From a4398b56f20a68471b558cc3af9409ec45d570fc Mon Sep 17 00:00:00 2001 From: rcourtman <8825017+rcourtman@users.noreply.github.com> Date: Sun, 18 Oct 2026 18:50:41 +0100 Subject: [PATCH] Record maintenance source qualification and remaining recovery Bind the completed source blocker to its exact checks and protected-main landing. Keep release inclusion, installed recovery and the existing manual reliability exit decision explicit without changing priority or lane state. --- ...ase-delivery-and-observation-2026-10-18.md | 33 ++++++++++++------- docs/release-control/v6/internal/status.json | 4 +-- 2 files changed, 24 insertions(+), 13 deletions(-) diff --git a/docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md b/docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md index 7bce722bc9..bbd3179936 100644 --- a/docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md +++ b/docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md @@ -1,6 +1,6 @@ # Reliability work and exit evidence -Reconciled: 2026-10-18. Public source checked against Pulse `13c99c17c13659ecce920fd04b24a2617479cca8`. Release recovery observations are dated 2026-10-18 09:36 UTC. Later outcomes must replace these observations with their exact source and runtime evidence. +Reconciled: 2026-10-18. Initial public-source audit: Pulse `13c99c17c13659ecce920fd04b24a2617479cca8`. Maintenance source qualification is updated below from `b6e56c5baa2ad995264faa80877543300bc10273`, landed as `eeda20c0dda52ff2f9d1935892d5a09e13d71250`. Release recovery observations retain their 2026-10-18 09:36 UTC observation time. Later outcomes must replace those observations with their exact source and runtime evidence. The active target remains `v6-release-reliability`, with manual completion and `proof_scope=none`. Stability, consistent updates, reported defects and verified recovery retain priority. The existing L1 follow-up `maintenance-release-delivery-and-observation` owns this reconciliation and the release-delivery residual. The existing L6 notification gap owns destination delivery and recovery. This record adds no release gate, readiness assertion, target, lane or scheduling rule. @@ -19,9 +19,9 @@ Ancestry was checked with `git merge-base --is-ancestor refs/tags/ | Owning surface | Remaining outcome | Evidence required for disposition | | --- | --- | --- | -| L1 release delivery and the existing maintenance source proposal | [PR2888](https://github.com/rcourtman/Pulse/pull/2888) remains open under source qualification. The old `09b82a...` Frontend and native failures are retained below. Integrated head `4b86af9a330d555cde0972bf1759b07bbaa94d64` exposed a cumulative NAS fixture alarm and a real conflict between caller-owned construction and shared session renewal. The per-control fixture runner is in `0b3261e1aa1356f291030622a91dca244324cd0b`. The login ownership correction is undergoing qualification. | Preserve the actual failed evidence, pass required checks on the final source and land through normal review. Then identify the release containing the repair and qualify affected installed workflows. Worker passes or unrelated green heads do not close those outcomes. | +| L1 release delivery and maintenance source | [PR2888](https://github.com/rcourtman/Pulse/pull/2888) has final-source qualification at `b6e56c5baa2ad995264faa80877543300bc10273` and landed as `eeda20c0dda52ff2f9d1935892d5a09e13d71250`. The source qualification and landing blocker is complete. The three previous Frontend assertions and macOS Intel fixture timeouts are retained below with their disposition. Release inclusion and affected installed workflows remain unverified by this source work. | Identify the first containing release and qualify installed installer/updater/removal and trusted-connection paths, including NAS teardown and private-token bootstrap. Preserve guest thaw, every-filesystem fresh writes and workload liveness, Windows collection/service/update recovery, and sustained memory observations as independent outcomes. Source CI and synthetic browser fixtures do not close them. | | Existing guest, agent, installer and monitoring owners, coordinated through L1 delivery | [Guest freeze/thaw #2439](https://github.com/rcourtman/Pulse/issues/2439), [Windows cooldown #2822](https://github.com/rcourtman/Pulse/issues/2822), [Windows disk collection #2619](https://github.com/rcourtman/Pulse/issues/2619), [Windows update #1820](https://github.com/rcourtman/Pulse/issues/1820) and [server memory #1803](https://github.com/rcourtman/Pulse/issues/1803) retain unverified customer outcomes. Current RC notes also retain unresolved guest-freeze and Windows-restart reports. | Bind each disposition to the affected source, installed version and workflow. For backup