Report Running to SCM only after supervisor startup succeeds

Execute starts Run in a goroutine and immediately sends svc.Running,
so any failure inside Run's synchronous startup path (logger init,
instance UID, auth, local OpAMP server, collector start) is reported
only after SCM has already been told the service is up.

Run now accepts an optional startedCh that it closes after sv.Start
returns successfully. The Windows service handler selects on this
channel and errCh, staying in StartPending until startup is confirmed
and only then transitioning to Running. A 30s WaitHint is attached to
the initial StartPending so SCM doesn't time out while real startup
runs.

Author: bernd

superv/command.go

@@ -289,5 +289,5 @@ func runSupervisor(cmd *cobra.Command, _ []string) error {
 	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer stop()
 
-	return Run(ctx, cfg, events)
+	return Run(ctx, cfg, events, nil)
 }

superv/run.go

@@ -34,7 +34,14 @@ import (
 
 // Run starts the supervisor and blocks until ctx is cancelled.
 // The caller controls the lifecycle: cancelling ctx triggers graceful shutdown.
-func Run(ctx context.Context, cfg config.Config, events []func(*zap.Logger)) error {
+//
+// If startedCh is non-nil, it is closed once synchronous startup has completed
+// successfully — i.e. after sv.Start returns and before Run blocks waiting for
+// ctx. Startup failures are reported via the returned error; startedCh is left
+// untouched. Callers that need to distinguish "started" from "failed during
+// startup" should select on both startedCh and the channel they use to receive
+// Run's return value.
+func Run(ctx context.Context, cfg config.Config, events []func(*zap.Logger), startedCh chan<- struct{}) error {
 	logger, err := initLogger(cfg.Logging, cfg.Debug)
 	if err != nil {
 		return fmt.Errorf("failed to create logger: %w", err)
@@ -91,6 +98,10 @@ func Run(ctx context.Context, cfg config.Config, events []func(*zap.Logger)) err
 		return fmt.Errorf("failed to start supervisor: %w", err)
 	}
 
+	if startedCh != nil {
+		close(startedCh)
+	}
+
 	<-ctx.Done()
 
 	shutdownCtx, cancelShutdown := context.WithTimeout(context.Background(), cfg.Shutdown.GracefulTimeout)

superv/service_windows.go

@@ -55,7 +55,11 @@ func NewSvcHandler() svc.Handler {
 type supervisorService struct{}
 
 func (s *supervisorService) Execute(_ []string, r <-chan svc.ChangeRequest, changes chan<- svc.Status) (bool, uint32) {
-	changes <- svc.Status{State: svc.StartPending}
+	// Give SCM a generous WaitHint so it doesn't decide the service is hung
+	// while Run is doing its synchronous startup (auth, OpAMP, collector).
+	// Ideally we'd also send periodic StartPending heartbeats with a monotonically
+	// increasing CheckPoint for full spec compliance.
+	changes <- svc.Status{State: svc.StartPending, WaitHint: uint32((30 * time.Second).Milliseconds())}
 
 	elog, err := eventlog.Open(eventLogSourceName)
 	if err != nil {
@@ -76,10 +80,25 @@ func (s *supervisorService) Execute(_ []string, r <-chan svc.ChangeRequest, chan
 	defer cancel()
 
 	errCh := make(chan error, 1)
+	startedCh := make(chan struct{})
 	go func() {
-		errCh <- Run(ctx, cfg, events)
+		errCh <- Run(ctx, cfg, events, startedCh)
 	}()
 
+	// Stay in StartPending until Run signals that synchronous startup has
+	// completed, or returns early with a startup error. Reporting Running to
+	// SCM before this point would falsely advertise the service as healthy.
+	select {
+	case <-startedCh:
+	case err := <-errCh:
+		if err != nil {
+			_ = elog.Error(serviceStartError, "Startup error: "+err.Error())
+			return true, 1
+		}
+		// Run returned nil before signaling start — treat as a clean exit.
+		return false, 0
+	}
+
 	changes <- svc.Status{
 		State:   svc.Running,
 		Accepts: svc.AcceptStop | svc.AcceptShutdown,