Use the existing BIND_ADDRESS setting in the fixed fixture environment, alongside telemetry opt-out. The connected production-function control verifies this exact private profile and persistence across all seven phases; no product default or native manager safeguard changes.
Contract-Neutral: Fixed local fixture environment only; source/native admission and transaction-completion contracts are unchanged.
Change-source: pulse-maintainer
A Type=simple start may return before exec. Read and hash the managed PID only after the served health/version pass; retain strict active/inactive process readback rather than accepting a launch race.
Contract-Neutral: Native receipt identity and safety contracts are unchanged; this orders the existing readiness and executable observations and rejects inactive residual processes.
Change-source: pulse-maintainer
Keep captured output private to the test process so connected controls reveal a failing setup without uploading native application logs.
Contract-Neutral: Confined fixture diagnostics only; native admission, transaction, signing and bounded receipt contracts are unchanged.
Change-source: pulse-maintainer
Exercise real systemd and signed local current-source replacement/recovery in the existing real-embed job for #2785. Preserve service masks, persistent bytes, backups and owned cleanup; source controls do not claim published or LXC recovery.
Change-source: pulse-maintainer
Drain the installer pipe after a failed log write, retain its first observed failure across later successes and collect an unterminated final line. Reuse the guarded restoration path without changing signed-input, service-state, mask or prior-activity safeguards; bind the regression controls to package acceptance.
Change-source: pulse-maintainer
Terminal native CI 38058763364 reaches unsupported BSD tar --no-overwrite-dir and mv -T in both macOS discovery fixtures. Verify Homebrew GNU tar and coreutils mv and expose them only to the existing Linux server installer test step. Exercise real archive and rename bytes, missing/non-GNU tools, fixed package identities and containing-suite failure propagation; native macOS runtime remains untouched.
Contract-Neutral: Native CI fixture environment repair only; product installers, service-state admission, signatures, recovery, native runtime and safety deadlines are unchanged.
Change-source: pulse-maintainer
Current PR2795 native CI fails on all four Unix runners, and Build rest-0 fails, because the extracted URL fixture omits read_update_service_state. Source the complete helper with bounded confined transport/manager doubles and a real versioned executable fixture. Verify exact paired target URLs, one installer handoff, prior-active/inactive reads and fail-closed refusal before downloads or backup for failed, partial and duplicate observations.
Contract-Neutral: Repair an incomplete updater test fixture against the existing service-state, versioned-installer and restoration contract; no production or contract delta.
Change-source: pulse-maintainer
Use the assets already built in the Frontend job for a read-only backend compile and server/API vet. Require byte-equal embed copies, retain the existing audit/tests/deadline and fail on compiler errors; source controls do not stand in for a containing hosted build.
Change-source: pulse-maintainer
Capture both pipeline statuses before logging overwrites them. Keep recovery, signature and prior-service safeguards unchanged; cover installer, collector, simultaneous and successful observations without attributing a past host interruption.
Change-source: pulse-maintainer
Containing PR2795 CI rejects explicit failure propagation because its old half-removal wiring check requires a bare unit-repair call. Execute both production update paths with genuinely absent config and unit files, confined activation and ownership, and guard failed repair against timer/start/false completion. Keep the installer and unattended recovery runtime unchanged.
Refs: #2785
Change-source: pulse-maintainer
Contract-Neutral: Test-only correction to the existing half-removed update contract; no runtime, workflow, authority or installability behaviour changes.
Read bounded, complete unit state before mutation and confirm inactive state before rollback replacement. Keep the verified backup and stop automatic recovery when service state cannot be reconciled; preserve prior-active restoration, masks, signatures and configuration.
Exercise failed/partial reads, deadlines, no-op stops and restoration through confined production-shell fixtures and the existing signed transaction controls. Fix fixture path and manager observations so registered Go controls execute the actual source.
Refs: #2785
Change-source: pulse-maintainer
The helper selects and passes an explicit service name, bypassing installer discovery. Apply the same bounded exact-unit admission there and preserve its error before any prior-active query, backup, installer call or restart trap. Execute both producers and the real helper handoff in the registered unattended updater proof artifact.
Refs: #2785
Change-source: pulse-maintainer
Consume one bounded inventory of exact historical unit names without early pipe closure. Preserve legacy and explicit-instance selection, and stop replacement, unit creation, reset and removal after unknown inventory even when Bash errexit is disabled. Distinguish this source defect from the unconfirmed cause of the reported LXC stop.
