[OrcaWin]

	Files	Added	Deleted	Net
Test	16	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​951	$\color{#cf222e}{\Huge{\mathbf{−}}}$​6	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​945
Prod	18	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​243	$\color{#cf222e}{\Huge{\mathbf{−}}}$​81	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​162

ELI5

This adds tests that run the real app against real SSH hosts and check the new connect-time conversion (#24979). A host Orca used over the old relay must move onto a managed Orca server the next time it connects. Its projects, folders and terminal tabs must come along, and its old records must stay until source retirement is switched on. It runs on a Linux Docker host and on a Windows OpenSSH host. A third test checks that the last relay-only release (v1.4.218) can still see a converted host and its project, in case someone downgrades.

What Changed

• tests/e2e/ssh-orcad-auto-convert.spec.ts, one spec for both host kinds:
  1. Relay era: the app's orcad template path (ORCA_ORCAD_TEMPLATE_PATH) is empty, so the connect keeps the relay (orcad_unavailable). The spec registers the repo, adds a remote project group and folder workspace, adds a session tab that never spawns a shell, and runs then exits a shell (its exit record lets the terminal gate prove nothing is running).
  2. Conversion: the template is copied in, then disconnect and connect. The status must reach managed. On the new environment, repo.list, folderWorkspace.list and session.tabs.listAll must contain the repo, the folder and the tab.
  3. Retention, then retirement: the cutover journal must be destination-committed with sourceRetainedAt. With the retirement flag switched on, the next connect must move it to source-retired, and the server must still serve the repo.
• tests/e2e/helpers/orcad-convert-host.ts: the host is the Docker fixture (ORCA_E2E_ORCAD_CONVERT_HOST=docker) or a Windows host-cell descriptor.
• Linux: a new orcad-auto-convert-docker job in e2e.yml builds the linux-x64-glibc template outside the app's default lookup and runs the spec. It's registered as a dedicated spec (job selection, sharding expectation, source route, release permissions).
• Windows: a new orcad-convert cell in ssh-windows-hosts, run on the x64 inbox host only and last in the run.
  • It creates the repo as the private account over the lane's own SSH, then moves out/orcad-template aside.
  • It switches native modules to Electron's runtime, builds the e2e app, and runs the same spec against the descriptor.
  • The descriptor parser accepts the new cell id.
• Downgrade: tests/e2e/cross-version-wire/managed-orcad-convert-downgrade.unit.test.ts loads v1.4.218's own normalizeSshTarget and SshConnectionStore from a tagged checkout.
  • The host this build persists (fence in orcadFence, no owner) must still be listed with its relay endpoint.
  • This build's visibleRepos hides the retained project, which that release's unfiltered repos:list still returns.
• One e2e-only product hook: ORCA_E2E_ROLLOUT_FLAGS_FILE, read on every rollout flag check and honored only when ORCA_E2E_USER_DATA_DIR is set (the gate the other ORCA_E2E_* variables use). The retirement flag otherwise only arrives through the hardcoded campaign fetch, so a test couldn't switch it on between two connects.

Why

The conversion reads the app's global SSH connection manager and target registry, so only the real app can drive it end to end. Running the same spec against Docker and a Windows host shows the conversion the same way on both kinds of host. The downgrade check uses the cross-version harness so the old build's own code decides visibility, not a re-implementation of it.

Linked Issue

Part of the Node-runtime convergence (#16741), Phase 3. Stacked on #24979.

Visual Proof

N/A: tests and CI.

Testing

• Locally: the downgrade cross-version test (2 tests against a v1.4.218 checkout), the rollout override tests, the host-cell tests, and the workflow and routing contract suites (42 files, 388 tests). Lint, the gate and the e2e typecheck are clean.

• The Docker and Windows cells run in this PR's CI.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

[pullfrog]

Caution

The Windows host lane cannot provision the conversion cell this PR adds: $cells now holds six entries, but those are passed as -Accounts 6 to a script whose parameter is capped at 5. The x64/inbox ssh-windows-hosts job fails before any test runs.

