# Proof audit, pass 1 — SSH tunnel readiness

PR [#33554](https://git.cafe/pingdotgg/t3code/pull/33554), [GitHub mirror](https://github.com/pingdotgg/t3code/pull/33554), branch `fix/issue-33531`.
Before: [ee59ab22a8](https://github.com/pingdotgg/t3code/commit/ee59ab22a819acb0544d85cd6cca0e4aa8c7c444). After: [d9c8cd4520](https://github.com/pingdotgg/t3code/commit/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8).

Read-only code-derived fixture plan. No runtime capture, test execution, browser, Electron session, or service was started in this pass. All before/after outcomes below are predictions to verify, not measured results. The supplied base is an ancestor of head; the worktree HEAD matched the supplied head and was clean. The local `main` ref has an older merge-base, so captures must use the explicitly supplied base, not an unqualified local main.

## Findings first

1. **Blocking evidence gap:** the PR body admits that its reproduction driver and sshd setup scripts were not uploaded. It links no raw runtime transcript. The existing table and short excerpt cannot be rebuilt or audited from the PR.
2. **Revision mismatch:** that table compares older revisions, not the requested base/head above. Capture the same immutable driver/fixture inputs on both requested revisions, or supply an explicit equivalence proof and the original full artifacts. Prefer fresh base/head recordings.
3. **The error has a visible surface.** `SshReadinessError.message` reaches desktop IPC, `sshPreparationError`, onboarding, and the Add Environment dialog's error alert. Saved-environment connection diagnostics also render failure detail when it reaches the supervisor. The absence of a changed React file does not justify saying “no visible surface.” Row F21 covers this. This remains a runtime evidence matrix, with no request for still screenshots.
4. **Missing failure and clock proof:** the existing three success/failure rows do not demonstrate the 90s connect cap, a fresh 20s HTTP budget after forwarding, HTTP failures with an established forward, or SSH exit in both phases. The new focused tests cover a simulated 25s forward and simulated never-listening cap; existing exit tests use an already-listening network stub and do not establish real pre-forward exit behavior.

## Function paths and input partition

Production changes are confined to `waitForTunnelForward` (new) and the readiness branch of `startSshTunnel`; `tunnel.test.ts` also adds two cases and changes its default `hasListenerOnHost` from false to true. There is no changed rendering function.

- **Every direct production caller:** `waitForTunnelForward` is called only by `startSshTunnel`; `startSshTunnel` only by `createTunnelEntry` inside `runWithSshAuth`. `createTunnelEntry` is reached by `ensureTunnelEntry` for a missing or stale cached tunnel. A healthy cached tunnel instead uses an unchanged 2s HTTP check. `ensureEnvironment` serializes this work by resolved target key and optionally issues a pairing credential afterward.
- **Every outer production entry:** `DesktopSshEnvironment.ensureEnvironment` is the sole production consumer of the manager. Its IPC method is invoked through preload `desktopBridge.ensureSshEnvironment`. Web code inside desktop calls it for (a) provisioning a new SSH environment or route, `issuePairingToken:true`; (b) preparing/reconnecting with a saved token, false; and (c) re-pairing when no usable saved token exists, true. The saved path is used by the connection broker, including route preflight. Tests and a standalone capture driver call the manager directly. Standalone web and native mobile report SSH unavailable; providers, agent MCP tools and scheduled turns do not directly call this desktop manager.
- **Target input equivalence:** alias or hostname resolves through `ssh -G`; nullable versus explicit username/port changes the connection/key/argv, not the two clocks. Record the resolved alias, username, port, IPv4/IPv6 address sequence and ssh config. The new error interpolates the *resolved target alias*. The locally reserved port is probed specifically on `127.0.0.1`; HTTP and WebSocket URLs use that same IPv4 loopback port. The remote `-L` destination is `127.0.0.1:remotePort`, independent of the SSH server's address family.
- **Runner/server equivalence:** node-script/archive runner and external/managed/omitted serverKind share the same forward gate. Their launch/stop/pair behavior must be labelled when stubbed. Important correction to the PR's wording: node-script launch is bounded at 90s, but archive launch at 900s; the new tunnel gate is always 90s. These upstream launch clocks are not the new connect clock.
- **Preparation failures:** invalid host spec, auth-helper preparation failure, or process spawn failure return before the gate. Target resolution, runner resolution, launch output/port parsing and local-port reservation can also fail upstream. F19 inventories these unchanged guards.
- **Forward gate branches:** first probe true; false repeated every 100ms then true before 90s; or no successful IPv4 TCP probe by 90s. Each real probe can take up to 250ms, so do not assert exactly 100ms wall-clock intervals. No typed network-error branch exists: `hasListenerOnHost` returns a boolean, mapping socket errors/timeouts to false. Scope interruption cancels the probe. A listener need not belong to ssh, so the subsequent HTTP probe and exit race remain necessary.
- **HTTP branches after true:** successful 2xx response with drained body; transient non-2xx/transport failure/probe timeout then recovery; or no successful readiness before the unchanged 20s overall bound (1s per request probe, 100ms retry spacing). An unfinished response body is separately bounded by the overall timeout. None of these HTTP operations should begin before the forward gate succeeds at head.
- **Concurrent SSH branch:** both gate and HTTP readiness race the same `exitFailure`. Nonzero exit with stderr uses trimmed bounded stderr; absent stderr uses an alias/exit-code fallback. Exit 0 is also unexpected. Stderr read failure is ignored without hiding exit; exit-code monitoring failure maps to `SshCommandError`. Success cancels the exit waiter but keeps stderr draining in the entry scope.
- **Failure and lifecycle:** typed readiness/SSH errors gather process/listener/remote-log diagnostics, then kill the child with SIGTERM and a 2s forced-kill allowance; the creator closes the entry scope. Failed startup is not cached. Cancellation also takes the cleanup path, but is not a normal typed error. After success, reuse/stale replacement, disconnect, per-target locking and manager-scope shutdown retain their existing paths. Auth-shaped `SshCommandError` can retry with a cached/new secret (at most two prompts); non-auth readiness errors should pass through without a password retry.