Refs: #2785
Change-source: pulse-maintainer
Repair the deterministic PR2768 backend failure after the safe node guide added its ninth request. Exercise that private-file POST alongside the existing recipes without positional method/path assumptions, and reject missing, duplicate or unqualified examples while preserving privacy, trust, one-shot and real deadline controls.
Contract-Neutral: Copied-guidance regression test and synthetic fixture reconciliation only; no runtime, API, TLS, workflow, frontend or shipped documentation contract changes.
Change-source: pulse-maintainer
The completed PR2761 native run spent 243 runner-seconds acquiring and building frontend assets before its deterministic immutable-image source check failed in four Unix jobs. Execute the existing uncached bounded image checks immediately after Go setup, before Node and native runtime work. Keep real frontend assets, exhaustive installer groups, pins, all native gates and their deadlines unchanged; guard order, selection and terminal failures.
Contract-Neutral: Additional early execution of existing immutable-image source assertions only; no public contract, agent runtime/lifecycle, Windows behaviour, image pin, complete-suite coverage, existing gate or deadline changes.
Change-source: pulse-maintainer
Native Unix CI rejects the fixed compose override even though its local default remains digest-pinned. Recognise only that existing override or a literal complete governed pin, with malformed and mutable-default controls. Keep images, producer admission, required gates and deadlines unchanged.
Change-source: pulse-maintainer
The containing macOS Intel job exhausted its ten-minute package alarm with 500 general installer checks while an individual bounded guidance probe was still running. Interleave the complete discovered inventory across two general invocations and keep the reset matrix separate. Preserve exact-once selection, failure propagation, all fixture deadlines and the existing native platform matrix.
Contract-Neutral: Only partitions existing native Unix installer test inventory; runtime behaviour, per-invocation package alarms and fixture safety contracts are unchanged.
Change-source: pulse-maintainer
The shared private-response helper supports DELETE for reviewed RBAC recipes. Its older Go fixture still expected DELETE to stop before curl, failing the containing backend shard and all four native Unix jobs. Exercise unsupported PATCH instead; retain every credential, preparation, request and privacy fence without changing the documented helper.
Contract-Neutral: Test-only correction of a stale unsupported-method control; no runtime, API, installer, guide or frontend behaviour changes.
Change-source: pulse-maintainer
Load the real service-status enum in the mocked Windows SCM controls and check lifecycle statements independently of checkout line endings. Keep Linux-only server installer fixtures on supported Bash and GNU metadata tools within their macOS test step, after native agent runtime testing. Partition the discovered installer inventory so the expanded reset matrix retains its own existing package deadline; preserve every check, failure exit and per-fixture deadline.
Change-source: pulse-maintainer
Contract-Neutral: Native CI fixture environment and inventory repair only; product installers, native lifecycle, safety contracts and fixture deadlines are unchanged.
The complete installer package correctly stopped its old re-entry fixture at unavailable mask evidence. Admit exact unmasked fixture units and record the sole daemon-reload operation instead of depending on a real host manager. Exercise the actual CLI re-entry with both effective runtime masks as well; retain refusal and all assets unchanged.
Contract-Neutral: Confined test admission and CLI coverage only; no installer runtime or subsystem contract change.
Change-source: pulse-maintainer
Reconcile the returned timer-discovery repair: both exact units must have a successful bounded unmasked inventory before shared asset staging. Keep configured, runtime and off-destination persistent masks and all assets unchanged across every installer consumer, explicit setup and sandbox repair. Unknown or failed inventory stops replacement; enabled and disabled refresh remains consent-preserving.
Change-source: pulse-maintainer
The complete installer suite failed because its older guide check still required --ssh-known-hosts after reviewed 953e0c6dec deliberately made cleanup local-only. Check the actual copied command and reject remote scope, purge, account deletion, extra actions and prose-only impostors; preserve all existing bounded/private diagnostic checks.
Contract-Neutral: Test-only reconciliation with the existing local-only guide; no runtime, shipped document, access or cleanup contract change.
