fix: suppress routine ssh timing noise

scripts/src/help.ts

@@ -178,7 +178,7 @@ export function sshHelp(): unknown {
       "Do not put operation names in any colon route segment, including nested k3s namespace/workload/container segments.",
       "Do not use post-provider shorthand such as `ssh G14 k3s ...`; write `ssh G14:k3s ...` so location and operation stay separated.",
       "If an ssh-like remote command fails with timeout/kex/exit-255 friction, stderr includes one low-noise UNIDESK_SSH_HINT JSON line with the argv retry command.",
-      "Every ssh/tran runtime writes one UNIDESK_SSH_TIMING JSON line to stderr with elapsedMs/elapsedSeconds; operations over 10s are marked level=warning and should be checked for provider latency, remote command cost, helper bootstrap, or tran/apply-patch optimization before repeating high-frequency work.",
+      "Only slow ssh/tran runtime writes UNIDESK_SSH_TIMING JSON to stderr; operations over 10s are marked level=warning and should be checked for provider latency, remote command cost, helper bootstrap, or tran/apply-patch optimization before repeating high-frequency work. Routine short calls do not emit timing noise.",
       "The local tran wrapper serializes non-interactive calls per provider/plane before opening provider SSH sessions, so parallel Codex file reads do not stampede the provider session allocator; set UNIDESK_TRAN_SESSION_LOCK=0 only for explicit diagnostics.",
       "Use -- before a remote command that intentionally starts with a dash.",
     ],

scripts/src/remote.ts

@@ -968,12 +968,13 @@ async function runRemoteSshWebSocket(
       restore();
       const hint = sshFailureHint(invocation.providerId, parsed, code, "");
       if (hint !== null) process.stderr.write(formatSshFailureHint(hint));
-      process.stderr.write(formatSshRuntimeTimingHint(sshRuntimeTimingHint({
+      const timingHint = formatSshRuntimeTimingHint(sshRuntimeTimingHint({
         invocation,
         transport: "frontend-websocket",
         exitCode: code,
         startedAtMs,
-      })));
+      }));
+      if (timingHint) process.stderr.write(timingHint);
       resolve(code);
     };
     const onStdinData = (chunk: Buffer): void => {

scripts/src/ssh.ts

@@ -1626,6 +1626,7 @@ export function sshRuntimeTimingHint(options: {
 }
 
 export function formatSshRuntimeTimingHint(hint: SshRuntimeTimingHint): string {
+  if (!hint.slow) return "";
   return `UNIDESK_SSH_TIMING ${JSON.stringify(hint)}\n`;
 }
 
@@ -1836,12 +1837,13 @@ export async function runSsh(config: UniDeskConfig, providerId: string, args: st
       restore();
       const hint = sshFailureHint(invocation.providerId, parsed, exitCode, stderrTail);
       if (hint !== null) process.stderr.write(formatSshFailureHint(hint));
-      process.stderr.write(formatSshRuntimeTimingHint(sshRuntimeTimingHint({
+      const timingHint = formatSshRuntimeTimingHint(sshRuntimeTimingHint({
         invocation,
         transport: "backend-core-broker",
         exitCode,
         startedAtMs,
-      })));
+      }));
+      if (timingHint) process.stderr.write(timingHint);
       resolve(exitCode);
     };
     child.on("error", (error) => {

scripts/ssh-argv-guidance-contract-test.ts

@@ -338,8 +338,9 @@ export function runSshArgvGuidanceContract(): JsonRecord {
     finishedAtMs: 5200,
     thresholdMs: 10_000,
   });
-  assertCondition(timingInfo.level === "info" && timingInfo.slow === false, "short ssh operation should emit an info timing hint", timingInfo);
+  assertCondition(timingInfo.level === "info" && timingInfo.slow === false, "short ssh operation should stay below the timing warning threshold", timingInfo);
   assertCondition(timingInfo.elapsedMs === 4200 && timingInfo.elapsedSeconds === 4.2, "timing hint must include elapsed ms and seconds", timingInfo);
+  assertCondition(formatSshRuntimeTimingHint(timingInfo) === "", "short ssh operation must not write routine timing noise to stderr", timingInfo);
   const slowTiming = sshRuntimeTimingHint({
     invocation: parseSshInvocation("D601", ["apply-patch"]),
     transport: "frontend-websocket",
@@ -371,7 +372,7 @@ export function runSshArgvGuidanceContract(): JsonRecord {
   assertCondition(helpText.includes("apply-patch [--allow-loose]") && helpText.includes("low-context update hunks"), "ssh help must document apply-patch loose-context guard", helpText);
   assertCondition(helpText.includes("ssh D601:k3s:hwlab-dev:hwlab-cloud-api script <<'SCRIPT'"), "ssh help must document k3s script operation", helpText);
   assertCondition(helpText.includes("UNIDESK_SSH_HINT"), "ssh help must document structured failure hint", helpText);
-  assertCondition(helpText.includes("UNIDESK_SSH_TIMING") && helpText.includes("10s"), "ssh help must document runtime timing hints", helpText);
+  assertCondition(helpText.includes("UNIDESK_SSH_TIMING") && helpText.includes("10s") && helpText.includes("Routine short calls do not emit timing noise"), "ssh help must document slow-only runtime timing hints", helpText);
   assertCondition(helpText.includes("UNIDESK_TRAN_SESSION_LOCK=0") && helpText.includes("provider session allocator"), "ssh help must document tran provider session serialization", helpText);
 
   const crossChecks = providerTriageRecommendedCrossChecks("D601");
@@ -438,7 +439,7 @@ export function runSshArgvGuidanceContract(): JsonRecord {
       "k3s route stays location-only while operations fix native kubeconfig and assemble kubectl exec as argv",
       "top-level remote option parsing preserves command-local -- separators for script -- sed -n style commands",
       "ssh-like timeout/kex failures emit one structured argv retry hint",
-      "ssh runtime emits one structured timing hint on stderr and marks operations over 10 seconds as warnings",
+      "ssh runtime emits structured timing only for slow operations over 10 seconds",
       "help text documents stdin script passthrough and UNIDESK_SSH_HINT",
       "provider triage recommendedCrossChecks keeps ssh D601 argv true",
       "remote frontend ssh uses the same structured route parser for host, k3s and pod argv routes",