosh-*
             !target/dosh-release/stage/**
 
+  publish-gitea-release:
+    if: github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')
+    needs: package-release
+    runs-on: ubuntu-latest
+    env:
+      GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      GITEA_URL: ${{ secrets.GITEA_URL || 'https://git.palav.dev' }}
+      GITEA_REPO: ${{ secrets.GITEA_REPO || 'Palav/dosh' }}
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: dosh-*
+          path: target/dosh-release
+          merge-multiple: true
+      - name: Verify release artifacts
+        run: sh scripts/verify-release-artifacts.sh
+      - name: Skip Gitea upload without token
+        if: env.GITEA_TOKEN == ''
+        run: echo "GITEA_TOKEN secret is not configured; release artifacts were verified but not uploaded."
+      - name: Upload Gitea release assets
+        if: env.GITEA_TOKEN != ''
+        run: |
+          set -eu
+          case "$GITHUB_REF" in
+            refs/tags/*) tag="${GITHUB_REF_NAME}" ;;
+            *)
+              version="$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | sed -n '1p')"
+              tag="v$version"
+              ;;
+          esac
+          scripts/upload-gitea-release.sh "$tag"
+
   remote-bench:
     runs-on: ubuntu-latest
     env:

Cargo.lock

@@ -436,7 +436,7 @@ dependencies = [
 
 [[package]]
 name = "dosh"
-version = "1.0.0-rc36"
+version = "1.0.0-rc42"
 dependencies = [
  "anyhow",
  "base64",

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "dosh"
-version = "1.0.0-rc36"
+version = "1.0.0-rc42"
 edition = "2024"
 license = "MIT"
 

scripts/verify-release-artifacts.sh

@@ -25,7 +25,7 @@ artifact_version() {
 if [ "$#" -gt 0 ]; then
   artifacts="$*"
 else
-  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-windows-x86_64.zip"
+  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-macos-x86_64.tar.gz $out_dir/dosh-windows-x86_64.zip"
 fi
 
 failed=0

src/bin/dosh-client.rs

@@ -75,6 +75,7 @@ const POST_RECONNECT_STALE_INPUT_GRACE: Duration = Duration::from_secs(5);
 const FOCUS_REPAINT_COOLDOWN: Duration = Duration::from_secs(1);
 const ALT_SCREEN_IDLE_REPAINT_AFTER: Duration = Duration::from_secs(15);
 const LOCAL_SLEEP_REPAINT_AFTER: Duration = Duration::from_secs(5);
+const LOCAL_SLEEP_REPAINT_RETRY_AFTER: Duration = Duration::from_secs(1);
 
 /// Sentinel `target_host` the server uses on a server-initiated `StreamOpen` that
 /// represents an SSH-agent connection (rather than a TCP target). The client
@@ -250,6 +251,12 @@ async fn main() -> Result<()> {
         "client.start",
         &[("version", dosh::build_info::VERSION.to_string())],
     );
+    if should_health_log_client_start(args.server.as_deref()) {
+        dosh::trace::health_event(
+            "client.start",
+            &[("version", dosh::build_info::VERSION.to_string())],
+        );
+    }
     let config = load_client_config(None).unwrap_or_default();
     if args.server.as_deref() == Some("cp") {
         return run_cp_command(&config, &args);
@@ -827,7 +834,13 @@ struct TraceReport {
     sent_input_events: usize,
     pty_write_events: usize,
     reconnect_events: usize,
+    reconnect_none_events: usize,
+    reconnect_live_fail_events: usize,
+    reconnect_ticket_fail_events: usize,
     unknown_resume_events: usize,
+    ticket_attach_start_events: usize,
+    ticket_attach_ok_events: usize,
+    ticket_attach_reject_events: usize,
     roam_events: usize,
     recent_events: VecDeque<String>,
 }
@@ -1034,6 +1047,33 @@ fn sanitize_trace_name(value: &str) -> String {
     }
 }
 
+fn should_health_log_client_start(command: Option<&str>) -> bool {
+    !matches!(
+        command,
+        Some(
+            "cp" | "exec"
+                | "ls"
+                | "mkdir"
+                | "rm"
+                | "cat"
+                | "update"
+                | "trace"
+                | "setup"
+                | "selftest"
+                | "proxy-stdio"
+                | "vscode"
+                | "recover"
+                | "repair"
+                | "status"
+                | "sessions"
+                | "restart"
+                | "import-ssh"
+                | "trust"
+                | "doctor"
+        )
+    )
+}
+
 fn run_trace_command(args: &Args) -> Result<()> {
     if args.command.first().is_some_and(|value| value == "report") {
         let config = load_client_config(None).unwrap_or_default();
@@ -1194,40 +1234,66 @@ fn trace_cache_dir() -> PathBuf {
 
