For the source: where the proof assumes phase-randomised signals, the assumption must hold (it fails for mode-locked lasers, pulses carved from a continuous laser or plug-and-play schemes) or be addressed in the analysis or by active phase randomisation from true randomness; the photon number statistics must be verified and must not degrade over the device's life; the source must be characterised for side channels in degrees of freedom other than the encoding one (frequency, timing, spatial mode); and it must be impossible from outside to read or modify internal settings or components, with monitored optical isolators required as a minimum.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.