Say how far a connection has got while it is still being made

The connecting card set its status string once, when the tab was created, and
never touched it again. Every connection therefore looked identical from the
outside: one three seconds into a key exchange, one waiting out a fifteen-second
timeout against a machine that is asleep, and one that had hung all drew the
same "connecting…". The card now draws the five steps of getting there, each lit
at the moment the handshake reports reaching it, over an amber track that fills
as they finish.

◆ NOTHING ON THE LIST IS INVENTED. Every row changes state because a layer below
it said so, at the instant the thing it names actually began.

That is the whole reason it is worth showing, and it is why most of this commit
is plumbing rather than XAML: there was no progress reporting anywhere in the
stack to hook a step list onto, and a card animating plausible progress would
have been indistinguishable from one that had stopped receiving any.

SshConnectionPhase names four phases and deliberately not more. SSH.NET runs the
entire handshake inside one ConnectAsync and raises exactly one event from the
middle of it — HostKeyReceived, once the key exchange has produced a key to show
— so that event is the only interior moment there is to report. Everything
before it is Reaching and everything after it is Authenticating. A fifth phase
in that assembly would have to be a timer, so there is not one. OpeningShell is
reported by TerminalWorkspace instead, because that is where it happens: the
factory's work ends with an authenticated connection, and asking for a
pseudo-terminal on one is a separate round trip. The SFTP path passes null — a
second connection opened behind an already-open shell has nobody watching a step
list for it.

The card's fifth step, "Starting the terminal", is the renderer wait and lives
in the shell rather than in the SSH assembly, which has never heard of a
renderer. On the first connection after a cold start it is a real wait with a
real failure mode of its own — a missing WebView2 runtime — so a list that began
at "reaching the host" would leave the one wait most likely to hang unnamed.

Amber for the step in flight, and that follows the palette's rule rather than
bending it. Green is what is true and purple is what you can press; a step still
happening is neither, and it is exactly the caveat-worth-reading that amber
exists for. Steps behind it go green as they become true. Nothing animates,
which is the argument TransfersScreen.axaml already makes for its own track,
reaching a screen with far more reason to want a spinner: a spinner is furniture
invented to fill a state nobody measured, and these states are measured, so the
track fills to what has finished and then waits there.

A refusal keeps the step it stopped on, in red, with the ones behind it still
green. That is the half a progress bar could not do, and it is the difference
between "that host is not there" and "that host is there and would not have me"
— a question the reason sentence alone frequently does not settle.

The strip's dot goes amber while a tab is connecting, on both heads. It was
grey, and so is a tab whose shell has exited: the two states in that strip with
the least in common, one worth waiting for and one over. PhoneShell's own
comment already recorded half of this — the dot stopped being green before
anything had answered — and this is the other half.

Progress is raised inline rather than through System.Progress<T>, which captures
whatever synchronisation context it was constructed on and posts to it. That
reads like a convenience and is really a second place the marshalling decision
gets made: silently, differently under a test with no context, and out of order
with respect to the failure that follows a phase. The shell marshals once, in
one handler, through a new optional post parameter on MainWindowViewModel — the
same seam TransfersViewModel already uses, and for the reason its own remark
gives. The three Dispatcher.UIThread.Post calls that predate it are the ones
this suite's comments record as out of reach; they are left alone rather than
swept in here.

Both heads draw the list. They differ in one place: Phone.axaml's mono class
sets a colour and a size along with the family, so the caption rule names its
own family instead of composing the two and asking two rules for one Foreground.
The desktop's mono sets the family alone, which is why ConnectingCard does
compose them. Each head also gains SHOW LOGS beside the button that gives up —
the step list is this attempt and the log is every other one, which is what a
connection taking too long actually raises.

Seven tests, and the two that matter most run against the container rather than
a fake: a real handshake reports its phases in order, and a host-key refusal
never claims to have authenticated. A fake asserting what it was written to
assert would have established nothing about either. The rest cover the tab
advancing while the connection is gated, the step a refusal stops on, and a
phase reported after the user has given up on the tab. 1,861 tests, none
failing.

