Decide what Lock does to a running shell, and say it

Pressing Lock nulled and disposed the vault view model and touched nothing else.
TerminalWorkspace is injected from App.axaml.cs and outlives every lock, so the SSH
connection, the pty and the pump all kept running while the window said "Unlock your
vault" — and since 0500e43 collapsed the WebView while locked, that live session was
invisible as well as unstopped. CloseSessionAsync was reachable in production only from
DisposeAsync, i.e. shutdown. None of this was written down anywhere, so it was neither a
policy nor a bug, which is the actual problem.

Shells now deliberately outlive the lock, and every layer says so.

The reason to prefer this over making Lock a disconnect: locking is what a person does
when they walk away from the machine, which is exactly when a long upgrade, build or
transfer is most likely to be in flight. Ending every shell would make Lock a button that
destroys work, and the predictable response is to stop pressing it and leave the vault
open instead. The idle auto-lock this will grow decides it outright — an unattended
timeout that killed a running job would be worse than the exposure it removes. Closing
the channel also buys less than it looks: the session was authorised at connect time by a
credential the remote verified itself, and no vault key participates in keeping it alive,
so locking cannot retroactively un-authorise it any more than removing a member can.

Stated honestly rather than implied, because the lock screen is what hides it:

- The unlock screen shows how many shells are still connected, and that locking closes
  the vault and not the connections — so a machine still holding authenticated SSH
  channels does not present itself as merely "locked". Shown only when there is something
  to disclose. Quitting is what ends them, and the text admits that.
- The Lock button carries the same thing in a tooltip, since its name implies the
  opposite of what it does to a shell.
- README lists it as a third architecture consequence beside non-retroactive revocation,
  which is the same shape of honest limit; docs/crypto.md §10 records it as a threat-model
  boundary; TerminalWorkspace and LockAsync carry the argument next to the code.

LiveSessionCount deliberately does not count dictionary entries. Nothing removes a
session when the remote closes the channel by itself — RunSessionAsync only drops the
renderer registration — so sessions.Count would report a shell that exited half an hour
ago as still running, on the one screen where a user is deciding whether it is safe to
walk away. A completed Run task is what "the shell is gone" actually looks like. While
locked the number can only fall, since opening a session needs the vault, so a stale
value over-reports rather than under-reports.

Both new tests fail when the policy is reverted: the count test times out against
sessions.Count, and the shell test reports "workspace.LiveSessionCount should be 1 but was
0" when Lock closes sessions. ShellFlowTests also stops building its workspace with a real
SshNetConnectionFactory that nothing ever called, which had made the suite's independence
from the network a coincidence rather than a property.

Verified by hand with a live shell, which nothing had done: a harness mirroring
MainWindow.axaml's 340,* grid with a real NativeWebView, the shipped WebAssets, a real
sshd in a container, and an ISshShellSession decorator recording every window-change the
remote is actually told about. Across lock and unlock, no window-change reached the remote
at all, stty size answered 50 118 before and after, the renderer's own buffer came back
byte for byte with the wrapped line intact, and the session stayed live throughout. A
control run that never hides the WebView behaves identically, so nothing above is startup
or idle behaviour. Keystrokes injected while locked reach nothing: twelve of twelve
SendInput events accepted with the harness confirmed as the foreground window, no probe
character in the remote's output, and a following Ctrl-U answered BEL, so nothing was
queued in the line editor either. A hidden WS_CHILD window is not eligible for keyboard
focus, which is what makes surviving the lock defensible rather than merely convenient.

Correction to a claim made in f80b3d4: terminal.js's guard comment listed "a host that
hides the WebView while the vault is locked" among the paths that reach a degenerate fit.
It does not. Collapsing the control hides a native child window without resizing it, so
the page still reports paneWidth 840 and paneHeight 760 with unchanged cols and rows, no
ResizeObserver callback fires and the fit never runs. Establishing that rather than
assuming it: the same cycle with MINIMUM_FITTABLE_PIXELS patched to 0 — the guard fully
disabled — is equally clean. The guard is still right for minimising and for a splitter
dragged to the edge; it is simply not what makes locking safe, and must not be cited as
though it were.