Reviewed changes

• New e2e spec ssh-orcad-auto-convert.spec.ts — real-host proof that a relay-era target converts to managed orcad on connect: relay era (managedServer kind:'relay' / reason:'orcad_unavailable') seeds a repo, folder workspace and dormant tab; after the template is copied in, a reconnect reaches managed and the new server's repo.list / folderWorkspace.list / session.tabs.listAll contain those rows; the cutover journal moves destination-committed → source-retired once orcad-source-retirement is on.
• New host helper orcad-convert-host.ts — resolves the docker fixture or a Windows host-cell descriptor.
• Linux CI — new orcad-auto-convert-docker job builds the linux-x64-glibc template outside the default lookup and runs the spec; registered as a dedicated spec across the job-selection, source-routing, sharding, and release-permission contract scripts.
• Windows CI — new orcad-convert cell (x64/inbox only, appended last because it switches native modules to Electron) plus descriptor-parser and relay-lane guard updates.
• Downgrade unit test — loads v1.4.218's own normalizeSshTarget / SshConnectionStore and pins that this build's orcadFence keeps the host visible over its relay while visibleRepos hides the retained repo.
• One product hook — readE2ERolloutConfigOverride, read on every isRolloutFlagActive but gated on ORCA_E2E_USER_DATA_DIR, so production is unaffected.

The conversion mechanism itself reads sound and the assertions are tied to the real server catalog rather than a re-implementation. Two issues with the lane wiring would prevent the new coverage from running as intended.

Technical details — Windows cell count exceeds the provider's account cap

# The provider rejects the sixth account

## Affected sites
- `.github/workflows/ssh-windows-hosts.yml:156` — appends `orcad-convert`, making `$cells.Count` 6 for x64/inbox.
- `.github/workflows/ssh-windows-hosts.yml:169` — `-Accounts $cells.Count` passed to `prove-preview-openssh.ps1`.
- `config/ci/windows-ssh-provider/preview-ssh/prove-preview-openssh.ps1:5` — `[ValidateRange(1,5)][int]$Accounts=1`.
- `config/ci/windows-ssh-provider/preview-ssh/prove-preview-openssh.ps1:35` — account names derive 1:1 from `$Accounts`.

## Required outcome
- The x64/inbox job provisions six private accounts and runs the conversion cell.

## Suggested approach
- Widen `ValidateRange` to admit six (e.g. `1,6`), or avoid consuming a sixth slot. The provider already
  derives account names from `$Accounts`, so widening the range is sufficient.

Technical details — dedicated Docker job is skipped for test-only edits

# ORCAD_AUTO_CONVERT_E2E_SPEC missing from e2e_needs_build

## Affected sites
- `config/scripts/ci-e2e-job-selection.mjs:43` — new dedicated spec constant.
- `config/scripts/ci-e2e-job-selection.mjs:85-90` — `e2e_needs_build` OR-list names `dockerSpecs`, `LOCALHOST_SSH_E2E_SPEC` and `ORCAD_SERVE_MODE_SWITCH_E2E_SPEC`, but not the new spec.
- `config/scripts/ci-e2e-job-selection.test.mjs:31-37` — build-prerequisite case does not cover either orcad spec.
- `.github/workflows/e2e.yml:560` — `orcad-auto-convert-docker.if` cannot compensate: its `needs` are skipped.

## Required outcome
- A PR that changes only `tests/e2e/ssh-orcad-auto-convert.spec.ts` (or `orcad-convert-host.ts`) still runs the
  `orcad-auto-convert-docker` job.

## Suggested approach
- Add `spec === ORCAD_AUTO_CONVERT_E2E_SPEC` to the `e2e_needs_build` `specs.some(...)` list, and extend the
  `ci-e2e-job-selection.test.mjs` iteration to assert it (as `ORCAD_SERVE_MODE_SWITCH_E2E_SPEC` already is in the
  production list).

