From b1fc6c7dcadead3827e6bdb6b7a73b9023ad71fa Mon Sep 17 00:00:00 2001 From: rcourtman Date: Mon, 17 Aug 2026 20:57:22 +0100 Subject: [PATCH] Prepare v6.2.2-rc.3 release --- VERSION | 2 +- deploy/helm/pulse/Chart.yaml | 8 +- deploy/helm/pulse/README.md | 2 +- docker-compose.yml | 2 +- docs/RELEASE_NOTES.md | 6 +- docs/UPGRADE_v6.md | 6 +- .../subsystems/deployment-installability.md | 26 +++-- docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md | 95 +++++++++++++++++++ docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md | 63 ++++++++++++ frontend-modern/public/docs/UPGRADE_v6.md | 6 +- scripts/install-docker.sh | 2 +- .../installtests/build_release_assets_test.go | 19 ++-- .../installtests/install_docker_sh_test.go | 3 +- 13 files changed, 206 insertions(+), 34 deletions(-) create mode 100644 docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md create mode 100644 docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md diff --git a/VERSION b/VERSION index 0313f445b..4cd3b64a3 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -6.2.2-rc.2 +6.2.2-rc.3 diff --git a/deploy/helm/pulse/Chart.yaml b/deploy/helm/pulse/Chart.yaml index a28305b41..cd053959d 100644 --- a/deploy/helm/pulse/Chart.yaml +++ b/deploy/helm/pulse/Chart.yaml @@ -2,9 +2,9 @@ apiVersion: v2 name: pulse description: Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent. type: application -version: 6.2.2-rc.2 -appVersion: "6.2.2-rc.2" -icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.2-rc.2/docs/images/pulse-logo.svg +version: 6.2.2-rc.3 +appVersion: "6.2.2-rc.3" +icon: https://raw.githubusercontent.com/rcourtman/Pulse/v6.2.2-rc.3/docs/images/pulse-logo.svg keywords: - monitoring - proxmox @@ -32,7 +32,7 @@ annotations: description: Smoke tests with kind cluster deployment artifacthub.io/links: | - name: Documentation - url: https://github.com/rcourtman/Pulse/blob/v6.2.2-rc.2/docs/KUBERNETES.md + url: https://github.com/rcourtman/Pulse/blob/v6.2.2-rc.3/docs/KUBERNETES.md - name: Support url: https://github.com/rcourtman/Pulse/discussions artifacthub.io/maintainers: | diff --git a/deploy/helm/pulse/README.md b/deploy/helm/pulse/README.md index 17bcc70b8..f3752a59a 100644 --- a/deploy/helm/pulse/README.md +++ b/deploy/helm/pulse/README.md @@ -1,6 +1,6 @@ # pulse -![Version: 6.2.2-rc.2](https://img.shields.io/badge/Version-6.2.2--rc.2-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.2.2-rc.2](https://img.shields.io/badge/AppVersion-6.2.2--rc.2-informational?style=flat-square) +![Version: 6.2.2-rc.3](https://img.shields.io/badge/Version-6.2.2--rc.3-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 6.2.2-rc.3](https://img.shields.io/badge/AppVersion-6.2.2--rc.3-informational?style=flat-square) Helm chart for deploying the Pulse hub and optional Docker, Kubernetes, or OpenShift monitoring agent. diff --git a/docker-compose.yml b/docker-compose.yml index 102b6d470..54743a2ae 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -2,7 +2,7 @@ version: '3.8' services: pulse: - image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.2-rc.2} + image: ${PULSE_IMAGE:-rcourtman/pulse:6.2.2-rc.3} container_name: pulse restart: unless-stopped logging: diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md index 7e454c04e..c64a58ce9 100644 --- a/docs/RELEASE_NOTES.md +++ b/docs/RELEASE_NOTES.md @@ -7,8 +7,8 @@ For historical v4 notes that previously lived in this repo, see: `docs/releases/RELEASE_NOTES_v4.md` For the current v6 support release candidate packet, see: -- `docs/releases/RELEASE_NOTES_v6.2.2-rc.2.md` -- `docs/releases/V6_CHANGELOG_v6.2.2-rc.2.md` +- `docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md` +- `docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md` For the current stable v6 packet, see: - `docs/releases/RELEASE_NOTES_v6.2.1.md` @@ -19,6 +19,8 @@ For earlier stable v6.2 packets, see: - `docs/releases/V6_CHANGELOG_v6.2.0.md` For historical v6.2 support release candidate packets, see: +- `docs/releases/RELEASE_NOTES_v6.2.2-rc.2.md` +- `docs/releases/V6_CHANGELOG_v6.2.2-rc.2.md` - `docs/releases/RELEASE_NOTES_v6.2.2-rc.1.md` - `docs/releases/V6_CHANGELOG_v6.2.2-rc.1.md` - `docs/releases/RELEASE_NOTES_v6.2.0-rc.11.md` diff --git a/docs/UPGRADE_v6.md b/docs/UPGRADE_v6.md index 4809ff08c..b35c56e49 100644 --- a/docs/UPGRADE_v6.md +++ b/docs/UPGRADE_v6.md @@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current v6 support release candidate packet, see: -- `docs/releases/RELEASE_NOTES_v6.2.2-rc.2.md` -- `docs/releases/V6_CHANGELOG_v6.2.2-rc.2.md` +- `docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md` +- `docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md` For the current stable v6 packet, see: @@ -19,6 +19,8 @@ For earlier stable v6.2 packets, see: For historical v6.2 support release candidate packets, see: +- `docs/releases/RELEASE_NOTES_v6.2.2-rc.2.md` +- `docs/releases/V6_CHANGELOG_v6.2.2-rc.2.md` - `docs/releases/RELEASE_NOTES_v6.2.2-rc.1.md` - `docs/releases/V6_CHANGELOG_v6.2.2-rc.1.md` - `docs/releases/RELEASE_NOTES_v6.2.0-rc.11.md` diff --git a/docs/release-control/v6/internal/subsystems/deployment-installability.md b/docs/release-control/v6/internal/subsystems/deployment-installability.md index 3ec866240..678a055d7 100644 --- a/docs/release-control/v6/internal/subsystems/deployment-installability.md +++ b/docs/release-control/v6/internal/subsystems/deployment-installability.md @@ -1447,16 +1447,17 @@ diagnostics. The same release workflow also executes the generated self-signed and custom-CA Windows installer commands through Windows PowerShell 5.1 before release assembly, so the first HTTPS fetch is release proof rather than a string-shape assertion. -The active support prerelease `v6.2.2-rc.2` cut sets the repo-root `VERSION`, +The active support prerelease `v6.2.2-rc.3` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` -fallback, and Helm chart release metadata to the same `6.2.2-rc.2` release -version. It follows stable `v6.2.1`, supersedes `v6.2.2-rc.1`, uses +fallback, and Helm chart release metadata to the same `6.2.2-rc.3` release +version. It follows stable `v6.2.1`, supersedes `v6.2.2-rc.2`, uses `rollback_version=v6.2.1`, and keeps stable/latest pointers on `v6.2.1`. This -candidate retains the complete first-candidate packet and adds host-local -Docker/Podman registry credentials for private-image update checks plus -smartmontools 7.5 `power_mode` object decoding for guarded rotational-disk -probes. The changes since `v6.2.2-rc.1` do not touch mobile, Relay, onboarding, -or mobile-facing API contracts, so the server cut is classified +candidate retains the complete earlier packet and adds durable scoped Patrol +objectives, validated read-only observers, verified work receipts, agent action +preflight with stable refusal codes, large-estate response improvements, and +monitoring correctness fixes. The changes since `v6.2.2-rc.2` do not require a +Pulse Mobile client change and preserve the existing mobile, Relay, onboarding, +and mobile-facing API contracts, so the server cut is classified `no-mobile-impact`; no companion upload or public mobile-store rollout is part of this candidate. The prerelease Windows path retains exact-SHA, checksum, and detached-signature @@ -1466,6 +1467,11 @@ This support prerelease keeps `rollback_version=v6.2.1`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases. +The preceding `v6.2.2-rc.2` candidate used the same support-prerelease path and +rollback target. It added host-local Docker/Podman registry credentials for +private-image update checks and smartmontools 7.5 `power_mode` object decoding +for guarded rotational-disk probes while retaining the first-candidate packet. + The preceding `v6.2.2-rc.1` candidate used the same support-prerelease path and rollback target. It established the cumulative security, monitoring-scale, resource-policy, agent, Relay, alerting, update, and release-qualification @@ -1730,8 +1736,8 @@ For the active stable `v6.1.2` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `6.1.2` whenever the governed `VERSION` is that stable cut. The stable promotion guard remains in force and rejects leftover `-rc.