Keep API-only monitoring from being mistaken for a backup-safe guest-agent-free path. Link the existing planned precaution and retain independent post-backup thaw, every-filesystem writes, liveness and prior-active restoration in both shipped quickstarts.
Contract-Neutral: Documentation and rendered-content tests only; no runtime, API, permissions or safety-contract change.
Change-source: pulse-maintainer
Remove the shared-password override from German and Spanish Compose setup and the password-on-argv example from configuration help. Default to bootstrap setup; exercise private-file permissions, argument boundaries and failed preparation with synthetic credentials.
Contract-Neutral: Help and regression fixtures only; authentication, container and API contracts are unchanged.
Change-source: pulse-maintainer
Chain signed installer downloads, verification and execution in the English, German and Spanish landing pages so a failed trust step cannot run stale or unverified bytes. Keep the pinned signer, namespace and release URLs, preserve real installer exits, and correct the existing plan and paired-app retirement guidance. Exercise the copyable Bash gate with offline command stubs and run those documentation regressions in Public docs CI.
Contract-Neutral: Public documentation and its secret-free CI validation only; no runtime, entitlement, release-selection or subsystem contract delta.
Change-source: pulse-maintainer
ssh-keygen -Y verify -f expects the principal in the FIRST field; the
docs published the key in authorized_keys order, so the documented
verification failed against a valid signature (customer-reported against
v6.0.5). Verified the new command against the live v6.0.5 release
artifacts.
pulse-triage[bot]