mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-24 04:33:17 +00:00
Cut 6.5 and later releases from main (#2468)
Releases are cut from the head of main since 2 October, but three things still made every release need hand edits before it could pass: - the control plane routed 6.5.x to the abandoned `release/v6.5` line; - main lacked the published 6.4.4 to 6.4.6 release packets, so rollback derivation on main still found 6.4.1; - the packet tests pinned prose from old 6.4.x notes (named highlights, issue numbers, one release's mobile decision) and per-release sentences in the deployment-installability contract, which changes several times a day on main. This maps 6.5 to main, carries the published packets over from `release/v6.4`, and keeps the packet tests to what the release tooling generates: version pins, packet pointers, required sections, and the rollback, signing and mobile sentences. Checked by preparing 6.5.0-rc.1 and then 6.5.0 on top of this branch with the release metadata tool: static checks and `go test ./scripts/installtests` pass for both.
This commit is contained in:
rcourtman
@@ -37,11 +37,6 @@
|
||||
"version_prefix": "6.4.6",
|
||||
"prerelease_branch": "release/v6.4",
|
||||
"stable_branch": "release/v6.4"
|
||||
},
|
||||
{
|
||||
"version_prefix": "6.5.",
|
||||
"prerelease_branch": "release/v6.5",
|
||||
"stable_branch": "release/v6.5"
|
||||
}
|
||||
],
|
||||
"profiles": [
|
||||
|
||||
@@ -0,0 +1,148 @@
|
||||
# Pulse v6.4.4-beta.1 Release Notes
|
||||
|
||||
This beta is a bounded alert-reliability checkpoint for Preview-channel
|
||||
testers. It supersedes `v6.4.3-rc.1`, carries every change from the `v6.4.2`
|
||||
packet that was tagged but never published, and adds integrated fixes for
|
||||
notification finality, delivery-warning ordering, restart-safe alert state,
|
||||
provider edge cases, notification-log confidentiality, discovery refreshes,
|
||||
host telemetry, update reporting, reconnect behavior, and accessibility. It is
|
||||
not an RC or stable release.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Resolved alerts stay resolved** - Pending, failed, and dead-lettered firing
|
||||
notifications cannot be revived by a later retry after the incident resolves.
|
||||
Disabled destinations are cancelled instead of being reported as delivered.
|
||||
- **Delivery warnings show the newest truth** - Concurrent timer, retry,
|
||||
dismissal, and refresh work can no longer let an older healthy snapshot hide
|
||||
a newer delivery failure or resurrect a warning that was just cleared.
|
||||
- **Delivery diagnosis is more actionable** - Failure status and reason
|
||||
ordering remain current after retries and refreshes, unavailable queue health
|
||||
is visible, and operators are directed to the affected notification settings.
|
||||
- **Notification diagnostics keep credentials private** - Webhook userinfo,
|
||||
Slack and Discord paths, Telegram bot tokens, encoded query credentials, and
|
||||
ntfy transport URLs are masked while useful status and destination context is
|
||||
retained.
|
||||
- **Recovery requires real observations** - Storage and PBS incidents do not
|
||||
clear merely because a metric or provider sample is absent. Incident identity
|
||||
and history survive configuration reloads and restarts until measured recovery.
|
||||
- **Provider alert semantics are more accurate** - TrueNAS CORE 12 endpoints
|
||||
are accepted, completed replication is recognised, informational events stay
|
||||
out of acknowledgement work, NOTICE events remain actionable, and critical
|
||||
transitions can notify correctly.
|
||||
- **PBS behavior is restart-safe** - Capacity, task, partial-metric, and webhook
|
||||
paths remain bound to actual observations across restart and recurrence.
|
||||
- **Host telemetry is more dependable** - Host and Docker CPU collectors use
|
||||
separate sampling baselines, disk collection follows the agent mount
|
||||
namespace, and pool-only or empty Unraid layouts no longer manufacture parity
|
||||
warnings.
|
||||
- **Updates fail more truthfully** - Docker updates require independent success
|
||||
evidence, oversized GitHub release metadata falls back to verified assets,
|
||||
and portable installer state retains correct ownership.
|
||||
- **Identity and reconnect behavior is safer** - Same-name systems stay
|
||||
separate across Proxmox providers, delayed browser startup offers a truthful
|
||||
retry path, and infrastructure edits stay mounted during background polling.
|
||||
- **Discovery repairs stay repaired** - Availability-suggestion backfill no
|
||||
longer writes an old discovery snapshot over a concurrent manual refresh,
|
||||
drops the repaired URL or engine version, or resurrects a deleted record.
|
||||
- **Navigation and settings are more accessible** - The skip link is first in
|
||||
keyboard order, badges remain readable, landmarks are distinct, and settings,
|
||||
Patrol, mobile navigation, and compact controls have stronger focus and
|
||||
screen-reader behavior.
|
||||
- **Current OpenAI models are handled correctly** - GPT-5-family requests use
|
||||
the supported completion-token parameter and can learn the required parameter
|
||||
from bounded API responses.
|
||||
- **The RC1 foundation remains included** - Windows agent delivery is restored,
|
||||
Large Availability estates scan faster, Slow starts are recoverable, and Disk
|
||||
I/O totals are more accurate. Resource identity, safer agent lifecycle
|
||||
operations, canonical health APIs, bounded privileged actions, and response
|
||||
size limits also remain in this checkpoint.
|
||||
|
||||
## What to test
|
||||
|
||||
- Exercise a threshold alert through firing, a missing observation, Pulse
|
||||
restart, genuine recovery, and recurrence. Confirm only the appropriate
|
||||
firing and recovery notifications arrive.
|
||||
- On a backed-up installation with retained delivery failures, try both **Retry
|
||||
retained deliveries** and **Dismiss retained failures**. Confirm each request
|
||||
succeeds without deleting queue or alert files, delivery history remains, and
|
||||
the warning reconciles promptly even while another health refresh is in flight.
|
||||
If either action fails, report the HTTP status and sanitized logs.
|
||||
- Retest PBS capacity and task transitions, TrueNAS replication and NOTICE
|
||||
events, host plus Docker CPU readings, and pool-only Unraid arrays.
|
||||
- Run a manual service-discovery refresh while availability suggestions are
|
||||
being backfilled. Confirm a repaired service keeps its type, name, URL, and
|
||||
engine version after restart, and inspect sanitized notification failures to
|
||||
confirm secrets are absent while the error remains actionable.
|
||||
- Upgrade a backed-up `v6.4.1` installation, including Docker behind a reverse
|
||||
proxy, and verify direct GUI access, proxied access, WebSocket reconnect, and
|
||||
`/api/version`.
|
||||
- On high-request-rate installations, compare API latency and CPU with your
|
||||
previous pin and report any material change.
|
||||
|
||||
## Known issues and beta limits
|
||||
|
||||
- Open issue [#1761](https://github.com/rcourtman/Pulse/issues/1761) has a
|
||||
7 September report from stable `v6.4.1` where both retained-failure actions
|
||||
returned HTTP 503 after CSRF validation. This candidate has integrated source
|
||||
repairs and tests around queue finality and warning reconciliation, but it has
|
||||
not been tested on that reporter's installation and is not claimed to fix the
|
||||
503. Do not delete `notification_queue.db` or alert files as a workaround; keep
|
||||
the stable rollback pin and report sanitized action results.
|
||||
- A 7 September comment on [#1812](https://github.com/rcourtman/Pulse/issues/1812)
|
||||
shows that a `v6.4.1` user could see a retained-delivery warning but could not
|
||||
find its recovery controls or delivery-attempt details from the incident
|
||||
timeline. This candidate includes the Overview controls and Notifications
|
||||
activity view, but installed discoverability is not yet verified. The broader
|
||||
task-timeline and orchestration requests are not part of this checkpoint.
|
||||
- Open issue [#1966](https://github.com/rcourtman/Pulse/issues/1966) reports
|
||||
50-66 GB/day of Pulse process writes on one idle `v6.4.1` LXC, plus repeated
|
||||
incident IDs sharing one occurrence start. This beta contains alert-lifecycle
|
||||
repairs but does not claim reduced aggregate write bytes, migration of old
|
||||
duplicates, or resolution on that installation. On flash-constrained test
|
||||
systems, monitor Pulse write volume and keep the stable rollback pin ready.
|
||||
- An advisory paired CI comparison measured UUID route-segment normalization at
|
||||
62.50 ns/op versus 51.64 ns/op, a 21.04% increase with no allocations. Local
|
||||
comparisons measured roughly 9-11%, and no end-user latency or throughput
|
||||
regression has been demonstrated. The integrated candidate-only benchmark
|
||||
passed, but that does not erase the paired result. This uncertainty is
|
||||
accepted for beta observation only and must be resolved or dispositioned
|
||||
again before RC.
|
||||
- Permanent SMTP authentication, configuration, or rejection errors can still
|
||||
consume the existing inner retry budget before queue handling, causing
|
||||
avoidable delay. This beta improves diagnosis and queue finality but does not
|
||||
include the separate main-line retry-classification repair.
|
||||
- Open issue [#1913](https://github.com/rcourtman/Pulse/issues/1913) reports an
|
||||
inaccessible GUI after changing a Docker deployment from v5.1.35 to stable
|
||||
v6.4.1. It does not yet distinguish direct access, published ports,
|
||||
reverse-proxy behavior, WebSocket routing, or exact running image identity.
|
||||
Keep the prior image pin available and include those details when reporting
|
||||
results.
|
||||
- Pulse Mobile does not require a companion mobile release. This server beta
|
||||
does not change Relay pairing, native push payload fields, approvals, or
|
||||
onboarding contracts. Ordinary off-LAN receipt, terminated-process replay,
|
||||
Doze, expiry, and failed-WAN cases are not claimed as qualified by this beta.
|
||||
- Historical notification rows are not rewritten or blindly replayed. The
|
||||
fixes govern new processing and operator retries.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This is an opt-in Preview-channel beta, not a stable release. Back up the
|
||||
Pulse data directory and keep the stable rollback pin available.
|
||||
- The `v6.4.2` tag was never accompanied by a GitHub release and was not
|
||||
shipped. This beta carries that packet's administrator-boundary and security
|
||||
changes together with the published rc.1 and subsequent alert fixes. The
|
||||
preceding published stable release remains `v6.4.1`.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in
|
||||
`admin` role before upgrading so an intended administrator retains access.
|
||||
- For least-privilege rootless Docker or Podman monitoring, expose exactly one
|
||||
local collector-owned runtime socket. Ambiguous or invalid sockets may fall
|
||||
back to summary-only monitoring.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath
|
||||
remains unavailable and may show an Unknown Publisher warning. Verify
|
||||
downloads with published checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`. For systemd and Proxmox LXC, run
|
||||
`sudo /bin/update --version v6.4.1`. For Docker Compose, pin
|
||||
`rcourtman/pulse:6.4.1` and recreate the container. For Helm, run
|
||||
`helm upgrade --install pulse oci://ghcr.io/rcourtman/pulse-chart/pulse
|
||||
--version 6.4.1` with the values used by the current installation.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "No screenshots are proposed because the release-critical changes concern ordering, restart persistence, retry finality, credential masking, concurrent discovery state, missing-observation handling, and accessibility semantics. Static images cannot demonstrate those outcomes, and delivery-warning styling is not materially changed.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,174 @@
|
||||
# Pulse v6.4.4-beta.2 Release Notes
|
||||
|
||||
This second beta is a bounded alert-history and delivery-recovery checkpoint
|
||||
for Preview-channel testers. It supersedes `v6.4.4-beta.1`, carries every
|
||||
change from the `v6.4.2` packet that was tagged but never published, adds exact
|
||||
occurrence boundaries for delayed lifecycle replay, and keeps retained-delivery
|
||||
controls connected to the active notification queue after a runtime reload. It
|
||||
also isolates cold tenant-store startup from unrelated API requests. It is not
|
||||
an RC or stable release.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Recurring incidents keep their own history** - Delayed firing,
|
||||
resolution, or acknowledgement replay for an older occurrence cannot reopen
|
||||
it, close a newer recurrence, or merge both occurrences into one timeline.
|
||||
- **Resolved alerts stay resolved** - Pending, failed, and dead-lettered firing
|
||||
notifications cannot be revived by a later retry after the incident resolves.
|
||||
Disabled destinations are cancelled instead of being reported as delivered.
|
||||
- **Retained-delivery recovery survives reloads** - Queue statistics,
|
||||
dead-letter details, **Retry retained deliveries**, and **Dismiss retained
|
||||
failures** now follow the active notification queue instead of keeping a
|
||||
stopped queue that returns HTTP 503.
|
||||
- **Webhook retries keep safe pacing** - A response-specific `Retry-After: 0`
|
||||
can permit one immediate retry without erasing the exponential delay for later
|
||||
unhinted 429 or 503 responses.
|
||||
- **Delivery warnings show the newest truth** - Concurrent timer, retry,
|
||||
dismissal, and refresh work can no longer let an older healthy snapshot hide
|
||||
a newer delivery failure or resurrect a warning that was just cleared.
|
||||
- **Delivery diagnosis is more actionable** - Failure status and reason
|
||||
ordering remain current after retries and refreshes, unavailable queue health
|
||||
is visible, and operators are directed to the affected notification settings.
|
||||
- **Notification diagnostics keep credentials private** - Webhook userinfo,
|
||||
Slack and Discord paths, Telegram bot tokens, encoded query credentials, and
|
||||
ntfy transport URLs are masked while useful status and destination context is
|
||||
retained.
|
||||
- **Cold tenants no longer stall unrelated API traffic** - Resource-store
|
||||
construction now runs outside the shared cache lock while same-tenant opens
|
||||
remain deduplicated and eviction waits safely for in-flight construction.
|
||||
- **Recovery requires real observations** - Storage and PBS incidents do not
|
||||
clear merely because a metric or provider sample is absent. Incident identity
|
||||
and history survive configuration reloads and restarts until measured recovery.
