Rename the retired hosted route bucket to hosted_legacy

The shipped privacy document must stay free of the retired hosted
quickstart wording (quickstartCopyContract.test.ts), and the provider
class vocabulary is disclosed there verbatim. The bucket that marks a
legacy config still pointing at the retired Pulse-hosted route is now
hosted_legacy in the sender, the disclosure, the contract note, and the
receiver's closed vocabulary.

docs/PRIVACY.md

@@ -133,7 +133,7 @@ Every field is listed below with the reason it exists. Nothing else is included
 | Notification failures server error 7d (schema v15) | `0` | Count terminal failures classified locally as destination HTTP 5xx server errors without sending response content, destination identity, or provider identity |
 | Notification failures unknown 7d (schema v5) | `0` | Count terminal failures that do not match another fixed class without sending raw errors |
 | Alert AI enabled | `true`/`false` | See whether AI analysis on alert firing is switched on, without sending alert content, resource identifiers, or analysis text |
-| AI provider class | `local` | See one closed bucket for how the Patrol (or default) model is reached: `none`, `local` (Ollama or a private-network OpenAI-compatible endpoint), `cloud_byok` (a hosted provider with your own key), `cloud_subscription` (the Codex or Claude CLI subscription route), or the retired `hosted_quickstart`, without sending the provider, model name, endpoint, or account |
+| AI provider class | `local` | See one closed bucket for how the Patrol (or default) model is reached: `none`, `local` (Ollama or a private-network OpenAI-compatible endpoint), `cloud_byok` (a hosted provider with your own key), `cloud_subscription` (the Codex or Claude CLI subscription route), or `hosted_legacy` (the retired Pulse-hosted route), without sending the provider, model name, endpoint, or account |
 | Relay enabled | `true`/`false` | See whether remote-access features are being used |
 | SSO enabled | `true`/`false` | See whether single-sign-on support is being used |
 | Multi-tenant | `true`/`false` | See whether multi-tenant/runtime-org features are being used |

docs/release-control/v6/internal/subsystems/security-privacy.md

@@ -2434,7 +2434,7 @@ outcome counts so the fleet can be read for local versus cloud model routes,
 approximate Patrol cost, effective autonomy mode, and how investigations end.
 `ai_provider_class` is derived locally from the configured Patrol or default
 model route (`none`, `local`, `cloud_byok`, `cloud_subscription`,
-`hosted_quickstart`, `unknown`) with a syntactic private-host check on
+`hosted_legacy`, `unknown`) with a syntactic private-host check on
 operator-supplied OpenAI-compatible endpoints; it never resolves DNS and never
 carries the provider ID, model name, endpoint, or account.
 `pulse_intelligence_patrol_autonomy_level` is the effective level after

frontend-modern/public/docs/PRIVACY.md

@@ -133,7 +133,7 @@ Every field is listed below with the reason it exists. Nothing else is included
 | Notification failures server error 7d (schema v15) | `0` | Count terminal failures classified locally as destination HTTP 5xx server errors without sending response content, destination identity, or provider identity |
 | Notification failures unknown 7d (schema v5) | `0` | Count terminal failures that do not match another fixed class without sending raw errors |
 | Alert AI enabled | `true`/`false` | See whether AI analysis on alert firing is switched on, without sending alert content, resource identifiers, or analysis text |
-| AI provider class | `local` | See one closed bucket for how the Patrol (or default) model is reached: `none`, `local` (Ollama or a private-network OpenAI-compatible endpoint), `cloud_byok` (a hosted provider with your own key), `cloud_subscription` (the Codex or Claude CLI subscription route), or the retired `hosted_quickstart`, without sending the provider, model name, endpoint, or account |
+| AI provider class | `local` | See one closed bucket for how the Patrol (or default) model is reached: `none`, `local` (Ollama or a private-network OpenAI-compatible endpoint), `cloud_byok` (a hosted provider with your own key), `cloud_subscription` (the Codex or Claude CLI subscription route), or `hosted_legacy` (the retired Pulse-hosted route), without sending the provider, model name, endpoint, or account |
 | Relay enabled | `true`/`false` | See whether remote-access features are being used |
 | SSO enabled | `true`/`false` | See whether single-sign-on support is being used |
 | Multi-tenant | `true`/`false` | See whether multi-tenant/runtime-org features are being used |

internal/telemetry/patrol_cost.go

@@ -18,7 +18,7 @@ const (
 	AIProviderClassLocal             = "local"
 	AIProviderClassCloudBYOK         = "cloud_byok"
 	AIProviderClassCloudSubscription = "cloud_subscription"
-	AIProviderClassHostedQuickstart  = "hosted_quickstart"
+	AIProviderClassHostedLegacy      = "hosted_legacy"
 	AIProviderClassUnknown           = "unknown"
 