 fn newest_client_trace_path() -> Result<Option<PathBuf>> {
     let root = trace_cache_dir();
-    let Ok(entries) = fs::read_dir(&root) else {
+    newest_client_trace_path_from(&root, default_health_trace_path())
-        return Ok(None);
+}
-    };
+
+fn newest_client_trace_path_from(
+    root: &Path,
+    health_path: Option<PathBuf>,
+) -> Result<Option<PathBuf>> {
     let mut newest: Option<(SystemTime, PathBuf)> = None;
-    for entry in entries {
+    if let Ok(entries) = fs::read_dir(root) {
-        let entry = entry?;
+        for entry in entries {
-        let path = entry.path();
+            let entry = entry?;
-        if !path.is_file() {
+            let path = entry.path();
-            continue;
+            if !path.is_file() {
+                continue;
+            }
+            let Some(name) = path.file_name().and_then(|value| value.to_str()) else {
+                continue;
+            };
+            if !(name.starts_with("client-")
+                || name.starts_with("dosh-client-")
+                || name.starts_with("dosh-"))
+                || !name.ends_with(".log")
+            {
+                continue;
+            }
+            let modified = entry
+                .metadata()
+                .and_then(|metadata| metadata.modified())
+                .unwrap_or(SystemTime::UNIX_EPOCH);
+            keep_newer_trace_path(&mut newest, modified, path);
         }
-        let Some(name) = path.file_name().and_then(|value| value.to_str()) else {
+    }
-            continue;
+    if let Some(path) = health_path.filter(|path| path.is_file()) {
-        };
+        let modified = path
-        if !(name.starts_with("client-")
-            || name.starts_with("dosh-client-")
-            || name.starts_with("dosh-"))
-            || !name.ends_with(".log")
-        {
-            continue;
-        }
-        let modified = entry
             .metadata()
             .and_then(|metadata| metadata.modified())
             .unwrap_or(SystemTime::UNIX_EPOCH);
-        if newest
+        keep_newer_trace_path(&mut newest, modified, path);
-            .as_ref()
-            .is_none_or(|(old_modified, _)| modified > *old_modified)
-        {
-            newest = Some((modified, path));
-        }
     }
     Ok(newest.map(|(_, path)| path))
 }
 
+fn keep_newer_trace_path(
+    newest: &mut Option<(SystemTime, PathBuf)>,
+    modified: SystemTime,
+    path: PathBuf,
+) {
+    if newest
+        .as_ref()
+        .is_none_or(|(old_modified, _)| modified > *old_modified)
+    {
+        *newest = Some((modified, path));
+    }
+}
+
+fn default_health_trace_path() -> Option<PathBuf> {
+    let path = dosh::trace::default_health_log_path();
+    path.is_file().then_some(path)
+}
+
 fn summarize_trace_file(path: &Path, tail: usize) -> Result<TraceReport> {
     summarize_trace_file_with_mode(path, tail, true)
 }
@@ -1341,9 +1407,27 @@ fn summarize_trace_file_with_mode(
         if event.contains("reconnect") || event.contains("resume") {
             report.reconnect_events += 1;
         }
+        if event == "client.reconnect_none" {
+            report.reconnect_none_events += 1;
+        }
+        if event == "client.reconnect_live_fail" {
+            report.reconnect_live_fail_events += 1;
+        }
+        if event == "client.reconnect_ticket_fail" {
+            report.reconnect_ticket_fail_events += 1;
+        }
         if event == "server.resume_unknown_client" {
             report.unknown_resume_events += 1;
         }
+        if event.ends_with("ticket_attach_start") {
+            report.ticket_attach_start_events += 1;
+        }
+        if event.ends_with("ticket_attach_ok") {
+            report.ticket_attach_ok_events += 1;
+        }
+        if event.ends_with("ticket_attach_reject") {
+            report.ticket_attach_reject_events += 1;
+        }
         if event.contains("roam") {
             report.roam_events += 1;
         }
@@ -1400,8 +1484,16 @@ fn print_trace_report(label: &str, report: &TraceReport) {
         report.hex_events
     );
     println!(
-        "  reconnect: events={} unknown_resume={} roam={}",
+        "  reconnect: events={} none={} live_fail={} ticket_fail={} unknown_resume={} ticket_attach={}/{}/{} roam={}",
-        report.reconnect_events, report.unknown_resume_events, report.roam_events
+        report.reconnect_events,
+        report.reconnect_none_events,
+        report.reconnect_live_fail_events,
+        report.reconnect_ticket_fail_events,
+        report.unknown_resume_events,
+        report.ticket_attach_start_events,
+        report.ticket_attach_ok_events,
+        report.ticket_attach_reject_events,
+        report.roam_events
     );
     for warning in trace_report_warnings(report) {
         println!("  alert: {warning}");
@@ -1422,12 +1514,24 @@ fn print_trace_report(label: &str, report: &TraceReport) {
 
 fn trace_report_warnings(report: &TraceReport) -> Vec<String> {
     let mut warnings = Vec::new();
-    if report.unknown_resume_events > 0 {
+    if report.unknown_resume_events > 0 && report.ticket_attach_ok_events == 0 {
         warnings.push(format!(
-            "{} unknown live resume event(s); ticket reattach should follow after server restart",
+            "{} unknown live resume event(s) without ticket attach recovery",
             report.unknown_resume_events
         ));
     }
+    if report.ticket_attach_reject_events > 0 {
+        warnings.push(format!(
+            "{} ticket attach reject event(s) observed",
+            report.ticket_attach_reject_events
+        ));
+    }
+    if report.reconnect_none_events > 0 {
+        warnings.push(format!(
+            "{} reconnect attempt(s) exhausted live resume and ticket attach",
+            report.reconnect_none_events
+        ));
+    }
     if report.server_mouseish_pty_write_events > 0 {
         warnings.push(format!(
             "{} mouse-like input event(s) reached the server PTY",
@@ -1488,6 +1592,10 @@ fn render_trace_event(fields: &BTreeMap<String, String>) -> String {
         "summary",
         "bytes",
         "silent_ms",
+        "session",
+        "mode",
+        "reason",
+        "output_seq",
     ] {
         if let Some(value) = fields.get(key) {
             parts.push(format!("{key}={value}"));
@@ -4012,7 +4120,16 @@ fn update_version_status(local: &str, latest: &str) -> &'static str {
     match compare_dotted_versions(latest, local) {
         std::cmp::Ordering::Equal => "current",
         std::cmp::Ordering::Greater => "update available",
-        std::cmp::Ordering::Less => "different",
+        std::cmp::Ordering::Less => "local newer than latest release",
+    }
+}
+
+fn update_binary_version_for_installer(local: &str, latest_tag: Option<&str>) -> Option<String> {
+    let latest = latest_tag.map(release_version_from_tag)?;
+    if compare_dotted_versions(latest, local) == std::cmp::Ordering::Less {
+        Some(format!("v{local}"))
+    } else {
+        None
     }
 }
 
