## What changed and why
Keep Proxmox guest readings, alerts and History owned by the live
connection that collected them. A completed obsolete poll must not
republish after connection replacement, retirement or runtime shutdown.
Both enumeration routes now stage the complete guest generation and its
effects before publication. Caller detail-budget expiry still preserves
already collected inventory, without granting another read or fallback.
Make FreeBSD rc.d and SysV agent removal retain recovery material until
shutdown, process absence and disabled boot activation are confirmed.
Refused, incomplete or ambiguous observations stop removal; a partially
stopped installation is not automatically restarted. Existing
systemd/OpenRC protections remain.
Keep the guest memory explanation's agent-setup advice safe: defer
setup, restarts and live guest-agent probes during backups or an
incident. The underlying percentage, source and reading age are
unchanged.
These are bounded maintenance steps for reported workload safety,
restart recovery and safe removal, not whole-report completion. Related
to #1099, #2439, #2619, #2762 and #2822. Native recovery, independent
thaw, Windows removal and installed acceptance remain separate.
## Included source
Complete unpublished range:
`dba4b722af3f1e9a648b09ace9484a1cfc26f785..d4e89c1a1bd7892b3fc16441365a90a15139efd4`.
- Guest publication candidate:
`1ccc3651fdd611a1d5da47c5d44659fbcd4c2773` through
`08a7eaf70d8452c223e05b19ce2bd7866bbb237d`, integrated at
`ac00b9ec782b1a5964c3a9b00cdd19775293d6fc`.
- Recovery-preserving removal candidate:
`bad484550830d19569e0332c96c495e71c1694d6` through
`65f813c49758c663380ad0179e5cce3245615baf`, integrated at
`7bda196005275cd25da63776db8eadc500c0066d`.
- Memory setup precaution: `c776990b817b6a96d02abc38692960c2be578419`
and compatibility-fixture correction
`9327bc02409ffe3f07d14b8f560d6fb75d492f46`, integrated at starting
reviewed tip `020a7be6bf2a2923c291395a8409ed79ddcde336`.
- Additive upstream composition
`b523c0b6f33b6cc0ddcb36b967b05fffa7f63b4a` contains the published backup
guide unchanged. It has the same source tree as the starting reviewed
tip. Every accepted commit identity and ancestry is preserved.
- Additive correction `6281d6e0008aec029b5cc7f79820ed46159aa17a`
reconciles the canonical Docker-ingest source guard with both routes
through the ownership gate, retaining the canonical state-update
assertion and all behavioral withdrawal controls. It changes no runtime
source.
- Additive upstream composition
`a61f14c823be5ee99f20b2aa2eb3808eff83645d` incorporates the published
second-beta metadata-test repair at
`171f003a04950b53e577019398961758eb32d91c`. Its exact object was already
present; no transport or history rewrite was needed.
- Final additive composition `d4e89c1a1bd7892b3fc16441365a90a15139efd4`
incorporates published beta.2 metadata at
`dba4b722af3f1e9a648b09ace9484a1cfc26f785`. The bounded upstream refresh
completed at the requested identity with source unchanged before this
merge. It adds no new maintenance scope or release action.
## Validation and limits
Publication provenance, whitespace and all fifteen per-commit completion
guards pass. The complete-range browser guard validates the unchanged
source-bound memory precaution receipt. Recorded candidate evidence
includes 33 guest scenarios and both original 500-guest budget controls,
60 removal methods and ten targeted installer fixtures, and 40 grouped
browser checks with twelve captures recorded as inspected. Unchanged
sufficient browser evidence was not replayed merely for batching.
Earlier Go 1.26.8 results remain diagnostic rather than matching the
declared compiler.
- `source-ji6j004_` on the first composition observed Go 1.26.9 and
failed the stale direct-publication assertion. The complete failure
remains retained; later vet/installer steps were not reached.
- Corrected `source-krkur1bl` on
`6281d6e0008aec029b5cc7f79820ed46159aa17a` passes the targeted
Proxmox/guest-ownership race suite, monitoring vet, shell syntax and
twelve targeted installer/consumer tests, including fifty Python removal
controls executed through their production-function wrappers. It uses Go
1.26.9, exits zero, collects complete output and confirms guest stop.
These monitoring and agent-removal bytes are unchanged in the final
composition.
