@zackbart/connecta 0.36.0 → 0.36.2

package/documentation/architecture.md

@@ -763,9 +763,9 @@ adoption, OAuth handoff ownership, single-use connect links, every downstream
 OAuth grant write and consent claim, the result stash, and initialization of the cursor signing key.
 
 Every key is built in `src/storage/keys.ts`, which lists each family with its
-scope, version, codec, and TTL policy; `test/storage-keys.node.test.ts` fails when
-two families overlap, another source file spells a prefix (constant concatenation
-folded), or a storage call passes a key holding literal text. Core hands
+scope, version, codec, and TTL policy. Deployed-consumer persistence journeys
+check actual owner isolation in the physical database; key probes retain NUL
+refusal. Core hands
 subsystems namespaced views: `conn:<id>:` per connector, `principal:<key>:` per
 personal registry, `results:` and `subject:<key>:` for result paging.
 
@@ -1199,6 +1199,15 @@ meaning. These facts do not change agent error fields or write outcomes.
 
 ## Configuration
 
+Downstream OAuth browser extensions use `auth.authorizationParams` on
+`remoteMcp()` and `oauth.authorizationParams` on `api()`. Both snapshot and
+validate the string map at construction, reserve protocol/security parameters
+case-insensitively, and add entries only when publishing the consent URL.
+Remote MCP includes canonical sorted entries in its existing client configuration
+binding (omitted and empty maps remain equivalent); static API OAuth retains
+its existing token-endpoint binding. The [auth contract](./auth.md#browser-authorization-parameters)
+owns limits, reserved names, and reconnect requirements.
+
 `ConnectaConfig` is one schema (`src/config.ts`, combinators in
 `src/config-schema.ts`). The same value produces the TypeScript type a
 deployment writes, the unknown-key walk createConnecta runs before reading any
@@ -1210,8 +1219,8 @@ is resolved in place of the caller's object, so no getter or Proxy trap runs;
 an accessor on a config object or array is refused by path, as is an object
 that cannot be inspected. A closed object or record slot takes a plain object
 only: an array or a class instance there is refused by path, unread. String
-maps (static `headers`, `api()`'s `authorizationParams` and
-`tokenRequestHeaders`) are copied the same way and each value must be a
+maps (static `headers`, remote MCP and `api()` OAuth `authorizationParams`,
+and `api()` OAuth `tokenRequestHeaders`) are copied the same way and each value must be a
 string. A discriminated union (`remoteMcp()`'s `auth.type`,
 a provider's `auth.type`) with a missing or unrecognized discriminant throws
 with the valid values. Only plain data is copied. Connectors, modules,
@@ -1266,20 +1275,16 @@ removed. Legacy hosted selectors fail at construction with the generic migration
 path. GitHub retains its scope-enforced App identity and exposes a bounded repository-read and release-write hatch plus local scope discovery, scoped data search and guarded merge.
 
