Keep outbound telemetry disabled through the process environment, test the expected locked-field refusal, and save only the unrelated notification fields. Assert the lock on restart rather than attempting to persist it.
Contract-Neutral: Correct the CI-only synthetic journey and its controls; product settings, deployment restrictions, permissions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Reuse the real-embed application to verify authenticated live startup, narrow destination admission, monitoring-only token scope, ordinary alert delivery, persisted sessions and saved policy across a real process restart. Keep source/binary identity, single-submission mutation rules and owned child/listener cleanup in a bounded receipt. This prevents component passes from hiding application-path regressions without another build or host capability.
Contract-Neutral: CI-only validation of existing authenticated notification and persistence behaviour; no product, permission, installer or release contract delta.
Change-source: pulse-maintainer
