PR: https://git.cafe/pingdotgg/t3code/pulls/33559
GitHub PR: https://github.com/pingdotgg/t3code/pull/33559
main baseline: 4c924ff4e6d0828e0a5810336ec7d7827d752645
verified PR head: 0521ecbfbc8824a84674864e2f8c97022c0ef67c

Linux Boat VM. Repository Playwright 1.60.0 + /usr/bin/google-chrome.
One development server at a time. Main stopped before PR started.
Isolated app state. Project /home/user/t3code added in the UI; threads and
Codex gpt-6.1-sol turns created/submitted in the UI. No mock provider or fixtures.
Hosted-mode dev client http://localhost:8693, backend port 16733.
Real Node HTTPS reverse proxies with a locally generated certificate:
https://seed-pr33559.test:4444 and https://advertise-pr33559.test:4443.
Both preserve Host, set X-Forwarded-Proto: https, and forward WebSockets.
The seed route was paired in Settings; the advertised route was never manually added.

MAIN: vp i; T3CODE_ADVERTISE_URL=https://advertise-pr33559.test:4443 vp run dev
subscribeServerConfig snapshot: directEndpoints=[] (loopback bind).
Settings -> Environments -> Routes: only seed-pr33559.test, In use.
Codex gpt-6.1-sol: endpoint verification ok.

PR: vp i; same setting and app state; vp run dev
subscribeServerConfig snapshot:
[{"kind":"configured","httpBaseUrl":"https://advertise-pr33559.test:4443/"}]
Settings automatically adds advertise-pr33559.test, "found automatically".
Reordered it first by dragging its route handle. "In use" moved to it.
Fresh UI thread, Codex gpt-6.1-sol: learned https route works.
Route remained "In use" after the turn. Recorded in learned-route-codex.mp4/gif.

FALLBACK: stopped only the captured advertised TLS proxy PID; reloaded client.
Settings: seed-pr33559.test "In use", still Connected; learned route retained.

REMOVAL: stopped PR dev server; restarted without T3CODE_ADVERTISE_URL,
bound to 0.0.0.0. Learned route disappeared; original paired route stayed Connected.
Actual config snapshot:
[{"kind":"lan","httpBaseUrl":"http://192.168.122.32:16733/"},
 {"kind":"lan","httpBaseUrl":"http://10.77.12.109:16733/"}]

MULTIPLE: restarted with comma-separated uppercase/duplicate configured origins.
Actual config snapshot, in order:
[{"kind":"configured","httpBaseUrl":"https://advertise-pr33559.test:4443/"},
 {"kind":"configured","httpBaseUrl":"https://seed-pr33559.test:4444/"},
 {"kind":"lan","httpBaseUrl":"http://192.168.122.32:16733/"},
 {"kind":"lan","httpBaseUrl":"http://10.77.12.109:16733/"}]

STARTUP REJECTIONS, each exit 1 before listening:
--advertise-url http://advertise-pr33559.test -> not an https origin
--advertise-url https://advertise-pr33559.test/prefix -> not an https origin
T3CODE_ADVERTISE_URL with embedded credentials -> not an https origin;
password absent from stdout/stderr.
Managed policy clients=["desktop","local-browser"] + --advertise-url ->
ManagedPolicyRefusedError: policy does not allow remote clients,
so the server cannot advertise an address.

BLACKSMITH: vp run check:changed, explicit original base after fetching head history.
PASS format, lint, knip (both passes), GraphQL generation check,
typecheck 37 packages, 8 test files / 101 tests.
No source changes or push required. Existing PR CI: 30 successful, 0 failed.

NOT VERIFIED: native desktop/iOS/Android; real external DNS/public CA/ingress,
Tailscale/Connect; live two-environment linking (single dev server constraint).