SetBytes benchmarks report B/s beside time and allocation costs. Treat
lower byte throughput as adverse, retain lower-is-better cost metrics,
and include each finding's unit so scaled values are not ambiguous. Keep
the significance, sample and magnitude gates unchanged.
Contract-Neutral: CI benchmark verdict parsing and registered regression
controls only; no product runtime or subsystem contract change.
---
Fleet candidate `20261025T111654Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`296b128254243218a65b34f25ae65ee984d62b94` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep configuration-transfer feedback in its active dialog**
Repeated transfer refusals duplicated persistent dialog feedback in
foreground, inert toasts that obscured phone forms. Keep errors, token
validation and saved-token status with the active dialog, allow its
contents to scroll, and retain an original-workspace completion notice
instead of hiding it. Preserve explicit-only dispatch, scope checks,
uncertain-outcome guidance and closed-dialog success confirmations.
Registered consuming tests and desktop/narrow browser proof cover the
complete interaction.
**Use supported Testing Library role options in transfer tests**
Remove the three Playwright-only exact options from DOM Testing Library
queries. String role names already match exactly there; the controls,
assertions and runtime bytes are unchanged. The full registered suite
passed before TypeScript identified this test-only API mismatch.
Contract-Neutral: Test-only query option correction; no runtime or
subsystem contract change.
---
Fleet candidate `20261025T111654Z-web-product` from the `web-product`
lane. Reviewed tip `6bbc3815a060e230e01aff1c693cbfd7bf616ade` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
A negative backup or verification age is clock uncertainty, not evidence
of a recent protected backup. Retain provider dates and artifacts,
explain the uncertainty, and preserve access boundaries and ordinary
clock correction through poll and posture reads.
---
Fleet candidate `20261025T111414Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `d7f138cea6f82523a84ffa4924b4effb7f2a18ef` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Remove the three Playwright-only exact options from DOM Testing Library queries. String role names already match exactly there; the controls, assertions and runtime bytes are unchanged. The full registered suite passed before TypeScript identified this test-only API mismatch.
Contract-Neutral: Test-only query option correction; no runtime or subsystem contract change.
Change-source: pulse-maintainer
On phone and narrow Workloads tables the guest name cell stacked the
backup shield on its own line under the name. Its 24px touch target then
made that line taller still, so every guest row on a 375px phone grew
from 32px to 43.5px just to show a 14px icon.
The shield now sits on the name's line, after the name, and the name
truncates first. Negative margins let the 24px target overhang the 14px
icon, so the row stays one line tall and the name loses only the icon's
width.
Measured on a mock stack, Proxmox overview, 36 guest rows:
| Width | Row height before | Row height after | Names truncated before
| Names truncated after |
| --- | --- | --- | --- | --- |
| 375px | 43.5px | 32px | 3 | 9 |
| 430px | 43.5px | 32px | – | 4 |
- Tapping the shield still opens the backup evidence dialog. Tapping the
row still opens the guest drawer.
- Locks keep their separate line below the name.
- Tablet and desktop layouts are unchanged.
Repeated transfer refusals duplicated persistent dialog feedback in foreground, inert toasts that obscured phone forms. Keep errors, token validation and saved-token status with the active dialog, allow its contents to scroll, and retain an original-workspace completion notice instead of hiding it. Preserve explicit-only dispatch, scope checks, uncertain-outcome guidance and closed-dialog success confirmations. Registered consuming tests and desktop/narrow browser proof cover the complete interaction.
Change-source: pulse-maintainer
SetBytes benchmarks report B/s beside time and allocation costs. Treat lower byte throughput as adverse, retain lower-is-better cost metrics, and include each finding's unit so scaled values are not ambiguous. Keep the significance, sample and magnitude gates unchanged.
Contract-Neutral: CI benchmark verdict parsing and registered regression controls only; no product runtime or subsystem contract change.
