## What changes and why
- Keep backup-age checks fast and make failed or partial evaluations
visible through one existing system warning, without clearing retained
age alerts. Indexed latest-observation reads preserve retention, schema
and the read budget. This responds to the recurring missed checks
reported in #2465; synthetic timing is not proof of relief on the
reporter's Pi.
- Defer guest-agent commands after uncertain HTTP results and require
same-target, unambiguous backup-lock evidence before guest reads. Keep
guest coverage truthful when only remembered versions or a parent-node
assignment exist. Preserve the original observation time/source of
retained memory through existing backend projections. These changes
advance #2439 safety, but do not establish native thaw or recovery.
- Attribute Proxmox backups using native connection/node and unique PBS
namespace evidence, retaining ambiguous artifacts rather than assigning
them by substring or display name. Show unreliable PBS capacity as
Unknown/Unavailable, while retaining valid measured zero and readable
phone warnings.
- Restore existing TrueNAS and VMware connection alerts using the
constructed runtime pollers. This does not resolve the distinct
monitoring cause reported in #2382.
- Keep safe report collection and attachment guidance self-contained,
and make manual backup pause/resumption precautions usable. Repair the
Diagnostics integration journey's outdated controls, download assertions
and session capability, without changing production authorization.
## Included source
Published base `61146105c74a5968d877691e02963c41f8e66076` → exact final
head `af73b0e6c618da83c4fc5e702ba464257481851c`.
The previous proposal head `dcde1d0157d5e3c4cd626d6b920a45016a3f0437`
and all reviewed ancestry remain unchanged. This advances the proposal
once after its workflows completed with demonstrated failures; it does
not interrupt a checking head.
Reviewed candidates include:
- Previous batch: guest HTTP `cd1e3ba12f`, runtime alerts `7f5c8a0cf1`,
safe intake `496ba1e73e`, PBS capacity/render sequence `8f09a59996`
through `d2f7e456b3a`.
- Manual pause `3fd44b8325`; native backup ownership `c5e83ceb3a` /
`6198a3ce22`; authoritative locks `b77e6908e6`; truthful guest coverage
`ba3e2d2c1c` / `8f9a9a6a1e` / `f9f53befbb`.
- Backup evaluation/query `5774b6bc4b` / `7a19a06631`; Diagnostics
sequence `ed168c8d7e` through `a3bbcae0c9`; memory provenance
`abee023634` through `80d8ad0f59`; self-contained intake `7c9922f55d`.
- Starting reviewed canonical tip
`8003a4037bf2e6628d47ca6c7da239a11096168e` is retained. Four additive
publication corrections (`745ddc982a` through `79091f7b03`) supply the
report-form contract, connected docsLinks regression and exact
historical completion pair. The first completion's section placement
failed the checker; its substantive-section correction passes. No
accepted commit was amended or recreated.
## Validation and remaining gates
The previous proposal's completed runs remain adverse: Build/Test
`37204956836` failed the documentation drift assertion; E2E
`37204956824` failed Diagnostics shards 3/6/8 (download/obsolete
Run-control timeouts). These warrant the admitted changed-source
repairs, not an unchanged retry.
Retained reviewed evidence includes guest transport/connected/race/build
(`source-5_ta7via`), runtime alert connected proof (`source-s0xmdftf`),
PBS source/render evidence (`source-_9ekxhcy`), manual-pause
source/render (`source-ifgmfzhw`), all-reader authoritative-lock proof
(`source-41amnzmb`), guest coverage's 1,901 connected tests/full
types/lint/build and inspected Chromium/WebKit desktop/phone renders
(`source-3y6kfagt`), backup recovery/alerts/monitoring/races/vet/real
builds (`source-vc1jlsz9`), and memory
models/unified-resource/alerts/monitoring/races/vet/types/real
embed/build (`source-5swnugj9`). Diagnostics retains nine passing
full-app journeys with matching source hashes; catalogue
`source-cyehgbio` discovers 916 test/project identities, including all
nine Diagnostics cases, but is not runtime acceptance. Intake
`source-stznewur` retains two intended parent failures and passing
policy/documentation/mirror checks.
Publication checks: provenance, clean retained ancestry, per-commit
canonical completion/history, registry/contract audits and final
browser-content coverage (nine changed production frontend files) pass.
