The private-response helper promises one request, but real curl expands quoted brace lists and bracket ranges into two or three requests, including POST, PUT and DELETE. Disable URL globbing without changing token-file transport, response privacy, scopes, TLS, deadlines or no-retry rules. Explain the literal-path and separate URL-encoding boundary.
Exercise the copied helper with both authentication headers, every supported method, encoded identifiers and adverse write responses. Add consuming desktop and narrow Docs/router verification.
Contract-Neutral: Documentation and synthetic recipe/browser checks only; API authentication, endpoint and runtime contracts are unchanged.
Change-source: pulse-maintainer
The copied loopback recipe inherits http_proxy and ALL_PROXY even with curl --disable. Real-curl parent controls sent the synthetic administrator-capable header to the proxy and could report its denial as a Pulse role result. Explicitly bypass proxies for the selected backend and keep the protocol boundary clear.
Exercise both response directions and three proxy environment selectors, preserving privacy, deadlines, cleanup and the existing role/IdP trust boundary. Add a repeatable production Docs/browser check for the exact copied guide.
Contract-Neutral: Documentation and synthetic recipe/browser checks only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
The exact-source broader audit suite exposed ENOEXEC differences in the direct Python exec path. Retain the former Bash executable-script fallback with a fixed exec program and literal argv, including whitespace and shell metacharacters in the executable path. Isolate the two path-lookalike fixtures so each still asserts its own one-commit guard result.
Contract-Neutral: Restore the existing Bash command compatibility within the new audit process group; audit classification, retry rules, dependency graphs, command arguments and external authority are unchanged.
Change-source: pulse-maintainer
Both required CI and the local gate must treat the new subprocess owner as audit runtime, not an unchanged dependency graph. Carry the actual helper into the isolated local-gate fixture and test positive findings, missing results, large change lists and exact-path lookalikes through both consumers.
Contract-Neutral: Extend the existing strict audit-runtime path classification to its new owned helper; advisory rules, dependency graphs, public runtime, credentials and external permissions are unchanged.
Change-source: pulse-maintainer
The existing helper leaves TERM-resistant children running after npm finishes or its attempt expires. Give each attempt its own process group and monotonic deadline, stop the owned group on every terminal path, and preserve the captured report and observed exit. An npm TERM handler returning zero cannot turn an expired attempt into a clean verdict. Exercise normal completion, failure, timeout, cancellation, positive findings and an unrelated live process through the actual shell helper.
Contract-Neutral: Repair the existing audit deadline and child ownership only; invocation arguments, manifests, strict and unchanged-graph advisory verdicts, retry budgets and external access remain unchanged.
Change-source: pulse-maintainer
Final whole-package proof retained a SCALE caller failure and showed its missing nas_agent_removal_platform definition. Extract the real platform reader through the existing redirected vendor paths and require an ordinary-Linux negative scope read without command-not-found noise. Preserve all sixteen task/process/manager controls and production refusal deadlines; this closure repair does not diagnose the observed service-quiescence failure.
Contract-Neutral: Complete test fixture namespace and negative-scope assertion only; no production installer, service, removal, credential or timeout delta.
Change-source: pulse-maintainer
The full package proof ran all nineteen NAS methods successfully but its Go caller still required the old eighteen-test count. Require the new named control as well as the nineteen-test OK verdict; keep every original case and fail-closed wrapper. The original failed full run remains recorded and the corrected containing source is revalidated.
Contract-Neutral: Test verdict accounting only; no installer, removal, credential, timeout or native acceptance contract change.
Change-source: pulse-maintainer
The new macOS native jobs fail NAS boot-filter positive controls and never recognise the generated private collector. Supply binary-aware GNU awk only to the existing Linux server fixtures and retain real safe/NUL/control-byte probes plus missing/non-GNU-tool refusals. Recognise both Unix comm formats while keeping the exact owned executable argument and cleanup controls. No installer or service source, skipped test or native-appliance acceptance changes.