- `source-9u5ig0nx` passes 62 frontend tests, full types, changed-source
formatting/ESLint, the production/embed build and every bundle budget.
Exit zero, complete output and guest stop are recorded. The final
frontend delta from that proof is only the already-published
upgrade-guide mirror; JavaScript, styles, manifests and browser-verified
inputs are unchanged.
- `source-p3ht5oy2` verifies the reconciled canonical ingest guard and
the newly published prerelease-predecessor helper/current prerelease
metadata on `a61f14c823be5ee99f20b2aa2eb3808eff83645d`. Two
stable-packet checks correctly skip on prerelease source. Go 1.26.9,
zero exit, complete output and guest stop are recorded. The later beta.2
metadata is validated separately on the final tip.
- Exact final `source-sl4t8d7o` on
`d4e89c1a1bd7892b3fc16441365a90a15139efd4` passes shell syntax and the
prerelease-predecessor/current beta.2 install-metadata checks on Go
1.26.9. The two stable-packet checks remain explicitly skipped. Exit
zero, complete 1,485-byte output and completed guest stop are recorded.
Earlier receipts retain their reporting-line-bound flags without loss of
their complete raw output.
These checks do not establish installed restoration, native guest
safety, Docker qualification, release readiness or publication of this
maintenance. Administrative review and all required exact-head hosted
checks still govern landing; any advisory failures need an
evidence-based disposition.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Reverts #2863 before any release ships it. No tag contains it;
v6.6.0-beta.1 predates it.
The live Pro pricing and Patrol pages, in English, German and Spanish,
sell both modes: Pro "applies safe fixes in the mode you choose (Ask
first, Safe auto-fix, or Autopilot)". Paying installs also chose them.
Shipping the retirement would have silently downgraded those installs
while the sales page still promised the modes. If the modes are retired,
that needs a dated notice: stop selling them, warn affected installs
in-app, then re-ship the change.
The companion enterprise revert (rcourtman/pulse-enterprise#114) already
landed. It is safe with either core.
The receipt #2863 landed stays in place; this adds a receipt for the
restored content.
Verification:
- Go vet is clean. config, ai, ai/qualification, telemetry,
actionlifecycle, unifiedresources, aicontracts, pkg/server and api pass
on pulse-dev. The only api failure, the server-info development check,
needs `.git` in the tree.
- Release_control Python suites, the commit guard, the status and
registry audits, and the docs mirror all pass.
- Browser, on a pulse-enterprise build of this revert with a Pro
licence:
- all four Patrol modes are offered and Safe auto-fix saves;
- the Autopilot acknowledgement dialog activates effective `full`, and
Revoke is shown;
- drawer and plan page render, and phone width is fine.
Reverts #2863 before any release ships it. The live Pro pricing and
Patrol pages, in English, German and Spanish, sell both modes ("applies
safe fixes in the mode you choose: Ask first, Safe auto-fix, or
Autopilot"), and paying installs chose them. Shipping the retirement
would have silently downgraded those installs while the sales page still
promised the modes.
If the modes are retired, that needs a dated notice: stop selling them
first, warn installs on those modes in-app, and then re-ship the change.
It should not arrive through an engineering cleanup.
The receipt #2863 landed stays in place; this commit adds the receipt
for the restored content.
Beta cut from main at 171f003a04. It carries every change merged since stable v6.5.0.
Contract-Neutral: Release-only v6.6.0-beta.2 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
The second beta's preparation pull request failed Backend tests
(TestCurrentPrereleasePacketTracksInstallMetadata): the changelog the
release metadata tool wrote said it describes the changes since
v6.6.0-beta.1, and the test expected v6.5.0. previousPrereleaseVersion
only understood -rc.N, so for beta.2 it reported no predecessor and the
test fell back to the previous stable. The tool names the predecessor in
the pre-release's own stage, alpha, beta or rc, N-1.
Do the same in the helper: rc.2 follows rc.1 and beta.2 follows beta.1,
while the first of a stage has no predecessor even when an earlier stage
shipped. Pin it with a table test, because beta.1 passed without ever
exercising the second-beta case.
Run against the beta.2 preparation snapshot with this change, the whole
installer test package and the release policy suite pass.
Contract-Neutral: Test helper only; no release, install or customer contract changes.