The Android head's layout is not verified by anything. It compiles, and
compiled bindings mean every new binding path resolves, but that project is not
in DodoSSH.slnx, there is no test project for it and no device here — so unlike
the desktop card, whose shapes the layout harness measures, these rows have not
been drawn. Vertical fit is reasoned, not observed.

tests/DodoSSH.Client.App.Tests/FakeSsh.cs

@@ -40,18 +40,32 @@ internal sealed class FakeSshConnectionFactory : ISshConnectionFactory, ISftpSes
     /// <inheritdoc />
     public async Task<ISshConnection> ConnectAsync(
         SshConnectionRequest request,
+        IProgress<SshConnectionPhase>? progress,
         CancellationToken cancellationToken)
     {
         Requests.Add(request);
 
+        // Before the gate rather than after it, which is what makes this fake useful for the connecting
+        // card: a test that holds Gate open is a connection stuck partway through, and the step list has to
+        // show it stuck on a named step rather than on none.
+        progress?.Report(SshConnectionPhase.Reaching);
+
         if (Gate is { } gate)
         {
             await gate.Task.WaitAsync(cancellationToken).ConfigureAwait(false);
         }
 
-        return Failure is { } failure
-            ? throw failure
-            : new FakeSshConnection(request);
+        if (Failure is { } failure)
+        {
+            throw failure;
+        }
+
+        // Only on the way to succeeding. A failure reported as having authenticated would let a test pass
+        // while the card showed a refused connection getting one step further than it did.
+        progress?.Report(SshConnectionPhase.CheckingHostKey);
+        progress?.Report(SshConnectionPhase.Authenticating);
+
+        return new FakeSshConnection(request);
     }
 
     /// <inheritdoc />

tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs

@@ -143,7 +143,14 @@ public sealed class ShellFlowTests : IAsyncLifetime
             {
                 clipboard.Add(text);
                 return Task.CompletedTask;
-            });
+            },
+
+            // Inline, because this suite has no window and therefore no dispatcher to drain — the same
+            // answer TransferQueueingTests reached, and for the reason its own remark gives: reaching
+            // Dispatcher.UIThread from a test means asserting on a queue owned by whichever class touched
+            // it first. Running the action where it was raised takes the thread out of the question, and
+            // every phase this suite reports is raised on the thread doing the asserting anyway.
+            post: action => action());
 
         return ValueTask.CompletedTask;
     }
@@ -1303,6 +1310,119 @@ public sealed class ShellFlowTests : IAsyncLifetime
         shell.IsConnectingShowing.ShouldBeFalse();
     }
 
