Retain failed startup and unknown service state as incomplete installation for fresh and prior-stopped installs. Preserve the prior-active bounded recovery retry and propagate startup failure through all five conditional main routes before markers or completion. Register real-producer service doubles and saved-state controls.
Change-source: pulse-maintainer
A literal backup prefix can also name another live instance. Publish private source/path/inode receipts without changing copied payloads, and require matching records before rotation or discard. Preserve unmarked historical copies and fail closed on receipt collisions; register filesystem controls and explain retention limits.
Change-source: pulse-maintainer
Inject the ownership failure in real setup_directories while invoking each of the five unchanged main routes in an OR-list. Retain inert build and lifecycle boundaries and assert no helper, service or success work follows the producer failure.
Contract-Neutral: Strengthens the existing registered failure-propagation proof without changing runtime or contract behaviour.
Change-source: pulse-maintainer
Propagate creation, ownership, environment-write and permission failures explicitly, including when Bash errexit is disabled by a caller. Require directory admission in all five installation/update paths before later helper, unit, service or completion work. Preserve existing bytes and report partial setup honestly. Register confined failure and success controls with the deployment contract.
Change-source: pulse-maintainer
Keep a capture sentinel around dirname and basename output so command substitution cannot move a custom instance's backup and retention into a trimmed-name peer. Stop explicitly on component resolution failure, including conditional update callers, and treat relative option-shaped paths as data. Register filesystem controls for final-name and parent newlines, retention, peer state and failure paths. This is a remaining edge of Pulse #3611; the earlier literal-pattern repair in PR #3610 is also required.
Change-source: pulse-maintainer
Custom directory names were interpreted by find as patterns, and newline-delimited results could become different recursive removal targets. Expand only the snapshot suffix and retain each complete pathname as a separate shell word. Keep current-snapshot protection, retention counts and non-following directory scope, with connected installer controls for foreign configuration and recovery files.
Change-source: pulse-maintainer
Recheck the selected executable after the final stable MainPID observation. Retain uncertainty instead of reporting success when the next start would use different or unusable bytes. Require real owned-process drift controls for primary, legacy and symlinked paths while preserving equivalent-byte replacements and existing recovery behaviour.
Change-source: pulse-maintainer
**Balance slow backend source slices by measured runtime**
The protected installer change still leaves required rest steps at 603
and 895 seconds. Reuse the existing contiguous API selector for
monitoring and installer slices, with source-listed coverage and
measured scheduling hints. Preserve test order, complete recorder
admission, timeouts, race checks and the existing worker envelope.
Contract-Neutral: CI scheduling only; no product runtime, public
contract, coverage, platform requirement or safety-assertion change.
**Keep Docker guide checks independent of cache admission spelling**
The newly protected replacement-image repair changes cache admission,
but the guide test still splits the retired guard and fails required
unit shard 3/4. Match the successful cached result instead, keeping the
digest and fresh-clock assertion in the same object and producing an
assertion failure if it disappears.
Contract-Neutral: Test-only CI integration repair; shipped producers,
rendered copy and public/runtime contracts are unchanged.
**Reconcile Docker guide assertions with published main**
Use the already published reusable-cache assertion verbatim to remove
the test-only landing conflict without changing runtime or help.
Preserve all imported scheduler commits exactly as reviewed.
Contract-Neutral: Integration-only source-consistency test
reconciliation; no runtime or subsystem contract change.
---
Fleet candidate `20261030T232023Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`e797d6c661b2fc5348c68f09e2d873a5d5f5f398` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Explain accepted keys, missing Pro runtimes and unavailable plan reads without clearing licences, replacing private images or repeating checkout. Link the shipped FAQ to scoped recovery and retain credentials, configuration and service identity.
Contract-Neutral: Documentation and safety regression checks only; existing licence, runtime and account boundaries are unchanged.
Change-source: pulse-maintainer
The protected installer change still leaves required rest steps at 603 and 895 seconds. Reuse the existing contiguous API selector for monitoring and installer slices, with source-listed coverage and measured scheduling hints. Preserve test order, complete recorder admission, timeouts, race checks and the existing worker envelope.
Contract-Neutral: CI scheduling only; no product runtime, public contract, coverage, platform requirement or safety-assertion change.
Change-source: pulse-maintainer
Current main's required rest shards take 843 and 959 seconds. Four remaining serial recovery validators own private files, child environments or closed service-manager state. Admit them through Go's existing parallel limit before their unchanged deadlines; preserve the live NAS inventory preflight, every scenario and native platform requirement.
Contract-Neutral: Test-only scheduling of isolated lifecycle fixtures; installer behaviour, coverage, safety assertions and deadlines are unchanged.
