[OrcaWin]

ELI5

Local-only sessions keep saved SSH targets available without loading the active SSH implementation. Testing a connection loads one shared transport/authentication owner; managed connections load deployment, restoration and compatibility code on demand. A queued quit can stop the remaining loading stages before they initialize an owner.

What Changed

Reuse the existing process manager, credential callbacks, cancellation registry and quit drain. Managed initialization upgrades the same owner, and saved-target restoration still completes before renderer/headless publication. Check committed quit between loading stages and before initialization. Load the public CommonJS SSH2 entry lazily; fixed yields let queued work run between stages. Automation wiring stays behind its existing asynchronous demand import. No protocol or public IPC signature changes.

Head e6987e7581d209974b90ff696119c5ca696b7880 depends on lifecycle #33891 at c427775815e7fac53cf268248403b8524b444f2a. Benchmark-only #33912 was reverted by #34162; measurement programs and reports remain external validation artifacts.

Measurements and tradeoffs

Six alternating fresh Linux Electron process pairs compare the production-built eager lifecycle parent with this head:

• At 3.5 seconds, paired process-tree PSS is 7.08 MiB lower. This is an early initialization snapshot.
• The first transport request costs 34.80 ms more, with 30.85 ms more maximum main-thread delay and 29.60 ms more overlapping IPC delay. Candidate maximum main-delay median is 37.49 ms; observed maximum is 49.25 ms. These observations are fixture-specific, not enforced upper bounds.
• After SSH demand, the memory difference shrinks to about 0.5–0.7 MiB.

Three additional alternating untouched-profile pairs sample 3.5, 30 and 60 seconds. At 60 seconds, paired process-tree PSS is 4.48 MiB lower (range 2.36–11.26 MiB lower), and main-process PSS is 5.99 MiB lower. All final apps retain zero SSH2 CJS files versus 21 eager files through 60 seconds. The 30-second range crosses zero; shared-host load and GC variation limit interpretation. This supports a modest saving for unused SSH in these Linux profiles, not a universal percentage or long-term steady-state guarantee.

Staging and the CommonJS correction do not establish a reliable latency improvement over the prior narrowed loader. Their demonstrated benefit is quit progress: nine independent controls prove a quit queued during SDK evaluation runs before subsequent transport/full/compatibility initialization. SDK evaluation remains synchronous on main, and loaded modules remain for the process lifetime. No historical combined-stack 3% figure is attributed to this implementation.

Validation

• Final loader: 18 focused tests, Node typecheck and lint passed. The prior source separately passed 30 independent SSH/ownership/cancellation controls. Final independent review found no pending introduced blocker; nine pinned factory controls establish staged ordering. Raw audits verified all three six-pair latency cohorts and all 18 untouched-idle snapshots.
• Final production Electron/preload and a matching source-built Linux glibc template passed real Docker OpenSSH deployment, managed connect/browse, same deployment/environment reuse, banner forwarding, disconnect cleanup, reconnect and saved-forward restoration.
• An intentionally incomplete scratch template fails deployment, releases setup publication and refuses browse without a connection. An older installed-template mismatch is not relabeled as final production evidence.
• Graceful final app quit with an active restored forward completed in 135 ms; all eight captured descendants exited and the forward listener refused a new connection. This is a correctness observation, not a comparative timing claim.
• Three final rendered cases passed: relay-era migration/folder/remote CLI and two refused-port/rejected-key Cancel controls. Seven earlier rendered Docker restoration/relaunch/reload/outage/Cancel cases remain attributed to their earlier source.
• Final ORCA_BACKGROUND_LAUNCH=1 pnpm check:changed --maxWorkers=2 --base=c427775815e7fac53cf268248403b8524b444f2a passed 20/20 checks in 832.0 seconds. The lifecycle dependency separately passed 19 checks and hosted CI.
• Final PR CI 40431659881 passed, including five Node 24 shards, cross-version wire checks, packaging and both managed Docker shards. Hostile-host/macOS, WSL, headless and mobile workflows passed. The Windows SSH matrix 40431659897 also passed, including ARM inbox SSH. All 50 non-skipped hosted checks are green; GitHub reports mergeable/clean, non-draft, with no unresolved review thread. No implementation merge has occurred.

Visual Proof

Final hidden CDP screenshots were directly inspected. The managed remote shell returns QA_CLI_READY with a converted folder row and remote explorer; rejected credentials render the specific authentication failure after Cancel. The production deploy/forward/quit harness is separate from this E2E-mode renderer. No test window was shown or focused on the user’s desktop.

Compatibility and limits

Source review, deterministic controls and the stated Linux journeys cover connection ownership, credentials, saved state, folder workspaces and unchanged mixed-version contracts. Native macOS/Windows/WSL and authentication methods are covered where the corresponding workflows actually run. Linux Docker success does not establish every native or mobile journey. Cold managed deployment has functional proof; the timing workload measures the first transport request, not every managed activation path.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer content copied.

[OrcaWin]

Closing after an in-depth source, lifecycle, caller and test review because this implementation does not clear the performance bar in #27143: a free win, or a nonfree gain substantial enough to justify its cost.

The final-head measurements in this PR show a modest saving for unused SSH: 4.48 MiB median process-tree PSS at 60 seconds across three pairs (2.36–11.26 MiB range). The 7.08 MiB figure is the earlier 3.5-second snapshot; after SSH demand, the difference falls to roughly 0.5–0.7 MiB. Meanwhile the first transport request adds 34.80 ms, maximum main-thread delay adds 30.85 ms, and overlapping IPC delay adds 29.60 ms. SDK evaluation remains synchronous on main; the timed transport request also does not cover every managed activation path.

That is not a free improvement, and these savings do not justify the added transport/full/compatibility loading stages, proxy registration and readiness states, cancellation/quit fences, and lifetime ownership spread across 50 changed files plus the lifecycle dependency. The staged quit controls are valuable validation of hazards introduced by deferral; they do not establish a separate functional benefit sufficient to carry this patch. The focused controls and green CI support correctness in their tested scope, but do not change this cost/benefit judgment.

This closes the current implementation on its measured merits, not because of conflicts, missing benchmarks, or a claim that lazy SSH is already shipped. The branch is preserved. A substantially smaller/free version or evidence of a substantially larger whole-path benefit would warrant a new proposal.