2ae7c94b

fix: a client that never answers its first agent request is hung up on

a73x 2026-08-22 17:46

Commit message

fix: a client that never answers its first agent request is hung up on

An agent_offer is a declaration, not a capability, and the daemon took
every client's word for it. Measured: ssh on a socket that accepts and
never replies blocks past 8s, where one that accepts and closes falls
through to the next auth method in 2ms. So an offerer that cannot
answer does not degrade forwarding, it wedges it — and eight such dials
fill the channel table against the real offerer too.

The daemon now clocks a channel from its FIRST forwarded request until
the client's first reply. Past 5s it closes the fd — ssh reads the
refusal it would have got from no offerer at all — and clears the
client's offer, so the next dial routes to a peer that answers.

Two things the clock deliberately does not do, each pinned by a test
watched to fire under its mutation:

- It is not anchored on the open. Until ssh asks, the client owes
  nothing, and a working client would lose its offer for ssh's pause.
- It does not run again after one reply. One answer is the proof the
  offer claimed; a later SIGN may wait on a token's touch, and the
  preflight's rule stands — never separate slow from refused.

An honest client already hangs up courteously (agent_close on any
reason it cannot serve). This is the backstop for a peer that does not
speak at all, which is what a browser-authored offer would be.

Pinned end to end as well, with no new fixture: the offerer is a real
`mux -A` whose ssh-agent is under SIGSTOP. The kernel completes the
connect from the listen backlog, so the fail-open preflight lets it
through, and ssh-add in the session is the oracle — the first comes back
inside `timeout 8`, the second is refused in milliseconds. Watched to
fail with the clock disabled. Two traps the leg found: expect needles
matched the pty's echo of the typed command (now split, `mu""te1=`),
and a plain kill cannot reap a stopped agent (the trap CONTs first).