+    /// <remarks>
+    /// <para>
+    /// What the card draws while the stretch above is going on. The tab used to carry one line of prose
+    /// fixed at the moment it was created, which made a handshake stuck on a key exchange look exactly like
+    /// one stuck on a dead socket — and made a connection that was progressing look exactly like one that
+    /// was not.
+    /// </para>
+    /// <para>
+    /// The gate is held open on the step the fake reports before it, so this asserts the state the card is
+    /// actually drawn in rather than one it passes through: one step behind, one step lit, three not
+    /// reached. Nothing here waits or polls, which is the other half of the claim — the report arrives on
+    /// the thread that raised it and the tab is up to date in the same turn.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task Connecting_LightsTheStepTheHandshakeHasActuallyReached()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        ssh.Gate = new TaskCompletionSource();
+        var connecting = vault.ConnectCommand.ExecuteAsync(null);
+
+        var tab = shell.Tabs.ShouldHaveSingleItem();
+
+        tab.Steps.Select(step => step.State).ShouldBe(
+        [
+            ConnectionStepState.Done,
+            ConnectionStepState.Running,
+            ConnectionStepState.Pending,
+            ConnectionStepState.Pending,
+            ConnectionStepState.Pending,
+        ],
+        "the renderer attached, the host is being reached, and nothing after that has happened");
+
+        tab.StepsDone.ShouldBe(1, "the track fills to what finished, and the running step is not half a step");
+        tab.Status.ShouldBe("Reaching the host");
+
+        ssh.Gate.SetResult();
+        await connecting;
+
+        tab.Steps.ShouldAllBe(step => step.IsDone, "a session that opened got through all of them");
+        tab.StepsDone.ShouldBe(tab.StepCount);
+    }
+
+    /// <remarks>
+    /// The half of the step list a progress bar could not do: where it stopped is kept, and the steps behind
+    /// it stay done. That is the difference between "that host is not there" and "that host is there and
+    /// would not have me", and it is the question the reason sentence alone often does not settle.
+    /// </remarks>
+    [Fact]
+    public async Task ARefusedConnection_KeepsTheStepItStoppedOn()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        ssh.Failure = new InvalidOperationException("No route to host.");
+
+        await vault.ConnectCommand.ExecuteAsync(null);
+
+        var tab = shell.Tabs.ShouldHaveSingleItem();
+
+        tab.Steps.Select(step => step.State).ShouldBe(
+        [
+            ConnectionStepState.Done,
+            ConnectionStepState.Stopped,
+            ConnectionStepState.Pending,
+            ConnectionStepState.Pending,
+            ConnectionStepState.Pending,
+        ],
+        "it got as far as reaching the host and no further");
+
+        tab.Steps[1].Mark.ShouldBe("✕", "and says so without relying on the colour");
+
+        // The reason still goes where it always went. The list says how far, and this says what happened.
+        tab.Status.ShouldBe("No route to host.");
+    }
+
+    /// <remarks>
+    /// A report that arrives for an attempt the shell has forgotten. Giving up on a connecting tab removes
+    /// it while the handshake is still running — see <c>CloseTabAsync</c> — so every phase reported after
+    /// that has no tab to land on. Dropped rather than resurrecting the tab, and above all not thrown: the
+    /// handshake is still going, and its session is still adopted if it opens.
+    /// </remarks>
+    [Fact]
+    public async Task GivingUpOnATab_LeavesLaterPhasesWithNothingToDo()
+    {
+        var vault = await ReadyToConnectAsync();
+
+        await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
+
+        ssh.Gate = new TaskCompletionSource();
+        var connecting = vault.ConnectCommand.ExecuteAsync(null);
+
+        var tab = shell.Tabs.ShouldHaveSingleItem();
+        await shell.CloseTabCommand.ExecuteAsync(tab);
+
+        // Everything after the gate — the host key, the credential, the shell — is reported to a shell that
+        // no longer has a tab for this attempt.
+        ssh.Gate.SetResult();
+        await connecting;
+
+        // The session opened anyway and was adopted, which is the behaviour giving up already promised.
+        var adopted = shell.Tabs.ShouldHaveSingleItem();
+        adopted.HasSession.ShouldBeTrue();
+        adopted.ShouldNotBe(tab);
+
+        // And the forgotten tab was left where it was rather than being advanced from the sidelines.
+        tab.Steps[1].IsRunning.ShouldBeTrue("nothing moved it on after the shell let go of it");
+    }
+
     /// <remarks>
     /// A refusal has to end up somewhere the user will see it, and by the time one arrives they are quite
     /// likely looking at another screen — which is exactly what not blocking bought. The tab is that place,
@@ -2341,6 +2461,7 @@ public sealed class ShellFlowTests : IAsyncLifetime
         await workspace.OpenSessionAsync(
             new SshConnectionRequest("host.invalid", 22, "dodo", new SshPasswordCredential("irrelevant")),
             TerminalSize.Default,
+            progress: null,
             Token);
 
         workspace.LiveSessionCount.ShouldBe(1);
@@ -8112,6 +8233,7 @@ public sealed class ShellFlowTests : IAsyncLifetime
         await workspace.OpenSessionAsync(
             new SshConnectionRequest("host.invalid", 22, "dodo", new SshPasswordCredential("irrelevant")),
             TerminalSize.Default,
+            progress: null,
             Token);
 
         shell.SignOutCommand.Execute(null);

tests/DodoSSH.Client.Ssh.Tests/KeyAuthenticationTests.cs

@@ -73,7 +73,8 @@ public sealed class KeyAuthenticationTests(SshServerFixture fixture)
         var factory = new SshNetConnectionFactory(knownHosts);
 
         await Should.ThrowAsync<SshAuthenticationException>(async () =>
-            await factory.ConnectAsync(Request(new SshPrivateKeyCredential(Pkcs1(stranger), null)), Token));
+            await factory.ConnectAsync(
+                Request(new SshPrivateKeyCredential(Pkcs1(stranger), null)), progress: null, Token));
     }
 
