# Proof audit pass 1 — final diff

Read-only proof audit of `/home/ubuntu/wt/issue-17202`, branch `fix/issue-17202`, head `43104e9349bd34737af38919d8dd6d17b7b8e08e`, base `ff1f6fd884`. No PR. Read worktree AGENTS.md, complete three-file diff, prior matrix, original red output, and controls red/green output. Worktree clean at inspection. No repository edits, tests rerun, captures, servers, browsers, or bot requests in this pass.

## Verdict and minimum proof

**Visual fixture matrix: EMPTY (0 rows).** No new render, native, navigation, style, or client implementation paths. Caller/conditional/interaction/platform/theme/width visual permutations are N/A. Worktree AGENTS.md requires: “A server-only fix with no visible surface ships the test plus a short runtime transcript.”

Minimum evidence is the existing original red regression, controls red regression, focused green results for the final changes, and ONE fresh real-app Claude after transcript with both capabilities disabled at the final head. No additional enabled live matrix, browser screenshots, recordings, simulator, or native captures are justified. Four independent permission combinations belong in automated HTTP discovery tests; they do not require four live sessions.

The prior statement that preview controls remain unchanged is superseded: `t3_preview_list` and `t3_preview_close` now require preview for discovery, matching their existing handler capability checks and resolving R1. Explicit membership assertions now cover both image tools and both controls in every capability row.

## Automated proof matrix

| Row | Changed path / caller | Capability condition and interaction | Expected evidence | Live requirement |
| --- | --- | --- | --- | --- |
| R1 | HTTP MCP standard preview, custom preview image, preview controls, standard device, custom device image registration | Neither; initialize then tools/list | No preview_* or device_*; explicit preview_snapshot, device_screenshot, t3_preview_list, t3_preview_close absent; ungated probe present | ONE matching fresh Claude disabled transcript |
| R2 | Same five registration paths | Preview only; tools/list | Preview family, preview_snapshot and both controls present; device family/device_screenshot absent; probe present | None; HTTP test sufficient |
| R3 | Same five registration paths | Device only; tools/list | Device family/device_screenshot present; preview family/preview_snapshot/both controls absent; probe present | None; HTTP test sufficient |
| R4 | Same five registration paths | Both; tools/list | Both families, both image names, both controls and probe present | None; HTTP test sufficient |
| R5 | EnabledWhen call filtering and existing handler checks | Direct calls with capability absent/present | Existing device toolkit test now expects denied device_list to fail tool-not-found; granted screenshot retains image content. Existing control handler tests exercise capability enforcement | None; server test boundary |
| R6 | Shared registration helper without a capability argument | Ordinary/HTML registrations | Existing behavior retained; ungated discovery probe survives in all four HTTP rows | None; focused regressions sufficient |

Standard and custom image registrations remain separate paths, now explicitly represented. Prefix assertions establish denied-family absence and some granted family membership, not an exact enumeration of every granted standard tool. The named image/control assertions close the prior image-discovery proof gap. The diff does not add a full HTTP denied-call matrix for preview/image/control tools; do not claim it does. Additional raw-protocol call probes, if a correctness review finds them necessary, belong in server tests, not live browser/native permutations.

## Exact brief for the evidence-capture agent

1. Use the lead-authorized isolated real-app environment running the final head above. Record actual running build/head, client/host and Claude CLI/model versions, and that this is a NEW provider session after both preview and device access are off. A resumed catalog from an earlier head is insufficient. Exclude credentials, pairing tokens and personal thread content.
2. Capture actual offered MCP tool names from that fresh Claude session, with enough raw catalog/transcript evidence to substantiate absence (not only a model assertion). Report zero preview_* and zero device_* tools, and explicitly verify preview_snapshot, device_screenshot, t3_preview_list and t3_preview_close are absent. If harness prefixes names, state the normalization used.
3. Show ordinary MCP discovery still works by identifying at least one expected ungated tool. A harmless ungated read can strengthen this but is not required for this discovery bug. Do not ask the model to invoke absent tools or bypass catalog filtering.
4. Save/upload one short redacted text transcript and return its URL and observed counts/names. No screenshots, video, browser/device interaction, enabled sessions, additional providers, themes, widths or client-platform matrix. Stop and report any remaining forbidden tool offered.

The lead will capture this. This reviewer did not launch or capture anything. **Final-head transcript remains pending.** The prior after at `a6c3bc1c8a` showed preview/device families absent while both controls remained offered; it is intermediate evidence only and cannot prove the final controls fix.

## Evidence status

- [Prior proof matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/36f39978169e09de/17202-proof-matrix.md): superseded by this final matrix.
- [Original before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2a63404c541ae920/17202-before-transcript.txt): prior audit records fresh Claude with both permissions false, 19 preview and 4 device tools offered, with execution denied. Before head differs from base; prior audit scoped equivalence to the affected discovery/gating paths.
- [Original red output](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/280beb53bb5558d4/17202-red-output.txt), also read locally at `/tmp/17202-red-output.txt`: none/preview-only/device-only fail, both-enabled passes on unfixed discovery behavior.
- `/tmp/17202-controls-output.txt`, read locally: controls pre-fix red fails for none/device-only at explicit t3_preview_list membership; green shows 24 tests across two files pass, plus targeted lint/format success. Red stops at the first failing assertion, so it does not independently report the t3_preview_close assertion; final source includes both assertions.
- Lead reports initial 224 MCP tests green plus later 24 focused tests for controls; these are successive runs, not 248 distinct tests. The 224 result and server typecheck are reported evidence, not independently log-verified here. No tests were rerun by this proof reviewer.
- Remaining minimum: final-head fresh disabled Claude transcript as specified above. Proof closure is pending that artifact; no new visual/native paths or capture requirements arose.

## Surface decisions

Shared server discovery/call filtering covers web, desktop and mobile clients before preview/device services. Provider adapters, contracts, auth issuance, client entry points, renderers and native code are unchanged. Local/remote/tunnel use the shared server registration; no new transport branch warrants extra live permutations. Fresh Claude matches the demonstrated catalog consumer. This is bounded proof of the changed server behavior, not a new certification of every provider/auth/transport combination.

## FRICTION — category | event | prevention

- Proof scope | Server discovery change could trigger unnecessary browser/native matrices | Derive fixtures from changed execution paths; keep visual matrix explicitly empty.
- Capability consistency | Initial fix omitted differently named preview controls despite the same handler permission | Inventory capability checks as well as name prefixes; assert both control names in all four automated rows.
- Assertion precision | Prefix-only granted checks missed custom image membership | Explicitly assert preview_snapshot and device_screenshot in the existing HTTP matrix; now resolved.
- Evidence freshness | Intermediate after transcript predates controls gating | Record one fresh disabled Claude catalog at the final running head; retain intermediate evidence only as history.
- Evidence accounting | Initial 224 and later 24 green runs can be mistaken for additive coverage | Label runs and scope separately; do not report 248 distinct tests.