` defaults. -For the active support prerelease `v6.2.2-rc.2` cut, the repo-root compose -default and `scripts/install-docker.sh` fallback must both pin `6.2.2-rc.2` +For the active support prerelease `v6.2.2-rc.3` cut, the repo-root compose +default and `scripts/install-docker.sh` fallback must both pin `6.2.2-rc.3` until the next governed stable cut moves them forward. Each new release moves these two pins together with the repo-root `VERSION` and the Helm chart metadata in the same commit; a cut that leaves any of the four on a superseded value is a diff --git a/docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md b/docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md new file mode 100644 index 000000000..fcd60d482 --- /dev/null +++ b/docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md @@ -0,0 +1,95 @@ +# Pulse v6.2.2-rc.3 Release Notes + +`v6.2.2-rc.3` is a release candidate for the next Pulse v6 patch. It follows +stable `v6.2.1` and supersedes `v6.2.2-rc.2`. This candidate includes the +complete earlier packet and introduces the Patrol v2 operating model, guarded +agent action preflight, large-estate response improvements, and monitoring +correctness fixes. + +## Highlights + +- Patrol now works from durable outcomes, scoped investigations, and recent + verified-work receipts. +- Read-only observers extend Patrol coverage between full model investigations + without granting mutation authority. +- Approved actions gain agent preflight and stable refusal telemetry; large + installations gain compressed APIs and indexed lookups. + +## Added + +- Durable Patrol objectives with pause, archive, resource-scope, coverage, and + observer-health state. +- Model-authored observer proposals that are validated, installed as bounded + read-only checks, and kept separate from action authority. +- Verified Patrol work receipts and clearer navigation between findings, + objectives, attention items, and governed actions. +- Unified Agent preflight contracts for package updates, package-cache cleanup, + and Docker lifecycle or update operations. +- Production security deployment guidance and a focused security-review packet. + +## Improved + +- Patrol investigations preserve objective and resource intent across retries, + provider interruptions, chat restarts, truncated responses, and retained + objective runs. +- Finding identity, evidence, causal conclusions, and remediation proposals are + canonicalized and validated before Patrol writes or acts on them. +- Autonomous execution remains bounded by advertised capabilities, explicit + policy, agent preflight, current target state, and post-action verification. +- Action refusal telemetry now classifies target changes, prerequisites, + contract failures, capability limits, policy decisions, and stale plans + instead of collapsing the new agent reason codes into the catch-all bucket. +- API gzip handling preserves informational and bodyless responses, while + polling, metric lookup, registry resolution, and source-target mapping avoid + repeated large-estate scans. +- OpenRouter, Ollama, and subscription-backed Patrol routes handle reasoning + limits, readiness checks, deadlines, and continuation latency more reliably. + +## Fixed + +- Patrol no longer accepts empty, blocked, contradicted, incoherent, unscoped, + or unsupported findings and proposals as successful investigation output. +- Enabling full AI mode or restarting the chat provider now preserves and + rewires Patrol controls and investigation dependencies. +- Docker health-check dependencies and app-container scope now remain attached + to the correct canonical findings. +- Stale ZFS alerts clear when storage loses its pool attachment, and node-local + ZFS pools are no longer attached to shared storage records. +- vSphere backup status, agent thermal history, explicit cluster-member