PR https://git.cafe/pingdotgg/t3code/pulls/27879
Head 86ffa2e951b3de005d466ef6e4ad5d8bc68ba7eb
Main ce9e016406 (github/main at verification)

Main: separate /home/user/main worktree, vp i, background vp run dev --no-seed.
Proxy route HTTP 404. Agent-started 127.0.0.1:15473 app refused direct LAN access.
Real Codex gpt-6.1-sol turn built and started app through the web UI.
The original desktop bug was not reproduced end-to-end.

PR: exact detached head, vp i, background vp run dev --no-seed --home-dir /home/user/t3code/.t3 --host 0.0.0.0.
Server port 13773, web port 5733. Only one dev server running.
Added same real git repo through Add project > Local folder.
Real Codex gpt-6.1-sol turn started frontend and API under timeout 6000.
Issued grants using mounted web client previewEnvironment.issueProxyGrant command and its authenticated RPC transport.
Started unmodified production startRemotePreviewProxyServer against LAN server route with that grant.
Direct service launch bypasses desktop lifecycle/menu/IPC; those paths are unverified.
Repo Playwright + /usr/bin/google-chrome with authenticated proxy and <-loopback> bypass override.

Grant [15473]: frontend loaded at original http://localhost:15473/. API 15474 denied.
Grant [15473,15474]: Fetch API displayed source remote-environment, status ok.
Counter two clicks => 2. /details and back passed.
Reserved server port grant => PreviewProxyGrantError port-reserved 13773.
missing grant {"status":401,"body":"grant-invalid"}
unapproved port with live listener {"status":403,"body":"port-not-approved"}
non-loopback destination {"status":400,"body":"destination-invalid"}
approved frontend tunnel {"status":101}
renew 200 {"ports":[15473,15474],"expiresAt":"2026-11-01T08:01:47.440Z"}
revoke 204
renewed grant after revoke {"status":401,"body":"grant-invalid"}

After revocation, Chrome showed Preview unavailable despite local frontend still listening. No local fallback.

Blacksmith: 2 focused existing test files, 21 tests passed.
Existing PR CI: 28 success, 0 pending, 0 failing.
No source changes or publication of code.

Not verified: full desktop path. Pairing failed with Desktop secure storage is unavailable in this system context.
Stopped isolated secret-service attempt when it prompted; pairing not completed.
Embedded Electron preview, Remote access menu, automatic grant renewal, route changes, T3 Connect,
annotation delivery, multi-machine isolation, TLS/WSS, native mobile, macOS/Windows remain unverified.
Screenshots compare denied/allowed API grants on PR, not main versus PR.