@@ -4141,6 +4258,10 @@ fn run_update(config: &dosh::config::ClientConfig, options: UpdateOptions) -> Re
         .join("dosh")
         .join("source");
     let use_prebuilt = std::env::var("DOSH_USE_PREBUILT").unwrap_or_else(|_| "1".to_string());
+    let binary_version = update_binary_version_for_installer(
+        env!("CARGO_PKG_VERSION"),
+        latest_release_tag(&repo)?.as_deref(),
+    );
     let status = run_update_installer(
         config,
         &repo,
@@ -4148,6 +4269,7 @@ fn run_update(config: &dosh::config::ClientConfig, options: UpdateOptions) -> Re
         installer_role,
         &update_cache.display().to_string(),
         &use_prebuilt,
+        binary_version.as_deref(),
     )?;
     if !status.success() {
         return Err(anyhow!("dosh update failed with status {status}"));
@@ -4162,6 +4284,7 @@ fn run_update_installer(
     installer_role: &str,
     update_cache: &str,
     use_prebuilt: &str,
+    binary_version: Option<&str>,
 ) -> Result<std::process::ExitStatus> {
     if cfg!(windows) {
         let script = windows_update_script(
@@ -4171,6 +4294,7 @@ fn run_update_installer(
             installer_role,
             update_cache,
             use_prebuilt,
+            binary_version,
         );
         return Command::new("powershell.exe")
             .arg("-NoProfile")
@@ -4189,6 +4313,7 @@ fn run_update_installer(
         installer_role,
         update_cache,
         use_prebuilt,
+        binary_version,
     );
     Command::new("sh")
         .arg("-c")
@@ -4205,14 +4330,22 @@ fn unix_update_script(
     installer_role: &str,
     update_cache: &str,
     use_prebuilt: &str,
+    binary_version: Option<&str>,
 ) -> String {
-    let mut script = format!(
+    let mut env = format!(
-        "curl -fsSL {} | DOSH_REPO={} DOSH_PORT={} DOSH_UPDATE_CACHE={} DOSH_UPDATE_QUIET=1 DOSH_USE_PREBUILT={} sh -s -- {}",
+        "DOSH_REPO={} DOSH_PORT={} DOSH_UPDATE_CACHE={} DOSH_UPDATE_QUIET=1 DOSH_USE_PREBUILT={}",
-        shell_word(installer),
         shell_word(repo),
         config.update_port.unwrap_or(config.dosh_port),
         shell_word(update_cache),
-        shell_word(use_prebuilt),
+        shell_word(use_prebuilt)
+    );
+    if let Some(version) = binary_version {
+        env.push_str(&format!(" DOSH_BINARY_VERSION={}", shell_word(version)));
+    }
+    let mut script = format!(
+        "curl -fsSL {} | {} sh -s -- {}",
+        shell_word(installer),
+        env,
         shell_word(installer_role)
     );
     if config.server != "user@example.com" {
@@ -4231,6 +4364,7 @@ fn windows_update_script(
     installer_role: &str,
     update_cache: &str,
     use_prebuilt: &str,
+    binary_version: Option<&str>,
 ) -> String {
     let mut script = String::from("$ErrorActionPreference='Stop';");
     script.push_str("$ProgressPreference='SilentlyContinue';");
@@ -4247,6 +4381,12 @@ fn windows_update_script(
     ] {
         script.push_str(&format!("$env:{name}={};", powershell_string(value)));
     }
+    if let Some(version) = binary_version {
+        script.push_str(&format!(
+            "$env:DOSH_BINARY_VERSION={};",
+            powershell_string(version)
+        ));
+    }
     if config.server != "user@example.com" {
         script.push_str(&format!(
             "$env:DOSH_SERVER={};",
@@ -5370,6 +5510,14 @@ async fn try_ticket_attach(
     requested_env: Vec<EnvVar>,
 ) -> Result<(Frame, CachedCredential)> {
     let addr = resolve_addr(&cached.udp_host, cached.udp_port)?;
+    dosh::trace::event(
+        "client.ticket_attach_start",
+        &[
+            ("server", cached.server.clone()),
+            ("session", cached.session.clone()),
+            ("mode", cached.mode.clone()),
+        ],
+    );
     let client_nonce = crypto::random_12();
     let request_key = crypto::hkdf32(
         &cached.attach_ticket_psk,
@@ -5406,6 +5554,10 @@ async fn try_ticket_attach(
     let ok = recv_response_until(socket, Duration::from_millis(700), |packet| {
         if packet.header.kind == PacketKind::AttachReject && packet.header.conn_id == [0u8; 16] {
             let reject: AttachReject = protocol::from_body(&packet.body)?;
+            dosh::trace::event(
+                "client.ticket_attach_reject",
+                &[("reason", reject.reason.clone())],
+            );
             return Err(anyhow!("ticket attach rejected: {}", reject.reason));
         }
         if packet.header.kind != PacketKind::AttachOk {
@@ -5451,6 +5603,15 @@ async fn try_ticket_attach(
     next.session_key = ok.session_key;
     next.session_key_id = ok.session_key_id;
     next.last_rendered_seq = ok.initial_seq;
+    dosh::trace::event(
+        "client.ticket_attach_ok",
+        &[
+            ("session", next.session.clone()),
+            ("mode", next.mode.clone()),
+            ("output_seq", next.last_rendered_seq.to_string()),
+            ("bytes", frame.bytes.len().to_string()),
+        ],
+    );
     Ok((frame, next))
 }
 
