Real Linux Electron / Xvfb proof, light theme, 1100x780 renderer. Fresh T3 state per checkout; T3CODE_DEV_SEED=0. No projects or threads needed.
Build each checkout with vp i and vp run build:desktop; install Electron with node node_modules/electron/install.js in apps/desktop; run vp run dev:web (read the port).
Run fixture.py ROOT in an empty scratch directory, then /usr/sbin/sshd -D -e -f ROOT/sshd_config. The wrapper invokes real OpenSSH with an isolated known_hosts file and StrictHostKeyChecking ask; it does not simulate a result.
Set EVIDENCE_ROOT=ROOT and use launch.py SIDE CHECKOUT WEBPORT CDPPORT (head ports 6013/14053, base 5877/13917 in this run). Connect agent-browser to CDP. Complete welcome without importing projects; open Settings > Connections > Environments.
Run driver.py AGENT_BROWSER SESSION NEW_OUTPUT_DIRECTORY on each side with empty ROOT/known_hosts. Both driver invocations use identical steps.
Run recovery.py ROOT: it independently reads the server public key fingerprint, compares it with the actual interactive SSH prompt, and answers yes only on a match. Run retry-driver.py AGENT_BROWSER SESSION NEW_OUTPUT_DIRECTORY for both open error dialogs. Both reach SSH verification required. Cancel both prompts afterward.
Private keys and app state are intentionally excluded. AI-assisted; verified with the tests and tools listed above.