The first beta's release workflow failed in publish_docker at "Verify
exact tags and signed provenance": gh attestation verify copied an image
blob from Docker Hub and got a 502 Bad Gateway. The verifier calls
docker buildx imagetools inspect and gh attestation verify against
Docker Hub and GHCR with no tolerance for a transient registry error, so
one 5xx fails the whole release, and the train can rerun it only once.
Each of those reads is now retried up to four times with doubling
backoff from 10 seconds. They are idempotent, and a moved tag or an
invalid attestation fails identically on every attempt, so a real
failure is delayed by the backoff and never masked. The script's stdout
is the step output, so each attempt's stdout is captured and only the
successful attempt's is emitted: a failed read that printed half a
manifest cannot corrupt the verified digests. VERIFY_REGISTRY_ATTEMPTS
and VERIFY_REGISTRY_WAIT_SECONDS tune it, validated as small whole
numbers so the retry stays bounded.
Tests use doubles that fail like a dropped connection: transient
attestation reads are retried and only the digest proof is emitted; a
digest read that prints a partial manifest before failing leaves no
trace in the output; an exhausted attempt budget fails with an explicit
error and no output; unbounded settings are rejected. The old assertion
that an unverifiable attestation costs exactly one read now expects the
four attempts. Against the previous script the new tests fail. The
contract records the retry.
Checked: all 9 tests in the verifier's test file pass; the script and
its test are not registered in a subsystem, so the completion guard has
no proof file to require.
Second of the release-path retries after #2862 (release listing 504).
Patrol now has two modes: **Watch only** reports findings, and **Ask
first** investigates and proposes fixes. Every fix waits in Actions for
an operator to approve and run it. Safe auto-fix (`assisted`) and
Autopilot (`full`) are retired.
Why: schema-v17 telemetry for the week to 2026-10-11 counts 1 assisted
and 2 full installs out of 612 reporting Patrol, and 4 executed Patrol
actions in 30 days, all on one install. No GitHub issue asks for more
autonomy. Meanwhile the automatic path carried its own policy leases,
acknowledgement store, per-resource allowlist, release gate and Colima
lab. Investigation is what paid installs use, so it stays.
Behaviour
- A saved `assisted`, `full` or `autonomous` level reads as `approval`.
Both autonomy update routes refuse those levels with `400
invalid_autonomy_level`. The acknowledgement routes are gone.
- The core Patrol action broker only plans: `Plan` and `Submit` persist
the plan and return. `TestContract_PatrolActionBrokerOnlyPlans` forbids
execution calls in its source.
- Removed:
- `ExecuteUnderPolicy`, the policy authorization lease, and the policy
execution store methods;
- Autopilot acknowledgement persistence, its routes and its dialog;
- the per-resource automatic-action allowlist: type, API field and
drawer editor. The store column is written as NULL.
- Kept for compatibility:
- `GetPatrolFullModeUnlocked` stays on the extension contract and
reports false;
- historical action records keep their lease and reason codes decodable,
labelled as retired modes.
- The Patrol inbox no longer has a "continuing without a decision"
bucket: every current issue is an operator decision.
Governance
- RG-06 now proves Patrol never executes without an operator decision
(integration tier).
- RG-02/RG-04 and the RA35/RA39/RA40 proof commands point at surviving
tests. Every `-run` name was checked against `git grep '^func Test'`.
- Pro plan copy, AI docs, privacy telemetry wording and the subsystem
contracts describe the two modes.
Verification
- Go: vet is clean. config, ai, ai/qualification, telemetry,
actionlifecycle, unifiedresources, aicontracts and api pass on
pulse-dev.
- Frontend: type-check and lint are clean; 217 related test files pass.
- Governance: release_control Python suites, status/registry audits and
the docs mirror pass.
- Browser: a pulse-enterprise build of this tree with a Pro licence, run
before and after merging onto main:
- the Patrol selector has exactly two modes, and each save reads back;
- retired levels get 400, and the acknowledgement route returns 404;
- the drawer Manage tab has no allowlist editor and still saves;
- phone width is fine; the plan page shows no retired modes.
The first beta's release workflow failed in publish_docker at "Verify
exact tags and signed provenance": gh attestation verify copied an image
blob from Docker Hub and got a 502 Bad Gateway. The verifier calls
docker buildx imagetools inspect and gh attestation verify against
Docker Hub and GHCR with no tolerance for a transient registry error, so
one 5xx fails the whole release, and the train can rerun it only once.
