[jjziets]

Summary

Fleet administrators can change a supported service between Pinned and Follow stable, while seeing installed and selected versions separately. Check Updates refreshes opted-in selections through the host broker before listing admitted releases; installation still requires the existing reviewed update action.

The policy routes keep the existing live-admin, session, CSRF and origin checks. Requests contain only bounded component/mode and expected selection identity fields. Unsupported services retain their existing lifecycle owner.

Validation

• Test-first API/client/actual-renderer regressions and independent correctness/security review. Full Proxy suite: 1,106 passed, two existing skips; final API/UI/latest subset: 122 passed.
• Chrome exercised the actual candidate page against synthetic APIs: unpin, newer selected target with installed version unchanged, reload persistence, re-pin and no later advancement. No install request was sent.
• Paired DC broker passed actual disposable Linux root/socket/SO_PEERCRED, timer, locks and four abrupt-death recovery checks using synthetic signed admissions and idle app containers.

This is a source candidate into dev with no version bump or LTX deployment. The trusted production release catalog and existing Fleet native recovery prerequisite remain held; the UI cannot activate safely until those are accepted. The paired DC policy broker candidate is required.

GitHub CI outcome

Python and image builds passed. The CI wheel matches the reviewed auth/client bytes; the image receipt binds the prospective merge of reviewed head6e518640 and unchanged dev base10f48b44. No release image was published or deployed. The paired DC source still has a base-layer download failure and a native frozen-source qualification hold, so this PR remains draft.

Paired host policy candidate: cryptolabsza/dc-overview#39