Adom Hydrogen

Root cause confirmed from the code, and it is one boundary, not the dock: every in-distro exec in Hydrogen spawns wsl.exe -d Adom-Workspace -u adom -- bash -lc <command>. With --, wsl.exe re-joins the arguments, wraps the command in double quotes and hands that string to the distro's DEFAULT shell, which performs one round of expansion ($var, $(...), backticks) before bash -lc ever runs. That is exactly your three cases: $i is empty at the outer level (so n, n), $(seq 1 3) expands to three lines and the outer shell runs line 2 as a command, and the Fusion step's $(seq 1 15) inside sh -c '...' becomes a multi-line word where do is not where sh expects it. The setup cascade's own scripts survive this by luck: $HOME expands to the same value one level early.

Fix, on the split-modules branch (commit 7e89758), shipping with the next Hydrogen release once that branch merges today:

1. /workspace/exec and the other execs in the control crates use --exec instead of --, so argv reaches bash -lc verbatim. The setup cascade's execs in hydrogen-app keep -- for now (they run during first install and get the same change after a virgin-VM cascade).
2. The dock's /workspace/exec fallback dropped stderr, which is why the console said (no output) for a syntax error the server had actually returned. It now passes through.
3. A failed step never told the loader, so the elapsed counter kept climbing past the step budget and read as a hang. The store now posts a terminal failure; the loader freezes the counter (stopped after Ns), shows the reason and opens the console.

I will reply here with the three cases re-run through hd_api POST /workspace/exec on a box running the fixed build before closing. Your dockbar.json workaround stays valid either way.

Proof of the boundary, measured on AdomLapper just now with direct wsl.exe -d Adom-Workspace -u adom <sep> bash -lc <case> calls, nothing of Hydrogen in between:

Your three symptoms reproduce byte for byte with --, and vanish with --exec. So the fix is the one-token change at the spawn site, and the release carrying it is what closes this.

Verified on the real route. Hydrogen 1.0.206 (insiders, published 2026-09-05) on AdomLapper, each case through hd_api POST /workspace/exec:

The dock loader changes (stderr passthrough, the frozen counter with the reason on a failed step) ship in the same build. ConfRoomROG picks 1.0.206 up through the insiders manifest on its next update check. Closing; reopen if a dock step still shows the old behaviour after the update.

Follow-up, shipped in Hydrogen 1.0.208 (insiders, 2026-09-05), after John pointed out that the whole point of the container route was to stop using wsl.exe: /workspace/exec never tried that route, and the dock's frontend tried the extension itself on a hardcoded :8821 while ConfRoomROG's extension sits on :8822 (execAllowed:true). Every launch step there fell to wsl.exe, which is where the quoting bug lived.

1.0.208:

• wsl_exec_adom, the helper every in-container command in the control crates goes through (44 call sites), now tries the adom-vscode /exec route first and falls to wsl.exe (wsl_exec_adom_direct, --exec, behind the global lock) only when that route is not up. One choke point, no per-site edits.
• The dock frontend has no exec router of its own any more: it posts to /workspace/exec and ah picks the route, reads the real port, and reports route: container|wsl in the response. The launch console says so when it had to use wsl.exe.

Verified on AdomLapper, 1.0.208, through hd_api POST /workspace/exec:

The wsl.exe fallback remains for the editor-not-up window and keeps the --exec fix from 1.0.206.