# Managed SSH launch logs: refreshed Linux proof

Target: [#8930](https://github.com/pingdotgg/t3code/pull/8930). Base main [99c692bb1f](https://github.com/pingdotgg/t3code/commit/99c692bb1f7dc31a6b1a28eddcff48aee6fd8186). Full candidate diff SHA-256: 3f0f372535b7975e583485b473267fe861960364e86b77fffac69ecee6b727fd.

The original takeover replaced one appended test with two behavior cases in the existing tunnel file: 35 to 36 tunnel cases, 54 SSH cases across five files. Global shell probing, child-process diagnostic suppression and source-order assertions were removed. Its original concurrent-launch regression failed before serialization. Earlier negative controls on the preceding candidate exposed stale output when unlinking was removed and old-descriptor contamination when truncation replaced unlinking; those are historical checks, not fresh runs of this candidate.

Main subsequently changed its archive lock to shell noclobber because uutils mkdir can report success on EEXIST. The test-helper conflict was resolved preserving environment, path, streamed stdin and stderr callbacks. The existing launch-concurrency case now injects faulty mkdir into both launchers, retaining deterministic FIFO milestones. Baseline with correct mkdir: 54 pass. Faulty mkdir with the prior directory launch lock: 53 pass, one real log-replacement failure. Launch lock aligned to main’s noclobber PID-file pattern: 54/54 pass, including archive installation, silent diagnostics, old descriptors and reuse. That update added no cases. A later Macroscope finding exposed persistent empty-owner lock-creation failures bypassing the inner timeout and sleep after the grace period. One new behavioral case in the existing file modeled a disappearing state directory independently of permissions, accelerated sleep, and bounded the broken loop with a fixture escape. It failed with 54 passing cases and a missing production timeout diagnostic; removing both reclaim-branch continues then passed all 55 cases (37 tunnel plus 18 across four files). All failed acquisitions now share the budget check and paced retry, including dead-owner reclamation. Reclaiming a stale lock adds one second before retry. The archive installer loop is unchanged. Scoped SSH typecheck, changed-file lint/format and diff checks pass.

## Independent running proof

Refreshed after the timeout fix. Production generated shell and Node runtime/readiness helpers run through real OpenSSH against an isolated loopback sshd. All homes are disposable. A fixture CLI creates a real HTTP server and runtime file, substituting for the packaged remote T3 binary.

Silent CLI signals a FIFO after opening the redirected log, then readiness deliberately fails. A descriptor retained from the previous log appends late output; the replacement remains empty. Three independent SSH commands with faulty mkdir race on one state key, return the same server identity and start exactly one CLI. HTTP answers, and ordinary reconnect preserves log bytes. A fifth scenario removes the state directory immediately after creation, then verifies the real SSH execution reaches the production timeout diagnostic. Sleep is accelerated for this scenario; it proves the retry budget and message, not 90 seconds of elapsed time.

Observed output:

    SILENT: real SSH executed generated script; silent failure reports no output; stale tail absent
    OLD_WRITER: append through old descriptor leaves replacement log empty
    CONCURRENT: three independent real SSH launchers, with mkdir succeeding on EEXIST, return one managed server; one CLI process starts; current HTTP works
    REUSE: ordinary reconnect preserves current server log and server identity
    MISSING_STATE: real SSH fails with the bounded production lock-timeout diagnostic; accelerated sleep; no fixture-exhaustion escape
    PASS: actual generated shell, Node readiness helpers, SSH and HTTP; fixture CLI substitutes for remote T3 server

## Limits

Linux shell/SSH behavior was exercised. Native macOS/Windows/Electron, iOS/Android, packaged remote T3 archive installation and real provider turns were not verified. The existing archive-runner suite passes on Linux. The proof uses a fixture CLI rather than the actual remote T3 server. Screenshots would not prove descriptor isolation or launch serialization; there is no visual UI change.

Coordination covers cooperating launchers sharing a state key. Older clients, stop/pairing and different keys remain outside it. PID reuse, delayed PID publication and a rare simultaneous stale-lock reclamation race remain known limits: a delayed reclaimer can delete a successor lock. Human assessment remains required. A legacy directory from the earlier unreleased PR format is treated as unowned and reclaimed after the grace period; it does not coordinate with live launchers using that old unreleased format. No released launch-lock migration is claimed.

New managed launches discard previous logs, including crash output; no history is retained. Outer SSH timeouts remain 180 seconds for Node and 1800 seconds for archive, allowing one lock wait plus one attempt, without a new budget per chained contender. No permission/ACL hardening claim is made. Public proof excludes keys, tokens and private data. Nothing is merged.