956642c4fc
Only main can answer whether a loopback address is reachable: it holds the live SSH connection and the profile precedence that picks it. The renderer asks over IPC instead of guessing. Forwards are scoped to the connection that authorized them and dropped whenever it changes, so a new host never inherits a tunnel into the old one. A failed forward logs and returns the original URL rather than breaking the load path.