Change-source: pulse-maintainer
On phone and narrow Workloads tables the guest name cell stacked the
backup shield on its own line under the name, and its 24px touch
target made that line taller still. Every guest row on a 375px phone
grew from 32px to 43.5px just to show a 14px icon, breaking the
one-line compact rows the tables are built around.
The shield now sits on the name's line, after the name, which
truncates first. Negative margins let the 24px target overhang the
14px icon, so the row keeps its single-line height and the name loses
only the icon's width. Tapping the shield still opens the backup
evidence dialog and tapping the row still opens the guest drawer.
Locks keep their separate line below the identity. Tablet and desktop
layouts are unchanged.
A negative backup or verification age is clock uncertainty, not evidence of a recent protected backup. Retain provider dates and artifacts, explain the uncertainty, and preserve access boundaries and ordinary clock correction through poll and posture reads.
Change-source: pulse-maintainer
**State configuration recovery's limits before transfer**
Remove the overview's all-connections and merge promises. Disclose the
selected-workspace export's exclusions and destination-backup warning
before opening either existing dialog, with the shipped migration guide
and registered consuming coverage. Desktop and narrow browser proof
preserves the existing actions and transfer scope.
**Align Recovery verification-policy regression coverage**
Keep the seven remaining settings shells under framing proof, and assert
transfer-specific membership for Recovery, its dialogs and its flow.
Confirm dedicated proofs match and generic settings architecture cannot
satisfy transfer safety. This repairs PR 3249's reproducible
governance-test failure without changing the guard or weakening the
registry.
**Align subsystem lookup with dedicated transfer verification**
Complete the same Recovery policy move in lookup coverage, including all
three transfer surfaces and their exact proof list. The broader
governance run exposed this stale framing expectation after the first
repair; no runtime, registry or enforcement changes are required.
**Keep Recovery overview proof separate from transfer safety**
Restore the existing dialog/flow verification policy unchanged and give
the Recovery overview its own direct-test requirement. Pin rejection of
cross-surface substitutes, cumulative proof for mixed edits and truthful
forward/reverse lookup routes without changing frontend bytes or
imported history.
---
Fleet candidate `20261025T103613Z-web-product` from the `web-product`
lane. Reviewed tip `77350524c4abb16252b00d35da4cc778b171f69b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep canonical protection aligned with recognised Proxmox subjects**
Use the same subject normalisation as recovery rollups when deriving
protection. Fresh points carrying recognised legacy node-scoped
identities must not disappear from a canonical guest's posture. Cover
stale-plus-fresh histories, incomplete/running/task evidence,
independent estates and the real poll/async-ingest path. This does not
establish the cause of issue #3248.
**Publish the canonical subject in persisted protection posture**
The real poll regression caught a second identity boundary: selecting
the newest point's raw subject still made canonical reads miss the
derived posture. Reuse recovery's recognised subject resolver for the
persisted projection, and verify both canonical requested reads and
state-filtered lists. No schema, driver, policy or identity resolver
change.
---
Fleet candidate `20261025T100027Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `b0d76d7cea27f9d612e365809e3147e11383aa06` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Do not infer failing versions from upgrade transitions**
A source-to-target sequence in a declared version or version-leading
title does not identify the failing executable or prove an upgrade
completed. Leave it ambiguous while retaining explicit current-version
declarations and Community-owned labels; exercise the real metadata
consumer without public contact or release inference.
Contract-Neutral: community metadata only; no product runtime or
subsystem contract delta
**Keep upgrade-version intake within the existing guide contract**
The metadata parser repair already implements the guide's existing
chronology rule. Remove its redundant guide addition rather than leave
source and shipped help out of sync; preserve both mirror checks and all
original upgrade safety guidance unchanged.
Contract-Neutral: Restore unchanged guide content; no subsystem or
rendered product contract delta
---
Fleet candidate `20261025T093632Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`3c5503eba94ba8ef2d4c09c322ecc91e08c15501` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Restore the existing dialog/flow verification policy unchanged and give the Recovery overview its own direct-test requirement. Pin rejection of cross-surface substitutes, cumulative proof for mixed edits and truthful forward/reverse lookup routes without changing frontend bytes or imported history.