     [Fact]
@@ -125,6 +126,86 @@ public sealed class KeyAuthenticationTests(SshServerFixture fixture)
         shell.IsOpen.ShouldBeTrue();
     }
 
+    /// <remarks>
+    /// <para>
+    /// The claim the connecting card is built on, checked where it can actually be checked: against a real
+    /// handshake rather than a fake that reports whatever it was written to report. Every other test of the
+    /// step list asserts that the shell draws what it is told; this one asserts that what it is told is
+    /// true.
+    /// </para>
+    /// <para>
+    /// The order is the assertion. A step list is only readable if the reports arrive in the order it draws
+    /// them, and the middle one is the load-bearing part — <see cref="SshConnectionPhase.CheckingHostKey"/>
+    /// comes out of SSH.NET's <c>HostKeyReceived</c>, which is the single interior moment the library gives
+    /// anybody, and it has to land between the other two rather than beside them.
+    /// </para>
+    /// <para>
+    /// <see cref="SshConnectionPhase.OpeningShell"/> is deliberately absent: this factory's work ends with
+    /// an authenticated connection, and the phase for opening a channel on one belongs to the layer that
+    /// opens it. <c>TerminalWorkspaceTests</c> covers that half.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task AHandshake_ReportsItsPhasesInTheOrderTheyHappen()
+    {
+        var knownHosts = await TrustedStoreAsync();
+        var reported = new List<SshConnectionPhase>();
+
+        await using var connection = await new SshNetConnectionFactory(knownHosts).ConnectAsync(
+            Request(new SshPrivateKeyCredential(Pkcs1(fixture.ClientKey), Passphrase: null)),
+            new DelegateProgress<SshConnectionPhase>(phase =>
+            {
+                lock (reported)
+                {
+                    // Locked because the last two are reported from SSH.NET's own handshake thread rather
+                    // than from the awaiting one, which is the whole reason the shell marshals them.
+                    reported.Add(phase);
+                }
+            }),
+            Token);
+
+        connection.IsConnected.ShouldBeTrue();
+
+        lock (reported)
+        {
+            reported.ShouldBe(
+            [
+                SshConnectionPhase.Reaching,
+                SshConnectionPhase.CheckingHostKey,
+                SshConnectionPhase.Authenticating,
+            ]);
+        }
+    }
+
+    /// <remarks>
+    /// The other half of the phase contract, and the one that would be easy to get wrong by reporting
+    /// optimistically: a refused key stops at the check. Nothing may claim the credential was offered, and
+    /// against an unknown host nothing ever is — the gate returns false and SSH.NET abandons the handshake
+    /// before authentication.
+    /// </remarks>
+    [Fact]
+    public async Task AHostKeyRefusal_NeverClaimsToHaveAuthenticated()
+    {
+        var reported = new List<SshConnectionPhase>();
+
+        await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
+            await new SshNetConnectionFactory(new InMemoryKnownHostStore()).ConnectAsync(
+                Request(new SshPasswordCredential(SshServerFixture.Password)),
+                new DelegateProgress<SshConnectionPhase>(phase =>
+                {
+                    lock (reported)
+                    {
+                        reported.Add(phase);
+                    }
+                }),
+                Token));
+
+        lock (reported)
+        {
+            reported.ShouldBe([SshConnectionPhase.Reaching, SshConnectionPhase.CheckingHostKey]);
+        }
+    }
+
     private static byte[] Pkcs1(RSA key) => Encoding.UTF8.GetBytes(key.ExportRSAPrivateKeyPem());
 
     private static byte[] Pkcs8(RSA key) => Encoding.UTF8.GetBytes(key.ExportPkcs8PrivateKeyPem());
@@ -141,7 +222,7 @@ public sealed class KeyAuthenticationTests(SshServerFixture fixture)
         // Learned by being refused, which is the only way this client learns a host key.
         var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
             await factory.ConnectAsync(
-                Request(new SshPasswordCredential(SshServerFixture.Password)), Token));
+                Request(new SshPasswordCredential(SshServerFixture.Password)), progress: null, Token));
 
         await knownHosts.TrustAsync(unknown.Presentation, Token);
 