Change-source: pulse-maintainer
Main run 41109701017 spends 225 seconds in one documentation shard while the others need 42 to 58 seconds. Reuse the existing whole-suite selector with complete native timing evidence, preserving discovered coverage, sorted isolated execution, every recipe deadline and the mandatory aggregate check. Cover weighted membership, new and stale hints, incomplete selection, invalid hints and every discovered suite's failure through actual runner and workflow commands.
Contract-Neutral: CI scheduling of the complete existing documentation suites only; product, installer, release, access and verification acceptance contracts are unchanged.
Change-source: pulse-maintainer
Use a 50 ms server poll in the six owned documentation HTTP fixtures, instead of Python’s default 500 ms. Preserve every request, transport and cleanup deadline, response, assertion and adverse control. Check real idle and exceptional teardown for all seven listeners.
Contract-Neutral: Test fixture scheduling and lifecycle assertions only; no product, frontend, documentation, access or deployment contract change.
Change-source: pulse-maintainer
Run two fixed per-flow fixture observations together while retaining every original case, deadline, file/mode preservation, no-restart and cleanup assertion. Collect outcomes on the test thread and require both bad-result and exception verdicts in the registered scheduling controls.
Contract-Neutral: Test scheduling only; installer runtime, replacement safety and recovery contracts are unchanged.
Change-source: pulse-maintainer
Run only the two fixed synthetic reader pairs concurrently, retaining the real collection deadlines, pidfd survival and cleanup checks, private output suppression and all original scenarios. Keep verdict collection on the test thread and test both adverse results and exception draining.
Contract-Neutral: Test scheduling only; resident-memory guidance, runtime and diagnostic safety contracts are unchanged.
Change-source: pulse-maintainer
Run only the two independent synthetic readers in each wait-bound pair concurrently. Preserve real collection and cleanup deadlines, private fixtures, complete result collection and every existing privacy/survival assertion; pin bounded overlap and injected failure/exception propagation in the ordinary smoke suite.
Contract-Neutral: Test-only scheduling and causal controls; no runtime, documented recipe, safety bound, access, API or frontend contract changes.
Change-source: pulse-maintainer
Run the seven independent synthetic producer/pipe/reader deadline cases with three bounded workers, keeping real deadlines, pidfd termination and private-output checks. Collect every queued verdict after failures and observation exceptions; causal barrier controls protect overlap and failure propagation.
Contract-Neutral: Synthetic test scheduling only; no passive helper, runtime, rendered surface, deadline or access contract changes.
Change-source: pulse-maintainer
The measured slowest smoke suite waits for three independent 80-second controls in series. Run only those private-fixture, new-session cases together with three bounded workers. Keep the real 80-second kill, 83-second ceiling, reader termination and private-output assertions unchanged; observe all results on the main test thread. Barrier, per-case failure and exceptional-result controls preserve fail-closed collection.
Contract-Neutral: Verification scheduling only; diagnostic recipes, runtime behaviour, deadlines and subsystem contracts are unchanged.
Change-source: pulse-maintainer
**Restore complete rootful installer source binding**
Bind the 23 added compiled installer test inputs without changing
manifest schema or production exclusions. Run the existing attestation
source-closure and reader-hash regressions in canonical CI so future
installer splits cannot silently narrow the boundary. No native
qualification or installed recovery is claimed.
**Bind installer startup and network dependencies**
The exact-source validator exposed current Cloud/auth/network packages
outside the rootful compiled closure after the missing test files were
restored. Bind their production roots and four committed Cloud embed
inputs, and verify the real reader hashes. Preserve the failed first
proof; no native qualification, service execution or rendered content
change.
---
Fleet candidate `20261030T094017Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`1d8f30c65bad3a9af7f3510107c3f234a9d6a97b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep unread replication inventory distinct from absent jobs**
Validate complete typed replication snapshots before using their counts
or job health. Malformed JSON, lists, flags and ambiguous identities use
the existing safe error and retry instead of hiding the view, dropping
rows or coercing health. Preserve scoped job IDs, accepted empty reads
and existing poll/access semantics.
**Verify replication inventory failures through the production app**
Record parent-bound desktop Chromium and narrow WebKit consumer proof,
native input, safe error/retry, scoped job state and
complete/empty/denied observation semantics. Lane evidence retains
source VM receipts, raw browser results, inspected captures and the two
corrected driver attempts.
**Keep replication registry entries in canonical order**
Sort the new owned-file and exact-proof lists with registry_audit's
case-folded lexical order. Preserve every member, proof policy, frontend
byte and existing parent-bound browser receipt; repair the recorded
preflight rejection without changing product behaviour.