Contract-Neutral: CI prerequisites and test fixtures only; production install, removal, credential retention and process-owner safety contracts are unchanged.
Change-source: pulse-maintainer
The containing install-metadata gate requires the existing companion-release disclosure. Retain it alongside, not instead of, the approved retirement notice; do not relax the gate or change the served runtime. Preserve the failed first proof and verify the final notes and actual producer.
Contract-Neutral: Notes-only compatibility disclosure and its assertion; no runtime, protocol, release identity, asset, maturity, latest pointer or cadence change.
Change-source: pulse-maintainer
Use the stable-based source comparison rather than a contradictory immutable changelog introduction. Preserve the reviewed bounded monitoring outcomes and the explicit guest-safety limitation, and include the approved Mobile retirement notice in the existing beta correction. Regression assertions bind the exact notice and comparison without changing release identity, assets or cadence.
Contract-Neutral: Published-note maintenance and its regression assertions only; no runtime, protocol, release identity, assets, maturity, latest pointer or cadence change.
Change-source: pulse-maintainer
Governance now reports explicit completion, residuals, evidence and
ownership availability. It no longer computes lane grades, completion
percentages or weighted candidate priority. Release qualification,
security assertions and lease boundaries stay enforced.
The frontend contract also drops obsolete Discovery surface catalogs and
preserves the live Assistant handoff and execution contracts.
Validation: 93 focused Python tests, repository-control Go tests, and
control-plane, status, registry and contract audits. Full delivery hooks
passed, including 164 helper tests and frontend audits after integration
with current main.
The first beta's page listed no changes, and the full changelog file is
neither attached to nor linked from any release page, so a reader could
not look up a change the summary did not name. Add a pointer, advisory
and additive.
The renderer appends a "## Source comparison" section after Roll back: a
link to GitHub's comparison of the release tag with the stable rollback
target the workflow already passes (--rollback-target and --candidate-tag).
It is a pointer, not a list. GitHub shows at most 250 commits in a
comparison and this beta had 328 changes, so the section says larger
comparisons may omit commits and is not called a full list.
It never fails a release on its own. The helper renders nothing, and
raises nothing, for a missing or malformed tag, a base that is not a
lower stable release, a trailing newline, non-ASCII digits, or numbers
too large to convert. Bodies without the section, including every
earlier release and any frozen in-flight one, keep validating, because
the validator already permits a trailing section and is unchanged. The
post-update changelog dialog reads only recognised category headings, so
a separate heading after Roll back is ignored by it.
Every consumer of the rendered body was audited (the renderer's
validators, create-release, validate-release-assets,
recover-release-activation, the updater backend, the what's-new model and
the Go and TypeScript tests): no regression. Review of the first draft
found a crash on a 5000-digit tag, a newline that would land inside the
URL, and overclaiming contract text; all fixed and pinned by tests that
fail against the first draft. A tags/ prefix would avoid a branch that
shares a tag's name, but GitHub's web comparison URL returned 404 for it
on existing tags, so bare refs are used and the limit is recorded.
Tests run the real renderer on the v6.5.0 notes: placement after Roll
back, exact spacing, numeric ordering, ten edit and annotation cycles
with CRLF and the extra jq newline, expected-body rejection of a changed
or deleted section, and absence still validating. They fail against the
original renderer. Making the section required, and a generated
row-level inventory that proves completeness, need a declarative contract
record in the preparation snapshot and are deliberately deferred; the
contract explains why.
Contract-Neutral: Adds an advisory link to rendered release pages; no published artifact, tag, signing, install or customer contract changes.
Preserve current Patrol setup and provider connection behavior alongside
the explicit governance completion and evidence contract. Inherited
application states retain their qualified main content.
Retain every reviewed starting commit and the refreshed exact published workload identity source additively. PR2888 remains unchanged pending its completed qualification defects; this unproposed composition requires exact final-source checks before the later publication batch.