@@ -153,6 +234,6 @@ public sealed class KeyAuthenticationTests(SshServerFixture fixture)
         var knownHosts = await TrustedStoreAsync();
 
         return await new SshNetConnectionFactory(knownHosts)
-            .ConnectAsync(Request(credential), Token);
+            .ConnectAsync(Request(credential), progress: null, Token);
     }
 }

tests/DodoSSH.Client.Ssh.Tests/KnownHostStoreTests.cs

@@ -137,3 +137,14 @@ public sealed class KnownHostStoreTests
         string fingerprint = "SHA256:approved") =>
         new(host, port, algorithm, fingerprint);
 }
+
+/// <summary>An <see cref="IProgress{T}"/> that runs its callback on the thread that reported.</summary>
+/// <remarks>
+/// <c>System.Progress&lt;T&gt;</c> posts to a captured synchronisation context, or to the thread pool when
+/// there is none — which is what a test has here — so a list it appended to would be asserted on before it
+/// had been written. The same reason the shell does not use it either; see <c>VaultViewModel.ReporterFor</c>.
+/// </remarks>
+internal sealed class DelegateProgress<T>(Action<T> report) : IProgress<T>
+{
+    public void Report(T value) => report(value);
+}

tests/DodoSSH.Client.Ssh.Tests/LoopbackProxyTests.cs

@@ -66,7 +66,7 @@ public sealed class LoopbackProxyTests(SshServerFixture fixture)
         var factory = new SshNetConnectionFactory(knownHosts);
 
         var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
-            await factory.ConnectAsync(request, Token));
+            await factory.ConnectAsync(request, progress: null, Token));
 
         unknown.Presentation.Host.ShouldBe(InternalHost, "the target's name, not the proxy's");
         unknown.Presentation.Port.ShouldBe(SshServerFixture.InternalPort);
@@ -75,7 +75,7 @@ public sealed class LoopbackProxyTests(SshServerFixture fixture)
 
         await knownHosts.TrustAsync(unknown.Presentation, Token);
 
-        await using var connection = await factory.ConnectAsync(request, Token);
+        await using var connection = await factory.ConnectAsync(request, progress: null, Token);
 
         connection.IsConnected.ShouldBeTrue();
         connection.HostKey.Host.ShouldBe(InternalHost);
@@ -121,7 +121,8 @@ public sealed class LoopbackProxyTests(SshServerFixture fixture)
         var request = Request(Credential(), new SshLoopbackProxy(DeadPort()));
 
         var failure = await Should.ThrowAsync<Exception>(async () =>
-            await new SshNetConnectionFactory(new InMemoryKnownHostStore()).ConnectAsync(request, Token));
+            await new SshNetConnectionFactory(new InMemoryKnownHostStore())
+                .ConnectAsync(request, progress: null, Token));
 
         failure.ShouldNotBeOfType<SshHostKeyUnknownException>();
         failure.ShouldNotBeOfType<SshHostKeyMismatchException>();
@@ -137,7 +138,7 @@ public sealed class LoopbackProxyTests(SshServerFixture fixture)
         var knownHosts = await TrustedStoreAsync();
 
         await using var connection = await new SshNetConnectionFactory(knownHosts)
-            .ConnectAsync(Request(Credential(), proxy: null), Token);
+            .ConnectAsync(Request(Credential(), proxy: null), progress: null, Token);
 
         connection.IsConnected.ShouldBeTrue();
     }
@@ -216,7 +217,7 @@ public sealed class LoopbackProxyTests(SshServerFixture fixture)
 
         var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
             await new SshNetConnectionFactory(knownHosts)
-                .ConnectAsync(Request(Credential(), proxy: null), Token));
+                .ConnectAsync(Request(Credential(), proxy: null), progress: null, Token));
 
         await knownHosts.TrustAsync(unknown.Presentation, Token);
 

tests/DodoSSH.Client.Ssh.Tests/PumpOverRealSshTests.cs

@@ -27,11 +27,11 @@ public sealed class PumpOverRealSshTests(SshServerFixture fixture)
             new SshPasswordCredential(SshServerFixture.Password));
 
         var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
-            await factory.ConnectAsync(request, TestContext.Current.CancellationToken));
+            await factory.ConnectAsync(request, progress: null, TestContext.Current.CancellationToken));
 
         await knownHosts.TrustAsync(unknown.Presentation, TestContext.Current.CancellationToken);
 