Change-source: pulse-maintainer
Match complete systemctl inventory rows by exact unit field with bounded reads, so updates and reinstalls reach the existing helper refresh. Preserve deliberate timer and updater masks instead of replacing their symlinks. Exercise all five installer consumers, unchanged settings and enablement, failure/timeout controls and actual fixture-root systemctl inventory.
Change-source: pulse-maintainer
Keep archive and sidecar downloads in owner-only staging, clean only owned leaves after handled failures and bootstrap exit, and preserve caller-provided inputs. Require the piped LXC installer signature before copying or execution instead of trusting PID-named files in shared tmp.
Exercise the actual download, prefetch and complete container bootstrap through confined offline doubles and real fixture SSH signatures. Preserve version, archive re-verification, staging-before-stop, service recovery, timer consent and removal boundaries; native acceptance remains separate.
Change-source: pulse-maintainer
Use the reviewed server-only selector in the existing-installation menu and bind automatic selection to available channel rows. A current selected release is a no-op; unavailable metadata or an automatic downgrade stops before mutations. Preview selection retains its channel, numeric beta/RC revisions compare correctly, and deliberate reinstall pins the actual current version.
Execute the actual menu through confined offline transport and stopped mutation boundaries. Preserve explicit version, interactive removal, signature and all-unit quiescence contracts; reconcile the inherited comment-only preview assertion with the real selector consumer.
Change-source: pulse-maintainer
Use one complete-metadata selector for installer URLs and server archives. Exclude chart and draft releases, reject unusable metadata and transport bodies, and preserve explicit pins, signed assets and downgrade refusal. Exercise the actual selectors with bounded offline controls and retain native installation as separate acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Restore server-only discovery within existing stable/preview channels; installer authority, signatures, architecture admission, downgrade refusal and state contracts are unchanged.
Repair the candidate preflight failure without changing the PowerShell control tokens or runtime assertions. Validate whitespace across the complete candidate range.
Contract-Neutral: Removes one trailing ASCII space after a closed string literal in an existing test control; no runtime, assertion, coverage or subsystem contract delta.
Change-source: pulse-maintainer
Exercise removal of the actual preflight-to-environment wiring in the native acceptance contract, and accurately count the fourteen adverse structural controls.
Change-source: pulse-maintainer
Reject missing Windows engines and pre-existing or unknown runner state. Independently verify first and repeated uninstall, propagate failed SCM/listener reads, preserve captured machine settings and fail unconfirmed owned server cleanup. Add actual-function controls alongside the unchanged production removal and native-exit checks.
Change-source: pulse-maintainer
Replace suppressed stop/delete failures with bounded SCM stop and absence evidence before replacement or uninstall. Retain binary and agent state on uncertainty, and report incomplete local cleanup. Add production-function failure controls to the existing native Windows test route and pin both destructive callers.
Change-source: pulse-maintainer
Observe every timer, updater and server before mutation; refuse configuration deletion on uncertain quiescence and restore only prior-active servers and recorded timer states. Keep roles independent of accepted custom service names and never replay an interrupted updater. Exercise actual sourced paths and adverse controls. Move existing Windows native-exit assertions unchanged to their registry-named completion file without relaxing checks.
Change-source: pulse-maintainer
Contain destructive installer removal when systemd observation, stop or disable is uncertain. Stop the updater before the server, reconcile default aliases and local legacy units, and preserve files on refusal. Propagate failed legacy-key replacement even in conditional cleanup. Exercise both removal entrypoints and instance isolation in confined fixtures.
Change-source: pulse-maintainer
Preserve Delivery exact candidate 99d7b5e671 and both independently reviewed installability contract sections. The only conflict resolution combines documentation; runtime and verification bytes remain exactly as proved. Retained component suites pass while two enclosing assertions fail, and no native workload recovery is established.
Change-source: pulse-maintainer
Account for every byte in the root-boundary compatibility reader, preserving descriptor-first recovery and rejecting oversized valid prefixes, multiple identities and discarded NULs. Keep the original two-second fixture budget, contain descendant processes and report build/probe timing separately. Add real-agent, legacy and cancellation controls without claiming a cause for the retained timeout.
Change-source: pulse-maintainer
Require stopped-state readback before each LXC mutation, reject failed pct set fallback, preserve snapshot entries and only-prior-active restoration, and return incomplete cleanup without removing recovery files. Add isolated adverse lifecycle and completion controls.