Recorded, not fixed:

- Nothing closes one terminal from the interface, so a user reading "1 shell is still
  connected" can only act on it by quitting. CloseSessionAsync is tested and correct;
  VaultViewModel discards the session id it would need.
- A session whose remote exits keeps its ISshConnection, and the thread ShellStream parks,
  until the process ends.
- Suspected and seen once: before the harness waited for the window's scale to settle, a
  DPI settle pushed a 2202x1328 pane for a window 1180 logical units wide and a later
  re-push reflowed the wrapped line. Three later runs at RenderScaling 1.00 never showed
  it, so it is filed as a lead, not a finding.
- WebView2 fails to initialise with CO_E_SERVER_EXEC_FAILURE when the host executable
  sits under a very long path. Cost an hour on the harness; relevant to packaging.

tests/DodoSSH.Client.App.Tests/FakeSshConnections.cs

@@ -0,0 +1,86 @@
+using DodoSSH.Client.Ssh;
+
+namespace DodoSSH.Client.App.Tests;
+
+/// <summary>
+/// An SSH layer that connects to nothing and hands out shells that simply stay open.
+/// </summary>
+/// <remarks>
+/// This suite has no network and no <c>sshd</c>; what it needs from a session is only that one can exist
+/// and outlive a lock. The real factory was here before and was never called by anything, which made the
+/// suite's independence from the network a coincidence rather than a property.
+/// </remarks>
+internal sealed class IdleSshConnectionFactory : ISshConnectionFactory
+{
+    /// <inheritdoc />
+    public Task<ISshConnection> ConnectAsync(
+        SshConnectionRequest request,
+        CancellationToken cancellationToken) =>
+        Task.FromResult<ISshConnection>(new IdleConnection(request));
+}
+
+/// <summary>A connection whose shells never end by themselves.</summary>
+internal sealed class IdleConnection(SshConnectionRequest request) : ISshConnection
+{
+    /// <inheritdoc />
+    public bool IsConnected { get; private set; } = true;
+
+    /// <inheritdoc />
+    public HostKeyPresentation HostKey { get; } =
+        new(request.Host, request.Port, "ssh-ed25519", "SHA256:idle");
+
+    /// <inheritdoc />
+    public Task<ISshShellSession> OpenShellAsync(
+        TerminalSize size,
+        CancellationToken cancellationToken) =>
+        Task.FromResult<ISshShellSession>(new IdleShell());
+
+    /// <inheritdoc />
+    public ValueTask DisposeAsync()
+    {
+        IsConnected = false;
+
+        return ValueTask.CompletedTask;
+    }
+}
+
+/// <summary>
+/// A shell that is connected, silent, and ends only when something ends it.
+/// </summary>
+/// <remarks>
+/// Which is what the interesting case looks like from the host's side: a remote sitting in the middle of
+/// a long job produces nothing for minutes and must not be mistaken for one that has exited.
+/// </remarks>
+internal sealed class IdleShell : ISshShellSession
+{
+    /// <inheritdoc />
+    public bool IsOpen { get; private set; } = true;
+
+    /// <inheritdoc />
+    public async ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken)
+    {
+        // Never returns 0 of its own accord: 0 would tell the pump the remote closed the channel, which
+        // is the opposite of what this stands in for.
+        await Task.Delay(System.Threading.Timeout.InfiniteTimeSpan, cancellationToken)
+            .ConfigureAwait(false);
+
+        return 0;
+    }
+
+    /// <inheritdoc />
+    public ValueTask WriteAsync(ReadOnlyMemory<byte> data, CancellationToken cancellationToken) =>
+        ValueTask.CompletedTask;
+
+    /// <inheritdoc />
+    public void Resize(TerminalSize size)
+    {
+    }
+
+    /// <inheritdoc />
+    public ValueTask DisposeAsync()
+    {
+        IsOpen = false;
+
+        return ValueTask.CompletedTask;
+    }
+}

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -57,7 +57,10 @@ public sealed class ShellFlowTests : IAsyncLifetime
                 {
                     ["/terminal"] = new("text/html; charset=utf-8", "<!doctype html>"u8.ToArray()),
                 }),
-            new SshNetConnectionFactory(knownHosts),
+
+            // Idle rather than real: a session in this suite has to be able to exist and to outlive a
+            // lock, and none of it should be able to reach a network.
+            new IdleSshConnectionFactory(),
             TimeProvider.System);
 
         shell = new MainWindowViewModel(
@@ -415,6 +418,68 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.State.ShouldBe(ShellState.Unlocked);
     }
 