## Timing and fixture conventions

`t=0` is successful spawn of the **tunnel** `ssh -N` process, not entry into `ensureEnvironment`. Let D be the time until the real local IPv4 forward accepts TCP, H the additional time until an HTTP 2xx response/body completes, and E a process exit. Base normally permits D+H under 20s. Head permits D under 90s and H under 20s after the successful forward probe, while preserving the exit race. Use margins; an event at exactly 20s or 90s is a race and is not a deterministic assertion.

The `ssh.tunnel.ready.failed` log is emitted **after** diagnostics, including a separate SSH remote-log request with a 10s bound. Final caller failure/cleanup can therefore occur later than the phase deadline; kill may add up to 2s. Upstream launch and downstream optional pairing create additional SSH connections. Record separate timestamps for launch, tunnel spawn, listener observation, HTTP readiness start/attempts, deadline/error, diagnostics start/end, child exit, and result/cleanup. Do not describe total ensure duration as the connect timeout.

**Minimum capture set:** F01, F03, F04, F05, F06, F07, F08, F10, F11 and F21. F21 reuses F06's failure rather than inventing a second timeout fixture. F03 must include real OpenSSH address fallback, not just a sleep. F07's 503 case is the minimum; connection-refused is an optional variant. All remaining rows inventory distinct guards/interactions and can be covered by focused existing tests or labelled harness evidence rather than multiplying real-host captures. Run the new focused regression at base using the same head test fixture and at head; do not equate old base tests without the new case with a regression proof.

`recording` means a timestamped runtime transcript of a real run. There are no still-image rows. Where syscall/service injection is needed, mark the evidence **HARNESS**, identify the replaced layer, and do not call it a real-host result. All statuses are pre-capture statuses.