address + overrides, and discovery-analysis request timeouts now reflect their actual + runtime state. + +## Security + +- Patrol observers are read-only and proposal-only. Mutating operations still + require the normal action-policy, approval, capability, preflight, and + verification path. +- Agent preflight responses expose bounded machine reason codes rather than + command output, paths, package names, or provider-specific error text. +- Investigation tooling is projected from the selected resource scope and + rejects tools that were not advertised for that run. + +## Upgrade Notes + +Use the normal v6 install or update flow for `v6.2.2-rc.3` only when you are +comfortable testing a release candidate. The rollback target is `v6.2.1`. + +The exact rollback reinstall command is: + +```bash +./scripts/install.sh --version v6.2.1 +``` + +The changes since `v6.2.2-rc.2` do not require a Pulse Mobile client change and +preserve the existing mobile, Relay, onboarding, and mobile-facing API +contracts. No companion mobile build upload or public mobile-store rollout is +part of this candidate. + +Windows Unified Agent binaries in this prerelease retain exact-SHA, checksum, +and detached-signature verification but are not Authenticode-signed, so Windows +may display an Unknown Publisher warning. Stable `v6.2.2` still requires the +normal SignPath Authenticode lane unless a separate version-bound owner decision +is recorded. + +Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the +private download page and private runtime image for paid runtime features. diff --git a/docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md b/docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md new file mode 100644 index 000000000..af0836b75 --- /dev/null +++ b/docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md @@ -0,0 +1,63 @@ +# Pulse v6.2.2-rc.3 + +_This changelog describes the changes since `v6.2.2-rc.2`. +`v6.2.2-rc.3` remains a prerelease and rolls back to stable `v6.2.1`._ + +## Added + +- Durable, scoped Patrol objectives and validated read-only observer missions. +- Patrol objective, recent-work receipt, and expanded attention interfaces. +- Typed Unified Agent action preflight for supported host and Docker operations. +- Stable pre-mutation refusal codes and fleet telemetry buckets for target + changes, prerequisites, contract failures, capability limits, policy, and + stale plans. +- Production security guidance and a reusable security-review evidence packet. + +## Changed + +- Patrol is organized around operator outcomes, quiet background observation, + scoped evidence, typed proposals, governed execution, and verified receipts. +- Finding and investigation lifecycles are idempotent, scope-aware, and bounded + across continuation, provider-failure, restart, and truncation recovery. +- API responses support gzip, the client WebSocket ceiling is 32 MiB, and + large-estate polling and resource correlation use bounded or indexed paths. +- Runtime version identity is bound to the packaged binary rather than a stale + source-tree value. + +## Fixed + +- Patrol rejects findings and causal proposals whose identity, evidence, + resource scope, tool authority, or conclusion is incoherent. +- Full-mode activation and in-process provider restarts preserve Patrol runtime + wiring and controls. +- Docker health findings retain health-check dependencies and selected workload + scope through investigation and remediation. +- ZFS storage attachment, vSphere backup presentation, thermal history, cluster + member addressing, and discovery-analysis timeout handling now use canonical + runtime facts. +- Informational and bodyless HTTP responses remain valid when gzip is enabled. + +## Security + +- Observer missions cannot mutate infrastructure and cannot bypass the normal + action-governance path. +- Action preflight carries only bounded feasibility evidence and stable reason + codes across the agent boundary. +- Patrol tool access is derived from the