Replit toolkit — one skill, four lanes

Lane 5 pointer: reaching a second box from this one (sshd bootstrap, proxy port reality, command -v/banner-probe traps, path-not-paste delivery) lives in references/join-bridge.md. Transport rule before you start: ssh to another box ONLY through a Host block whose ProxyCommand is the tailscale daemon's own nc (tailscale --socket=<sock> nc %h %p); a raw dial to the tailnet IP, an -J jump, or a hand-rolled SOCKS5 forward each lands on the platform gateway (binary dEob… preamble, then close) and reads as "banner exchange timeout" on a perfectly healthy box. Copy the working block from an existing Host entry instead of inventing a transport. Reachability is per node, not per tailnet: a listed peer answers only once it has joined, run the prep there and carries the hop key. Survey with scripts/probe-tailnet-peers.sh [port] and never promise "any machine on the tailnet"; scan one host across many ports with scripts/socks5-probe.py <ip> <port>... (reachability reading in references/join-bridge.md). The box's own row is printed as self there — resolve self from the JSON Self field, never from a name you remember, since the plain status table labels no row.