## Runtime matrix

| ID / fixture and required data | Diff effect / minimum | Before: ee59ab22a8 | After: d9c8cd4520 | Linux production method / evidence | Pass-1 status |
|---|---|---|---|---|---|
| F01 Direct healthy: isolated sshd on 127.0.0.1, D comfortably <1s, backend immediately returns 200 | Control; **minimum** | Success promptly | Success promptly; forward gate precedes HTTP | Real ssh/sshd + real Net/HTTP, manager driver; **recording** | PENDING; old PR table is unlinked and on older SHAs |
| F02 One dead address before live sshd: ordered [DROP1, live], D about 10s, H≈0 | Control; optional | Success before 20s | Success | Real address fallback recipe A; **recording** | PENDING; optional preservation of PR table's middle row |
| F03 Two dead addresses before live sshd: ordered [DROP1, DROP2, live], measure D>20s and <90s; backend ready | **Affected; minimum** | HTTP timeout at about t=20s; process still alive, no listener; killed | Listener appears after address retries; HTTP begins then; success | Real OpenSSH address fallback recipe A. If two addresses do not exceed 20s, report that run invalid and add a third dead address with explicit labelling; **recording** | PENDING; regression test exists with simulated D=25s |
| F04 Split budgets: D≈10s, then backend returns 503 until H≈15s, then 200 | **Affected; minimum** | Timeout near t=20s despite backend becoming ready around t=25s | Success around t=25s; HTTP has its own full budget | Real ssh with one dropped address; backend switches based on observed listener milestone, not driver start; **recording** | PENDING; not proved by the D=25s/instant-HTTP unit case |
| F05 Near connect cap, then backend delay: D≈85s, H≈10s, ssh stays alive | **Affected; minimum** | HTTP timeout near t=20s | Success around t=95s; 90s is not a combined connect+HTTP cap | Real ssh with delayed forwarding via per-connection loopback proxy; delay mechanism labelled. If exact D cannot be generated with real ssh, **HARNESS** with controlled listener at 85s; **recording** | PENDING; real-host scheduling unvalidated |
| F06 Forward never listens: successful launch, tunnel process remains running, no IPv4 listener for >90s | **Affected; minimum** | Backend-readiness error near t=20s, child killed | `SshReadinessError: SSH connection to <alias> did not come up within 90000ms.` near t=90s; no HTTP probes; child killed; no cached entry | Tunnel-only address sequence with ≥10 blackholes (so ssh's own exit is later than the cap), or a real authenticated ssh tunnel with forwarding suppressed; launch/log calls must still be successful/stubbed separately. Otherwise labelled never-listening process **HARNESS**; **recording** | PENDING; simulated cap-and-kill unit test exists |
| F07 IPv4 forward listens, backend is never ready: immediate D, persistent HTTP 503; optional closed remote port variant | Control; **minimum** 503 case | Backend-readiness timeout near t=20s; ssh alive/listener true before cleanup | Same HTTP error about 20s after gate, not 90s SSH-connect error; cleanup | Real sshd forwards to 503 server; optional no remote listener for refused/reset branch; **recording** | PENDING; listener cannot be treated as backend readiness |
| F08 Forward listens, backend stalls: TCP accepted but no HTTP headers; optional 200 headers with unfinished body | Control; **minimum** no-headers case | Per-probe failures and overall HTTP timeout near 20s; body-hang also bounded overall | Same HTTP behavior, after gate | Real TCP server accepting forwarded sockets without replying; separately serve unterminated body for optional variant; **recording** | PENDING; test hangingHttpClient is not raw runtime evidence |
| F09 Delayed forward and backend never ready: D≈30s, H unbounded | **Affected; supporting** | HTTP timeout near t=20s with no listener | HTTP timeout near t=50s with listener true, after a fresh 20s backend wait | Real ssh with three dropped addresses + 503 backend; **recording** | PENDING; optional combined corroboration of F03/F04/F07 |
| F10 SSH fails before forward: tunnel-only connect refusal or server rejects key, E well before 20s, stderr nonempty | New phase/exit race; **minimum** | `SshCommandError` with real ssh stderr/exit code, before readiness deadline | Same error before 90s; no HTTP started; cleanup | Remote launch must succeed first; then stop tracked isolated sshd before -N or reject only tunnel attempt. Use disabled prompt for refusal; auth variants in F18; **recording** | PENDING; existing exit tests default forward=true, so do not cover this phase |
| F11 SSH exits while HTTP is pending: forward observed, persistent 503/hang, then close tracked tunnel/server connection at H≈3s | Preserved second-phase exit race; **minimum** | SSH exit error wins before 20s | Same SSH exit error wins before HTTP deadline | Kill only captured tunnel PID, or terminate its isolated sshd child; capture stderr completion and exit code; **recording** | PENDING |
| F12 Unexpected clean exit with empty stderr, before/after listener | Guard; optional two phase variants | `SshCommandError`, exit 0, alias/exit fallback | Same fallback; not readiness timeout | Deterministic process handle or exit-0 command **HARNESS**; real ssh is unlikely to produce a clean unexpected exit on demand; **recording** | PENDING; harness-only planned |
| F13 Exit diagnostics shapes: long/multibyte stderr tail; stderr stream fails; exit-code monitor fails | Guard; optional independent subcases | Last 16384 chars retained; stderr read failure ignored; monitor failure mapped | Same errors while racing either phase | Existing tail/read-failure tests for first two; injected handle needed for monitor failure. **HARNESS recording** | SOURCE-TRACED; existing tests present, not executed here |