Retry each of those reads up to four times with doubling backoff from 10
seconds. They are idempotent, and a moved tag or an invalid attestation
fails identically on every attempt, so a real failure is delayed by the
backoff and never masked. This script's stdout is the step output, so
each attempt's stdout is captured and only the successful attempt's is
emitted: a failed read that printed half a manifest cannot corrupt the
verified digests. VERIFY_REGISTRY_ATTEMPTS and VERIFY_REGISTRY_WAIT_SECONDS
tune it, validated as small whole numbers so the retry stays bounded.
Test it with doubles that fail like a dropped connection: transient
attestation reads are retried and only the digest proof is emitted; a
digest read that prints a partial manifest before failing leaves no trace
in the output; and an exhausted attempt budget fails with an explicit
error and no output. The old assertion that an unverifiable attestation
costs exactly one read now expects the four attempts. Against the previous
script the new tests fail. The contract records the retry.
Contract-Neutral: Release verification reliability only; no published artifact, tag, signing, install or customer contract changes.
The compound worktree commands still assume pulse/v6 and reserve a lease
in the source checkout that Git does not transfer to the new worktree.
They also use a second claim implementation with different renewal and
expiry rules. No callers remain outside their entrypoints, docs and tests.
Use ordinary Git tools under the current branch policy and the supported
work_claim command in the checkout where the slice runs. Remove the legacy
workflow, its private claim engine and their obsolete advertisements.
Patrol could run some fixes on its own in two paid modes: assisted (Safe
auto-fix) and full (Autopilot, behind a server-owned acknowledgement).
Schema-v17 telemetry for the week to 2026-10-11 counts 1 assisted and 2
full installs out of 612 reporting Patrol, 4 executed Patrol actions in
30 days, all on one install, and no GitHub request for more autonomy,
while the automatic path carried its own policy leases, acknowledgement
store, per-resource allowlist, release gate and Colima lab. Investigation
is what paid installs use, so it stays.
Patrol now has two modes. Watch only reports findings. Ask first
investigates and proposes fixes, and every fix waits in Actions for an
operator to approve and run it.
- A saved assisted, full or autonomous level reads as approval, and the
update routes refuse those levels with 400 invalid_autonomy_level.
- The core Patrol action broker only plans: Plan and Submit persist the
plan and return. ExecuteUnderPolicy, the policy authorization lease,
the policy admission store methods, the Autopilot acknowledgement
persistence, routes and dialog, and the per-resource automatic-action
allowlist (store column now written as NULL) are gone.
GetPatrolFullModeUnlocked stays on the extension contract and reports
false.
- Historical action records keep their policy lease and tenant/resource
reason codes decodable, labelled as retired modes.
- The Patrol inbox no longer splits issues into "continuing without a
decision"; every current issue is an operator decision.
- Release gate RG-06 now proves Patrol never executes without an operator
decision (integration tier) instead of limited unattended autonomy,
and RG-02/RG-04 point at the surviving human-admission proofs.
- Pro plan copy, AI docs, privacy telemetry wording and the subsystem
contracts describe the two modes.
The first beta's release workflow failed in create_release at "Locate
existing release". That step reads up to 100 releases with every asset,
about 25 MB, in one call, and GitHub answered it with an HTTP 504. The
step has no pipefail, so the failed read reached jq as empty input and
the job ended with exit code 5. Timing the call from a workstation, one
of three tries returned an error body, so this is not rare.
Retry the read up to five times with the same backoff the asset upload
uses, and accept only a complete listing of valid pages. A failed or
truncated read must never look like "no existing release": that answer
would stage a duplicate draft for a tag that already has one. Exhausting
the attempts fails the job with an explicit error. The listing call and
the downstream handling of an existing draft are unchanged.
Run the real step script in the release policy test against doubles for
gh and sleep: two 504s then a complete listing finds the draft after
backoff of 15s and 30s; a read that exits 0 but is truncated every time
fails after five attempts, with the capped backoff and no outputs; and a
complete listing without the tag still means no existing release. Against
the previous step the test fails with the production symptom, exit 5 and
the 504 message. The create-release pin list and the contract record the
retry.
