Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/OPS.md`:
- Around line 77-89: Clarify the cron limitation in the `siphon schedule`
documentation block: scheduled entries created by `siphon schedule add`, `list`,
and `remove` ultimately invoke `siphon backup <profile>`, and that command still
goes through the confirmation/2FA gate with no unattended bypass. Update the
`siphon schedule` section in `docs/OPS.md` to note that gated profiles cannot be
safely run by cron unless that interaction is removed or a non-interactive path
is added in `backup`.

In `@internal/app/backup.go`:
- Around line 81-89: The backup flow leaves the audit record open when job
startup fails because guardedOp is called before Runner.Run and done(retErr)
only runs inside the job Func. Update the backup path in the Run/guardedOp
sequence to ensure the returned done callback is invoked if Runner.Run returns a
synchronous error, so the audit record is finalized even when the job never
starts.

In `@internal/app/sync.go`:
- Around line 63-66: The continuous and cross-engine sync paths bypass the
shared guard, so 2FA/confirmation gating and audit logging are only enforced on
the native sync route. Update Sync, RunCDC, and runCrossEngineSync so the shared
guardedOp flow is applied before any destructive sync work starts, or refactor
the guard into a common helper that all three paths must call. Make sure the
existing guardedOp/audit.OpSync behavior is reused consistently across these
entry points.

In `@internal/cli/gate.go`:
- Around line 82-84: The 2FA prompt in gate.go currently reads the code with the
normal stdin path, which can echo the TOTP value in interactive terminals.
Update the code in the gate flow around the existing bufio.NewReader/Verify path
to detect when g.in is a terminal and use a no-echo reader there, while
preserving the current g.in reader behavior for tests and non-interactive input.
Keep the existing twofactor.Verify(secret, line, g.now()) call and the prompt
flow intact.
- Around line 68-83: The confirm flow in promptGate.confirmName and
promptGate.confirmTOTP creates a new bufio.Reader for each prompt, which can
consume and discard piped input between destructive-name confirmation and 2FA.
Reuse a single buffered reader for both reads by storing it on promptGate or
passing it through both methods, and update both confirmName and confirmTOTP to
read from the shared reader so scripted input like profile name plus TOTP code
is preserved.

In `@internal/cli/schedule.go`:
- Around line 57-68: Validate the cron input in schedule.Add before calling
schedule.Add or writing the managed block, since it currently accepts any
non-empty string and can store expressions that schedule.List cannot round-trip.
Add a check in the schedule.Add flow to reject non-5-field cron specs such as
`@daily` or 6-field expressions, and return a user-facing errs.Error similar to
the existing --cron required validation. Use the existing schedule.Add,
schedule.List, and readCrontab path to keep the contract consistent.
- Around line 105-114: The empty-output fallback in the schedule listing logic
is too broad because it masks real system failures from exec.Command("crontab",
"-l").Output(). In the schedule list path, keep only the explicit ExitError
branch in listSchedule/its crontab read handling that checks for the known “no
crontab” message, and remove the len(out) == 0 shortcut so missing binaries and
other crontab errors still return the errs.Error with the system error details.

In `@internal/cli/tunnel.go`:
- Around line 40-48: Validate the tunnel port values in the tunnel command
before calling tunnelArgs: check prof.Tunnel.LocalPort and prof.Port for being
within the valid TCP port range and reject zero, negative, or out-of-range
values with a user-facing error instead of proceeding. Update the logic around
localPort selection and the tunnelArgs call in the tunnel open flow so invalid
ProfileConfig.Port or TunnelConfig.LocalPort never reaches ssh, and keep the
success message only for validated ports.
- Around line 52-55: The cmd.Run() error handling in tunnel logic is treating
the normal Ctrl-C/interrupt shutdown path as a tunnel failure. Update the branch
in the tunnel command execution to detect context cancellation or
interrupt-style ssh exits and return success instead of wrapping them in
errs.CodeSystem; only wrap genuine ssh failures with the existing errs.Error
path.

In `@internal/schedule/crontab.go`:
- Around line 33-35: The rendered cron command in Entry.render is interpolating
bin and e.Profile directly into a shell command, so update this path to
shell-escape or quote each argument before writing the crontab. Use the render
method as the fix point and ensure both the executable path and profile value
are treated as separate argv elements, or validate e.Profile against a safe
charset before formatting the command string.

In `@internal/telemetry/telemetry.go`:
- Around line 57-76: The persisted telemetry snapshot in recHandle.End can
regress because h.r.flush(snapshot) runs after h.r.mu is unlocked, allowing
concurrent End calls to write stale snapshots out of order. Fix this by
serializing the flush with the same lock (or by adding a dedicated write mutex
in the recorder path) so the snapshot captured in snapshotLocked is written to
disk before another End can overwrite it. Keep the change centered on
recHandle.End, snapshotLocked, and flush so on-disk counts remain monotonic.

---

Nitpick comments:
In `@internal/audit/multi.go`:
- Around line 15-26: NewMulti is compacting the variadic input in place by
slicing auditors[:0], which can mutate the caller’s backing array when invoked
with sinks.... Update the NewMulti helper to build live from a fresh slice
instead of reusing auditors, while preserving the nil-filtering logic and the
existing return behavior. Keep the change localized to NewMulti and the Multi
constructor path so the exported helper remains side-effect free.

In `@internal/twofactor/totp_test.go`:
- Around line 13-18: Add an independent RFC 6238 vector to the TOTP tests
instead of deriving the expected code with generate in
TestVerify_AcceptsCurrentStep and the related test cases. Use a fixed known
value for the RFC test key (for example, counter 1 at Unix 59 should verify
against 287082) and assert Verify returns that code so the test validates the
implementation rather than self-confirming generate. Keep the change localized
to the existing TestVerify_AcceptsCurrentStep and nearby Verify test helpers in
totp_test.go.