Items 1–5 are implemented. Variant B is now the compatibility treatment in the web and desktop client.
| Item | State | Result |
|---|---|---|
| 1. Managed startup output | Built | Background service logs no longer mint or print pairing credentials, URLs, or QR codes. |
| 2. Service version safety | Built | Pinned and nightly CLIs install their exact version. Newer services are preserved unless --allow-downgrade is explicit. |
| 3. Pairing diagnostics | Built | Missing or stale runtime state names checked locations and points to --base-dir. Tailscale permission failures include the operator fix. |
| 4. Compatibility failure | Built | RPC defects and invalid schemas become a stable unsupported state. Stable versus Nightly mismatches show both exact versions and channels before config decoding. |
| 5. Tunnel origin drift | Built | The environment credential reconciles the active local origin at startup, persists it, skips unchanged origins, and retries recoverable failures. |
All three make the common Stable versus Nightly mismatch explicit. The channel and exact version are detected independently of the full config response. None inspect error-message text.
Names the actual mismatch first, shows exact builds, and offers symmetric fixes. Actions adapt when a surface cannot switch one side directly.
Avoids recommending a channel. The direct action copies the exact server command needed to match the client.
Very dense and immediately legible. Long nightly build identifiers will be truncated on narrow surfaces.
Metadata rule: the server version comes from the environment descriptor fetched before the WebSocket opens. The client channel comes from build metadata. If either is unavailable, the existing generic incompatibility banner remains.
B is implemented. Mobile retains the generic notice because its app version is independent from the connected server version.