Collab: b316df53

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/server.zig

@@ @@ -334,6 +334,12 @@ const AgentChan = struct { @@
+    id: u32,
+    client: usize,
+    session: usize,
+    /// The answer clock: when the first request was handed to the client,
+    /// until the client's first reply lands. Started by the request and not
+    /// by the open, because until ssh asks the client owes nothing; stopped
+    /// for good by one reply, because that reply is the proof the offer
+    /// claimed (`Server.agent_answer_ms`).
+    answer: union(enum) { unasked, asked: i64, proven } = .unasked,
+};
+/// Whether closing a channel owes its client an `agent_close`. `.silent` is
@@ @@ -620,6 +626,18 @@ pub const Server = struct { @@
+    /// confused with an absent one at a glance, and wraps — `nextAgentId`
+    /// is what keeps a wrap from colliding with a live channel.
+    next_agent_id: u32 = 1,
+    /// How long a client may sit on a channel's FIRST forwarded request
+    /// before the daemon hangs up for it and stops routing to it. An
+    /// `agent_offer` is a declaration, not a capability: a peer that
+    /// offered and cannot answer does not degrade forwarding, it wedges
+    /// it — ssh on a socket that accepts and never replies blocks past 8s
+    /// where one that closes falls through in 2ms (decisions.md). Only the
+    /// first request is clocked: one reply proves the peer speaks for an
+    /// agent, and a later SIGN may legitimately wait on a human's touch.
+    /// Ten times the preflight's 500ms round-trip bound (decisions.md), so
+    /// it never separates slow from refused. A field rather than a const so
+    /// a test does not wait it out.
+    agent_answer_ms: i64 = 5000,
+    stats: Stats = .{},
+    pub const Options = struct {
@@ @@ -1330,6 +1348,7 @@ pub const Server = struct { @@
+            if (self.agent_chans[s] == null) continue;
+            if (fds[agent_chan_base + s].revents != 0) self.serviceAgentChan(s);
+        self.sweepMuteAgentChans();
+        for (0..max_sessions) |si| {
+            if (self.sessions[si] == null) continue;
+            if (fds[agent_listener_base + si].revents & std.posix.POLL.IN != 0) {
@@ @@ -1512,6 +1531,9 @@ pub const Server = struct { @@
+            self.closeAgentChan(s, .notify);
+            return;
+        if (ch.answer == .unasked) {
+            self.agent_chans[s].?.answer = .{ .asked = std.time.milliTimestamp() };
+        }
+        // Drop-on-backpressure, per queueFrame's standing contract: an agent
+        // exchange is one or two KB against an 8 MiB cap, so tripping it
+        // means the peer stopped reading, not that the agent is chatty. A
@@ @@ -1535,6 +1557,24 @@ pub const Server = struct { @@
+    /// Hang up on every channel whose client has sat on its first request
+    /// past `agent_answer_ms`, and take that client's offer away: the next
+    /// dial must route to a peer that answers, or every ssh pays the bound
+    /// before falling through. Granularity is the pump, like checkAwaits.
+    fn sweepMuteAgentChans(self: *Server) void {
+        const now = std.time.milliTimestamp();
+        for (0..max_agent_chans) |s| {
+            const ch = self.agent_chans[s] orelse continue;
+            const since = switch (ch.answer) {
+                .asked => |t| now - t,
+                else => continue,
+            };
+            if (since < self.agent_answer_ms) continue;
+            if (self.clients[ch.client]) |*c| c.agent_offer = false;
+            self.closeAgentChan(s, .notify);
+        }
+    }
+    /// Close every channel this client owns, silently: the peer that would
+    /// be told is the one that has gone. Called from dropClient, which is
+    /// every way a client can leave.
@@ @@ -2427,7 +2467,10 @@ pub const Server = struct { @@
+            .agent_offer => {
+                // Re-sent after every attach, so this is idempotent by
+                // design: a redial re-offers on a slot that may already be
+                // flagged, and nothing here is allowed to care. That
+                // includes an offer sweepMuteAgentChans took away — a
+                // reattach may bring a working agent, and a mute one costs
+                // one more agent_answer_ms per attach, not per dial.
+                self.clients[i].?.agent_offer = true;
+            },