 	// Patrol 30-day input token buckets. Boundaries are inclusive lower and
@@ -58,7 +58,7 @@ func AIProviderClassValues() []string {
 		AIProviderClassLocal,
 		AIProviderClassCloudBYOK,
 		AIProviderClassCloudSubscription,
-		AIProviderClassHostedQuickstart,
+		AIProviderClassHostedLegacy,
 		AIProviderClassUnknown,
 	}
 }
@@ -110,7 +110,7 @@ func PatrolInvestigationOutcomeBucketValues() []string {
 //     including a custom OpenAI-compatible endpoint on a public host.
 //   - cloud_subscription: the locally authenticated Codex or Claude CLI
 //     subscription routes, which carry no per-token bill.
-//   - hosted_quickstart: the retired Pulse-hosted route still selected in a
+//   - hosted_legacy: the retired Pulse-hosted route still selected in a
 //     legacy config that has not been normalized yet.
 func ClassifyAIProviderClass(cfg *config.AIConfig) string {
 	if cfg == nil || !cfg.Enabled {
@@ -125,7 +125,7 @@ func ClassifyAIProviderClass(cfg *config.AIConfig) string {
 	}
 	model := config.NormalizeQuickstartModelString(rawModel)
 	if model == "" {
-		return AIProviderClassHostedQuickstart
+		return AIProviderClassHostedLegacy
 	}
 	provider, _ := config.ParseModelString(model)
 	switch strings.ToLower(strings.TrimSpace(provider)) {
@@ -139,7 +139,7 @@ func ClassifyAIProviderClass(cfg *config.AIConfig) string {
 		}
 		return AIProviderClassCloudBYOK
 	case config.AIProviderQuickstart:
-		return AIProviderClassHostedQuickstart
+		return AIProviderClassHostedLegacy
 	case "":
 		return AIProviderClassUnknown
 	}

internal/telemetry/patrol_cost_test.go

@@ -148,8 +148,8 @@ func TestClassifyAIProviderClass(t *testing.T) {
 		{"openrouter", enabled(func(c *config.AIConfig) { c.Model = "openrouter:meta-llama/x" }), AIProviderClassCloudBYOK},
 		{"codex subscription", enabled(func(c *config.AIConfig) { c.Model = "codex-subscription:gpt-x" }), AIProviderClassCloudSubscription},
 		{"claude subscription", enabled(func(c *config.AIConfig) { c.Model = "claude-subscription:claude-x" }), AIProviderClassCloudSubscription},
-		{"retired hosted quickstart alias", enabled(func(c *config.AIConfig) { c.Model = config.DefaultAIModelQuickstart }), AIProviderClassHostedQuickstart},
-		{"retired hosted quickstart provider prefix", enabled(func(c *config.AIConfig) { c.Model = config.AIProviderQuickstart + ":pulse-hosted" }), AIProviderClassHostedQuickstart},
+		{"retired hosted quickstart alias", enabled(func(c *config.AIConfig) { c.Model = config.DefaultAIModelQuickstart }), AIProviderClassHostedLegacy},
+		{"retired hosted quickstart provider prefix", enabled(func(c *config.AIConfig) { c.Model = config.AIProviderQuickstart + ":pulse-hosted" }), AIProviderClassHostedLegacy},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {

internal/telemetry/telemetry.go

@@ -197,7 +197,7 @@ const (
 	// Each browser reports each closed milestone at most once per session to a
 	// bounded local daily tally; no event stream or browser identity is sent.
 	// Schema v17 adds the closed Patrol provider class (local, cloud_byok,
-	// cloud_subscription, hosted_quickstart, none), the effective Patrol
+	// cloud_subscription, hosted_legacy, none), the effective Patrol
 	// autonomy level, coarse 30-day Patrol input and output token buckets, and
 	// per-outcome investigation counts. The 2026-09-01 Patrol assessment could
 	// not tell local from cloud installs, estimate what Patrol costs an
@@ -311,7 +311,7 @@ type Ping struct {
 	AIActionsEnabled     bool `json:"ai_actions_enabled"`
 	AlertAIEnabled       bool `json:"alert_ai_enabled"`
 	// AIProviderClass is the closed route class of the Patrol (or default)
-	// model: none, local, cloud_byok, cloud_subscription, hosted_quickstart,
+	// model: none, local, cloud_byok, cloud_subscription, hosted_legacy,
 	// or unknown. Never a provider ID, model name, endpoint, or account.
 	AIProviderClass string `json:"ai_provider_class"`
 	ActiveAlerts    int    `json:"active_alerts"`