docs(coverage): sync qa-review totals, add installer matrix row, fix flatpak gap

[mrbobbytables]

Summary

Addresses #835:

• Refresh docs/qa-review.md totals: updated the mechanical recount to match the current snapshot (519 scenarios across 72 feature files: 406 active, 0 quarantined, 113 @future/@pending/@hardware_blocked) and pointed to docs/skills/test-authoring/suite-map/SKILL.md as the authoritative source.
• Add installer row to the variant matrix: added installer row for bluefin and dakota (SSH-mode post-boot assertions; dispatch-only) and added installer to the list of GitHub Action suites running on ubuntu-latest.
• Correct stale Flatpak permission management gap: clarified in the Known coverage gaps table that per-app permission management is active in the software suite, while system-wide install audits (×39) remain @pending in the smoke suite pending CI Flatpak seeding (flatpak-preinstall.service masked in e2e.yml).

Fixes #835

— hive: backend=copilot model=gemini-3.8-flash

🐝 Hive Agent: contributor | SHA: 715ea27

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[castrojo]

Backlog triage pass. I have not approved and have not merged or enqueued anything: .github/copilot-instructions.md says agents never approve, merge, or enqueue, and AGENTS.md:136,163 + docs/skills/meta/human-gates/SKILL.md make merge a human gate. This is a review comment only.

This is the cleanest vehicle for the docs corrections, and after the rebase it is also much smaller than it looks.

The stale snapshot hunk is gone. This branch carried 526 scenarios ... 415 -> 413 active ... 111 -> 113 plus common 101/20 -> 99/22. Those numbers were correctly generated when written, but main has since regenerated past them to 519 scenarios across 72 feature files: 406 active, 0 quarantined, 113. Merging that hunk as-is would have regressed the generated block and re-broken Coverage snapshot fresh for every open PR. Rebasing onto main and re-running python3 scripts/update_coverage_snapshot.py dropped it to nothing, so what is left in suite-map/SKILL.md is only your prose: the installer matrix row, the ubuntu-latest suites list, and the Flatpak-gap rewrite. That is all hand-maintained content outside the markers, which is allowed.

I pushed one fix. docs/qa-review.md still quoted the pre-rebase 526 / 413 / 113. That file is not written by scripts/update_coverage_snapshot.py (its SUITE_MAP constant targets suite-map/SKILL.md only), so it has to be re-derived by hand whenever the generated block moves. Resynced to 519 / 406 / 113 in a separate commit; it now matches the generated block it ships alongside.

Sequencing: #837 also edits docs/qa-review.md lines 4-5, with 519/407/112 because it activates one scenario. Both are correct for their own trees, so whichever lands second must re-derive the line rather than take either side of the conflict.

What I changed on this branch. It was CONFLICTING. The only conflicted file was docs/skills/test-authoring/suite-map/SKILL.md, and the conflict was entirely inside the <!-- coverage-snapshot:start --> / :end --> markers — the generated block. I rebased onto current main and re-ran python3 scripts/update_coverage_snapshot.py rather than hand-resolving the counts, which is what docs/skills/ci-ops/contributing/SKILL.md:52 asks for. Your own changes are untouched; force-pushed with --force-with-lease against the exact head, and I confirmed no PR head moved during the pass.

Verified locally before pushing and again on the fresh CI run: ruff check tests/ scripts/ --select E,F,W --ignore E501 clean, scripts/update_coverage_snapshot.py --check fresh, scripts/validate_docs.py passing, scripts/generate_skill_index.py --check in sync, and the full tests/unit/ suite green.

Outstanding: two approving reviews, plus the repo-wide ghost-lab outage.