|
||||
- **Provider alert semantics are more accurate** - TrueNAS CORE 12 endpoints
|
||||
are accepted, completed replication is recognised, informational events stay
|
||||
out of acknowledgement work, NOTICE events remain actionable, and critical
|
||||
transitions can notify correctly.
|
||||
- **PBS behavior is restart-safe** - Capacity, task, partial-metric, and webhook
|
||||
paths remain bound to actual observations across restart and recurrence.
|
||||
- **Host telemetry is more dependable** - Host and Docker CPU collectors use
|
||||
separate sampling baselines, disk collection follows the agent mount
|
||||
namespace, and pool-only or empty Unraid layouts no longer manufacture parity
|
||||
warnings.
|
||||
- **Updates fail more truthfully** - Docker updates require independent success
|
||||
evidence, oversized GitHub release metadata falls back to verified assets,
|
||||
and portable installer state retains correct ownership.
|
||||
- **Identity and reconnect behavior is safer** - Same-name systems stay
|
||||
separate across Proxmox providers, delayed browser startup offers a truthful
|
||||
retry path, and infrastructure edits stay mounted during background polling.
|
||||
- **Discovery repairs stay repaired** - Availability-suggestion backfill no
|
||||
longer writes an old discovery snapshot over a concurrent manual refresh,
|
||||
drops the repaired URL or engine version, or resurrects a deleted record.
|
||||
- **Navigation and settings are more accessible** - The skip link is first in
|
||||
keyboard order, badges remain readable, landmarks are distinct, and settings,
|
||||
Patrol, mobile navigation, and compact controls have stronger focus and
|
||||
screen-reader behavior.
|
||||
- **Current OpenAI models are handled correctly** - GPT-5-family requests use
|
||||
the supported completion-token parameter and can learn the required parameter
|
||||
from bounded API responses.
|
||||
- **The RC1 reliability fixes remain included** - Windows agent delivery is
|
||||
restored, Large Availability estates scan faster, Slow starts are recoverable,
|
||||
and Disk I/O totals are more accurate.
|
||||
- **The safer operational foundation remains included** - Resource identity,
|
||||
safer agent lifecycle operations, canonical health APIs, bounded privileged
|
||||
actions, and response size limits remain in this checkpoint.
|
||||
|
||||
## Known issues
|
||||
|
||||
- The recurring-occurrence repair has focused race-enabled and protected-line
|
||||
CI evidence, but has not yet been verified on an installed beta through a
|
||||
restart and ordinary notification destination.
|
||||
- Open issue [#1761](https://github.com/rcourtman/Pulse/issues/1761) reports
|
||||
HTTP 503 from both retained-failure actions on stable `v6.4.1` while alert
|
||||
emails continued.
|
||||
- This beta repairs the reproduced stopped-queue ownership path with focused
|
||||
race-enabled tests and protected-line CI, but the reporter has not tested it.
|
||||
Do not delete queue or alert files as a workaround.
|
||||
- A 7 September comment on [#1812](https://github.com/rcourtman/Pulse/issues/1812)
|
||||
says a `v6.4.1` user saw a retained-delivery warning but could not find recovery
|
||||
controls or delivery-attempt details from the incident timeline.
|
||||
- This beta includes Overview controls and the Notifications activity view, but
|
||||
installed discoverability is unverified. Broader task-timeline and orchestration
|
||||
requests are outside this checkpoint.
|
||||
- Open issue [#1966](https://github.com/rcourtman/Pulse/issues/1966) reports
|
||||
50-66 GB/day of Pulse process writes on one idle `v6.4.1` LXC and repeated
|
||||
incident IDs sharing one occurrence start.
|
||||
- This beta has alert-lifecycle repairs but does not claim reduced aggregate
|
||||
writes, migration of old duplicates, or resolution on that installation. On
|
||||
flash-constrained systems, monitor write volume and keep the rollback pin ready.
|
||||
- An advisory paired comparison measured the metrics-store statistics handler
|
||||
at 94.42 µs/op versus 81.86 µs/op, a 15.35% increase. The benchmarked
|
||||
handler was not changed by the tenant-isolation repair.
|
||||
- No end-user latency or throughput regression is demonstrated. The absolute
|
||||
increase and its relationship to real workloads remain uncertain, so this is
|
||||
accepted for beta observation and needs a new disposition before RC.
|
||||
- Permanent SMTP authentication, configuration, or rejection errors can still
|
||||
consume the inner retry budget before queue handling. This beta improves
|
||||
diagnosis and finality but excludes the separate main-line classification fix.
|
||||
- Open issue [#1913](https://github.com/rcourtman/Pulse/issues/1913) reports
|
||||
an inaccessible GUI after changing a Docker deployment from v5.1.35 to stable
|
||||
v6.4.1.
|
||||
- The report does not yet separate direct access, published ports, reverse-proxy
|
||||
behavior, WebSocket routing, or running image identity. Keep the prior image
|
||||
pin available and include those details when reporting results.
|
||||
- This server beta does not require a companion mobile release. It does
|
||||
not change Relay pairing, native push payloads, approvals, or onboarding.
|
||||
- Ordinary off-LAN receipt, terminated-process replay, Doze, expiry, and
|
||||
failed-WAN cases are not claimed as qualified by this beta.
|
||||
- Historical notification rows are not rewritten or blindly replayed. The
|
||||
fixes govern new processing and operator retries.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This is an opt-in Preview-channel beta, not a stable release. Back up the
|
||||
Pulse data directory and keep the stable rollback pin available.
|
||||
- The `v6.4.2` tag had no GitHub release and was not shipped. This beta
|
||||
carries its administrator-boundary and security changes with published rc.1
|
||||
and later alert fixes. The preceding stable release remains `v6.4.1`.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in
|
||||
`admin` role before upgrading so an intended administrator retains access.
|
||||
- For least-privilege rootless Docker or Podman monitoring, expose exactly one
|
||||
local collector-owned runtime socket. Ambiguous or invalid sockets may fall
|
||||
back to summary-only monitoring.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath
|
||||
remains unavailable and may show an Unknown Publisher warning. Verify
|
||||
downloads with published checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`. For systemd and Proxmox LXC, run
|
||||
`sudo /bin/update --version v6.4.1`.
|
||||
- For Docker Compose rollback, pin `rcourtman/pulse:6.4.1` and recreate the
|
||||
container.
|
||||
- For Helm rollback, run `helm upgrade --install pulse
|
||||
oci://ghcr.io/rcourtman/pulse-chart/pulse --version 6.4.1` with the values
|
||||
used by the current installation.
|
||||
|
||||
After upgrading, please test:
|
||||
|
||||
- Trigger, resolve, and then retrigger the same alert. Restart Pulse or replay
|
||||
retained lifecycle work between transitions. Confirm the old occurrence stays
|
||||
resolved with its own acknowledgement history while the recurrence remains a
|
||||
separate current incident.
|
||||
- Exercise a threshold alert through firing, a missing observation, Pulse
|
||||
restart, genuine recovery, and recurrence. Confirm only the appropriate
|
||||
firing and recovery notifications arrive.
|
||||
- With a controlled webhook destination, return `Retry-After: 0` once and then
|
||||
an unhinted 429 or 503. Confirm the immediate override applies only once and
|
||||
the next retry resumes exponential pacing instead of hammering the endpoint.
|
||||
- On a backed-up installation with retained delivery failures, try **Retry
|
||||
retained deliveries** and **Dismiss retained failures**. Confirm each succeeds
|
||||
without deleting queue or alert files and delivery history remains.
|
||||
- Reload notification configuration or exercise a normal runtime restart before
|
||||
inspecting queue statistics, dead-letter details, Retry, and Dismiss. Confirm
|
||||
each operation follows the active queue rather than returning HTTP 503.
|
||||
- Confirm the retained-delivery warning reconciles while another health refresh
|
||||
is in flight. If either action fails, report the HTTP status and sanitized logs.
|
||||
- Retest PBS capacity and task transitions, TrueNAS replication and NOTICE
|
||||
events, host plus Docker CPU readings, and pool-only Unraid arrays.
|
||||
- Run a manual service-discovery refresh while availability suggestions are
|
||||
backfilled. Confirm a repaired service keeps its type, name, URL, and engine
|
||||
version after restart.
|
||||
- Inspect sanitized notification failures. Confirm recognised secrets are absent
|
||||
while the remaining error context is actionable.
|
||||
- Upgrade a backed-up `v6.4.1` installation, including Docker behind a reverse
|
||||
proxy, and verify direct GUI access, proxied access, WebSocket reconnect, and
|
||||
`/api/version`.
|
||||
- On high-request-rate installations, compare API latency and CPU with your
|
||||
previous pin and report any material change.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "No screenshots are proposed because this checkpoint changes lifecycle replay, incident-history occurrence boundaries, and backend ownership of retained-delivery controls without changing visual presentation. Static images cannot prove delayed replay, reload behavior, queue ownership, acknowledgement isolation, or ordinary destination delivery.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,92 @@
|
||||
# Pulse v6.4.4-beta.3 Release Notes
|
||||
|
||||
This third beta is a focused History reliability update for Preview-channel
|
||||
testers. It corrects chart target selection for Proxmox nodes and Proxmox
|
||||
Backup Server systems while retaining the alert and API reliability repairs
|
||||
from beta.2, and carries every change from the `v6.4.2` packet that was never
|
||||
published. It is not an RC or stable release.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Proxmox node History uses the right source** - API-collected nodes now use
|
||||
their canonical node coordinates instead of being redirected to an inferred
|
||||
agent identity with no matching history.
|
||||
- **PBS History supports more installed shapes** - Backup Server drawers can
|
||||
use standalone PBS agent telemetry and uniquely correlated agent-bearing VM
|
||||
or container telemetry.
|
||||
- **Partial telemetry stays useful** - CPU and memory History can plot when
|
||||
disk data is absent. Missing network or disk series remain visibly collecting
|
||||
instead of inventing values.
|
||||
- **Ambiguous identities remain safe** - A PBS system is not attached to a
|
||||
guest or agent unless the available identity evidence selects one unique
|
||||
target.
|
||||
- **Monitoring lifecycle state is synchronized** - Startup and reset paths now
|
||||
coordinate state snapshots, removing a race found while validating this
|
||||
checkpoint.
|
||||
- **The beta.2 reliability repairs remain included** - Recurring alert history,
|
||||
retained-delivery recovery, webhook pacing, warning reconciliation, secret
|
||||
masking, and cold tenant startup keep their repaired behavior.
|
||||
- **Provider identity remains isolated** - Same-name systems stay separate
|
||||
across Proxmox providers, including installations that reuse one short node
|
||||
name or one enrollment token.
|
||||
- **Windows agent delivery is restored** - Canonical executable assets and
|
||||
detached signatures remain available to Unified Agent updates.
|
||||
- **Large Availability estates scan faster** - The compact fleet view remains
|
||||
included, and Slow starts are recoverable through the existing startup
|
||||
recovery path.
|
||||
- **Disk I/O totals are more accurate** - Numbered partitions are not counted
|
||||
again when their parent device already supplies the total.
|
||||
|
||||
## Known issues
|
||||
|
||||
- These History corrections have focused automated and browser checks, but
|
||||
they still need confirmation on installed Proxmox and PBS systems.
|
||||
- Existing History data is not rewritten. The correction selects the canonical
|
||||
stored series that already belongs to each node or uniquely matched PBS host.
|
||||
- A controlled beta.2 installation passed firing, retry, exhaustion, restart,
|
||||
recurrence, suppression, dismissal, audit, and warning-retirement checks.
|
||||
Ordinary email-provider and reporter acceptance remain unconfirmed.
|
||||
- Open issue [#1966](https://github.com/rcourtman/Pulse/issues/1966) reports
|
||||
high process write volume and repeated incident IDs on one stable v6.4.1 LXC.
|
||||
This beta does not claim reduced aggregate writes or migrate old duplicates.
|
||||
- Advisory comparisons remain adverse. A beta.2 study measured a slower
|
||||
metrics-store statistics handler, and this candidate repeatedly measured
|
||||
slower low-level route-segment normalization despite unchanged allocations.
|
||||
Focused full History middleware measurements did not reproduce a slowdown,
|
||||
and no user-facing latency regression has been demonstrated. Both questions
|
||||
remain open before RC. High-request-rate testers should compare latency and
|
||||
CPU with their previous pin.
|
||||
- Permanent SMTP authentication, configuration, or rejection errors can still
|
||||
consume the inner retry budget before queue handling reaches final failure.
|
||||
- Open issue [#1913](https://github.com/rcourtman/Pulse/issues/1913) reports an
|
||||
inaccessible GUI after an upgrade from v5.1.35 to stable v6.4.1. Keep the
|
||||
prior image pin available while its deployment-specific cause is investigated.
|
||||
- This server beta does not require a companion mobile release. It does not
|
||||
change Relay pairing, native push payloads, approvals, or onboarding.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This is an opt-in Preview-channel beta. Back up the Pulse data directory and
|
||||
keep the stable rollback pin available.
|
||||
- The v6.4.2 packet had no GitHub release and was not shipped. Its changes are
|
||||
carried through the published beta line. The preceding stable release remains
|
||||
v6.4.1.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in
|
||||
`admin` role before upgrading so intended administrator access remains.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath is
|
||||
unavailable and may show an Unknown Publisher warning. Verify downloads with
|
||||
published checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`.
|
||||
- For rollback on systemd and Proxmox LXC, run `sudo /bin/update --version
|
||||
v6.4.1`.
|
||||
- For Docker Compose rollback, pin `rcourtman/pulse:6.4.1` and recreate the
|
||||
container.
|
||||
- For Helm rollback, run `helm upgrade --install pulse
|
||||
oci://ghcr.io/rcourtman/pulse-chart/pulse --version 6.4.1` with the values
|
||||
used by the current installation.