Change-source: pulse-maintainer
A Proxmox node move changed the workload row key, reset an open drawer’s
History view and could publish new coordinates before saved guest
metadata migrated. Rows now use the stable unified resource ID,
bookmarks resolve through the registry, and the selected resource owns
its drawer tab and History range across regrouping.
Accepted publication migrates metadata before exposing the new node. A
failed write retains operator fields in memory and the last successful
disk snapshot, with recovery through the existing writer. Native
metadata and History coordinates remain separate from row identity.
Backend metrics targets take precedence over the legacy native fallback.
Route focus owns initial positioning. Viewport initialization measures
the selected row without replacing its reveal window. Local row clicks
retain their scroll position, while later scroll and resize events
follow the viewport. Operator policy, Assistant, all four Patrol modes
and paid entitlements are preserved.
The proof registry owns the focused publication and writer tests. Its
guard verifies acceptance and rejection without duplicating the catalog.
Canonical and browser guards share exact Git inheritance reads, so
updating a branch retains parent qualification for unchanged content.
New resolutions and mode changes still need current proof, and range
checks qualify the complete proposed change.
Validation:
- Regression controls reproduce publication ordering and persistence
failures. Targeted backend and race tests pass.
- Final repair checks pass: 476 tests across 15 frontend files,
type-check, production frontend build and embedded build.
- Current-source browser checks on /proxmox/overview at 1280x800,
900x800 and 390x844 cover VM and LXC, canonical and legacy links, node
regrouping, native and explicit History targets, saved links, reload,
keyboard selection, Collapse, Escape and search reselection.
- Additional desktop and phone checks cover operator policy persistence,
metadata write failure, delayed lookup cancellation and refused
references. The final browser matrix passes 196 checks.
- Merge-qualification regression reproduces inherited additions, renames
and deletions being misclassified. All 216 focused guard tests pass,
including retained mode changes, new resolutions and ordinary commits.
Browser node movement uses controlled resource updates. Publication and
metadata ordering are verified independently with filesystem barriers
and failure injection.
Refs #1669
The script-smoke fixture includes the shared repository I/O dependency.
All 23 prepush fixture tests pass.
Preserve the starting reviewed e5c1f39636 and current published Patrol setup/provider guidance additively. Existing PR2888 remains unchanged while its completed qualification defects return to their owner.
Change-source: pulse-maintainer
The complete installer suite exposed a stale assertion requiring a beta.1 comparison after the reviewed changelog correctly named its actual v6.5.0 base. Keep the existing packet, signing, installer, rollback and compatibility checks, and require both the truthful stable-based introduction and matching changelog heading.
Contract-Neutral: Test-only correction for the unchanged, already-recorded beta.2 changelog range; no release or runtime contract changes.
Change-source: pulse-maintainer
Numeric lane grades and weighted candidate rankings duplicate model
judgment without adding a qualification invariant. Keep explicit completion,
residuals, evidence, assertions and ownership availability as the current
state contract. Remove duplicated prose catalogs and stale retired-surface
obligations while retaining their canonical owners.
The browser gate now uses the shared repository I/O module. Exercise its
real dependency in the prepush fixture so smoke tests reach qualification
checks instead of failing during import.
Contract-Neutral: Test fixture dependency only, no application or contract behavior changes.
Bind removal guidance to checked NAS quiescence and boot retirement instead of retired installation markers. Model DSM hard-link semantics through real exclusive link syscalls so macOS contract jobs no longer depend on GNU ln, retaining raced-directory adverse controls and every existing manager/recovery assertion.
Contract-Neutral: Tests only; production removal, documentation and teardown contracts are unchanged.
Change-source: pulse-maintainer
Keep the current clock and stored-History readout alongside canonical row
selection and resource-owned drawer state.
Use one Git inheritance reader for browser and canonical qualification.
Inherited modes and objects keep their parent proof, while new resolutions
and mode changes remain subject to current contract and proof requirements.
Range checks still qualify the complete proposed change.