## Open questions for the human
- Is the Docker job intentionally gated on `ssh_source_changed == 'true'` (so it runs on any SSH source change),
  unlike `orcad-serve-mode-switch`? If so that is only a CI-cost decision; the test-only gap above still applies
  when no source changes.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

This dedicated spec depends on build/prepare-native-cache like ORCAD_SERVE_MODE_SWITCH_E2E_SPEC, but it was not added to classifyE2eJobs's e2e_needs_build specs.some(...) list (lines 85-90). A PR that only edits tests/e2e/ssh-orcad-auto-convert.spec.ts (or orcad-convert-host.ts) yields e2e_needs_build=false, so build/prepare-native-cache skip and the dependent orcad-auto-convert-docker job is skipped despite contains(inputs.test_files, …) being true. Add spec === ORCAD_AUTO_CONVERT_E2E_SPEC there and cover it in ci-e2e-job-selection.test.mjs's build-prerequisite case.

Technical details

# Dedicated Docker job never runs on test-only edits

## Affected sites
- `config/scripts/ci-e2e-job-selection.mjs:85-90` — `e2e_needs_build` list omits the new spec.
- `config/scripts/ci-e2e-job-selection.test.mjs:31-37` — build-prerequisite iteration omits both orcad specs.
- `.github/workflows/e2e.yml:560` — job `if` cannot rescue a skipped `needs`.

## Required outcome
- Editing only the spec or its helper still runs `orcad-auto-convert-docker`.

## Suggested approach
- Add `spec === ORCAD_AUTO_CONVERT_E2E_SPEC` to the OR-list and extend the test iteration.

[pullfrog]

ℹ️ No new issues in the new commits. The Windows provisioning blocker from the prior review is fixed; one earlier thread (the dedicated Docker job's e2e_needs_build gating) is still open and unaddressed, so this run cannot approve.

Reviewed changes

• Windows conversion cell can provision — prove-preview-openssh.ps1 raises the private-account cap from five to six ([ValidateRange(1,6)]), so the x64/inbox lane that appends orcad-convert no longer fails PowerShell parameter binding before any cell runs.
• Account-cap contract test — ssh-windows-hosts-workflow.test.mjs now asserts the workflow appends orcad-convert and that the provisioner's cap is at least WINDOWS_HOST_CELL_IDS.length + WINDOWS_ORCAD_CELL_IDS.length + 1, so the count can't silently drift past the range again.
• Spec reads the host's session partition — the dormant-tab check in ssh-orcad-auto-convert.spec.ts now calls window.api.session.get(toSshExecutionHostId(remote.targetId)) instead of the local partition, matching how ssh-relay-session.ts writes an SSH worktree's workspace session.
• Packaged builds refuse the E2E rollout override — readE2ERolloutConfigOverride takes an isPackaged flag defaulting to !hasAppEnvironment() || getAppEnvironment().isPackaged(), so an env-named flags file cannot move rollout flags in a shipped build; tests cover the packaged, unpackaged, and missing-file cases.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The prior review's one open thread — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• Convert poll reports the full relay state on timeout — tests/e2e/ssh-orcad-auto-convert.spec.ts replaces the toMatchObject({ kind: 'managed' }) poll with an isManaged helper that returns 'managed' or JSON.stringify(server), so a timeout failure shows why the host stayed on the relay rather than a bare matcher diff. Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• Require the relay to list no terminals before the converting connect — tests/e2e/ssh-orcad-auto-convert.spec.ts now polls window.api.pty.listSessions({ connectionId }) to '[]' after the shell exits, so the reconnect that triggers conversion starts from a state the relay has confirmed is terminal-free. pty:listSessions routes the scoped call to the same provider.listProcesses() the conversion gate's relay lister uses (orcad-migration-relay-pty-lister.ts), so this is a faithful precondition, not a local-only shadow. If a relay PTY lingers, the poll fails with the relay's actual session JSON rather than surfacing later as an opaque conversion timeout. Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commits. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• The terminal gate's lease input is now asserted before conversion — tests/e2e/ssh-orcad-auto-convert.spec.ts polls the target's persisted sshRemotePtyLeases until none read attached/detached, mirroring the live-lease filter in orcad-migration-terminal-gate.ts:25. Together with the earlier pty.listSessions === '[]' poll (the relay's process list, which keeps the expired-lease path from blocking as unverifiable), both gate inputs are now proven before the reconnect.
• The convert poll's timeout failure names the leases — a targetLeases helper is extracted and reused, and the non-managed branch now returns JSON.stringify({ server, leases }), so a timeout shows why the host stayed on the relay.
• The convert poll timeout drops from 8 minutes to 30 seconds — the removed CONVERT_TIMEOUT_MS is replaced by a fixed 30_000. This is safe: ssh-connect-flow.ts:172 awaits decideHostServer (and publishManagedServerConnect broadcasts) before window.api.ssh.connect resolves, so the poll is only waiting on the renderer broadcast, not on the conversion.

Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• The relay era now ends with no relay shell left to respawn — tests/e2e/ssh-orcad-auto-convert.spec.ts switches to the local worktree (switchToWorktree(page, localWorktreeId)) before sending exit, then creates the dormant session tab after the exit and both gate polls, with { activate: false } only. Previously the tab was created up front with pendingActivationSpawn: true; now it is created while its worktree is hidden, so it never mounts a shell. Closing the exited tab can no longer activate and spawn a live relay shell on the remote worktree, which would otherwise keep the host on the relay. Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• Settles before the converting connect — tests/e2e/ssh-orcad-auto-convert.spec.ts now waits 5s after copying the template and re-asserts that pty.listSessions is empty and no lease reads attached/detached, catching a relay shell that starts after the earlier gate polls have already passed.
• Names the tabs a lingering shell belongs to — the seeded tab's id is captured via getActiveTabId, and both it and the dormant sessionTabId are included in the pre-convert snapshot and the convert-poll failure JSON, so a timeout shows which sessions a resurrected relay shell is tied to.

Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• The session tab is now the exited relay tab — tests/e2e/ssh-orcad-auto-convert.spec.ts drops the createTab(remote.worktreeId, …, { activate: false }) dormant tab and instead captures the active terminal tab (getActiveTabId) as sessionTabId, runs the marker and exit in it, then asserts that same id appears in the host's session partition and in the managed server's session.tabs.listAll after conversion. Any tab that mounts starts a shell, so reusing the tab already exited removes the risk that the "dormant" tab mounts and blocks the conversion; the pre-convert snapshot and poll failure JSON now carry only sessionTabId.

Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• The converted session tab is now an editor tab — tests/e2e/ssh-orcad-auto-convert.spec.ts opens <remoteRepo>/README.md via store.openFile on the remote worktree instead of reusing the exited relay terminal tab. Because editor tabs never mount a shell, this removes the last way the relay era could respawn a terminal and hold the host back, while still exercising session migration: the spec asserts the host's session partition includes the file path, and the managed server's session.tabs.listAll contains it after conversion. Editor rows are part of the orcad workspace-session migration (orcad-destination-workspace-session.ts / orcad-source-workspace-session-fragments.ts), so the assertion is on the migrated session rather than a local shadow. The terminal is still run and exited only to satisfy the conversion gate; the header comment and poll-failure JSON were updated to match.

Test-only; no product surface.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• Refused conversions now log their blockers — src/main/ssh/orcad-runtime-conversion.ts replaces the fenced/refuse ternary in fenceOrResume with an explicit early return; on the refusal path it console.warns the preflight blocker codes (and dependencies for orcad_migration_dependent_state) before returning refuse(...). The connect still surfaces only result.reason, so this is main-process support diagnostics. The success path is unchanged, and the [ssh]-prefixed console.warn matches the convention used across src/main/ssh.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the newest commit. The one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• Pre-convert diagnostics now print both session partitions — tests/e2e/ssh-orcad-auto-convert.spec.ts adds a console.log that reads the host partition (window.api.session.get(hostId)) plus the local partition's fields that mention the remote worktree, beside the existing census-input log, right before the converting connect. Diagnostic-only; no assertion or app behavior changes.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

This run hit its time limit while still working, so it stopped before finishing.

Give runs longer with --timeout=2h (or --notimeout) in this repo's instructions — or raise the workflow's timeout input if it sets one, since that input wins. A smaller PR or a lower effort also finishes sooner.

Repo settings → · Flags →

agent run timed out after 1h

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the new commits. Reviewed the three product fixes and the spec diagnostics; the one open thread from the initial review — the dedicated Docker job's e2e_needs_build gating (config/scripts/ci-e2e-job-selection.mjs:85-90) — is still unaddressed, so this run cannot approve.