safety, independently observe thaw, fresh writes on every backed-up filesystem and workload liveness. For Windows, prove collection and service recovery after restart and the signed server-hosted update path. For memory, compare sustained steady usage and growth under the relevant workload. Source inclusion, an OK backup, a running VM or an initial render is insufficient. Any accepted residual needs an explicit scoped disposition and retained owner, without claiming field recovery. | -| L6 `notification-delivery-terminal-failure-diagnosis` | [SMTP PR3045](https://github.com/rcourtman/Pulse/pull/3045) and [connectivity/DNS PR3049](https://github.com/rcourtman/Pulse/pull/3049) are landed. Real destination acceptance, release delivery, repeated-failure handling and destination recovery remain separate outcomes. [Issue #3047](https://github.com/rcourtman/Pulse/issues/3047) retains the misleading retries-exhausted label. | Prove controlled real-provider delivery and the affected release's installed path, distinguish terminal refusal from exhausted retries, and observe recovery after the destination is repaired. Preserve restart, queue, TLS and DNS failure evidence. Rolling fleet counters cannot attribute failures to these fixes or prove fleet recovery. See the existing [SMTP record](notification-smtp-delivery-reliability-2026-10-17.md) and [connectivity record](notification-connectivity-reliability-2026-10-18.md). | +| L6 `notification-delivery-terminal-failure-diagnosis` | [SMTP PR3045](https://github.com/rcourtman/Pulse/pull/3045) and [connectivity/DNS PR3049](https://github.com/rcourtman/Pulse/pull/3049) are landed. Real destination acceptance, release delivery, repeated-failure handling and destination recovery remain separate outcomes. The terminal-failure label and further response-verdict repairs landed through [PR3052](https://github.com/rcourtman/Pulse/pull/3052), merge `3d6949851f9370898390c690bec7e62631c51f3b`. Its [owning record](notification-unclassified-reliability-2026-10-18.md) retains the source proof and the separate destination-recovery outcomes. That label correction is no longer unfinished source work. | Prove controlled real-provider delivery and the affected release's installed path, distinguish terminal refusal from exhausted retries, and observe recovery after the destination is repaired. Preserve restart, queue, TLS and DNS failure evidence. Rolling fleet counters cannot attribute failures to these fixes or prove fleet recovery. See the existing [SMTP record](notification-smtp-delivery-reliability-2026-10-17.md) and [connectivity record](notification-connectivity-reliability-2026-10-18.md). | | L1 exact-candidate publication and observation | Latest stable is v6.5.0. [RC3](https://github.com/rcourtman/Pulse/releases/tag/v6.6.0-rc.3) published at 17 October 18:59:47 UTC from `524b10f54f23b6ffca71e73762fc2cfb926cae4f`. RC4 preparation `edf720ab9278a317ad881a9c9f375aa208ab90ce` is landed but unpublished at the observation time. | Verify the selected candidate's actual publication, source pair, assets and customer-facing update paths. Its own full 24-hour soak starts at actual product publication. RC3's minimum is 18 October 18:59:47 UTC. RC4's previous-publication spacing floor is that same time, which is not its own soak completion. No candidate inherits another candidate's elapsed soak. Stable must retain the fully soaked product source with release metadata only, pass the existing gates and have installed upgrade/recovery evidence. | | Existing release continuity and operational recovery owners, coordinated through L1 | [Scheduled Security Scan 39104703123](https://github.com/rcourtman/Pulse/actions/runs/39104703123) failed on HTTP/2 cancellation while reading publication inventory. The transport repair has accepted local review but protected delivery and the next genuine scheduled success remain unverified. Separately, [disk-footprint PR772](https://github.com/rcourtman/pulse-dev-infra/pull/772) is installed, with ordinary-run footprint and sustained free-space trend still pending. | Land and activate any required repair through normal gates, then observe the genuine scheduled recovery. Do not infer an orphaned tag or vulnerability from the interrupted inventory read. Measure ordinary publication footprints and storage trends across guest and backing host separately. A capacity increase, one healthy sample or source proof alone does not establish bounded growth. Retain known old-stable convergence debt separately from the successful exact RC3 convergence. | @@ -29,21 +29,32 @@ The dated release recovery snapshot is retained in workspace evidence at `.pulse Two observation residuals remain with their existing release owner. RC4's exact request-origin explanation is unreconciled, without