| F14 Cancellation in pending forward and pending HTTP, then repeat ensure | New phase lifetime interaction; supporting two variants | Interrupted startup cleans child; fresh ensure can run | Same; forward polling/HTTP interrupted, child stopped, failure not cached | Direct Effect fiber interruption driver + real ssh/proxy; labelled lifecycle **HARNESS** if fake child; **recording** | PENDING; distinguish cancellation from ordinary timeout |
| F15 Healthy cached entry: second ensure of identical resolved key, optional pairing=true | Bypasses changed function; optional control | Existing 2s readiness check, same local port/PID, no new tunnel | Same; no 90s connect gate on healthy reuse | Two ensures in one manager scope; true/false pairing options; count -N spawns; **recording** | SOURCE-TRACED; capture optional |
| F16 Stale cache then slow recreation: fail existing 2s HTTP check, old entry closes, replacement D>20s | **Affected through second caller path; supporting** | Replacement fails original 20s startup budget | New gate permits replacement; new local forward succeeds; stale entry closure does not stop shared remote server | Same scoped manager, stop old captured forward or make it stale, use replacement-only fallback/proxy delay; **recording** | PENDING; distinct from healthy reuse |
| F17 Target lock interactions: two same-target ensures while creating; other target concurrently; disconnect/reconnect while stop pending | Longer in-flight window; supporting | Same-target work serialized, other target independent; shutdown precedes reconnect | Same; one successful tunnel reused; failed creation can retry; disconnect waits for target lock | Labelled Deferred/process **HARNESS**; existing shutdown tests parameterize local tunnel vs remote-stop stall; **recording** | SOURCE-TRACED; tests exist for shutdown variants, not executed here |
| F18 Auth shapes: denied tunnel then password success; prompts unavailable/cancelled; two denied attempts; agent signing failure; cached secret | Preserved outer retry; optional distinct subcases | Auth error may prompt/retry up to two times; cancel/signing/unavailable terminate appropriately | Same after SSH exit race; readiness timeout itself does not prompt; a retry receives a fresh gate | Isolated sshd password/keyboard auth only if configured without changing host accounts; otherwise injected prompt/spawner **HARNESS**. Never publish secrets; **recording** | SOURCE-TRACED; existing signing-failure cases present, not executed here |
| F19 Preparation guards: target/runner resolution failure; invalid launch JSON/port; reservation failure; invalid host spec/auth helper/spawn failure | Unchanged, before new wait; optional independent subcases | Existing typed error, no active readiness wait | Same; no gate on paths that never spawn | Labelled service **HARNESS**; error text/typed result transcript, no time assertion | SOURCE-TRACED; no capture required for unchanged guard inventory |
| F20 Listener interaction: reserved port taken by another process before ssh bind; IPv6-only listener while 127.0.0.1 absent | New probe can observe unrelated or miss IPv6-only listener; supporting variants | Bind failure or HTTP failure; unrelated HTTP 2xx can race exit (pre-existing) | Bind failure normally exits; unrelated HTTP 2xx can race that exit on either revision (pre-existing ownership limitation). IPv6-only does not satisfy the IPv4 gate and may hit 90s if ssh remains alive | Isolated holder on chosen port; explicit v6 bind variant. Net probe/socket ownership race requires a labelled deterministic **HARNESS** if real ordering cannot be controlled; **recording** | PENDING; do not interpret TCP listener alone as ssh ownership |
| F21 Desktop error presentation for F06: Add Environment -> SSH with alias `fixture-never`; saved-route detail separately | **Affected visible text; minimum**, reuse F06 timing | Alert includes old backend-readiness timeout | Alert includes `SSH connection to fixture-never did not come up within 90000ms.` with possible Electron/connection wrapper; actual final text must be recorded | Production IPC/preload -> platform -> onboarding -> formatter -> Alert. Timestamped Electron runtime/accessible-text transcript if separately authorized; otherwise explicitly **HARNESS** for IPC/presenter and source trace for render (not a claim of observed UI). Saved route may surface generic setup timeout first (F22); **recording** | SOURCE-CONFIRMED visible route; actual rendered text NOT CAPTURED |
| F22 Saved reconnect exceeds outer setup deadline; aborted renderer waiter then retry/adopt | Relevant caller interaction; supporting | Supervisor may time out at 15s per route before a manager result; IPC continues | Same outer deadline; underlying manager can now finish slowly and retry may reuse/adopt pending work depending on provision vs saved-token path | Labelled connection-platform/supervisor **HARNESS** or real authorized desktop session; include option true/false and aborted signal. Do not claim manager success proves first-attempt UI success; **recording** | SOURCE-TRACED; exact UI outcome needs capture |
| F23 Tunnel succeeds, then later writes stderr/exits; subsequent ensure sees stale entry; explicit disconnect/manager shutdown | Preserved lifetime; optional | stderr drain remains until entry closes; reuse checks HTTP; shutdown kills tracked child | Same; readiness success cancels exit waiter, not diagnostics drain | Real ssh + logged stderr or injected handle **HARNESS**, then second ensure/disconnect; **recording** | SOURCE-TRACED; capture optional |
| F24 macOS/Windows OpenSSH parity for the slow-host and cap fixtures | Platform qualification; optional beyond Linux | Not established here | Not established here | Cannot run native OS behavior on this Linux VM; separate labelled platform recording, or explicitly leave unverified. A Linux fake platform/ssh.exe handle is **HARNESS** only; **recording** | NOT COVERED ON THIS VM |

