fix(docs): restore guarded invariants after public surface refresh

40d29ca44 rewrote the public repository surface and tripped four standing
guards. Reinstate the signed-installer verification snippet and pinned
pulse-installer ed25519 key in README.md, use native-language names for
the localized guide links, point the issue-template docs contact link at
a stable non-branch-tip URL, and resync the shipped copies under
frontend-modern/public/docs with their repo sources.

Fixes CI on main (runs 31058322973, 31058903048).

.github/ISSUE_TEMPLATE/config.yml

@@ -4,5 +4,5 @@ contact_links:
     url: https://github.com/rcourtman/Pulse/discussions
     about: Please ask and answer questions here
   - name: Documentation
-    url: https://github.com/rcourtman/Pulse/blob/main/docs/README.md
+    url: https://github.com/rcourtman/Pulse#documentation
     about: Browse installation, platform, security, and troubleshooting guides

README.md

@@ -86,6 +86,22 @@ not need the Docker socket.
 - [Docker Compose](docs/INSTALL.md#docker-compose)
 - [Kubernetes and Helm](docs/KUBERNETES.md)
 
+The installer is signed. Verify `install.sh` against the pinned
+`pulse-installer` key before running it:
+
+```bash
+export PULSE_VERSION=vX.Y.Z
+curl -fsSLO "https://github.com/rcourtman/Pulse/releases/download/${PULSE_VERSION}/install.sh"
+curl -fsSLO "https://github.com/rcourtman/Pulse/releases/download/${PULSE_VERSION}/install.sh.sshsig"
+ssh-keygen -Y verify \
+  -f <(printf '%s\n' 'pulse-installer namespaces="pulse-install" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZd/DaH+BldzOkq1A8KVTcFk73nAyrE8aJOyf7i00jm pulse-installer') \
+  -I pulse-installer \
+  -n pulse-install \
+  -s install.sh.sshsig < install.sh
+bash install.sh --version "${PULSE_VERSION}"
+rm -f install.sh install.sh.sshsig
+```
+
 The GitHub installer installs the Pulse server. Install and upgrade agents with
 the per-host command generated under **Settings → Infrastructure → Install on a
 host**.
@@ -121,8 +137,8 @@ volume. See the [runtime-aligned capability reference](docs/PULSE_PRO.md) and
 - [Troubleshooting](docs/TROUBLESHOOTING.md)
 - [API reference](docs/API.md) and [architecture](ARCHITECTURE.md)
 
-Localized getting started guides are available in
-[German](docs/i18n/de/README.md) and [Spanish](docs/i18n/es/README.md).
+Localized getting started guides:
+[Deutsch](docs/i18n/de/README.md) · [Español](docs/i18n/es/README.md)
 
 ## Development
 

frontend-modern/public/docs/ARCHITECTURE.md

@@ -1,6 +1,10 @@
 # Pulse Architecture
 
-Pulse is a real-time infrastructure monitoring platform for **Proxmox VE**, **Proxmox Backup Server**, **Proxmox Mail Gateway**, **Docker**, **Host** systems, **Kubernetes**, and **TrueNAS**. It is built with a **Go 1.25+** backend and a **SolidJS / TypeScript** frontend, focusing on low latency, high concurrency, and a premium user experience.
+Pulse is a real-time infrastructure monitoring platform for **Proxmox VE**,
+**Proxmox Backup Server**, **Proxmox Mail Gateway**, **Docker**, **machine
+agents**, **Kubernetes**, **TrueNAS**, and early-access **VMware vSphere**
+environments. It uses a **Go 1.26** backend and a **SolidJS / TypeScript**
+frontend.
 
