Admit a prepared executable and source revision before stopping Pulse. Keep the live binary in place until one same-filesystem rename, and restore only a previously active service after a failed rename. Preserve existing recovery files and exercise staging, stop, rename and recovery failures.
Change-source: pulse-maintainer
Reject signature, extraction, architecture, destination staging and version failures before the service outage. Keep the live executable until a same-filesystem rename succeeds, remove the destructive version retry, and recover only a previously active, confirmed-stopped service if rename fails. Exercise the real archive path with download/local inputs and retained byte/mode/state fault controls; preserve uncertain-stop restrictions and separate native acceptance.
Change-source: pulse-maintainer
The first exact-source proof passed all replacement controls but the menu fixture shadowed main's choice variable and exited before staging. Use a distinct local selector and retain the fixture stderr on assertion failure.
Contract-Neutral: Fixture-only shell output-variable correction; no runtime or replacement-contract delta.
Change-source: pulse-maintainer
Archive and source installs ignored stop failures, while the manual flows stopped Pulse before staging. Require bounded state reads and a confirmed inactive service before either replacement; keep prior-active attribution and installed metadata on refusal. Exercise both real paths, timeout and uncertain-state controls, and manual staging failures without native or production mutation.
Change-source: pulse-maintainer
pulse-triage[bot]