-        return await factory.ConnectAsync(request, TestContext.Current.CancellationToken);
+        return await factory.ConnectAsync(request, progress: null, TestContext.Current.CancellationToken);
     }
 
     [Fact]

tests/DodoSSH.Client.Ssh.Tests/TerminalEndToEndTests.cs

@@ -110,7 +110,7 @@ public sealed class TerminalEndToEndTests(SshServerFixture fixture)
 
         var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
             await workspace.OpenSessionAsync(
-                request, TerminalSize.Default, TestContext.Current.CancellationToken));
+                request, TerminalSize.Default, progress: null, TestContext.Current.CancellationToken));
 
         unknown.Presentation.Fingerprint.ShouldStartWith(SshHostKeyFingerprint.Prefix);
 
@@ -119,6 +119,7 @@ public sealed class TerminalEndToEndTests(SshServerFixture fixture)
         return await workspace.OpenSessionAsync(
             request,
             new TerminalSize(100, 30, 1000, 750),
+            progress: null,
             TestContext.Current.CancellationToken);
     }
 

tests/DodoSSH.Client.Terminal.Tests/FakeShellSession.cs

@@ -139,8 +139,15 @@ internal sealed class FakeConnectionFactory(long bytesPerShell = long.MaxValue,
     /// <inheritdoc />
     public Task<ISshConnection> ConnectAsync(
         SshConnectionRequest request,
+        IProgress<SshConnectionPhase>? progress,
         CancellationToken cancellationToken)
     {
+        // The real factory's own order, so that a test watching this fake is watching the same sequence a
+        // real handshake produces. It cannot report CheckingHostKey — there is no key exchange here to
+        // produce a key — and inventing one would make this the only place that phase came from.
+        progress?.Report(SshConnectionPhase.Reaching);
+        progress?.Report(SshConnectionPhase.Authenticating);
+
         var connection = new FakeConnection(request, bytesPerShell, blockShellReads);
         Connections.Add(connection);
 
@@ -250,3 +257,15 @@ internal sealed class RecordingTransport : ITerminalTransport
             TerminalFrame.TryRead(frame, out var actual, out _, out _)
             && actual == (byte)opcode);
 }
+
+/// <summary>An <see cref="IProgress{T}"/> that runs its callback on the thread that reported.</summary>
+/// <remarks>
+/// <c>System.Progress&lt;T&gt;</c> would post to a captured synchronisation context, or to the thread pool
+/// when there is none — which is what a test has here — so a list it appended to would be asserted on before
+/// it had been written. This is the same reason the shell does not use it either; see
+/// <c>VaultViewModel.ReporterFor</c>.
+/// </remarks>
+internal sealed class DelegateProgress<T>(Action<T> report) : IProgress<T>
+{
+    public void Report(T value) => report(value);
+}

tests/DodoSSH.Client.Terminal.Tests/TerminalWorkspaceTests.cs

@@ -72,12 +72,12 @@ public sealed class TerminalWorkspaceTests
         workspace.LiveSessionCount.ShouldBe(0);
 
         await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         workspace.LiveSessionCount.ShouldBe(1);
 
         await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         workspace.LiveSessionCount.ShouldBe(2);
     }
@@ -98,11 +98,63 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(connections);
 
         await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         await WaitUntilAsync(() => workspace.LiveSessionCount == 0);
     }
 