|
||||
- After upgrading, open 7-day History for API-only and agent-linked Proxmox
|
||||
nodes. Confirm existing CPU, memory, disk, network, and temperature series
|
||||
appear where those metrics are collected.
|
||||
- Open History for standalone and PVE-hosted PBS systems. Confirm CPU and memory
|
||||
plot even without disk history, and report any drawer that remains collecting
|
||||
despite fresh Overview values.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "No screenshots are proposed because this checkpoint changes the data target used by existing History charts without changing their layout. A static chart image cannot establish which node or agent API coordinates supplied the series, while the focused request and plotting checks verify that behavior directly.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,91 @@
|
||||
# Pulse v6.4.4-beta.4 Release Notes
|
||||
|
||||
This fixed-forward beta is a focused History reliability update for
|
||||
Preview-channel testers. It corrects chart target selection for Proxmox nodes
|
||||
and Proxmox Backup Server systems, and keeps metrics statistics responsive when
|
||||
History traffic uses all of its bounded connections. Beta.3 did not complete
|
||||
publication. Beta.4 carries its History corrections with the qualification
|
||||
repair. It is not an RC or stable release.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Proxmox node History uses the right source** - API-collected nodes now use
|
||||
their canonical node coordinates instead of being redirected to an inferred
|
||||
agent identity with no matching history.
|
||||
- **PBS History supports more installed shapes** - Backup Server drawers can
|
||||
use standalone PBS agent telemetry and uniquely correlated agent-bearing VM
|
||||
or container telemetry.
|
||||
- **Partial telemetry stays useful** - CPU and memory History can plot when
|
||||
disk data is absent. Missing network or disk series remain visibly collecting
|
||||
instead of inventing values.
|
||||
- **Ambiguous identities remain safe** - A PBS system is not attached to a
|
||||
guest or agent unless the available identity evidence selects one unique
|
||||
target.
|
||||
- **Statistics stay available during History bursts** - Current committed
|
||||
metrics counts use a dedicated read-only connection instead of waiting for a
|
||||
saturated History pool. Counts are neither cached nor estimated.
|
||||
- **Monitoring lifecycle state is synchronized** - Startup and reset paths
|
||||
coordinate state snapshots, removing a race found while validating this
|
||||
release line.
|
||||
- **Alert and API reliability remains included** - Recurring alert history,
|
||||
retained-delivery recovery, webhook pacing, warning reconciliation, secret
|
||||
masking, and cold tenant startup retain their beta.2 behavior.
|
||||
- **Host and update repairs remain included** - Provider identity isolation,
|
||||
Windows agent delivery, compact Availability scans, and corrected disk I/O
|
||||
totals retain their beta.2 behavior.
|
||||
|
||||
## Known issues
|
||||
|
||||
- These History corrections have focused automated, load, and browser checks,
|
||||
but they still need confirmation on installed Proxmox and PBS systems.
|
||||
- Existing History data is not rewritten. The correction selects the canonical
|
||||
stored series that already belongs to each node or uniquely matched PBS host.
|
||||
- Statistics isolation passed three controlled mixed-load comparisons with the
|
||||
existing latency budget. This does not establish high-request-rate behavior
|
||||
on installed systems.
|
||||
- Already active long-running reads can still extend store shutdown. Query
|
||||
cancellation and constructor fault injection remain follow-up items before
|
||||
RC.
|
||||
- An advisory comparison measured route normalization at 2.495 ns rather than
|
||||
2.185 ns. This release does not change that code, and no user-facing
|
||||
regression is established. The result remains open for RC review.
|
||||
- A controlled beta.2 installation passed firing, retry, exhaustion, restart,
|
||||
recurrence, suppression, dismissal, audit, and warning-retirement checks.
|
||||
Ordinary email-provider and reporter acceptance remain unconfirmed.
|
||||
- Open issue [#1966](https://github.com/rcourtman/Pulse/issues/1966) reports
|
||||
high process write volume and repeated incident IDs on one stable v6.4.1 LXC.
|
||||
This beta does not claim reduced aggregate writes or migrate old duplicates.
|
||||
- Permanent SMTP authentication, configuration, or rejection errors can still
|
||||
consume the inner retry budget before queue handling reaches final failure.
|
||||
- Open issue [#1913](https://github.com/rcourtman/Pulse/issues/1913) reports an
|
||||
inaccessible GUI after an upgrade from v5.1.35 to stable v6.4.1. Keep the
|
||||
prior image pin available while its deployment-specific cause is investigated.
|
||||
- This server beta does not require a companion mobile release. It does not
|
||||
change Relay pairing, native push payloads, approvals, or onboarding.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This is an opt-in Preview-channel beta. Back up the Pulse data directory and
|
||||
keep the stable rollback pin available.
|
||||
- Beta.3 was not published. The v6.4.2 build also had no GitHub release and was
|
||||
not shipped. Their intended changes are carried through this fixed-forward
|
||||
preview. The preceding stable release remains v6.4.1.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in
|
||||
`admin` role before upgrading so intended administrator access remains.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath is
|
||||
unavailable and may show an Unknown Publisher warning. Verify downloads with
|
||||
published checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`.
|
||||
- For rollback on systemd and Proxmox LXC, run `sudo /bin/update --version
|
||||
v6.4.1`.
|
||||
- For Docker Compose rollback, pin `rcourtman/pulse:6.4.1` and recreate the
|
||||
container.
|
||||
- For Helm rollback, run `helm upgrade --install pulse
|
||||
oci://ghcr.io/rcourtman/pulse-chart/pulse --version 6.4.1` with the values
|
||||
used by the current installation.
|
||||
- After upgrading, open 7-day History for API-only and agent-linked Proxmox
|
||||
nodes. Confirm existing CPU, memory, disk, network, and temperature series
|
||||
appear where those metrics are collected.
|
||||
- Open History for standalone and PVE-hosted PBS systems. Confirm CPU and memory
|
||||
plot even without disk history, and report any drawer that remains collecting
|
||||
despite fresh Overview values.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "No screenshots are proposed because this checkpoint changes existing History data targeting and backend statistics connection isolation without changing layout. A static chart image cannot establish the API coordinates or database connection that supplied its series and counts. Exact request, plotting, saturation, and load checks are the relevant evidence.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,126 @@
|
||||
# Pulse v6.4.5-beta.1 Release Notes
|
||||
|
||||
This opt-in Preview-channel beta fixes TrueNAS CORE snapshot refresh when a
|
||||
REST alert has non-object arguments. It retains the release-line History and
|
||||
reliability fixes and carries every change from the `v6.4.2` packet that was
|
||||
never published. The previous published preview is `v6.4.4-beta.2`. The stable
|
||||
rollback target remains `v6.4.1`. This is not an RC or stable release.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **TrueNAS CORE snapshots survive legacy alert shapes** - Non-object arguments
|
||||
no longer abort snapshots (#2077). Messages stay intact. Only objects supply
|
||||
disk identity and SMART data. Malformed JSON and HTTP failures remain errors.
|
||||
- **Proxmox node History selects the right series** - Existing canonical node
|
||||
series are selected for API-only and agent-linked nodes.
|
||||
- **PBS History supports more installed shapes** - Standalone and PVE-hosted
|
||||
PBS history can select available CPU and memory without requiring disk history.
|
||||
- **Statistics stay available during History bursts** - The release line retains
|
||||
statistics connection isolation from long-running History reads.
|
||||
|
||||
- **Recurring incidents keep their own history** - Delayed firing,
|
||||
resolution, or acknowledgement replay for an older occurrence cannot reopen
|
||||
it, close a newer recurrence, or merge both occurrences into one timeline.
|
||||
- **Resolved alerts stay resolved** - Pending, failed, and dead-lettered firing
|
||||
notifications cannot be revived by a later retry after the incident resolves.
|
||||
Disabled destinations are cancelled instead of being reported as delivered.
|
||||
- **Retained-delivery recovery survives reloads** - Queue statistics,
|
||||
dead-letter details, **Retry retained deliveries**, and **Dismiss retained
|
||||
failures** now follow the active notification queue instead of keeping a
|
||||
stopped queue that returns HTTP 503.
|
||||
- **Webhook retries keep safe pacing** - A response-specific `Retry-After: 0`
|
||||
can permit one immediate retry without erasing the exponential delay for later
|
||||
unhinted 429 or 503 responses.
|
||||
- **Delivery warnings show the newest truth** - Concurrent timer, retry,
|
||||
dismissal, and refresh work can no longer let an older healthy snapshot hide
|
||||
a newer delivery failure or resurrect a warning that was just cleared.
|
||||
- **Delivery diagnosis is more actionable** - Failure status and reason
|
||||
ordering remain current after retries and refreshes, unavailable queue health
|
||||
is visible, and operators are directed to the affected notification settings.
|
||||
- **Notification diagnostics keep credentials private** - Webhook userinfo,
|
||||
Slack and Discord paths, Telegram bot tokens, encoded query credentials, and
|
||||
ntfy transport URLs are masked while useful status and destination context is
|
||||
retained.
|
||||
- **Cold tenants no longer stall unrelated API traffic** - Resource-store
|
||||
construction now runs outside the shared cache lock while same-tenant opens
|
||||
remain deduplicated and eviction waits safely for in-flight construction.
|
||||
- **Recovery requires real observations** - Storage and PBS incidents do not
|
||||
clear merely because a metric or provider sample is absent. Incident identity
|
||||
and history survive configuration reloads and restarts until measured recovery.
|
||||
- **Provider alert semantics are more accurate** - TrueNAS CORE 12 endpoints
|
||||
are accepted, completed replication is recognised, informational events stay
|
||||
out of acknowledgement work, NOTICE events remain actionable, and critical
|
||||
transitions can notify correctly.
|
||||
- **PBS behavior is restart-safe** - Capacity, task, partial-metric, and webhook
|
||||
paths remain bound to actual observations across restart and recurrence.
|
||||
- **Host telemetry is more dependable** - Host and Docker CPU collectors use
|
||||
separate sampling baselines, disk collection follows the agent mount
|
||||
namespace, and pool-only or empty Unraid layouts no longer manufacture parity
|
||||
warnings.
|
||||
- **Updates fail more truthfully** - Docker updates require independent success
|
||||
evidence, oversized GitHub release metadata falls back to verified assets,
|
||||
and portable installer state retains correct ownership.
|
||||
- **Identity and reconnect behavior is safer** - Same-name systems stay
|
||||
separate across Proxmox providers, delayed browser startup offers a truthful
|
||||
retry path, and infrastructure edits stay mounted during background polling.
|
||||
- **Discovery repairs stay repaired** - Availability-suggestion backfill no
|
||||
longer writes an old discovery snapshot over a concurrent manual refresh,
|
||||
drops the repaired URL or engine version, or resurrects a deleted record.
|
||||
- **Navigation and settings are more accessible** - The skip link is first in
|
||||
keyboard order, badges remain readable, landmarks are distinct, and settings,
|
||||
Patrol, mobile navigation, and compact controls have stronger focus and
|
||||
screen-reader behavior.
|
||||
- **Current OpenAI models are handled correctly** - GPT-5-family requests use
|
||||
the supported completion-token parameter and can learn the required parameter
|
||||
from bounded API responses.
|
||||
- **The RC1 reliability fixes remain included** - Windows agent delivery is
|
||||
restored, Large Availability estates scan faster, Slow starts are recoverable,
|
||||
and Disk I/O totals are more accurate.
|
||||
- **The safer operational foundation remains included** - Resource identity,
|
||||
safer agent lifecycle operations, canonical health APIs, bounded privileged
|
||||
actions, and response size limits remain in this checkpoint.
|
||||
|
||||
## Known issues
|
||||
|
||||
- The TrueNAS fix has synthetic repeated-snapshot and race-enabled regression
|
||||
coverage. Physical-appliance and reporter acceptance remain unconfirmed.
|
||||
- History corrections still need confirmation on installed Proxmox and PBS systems.
|
||||
Existing stored history is not rewritten. Active long-running reads may still
|
||||
extend shutdown. Cancellation and fault-injection coverage remain incomplete.
|
||||
- Previous unpublished preview candidates did not complete qualification. This
|
||||
version number is not evidence that their stability failures were resolved.
|
||||
- Performance risk remains open: earlier main-line comparisons measured slower
|
||||
numeric-ID and UUID route normalization. Passing release-line source benchmarks
|
||||
do not establish installed workload performance or invalidate earlier results.
|
||||
- Alert delivery depends on destination configuration and provider responses.
|
||||
Reporter acceptance, ordinary email-provider behavior and retained-delivery
|
||||
discoverability remain incomplete. Do not delete queue or alert files as a workaround.
|
||||
- Issue #1966 reports high write volume and repeated incident IDs on a stable
|
||||
installation. No reduction in aggregate writes or migration of old duplicates
|
||||
is claimed. Keep the rollback pin ready on flash-constrained systems.
|
||||
- Issue #1913 reports inaccessible GUI after an upgrade from v5.1.35 to v6.4.1.
|
||||
Deployment-specific upgrade failures remain outside this fix.
|
||||
- This server preview does not change mobile pairing, push payloads, approvals
|
||||
or onboarding and does not require a companion mobile release.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- Use only published, integrity-verified artifacts. Back up the Pulse data
|
||||
directory and configuration before opting into Preview.
|
||||
- The v6.4.4-beta.3 and beta.4 candidates were not published. Beta.5 was withdrawn.
|
||||
Their version numbers must not be treated as available upgrade targets.
|
||||
- On SSO-only deployments, map at least one trusted IdP group to the built-in
|
||||
`admin` role so intended administrator access remains available.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath is
|
||||
unavailable and may show an Unknown Publisher warning. Verify downloads with
|
||||
published checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC, run
|
||||
`sudo /bin/update --version v6.4.1`.
|
||||
- For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
- For Helm, run `helm upgrade --install pulse oci://ghcr.io/rcourtman/pulse-chart/pulse --version 6.4.1`
|
||||
with the installation's saved values.