 [Decision 0011](https://github.com/zackbart/connecta/blob/main/decisions/0011-provider-standard.md)
-records the provider standard now implemented by all 15 maintained providers. It fixes
+records the provider standard implemented by every maintained provider. It fixes
 one folder layout per kind and fixed evidence names. `drift.json` gets a
 generated block and the guide a generated Conventions section, and every
-`api()` surface gets one agent-facing shape. Providers completed two migration
-steps: onto the kit with unchanged output, then onto the standard surface.
-Both `PENDING.step1` and `PENDING.step2` in `test/provider-standard.ts` are empty;
-every maintained provider now meets the standard without a migration exemption.
-`test/provider-standard.node.test.ts` holds every maintained provider folder to the
-standard, and `test/provider-conventions.test.ts` checks the surface rules on
-Node. `providers:generate` writes the standard's derived parts and
-refuses a provider past step 1 that breaks the `drift.json` rules, or one past
-step 2 that breaks the guide rules: `drift.json` version 2's `generated` block
-(operations from the kit's `ProviderKitFacts` and evidence digests), and a guide's `## Conventions`, rendered
-from the definition's declarations into `skill.generated.ts`.
+`api()` surface gets one agent-facing shape. Every maintained provider meets the
+standard without a migration exemption. `test/provider-standard.node.test.ts`
+holds every provider folder to it, and `test/provider-conventions.test.ts`
+checks the surface rules on Node. `providers:generate` refuses drift (D) and
+guide (G) violations before writing. It derives `drift.json` version 2's
+`generated` block from kit operations and evidence digests, and the guide's
+`## Conventions` from definition declarations into `skill.generated.ts`.
 The generator requires `fixtures.ts` to export `createAuthored()` with a
 nonempty offline `staticTools` catalog. Its input/output schemas derive one
 paging convention, including `get_*`, hatch search and details, excluding
@@ -1291,8 +1296,9 @@ reports a nonzero explicit refusal count with singular/plural wording and
 points to the actual prefixed details tool with method/path lookup; it never
 embeds the refusal table. Unreviewed operations remain refused.
 `ProviderContext.usageGuide` selects a guide's `<!-- when: <key> -->` blocks
-with the definition's `blocks`. `providers:check` reads both record versions,
-reports a manifest operation no endpoint row records at the provider's level,
+with the definition's `blocks`. Maintained drift records use version 2;
+`providers:check` retains version-1 endpoint/manual record parsing for historical
+reports, while OpenAPI generation and checks use `evidence/openapi.json`. It reports a manifest operation no endpoint row records at the provider's level,
 and lists manual checks last verified more than 180 days ago. Its offline
 record validator, `scripts/drift-validate.mjs`, also gates `providers:generate`
 and the standard suite, so a record they accept is one `providers:check` reads.
@@ -1356,8 +1362,10 @@ acknowledgement, then reconciles vendor state with exactly one physical send.
 `test/provider-privacy-journey.node.test.ts` checks credential echoes over HTTP.
 Focused provider suites retain MIME/draft restrictions, revision conflicts,
 CCB routing, Planning Center product exclusions and deployment pins. Native
-HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites;
-catalog copies and decoder/adapter parity matrices are retired under #1072.
+HTTP framing, cursor and request-lifetime fault probes remain in the HTTP suites.
+The catalog-wide status sweep and its argument roster, catalog/ranking copies
+and unused paging strategy tests are retired under #1072. Provider workflows
+belong in the existing shared outcomes; a new tool requires no failure-matrix row.
 No legacy REST tool adapter remains.
 Large documents opt into generator options that drop restated operation ids
 and plain path parameters and cap one operation's details (`opBudget`).
@@ -1376,7 +1384,7 @@ schemaless and non-JSON responses declare no fields. Request shrinking and
 endpoint contract digests do not depend on this metadata.
 Fields remain optional additive metadata, so a previously compiled
 index without the source bytes remains usable without inventing a response
-contract. Vercel's step-2 pin review restores response metadata from the reviewed public
+contract. Vercel's pin includes response metadata from the reviewed public
 document; operations without declared response properties still refuse fields. Breeze's pin declares no response
 properties. GitHub's immutable official OpenAPI pin supplies its complete index and response fields; a reviewed repository allowlist controls dispatch. Natural queries with reviewed matches scope discovery to those matches and named-only operations; explicit paths and unmatched queries retain full-pin refusal discovery.
 `check:providers-generated` checks each index header against its source record
@@ -1435,14 +1443,12 @@ every vendor ships one reviewed table through one mechanism
    signing, webhooks, drains, transfer, claim, and invite codes). It is the
    union of the detectors Cloudflare and Vercel shipped first, and
    deliberately over-inclusive. `providers:spec` writes
-   `evidence/value-safety.json` (`value-safety.candidates.json` until the
-   provider's step 1) when the source record sets
+   `evidence/value-safety.json` when the source record sets
    `options.valueSafety` (vendor `operationWords`; Stripe's `expansions: false`
    skips id-or-object expansions, which are their own operations' candidates),
    stamped with the pinned digest, the detector format, and its options. The
    file is test evidence and never ships.
-2. **One reviewed verdict per candidate**, in the vendor's `safety.ts`
-   (`value-safety.ts` until its step 1):
+2. **One reviewed verdict per candidate**, in the vendor's `safety.ts`:
    `refuse` (the generic tools refuse it before transport, naming the
    operation and the reason), `redact` (reviewed field paths), or `safe`, each
    with a reason. Paths are dot paths into the data a tool returns: a list on
@@ -1627,14 +1633,13 @@ response schema can return (through `options.valueSafety.dataRoot` for an
 envelope such as Cloudflare's `result`), and every resource rule path
 something the resource's schema can return. It stamps the paths that resolve
 into the candidates file and fails on the rest, unless the table's `absent`
-field (`value-safety.absent.json` until the provider's step 1) acknowledges
+field acknowledges
 them with a reason (shared verdicts applied to operations whose schema lacks a
 path, or fields a schema leaves undeclared; such paths still apply at
 runtime).
 