Earlier proposal-head (`79091f7b`) offline VM proof `source-1fn6chab`
passes 36 docsLinks tests, formatting, 27 intake cases, 211 public
Markdown checks and 62 mirrors, with complete hash-matched output and
guest stop. Its line-index bound is explicit. Earlier `source-yj300mm2`
passed docsLinks but exited 1 when a browser script was mistakenly
invoked in a source VM without Playwright; no browser result is claimed
from that attempt. Earlier local preparation failures and prior
API/embed limitation remain evidence at their own bindings, not green
aggregate results.
Required exact-head CI must run the complete backend/build/frontend,
audit and protected E2E checks, with independent source review, before
landing. Existing sufficient connected/render proof was not repeated
solely for batching. This is source publication, not release
qualification, deployment, native appliance/guest acceptance or
completion of the linked reports. The containing all-main release, Pi
evaluation/failure/recovery, native backup/thaw/covered writes/liveness,
remaining memory drawer consumption and installed whole-panel/alert
results remain separate.
Related to #2465
Related to #2439
Related to #2382
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Completed workflow reconciliation and additive smoke repair
The starting proposal head `79091f7b0317807fcc76e36cde52c4ee1cc4c928`
and every reviewed commit remain ancestors of this head. Build/Test
`37219920651` has now completed. All backend partitions, frontend,
governance, security and all eight E2E shards/verdict passed, but script
smoke failed two obsolete whole-guide assertions in
`test_vm_disk_diagnostics.py`; backend build was consequently skipped.
The reviewed manual backup precaution deliberately adds six server/timer
examples. The old passive-helper test counted all seven guide examples
and banned `systemctl` throughout the whole guide. This source mismatch
warrants changed-source repair, not an unchanged retry. Additive
test-only `c4a72995c6bf2465a6540a1b546a9dcd732944af` scopes
passive-helper execution to its named section and admits only the exact
six reviewed manual-pause blocks. Its first local run retained one
failure because a shell comment was mistaken for a heading. Additive
`af73b0e6c618da83c4fc5e702ba464257481851c` parses headings only outside
fenced blocks. All 17 diagnostics/safety controls now pass, including
missing/duplicate headings, shell comments and five prohibited-command
mutations. The passive helper still rejects active guest requests and
service mutations. Production and guidance bytes remain unchanged;
mirrored docs and connected intake checks pass. Both failed
correction/control observations remain recorded, not relabelled.
Final publication provenance, clean retained ancestry, additive
contract/registry audits and the unchanged nine-production-file
browser-content coverage pass. Lightweight confined fixture proof
supplies the full 17-case suite; existing heavy/render proof was not
repeated for this test-only delta. This proposal advances only after the
previous head's workflows completed. Exact new-head CI must rerun its
required checks before landing.
The completed advisory benchmark job is also adverse:
`RefreshPlatformScopes` 294.1 → 325.0 ns (+10.51%) and
`ClassifyResourceSensitivity` 67.68 → 77.20 ns (+14.07%), each p=0.000
with ten samples. Their implementation and benchmark source are
unchanged across the batch; that does not prove noise, intentional cost
or lack of regression. Delivery owns a bounded evidence-based
disposition through the existing lane handoff. No favourable repeat,
threshold change or performance/release approval is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned release/v6.5 line;
- main lacked the published 6.4.4 to 6.4.6 packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named
highlights, issue numbers, one release's mobile decision) and the
per-release sentences in the deployment-installability contract,
which changes several times a day on main.
Map 6.5 to main, carry the published packets over from release/v6.4,
and keep the packet tests to what the release tooling generates: version
pins, packet pointers, required sections and the rollback, signing and
mobile sentences.
Contract-Neutral: Release routing and release-packet test scope only; no runtime, install or public contract changes.
Use the exact additive completion that satisfies the unchanged canonical checker. Retain the earlier failed completion and every reviewed commit as history.
Change-source: pulse-maintainer
Register the exact historical completion pair for governance CI; preserve the intermediate repair and all later accepted source unchanged. Completion checks still require ancestry, substantive contract text and registry-accepted proof.
Change-source: pulse-maintainer
Keep the inherited report-form commit untouched and bind its additive completion to the tree with the actual optional attachment field IDs. The existing real guard still requires the contract and executable verification together; no release or runtime acceptance is asserted.
