# Proof audit, pass 1 — fixture matrix

PR [#25991](https://git.cafe/pingdotgg/t3code/pull/25991), source branch `fix/issue-17246`; read-only review in `/home/ubuntu/wt/pr-25991` (local review branch `pr-25991`). Audited head [2061bd7](https://git.cafe/pingdotgg/t3code/commit/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a) against supplied and `origin/main` merge-base [36d4d71](https://git.cafe/pingdotgg/t3code/commit/36d4d711b79c73eb33131944f73ea4a8c6156484). Local `main` has a different merge-base; it was not used. Live GitCafe metadata confirmed the requested head and target. No edits to the worktree, pushes, comments, browser use, or server launches.

## Findings first

1. **Proof is incomplete on this head.** This pass creates the capture specification, not runtime/UI evidence. Historical route-list evidence identifies [0833ff3](https://git.cafe/pingdotgg/t3code/commit/0833ff314a), before the new startup pairing-host exclusion. Even if its route images remain representative, it cannot establish the current pairing-URL behavior. The supplied [historical transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/550f1a46275576d3/transcript.md) could not be downloaded here (HTTP 403).
2. **A plain explicit wildcard launch cannot prove private pairing selection.** `serve --host 0.0.0.0` advertises filtered direct endpoints, but explicit host configuration disables `privateNetworkOnly`. The new pairing-host filter executes only when that flag is true. R05–R07 must record the resolved mode and use a managed-service-style launch, or carry an explicit harness label. Just setting the launcher-context environment variable is insufficient: connected Node IPC is also required.
3. **The browser origin matters.** The shared client rejects learned `http:` endpoints when the page runs on HTTPS. Use a separate HTTP web client for R01–R03; an HTTPS client showing no tunnel row does not prove this fix. Pair the target as a saved remote environment, not as the web client's primary/platform environment, which skips route learning.
4. **Reconnection needs motion proof.** Learned endpoints are reconciled from a connection session's initial server config. Keep environment identity and the browser's persisted registrations across the before/after server replacement, then reconnect. Stills alone do not prove stale-route withdrawal or timing. Manually paired/saved routes are deliberately retained even when no longer advertised.
5. **Native platform claims remain limited.** Linux can supply synthetic tunnel addresses through dummy interfaces; it cannot supply Windows adapter names with spaces. Native Windows hotspot behavior and real macOS VPN enumeration are not verified. R09–R11 are labelled unit-only coverage, not native recordings.

## Validation already performed

- Two changed test files passed **17/17** at the audited head (`vp test run apps/server/src/environment/DirectEndpoints.test.ts apps/server/src/startupAccess.test.ts`). Log: `run-20261027T155029Z/unit-tests.log` beneath this audit's scratch directory.
- An additional **32 assertions** passed in a scratch-only Node unit harness importing this checkout's real functions: `fixture-unit-harness.mjs`, successful log `run-20261027T155232Z/fixture-unit-harness.log`. It covers wildcard spellings, both benchmarking-range halves, explicit binds, hotspot names and private/unrestricted selection, tailnet fallback, localhost fallback, range boundaries, cloud suppression, and unchanged connection access policy. These are synthetic input assertions, not server/RPC/CLI/UI captures.
- `sudo -n true` exited 0; `ip netns list` exited 0 with no namespaces listed; `/usr/sbin/ip` is installed. This establishes tool availability, not that namespace creation and networking have been exercised. No namespace or interface was created.

Supplementary unit artifacts: [scratch harness](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/067f70660a50478d/fixture-unit-harness.mjs), [32-assertion passing log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9b5f15afd9b51b21/fixture-unit-harness.log), [17-test passing log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b323b897a806c739/unit-tests.log).

## Changed paths and complete caller/branch inventory

There are no changed React components, UI props, CSS, wire schemas, or provider adapters. The changed production files are [DirectEndpoints.ts](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/server/src/environment/DirectEndpoints.ts) and [startupAccess.ts](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/server/src/startupAccess.ts); the other two diff files contain tests.