---
Fleet candidate `20261030T090451Z-web-product` from the `web-product`
lane. Reviewed tip `c07cbf886c47f3151ad79d0239f75d94a3a3fc75` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Explain the distinct Linux agent privilege profiles**
Show the typed-helper and legacy sudo/socket boundaries before
production operators choose a host agent. Keep opt-in support limits,
reduced container telemetry and explicit profile migration distinct from
updates and diagnostics.
Contract-Neutral: Documentation-only profile selection and consuming
guide tests; installer authority, defaults and telemetry contracts are
unchanged.
**Compare rendered profile guidance without Markdown line breaks**
Normalise whitespace in the rollout-link assertion. The guide, its
shipped mirror and all runtime consumer bytes are unchanged from the
completed browser pass.
Contract-Neutral: Consuming documentation test correction only; no
runtime, guide content or subsystem contract change.
---
Fleet candidate `20261030T091101Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`9c68df2eb7b66693362f1969a95844c6b23a8223` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The exact-source validator exposed current Cloud/auth/network packages outside the rootful compiled closure after the missing test files were restored. Bind their production roots and four committed Cloud embed inputs, and verify the real reader hashes. Preserve the failed first proof; no native qualification, service execution or rendered content change.
Change-source: pulse-maintainer
Bind the 23 added compiled installer test inputs without changing manifest schema or production exclusions. Run the existing attestation source-closure and reader-hash regressions in canonical CI so future installer splits cannot silently narrow the boundary. No native qualification or installed recovery is claimed.
Change-source: pulse-maintainer
Validate complete typed replication snapshots before using their counts or job health. Malformed JSON, lists, flags and ambiguous identities use the existing safe error and retry instead of hiding the view, dropping rows or coercing health. Preserve scoped job IDs, accepted empty reads and existing poll/access semantics.
Change-source: pulse-maintainer
Show the typed-helper and legacy sudo/socket boundaries before production operators choose a host agent. Keep opt-in support limits, reduced container telemetry and explicit profile migration distinct from updates and diagnostics.
Contract-Neutral: Documentation-only profile selection and consuming guide tests; installer authority, defaults and telemetry contracts are unchanged.
Change-source: pulse-maintainer
Keep the generated watchdog/kernel inventory control serial and first,
then use the existing two-worker Go budget for the 22 independent
ps/kill/flash model controls. Preserve every control body, production
producer and per-control deadline.
Contract-Neutral: Installer fixture scheduling only; production
behaviour, safety assertions, inventory isolation and deadlines are
unchanged.
---
Fleet candidate `20261030T074007Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`49051cdfebd417d95664150119b47d53126a079a` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Back off optional Proxmox permission-denied reads**
Keep typed HTTP 403 denials on the existing 30-minute APT and
five-minute guest-memory negative intervals, without promoting stale or
absent observations. Preserve successful clocks, independent target
scopes, ordinary transient retries and guest lifecycle/uncertainty
fences. Cover direct and cluster transports, expiry, recovery, zero
evidence and shared runtime separation.
Report and patch reference: Pulse #3546 by @tyvsmith; this candidate
implements the scoped repair from current source.
Reported-by: tyvsmith
**Keep Proxmox update recovery zeros explicit on the wire**
Consuming browser proof for #3546 exposed a connected recovery failure:
the canonical merge retained seven stale updates and its access reason
when a successful empty response omitted zero and empty fields. Emit the
complete existing count/status/reason/origin tuple for an explicit node
verdict, preserving guest and legacy payloads.
Register JSON merge, API/realtime and legacy controls with precise
ownership. This fixes the changed producer through the existing
consuming surface without a frontend, permission or cadence change.
**Keep SSO provider labels on complete UTF-8 boundaries**
Preserve the existing 128-byte cap without slicing a valid code point
into invented replacement characters. Keep trim/control order and
intentional replacement characters, and cover byte-boundary cases,
registered Community HTTP writes and persisted/list/detail/login
discovery, redaction, stable IDs and presentation-only runtime reuse.
Register the focused SSO management proof route.
Contract-Neutral: Restore valid UTF-8 within the existing 128-byte label
cap; API shapes, byte limit, trim/control rules, IDs, credentials,
authorisation and runtime-reuse contracts are unchanged.
**Keep SSO verification paths in canonical order**
The first composed source proof passed all 131 SSO/API race roots, vet
and the native consuming exporter, but the registry's sorted-path
invariant failed on the new SSO policy. Sort the same exact six proof
paths; preserve their scope and every runtime byte.
Contract-Neutral: Verification-path ordering only; runtime, API, proof
selection, contract and frontend content are unchanged.
