The QR mirrored the browser origin — an operator browsing over Tailscale handed the phone a 100.x address it has no route to, so pairing silently never connected (reported 2026-07-22; the 'random password' alongside it was the device token working as designed). system.get-hostname now also returns the default-route LAN IPv4; the QR substitutes it (or the mDNS name) whenever the origin is localhost or a CGNAT/tailnet 100.64/10 IP. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>