+            .agent_data => {
@@ @@ -2446,6 +2489,9 @@ pub const Server = struct { @@
+                    self.closeAgentChan(s, .notify);
+                    return;
+                // A reply proves; a volley before any question does not, or
+                // a mute peer clears the clock by talking first.
+                if (self.agent_chans[s].?.answer == .asked) self.agent_chans[s].?.answer = .proven;
+                // The daemon's one deliberate blocking write, and it is not
+                // the doctrine's exception it looks like. "Never block on a
+                // client" holds because a client is a stranger across a
+    try std.testing.expect(srv.agent_chans[0] == null);
+/// Test helper: a channel brought to the moment the answer clock starts.
+fn openAndAsk(
+    alloc: std.mem.Allocator,
+    srv: *Server,
+    client_fd: std.posix.fd_t,
+    agent_fd: std.posix.fd_t,
+) !u32 {
+    const open = (try awaitFrame(alloc, srv, client_fd, .agent_open, 200)) orelse
+        return error.NoAgentOpen;
+    defer open.deinit(alloc);
+    const id = try proto.decodeAgentId(open.payload);
+    try proto.writeAllFd(agent_fd, "req");
+    const data = (try awaitFrame(alloc, srv, client_fd, .agent_data, 200)) orelse
+        return error.RequestNeverForwarded;
+    data.deinit(alloc);
+    return id;
+}
+test "Server: an offerer that never answers its first request is hung up on and stops offering" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const sock_path = try std.fmt.allocPrint(alloc, "{s}/agentmute.sock", .{tmp.path()});
+    defer alloc.free(sock_path);
+    var srv = try Server.init(alloc, .{ .sock_path = sock_path, .shell = "/bin/cat" });
+    defer srv.deinit();
+    srv.agent_answer_ms = 150;
+    const c = try std.net.connectUnixSocket(sock_path);
+    defer c.close();
+    try attachOffering(&srv, c.handle, 0, "");
+    const path = srv.ses(0).agent_path orelse return error.NoAgentSocket;
+    const agent = try std.net.connectUnixSocket(path);
+    defer agent.close();
+    const id = try openAndAsk(alloc, &srv, c.handle, agent.handle);
+    // The client says nothing. Measured (decisions.md): ssh on a socket
+    // that accepts and never replies blocks past 8s; on one that accepts
+    // and closes it falls through to its next auth method in 2ms. So the
+    // daemon's answer to silence is the close the client should have sent.
+    var buf: [16]u8 = undefined;
+    const n = try pumpUntilReadable(&srv, agent.handle, &buf, 200);
+    try std.testing.expectEqual(@as(?usize, 0), n);
+    try std.testing.expect(srv.agent_chans[0] == null);
+    // The client is told, like any other far-end close it did not ask for.
+    const closed = (try awaitFrame(alloc, &srv, c.handle, .agent_close, 200)) orelse
+        return error.NoAgentClose;
+    defer closed.deinit(alloc);
+    try std.testing.expectEqual(id, try proto.decodeAgentId(closed.payload));
+    // And it is no longer an offerer: the next dial must not route here
+    // again, or every ssh pays the bound before falling through.
+    try std.testing.expect(!srv.clients[0].?.agent_offer);
+    const again = try std.net.connectUnixSocket(path);
+    defer again.close();
+    try std.testing.expectEqual(@as(?usize, 0), try pumpUntilReadable(&srv, again.handle, &buf, 60));
+    try std.testing.expectEqual(@as(u32, 1), srv.agent_refused_no_offer);
+}
+test "Server: a channel that has answered once is never timed out" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const sock_path = try std.fmt.allocPrint(alloc, "{s}/agentslow.sock", .{tmp.path()});
+    defer alloc.free(sock_path);
+    var srv = try Server.init(alloc, .{ .sock_path = sock_path, .shell = "/bin/cat" });
+    defer srv.deinit();
+    srv.agent_answer_ms = 150;
+    const c = try std.net.connectUnixSocket(sock_path);
+    defer c.close();
+    try attachOffering(&srv, c.handle, 0, "");
+    const path = srv.ses(0).agent_path orelse return error.NoAgentSocket;
+    const agent = try std.net.connectUnixSocket(path);
+    defer agent.close();
+    const id = try openAndAsk(alloc, &srv, c.handle, agent.handle);
+    // One reply proves the client speaks for an agent.
+    var resp: [proto.agent_id_len + 4]u8 = undefined;
+    @memcpy(resp[0..proto.agent_id_len], &proto.encodeAgentId(id));
+    @memcpy(resp[proto.agent_id_len..], "resp");
+    try proto.writeFrame(c.handle, .agent_data, &resp);
