Environment: Linux CLI; real Tailscale 1.104.5. macOS target refusal simulated by PATH wrapper; all other calls use real CLI. Fresh isolated database.
Command: node src/bin.ts serve --host 100.111.125.34 --port 39527 --tailscale-serve --tailscale-serve-port 8527 --base-dir [fresh-state] --no-browser

[19:05:24.189] INFO (#65): Migrations ran successfully
  migrations: [
    '1_OrchestrationEvents',
    '2_OrchestrationCommandReceipts',
    '3_CheckpointDiffBlobs',
    '4_ProviderSessionRuntime',
    '5_Projections',
    '6_ProjectionThreadSessionRuntimeModeColumns',
    '7_ProjectionThreadMessageAttachments',
    '8_ProjectionThreadActivitySequence',
    '9_ProviderSessionRuntimeMode',
    '10_ProjectionThreadsRuntimeMode',
    '11_OrchestrationThreadCreatedRuntimeMode',
    '12_ProjectionThreadsInteractionMode',
    '13_ProjectionThreadProposedPlans',
    '14_ProjectionThreadProposedPlanImplementation',
    '15_ProjectionTurnsSourceProposedPlan',
    '16_CanonicalizeModelSelections',
    '17_ProjectionThreadsArchivedAt',
    '18_ProjectionThreadsArchivedAtIndex',
    '19_ProjectionSnapshotLookupIndexes',
    '20_AuthAccessManagement',
    '21_AuthSessionClientMetadata',
    '22_AuthSessionLastConnectedAt',
    '23_ProjectionThreadShellSummary',
    '24_BackfillProjectionThreadShellSummary',
    '25_CleanupInvalidProjectionPendingApprovals',
    '26_CanonicalizeModelSelectionOptions',
    '27_ProviderSessionRuntimeInstanceId',
    '28_ProjectionThreadSessionInstanceId',
    '29_ProjectionThreadDetailOrderingIndexes',
    '30_ProjectionThreadShellArchiveIndexes',
    '31_AuthAuthorizationScopes',
    '32_AuthPairingProofKeyThumbprint',
    '33_ProjectionThreadsSettled',
    '34_ProjectionThreadsSnoozed',
    '35_ProjectionThreadTitleRegeneration',
    '36_ProjectionThreadsPinned',
    '37_ProjectionTurnsKeysetIndex',
    '38_ProjectionThreadsPinOrderKey',
    '39_ProjectionProjectsDefaultThreadEnvMode',
    '40_ProjectionProjectFaviconPath',
    '41_AuthSessionClientConnection',
    '42_ProjectionThreadLinkedPullRequest',
    '43_ProjectionThreadsUnsettledAt',
    '44_ClearAutomaticProjectModelDefaults',
    '45_ProjectionProjectsAutoPull',
    '46_RepairAutomaticSettlementTimestamps',
    '47_ProjectionProjectIcon',
    '48_ProjectionThreadBranchPullRequest',
    '49_ProjectionThreadsActiveOrderKey',
    '50_ProjectionThreadPullRequests',
    '51_ProjectionThreadMessageContext',
    '52_ProjectionThreadTitleState',
    '53_PullRequestFilesViewed',
    '54_ProjectionThreadsAutoSettleDisabledAt',
    '55_OrchestrationV2',
    '56_RemoveRedundantProjectionIndexes',
    '57_ScheduledTaskWebhooks',
    '58_WebhookRelayDeliveries',
    '59_McpAppModelContext',
    '60_ThreadSnapshotWindowIndexes',
    '61_PullRequestReviewGuides',
    '62_ThreadFailureLookupIndex',
    '63_DropUnusedV1Projections',
    '64_CanonicalizeThreadPullRequestLinks',
    '65_CodexUsageNativeTurnIndex',
    '66_RepairClientSettlementTimestamps',
    '67_WebhookDedupe',
    '68_ShellStopRequestIndex',
    '69_ThreadMessageSearch',
    '70_PeerLinks',
    '71_PeerLinkFence',
    '72_WaitingLinkRequestIndex',
    '73_ActiveTurnItemIndexes',
    '74_ExcludeAttachmentPlaceholdersFromSearch',
    '75_SubagentDeliveryState',
    '76_ProjectionProjectsPinArchive',
    '77_RepairBooleanSettledOverride',
    '78_DropOrchestrationEventCorrelationIndex',
    '79_DelegatedRecoveryIndexes',
    '80_ScheduledTaskThreadMode',
    '81_ProjectionMessageSearchText',
    '82_TurnItemConversationIndex',
    '83_CommandReadIndexes',
    '84_LastExecutedRunIndex',
    '85_TurnItemCounts'
  ]
[19:05:24.197] WARN (#432): process group metrics are not exported: sample failed
  ResourceTelemetryRefreshFailed: Resource telemetry operation 'refresh' failed.
      at [source location redacted]
      at [source location redacted]
      at Array.map (<anonymous>)
      at [source location redacted]
      at [source location redacted] {
    [cause]: NativeTelemetryUnavailable: Resource monitor is unavailable: sidecar is not running
        at [source location redacted]
  }
  operation: refresh
[19:05:24.635] INFO (#946): Listening on http://100.111.125.34:39527
[19:05:24.642] INFO (#943): agent activity publishing standby; waiting for T3 Connect link reconciliation
[19:05:24.642] INFO (#943): V2 orchestration recovery completed
  {
    terminalizedRuns: 0,
    stoppedSessions: 0,
    closedRequests: 0,
    retiredEffects: 0,
    requeuedEffects: 0
  }
T3 Code server is ready.
Connection string: http://100.111.125.34:39527
Token: [redacted]
Pairing URL: [pairing URL redacted]
App link: [redacted]

                                     
                                     

[19:05:24.730] WARN (#950): Failed to configure Tailscale Serve
  {
    cause: {
      _tag: 'TailscaleCommandExitError',
      executable: 'tailscale',
      subcommand: 'serve',
      argumentCount: 4,
      exitCode: 1,
      stderrLength: 102,
      stderrDiagnostic: 'unknown'
    },
    localPort: 39527,
    servePort: 8527
  }
[19:05:28.047] INFO (#27): V2 orchestration shutdown reconciliation completed
  {
    terminalizedRuns: 0,
    stoppedSessions: 0,
    closedRequests: 0,
    retiredEffects: 0,
    requeuedEffects: 0
  }

Command: node src/bin.ts pair --tailscale --tailscale-serve-port 8527 --base-dir [same-state]
[19:05:28.020] ERROR (#2): TailscaleServeFailedError: tailscale serve failed for HTTPS port 8527. Run `tailscale serve --https=8527 --bg <local-url>` by hand to see why.
    at [source location redacted]
    at [source location redacted]
    at Array.map (<anonymous>)
    at [source location redacted]
    at [source location redacted]
    at tailscale.runTailscaleCommand ([source location redacted])
    at tailscale.runTailscaleCommand (definition) ([source location redacted])
    at pair.resolveTailscalePairingBase ([source location redacted])
    at pair.resolveTailscalePairingBase (definition) ([source location redacted]) {
  [cause]: TailscaleCommandExitError: tailscale serve exited with code 1.
      at [source location redacted]
}

Pair exit: 1

Actual wrapped Serve calls:
tailscale serve --bg --https=8527 http://100.111.125.34:39527
tailscale serve --bg --https=8527 http://100.111.125.34:39527