 `test/fixtures/value-safety.ts` is the shared harness each vendor's
-`value-safety.node.test.ts` (`provider.safety.node.test.ts` after its step 1)
-runs; `reviewProblems` is pure, and
+`provider.safety.node.test.ts` runs; `reviewProblems` is pure, and
 `test/value-safety-harness.node.test.ts` proves wrong paths fail it. It fails
 on candidates from another pin, format, or option set; an unreviewed
 candidate; a verdict for an operation the index lacks; a table path the stamp
@@ -1672,21 +1677,74 @@ capture determinism. Production invariants remain unchanged.
 Use the existing stateful fixture vendors and published-edge deployment adapters:
 
 - `pnpm run eval:outcomes` drives representative joins, retained paging, endpoint
-  refusal, auth handoff, value safety and refund recovery. Graders inspect
+  refusal, auth handoff, value safety and recovery after committed refunds,
+  cancellations, DNS and environment updates, plus a single GitHub draft release
+  and Google document partial creation and shared-drive permissions. Graders inspect
   independent downstream state and the physical mutation ledger, and reject
   wrong targets, duplicate writes, missing completion and interrupted trials.
+  Every reference also rejects a fabricated correct answer without the work.
+  Promoted read journeys reject erased MCP data even with the vendor ledger intact.
 - `pnpm run eval:smoke` boots the Node template, Node eval deployments and native
-  Workers deployments, including the actual QuickBooks provider, then exercises
+  Workers deployments, including the actual QuickBooks and Granola providers, then exercises
   MCP and the operator page.
+- The shared `granola-workspace-journey` outcome uses actual provider reads,
+  independent fake meeting state and physical cursor/filter requests on both
+  Node/SQLite/QuickJS and native Workers/D1. It covers transcript-too-large
+  recovery, empty intermediate pages, selected fields, withheld photo/credential
+  values and shared-vault reuse after application reconstruction. No-op,
+  fabricated-read and erased-delivery controls must fail.
+- `test/identity-write-journey.node.test.ts` uses the existing Node deployment
+  adapter, stateful MCP fake, SQLite vault and QuickJS to grade admitted human
+  and machine identities, pool isolation, fail-closed discovery, endpoint and
+  connector policy, physical mutation counts, ambiguous-write reconciliation,
+  credential ownership and payload-free activity. Independent decoding checks
+  returned private values and credential echoes; positive record facts must
+  still arrive. An explicitly writable pool also exercises reopening a
+  read-only deployment without bypassing connector policy.
+- `test/cancellation-journey.node.test.ts` observes a queued client's departure
+  without another vendor send, and an active client's departure after the
+  vendor commits. The vendor must see its held response socket close before
+  releasing it; a later MCP read recovers the committed intent exactly once.
+  `test/cancellation-faults.test.ts` keeps signal-less token-resolution,
+  warmed-credential digest, stalled body-cleanup and abort/grant races on Node
+  and workerd. These replace the universal Promise-method/seam/owner matrix
+  and its enrollment self-test, plus migration-only runtime wrapper checks.
+- `test/browser/operator-flows.spec.ts` serves the actual operator shell and
+  routes over TCP with file-backed SQLite. Sign-in, Settings provenance, OAuth
+  connect/disconnect and credential save/test/replace/remove survive closing and
+  reopening the app, database and vault. An independent SQL connection reads
