## AndrewDryga/emisar — v0.38.0…v0.39.0

_60 commits._

### Features
- **Add nomad.alloc_fs_tail behind a secrets/ guard** (a86b4e4)

### Fixes
- **Cover linux-core's unit and cron reads, and fix a filter that never matched** (52b84d6)

### Backend
- **Let a trust gap narrow a runbook target set instead of blocking it** (5e7184a)
- **Rank the concept an operator asked for, not the word form or the blend** (993cb16)
- **Judge a stale certification pin by what the fleet never advertises** (cc3c0f0)
- **Refuse a certification prompt that names its own action** (80a0644)
- **Name the arguments that actually conflict** (e8de4f4)
- **Classify every published tool, so a scenario cannot block one** (1e62d0b)
- **Stop certification punishing read-only diligence** (7de33a4)
- **Let a held-out partition be rebuilt when packs move** (08d75a9)
- **Make a stale certification pack pin say so** (5d5c142)
- **release: v0.39.0 — One runbook, one unpublished change, and a diff before you publish** (778be0d)
- **Let the image guard see a file that was not there last compile** (52c6fac)
- **Cost the uncovered remainder where it will outlive the task** (04112db)
- **Record the two shapes that are not the systemd lane** (1b02408)
- **Trace a real process, and check the tracer let go** (ead7f17)
- **Cover the iptables verbs in the namespace they write** (13cc356)
- **Record that the systemd lane exists now** (96cc471)
- **Install, remove and autoremove against a real dpkg database** (e8867ab)
- **Stop the journal-vacuum probe from passing on an empty machine** (ad26a26)
- **Show the publish diff in the runbooks guide** (53616df)
- **Drive a real service manager from the pack harness** (e4c4385)
- **Make the environment-limits card pass its own audit** (6b76d15)
- **Bring the environment-limits card up to what shipped** (b6b42ec)
- **Say why each uncovered action is uncovered, accurately** (f8af49c)
- **Cover docker against a daemon of the case's own** (836f1e2)
- **Say what publishing mints instead of calling a draft a draft** (1ed0ef0)
- **Put the live version on the Run button and calm the draft signal** (08ccb29)
- **Collapse runbook versioning to one runbook, one draft, and releases** (4115389)
- **Replace a leaked review answer with the inputs subtitle it overwrote** (9bd71e0)
- **Put the superseded state where the operator actually looks** (58df004)
- **Refuse runbook mutations from superseded versions** (af78105)
- **Show what changed between two runbook versions** (6e0514f)
- **Measure the privileged-host bucket instead of assuming a VM** (5ae164a)
- **Hold, release, and explain a workspace lock** (e5c5611)
- **Reserve and release one DHCP address, staged for the operator to apply** (58a9b0d)
- **Read pfSense resolver, NTP, and WireGuard peers without their secrets** (2a1ec53)
- **Map what the pack harness cannot reach, and close one it can** (f43256f)
- **Adopt the Paddle customer an owner's email already has** (15f37b6)
- **Pin the empty-synced-group behaviour with tests** (23ef514)
- **Prove compose_config's byte cap at its worst advertised size** (c92f654)
- **Give the IdP capture drivers a shared package, and move only what is safe** (9a7fb97)
- **Stop the seed producing an empty capture database quietly** (f0fcb86)
- **Make a repeating Paddle 409 say which conflict it is** (1dc4c96)
- **Prove the pfSense certificate reads never emit a private key** (7345082)
- **Validate --previous through one shared catalog validator** (1c7a554)
- **Re-tier redis.config_get to medium on enumerated coverage** (e6d848f)
- **Derive the demo's one-version-behind pack instead of naming it** (0f7f2ff)
- **Show operators the override that keeps an investigation moving** (1d1c117)
- **Teach the fleet install to keep a reusable key out of argv** (1e9e4ac)
- **Say what happens when a pack's connection variable is not allowlisted** (274dcc4)
- **Record that cloud-init init is the recommended form, not a doomed one** (3e3b23a)
- **Stop a refused TLS port reporting as a certificate parse error** (6ca55fb)
- **Widen the default redaction key names, and pin what must not match** (e67fc61)
- **Stop the seeder speaking for a runner that already advertised** (6859858)
- **Name the binary that actually builds the catalog** (cfc4a42)
- **Delete the SSO overview that redirects before it renders** (4cb6a73)
- **Compress LiveView socket frames** (db72b8b)
- **Record when redaction can carry a risk tier, and when it cannot** (f16a7d5)
- **Keep the audit total exact until counting it actually costs something** (ae0c97a)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/AndrewDryga/emisar?utm_source=github-action)._