# Real-server reproduction

AI-assisted; verified with the tests and tools listed above.

Both commits were installed with `vp i` and built separately with `vp run --filter t3 build:bundle`. No tests were used as evidence. The driver launches the built server from the checkout passed as its first argument. Every run gets a new timestamped directory, a fresh server-created database, and one synthetic Git repository seeded through the project HTTP API. It never reads a real database.

Prerequisites: Linux, repository-selected Node, OpenSSL, installed checkout dependencies. For recordings: Ghostty, Xvfb/headless-desktop, ffmpeg. Keep the downloaded scripts together in an empty scratch directory. Set SCRATCH to that directory and CHECKOUT to the desired checkout.

```sh
ln -s "$CHECKOUT/apps/server/node_modules" "$SCRATCH/node_modules"
openssl req -x509 -newkey rsa:2048 -nodes \
  -keyout "$SCRATCH/key.pem" -out "$SCRATCH/cert.pem" -days 1 \
  -subj /CN=github.localhost -addext subjectAltName=DNS:github.localhost
node "$SCRATCH/driver.mjs" "$CHECKOUT" before
# Or record the same invocation:
headless-desktop bash "$SCRATCH/record.sh" before "$CHECKOUT"
# Repeat with the head checkout and side 'after'.
```

The fixture listens on HTTPS github.localhost:19443 (localhost DNS resolution required). It always returns HTML HTTP 403, Retry-After: 5, and no X-RateLimit headers. A synthetic credential avoids real account access. Two pullRequests.checks RPCs use PR numbers 1 and 2, one second apart; distinct numbers avoid reusing a cached error. This is the server background-read path, with no interactive pause override. The proxy logs every actual inbound request.

Captured environment: Linux, Node 26.12.1, built T3 server, fresh isolated state, identical synthetic seed. Terminal: Ghostty, DejaVu Sans Mono 13, background #101820, foreground #e8edf2; Xvfb 1920x1080. Published videos crop the identical terminal rectangle to 1600x804, at 10 fps. Both recordings were opened and inspected across their frames. The server and fixture stop at the end of each run.

Observed base: first read says rate limit exceeded; second read says host paused; only one proxy request. Observed head: both reads say HTTP 403; two proxy requests about one second apart, inside Retry-After's five-second window.

Scope: the fixture reproduces the refusal response, not an actual client-certificate negotiation or successful gh API call. The exercised outbound transport was GraphQL (visible in the request logs). REST, genuine GitHub rate-limit responses, web/desktop/mobile presentation, and automatic linked-thread polling were not captured.