Refs #1669
18 of 60 paid installs on the current telemetry schema have no AI
provider. Getting Patrol running meant three pages: turn on Pulse
Intelligence, pick one of 14 providers and paste a key, choose a model
from a raw list, then find Check Patrol model on another page.
When Patrol is blocked because no provider is connected, Pulse
Intelligence is off, or the provider refused the saved key, the setup
card now connects a provider in place. It covers a cloud API key
(Anthropic, OpenAI, Gemini, DeepSeek, OpenRouter) or Ollama, names the
model Pulse will use from the Patrol guidance table, prices it before
anything is saved, then saves it, runs the provider test and the Patrol
model check, and offers the first run. A per-token model on the
untouched 6-hour schedule gets the same slower schedule Patrol settings
would propose. Everything else stays on Provider & Models.
The panel stays mounted once started, because polling flips the
readiness cause mid-setup and would otherwise remove the verdict. A
refused key (provider_auth) now routes to Provider & Models instead of
the model check, which could not fix it.
Replace generic fallback notes with source-bound customer changes, preserve signed installer and rollback advice, and correct the canonical cumulative changelog range. Cover meaningful notes, source range and safe rendering with regression checks. This is a notes-only candidate, not a live release edit.
Contract-Neutral: Customer notes, changelog introduction and note-content regression tests only; no runtime, source tag, version, asset, maturity, latest-release or release-cadence change.
Change-source: pulse-maintainer
Rebind its old next-platform sentinel and include the production NAS selector. The fixture otherwise reaches unrelated runtime cleanup and correctly refuses a non-fixture path. Keep that filesystem guard and every existing DSM safety assertion unchanged.
Change-source: pulse-maintainer
Require the actual NAS quiescence/retirement caller rather than the removed best-effort autorun cleanup. Preserve Upstart exclusion from SysV while requiring the NAS exclusion too. No manager or process safety control is removed.
Change-source: pulse-maintainer
The closed signal and server doubles record the current boot/process state without changing outcomes. Require exact boot absence before both signals and complete quiescence at the server boundary, so a future ordering regression cannot pass on final state alone.
Change-source: pulse-maintainer
A go shell can hold later launches in memory after its boot file changes. Treat that live mixed-purpose owner as unknown rather than signalling it or inferring quiescence from the edited file. Require the actual-caller refusal control alongside the existing NAS suite.
Change-source: pulse-maintainer
The renderer heredoc contains nested shell functions. Extract through its own EOF and outer closing brace so the real private process control executes the complete producer; retain renderer diagnostics on failure.
Change-source: pulse-maintainer
Retire only exact Unraid and QNAP boot entries before checked watchdog-first process termination and same-instance server removal. Preserve unrelated boot owners and refuse unknown, partial or concurrent state without erasing credentials or restarting. Exercise the complete uninstall caller and generated private watchdogs.
Change-source: pulse-maintainer
Use unified resource IDs for workload rows and selection so moving a guest
between Proxmox nodes retains its open drawer and History range. Resolve
existing bookmarks through the registry instead of rebuilding client IDs.
Migrate guest metadata before accepted inventory publication and retain its
operator fields in memory if persistence fails. Native metadata and metrics
coordinates remain explicit compatibility inputs. Operator policy and paid
execution behavior remain intact.
Register the focused publication and writer proofs once. Check proof
acceptance and rejection without copying the registry catalog into tests.
Refs #1669
A missing SCRIPT path or empty COMMAND target cannot establish that a task is unrelated or absent. Retain recovery before any task or service mutation when those fields are unavailable. Add three actual-caller adverse controls to the mandatory sixteen-method hook and both owning contracts.
Change-source: pulse-maintainer
Disable and independently verify every exact owned middleware activation task before systemd stop and server removal. Close task, unit and process state after the full stop and after task deletion, retaining recovery on refusals or concurrent changes without restarting. Ordinary Linux state directories are not appliance identity. Register all fifteen actual-function/full-caller controls and update both owning contracts in this coherent candidate.
