# Reproduction and capture protocol

This records actual interactive Preview operations; it is not an unexecuted browser harness. No repository files or real-user data were used. All fixtures are synthetic Linux interfaces, including the Tailscale-named dummy (no daemon/real tailnet claim).

Base checkout: `/home/ubuntu/wt/pr-25991-base`, 36d4d711b79c73eb33131944f73ea4a8c6156484. Head checkout: `/home/ubuntu/wt/pr-25991`, 2061bd78a2a0d6b5d9f8d4f93eeda0177a9ce15a. Created detached base with `git -C /home/ubuntu/t3code worktree add --detach /home/ubuntu/wt/pr-25991-base 36d4d711b79c73eb33131944f73ea4a8c6156484`, then `vp install` there. No build/source stubs or component harnesses.

## Network and app setup

1. Scratch root `/tmp/lead-25991-r1/evidence-capture`. Create namespaces `sudo -n ip netns add t3e25991` and `sudo -n ip netns add t3e25991cli`; bring `lo` up in each.
2. `python3 network-fixture.py init t3e25991` creates the public transport veth and VPN-first mixed fixture. Add host routes with `sudo -n ip route replace <address>/32 via 203.0.113.2 dev t3e25991h` for 10.172.46.2, 192.168.1.42, 198.18.0.1, 198.19.2.2, 100.101.102.103 as needed. The directly connected 10.172.46.0/30 route already reaches the manual LAN. No metadata/default Internet route exists in the target namespace.
3. Start HTTP client from head checkout with `T3CODE_DEV_SEED=0 vp run dev`. Actual runner output: serverPort=14243 webPort=6203, isolated checkout `.t3` state. Open `http://localhost:6203` using Preview, pair its fresh local client using its own startup link without exposing that credential in captures. Do not read or copy any live userdata.
4. For each target, execute `sudo -n ip netns exec t3e25991 /home/ubuntu/.local/share/vite-plus/js_runtime/node/26.12.1/bin/node target-launch.mjs <checkout> <fresh-home> <log> 0.0.0.0`. The helper forks the real serve CLI on port3773. Keep home stable only across control/revision swaps. Pair through a freshly minted target pairing URL using Settings -> Connections (labelled Environments in this build) -> Add environment. The UI is the same head web client on both sides; the target runs the actual requested SHA.
5. Preview freeform viewport1440x1000, light theme, zoom100%, DPR2, no device emulation, default16px interface font. Scroll positions0. Set app panelAnimationDurationMs=0. Set constructor Date to2026-10-27T16:00:00Z; R01 also froze Date.now. For upgrade recordings leave Date.now running so the real reconnect deadlines advance. This is a documented clock-condition limitation. Preview cannot emulate prefers-reduced-motion. All stills waited for network idle/fonts and two snapshots500ms apart with zero pixel difference. Preview downscales wide saved PNGs to1280x889; the full CSS viewport is preserved. Native videos are2880x2000.

## R01 fresh registrations

Base target home `r01-base-home`; head target home `run-20261027T160500Z/R01-head-home`. Pair afresh to `http://10.172.46.2:3773` for each SHA; remove previous registration before adding the head target. Expand route count. Base5 routes: manual10.172.46.2, learned198.19.2.2,198.18.0.1,192.168.1.42,100.101.102.103. Head3: same manualLAN, valid learnedLAN andtailnet. Run rpc-capture.mjs inside namespace for each. Save settled before/after stills. No transition is claimed by R01.

## R02 same-registration restart interaction

Fresh home `run-20261027T161900Z/R02-home`; mixed profile. Pair base once via10.172.46.2. Preserve home/browser registration/environment identity throughout. Record base control: hold initial connected5routes for2s, SIGTERM the tracked launcher, await actual exit, restart base with same home; automatic reconnect retains5routes. Record upgrade with same steps but restart head: automatic reconnect withdraws2VPNrows and retains manualLAN + learnedLAN/tailnet. No re-pair/toggle/storage deletion between the two sides. Catalog snapshots contain only target IDs/origins, no credentials. Final frame holds >=2s.

Recording UTC bounds: control16:20:22.351-16:20:45.996, upgrade16:21:00.229-16:21:12.190. Encoded durations23.956s/12.246s. At~2s stop/restart; upgrade final3route state visible by~10s. Control final5route state by~22s. Reconnect/offline diagnostics are normal transient states and not delivered as settled stills.