 ## 🏗 High-Level Overview
 
@@ -27,6 +31,7 @@ flowchart TD
     Pulse -->|HTTPS :8007| PBS[Proxmox Backup Server]
     Pulse -->|HTTPS| PMG[Proxmox Mail Gateway]
     Pulse -->|HTTPS| TrueNAS[TrueNAS SCALE/CORE]
+    Pulse -->|HTTPS| vSphere[VMware vCenter]
     DockerAgent[Docker Agent] -->|HTTPS POST| API
     HostAgent[Host Agent] -->|HTTPS POST| API
     K8sAgent[Kubernetes Agent] -->|HTTPS POST| API
@@ -50,7 +55,9 @@ All backend code lives under `cmd/`, `internal/`, and `pkg/`. The binary is asse
    - Supports graceful hot-reload via `SIGHUP` and `.env` file watching.
 
 2. **Unified Resource Registry (`internal/unifiedresources`)**
-   - Central data model that normalises resources from **7 data sources** (`proxmox`, `pbs`, `pmg`, `docker`, `agent`, `kubernetes`, `truenas`) into a single `Resource` struct.
+   - Central data model that normalises resources from Proxmox, PBS, PMG,
+     Docker, machine agents, Kubernetes, TrueNAS, and VMware providers into a
+     shared `Resource` contract.
    - **Canonical v6 resource types**: `agent`, `vm`, `system-container`, `app-container`, `docker-host`, `k8s-cluster`, `k8s-node`, `pod`, `k8s-deployment`, `storage`, `pbs`, `pmg`, `ceph`, `physical_disk`.
    - Identity-matching engine: merges resources across sources using machine IDs, DMI UUIDs, hostnames, IPs, and MAC addresses.
    - Provides typed **views** (`NodeView`, `K8sClusterView`, etc.) for consumer-specific queries.
@@ -90,10 +97,14 @@ All backend code lives under `cmd/`, `internal/`, and `pkg/`. The binary is asse
    - **Intelligence Services**: Patterns, correlations, anomalies, baselines, forecasts, and incident recording. All surfaced via `/api/ai/intelligence/*`.
    - **Safety gates**: Command execution disabled by default (`--enable-commands` opt-in); circuit breakers and scoped permissions at every layer.
 
-8. **Entitlements & Licensing (`internal/license`)**
+8. **Entitlements & Licensing (`pkg/licensing`)**
    - Capability-key based gating: `ai_autofix`, `rbac`, `multi_tenant`, `relay`, `agent_profiles`, `kubernetes_ai`, `ai_alerts`, etc.
-   - Core tiers include **Community** (free), **Relay**, **Pro**, hosted **Cloud**, request-assisted **MSP**, and Enterprise/custom entitlements.
-   - Trial lifecycle with activation, renewal, and expiry. All state exposed via `/api/license/*`.
+   - Core tiers include **Community** (free), **Relay**, **Pro**, a reserved
+     hosted **Cloud** capability tier, request-assisted **MSP**, and
+     Enterprise/custom entitlements. The Cloud service is not generally
+     available.
+   - Activation, grant refresh, renewal, expiry, and legacy-license migration.
+     Active state is exposed through `/api/license/*`.
 
 9. **Provider-hosted MSP control plane (`internal/cloudcp`)**
    - A Stripe-free provider control plane can run one isolated Pulse runtime/container per client workspace.
@@ -134,20 +145,26 @@ The frontend is a modern SPA in `frontend-modern/`, built with **SolidJS** and *
 
 ### Routing & Navigation
 
-Navigation is organised by **task**, not by platform:
+Navigation is organised around platform-shaped pages with cross-platform
+operational surfaces:
 