Change-source: pulse-maintainer
The first exact-source suite reached an erroneous common evidence-field assumption: the bug form uses logs while the prerelease form uses evidence. Verify both real identities and their shared label without changing either form, requiring new diagnostics or weakening the optional-evidence assertion. Retain the original failed proof.
Change-source: pulse-maintainer
Use the existing exact-commit completion registry and exercise its real guard, ancestry and substantive verification requirements. Preserve the original documentation-link commit and the final self-contained forms; no history is rewritten and no completion or release check is weakened.
Change-source: pulse-maintainer
Record self-contained collection and privacy safeguards for installed releases and parse both forms to protect their actual inline advice. This additively supplies the missing deployment-installability contract and accepted verification for the retained documentation-link correction without rewriting reviewed history or changing any runtime safeguard.
Change-source: pulse-maintainer
Merge exact Delivery candidate c5bd6f1d99. Resolve the overlapping test-only repair by retaining the union of existing and candidate read-only admission and billing-write prohibitions. No runtime or frontend changes.
Contract-Neutral: Test-only integration preserves production behaviour and release authority.
Change-source: pulse-maintainer
PR2429 governance run 37161775883 still required the superseded entitlement rewrite after reviewed repair 7d739698 made profile admission read-only. Require the existing demo capability and reject the former integrity removal and billing rewrite instead. Retain runtime-setting, release and recovery guards unchanged.
Contract-Neutral: Test-only integration reconciliation; production billing and release admission are unchanged.
Change-source: pulse-maintainer
PR2429 governance run 37161775883 still requires the removed demo entitlement rewrite and integrity clearing. Require the existing read-only capability gate instead, and reject billing writes or integrity removal. Keep all runtime profile, protected publication and exact-RC controls.
Contract-Neutral: Test-only alignment with the reviewed billing-preserving demo transaction; no runtime, API, deployment authority or release policy delta.
Change-source: pulse-maintainer
Retain reviewed local source and upstream governance exactly. Resolve the retired shared receipt in favour of deletion; historical non-merge receipts remain available in Git.
Contract-Neutral: Integration only; no changed frontend runtime content or product contract.
Change-source: pulse-maintainer
Correct the empty-heading control and retain current signed-archive selection and loss-aware rollback terminal checks. Reviewed runtime commits a2fc29b70b and 227657b1b0 replaced the old installer and unconditional receipt writes; this changes no runtime or release gates.
Contract-Neutral: Test-only alignment with already-reviewed release signing and recovery contracts; no runtime, policy, qualification requirement or public content changes.
Change-source: pulse-maintainer
Align Python preparation with the existing Go reader-facing contract. Accept authored titles with or without the legacy suffix, require exact first-heading identity, and reject malformed headings even when prose repeats the version.
Contract-Neutral: Test-only alignment with the existing release-note identity contract; no runtime, policy, packet, qualification requirement or public content changes.
Change-source: pulse-maintainer
The per-commit receipt change left
frontend-modern/browser-verification.json in the tree, frozen, so that
it would not conflict with the pull requests still rewriting it. Nothing
reads the file at the tip: range mode reads a receipt from the commit
that recorded it. Left in place it invites the old habit and keeps those
pull requests conflicting with each other on it.
The guard now refuses a staged tree or a range tip that carries the
file, rather than only a commit that writes it. Without that, resolving
the modify/delete conflict by keeping the file changes nothing against
HEAD, passes the hook, and restores the file on main when the branch
merges.
A pull request that still rewrites the file is repaired by merging main
and removing the file with git rm. Its commits remain valid evidence in
range mode.
Every commit touching user-visible frontend source rewrote the single
frontend-modern/browser-verification.json, so any two open frontend pull
requests conflicted as soon as either merged. A merge could not repair
the loser: concluding it staged main's frontend files as if the author
had changed them, and the guard then demanded a receipt for files the
author never ran. The only honest recovery was a rebuild on the new main
and a fresh browser pass, as #2415 -> #2418 -> #2433 showed on 2-3
October.
Each commit now adds its own receipt under
frontend-modern/browser-verification/, named by the fingerprint of the
content it verified. Receipts are only ever added, so git merges them
unaided. The guard keeps every binding it had: the commit's own parent,
the exact changed paths and their content digests, a desktop and a
narrow viewport, non-empty routes, states and interactions, and the
range check that each changed file's final content matches a receipt
from a non-merge commit in the range.