| Changed function/data | Every production caller and downstream surface | Branches and data inputs |
|---|---|---|
| `isVpnTunnelAddress(address)` | `isAdvertisableAddress`; private branch of `resolveHeadlessConnectionHost` | Address belongs to `198.18.*` or `198.19.*`; all other addresses unchanged. Does not modify `isPrivateNetworkAddress` or the connection access policy. |
| `VIRTUAL_INTERFACE` | Wildcard interface enumeration in `resolveBoundEndpoints`; private-mode interface enumeration in `resolveHeadlessConnectionHost` | Existing virtual-interface prefixes OR a name ending `* <digits>`. English/localized hotspot names; ordinary numbered names remain. Explicit address binds bypass name filtering. Unrestricted pairing bypasses it too. |
| `isAdvertisableAddress` → `resolveBoundEndpoints` | `DirectEndpoints.make` → `DirectEndpoints.resolve` → `ws.loadServerConfig` via both `server.getConfig` and `subscribeServerConfig` | Loopback/undefined → none; wildcard `0.0.0.0`, `::`, `[::]` → enumerate; explicit host → test that address. Reject non-IPv4, internal entries (enumeration), public/link-local/loopback, virtual names (enumeration), and now benchmarking range. Deduplicate addresses. Cloud/private-service detection suppresses non-tailnet addresses. Tailscale identified by interface name or sentinel IPv6, so real Tailscale `utun` remains. |
| `DirectEndpoints.resolve` additions | Same two config RPC paths | Tailscale Serve disabled, reachable HTTPS endpoint added, no MagicDNS, failing/unreachable probe, timeout/error → no Serve endpoint. These branches are unchanged; their public tailnet URL can coexist with or outlive filtered LAN endpoints. The outer config discovery timeout also yields an empty array; distinguish that fallback from a genuine empty result. No endpoint-specific loading/error UI. |
| `resolveHeadlessConnectionHost` → exported `resolveHeadlessConnectionString` | (a) `issueHeadlessServeAccessInfo` → `serverRuntimeStartup` headless branch → `formatHeadlessServeOutput`: connection string, pairing URL and QR; (b) `cli/pair.ts` `resolveDirectPairingBaseUrl` → `pairCommand` output | Host absent → localhost; explicit host → normalized literal; wildcard private mode → eligible IPv4, prefer non-CGNAT LAN, otherwise CGNAT/tailnet, otherwise localhost. Wildcard unrestricted → first external IPv4 (including VPN/hotspot), then external IPv6, then localhost. `pair` dev URL override and `--tailscale` bypass direct host selection; localhost/private-network notes differ. Browser/desktop non-headless startup does not call the changed headless resolver through `issueHeadlessServeAccessInfo`. |
| Server config `directEndpoints?: [{kind:'lan'|'tailnet',httpBaseUrl}]` | Shared runtime supervisor `learnRoutesFrom` → registry `learnRoutes` → `mergeLearnedRoutes` → saved-route catalog → web/desktop/mobile views | Undefined old-server field or initial config failure → no reconciliation. `[]` → withdraw learned endpoints. Reported manual origin → retain/deduplicate. Withdrawn manual origin → retain. Existing learned origin absent → remove on new session. HTTPS page → reject HTTP hints. Primary/platform and unsupported active target types skip learning. Bearer/relay active routes supply credentials with existing restrictions. |

Source pointers: [config mode selection](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/server/src/cli/config.ts#L405), [connected IPC requirement](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/server/src/cloud/serviceLauncherClient.ts#L111), [pair caller](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/server/src/cli/pair.ts#L145), [initial config learning](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/packages/client-runtime/src/connection/supervisor.ts#L304), [merge behavior](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/packages/client-runtime/src/connection/routes.ts#L201), [registry guards](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/packages/client-runtime/src/connection/registry.ts#L866).