Change-source: pulse-maintainer
The proposed-source triage suite already exercises the locked parser and
silent-mutation consumers. Pure helper edits still queued unrelated
application suites for more than twenty minutes. Recognise only the six
exact triage inputs from a complete tree diff; mixed, missing and
control-path changes retain full application checks. Keep workflow
output outside the fixture source tree so real-diff controls do not
stage it.
Contract-Neutral: CI admission for isolated issue-event inputs only;
locked triage tests, secret scanning, governance and mixed-source
runtime checks remain enforced, with no product contract or permission
change.
---
Fleet candidate `20261025T085429Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`e404c2fe07096fcf9b733f307a5a834719a966c5` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The metadata parser repair already implements the guide's existing chronology rule. Remove its redundant guide addition rather than leave source and shipped help out of sync; preserve both mirror checks and all original upgrade safety guidance unchanged.
Contract-Neutral: Restore unchanged guide content; no subsystem or rendered product contract delta
Change-source: pulse-maintainer
Two fixes from one support report.
- Link unpinned cluster members to their Proxmox address. Under strict
TLS a member without its own certificate pin is dialed by its bare node
name, and the frontend then guessed a browser address from the node
interfaces, picking a bridge every member shares (a report had the
newest node open 172.16.0.1). The runtime link now uses the address
Proxmox reports for that member, keeping the dial scheme and port.
Dialing is unchanged.
- Keep the system hostname when migrating to the safe profile. Migration
pinned hostname -f, so migrated hosts switched to their FQDN while
root-profile hosts kept the short name. It now pins the system hostname
the agent already reports. An explicit --hostname still wins. Hosts
migrated earlier keep their stored name.
The real poll regression caught a second identity boundary: selecting the newest point's raw subject still made canonical reads miss the derived posture. Reuse recovery's recognised subject resolver for the persisted projection, and verify both canonical requested reads and state-filtered lists. No schema, driver, policy or identity resolver change.
Change-source: pulse-maintainer
Complete the same Recovery policy move in lookup coverage, including all three transfer surfaces and their exact proof list. The broader governance run exposed this stale framing expectation after the first repair; no runtime, registry or enforcement changes are required.
Change-source: pulse-maintainer
Use the same subject normalisation as recovery rollups when deriving protection. Fresh points carrying recognised legacy node-scoped identities must not disappear from a canonical guest's posture. Cover stale-plus-fresh histories, incomplete/running/task evidence, independent estates and the real poll/async-ingest path. This does not establish the cause of issue #3248.
Change-source: pulse-maintainer
Keep the seven remaining settings shells under framing proof, and assert transfer-specific membership for Recovery, its dialogs and its flow. Confirm dedicated proofs match and generic settings architecture cannot satisfy transfer safety. This repairs PR 3249's reproducible governance-test failure without changing the guard or weakening the registry.
Change-source: pulse-maintainer
**Prevent configuration-import replays from overwriting newer edits**
Keep one active import per workspace through persistence and runtime
apply. Reject equal committed archive/passphrase requests for ten
minutes, including after lost responses or failed apply, rather than
repeat writes/reloads or report a cached success. Bound process-local
admission without evicting live protection and release uncommitted
failures for corrected retries. Preserve existing authentication, CSRF,
tenant scope and complete legacy archives. Cover the real handler with
response-loss, overlap, newer-edit, router and admission controls.
**Complete synthetic node credentials in import-replay controls**
The real loader correctly requires both token name and value, including
for disabled fixture nodes. Supply the missing synthetic names so the
controls reach runtime apply rather than fail validation. No runtime
behavior or assertion is changed.
**Use a non-empty backup in scoped replay contract controls**
Keep the existing empty-node wipe defence intact. The contract fixture
targets populated tenants, so give its shared archive a fully
authenticated disabled synthetic node rather than expect an empty export
to remove their inventory. Runtime and admission logic are unchanged.