|
||||
- Keep the pre-upgrade backup until health and data continuity are verified.
|
||||
Restore it if rollback cannot read the upgraded data safely.
|
||||
- Verify repeated TrueNAS snapshots and alert messages after upgrading. Check
|
||||
7-day History for Proxmox nodes and PBS systems, and confirm expected series
|
||||
appear where the provider collects those metrics.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "No new layout is introduced. Synthetic snapshot/alert decoding checks and live installed data continuity are the relevant evidence. Static screenshots cannot prove either.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,135 @@
|
||||
# Pulse v6.4.5-beta.2 Release Notes
|
||||
|
||||
This opt-in Preview-channel beta combines monitoring, notification,
|
||||
agent and installation reliability improvements with the fixes below. It follows
|
||||
`v6.4.5-beta.1` and carries every change from the `v6.4.2` packet that was never
|
||||
published. It is not a stable release. Keep stable `v6.4.1` available for rollback.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Creating tenant API tokens avoids inventory startup** - Session-authenticated
|
||||
token creation no longer starts a tenant monitor. Organization membership,
|
||||
lifecycle, CSRF, token ownership and scopes remain enforced.
|
||||
- **Tenant inventory starts with one provider fill** - Initial resource-store
|
||||
wiring batches supplemental providers while preserving synchronous readiness.
|
||||
- **Notification severity preferences stay saved** - Email and webhook settings
|
||||
preserve “Warnings and critical alerts” through save, reload and display (#2069).
|
||||
- **Fewer unchanged alert checkpoint writes** - Byte-identical pending-intent
|
||||
checkpoints are not rewritten. Changed state still persists and stale files are
|
||||
repaired. This does not resolve all reported write volume (#1966).
|
||||
- **More disks remain visible** - Disks without a serial number keep distinct
|
||||
inventory identities (#2076).
|
||||
- **All disk mounts stay reachable** - The Disks card no longer clips its mount
|
||||
list inside a nested scroller. Mounts remain in the outer scrolling flow,
|
||||
including keyboard access to the final mount (#2051).
|
||||
- **Container image checks tolerate registry differences** - Digest discovery
|
||||
can fall back to a validated manifest response when HEAD lacks a digest (#2048).
|
||||
- **VM-linked agent memory is used correctly** - Fresh available agent memory can
|
||||
supply the linked VM reading without confusing provider instances (#1962).
|
||||
|
||||
|
||||
- **TrueNAS CORE snapshots survive legacy alert shapes** - Non-object arguments
|
||||
no longer abort snapshots (#2077). Messages stay intact. Only objects supply
|
||||
disk identity and SMART data. Malformed JSON and HTTP failures remain errors.
|
||||
- **Proxmox node History selects the right series** - Existing canonical node
|
||||
series are selected for API-only and agent-linked nodes.
|
||||
- **PBS History supports more installed shapes** - Standalone and PVE-hosted
|
||||
PBS history can select available CPU and memory without requiring disk history.
|
||||
- **Statistics stay available during History bursts** - The release line retains
|
||||
statistics connection isolation from long-running History reads.
|
||||
|
||||
- **Recurring incidents keep their own history** - Delayed firing,
|
||||
resolution, or acknowledgement replay for an older occurrence cannot reopen
|
||||
it, close a newer recurrence, or merge both occurrences into one timeline.
|
||||
- **Resolved alerts stay resolved** - Pending, failed, and dead-lettered firing
|
||||
notifications cannot be revived by a later retry after the incident resolves.
|
||||
Disabled destinations are cancelled instead of being reported as delivered.
|
||||
- **Retained-delivery recovery survives reloads** - Queue statistics,
|
||||
dead-letter details, **Retry retained deliveries**, and **Dismiss retained
|
||||
failures** now follow the active notification queue instead of keeping a
|
||||
stopped queue that returns HTTP 503.
|
||||
- **Webhook retries keep safe pacing** - A response-specific `Retry-After: 0`
|
||||
can permit one immediate retry without erasing the exponential delay for later
|
||||
unhinted 429 or 503 responses.
|
||||
- **Delivery warnings show the newest truth** - Concurrent timer, retry,
|
||||
dismissal, and refresh work can no longer let an older healthy snapshot hide
|
||||
a newer delivery failure or resurrect a warning that was just cleared.
|
||||
- **Delivery diagnosis is more actionable** - Failure status and reason
|
||||
ordering remain current after retries and refreshes, unavailable queue health
|
||||
is visible, and operators are directed to the affected notification settings.
|
||||
- **Notification diagnostics keep credentials private** - Webhook userinfo,
|
||||
Slack and Discord paths, Telegram bot tokens, encoded query credentials, and
|
||||
ntfy transport URLs are masked while useful status and destination context is
|
||||
retained.
|
||||
- **Cold tenants no longer stall unrelated API traffic** - Resource-store
|
||||
construction now runs outside the shared cache lock while same-tenant opens
|
||||
remain deduplicated and eviction waits safely for in-flight construction.
|
||||
- **Recovery requires real observations** - Storage and PBS incidents do not
|
||||
clear merely because a metric or provider sample is absent. Incident identity
|
||||
and history survive configuration reloads and restarts until measured recovery.
|
||||
- **Provider alert semantics are more accurate** - TrueNAS CORE 12 endpoints
|
||||
are accepted, completed replication is recognised, informational events stay
|
||||
out of acknowledgement work, NOTICE events remain actionable, and critical
|
||||
transitions can notify correctly.
|
||||
- **PBS behavior is restart-safe** - Capacity, task, partial-metric, and webhook
|
||||
paths remain bound to actual observations across restart and recurrence.
|
||||
- **Host telemetry is more dependable** - Host and Docker CPU collectors use
|
||||
separate sampling baselines, disk collection follows the agent mount
|
||||
namespace, and pool-only or empty Unraid layouts no longer manufacture parity
|
||||
warnings.
|
||||
- **Updates fail more truthfully** - Docker updates require independent success
|
||||
evidence, oversized GitHub release metadata falls back to verified assets,
|
||||
and portable installer state retains correct ownership.
|
||||
- **Identity and reconnect behavior is safer** - Same-name systems stay
|
||||
separate across Proxmox providers, delayed browser startup offers a truthful
|
||||
retry path, and infrastructure edits stay mounted during background polling.
|
||||
- **Discovery repairs stay repaired** - Availability-suggestion backfill no
|
||||
longer writes an old discovery snapshot over a concurrent manual refresh,
|
||||
drops the repaired URL or engine version, or resurrects a deleted record.
|
||||
- **Navigation and settings are more accessible** - The skip link is first in
|
||||
keyboard order, badges remain readable, landmarks are distinct, and settings,
|
||||
Patrol, mobile navigation, and compact controls have stronger focus and
|
||||
screen-reader behavior.
|
||||
- **Current OpenAI models are handled correctly** - GPT-5-family requests use
|
||||
the supported completion-token parameter and can learn the required parameter
|
||||
from bounded API responses.
|
||||
- **The RC1 reliability fixes remain included** - Windows agent delivery is
|
||||
restored, Large Availability estates scan faster, Slow starts are recoverable,
|
||||
and Disk I/O totals are more accurate.
|
||||
- **The safer operational foundation remains included** - Resource identity,
|
||||
safer agent lifecycle operations, canonical health APIs, bounded privileged
|
||||
actions, and response size limits remain in this checkpoint.
|
||||
|
||||
## Known issues
|
||||
|
||||
- Switching repeatedly into newly created organizations can leave mobile Safari
|
||||
settings waiting for capabilities or inventory. Sharing and billing navigation
|
||||
remain under investigation. Passing token tests do not establish that this
|
||||
transition is fixed. Avoid treating a loading page as a completed switch.
|
||||
- TrueNAS appliance acceptance and installed Proxmox/PBS History confirmation
|
||||
remain outstanding. Existing history is not rewritten.
|
||||
- Aggregate high write volume and old duplicate incidents reported in #1966
|
||||
remain unresolved. Keep backups and monitor write activity on flash storage.
|
||||
- Some v5-to-v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- Notification delivery still depends on destination configuration and provider
|
||||
responses. Do not delete alert or queue files as a workaround.
|
||||
- This server release does not change mobile pairing, push payloads, approvals
|
||||
or onboarding and does not require a companion mobile release.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- Use published, integrity-verified artifacts and back up the complete Pulse data
|
||||
directory and configuration before opting into Preview.
|
||||
- On SSO-only deployments, map at least one trusted IdP group to the built-in
|
||||
`admin` role so intended administrator access remains available.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath is
|
||||
unavailable and may show an Unknown Publisher warning. Verify published
|
||||
checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`. For systemd and Proxmox LXC, run
|
||||
`sudo /bin/update --version v6.4.1`.
|
||||
- For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
- For Helm, use chart version `6.4.1` with your saved values.
|
||||
- Keep the pre-upgrade backup until health and data continuity are verified.
|
||||
Restore it if rollback cannot read the upgraded data safely.
|
||||
- After upgrading, verify inventory, organization switching, repeated snapshots,
|
||||
History and notification delivery against your actual installed systems.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "Text describes targeted reliability and existing-layout corrections. Retained regression evidence covers disk mount-list visibility without nested clipping and keyboard reachability. No new explanatory release screenshot is needed. Static captures cannot establish tenant-switch latency, delivery or rollback.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,137 @@
|
||||
# Pulse v6.4.5-beta.3 Release Notes
|
||||
|
||||
This opt-in Preview-channel beta combines monitoring, notification,
|
||||
agent and installation reliability improvements with the fixes below. It follows
|
||||
published `v6.4.5-beta.1`. The `v6.4.5-beta.2` preparation did not complete
|
||||
publication. Beta.3 carries every change from the `v6.4.2` packet that was never
|
||||
published, together with the same corrections as beta.2. It is not a stable
|
||||
release. Keep stable `v6.4.1` available for rollback.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Creating tenant API tokens avoids inventory startup** - Session-authenticated
|
||||
token creation no longer starts a tenant monitor. Organization membership,
|
||||
lifecycle, CSRF, token ownership and scopes remain enforced.
|
||||
- **Tenant inventory starts with one provider fill** - Initial resource-store
|
||||
wiring batches supplemental providers while preserving synchronous readiness.
|
||||
- **Notification severity preferences stay saved** - Email and webhook settings
|
||||
preserve “Warnings and critical alerts” through save, reload and display (#2069).
|
||||
- **Fewer unchanged alert checkpoint writes** - Byte-identical pending-intent
|
||||
checkpoints are not rewritten. Changed state still persists and stale files are
|
||||
repaired. This does not resolve all reported write volume (#1966).
|
||||
- **More disks remain visible** - Disks without a serial number keep distinct
|
||||
inventory identities (#2076).
|
||||
- **All disk mounts stay reachable** - The Disks card no longer clips its mount
|
||||
list inside a nested scroller. Mounts remain in the outer scrolling flow,
|
||||
including keyboard access to the final mount (#2051).
|
||||
- **Container image checks tolerate registry differences** - Digest discovery
|
||||
can fall back to a validated manifest response when HEAD lacks a digest (#2048).
|
||||
- **VM-linked agent memory is used correctly** - Fresh available agent memory can
|
||||
supply the linked VM reading without confusing provider instances (#1962).
|
||||
|
||||
|
||||
- **TrueNAS CORE snapshots survive legacy alert shapes** - Non-object arguments
|
||||
no longer abort snapshots (#2077). Messages stay intact. Only objects supply
|
||||
disk identity and SMART data. Malformed JSON and HTTP failures remain errors.
|
||||
- **Proxmox node History selects the right series** - Existing canonical node
|
||||
series are selected for API-only and agent-linked nodes.
|
||||
- **PBS History supports more installed shapes** - Standalone and PVE-hosted
|
||||
PBS history can select available CPU and memory without requiring disk history.
|
||||
- **Statistics stay available during History bursts** - The release line retains
|
||||
statistics connection isolation from long-running History reads.
|
||||
|
||||
- **Recurring incidents keep their own history** - Delayed firing,
|
||||
resolution, or acknowledgement replay for an older occurrence cannot reopen
|
||||
it, close a newer recurrence, or merge both occurrences into one timeline.
|
||||
- **Resolved alerts stay resolved** - Pending, failed, and dead-lettered firing
|
||||
notifications cannot be revived by a later retry after the incident resolves.
|
||||
Disabled destinations are cancelled instead of being reported as delivered.
|
||||
- **Retained-delivery recovery survives reloads** - Queue statistics,
|
||||
dead-letter details, **Retry retained deliveries**, and **Dismiss retained
|
||||
failures** now follow the active notification queue instead of keeping a
|
||||
stopped queue that returns HTTP 503.
|
||||
- **Webhook retries keep safe pacing** - A response-specific `Retry-After: 0`
|
||||
can permit one immediate retry without erasing the exponential delay for later
|
||||
unhinted 429 or 503 responses.
|
||||
- **Delivery warnings show the newest truth** - Concurrent timer, retry,
|
||||
dismissal, and refresh work can no longer let an older healthy snapshot hide
|
||||
a newer delivery failure or resurrect a warning that was just cleared.
|
||||
- **Delivery diagnosis is more actionable** - Failure status and reason
|
||||
ordering remain current after retries and refreshes, unavailable queue health
|
||||
is visible, and operators are directed to the affected notification settings.
|
||||
- **Notification diagnostics keep credentials private** - Webhook userinfo,
|
||||
Slack and Discord paths, Telegram bot tokens, encoded query credentials, and
|
||||
ntfy transport URLs are masked while useful status and destination context is
|
||||
retained.
|
||||
- **Cold tenants no longer stall unrelated API traffic** - Resource-store
|
||||
construction now runs outside the shared cache lock while same-tenant opens
|
||||
remain deduplicated and eviction waits safely for in-flight construction.
|
||||
- **Recovery requires real observations** - Storage and PBS incidents do not
|
||||
clear merely because a metric or provider sample is absent. Incident identity
|
||||
and history survive configuration reloads and restarts until measured recovery.
