**Distinguish container SSH warnings from enforced key setup
restrictions**
The legacy temperature collector warns and continues with an existing
key; the canonical security guide must not claim that collection is
blocked. Keep the container key prohibition, private audit, independent
recovery access and key-specific revocation guidance, without changing
runtime or setup guards.
Contract-Neutral: Documentation and rendered-guide regression coverage
only; SSH collection, authentication, key-generation restrictions and
runtime contracts are unchanged.
**Bind security migration checks to their section heading**
The guide's new introduction left an old telemetry-doc assertion
splitting on prose that no longer exists. Use the bounded migration
section, preserve every credential and installer assertion, and reject
missing or displaced safety guidance without depending on an
introductory sentence.
Contract-Neutral: Test locator and adverse-control repair only; shipped
documentation, runtime, telemetry accounting and subsystem contracts are
unchanged.
---
Fleet candidate `20261031T164003Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`ef48888902f459ba145c3934ba0e40bd7ea553d8` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
pulse-triage[bot]
f488ae35a6