---
Fleet candidate `20261025T081822Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `d2ae24d62d15f79932f8ec8b9452605604d3bc2e` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
A source-to-target sequence in a declared version or version-leading title does not identify the failing executable or prove an upgrade completed. Leave it ambiguous while retaining explicit current-version declarations and Community-owned labels; exercise the real metadata consumer without public contact or release inference.
Contract-Neutral: community metadata only; no product runtime or subsystem contract delta
Change-source: pulse-maintainer
Safe-profile migration pinned the output of hostname -f as the agent's
reported name, so every migrated host switched to its FQDN while
root-profile hosts kept the short system hostname the agent reads. Pin
the system hostname instead. An explicit --hostname still wins, and the
server's authority check already accepts short and FQDN forms of the
bound name. Hosts migrated earlier keep their stored name.
Contract-Neutral: Safe-profile migration now pins the system hostname the agent already reports; no agent-lifecycle or deployment-installability clause names the hostname -f choice, and the new install_sh_test.go case proves the behaviour.
Under strict TLS a cluster member without its own certificate pin is
dialed by its bare node name, which is what happens to a node that joins
after the others were pinned. Its runtime link was left empty, so the
frontend swapped the bare name for an address guessed from the node's
interfaces and picked a bridge every member shares. A support report
had the newest node's web interface link open 172.16.0.1 instead of
the node's management address.
When neither the member nor the connection has a link override and the
dial URL is a bare label, use the address Proxmox reports for that
member, keeping the dial scheme and port. Dialing is unchanged.
The proposed-source triage suite already exercises the locked parser and silent-mutation consumers. Pure helper edits still queued unrelated application suites for more than twenty minutes. Recognise only the six exact triage inputs from a complete tree diff; mixed, missing and control-path changes retain full application checks. Keep workflow output outside the fixture source tree so real-diff controls do not stage it.
Contract-Neutral: CI admission for isolated issue-event inputs only; locked triage tests, secret scanning, governance and mixed-source runtime checks remain enforced, with no product contract or permission change.
Change-source: pulse-maintainer
Keep the existing empty-node wipe defence intact. The contract fixture targets populated tenants, so give its shared archive a fully authenticated disabled synthetic node rather than expect an empty export to remove their inventory. Runtime and admission logic are unchanged.
Change-source: pulse-maintainer
Remove the overview's all-connections and merge promises. Disclose the selected-workspace export's exclusions and destination-backup warning before opening either existing dialog, with the shipped migration guide and registered consuming coverage. Desktop and narrow browser proof preserves the existing actions and transfer scope.
Change-source: pulse-maintainer
Keep the locked parser's document-wide reference definitions when
classifying extracted version, feedback and topic fields. Match visible
link labels without reading destinations as evidence or fetching them.
Exercise all three fields and the silent label consumer, preserving
Community state and unknown or copied evidence.
Contract-Neutral: Silent issue-label metadata only; no product runtime,
rendered frontend, dependency, access or canonical subsystem contract
delta.
---
Fleet candidate `20261025T080016Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`2b3d5605287e4b6bcf8d8066271feca7e1697a2d` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Bind configuration transfers to their confirmed workspace**
Capture the target before file or CSRF preparation, freeze submitted
inputs and use the existing strict non-retrying API path. Keep one
operation pending, suppress late downloads/reloads after scope changes
or teardown, and require explicit resubmission after token entry.
An unconfirmed import may have applied: retain that warning rather than
claiming no work occurred. Browser reset controls show transport-level
replay despite one application fetch; server-side single-application
protection remains a separate Core assessment.
**Check configuration recovery's actual reload timers**
Track the scheduled 2000 ms reload and its exact cancellation handle
instead of asserting the total fake-clock task count. Unrelated queued
timer observations must neither fail nor stand in for the real no-reload
and cleanup proofs.
**Keep configuration reload timer assertions typed**
Use the concrete timeout function for the Vitest spy so callback
arguments retain their types under strict type checking.
