fix(client-runtime): show routes whose host refused this device's sign-in#33199

Problem

When a saved environment has several routes and the host refuses this device's sign-in on the preferred one (for example after its 30-day session expires), the client quietly connects over the next route. Settings → Environments marks that route "In use" and the refused route looks healthy, so the user never learns the preferred route needs pairing again. The refusal only became visible after removing every other route.

Reproduced on main (d0f1f7200d) in the web client: a host paired on a loopback route and a LAN route, each with its own code. The host clock was moved forward 31 days, which expired the loopback session, and only the LAN route was paired again. The host logged Rejected authenticated session credential. reason: Session token expired. Settings showed "via LAN · Connected" and the loopback row looked normal.

Change

• connectOverRoutes notes every route that failed because the host refused this device's credential and returns those route ids with the connection. It still falls back to the next route as before.
• isHostCredentialRefusal decides what counts: a ConnectionBlockedError on the server hop with reason authentication or permission, excluding clock skew. Tunnel, link and missing-local-credential failures do not count.
• The better-route check now reports "refused" instead of "unprepared" when the host refuses a route's credential, so a refusal found while the device is already on another route also shows up.
• The supervisor remembers refused routes for as long as it lives. It drops a route once that route connects, and drops routes that are no longer saved. The connected state publishes the list as refusedRouteIds. Pairing the address again rebuilds the supervisor, which clears the list. The better-route check now writes to the state atomically, and only for the same connection generation.
• Web (EnvironmentRoutesList, also used by desktop) and mobile (EnvironmentRoutesSection) mark a refused route "Sign-in refused" and add the hint "The host refused this device's sign-in. Pair this address again with Add route." The mobile hint is also in the row's accessibility label. docs/user/remote-access.md gets one sentence on this.

Route selection, ordering, retries and session lifetime are unchanged.

Scope and approval

Fixes pingdotgg/t3code#33183

This fixes the silent fallback the issue describes. Making the session lifetime configurable is a separate change and is not part of this PR.

Verification

Tests, all failing on main and passing on this branch:

• packages/client-runtime/src/connection/supervisor.test.ts, "EnvironmentSupervisor routes": a refused preferred route is reported while connected over another route; tunnel tunnel_not_enabled and server-hop clock_skew failures are not; a refusal found by the better-route check is reported; refused routes survive a switch to a better route; a refused route stops being reported once it connects.
• packages/client-runtime/src/state/presentation.test.ts: the provider presentation follows refusedRouteIds.
• apps/web/src/components/settings/EnvironmentRoutesList.browser.test.tsx: "marks a route whose host refused this device's sign-in".
• vp run check:changed passes on the final head (format, lint, knip, typecheck of 7 packages, tests, react compiler).

Review: two independent review rounds on the merged head, both MERGE with no blocking findings.

Evidence

Before = merge-base bcee0f5d28, after = 3cee08825d (later commits change only tests and merge main). Real app on fresh databases: a second host H1 paired over two routes, then route A's session revoked from an admin session on H1 (no clock change). Web: Chrome 157 on Linux, DPR 2, no emulation, 1440×1000 and 390×844 CSS px. Android: Pixel 9 emulator, 1080×2424 px, density 2.625, font scale 1.0. Diff0 = any changed channel, DiffT = 16/255.

Refused preferred route A, fallback B in use (Settings → Environments):

Web 1440/390 × light/dark sheets: 1440 light, 1440 dark, 390 light, 390 dark. Android accessibility dump: the refused row's label ends with the hint (S01-after-dark-accessibility.json).

Labelled component harness (actual EnvironmentRoutesList from each revision, real parent widths), each at 1440/390 × light/dark: several refusals, long hostname, learned address, T3 Connect relay, badge without hint, SSH, missing profile, healthy pair control (before, Diff0).

Recordings (web 390 dark, before | after; steps and timestamps in the index):

• Revoke A → fallback to B with A flagged → Add route re-pairs A → flag gone: before | after; re-pair close-up before | after; Android after: R02-R05-android-dark-redacted.mp4
• Refusal found by the better-route check, kept across the switch: before | after with traces (before, after)
• Reconnect of the fallback: before | after
• Removing routes, down to one, and relay confirmation: before | after, 2→1 before | after, relay before | after
• Entry points: before | after; every route refused, no fallback: before | after; tunnel, clock-skew, device and relay failures add no flag, a host refusal does: before | after

More recordings, before bcee0f5d28 | after ad38094ff5 (the later main merge touches none of these files):

• Android light, Pixel 9: revoke A → fallback to B → Add route → Cancel → Add route at A's exact address → flag gone, two routes: before | after. Only the pairing code is masked.
• Web 390 dark, component harness: drag a refused row down twice and drop, lift and cancel, Remove → Cancel, Remove → Confirm: before | after.
• Android dark, native harness: Edit, drag a refused row across the others and drop, lift and release in place, Remove → Cancel → Confirm, Done: before | after. While a row is lifted it overlaps its neighbours on both sides; the taller refused row covers more of the row below until it drops. The drop lands in the right slot.

Steps, timestamps and scripts: recapture index.

What else changed: refused rows grow by the hint line, their drag and remove controls recenter, and the rows below move down; long hostname, SSH and relay labels wrap differently at 390. While the environment is reconnecting (about 0.2 s during a better-route switch, the same on both revisions) no route shows "In use" or "Sign-in refused". The Android status bar clock differs between the before and after frames. Healthy routes render pixel-identically except one blue-channel pixel (0 → 7) in the five-label control.

Indexes and scripts (synthetic data only): web index, web fix-up index, Android index, fixture matrix, capture procedure, browser driver, component harness, capture drivers, Android procedure.

Not checked:

• A real T3 Connect route, the reporter's setup; the relay row was checked in the component harness only.
• Android rows other than the refused-route state and the revoke/re-pair recording (after only), and the relay row on Android.
• iOS and macOS desktop; the desktop app renders the web component.

AI-assisted; verified with the tests and tools listed above.