Issue 25161 — final server evidence
Base: 03df289735527354a500c8e8cf371c11d4c75d3c
Final head (verified): 7219262525979feb9b26c8c3385958270fea43a0
Environment: Linux 6.1.102 x86_64; Node v26.12.1.
Workspace: /home/ubuntu/wt/issue-25161
Managed-service IPC context: protocol 3, childVersion 0.1.2.
Isolated T3 homes under /tmp/issue-25161; a Node net.Server bound to a specific nonloopback IPv4 address simulates the conflicting listener.

Exact replay commands reconstructed from inspected drivers and supplied log paths (lead already ran these scenarios; original shell history unavailable; not repeated):
cd /home/ubuntu/wt/issue-25161
node /tmp/issue-25161/runtime.mjs > /tmp/issue-25161/before.log 2>&1
node /tmp/issue-25161/loopback.mjs > /tmp/issue-25161/loopback.log 2>&1
node /tmp/issue-25161/after.mjs > /tmp/issue-25161/after-final.log 2>&1
Drivers invoke: node apps/server/src/bin.ts serve --port <listener-port> --base-dir <isolated-home>
Loopback control additionally passes: --host 127.0.0.1

Selected safe runtime lines:

BEFORE
Specific-address listener: 169.254.77.2:41835
  [cause]: Error: listen EADDRINUSE: address already in use 0.0.0.0:41835
Server exit: 1, signal: null

LOOPBACK CONTROL
Specific-address listener: 169.254.77.2:43517
[00:28:50.582] INFO (#6789): Listening on http://127.0.0.1:43517
Server exit: 130, signal: null

FINAL HEAD
Specific-address listener: 169.254.77.2:43167
[00:44:35.943] WARN (#51): Port 43167 is taken on another interface; listening on 127.0.0.1 only.
[00:44:36.808] INFO (#6490): Listening on http://127.0.0.1:43167
Server exit: 130, signal: null

Exit 130 follows the driver's SIGTERM after observing successful listening.

Red test (reported by prior evidence summary; raw red-test log unavailable):
"managed service falls back to loopback when its wildcard port is taken"
1 failed | 1 passed; EADDRINUSE from managed wildcard bind.

Green test: 1 file passed; 2 tests passed (green-test.log).
Focused reproduction command: vp test run apps/server/src/server.test.ts
The green log does not retain its invocation; this command identifies the inspected test file, not a recovered shell-history record.
Checks command: vp run check:changed (log shows node scripts/check-changed.ts).
All checks passed: format, lint, knip 1/2, knip 2/2, graphql (apps/server), typecheck (2 packages), test (1 file).
Check log scopes 2 files since c58beff8102e; it is not a full repository test run.

Limitations: no actual tailscaled, desktop update/rollback, or UI exercised. Server-only empty UI matrix confirmed by lead's proof audit pass1; no browser/captures required.
FRICTION: native resource telemetry sidecar unavailable (warning); it did not prevent listening. Raw red-test output and original green invocation were not retained here. Runtime logs are kept local; only these allowlisted binding/exit lines are published. Scratch retained. No repository edits, server reruns, push, forge operations, merge, or watch performed during evidence capture.