docs(parity): corrections round 8, 4 rows re-read against their issues

[rubenvdlinde]

Corrections round 8 re-reads parity-matrix rows against the issues the functional issues lane filed or commented on, and corrects the own rating where the issue shows at the current tip that the rated capability does not work. Only openspec/parity/capabilities.json changes. Every citation was re-read at development b5727e0; no fix landed on the cited files after the issues were written.

row	before	after	issue	what the issue shows at b5727e0
apps-06	keepiq yes	keepiq partial	#793	The by-name route answers, but the CLI reads a top-level scheme and payload.value (cli/internal/client/client.go:201-207) while the server sends encryption.scheme and ciphertext.key (lib/Service/MachineSecretEnvelopeService.php:145-148), so cli/ci.go:65-66 refuses every envelope.
apps-15	keepiq yes	keepiq no	#793	ci run uses the same fetchDecrypt() (cli/ci.go:118), so it stops before runChild (cli/ci.go:125) and no secret reaches the child process.
apps-10	evidence and note	evidence and note appended, rating yes kept	#793	The CLI never prints the lease line (cli/ci.go:84-86) because the fetch fails first. The server still grants the lease and sends its headers on every machine fetch (lib/Service/MachineSecretResponseService.php:95, :118), so the lease capability works.
portability-09	evidence and note	evidence and note appended, rating partial kept	#749	A restore loses every secret type, not only custom ones: the backup stores the type UUID (src/export/serializer.js:120, lib/Db/Secret.php:307) and the import only recognises type names (src/store/modules/import.js:271-288). Names, values and folders still round-trip, which partial already records.

Rows on the list left alone: none. apps-10 keeps its rating on purpose, as the table says: the defect is in the CLI's display of a lease the server does grant.

Checks:

• parity-verify --strict: 229 rated rows, 0 pending, 7 systems, one finding (the unknown-cells census, 150 cells), schema errors 0, before and after identical.
• node v24.11.1, npm 11.19.1: npm ci exit 0, lint exit 0, format exit 0, check:manifest exit 0, check:schema-l10n exit 0, test:l10n exit 0.
• composer check:strict: not run, no lane has a bare-clone run that finishes, and this PR changes only the matrix JSON, which no PHP gate reads.

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/keepiq @ d0b4a31

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
format		✅
check-l10n-js		✅
check-schema-l10n		✅
composer			✅	✅ 114/114
npm			✅	✅ 660/660
app:check-code	⏭️
info.xml	✅
REUSE	✅
lockfile sync		✅
PHPUnit					⏭️ not run for this diff — no file in this diff matches the code globs, and none carries a source extension — the heavy tier has nothing to decide about it.
Newman					✅
Playwright					⏭️ deferred: E2E runs locally and on the promotion path only. This pull request targets development, so the suite is asked once per promotion into beta and main rather than once per push per open pull request. Run it on any branch from the Actions tab, or locally with npx playwright test.
Hydra gates					✅

---

Quality workflow — 2026-09-28 04:46 UTC

Download the full PDF report from the workflow artifacts.