+    var buf: [64]u8 = undefined;
+    _ = (try pumpUntilReadable(&srv, agent.handle, &buf, 200)) orelse return error.NoReply;
+    // A second request the client takes its time over — a SIGN against a
+    // token waiting for a touch. The bound is for a peer that cannot
+    // answer, and must not separate slow from refused (the preflight's
+    // rule, decisions.md): this is the arm that would pass silently if the
+    // clock were anchored on the open or re-armed per request.
+    try proto.writeAllFd(agent.handle, "req2");
+    const fwd = (try awaitFrame(alloc, &srv, c.handle, .agent_data, 200)) orelse
+        return error.RequestNeverForwarded;
+    fwd.deinit(alloc);
+    try std.testing.expectEqual(@as(?usize, null), try pumpUntilReadable(&srv, agent.handle, &buf, 100));
+    try std.testing.expect(srv.agent_chans[0] != null);
+    try std.testing.expect(srv.clients[0].?.agent_offer);
+}
+test "Server: bytes a client sends before it was asked prove nothing" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const sock_path = try std.fmt.allocPrint(alloc, "{s}/agenteager.sock", .{tmp.path()});
+    defer alloc.free(sock_path);
+    var srv = try Server.init(alloc, .{ .sock_path = sock_path, .shell = "/bin/cat" });
+    defer srv.deinit();
+    srv.agent_answer_ms = 150;
+    const c = try std.net.connectUnixSocket(sock_path);
+    defer c.close();
+    try attachOffering(&srv, c.handle, 0, "");
+    const path = srv.ses(0).agent_path orelse return error.NoAgentSocket;
+    const agent = try std.net.connectUnixSocket(path);
+    defer agent.close();
+    const open = (try awaitFrame(alloc, &srv, c.handle, .agent_open, 200)) orelse
+        return error.NoAgentOpen;
+    defer open.deinit(alloc);
+    const id = try proto.decodeAgentId(open.payload);
+    // Unsolicited bytes on the fresh channel. A reply is the proof; a
+    // volley before any question is not, or a mute peer clears the clock
+    // by talking first and then wedging the real request.
+    var eager: [proto.agent_id_len + 2]u8 = undefined;
+    @memcpy(eager[0..proto.agent_id_len], &proto.encodeAgentId(id));
+    @memcpy(eager[proto.agent_id_len..], "hi");
+    try proto.writeFrame(c.handle, .agent_data, &eager);
+    var buf: [64]u8 = undefined;
+    _ = (try pumpUntilReadable(&srv, agent.handle, &buf, 200)) orelse return error.NotForwarded;
+    // Then ssh asks and the client goes quiet: the clock must still run.
+    try proto.writeAllFd(agent.handle, "req");
+    const fwd = (try awaitFrame(alloc, &srv, c.handle, .agent_data, 200)) orelse
+        return error.RequestNeverForwarded;
+    fwd.deinit(alloc);
+    try std.testing.expectEqual(@as(?usize, 0), try pumpUntilReadable(&srv, agent.handle, &buf, 200));
+    try std.testing.expect(!srv.clients[0].?.agent_offer);
+}
+test "Server: a channel nobody has asked anything on is not timed out" {
+    const alloc = std.testing.allocator;
+    var tmp = try TmpDir.make();
+    defer tmp.cleanup();
+    const sock_path = try std.fmt.allocPrint(alloc, "{s}/agentidle.sock", .{tmp.path()});
+    defer alloc.free(sock_path);
+    var srv = try Server.init(alloc, .{ .sock_path = sock_path, .shell = "/bin/cat" });
+    defer srv.deinit();
+    srv.agent_answer_ms = 150;
+    const c = try std.net.connectUnixSocket(sock_path);
+    defer c.close();
+    try attachOffering(&srv, c.handle, 0, "");
+    const path = srv.ses(0).agent_path orelse return error.NoAgentSocket;
+    const agent = try std.net.connectUnixSocket(path);
+    defer agent.close();
+    const open = (try awaitFrame(alloc, &srv, c.handle, .agent_open, 200)) orelse
+        return error.NoAgentOpen;
+    open.deinit(alloc);
+    // ssh dialled and has not asked yet. The client owes nothing until it
+    // has been handed a request, so a clock anchored on the open would
+    // hang up on a working client for the peer's pause.
+    var buf: [16]u8 = undefined;
+    try std.testing.expectEqual(@as(?usize, null), try pumpUntilReadable(&srv, agent.handle, &buf, 100));
+    try std.testing.expect(srv.agent_chans[0] != null);
+    try std.testing.expect(srv.clients[0].?.agent_offer);
+}
+// Forces semantic analysis of every pub decl under `zig build test`, so an
+// unreferenced decl must at least compile (the silent-module-loss hazard,
+// decisions.md). Pub decls only: std.meta.declarations sees nothing private.

