Mobile permission proof driver

Surface: T3 Code Android dev client on a pooled Pixel 9, Android API 36, dark theme, native viewport 1080x2424. Public images/videos are resized uniformly to 540x1212.

Use separate worktrees and fresh data directories for the base and head. Install dependencies in each with vp i. Never seed from an existing T3 home.

For each checkout, start its real server and Metro with:
  T3CODE_DEV_SEED=0 node scripts/scenarios/start-app.ts mobile <fresh-home> 13992 8192 <device-reachable-host>

Start fault-proxy.mjs separately. It forwards port 13993 to 13992 and exposes local-only proof controls. Save its stdout as <proof-root>/proxy.log.

Seed:
  node seed.mjs <checkout> <fresh-home> <seed.json>

Lease a Pixel 9 with the device-pool workflow and session proof-28708-android. Install the native client through:
  vp run mobile:install android --session proof-28708-android --metro http://<device-reachable-host>:8192
Set the device appearance to dark. Pair through the proxy:
  node pair.mjs <checkout> <fresh-home> proof-28708-android

Drive:
  node drive.mjs <before|after> <seed.json> <proof-root>

The driver fills the draft, captures a known grant, holds session lookups across a fresh app launch, captures the unknown state twice with an extra 15-second wait, releases the lookup and captures Send enabled. It creates a replay approval request through the real composer in Supervised mode for the Stop control. It drops proxied connections and refuses new connections for two seconds; it waits for the proxy to actually reset a session lookup before capturing network failure, then releases the fault and captures recovery. It holds a fresh lookup to show Stop disabled and captures Stop enabled after release. Finally it repeats the disconnect with HTTP 403 responses and captures explicit denial.

Every still requires pixel-identical screenshots taken at least 500 ms apart. The observation JSON reads warning text and native enabled flags from the app's accessibility tree. No test assertions are used as visual evidence. Stop retains a red icon when disabled; the captured native enabled=false/true observations establish its state alongside the recording. The separate approval-card permission message is outside this composer-warning fix.

The original base collection was resumed with the optional final argument "rest" after its pending/Send-recovery recording: the first network sample preceded Android's reconnect and was discarded. Final base pending captures come from the first successful segment; network, Stop and denial captures come from the resumed segment. The head collection uses three segments of the same driver: pending/Send, Stop/403 with the optional final argument "stop-only", and network/recovery with "network-only". Earlier head network clips were discarded: one ended during retry backoff, and another export stopped on a frame before recovery despite the recovery still. The final driver waits for Send to be enabled and retains a 30-second tail with an extra harmless blur tap before ending the recording. A pending Stop still initially failed the exact-pixel stability check, so that segment was repeated. The reset fault is held through capture rather than released after a fixed request count, so the failure window is visible on both sides. Lookup holds are explicitly released in the recordings.

Return the lease and stop both Metro/server and the proxy after collecting.