Contract-Neutral: Release workflow reliability only; no published artifact, tag, signing, install or customer contract changes.
The retained validation ended with an empty model record, not a product erasure verdict. Use atomic replacement for closed model updates so command interruption cannot truncate the state used to judge actual recovery files; production deadlines and safety assertions are unchanged.
Contract-Neutral: Closed fixture observation writes only; no product runtime or contract change.
Change-source: pulse-maintainer
Compose upstream bed5052eb5 without replacing reviewed history. Keep the accepted one complete stdout/stderr observation and blank-line refusal instead of upstream second-sample replacement. Retain upstream real-systemctl fresh-host assertions and its platform-availability decorator alongside every reviewed failure-retention control. No release, installed recovery or LXC stop-cause claim.
Change-source: pulse-maintainer
An owned activation link may already be disabled before a later observation fails; assert exact service/PID/credential retention without re-enabling it. Require the old installed-script PID-erasure adverse control, keeping that runtime observation distinct from credential erasure and new renderer behaviour.
Contract-Neutral: Verification and precise contract documentation only; the production installer is unchanged.
Change-source: pulse-maintainer
The renderer contains nested functions inside its heredoc; extracting at the first closing brace never exercises its stop function. Bind its full top-level body and inject missing sysrc in the executable model reached by timeout.
Contract-Neutral: Confined test extraction and missing-tool modelling only; no installer or contract behaviour changes.
Change-source: pulse-maintainer
The first beta (v6.6.0-beta.1) now passes its preparation checks and
both source pairs, and its release workflow failed twice at the
install.sh smoke test: on a clean Debian 12 container install.sh stops
with "Cannot identify the Pulse systemd service: unit inventory failed".
That is a real regression on main, not a flake. v6.5.0 does not have it,
so no release carries it.
Cause: the 2026-10-10 service discovery change reads `systemctl
list-unit-files -- pulse-backend.service pulse.service` and refuses on
any non-zero exit. systemd exits 1, printing nothing on stdout or
stderr, when none of the named unit files exist, which is every fresh
host (checked on systemd 255 here and by the smoke container's systemd
252). The change's comment says a successful empty read permits a new
installation, but an empty read is not exit 0.
Why the tests missed it: their systemctl double reports no units as exit
0, and `test_partial_failed_inventory_is_not_absence` asserted that an
empty inventory with exit 1 is refused.
Fix: one shared inventory read, used by the installer, the unattended
updater and the auto-update mask check (which had the same hazard). It
accepts exactly the silent exit 1 as an empty inventory, after a second
read confirms there is still no output and no message. A timeout, a
signal, any other status, or an exit 1 that carries output or a message
stays a failed inventory, so real failures still refuse.
Tests: the doubles now model systemd (a failure prints its message, a
silent exit 1 is absence), the two tests that encoded the defect model a
real failure, and new tests cover a fresh host for both scripts,
including real `systemctl --root` over an empty unit root. Contract doc
updated. The registered runtime proofs for install.sh and the unattended
updater (the Go tests that drive this suite) now require the fresh-host
controls to have run and passed.
Checked on pulse-dev: against the unfixed scripts the four new
fresh-host tests fail and the rest pass; against this change all 18
discovery tests, the 2 repair tests and the 16 timer tests pass, and the
Go installer tests pass (184 s).
This replaces #2855, whose first commit lacked the registered proof
files the completion guard requires per commit.
Refs #2785
Compose current main e2f4bdff03 additively. Retain both subsystem records and the held change-age control while withdrawing only the obsolete Discovery identification test. Reviewed identities and ancestry, canonical guest History ownership and upstream feature removal remain intact.
Change-source: pulse-maintainer
Retain recovery before unknown or unavailable timeout/sysrc observations, require bounded PID records, and align the existing daemon-supervisor assertion with checked signal delivery rather than ignored errors. Every source control remains mandatory.
Change-source: pulse-maintainer
Continue #1099: stop and disable the actual legacy manager before remote deregistration or local erasure, recheck after confirmation, and retain PID/service/credential material on refusal or unknown state. Check collector and supervisor absence, exact runlevel ownership and rendered signal failures with confined production-function controls. Appliance bootstrap and native acceptance remain separate.