@@ -7057,32 +7218,70 @@ async fn reconnect(
             ("last_rendered_seq", cred.last_rendered_seq.to_string()),
         ],
     );
-    if let Ok((frame, next)) = try_live_resume(socket, cred, send_seq, size.0, size.1).await {
+    dosh::trace::health_event(
-        *cred = next;
+        "client.reconnect_start",
-        frame_buffer.clear();
+        &[
-        predictor.reset();
+            ("session", cred.session.clone()),
-        cred.last_rendered_seq = frame.output_seq;
+            ("mode", cred.mode.clone()),
-        send_ack(
+            ("last_rendered_seq", cred.last_rendered_seq.to_string()),
-            socket,
+        ],
-            resolve_addr(&cred.udp_host, cred.udp_port)?,
+    );
-            cred,
+    match try_live_resume(socket, cred, send_seq, size.0, size.1).await {
-            send_seq,
+        Ok((frame, next)) => {
-        )
+            *cred = next;
-        .await?;
+            frame_buffer.clear();
-        dosh::trace::event(
+            predictor.reset();
-            "client.reconnect_live_ok",
+            cred.last_rendered_seq = frame.output_seq;
-            &[
+            send_ack(
-                ("output_seq", frame.output_seq.to_string()),
+                socket,
-                ("bytes", frame.bytes.len().to_string()),
+                resolve_addr(&cred.udp_host, cred.udp_port)?,
-            ],
+                cred,
-        );
+                send_seq,
-        return Ok(Some(frame));
+            )
+            .await?;
+            dosh::trace::event(
+                "client.reconnect_live_ok",
+                &[
+                    ("output_seq", frame.output_seq.to_string()),
+                    ("bytes", frame.bytes.len().to_string()),
+                ],
+            );
+            dosh::trace::health_event(
+                "client.reconnect_live_ok",
+                &[
+                    ("output_seq", frame.output_seq.to_string()),
+                    ("bytes", frame.bytes.len().to_string()),
+                ],
+            );
+            return Ok(Some(frame));
+        }
+        Err(err) => {
+            dosh::trace::event(
+                "client.reconnect_live_fail",
+                &[("reason", format!("{err:#}"))],
+            );
+            dosh::trace::health_event(
+                "client.reconnect_live_fail",
+                &[("reason", format!("{err:#}"))],
+            );
+        }
     }
 
-    let Ok((frame, next)) = try_ticket_attach(socket, cred, size.0, size.1, Vec::new()).await
+    let (frame, next) = match try_ticket_attach(socket, cred, size.0, size.1, Vec::new()).await {
-    else {
+        Ok(value) => value,
-        dosh::trace::event("client.reconnect_none", &[]);
+        Err(err) => {
-        return Ok(None);
+            dosh::trace::event(
+                "client.reconnect_ticket_fail",
+                &[("reason", format!("{err:#}"))],
+            );
+            dosh::trace::health_event(
+                "client.reconnect_ticket_fail",
+                &[("reason", format!("{err:#}"))],
+            );
+            dosh::trace::event("client.reconnect_none", &[]);
+            dosh::trace::health_event("client.reconnect_none", &[]);
+            return Ok(None);
+        }
     };
     *cred = next;
     *send_seq = 2;
@@ -7103,6 +7302,13 @@ async fn reconnect(
             ("bytes", frame.bytes.len().to_string()),
         ],
     );
+    dosh::trace::health_event(
+        "client.reconnect_ticket_ok",
+        &[
+            ("output_seq", frame.output_seq.to_string()),
+            ("bytes", frame.bytes.len().to_string()),
+        ],
+    );
     Ok(Some(frame))
 }
 
@@ -7276,10 +7482,13 @@ fn should_repaint_idle_terminal(
     status_tick_gap: Duration,
     now: Instant,
 ) -> bool {
-    (alternate_screen
+    let sleep_wake_gap = status_tick_gap >= LOCAL_SLEEP_REPAINT_AFTER;
-        && now.duration_since(last_terminal_frame_at) >= ALT_SCREEN_IDLE_REPAINT_AFTER
+    let stale_alternate_screen = alternate_screen
-        || status_tick_gap >= LOCAL_SLEEP_REPAINT_AFTER)
+        && now.duration_since(last_terminal_frame_at) >= ALT_SCREEN_IDLE_REPAINT_AFTER;
-        && now.duration_since(last_attempt_at) >= ALT_SCREEN_IDLE_REPAINT_AFTER
+    if sleep_wake_gap {
+        return now.duration_since(last_attempt_at) >= LOCAL_SLEEP_REPAINT_RETRY_AFTER;
+    }
+    stale_alternate_screen && now.duration_since(last_attempt_at) >= ALT_SCREEN_IDLE_REPAINT_AFTER
 }
 