## Concrete Linux recipes for the capturer

### A. Real OpenSSH address fallback without editing host /etc/hosts

This VM has `/usr/bin/ssh` and `/usr/sbin/sshd` OpenSSH 9.6p1, `cc`, `ip`, iptables/nft and passwordless sudo. A no-op `sudo -n unshare --mount --net true` succeeded, so private network/mount namespaces are available. These are feasibility checks, not a configured fixture or captured run.

Use one disposable private network namespace; bring its loopback up, run an isolated high-port sshd with scratch host/client keys and authorized_keys for the existing ubuntu user, `StrictModes no`, `AllowTcpForwarding yes`, and no writes to global ssh config/accounts. Bind sshd to 127.0.0.1. Inside that namespace only, DROP TCP traffic to chosen aliases in 127/8, such as 127.77.0.11 and 127.77.0.12, on the isolated SSH port. Reachable 127.0.0.1 remains untouched. This gives SYN timeouts rather than immediate refusals.

Provide an explicit ordered address list for only the fixture hostname using a narrow `getaddrinfo` LD_PRELOAD shim on `/usr/bin/ssh`; retain normal resolver behavior for all other names. Because ssh is dynamically linked on this VM, this can drive OpenSSH's own real per-address retry logic. Label it **real OpenSSH/sshd, injected resolver answers**, not real production DNS. Publish the shim source/build command and `ssh -vvv` connection order. Alternatively run a local resolver with a namespace-private resolv.conf (no host /etc/hosts edits), but record actual OpenSSH order: libc address sorting can reorder DNS answers, especially loopback vs other address families. A resolver response alone does not establish retry order.

**Do not use repeated HostName entries as fallbacks.** OpenSSH uses the first obtained value for ordinary config parameters; they are not an ordered list of connection attempts. `HostName` can name a multi-address DNS fixture, but the fallback sequence must come from actual resolution. A sleep wrapper that eventually execs real ssh tests timing only; label it HARNESS/delayed launch and do not substitute it for F03's address fallback.

### B. Production-manager driver with isolated dependencies

Run a standalone driver that imports each revision's actual `SshEnvironmentManager` and calls `ensureEnvironment` in an Effect scope. Keep real child spawning, NetService and HTTP client for real-host rows. Inject only remote runner resolution and a clearly documented dispatcher for upstream/downstream SSH commands if necessary. A PATH `ssh` wrapper can add `-F <scratch ssh_config>` and exec `/usr/bin/ssh` for the real `-N` tunnel; `-G` should still resolve the fixture config faithfully. It may return launch JSON for a prestarted external HTTP server and stub optional pairing/stop/log commands. Publish exactly which commands are stubbed. Set `TMPDIR` under the run directory so askpass/helper temporary files remain in the one scratch tree. Never use or copy live T3 state/credentials.