## Render-path inventory and equivalence decisions

- **Web/desktop route list:** the sole direct caller of `EnvironmentRoutesList` is `SavedBackendListRow` in `SavedEnvironmentRows.tsx`, rendered by `ConnectionsSettings` at `/settings/connections`. The route-count button and the More actions → Routes menu toggle the same `routesOpen` branch. Closed rows show `Routes` for one saved route versus `N routes` for multiple; open rows show the ordered list. R01/R02 cover multiple, R03 covers one. A saved environment cannot have zero routes; an empty *advertisement* list is not an empty *saved-route* UI.
- **Row inputs:** `route` determines LAN/Tailscale/VPN/public/SSH/relay label and optional address; learned bearer profiles add `found automatically`. `position` changes drag ARIA text. `inUse` requires connected phase plus matching prepared target. `removable` requires more than one saved route and a nonlearned row; learned rows lack the X, and the last manual row lacks it. R01 covers valid learned LAN and tailnet, manual/in-use and multi-route remove availability; R03 covers the single manual row. Address and environment-label truncation, absent-address relay/SSH cases, arbitrary long names and larger list counts are unchanged equivalence controls, not new capture dimensions.
- **Status and interaction:** parent connected/connecting/reconnecting/offline/error/available/unsupported and switched-off states, removing state, diagnosis/details, retry countdown, permissions, update actions and dialog errors/loading are unchanged. R02/R03 recordings include the disconnect/reconnect transition and removal of In use while disconnected. The route list itself has no loading or error branch. Route reorder supports pointer/keyboard, optimistic `pending` ordering and failure reset; remove opens confirmation and can cancel; Add route opens the existing pairing dialog. These interactions are not altered by this diff and do not require extra recordings. Opening Routes is setup for a stable still; testing its expansion animation would require a recording but is not part of this fix.
- **Desktop:** same web components; primary local/WSL/SSH target branches are unaffected. A paired remote environment is the relevant entry point. No Electron-specific capture required for a server-only data change.
- **Mobile:** `SettingsEnvironmentDetailRouteScreen` calls `EnvironmentRoutesSection`. Missing saved entry returns no section. It shows ordered rows, active/learned markers, count >1 Edit/Done, edit-only removal/reorder controls, drag offsets and accessibility step controls, Add route, and expandable permissions with session waiting/failure/authentication branches. iOS/Android differ in spacing, icon sizes and native symbols. All are unchanged; the shared catalog receives the same filtered endpoints. No native mobile visual proof is claimed or required by this server-only minimum.
- **Viewport/theme:** use **1440×1000 CSS pixels, light theme**, with the whole route section and addresses visible, at identical browser zoom for paired captures. A different single desktop size/theme is equivalent if declared and labels remain readable. No new dark-theme, narrow-width, responsive, iOS or Android styling path exists. Extra viewports/themes would add no evidence for the server filter. Terminal/RPC transcripts and unit assertions have no meaningful viewport or theme.

Render sources: [web route list](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/web/src/components/settings/EnvironmentRoutesList.tsx), [web caller](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/web/src/components/settings/SavedEnvironmentRows.tsx#L337), [mobile section](https://git.cafe/pingdotgg/t3code/blob/2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a/apps/mobile/src/features/settings/EnvironmentRoutesSection.tsx).

## Fixture matrix

Statuses: **PENDING** = required runtime/capture proof not produced in this pass; **UNIT PASS** = tested functions only; **TRACED** = unchanged source path inspected, not runtime-tested. Every UI still/recording uses the one viewport/theme above. Each terminal/RPC row requires before and audited-head outputs with the actual interface enumeration, flags/resolved private mode, server version/head, and result. All addresses below are synthetic fixture data.