 fn arm_stale_terminal_input_suppression(suppress_until: &mut Option<Instant>) {
@@ -9238,16 +9447,17 @@ mod tests {
         ensure_tui_safe_status_overlay, expand_ssh_path_tokens, input_contains_focus_in,
         input_matches_escape, is_local_status_target, is_resume_response_for_client,
         latest_release_download_url, load_first_native_identity_with_prompt,
-        native_proxy_udp_warning, parse_dynamic_forward, parse_escape_key, parse_local_forward,
+        native_proxy_udp_warning, newest_client_trace_path_from, parse_dynamic_forward,
-        parse_remote_forward, parse_ssh_config, parse_trace_line, parse_trace_options,
+        parse_escape_key, parse_local_forward, parse_remote_forward, parse_ssh_config,
-        parse_trace_report_options, parse_trace_summary, parse_update_options,
+        parse_trace_line, parse_trace_options, parse_trace_report_options, parse_trace_summary,
-        post_submit_hold_duration, queue_pending_user_input, queue_stale_pending_user_input,
+        parse_update_options, post_submit_hold_duration, queue_pending_user_input,
-        raw_contains_host_table, recv_response_until, refresh_live_addr, release_tag_download_url,
+        queue_stale_pending_user_input, raw_contains_host_table, recv_response_until,
-        release_tag_from_effective_url, release_version_from_tag, render_status_clear,
+        refresh_live_addr, release_tag_download_url, release_tag_from_effective_url,
-        render_status_overlay, requested_env, resolved_startup_command, retire_stream_state,
+        release_version_from_tag, render_status_clear, render_status_overlay, requested_env,
-        retransmit_stream_opens, rewrite_forward_command, sanitize_trace_name,
+        resolved_startup_command, retire_stream_state, retransmit_stream_opens,
-        selected_predict_mode, selected_udp_host, server_version_mismatch,
+        rewrite_forward_command, sanitize_trace_name, selected_predict_mode, selected_udp_host,
-        should_flush_terminal_input_after_contact, should_hold_during_startup_gate,
+        server_version_mismatch, should_flush_terminal_input_after_contact,
+        should_health_log_client_start, should_hold_during_startup_gate,
         should_hold_post_submit_input, should_reconnect_before_input_for_local_sleep,
         should_repaint_idle_terminal, should_strip_unowned_terminal_reports,
         split_after_command_submit, split_trace_tokens, ssh_command_target, ssh_config_uses_proxy,
@@ -9255,8 +9465,8 @@ mod tests {
         strip_stale_mouse_reports, strip_terminal_focus_reports, strip_unowned_terminal_reports,
         summarize_trace_file, summarize_trace_file_with_mode, terminal_private_mode_transition,
         toml_bare_key_or_quoted, top_trace_events, trace_report_warnings, unix_update_script,
-        update_installer_url, update_version_status, upsert_managed_block, valid_forward_host,
+        update_binary_version_for_installer, update_installer_url, update_version_status,
-        vscode_safe_alias, windows_update_script,
+        upsert_managed_block, valid_forward_host, vscode_safe_alias, windows_update_script,
     };
     use dosh::config::{ClientConfig, CommandExtension, HostConfig};
     use dosh::native::EnvVar;
@@ -10734,6 +10944,142 @@ mod tests {
         assert_eq!(all.server_mouseish_pty_write_events, 1);
     }
 
+    #[test]
+    fn trace_report_correlates_unknown_resume_with_ticket_recovery() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("server.log");
+        fs::write(
+            &path,
+            concat!(
+                "ts_ms=10 pid=1 event=server.start version=1.0.0 bind=0.0.0.0:50000\n",
+                "ts_ms=11 pid=1 event=server.resume_start client=abc seq=2 ack=1\n",
+                "ts_ms=12 pid=1 event=server.resume_unknown_client client=abc\n",
+                "ts_ms=13 pid=1 event=server.ticket_attach_start peer=1.2.3.4:5\n",
+                "ts_ms=14 pid=1 event=server.ticket_attach_ok session=term mode=read-write client=def output_seq=9 bytes=100\n",
+            ),
+        )
+        .unwrap();
+
+        let recovered = summarize_trace_file(&path, 10).unwrap();
+        assert_eq!(recovered.unknown_resume_events, 1);
+        assert_eq!(recovered.ticket_attach_start_events, 1);
+        assert_eq!(recovered.ticket_attach_ok_events, 1);
+        assert!(trace_report_warnings(&recovered).is_empty());
+
+        fs::write(
+            &path,
+            concat!(
+                "ts_ms=20 pid=2 event=server.start version=1.0.0 bind=0.0.0.0:50000\n",
+                "ts_ms=21 pid=2 event=server.resume_unknown_client client=abc\n",
+                "ts_ms=22 pid=2 event=server.ticket_attach_reject reason='ticket expired'\n",
+            ),
+        )
+        .unwrap();
+
+        let rejected = summarize_trace_file(&path, 10).unwrap();
+        let warnings = trace_report_warnings(&rejected);
+        assert_eq!(rejected.unknown_resume_events, 1);
+        assert_eq!(rejected.ticket_attach_reject_events, 1);
+        assert!(warnings.iter().any(|warning| {
+            warning == "1 unknown live resume event(s) without ticket attach recovery"
+        }));
+        assert!(
+            warnings
+                .iter()
+                .any(|warning| warning == "1 ticket attach reject event(s) observed")
+        );
+    }
+
+    #[test]
+    fn trace_report_warns_when_reconnect_exhausts_all_paths() {
+        let dir = tempfile::tempdir().unwrap();
+        let path = dir.path().join("client.log");
+        fs::write(
+            &path,
+            concat!(
+                "ts_ms=10 pid=1 event=client.start version=1.0.0\n",
+                "ts_ms=11 pid=1 event=client.reconnect_start session=term mode=read-write last_rendered_seq=9\n",
+                "ts_ms=12 pid=1 event=client.reconnect_live_fail reason='live resume timed out'\n",
+                "ts_ms=13 pid=1 event=client.reconnect_ticket_fail reason='ticket attach timed out'\n",
+                "ts_ms=14 pid=1 event=client.reconnect_none\n",
+            ),
+        )
+        .unwrap();
+
+        let report = summarize_trace_file(&path, 10).unwrap();
+        let warnings = trace_report_warnings(&report);
+        assert_eq!(report.reconnect_none_events, 1);
+        assert_eq!(report.reconnect_live_fail_events, 1);
+        assert_eq!(report.reconnect_ticket_fail_events, 1);
+        assert!(warnings.iter().any(|warning| {
+            warning == "1 reconnect attempt(s) exhausted live resume and ticket attach"
+        }));
+    }
+
+    #[test]
+    fn trace_report_falls_back_to_health_log_when_no_client_trace_exists() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("trace");
+        let health = root.join("health.log");
+        fs::create_dir_all(&root).unwrap();
+        fs::write(
+            &health,
+            concat!(
+                "ts_ms=10 pid=1 event=client.start version=1.0.0\n",
+                "ts_ms=11 pid=1 event=client.reconnect_none\n",
+            ),
+        )
+        .unwrap();
+
+        let selected = newest_client_trace_path_from(&root, Some(health.clone()))
+            .unwrap()
+            .expect("health log fallback");
+        assert_eq!(selected, health);
+        let report = summarize_trace_file(&selected, 10).unwrap();
+        assert_eq!(report.reconnect_none_events, 1);
+    }
+
+    #[test]
+    fn trace_report_prefers_newer_health_log_over_stale_trace_file() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path().join("trace");
+        let stale_trace = root.join("client-palav-1-1.log");
+        let health = root.join("health.log");
+        fs::create_dir_all(&root).unwrap();
+        fs::write(
+            &stale_trace,
+            "ts_ms=10 pid=1 event=client.start version=old\n",
+        )
+        .unwrap();
+        std::thread::sleep(Duration::from_millis(20));
+        fs::write(
+            &health,
+            concat!(
+                "ts_ms=20 pid=2 event=client.start version=new\n",
+                "ts_ms=21 pid=2 event=client.reconnect_none\n",
+            ),
+        )
+        .unwrap();
+
+        let selected = newest_client_trace_path_from(&root, Some(health.clone()))
+            .unwrap()
+            .expect("newest client trace");
+        assert_eq!(selected, health);
+        let report = summarize_trace_file(&selected, 10).unwrap();
+        assert_eq!(report.reconnect_none_events, 1);
+    }
+
+    #[test]
+    fn health_log_start_markers_only_for_connect_runs() {
+        assert!(should_health_log_client_start(None));
+        assert!(should_health_log_client_start(Some("palav")));
+        assert!(should_health_log_client_start(Some("forward")));
+        assert!(!should_health_log_client_start(Some("trace")));
+        assert!(!should_health_log_client_start(Some("update")));
+        assert!(!should_health_log_client_start(Some("doctor")));
+        assert!(!should_health_log_client_start(Some("status")));
+    }
+
     #[test]
     fn update_installer_uses_platform_native_script() {
         assert_eq!(
@@ -10784,6 +11130,7 @@ mod tests {
             "both",
             "/tmp/dosh-cache",
             "1",
+            None,
         );
         assert!(unix.contains("curl -fsSL"));
         assert!(unix.contains("install.sh"));
@@ -10798,6 +11145,7 @@ mod tests {
             "client",
             "C:\\Users\\palav\\AppData\\Local\\dosh\\source",
             "1",
+            None,
         );
         assert!(
             windows.contains(
@@ -10811,6 +11159,46 @@ mod tests {
         assert!(!windows.contains(" sh -s "));
     }
 
