The final slice merged with the backend suite, type checks, lint and the whole frontend chain green. It had never spoken to a real server. This part is the closing account of what that meant, and where the work stopped.
Green Gates, Unproven Path
The transport was mocked wholesale in every test, which is correct for unit tests and means precisely that they proved the wiring around the protocol and nothing about the protocol. That is not a criticism of the strategy but a statement of what the gates measure: connect, verify, authenticate and write against an actual server is verifiable only by running it against an actual server — a container away, and still something you have to schedule deliberately, because nothing in the pipeline will ever tell you it is missing.
The Questions Code Cannot Answer
What remained was environmental, so it went out as a question sheet with code references rather than as tickets: outbound connections need a stable source address, because a customer's security team asks for one to allowlist, and an answer of it varies is an answer of no; egress on the port has to be permitted, or every delivery fails at the first stage looking exactly like customer misconfiguration; and the encryption key needs a custodian and a written rotation story, because rotating it makes every stored credential permanently unreadable and recovery means a human re-entering each secret by hand.
One decision could not be made in the codebase at all. Outbound HTTP destinations here block private and reserved address ranges; the new destination does not, which is a real exposure given that the connection tester reports which stage failed and can return a host fingerprint. But applying the guard makes customers reachable only over a private interconnect unservable. Which choice is right depends on whether the platform can reach such targets — a fact about the network, not the code. I wrote up both options and the single question that settles them, and left the code alone, because guessing would have committed either an unagreed security hole or a broken deployment and both would have looked like a decision.
Gaps Between Correct Changes
An audit-logging feature merged one commit ahead, wired deliberately to the services it enumerated. This one was not among them, so profile creation, modification and enablement — including the operations carrying credentials — emit no audit entries. Neither change is defective; the gap exists only between them, and it is invisible from either side.
Uploads are also written straight to their final remote name, so a customer watching a directory can ingest a half-written file that parses cleanly. Writing to a temporary name and renaming is the fix, and it changes what the customer's automation observes — which makes it an integration contract to announce rather than a same-day patch.