test+refactor: verify the SSH gate runs, harden dead-updater coverage (post-merge /review)

[kapoorankush]

Follow-up from running the FULL /review pipeline on the merged #636 port (#52) — the critical pass plus testing, maintainability, security, and performance specialists, Codex structured review, and adversarial passes. The batch had merged on two adversarial passes; the whole pipeline should have run first. It did now, and the code came back sound, but the specialists surfaced real gaps.

The headline: the SSH gate was never executed

The factory-reset SSH-off gate (disable_ssh_for_handoff) had only structural tests — string matches over the script text. A security gate that is only pattern-matched is unverified: a refactor could satisfy every grep and still not block. Added behavioral tests that extract the function and RUN it under bash with stubbed systemctl/raspi-config/ss:

• port 22 still listening → the gate exits 1, poweroff never reached;
• only :2222/:220 listening → proceeds (pins that grep -qx 22 is an exact match, not a substring);
• nothing listening → proceeds.

And a fail-open fix the security specialist caught: the old ss -H -ltn 2>/dev/null | ... | grep conflated "ss ran, port closed" (empty output) with "ss itself errored" (also empty output), so an ss that failed at runtime read as "verified closed". It now captures ss's output and exit status separately and, on an ss error, warns and proceeds exactly like an absent ss — never a silent pass. A test drives an erroring ss and asserts the warning fires.

Dead-updater refactor + refinement

• Both fireApply arms claim the run through one claimOptimisticRun() helper (was duplicated), with the deadUpdaterPolls reset invariant stated at the threshold declaration.
• The reconnect-resume path resets the corpse counter unconditionally (a pre-disconnect count is stale evidence) but only enters the live reading list on unit_busy!==false — a corpse status that outlived the Phase-7 restart hands back to the poll loop instead of showing a live view for it.

Test gaps closed (each verified red without its guard)

• JS: dialog-open promotion guard, verdict row-freeze, reconnect reset, fireApply catch-path reset.
• Route: a stale status file carries no unit_busy key even when busy.
• download_images: & and a bare . repo segment added to the slug hostile vectors.
• wifi: SSID rejection pins U+2028/U+2029 and the C1 NEL.

Hygiene

The 7 bare #528 references (a dev-repo issue; public tops out at #46) are now litclock-dev#528, matching the convention every other dev ref uses here. 5 predated this work; my SSH refactor added 2.

Gates: ruff clean; pytest 3,263 with the freetype-gated tests executed locally (zero relevant skips); vitest 191. No fleet-reaching behavior change beyond the ss fail-open hardening and the reconnect-resume refinement, both correctness improvements to paths that only run during an update or a factory reset. Rides the v0.224.0 train.