 | Route | Page | Purpose |
 |---|---|---|
-| `/infrastructure` | Infrastructure | Hosts, nodes, clusters across all platforms |
-| `/workloads` | Workloads | VMs, LXCs, containers, K8s pods |
-| `/storage` | Storage | Proxmox storage, ZFS pools, Ceph |
-| `/recovery` | Recovery | Backups, snapshots, replication |
-| `/ceph` | Ceph | Detailed Ceph cluster view |
+| `/` and `/infrastructure` | Runtime home | Monitor-first authenticated entry point |
+| `/proxmox/*` | Proxmox | PVE, PBS, PMG, guests, storage, recovery, and Ceph |
+| `/docker/*` | Docker | Hosts, containers, Compose projects, Swarm, images, and storage |
+| `/kubernetes/*` | Kubernetes | Clusters, workloads, networking, storage, and events |
+| `/truenas/*` | TrueNAS | Systems, pools, datasets, disks, apps, VMs, and recovery |
+| `/vmware/*` | vSphere | Early-access vCenter, host, cluster, VM, datastore, and network views |
+| `/standalone/*` | Machines | Agent-backed machines and availability checks |
 | `/alerts/*` | Alerts | Alert rules, active alerts, history |
-| `/ai/*` | AI Intelligence | Patrol findings, investigations, forecasts |
-| `/settings/*` | Settings | Configuration, security, diagnostics, reporting, AI, relay |
+| `/actions/*` | Actions | Governed action proposals, approvals, delivery, and audit state |
+| `/patrol/*` | Patrol | Attention queue, findings, investigations, and run history |
+| `/settings/*` | Settings | Infrastructure, security, notifications, plans, and Intelligence |
 
-Canonical v6 task surfaces live on the routes above; legacy aliases redirect into those canonical settings and patrol paths.
+The retired aggregate `/workloads`, `/storage`, and `/recovery` top-level
+routes are not canonical navigation. Shared resource, storage, and recovery
+contracts remain backend building blocks consumed inside platform pages.
 
 ### State Management
 - **WebSocket store** (`stores/websocket.ts`): Manages the live connection, reactive `State` object, reconnection logic, and per-org switching.
@@ -161,7 +178,9 @@ Canonical v6 task surfaces live on the routes above; legacy aliases redirect int
 - **Lazy-loaded pages**: All top-level pages are loaded via `lazy()` with optional preloading after initial render.
 - **Virtual table windowing**: Large resource lists use virtualised rendering for smooth scrolling at scale.
 - **Command Palette** (`Cmd/Ctrl+K`): Quick-access command launcher.
-- **Keyboard shortcuts**: `g i` → Infrastructure, `g w` → Workloads, `g s` → Storage, `g b` → Recovery, `g a` → Alerts, `g t` → Settings, `/` → Search.
+- **Keyboard shortcuts**: `g p` → Proxmox, `g d` → Docker, `g k` →
+  Kubernetes, `g n` → TrueNAS, `g v` → vSphere, `g s` → Machines, `g a` →
+  Alerts, `g r` → Patrol, `g t` → Settings, `/` → Search.
 
 ### Mobile Experience
 - **MobileNavBar** component: Bottom tab bar for touch navigation.

frontend-modern/public/docs/CONFIGURATION.md

@@ -652,7 +652,7 @@ For unattended displays (wall monitors, dashboards), use a kiosk token to avoid
 
 ---
 
-## TrueNAS Integration {#truenas}
+## TrueNAS
 
 Pulse v6 supports first-class TrueNAS SCALE and CORE monitoring.
 
@@ -687,7 +687,7 @@ TrueNAS connections are stored encrypted in `truenas.enc`.
 
 ---
 
-## Relay / Mobile Remote Access (Relay and Above) {#relay}
+## Relay
 
 The relay protocol provides end-to-end encrypted remote access foundations for Pulse mobile connectivity.
 

frontend-modern/public/docs/CONTRIBUTING.md

@@ -47,7 +47,7 @@ and installer tooling.
 
 ## Project Overview
 
-- **Backend (`cmd/`, `internal/`, `pkg/`)** – Go 1.25+ web server that embeds
+- **Backend (`cmd/`, `internal/`, `pkg/`)** – Go 1.26 web server that embeds
   the built frontend and exposes REST + WebSocket APIs.
 - **Architecture (`ARCHITECTURE.md`)** – High-level system design diagrams and explanations.
 - **Frontend (`frontend-modern/`)** – Vite + SolidJS app built with TypeScript.
@@ -66,13 +66,11 @@ and installer tooling.
 git clone https://github.com/rcourtman/Pulse.git
 cd Pulse
 
-# Install dependencies
-brew install go node npm # or use your distro equivalents
+# Install Go 1.26 and Node.js 20 with your preferred package manager.
 