authority to replay or issue a release request. Separately, [scheduled convergence reconciliation 39112622024](https://github.com/rcourtman/Pulse/actions/runs/39112622024) retains old-stable debt because the original workflow owner run is unavailable. Its disposition and expected normal reconciliation need evidence. [Exact RC3 convergence 39071952106](https://github.com/rcourtman/Pulse/actions/runs/39071952106) passed, so the historical debt must not be relabelled an RC3 convergence failure. -## Maintenance source qualification in progress +## Maintenance source qualification completed -The initial [Frontend failure](https://github.com/rcourtman/Pulse/actions/runs/38660106123/job/116179237804) consists of three document-structure assertions. The correction asserts named workflows, required destinations and shipped headings, and scopes the opening safety link to its intended paragraph. It preserves command and safety assertions while allowing additional troubleshooting content. +The highest remaining source blocker was PR2888 at `09b82aec6dd30cc030abe89df125f6f399708fc2`. Its final qualified source is `b6e56c5baa2ad995264faa80877543300bc10273`, landed through the protected main PR path as `eeda20c0dda52ff2f9d1935892d5a09e13d71250`. [All nine required source checks](https://github.com/rcourtman/Pulse/pull/2888/checks) and the [native matrix](https://github.com/rcourtman/Pulse/actions/runs/39148879516) passed on that exact source. The required [build/test run](https://github.com/rcourtman/Pulse/actions/runs/39148879492), governance and boundary audits retain their own results. [Core E2E](https://github.com/rcourtman/Pulse/actions/runs/39148879470) also passed. The [macOS Intel result](https://github.com/rcourtman/Pulse/actions/runs/39148879516/job/117738250270) accounts for all 545 discovered roots: 532 passed, 13 explicitly skipped and none failed. Its remaining installer phase passed in 18m48s, followed by native agent build and execution. This replaces the previous failed head as current qualification evidence, without erasing the earlier observations. The matrix covers Linux x64/ARM64, macOS Intel/ARM64 and Windows x64 execution plus the FreeBSD cross-build contract. -The [original Intel timeout](https://github.com/rcourtman/Pulse/actions/runs/38660106183/job/116179086007) and [integrated Intel timeout](https://github.com/rcourtman/Pulse/actions/runs/39135739613/job/117699764462) retain adverse evidence. The latter completed fifteen NAS controls before exhausting a two-minute alarm shared across 23 controls. The selected isolated Python interpreter and a discovered per-control runner address fixture execution and aggregate budgets. All 59 NAS, TrueNAS, service-state and log-sink controls passed worker proof, together with rejection of skipped, missing and failed controls. Actual installer operation deadlines and the native phase's ten-minute alarm are unchanged. Fresh native CI is still required. +- The [old Frontend failure](https://github.com/rcourtman/Pulse/actions/runs/38660106123/job/116179237804) was three structural assertions: a document-wide safety label appeared twice, and the guide grew from 12 to 15 workflows and from 19 to 22 links. Tests now assert named workflows, required destinations and shipped headings, and scope the opening safety link to its intended paragraph. Safety and command assertions remain. +- The [old macOS Intel log](https://github.com/rcourtman/Pulse/actions/runs/38660106183/job/116179086007) exhausted cumulative fixture and package budgets. It does not establish a production installer deadlock. Nested service-state/NAS models now launch the selected Python interpreter in isolated, stdlib-only mode. An [intervening exact-source Intel run at 4b86af9a33](https://github.com/rcourtman/Pulse/actions/runs/39135739613/job/117699764462) completed fifteen generic NAS controls before the aggregate two-minute alarm killed the 23-control suite. The fixture runner now discovers and executes every method independently, applies the previous two-minute or 45-second fixture bound to each control, requires the existing named safety controls, and rejects skipped, missing or failed execution. All 59 methods across NAS, TrueNAS, service state and log sinks passed the worker proof, alongside discovery and false-pass negative controls. A [later Intel run at 6bf9e818e8](https://github.com/rcourtman/Pulse/actions/runs/39138980077/job/117709536519) passed that NAS preflight but exhausted the general-1 aggregate ten-minute Go alarm while its active recovery control had run only 17 seconds. The canonical Unix runner now compiles once per phase, discovers that exact binary's complete inventory, and executes every root test, example and fuzz seed independently in binary discovery