| ID / named fixture | Data and setup | Diff effect / expected result | Proof type and minimum capture | Seed route / real app or harness | Pass-1 status |
|---|---|---|---|---|---|
| **R01 — fresh mixed routes** | Wildcard server; manual transport LAN `10.172.46.2`; second LAN `192.168.1.42`; VPN `198.18.0.1` and `198.19.2.2`; Tailscale-named interface `100.101.102.103`. Fresh browser registration for each revision. | Affected. Before: 5 reported endpoints / 5 saved routes (manual transport deduplicated). After: 3 endpoints / 3 routes. Both VPN rows disappear; valid learned LAN and Tailscale rows remain, with automatic labels; manual transport remains In use. | **UI still** before/after + image diff, and **terminal/RPC transcript** of endpoint tuples on both revisions. One desktop size/theme. | Real app with Linux netns, veth LAN transport, dummy LAN/VPN/Tailscale interfaces. HTTP web client → `/settings/connections` → Add environment → pair by transport URL → expand Routes. Linux network fixture, not native macOS VPN proof. | **PENDING** UI/RPC. Wildcard filtering and both halves UNIT PASS. |
| **R02 — existing client learns then upgrades** | Same mixed fixture and stable target T3 home/identity; browser first learns VPN routes on base. Replace target with audited head; preserve browser storage. | Affected. Existing learned VPN routes remain until new config is received; then both removed, valid learned/manual routes retained, route count corrected, connected state restored. | **recording** of old open list → controlled disconnect/restart/reconnect → cleaned connected list. Include endpoint/catalog transcript. Stills alone insufficient. | Real app. Keep client running separately from the target. Restart only tracked target processes; toggle saved environment off/on or use existing reconnect/retry action to force a new session. Do not delete and re-pair. | **PENDING recording**; shared reconciliation TRACED. |
| **R03 — all advertisements removed, one saved route remains** | Wildcard target with a documentation-public transport `203.0.113.2` on isolated veth (not advertised), and only the two VPN candidates; manually pair to transport from the same isolated test topology. No eligible LAN/tailnet advertisements. | Affected. Before: two VPN advertisements, three saved routes. After: `directEndpoints: []`; only manual public transport saved. Header becomes `Routes`, no automatic suffix, no last-route remove button, connection remains usable. | **recording**, including stable before/after route states and n>1→1 transition; final frame may supply a **UI still**. **RPC transcript** must show actual `[]`, not missing field or failure. | Real app on HTTP client and isolated namespace, public-range transport reachable only inside test topology. Preserve browser registration across revision swap. If topology cannot be built, label replacement as a catalog harness capture, not real app. | **PENDING recording/RPC**. Empty advertisements UNIT PASS; saved-route behavior TRACED. |
| **R04 — explicit binding branches** | Explicit binds to `198.18.0.1`, `198.19.2.2`, ordinary LAN, and hotspot address on a mocked Windows-named interface. | Address exclusion affects explicit VPN bind too: no direct hint. Explicit connection string keeps requested host. Explicit ordinary LAN/hotspot address is still advertised; name filter is not consulted. Manually saved route persists. | **terminal/RPC transcript** for Linux explicit VPN bind plus LAN control; **unit test only — cannot-verify windows** for explicit hotspot/name branch. No extra UI needed; manual retention covered by R03. | Real Linux namespace server `serve --host <address> --base-dir <run-home>` and authenticated `server.getConfig`; pure-function object fixture for Windows name. | **PENDING RPC**; explicit function branches UNIT PASS. |
| **R05 — private pairing prefers real LAN** | Private managed wildcard listener. Actual interface order puts both VPN range halves before LAN and tailnet. | Affected. Base pairing host can be VPN; head chooses real LAN. `serve` Connection string and Pairing URL hosts agree; non-dev, non-Tailscale `pair` chooses same LAN. | **terminal transcript**, both revisions, actual `serve` stdout plus `pair` stdout. Theme/viewport N/A. No UI screenshot needed. | Real managed-service-style Node child with IPC, valid `T3_SERVICE_LAUNCHER_CONTEXT`, no explicit host or dev URL, isolated base-dir. Record resolved `privateNetworkOnly: true` and enumeration. If using direct function/Effect service injection instead, label **harness transcript** and do not claim an actual CLI launch. | **PENDING terminal proof**; pure selection UNIT PASS. |
| **R06 — private pairing has tailnet only** | Private managed wildcard; VPN entries precede `100.101.102.103`; no eligible non-CGNAT LAN. A public transport may exist for test RPC but must not count as a private candidate. | Affected. Head chooses tailnet/CGNAT fallback rather than tunnel; advertisement contains tailnet only. A Tailscale `utun` with sentinel IPv6 remains eligible. | **terminal/RPC transcript** before/after; `serve`/direct `pair` may share the same transcript batch as R05. No UI required; tailnet row shape covered by R01. | Real namespace with synthetic Tailscale interface, private managed launch as R05. Label real-macOS `utun` part as unit-only R11. | **PENDING terminal/RPC**; fallback and utun retention UNIT PASS. |