+    /// <summary>
+    /// The deliberate half of what Lock does: the vault closes, the shells do not.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// A policy rather than an implementation detail, which is why it is asserted here. Locking is what a
+    /// person does when they walk away from the machine, and that is exactly when a long job is most
+    /// likely to be running — so ending every shell would make Lock destroy work, and an idle auto-lock
+    /// would do it unattended. <c>MainWindowViewModel.LockAsync</c> carries the full argument.
+    /// </para>
+    /// <para>
+    /// The disclosure is asserted along with the behaviour, because the two are the same decision. A
+    /// lock screen that hides the terminal — which it does, the WebView is collapsed while locked — while
+    /// authenticated SSH channels stay open is only defensible if it says so.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task LockingKeepsOpenShellsRunning_AndSaysSoOnTheUnlockScreen()
+    {
+        await UnlockedAsync();
+
+        // Opened on the workspace rather than through Connect, because Connect waits for a renderer to
+        // attach and there is no WebView in this suite. What is under test is what Lock does to a session
+        // that exists, not how it came to exist.
+        await workspace.OpenSessionAsync(
+            new SshConnectionRequest("host.invalid", 22, "dodo", new SshPasswordCredential("irrelevant")),
+            TerminalSize.Default,
+            Token);
+
+        workspace.LiveSessionCount.ShouldBe(1);
+
+        await shell.LockCommand.ExecuteAsync(null);
+
+        shell.State.ShouldBe(ShellState.Locked);
+        shell.Vault.ShouldBeNull("the vault's keys are gone");
+
+        workspace.LiveSessionCount.ShouldBe(1, "the shell was still running, so it kept running");
+
+        shell.HasLiveSessions.ShouldBeTrue();
+        shell.LiveSessionCount.ShouldBe(1);
+        shell.LiveSessionSummary.ShouldBe("1 shell is still connected and still running.");
+
+        // And it survives the unlock too, so the session outlives the whole cycle rather than merely
+        // outliving the disposal.
+        shell.Passphrase = Passphrase;
+        await shell.UnlockCommand.ExecuteAsync(null);
+
+        shell.State.ShouldBe(ShellState.Unlocked);
+        workspace.LiveSessionCount.ShouldBe(1);
+    }
+
+    [Fact]
+    public async Task LockingWithNoOpenShells_DisclosesNothing()
+    {
+        await UnlockedAsync();
+
+        await shell.LockCommand.ExecuteAsync(null);
+
+        shell.LiveSessionCount.ShouldBe(0);
+        shell.HasLiveSessions.ShouldBeFalse("an ordinary lock must not warn about nothing");
+    }
+
     // ---- Helpers ----
 
     private static CancellationToken Token => TestContext.Current.CancellationToken;

tests/DodoSSH.Client.Terminal.Tests/FakeShellSession.cs

@@ -101,6 +101,65 @@ internal sealed class FakeShellSession : ISshShellSession
     }
 }
 
+/// <summary>
+/// Hands out <see cref="FakeShellSession"/>s, so a workspace can be driven with no network.
+/// </summary>
+/// <remarks>
+/// Exists for the session-lifetime tests. Everything else in this suite works on a pump directly; the
+/// workspace is the layer that decides when a session is over, and that decision is what needs a
+/// connection whose shell can be made to end on cue.
+/// </remarks>
+internal sealed class FakeConnectionFactory(long bytesPerShell = long.MaxValue) : ISshConnectionFactory
+{
+    /// <summary>Connections handed out, in order.</summary>
+    internal List<FakeConnection> Connections { get; } = [];
+
+    /// <inheritdoc />
+    public Task<ISshConnection> ConnectAsync(
+        SshConnectionRequest request,
+        CancellationToken cancellationToken)
+    {
+        var connection = new FakeConnection(request, bytesPerShell);
+        Connections.Add(connection);
+
+        return Task.FromResult<ISshConnection>(connection);
+    }
+}
+
+/// <summary>A connection that opens fake shells and records its own disposal.</summary>
+internal sealed class FakeConnection(SshConnectionRequest request, long bytesPerShell) : ISshConnection
+{
+    /// <inheritdoc />
+    public bool IsConnected { get; private set; } = true;
+
+    /// <inheritdoc />
+    public HostKeyPresentation HostKey { get; } =
+        new(request.Host, request.Port, "ssh-ed25519", "SHA256:fake");
+
+    /// <summary>The shell this connection opened, if it opened one.</summary>
+    internal FakeShellSession? Shell { get; private set; }
+
+    /// <summary>Whether the connection was disposed, which is what closing a session must do.</summary>
+    internal bool IsDisposed { get; private set; }
+
+    /// <inheritdoc />
+    public Task<ISshShellSession> OpenShellAsync(TerminalSize size, CancellationToken cancellationToken)
+    {
+        Shell = new FakeShellSession(bytesPerShell);
+
+        return Task.FromResult<ISshShellSession>(Shell);
+    }
+
+    /// <inheritdoc />
+    public ValueTask DisposeAsync()
+    {
+        IsDisposed = true;
+        IsConnected = false;
+
+        return ValueTask.CompletedTask;
+    }
+}
+
 /// <summary>Records frames, and can acknowledge them to keep credit flowing.</summary>
 internal sealed class RecordingTransport : ITerminalTransport
 {

