Every attention row on every install (and all 38 rows on the public demo)
carried a warning 'Evidence incomplete; timing unavailable' / 'Evidence
timing unavailable' metadata line. Unknown freshness just means the evidence
source publishes no validity window - only availability-poller evidence does
- so it is not an operator-facing warning, and the 'timing unavailable' claim
was false with per-envelope observation times rendered beside it.
- Presentation: the scan row now surfaces an evidence phrase only for states
worth a glance (unavailable, incomplete, stale, or window-backed current);
complete evidence with unknown freshness stays quiet on the row and shows
a muted 'Evidence recorded' badge in the detail, mirroring the existing
unavailable-protection row rule.
- Alerts bridge: provider incidents without a backing availability check now
carry a first-class complete/confirmed envelope derived from the observed
incident payload instead of falling to the legacy partial shim, and each
sync merges the cycle's freshly observed envelopes into the active alert so
raise-time evidence does not age out while the condition is still observed.
Verified live on a scratch mock instance at 1280px and 744px: all 44+ mock
attention rows now project complete evidence and render without the noise
line; detail shows 'Evidence recorded' with per-observation timestamps.
The Up to date verdict on the Pulse server updates panel can come from the
frontend's 24h localStorage cache, but it rendered with no timestamp, so a
day-old verdict read as a live comparison. A user on rc.9 read Up to date
minutes after v6.2.0 published and concluded the updater was broken.
The status cell now carries the age of the check the verdict came from
(Checked 3 hours ago, or Not checked yet when this browser has never
checked). Copy stays in the updatesPresentation owner, the store exposes
lastCheckedAt for the verdict actually displayed, and the line is hidden
for source builds, where checks are disabled.
Refs #1601
The Plans & Billing navigation entry is suppressed for sessions without
commercial context, which hid the only activation-form entry point from
exactly the customers who need it: a fresh Pro install has no license yet,
so hideUpgrade stayed true until the key the customer could not find a
place to paste was pasted. The compiled Pro binary is only distributed
through the paid broker flow, so a Pro-edition session is commercial
context by construction — edition.IsPro() now sets commercialContext in
securityStatusPresentationPolicy.
Ordinary free self-hosted sessions run the community binary and keep the
opt-in default (the edition marker keys off the compiled binary, never
license state). Demo mode and white-label keep full suppression via
hideCommercial, which wins over edition-derived context. Complements
1b9bc9482 (setup-completion activation pointer); together a fresh Pro
install gets both the first-run pointer and a permanently visible
Plans & Billing entry. api-contracts, storage-recovery, and
agent-lifecycle contracts record the policy delta.
A fresh Pro install has no way to discover where its activation key goes:
the Plans & Billing nav entry is navigation-suppressed until a license or
subscription exists (hideWhenUpgradeHidden), which hides the only panel
holding the activation form exactly while the install is unlicensed. A Pro
customer hit this after the broker download flow and emailed support.
The setup completion panel now probes /api/license/runtime-capabilities
and /api/license/status with the setup token and, only when the compiled
Pro build reports no valid license, renders an Activate Pulse Pro card
linking straight to /settings/pulse-intelligence/billing/plan (direct
routes stay reachable by design). Community builds, licensed installs,
and failed probes all keep the card hidden, so the self-hosted opt-in
commercial posture is untouched. The pro-unlicensed preview scenario
keeps browser proof deterministic; strings are localized in EN/DE/ES;
agent-lifecycle, frontend-primitives, and security-privacy contracts
record the new handoff and catalog boundaries.
Route config-owned install commands and setup-script artifacts through the canonical trusted request-origin resolver. Preserve configured URL precedence and add endpoint-level adversarial coverage for token-bearing commands.
rcourtman