Smaller audit findings: error classification, exit codes, help output, config coverage

[lfnothias]

Low-severity findings from the same audit, grouped so they don't crowd the tracker. Each survived refutation; none is urgent.

• hs_error_is_fatal can't see a key failure under 2FA (lib/session.sh:82). The only key-failure pattern is a bare Permission denied (publickey), which sshd emits only when keyboard-interactive is not in the method list. On a cluster running AuthenticationMethods publickey,keyboard-interactive — the setup this tool is built for — a genuinely bad key produces a different string and gets retried three times over ~90s instead of failing fast.
• fetch returns 0 on partial success (lib/slurm.sh:106). The per-file pull runs on the right of a pipe, so the function's status is the last iteration's; earlier scp failures are neither reported nor reflected in the exit code.
• A failed control-dir mkdir is swallowed (lib/session.sh:141). set -uo pipefail without -e, and the status is discarded — the open proceeds and simply never multiplexes, which looks like a slow cluster rather than a broken setup.
• A local code-generation failure sleeps through every attempt (lib/session.sh:94). Returning 2 without running ssh leaves HS_SSH_ERROR holding the previous iteration's text, so hs_error_is_fatal judges a stale string and the loop waits out three full time steps for a failure that will never change.
• A bad TOTP parameter is misreported as a bad seed (lib/totp.sh:23). getattr(hashlib, algo) and int(...) are unguarded, so HS_TOTP_ALGO=SHA1 or HS_TOTP_PERIOD=30s raise an uncaught Python exception whose stderr hs_store_seed discards — the user is told their seed is invalid.
• file backend does not enforce its mode (lib/totp.sh:65). umask 077 affects creation only; if HS_TOTP_FILE already exists at 0644 the redirect writes the seed into it and leaves the mode alone.
• --help prints executable code (bin/hpc-session:40). hs_usage slices lines 2,25p out of its own source, but the header comment ends at line 19.
• config.example omits HS_CONTROL_DIR, HS_CONFIG_DIR, HS_OTP — so a reader following README.md:127 has no documented way to act on SECURITY.md's own suggestions.
• hs_uses_vpn keys only off HS_VPN_UP_CMD (lib/config.sh:62), so the "status-only" configuration docs/vpn-hooks.md:80 explicitly recommends makes every VPN report read not configured.

From an adversarially-verified audit, 2026-07-30. 26 findings survived, 7 were refuted and are not listed.