docs: changelog entries for the wave 3 refactors (#209)

CHANGELOG.md

@@ -9,14 +9,22 @@ and this project adheres to [Conventional Commits](https://www.conventionalcommi
 
 ### Added
 
+- `Get-PveFirewallRule`, `New-PveFirewallRule`, `Set-PveFirewallRule` and `Remove-PveFirewallRule` accept `-Level Group -Group <name>` to manage the rules of a firewall security group; the `FirewallService` methods for group rules existed with no cmdlet surface, so a group created with `New-PveFirewallGroup` could not be given rules from PowerShell. (#126)
 - `New-PveNetwork` and `Set-PveNetwork` gained `-BridgeVlanAware`, so a VLAN-aware Linux bridge can be created and toggled from the module instead of only being read back. The model already surfaced `bridge_vlan_aware` as `BridgeVlanAware`, so this closed a write-path gap. On `Set-PveNetwork` the switch is only sent when explicitly bound, so an update that omits it leaves the flag alone. Clearing it goes through the endpoint's `delete` list rather than `bridge_vlan_aware=0`: PVE merges supplied keys onto the stored stanza and accepts the `0` without acting on it, so the obvious form is a silent no-op — confirmed against a live PVE 9 cluster, where the bridge stayed VLAN-aware. `bridge_vids` is not covered; it is an independent parameter and PVE defaults to 2-4094. (#92)
 
 ### Changed
 
+- Every API call opened a fresh TLS connection: `PveHttpClient` now shares one pooled transport per host, port and certificate-check setting for the life of the process, and `Wait-PveTask` and every `-Wait` cmdlet poll over one connection, backing off from 1 s toward a 10 s cap instead of a new handshake every 2 s. An explicit `-PollInterval` is still honoured as a fixed interval. (#151)
+- The 31 cmdlets that built their own HTTP request now send it through their `*Service`, so the path and payload each emits is asserted by offline tests: `New-`/`Remove-`/`Restore-PveSnapshot`; `Get-PveNode` and `Get-PveNodeStatus`; `Get-PveUser`, `Get-PveRole`, `New-PveRole` and `Set-PvePermission`; `New-PveContainer` and its three snapshot cmdlets; `Get-PveCloudInitConfig` and `Get-PveTemplate`; `Get`/`New`/`Set`/`Remove-PveNetwork`, `Invoke-PveNetworkApply`, `Get`/`New-PveSdnZone`, `Get`/`New-PveSdnVnet`, `Get`/`New-PveSdnSubnet` and `Remove-PveSdnSubnet`; `New-PveStorage`, `Invoke-PveStorageDownload` and `Send-PveFile`. Where a service and its cmdlet disagreed, the shipped cmdlet behaviour won: an unset switch is omitted rather than sent as `0` (`New-PveSnapshot -IncludeVmState`, `Set-PvePermission -Propagate`), and a task returned without `-Wait` reports `Status = "running"`. `New-PveSdnZone`, `New-PveSdnVnet`, `New-PveSdnSubnet` and `Remove-PveSdnSubnet` now validate their `Vnet`/`Zone` identifiers against the same pattern the other SDN cmdlets use. (#126)
+- Removed the eight duplicated task-response parsers in favour of one shared one, so every cmdlet that returns a task without `-Wait` reports `Status = "running"` where several (`New-PveVm`, the VM lifecycle cmdlets, `Copy-PveVm`, `Move-PveVm`, `Resize-PveVmDisk`, `Import-PveVmDisk`, `New-PveBackup`, `Start`/`Stop-PveNodeAll`, `New-PveTemplate`, and the container lifecycle cmdlets) left it blank. Removed the unused `PveAuthenticationException`, the `Put`/`Delete` sync wrappers on `PveHttpClient` and the duplicate `ClusterConfigService.GetClusterStatus`; the firewall cmdlets validate `-Level`/`-Node`/`-VmId`/`-Group` through one shared check instead of 18 copies, with messages and error categories unchanged; the three hand-rolled version warnings go through `PveCmdletBase.WarnIfBelowVersion`; and the offline suite lost 126 tests that asserted a null-session guard only `null!` in a test could reach. (#154)
+- The offline Pester suite can now fail: `Skip-IfMissing`, which skipped a test whenever the cmdlet it was about was missing, is gone; one manifest test diffs `CmdletsToExport` against the built module in both directions and checks the per-cmdlet conventions by reflection, replacing 894 tests that restated `[Cmdlet]` and `[Parameter]` attributes. The help was regenerated for the 25 cmdlets (the HA and Cluster families) that shipped without any. (#153)
 - `Newtonsoft.Json` is now 13.0.4 in both shipped assemblies, with every package version managed centrally in `Directory.Packages.props` so the two can no longer drift; the SDK is pinned by `global.json` (10.0, latest feature band) and the net48 test build no longer emits the `System.Memory` MSB3277 conflict. (#156)
 
 ### Fixed
 
+- `Send-PveFile -ContentType vztmpl` and `-ContentType import` uploaded as `iso`; the content type is now sent as given. `Invoke-PveStorageDownload -TimeoutSeconds` keeps applying to the download request. (#126)
+- `Get-PveTemplate` warns for each node skipped because it was unreachable instead of silently returning a shorter list, and an empty `-Node` again means all nodes. (#126)
+- A connection dropped while the response body was being read escaped `PveHttpClient` as a raw `HttpRequestException` instead of a `PveApiException`; the body read is now inside the same guard as the request. (#154)
 - `Copy-PveVm` and `Copy-PveContainer` now allocate a valid guest ID through `cluster/nextid` when `-NewVmId` is omitted, instead of sending `newid=0`, which PVE rejects. Both cmdlets now forward `-Storage` to the clone request; it was declared and silently dropped, so a full clone always landed on the source storage. `New-PveVm` and `Import-PveOva` use the same service call for their ID allocation, so a response without `data` is a clear error rather than a `NullReferenceException`. (#135)
 - `Import-PveOva` no longer throws an unhandled `InvalidOperationException` when the created VM is not yet listed on the node (the disk import still running without `-Wait`); it returns the basic VM record instead, as the cmdlet always intended. Its upload no longer runs under the session's 100-second timeout, so an OVA that takes longer to transfer completes; `-TimeoutSeconds` was added (default 30 minutes, `0` for none), mirroring `Send-PveFile`. (#139)
 - `Wait-PveTask` polls through `TaskService.WaitForTask` like every other `-Wait` path, so it clamps the poll interval to one second, checks the task before sleeping, and no longer overflows on intervals over 24 days. An omitted `-Timeout` still waits indefinitely. (#140)

tests/PSProxmoxVE.Core.Tests/Fixtures/pve8_version.json

@@ -1 +0,0 @@
-{"data":{"version":"8.3-2","release":"8.3","repoid":"12345678","console":"xtermjs","keyboard":"en-us"}}

tests/PSProxmoxVE.Core.Tests/Fixtures/pve9_ticket_response.json

@@ -1 +0,0 @@
-{"data":{"username":"root@pam","ticket":"PVE:root@pam:65F00000::abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890","CSRFPreventionToken":"65F00000:abcdef1234567890abcdef12"}}

tests/PSProxmoxVE.Core.Tests/Fixtures/pve9_version.json

@@ -1 +0,0 @@
-{"data":{"version":"9.1-1","release":"9.1","repoid":"abcdef12","console":"xtermjs","keyboard":"en-us"}}

tests/PSProxmoxVE.Core.Tests/Fixtures/pve_api_error.json

@@ -1 +0,0 @@
-{"errors":{"vmid":"property is missing and it is not optional"},"data":null}