+    /// <remarks>
+    /// <para>
+    /// <see cref="SshConnectionPhase.OpeningShell"/> is the one phase no connection factory can report,
+    /// because by the time it happens the factory has handed back a connection and gone. If this layer did
+    /// not report it the card's last step would light only when the whole session opened, which is the one
+    /// moment the card is already being taken down — a step nobody would ever see lit.
+    /// </para>
+    /// <para>
+    /// Asserted as the whole sequence rather than as "contains OpeningShell", because the order is the part
+    /// that matters: a step list is only readable if what it is told arrives in the order it draws.
+    /// </para>
+    /// </remarks>
+    [Fact]
+    public async Task OpeningASession_ReportsTheShellPhaseTheFactoryCannot()
+    {
+        var connections = new FakeConnectionFactory();
+        var reported = new List<SshConnectionPhase>();
+
+        await using var workspace = CreateWorkspace(connections);
+
+        await workspace.OpenSessionAsync(
+            Request(),
+            TerminalSize.Default,
+            new DelegateProgress<SshConnectionPhase>(reported.Add),
+            TestContext.Current.CancellationToken);
+
+        reported.ShouldBe(
+        [
+            SshConnectionPhase.Reaching,
+            SshConnectionPhase.Authenticating,
+            SshConnectionPhase.OpeningShell,
+        ],
+        "the factory's own phases, then the one this layer performs itself");
+    }
+
+    /// <remarks>
+    /// Nobody watching is the ordinary case — every caller but the connecting card passes null — so it is
+    /// worth one test that the null is a null and not a null reference.
+    /// </remarks>
+    [Fact]
+    public async Task OpeningASession_WorksWithNobodyWatchingItsPhases()
+    {
+        var connections = new FakeConnectionFactory();
+
+        await using var workspace = CreateWorkspace(connections);
+
+        var sessionId = await workspace.OpenSessionAsync(
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
+
+        workspace.IsSessionLive(sessionId).ShouldBeTrue();
+    }
+
     [Fact]
     public async Task ClosingASessionEndsItAndDisposesItsConnection()
     {
@@ -111,7 +163,7 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(connections);
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         await workspace.CloseSessionAsync(sessionId);
 
@@ -138,9 +190,9 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(connections);
 
         var first = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
         var second = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         workspace.IsSessionLive(first).ShouldBeTrue();
         workspace.IsSessionLive(second).ShouldBeTrue();
@@ -166,7 +218,7 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(connections);
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         var facts = workspace.GetSessionFacts(sessionId).ShouldNotBeNull();
         var connection = connections.Connections.ShouldHaveSingleItem();
@@ -199,7 +251,7 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(connections);
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         (await workspace.PasteAsync(
             sessionId, "uptime", execute: false, TestContext.Current.CancellationToken))
@@ -245,7 +297,7 @@ public sealed class TerminalWorkspaceTests
         };
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         await WaitUntilAsync(() =>
         {
@@ -283,7 +335,7 @@ public sealed class TerminalWorkspaceTests
         };
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         await workspace.CloseSessionAsync(sessionId);
 
@@ -309,9 +361,9 @@ public sealed class TerminalWorkspaceTests
         workspace.SessionEnded += (_, _) => Interlocked.Increment(ref announcements);
 
         await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
         await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         await workspace.DisposeAsync();
 
@@ -355,7 +407,7 @@ public sealed class TerminalWorkspaceTests
         using var first = await ConnectRendererAsync(workspace);
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         // The session's own opening frame, sent as soon as the pump starts running. Not a replay, and not
         // what this test is about — read and discarded so it cannot be confused for one below.
@@ -422,7 +474,7 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(connections);
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         // The up-arrow, as a PTY expects it. Three bytes, and all three matter.
         byte[] upArrow = [0x1B, (byte)'[', (byte)'A'];
@@ -444,7 +496,7 @@ public sealed class TerminalWorkspaceTests
         await using var workspace = CreateWorkspace(new FakeConnectionFactory());
 
         var sessionId = await workspace.OpenSessionAsync(
-            Request(), TerminalSize.Default, TestContext.Current.CancellationToken);
+            Request(), TerminalSize.Default, progress: null, TestContext.Current.CancellationToken);
 
         await workspace.CloseSessionAsync(sessionId);
 

tests/DodoSSH.SystemTests/M1VerticalSliceTests.cs

@@ -391,7 +391,7 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
 
         try
         {
-            await using var first = await factory.ConnectAsync(request, Token);
+            await using var first = await factory.ConnectAsync(request, progress: null, Token);
             Assert.Fail("An unseen host key must not be trusted silently.");
         }
         catch (SshHostKeyUnknownException exception)
@@ -402,7 +402,7 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
             await knownHosts.TrustAsync(pin, Token);
         }
 
-        await using var connection = await factory.ConnectAsync(request, Token);
+        await using var connection = await factory.ConnectAsync(request, progress: null, Token);
         await using var shell = await connection.OpenShellAsync(TerminalSize.Default, Token);
 
         await shell.WriteTextAsync("echo dodossh-e2e-ok\n", Token);