Reviewed changes

• A converted host's managed state now reaches the renderer — sshConnectionStatesEqual also compares managedServer and plainSsh (via JSON.stringify), so a connect that ends on the same status/epoch it set up under no longer gets dropped by the store's dedupe; the function is extracted into ssh-connection-state-equality.ts, both callers are updated, and store-level tests cover the setting-up → managed transition.
• Port-0 forwards report the port the OS bound — Ssh2PortForwardProvider reads server.address().port after listen, so OrcadManagedTunnelManager.start (which requests port 0 for an OS-assigned tunnel) records a usable localPort for pairing instead of 0.
• Out-of-scope focus no longer blocks conversion — countUnsupportedSessionState stops counting the source host partition's activeWorktreeId/activeWorkspaceKey when they point at another host's workspace; that scalar is a copy of client-wide focus and is not carried anyway (an in-scope copy is). Covered by a new census test that fails before the change.
• Conversion poll regains its budget and richer stall diagnostics — the spec's poll timeout returns to 8 * 60_000 (CONVERT_TIMEOUT_MS) and now reports the connect's own result, main's managed state, the cutover journal phase, and both session partitions on timeout; serverCall prints the response in its failure message.
• Migrated editor tab is host-stamped — the spec calls setActiveWorktree(worktreeId, sshHostId) before openFile, matching a sidebar click, so the tab is attributed to the remote host and carried by the workspace-session migration.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the two commits pushed during the prior review. They are test-only robustness changes; the earlier open thread (the dedicated Docker job's e2e_needs_build gating) remains unaddressed, so this run cannot approve.

Reviewed changes

• Server calls get a longer budget — serverCall now forwards params and sets timeoutMs: 120_000, because a fresh managed server's first session inventory restores every migrated tab and can outlast the default call timeout. Both the preload bridge (runtime-environments-bridge.ts) and the main IPC handler accept params/timeoutMs.
• Session-tab assertion is scoped to the converted worktree — the spec calls session.tabs.list with { worktree: 'id:<worktreeId>' } instead of session.tabs.listAll, matching the host RPC method's scoped form (the id: worktree key is the shape mobile clients use).

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Important

The converted-host editor-tab assertion was replaced with a log, so the spec no longer proves the editor-tab migration the PR advertises. The surface it checked (session.tabs.list) is terminal/browser-only and can never contain an editor path, so this reads as a pending server bug but is actually an oracle mismatch.

Reviewed changes

• Editor-tab assertion became a diagnostic log — tests/e2e/ssh-orcad-auto-convert.spec.ts no longer asserts that the managed server lists the migrated README.md; it logs session.tabs.list for the worktree plus the runtime host partition and continues, "pending the server-side fix". Added the toRuntimeExecutionHostId import for the partition read.

ℹ️ Nitpicks

• The spec header still says "the new server lists that repository, folder and editor tab", but the editor tab is no longer asserted. Align the header (and the PR body's session.tabs.listAll claim) once the assertion is restored or the gap is tracked.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

The deleted .toContain(sessionFilePath) targeted session.tabs.list, whose projection carries only terminal and browser tabs — see mobile-session-terminal-projection.ts:11 (RuntimeMobileSessionTerminalTab) and orca-runtime-hydrate-headless-mobile-session-tabs-from-workspace-session.ts:114-128 (snapshot = terminal tabs + browser tabs); the e2e helpers host-session-tabs.ts:24-25 and paired-html-preview-inventory.ts:14-15 state the same. An editor file path therefore could not appear there whether or not the tab migrated, so "the server lists no migrated editor tab" is not evidence of a server-side bug. The log already reads the runtime partition via session.get(toRuntimeExecutionHostId(environment!.id)), so assert the migrated editor row there (or on whatever surface carries openFilesByWorktree) to keep the coverage; if the real plan is to extend the server's session-tab projection to editor tabs, track that follow-up explicitly.

