diff --git a/TODO.md b/TODO.md
index a6b51b4..745bbfc 100644
--- a/TODO.md
+++ b/TODO.md
@@ -5,8 +5,7 @@
 # M2 — Seeing the work
 
 - Previews
-  Web: byre supervises a per-task dev server and exposes it over Tailscale, preferably as a per-task port through `tailscale serve`, since path-prefix proxying breaks apps that use absolute paths. iOS: on-demand simulator screenshots and recordings attached to the task, with Screen Sharing over Tailscale as the manual fallback. Shown as a pane tab.
-- Confirm `tailscale serve` can expose per-task preview ports
+  Web: byre supervises a per-task dev server and exposes it over Tailscale as a per-task port through `tailscale serve --bg --https=<port> http://127.0.0.1:<port>`, since path-prefix proxying breaks apps that use absolute paths. Any port in the task's block works, and identity headers pass through. While a port is served, a dev server can bind `127.0.0.1` on the same port but not `0.0.0.0` ("Address already in use"), so the dev server must listen on loopback. iOS: on-demand simulator screenshots and recordings attached to the task, with Screen Sharing over Tailscale as the manual fallback. Shown as a pane tab.
 
 # M3 — Second vendor and review