|
||||
- **Provider alert semantics are more accurate** - TrueNAS CORE 12 endpoints
|
||||
are accepted, completed replication is recognised, informational events stay
|
||||
out of acknowledgement work, NOTICE events remain actionable, and critical
|
||||
transitions can notify correctly.
|
||||
- **PBS behavior is restart-safe** - Capacity, task, partial-metric, and webhook
|
||||
paths remain bound to actual observations across restart and recurrence.
|
||||
- **Host telemetry is more dependable** - Host and Docker CPU collectors use
|
||||
separate sampling baselines, disk collection follows the agent mount
|
||||
namespace, and pool-only or empty Unraid layouts no longer manufacture parity
|
||||
warnings.
|
||||
- **Updates fail more truthfully** - Docker updates require independent success
|
||||
evidence, oversized GitHub release metadata falls back to verified assets,
|
||||
and portable installer state retains correct ownership.
|
||||
- **Identity and reconnect behavior is safer** - Same-name systems stay
|
||||
separate across Proxmox providers, delayed browser startup offers a truthful
|
||||
retry path, and infrastructure edits stay mounted during background polling.
|
||||
- **Discovery repairs stay repaired** - Availability-suggestion backfill no
|
||||
longer writes an old discovery snapshot over a concurrent manual refresh,
|
||||
drops the repaired URL or engine version, or resurrects a deleted record.
|
||||
- **Navigation and settings are more accessible** - The skip link is first in
|
||||
keyboard order, badges remain readable, landmarks are distinct, and settings,
|
||||
Patrol, mobile navigation, and compact controls have stronger focus and
|
||||
screen-reader behavior.
|
||||
- **Current OpenAI models are handled correctly** - GPT-5-family requests use
|
||||
the supported completion-token parameter and can learn the required parameter
|
||||
from bounded API responses.
|
||||
- **The RC1 reliability fixes remain included** - Windows agent delivery is
|
||||
restored, Large Availability estates scan faster, Slow starts are recoverable,
|
||||
and Disk I/O totals are more accurate.
|
||||
- **The safer operational foundation remains included** - Resource identity,
|
||||
safer agent lifecycle operations, canonical health APIs, bounded privileged
|
||||
actions, and response size limits remain in this checkpoint.
|
||||
|
||||
## Known issues
|
||||
|
||||
- Switching repeatedly into newly created organizations can leave mobile Safari
|
||||
settings waiting for capabilities or inventory. Sharing and billing navigation
|
||||
remain under investigation. Passing token tests do not establish that this
|
||||
transition is fixed. Avoid treating a loading page as a completed switch.
|
||||
- TrueNAS appliance acceptance and installed Proxmox/PBS History confirmation
|
||||
remain outstanding. Existing history is not rewritten.
|
||||
- Aggregate high write volume and old duplicate incidents reported in #1966
|
||||
remain unresolved. Keep backups and monitor write activity on flash storage.
|
||||
- Some v5-to-v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- Notification delivery still depends on destination configuration and provider
|
||||
responses. Do not delete alert or queue files as a workaround.
|
||||
- This server release does not change mobile pairing, push payloads, approvals
|
||||
or onboarding and does not require a companion mobile release.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- Use published, integrity-verified artifacts and back up the complete Pulse data
|
||||
directory and configuration before opting into Preview.
|
||||
- On SSO-only deployments, map at least one trusted IdP group to the built-in
|
||||
`admin` role so intended administrator access remains available.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath is
|
||||
unavailable and may show an Unknown Publisher warning. Verify published
|
||||
checksums and detached signatures.
|
||||
- The rollback target is stable `v6.4.1`. For systemd and Proxmox LXC, run
|
||||
`sudo /bin/update --version v6.4.1`.
|
||||
- For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
- For Helm, use chart version `6.4.1` with your saved values.
|
||||
- Keep the pre-upgrade backup until health and data continuity are verified.
|
||||
Restore it if rollback cannot read the upgraded data safely.
|
||||
- After upgrading, verify inventory, organization switching, repeated snapshots,
|
||||
History and notification delivery against your actual installed systems.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "Text describes targeted reliability and existing-layout corrections. Retained regression evidence covers disk mount-list visibility without nested clipping and keyboard reachability. No new explanatory release screenshot is needed. Static captures cannot establish tenant-switch latency, delivery or rollback.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,45 @@
|
||||
# Pulse v6.4.5-rc.1 Release Notes
|
||||
|
||||
This release candidate gathers the accumulated monitoring, notification, agent and installation reliability repairs since stable `v6.4.1` into one build intended to become the next stable release. It carries every change from the `v6.4.2` packet that was never published, together with the corrections already exercised in `v6.4.5-beta.1`. Preview users can opt in to confirm the fixes before stable promotion. Keep stable `v6.4.1` available for rollback.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Same-name systems stay separate** - Stronger host, Docker, Kubernetes and Proxmox identity checks keep alerts, metrics, actions and removal tied to the right machine even when short names or shared tokens repeat (#1753, #1930).
|
||||
- **Windows agent delivery is restored** - Unified Agent downloads resolve canonical signed `.exe` assets and their signature sidecars, so installation and auto-update no longer fail with HTTP 404 (#1820, #2125).
|
||||
- **Large Availability estates scan faster** - Estates with 20 or more checks open in fleet view, and the chosen table or fleet presentation stays stable across refreshes and shareable URLs.
|
||||
- **Slow starts are recoverable** - A delayed or stalled startup now shows connection status and a retry, and large alert histories catch up incrementally instead of blocking the server (#2129).
|
||||
- **Disk I/O totals are more accurate** - Partition accounting no longer inflates whole-device traffic, and endurance counters stop raising false disk-wear warnings (#2112).
|
||||
- **Backup alerts stay truthful** - A guest backed up locally on Proxmox and copied to a PBS is counted once, and a host that stops reporting no longer raises repeated critical backup-age alerts (#1741, #1721).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list keeps every host row visible while scrolling instead of dropping rows as the window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics and text alignment match the underlying incidents after retries and refreshes (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent checkpoints and oversized alert event-log snapshots are no longer rewritten on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Guest panels order predictably** - The workload drawer lists Filesystems before Tags, matching the rest of the interface (#2121).
|
||||
- **TrueNAS telemetry is accurate** - AMD temperature aggregates are rejected instead of inflated, CORE memory is read through the legacy REST path, and idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type names, probe the current 8.0.3 release shape, and surface API fault detail instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests are treated as the current image, so PostgreSQL and other containers stop reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards its configuration backup, and a completed update clears its trap so success is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs verify checksums** - The installer verifies downloaded agent checksums without relying on GNU coreutils (#2123).
|
||||
- **Custom sensor warnings are delivered** - Health-assessment escalations for custom sensors now send their warning notifications (#1801).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity honours the removal block, and the event-log volume stays bounded through the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live host state instead of losing continuity (#1913).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached so repeated Patrol runs cost less (#2118).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration, the configured-admin authorizer and security-setup preferences survive save and restart.
|
||||
- **Verify SSL choices stick** - A node's "Verify SSL Certificate" setting is preserved through agent re-registration and PVE instance consolidation, so a deliberately disabled or enabled choice is no longer silently overwritten by the automatic paths (#2140).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Known issues
|
||||
|
||||
- Installed confirmation of Proxmox and PBS History rendering on API-only nodes, agent-linked nodes and standalone PBS systems remains outstanding.
|
||||
- Aggregate alert-engine write volume and old duplicate incidents reported in #1966 are reduced but not fully resolved. Monitor write activity on flash storage.
|
||||
- Some v5 to v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- TrueNAS appliance acceptance and notification-provider acceptance remain incomplete.
|
||||
- Notification delivery still depends on destination configuration and provider responses. Do not delete alert or queue files as a workaround.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This candidate carries every change from the `v6.4.2` packet, which was tagged but never published. If you run `v6.4.1`, read the `v6.4.2` notes for the administrator-boundary changes as well.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in `admin` role before upgrading so an intended administrator retains access.
|
||||
- Back up the complete Pulse data directory and configuration before opting into the preview channel, and keep the backup until health and data continuity are verified.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile remains compatible. This candidate does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.1` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "The release owner declined the model-selected visual plan. The listed repairs are behavioural changes in alerting, telemetry, installation and upgrade handling that a static screenshot cannot establish, and the previously considered Patrol and History captures depend on live data that is not deterministic at capture time. This candidate publishes no screenshots.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,58 @@
|
||||
# Pulse v6.4.5-rc.2 Release Notes
|
||||
|
||||
This release candidate follows `v6.4.5-rc.1` and gathers the accumulated monitoring, notification, agent and installation reliability repairs since stable `v6.4.1` into one build intended to become the next stable release. It adds alert-delivery, grouping and escalation correctness, more reliable PBS identity and capacity handling, clearer filesystem labels, safer copied install commands, stronger disk correlation and a resource-drawer tab fix on top of rc.1. Preview users can opt in to confirm the fixes before stable promotion. Keep stable `v6.4.1` available for rollback.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Same-name systems stay separate** - Stronger host, Docker, Kubernetes and Proxmox identity checks keep alerts, metrics, actions and removal tied to the right machine even when short names or shared tokens repeat (#1753, #1930).
|
||||
- **Windows agent delivery is restored** - Unified Agent downloads resolve canonical signed `.exe` assets and their signature sidecars, so installation and auto-update no longer fail with HTTP 404 (#1820, #2125).
|
||||
- **Large Availability estates scan faster** - Estates with 20 or more checks open in fleet view, and the chosen table or fleet presentation stays stable across refreshes and shareable URLs.
|
||||
- **Slow starts are recoverable** - A delayed or stalled startup now shows connection status and a retry, and large alert histories catch up incrementally instead of blocking the server (#2129).
|
||||
- **Disk I/O totals are more accurate** - Partition accounting no longer inflates whole-device traffic, and endurance counters stop raising false disk-wear warnings (#2112).
|
||||
- **Duplicate disk rows are reduced** - Linked PVE and agent observations can safely correlate the same USB disk when one source lacks a stable ID, while conflicting and ambiguous devices remain separate (#2076).
|
||||
- **Backup alerts stay truthful** - A PBS host or config backup no longer raises a repeated guest backup-age alert, while a guest backed up locally and copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **PBS History keeps its identity** - Linked guest and agent rows correlate only when stable identity proves they are the same system. Multiple datastores stay distinct when refresh ordering changes (#1723).
|
||||
- **PBS capacity follows policy** - Datastore capacity health uses the configured warning and critical thresholds instead of fixed percentages (#1448).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the folded alert history instead of re-walking the whole event log, so a large history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list keeps every host row visible while scrolling instead of dropping rows as the window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the underlying incidents, and the alert-card footer Started run now shares the baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent checkpoints and oversized alert event-log snapshots are no longer rewritten on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the configured destination and grouping window across restarts instead of creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Due notifications survive startup** - A persisted notification already due at startup is no longer processed before saved webhook, email and Apprise destinations are applied, so a grouped recovery is not cancelled as "delivery disabled" (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes critical, the higher severity can bypass only the same-occurrence cooldown and records its destination delivery in notification history (#1801).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current rule, occurrence, acknowledgement and snooze state before admitting a delayed escalation, and an automatic acknowledgement survives a re-fire (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps back to Overview when a live data refresh briefly omits a field that gates that tab, such as a merged metrics target on the Proxmox Backups History view (#1723).
|
||||
- **Filesystem paths stay distinguishable** - Long mount paths use the full Filesystems-panel width and wrap above the usage bar instead of collapsing to identical prefixes (#2121).
|
||||
- **TrueNAS compatibility improves** - AMD temperature aggregates are rejected instead of inflated, CORE memory uses the legacy mapping, and idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type names, probe the current 8.0.3 release shape, and surface API fault detail instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests are treated as the current image, so PostgreSQL and other containers stop reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards its configuration backup, and a completed update clears its trap so success is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs are safer** - The installer verifies agent checksums without GNU coreutils, and commands copied from the web interface preserve the line breaks required by Bash (#2123).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity honours the removal block, and the event-log volume stays bounded through the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live host state instead of losing continuity (#1913).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose in-memory observer was lost or rejected is reconciled from retained intent and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse agent inside a Proxmox LXC supplies the container memory reading instead of the cache-inclusive cluster value when the agent total matches the provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration, the configured-admin authorizer and security-setup preferences survive save and restart.
|
||||
- **Verify SSL choices stick** - A node's "Verify SSL Certificate" setting is preserved through agent re-registration and PVE instance consolidation, and an explicit PBS choice is no longer silently overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade documentation warns that `/bin/update` is the community-scripts updater on some Proxmox helper-script containers and points those users at the signed, version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Known issues
|
||||
|
||||
- Installed confirmation of the corrected PBS History identity on API-only nodes, agent-linked nodes, standalone PBS systems and multi-datastore systems remains outstanding.
|
||||
- Native pfSense GUI installation, service start and reboot confirmation remains outstanding.
|
||||
- Native confirmation of the mixed-source disk correlation remains outstanding.
|
||||
- Aggregate alert-engine write volume and old duplicate incidents reported in #1966 are reduced but not fully resolved. Monitor write activity on flash storage.
|
||||
- Some v5 to v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- TrueNAS CPU and memory graph acceptance on affected CORE appliances remains incomplete.
|
||||
- Notification-provider acceptance for the corrected escalation and recovery journeys remains incomplete. Notification delivery still depends on destination configuration and provider responses. Do not delete alert or queue files as a workaround.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This candidate carries every change from the `v6.4.2` packet, which was tagged but never published. If you run `v6.4.1`, read the `v6.4.2` notes for the administrator-boundary changes as well.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in `admin` role before upgrading so an intended administrator retains access.