Technical details

# Migrated editor tab is invisible to session.tabs.list

## Affected sites
- `tests/e2e/ssh-orcad-auto-convert.spec.ts:286-294` — assertion replaced by a log.
- `src/main/runtime/mobile-session-terminal-projection.ts:11` — projects only `RuntimeMobileSessionTerminalTab`.
- `src/main/runtime/orca-runtime-hydrate-headless-mobile-session-tabs-from-workspace-session.ts:114-128` — snapshot is terminal tabs + browser tabs only.
- `tests/e2e/helpers/host-session-tabs.ts:24-25`, `tests/e2e/helpers/paired-html-preview-inventory.ts:14-15` — document that `session.tabs.list` carries only terminals.

## Required outcome
- The spec again proves the migrated editor tab reaches the converted host, on a surface that can represent editor tabs, or an explicit tracked follow-up records the missing server capability.

## Suggested approach
- Assert against the runtime host partition already logged, or the destination workspace-session record holding `openFilesByWorktree`.

[pullfrog]

ℹ️ No new issues in the new commits. Both are test-only: a stronger retirement assertion and a diagnostics cleanup. The two earlier open threads — the Docker job's e2e_needs_build gating and the editor-tab oracle mismatch — remain unaddressed, so this run cannot approve.

Reviewed changes

• Retirement is now proven by the dropped source rows — sourceRows(...) counts the relay-era repos/folderWorkspaces by connectionId; the spec asserts {repos:1, folderWorkspaces:1} while the journal is destination-committed, then polls to {repos:0, folderWorkspaces:0} with the journal absent or source-retired once orcad-source-retirement is on.
• Conversion diagnostics removed — drops the logConversionInputs helper and the session-partition console.log now that the cell passes, and simplifies the retirement poll while keeping the compacted-or-source-retired equivalence.
• Header aligned with the oracle — the phase-2 comment now states the editor tab is logged, not asserted.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the new commit. The change is test-only; the two earlier open threads remain unaddressed, so this run cannot approve.

Reviewed changes

• The conversion reconnect fails per step — tests/e2e/ssh-orcad-auto-convert.spec.ts splits reconnect into separate disconnect and connect page.evaluate steps, each raced against a 6-minute timeout. A hung step now throws with main's ssh.getState JSON instead of consuming the whole test budget; a successful disconnect returns '' and the loop proceeds to the connect step, whose resolved managed-server string feeds the poll's diagnostics.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in this delta. It extracts the conversion flow into shared e2e helpers and adds a Docker + Windows test for a relay-era profile that converts on its first connect after upgrading. The two earlier open threads — the Docker job's e2e_needs_build gating and the editor-tab oracle mismatch — remain unaddressed, so this run cannot approve.

Reviewed changes

• Conversion flow extracted into orcad-convert-flow.ts — reconnect, the managed-server poll, the source-row/lease reads, serverCall, and the convert → retain → retire sequence move out of the spec unchanged, so the relay-era cell and the new upgraded-profile cell share one implementation.
• Relay-era profile seeder orcad-upgrade-profile.ts — seedRelayEraProfile writes a fence-less SSH target (normalizeSshTarget, no orcadFence), its repo, project group, folder workspace, and a host-partitioned editor tab into a stopped profile, then the spec relaunches against it.
• New upgraded-profile test — launches once to establish the profile, seeds the relay-era rows, relaunches, and runs the same convert-then-retire assertions; it runs on both Docker and Windows, while the runtime relay-era test is now skipped off Docker (the Windows lane hides host Node).
• Windows trigger paths — ssh-windows-hosts.yml now also fires on orcad-convert-flow.ts and orcad-upgrade-profile.ts.

Verified locally: oxlint and oxfmt --check clean on the four test files; ssh-windows-hosts-workflow, ci-e2e-job-selection, and pr-e2e-gate-contract suites pass (59 tests). The Docker and Windows cells were still running at review time.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in this delta. The commit only tightens the upgraded-profile fixture; the two earlier open threads remain unaddressed, so this run cannot approve.