| **R07 — private pairing has no eligible IPv4** | Private managed wildcard; only VPN external candidates, optionally public/IPv6/internal entries that private selection ignores; no valid LAN/tailnet. | Affected. Head falls back to `http://localhost:<port>` and `pair` gives local-only note; direct hint list empty. No unusable tunnel pairing host. | **terminal/RPC transcript** before/after; record actual resolved private mode. No UI required beyond empty-list case R03. | Real namespace with only tunnel candidates and loopback; root-invoked CLI can run inside namespace. Managed IPC launch as R05. A pure helper print is a labelled harness, not CLI proof. | **PENDING terminal/RPC**; localhost fallback UNIT PASS. |
| **R08 — unrestricted wildcard control** | Same VPN-first enumeration as R05, but plain `serve --host 0.0.0.0`, no private mode. | Unchanged pairing selection: first tunnel may still be printed. Direct advertisements nevertheless exclude tunnels. This distinguishes filter scope and prevents falsely claiming all headless URLs were changed. | **terminal/RPC transcript** before/after. No UI, viewport or theme. | Real Linux namespace, explicit wildcard argument; no launcher fixture needed. `pair` uses recorded unrestricted state. | **PENDING terminal/RPC**; unrestricted selection UNIT PASS. |
| **R09 — Windows hotspot with LAN** | `Local Area Connection* 2` at `.137.1`, `LAN-Verbindung* 10` at `.137.2`, both before normal LAN; ordinary `Ethernet 2` positive control. | Affected. Both hotspot names omitted from wildcard hints and private pairing selection; real numbered LAN preserved. | **unit test only — cannot-verify windows**. No native UI still or terminal claim. Expected visual outcome is same equivalence class as R01. | Labelled `NodeOS.networkInterfaces()` object fixture through real resolver functions; Linux cannot create the space-containing names. Existing direct-endpoint test plus scratch assertions cover this pass. | **UNIT PASS; cannot-verify windows**. |
| **R10 — Windows hotspot-only fallback** | Only English/localized hotspot IPv4 candidates. Private vs unrestricted pairing, plus explicit-hotspot branch in R04. | Affected private mode → localhost; unchanged unrestricted mode → hotspot host. Prevent filtering the new name pattern in modes that intentionally bypass it. | **unit test only — cannot-verify windows**. No viewport/theme. | Scratch-only pure resolver fixture. No production/native Windows claim and no repository test edits. | **UNIT PASS; cannot-verify windows**. |
| **R11 — native macOS VPN / Tailscale distinction** | `utun40` at `198.19.2.2`; real Tailscale-shaped `utun4` IPv4 plus `fd7a:115c:a1e0::/48` sentinel; ordinary LAN. | Affected tunnel excluded by address while Tailscale utun stays tailnet. Shared address classification/access policy otherwise unchanged. | **unit test only — cannot-verify macos** for native platform enumeration. R01/R05 provide Linux analog runtime proof separately. | Existing injected interface maps in changed tests and scratch assertions; no native macOS environment accessed. | **UNIT PASS; cannot-verify macos**. |
| **C01 — unchanged endpoint branches** | Loopback/undefined, hostname/public/mapped binds; internal/IPv6/link-local entries; duplicate entries; preexisting VM/container prefixes vs LAN bridges; cloud VM tailnet-only; Tailscale Serve success/failure. | Controls. No visual branch added by this diff. Cloud detection may otherwise mask the bug: non-cloud/private topology must be declared for before captures. | **unit test only / source trace**. No extra screenshots. Tailscale Serve success/failure is covered by the existing passing suite, not live Serve. | Existing tests plus scratch resolver assertions; namespace topology in R01 avoids metadata service. Unexercised unchanged subcases remain TRACED, not claimed newly tested. | **UNIT PASS + TRACED**, no required capture. |
| **C02 — range boundaries and access policy** | `198.18.0.0`, `198.18.255.255`, `198.19.0.0`, `198.19.255.255`, adjacent `198.17.255.255`/`198.20.0.0`; tunnel-address socket peers. | Both halves excluded; helper boundaries do not overmatch. Adjacent public ranges remain nonadvertisable for existing reasons. Private-network connection admission remains unchanged. | **unit test only**. Same UI shape as R01; no extra viewport/theme/capture. | Scratch harness imports real `isVpnTunnelAddress` and `acceptsPrivateNetworkConnection`. | **UNIT PASS**, no required capture. |
| **C03 — client origin/transport compatibility** | HTTP vs HTTPS page; bearer vs relay/primary/SSH; `directEndpoints` omitted vs empty; manual vs learned same origin; credential constraints. | Unchanged guards control whether server hints ever become visible; `[]` withdraws learned routes, omitted field does not trigger reconciliation. | **unit test only / source trace**; not an additional UI matrix. R01–R03 must use a qualifying HTTP saved bearer route. Relay labels, SSH address omission and HTTPS suppression need no new visual proof. | Shared runtime unit fixtures or inspected merge/registry functions. No need for a real T3 Connect account or native mobile instance. | **TRACED**, no required capture; shared-runtime suites were not rerun. |
| **C04 — unchanged presentation and interactions** | Closed/open list; n=1/n>1; active/disconnected; learned/manual; long/absent address; pending reorder/drag; remove confirmation/cancel; Add route; permissions; parent connection/error/loading/unsupported/off states; light/dark, narrow/wide, web/desktop/mobile. | No UI code changed. The only material state differences for this fix are disappearing rows, count, valid labels and active connection, covered by R01–R03. | Stable states → **UI still** in R01; count/reconnect/time transitions → **recording** in R02/R03. All other listed unchanged branches require no new capture and are not claimed runtime-verified. | Real settings routes for R01–R03. Native mobile controls remain source-traced; no imitation DOM/static-markup proof. | **TRACED**; relevant captures PENDING in R01–R03. |