Change-source: pulse-maintainer
The first beta's release workflow failed twice in backend_tests:
TestHostAgentCredentialFileHandoff, added on 2026-10-11 and so new to
every release job, compiles pulse-agent itself and was killed at exactly
180s with "build agent from this source: signal: killed".
The release runner starts each API shard with a small pinned GOMAXPROCS,
and the test's child compiler inherits it. A cold agent build is about
250 CPU-seconds, so under the pin it serializes past the test's fixed
three-minute limit. The release job also has no Go build cache, and the
race-enabled test binary the runner compiles does not warm this plain
build. Pull request jobs keep a warm cache, which is why the test passed
there.
Reproduced on pulse-dev with the shard's conditions, a prebuilt test
binary, GOMAXPROCS=1 and an empty cache: the test fails at 180.02s with
the identical message. With the agent built once beforehand, unpinned, in
99s, the same pinned run passes in 16s.
Build the agent once in the runner, after compiling the test binary and
before any shard starts, with the full CPU count. The runner test pins
that order so the warm-up cannot drift after the shards, and the contract
records why. Against the previous runner the pin fails with the expected
message. The release preflight and policy suites pass.
Contract-Neutral: Release test runner ordering only; no published artifact, tag, signing, install or customer contract changes.
## What changed and why
Keep Proxmox guest readings, alerts and History owned by the live
connection that collected them. A completed obsolete poll must not
republish after connection replacement, retirement or runtime shutdown.
Both enumeration routes now stage the complete guest generation and its
effects before publication. Caller detail-budget expiry still preserves
already collected inventory, without granting another read or fallback.
Make FreeBSD rc.d and SysV agent removal retain recovery material until
shutdown, process absence and disabled boot activation are confirmed.
Refused, incomplete or ambiguous observations stop removal; a partially
stopped installation is not automatically restarted. Existing
systemd/OpenRC protections remain.
Keep the guest memory explanation's agent-setup advice safe: defer
setup, restarts and live guest-agent probes during backups or an
incident. The underlying percentage, source and reading age are
unchanged.
These are bounded maintenance steps for reported workload safety,
restart recovery and safe removal, not whole-report completion. Related
to #1099, #2439, #2619, #2762 and #2822. Native recovery, independent
thaw, Windows removal and installed acceptance remain separate.
## Included source
Complete unpublished range:
`dba4b722af3f1e9a648b09ace9484a1cfc26f785..d4e89c1a1bd7892b3fc16441365a90a15139efd4`.
- Guest publication candidate:
`1ccc3651fdd611a1d5da47c5d44659fbcd4c2773` through
`08a7eaf70d8452c223e05b19ce2bd7866bbb237d`, integrated at
`ac00b9ec782b1a5964c3a9b00cdd19775293d6fc`.
- Recovery-preserving removal candidate:
`bad484550830d19569e0332c96c495e71c1694d6` through
`65f813c49758c663380ad0179e5cce3245615baf`, integrated at
`7bda196005275cd25da63776db8eadc500c0066d`.
- Memory setup precaution: `c776990b817b6a96d02abc38692960c2be578419`
and compatibility-fixture correction
`9327bc02409ffe3f07d14b8f560d6fb75d492f46`, integrated at starting
reviewed tip `020a7be6bf2a2923c291395a8409ed79ddcde336`.
- Additive upstream composition
`b523c0b6f33b6cc0ddcb36b967b05fffa7f63b4a` contains the published backup
guide unchanged. It has the same source tree as the starting reviewed
tip. Every accepted commit identity and ancestry is preserved.
- Additive correction `6281d6e0008aec029b5cc7f79820ed46159aa17a`
reconciles the canonical Docker-ingest source guard with both routes
through the ownership gate, retaining the canonical state-update
assertion and all behavioral withdrawal controls. It changes no runtime
source.
