Estimate: 35m · Depends on: 6.7.1, 6.1.6, 6.2, 6.3, 6.4, 6.5, 6.6
The chain-proof: tests/e2e/epic6-journey.spec.ts, one continuous flow on a fresh small project (not the corpus — this spec is about the seams, not scale), against the standing dev-server harness with the Inngest dev stub.
The build-up (admin): build an advanced filter with a negation row + a custom-field row (the 6.1 builder) → save + name it (6.2) → back a dashboard widget with the saved filter (6.3) → create an automation rule from the built-in action set (6.6) → transition a matching issue → assert the seams in one pass: the rule fires through the job lane exactly once, its action lands through the shipped services (History records it attributed to automation — the 5.5 feed shows it like a real actor; the 5.4 watcher email fires with the dedupe contract intact, actor excluded), and the saved-filter result set + the widget count both track the change.
The gate (non-admin): in a limited/private project (the shipped 6.4 levels), the viewer uses what the level grants, but EVERY Epic-6 admin surface — saved-filter management, dashboard editing, rule admin in the 6.5 hub — is hidden in the UI AND rejected 403 at the API (deep-link + direct request both). These surfaces post-date 6.4.8, so no shipped test covers them.
The unwind: delete the saved filter under the live widget → the designed stale-widget state (the 6.1 stale-referent durability rule one story up), never a crash; disable the rule → a further transition fires nothing; delete the rule → its History entries keep rendering via the deleted-referent fallback (the 5.5.1 grammar).
Vitest companion (tests/integration/epic6-journey.test.ts): the consolidated role × Epic-6-admin-endpoint permission matrix — driven from a route inventory so a new admin endpoint without a matrix row FAILS the suite (the totality-guard pattern) — plus the rule-firing transaction seams the E2E asserts weakly: exactly-once per event under retry, automation actor attribution on the revision rows, no orphan rows after rule delete.
[EMAIL] grep contract; @inngest/test where the E2E can't reach