**Keep installer configuration snapshots private during copying**
cp -a adopts source-root permissions, defeating a reserved private stage
when legacy configuration is broadly traversable. Keep the copy behind
an installer-owned private enclosure until its root mode is 0700, then
use the existing no-clobber publication. Preserve source ownership,
nested recovery metadata, flat layout, retention and
failure-before-mutation semantics.
Register real-copy prepublication privacy, final metadata and
failed-mode preservation controls in the ordinary installer suite, and
update the deployment contract. No frontend, host policy, installed
service or release state changes.
**Overlap isolated server reset and removal safety checks**
The installer package still serialises these independent temporary-state
matrices. Admit their roots and cases through Go test's existing
parallel budget, with each watchdog starting inside its admitted case.
Preserve every sourced installer action, preservation assertion, case,
timeout and cleanup.
Contract-Neutral: Only independent test scheduling changes; no
production installer, safety contract, assertion, deadline, selected
case or frontend change.
---
Fleet candidate `20261030T024009Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`e6e6fc2f28874308e316214e631ff0692d50bda8` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
pulse-triage[bot]
d2b541683b