|
||||
- Back up the complete Pulse data directory and configuration before opting into the preview channel, and keep the backup until health and data continuity are verified.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile remains compatible. This candidate does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.1` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"decision": "The release owner selected zero captures. The listed repairs are behavioural changes in alerting, identity, telemetry, installation, upgrade handling and drawer interaction that a static image cannot establish. A staged image would add no proof beyond the qualified journey and could expose environment-specific mount names. This candidate therefore publishes no screenshots.",
|
||||
"captures": []
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
# Pulse v6.4.5-rc.3 Release Notes
|
||||
|
||||
This release candidate follows `v6.4.5-rc.2` and gathers the accumulated monitoring, notification, agent and installation reliability repairs since stable `v6.4.1` into one build intended to become the next stable release. It carries the repairs from `v6.4.5-rc.2` and adds AI knowledge-store save serialization, PBS History host-target retention, and provider-hosted client upgrade and isolation repairs. Preview users can opt in to confirm the fixes before stable promotion. Keep stable `v6.4.1` available for rollback.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Same-name systems stay separate** - Stronger host, Docker, Kubernetes and Proxmox identity checks keep alerts, metrics, actions and removal tied to the right machine even when short names or shared tokens repeat (#1753, #1930).
|
||||
- **Windows agent delivery is restored** - Unified Agent downloads resolve canonical signed `.exe` assets and their signature sidecars, so installation and auto-update no longer fail with HTTP 404 (#1820, #2125).
|
||||
- **Large Availability estates scan faster** - Estates with 20 or more checks open in fleet view, and the chosen table or fleet presentation stays stable across refreshes and shareable URLs.
|
||||
- **Slow starts are recoverable** - A delayed or stalled startup now shows connection status and a retry, and large alert histories catch up incrementally instead of blocking the server (#2129).
|
||||
- **Disk I/O totals are more accurate** - Partition accounting no longer inflates whole-device traffic, and endurance counters stop raising false disk-wear warnings (#2112).
|
||||
- **Duplicate disk rows are reduced** - Linked PVE and agent observations can safely correlate the same USB disk when one source lacks a stable ID, while conflicting and ambiguous devices remain separate (#2076).
|
||||
- **Backup alerts stay truthful** - A PBS host or config backup no longer raises a repeated guest backup-age alert, while a guest backed up locally and copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **PBS History keeps its identity** - Linked rows correlate only with proven identity. Datastores stay distinct across refreshes, and History remains on the PBS host target when its connection uses an IP or alias (#1723).
|
||||
- **PBS capacity follows policy** - Datastore capacity health uses the configured warning and critical thresholds instead of fixed percentages (#1448).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the folded alert history instead of re-walking the whole event log, so a large history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list keeps every host row visible while scrolling instead of dropping rows as the window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the underlying incidents, and the alert-card footer Started run now shares the baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent checkpoints and oversized alert event-log snapshots are no longer rewritten on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the configured destination and grouping window across restarts instead of creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Due notifications survive startup** - A persisted notification already due at startup is no longer processed before saved webhook, email and Apprise destinations are applied, so a grouped recovery is not cancelled as "delivery disabled" (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes critical, the higher severity can bypass only the same-occurrence cooldown and records its destination delivery in notification history (#1801).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current rule, occurrence, acknowledgement and snooze state before admitting a delayed escalation, and an automatic acknowledgement survives a re-fire (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps back to Overview when a live data refresh briefly omits a field that gates that tab, such as a merged metrics target on the Proxmox Backups History view (#1723).
|
||||
- **Filesystem paths stay distinguishable** - Long mount paths use the full Filesystems-panel width and wrap above the usage bar instead of collapsing to identical prefixes (#2121).
|
||||
- **TrueNAS compatibility improves** - AMD temperature aggregates are rejected instead of inflated, CORE memory uses the legacy mapping, and idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type names, probe the current 8.0.3 release shape, and surface API fault detail instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests are treated as the current image, so PostgreSQL and other containers stop reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards its configuration backup, and a completed update clears its trap so success is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs are safer** - The installer verifies agent checksums without GNU coreutils, and commands copied from the web interface preserve the line breaks required by Bash (#2123).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity honours the removal block, and the event-log volume stays bounded through the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live host state instead of losing continuity (#1913).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose in-memory observer was lost or rejected is reconciled from retained intent and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Provider-hosted clients survive upgrades** - Client workspaces reconcile their own networks and health during provider MSP upgrades, avoiding stranded clients and interrupted renewal (#2247).
|
||||
- **Provider client networks stay separate** - An existing provider install does not reuse another tenant's Docker network when provisioning or cleaning up clients (#2226).
|
||||
- **Organization owners see available settings** - Owners can reach the settings routes their own organization is allowed to use (#2208).
|
||||
- **Hosted agent setup mints scoped tokens** - Agent installation tokens are created inside the selected client workspace rather than from another provider context (#2209).
|
||||
- **AI knowledge saves stay consistent** - Concurrent AI knowledge-store saves are serialized behind a single writer, so a rapid sequence of saves can no longer defeat the atomic temp-file rename or recreate files during cleanup.
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse agent inside a Proxmox LXC supplies the container memory reading instead of the cache-inclusive cluster value when the agent total matches the provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration, the configured-admin authorizer and security-setup preferences survive save and restart.
|
||||
- **Verify SSL choices stick** - A node's "Verify SSL Certificate" setting is preserved through agent re-registration and PVE instance consolidation, and an explicit PBS choice is no longer silently overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade documentation warns that `/bin/update` is the community-scripts updater on some Proxmox helper-script containers and points those users at the signed, version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Known issues
|
||||
|
||||
- Retiring a resource can produce repeated alert records and notifications in affected deployments (#2237). This candidate does not yet contain a verified correction.
|
||||
|
||||
- Installed confirmation of the corrected PBS History identity on API-only nodes, agent-linked nodes, standalone PBS systems and multi-datastore systems remains outstanding.
|
||||
- Native pfSense GUI installation, service start and reboot confirmation remains outstanding.
|
||||
- Native confirmation of the mixed-source disk correlation remains outstanding.
|
||||
- Aggregate alert-engine write volume and old duplicate incidents reported in #1966 are reduced but not fully resolved. Monitor write activity on flash storage.
|
||||
- Some v5 to v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- TrueNAS CPU and memory graph acceptance on affected CORE appliances remains incomplete.
|
||||
- Notification-provider acceptance for the corrected escalation and recovery journeys remains incomplete. Notification delivery still depends on destination configuration and provider responses. Do not delete alert or queue files as a workaround.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This candidate carries every change from the `v6.4.2` packet, which was tagged but never published. If you run `v6.4.1`, read the `v6.4.2` notes for the administrator-boundary changes as well.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in `admin` role before upgrading so an intended administrator retains access.
|
||||
- Back up the complete Pulse data directory and configuration before opting into the preview channel, and keep the backup until health and data continuity are verified.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile remains compatible. This candidate does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.1` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"captures": [],
|
||||
"decision": "The release owner selected zero captures. The listed repairs are behavioural changes in alerting, identity, telemetry, installation, upgrade handling and drawer interaction that a static image cannot establish. A staged image would add no proof beyond the qualified journey and could expose environment-specific mount names. This candidate therefore publishes no screenshots.",
|
||||
"schema_version": 1
|
||||
}
|
||||
@@ -0,0 +1,73 @@
|
||||
# Pulse v6.4.5-rc.4 Release Notes
|
||||
|
||||
This release candidate follows published `v6.4.5-rc.3` and is intended to replace it, not to promote that earlier build. It includes all prior candidate repairs since stable `v6.4.1` plus reviewed updater, disk-alert, TrueNAS, linked-guest storage, and notification fixes. In particular, the earlier RC can miss a stable update or select the wrong ARM server archive (#2282), preview users should test this corrected build before any stable promotion. Stable `v6.4.1` remains the rollback target.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Same-name systems stay separate** - Stronger host, Docker, Kubernetes and Proxmox identity checks keep alerts, metrics, actions and removal tied to the right machine even when short names or shared tokens repeat (#1753, #1930).
|
||||
- **Windows agent delivery is restored** - Unified Agent downloads resolve canonical signed `.exe` assets and their signature sidecars, so installation and auto-update no longer fail with HTTP 404 (#1820, #2125).
|
||||
- **Large Availability estates scan faster** - Estates with 20 or more checks open in fleet view, and the chosen table or fleet presentation stays stable across refreshes and shareable URLs.
|
||||
- **Slow starts are recoverable** - A delayed or stalled startup now shows connection status and a retry, and large alert histories catch up incrementally instead of blocking the server (#2129).
|
||||
- **Disk I/O totals are more accurate** - Partition accounting no longer inflates whole-device traffic, and endurance counters stop raising false disk-wear warnings (#2112).
|
||||
- **Duplicate disk rows are reduced** - Linked PVE and agent observations can safely correlate the same USB disk when one source lacks a stable ID, while conflicting and ambiguous devices remain separate (#2076).
|
||||
- **Backup alerts stay truthful** - A PBS host or config backup no longer raises a repeated guest backup-age alert, while a guest backed up locally and copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **PBS History keeps its identity** - Linked rows correlate only with proven identity. Datastores stay distinct across refreshes, and History remains on the PBS host target when its connection uses an IP or alias (#1723).
|
||||
- **PBS capacity follows policy** - Datastore capacity health uses the configured warning and critical thresholds instead of fixed percentages (#1448).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the folded alert history instead of re-walking the whole event log, so a large history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list keeps every host row visible while scrolling instead of dropping rows as the window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the underlying incidents, and the alert-card footer Started run now shares the baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent checkpoints and oversized alert event-log snapshots are no longer rewritten on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the configured destination and grouping window across restarts instead of creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Due notifications survive startup** - A persisted notification already due at startup is no longer processed before saved webhook, email and Apprise destinations are applied, so a grouped recovery is not cancelled as "delivery disabled" (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes critical, the higher severity can bypass only the same-occurrence cooldown and records its destination delivery in notification history (#1801).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current rule, occurrence, acknowledgement and snooze state before admitting a delayed escalation, and an automatic acknowledgement survives a re-fire (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps back to Overview when a live data refresh briefly omits a field that gates that tab, such as a merged metrics target on the Proxmox Backups History view (#1723).
|
||||
- **Filesystem paths stay distinguishable** - Long mount paths use the full Filesystems-panel width and wrap above the usage bar instead of collapsing to identical prefixes (#2121).
|
||||
- **TrueNAS compatibility improves** - AMD temperature aggregates are rejected instead of inflated, CORE memory uses the legacy mapping, and idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type names, probe the current 8.0.3 release shape, and surface API fault detail instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests are treated as the current image, so PostgreSQL and other containers stop reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards its configuration backup, and a completed update clears its trap so success is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs are safer** - The installer verifies agent checksums without GNU coreutils, and commands copied from the web interface preserve the line breaks required by Bash (#2123).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity honours the removal block, and the event-log volume stays bounded through the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live host state instead of losing continuity (#1913).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose in-memory observer was lost or rejected is reconciled from retained intent and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Provider-hosted clients survive upgrades** - Client workspaces reconcile their own networks and health during provider MSP upgrades, avoiding stranded clients and interrupted renewal (#2247).
|
||||
- **Provider client networks stay separate** - An existing provider install does not reuse another tenant's Docker network when provisioning or cleaning up clients (#2226).
|
||||
- **Organization owners see available settings** - Owners can reach the settings routes their own organization is allowed to use (#2208).
|
||||
- **Hosted agent setup mints scoped tokens** - Agent installation tokens are created inside the selected client workspace rather than from another provider context (#2209).
|
||||
- **AI knowledge saves stay consistent** - Concurrent AI knowledge-store saves are serialized behind a single writer, so a rapid sequence of saves can no longer defeat the atomic temp-file rename or recreate files during cleanup.
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse agent inside a Proxmox LXC supplies the container memory reading instead of the cache-inclusive cluster value when the agent total matches the provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration, the configured-admin authorizer and security-setup preferences survive save and restart.
|
||||
- **Verify SSL choices stick** - A node's "Verify SSL Certificate" setting is preserved through agent re-registration and PVE instance consolidation, and an explicit PBS choice is no longer silently overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade documentation warns that `/bin/update` is the community-scripts updater on some Proxmox helper-script containers and points those users at the signed, version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
- **Stable updates become installable again** - Full release metadata is read, offers require the matching server archive, and ARMv6/ARMv7 installs select the correct server build (#2282).
|
||||
- **Older previews may need manual repair** - An install stuck on a broken self-update path may need a manual, version-pinned update instead of relying on that updater (#2282).
|
||||
- **Disk wearout warnings follow confirmed recovery** - Corrected PVE SMART warning handling avoids repeating a warning for a recovered or explicitly excluded disk (#2112). The reporter's same-disk email result still needs an installed retest.
|
||||
- **Retired resources stop generating incidents** - Operator-suppressed or removed resources no longer create the repeated alert activity observed in #2237, installation-level confirmation is pending.
|
||||
- **TrueNAS CORE charts retain CPU and memory data** - The legacy REST request shape and optional graph failures no longer suppress otherwise available host telemetry (#2077).
|
||||
- **Linked guests show physical disks** - VM and container storage views retain linked-agent filesystem, SMART and RAID details when that evidence exists (#2263).
|
||||
- **Queued notifications wait for destinations** - Startup dispatch waits until destination configuration is available, avoiding lost or misrouted recovery messages (#2160).
|
||||
|
||||
## Known issues
|
||||
|
||||
- The corrected retired-resource alert path has not yet been confirmed on the affected installation (#2237).
|
||||
|
||||
- Installed confirmation of the corrected PBS History identity on API-only nodes, agent-linked nodes, standalone PBS systems and multi-datastore systems remains outstanding.
|
||||
- Native pfSense GUI installation, service start and reboot confirmation remains outstanding.
|
||||
- Native confirmation of the mixed-source disk correlation remains outstanding.
|
||||
- Aggregate alert-engine write volume and old duplicate incidents reported in #1966 are reduced but not fully resolved. Monitor write activity on flash storage.
