Hardening state files under /var/log was applying chmod 700 to the parent
directory, which broke syslog/logrotate and other services after agent update.
Phase 4.2: SAC_SUPPRESS_FAIL_COUNT during lifecycle shutdown so restart during SAC deploy does not trip Telegram fallback. Add docs/sac-ingest.ru.md for SAC_TIMEOUT_SEC guidance, smoke test, and release manifest.
Add shared server label helpers in ssh-monitor-perms.sh; roadmap marks
phase 1 done and phase 2.2.0 as next release.
Co-authored-by: Cursor <cursoragent@cursor.com>
Updater applies chmod/chown on config, spool and state paths on every run.
SAC is the primary update path; optional cron uses the same behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
PTah