Change-source: pulse-maintainer
Reject successful installers whose replacement cannot identify itself as the target community runtime. VERSION metadata and failed or unrecognised probes cannot establish acceptance; retain the existing verified rollback and prior-active restoration. Exercise the complete locally signed installer transaction and bounded executable read.
Change-source: pulse-maintainer
The installer rereads saved preferences without an explicit selector. Forward the parsed stable default as well as RC, and prove the containing installer's actual channel-selection functions against the same signed fixtures.
Change-source: pulse-maintainer
Stop the generated helper before downloads when saved channel evidence is malformed or unreadable. Preserve explicit selectors, source-marker precedence and signed-installer verification; exercise the actual helper with signed local fixtures.
Change-source: pulse-maintainer
The full installer race suite exposed report deletion despite the subshell-counter guard. Bind EXIT cleanup to the original process using the direct child shell parent PID, including before the inherited counter is initialised. Retain strict and unchanged-graph verdicts, exact arguments and parent cleanup. Align the stale channel-copy assertion with the existing non-stable message; executable consent controls remain unchanged.
Change-source: pulse-maintainer
Require a successful bounded executable identity probe before release discovery. Keep Pro and unknown runtime editions untouched even when VERSION offers a usable community version, and do not defer a broken primary binary to a legacy one. Exercise the real shell classifier and main boundary with adverse controls and a TERM-resistant deadline.
Change-source: pulse-maintainer
A TERM-only timeout relies on the child exiting. Keep a fixed five-second KILL backstop, preserve every timeout as a failure and bind the shell/Go command proofs to the actual bounded invocation.
Contract-Neutral: Internal build timeout containment; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
Keep the same pinned Go graph and endpoint. Retry only the observed transport-only diagnostic, at most three attempts; stop on refusals, integrity errors, unknown output, timeouts and signals. Execute the actual Docker download command against controlled outcomes and retain its original-base rejection.
Contract-Neutral: Build-only transport recovery; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
The broader installer race/vet VM attempt reached readiness but returned no command verdict at its observation deadline. Keep the same consent cases in the normal installer suite and make their committed file standalone, with only standard-library imports and the actual shell gate. This enables proportionate exact-source Bash regression proof without building unrelated application dependencies; the broader failed attempt remains retained.
Change-source: pulse-maintainer
Text matching admitted truncated configuration, nested opt-in and padded RC channels. Parse one configuration object with the installed jq dependency and fail closed before downloads when consent cannot be verified. Preserve the legacy no-config timer opt-in, manual updates and disabled-timer gate; add executed-shell regression cases and the deployment contract.
Change-source: pulse-maintainer
Admit a prepared executable and source revision before stopping Pulse. Keep the live binary in place until one same-filesystem rename, and restore only a previously active service after a failed rename. Preserve existing recovery files and exercise staging, stop, rename and recovery failures.
Change-source: pulse-maintainer
Reject signature, extraction, architecture, destination staging and version failures before the service outage. Keep the live executable until a same-filesystem rename succeeds, remove the destructive version retry, and recover only a previously active, confirmed-stopped service if rename fails. Exercise the real archive path with download/local inputs and retained byte/mode/state fault controls; preserve uncertain-stop restrictions and separate native acceptance.
Change-source: pulse-maintainer
Archive and source installs ignored stop failures, while the manual flows stopped Pulse before staging. Require bounded state reads and a confirmed inactive service before either replacement; keep prior-active attribution and installed metadata on refusal. Exercise both real paths, timeout and uncertain-state controls, and manual staging failures without native or production mutation.
Change-source: pulse-maintainer
Preserve f2b5080bcc and 580199f07c exactly. Resolve only the shared classifier working-directory comment in favour of main's wording, retaining its compilation assertions and the common checkout-root execution.
Change-source: pulse-maintainer
Completed PR2576 checks exposed a workflow-shell fixture running outside the checkout root, two unformatted test files, and the missing monitoring contract for accepted 26ae5b1aa2. Run the real classifier helper in its actual Actions context and assert Go compilation admission alongside strict dependency-audit decisions. Record collected metadata with empty series and retained-only exclusion without changing runtime or synthesizing samples. All reviewed commit identities remain unchanged; final source proof and exact-head hosted checks remain required.
Change-source: pulse-maintainer
pulse-triage[bot]