Change-source: pulse-maintainer
The previous commit inserted a new real-systemctl test above the old one
and took over its skipUnless decorator, so on macOS, which has no
systemctl, the new test skipped and the old one ran unprotected and
failed. Restore the decorator on the old test.
The installer proof required the real-systemctl control to have passed.
Where systemctl does not exist it must instead report skipped, so the
proof now checks for ok on a host with systemctl and for skipped on one
without, and still fails if the control is absent from the output.
Refs: #2785
The 2026-10-10 server service discovery change lists the two historical
unit names with one pattern read and refuses to continue when that read
exits non-zero. systemctl list-unit-files exits 1, printing nothing on
stdout or stderr, when none of the named unit files exist. That is every
fresh host, so install.sh refused with "Cannot identify the Pulse systemd
service: unit inventory failed" before it did any work. The first beta's
install.sh smoke test caught it on a clean Debian 12 container; no
release carries it, and v6.5.0 listed the whole inventory and grepped it.
The tests could not see it. Their systemctl double reports "no units" as
exit 0, and test_partial_failed_inventory_is_not_absence asserted that an
empty inventory with exit 1 must be refused, which is the defect itself.
Add one inventory read shared by the installer and the unattended
updater, and use it for the auto-update mask check, which had the same
hazard. It accepts exactly the silent exit 1 as an empty inventory, and
only after a second read confirms there is still no output and no
message. A timeout, a signal, any other status, or an exit 1 that carries
output or a message stays a failed inventory, so a real failure still
cannot pass as absence.
Make the doubles model systemd: a failure now prints its message, silent
exit 1 is absence, and a new test runs real systemctl --root over an
empty unit root for both scripts. Run against the unfixed scripts, the
four new fresh-host tests fail; the rest of the suite is unchanged.
The registered runtime proofs for install.sh and the unattended updater,
which drive this suite, now require the fresh-host controls to have run
and passed, so they cannot be skipped or deleted unnoticed.
Refs: #2785
Read optional intake precautions at their expandable report fields, bind OpenShift Secret tests to the validated private file, and target helper workflow negative controls by step. Preserve the prepared GNU timeout in the private teardown probe on macOS and keep the actual security migration boundaries mandatory. Production guidance, installer behaviour and platform coverage are unchanged.
Contract-Neutral: Fixture-only integration repair; no product, installer, workflow, deployment or safety contract delta.
Change-source: pulse-maintainer
Combined-source validation found the removal-help assertion still looking for a direct systemctl stop after accepted teardown moved that operation into its fail-closed shared helper. Verify the actual helper call before revocation and retain stop, disable and complete-set readback assertions, with missing, late and ignored-call adverse controls.
Contract-Neutral: Test-fixture reconciliation only; no installer, help, lifecycle, schema or authority change.
Change-source: pulse-maintainer
Require bounded diagnostic-free service and all-runlevel readback before server removal or local mutation, and reconcile again after remote confirmation while recovery state still exists. Refused stops, disable failures, unknown reads and unexpected init paths retain local material; absent and repeated removal need independent manager/process absence. Add executable confined refusal, ordering, custom-runlevel and timeout-child controls to the registered installer hook and owning contracts. Native OpenRC, Windows, other-manager and installed acceptance remain separate.
Change-source: pulse-maintainer
SSO operators can hold permitted non-administrative write capabilities. The guide now checks the actual instance-administration boundary, without instructing a settings mutation or changing roles.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate and its portable proof. Hosted native systemd receipts, matching Go compilation, signed installed-agent transport and Windows recovery remain separate acceptance obligations.
Change-source: pulse-maintainer
Copy generated callbacks only after provider save, align group-claim advice with provider-specific scopes, and retain administrator access until separate-session permission checks pass. Keep shipped documentation and regression checks in step without changing authentication or provider behaviour.
Change-source: pulse-maintainer
Preserve the exact reviewed guide and regression-test commits. Retained command controls and browser evidence establish safer credential paths and permission diagnostics without cluster or privilege changes.
Change-source: pulse-maintainer
Preserve the five reviewed Core commits exactly. Blank-only bootstrap admission and the matching persistence path retain existing access; authenticated transfer remains unchanged.