**Keep configuration-transfer ownership in registry order**
Insert the two transfer files into the existing case-insensitive sorted
ownership list so the real registry audit accepts the candidate.
Membership, path policies, proof requirements and frontend content are
unchanged.
**Keep configuration-transfer guidance within copy-style checks**
Repair the two user-visible semicolons rejected by PR 3241's frontend CI
without weakening checks or changing transfer behaviour. Protect the
messages with consuming tests and fresh desktop/narrow browser proof.
Contract-Neutral: Copy-only configuration-transfer CI repair. Scope,
authority and transfer behaviour are unchanged.
---
Fleet candidate `20261025T080021Z-web-product` from the `web-product`
lane. Reviewed tip `f4d8913008476e7df96172cb40b97f6068cea40e` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Promote v6.6.0-rc.6 to stable after its 24-hour soak. Only release metadata changes.
Contract-Neutral: Release-only v6.6.0 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
The real loader correctly requires both token name and value, including for disabled fixture nodes. Supply the missing synthetic names so the controls reach runtime apply rather than fail validation. No runtime behavior or assertion is changed.
Change-source: pulse-maintainer
Keep one active import per workspace through persistence and runtime apply. Reject equal committed archive/passphrase requests for ten minutes, including after lost responses or failed apply, rather than repeat writes/reloads or report a cached success. Bound process-local admission without evicting live protection and release uncommitted failures for corrected retries. Preserve existing authentication, CSRF, tenant scope and complete legacy archives. Cover the real handler with response-loss, overlap, newer-edit, router and admission controls.
Change-source: pulse-maintainer
Keep the locked parser's document-wide reference definitions when classifying extracted version, feedback and topic fields. Match visible link labels without reading destinations as evidence or fetching them. Exercise all three fields and the silent label consumer, preserving Community state and unknown or copied evidence.
Contract-Neutral: Silent issue-label metadata only; no product runtime, rendered frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
Repair the two user-visible semicolons rejected by PR 3241's frontend CI without weakening checks or changing transfer behaviour. Protect the messages with consuming tests and fresh desktop/narrow browser proof.
Contract-Neutral: Copy-only configuration-transfer CI repair. Scope, authority and transfer behaviour are unchanged.
Change-source: pulse-maintainer
**Reproduce partial recovery when guest metadata cannot be imported**
Cover false-success metadata failures, whole-file rollback and restored
absence, plus HTTP failure audit and unchanged runtime controls.
Contract-Neutral: Adds regression controls for the existing
configuration recovery transaction; no runtime, archive format, API or
access contract changes.
**Commit guest metadata with configuration recovery**
Stage guest metadata with the archive's settings and credentials,
publish the live cache only after a successful commit, and serialize it
with pending identity snapshots. Restore newly created targets and an
original moved aside before a failed replacement. Preserve
normalization, scope, archive compatibility and ordinary metadata-writer
ownership.
Contract-Neutral: Repairs the existing all-or-nothing configuration
recovery behaviour; archive formats, API response shape, tenant
authority and normal metadata mutation contracts are unchanged.
**Keep recovery backups and legacy settings inside the import
transaction**
The full preservation controls exposed backup writes outside staging.
Stage node and API-token backups, delay pruning until every section
commits, and include the legacy settings-file update. Preserve normal
non-import save behaviour and successful import backup retention; verify
prior backups and settings survive failed recovery.
Contract-Neutral: Completes failure preservation for the existing
configuration import transaction without changing archive formats, API
response shape, tenant scope or ordinary save and backup-retention
contracts.
---
Fleet candidate `20261025T063939Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `a16f19c370e3d390eec3fd49566528e43221721f` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Bound signed manual-update bootstrap downloads**
Keep both bootstrap requests within curl's connection and whole-request
deadlines, without ambient retry settings. Arm cleanup before allocation
so a second mktemp failure cannot strand the first input. Exercise the
emitted helper's signed success, partial download failures, allocation
failures and signature rejection without native or production execution.