Concluding a merge no longer counts content a merged parent already
carries as the commit's own change. Merged content that neither parent
holds is flagged and still needs a follow-up receipt in range mode, and
a merge commit may not record one.
The shared file is retired: no commit may write it again. A commit that
modified it while its own parent still carried it stays valid evidence
in range mode, so a pull request that still rewrites it is repaired by
merging main and taking main's copy rather than by a rebuild. The file
is deleted in a change of its own, because deleting it here would
conflict with every pull request that still rewrites it.
--write-template writes the skeleton at the path the staged content
requires. --prune deletes receipts already on main. A change that
records a receipt may not delete one: git pairs the two as a rename,
which conflicts with any other change deleting the same receipt.
Candidate preflight rejected three path lists that used ASCII or insertion order instead of the registry's case-insensitive order. Sort only those lists and exercise the committed registry in the audit suite so fixture-only passes cannot miss the same mistake.
Contract-Neutral: Canonical registry path-list ordering and regression coverage only; ownership, verification requirements and runtime behaviour are unchanged.
Change-source: pulse-maintainer
The broader release-policy check still expected the removed shell configuration step. Assert its real transaction entry and runtime profile/entitlement preservation while keeping activation, exact stable tag, network and public browser checks unchanged.
Contract-Neutral: Align verification with the already implemented demo transaction; no runtime or authority change.
Change-source: pulse-maintainer
Exercise actual systemd and Caddy with a changed executable, distinct persistent data, delayed synthetic failure, observer loss and TERM during full rollback. Keep 300-second clocks, exact-source and cleanup receipts; no production credential or worker system privilege is added. Update the connected recovery contract and policy assertions, and retain bounded service identity observations.
Change-source: pulse-maintainer
Assert the existing file-level verification receipt so the new routing control exercises real ownership instead of assuming an unavailable summary field.
Contract-Neutral: Test-only assertion of existing subsystem lookup output; no runtime or authority change.
Change-source: pulse-maintainer
Keep new source paths on their own connected proof policy after the full lookup suite exposed six broadened metadata expectations. Preserve terminal no-op cancellation evidence and the runtime file owner.
Contract-Neutral: Correct connected observation and verification routing within the existing demo operations and authority.
Change-source: pulse-maintainer
Convergence used main's unmapped fallback and rejected the immutable 6.4.6-rc.1 source. Retain its exact-version release/v6.4 policy for artifact convergence and promotion without mapping future patches or accepting unrelated source.
Change-source: pulse-maintainer
Governance run 37016171545 rejected the original malformed timestamp even though a later reviewed receipt corrected it for identical runtime bytes. Use the existing fail-closed integration-range guard in CI while retaining per-commit canonical checks. Exercise the workflow shell with valid additive correction and invalid missing-base or unverified-content fixtures.
Change-source: pulse-maintainer
Exact closure validation also identified eleven uncovered package roots pulled into the install-test binary. Bind their Go/template inputs without changing runtime or relaxing the attestation assertions.
Contract-Neutral: Additive source-manifest coverage only; no runtime or subsystem contract change.
Change-source: pulse-maintainer
Include the four current install-test inputs omitted from the rootful source manifest and report exact missing paths on future drift. Product and qualification assertions are unchanged.
Contract-Neutral: Additive qualification source closure and diagnostic-only assertion message; no runtime or subsystem contract change.
Change-source: pulse-maintainer
First step of the release simplification plan. create-release.yml loses
candidate_qualification and release_readiness, which only restated other
jobs' results. Their exact predicates move into publish_release_tag,
publish_docker, publish_helm_chart, activate_release and
release_commit_verdict, with cancellation unchanged.
recover-release-activation accepts both run shapes, so v6.4.6 and older
runs recover exactly as before. Failure-only diagnostics and the chart
artifact nobody downloads keep 3 days instead of 14 or 90. Only lines
cut from main after this land use it (release/v6.6 from 7 Oct). Reviewed
with gpt-6.1-sol, SAFE TO MERGE; predicate equivalence sampled over
2,784 cases.
