# Capture drivers and interpretation

Checkout: /home/ubuntu/wt/issue-5639, head 853aceb5a1390badfe165d72266ce178bfee1886; base 9bc0c334383a43af5390283e9b10f999acc021b8. Evidence only, no tracked edits or forge operations.

## Fixture

All three transports forward to the same isolated backend on 127.0.0.1:15135. observed-proxy.mjs is the exact transport observer used. Private-user-CA HTTPS/WSS listens on 18443, system-CA HTTPS/WSS on 18444, HTTP/WS on 18080. The proxy logs only allowlisted HTTP operation metadata, TLS errors, WS upgrade statuses, frame sizes/directions, and selected RPC tags. It forwards encrypted/authenticated native app traffic; no certificate bypass is used. Keys stay local and are not included.

The source parses frames for metadata but does not persist payloads. transport-evidence.jsonl is a reviewed snapshot, with no headers, query strings, bodies, codes, cookies, tickets, or tokens. IDs restart when the proxy restarts at 02:00:03 UTC; use timestamps with IDs.

## Native gate

Used Android build-tools 36.0.0 aapt dump xmltree against apps/mobile/android/app/build/outputs/apk/debug/app-debug.apk, for AndroidManifest.xml and res/xml/network_security_config.xml. Native receipt and APK SHA-256 are in native-artifact-evidence.txt. A JS reload alone does not establish this gate.

## Device and pairing

Pixel 9, API 36, portrait 1080x2424, light appearance, font_scale 1.0. Every device mutation and capture used --session issue-5639. Pool leases were reused until Simlock ended the first lease; the replacement used the same named session and cached head artifact. Backend and Metro were never restarted by this pass.

Fresh codes were minted by .agents/skills/test-t3-mobile/scripts/pair-client.sh against the isolated .t3, with the relevant fixture origin. That script opens the app's existing Add Environment route with autoConnect, while suppressing credentials from command output. Screens with real codes were kept private or redacted. UI actions used snapshot refs/text, including Refresh providers and the environment Enable switch; no thread was run.

For the replacement install, the worktree's scripts/mobile-native-client.ts ensure android --session issue-5639 --metro <existing Metro origin> ran from /home/ubuntu/t3code, the device session's owning workspace. It reported cached fingerprint e9cabfd8aa6930799024d4e47fefcd0c8220fc7d, installed in 50s, source local. No native rebuild occurred.

## Publication transformations

Pairing clips use ffmpeg drawbox x=0:y=880:w=iw:h=ih-880:color=black:t=fill. R1 masks only its first 45 seconds and trims at 60 seconds; after 45 seconds the app is on credential-free settings/connection screens. R3 and R4 pairing clips mask that region throughout. R2's valid-code pairing clip also masks it throughout. Separate read/reconnect clips show the full screen. Black regions are explicit redactions, not missing application content.

The visible R0 and R2 discovery clips use deliberately invalid placeholder 123456. No usable pairing credential appears there; discovery fails before redemption. Blank scan illustrations are UI placeholders, not actual QR credentials.

The before/after comparison is a labeled side-by-side resize of two full-resolution stills. It shows an observable connection-state change, not a rendering change; pixel-diff scoring would be misleading. No UI render path changed.

Videos and stills were reviewed locally with ffmpeg-extracted contact sheets and full-resolution image inspection. Android screenrecord omits unchanged frames, so encoded durations can be shorter than capture windows. The final R3 read clip includes a small scroll after refresh completion so the completed state is encoded visibly. No sampled contact sheet is claimed as exhaustive frame-by-frame review; safety relies on conservative full-region pairing redaction and the credential-free content of read clips.

## Reachability limit of R2

The existing manual/deep-link pairing routes both call preparePairingRegistration, which fetches the HTTPS environment descriptor before redeeming credentials. Retained connections also fetch the descriptor in ConnectionResolver.authorize before preparing the RPC socket. After removal of the private root and process restart, this TLS preflight rejects the chain and no WSS upgrade occurs. The app does not expose a supported route to bypass that preflight. Therefore discovery and retained reconnect rejection are observed, while an independent native WSS TLS handshake rejection is UNVERIFIED / not reachable through this app flow. Do not present the TLS alert as proof of a WS-specific handshake.