test/e2e.sh

Old		New
@@ -1288,6 +1288,9 @@ cleanup() {
1288	# the leak sweep's business, but they are daemons this file forked: left	1288	# the leak sweep's business, but they are daemons this file forked: left
1289	# alive they outlive the suite holding a private key, which is the one	1289	# alive they outlive the suite holding a private key, which is the one
1290	# kind of leak worth chasing even on a green run.	1290	# kind of leak worth chasing even on a green run.
		1291	# CONT first: the mute-offerer leg holds this agent under SIGSTOP, and
		1292	# a stopped process does not see SIGTERM until it runs again.
		1293	[ -n "$AGENT48PID" ] && kill -CONT "$AGENT48PID" 2>/dev/null \|\| true
1291	[ -n "$AGENT48PID" ] && kill "$AGENT48PID" 2>/dev/null \|\| true	1294	[ -n "$AGENT48PID" ] && kill "$AGENT48PID" 2>/dev/null \|\| true
1292	[ -n "$AGENT49APID" ] && kill "$AGENT49APID" 2>/dev/null \|\| true	1295	[ -n "$AGENT49APID" ] && kill "$AGENT49APID" 2>/dev/null \|\| true
1293	[ -n "$AGENT49BPID" ] && kill "$AGENT49BPID" 2>/dev/null \|\| true	1296	[ -n "$AGENT49BPID" ] && kill "$AGENT49BPID" 2>/dev/null \|\| true
@@ -1516,6 +1519,9 @@ cleanup() {
1516	# agent forwarding: the nested-agent leg and the three no-offer captures.	1519	# agent forwarding: the nested-agent leg and the three no-offer captures.
1517	rm -f "$OUT.agtnest" "$OUT.agtnest.err" "$OUT.agtnest.log" "$OUT.anoag" \	1520	rm -f "$OUT.agtnest" "$OUT.agtnest.err" "$OUT.agtnest.log" "$OUT.anoag" \
1518	"$OUT.anoag2" "$OUT.anoag3"	1521	"$OUT.anoag2" "$OUT.anoag3"
		1522	# agent forwarding: the mute-offerer leg.
		1523	rm -f "$OUT.agtmute" "$OUT.agtmute.err" "$OUT.agtmute.log" "$OUT.agtmute.env" \
		1524	"$OUT.agtmute.d"
1519	# the CLI wall: both halves (cw, wc) — captures, injections and stop files.	1525	# the CLI wall: both halves (cw, wc) — captures, injections and stop files.
1520	rm -f "$OUT.cwa" "$OUT.cwa.err" "$OUT.cwall.d" "$OUT.cwb" "$OUT.cwb.err" \	1526	rm -f "$OUT.cwa" "$OUT.cwa.err" "$OUT.cwall.d" "$OUT.cwb" "$OUT.cwb.err" \
1521	"$OUT.cwcap" "$OUT.cwcap.err" "$OUT.cwinj" "$OUT.cwpc" "$OUT.cwst" \	1527	"$OUT.cwcap" "$OUT.cwcap.err" "$OUT.cwinj" "$OUT.cwpc" "$OUT.cwst" \
@@ -7542,6 +7548,7 @@ kill "$AGENT49BPID" 2>/dev/null \|\| true
7542	AGENT49BPID=""	7548	AGENT49BPID=""
7543	ok "agent forwarding: the agent that answers is whoever typed last"	7549	ok "agent forwarding: the agent that answers is whoever typed last"
7544		7550
		7551
7545	# ---- a mouse report at the UNZOOMED wall is discarded, not typed --------	7552	# ---- a mouse report at the UNZOOMED wall is discarded, not typed --------
7546	#	7553	#
7547	# The wall asks its own terminal for mouse reporting now, so reports reach	7554	# The wall asks its own terminal for mouse reporting now, so reports reach
@@ -7825,6 +7832,86 @@ assert_stopped "$SOCK50" "$D48PID" "wall mouse" "$OUT.wmstop"
7825	D48PID=""	7832	D48PID=""
7826	ok "a drag copies on release, and a click copies nothing"	7833	ok "a drag copies on release, and a click copies nothing"
7827		7834
		7835	# --- an offerer that cannot answer is hung up on, and ssh falls through ----
		7836	#
		7837	# An agent_offer is a declaration, not a capability (decisions.md
		7838	# 2026-08-22). The offerer here is a real `mux -A` whose agent is a real
		7839	# ssh-agent under SIGSTOP: the kernel still completes the connect from the
		7840	# listen backlog, so the -A preflight — which fails OPEN on silence, by
		7841	# design — lets the client through, and every request the session forwards
		7842	# to it then vanishes. That is the mute peer the daemon's answer clock
		7843	# exists for, produced with nothing but the binaries this suite already
		7844	# requires.
		7845	#
		7846	# Measured by hand for the issue: ssh-add against a socket that accepts and
		7847	# never replies blocks past 8s, against one that accepts and closes it
		7848	# fails in 2ms. So the two things asserted are the two halves of the fix:
		7849	# the FIRST ssh-add comes back inside `timeout 8` (the daemon closed the
		7850	# channel for the client that would not), and the SECOND is refused in
		7851	# milliseconds (the offer was taken away, so nobody routes to the mute
		7852	# client again and ssh pays nothing).
		7853	"$MUXD" run --sock "$SOCK48" --shell /bin/sh > "$OUT.agtmute.d" 2>&1 &
		7854	D42PID=$!
		7855	wait_sock "$SOCK48" "$OUT.agtmute.d" "agent-mute daemon never bound"
		7856	ssh-agent -a "$AGENT48" > "$OUT.agtmute.env" 2>&1
		7857	AGENT48PID=$(sed -n 's/.SSH_AGENT_PID=$[0-9]$.*/\1/p' "$OUT.agtmute.env")
