Stop a dead WebView2 hanging Connect with the busy flag stuck

VaultViewModel.ConnectAsync awaited TerminalWorkspace.WaitForRendererAsync
with no timeout and no token, and RunAsync clears IsBusy only after the
work returns. Whether the renderer attaches at all depends on a runtime
this application does not install: with a missing or policy-blocked
Evergreen runtime, or an AppContainer that cannot reach loopback, the
socket never arrives — so Connect never returned, the window stayed
disabled on "Connecting…" for the rest of the session, and nothing on
screen said why. Left out of 0500e43 to keep that change focused, and
recorded in docs/platform-flags.md as worth fixing on its own merits.

The gate itself is unchanged and has to stay: TerminalDataPlane.SendAsync
drops frames when no renderer is attached rather than queueing them, so a
session opened before the renderer arrives loses its SessionOpened frame
and then streams output at a terminal that was never created. Only the
wait changed — RendererAttached.WaitAsync(timeout, cancellationToken),
with the command's own token threaded through.

Fifteen seconds, on TerminalWorkspaceOptions.RendererTimeout. Attaching is
normally near-instant, since WebView2 starts with the window and the page
has usually attached while the passphrase was still being typed, but a
first run on a cold profile creates a user-data directory and starts a
process tree of some thirty-five processes first, which on a loaded
machine is seconds rather than milliseconds. A renderer that will never
attach will not attach however long the wait is, so being generous costs
only how long a broken runtime takes to say so, while being tight costs
telling someone their runtime is broken when it was merely slow.
Injectable because both new tests would otherwise sit out that budget.

The timeout is caught in VaultViewModel rather than left to RunAsync's
generic handler, because TimeoutException.Message is "The operation has
timed out" — which sends someone looking at their network or their host.
The status now names the WebView2 runtime and says to install it.

TerminalWorkspaceTests covers the half that was missing: the wait gives up
(329 ms against a 250 ms budget) and obeys its token (2 ms against a
five-minute one). Before the bound, the first of those would have hung
rather than failed. ShellFlowTests never starts its workspace, which from
the view model's side is indistinguishable from a WebView2 that failed to
initialise, so it asserts that the status names WebView2 and that IsBusy
is cleared; changing the catch to another exception type makes it fail
with "The operation has timed out.", so neither assertion is vacuous. The
success path is untouched and still covered end to end by
TerminalEndToEndTests against a real sshd container, which now passes the
test's cancellation token.

One byproduct: the doc comment on WaitForRendererAsync carried two
double-encoded em dashes, fixed now that the block is rewritten.

src/DodoSSH.Client.App/ViewModels/VaultViewModel.cs

@@ -412,13 +412,14 @@ internal sealed partial class VaultViewModel(
     /// <remarks>
     /// The renderer has to be attached before a session opens: the transport drops frames when nothing is
     /// connected, so a session opened earlier would lose its <c>SessionOpened</c> frame and then stream
-    /// output at a terminal that was never created.
+    /// output at a terminal that was never created. That wait is bounded and takes this command's token, so
+    /// a renderer that never arrives ends as a message rather than as a window stuck on "Connecting…".
     /// </remarks>
     private async Task OpenSessionAsync(HostRowViewModel row, CancellationToken cancellationToken)
     {
         try
         {
-            await workspace.WaitForRendererAsync().ConfigureAwait(true);
+            await workspace.WaitForRendererAsync(cancellationToken).ConfigureAwait(true);
 
             var request = new SshConnectionRequest(
                 row.Host.Hostname,
@@ -432,6 +433,14 @@ internal sealed partial class VaultViewModel(
 
             Status = $"Connected to {row.Label}.";
         }
+        catch (TimeoutException)
+        {
+            // The renderer never attached, so nothing was connected. Reported here rather than left to
+            // RunAsync's generic handler because TimeoutException says only "The operation has timed out",
+            // and the one thing worth saying is where to look: a runtime this application does not install.
+            Status = "The terminal did not start, so nothing was connected. The Microsoft Edge WebView2 "
+                + "runtime is probably missing or blocked; install it and try again.";
+        }
         catch (SshHostKeyUnknownException exception)
         {
             // First contact. The user has to decide, and they need the fingerprint to do it.

src/DodoSSH.Client.Terminal/TerminalWorkspace.cs

@@ -2,6 +2,31 @@ using DodoSSH.Client.Ssh;
 
 namespace DodoSSH.Client.Terminal;
 
