PR #21056 server-service proof
Base: 1451e7cb23034d29774338608368a15d8845df36
Head: a7514a120f503bdfb247957e975d184bb6f6f51e
Host: headless Linux / Node24
Production DirectEndpoints.make + resolve(), real NodeServices/FetchHttpClient layers.
Injected HostProcess.Platform=win32 or linux and synthetic NodeOS.networkInterfaces.
No real Windows driver, packaged desktop, remote paired client, iOS or Android verified.
Baseline is git show origin/main:apps/server/src/environment/DirectEndpoints.ts, copied to scratch with import specifiers relocated only; no behavior edits. Head loaded directly from worktree.

BEFORE (main):
Windows wildcard [{"kind":"lan","httpBaseUrl":"http://192.168.1.10:3773/"},{"kind":"tailnet","httpBaseUrl":"http://100.100.1.2:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.56.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.128.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.150.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.30:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.31:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.32:3773/"}]
Windows explicit host-only [{"kind":"lan","httpBaseUrl":"http://192.168.56.1:3773/"}]
Linux wildcard [{"kind":"lan","httpBaseUrl":"http://192.168.1.10:3773/"},{"kind":"tailnet","httpBaseUrl":"http://100.100.1.2:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.56.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.128.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.150.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.30:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.31:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.32:3773/"}]
Real host OS: linux ; interface fixtures and platform dependency injected; native Windows and drivers NOT verified.

AFTER (head):
Windows wildcard [{"kind":"lan","httpBaseUrl":"http://192.168.1.10:3773/"},{"kind":"tailnet","httpBaseUrl":"http://100.100.1.2:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.30:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.31:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.32:3773/"}]
Windows explicit host-only [{"kind":"lan","httpBaseUrl":"http://192.168.56.1:3773/"}]
Linux wildcard [{"kind":"lan","httpBaseUrl":"http://192.168.1.10:3773/"},{"kind":"tailnet","httpBaseUrl":"http://100.100.1.2:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.56.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.128.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.150.1:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.30:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.31:3773/"},{"kind":"lan","httpBaseUrl":"http://192.168.1.32:3773/"}]
Real host OS: linux ; interface fixtures and platform dependency injected; native Windows and drivers NOT verified.

Focused suite: 10 tests before -> 10 after, one existing file.
Negative regression proof: main production implementation -> Windows test fails, 9 others pass.
Focused lint, formatting, server typecheck passed (load checked before typecheck).
Screenshots are not applicable to the server filtering change; this proves emitted routes at the service boundary, not native Windows or client route persistence.