Keep unattended update containment separate from cancellation, host-stop diagnosis and rollback. Preserve known timer ownership, masks, consent, prior enabled and active states, and the original failure evidence; exercise copied commands with an isolated unit-manager double and a real timeout.
Contract-Neutral: Documentation and confined recipe controls only; no installer, updater, service or recovery runtime behaviour changed.
Change-source: pulse-maintainer
pulse-triage[bot]