+    #[test]
+    fn update_uses_local_tag_when_release_latest_is_older() {
+        assert_eq!(
+            update_binary_version_for_installer("1.0.0-rc41", Some("v1.0.0-rc37")).as_deref(),
+            Some("v1.0.0-rc41")
+        );
+        assert_eq!(
+            update_binary_version_for_installer("1.0.0-rc41", Some("v1.0.0-rc41")),
+            None
+        );
+        assert_eq!(
+            update_binary_version_for_installer("1.0.0-rc41", Some("v1.0.0-rc42")),
+            None
+        );
+        let config = ClientConfig::default();
+        let unix = unix_update_script(
+            &config,
+            "https://git.palav.dev/Palav/dosh.git",
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.sh",
+            "both",
+            "/tmp/dosh-cache",
+            "1",
+            Some("v1.0.0-rc41"),
+        );
+        assert!(unix.contains("DOSH_BINARY_VERSION='v1.0.0-rc41'"));
+        assert!(unix.contains("| DOSH_REPO="));
+        assert!(unix.contains(" sh -s -- 'both'"));
+
+        let windows = windows_update_script(
+            &config,
+            "https://git.palav.dev/Palav/dosh.git",
+            "https://git.palav.dev/Palav/dosh/raw/branch/main/install.ps1",
+            "client",
+            "C:\\Users\\palav\\AppData\\Local\\dosh\\source",
+            "1",
+            Some("v1.0.0-rc41"),
+        );
+        assert!(windows.contains("$env:DOSH_BINARY_VERSION='v1.0.0-rc41';"));
+    }
+
     #[test]
     fn status_uses_host_alias_and_user() {
         let host = HostConfig {
@@ -10908,7 +11296,14 @@ mod tests {
     fn update_version_status_compares_numeric_parts() {
         assert_eq!(update_version_status("0.1.5", "0.1.5"), "current");
         assert_eq!(update_version_status("0.1.9", "0.1.10"), "update available");
-        assert_eq!(update_version_status("1.0.0", "0.9.9"), "different");
+        assert_eq!(
+            update_version_status("1.0.0", "0.9.9"),
+            "local newer than latest release"
+        );
+        assert_eq!(
+            update_version_status("1.0.0-rc40", "1.0.0-rc37"),
+            "local newer than latest release"
+        );
     }
 
     #[test]
@@ -11282,6 +11677,7 @@ mod tests {
         let now = Instant::now();
         let stale = now - ALT_SCREEN_IDLE_REPAINT_AFTER - Duration::from_secs(1);
         let recent = now - Duration::from_secs(1);
+        let just_attempted = now - Duration::from_millis(500);
         assert!(should_repaint_idle_terminal(
             true,
             stale,
@@ -11296,6 +11692,20 @@ mod tests {
             LOCAL_SLEEP_REPAINT_AFTER + Duration::from_secs(1),
             now
         ));
+        assert!(should_repaint_idle_terminal(
+            false,
+            recent,
+            recent,
+            LOCAL_SLEEP_REPAINT_AFTER + Duration::from_secs(1),
+            now
+        ));
+        assert!(!should_repaint_idle_terminal(
+            false,
+            recent,
+            just_attempted,
+            LOCAL_SLEEP_REPAINT_AFTER + Duration::from_secs(1),
+            now
+        ));
         assert!(!should_repaint_idle_terminal(
             false,
             stale,
@@ -11310,7 +11720,7 @@ mod tests {
             Duration::from_secs(1),
             now
         ));
-        assert!(!should_repaint_idle_terminal(
+        assert!(should_repaint_idle_terminal(
             true,
             stale,
             recent,

