chore: merge main into the p3 fixes

tests/test_install_experience.py

@@ -743,8 +743,11 @@ class ARefusalTheProbeDoesNotRaise(unittest.TestCase):
         install._DETECTION_REFUSED.clear()
         self.addCleanup(install._DETECTION_REFUSED.clear)
         quiet = mock.patch.object(install.Path, "exists", lambda self: False)
-        with quiet, mock.patch.object(install._SETUP_SEARCH, "active", True, create=True), \
-                contextlib.redirect_stderr(io.StringIO()):
+        # What _detection_guarded sets while it looks for setups.
+        outer = getattr(install._SETUP_SEARCH, "active", False)
+        install._SETUP_SEARCH.active = True
+        self.addCleanup(setattr, install._SETUP_SEARCH, "active", outer)
+        with quiet, contextlib.redirect_stderr(io.StringIO()):
             self.assertFalse(install._exists(target))
             self.assertFalse(install._exists(base / "absent"))
             self.assertEqual(install.closed_folder(target), (closed, "Permission denied"))

tests/test_profile_sync.py

@@ -4599,6 +4599,18 @@ class TestRateLimitEndsOneProfile(unittest.TestCase):
         self.assertEqual(by_name["after"]["needs_review"], 1)
 
 
+class FreshRefusesOffline(unittest.TestCase):
+    def test_the_pair_is_refused(self):
+        saved = sys.argv
+        try:
+            sys.argv = ["profile_sync.py", "--all", "--fresh", "--offline"]
+            with contextlib.redirect_stderr(io.StringIO()), self.assertRaises(SystemExit) as caught:
+                profile_sync.main()
+        finally:
+            sys.argv = saved
+        self.assertEqual(caught.exception.code, 1)
+
+
 class TestOutputModesApplyTheirFlags(unittest.TestCase):
     """--changed-only narrows --json too. Extras are refused off the text report."""