-# Install JS deps
-cd frontend-modern
-npm install
-cd ..
+# Install the repository and frontend dependencies exactly from their locks
+npm ci
+npm --prefix frontend-modern ci
 ```
 
 ### Hot Reload Dev Loop
@@ -127,9 +125,10 @@ examples where possible.
 - Browser proof pack: `npm run dev:verify`
 - Foreground managed launcher: `npm run dev:foreground`
 - Frontend-only escape hatch: `cd frontend-modern && npm run dev:frontend-only`
-- Tests: `npm run test`
-- Lint: `npm run lint`
-- Format: `npm run format`
+- Tests: `npm --prefix frontend-modern test`
+- Type check: `npm --prefix frontend-modern run type-check`
+- Lint: `npm --prefix frontend-modern run lint`
+- Format check: `npm --prefix frontend-modern run format:check`
 
 The same managed runtime wrappers are available from `frontend-modern/` if you
 start there by habit, so `npm run dev`, `npm run dev:status`, and
@@ -167,14 +166,16 @@ Document rollout plans and kill switches in `MIGRATION_SCAFFOLDING.md` so future
 - Keep instructions evergreen; put release-specific notes in
   `docs/RELEASE_NOTES.md`.
 
-Run a quick link check (`npm run lint-docs` if available, or `markdownlint`)
-before submitting large doc updates.
+Run `python3 scripts/check_public_docs.py` before submitting public
+documentation updates. It verifies local links and rejects retired navigation
+claims on the current documentation surface.
 
 ---
 
 ## Testing Expectations
 
-- Every PR should note the tests run (`go test`, `npm test`, `scripts/tests/run.sh`).
+- Every requested PR should note the tests run (`go test`, frontend tests, or
+  `scripts/tests/run.sh`, as applicable).
 - Add regression coverage when fixing bugs.
 - Mention manual verification steps (e.g., “Proxmox LXC installer tested on
   PVE 8.1”) if automated coverage is not feasible.
@@ -197,9 +198,9 @@ For maintainer-requested code help on a tracked issue:
 
 1. Link the issue where the maintainer requested the patch.
 2. Fork + branch (`git checkout -b feature/my-change`).
-2. Make your edits and run relevant tests.
-3. Update docs and changelog entries as needed.
-4. Open a PR describing:
+3. Make your edits and run relevant tests.
+4. Update docs and changelog entries as needed.
+5. Open a PR describing:
    - What changed
    - Why it changed
    - Testing performed

frontend-modern/public/docs/FAQ.md

@@ -58,16 +58,26 @@ See [VM Disk Monitoring](VM_DISK_MONITORING.md) for details.
 Yes! If Pulse detects Ceph storage, it automatically queries cluster health, OSD status, and pool usage. No extra config needed.
 
 ### Does Pulse monitor TrueNAS?
-Yes. Pulse v6 includes first-class TrueNAS SCALE/CORE integration. Add your TrueNAS server in **Settings → TrueNAS** with the URL and API key. Pulse monitors the appliance, native VMs, apps, pools, datasets, disks, ZFS snapshots, replication tasks, and alerts. TrueNAS resources appear in the TrueNAS, Infrastructure, Storage, and Recovery views.
+Yes. Pulse includes first-class TrueNAS SCALE/CORE integration. Add your
+TrueNAS server under **Settings → Infrastructure → Platform connections** with
+the URL and API key. Pulse monitors the appliance, native VMs, apps, pools,
+datasets, disks, ZFS snapshots, replication tasks, and alerts. Those resources
+appear on the dedicated TrueNAS page.
 
-### Where did my pages go? (Unified Navigation)
-Pulse v6 organises the UI by **task** instead of **platform**:
