Added instructions for repurposing or re-enrolling a Windows device via
Autopilot to avoid enrollment conflicts.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #42144
---------
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Docker Desktop application support to version 4.71.0 for macOS
and Windows platforms.
* Updated Postman application support to version 12.8.0 for macOS and
Windows platforms.
* Updated Rider application support to version 2026.1.1 for macOS
platform.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Added name and LinkedIn
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
**Related issue:** Resolves#42240.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Statistics now include GitOps mode: whether it’s enabled and the
ordered list of configured exception categories (serializes as an empty
list when none).
* **Tests**
* Added tests for GitOps-related statistics transitions and made
statistics-timing tests deterministic for reliable behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated version support for Notepad++ (8.9.4), Signal for macOS
(8.8.0), and Stats for macOS (2.12.12).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
Rename and standardize configuration keys across fleet profiles: replace
macos_settings -> apple_settings, macos_setup -> setup_experience, and
macos_setup_assistant -> apple_setup_assistant. Move/rename bootstrap
key to macos_bootstrap_package under setup_experience. Convert per-OS
custom_settings to configuration_profiles (including
windows_settings.custom_settings -> configuration_profiles). Update
server flags: live_query_disabled -> live_reporting_disabled and
query_reports_disabled -> discard_reports_data. Changes applied to:
it-and-security/default.yml, and fleet files in it-and-security/fleets
(company-owned-mobile-devices.yml, personal-mobile-devices.yml,
servers.yml, testing-and-qa.yml, unassigned.yml, workstations.yml) to
unify naming and align with cross-platform config schema.
Add detection and remediation for Santa's Endpoint Security system
extension: new policy
it-and-security/lib/macos/policies/santa-endpoint-security-extension-active.yml
and remediation script
it-and-security/lib/macos/scripts/load-santa-system-extension.sh. Add a
dynamic label for Macs with Santa installed and update the macOS patch
policy to include a Fleet-maintained santa/darwin entry so Fleet can
install/patch Santa. Update workstations fleet config to reference the
new script, policy, and the santa/darwin software slug; remove the old
static santa.yml package file. The policy checks for Santa's bundle id
and the system_extensions record (identifier/team/state) and the script
invokes Santa's binary to request loading the system extension as the
console user.
Comment out the nudge-installed policy in
it-and-security/fleets/workstations.yml and set install_software: true
for the Nudge fleet-maintained app in
it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml. This
ensures Fleet will automatically install/patch Nudge on matching Macs
(using the existing install-nudge-assets policy) rather than relying on
the nudge-installed enforcement entry.
Uncomment 1Password entries in workstations.yml so 1Password is managed
as a fleet_maintained_app for both macOS and Windows. Commented out the
separate Windows 1Password installed policy path and enabled the
corresponding patch checks in
macos/windows/patch-fleet-maintained-apps.yml to surface/update
out-of-date 1Password installations.
Comment out 1Password fleet-maintained app entries and related
install/patch policies for macOS and Windows. Updates remove/disable the
fleet_maintained_app references in
it-and-security/fleets/workstations.yml and comment out install_software
and patch entries in the macOS and Windows policy files to temporarily
stop automatic installation and patch enforcement for 1Password.
Temporarily disable 1Password-related Fleet checks and app entry.
workstations.yml: commented out the macOS policies
1password-emergency-kit-check.yml and 1password-installed.yml and the
fleet_maintained_apps entry for 1password/darwin.
lib/macos/policies/patch-fleet-maintained-apps.yml: commented out the
patch rule for 1password/darwin. This stops 1Password health checks and
automatic patching until re-enabled.
Replace ad-hoc 1Password update flow with fleet_maintained app handling:
remove the macOS updater script and platform-specific update policy
files; switch install_software refs in macOS/Windows 1Password policies
to fleet_maintained_app_slug; add fleet_maintained_apps entries for
1Password in the workstation fleet manifest; add dynamic labels and
patch policies to track/upkeep 1Password on macOS and Windows. Also
remove references to the removed update step from the dogfood CI
workflow and simplify PR title/branch generation logic accordingly.
Replace the previous manual Nudge install flow with fleet-managed
configuration: add policies and label entries for Nudge, add an
assets-only policy, and add a fleet_maintained software slug. Updated
it-and-security/fleets/workstations.yml to reference
nudge-installed.yml, install-nudge-assets.yml and the new nudge/darwin
software slug (moved from the old nudge software entry). Added label for
Macs with Nudge installed (bundle id com.github.macadmins.Nudge). Added
policy it-and-security/lib/macos/policies/install-nudge-assets.yml and
it-and-security/lib/macos/policies/nudge-installed.yml, and added a
patch policy entry to patch-fleet-maintained-apps.yml for keeping Nudge
up to date. Removed the legacy combined install-nudge.yml policy and the
install-nudge.sh script since installation is now handled via the
fleet-maintained app.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated Cursor (macOS and Windows) to version 3.2.10
* Updated Draw.io Desktop (macOS) to version 29.7.9
* Updated Zen Browser (macOS) to version 1.19.9b
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: mostlikelee <16102903+mostlikelee@users.noreply.github.com>
updated the word "calendar" which was spelled incorrectly.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
## Summary
- Adds the missing "Ingesting custom ADMX templates (ADMXInstall)"
section to the Windows CSP guide
- Covers the full workflow: download ADMX template → ingest via
ADMXInstall URI → configure policies using the ingested definitions
- Includes practical examples using Microsoft Edge as the reference app
- Explains the `{AppName}~Policy~{CategoryPath}/{PolicyName}` LocURI
format
- Shows how to combine ingestion and policy configuration in a single
Fleet profile
- Adds tips for finding category paths and understanding registry key
restrictions
- Fixes a typo (LocURL → LocURI)
The existing guide at line 22 promised to cover ADMXInstall "further on
in this guide" but never delivered. This was called out as a pain point
by a customer who struggled to configure Edge policies via ADMX
ingestion because the documentation gap left them without guidance.
