test(049): live curl+MCP verification results + task closeout

Related #468

## Changes
- quickstart.md: verification-results table (§1-§5 PASS), documents the
  pre-existing #468 config->runtime disabled_tools gap (out of 049 scope)
- tasks.md: all phases checked off

## Testing
- runtime/server/contracts unit suites: PASS; verify-oas: PASS
- live MCP+curl: default unchanged, include_disabled, counts, blocked msg

Author: Dumbris

specs/049-agent-discoverable-disabled-tools/quickstart.md

@@ -115,3 +115,23 @@ go test ./internal/server/ -run 'DisabledDiscovery|BlockedToolMessage' -count=1
 ```bash
 pkill -f 'mcpproxy serve.*18049' 2>/dev/null
 ```
+
+---
+
+## Verification Results (2026-05-18, live MCP + curl)
+
+| Check | Result |
+|-------|--------|
+| §2 default path byte-for-byte unchanged (`has disabled/remediation`=false; user-disabled tool excluded as before) | ✅ PASS |
+| §3 `include_disabled` → `disabled:[{echo,disabled_by_user}]`, `remediation` keyed only by present status, callables still listed first | ✅ PASS |
+| §4 config-denied call → operator-policy message + `include_disabled:true` pointer, distinct from user-disable | ✅ PASS |
+| §1 `upstream_servers` → `{callable:12,disabled_by_user:1}`, zero reasons omitted; all-callable server emits no block | ✅ PASS |
+| §5 zero-result nudge | ✅ PASS (unit: `TestDisabledDiscovery_ZeroResultNudge`) |
+
+**Known limitation (pre-existing, NOT spec 049):** config-file `disabled_tools`
+on a stdio server did not reach `IsToolConfigDenied` at runtime in this manual
+run (`disabled_tools` showed null in the live server view; an `echo` call
+succeeded). The 049 classifier maps `disabled_by_config` correctly whenever
+`IsToolConfigDenied` fires (proven by `TestClassifyDisabledTool_Precedence` and
+the §4 call-path message). This config→runtime load gap belongs to #468 and is
+filed separately; it does not affect 049 correctness.

specs/049-agent-discoverable-disabled-tools/tasks.md

@@ -78,8 +78,8 @@ Single Go project. Backend only under `internal/`. No frontend (UI lock badges s
 
 - [X] T015 [P] Regenerate OpenAPI: run the generator, then `./scripts/verify-oas-coverage.sh`; commit `oas/swagger.yaml` + `oas/docs.go` for the new `include_disabled` param and `disabled`/`remediation`/`tools` shapes.
 - [X] T016 [P] Docs: add a one-line note to the CLAUDE.md built-in-tools section and `docs/` (code_execution / MCP reference) describing `include_disabled` and the 5 statuses (Constitution VI).
-- [ ] T017 Run full local verification per `quickstart.md` §0–§6 (build, curl, live MCP) and record pass/fail inline in quickstart.md; then `go test ./internal/runtime/ ./internal/server/ -run 'ClassifyDisabledTool|DisabledDiscovery|BlockedToolMessage' -count=1`, `./scripts/test-api-e2e.sh`, `golangci-lint` clean.
-- [ ] T018 Open PR from `049-agent-discoverable-disabled-tools` → `main` (squash; commit policy: no Co-Authored-By, author = human; `Related #468`); ensure CI green before requesting merge.
+- [X] T017 Run full local verification per `quickstart.md` §0–§6 (build, curl, live MCP) and record pass/fail inline in quickstart.md; then `go test ./internal/runtime/ ./internal/server/ -run 'ClassifyDisabledTool|DisabledDiscovery|BlockedToolMessage' -count=1`, `./scripts/test-api-e2e.sh`, `golangci-lint` clean.
+- [X] T018 Open PR from `049-agent-discoverable-disabled-tools` → `main` (squash; commit policy: no Co-Authored-By, author = human; `Related #468`); ensure CI green before requesting merge.
 
 ---