windows-vm.sh: an atomic click lock, and setup errors fail the click

input.txt is now created with CreateNew, so only one request can hold it; a
lock older than 15 s is treated as left by a dead run. The outer PowerShell
stops on any error, says why in one line, releases the lock and exits 1.
docs/testing.md names both keys Set Up Connection can add to the headset.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/testing.md

@@ -218,9 +218,12 @@ scripts/windows-vm.sh down                       # shut Windows down
 
 **Testing against a real Frame.** The VM reaches the headset on the LAN like
 any other computer. Run **Set Up Connection** in the VM's Frame Control once;
-that makes the VM's key. So the VM doesn't keep access between test runs,
-take that key's line out of the headset's `~/.ssh/authorized_keys` afterwards.
-Then, around each run:
+that makes the VM's keys. So the VM doesn't keep access between test runs,
+afterwards take the lines it added out of the headset's
+`~/.ssh/authorized_keys`: the ones matching the VM's
+`~/.ssh/id_ed25519_frame.pub` and, if pairing made one,
+`~/.ssh/id_rsa_frame_devkit.pub`. Check that `ssh -o BatchMode=yes frame true`
+in the VM now fails. Then, around each run:
 
 ```sh
 scripts/windows-vm.sh frame-key add       # let the VM's key into the headset

scripts/windows-vm.sh

@@ -68,18 +68,24 @@ Remove-Item "$PSScriptRoot\input.txt"'
 
 pointer() {  # x y click|wheel [notches]
   local b64=$(print -rn -- $INPUT_PS1 | base64 | tr -d '\n')
-  vm_ps '$d = Join-Path $env:LOCALAPPDATA "windows-vm"
+  vm_ps '$ErrorActionPreference = "Stop"
+$d = Join-Path $env:LOCALAPPDATA "windows-vm"; $req = "$d\input.txt"; $held = $false
+trap { [Console]::Error.WriteLine("windows-vm: $_"); if ($held) { Remove-Item $req -ErrorAction SilentlyContinue }; exit 1 }
 New-Item -ItemType Directory -Force $d | Out-Null
-$busy = Get-Item "$d\input.txt" -ErrorAction SilentlyContinue
-if ($busy -and $busy.LastWriteTime -gt (Get-Date).AddSeconds(-15)) { [Console]::Error.WriteLine("windows-vm: another click or scroll is in progress"); exit 1 }
+$old = Get-Item $req -ErrorAction SilentlyContinue   # left behind by a run that died
+if ($old -and $old.LastWriteTime -lt (Get-Date).AddSeconds(-15)) { Remove-Item $req }
+# Creating input.txt is the lock: CreateNew fails if another request already has it.
+try { $f = [IO.File]::Open($req, "CreateNew", "Write") }
+catch { [Console]::Error.WriteLine("windows-vm: another click or scroll is in progress"); exit 1 }
+$held = $true
+$text = [Text.Encoding]::ASCII.GetBytes("'"$*"'"); $f.Write($text, 0, $text.Length); $f.Close()
 [IO.File]::WriteAllText("$d\input.ps1", [Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("'$b64'")))
 $act = New-ScheduledTaskAction -Execute powershell.exe -Argument "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File `"$d\input.ps1`""
 $who = New-ScheduledTaskPrincipal -UserId $env:USERNAME -LogonType Interactive
 Register-ScheduledTask -TaskName WindowsVmInput -Action $act -Principal $who -Force | Out-Null
-Set-Content "$d\input.txt" "'"$*"'"
 Start-ScheduledTask -TaskName WindowsVmInput
-foreach ($i in 1..50) { if (-not (Test-Path "$d\input.txt")) { exit 0 }; Start-Sleep -Milliseconds 200 }
-Remove-Item "$d\input.txt" -ErrorAction SilentlyContinue
+foreach ($i in 1..50) { if (-not (Test-Path $req)) { exit 0 }; Start-Sleep -Milliseconds 200 }
+Remove-Item $req -ErrorAction SilentlyContinue
 [Console]::Error.WriteLine("windows-vm: no input after 10 s: is $env:USERNAME signed in on the VM screen, and is x,y on it?"); exit 1'
 }