The strace in section 1 is the tell: read(0, "c", 1) means the shell already has decoded characters on the pts slave. A terminal emulator writes those bytes to the pty master; it does not push scan codes across /dev/pts. Scan codes die in the local keyboard stack (evdev), and over SSH the remote pty only sees the channel bytes. The rest of that section (alias/hash, PATH stat loop, clone + execve, parent in wait4) matches what I see.

Smaller one in the resolver section: [NOTFOUND=return] after mdns4_minimal is not "try mDNS, then DNS if missing." nss-mdns returns UNAVAIL for non-.local names so glibc continues to dns, and NOTFOUND only for .local misses, which is why those stop instead of leaking to the upstream resolver. The 301 walk-through is the part that is easy to get wrong and this one doesn't: Location stays on the www host, still plain HTTP, and -L is what starts the second hop onto HTTPS.