- Additive upstream composition
`a61f14c823be5ee99f20b2aa2eb3808eff83645d` incorporates the published
second-beta metadata-test repair at
`171f003a04950b53e577019398961758eb32d91c`. Its exact object was already
present; no transport or history rewrite was needed.
- Final additive composition `d4e89c1a1bd7892b3fc16441365a90a15139efd4`
incorporates published beta.2 metadata at
`dba4b722af3f1e9a648b09ace9484a1cfc26f785`. The bounded upstream refresh
completed at the requested identity with source unchanged before this
merge. It adds no new maintenance scope or release action.
## Validation and limits
Publication provenance, whitespace and all fifteen per-commit completion
guards pass. The complete-range browser guard validates the unchanged
source-bound memory precaution receipt. Recorded candidate evidence
includes 33 guest scenarios and both original 500-guest budget controls,
60 removal methods and ten targeted installer fixtures, and 40 grouped
browser checks with twelve captures recorded as inspected. Unchanged
sufficient browser evidence was not replayed merely for batching.
Earlier Go 1.26.8 results remain diagnostic rather than matching the
declared compiler.
- `source-ji6j004_` on the first composition observed Go 1.26.9 and
failed the stale direct-publication assertion. The complete failure
remains retained; later vet/installer steps were not reached.
- Corrected `source-krkur1bl` on
`6281d6e0008aec029b5cc7f79820ed46159aa17a` passes the targeted
Proxmox/guest-ownership race suite, monitoring vet, shell syntax and
twelve targeted installer/consumer tests, including fifty Python removal
controls executed through their production-function wrappers. It uses Go
1.26.9, exits zero, collects complete output and confirms guest stop.
These monitoring and agent-removal bytes are unchanged in the final
composition.
- `source-9u5ig0nx` passes 62 frontend tests, full types, changed-source
formatting/ESLint, the production/embed build and every bundle budget.
Exit zero, complete output and guest stop are recorded. The final
frontend delta from that proof is only the already-published
upgrade-guide mirror; JavaScript, styles, manifests and browser-verified
inputs are unchanged.
- `source-p3ht5oy2` verifies the reconciled canonical ingest guard and
the newly published prerelease-predecessor helper/current prerelease
metadata on `a61f14c823be5ee99f20b2aa2eb3808eff83645d`. Two
stable-packet checks correctly skip on prerelease source. Go 1.26.9,
zero exit, complete output and guest stop are recorded. The later beta.2
metadata is validated separately on the final tip.
- Exact final `source-sl4t8d7o` on
`d4e89c1a1bd7892b3fc16441365a90a15139efd4` passes shell syntax and the
prerelease-predecessor/current beta.2 install-metadata checks on Go
1.26.9. The two stable-packet checks remain explicitly skipped. Exit
zero, complete 1,485-byte output and completed guest stop are recorded.
Earlier receipts retain their reporting-line-bound flags without loss of
their complete raw output.
These checks do not establish installed restoration, native guest
safety, Docker qualification, release readiness or publication of this
maintenance. Administrative review and all required exact-head hosted
checks still govern landing; any advisory failures need an
evidence-based disposition.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Inline and command-double changes did not establish cleanup on the retained race refusal. Register only the non-credential manual temporary with the existing installer trap and execute that exact trap in the confined caller controls. Never register the credential-bearing staged job backup for automatic deletion. All retention, no-clobber, refusal and native obligations remain intact.
Change-source: pulse-maintainer
The retained race refusals still left manual temporary files after the command-double change. Check write, permission and atomic link operations individually rather than relying on the grouped chain to reach cleanup. Keep concurrent files/directories and all credentials intact; the same mandatory race assertions remain. Matching Go1.26.9 is now actually observed and the complete installer suite remains required.
Change-source: pulse-maintainer
The two race controls retained private manual temporary files because the command double exited before the production failure handler. Exact confined traces show that exit boundary. Capture and return the real external ln exit explicitly, preserving production cleanup and every file/directory race assertion. No product code, safety assertion, method count or deadline changes.