order. Every root retains its ten-minute Go bound, uncached execution, panic-on-exit-zero and explicit completion requirement. The two workflow phases remain exhaustive and disjoint. Real compiled-Go controls reject actual failure, unexpected exit zero, timeout and unmatched names, while retaining explicit platform skips. Fixture, installer-operation and overall CI job deadlines remain unchanged. The final native matrix supplies platform evidence, rather than inferring a timing improvement from shared Linux worker wall time. +- The intervening [Intel run at 45a82ea03c](https://github.com/rcourtman/Pulse/actions/runs/39145479928/job/117728323431) completed the platform's entire discovered installer inventory: 532 passed and 13 explicitly skipped, with no failures or missing completion. Its remaining phase passed in 20m07s and native agent build/execution followed. All six native jobs passed at that head. The final matrix above qualifies the later combined corrections. +- The required [script-smoke shard at 45a82ea03c](https://github.com/rcourtman/Pulse/actions/runs/39145479921/job/117728549560) exposed an existing script test entrypoint still asserting the old grouped runner. The execution controls are now consolidated in that canonical suite, shared by script-smoke discovery and the native Go wrapper. They retain growing and Unicode inventories, discovery order, phase coverage, every failure position, exact selectors and deadlines, and real compiled-Go pass/skip/failure/timeout behavior. The duplicate Python suite was removed. +- Integration preserves both selected-agent freshness and VM/LXC memory interpretation, both GNU tool requirements, existing API concurrency controls and both parents' subsystem declarations. The merge records the documented contract-neutral composition reason because several incoming verification files already match main. Their absence from the merge diff is not missing coverage. All other commit checks and final-head CI still ran. +- The intervening [backend partition 0](https://github.com/rcourtman/Pulse/actions/runs/39135739571/job/117701554206) and [partition 1](https://github.com/rcourtman/Pulse/actions/runs/39135739571/job/117701554230) failures exposed a real integration defect, independently reproduced on the worker at `0b3261e1aa1356f291030622a91dca244324cd0b`. Initial Proxmox authentication joined a detached login intended for readers renewing an accepted session, leaving password requests active after cancelled construction. Initial JSON/form authentication now owns a synchronous exchange bounded by its caller and the client timeout. Shared expiry/401 renewal retains its independent bounded lifetime and generation coalescing. All 340 Proxmox tests and both affected startup/first-poll tests passed under the race detector with no failures or skips, including constructor cancellation/deadline, cluster selection/recovery, client-timeout, shared-renewal starter/waiter cancellation, late-401 and failure-recovery controls. This repairs the ownership boundary without changing a rendered health state or claiming installed recovery. +- The [backend partition 0 at 45a82ea03c](https://github.com/rcourtman/Pulse/actions/runs/39145479921/job/117729442632) exposed a PBS cancellation race while consuming an authentication response. A deterministic control failed all ten JSON/form cases on unchanged runtime at `266144de1fc00e699f0ed07c8df76fd6a00cacc4`, including late complete-session publication and an encoding retry after cancellation. The shared authentication boundary now preserves the owner context error for joined readers, prevents fallback after cancellation and checks the caller before publishing a session. All 108 PBS root tests and five affected monitoring controls passed under the race detector with no failures or skips. Live response validation, TLS trust, existing shared renewal and distinct later recovery remain covered. +- The earlier full worker installer inventory accounted for all 551 roots: 535 passed, 16 had explicit platform skips, and none failed. All eight consolidated runner execution controls subsequently passed through both the script-smoke harness and native Go wrapper. The worker does not supply native PowerShell acceptance. Platform-specific CI remains separate. Normal commit checks and status/ownership audits also passed. +- Bounded integrated proof passed 113 frontend cases, API and guest-transport race checks, native installer fixtures, production frontend embed build, full frontend lint/types and status/ownership audits. The [browser receipt](../../../../../frontend-modern/browser-verification/92bc35bb42331b0c.json) binds the three newly combined runtime files to their final content. Drawer History passed Chromium 1280×900 and 1024×768 and WebKit 