diff --git a/apps/backend/internal/ssh/handlers.go b/apps/backend/internal/ssh/handlers.go
index 356b2b3684..820782e8c1 100644
--- a/apps/backend/internal/ssh/handlers.go
+++ b/apps/backend/internal/ssh/handlers.go
@@ -330,6 +330,11 @@ func (h *Handler) testAgentctlCache(ctx context.Context, client *ssh.Client, res
 // the TaskSession associated with each row — the row itself has an
 // ExecutorID column but the lifecycle manager does not populate it for fresh
 // executions, so it's unreliable as a filter.
+//
+// The runtime filter runs before the session lookup, so the per-row
+// GetTaskSession call only fires for SSH rows — typically <10 per executor.
+// If that count ever grows materially we should add a batch List by
+// session-ID method to the repo and resolve in one query.
 func (h *Handler) listSessions(ctx context.Context, executorID string) ([]SessionRow, error) {
 	rows, err := h.repo.ListExecutorsRunning(ctx)
 	if err != nil {
diff --git a/apps/web/e2e/helpers/api-client-ssh.ts b/apps/web/e2e/helpers/api-client-ssh.ts
new file mode 100644
index 0000000000..dc8d96a998
--- /dev/null
+++ b/apps/web/e2e/helpers/api-client-ssh.ts
@@ -0,0 +1,51 @@
+// SSH-specific HTTP shapes for the e2e ApiClient. Kept in a dedicated module
+// (apart from helpers/api-client.ts) so adding SSH fields doesn't keep growing
+// the omnibus client file. ApiClient methods that exercise these shapes live
+// on the ApiClient class itself, alongside the rest of the surface.
+
+export type SSHIdentitySourceBody = "agent" | "file";
+
+export type SSHTestRequestBody = {
+  name: string;
+  host_alias?: string;
+  host?: string;
+  port?: number;
+  user?: string;
+  identity_source?: SSHIdentitySourceBody;
+  identity_file?: string;
+  proxy_jump?: string;
+};
+
+export type SSHTestStepBody = {
+  name: string;
+  duration_ms: number;
+  success: boolean;
+  output?: string;
+  error?: string;
+};
+
+export type SSHTestResultBody = {
+  success: boolean;
+  fingerprint?: string;
+  uname_all?: string;
+  arch?: string;
+  git_version?: string;
+  agentctl_action?: "cached" | "uploaded" | "skipped";
+  steps: SSHTestStepBody[];
+  total_duration_ms: number;
+  error?: string;
+};
+
+export type SSHSessionBody = {
+  session_id: string;
+  task_id: string;
+  task_title?: string;
+  host: string;
+  user?: string;
+  remote_task_dir?: string;
+  remote_agentctl_port?: number;
+  local_forward_port?: number;
+  status: string;
+  uptime_seconds: number;
+  created_at: string;
+};
diff --git a/apps/web/e2e/helpers/api-client.ts b/apps/web/e2e/helpers/api-client.ts
index afe0e219cc..486e6b38aa 100644
--- a/apps/web/e2e/helpers/api-client.ts
+++ b/apps/web/e2e/helpers/api-client.ts
@@ -7,6 +7,7 @@ import type {
   TaskSessionState,
 } from "../../lib/types/http";
 import type { Agent, AgentProfile } from "../../lib/types/http-agents";
+import type { SSHSessionBody, SSHTestRequestBody, SSHTestResultBody } from "./api-client-ssh";
 
 // --- GitHub Mock Types ---
 
@@ -1519,54 +1520,15 @@ export class ApiClient {
   }
 }
 
-// --- SSH HTTP shapes (kept here, alongside the rest of the api-client types) ---
-
-export type SSHIdentitySourceBody = "agent" | "file";
-
-export type SSHTestRequestBody = {
-  name: string;
-  host_alias?: string;
-  host?: string;
-  port?: number;
-  user?: string;
-  identity_source?: SSHIdentitySourceBody;
-  identity_file?: string;
-  proxy_jump?: string;
-};
-
-export type SSHTestStepBody = {
-  name: string;
-  duration_ms: number;
-  success: boolean;
-  output?: string;
-  error?: string;
-};
-
-export type SSHTestResultBody = {
-  success: boolean;
-  fingerprint?: string;
-  uname_all?: string;
-  arch?: string;
-  git_version?: string;
-  agentctl_action?: "cached" | "uploaded" | "skipped";
-  steps: SSHTestStepBody[];
-  total_duration_ms: number;
-  error?: string;
-};
-
-export type SSHSessionBody = {
-  session_id: string;
-  task_id: string;
-  task_title?: string;
-  host: string;
-  user?: string;
-  remote_task_dir?: string;
-  remote_agentctl_port?: number;
-  local_forward_port?: number;
-  status: string;
-  uptime_seconds: number;
-  created_at: string;
-};
+// SSH HTTP shapes live in api-client-ssh.ts; re-exported here so existing
+// callers that imported them from api-client keep working.
+export type {
+  SSHIdentitySourceBody,
+  SSHTestRequestBody,
+  SSHTestStepBody,
+  SSHTestResultBody,
+  SSHSessionBody,
+} from "./api-client-ssh";
 
 // --- Jira / Linear mock payload types ---