Observed runtime checks (private hostnames and addresses omitted)

Signed-in host / original user:
  tailscale BackendState: Running
  tailscale serve --bg --https=443 http://127.0.0.1:19999:
    exit 1
    sending serve config: Access denied: serve config denied
  initial Serve config: none

Successful setup, operator temporarily granted:
  head tailscale.ensureTailscaleServe: Success
  head DirectEndpoints.configureTailscaleServe: Success
  certificate-verified HTTPS GET /.well-known/t3/environment: HTTP 200, ssl_verify_result=0
  after reopening Settings: HTTPS endpoint visible, no failure guidance

DNS acceptance:
  initial lookup of own MagicDNS hostname: resolves
  accept-dns=false: lookup returns no addresses (both runs)
  base after reopen: HTTPS switch aria-checked=false
  head after reopen: HTTPS switch aria-checked=true
  accept-dns=true restored

Independent logged-out daemon:
  BackendState: NeedsLogin
  serve status --json: {}
  serve --bg --https=443 http://127.0.0.1:19999: exit 1, Logged out.
  head: unknown setup diagnostic visible, saved-enabled switch checked
  base: Start Tailscale guidance, no HTTPS switch

Same running head backend, recovery by externally configuring its real Serve route:
  prior permission warning visible
  no backend restart during recovery
  after endpoint verification: warning cleared, HTTPS endpoint visible

Stability:
  all uploaded desktop stills: identical screenshot pair at >=500 ms
  mobile base and head raw screenshot pairs: cmp exit 0 at >=500 ms
  web fallback evidence: real browser recordings, not test assertions