390×844. Private installation passed Chromium 1280×900 and WebKit 390×900 in both themes. Inspected states include stale/current/unknown memory with original dates, VM/LXC provider caveats, stopped-VM stored History with keyboard inspection, wrapped signing keys, token copy/dismissal and Last seen advancing without a new lookup. Browser endpoints, observations and tokens were synthetic, and owned browsers and servers were closed. +- During qualification, main advanced through [PR3053](https://github.com/rcourtman/Pulse/pull/3053) to `52b40fd611112904cf7e987e0fc1e8df1c7a0cbf`. Its five changed files contain benchmark/SLO tests and their documentation. There is no shipped runtime change. Conflict-free composition with the qualified source produced tree `fa059ae37b46af49ac9dd140fb392b1180569770`, verified against the actual landing. A bounded worker proof compiled and executed all three workload-chart benchmark cases under the race detector, with source hashes unchanged before and after. The SLO test explicitly skipped under the race detector. One-iteration benchmark execution is a composition control and supplies no performance comparison or strict-latency pass. Protected source checks remained tied to the qualified source above under the unchanged branch rules. -The integrated source's [backend partition 0](https://github.com/rcourtman/Pulse/actions/runs/39135739571/job/117701554206) and [partition 1](https://github.com/rcourtman/Pulse/actions/runs/39135739571/job/117701554230) failures were reproduced on the worker at `0b3261e1aa1356f291030622a91dca244324cd0b`. Constructor cancellation returned promptly but left its password request active. The integrated constructor had joined the detached login intended for concurrent readers renewing an accepted session. Initial authentication now owns a synchronous bounded JSON/form exchange. Shared renewal retains its separate caller-independent lifetime, generation coalescing and timeout. Existing constructor, startup and cluster controls must pass alongside shared-renewal cancellation and new client-timeout controls before source qualification closes. +The [advisory comparison at 6bf9e818e8](https://github.com/rcourtman/Pulse/actions/runs/39138980114/job/117709718583) completed execution but reported three test-only legacy history-filter regressions: day +11.73% (p=.023), all +10.90% (p=.004), and interleaved +12.61% (p<.001), ten samples each. Corresponding production variants were unchanged or below 4% in that run. The filter implementation and benchmark files are byte-identical between baseline `84a96940185cc202aef0451d658bc89b864710a0` and synthetic candidate `ed25833fa8318e493d560239f60e56ec5ffad540`. An alternating 100-ms worker comparison reproduced interleaved/legacy +17.61% (p=.023). Production timings had broad variance and unchanged allocation counts. -At `6bf9e818e8c261012902da79ac2fc2e4a5b57acc`, all nine protected required checks passed, including both backend partitions, and five native platforms passed. The [Intel job](https://github.com/rcourtman/Pulse/actions/runs/39138980077/job/117709536519) passed the NAS preflight but exhausted the general-1 ten-minute Go process alarm while its active log-sink recovery control had run only 17 seconds. The remaining source blocker is aggregate native inventory execution. The canonical Unix runner now compiles and discovers one exact binary per phase, then executes every root check independently under the same ten-minute Go bound. Individual fixture and operation deadlines, full inventory acceptance and overall CI job deadlines remain unchanged. Exact-source native qualification is still required before landing. The required [script-smoke shard at 45a82ea03c](https://github.com/rcourtman/Pulse/actions/runs/39145479921/job/117728549560) exposed an existing script test entrypoint that still asserted the old grouped runner. The compiled-Go execution controls now live in that canonical script suite, shared by script-smoke discovery and the native Go wrapper. All eight controls passed through both worker entrypoints; fresh required and native checks must pass after this integration correction. +A longer, rotating-order control used ten one-second samples per arm on Go 1.26.9/linux-amd64 at integrated source `45a82ea03cb919d14172bf08d751ffaf80b16380`, tree `69f5dcc83a2dc2cb5b40bdf1be36eb0d644b0833`. Baseline-to-current medians were 83.88→68.27µs for legacy (p=.280) and 54.03→46.74µs for production (p=.247). Two byte-identical integrated-source binaries produced 68.27→105.69µs for legacy (p=.105) and 46.74→66.29µs for production (p=.143), with broad 34–65% intervals. Their common binary SHA-256 is `fdf613743dd3618c76f55ed3ebd6c91ee33d9a04266d96ab2e10fb0b255a4ac9`. Worker load averages were 14.99 before