Method & limits

Source-linked evidence, with the uncertainty left visible.

This catalogue relies on dated repository, release and official-documentation readings through 30 October 2026. The 4 October small-list welcome report reopens narrow phpList v3.6.16 and Listmonk v6.2.0 tagged paths and current Keila/phpList documentation; it is a source synthesis, not a runtime test. The 2 October Listmonk private-test follow-up could not execute without a pinned artifact and isolated sink-only fixture. The 6 October Marketing Agent OS install test stopped before execution for lack of a reachable pinned checkout and working network isolation; it yielded no installer file effects. The 28 September handoff was a documentation-only synthesis with no new source recheck. A project claim is marked as such; an inference is not a tested fact.

MJML draft-to-HTML boundary · 30 October

The changed-email report reads the official MJML v5.4.1 release, tagged licence/package manifests, CLI documentation and a moving first-party template example. MIT applies to the tagged repository and named packages, not automatically to transitive dependencies, a hosted service or template assets. The local exact-version compiler test was unrun; no validation, HTML, diff, send or client display was observed. The documented strict CLI behavior is not an observed result here.

Planned-link offline fixture · 23 October

The fictional URL-string check used Node v24.20.0 with the standard URL API and WHATWG URL parsing model. Its 17 expected outcomes matched observed diagnostics, with no unexpected oracle mismatch. Only the local planned string was checked; no live link, sender or conversion was observed. The email-like cue is a narrow whole-value pattern, not privacy assurance.

New-share metadata trace · 22 October

The share-card report records a DNS-limited ordinary page request, a saved assembled HTML snapshot and the unobserved image and native-preview rungs. The Open Graph protocol defines markup; LinkedIn sharing help describes preview inputs; Post Inspector help distinguishes new from existing posts. None supplies this page’s current response or displayed card.

Pre-send Mailpit boundary · 18 October

The pre-send decision compares an uninspected existing-sender preview with Mailpit v1.31.5 as a conditional isolated SMTP sink. The tagged release, configuration and CLI support exact-version default and control claims; current official docs describe storage, relay, forwarding, UI and HTTP checks. No artifact or sink was run, no message was sent or captured, and no provider or recipient outcome was observed. A local receipt would not establish contact eligibility or deliverability.

Mautic form-to-contact boundary · 17 October

The form-to-contact audit reads the 7.2.1 release, tagged package metadata, living forms guide and forms API guide. The tagged package and production ZIP were not inspected, and no installed form, API, adapter or CRM was run. Documented submission/contact IDs do not establish a destination receipt. The releases page conflicts on 7.2 support dates, leaving current support status unresolved pending maintainer confirmation. Independent operator posts illustrate the handoff problem but are anecdotal.

Weblate localized-offer boundary · 14 October

The localized-offer release-control report uses the 2026.10.1 release view and versioned workflow documentation. The listed tag and linked commit were not independently fetched, inspected or signature-verified. Review states, approved-only file filtering and repository sync do not verify campaign facts or channel status. No instance, translation, export, queue, deployment or social post was tested. The six-row handoff is fictional.

ResourceSpace image-rights boundary · 13 October

The one-image DAM decision uses living vendor documentation and limited repository master licence notices, not an immutable 11.0 build. No install or expiry test ran. The expiry field guide describes a warning and recoverable download options; plugin state changes need configuration and scheduler checks. No DAM state retracts external copies.

YOURLS link boundary · 11 October

The 1.10.6 source audit reads tagged redirect and edit code, release notes, advisories and living documentation only. It found no core second-approval or rollback ledger. A 301 cache concern is an inference, not a measured client result. Click attempts do not prove arrival or signup. No executable redirect, response header, cache, query bytes or database state was observed.

Umami measurement boundary · 8 October

The v3.4.0 report is a tagged-source and current-documentation reading. No fixture, site, message, signup or report output was observed. Tagged UTM query counts page-view rows; attribution docs describe credit rules, not causal lift. The advisory and tagged auth source require separate deployed-build review. Umami is not a verified signup or ROI system.

Terminology guardrail

OSI’s Open Source Definition is about distribution terms, not merely visible source code or self-hosting. Here, “OSI-style open source” is used only for the named component where the checked license supports that label. Activepieces has commercial EE paths; Marketing Agent OS retains third-party licenses.

What this page does not establish

No hands-on install or connector testing; safe experiments are plans derived from documentation.
No security audit, deliverability, ROI, accuracy, uptime or performance ranking.
No blanket integration claim. Connector, version, OAuth scope, maintenance and data path must be checked for each promised workflow.
No legal advice: license labels are component-scoped taxonomy, not a decision on derivative works, trademarks or SaaS obligations.

Primary sources

Cross-layer inference

The 28 September handoff report maps distinct draft, approval, run and sender records. Its combined route is a paper architecture, not a tested integration, approval control or recommendation. Activepieces CE Flow Approvals require Enterprise/Cloud with plan limits; retention and log-cap documentation conflicts, and selected-build behavior remains unverified. Mautic roles and preferences do not establish two-person approval or lawful consent. Skill instructions do not enforce host permissions.

How this evidence is compiled

The research library turns this source set into a comparison, five project dossiers, and dated decision reports. It does not add hands-on test results; it keeps each project's documented boundary and missing evidence visible.

16 October: two-newsletter migration boundary

The Listmonk v6.2.0 source audit distinguishes global and per-list state, import overwrite collisions and regular-campaign selection. It uses official source and documentation, not a migration or send test. The nine-contact mapping is fictional. The current provider, export completeness, permission history, installed target, package provenance, exact settings and restore remain unverified.