fix(manager): DeviceManager startup cancel 不再殘留 zombie read_loop

[csp0924]

問題

Closed-loop probe 發現：DeviceManager._on_start 啟動中被 cancel 時，已完成 start() 的 standalone device 的 read_loop task 永不被清理。finally block 只 rollback _running = False，後續 mgr.stop() 因 if not self._running: return early-return（manager.py:393-394），zombie task 永生。

Sandbox 證據（sandbox/device_manager_reconnect_storm_demo.py H3 scenario）：N=30 (15 fast + 15 slow)、cancel @ 0.3s → 15 個 read_loop task 在 explicit stop() 後仍 alive。

改動（Option A：追蹤已啟動 device，rollback 時反向收尾）

• csp_lib/manager/device/manager.py::_on_start 追蹤已成功啟動的 standalone / group device / group
• 新增 _rollback_partial_startup()：在 rollback finally 中反向 stop + disconnect（best-effort、BaseException-safe）
• 保留 _on_stop early-return 語意（沒啟動過的 manager stop() 仍然 no-op）
• 無 public API 變更（patch bump）

驗證

• 新增 tests/manager/test_device_manager_startup_cancel.py（3 案，含 reproduce + post-fix assertion）
• Manager 層 84 tests pass、整體 3680 tests pass、ruff / mypy clean
• Sandbox H3 scenario 重跑：zombie count 從 15/15 降為 0/0

[Copilot]

Pull request overview

This PR addresses a DeviceManager lifecycle bug where cancelling DeviceManager._on_start() mid-startup could leave already-started standalone devices’ background read_loop tasks running indefinitely (“zombie tasks”), because _running was rolled back to False and later stop() became a no-op.

Changes:

• Track partially-started standalone devices, group devices, and groups during _on_start() to enable cleanup on startup cancellation/failure.
• Add _rollback_partial_startup() to best-effort stop/disconnect devices (and stop groups) when startup doesn’t complete.
• Add regression tests reproducing the startup-cancel zombie-task scenario and asserting no task leaks.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
csp_lib/manager/device/manager.py	Adds partial-startup tracking and rollback cleanup to prevent zombie tasks when startup is cancelled.
tests/manager/test_device_manager_startup_cancel.py	New async regression tests for startup cancellation cleanup and task-leak prevention.

Comments suppressed due to low confidence (2)

csp_lib/manager/device/manager.py:468

• _rollback_partial_startup() 宣稱 BaseException-safe，但這兩個 await asyncio.gather(...) 仍是 cancellable await point：在 startup cancel 的 standalone-only 情境下（started_groups 為空）它們會成為 rollback 的第一個 await，容易直接被 CancelledError 打斷而完全跳過 cleanup。建議避免在 rollback 路徑使用未 shield 的 gather（例如改成逐台順序收尾並在每次 await 內捕捉 asyncio.CancelledError，或用 shield 包住 gather 並確保 inner cleanup 完成後再返回）。

        if started_standalone:
            await asyncio.gather(
                *(_rollback_standalone(d) for d in started_standalone),
                return_exceptions=True,
            )
        if started_group_devices:
            await asyncio.gather(
                *(_rollback_group_device(d) for d in started_group_devices),
                return_exceptions=True,
            )

tests/manager/test_device_manager_startup_cancel.py:202

• 檔尾這個 autouse fixture 目前是 no-op（只 yield），也沒有實際「silence warnings」或「接管 event loop」的行為，且註解描述與實作不一致。建議移除以避免誤導，或改為真正的 warnings/unraisable 捕捉設定（例如用 pytest.warns / warnings.filterwarnings / pytest 的 unraisablehook fixture）並在 docstring 說明其必要性。

# 提供給 pytest 的 fixture 接管 event loop（與其他測試慣例一致）
@pytest.fixture(autouse=True)
def _silence_asyncio_warnings() -> Any:
    """避免測試環境因 unraisable warning 而 noise。"""
    yield

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.