A repo scope can narrow itself with an action list, and the coverage check ignored it: a grant limited to action=update named its collection plainly, so it passed as if it could create records and the PDS refused the write. covers_create reads the list the way the scope specification defines it — absent is every action, an explicit list without create is a real gap.
repo_collections still reads the collection, so a narrowed grant is reported as a missing scope rather than as an unreadable token. Unit tests cover both spellings, action=create, action=update, and the missing-scope report.