Tailscale finds the tailnet's login provider through the OpenID issuer link in phil@'s WebFinger record, which now points at Pocket ID. The same record carries GoToSocial's links, since the apex is its account domain; other fediverse discovery paths redirect to GoToSocial. All of these returned 404 before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>