		7858	[ -n "$AGENT48PID" ] \|\| {
		7859	echo "e2e FAIL: agent-mute: ssh-agent printed no pid to stop:"
		7860	cat "$OUT.agtmute.env"; exit 1; }
		7861	kill -STOP "$AGENT48PID"
		7862	set +e
		7863	SSH_AUTH_SOCK="$AGENT48" timeout 60 "$PTYCLIENT" --cols 100 --rows 30 \
		7864	--out "$OUT.agtmute" --err "$OUT.agtmute.err" \
		7865	-- "$MUX" -A --sock "$SOCK48" > "$OUT.agtmute.log" 2>&1 <<'EOF'
		7866	expect \x1b[?1049h 15000
		7867	settle 400 15000
		7868	send timeout 8 ssh-add -l; echo mu""te1=$?\n
		7869	expect mute1= 20000
		7870	send S=$(date +%s%N); ssh-add -l; R=$?; echo mu""te2=$R ms=$(( ($(date +%s%N)-S)/1000000 ))\n
		7871	expect mute2= 15000
		7872	settle 400 15000
		7873	send exit\n
		7874	waitexit 10000
		7875	EOF
		7876	RC=$?
		7877	set -e
		7878	# The agent is resumed before it is killed: a stopped process ignores
		7879	# SIGTERM until it runs again, and the trap's plain kill would leave it.
		7880	kill -CONT "$AGENT48PID" 2>/dev/null \|\| true
		7881	kill "$AGENT48PID" 2>/dev/null \|\| true
		7882	AGENT48PID=""
		7883	# The needles are split in the typed lines (`mu""te1=`) so an expect can
		7884	# only be satisfied by the command's OUTPUT, never by the pty's echo of the
		7885	# command — with an 8s wait in play, matching the echo runs the script
		7886	# ahead into a shell that is still busy. The wedge is checked before the
		7887	# exit code, because a wedged second ssh-add also swallows the `exit`.
		7888	grep -q "mute1=124" "$OUT.agtmute" && {
		7889	echo "e2e FAIL: agent-mute: the first ssh-add wedged for the whole 8s — the"
		7890	echo " daemon never hung up on the client that would not answer:"
		7891	cat -v "$OUT.agtmute"; exit 1; }
		7892	[ "$RC" -eq 0 ] \|\| {
		7893	echo "e2e FAIL: agent-mute: the leg exited $RC:"
		7894	cat "$OUT.agtmute.log"; exit 1; }
		7895	grep -qE "mute1=[1-9]" "$OUT.agtmute" \|\| {
		7896	echo "e2e FAIL: agent-mute: the first ssh-add did not fail at all — something"
		7897	echo " answered for a stopped agent:"
		7898	cat -v "$OUT.agtmute"; exit 1; }
		7899	MUTE2MS=$(sed -n 's/.mute2=[0-9] ms=$[0-9]$./\1/p' "$OUT.agtmute" \| head -1)
		7900	[ -n "$MUTE2MS" ] \|\| {
		7901	echo "e2e FAIL: agent-mute: the second ssh-add reported no timing:"
		7902	cat -v "$OUT.agtmute"; exit 1; }
		7903	# Well under the 5s bound, not merely under 8s: a refusal is the dial being
		7904	# closed at accept, and the only way to take 5s here is to be routed to the
		7905	# mute client again, which means the offer was not cleared.
		7906	[ "$MUTE2MS" -lt 2000 ] \|\| {
		7907	echo "e2e FAIL: agent-mute: the second ssh-add took ${MUTE2MS}ms — the mute"
		7908	echo " client kept its offer and ssh paid the bound again"
		7909	cat -v "$OUT.agtmute"; exit 1; }
		7910	wait_pid_gone "$D42PID" "agent-mute: the session ended and the daemon should follow"
		7911	D42PID=""
		7912	ok "agent forwarding: a mute offerer is hung up on, then no longer offered (${MUTE2MS}ms)"
		7913
		7914
7828		7915
7829	# The long-lived daemon has served every scenario that wanted it; stop it	7916	# The long-lived daemon has served every scenario that wanted it; stop it
7830	# NOW so its allocator verdict is written while the suite is still running	7917	# NOW so its allocator verdict is written while the suite is still running
@@ -7955,8 +8042,15 @@ DPID=""
7955	# supposed to emit are all still present, and the row is a column too wide.	8042	# supposed to emit are all still present, and the row is a column too wide.
7956	# That shipped and was found by hand. This is the check that would have	8043	# That shipped and was found by hand. This is the check that would have
7957	# caught it.	8044	# caught it.
7958	[ "$OK_COUNT" = "64" ] \|\| {	8045	#
7959	echo "e2e FAIL: $OK_COUNT scenario checkpoints ran, the pin says 64 —"	8046	# The 65th is the mute offerer, and no convergence point for the 58th's
		8047	# reason: its subject is whether ssh in the session got an answer, and how
		8048	# fast, which is a side channel no grid carries. Last in the file because
		8049	# it is the one leg that holds an ssh-agent under SIGSTOP, and a trap that
		8050	# has to CONT before it kills is cheaper to reason about with nothing
		8051	# after it.
		8052	[ "$OK_COUNT" = "65" ] \|\| {
		8053	echo "e2e FAIL: $OK_COUNT scenario checkpoints ran, the pin says 65 —"
7960	echo " a scenario was added (update the pin) or silently lost"	8054	echo " a scenario was added (update the pin) or silently lost"
7961	exit 1	8055	exit 1
7962	}	8056	}