+  trigger counts: one save, one replacement, one removal, and no credential
+  writes from reads or a rejected replacement. A real SQL trigger failure leaves the old
+  credential usable after restart. MCP calls verify that those edits preserve
+  the reader pool's actual read access and write refusal. Activity renders
+  successful calls recorded before restart without either credential value.
+- The existing Node-template `eval:smoke` target constructs invalid config from
+  published imports before any I/O and reuses a stored token after restarting
+  the consumer process. Its Worker-fakes target saves a personal credential in
+  Chromium, refuses another owner's use, saves that owner's invalid credential,
+  then restarts workerd on the same D1 directory. Actual downstream records
+  remain readable only to the correct owner. Direct SQL inspection finds two
+  distinct durable encrypted rows and exactly one committed save for each.
+- Keep focused SQL batch/schema/retention rollback, clock-skew and absolute
+  expiry, NUL/UTF-8 and literal-prefix, cross-connection claims, cancellation,
+  corrupt-row and tracing-secrecy probes. Keep operator identity/slot fences,
+  deadlines, CSRF, restricted-view projection and sink secrecy probes. These
+  cover faults that a successful browser journey cannot reproduce. Retired
+  evidence includes the key-prefix source scanner, config expected-object
+  matrices, operator structure snapshots and native-composition sentinels.
 - `test/provider-privacy-journey.node.test.ts` sends credentials through real
   HTTP MCP and a maintained API provider. Unknown vendor fields and keys carry
   raw, escaped, percent-encoded, base64 and Basic echoes through direct calls,
   QuickJS programs, failure and recovery. The independent decoder in
   `test/helpers/secret-echoes.ts` checks the wire responses for secret fragments;
   it does not normalize them to placeholders or compare saved output.
-- `test/provider-failure-sweep.test.ts` checks retained catalog examples for
-  dispatched failure, classification, auxiliary and composite write outcomes.
-  New providers use the required deployment outcomes above. Existing
+- `test/provider-hostile-response.node.test.ts` reconciles real HTTP mutations
+  after HTML, malformed JSON and oversized acknowledgements with one physical
+  send. It distinguishes Stripe's reviewed pre-execution 401 refusal, and checks
+  read failure facts, secrecy and recovery through direct and QuickJS calls.
+  `test/provider-failure-sweep.test.ts` retains only concrete auxiliary, composite,
+  in-flight and untracked-call fault probes; no provider/tool argument roster or
+  catalog/finalizer agreement sweep remains. Existing
   `test/sent-secrets.test.ts`, `test/sent-secret-output-boundary.test.ts`,
   `test/request-secret-redaction.test.ts` and `test/catalog-secret-redaction.test.ts`
   cover secrecy before projection, truncation, caching, paging and diagnostics.
@@ -1695,11 +1753,24 @@ Use the existing stateful fixture vendors and published-edge deployment adapters
   Native transport parity, OAuth and write-provenance suites retain their
   workerd coverage. The shared throwaway RSA key in `test/fixtures/rsa.ts` is
   used by write-provenance and unknown-write-advice fixtures.
-- The request, catalog, auxiliary-call, renewal and Promise-boundary lifetime
+- The request, catalog, auxiliary-call and renewal lifetime
   suites, plus `test/auth-admission-binding.test.ts`, exercise cancellation,
   held native work and garbage collection. These test actual request ownership;
   the retired capture scheduler's source guards were only harness constraints.
 
