0043: Pair gives control without a short code

Status: accepted. It replaces the short code in 0038; the rest of 0038 stands.

Context

0038 made host and guest read a six-digit code out loud before control could be given. The code was derived from both peers' DTLS certificates and the invite token, so it would differ if someone in the signaling path (Cloudflare's tunnel, or anyone who could change the offer and answer) put their own certificate in the middle. Testers found the step slowed every call down. It also protected less than it seemed: the code was read over the same call it was meant to check, and someone who simply had the invite link would read the same code honestly.

Decision

• One click. The host gives control with Give control next to a guest's name. There's no code to compare, no checkbox, and no confirm-code endpoint or leash pair code-matches command.
• Only while the host shares a screen. A guest controls what they can see. Give control is refused while the call is voice only, while choosing a screen, or while a guest has the turn.
• A new connection still takes control back. The helper reports each peer's certificate commitment when a connection comes up (FromHelper::Connected). If a guest's connection is replaced, control returns to the host, as a changed code did before.
• What stays from 0038: control is off by default and given to one guest at a time; the host's own mouse or keyboard takes it back at once; secure input, administrator windows on Windows, the protected apps and system shortcuts stay out of reach; the frame and banner show while a guest has control; the answering side still commits to its certificate before receiving an offer.

Consequences

• Less protection against a man in the middle of signaling. Trust in who's on the other end now rests on the invite token, which travels through Cloudflare, and on the host letting each person in by name. Someone able to change signaling could sit between host and guest unnoticed. Send invites only to people you know, through a channel you trust; Replace link makes a new one.
• The commitment step stays but no longer guards anything a person checks. It costs little, and keeps the door open to bringing a check back.
• Faster calls: giving control is one click, and the CLI and AI tools have one step fewer.
• CLAUDE.md's invariant 12 now reads "given, never taken" without the code.