-- **Infrastructure** → all hosts (Proxmox, Docker, K8s, TrueNAS)
-- **Workloads** → VMs, LXCs, containers, pods
-- **Storage** → all storage pools
-- **Recovery** → backups, snapshots, replication
+### How is navigation organised in Pulse v6?
+Pulse uses platform-shaped top-level pages:
 
-Legacy URLs (`/proxmox`, `/docker`, `/kubernetes`, `/hosts`, `/services`) redirect automatically. See [Migration Guide](MIGRATION_UNIFIED_NAV.md) for the full mapping.
+- **Proxmox**, **Docker**, **Kubernetes**, **TrueNAS**, **vSphere**, and
+  **Machines** keep platform-specific inventory and workflows together.
+- Storage, snapshots, backups, and replication appear inside the platform page
+  they belong to.
+- **Alerts**, **Actions**, and **Patrol** provide cross-platform operational
+  views.
+
+The short-lived unified `/workloads`, `/storage`, and `/recovery` top-level
+navigation was retired during the v6 prerelease cycle. See the
+[historical migration note](MIGRATION_UNIFIED_NAV.md) if you are comparing an
+older release candidate.
 
 ### Can I disable alerts for specific metrics?
 Yes. Go to **Alerts → Thresholds** and use the On/Off toggle next to any metric while editing, or set the value to `-1`. You can do this globally or per-resource (VM/Node).
@@ -111,7 +121,7 @@ pct exec <ctid> -- pulse bootstrap-token
 If you only missed the token during a fresh install (no password set yet), skip the first two commands and just read it back with the last one.
 
 ### How do I enable HTTPS?
-Set `HTTPS_ENABLED=true` and provide `TLS_CERT_FILE` and `TLS_KEY_FILE` environment variables. See [Configuration](CONFIGURATION.md#https--tls).
+Set `HTTPS_ENABLED=true` and provide `TLS_CERT_FILE` and `TLS_KEY_FILE` environment variables. See [Configuration](CONFIGURATION.md#-https--tls).
 
 ### Can I use Single Sign-On (SSO)?
 Yes. Pulse supports **OIDC** and **SAML** SSO providers, with multi-provider support (multiple IdPs active simultaneously). Configure in **Settings → Security → SSO Providers**. Pulse also supports Proxy Auth (Authentik, Authelia, Cloudflare). See [Proxy Auth Guide](PROXY_AUTH.md).

frontend-modern/public/docs/README.md

@@ -1,106 +1,103 @@
-# 📚 Pulse Documentation
+# Pulse documentation
 
-Welcome to the Pulse documentation portal. Here you'll find everything you need to install, configure, and master Pulse.
+Start here for installation, platform setup, security, operations, and Pulse
+Intelligence. Commands, configuration keys, image names, API fields, and
+product identifiers remain untranslated in localized guides.
 
----
+## Start here
 
-## 🚀 Getting Started
+- [Install Pulse](INSTALL.md) — signed Proxmox/Linux installation, Docker,
+  Docker Compose, Kubernetes, and first-run setup.
+- [Upgrade from Pulse v5](UPGRADE_v6.md) — migration prerequisites, rollback,
+  agent continuity, and post-upgrade checks.
+- [Configure Pulse](CONFIGURATION.md) — authentication, notifications,
+  discovery, retention, and system settings.
+- [Deployment models](DEPLOYMENT_MODELS.md) — data locations, lifecycle, and
+  differences between supported deployment paths.
+- [Troubleshooting](TROUBLESHOOTING.md) and [FAQ](FAQ.md) — common failures,
+  diagnostics, and operator questions.
 
-- **Localized getting started**:
-  [Deutsch](i18n/de/README.md) • [Español](i18n/es/README.md).
-  These first-wave pages cover the public install path and preserve commands,