+The remaining probes defend distinct reachable failures: auth admission and
+native scheduler ownership, grant/callback fencing and refresh coordination,
+SDK replay/redirect/SSE attempts, nested write provenance and refusal evidence,
+unawaited program drain and failed-program accounting, catalog drift and paging
+revocation, and hostile serializers, structural echoes, truncation and persisted
+pages. Broad scripted-executor policy/privacy cross-products and repeated
+post-401 result/error-shape tables are retired. Protocol claims link executable
+evidence files in `spec/coverage.json`; the invariant contracts above are defended
+by the actual behavior assertions in these journeys and focused probes.
+The required CI gate includes build/declarations, Node and Workers probes,
+outcomes, browser flows, installed consumers and Docker, audits and real Eve
+compatibility. Further contributor cleanup is tracked in #1072.
+
 Add a compact fault journey only for a meaningful outcome those suites cannot
 observe. Reuse their fixtures and adapters; do not reintroduce a snapshot
 format, module loader or virtual scheduler. Workerd enrollment is for native
@@ -1708,6 +1779,19 @@ fetch, streams, Web Crypto, lifetime and request-byte behavior, as listed in
 
 ## Optional deployment modules
 
+`/google` (`src/google.ts`) exports the Promise-based
+`googleServiceAccountToken` request-token resolver outside the root graph.
+It reuses `src/providers/_shared/google/service-account.ts` for Web Crypto,
+in-memory token caching and exact-token invalidation, with an absent subject
+for service accounts acting as themselves. Workspace providers keep supplying
+subjects and retain their delegated error guidance. `src/request-token.ts`
+owns the callable resolver contract and optional HTTP-401 invalidation hook;
+`remoteMcp()` invokes it without replaying the failed operation.
+`test/google-service-account-token.test.ts` exercises signing/cache behavior on
+Node and workerd; `test/google-service-account-remote.node.test.ts` checks
+real-socket token/MCP requests, invalidation and one physical attempt per write.
+Operator setup lives in [Google hosted MCP](./auth.md#google-service-account-tokens-and-hosted-mcp).
+
 `createConnecta` takes closed typed `ui`, `vault`, and `activity`
 slots, with factories at `/ui`, `/credentials`, and `/activity`
 and agent tokens at `/auth/access-tokens`. Root exports the contracts, never the implementations, and there
@@ -1822,9 +1906,9 @@ declarations; elsewhere it lives in an unexported function or in
 (`ConnectorCallError`, `ExecutorAdmissionError`, `CallAdmissionError`) because
 callers and tests check `instanceof`, `name`, and `message`.
 
-Effect callers skip the Promise and take the program: `admit` and
-`acquireScoped` for request admission (`src/runtime/admission.ts`), `admitCall`
-and `acquireCallScoped` for call admission, `closeScope` and `closeScopeOnExit`
+Effect callers skip the Promise and take the program: `admit` for executor
+admission (`src/runtime/admission.ts`), `admitCall` and `acquireCallScoped` for
+call admission, `closeScope` and `closeScopeOnExit`
 for a connector scope, `withDeadlineEffect` where Promise code has
 `withDeadline`. The build prunes every declaration no `exports` target reaches,
 and `pnpm run check:declarations` fails if what remains names an Effect type.
@@ -2044,8 +2128,8 @@ published storage interfaces.
 The synchronous state-file parser, validation, file read, and one atomic
 SQLite import remain native synchronous leaves because `importStateFile` is a
 published synchronous API. `openSqlite` retains file modes, WAL, busy timeout,
-and database ownership. `test/sql-effect-contract.ts` runs native-path,
-affected-row, 50-claim, cancellation, and tracing checks on SQLite and native
+and database ownership. `test/sql-effect-contract.ts` retains affected-row,
+50-claim, typed-failure, cancellation, and tracing probes on SQLite and native
 D1. `test/kv-to-d1.test.ts` also reuses stores across separate workerd requests;
 the existing SQL contracts prove rollback, database-clock TTL, encodings,
 activity upgrades, and copy recovery.
@@ -2198,8 +2282,7 @@ ordinary Promise-based Connector factory. The kit stays outside the root
 graph and its Effect types are internal. In each provider, `api.ts` declares
 the vendor and `tools.ts` the tools.
 