src/bin/dosh-server.rs

@@ -1463,6 +1463,7 @@ async fn handle_ticket_attach(
     peer: SocketAddr,
     body: Vec<u8>,
 ) -> Result<()> {
+    dosh::trace::event("server.ticket_attach_start", &[("peer", peer.to_string())]);
     let env: TicketAttachEnvelope = protocol::from_body(&body)?;
     let opened = {
         let locked = state.lock().expect("server state poisoned");
@@ -1486,10 +1487,22 @@ async fn handle_ticket_attach(
     };
     let (ticket, request_plain) = match opened {
         Ok(opened) => opened,
-        Err(err) => return send_reject(socket, peer, &err.to_string()).await,
+        Err(err) => {
+            let reason = err.to_string();
+            dosh::trace::event("server.ticket_attach_reject", &[("reason", reason.clone())]);
+            return send_reject(socket, peer, &reason).await;
+        }
     };
     let req: TicketAttachBody = protocol::from_body(&request_plain)?;
     if req.session != ticket.session || req.mode != ticket.mode {
+        dosh::trace::event(
+            "server.ticket_attach_reject",
+            &[
+                ("session", req.session.clone()),
+                ("mode", req.mode.clone()),
+                ("reason", "ticket scope mismatch".to_string()),
+            ],
+        );
         return send_reject(socket, peer, "ticket scope mismatch").await;
     }
 
@@ -1560,7 +1573,18 @@ async fn handle_ticket_attach(
     };
     let (client_id, output_seq, snapshot) = match attached {
         Ok(attached) => attached,
-        Err(err) => return send_reject(socket, peer, &err.to_string()).await,
+        Err(err) => {
+            let reason = err.to_string();
+            dosh::trace::event(
+                "server.ticket_attach_reject",
+                &[
+                    ("session", req.session.clone()),
+                    ("mode", req.mode.clone()),
+                    ("reason", reason.clone()),
+                ],
+            );
+            return send_reject(socket, peer, &reason).await;
+        }
     };
 
     let ok = AttachOk {
@@ -1591,6 +1615,16 @@ async fn handle_ticket_attach(
     let body = protocol::to_body(&envelope)?;
     let out = protocol::encode_plain(PacketKind::AttachOk, client_id, 1, 0, &body)?;
     let _ = send_udp(socket, &out, peer).await?;
+    dosh::trace::event(
+        "server.ticket_attach_ok",
+        &[
+            ("session", ok.session.clone()),
+            ("mode", ok.mode.clone()),
+            ("client", hex_id(client_id)),
+            ("output_seq", output_seq.to_string()),
+            ("bytes", ok.snapshot.len().to_string()),
+        ],
+    );
     Ok(())
 }
 

src/trace.rs

@@ -1,11 +1,13 @@
 use std::fs::{File, OpenOptions};
 use std::io::Write;
-use std::path::PathBuf;
+use std::path::{Path, PathBuf};
 use std::sync::{Mutex, OnceLock};
 use std::time::{SystemTime, UNIX_EPOCH};
 
 static TRACE_FILE: OnceLock<Option<Mutex<File>>> = OnceLock::new();
+static HEALTH_FILE: OnceLock<Option<Mutex<File>>> = OnceLock::new();
 static TRACE_BYTES: OnceLock<bool> = OnceLock::new();
+const HEALTH_LOG_MAX_BYTES: u64 = 1024 * 1024;
 
 pub fn enabled() -> bool {
     TRACE_FILE.get_or_init(open_trace_file).is_some()
@@ -19,6 +21,21 @@ pub fn event(name: &str, fields: &[(&str, String)]) {
     let Some(file) = TRACE_FILE.get_or_init(open_trace_file) else {
         return;
     };
+    write_event(file, name, fields);
+}
+
+pub fn health_event(name: &str, fields: &[(&str, String)]) {
+    let Some(file) = HEALTH_FILE.get_or_init(open_health_file) else {
+        return;
+    };
+    write_event(file, name, fields);
+}
+
+pub fn default_health_log_path() -> PathBuf {
+    trace_root().join("health.log")
+}
+
+fn write_event(file: &Mutex<File>, name: &str, fields: &[(&str, String)]) {
     let now = SystemTime::now()
         .duration_since(UNIX_EPOCH)
         .map(|duration| duration.as_millis())
@@ -81,11 +98,49 @@ fn open_trace_file() -> Option<Mutex<File>> {
         .map(Mutex::new)
 }
 
+fn open_health_file() -> Option<Mutex<File>> {
+    let path = health_log_path_from_env()?;
+    rotate_health_log_if_needed(&path);
+    if let Some(parent) = path.parent() {
+        let _ = std::fs::create_dir_all(parent);
+    }
+    OpenOptions::new()
+        .create(true)
+        .append(true)
+        .open(&path)
+        .ok()
+        .map(Mutex::new)
+}
+
+fn health_log_path_from_env() -> Option<PathBuf> {
+    match std::env::var_os("DOSH_HEALTH_LOG") {
+        Some(raw) => {
+            let normalized = raw.to_string_lossy().to_ascii_lowercase();
+            if normalized.is_empty() || matches!(normalized.as_str(), "0" | "false" | "off") {
+                None
+            } else if matches!(normalized.as_str(), "1" | "true" | "on") {
+                Some(default_health_log_path())
+            } else {
+                Some(PathBuf::from(raw))
+            }
+        }
+        None => Some(default_health_log_path()),
+    }
+}
+
+fn rotate_health_log_if_needed(path: &Path) {
+    let Ok(metadata) = std::fs::metadata(path) else {
+        return;
+    };
+    if metadata.len() <= HEALTH_LOG_MAX_BYTES {
+        return;
+    }
+    let rotated = path.with_extension("log.1");
+    let _ = std::fs::remove_file(&rotated);
+    let _ = std::fs::rename(path, rotated);
+}
+
 fn default_trace_path() -> PathBuf {
-    let root = dirs::cache_dir()
-        .unwrap_or_else(std::env::temp_dir)
-        .join("dosh")
-        .join("trace");
     let exe = std::env::current_exe()
         .ok()
         .and_then(|path| {
@@ -93,7 +148,14 @@ fn default_trace_path() -> PathBuf {
                 .map(|stem| stem.to_string_lossy().to_string())
         })
         .unwrap_or_else(|| "dosh".to_string());
-    root.join(format!("{}-{}.log", exe, std::process::id()))
+    trace_root().join(format!("{}-{}.log", exe, std::process::id()))
+}
+
+fn trace_root() -> PathBuf {
+    dirs::cache_dir()
+        .unwrap_or_else(std::env::temp_dir)
+        .join("dosh")
+        .join("trace")
 }
 