---
Fleet candidate `20261030T064533Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `3279b66588c06775ef6d5aab0a868d4e055a8602` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Keep the generated watchdog/kernel inventory control serial and first, then use the existing two-worker Go budget for the 22 independent ps/kill/flash model controls. Preserve every control body, production producer and per-control deadline.
Contract-Neutral: Installer fixture scheduling only; production behaviour, safety assertions, inventory isolation and deadlines are unchanged.
Change-source: pulse-maintainer
Keep each complete private fixture suite on one worker while sharing
Go's existing parallel budget. Real process-inventory and native manager
acceptance remain separate; no deadline, case, assertion or production
path changes.
Contract-Neutral: Installer and updater contracts, safety controls and
deadlines are unchanged; only four isolated test roots use the existing
Go parallel scheduler.
---
Fleet candidate `20261030T061002Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`dc9d7e20f615f23424076c5121fb2c26afd0fa9f` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the existing 128-byte cap without slicing a valid code point into invented replacement characters. Keep trim/control order and intentional replacement characters, and cover byte-boundary cases, registered Community HTTP writes and persisted/list/detail/login discovery, redaction, stable IDs and presentation-only runtime reuse. Register the focused SSO management proof route.
Contract-Neutral: Restore valid UTF-8 within the existing 128-byte label cap; API shapes, byte limit, trim/control rules, IDs, credentials, authorisation and runtime-reuse contracts are unchanged.
Change-source: pulse-maintainer
Merge reviewed candidate 592bfdd101 onto assigned main 46b0405046. Resolve the sole conflict by retaining both complete, independent unified-resources contract sections: dated restore-point disclosure and authoritative update observations. No runtime or frontend resolution edits.
Change-source: pulse-maintainer
Distinguish workspace runtime reachability from Docker-host reachability, first-seen certificate capture from independent trust, and baseline API monitoring from optional guest reads. Explain generated root-scope ACL changes before execution without making setup or broader access a troubleshooting requirement. Preserve the recent signed-bundle, upgrade and self-serve buying guidance.
Contract-Neutral: Documentation and registered documentation safety tests only; no runtime, API, TLS, permission or setup contract changes.
Change-source: pulse-maintainer
Consuming browser proof for #3546 exposed a connected recovery failure: the canonical merge retained seven stale updates and its access reason when a successful empty response omitted zero and empty fields. Emit the complete existing count/status/reason/origin tuple for an explicit node verdict, preserving guest and legacy payloads.
Register JSON merge, API/realtime and legacy controls with precise ownership. This fixes the changed producer through the existing consuming surface without a frontend, permission or cadence change.
Change-source: pulse-maintainer
Distinguish the denied APT and Linux memory reads from a failed
connection. Reuse existing refusals instead of requesting a
credential-matched probe, preserve stale observation semantics and link
the guest backup safety boundary. Protect the shipped guide and safe
diagnostic path in the existing documentation suite.
Contract-Neutral: Documentation and registered guide tests only; no
runtime, API, permission or polling contract changes.
---
Fleet candidate `20261030T042301Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`f8f3c1298de1a7246b8b92690f61782dce820b1c` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Keep each complete private fixture suite on one worker while sharing Go's existing parallel budget. Real process-inventory and native manager acceptance remain separate; no deadline, case, assertion or production path changes.
Contract-Neutral: Installer and updater contracts, safety controls and deadlines are unchanged; only four isolated test roots use the existing Go parallel scheduler.
Change-source: pulse-maintainer
**Keep installer configuration snapshots private during copying**
cp -a adopts source-root permissions, defeating a reserved private stage
when legacy configuration is broadly traversable. Keep the copy behind
an installer-owned private enclosure until its root mode is 0700, then
use the existing no-clobber publication. Preserve source ownership,
nested recovery metadata, flat layout, retention and
failure-before-mutation semantics.
Register real-copy prepublication privacy, final metadata and
failed-mode preservation controls in the ordinary installer suite, and
update the deployment contract. No frontend, host policy, installed
service or release state changes.
**Overlap isolated server reset and removal safety checks**
The installer package still serialises these independent temporary-state
matrices. Admit their roots and cases through Go test's existing
parallel budget, with each watchdog starting inside its admitted case.
Preserve every sourced installer action, preservation assertion, case,
timeout and cleanup.
Contract-Neutral: Only independent test scheduling changes; no
production installer, safety contract, assertion, deadline, selected
case or frontend change.