-Decision 0011's standard surface (Tithe.ly's step 2) adds four kit pieces.
-A `list` without the legacy `key` returns `{ items, page }`, with
+The standard `list` builder returns `{ items, page }`, with
 `page.nextCursor` only while `hasMore`, and the kit appends `limit` (the
 declared default and maximum), `cursor` and `fields` to the tool's filters;
 `read` and `get` take `fields: true`. `src/http/fields.ts` narrows after every
@@ -2441,8 +2524,8 @@ after repairing/deleting a corrupt key, restart every process/isolate to clear
 cached keys. Pre-upgrade cursors require a new first page.
 
 The helper derives connection metadata and probe messages from
-validated options and still accepts complete legacy usage guides for compatibility.
-All maintained providers have completed the standard-surface migration.
+validated options and renders every maintained guide through
+`ProviderContext.usageGuide`.
 Candidate checks can refuse before authentication while
 preserving the provider's exact diagnostic. Its optional `authScope(options)`
 selector fixes OAuth grant ownership from deployment mode at construction;
@@ -2544,7 +2627,7 @@ dispatch.
 
 The generator's `allSuccessResponses: true` option unions JSON response fields
 from every 2xx. Existing providers keep the first JSON success contract until
-their own reviewed regeneration; no committed provider index changes here.
+their own reviewed regeneration.
 
 `src/providers/_shared/google/hatch.ts` supplies JSON framing over the existing
 confined `Connection.sendPath`. It retains the hatch's origin/media guards,
@@ -2571,8 +2654,7 @@ For example, a direct value-mode result has outer `result.data`, the hatch's
 `result.data.page.nextCursor`, and vendor JSON at `result.data.data`:
 `call_tool({ address: "crm.forms_api_read", args: { path:
 "/forms/form_1/responses", cursor: previous.data.page.nextCursor },
-resultMode: "value" })`. This is an envelope illustration for an opted-in
-provider, not a claim that the Forms migration has shipped.
+resultMode: "value" })`. Google Forms uses this continuation envelope.
 
 `googleErrors(product, { standard: true })` declares the product's 404 meaning
 and uses common status fallbacks; revision-conflict meanings require a
@@ -2602,7 +2684,7 @@ Sheets declares its seven API methods in `src/providers/sheets/api.ts`; its
 kit tools retain the private digest-bound cell cursor, legacy A1 path encoding,
 and create/append recovery advice. Its projections and the Google failure
 classifier read fields by the names Google gave them, which the kit's parse pass
-keeps. Its catalog and guide stay unchanged in step 1.
+keeps.
 
 Google's request adapter also offers a reviewed binary send. It marks the
 operation `googleBytes` for the product's `binaryBodies` selector and forwards
@@ -2814,8 +2896,8 @@ result handling, reviewed value safety and the deployment privacy projection
 before paging or provider projections can read it. Read methods beyond GET
 and HEAD require a review. Construction fixes each write step's capacity;
 the guarded transport reserves it before preparation and the shared core
-decides the whole call's write outcome. Dedicated upload builders wait for
-the Google Drive migration in C.7.
+decides the whole call's write outcome. Drive uploads use write builders over
+reviewed raw-body sends.
 
