Final done-check residuals (Spec 108/109 UX effort)

[Dumbris]

Low-severity residuals from the final definition-of-done check on main d7efa80 (Spec 108/109 UX effort). The medium items are being fixed in dedicated PRs.

• Access explainer, PATCH /config and retrieve_tools:
  • PATCH /config returns "No configuration changes detected" even when the change was applied.
  • retrieve_tools returns profile: null when nothing is hidden.
• connect codex writes the credential as ?apikey= in the URL. Check whether Codex supports a header and use that instead.
• Client rows still use emoji instead of logos (O3 residual).
• Home still says "Browse Registry", and Settings headings still carry emoji (N7 residual).
• Tool definitions aren't captured automatically for a newly imported quarantined server, and the Tools tab still points to a "Security tab" (S2 residual). This is handled in the review-screen PR if a safe path exists.
• The expandable Clients row gives no visual hint that it expands; its Activity, Sessions, Tools and Usage links are hidden inside.
• Activity: the "Success" text is visible to screen readers only, and the Scope column disappears at 900 px.
• The lock warning in the Connect dialog's "Require authentication…" navigates away and loses the half-done connect.
• Copy glitches: "finish this step.2 imported servers"; "No importable servers found" shown next to "2 servers imported".
• Flakes:
  • test-api-e2e.sh launcher-test reconnect check fails intermittently (also at baseline 638fa80).
  • shellwrap tests time out under load.
  • The activity-views vitest test timed out once.
• Follow-ups from Spec 108-c client credentials review (#1389) #1395 item 4 looks stale (fixed at mcp.go:541); verify it and close it.

[Dumbris]

Remaining lows from #1467:

• frontend/src/views/Activity.vue:2062 (showBlockedOffer): "Show N blocked attempts" does nothing when an explicit type override excludes policy_decision.
• frontend/src/views/Home.vue:47: on a fresh instance the usage strip flashes before the servers store loads.
• frontend/src/views/ServerDetail.vue:1931/1963: after an optimistic disable or quarantine, the Health tile still reads "Online" until the next refresh.
• native/macos/MCPProxy/MCPProxyTests/HomeTokenSavingsBadgeTests.swift:54: the test checks the whole source file, so it can't detect the card losing its shared estimate label.
• Opening /servers/<disabled server> logs a console error from a 500 ("Failed to get logs: server not found").

[Dumbris]

Remaining lows from catalog ranking PR #1469:

• internal/registries/listing_cache.go:146 matchCachedEntry matches literal substrings only, so a multi-word query like "github actions" misses hyphenated names in the cached fallback.
• internal/registries/catalog.go:585 namespaceOwner skips second-level suffixes without checking the first label is a country code (com.org.github/x → owner "github"). This feeds Verified and stars.
• internal/registries/catalog.go:496: residual Verified-badge spoofing via generic domain labels (labs/tools/mcp). Narrower than before the PR, and not a regression.
• docs/api/rest-api.md:1004 and docs/cli/catalog-commands.md:37: the "verified" wording doesn't cover the trusted Docker/reference exception.
• specs/109-ux-navigation-consistency/quickstart.md:130: the recipe says 3 official requests per typed search, but its multi-word step makes 4.

[Dumbris]

Remaining lows from review-screen PR #1470:

• internal/runtime/review.go:341-347 with internal/server/review_capture.go:49: coverage matches scan to record by tool name only. A server serving a benign definition to the scanner and a poisoned one at capture can read "clean". Fix: store per-tool definition hashes (or export time) in ScanContext. The approval gate re-scans independently, so this is a documented residual.
• cmd/mcpproxy/review_cmd.go:259-264: with no scan.coverage (older core), the CLI prints no Scan line, while Web and macOS read it as "none".
• specs/109-ux-navigation-consistency/contracts/mcp-tools.md:8: the server_summary.scan coverage sentence only holds on the captured branch of inspect_quarantined/inspect_tools.
• frontend/src/components/ReviewScreen.vue:95-98,131: an in-flight rescan error from server A can overwrite server B's state after switching servers. Fix: capture the server name at call time.

[Dumbris]

Remaining lows from CLI/security PR #1472:

• cmd/mcpproxy/registry_cmd.go:632: loadRegistryConfig swallows load errors. An explicit global -c pointing at a missing file isn't reported as CONFIG_NOT_FOUND for registry or catalog commands.
• cmd/mcpproxy/cli_config.go:30-35: the "data-dir given, no config anywhere" branch uses DefaultConfig() and skips the MCPPROXY_LISTEN/TLS env overrides.
• cmd/mcpproxy/doctor_redact.go:23: doctorURLPattern stops at an apostrophe, so a percent-encoded credential parameter after an apostrophe in the same URL escapes redaction (?label=Bob's&%74oken=...).

[Dumbris]

Remaining lows from Web user-test PR #1473:

• frontend/src/components/OnboardingWizard.vue:901-904 and utils/onboardingServersStep.ts:44-47: "including the N you just imported" assumes this session's imports were quarantined, which isn't true when the quarantine box was unchecked.
• frontend/src/components/ImportServers.vue:267: paste/file import emits names.length rather than summary.imported, so re-applying already-existing servers counts as new imports.
• internal/httpapi/import.go:300-313: a {} config previewed without a format hint still returns 400, while the swagger text promises 200. Only the paste-mode Quick-import button hits this path.

[Dumbris]

Remaining lows from telemetry/macOS PR #1471:

• frontend/src/components/TelemetryBanner.vue:116-118: the effective telemetry state is fetched only on mount, so a notice left open can show an obsolete mode.
• specs/109-ux-navigation-consistency/parity-matrix.json:1566: row 28a cites telemetry_cmd_test.go for telemetry status, but that file doesn't assert it.
• specs/109-ux-navigation-consistency/parity-matrix.json:1673: row 29a cites status_telemetry_test.go, which never asserts status.listen_addr.

[Dumbris]

From live QA of #1468: a nested call_tool to a server outside a profile-bound agent token's scope is refused by the token server check ("token does not have access to server 'fx'", ACCESS_DENIED). Its child tool_call record has no block_reason. A nested tier refusal correctly records block_reason=profile_tier. Server-scope refusals for profile-bound callers should probably carry a profile scope reason too, for consistent Activity filtering and the "Why?" view.

• Add a block_reason for nested server-scope refusals of profile-bound tokens and client credentials.

[Dumbris]

Remaining lows from telemetry/macOS PR #1471:

• frontend/src/utils/telemetryState.ts:55 and internal/httpapi/server.go:5675-5710: the Raw JSON telemetry lock is enforced only in the client. A duplicate case-variant key can store telemetry.enabled; at runtime the env override still forces it off. Enforce the lock on the server, or reject case-variant duplicates of locked keys.
• native/macos/MCPProxy/MCPProxy/Settings/ConfigSettingsView.swift:121-126: adoptRunningListenIfBlank refills a deliberately cleared listen field on the next status refresh. It can also mark an unsaved typed value as clean when it happens to match the running address.

[Dumbris]

• From fix(review): review screen starts fail-closed with exact-count approve (Spec fix-review-defaults) #1481 QA: mcpproxy review approve --all on a re-quarantined server prints "Allowing 14 of 14 tools; blocking none" while previously blocked tools stay blocked (cmd/mcpproxy/review_cmd.go:289). Reword it the same way as the UI and docs: pending or changed tools are allowed, and previously blocked tools stay blocked.