- coverage audit recorded in the task file: every mapping.md row ×
every build it can appear in × both directions → the pinning test
- gap rows landed in tests/dispatch_core.rs: the streamlocal_forward
decline, the cancel-form refusions, the git-build pty decline
- never-features pinned in every build both directions; the auth-agent
open recorded pin-bound upstream (russh 0.65 declines AgentForward
opens pre-handler; no client initiator at the pin)
- sftp-only build verified no-op + declining via the matrix run
- matrix runner landed: scripts/matrix.sh (cargo test × 6 builds,
clippy ×2 -D warnings, fmt, doc), joined AGENTS.md verification list
Verification: scripts/matrix.sh green end to end
