The production Docs fixture reads GET /api/security/status during the consuming journey. Record and admit that single endpoint/method class as synthetic fixture traffic, while aborting any other API or off-origin request. The desktop keyboard and touch-enabled narrow journey now completes exact-guide, linked help, fragment focus and reload checks.
Contract-Neutral: Browser verification driver only; the documented API helper, frontend runtime and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Keep the two failed WebKit reload attempts as evidence rather than claim browser success. Exercise the same production Docs/router and exact copied guide in Chromium at desktop and touch-enabled phone widths, including linked administration help, fragment focus, reload and no API or off-origin requests. The helper and its response-privacy controls are unchanged.
Contract-Neutral: Browser verification driver only; documented API helper, frontend runtime and subsystem contracts are unchanged.
Change-source: pulse-maintainer
The private-response helper promises one request, but real curl expands quoted brace lists and bracket ranges into two or three requests, including POST, PUT and DELETE. Disable URL globbing without changing token-file transport, response privacy, scopes, TLS, deadlines or no-retry rules. Explain the literal-path and separate URL-encoding boundary.
Exercise the copied helper with both authentication headers, every supported method, encoded identifiers and adverse write responses. Add consuming desktop and narrow Docs/router verification.
Contract-Neutral: Documentation and synthetic recipe/browser checks only; API authentication, endpoint and runtime contracts are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]