## R03 public manual transport, all advertisements removed

`python3 network-fixture.py vpn t3e25991` removes LAN/tailnet dummy candidates. Home `run-20261027T160500Z/R03-home`. Pair base manually through isolated203.0.113.2. Make host198.18.0.1/32 and198.19.2.2/32 routes unreachable to keep the public manual transport active; these routes affect browser transport only, not namespace enumeration/RPC. Preserve the same registration for base-control and head-upgrade recording. Initial3routes are learned2VPN plus manualpublic. Same2s hold/stop/await exit/restart interaction as R02. Base retains3; head returns actual successful RPC directEndpoints:[] and connected manualpublic only. Final frame holds>=2s. No address is Internet-routed.

Recording UTC bounds: control16:17:35.523-16:18:09.598, upgrade16:18:10.846-16:18:34.637. Encoded durations34.480s/24.181s. At~2s stop/restart; upgrade one-route result visible by~20s. Control reconnects with3routes by~13s. R03 endpoint RPC captures were taken in the same stable home/interface fixture before the final motion retake; host-only unreachable routes do not alter that RPC.

## CLI and units

`cli-matrix.mjs` runs R04-R08 in t3e25991cli, fresh timestamped home per case/SHA, actual serve + pair + authenticated server.getConfig. R05-R07 valid protocol3 context + connected Node IPC models managed service; no explicit host/dev URL. This is a launcher fixture around the real CLI, not a service injection. Context/actual interface order and persisted runtime show privateNetworkOnly:true. R08 explicit wildcard is unrestricted. `rpc-capture.mjs` reads persisted origin for explicit binds. ROWS=R04-vpn18,R04-vpn19 produced the successful recapture after fixing an initial127.0.0.1 assumption; only successful explicit-bind RPCs are delivered.

Head command `vp test run apps/server/src/environment/DirectEndpoints.test.ts apps/server/src/startupAccess.test.ts`: 2files/17tests passed. Windows hotspot and native macOS enumeration remain cannot-verify windows/macos; no native capture is claimed. C01-C04 require no additional captures and are not claimed newly runtime-verified.

## Packaging and review

`compose-evidence.py` verifies both sides against their second500ms still, builds labelled whole-viewport sheets and exact absRGB*16 diff0 plus per-channel>16 diffT. All delivered stills/diffs/sheets and sampled recordings were opened and visually reviewed. `redact-transcripts.py` removes pairing token/QR/session material from actual logs while preserving complete RPC response frames. Safe catalog files accompany R02/R03. Upload only synthetic delivery files and authored drivers with ghdrop upload -m; keep raw logs locally. Optional390x844 dark head capture is a supplementary viewport, not native mobile.

## What else changed

- R01/R02: count5->3, two VPNrows disappear; remaining learnedLAN/tailnet and Addroute move up96CSSpx; routecard shrinks96px and Loadbalancing/Pullrequestsharing sections move up96px. ManualLAN stays Inuse, valid automatic labels stay. No zero-threshold changes outside the affected card/header and the moved lower sections.
- R03: count3routes->Routes; two learnedVPNrows disappear; manualpublic moves fromthird tofirst and remains Inuse; the last-route removeX disappears. Header changes fromvia203.0.113.2 to fullhttp://203.0.113.2:3773/ due single-route presentation. Card and lower sections move up96px. No other zero-threshold changes.
- Motion: Connected becomes Reconnecting/Offline while process is replaced, Inuse temporarily disappears, and Connected/Inuse return after config reconciliation. No unrelated visual change found.

## Friction

- tool | Preview lacks reduced-motion/full virtual-clock controls and downsamples wide savedPNG | Declare browser capture capabilities and preserve native video dimensions; display date fixed, network clock live.
- infra | Root/netns invocation of node shim tried downloading a runtime without namespace DNS | Use the checkout-selected installed node executable path.
- model | Initial explicit-bind RPC assumed loopback and failed; one restart raced the old home lock | Read persisted runtime origin; await tracked process exit. Recaptured affected evidence successfully.
- tool | agent-browser CLI unavailable; Preview locators reject exact=true and Space must use key Space | Use documented Preview locator/key syntax. No browser fallback was needed.