-  config keys, image names, activation keys, and product identifiers exactly.
-- **[Installation Guide](INSTALL.md)**
-  Step-by-step guides for Docker, Kubernetes, and bare metal.
-- **[Configuration](CONFIGURATION.md)**  
-  Learn how to configure authentication, notifications (Email, Discord, etc.), and system settings.
-- **[Deployment Models](DEPLOYMENT_MODELS.md)**  
-  Where config lives, how updates work, and what differs per deployment.
-- **[Migration Guide](MIGRATION.md)**  
-  Moving to a new server? Here's how to export and import your data safely.
-- **[Upgrade to v6](UPGRADE_v6.md)**  
-  Practical upgrade guidance and post-upgrade checks for Pulse v6.
-- **[FAQ](FAQ.md)**
-  Common questions and quick answers.
+Localized getting started guides: [Deutsch](i18n/de/README.md) ·
+[Español](i18n/es/README.md)
 
-## 🛠️ Deployment & Operations
+## Platforms and agents
 
-- **[Docker Guide](DOCKER.md)** – Advanced Docker & Compose configurations.
-- **[Kubernetes](KUBERNETES.md)** – Helm charts, ingress, and HA setups.
-- **[Reverse Proxy](REVERSE_PROXY.md)** – Nginx, Caddy, Traefik, and Cloudflare Tunnel recipes.
-- **[Troubleshooting](TROUBLESHOOTING.md)** – Deep dive into common issues and logs.
+- [Proxmox Backup Server](PBS.md)
+- [Proxmox Mail Gateway](MAIL_GATEWAY.md)
+- [Docker and Podman](DOCKER.md)
+- [Kubernetes and Helm](KUBERNETES.md)
+- [TrueNAS SCALE and CORE](TRUENAS.md)
+- [Unified Agent](UNIFIED_AGENT.md)
+- [Agent security](AGENT_SECURITY.md)
+- [VM disk monitoring](VM_DISK_MONITORING.md)
+- [ZFS monitoring](ZFS_MONITORING.md)
+- [Temperature monitoring](TEMPERATURE_MONITORING.md)
 
-## 🔐 Security
+VMware vSphere support is early access. Current builds expose dedicated
+vSphere inventory and recovery context, but operators should validate the
+integration against their own vCenter before production use.
 
-- **[Security Policy](../SECURITY.md)** – The core security model (Encryption, Auth, API Scopes).
-- **[Privacy](PRIVACY.md)** – What leaves your network (and what doesn’t).
-- **[OIDC / SSO](OIDC.md)** – OIDC Single Sign-On configuration (Authentik, Keycloak, Azure AD, etc.).
-- **[Proxy Auth](PROXY_AUTH.md)** – Authentik/Authelia/Cloudflare proxy authentication configuration.
-- **[Agent Security](AGENT_SECURITY.md)** – Agent privilege model, Proxmox API-only choices, and self-update verification.
+## Monitoring and operations
 
-## 📖 Advanced Topics (Relay / Pro / legacy Pro+ / Cloud)
+- [Metrics history](METRICS_HISTORY.md)
+- [Recovery data](RECOVERY.md)
+- [Webhooks](WEBHOOKS.md)
+- [Automatic updates](AUTO_UPDATE.md)
+- [Centralized agent management](CENTRALIZED_MANAGEMENT.md) (Pro)
+- [Operational trust model](OPERATIONAL_TRUST.md)
+- [Current product screenshots](SCREENSHOTS.md)
 
-- **[AI Modes & Safety](AI_AUTONOMY.md)** – Configure Patrol mode, assistant control levels, investigation tuning, and safety guardrails.
-- **[Role-Based Access Control (RBAC)](RBAC.md)** – Define custom roles, assign permissions, and integrate with OIDC group mapping.
-- **[Audit Logging](AUDIT_LOGGING.md)** – Tamper-evident event logging for compliance, with query, export, and signature verification.
+## Pulse Intelligence
 
-## ✨ New in 6.0
+- [Assistant, Patrol, and external-agent overview](AI.md)
+- [Patrol modes and safety](AI_AUTONOMY.md)
+- [Assistant safety model](ASSISTANT_SAFETY.md)
+- [External agent HTTP and MCP substrate](AGENT_SUBSTRATE.md)
 