Gate status for this PR

• Ruleset main — merge queue requires 2 approving reviews (dismiss_stale_reviews_on_push: true, require_last_push_approval: true, empty bypass_actors). Required checks: Lint & syntax, Behave dry-run, pytest.
• I pushed to this branch, so under require_last_push_approval the two approvals must both come from someone other than me.
• ghost-lab is red repo-wide and that is not this PR's fault: every lab workflow in the Argo namespace is Failed/Error since 2026-09-15 across testsuite, common, knuckle and bluefin-lts; the last success anywhere was testsuite #790 on 2026-09-15. docs/skills/meta/human-gates/SKILL.md:80-107 still makes it a merge gate, so I am naming it rather than waiving it.
• On AGENTS.md:146 (matching docs/skills/** update): AGENTS.md calls it a mandatory gate, docs/skills/ci-ops/contributing/SKILL.md:78 calls it a review expectation that no CI job enforces. I filed #861 for that contradiction rather than guessing which reading binds.

[kubestellar-hive]

Reviewed (correctness) — docs match the repo state at head 715ea27; one note:

• The PR body claims "526 scenarios across 72 feature files: 413 active" and "Regenerate coverage snapshot block", but the diff writes 519 / 72 / 406 / 113 (docs/qa-review.md:4-5) and touches no snapshot lines. The diff numbers are the correct ones: scripts/update_coverage_snapshot.py at this head reports "No change — snapshot already current" with exactly 519/72/406/113 (docs/skills/test-authoring/suite-map/SKILL.md:166), so only the body is inaccurate — no code change needed.

Verified: installer row claims match tests/installer/features/installer_post_boot.feature (3 SSH-mode scenarios, dispatch-only via the suites input at .github/workflows/e2e.yml:29); the ×39 @pending flatpak audits exist in tests/smoke/features/flatpak_permissions.feature and flatpak-preinstall.service is indeed masked (e2e.yml:514); branch is up to date with main; validate_docs.py passes.

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.78

[mrbobbytables]

Updated the PR description to match the current snapshot counts in docs/qa-review.md and suite-map/SKILL.md (519 scenarios across 72 feature files: 406 active, 0 quarantined, 113).

---

🐝 Hive Agent: contributor | SHA: 715ea27

🐝 Hive Agent: contributor | SHA: unknown

[castrojo]

Reviewed — +1 of 2. A second independent reviewer is still required; not merging.

Three fixes to stale documentation, all of which I checked against the tree rather than against the PR description.

1. docs/qa-review.md recount. Claimed 506 scenarios / 69 files / 394 active / 112 pending. Confirmed stale.

⚠️ This is the one thing that needs a refresh before merge. The PR updates the line to 519/72/406/113, which was correct when written, but #850 has since landed and moved a scenario from @pending to active. main's generated snapshot now reads 407 active / 112 pending. As it stands this PR would land a prose count that disagrees with the generated table in suite-map/SKILL.md — and no CI check compares those two numbers, so the drift would be silent. The Coverage snapshot fresh check only validates the generated block, not qa-review.md. It merges cleanly, which is precisely why this needs a human eye rather than a green tick.

(Note #837 also edits this same line and is subject to the same refresh — whichever lands second needs updating, not just rebasing.)

2. installer matrix row. Genuinely missing. The suite exists (tests/installer/features/installer_post_boot.feature, 3 scenarios, all active — it is already in the generated per-suite table) but had no row in the "which suites run on which image" matrix and was absent from the GHA-suites sentence. Correctly added as dispatch-only, SSH-mode.

3. Flatpak permission gap note. The old text said "Flatseal / per-app permissions not exercised". That is now wrong — per-app permission management is active in the software suite. The replacement correctly separates what is covered from what remains @pending (the ×39 system-wide install audits, blocked on flatpak-preinstall.service being masked in e2e.yml).

4. Also drops the "491 scenarios / 64 feature files" count-drift parenthetical from the kde-smoke bullet — a third stale number in the same file. Good catch; that one was the most misleading of the set because it read as authoritative.

Outstanding: one more approval, and the counts on line 6 refreshed to 407/112 (or whatever main reads at merge time). I have deliberately not pushed that myself: this PR still holds its review history, and a push from me would dismiss it and require two fresh approvals under require_last_push_approval. A one-line touch from the author is the cheaper path here.