## Minimum capture delivery

1. R01: matched before/after stills at 1440×1000/light plus an image diff. Show full addresses, automatic labels, route count, surviving LAN/tailnet and In use marker. Pair afresh for each side.
2. R02: one short recording showing old learned routes, controlled target replacement/reconnect, and the final cleaned multi-route list using the same browser registration.
3. R03: one short recording of the three-to-one route transition, and its final still if useful. Show `directEndpoints: []` in the associated transcript.
4. R04–R08: one or more plaintext transcripts covering all named input configurations on base and audited head. Batch them in one driver if convenient, but preserve row IDs and actual stdout/RPC payloads. R05 must include both `serve` and direct `pair`; the fallback rows should include the resulting `pair` notes as well. Interaction/time-dependent UI portions are recordings; plaintext terminal/RPC logs are the requested proof medium for CLI/service behavior, not a replacement for the UI recordings.
5. R09–R11: retain the explicit platform limitation and unit logs; no fabricated native screenshots. C01–C04 add no captures to the minimum.

## Seeding and evidence handoff details

- Each capturer run writes to a new UTC-timestamped subdirectory beneath `/tmp/lead-25991-r1/proof-audit-1/`; do not overwrite prior evidence. Keep target T3 home stable only for the upgrade scenario; use independent fresh homes/registrations for fresh-pair comparisons. Pass `--base-dir <isolated-run-home>` to these CLI commands. Do not use live userdata.
- Build the network fixture in an isolated namespace with a veth connection to the browser host, dummy VPN interfaces, and ordinary LAN/tailnet candidates. For R01, a Tailscale-named dummy interface is a labelled synthetic network fixture, not evidence that a Tailscale daemon or real tailnet transport worked. Ensure host routes make the selected pairing address reachable from the client.
- R03 uses documentation-public addresses exclusively inside the isolated topology, so the server can be paired through an origin that is not itself advertised. No Internet endpoint is involved. Before assertions must show actual tunnel hints; otherwise the setup has masked the bug.
- R05–R07: model the connected IPC setup used in the existing managed-service config test and launch a real `serve` child without explicit host, `T3CODE_HOST`, `--dev-url`, or bootstrap host override. Context uses `protocol: 3` and the checkout's actual server package version. Prove resulting config has `host: '0.0.0.0'` and `privateNetworkOnly: true`. If running the actual service launcher is impractical, a harness that constructs `ServerConfig` and invokes the real service must be labelled **harness**, including exactly which CLI/config layers were bypassed.
- Query authenticated `server.getConfig` or retain the initial `subscribeServerConfig` payload. Save the complete `directEndpoints` tuples, not a hand-assembled list or direct helper return presented as an RPC response. The latter is unit/harness proof only.
- Run the HTTP web client separately, navigate `/settings/connections`, Add environment using the target's synthetic pairing link, then expand Routes through the count button or More actions. For upgrade, replace only the tracked target process and reconnect without re-pairing. Record saved-route catalog changes or visible route IDs as corroboration where available.
- Include exact tested SHAs and commands. Pair base and head with the same fixture, viewport, theme, and URL visibility. Redact pairing secrets, tokens and their QR encodings from public uploads while preserving scheme/host/port/path. Upload UI images/recordings and transcript through ghdrop, keeping raw local evidence. No evidence assets belong in the repository.
- Only tracked PIDs may be stopped. This audit started no server, browser, namespace or persistent process; all its test/Node subprocesses exited. The lead-owned worktree is untouched.

FRICTION:
- tool | Historical transcript was inaccessible through web retrieval, then direct download returned HTTP 403 | Provide an accessible artifact or local copy.
- model | First optional scratch harness accidentally supplied its own default wildcard when testing an undefined host, producing a harness assertion failure; corrected direct call then all 32 assertions passed | Avoid defaulted wrapper arguments for undefined-input fixtures. The failed raw log was retained.

VERDICT: INSUFFICIENT R01–R03 UI stills/recordings and RPC evidence; R04–R08 current-head/base terminal/RPC transcripts