tests/DodoSSH.Client.Terminal.Tests/TerminalWorkspaceTests.cs

@@ -0,0 +1,130 @@
+using DodoSSH.Client.Ssh;
+
+namespace DodoSSH.Client.Terminal.Tests;
+
+/// <summary>
+/// How long a terminal session lives, and what the workspace says about it.
+/// </summary>
+/// <remarks>
+/// The count these tests are about is shown to a user on the unlock screen, as the disclosure that
+/// locking the vault leaves shells running. A wrong number there is not a cosmetic bug: it either hides
+/// a live connection or invents one.
+/// </remarks>
+public sealed class TerminalWorkspaceTests
+{
+    private static readonly TimeSpan Timeout = TimeSpan.FromSeconds(10);
+
+    private static InMemoryTerminalAssetProvider StubAssets() =>
+        new(new Dictionary<string, TerminalAsset>(StringComparer.Ordinal)
+        {
+            [TerminalDataPlane.PagePath] = new("text/html; charset=utf-8", "<!doctype html>"u8.ToArray()),
+        });
+
+    private static SshConnectionRequest Request() =>
+        new("host.invalid", 22, "dodo", new SshPasswordCredential("irrelevant"));
+
+    [Fact]
+    public async Task AnOpenSessionIsReportedAsLive()
+    {
+        var connections = new FakeConnectionFactory();
+
+        await using var workspace = new TerminalWorkspace(
+            StubAssets(), connections, TimeProvider.System);
+
+        workspace.LiveSessionCount.ShouldBe(0);
+
+        await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+
+        workspace.LiveSessionCount.ShouldBe(1);
+
+        await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+
+        workspace.LiveSessionCount.ShouldBe(2);
+    }
+
+    /// <remarks>
+    /// The case a naive <c>sessions.Count</c> gets wrong. Nothing removes the entry when the remote
+    /// closes the channel by itself — the session is still in the dictionary, holding a connection that
+    /// is finished — so counting entries would report a shell that exited as still running. A user
+    /// deciding whether it is safe to walk away is the person that lie is told to.
+    /// </remarks>
+    [Fact]
+    public async Task ASessionWhoseRemoteHasExitedIsNotReportedAsLive()
+    {
+        // A shell with no output to give: its first read returns 0, which is a remote closing the
+        // channel, so the pump finishes on its own with nobody asking it to.
+        var connections = new FakeConnectionFactory(bytesPerShell: 0);
+
+        await using var workspace = new TerminalWorkspace(
+            StubAssets(), connections, TimeProvider.System);
+
+        await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+
+        await WaitUntilAsync(() => workspace.LiveSessionCount == 0);
+    }
+
+    [Fact]
+    public async Task ClosingASessionEndsItAndDisposesItsConnection()
+    {
+        var connections = new FakeConnectionFactory();
+
+        await using var workspace = new TerminalWorkspace(
+            StubAssets(), connections, TimeProvider.System);
+
+        var sessionId = await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+
+        await workspace.CloseSessionAsync(sessionId);
+
+        workspace.LiveSessionCount.ShouldBe(0);
+        connections.Connections.ShouldHaveSingleItem().IsDisposed.ShouldBeTrue();
+    }
+
+    /// <remarks>
+    /// Disposal is the one path that does close sessions, because it is process shutdown. Asserted so
+    /// that the SSH connections are known to be released rather than assumed to be.
+    /// </remarks>
+    [Fact]
+    public async Task DisposingTheWorkspaceClosesEverySession()
+    {
+        var connections = new FakeConnectionFactory();
+
+        var workspace = new TerminalWorkspace(StubAssets(), connections, TimeProvider.System);
+
+        await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+        await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+
+        await workspace.DisposeAsync();
+
+        workspace.LiveSessionCount.ShouldBe(0);
+        connections.Connections.Count.ShouldBe(2);
+        connections.Connections.ShouldAllBe(connection => connection.IsDisposed);
+    }
+
+    /// <remarks>
+    /// Polled rather than awaited on a task, because the point is what an observer of the property
+    /// sees: the pump ends on a thread of its own, and the count has to catch up without anyone
+    /// telling it to.
+    /// </remarks>
+    private static async Task WaitUntilAsync(Func<bool> condition)
+    {
+        var deadline = TimeProvider.System.GetUtcNow() + Timeout;
+
+        while (TimeProvider.System.GetUtcNow() < deadline)
+        {
+            if (condition())
+            {
+                return;
+            }
+
+            await Task.Delay(20, TestContext.Current.CancellationToken);
+        }
+
+        throw new TimeoutException($"The condition was still false after {Timeout}.");
+    }
+}