Completed PR #2379 governance run 36949586647 reached a later subsystem lookup assertion that also omitted the reviewed startup test. Preserve registry coverage and update the remaining stale expectation additively; no runtime or permission change.
Change-source: pulse-maintainer
The first correction exposed the later monitoring-specific assertion in the same test. Align that exact list too, without changing policy or coverage. All 132 governance fixture tests now pass under the confined native-Git fixture executor.
Change-source: pulse-maintainer
PR #2379 governance run 36940673378 failed two exact verification-file assertions after the reviewed startup test was added to the registry. Retain the declared coverage and update both fixture expectations; runtime and accepted commit identities remain unchanged.
Change-source: pulse-maintainer
candidate_qualification and release_readiness only restated other jobs'
results. publish_release_tag, publish_docker, publish_helm_chart and
activate_release now each carry the exact candidate predicate in their own
needs and if, guarded by !cancelled() with the same allowed integration
skip, and activation joins the tag and both registry publications directly.
The commit verdict restates every candidate result in place of the
readiness join.
recover-release-activation.yml accepts both shapes. A source run that has
release_readiness still has to prove only that join, as before. A run
without it has to prove publish_release_tag and at least one, and only
successful, jobs under the publish_docker and publish_helm_chart caller IDs.
Failure diagnostics and the inspection-only Helm chart artifact, which
nothing downloads, are kept for three days instead of 14 and 90.
Exact-source validation found two unbound compiled packages after composing the retained notes repair with current main. Include both in the source manifest and report the whole dependency closure without weakening the check.
Change-source: pulse-maintainer
Bind the new compiled notes helper and authored fixture in the rootful source manifest. Repair the visual rollback fixture's missing version and align the internal control-plane page with the active release-reliability target, without changing source routing or published packets.
Change-source: pulse-maintainer
Bind stable notes to version and operator disclosures rather than obsolete prose. Support bounded grouped customer sections for v6.4.6 and later, align generation and rendering, and preserve published history and all qualification gates.
Change-source: pulse-maintainer
The first exact offline suite passed the metadata cases but the clean-tree assertion saw Python import bytecode because the fixture omitted the real .gitignore. Copy that existing policy into the fixture, retaining the source/no-mutation assertion.
Contract-Neutral: Fixture setup now copies the existing repository ignore policy; runtime and deployment contracts are unchanged.
Change-source: pulse-maintainer
The exact no-mutation watchdog failed at published 6.4.5 because the release line has pending repairs but still declares its stable VERSION. Observe that governed source and its preceding stable reference without inventing a new promotion, while keeping candidate resolver gates unchanged and watchdog artifacts out of promotion-readiness records.
Change-source: pulse-maintainer
Replace two stale schema assertions with explicit watchdog omission and ordinary candidate rollback requirements. The actual workflow admission/source-selection shell tests preserve the fail-closed distinction.
Contract-Neutral: Tests and explanatory comments reflect the already recorded watchdog admission contract; no further runtime contract change.
Change-source: pulse-maintainer
Retain the scheduled governed-source selection and no-mutation demo verdict in a separate fixed dispatch mode. Check its control SHA and candidate-free envelope before checkout, preserve ordinary rehearsal rollback and exact event-source guards, and skip candidate builds.
Change-source: pulse-maintainer
Keep the existing signed installer fallback and require nearby Pulse helper ownership for every install and rollback example, including authored bullets. A distant community-scripts warning must not make an unsafe command publishable.
Change-source: pulse-maintainer
The feedback form forced screenshots into shell code fences and conflated a running container image with a non-container release asset. Preserve rendered attachments, ask for the Pulse image only on running containers, and keep failed-install evidence truthful.
Contract-Neutral: Community issue intake only; release and installation contracts unchanged.
Change-source: pulse-maintainer
The bug and v6 pre-release forms previously required reproduction steps even when a retry could cause a host outage, duplicate update, alert storm or data loss. Ask for the original sequence and safe evidence instead, and mirror the guidance in the public triage document.
Contract-Neutral: Community intake wording only; release and installation contracts unchanged.
Change-source: pulse-maintainer
The maintainer coordinator integrates reviewed candidates by merge onto a
main that keeps moving, then ran this guard once over before..after with
--commit after. That demands one tip receipt whose base_sha is the tip's
parent and whose paths and digests cover the whole cumulative delta. The
tip is a merge and the range carries the candidate plus upstream work that
was verified on its own, so no lane could ever produce that receipt. 13 of
13 coordinator browser-guard rollbacks since 28 September failed on
base_sha for this reason.