---
Fleet candidate `20261030T024009Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`e6e6fc2f28874308e316214e631ff0692d50bda8` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Distinguish the denied APT and Linux memory reads from a failed connection. Reuse existing refusals instead of requesting a credential-matched probe, preserve stale observation semantics and link the guest backup safety boundary. Protect the shipped guide and safe diagnostic path in the existing documentation suite.
Contract-Neutral: Documentation and registered guide tests only; no runtime, API, permission or polling contract changes.
Change-source: pulse-maintainer
Require PVE task results and completion clocks to agree before replacing accepted writer evidence. An unread page retains the original running task and partial archive while independent completed copies remain usable. Native live/ended controls and ordinary completion are covered through the real client and VM/LXC ingestion.
Bind the existing response parser to its precise monitoring contract and normal response/lifecycle tests; its previously unowned path must not hide a missing proof route. No guest, task, backup or restore operation, public payload, protection policy or retention change.
Change-source: pulse-maintainer
The installer package still serialises these independent temporary-state matrices. Admit their roots and cases through Go test's existing parallel budget, with each watchdog starting inside its admitted case. Preserve every sourced installer action, preservation assertion, case, timeout and cleanup.
Contract-Neutral: Only independent test scheduling changes; no production installer, safety contract, assertion, deadline, selected case or frontend change.
Change-source: pulse-maintainer
cp -a adopts source-root permissions, defeating a reserved private stage when legacy configuration is broadly traversable. Keep the copy behind an installer-owned private enclosure until its root mode is 0700, then use the existing no-clobber publication. Preserve source ownership, nested recovery metadata, flat layout, retention and failure-before-mutation semantics.
Register real-copy prepublication privacy, final metadata and failed-mode preservation controls in the ordinary installer suite, and update the deployment contract. No frontend, host policy, installed service or release state changes.
Change-source: pulse-maintainer
Canonical Governance rejected the retained backup-safety candidate because the lookup regression still expected the old five-file PBS verification list. Require the registered snapshot-identity proof as well, and check that the new test itself resolves to the same monitoring owner and exact proof route. Preserve the production registry, runtime and every existing check.
Contract-Neutral: Correct and extend the ownership test expectation for the already registered PBS snapshot-identity proof; no runtime, contract, policy or verification requirement changes.
Change-source: pulse-maintainer
Preserve the exact prior runtime repairs and current main, including the protected phone disclosure and help. Resolve only additive contract composition if needed; the rejected governance expectation will be corrected separately.
Contract-Neutral: Composition preserves the reviewed task inventory, PBS attribution and organisation-bound recovery contracts with no new runtime change.
Change-source: pulse-maintainer
Distinguish existing multi-guest vzdump result collection from raw log access through Pulse MCP. Keep monitoring-read redaction and separate host access explicit, and check both shipped guide copies.
Contract-Neutral: Documentation-only correction to existing collection and read boundaries; no runtime, scope or capability change.
Change-source: pulse-maintainer
Explain compressed downloads, shared image layers, container writes and
mounted data before operators compare sizes. Keep the existing read-only
identity check and rollback data; add no new diagnostic or cleanup
command.
Contract-Neutral: Documentation and its safety assertions only; no
runtime, storage or Docker lifecycle contract changes.
---
Fleet candidate `20261029T220009Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`3baacbebc1acce8adf07e79c4c79facc7a0018f4` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Main native job 123729055242 fails before contract execution when an
unconditional Homebrew install collides with the Intel runner framework
Python links. Prefer the existing versioned Python 3.13, verify its
version, and acquire the formula only when that command is absent.
Preserve the isolated binary-only pinned parser and all gating checks.
Cover preinstalled and acquired runtimes, conflicting links, version and
preparation failures. These source controls do not claim actual repaired
hosted macOS execution.
Contract-Neutral: Only macOS CI prerequisite selection changes; shipped
installers, native Windows lifecycle and runtime contracts are
unchanged.
---
Fleet candidate `20261029T211255Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`1741267025a971f529dd044349df580b4f5a45b4` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Human PR3526 and PR3525 are on main, so the previous monitoring-contract overlap is resolved. Preserve their content and all three independent storage-recovery sections. Imported PBS and callback runtime/test files are unchanged from 9b87d13a8ef5ba6082602bed2b33e3834e056881; only additive contract composition resolves the conflict.
Contract-Neutral: Composition retains the reviewed PBS attribution and organisation-bound lazy selection contracts; no new public surface, authority, policy or schema.
Change-source: pulse-maintainer
Explain compressed downloads, shared image layers, container writes and mounted data before operators compare sizes. Keep the existing read-only identity check and rollback data; add no new diagnostic or cleanup command.
Contract-Neutral: Documentation and its safety assertions only; no runtime, storage or Docker lifecycle contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]