|
||||
- Some v5 to v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- TrueNAS CPU and memory graph acceptance on affected CORE appliances remains incomplete.
|
||||
- Notification-provider acceptance for the corrected escalation and recovery journeys remains incomplete. Notification delivery still depends on destination configuration and provider responses. Do not delete alert or queue files as a workaround.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This candidate carries every change from the `v6.4.2` packet, which was tagged but never published. If you run `v6.4.1`, read the `v6.4.2` notes for the administrator-boundary changes as well.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in `admin` role before upgrading so an intended administrator retains access.
|
||||
- Back up the complete Pulse data directory and configuration before opting into the preview channel, and keep the backup until health and data continuity are verified.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile remains compatible. This candidate does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.1` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"captures": [],
|
||||
"decision": "The release owner selected zero captures. The listed repairs are behavioural changes in alerting, identity, telemetry, installation, upgrade handling and drawer interaction that a static image cannot establish. A staged image would add no proof beyond the qualified journey and could expose environment-specific mount names. This candidate therefore publishes no screenshots.",
|
||||
"schema_version": 1
|
||||
}
|
||||
@@ -0,0 +1,75 @@
|
||||
# Pulse v6.4.5-rc.5 Release Notes
|
||||
|
||||
This preview replaces published `v6.4.5-rc.4` for an alert-delivery regression. A grouped child symptom could notify repeatedly, or remain unnotified after its primary recovered. The reviewed repair fixes that lifecycle. All other product changes are inherited from RC.4. Stable promotion requires exact qualification and a new clean 24-hour soak after this candidate publishes. Stable `v6.4.1` remains the rollback target.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Continuing symptoms are notified once** - Grouped child alerts no longer escape through duplicate escalation. A child that outlives its primary receives its first notification after the primary recovers (#2336).
|
||||
|
||||
- **Same-name systems stay separate** - Stronger host, Docker, Kubernetes and Proxmox identity checks keep alerts, metrics, actions and removal tied to the right machine even when short names or shared tokens repeat (#1753, #1930).
|
||||
- **Windows agent delivery is restored** - Unified Agent downloads resolve canonical signed `.exe` assets and their signature sidecars, so installation and auto-update no longer fail with HTTP 404 (#1820, #2125).
|
||||
- **Large Availability estates scan faster** - Estates with 20 or more checks open in fleet view, and the chosen table or fleet presentation stays stable across refreshes and shareable URLs.
|
||||
- **Slow starts are recoverable** - A delayed or stalled startup now shows connection status and a retry, and large alert histories catch up incrementally instead of blocking the server (#2129).
|
||||
- **Disk I/O totals are more accurate** - Partition accounting no longer inflates whole-device traffic, and endurance counters stop raising false disk-wear warnings (#2112).
|
||||
- **Duplicate disk rows are reduced** - Linked PVE and agent observations can safely correlate the same USB disk when one source lacks a stable ID, while conflicting and ambiguous devices remain separate (#2076).
|
||||
- **Backup alerts stay truthful** - A PBS host or config backup no longer raises a repeated guest backup-age alert, while a guest backed up locally and copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **PBS History keeps its identity** - Linked rows correlate only with proven identity, and datastores stay distinct across refreshes (#1723). Some API-plus-Agent PBS History layouts remain unresolved.
|
||||
- **PBS capacity follows policy** - Datastore capacity health uses the configured warning and critical thresholds instead of fixed percentages (#1448).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the folded alert history instead of re-walking the whole event log, so a large history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list keeps every host row visible while scrolling instead of dropping rows as the window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the underlying incidents, and the alert-card footer Started run now shares the baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent checkpoints and oversized alert event-log snapshots are no longer rewritten on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the configured destination and grouping window across restarts instead of creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Due notifications survive startup** - A persisted notification already due at startup is no longer processed before saved webhook, email and Apprise destinations are applied, so a grouped recovery is not cancelled as "delivery disabled" (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes critical, the higher severity can bypass only the same-occurrence cooldown and records its destination delivery in notification history (#1801).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current rule, occurrence, acknowledgement and snooze state before admitting a delayed escalation, and an automatic acknowledgement survives a re-fire (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps back to Overview when a live data refresh briefly omits a field that gates that tab, such as a merged metrics target on the Proxmox Backups History view (#1723).
|
||||
- **Filesystem paths stay distinguishable** - Long mount paths use the full Filesystems-panel width and wrap above the usage bar instead of collapsing to identical prefixes (#2121).
|
||||
- **TrueNAS compatibility improves** - AMD temperature aggregates are rejected instead of inflated, CORE memory uses the legacy mapping, and idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type names, probe the current 8.0.3 release shape, and surface API fault detail instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests are treated as the current image, so PostgreSQL and other containers stop reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards its configuration backup, and a completed update clears its trap so success is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs are safer** - The installer verifies agent checksums without GNU coreutils, and commands copied from the web interface preserve the line breaks required by Bash (#2123).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity honours the removal block, and the event-log volume stays bounded through the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live host state instead of losing continuity (#1913).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose in-memory observer was lost or rejected is reconciled from retained intent and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Provider-hosted clients survive upgrades** - Client workspaces reconcile their own networks and health during provider MSP upgrades, avoiding stranded clients and interrupted renewal (#2247).
|
||||
- **Provider client networks stay separate** - An existing provider install does not reuse another tenant's Docker network when provisioning or cleaning up clients (#2226).
|
||||
- **Organization owners see available settings** - Owners can reach the settings routes their own organization is allowed to use (#2208).
|
||||
- **Hosted agent setup mints scoped tokens** - Agent installation tokens are created inside the selected client workspace rather than from another provider context (#2209).
|
||||
- **AI knowledge saves stay consistent** - Concurrent AI knowledge-store saves are serialized behind a single writer, so a rapid sequence of saves can no longer defeat the atomic temp-file rename or recreate files during cleanup.
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse agent inside a Proxmox LXC supplies the container memory reading instead of the cache-inclusive cluster value when the agent total matches the provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration, the configured-admin authorizer and security-setup preferences survive save and restart.
|
||||
- **Verify SSL choices stick** - A node's "Verify SSL Certificate" setting is preserved through agent re-registration and PVE instance consolidation, and an explicit PBS choice is no longer silently overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade documentation warns that `/bin/update` is the community-scripts updater on some Proxmox helper-script containers and points those users at the signed, version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
- **Stable updates become installable again** - Full release metadata is read, offers require the matching server archive, and ARMv6/ARMv7 installs select the correct server build (#2282).
|
||||
- **Older previews may need manual repair** - An install stuck on a broken self-update path may need a manual, version-pinned update instead of relying on that updater (#2282).
|
||||
- **Disk wearout warnings follow confirmed recovery** - Corrected PVE SMART warning handling avoids repeating a warning for a recovered or explicitly excluded disk (#2112). The reporter's same-disk email result still needs an installed retest.
|
||||
- **Retired resources stop generating incidents** - Operator-suppressed or removed resources no longer create the repeated alert activity observed in #2237, installation-level confirmation is pending.
|
||||
- **TrueNAS CORE charts retain CPU and memory data** - The legacy REST request shape and optional graph failures no longer suppress otherwise available host telemetry (#2077).
|
||||
- **Linked guests show physical disks** - VM and container storage views retain linked-agent filesystem, SMART and RAID details when that evidence exists (#2263).
|
||||
- **Queued notifications wait for destinations** - Startup dispatch waits until destination configuration is available, avoiding lost or misrouted recovery messages (#2160).
|
||||
|
||||
## Known issues
|
||||
|
||||
- The corrected retired-resource alert path has not yet been confirmed on the affected installation (#2237).
|
||||
|
||||
- Installed confirmation of the corrected PBS History identity on API-only nodes, agent-linked nodes, standalone PBS systems and multi-datastore systems remains outstanding.
|
||||
- Native pfSense GUI installation, service start and reboot confirmation remains outstanding.
|
||||
- Native confirmation of the mixed-source disk correlation remains outstanding.
|
||||
- Aggregate alert-engine write volume and old duplicate incidents reported in #1966 are reduced but not fully resolved. Monitor write activity on flash storage.
|
||||
- Some v5 to v6 deployment-specific upgrade problems remain unresolved (#1913).
|
||||
- TrueNAS CPU and memory graph acceptance on affected CORE appliances remains incomplete.
|
||||
- Notification-provider acceptance for the corrected escalation and recovery journeys remains incomplete. Notification delivery still depends on destination configuration and provider responses. Do not delete alert or queue files as a workaround.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- This candidate carries every change from the `v6.4.2` packet, which was tagged but never published. If you run `v6.4.1`, read the `v6.4.2` notes for the administrator-boundary changes as well.
|
||||
- On an SSO-only deployment, map at least one trusted IdP group to the built-in `admin` role before upgrading so an intended administrator retains access.
|
||||
- Back up the complete Pulse data directory and configuration before opting into the preview channel, and keep the backup until health and data continuity are verified.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile remains compatible. This candidate does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.1` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
@@ -0,0 +1,81 @@
|
||||
# Pulse v6.4.5
|
||||
|
||||
`v6.4.5` is a stable patch release and the first stable release since `v6.4.1`. It brings everyone the fixes that have been in the v6.4.5 previews over the past month: quieter and more accurate alerts, fewer disk writes, working updates and Windows agent installs, and better PBS, TrueNAS, vSphere and Docker support.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Far fewer false disk-wear alerts.** Endurance counters no longer raise false disk-wear warnings, disk I/O totals are no longer inflated, and a recovered or excluded disk stops re-alerting (#2112).
|
||||
- **Stable updates work again.** The updater reads the full release information and offers the right build, including on ARMv6 and ARMv7 (#2282).
|
||||
- **Windows agent installs and auto-updates work again.** Downloads no longer fail with HTTP 404 (#1820, #2125).
|
||||
- **Machines with the same name stay separate.** Hosts, Docker, Kubernetes and Proxmox systems that share a short name or token no longer get their alerts, metrics or actions mixed up (#1753, #1930).
|
||||
- **Less writing to SSD and flash storage.** Pulse no longer rewrites unchanged alert state on every cycle (#1966).
|
||||
- **Large alert histories no longer freeze Pulse.** They load gradually instead of blocking the server, and a slow start now shows its status with a retry button (#2129, #2146).
|
||||
|
||||
## Alerts and notifications
|
||||
|
||||
- A problem that continues after its parent recovers now gets its own notification, and grouped alerts no longer repeat (#2336).
|
||||
- Many alerts recovering at once are grouped into one notification instead of flooding your notification queue (#2160).
|
||||
- Notifications due at startup wait until your webhook, email and Apprise settings have loaded, so they are no longer dropped (#2160).
|
||||
- A warning that becomes critical is now delivered, escalations respect current acknowledgements and snoozes, and an automatic acknowledgement survives the alert firing again (#1801, #2173).
|
||||
- Removed or suppressed resources stop creating alerts (#2237).
|
||||
- The Alerts overview counts now match the incidents shown, alert-card footers line up, and the Alert Thresholds list keeps every host visible while scrolling (#2119, #2130).
|
||||
|
||||
## Disks and storage
|
||||
|
||||
- The same USB disk seen by both Proxmox and the agent can now be shown once when one source lacks a stable ID, while ambiguous or conflicting disks stay separate (#2076).
|
||||
- VMs and containers show the physical disks, SMART and RAID details reported by their linked agent (#2263).
|
||||
- Long mount paths in the Filesystems panel are shown in full instead of being cut to identical prefixes (#2121).
|
||||
|
||||
## Proxmox, PBS and backups
|
||||
|
||||
- PBS host and config backups no longer trigger repeated guest backup-age alerts, and a guest backed up locally and copied to PBS is counted once (#1741, #1721, #2136).
|
||||
- PBS History keeps each host and datastore separate across refreshes (#1723).
|
||||
- PBS datastore health uses your warning and critical thresholds (#1448).
|
||||
- Proxmox LXC memory uses the reading from an online Pulse agent inside the container, which excludes the page cache, when the agent's total matches the container's limit (#2148).
|
||||
- The resource drawer stays on the tab you picked during live refreshes (#1723).
|
||||
- Your "Verify SSL Certificate" choice for a node or PBS is kept through agent re-registration and cluster changes (#2140).
|
||||
|
||||
## TrueNAS, vSphere and Docker
|
||||
|
||||
- TrueNAS: AMD temperatures are no longer inflated, TrueNAS CORE memory is read correctly, CPU and memory charts keep their data, and idle sessions poll less often (#2122, #2077, #1893).
|
||||
- vSphere: enrichment works again with vSphere 8.0.3 and shows the actual API error instead of HTTP 500 (#2070).
|
||||
- Docker: containers such as PostgreSQL no longer show a false "update available" (#2110).
|
||||
|
||||
## Install, updates and agents
|
||||
|
||||
- A failed update no longer leaves stale backups behind, and a successful one is no longer reported as failed (#2127, #2128).
|
||||
- FreeBSD and pfSense agent installs verify checksums without GNU tools, and the copied install command keeps its line breaks (#2123).
|
||||
- Agents that re-enroll with a changed identity heal cleanly without a burst of events, and a removed agent stays removed (#2113, #1586).
|
||||
- Upgrades from v5 keep your existing hosts (#1913).
|
||||
- The upgrade guide warns that on some Proxmox community-script containers `/bin/update` is the community-scripts updater, and shows the signed Pulse installer instead (#2129).
|
||||
- Previews stuck on the old broken self-updater may need one manual, version-pinned update (#2282).
|
||||
|
||||
## Pulse Pro, AI and hosted
|
||||
|
||||
- AI Patrol caches its system prompt, so repeated runs cost less (#2118), and a saved Patrol objective whose watcher was lost or rejected is restored instead of going unchecked (#2147).
|
||||
- AI knowledge saves no longer conflict when made quickly one after another.
|
||||
- Ollama Basic Auth, the configured-admin setting and security setup choices survive saving and restarting.
|
||||
- Provider (MSP) installs keep each client's networks separate and client workspaces healthy through upgrades, and agent install tokens are created in the right client workspace (#2247, #2226, #2209).
|
||||
- Organization owners can reach the settings their organization allows (#2208).
|
||||
|
||||
## Other improvements
|
||||
|
||||
- Availability views with 20 or more checks open in the fleet view, and your chosen table or fleet view stays put across refreshes and shared links.
|
||||
- The metrics store drops replayed samples and is more robust across shutdowns, rollups and upgrades.
|
||||
|
||||
## Known issues
|
||||
|
||||
- **PBS History for a replaced PBS host can reappear.** If a PBS host's identity changes, its old History may show again. No monitoring data is lost. The fix is planned for v6.4.6 (#2343).
|
||||
- **The update screen can stay on "Downloading update… 10%".** The update still completes in the background. Refresh the page after a minute to see the new version. A fix is planned for v6.4.6.
|
||||
- Some PBS History layouts that combine the API and an agent are still not fully resolved (#1723).
|
||||
- Disk writes are much lower but not yet at their final level on busy installs. Keep an eye on write activity if you run on flash storage, and some older duplicate incidents may remain (#1966).
|
||||
- A small number of v5 to v6 upgrade problems remain for specific setups (#1913).
