Integrate reviewed credential-safe container diagnostics

Preserve both exact Core candidate commits; keep private terminal entry and monitoring trust boundaries intact.

Change-source: pulse-maintainer

docs/release-control/v6/internal/subsystems/agent-lifecycle.md

@@ -3452,6 +3452,25 @@ Agent` secondary handoff against the live setup wizard instead of relying
 
 ## Current State
 
+### Credential-safe container diagnostics bootstrap (1 October 2026)
+
+The existing container-runtime migration command now shares the Proxmox
+complete-download/preflight/private-input implementation in
+`internal/api/configapi/install_command.go`. The authenticated response keeps
+its separate `token` field; `installCommand` never interpolates it. A terminal
+prompt inside the root/sudo child creates a bounded 0700/0600 handoff, passes
+only its path, and removes it on success, failure or handled signals. Optional
+auth needs neither a credential nor a terminal. Default host-plus-Docker and
+explicit workload-only modes, their persisted scopes, 30-second interval and
+plain-HTTP continuity remain unchanged; neither mode adds command execution.
+The diagnostic systemd reference uses the default installer's protected
+`/var/lib/pulse-agent/token`, not a token literal or secret environment value.
+It is not a replacement for the complete installer-generated unit, especially
+on custom-state or privilege-profile installations. Executable root/sudo,
+history, argv, cleanup and real TLS-download fixtures are in
+`configapi/container_install_command_test.go`; they are not native installation
+or Docker/Podman estate acceptance.
+
 ### Credential-safe Proxmox bootstrap (1 October 2026)
 
 Proxmox initial bootstrap keeps credentials out of copied shell source. The current PVE/PBS agent command fetches a complete installer, runs its credential-free preflight, then privately prompts inside the root/sudo Bash child. Its 0700 directory and 0600 token file are owned by that child, passed only by path and removed on exit or handled signals. The UI reveals credentials separately, clears cached setup material on close and discards late issuance after close/reset. No exec scope is added. Existing fleet reporting is unchanged; newly enrolling an older agent with a newer server requires the current installer. New agents and the root installer still validate coherent old-server artifacts during rolling upgrades, but never execute their command strings.

docs/release-control/v6/internal/subsystems/api-contracts.md

@@ -4579,6 +4579,25 @@ auto-register mutation boundary.
 
 ## Current State
 
+### Credential-safe container diagnostics response (1 October 2026)
+
+`POST /api/diagnostics/docker/prepare-token` retains its fields and durable,
+tenant-bound monitoring-token issuance. Only the separate `token` field may
+contain the credential; `installCommand` is now a credential-free single line
+with complete download, installer preflight, then root/sudo private terminal
+input and token-file handoff. The response is `Cache-Control: no-store`.
+`systemdServiceSnippet` is a default-Linux reference to the installer's private
+state file, with no raw token in environment or process arguments. It explicitly
+instructs callers to use `installCommand` for the complete service and retain
+installer-generated units for custom state/privilege profiles. Unit URL data is
+quoted with literal percent specifiers; structural control characters fail
+before token issuance. Existing module flags/scopes, optional-token omission,
+normalised target and plain-HTTP policy are unchanged. No new endpoint,
+credential authority, execution scope or trust exception is introduced.
+`agent_install_command_shared_test.go`, `contract_test.go`,
+`router_low_coverage_additional_test.go` and `security_regression_test.go` pin
+the response, hosted-origin boundary, persisted scope and safe unit grammar.
+
 ### Credential-safe Proxmox bootstrap (1 October 2026)
 
 The current Proxmox setup artifact supersedes the former token-bearing command/download contract: `command`, `commandWithEnv` and `commandWithoutEnv` are identical credential-free, single-line transports. `downloadURL` equals the tokenless `url`; downloads embed no setup token. `setupToken` (or agent-install `token`) is returned separately through the authenticated issuance response for an explicit reveal, never interpolated by the consumer. Settings uses the existing token-reveal dialog and tells users to run the command before pasting at its silent terminal prompt. Setup cache remains bound to endpoint/mode/live five-minute expiry and is discarded on modal close. The rendered scripts accept a bounded private `PULSE_SETUP_TOKEN_FILE` before mutation, unexport the secret, and put registration credentials in stdin, not process arguments. Legacy explicit query-token downloads remain accepted for compatibility, but no current artifact generates those URLs. Failed attempted registration returns nonzero and never echoes the response body. Runtime and root-installer consumers validate either the complete new artifact or the coherent old-server artifact; mixed transports fail closed.

docs/release-control/v6/internal/subsystems/security-privacy.md

@@ -956,6 +956,23 @@ tokens, and path-normalization variants.
 
 ## Current State
 
+### Container diagnostics keeps copied material credential-free (1 October 2026)
+
+Container migration-token issuance returns its secret separately on the
+existing authenticated route, with a no-store response. Copied install source,
+download URLs and the diagnostic systemd reference must never contain that
+secret, a raw token process argument or a secret-bearing environment directive.
+The installer receives a bounded private file only after complete download and
+preflight, from silent root/sudo terminal input; failure and handled signals
+clean the handoff. The service reference points to the canonical default
+Linux private state file and does not replace installer-owned profile policy.
+URL percent specifiers are literal in the systemd environment, and structural
+control characters are rejected before minting. Monitoring scopes, tenant
+resolution, persistence rollback and HTTPS verification remain unchanged.
+`TestSecurityContainerDiagnosticsRejectsUnitInjectionBeforeTokenIssuance` and
+`TestSecurityContainerDiagnosticsServiceReferenceUsesPrivateState` exercise
+that boundary, including real systemd grammar validation without installation.
+
 ### Node TLS verification preference is operator-owned
 
 A PVE connection's `VerifySSL` value is security-relevant, so the stored

docs/release-control/v6/internal/subsystems/storage-recovery.md

@@ -2640,6 +2640,19 @@ vdev layout is reported` in
 
 ## Current State
 
+### Container diagnostics shares private bootstrap transport (1 October 2026)
+
+Recovery-adjacent diagnostics now reuse the canonical complete installer
+fetch/preflight and root/sudo private token-entry boundary, rather than exposing
+credentials in a copied pipeline or reference service. Its existing token
+response remains separate, no-store and durably bound to the unchanged
+host-plus-Docker or workload-only scopes. The default-Linux service reference
+uses a protected token path and instructs users to retain the actual
+installer-generated unit for custom state and privilege profiles. Invalid
+unit structure fails before issuance. This changes no storage permission,
+retention, recovery operation or success condition; executable bootstrap and
+response proof is not persistent-data upgrade/rollback acceptance.
+
 ### Credential-safe Proxmox bootstrap (1 October 2026)
 
 The shared Proxmox setup boundary now receives its bootstrap credential from private terminal input via a bounded 0700/0600 file, before native setup mutation, rather than from copied shell literals or newly generated token-bearing download URLs. Existing registration grant binding, PVE/PBS monitoring scopes, and explicit non-rotating Audit/Repair remain unchanged. A private-file validation failure stops setup, and failed attempted registration exits nonzero with fixed guidance rather than echoed credential-bearing responses. This supersedes historical shared-boundary requirements for token-bearing commands and manual download URLs; it does not change storage permissions, recovery or retention.