**Keep native recovery proof aligned with bounded manual downloads**
Admit only the manual helper's exact new curl envelope in the existing
closed transport fixture. Require a signed emitted-helper round trip and
reject altered deadlines, retries and TLS flags through the registered
installer suite; do not widen the adapter or execute a native journey.
**Preserve each configuration-backup safety control's deadline**
The containing installer suite exhausted a single 30-second Python-class
budget after eleven controls and killed the last. Use the existing
serial discovery runner with all twelve required methods, retaining each
control's 30-second bound and the existing inner shell bounds rather
than treating cumulative class time as a safety deadline.
---
Fleet candidate `20261025T062429Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`b6618c19a3f2925fff019db2651d885ad1ede9b8` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Read only the selected feedback option rather than bug-like words in
link destinations, titles, prose or withdrawn examples. Preserve all
current dropdown choices, legacy Bug and Regression values, maintainer
classifications and unrelated Community labels. Registered consumer
controls exercise the silent label delta without contact or release
inference.
Contract-Neutral: Silent issue-label metadata only; no product runtime,
frontend, dependency, access or canonical subsystem contract delta.
---
Fleet candidate `20261025T064010Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`41acf9ca6f261bf7355369cad498cff90a1e504d` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The full preservation controls exposed backup writes outside staging. Stage node and API-token backups, delay pruning until every section commits, and include the legacy settings-file update. Preserve normal non-import save behaviour and successful import backup retention; verify prior backups and settings survive failed recovery.
Contract-Neutral: Completes failure preservation for the existing configuration import transaction without changing archive formats, API response shape, tenant scope or ordinary save and backup-retention contracts.
Change-source: pulse-maintainer
Stage guest metadata with the archive's settings and credentials, publish the live cache only after a successful commit, and serialize it with pending identity snapshots. Restore newly created targets and an original moved aside before a failed replacement. Preserve normalization, scope, archive compatibility and ordinary metadata-writer ownership.
Contract-Neutral: Repairs the existing all-or-nothing configuration recovery behaviour; archive formats, API response shape, tenant authority and normal metadata mutation contracts are unchanged.
Change-source: pulse-maintainer
Read only the selected feedback option rather than bug-like words in link destinations, titles, prose or withdrawn examples. Preserve all current dropdown choices, legacy Bug and Regression values, maintainer classifications and unrelated Community labels. Registered consumer controls exercise the silent label delta without contact or release inference.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
The containing installer suite exhausted a single 30-second Python-class budget after eleven controls and killed the last. Use the existing serial discovery runner with all twelve required methods, retaining each control's 30-second bound and the existing inner shell bounds rather than treating cumulative class time as a safety deadline.
Change-source: pulse-maintainer
Cover false-success metadata failures, whole-file rollback and restored absence, plus HTTP failure audit and unchanged runtime controls.
Contract-Neutral: Adds regression controls for the existing configuration recovery transaction; no runtime, archive format, API or access contract changes.
Change-source: pulse-maintainer
Admit only the manual helper's exact new curl envelope in the existing closed transport fixture. Require a signed emitted-helper round trip and reject altered deadlines, retries and TLS flags through the registered installer suite; do not widen the adapter or execute a native journey.
Change-source: pulse-maintainer
Insert the two transfer files into the existing case-insensitive sorted ownership list so the real registry audit accepts the candidate. Membership, path policies, proof requirements and frontend content are unchanged.
Change-source: pulse-maintainer
Keep both bootstrap requests within curl's connection and whole-request deadlines, without ambient retry settings. Arm cleanup before allocation so a second mktemp failure cannot strand the first input. Exercise the emitted helper's signed success, partial download failures, allocation failures and signature rejection without native or production execution.
Change-source: pulse-maintainer
Use the concrete timeout function for the Vitest spy so callback arguments retain their types under strict type checking.
Change-source: pulse-maintainer
pulse-triage[bot]