Note: related to customer feedback from a recent call
## Testing
Documentation-only change — no code impact. Verified XML examples are
syntactically correct and consistent with [Microsoft's ADMX ingestion
documentation](https://learn.microsoft.com/en-us/windows/client-management/win32-and-centennial-app-policy-configuration).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#44071
Verified fix in loadtest.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed a race condition that could cause hosts to silently revert to a
previous team after an admin team transfer.
* Improved reliability of team-transfer handling to prevent unexpected
reversion during certificate/template transfers and device/profile
operations.
* **Tests**
* Added regression tests to ensure team assignments persist correctly
across host refreshes and related workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Changes:
- Unpublished a case study (I will be reopening a Draft PR to add it)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Style**
* Updated styling for case study quote author images
* **Chores**
* Removed Proton case study from customer stories navigation menu and
featured stories section on the customers page
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add Proton case study for review
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Proton as a featured customer with a case study card on the
customers page, including logo, summary blurb, and link to the full
story.
* Added Proton to the "More customer stories" sidebar for easy
navigation to their case study.
* **Style**
* Case-study author images now render as circular avatars.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
workshop template update
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated provisioning for marketing workshops that creates
GitHub project structures with parent overview issues, child issues from
templates, workshop labels, and organizes artifacts in a centralized
project with team member assignments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: johnjeremiah <jjeremiah@gmail.com>
Quality of life improvements when testing unmerged changes in osquery
(bundled in fleetd using local TUF).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a build target that fetches a Linux osqueryd executable for a
specified pull request and architecture, validates the downloaded
artifact, extracts and verifies the binary, and installs a runnable
osqueryd into a user-specified output directory. The target reports
clear errors when inputs are missing or when retrieval/validation fails.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38785
This feature has been pushed to 4.86
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Setup Experience Updates**
* Windows: Automatic cancellation of pending setup steps when required
software installation fails has been removed from the device setup
experience
* macOS: Device setup experience behavior remains unchanged, continuing
to enforce software requirements during enrollment
* Behavior is now platform-specific to align with individual operating
system requirements
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Ease testing locally built osquery on macOS (bundled with fleetd).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for packaging locally built osqueryd binaries into
osquery.app tarballs on macOS with automatic validation and cleanup.
* **Improvements**
* Enhanced PR artifact download workflow for improved artifact
retrieval.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#44127
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed the unused Windows Updates feature: ingestion, parsing,
persistence APIs, and detail query; added a migration to drop the
related database table.
* **Tests**
* Removed unit and integration tests for Windows update parsing,
ingestion, persistence, and query inclusion.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** For #40171
# Details
Adds audit activity when enabling or disabling GitOps exceptions.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
n/a, unreleased
## Testing
- [X] Added/updated automated tests
- [X] QA'd all new/changed functionality manually
<img width="714" height="699" alt="image"
src="https://github.com/user-attachments/assets/161bd084-347b-4cde-893e-9b385f13872c"
/>
For unreleased bug fixes in a release candidate, one of:
- [X] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Activity feed now records when GitOps exceptions (labels, software,
secrets) are enabled or disabled.
* **UI**
* Activity messages show which specific exception was enabled or
disabled.
* **Tests**
* Added unit and integration tests verifying generation and rendering of
enable/disable exception activities, including single and multiple flips
and no-op updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: sgress454 <553428+sgress454@users.noreply.github.com>
Co-authored-by: Luke Heath <luke@fleetdm.com>
Changes:
- Removed a logo from the logo carousel and added missing logos to the
bottom row of logos on the /customers page, and increased the animation
duration.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Logo carousel updated with new partner logos and reconfigured
ordering: SandboxAQ, Webflow, Abridge, Coinbase, Smarter Technologies,
Treeline, and Grafana Labs.
* **Style**
* Carousel scrolling duration increased for a smoother, more leisurely
horizontal animation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42545
This rework does not significantly improve the worst case performance,
but it does improve some cases (like lower number of hosts with a lot of
profiles).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Performance Improvements**
* Improved batch deletion for Windows MDM configuration profiles to
handle very large-scale cleanup with fewer database updates.
* Replaced per-profile update loops with multi-profile batched updates
to reduce update overhead and improve determinism.
* **Tests**
* Added tests validating multi-profile batch delete behavior and
ensuring each queued delete command is correctly targeted.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