 fn truthy_env(name: &str) -> bool {

tests/integration_smoke.rs

@@ -152,21 +152,41 @@ fn write_server_config_with_retransmit_window(
 }
 
 fn start_server(dir: &tempfile::TempDir, config: &std::path::Path) -> Child {
+    start_server_with_trace(dir, config, None)
+}
+
+fn start_server_with_trace(
+    dir: &tempfile::TempDir,
+    config: &std::path::Path,
+    trace: Option<&Path>,
+) -> Child {
     let server = env!("CARGO_BIN_EXE_dosh-server");
-    let child = Command::new(server)
+    let mut command = Command::new(server);
+    command
         .arg("serve")
         .arg("--config")
         .arg(config)
         .env("HOME", dir.path())
         .stdout(Stdio::null())
-        .stderr(Stdio::null())
+        .stderr(Stdio::null());
-        .spawn()
+    if let Some(trace) = trace {
-        .unwrap();
+        command.env("DOSH_TRACE", trace);
+    }
+    let child = command.spawn().unwrap();
     thread::sleep(Duration::from_millis(500));
     child
 }
 
 fn attach_once(dir: &tempfile::TempDir, port: u16, cache: bool) -> std::process::Output {
+    attach_once_with_trace(dir, port, cache, None)
+}
+
+fn attach_once_with_trace(
+    dir: &tempfile::TempDir,
+    port: u16,
+    cache: bool,
+    trace: Option<&Path>,
+) -> std::process::Output {
     let client = env!("CARGO_BIN_EXE_dosh-client");
     let mut cmd = Command::new(client);
     cmd.arg("--local-auth")
@@ -181,6 +201,9 @@ fn attach_once(dir: &tempfile::TempDir, port: u16, cache: bool) -> std::process:
     if !cache {
         cmd.arg("--no-cache");
     }
+    if let Some(trace) = trace {
+        cmd.env("DOSH_TRACE", trace);
+    }
     cmd.output().unwrap()
 }
 
@@ -1564,7 +1587,9 @@ fn ticket_attach_after_server_restart_smoke() {
     let dir = tempfile::tempdir().unwrap();
     let port = free_udp_port();
     let config = write_server_config(&dir, port);
-    let mut server = start_server(&dir, &config);
+    let server_trace = dir.path().join("server-trace.log");
+    let client_trace = dir.path().join("client-trace.log");
+    let mut server = start_server_with_trace(&dir, &config, Some(&server_trace));
     let first = attach_once(&dir, port, true);
     let _ = server.kill();
     let _ = server.wait();
@@ -1574,8 +1599,8 @@ fn ticket_attach_after_server_restart_smoke() {
         String::from_utf8_lossy(&first.stderr)
     );
 
-    let mut server = start_server(&dir, &config);
+    let mut server = start_server_with_trace(&dir, &config, Some(&server_trace));
-    let second = attach_once(&dir, port, true);
+    let second = attach_once_with_trace(&dir, port, true, Some(&client_trace));
     let _ = server.kill();
     let _ = server.wait();
     let stderr = String::from_utf8_lossy(&second.stderr);
@@ -1584,6 +1609,24 @@ fn ticket_attach_after_server_restart_smoke() {
         stderr.contains("udp_ticket_attach_ready"),
         "stderr={stderr}"
     );
+    let server_trace = fs::read_to_string(&server_trace).unwrap();
+    let client_trace = fs::read_to_string(&client_trace).unwrap();
+    assert!(
+        server_trace.contains("event=server.ticket_attach_start"),
+        "server trace={server_trace}"
+    );
+    assert!(
+        server_trace.contains("event=server.ticket_attach_ok"),
+        "server trace={server_trace}"
+    );
+    assert!(
+        client_trace.contains("event=client.ticket_attach_start"),
+        "client trace={client_trace}"
+    );
+    assert!(
+        client_trace.contains("event=client.ticket_attach_ok"),
+        "client trace={client_trace}"
+    );
 }
 
 #[test]

tests/release_scripts.rs

@@ -42,6 +42,15 @@ fn package_check_verifies_only_artifacts_it_builds() {
     );
 }
 
+#[test]
+fn complete_release_verifier_requires_both_macos_architectures() {
+    let verify = include_str!("../scripts/verify-release-artifacts.sh");
+    assert!(verify.contains("dosh-linux-x86_64.tar.gz"));
+    assert!(verify.contains("dosh-macos-aarch64.tar.gz"));
+    assert!(verify.contains("dosh-macos-x86_64.tar.gz"));
+    assert!(verify.contains("dosh-windows-x86_64.zip"));
+}
+
 #[test]
 fn package_release_stamps_git_build_info() {
     let package = include_str!("../scripts/package-release.sh");