and 14.39 after. Allocations remained 12 for legacy and one for production. These controls establish substantial measurement variation, without proving performance equivalence or attributing the earlier adverse result to source. Complete samples, identities and comparisons are retained in the task's benchmark proof artifacts. -The [backend partition 0 at 45a82ea03c](https://github.com/rcourtman/Pulse/actions/runs/39145479921/job/117729442632) exposed a PBS response-consumption race: construction stopped but sometimes classified an ended password exchange as a malformed session. A deterministic control at `266144de1fc00e699f0ed07c8df76fd6a00cacc4` reproduced all ten JSON/form cases, including late complete-session publication and a cancelled encoding refusal authorizing another attempt. The shared authentication boundary now preserves the owner's context error for joined readers, blocks fallback after cancellation and checks caller lifetime before publishing a session. Live response validation and independent later recovery remain. All 108 PBS root tests and five affected monitoring controls passed under the race detector with no failures or skips, including all ten deterministic response-cancellation cases. Fresh final-source required and native CI still govern source qualification. +The [intervening comparison at 45a82ea03c](https://github.com/rcourtman/Pulse/actions/runs/39145479921/job/117728549510) passed. Its baseline is `3d6949851f9370898390c690bec7e62631c51f3b`. Synthetic candidate `570462312b39197166135e22eff77d7d60c4bc8f` has the tested head's tree `69f5dcc83a2dc2cb5b40bdf1be36eb0d644b0833`. It used ten 100-ms samples on Go 1.26.9/linux-amd64. Production interleaved filtering rose 4.57% (32.06→33.52µs, p<.001). Expired, one-point and hour production filtering improved 6.35–7.76%. The three previously flagged legacy cases were not significant in this run, with broad intervals. All history allocation counts remained unchanged. Artifact `12143797334` retains both sample streams, comparison and metadata. This was a different baseline and does not erase the earlier failed comparison. -The [advisory benchmark comparison](https://github.com/rcourtman/Pulse/actions/runs/39138980114/job/117709718583) completed execution but reported three regressions above 10% in test-only legacy history-filter references. Their corresponding production variants were unchanged or below 4%. Both filter implementation and benchmark source are byte-identical between baseline `84a96940185cc202aef0451d658bc89b864710a0` and synthetic candidate `ed25833fa8318e493d560239f60e56ec5ffad540`. The retained paired samples and source identities require an owning disposition; unchanged source alone does not classify the timing observation. The later [45a82ea03c comparison](https://github.com/rcourtman/Pulse/actions/runs/39145479921/job/117728549510) passed against newer baseline `3d6949851f9370898390c690bec7e62631c51f3b`; it does not erase the earlier samples. This advisory result does not replace the protected required checks or existing release gates. +The [final-source advisory comparison](https://github.com/rcourtman/Pulse/actions/runs/39148879492/job/117738375776) completed all paired samples and failed its comparison on one test-only legacy case: empty filtering 2.945→3.263ns, +10.82% (p<.001, ten samples). This is a comparison failure, not an execution timeout. Its baseline is `3d6949851f9370898390c690bec7e62631c51f3b`, tree `3d7d273e14f4d7c045cd35a16d2095c6da8eafa8`. Synthetic candidate `c21333c676ac004935c9683027490203d8f869ea` merges final source `b6e56c5baa2ad995264faa80877543300bc10273` into main `52b40fd611112904cf7e987e0fc1e8df1c7a0cbf` and has the actual landing tree `fa059ae37b46af49ac9dd140fb392b1180569770`. Both used Go 1.26.9/linux-amd64 with ten alternating 100-ms samples. The filter implementation and benchmark sources remain byte-identical between this baseline and candidate. Production empty filtering improved 16.70% (9.027→7.519ns, p<.001), interleaved filtering rose 2.96% (29.78→30.66µs, p=.011), and day/all production comparisons were not significant. Every history-filter byte and allocation count was unchanged. These observations do not classify the legacy timing result as intentional or harmless. The owning L1 residual retains its repeatability and attribution investigation. [Artifact 12145720151](https://github.com/rcourtman/Pulse/actions/runs/39148879492/artifacts/12145720151), digest `sha256:5215dbe650effe4cb5fff8206125699a410f5ffc90fcf45184ffe33365743849`, retains baseline/candidate streams, comparison and binary/source metadata. The overall Build and Test workflow is red because of this advisory job. All nine protected required checks passed, as did the native matrix and Core E2E. -These are