PR #17550 — reused SSH server pairing
Base: 1451e7cb23034d29774338608368a15d8845df36
Head: ac23054c565db5f2e76ad62c112d453ddf61bf5d
Linux x64; October 4 and October 7 release archives checked against release SHA256SUMS.

Isolated temporary server and home. Production SshEnvironmentManager with a controlled
SSH command adapter; real descriptor HTTP, generated pairing shell, verified release CLIs,
and grant exchange. No actual SSH/Tailscale connection or Electron window.
Temporary server PID tracked at spawn, stopped in finally; temporary state removed.
No live user state. No credentials included in this proof.

BEFORE — exact main production, same fixture:
[
  {
    "productionManagerAttempt": 1,
    "desktopPinned": "0.0.46-nightly.20261007.2787",
    "runningServer": "0.0.46-nightly.20261004.2652",
    "exchangeStatus": 500,
    "launchRunnerUnchanged": false,
    "sameServerPid": true,
    "transport": "controlled SSH command adapter; real HTTP, generated shell and verified Linux CLI"
  }
]
Expected successful exchange assertion fails (500 instead of 200).

AFTER — current head production:
[
  {
    "productionManagerAttempt": 1,
    "desktopPinned": "0.0.46-nightly.20261007.2787",
    "runningServer": "0.0.46-nightly.20261004.2652",
    "exchangeStatus": 200,
    "launchRunnerUnchanged": true,
    "sameServerPid": true,
    "transport": "controlled SSH command adapter; real HTTP, generated shell and verified Linux CLI"
  },
  {
    "productionManagerAttempt": 2,
    "desktopPinned": "0.0.46-nightly.20261007.2787",
    "runningServer": "0.0.46-nightly.20261004.2652",
    "exchangeStatus": 200,
    "launchRunnerUnchanged": true,
    "sameServerPid": true,
    "transport": "controlled SSH command adapter; real HTTP, generated shell and verified Linux CLI"
  }
]
Both attempts pass. Exactly one server-reuse launch operation and two pairing commands.

Independent real release compatibility check (same running old server PID):
{
  "platform": "Linux x64",
  "archives": "both verified against release SHA256SUMS",
  "transport": "direct loopback HTTP, independent of SSH manager regression tests",
  "observations": [
    {
      "serverVersion": "0.0.46-nightly.20261004.2652",
      "issuerVersion": "0.0.46-nightly.20261007.2787",
      "exchangeStatus": 500,
      "failureReason": "access_token_issuance_failed",
      "sessionStatus": null,
      "authenticated": null,
      "sameServerPid": true
    },
    {
      "serverVersion": "0.0.46-nightly.20261004.2652",
      "issuerVersion": "0.0.46-nightly.20261004.2652",
      "exchangeStatus": 200,
      "failureReason": null,
      "sessionStatus": 200,
      "authenticated": true,
      "sameServerPid": true
    }
  ]
}
PASS: matching old CLI grants authenticate against the unchanged running old server.

Focused tunnel suite: 39 passed. New archive regression against main fails on
paired desktop version instead of paired running-server version.
Scoped SSH typecheck, lint, formatting and diff checks pass.
Limits: actual SSH/Tailscale, Electron, macOS, Windows, iOS and Android not exercised.