debugging

Tailscale said everything was fine: it wasn't.

The Tailscale admin console showed a perfectly healthy app connector for an hour while it silently advertised zero routes.