docs(connections): record current authorization qualification

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/plans/2026-10-13-connection-api-parity.md

@@ -111,7 +111,12 @@ The implementation was rebased onto `a1f77821b9cd5c9c846fdf7a0fa5cc620ad2b6bb`.
 - First Linux CI exposed a duplicate user fixture, a lost viewer restriction, a host-template visibility gap, an integration fixture race with production harness verification, and the prompt-bound Copilot identity. These are tracked and fixed separately from the local host limit. Current-head CI remains the completion gate.
 - Harness verification uses a deterministic lifecycle driver fixture; agent creation, grant defaults, bearer authentication, authorization, and persistence remain production paths.
 
-- Fresh isolated PostgreSQL 18 qualification: **25 acceptance scenarios passed** through the assembled server and actual bearer/session middleware. The database is a task-owned container; no shared service or kernel setting was changed. CI uses its normal embedded database path.
+- Fresh isolated PostgreSQL 18 qualification: **31 acceptance scenarios passed** through the assembled server and actual bearer/session middleware. The database is a task-owned container; no shared service or kernel setting was changed. CI uses its normal embedded database path.
 - Review regressions now prove nested finish audience authorization, both management grants, all/current target limits, task/project execution policy, actual actor/run attribution, another authorized target agent, human approval after a successfully yielded run, user/agent revocation, task cancellation, and replay without a second provider call.
 - The local MCP fixture initially lacked cached healthy catalog state; the next fixture pass exposed equal policy-priority assumptions and a legitimate closed-task 409. Those fixture expectations were corrected. A reused external test database also caused a Slack identity collision; the passing run used a fresh database. None of those attempts is represented as a passing run.
 - Saved setup UI and shared guidance: **278 passed**. Native API/OpenAPI regression selection: **2,041 passed**. Prompt-bound Copilot identity: **57 passed**.
+
+- Further review regressions cover bounded selector expansion before resource reads, duplicate-selector lookup cost, foreign-resource non-disclosure, one run capture per management listing, provider scope on existing and proposed configuration, and grant revocation during remote endpoint validation before persistence. Commit-time checks resolve current saved selectors and affected targets again.
+- A one-call rate limit permits the admitted test and denies the next test without a second provider invocation. The final policy check carries the invocation's recorded admission. The first new test assertion used an incorrect response shape; the corrected assertion checks the existing `decision`/`error` contract and actual provider call count.
+- Current workspace typecheck and production build passed after these changes. The focused Slack retry authorization cases passed (**3 tests**) after sorting both ID reads. Their first local attempt raced the database package build's migration-directory replacement; after that build completed, normal migrations and all three cases passed.
+- The preceding CI head had several runner-shutdown cancellations and a browser strict-locator failure involving duplicate chat replies. The chat integration failure was an unordered ID comparison, corrected above. These failures remain part of the qualification history; only fresh current-head CI can establish the final check result.