Change-source: pulse-maintainer
Run the accepted Unix teardown functions on fresh public Linux x64 and ARM64 CI, with real stop refusal, socket activation, batch reactivation and independent process/file readback. Retain bounded source-bound phase and owned-cleanup receipts; keep synthetic revocation separate from installed TLS, signed-agent and Windows acceptance.
Change-source: pulse-maintainer
The copied token recipe followed linked paths and continued without its own failure boundary. Reject unsafe paths before editing or contacting the cluster, preserve scoped file-only provisioning, and distinguish Kubernetes RBAC from local pod privilege and missing usage. Exercise the exact copied recipes with synthetic inputs and render the served guidance.
Contract-Neutral: Existing Kubernetes help and its regression tests only; no runtime, API, chart, role, deployment profile or feature change.
Change-source: pulse-maintainer
Load the production quiescence helpers in the existing failed-revocation fixture and provide complete closed systemd observations. Continue testing the actual revocation refusal after verified stop/disable rather than replacing or bypassing the new safety boundary.
Change-source: pulse-maintainer
Replace ignored stop and disable failures with bounded complete state observations and independent inactive/non-enabled readback. Reconcile helper socket and service together, and quiesce the full uninstall activation set before remote or local mutation. Preserve failed runner revocation material and existing saved-state, token, trust and platform boundaries. Add executable production-shell refusal, reactivation, timeout and owned-cleanup controls.
Change-source: pulse-maintainer
Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
The v4-to-v5 entry point still offered privileged download-and-purge cleanup and duplicate update shortcuts despite safer current procedures. Preserve configuration, credential and workload recovery evidence, separate server and agent paths, and link the inspected local cleanup without broadening it.
Contract-Neutral: Existing customer guidance, shipped Markdown and focused regression checks only; no runtime, API, permission, installer or cleanup contract changes.
Change-source: pulse-maintainer
Retain exact PI candidate identity and its proof; existing configuration-transfer help now states the real admission gate and replacement limits.
Change-source: pulse-maintainer
Non-interactive token-file reading currently erases the supplied credential before permission checks and authenticated removal, including when removal is refused or its result is unknown. Treat token-file ingress as read-only: callers own their bootstrap cleanup, and confirmed removal still deletes only authorised runtime state. Keep token validation, TLS policy, exact record confirmation and credential-free local removal unchanged.
Extend the existing portable removal fixture through the actual parser and token ingress, root refusal and post-confirmation owned cleanup. Parent proof records thirty premature-erasure failures; a separate no-TTY harness control remains distinct. Update both owning contracts and the registered Go inventory hook together. Native Windows, compiled TLS and installed whole-job acceptance remain separate.
Change-source: pulse-maintainer
Document the existing nodes.enc gate, replacement scope, file precedence and non-fatal import errors. Preserve agent identity and excluded state, isolate provisioning from live traffic, and keep one-shot inputs private rather than forcing a reset.
Contract-Neutral: Existing bootstrap and encrypted-import behaviour is unchanged; this corrects canonical and served help, with documentation regression controls.
Change-source: pulse-maintainer
Retain the exact Delivery candidate b3b368c21b and its attributed PR2855 adaptation. Independent review verifies one-read failure retention and unchanged runtime-proof bytes; no native installation or published availability is claimed.
Change-source: pulse-maintainer
Adapt rcourtman’s Pulse PR2855 (aef53d0d3e), which diagnosed systemd’s silent exit-one absence. The original contributor commit is unchanged and explicitly credited, not imported, amended or re-parented in this maintainer candidate.
One bounded stdout/stderr observation accepts genuine absence but retains failed first reads, other statuses and blank-line output. Include the existing registered installer/updater verification hooks, real-empty-root controls and missing-unit recovery double in this same source commit. This replaces the rejected foreign-history composition with a normal maintainer-reviewed implementation; no provenance policy, credential or host installation changes.
Source-attribution: rcourtman, https://github.com/rcourtman/Pulse/pull/2855, aef53d0d3e
Change-source: pulse-maintainer
Align existing removal and orphan-service help with credential-first Unix admission. Explain same-instance recovery, keep older served scripts and Windows behaviour distinct, and prevent stopping retries from being mistaken for revocation or completed removal.
Contract-Neutral: Existing operator guidance and regression assertions only; no runtime, schema, lifecycle or trust-boundary change.
Change-source: pulse-maintainer
pulse-triage[bot]