Reviewed changes

• Seeded relay-era target now matches SshConnectionStore.addTarget — tests/e2e/helpers/orcad-upgrade-profile.ts adds a nextGeneration helper (high-water mark over sshTargetGenerationCounter and the existing targets' generations) and writes configHost, source: 'manual' and that fresh generation through normalizeSshTarget, so the upgraded-profile fixture's target carries the same defaults a real registration would instead of relying on load-time normalization.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in this commit. It is a main-process crash fix plus a diagnostic log; the two earlier open threads — the Docker job's e2e_needs_build gating and the editor-tab oracle mismatch — remain unaddressed, so this run cannot approve.

Reviewed changes

• A stale ssh2 forward no longer crashes main on 'Not connected' — src/main/ssh/ssh2-port-forward-provider.ts wraps client.forwardOut in a try/catch and destroys the local socket when it throws synchronously after the SSH transport has dropped, mirroring the existing async error path; the new case in ssh-port-forward.test.ts stubs that throw and asserts the server's connection handler neither throws nor leaves the socket open.
• The upgraded-profile launch forwards its own SSH logs — tests/e2e/ssh-orcad-auto-convert.spec.ts passes an onStderr handler relaying [ssh]-prefixed main-process chunks on the second launch, which bypasses the fixture's log relay.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the new commit. It fixes the Windows active-slot readiness probe; the two earlier open threads — the dedicated Docker job's e2e_needs_build gating and the editor-tab oracle mismatch — remain unaddressed, so this run cannot approve.

Reviewed changes

• Windows active-slot readiness probe reads through the host script — new readOrcadReadinessNowCommand in orcad-remote-readiness-wait.ts selects the Windows host-script readiness-wait op with no wait vs POSIX head; probeActiveOrcadReadiness and readRemoteOrcadManagedStopTarget now both call it. Previously probeActiveOrcadReadiness called readOrcadReadinessCommand, whose assertPosixHost throws on Windows, so the active-slot probe could never run there; POSIX output is byte-identical to before. A new orcad-remote-windows-commands.test.ts case asserts the second exec is the host-script wait op and would fail before the fix (the throw happened before any exec).

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the new commit. It grants the Windows conversion cell's SSH account the local forwarding the managed tunnel needs. The two earlier threads — the dedicated Docker job's e2e_needs_build gating and the editor-tab oracle mismatch — remain unaddressed, so this run cannot approve.

Reviewed changes

• Only the convert cell's account may open an SSH local forward — ssh-windows-hosts.yml computes $forwarding as 1 only when the last cell is orcad-convert and passes -ForwardingAccounts $forwarding to the provisioner. prove-preview-openssh.ps1 adds a Match User <convert account> block with AllowTcpForwarding local, overriding the global AllowTcpForwarding no, so the managed server's tunnel can pair while every other cell stays forwarding-disabled.
• Contract test pins the wiring — ssh-windows-hosts-workflow.test.mjs asserts the workflow emits $forwarding=if($cells[-1] -eq 'orcad-convert'){1}else{0} and passes -ForwardingAccounts $forwarding.

Verified locally: the generated Match User block passes sshd -t, and sshd -T -C user=<last> resolves allowtcpforwarding local for the last account while a non-last account resolves no; Select-Object -Last 0 emits nothing, so -ForwardingAccounts 0 leaves the config unchanged. The forwarding account is accounts[-1] = Cells[-1] (invoke-pinned-relay-cells.ps1:92), matching the workflow's last-cell check, and AllowTcpForwarding local is documented in the OpenSSH 8.1-era man page, so the Windows inbox baseline supports it.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the JSON-escaping fix. The two earlier open threads — the dedicated Docker job's e2e_needs_build gating and the editor-tab oracle mismatch — remain unaddressed, so this run cannot approve.

Reviewed changes

• Server path assertions now match the JSON-escaped form — tests/e2e/helpers/orcad-convert-flow.ts adds jsonText(value) (JSON.stringify(value).slice(1, -1)) and checks the repo.list and folderWorkspace.list responses against jsonText(host.repoPath) / jsonText(host.folderPath). serverCall returns JSON.stringify(response) where response is a parsed RuntimeRpcResponse object, so a Windows path's backslashes arrive doubled in that text and the raw path no longer matched; the escaped form matches, and Linux paths are unchanged.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}