-- **[Unified Resource Model](UNIFIED_RESOURCES.md)** – How all platforms merge into one model with task-based navigation.
-- **[Unified Navigation Migration](MIGRATION_UNIFIED_NAV.md)** – Upgrading from platform-specific tabs to v6 navigation.
-- **[TrueNAS Integration](TRUENAS.md)** – First-class TrueNAS SCALE/CORE monitoring (pools, datasets, disks, snapshots, replication).
-- **[Relay / Pulse Mobile Handoff](RELAY.md)** – End-to-end encrypted relay for supported Pulse Mobile clients (Relay and above).
-- **[Recovery Central](RECOVERY.md)** – Unified backup, snapshot, and replication view across all providers.
-- **[Pulse Cloud (Hosted)](CLOUD.md)** – Fully managed hosting with automatic updates and backups.
-- **[Pulse Intelligence](AI.md)** – Pulse Assistant, Patrol findings, alert analysis, governed actions, and forecasts.
-- **[Metrics History](METRICS_HISTORY.md)** – Persistent metrics storage with configurable retention.
-- **[Mail Gateway](MAIL_GATEWAY.md)** – Proxmox Mail Gateway (PMG) monitoring.
-- **[Auto Updates](AUTO_UPDATE.md)** – One-click updates for supported deployments.
-- **[Multi-Tenant Organizations](MULTI_TENANT.md)** – Isolate infrastructure by organization (Enterprise, opt-in).
-- **[Pulse for MSPs](MSP.md)** – Provider operations guide: per-client isolation, split ingress, alert routing, branded reports.
-- **[Entitlements Overhaul](PULSE_PRO.md)** – Capability-key-based feature gating across Community/Relay/Pro/Cloud, with legacy Pro+ continuity still supported.
+Patrol watch-only analysis is available on Community with a local model or the
+operator's own provider. Investigation and governed fixes require the relevant
+Pulse Pro capabilities.
 
-## 💳 Plans (Community / Relay / Pro / Cloud)
+## Security, privacy, and access
 
-Pulse is available in three self-hosted tiers plus hosted Cloud:
+- [Security guide](../SECURITY.md)
+- [Privacy and telemetry disclosure](PRIVACY.md)
+- [OIDC and SSO](OIDC.md)
+- [Proxy authentication](PROXY_AUTH.md)
+- [Role-based access control](RBAC.md) (Pro)
+- [Audit logging](AUDIT_LOGGING.md) (Pro)
+- [Reverse proxy configuration](REVERSE_PROXY.md)
+- [Code-signing policy](CODE_SIGNING_POLICY.md)
 
-- **Community**: Free self-hosted monitoring with core monitoring included and 7-day history.
-- **Relay**: Adds secure remote access to the Pulse web UI, Pulse Mobile pairing for handoff, push notifications, and 14-day history.
-- **Pro**: Adds hands-on Patrol modes, issue investigation, governed fixes, verified outcomes, operations tooling, governance features, and 90-day history.
-- **Cloud**: Hosted Pulse with Pro-level capabilities; hosted pricing is unchanged by the self-hosted model lock.
+## Plans and managed access
 
-- **[Learn more at pulserelay.pro](https://pulserelay.pro)**
-- **[Plans and entitlements](PULSE_PRO.md)** (includes the Community/Relay/Pro/Cloud matrix)
-- **[AI deep dive](AI.md)**
-- **[Multi-Tenant Organizations (Enterprise)](MULTI_TENANT.md)** — Isolate infrastructure by organization for MSPs and multi-datacenter deployments.
+- [Community, Relay, and Pro capabilities](PULSE_PRO.md)
+- [Relay and Pulse Mobile handoff](RELAY.md)
+- [Multi-tenant organizations](MULTI_TENANT.md) (Enterprise/custom)
+- [Provider-hosted MSP operations](MSP.md) (request-assisted)
 
-## 📡 Monitoring & Agents
+Pulse Cloud is not generally available. Ordinary self-hosted Pulse remains the
