From e597bb2a4beba8679782a453e0653bf53d3f743d Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sun, 4 Oct 2026 01:04:36 +0100
Subject: [PATCH] Keep release governance aligned with billing-safe demo
 profiles

PR2429 governance run 37161775883 still required the superseded entitlement rewrite after reviewed repair 7d739698 made profile admission read-only. Require the existing demo capability and reject the former integrity removal and billing rewrite instead. Retain runtime-setting, release and recovery guards unchanged.

Contract-Neutral: Test-only integration reconciliation; production billing and release admission are unchanged.
Change-source: pulse-maintainer
---
 .../release_control/release_promotion_policy_test.py  | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/scripts/release_control/release_promotion_policy_test.py b/scripts/release_control/release_promotion_policy_test.py
index 351a017957..f68fbb09d2 100644
--- a/scripts/release_control/release_promotion_policy_test.py
+++ b/scripts/release_control/release_promotion_policy_test.py
@@ -2643,15 +2643,20 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
         self.assertIn("MOCK_SEED_DURATION=2h", demo_profile)
         self.assertIn("MOCK_SAMPLE_INTERVAL=5m", demo_profile)
         self.assertIn("MOCK_UPDATE_INTERVAL=15s", demo_profile)
-        # Profile application moved into the owned transaction; keep its
-        # runtime settings and entitlement, not the superseded shell snippets.
+        # Profile application moved into the owned transaction; retain runtime
+        # settings but require an existing capability without rewriting billing.
         transaction = read(".github/scripts/demo-runtime-transaction.py")
         for required in ('"DEMO_MODE": "true"', '"PULSE_MOCK_MODE": "true"',
                          '"PULSE_MOCK_SEED_METRICS_STORE": "false"',
                          '"seed_duration": "trends_seed_duration"', '"sample_interval": "trends_sample_interval"',
-                         '"PULSE_MOCK_" + key.upper()', '["demo_fixtures"]', 'billing.pop("integrity", None)',
+                         '"PULSE_MOCK_" + key.upper()', 'self.profile_admission()',
+                         'if "demo_fixtures" not in billing["capabilities"]:',
+                         'raise Failure("billing-demo-capability-required")',
                          'self.host.profile(self.request, not healthy_baseline)', 'self.host.start()'):
             self.assertIn(required, transaction)
+        self.assertNotIn('billing.pop("integrity", None)', transaction)
+        self.assertNotIn('billing["capabilities"] = ["demo_fixtures"]', transaction)
+        self.assertNotIn('atomic_json(billing_file, billing)', transaction)
         self.assertIn("MOCK_NODES: ${{ needs.resolve.outputs.mock_nodes }}", demo)
         self.assertIn("MOCK_UPDATE_INTERVAL: ${{ needs.resolve.outputs.mock_update_interval }}", demo)
         self.assertIn("/api/license/runtime-capabilities", demo)