To reach F06/F10 specifically, **launch must succeed first**. A uniformly unreachable host would otherwise fail `launchOrReuseRemoteServer` and never exercise the diff. Inject blackholes/refusal only on the -N tunnel attempt or explicitly stub launch. Default core rows to `issuePairingToken:false` to isolate readiness, then cover true in the presentation/reuse interactions. Record options and command counts so a 20s launch or pairing connection cannot be mistaken for tunnel wait time.

For delayed HTTP rows, use a real loopback server returning 503 until the delay measured **after forwarding is observed** has elapsed. For F08, accept the TCP connection and withhold headers; separately publish the optional unfinished-body case. The manager's TCP probe creates an accepted forwarded connection by itself; the fixture backend must tolerate EOF/no HTTP request on that connection.

For long D without many blackholes, a tunnel-only loopback SSH proxy can delay passing the SSH authentication exchange. Ensure each individual ConnectTimeout=10 handshake is not accidentally exceeded: an 85s pure banner stall normally makes ssh exit early and is not F05. Safer F05 options are eight real 10s address timeouts plus a short delay, or an explicitly labelled process/listener harness. Never describe a sleeping wrapper or fake process as a real 85s successful SSH handshake.

### C. Clock/error capture contract

Every run gets a new timestamped directory within the lead's scratch root. Publish a manifest containing exact base/head SHA and dirty status, driver/setup/shim hashes, SSH/Node versions, target and effective ssh config (redacted), runner/serverKind, pairing option, chosen ports, resolver order, blackhole rules, HTTP mode/delay and exit trigger. Preserve stdout/stderr separately with UTC timestamps and monotonic offsets. Include actual result tag/message, ssh PID/exit code, listener status, HTTP attempt/start evidence and cleanup result.

For every minimum row link both full raw transcripts plus the immutable fixture source/setup instructions. A short PR excerpt is a convenient summary only. Include failing regression output at base and passing output at head. Existing focused tests can be run with `vp test run packages/ssh/src/tunnel.test.ts`; do not run repository-wide checks for this audit. Any fake clock/process/service rows remain labelled HARNESS. Real timing transcripts are recordings, not screenshot substitutes.

The desktop error chain is statically established; this pass did not request or perform browser/computer use. The capturer should obtain authorization before an integrated desktop UI observation. If unavailable, retain F21 as an explicitly limited IPC/presentation harness plus source trace; do not claim rendered verification.

## Source anchors

- [Changed gate and race](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/ssh/src/tunnel.ts#L1104), [startup failure/cleanup](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/ssh/src/tunnel.ts#L1301), [creation/reuse/ensure](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/ssh/src/tunnel.ts#L1535).
- [TCP probe semantics](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/shared/src/Net.ts#L85), [HTTP retry/probe/overall bounds](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/shared/src/httpReadiness.ts#L33), [new regression tests](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/ssh/src/tunnel.test.ts#L276).
- [Desktop manager](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/desktop/src/ssh/DesktopSshEnvironment.ts#L145), [IPC](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/desktop/src/ipc/methods/sshEnvironment.ts#L131), [IPC promise propagation](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/desktop/src/ipc/DesktopIpc.ts#L97), [preload](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/desktop/src/preload.ts#L168).
- [Error message wrapping](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/web/src/connection/platform.ts#L167), [onboarding](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/client-runtime/src/connection/onboarding.ts#L261), [formatter](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/web/src/components/settings/ConnectionsSettings.logic.ts#L285), [dialog error handling](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/web/src/components/settings/AddEnvironmentDialog.tsx#L162), [visible AlertDescription](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/web/src/components/settings/AddEnvironmentDialog.tsx#L590).
- [Saved-route error facts](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/client-runtime/src/connection/diagnosis.ts#L352), [visible diagnostics](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/apps/web/src/components/settings/ConnectionDiagnosisDetails.tsx#L179), [outer setup deadline](https://github.com/pingdotgg/t3code/blob/d9c8cd4520ac1e4cc9c8141db9f215716e6d4fd8/packages/client-runtime/src/connection/supervisor.ts#L887).

FRICTION: none

VERDICT: INSUFFICIENT F01/F03/F04/F05/F06/F07/F08/F10/F11/F21 lack reproducible requested-revision recordings and uploaded fixture/setup/raw artifacts