# Server CLI reproduction

This is a narrower reproduction than the reported two-machine desktop flow.
Two isolated T3 environments run on one Linux VM with real Tailscale in TUN mode.
The source is the actual CLI from each compared checkout. The target remains
on head for both runs, so the only comparison variable is the linking source.
No provider turns or live application data are used.

1. Install each checkout with `vp i`.
2. Choose an empty output directory; place driver.py and capture.py there.
3. Create `target/userdata/settings.json` under the output directory containing
   `{"linkedEnvironmentsEnabled":true}`.
4. From the head checkout start the target:
   `T3CODE_DEV_SEED=0 node apps/server/src/bin.ts serve --host 0.0.0.0 --port 19875 --base-dir <output>/target --no-browser`
5. Confirm `tailscale status --json` has `BackendState: Running` and `TUN: true`.
6. Run `python3 driver.py <base-checkout> <output>/before <numeric-target-url>`.
7. Run `python3 driver.py <head-checkout> <output>/after <same-numeric-target-url>`.
   Each run creates a fresh source database and issues a fresh disposable target
   pairing credential. Credentials, machine labels and checkout paths are
   redacted before terminal display. The driver prints actual command output.
8. For recordings, run the capture.py wrapper under headless-desktop. Its URL
   literal records the address used here; change it to the local Tailscale IPv4
   when repeating elsewhere. It runs those same commands in GNOME Terminal and
   records the display with ffmpeg. Stills require two identical captures 500 ms apart.
9. As a negative control, run driver.py on head with a numeric 100.64.0.0/10
   address absent from Tailscale status. Here 100.64.0.1 was absent and rejected.
10. Stop the target and remove disposable state.

Observed: base exit 1 with the unencrypted HTTP refusal; head exit 0 with
"Linked"; head negative control exit 1 with the same unencrypted HTTP refusal.

Not verified: desktop SSH environment selection, two-machine tunnel traffic,
loopback mismatch handling, or behavior with Tailscale stopped/userspace mode.

AI-assisted; verified with the tests and tools listed above.