+primary installation path; MSP and Enterprise access are explicit commercial
+paths rather than defaults in self-hosted setup.
 
-- **[Unified Agent](UNIFIED_AGENT.md)** – Single binary for host, Docker, and Kubernetes monitoring.
-- **[Centralized Agent Management (Pro/Cloud)](CENTRALIZED_MANAGEMENT.md)** – Agent profiles and remote config.
-- **[Proxmox Backup Server](PBS.md)** – PBS integration, direct API vs PVE passthrough, token setup.
-- **[TrueNAS](TRUENAS.md)** – TrueNAS SCALE/CORE integration.
-- **[ZFS Monitoring](ZFS_MONITORING.md)** – Proxmox-native ZFS pool monitoring.
-- **[Storage Architecture](STORAGE_ARCHITECTURE.md)** – Proposed canonical storage, disk, S.M.A.R.T., and topology model for making storage genuinely operator-useful.
-- **[VM Disk Monitoring](VM_DISK_MONITORING.md)** – Enabling QEMU Guest Agent for disk stats.
-- **[Temperature Monitoring](TEMPERATURE_MONITORING.md)** – Agent-based temperature monitoring (`pulse-agent --enable-proxmox`). Sensor proxy has been removed.
-- **[Webhooks](WEBHOOKS.md)** – Custom notification payloads.
+## Development and reference
 
-## 💻 Development
+- [REST API](API.md)
+- [Architecture](../ARCHITECTURE.md)
+- [Contributing](../CONTRIBUTING.md)
+- [Release notes index](RELEASE_NOTES.md)
+- [Development transparency disclosure](AI_TRANSPARENCY.md)
 
-- **[API Reference](API.md)** – Complete REST API documentation.
-- **[Architecture](../ARCHITECTURE.md)** – System design and component interaction.
-- **[Contributing](../CONTRIBUTING.md)** – How to contribute to Pulse.
-- **[AI-Assisted Development](AI_TRANSPARENCY.md)** – How AI tools are used to build and maintain Pulse, and where their output is labelled.
+Detailed design notes and dated migration specifications may remain in this
+directory for maintainers, but they are not operator setup guides unless they
+are linked from the sections above.
 
-## 📁 Previous Versions
+## Previous versions and migrations
 
-- **[Upgrade to v5](UPGRADE_v5.md)** – Upgrade guidance for v4 → v5 migrations.
-- **[v6 Release Promotion Policy](release-control/v6/internal/RELEASE_PROMOTION_POLICY.md)** – Canonical stable-vs-prerelease promotion rules and rollback expectations.
-- **[v6 Prerelease Runbook](releases/V6_PRERELEASE_RUNBOOK.md)** – Internal release operations used during the v6 prerelease period.
+- [Upgrade from v4 to v5](UPGRADE_v5.md)
+- [Retired unified-navigation migration](MIGRATION_UNIFIED_NAV.md) — historical
+  context only; current Pulse uses platform-shaped navigation.
+- [Move a Pulse installation](MIGRATION.md)
 
----
-
-Found a bug or have a suggestion?
-
-[![GitHub Issues](https://img.shields.io/badge/GitHub-Issues-green)](https://github.com/rcourtman/Pulse/issues)
+Found a bug? Use the [issue forms](https://github.com/rcourtman/Pulse/issues/new/choose).
+For setup questions, use [GitHub Discussions](https://github.com/rcourtman/Pulse/discussions).

frontend-modern/public/docs/RELAY.md

@@ -123,5 +123,5 @@ Pulse Mobile can pair with multiple Pulse instances. Each pairing has its own en
 ## See Also
 
 - [Configuration Guide](CONFIGURATION.md#relay) — environment variables
-- [Security](../SECURITY.md#relay-security-pro) — relay security details
+- [Security](../SECURITY.md#relay-security-relay-and-above) — relay security details
 - [Plans & Entitlements](PULSE_PRO.md) — feature availability by plan