Add --base <range-base> for range mode. Every changed user-visible
frontend file's content at the tip must equal a digest recorded by a valid
receipt in a non-merge commit inside the range, and each receipt is
validated as the per-commit guard validates it at its own commit, bound to
that commit's parent and tree. Merge-authored receipts are never evidence,
so a conflict resolution or a later correction that changes frontend
source still needs fresh proof for the final content. Replaying the three
rolled-back 29 September batches from the host passes, and the existing
per-commit and staged modes are unchanged.
The resolver refused a stable promotion until its candidate had soaked for
72 hours, or 168 for a minor. Few installs run previews: 35 of about 7,900
active installs ran v6.4.5-rc.3 in the week to 2026-09-28, so a longer
soak saw little the first day did not, while 75 percent of installs sat on
a stable build a month old. Richard set a 24 hour soak for every release
on 2026-09-28.
The minimums drop to 24 hours for minor and patch alike, the error text
reads the constants instead of repeating numbers, and the workflow and
trigger prompts, the promotion policy and the deployment contract say the
same. The content-drift check and the hotfix exception are unchanged.
The release-promotion guard still expected the old installer-link wording,
so it rejected the corrected helper-ownership and version-pinning guidance.
Separate the installer safety assertions from support-pack coverage and
check the signed fallback, rollback applicability and version verification.
Rejected active-alert writes still reached history, firing events and
notification dispatch. Make admission explicit across detector and restore
paths so repeated suppressed observations cannot create those side effects.
Reconcile restored alerts when persisted resource policy attaches at startup,
reconcile again after native aliases become canonical, and refresh shared
state before those alerts reach clients.
Preserve occurrence identity when retained alerts re-fire, including durable
history reconstruction and delayed lifecycle replay.
Keep retained table and card components mounted when scrolling shifts the
visible window, so policy editors do not lose unsaved state. Show actual
future maintenance times and the paused-attention effect.
Keep synthetic host machine identities stable across restarts so saved
operator policy remains attached during verification.
Qualify server update and rollback instructions by helper ownership, and
stop signed installer recipes before execution if a download or signature
check fails.
Refs #2237
Every stable cut re-pins CANONICAL_DEFAULT_PULSE_VERSION in
scripts/install-docker.sh from the RC to the stable version, and the
stable install-metadata test requires it. The drift allowlist omitted
that file, so no release candidate could be promoted without
hotfix_exception. The rule arrived on 2026-09-01, after v6.4.1, so no
stable promotion has run under it yet. v6.4.5 would be the first to fail.
The installer is shipped content, so the resolver accepts it only when
its diff against the candidate changes nothing but that pin line. Any
other installer change still counts as drift.
Go _test.go files are never compiled into a shipped artifact. A stable
cut can need test-only corrections, as v6.4.5 needs for the RC-derived
install-metadata contract, so they no longer count as unsoaked content.
Tests cover the allowed shapes, the refused near misses, and the pin
check against a real git diff.
Register 8b56fc72e4 with its contract-completion commit so canonical governance evaluates the reviewed Proxmox LXC linked-agent memory runtime change and its monitoring and unified-resources contract sections as one historical unit.
Change-source: pulse-maintainer
The secure-runtime RC qualification workflow (commit 79d87a4a2c) resolves the branch the control plane maps the version to and passes it as --main-ref, but secure_runtime_attestation_v6.verify_canonical_main_identity still required origin/main and required the candidate to be an ancestor of origin/main. Every release-train candidate therefore failed the pre-authentication step before any check ran; v6.4.5-rc.1 failed at 'Pre-authenticate exact qualification packet' with 'committed-main classification requires canonical origin/main' (run 35680955017), and all three historical runs failed.
Accept exactly origin/main or the release train's origin/release/vX.Y, verify the ref against the canonical origin's live branch tip, and check candidate ancestry against that same ref. The release-candidate classification is unchanged. Update the deployment-installability contract and the v6 unit tests, including a mapped-release-branch acceptance case.
Change-source: pulse-maintainer
pulse-triage[bot]