# F06b evidence for [#33554](https://git.cafe/pingdotgg/t3code/pull/33554)

Extends only the same-manager retry requirement from F06 of the [fixture matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cac7011d74d51bbb/fixture-matrix.md). This does not change the status of other matrix rows.

Fixture preserved: ten ordered dropped loopback addresses followed by live loopback sshd; namespace-private iptables DROP; real OpenSSH/sshd 9.6p1 Ubuntu-3ubuntu13.19. Only remote T3 launch/log commands are stubbed. Launch reports an external synthetic backend on port 43333, pairing is false. Each side uses its own unnamed network namespace, throwaway SSH keys/config/known_hosts, and clean detached checkout. No T3 dev server or live state was used. The same driver SHA256 `b413335a0bcb66778b0361bbd07c45ad2c80de1da1e5fa5d9abc2f1761f0bd29` ran on both sides, using Node v24.21.0 in the namespace.

The transcripts log UTC and monotonic offsets for each call start/end, error class and message, PID/local port, per-call and cumulative HTTP probe counts, first-child liveness before the second spawn, and scope closure. Error outcomes are expected fixture behavior. The raw archive includes JSON events/results, SSH stderr and commands, resolver order per spawn, public keys/config, manifests with script hashes, and worker cleanup records. Private keys and runtime model identifiers are excluded.

### F06b — Forward never listens; retry in the same manager scope

Two sequential `ensureEnvironment` calls use the same target and the same `SshEnvironmentManager` instance. Call 1 completes with failure before call 2 begins; the manager scope closes only after call 2 fails. Each retry reserves a new local port and spawns a distinct real tunnel SSH PID. The first child is confirmed absent before the second spawn; both children are absent after scope close. No forward listener is observed. The after revision makes zero HTTP probes across both calls. No failed tunnel reuse was observed.

| Before | After |
|---|---|
| [ee59ab22a8](https://github.com/pingdotgg/t3code/commit/ee59ab22a819acb0544d85cd6cca0e4aa8c7c444) | [e4868beb9d](https://github.com/pingdotgg/t3code/commit/e4868beb9d922edc2dd0ebaf6db16c996b044d5b) |
| Call 1: **failure; 20198 ms**<br>`SshReadinessError: Timed out waiting 20000ms for backend readiness at http://127.0.0.1:42237/.`<br>PID 581386; local port 42237; HTTP probes 196 | Call 1: **failure; 90172 ms**<br>`SshReadinessError: SSH connection to fixture-never did not come up within 90000ms.`<br>PID 582024; local port 44435; HTTP probes 0 |
| Call 2: **failure; 20143 ms**<br>`SshReadinessError: Timed out waiting 20000ms for backend readiness at http://127.0.0.1:39447/.`<br>PID 581924; local port 39447; HTTP probes 196 | Call 2: **failure; 90144 ms**<br>`SshReadinessError: SSH connection to fixture-never did not come up within 90000ms.`<br>PID 582566; local port 42029; HTTP probes 0 |
| [F06b-before.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d1d02a570d8ad636/F06b-before.log) | [F06b-after.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/24040cbf93532441/F06b-after.log) |

[F06b-before-summary.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/71de3e0ad89632b7/F06b-before-summary.txt) · [F06b-after-summary.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/289248fd8c1043cb/F06b-after-summary.txt) · [driver.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d9ad042f25327028/driver.mjs) · [driver.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d67f5c74c75ab9b8/driver.diff) · [F06b-raw-artifacts.tar.gz](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/870e6a96dff4f51b/F06b-raw-artifacts.tar.gz)

AI-assisted; verified with the tests and tools listed above.

## Rebuild

Create the two detached worktrees at the exact commits above and run `vp install` in each. Put the linked scripts under `/tmp/lead-33554-r1/evidence-capture-3/`, create `bin/ssh` as a symlink to `ssh-wrapper.py`, mark it executable, and compile `cc -shared -fPIC -o resolver.so resolver.c -ldl`. Run `python3 run-fixture.py F06b`. The runner creates a new timestamped directory for each side, fresh throwaway keys, an unnamed network namespace and namespace-private DROP rules. It stops its captured driver and sshd PIDs on completion; namespace lifetime ends with its processes. Requires passwordless sudo, iptables, unshare, OpenSSH and a C compiler.

[run-fixture.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/eabe32d2c9a8bb12/run-fixture.py) · [ssh-wrapper.py](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bf09c1c820da21ce/ssh-wrapper.py) · [resolver.c](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9d659bf1c852466b/resolver.c)