Contract-Neutral: Faithful closed-model external exit observation only; no runtime or contract delta.
Change-source: pulse-maintainer
Reverts #2863 before any release ships it. No tag contains it;
v6.6.0-beta.1 predates it.
The live Pro pricing and Patrol pages, in English, German and Spanish,
sell both modes: Pro "applies safe fixes in the mode you choose (Ask
first, Safe auto-fix, or Autopilot)". Paying installs also chose them.
Shipping the retirement would have silently downgraded those installs
while the sales page still promised the modes. If the modes are retired,
that needs a dated notice: stop selling them, warn affected installs
in-app, then re-ship the change.
The companion enterprise revert (rcourtman/pulse-enterprise#114) already
landed. It is safe with either core.
The receipt #2863 landed stays in place; this adds a receipt for the
restored content.
Verification:
- Go vet is clean. config, ai, ai/qualification, telemetry,
actionlifecycle, unifiedresources, aicontracts, pkg/server and api pass
on pulse-dev. The only api failure, the server-info development check,
needs `.git` in the tree.
- Release_control Python suites, the commit guard, the status and
registry audits, and the docs mirror all pass.
- Browser, on a pulse-enterprise build of this revert with a Pro
licence:
- all four Patrol modes are offered and Safe auto-fix saves;
- the Autopilot acknowledgement dialog activates effective `full`, and
Revoke is shown;
- drawer and plan page render, and phone width is fine.
The retained fourth proof stopped at a test-double argument refusal before the intended prior-source race. Execute both legitimate ln argv forms unchanged inside the private fixture; current file/directory preservation still requires exact-target non-clobbering semantics. No product change, safety assertion, method count or deadline is weakened.
Contract-Neutral: Transparent closed-model command arguments only; no runtime or contract delta.
Change-source: pulse-maintainer
Extend the existing no-clobber method with file and directory creation at restoration, not only before its initial path check. The real private-file operations must retain the original staged inode and every credential, never overwrite or write inside a concurrent target. Product code, method count, deadlines and native obligations are unchanged.
Contract-Neutral: Closed-model race coverage only; no runtime or contract delta.
Change-source: pulse-maintainer
Reverts #2863 before any release ships it. The live Pro pricing and
Patrol pages, in English, German and Spanish, sell both modes ("applies
safe fixes in the mode you choose: Ask first, Safe auto-fix, or
Autopilot"), and paying installs chose them. Shipping the retirement
would have silently downgraded those installs while the sales page still
promised the modes.
If the modes are retired, that needs a dated notice: stop selling them
first, warn installs on those modes in-app, and then re-ship the change.
It should not arrive through an engineering cleanup.
The receipt #2863 landed stays in place; this commit adds the receipt
for the restored content.
A pathname absence check followed by mv could overwrite a concurrent root-created job. Use exact-target non-replacement links for override creation and config restoration; directory races also refuse without creating nested artifacts. Confined concurrent-file/directory controls are mandatory. Partial activation is never restarted and conflicting staged recovery is never discarded.
Change-source: pulse-maintainer
Beta cut from main at 171f003a04. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.2 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
The first exact proof retained two fixture failures: timeout executes an external initctl rather than a shell function, and the source-order assertion unintentionally included later install code. Remove the actual model binary for its missing-tool control and bound the assertion to uninstall. Add an explicit concurrent-config/no-clobber recovery verdict; product code and safety deadlines are unchanged.
Change-source: pulse-maintainer
Treat DSM6 Upstart and stale DSM7 jobs through their actual manager, not SysV or late best-effort cleanup. Keep trusted job state and credentials on refused, unknown or partial observations; require effective manual activation and observed stopped/absent processes before remote removal and local erasure. Stage the original config until absence is confirmed, restore without restart on failure, and preserve non-clobbering recovery. Mandatory production-function/caller controls retain every refusal and timeout boundary. This is confined source repair, not native Linux/Windows or whole-issue acceptance.
Change-source: pulse-maintainer
pulse-triage[bot]