From e0f36c933d7b7201523a4e7008675ea00b6bda38 Mon Sep 17 00:00:00 2001
From: joshsiv-mulga <mrk@mulgadc.com>
Date: Mon, 11 May 2026 15:35:37 +1000
Subject: [PATCH] fix(ddil): case-insensitive transient SSH error match
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

awaitGuestSSH's retry matcher used lowercase substrings, but x/crypto/ssh
emits "ssh: rejected: connect failed (Connection refused)" with capital
C — strings.Contains returned false and the helper bailed on first
attempt instead of polling. Last run failed in 49s, not the 90s budget.

Lowercase the error before matching, and add "connect failed" as the
canonical signal for "jump host dial through tunnel failed".

Continues mulga-siv-57.
---
 tests/e2e/ddil/harness/witness.go | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/tests/e2e/ddil/harness/witness.go b/tests/e2e/ddil/harness/witness.go
index 28a184fc5..45d5ff0e2 100644
--- a/tests/e2e/ddil/harness/witness.go
+++ b/tests/e2e/ddil/harness/witness.go
@@ -496,10 +496,15 @@ func awaitGuestSSH(ctx context.Context, w *Witness, host Node, publicIP string,
 			return nil
 		}
 		lastErr = err
-		msg := err.Error()
-		transient := strings.Contains(msg, "connection refused") ||
+		msg := strings.ToLower(err.Error())
+		// "connect failed" covers x/crypto/ssh's
+		//   `ssh: rejected: connect failed (Connection refused)`
+		// which fires when the SSH jump host's DialContext fails — the
+		// canonical signal that the guest hasn't bound :22 yet.
+		transient := strings.Contains(msg, "connect failed") ||
+			strings.Contains(msg, "connection refused") ||
 			strings.Contains(msg, "connection reset") ||
-			strings.Contains(msg, "EOF") ||
+			strings.Contains(msg, "eof") ||
 			strings.Contains(msg, "i/o timeout") ||
 			strings.Contains(msg, "no route to host")
 		if !transient {