Refresh v6.4.2 release packet

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -4664,3 +4664,15 @@ historical releases without a portable candidate bundle retain verification
 against their original `create-release.yml` publication provenance. Multi-asset
 download retries clear the activation marker, checksum manifest, and portable
 bundle first so a partial attempt cannot poison every later retry.
+
+### Stable v6.4.2 patch cutoff
+
+The stable v6.4.2 packet remains centered on the infrastructure-action and SSO
+administrator-boundary fixes. Its final mainline cutoff also names every
+customer-visible change that landed after the initial packet preparation:
+bounded security setup request decoding, accurate PBS running and incomplete
+backup state, Overview-level notification retry and dismissal, canonical
+Assistant command-help dialog behavior, and agent server-address migration
+guidance. Release-integrity detail also records authenticated Unified Agent
+download validation and the exact-step candidate version binding. Packet proof
+must retain those outcomes before v6.4.2 can be dispatched for publication.

docs/releases/RELEASE_NOTES_v6.4.2.md

@@ -9,6 +9,11 @@ actions and SSO-only deployments.
 - **Infrastructure actions honor role boundaries** - Browser and proxy users must now be administrators or hold an explicit action permission before they can plan, approve, view, or execute infrastructure actions.
 - **SSO access no longer implies administrator access** - An authenticated SSO user now needs an effective RBAC `admin` grant for administrator routes. Unassigned, `operator`, and `viewer` users remain non-administrative even when no local administrator exists.
 - **SAML allowlists fail closed** - A configured domain or email allowlist now rejects a SAML assertion that omits the email claim instead of bypassing the allowlist.
+- **Security-sensitive setup requests are bounded** - Bootstrap, setup, repair, and recovery endpoints now reject oversized JSON request bodies before decoding them.
+- **PBS backup state returns to idle reliably** - Failed backups, interrupted snapshots, and completed PBS-to-PBS sync copies no longer leave guests stuck in a Backup Running state. Incomplete artifacts remain visible as failed rather than appearing recoverable.
+- **Delivery warnings can be resolved from Overview** - Retained notification failures can now be retried or dismissed directly from the Alerts overview while delivery history remains available.
+- **Assistant command help behaves as a complete dialog** - Command help now traps focus, isolates the background, closes consistently, returns focus to its trigger, and uses the same responsive dialog behavior as the rest of Pulse.
+- **Agent URL migration guidance is now included** - The built-in migration guide explains how to rerun the agent installer with the new server URL after moving or renaming a Pulse server.
 
 ## Before you upgrade
 

docs/releases/V6_CHANGELOG_v6.4.2.md

@@ -19,6 +19,30 @@ _This changelog describes stable `v6.4.2` compared with stable `v6.4.1`._
   action routes.
 - SAML domain and email allowlists now reject assertions without an email
   claim when either allowlist is configured.
+- Security-sensitive bootstrap, setup, repair, and recovery request bodies now
+  have explicit size limits and reject oversized JSON before decoding.
+- Pulse now distinguishes actively written PBS snapshots from terminally
+  incomplete artifacts by correlating incomplete snapshots with live PBS data
+  tasks. Failed backups and completed PBS-to-PBS sync copies no longer pin a
+  guest in Backup Running, and incomplete artifacts are excluded from
+  recoverable latest-backup pointers.
+- The Alerts overview now exposes the same retry and dismiss actions as the
+  Notifications view for retained delivery failures, so operators can clear a
+  warning without deleting delivery history.
+- Assistant command help now uses the canonical responsive dialog boundary,
+  including focus containment, background isolation, Escape and backdrop
+  dismissal, and focus return to the invoking control.
+- The shipped migration guide now documents rerunning the agent installer with
+  a new URL when the Pulse server address changes.
+
+## Release integrity
+
+- Published release validation now authenticates every Unified Agent download
+  endpoint by checking its checksum and detached-signature headers against the
+  exact served bytes before activation.
+- The release candidate verifier now binds the requested version explicitly in
+  the exact-SHA compiled-payload step, preventing step-local environment state
+  from aborting candidate assembly.
 
 ## Upgrade requirement
 

scripts/installtests/build_release_assets_test.go

@@ -2066,6 +2066,12 @@ func TestV642SecurityPacketCoversBothAdministratorBoundaryFixes(t *testing.T) {
 	for _, required := range []string{
 		"Infrastructure actions honor role boundaries",
 		"SSO access no longer implies administrator access",
+		"SAML allowlists fail closed",
+		"Security-sensitive setup requests are bounded",
+		"PBS backup state returns to idle reliably",
+		"Delivery warnings can be resolved from Overview",
+		"Assistant command help behaves as a complete dialog",
+		"Agent URL migration guidance is now included",
 		"map at least one trusted IdP group to the built-in `admin` role before upgrading",
 		"The rollback target is stable `v6.4.1`",
 	} {
@@ -2076,6 +2082,13 @@ func TestV642SecurityPacketCoversBothAdministratorBoundaryFixes(t *testing.T) {
 	for _, required := range []string{
 		"effective RBAC `admin` grant on `*`",
 		"SSO-only installation must map at least one trusted IdP group",
+		"request bodies now\n  have explicit size limits",
+		"completed PBS-to-PBS sync copies no longer pin a\n  guest in Backup Running",
+		"Alerts overview now exposes the same retry and dismiss actions",
+		"Assistant command help now uses the canonical responsive dialog boundary",
+		"migration guide now documents rerunning the agent installer",
+		"authenticates every Unified Agent download",
+		"release candidate verifier now binds the requested version explicitly",
 		"Promotion path: emergency stable patch from `main`",
 		"Mobile decision: `no-mobile-impact`",
 	} {