 Reviewed path calls resolve their actual method and path through an indexed
 safety adapter; a provider-supplied template cannot bypass the policy.
@@ -3026,7 +3108,8 @@ compiling and configuring the real thing.
   rejections are observed; dispatch and lease guards still contain detached
   work. Per-await I/O cancellation remains useful for releasing resources,
   while prompt refusal is enforced at the boundary
-  (`test/promise-boundary-lifetime.test.ts`). Invocation owns
+  (`test/cancellation-faults.test.ts`, `test/operation-cancellation.test.ts`
+  and `test/cancellation-journey.node.test.ts`). Invocation owns
   the recovery and logical-call records it reads after teardown. Closing an
   outer call also revokes nested calls paused in preparation. Request-owned
   MCP sessions and token flights outlive individual calls and close with the
@@ -3119,8 +3202,9 @@ compiling and configuring the real thing.
   at construction) and the predicate matched, which the ledger records on the
   request. Only Stripe declares it (`src/providers/stripe/api.ts`, reviewed
   as a `manual` check in its `drift.json`): an API v1 answer carrying Stripe's
-  `Request-Id`. `test/provider-failure-sweep.test.ts` holds that list to the
-  sources. Q8 is decided in one place, `settleWrite` in
+  `Request-Id`. The real HTTP hostile-response journey checks this refusal
+  against an ambiguous committed write; there is no copied declaration list.
+  Q8 is decided in one place, `settleWrite` in
   `src/write-outcome.ts`, once per logical call and over every request it
   recorded. The invocation calls it for every failure of a served write: a
   thrown or mapped error, a custom connector's, a program's call, and its
@@ -3369,29 +3453,17 @@ compiling and configuring the real thing.
   `write_outcome_unknown`. The caller's own abort reason still passes by
   identity for a read and for a served call, whose timeout passes through
   unchanged for the invocation to report.
-  The catalog-driven `test/provider-failure-sweep.test.ts` checks every API
-  provider/tool on Node, fails on missing provider/tool examples or a
-  dispatched failure bypassing the helper, and covers served write/read
-  overrides with HTTP 503 for every tool and a connection reset after send
-  for each provider/verdict representative. HTTP 401 recovery uses those
-  representatives plus the distinct composite, auxiliary, owner-lookup and
-  POST-as-read paths.
-  Shared sender and real-socket evidence below own status/reset permutations.
-  Local metadata
-  tools prove zero sends; composite calls prove each distinct request leaves
-  once. The round-5 cases additionally cover Docs creation with initial text,
-  composite success followed by refusal, GitHub preflight failures, typed
-  handler errors after successful sends, Forms cursor conflicts after 200,
-  generic-code vendor refusals, auxiliary failures after resource dispatch,
-  redaction of refusal errors, and concurrent direct-call ledger isolation.
-  The round-6 cases cover a composite write's early refusal while siblings
-  await credentials or are in flight, requests started after the call ended,
-  connect-phase errnos with each body kind (all unknown for a write, and a
-  direct read stays retryable), a request aborted with a refusal-shaped
-  reason, an errno outside fetch's network error, and
-  undeclared handlers whose untracked send precedes a typed failure. Each
-  catalog case also checks that the ledger recorded every resource request
-  the network saw, and the inventory that every API connector declares it.
+  Shared provider outcomes and the real HTTP hostile-response journey check
+  returned data, failure/recovery, privacy and physical writes without a
+  catalog-wide status matrix. `test/provider-failure-sweep.test.ts` retains
+  fault probes for Docs creation with initial text, composite success followed
+  by refusal, GitHub preflight failures, typed handler errors after successful
+  sends, Forms cursor conflicts after 200, generic-code vendor refusals,
+  auxiliary failures after resource dispatch and concurrent direct-call isolation.
+  It also holds siblings awaiting credentials or already in flight when another
+  write fails, refuses requests after call closure, and probes network errors,
+  refusal-shaped abort reasons and untracked sends. Native transport and
+  request-lifetime suites retain their platform-specific evidence.
   `test/write-evidence.test.ts` uses real refused, reset, and held sockets on
   both runtimes: a refused write is unknown and a refused read retryable,
   including a write aborted with another fetch's real refusal as its reason