requested resource scope and rejects + unadvertised calls. + +## Release Metadata + +- Version: `v6.2.2-rc.3` +- Previous candidate: `v6.2.2-rc.2` +- Previous stable: `v6.2.1` +- Rollback target: `v6.2.1` +- Rollback command: `./scripts/install.sh --version v6.2.1` +- Promotion path: exact-SHA single-build release candidate from `main`, + published as a support prerelease without moving stable or latest pointers +- Windows signing decision: the standing prerelease path publishes exact-SHA, + checksum, and detached-signature verified Windows agents without + Authenticode; stable `v6.2.2` restores mandatory SignPath signing +- Mobile decision: `no-mobile-impact`; changes since `v6.2.2-rc.2` preserve the + existing mobile, Relay, onboarding, and mobile-facing API contracts, and no + companion upload or public store rollout is required diff --git a/frontend-modern/public/docs/UPGRADE_v6.md b/frontend-modern/public/docs/UPGRADE_v6.md index 4809ff08c..b35c56e49 100644 --- a/frontend-modern/public/docs/UPGRADE_v6.md +++ b/frontend-modern/public/docs/UPGRADE_v6.md @@ -4,8 +4,8 @@ This guide covers practical upgrade steps for existing Pulse installs moving to For the current v6 support release candidate packet, see: -- `docs/releases/RELEASE_NOTES_v6.2.2-rc.2.md` -- `docs/releases/V6_CHANGELOG_v6.2.2-rc.2.md` +- `docs/releases/RELEASE_NOTES_v6.2.2-rc.3.md` +- `docs/releases/V6_CHANGELOG_v6.2.2-rc.3.md` For the current stable v6 packet, see: @@ -19,6 +19,8 @@ For earlier stable v6.2 packets, see: For historical v6.2 support release candidate packets, see: +- `docs/releases/RELEASE_NOTES_v6.2.2-rc.2.md` +- `docs/releases/V6_CHANGELOG_v6.2.2-rc.2.md` - `docs/releases/RELEASE_NOTES_v6.2.2-rc.1.md` - `docs/releases/V6_CHANGELOG_v6.2.2-rc.1.md` - `docs/releases/RELEASE_NOTES_v6.2.0-rc.11.md` diff --git a/scripts/install-docker.sh b/scripts/install-docker.sh index 54062090b..9e4edf8fe 100755 --- a/scripts/install-docker.sh +++ b/scripts/install-docker.sh @@ -6,7 +6,7 @@ set -euo pipefail SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" DOCKER_IMAGE_REPO="${DOCKER_IMAGE_REPO:-rcourtman/pulse}" -CANONICAL_DEFAULT_PULSE_VERSION="6.2.2-rc.2" +CANONICAL_DEFAULT_PULSE_VERSION="6.2.2-rc.3" resolve_default_pulse_version() { if [ -n "${PULSE_IMAGE_VERSION:-}" ]; then diff --git a/scripts/installtests/build_release_assets_test.go b/scripts/installtests/build_release_assets_test.go index 67b1b093f..50711b11d 100644 --- a/scripts/installtests/build_release_assets_test.go +++ b/scripts/installtests/build_release_assets_test.go @@ -653,11 +653,12 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "`v"+version+"` is a release candidate", "## Highlights", "stable `v"+previous+"`", - "Private-registry update checks now use the Docker or Podman login already on the agent host", - "smartmontools 7.5 power-mode objects no longer discard SMART data from guarded rotational-disk probes", - "Registry credentials remain on the monitored host and are presented only to the registry or its advertised token endpoint", + "Patrol now works from durable outcomes, scoped investigations", + "Read-only observers extend Patrol coverage between full model investigations", + "Action refusal telemetry now classifies target changes, prerequisites, contract failures", "The rollback target is `v"+previous+"`", - "The changes since `v"+previousCandidate+"` do not alter mobile, Relay, onboarding, or mobile-facing API contracts", + "The changes since `v"+previousCandidate+"` do not require a Pulse Mobile client change", + "preserve the existing mobile, Relay, onboarding, and mobile-facing API contracts", "Windows Unified Agent binaries in this prerelease retain exact-SHA, checksum, and detached-signature verification but are not Authenticode-signed", "Stable `v"+stableTarget+"` still requires the normal SignPath Authenticode lane", "Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the private download page", @@ -668,12 +669,12 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "Rollback