+/// <summary>Tuning for the workspace.</summary>
+public sealed class TerminalWorkspaceOptions
+{
+    /// <summary>
+    /// How long <see cref="TerminalWorkspace.WaitForRendererAsync"/> waits for the renderer's socket
+    /// before giving up.
+    /// </summary>
+    /// <remarks>
+    /// <para>
+    /// The value has to separate two cases. Attaching is normally near-instant: WebView2 starts with the
+    /// window and the page has usually attached while the user was still typing a passphrase. But a first
+    /// run on a cold profile creates a user-data directory and starts a process tree of some thirty-five
+    /// processes, and on a slow or loaded machine that is seconds rather than milliseconds. A renderer
+    /// that will never attach — no Evergreen runtime, an install blocked by policy, an AppContainer that
+    /// cannot reach loopback — will not attach however long the wait is.
+    /// </para>
+    /// <para>
+    /// So being generous costs only how long a genuinely broken WebView2 takes to say so, while being
+    /// tight costs telling someone their runtime is broken when it was merely slow. Fifteen seconds is
+    /// well clear of any cold start observed here and is still an answer rather than a hang.
+    /// </para>
+    /// </remarks>
+    public TimeSpan RendererTimeout { get; init; } = TimeSpan.FromSeconds(15);
+}
+
 /// <summary>
 /// Owns the loopback data plane and every live terminal session.
 /// </summary>
@@ -16,6 +41,7 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     private readonly TerminalDataPlane dataPlane;
     private readonly ISshConnectionFactory connections;
     private readonly TimeProvider clock;
+    private readonly TerminalWorkspaceOptions options;
     private readonly Dictionary<uint, LiveSession> sessions = [];
     private readonly CancellationTokenSource lifetime = new();
 
@@ -23,13 +49,19 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     private Task? server;
     private int disposed;
 
+    /// <param name="assets">Where the renderer's files come from.</param>
+    /// <param name="connections">How SSH connections are made.</param>
+    /// <param name="clock">Time source, so the pumps' flush interval is testable.</param>
+    /// <param name="options">Tuning, or null for the defaults.</param>
     public TerminalWorkspace(
         ITerminalAssetProvider assets,
         ISshConnectionFactory connections,
-        TimeProvider clock)
+        TimeProvider clock,
+        TerminalWorkspaceOptions? options = null)
     {
         this.connections = connections;
         this.clock = clock;
+        this.options = options ?? new TerminalWorkspaceOptions();
 
         dataPlane = new TerminalDataPlane(assets);
     }
@@ -44,11 +76,25 @@ public sealed class TerminalWorkspace : IAsyncDisposable
     /// Waits until the renderer page has attached its socket.
     /// </summary>
     /// <remarks>
-    /// A session opened before the renderer attaches would have its <c>SessionOpened</c> frame
-    /// dropped — the transport discards frames when nothing is connected — leaving output arriving
-    /// for a terminal that was never created.
+    /// <para>
+    /// A session opened before the renderer attaches would have its <c>SessionOpened</c> frame dropped —
+    /// the transport discards frames when nothing is connected — leaving output arriving for a terminal
+    /// that was never created. The gate is the invariant and stays.
+    /// </para>
+    /// <para>
+    /// Bounded, because whether the renderer attaches at all depends on a WebView2 runtime this process
+    /// does not install. An unbounded wait turned a missing runtime into a Connect that never returned,
+    /// with the caller's busy state never cleared and nothing on screen to explain it. Callers are
+    /// expected to translate the timeout into something that names the runtime, because
+    /// <see cref="TimeoutException"/>'s own message names nothing.
+    /// </para>
     /// </remarks>
-    public Task WaitForRendererAsync() => dataPlane.RendererAttached;
+    /// <param name="cancellationToken">Abandons the wait.</param>
+    /// <exception cref="TimeoutException">
+    /// No renderer attached within <see cref="TerminalWorkspaceOptions.RendererTimeout"/>.
+    /// </exception>
+    public Task WaitForRendererAsync(CancellationToken cancellationToken) =>
+        dataPlane.RendererAttached.WaitAsync(options.RendererTimeout, cancellationToken);
 
     /// <summary>Connects to a host and starts a terminal for it.</summary>
     /// <returns>The session id, which identifies this terminal in the renderer.</returns>