# Desktop update SSH cleanup: headless proof

Target: [#14276](https://github.com/pingdotgg/t3code/pull/14276). Candidate: main [1451e7cb23](https://github.com/pingdotgg/t3code/commit/1451e7cb23034d29774338608368a15d8845df36) plus the rebuilt full PR, diff SHA-256 c8dae5e9fd323608ed23dc790a46c9c431d9e6fda0ec904df924a342645bbca9. Native Electron and installer adapters are stubbed; this is not packaged update approval.

## Before and after

Current main has 72 focused cases across the SSH and desktop update suites. The original proposal merged onto main has 73. Independently rewritten initial cases exposed the cleanup race and failure recovery; round-one review then exposed stale-port retries and lost remote shutdown ownership in the first rebuild. The final two regressions failed before the simplification (77 passing / 2 failing). After publication, two fresh regressions reproduced an uninterruptible drain behind admitted SSH startup: 87 passing / 2 failing. A review then moved the drain before backend shutdown: the existing case failed on the unnecessary stop (88 passing / 1 failing), then passed after reordering. The current implementation passes 81 focused cases (37 SSH, 44 updater), plus eight desktop lifecycle/service cases: 89 passing. Scoped SSH/desktop types, changed-file lint, formatting and diff checks pass.

The root also reproduced lost ownership with actual OpenSSH in the preceding candidate: after an occupied old port prevented restore, ordinary shutdown issued zero remote stop commands. The current candidate stops it once, even without a renderer reconnect.

## Running service and transport

The proof runs the actual DesktopUpdates service, DesktopSshEnvironment service and SshEnvironmentManager with actual Node process services and OpenSSH -L child processes against a disposable loopback sshd. A local HTTP/WebSocket fixture stands in for the remote T3 server. Remote launch/stop commands and native Electron/installer adapters are stubbed. Updater filesystem/window/backend fixtures are the existing service harness; no real installer or user data is accessed.

Every case first completes HTTP and WebSocket through the SSH forward. At installer handoff, the original forwarded HTTP request fails, direct remote HTTP still succeeds, and no remote stop command has been issued. After failure, ordinary ensure returns bootstrap URLs that carry HTTP and WebSocket traffic. A typed-failure case occupies the former local port; reconnect avoids it. A separate case skips reconnect and verifies normal scope shutdown still issues one remote stop.

Exact observed case markers:

### success

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    HANDOFF: original forward closed; remote HTTP alive; remote stop commands=0
    PASS success: scope shutdown remote stop commands=0; native Electron/installer adapters stubbed

### typed

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    HANDOFF: original forward closed; remote HTTP alive; remote stop commands=0
    RECOVERED: ordinary renderer ensure returned working HTTP/WebSocket URLs; occupied former port avoided
    PASS typed: scope shutdown remote stop commands=1; native Electron/installer adapters stubbed

### thrown

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    HANDOFF: original forward closed; remote HTTP alive; remote stop commands=0
    RECOVERED: ordinary renderer ensure returned working HTTP/WebSocket URLs
    PASS thrown: scope shutdown remote stop commands=1; native Electron/installer adapters stubbed

### interrupted

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    HANDOFF: original forward closed; remote HTTP alive; remote stop commands=0
    INTERRUPTED: admission reopened without restarting backends during shutdown
    RECOVERED: ordinary renderer ensure returned working HTTP/WebSocket URLs
    PASS interrupted: scope shutdown remote stop commands=1; native Electron/installer adapters stubbed

### native-before

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    RECOVERED: ordinary renderer ensure returned working HTTP/WebSocket URLs
    PASS native-before: scope shutdown remote stop commands=1; native Electron/installer adapters stubbed

### native-after

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    HANDOFF: original forward closed; remote HTTP alive; remote stop commands=0
    RECOVERED: ordinary renderer ensure returned working HTTP/WebSocket URLs
    PASS native-after: scope shutdown remote stop commands=1; native Electron/installer adapters stubbed

### without-reconnect

    BEFORE: actual OpenSSH HTTP and WebSocket connected
    HANDOFF: original forward closed; remote HTTP alive; remote stop commands=0
    RECOVERED: normal quitting restored without renderer reconnect
    PASS typed: scope shutdown remote stop commands=1; no reconnect; native Electron/installer adapters stubbed

Native-error-before-preparation completion aborts installer handoff, so that case has no HANDOFF marker. The success case leaves remote ownership preserved through manager scope exit, issuing zero remote stop commands. Failed cases restore ordinary shutdown ownership and issue exactly one stop only on normal scope exit.

Interruption during normal shutdown reopens SSH and resets the install state without restarting backends; the live interruption run explicitly asserts zero backend starts. The existing interruption test first failed against the preceding candidate because it restarted the backend, then passed with the reset path restored. Typed, thrown and native installer errors retain full desired-running backend recovery.

## Blocked startup deadline and late ownership

A Deferred pauses remote archive launch before any forward starts. The actual updater aborts without releasing that launch gate; then the gate is released and real OpenSSH HTTP/WebSocket traffic verifies the late connection.

    DRAIN: remote launch deliberately blocked before any local forward
    DEADLINE: update aborted after 10009ms while launch still blocked; no installer handoff; backend never stopped or restarted; markers cleared
    LATE_ENSURE: actual OpenSSH forward registered after abort; HTTP/WebSocket work; ordinary ensure reuses one managed forward
    PASS: normal shutdown closed late forward and issued one remote stop; native/remote launch adapters stubbed

All seven earlier transport cases above were rerun against this exact candidate and passed.

## Limits

No packaged Electron update, macOS native updater timing, Windows installer, Linux package installation, native relaunch, running renderer supervisor, real remote T3 server, iOS or Android client was verified. The renderer reconnect path was traced in current source; proof invokes its ordinary ensure operation through the real desktop service. Native platform update/recovery and maintainer lifecycle approval remain required.

The updater gives SSH draining a 10-second budget. Lock acquisition is interruptible; an acquired entry still completes its local process cleanup before recovery. This bounds a blocked launch/password wait, rather than imposing a hard bound over arbitrary finalizers or backend restart. Draining runs before backend shutdown. On timeout, installation aborts before handoff and recovery reopens admission and clears quitting/markers/reservations; running local backends are neither stopped nor restarted. An independently admitted ensure can then finish and remains managed. Remote startup/authentication budgets themselves are unchanged. Remote shutdown remains best effort through the existing stop script. One unchanged zombie-process fixture failed once in an earlier run and passed in the final 89-case run.

This process-lifecycle change has no visual UI difference; screenshots would not establish installer cleanup. Public proof contains no credentials, keys, pairing URLs or private data.