target: `v"+previous+"`", "Promotion path: exact-SHA single-build release candidate from `main`", "This changelog describes the changes since `v"+previousCandidate+"`", - "Host-local registry credential discovery for Docker and Podman update checks", - "smartmontools 7.5 may encode guarded-probe `power_mode` as an object", - "Registry credentials remain host-local", + "Durable, scoped Patrol objectives and validated read-only observer missions", + "Typed Unified Agent action preflight for supported host and Docker operations", + "Stable pre-mutation refusal codes and fleet telemetry buckets", "Windows signing decision: the standing prerelease path publishes exact-SHA, checksum, and detached-signature verified Windows agents without Authenticode; stable `v"+stableTarget+"` restores mandatory SignPath signing", "Mobile decision: `no-mobile-impact`", - "changes since `v"+previousCandidate+"` do not modify mobile, Relay, onboarding, or mobile-facing API contracts", + "changes since `v"+previousCandidate+"` preserve the existing mobile, Relay, onboarding, and mobile-facing API contracts", "no companion upload or public store rollout is required", ) assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"), @@ -707,7 +708,7 @@ func TestCurrentSupportPrereleasePacketTracksInstallMetadata(t *testing.T) { "The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", "This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.", "For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.", - "The changes since `v"+previousCandidate+"` do not touch mobile, Relay, onboarding, or mobile-facing API contracts, so the server cut is classified `no-mobile-impact`; no companion upload or public mobile-store rollout is part of this candidate.", + "The changes since `v"+previousCandidate+"` do not require a Pulse Mobile client change and preserve the existing mobile, Relay, onboarding, and mobile-facing API contracts, so the server cut is classified `no-mobile-impact`; no companion upload or public mobile-store rollout is part of this candidate.", "The prerelease Windows path retains exact-SHA, checksum, and detached-signature verification without Authenticode; stable `v"+stableTarget+"` restores mandatory SignPath signing unless a new version-bound decision is recorded.", ) } diff --git a/scripts/installtests/install_docker_sh_test.go b/scripts/installtests/install_docker_sh_test.go index 2240f316c..9099b1ee5 100644 --- a/scripts/installtests/install_docker_sh_test.go +++ b/scripts/installtests/install_docker_sh_test.go @@ -138,6 +138,7 @@ func TestPreviousStableForPrereleaseVersionCrossesMinorBoundaries(t *testing.T) {version: "6.2.0-rc.11", want: "6.1.2"}, {version: "6.2.2-rc.1", want: "6.2.1"}, {version: "6.2.2-rc.2", want: "6.2.1"}, + {version: "6.2.2-rc.3", want: "6.2.1"}, } for _, test := range tests { @@ -356,7 +357,7 @@ func TestInstallDockerProofTracksSupportPrereleaseContract(t *testing.T) { assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"), "The active support prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.", "This support prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.", - "The changes since `v"+previousCandidate+"` do not touch mobile, Relay, onboarding, or mobile-facing API contracts, so the server cut is classified `no-mobile-impact`; no companion upload or public mobile-store rollout is part of this candidate.", + "The changes since `v"+previousCandidate+"` do not require a Pulse Mobile client change and preserve the existing mobile, Relay, onboarding, and mobile-facing API contracts, so the server cut is classified `no-mobile-impact`; no companion upload or public mobile-store rollout is part of this candidate.", "The prerelease Windows path retains exact-SHA, checksum, and detached-signature verification without Authenticode; stable `v"+stableTarget+"` restores mandatory SignPath signing unless a new version-bound decision is recorded.", "For the active support prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.", )