source repairs and qualification evidence. Release inclusion, affected installed workflows and the manual reliability exit decision remain open. No target, lane state or priority changes with this work. +Source landing follows the unchanged protected checks. The existing L1 follow-up retains the advisory repeatability and attribution residual: obtain an interleaved comparison with an identical-binary control on a suitably quiet host before attributing a change or claiming performance closure. Neither unchanged source nor a later passing check erases the adverse samples. No benchmark threshold, required check or release gate changed. + +This closes source qualification and landing for PR2888 only. Release inclusion, installed customer recovery, exact-candidate publication and soak, operational recovery and the manual reliability exit decision remain in the existing follow-up. The dated release observations elsewhere in this record keep their own observation time. This work records no installed recovery or manual target closure. This work did not issue a release or change any target or lane priority. ## Exit decision and feature pickup diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json index 50087d099e..2890c3276d 100644 --- a/docs/release-control/v6/internal/status.json +++ b/docs/release-control/v6/internal/status.json @@ -5102,7 +5102,7 @@ "status": "partial", "completion": { "state": "bounded-residual", - "summary": "Self-hosted release confidence retains its historical v6.3.1 qualification evidence. Reconciled 18 October 2026: source-binding repair f04c230 landed through PR2091 and is included in stable v6.5.0. Remaining reliability work is final-source maintenance qualification, affected customer workflow recovery, exact-candidate publication and its own full soak, stable installed upgrade/recovery, and observed scheduled-scan and publisher storage recovery. The existing maintenance-release-delivery-and-observation follow-up and docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md own the current evidence and manual exit decision. No lane closure or priority handoff is claimed.", + "summary": "Self-hosted release confidence retains its historical v6.3.1 qualification evidence. Reconciled 18 October 2026: source-binding repair f04c230 landed through PR2091 and is included in stable v6.5.0. Maintenance PR2888 source qualification is complete at eeda20c0dda52ff2f9d1935892d5a09e13d71250, from exact source b6e56c5baa2ad995264faa80877543300bc10273. Remaining reliability work is release inclusion of that source, affected customer workflow recovery, exact-candidate publication and its own full soak, stable installed upgrade/recovery, and observed scheduled-scan and publisher storage recovery. The existing maintenance-release-delivery-and-observation follow-up and docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md own the current evidence and manual exit decision. No lane closure or priority handoff is claimed.", "tracking": [ { "kind": "lane-followup", @@ -9672,7 +9672,7 @@ }, { "id": "maintenance-release-delivery-and-observation", - "summary": "Reconcile final-source maintenance qualification and affected installed customer outcomes, selected-candidate publication and its own 24-hour soak, stable promotion and installed upgrade/recovery, the existing unassisted-release observation commitment, and actual scheduled-scan and publisher storage recovery. Delivered PR2091 and the stable #1815 correction are reconciled rather than unfinished landing work. Current dated evidence and manual target exit criteria are in docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md. Keep v6-release-reliability active until those outcomes support an explicit completion judgment.", + "summary": "Maintenance PR2888 source qualification and landing are complete at eeda20c0dda52ff2f9d1935892d5a09e13d71250. Track its release inclusion and affected installed customer outcomes, selected-candidate publication and its own 24-hour soak, stable promotion and installed upgrade/recovery, the existing unassisted-release observation commitment, and actual scheduled-scan and publisher storage recovery. Delivered PR2091 and the stable #1815 correction are reconciled rather than unfinished landing work. Current dated evidence and manual target exit criteria are in docs/release-control/v6/internal/records/maintenance-release-delivery-and-observation-2026-10-18.md. Keep v6-release-reliability active until those outcomes support an explicit completion judgment. Retain the advisory history-filter timing evidence and its repeatability/attribution residual under this existing owner. It does not add a protected source or release gate.", "owner": "pulse-maintainer", "status": "planned", "recorded_at": "2026-09-15",