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- Back up your Pulse data directory and configuration, and keep the backup until you have checked everything works.
|
||||
- This release includes the changes from v6.4.2, which was never published. If you use SSO only, map at least one trusted identity-provider group to the built-in `admin` role before upgrading so you keep admin access.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable, so Windows may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile works with this release unchanged. It does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.1`. On systemd and Proxmox LXC installs, use `sudo /bin/update --version v6.4.1`. For Docker Compose, pin `rcourtman/pulse:6.4.1` and recreate the container.
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"captures": [],
|
||||
"decision": "The release owner selected zero captures. Stable v6.4.5 promotes the published v6.4.5-rc.5 unchanged apart from release metadata, and its changes are behavioural fixes that a static image cannot establish.",
|
||||
"schema_version": 1
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
# Pulse v6.4.6-rc.1 Release Notes
|
||||
|
||||
This release candidate opens the `v6.4.6` candidate line after stable `v6.4.5`, which remains the rollback target.
|
||||
|
||||
This maintenance preview keeps Backup Server History attached to the right host and makes updates and startup checks more reliable.
|
||||
|
||||
## What's improved
|
||||
|
||||
- **Backup Server History stays with its host.** History no longer carries readings from a replaced or ambiguously identified host into another host's charts.
|
||||
- **Update progress keeps moving.** The update window follows an update through completion even when the progress stream goes quiet, and waits for the updated server to be ready before offering a reload.
|
||||
- **Startup checks handle both address families.** Local service checks try IPv4 and IPv6 within a bounded timeout, avoiding misleading failures on single-family systems.
|
||||
- **More dependable metrics storage.** Updated SQLite dependencies replace the affected low-level memory-copy implementation.
|
||||
- **Automatic updates stay opt-in.** New installations enable unattended updates only after an affirmative choice.
|
||||
|
||||
## Before you upgrade
|
||||
|
||||
- Back up your Pulse configuration and data before trying this preview. Keep production installations on the stable channel unless you intend to test a preview.
|
||||
- If you sign in through SSO, map at least one trusted IdP group to the built-in `admin` role so an administrator can still manage settings.
|
||||
- Windows Unified Agent binaries are not Authenticode-signed while SignPath remains unavailable and may show an Unknown Publisher warning. Verify downloads with the published checksums and detached signatures.
|
||||
- Pulse Mobile remains compatible. This candidate does not require a companion mobile release.
|
||||
- The rollback target is stable `v6.4.5`. On systemd and Proxmox LXC installs, use this command only when `/bin/update` was installed by the Pulse server installer: `sudo /bin/update --version v6.4.5` to return to the previous stable release. For Docker Compose, pin `rcourtman/pulse:6.4.5` and recreate the container.
|
||||
@@ -0,0 +1,5 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"captures": [],
|
||||
"decision": "Zero captures: these changes repair History attribution, asynchronous update completion, local health probes and installation consent. Static screenshots would not demonstrate their correctness. behavior-specific browser and runtime checks provide the relevant evidence."
|
||||
}
|
||||
@@ -0,0 +1,90 @@
|
||||
# Pulse v6.4.4-beta.1
|
||||
|
||||
This changelog describes the changes since `v6.4.1`, the latest published
|
||||
stable release. The `v6.4.2` tag was staged on 2026-08-31 but never activated
|
||||
as a public release. This beta therefore carries the complete `v6.4.2` change
|
||||
set, the published `v6.4.3-rc.1` foundation, and the bounded release-line
|
||||
regression repairs below.
|
||||
|
||||
## Alert delivery and lifecycle
|
||||
|
||||
- Resolved incidents cannot be revived by later retry work, and destinations
|
||||
disabled before dispatch are recorded as cancelled rather than delivered.
|
||||
- Delivery diagnosis preserves the newest failure, dismissal, or unavailable
|
||||
state when timer, retry, and manual refresh work overlap.
|
||||
- Webhook, Slack, Discord, Telegram, encoded-query, and ntfy diagnostics mask
|
||||
recognised credentials without discarding useful failure context.
|
||||
- Storage and PBS alert identity persists through missing observations,
|
||||
configuration reload, restart, measured recovery, and recurrence.
|
||||
- TrueNAS replication completion and NOTICE severity, PBS capacity/task
|
||||
callbacks, and pool-only or empty Unraid layouts retain their intended alert
|
||||
semantics.
|
||||
|
||||
## Host, update, identity, and interface reliability
|
||||
|
||||
- Host and Docker CPU collection use independent baselines, agent disk
|
||||
collection follows its mount namespace, and Docker update completion requires
|
||||
independent success evidence.
|
||||
- Same-name systems stay separate across provider scope; delayed startup,
|
||||
reconnect, settings navigation, skip-link order, badges, landmarks, and
|
||||
compact controls retain the reviewed recovery and accessibility behavior.
|
||||
- Availability-suggestion backfill derives from the current discovery under
|
||||
lock, so a concurrent manual repair remains intact and deleted records are
|
||||
not resurrected.
|
||||
- Current OpenAI model requests use the supported completion-token parameter
|
||||
and may learn that requirement from bounded API responses.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet and RC1
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404; canonical
|
||||
signed `.exe` assets and detached signatures are served from release assets
|
||||
(#1820).
|
||||
- Infrastructure actions and SSO sessions retain the canonical administrator
|
||||
boundary, sensitive request bodies are bounded, large Availability estates
|
||||
use the compact fleet view, slow starts offer recovery, and Disk I/O totals
|
||||
avoid numbered-partition double counting.
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Issue #1761 has a 7 September installed report that both retained-failure
|
||||
actions return HTTP 503 on stable `v6.4.1` after CSRF validation. The beta's
|
||||
integrated queue-finality and warning-reconciliation changes have not been
|
||||
tested on that reporter's installation, so the beta does not claim to fix this
|
||||
failure. Non-destructive Retry and Dismiss behavior remains an explicit test.
|
||||
- Issue #1812 shows that recovery controls and delivery-attempt details were not
|
||||
discoverable from a `v6.4.1` incident timeline. The beta includes the Overview
|
||||
controls and Notifications activity view, but installed discoverability is
|
||||
unverified; broader task orchestration is outside this checkpoint.
|
||||
- Issue #1966 reports 50-66 GB/day of process writes and duplicate incident IDs
|
||||
on one idle `v6.4.1` LXC. This beta does not establish reduced aggregate
|
||||
writes, migrate old duplicates, or resolve that installed report.
|
||||
- A paired advisory benchmark measured UUID route-segment normalization at
|
||||
62.50 ns/op versus 51.64 ns/op (+21.04%, zero allocations). Candidate-only
|
||||
CI passed its budget, but the paired result remains adverse evidence for
|
||||
beta observation and requires a new disposition before RC.
|
||||
- Permanent SMTP authentication, configuration, or rejection errors may still
|
||||
consume the existing inner retry budget before final failure.
|
||||
- Ordinary off-LAN native receipt, terminated-process replay, Doze, expiry,
|
||||
and failed-WAN cases are not qualified by this server checkpoint.
|
||||
- Historical notification rows are not rewritten or blindly replayed.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.4-beta.1`
|
||||
- Previous published preview: `v6.4.3-rc.1`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push, or onboarding contract changed from
|
||||
`v6.4.1`, so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,101 @@
|
||||
# Pulse v6.4.4-beta.2
|
||||
|
||||
This changelog describes the changes since `v6.4.4-beta.1`. It carries the complete `v6.4.2` change set from that
|
||||
published beta and `v6.4.3-rc.1` foundation,
|
||||
then adds the bounded recurring-incident lifecycle repairs below.
|
||||
|
||||
## Alert delivery and lifecycle
|
||||
|
||||
- Exact occurrence start times now bind delayed lifecycle replay to the
|
||||
intended incident. Historical resolution and acknowledgement cannot mutate a
|
||||
later recurrence, and canonical projection stops at the next retained start.
|
||||
- Replayed firing and resolution transitions are idempotent across retained
|
||||
checkpoints; genuine recurrences keep distinct shells and timelines.
|
||||
- Resolved incidents cannot be revived by later retry work, and destinations
|
||||
disabled before dispatch are recorded as cancelled rather than delivered.
|
||||
- Queue statistics, dead-letter inspection, Retry, and Dismiss follow the live
|
||||
notification queue after runtime replacement instead of retaining a stopped
|
||||
queue owner and returning HTTP 503.
|
||||
- A webhook `Retry-After` value overrides only its response-specific wait; a
|
||||
zero hint no longer erases exponential pacing for later unhinted failures.
|
||||
- Delivery diagnosis preserves the newest failure, dismissal, or unavailable
|
||||
state when timer, retry, and manual refresh work overlap.
|
||||
- Webhook, Slack, Discord, Telegram, encoded-query, and ntfy diagnostics mask
|
||||
recognised credentials without discarding useful failure context.
|
||||
- Cold tenant resource-store construction no longer holds the shared cache
|
||||
lock or delays unrelated tenants. Same-tenant opens remain deduplicated, and
|
||||
eviction coordinates with in-flight construction.
|
||||
- Storage and PBS alert identity persists through missing observations,
|
||||
configuration reload, restart, measured recovery, and recurrence.
|
||||
- TrueNAS replication completion and NOTICE severity, PBS capacity/task
|
||||
callbacks, and pool-only or empty Unraid layouts retain their intended alert
|
||||
semantics.
|
||||
|
||||
## Host, update, identity, and interface reliability
|
||||
|
||||
- Host and Docker CPU collection use independent baselines, agent disk
|
||||
collection follows its mount namespace, and Docker update completion requires
|
||||
independent success evidence.
|
||||
- Same-name systems stay separate across provider scope; delayed startup,
|
||||
reconnect, settings navigation, skip-link order, badges, landmarks, and
|
||||
compact controls retain the reviewed recovery and accessibility behavior.
|
||||
- Availability-suggestion backfill derives from the current discovery under
|
||||
lock, so a concurrent manual repair remains intact and deleted records are
|
||||
not resurrected.
|
||||
- Current OpenAI model requests use the supported completion-token parameter
|
||||
and may learn that requirement from bounded API responses.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet and RC1
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404; canonical
|
||||
signed `.exe` assets and detached signatures are served from release assets
|
||||
(#1820).
|
||||
- Infrastructure actions and SSO sessions retain the canonical administrator
|
||||
boundary, sensitive request bodies are bounded, large Availability estates
|
||||
use the compact fleet view, slow starts offer recovery, and Disk I/O totals
|
||||
avoid numbered-partition double counting.
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Issue #1761 has a 7 September installed report that both retained-failure
|
||||
actions return HTTP 503 on stable `v6.4.1` while alert emails continue. This
|
||||
beta repairs the reproduced stopped-queue ownership path, but has not been
|
||||
verified on that reporter's installation. Non-destructive Retry and Dismiss
|
||||
behavior after reload remains an explicit test.
|
||||
- Issue #1812 shows that recovery controls and delivery-attempt details were not
|
||||
discoverable from a `v6.4.1` incident timeline. The beta includes the Overview
|
||||
controls and Notifications activity view, but installed discoverability is
|
||||
unverified; broader task orchestration is outside this checkpoint.
|
||||
- Issue #1966 reports 50-66 GB/day of process writes and duplicate incident IDs
|
||||
on one idle `v6.4.1` LXC. This beta does not establish reduced aggregate
|
||||
writes, migrate old duplicates, or resolve that installed report.
|
||||
- A paired advisory benchmark measured the metrics-store statistics handler at
|
||||
94.42 µs/op versus 81.86 µs/op (+15.35%). That handler was not changed by
|
||||
the tenant-isolation repair, but the result remains adverse evidence for beta
|
||||
observation and requires a new disposition before RC.
|
||||
- Permanent SMTP authentication, configuration, or rejection errors may still
|
||||
consume the existing inner retry budget before final failure.
|
||||
- Ordinary off-LAN native receipt, terminated-process replay, Doze, expiry,
|
||||
and failed-WAN cases are not qualified by this server checkpoint.
|
||||
- Historical notification rows are not rewritten or blindly replayed.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.4-beta.2`
|
||||
- Previous published preview: `v6.4.4-beta.1`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push, or onboarding contract changed from
|
||||
`v6.4.1`, so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,89 @@
|
||||
# Pulse v6.4.4-beta.3
|
||||
|
||||
This changelog describes the changes since `v6.4.4-beta.2`. The bounded delta
|
||||
corrects History target selection. The alert, recovery, API, host, update,
|
||||
identity, reconnect, and accessibility repairs from the published beta.2 remain
|
||||
included. This beta carries the complete `v6.4.2` change set through the
|
||||
published preview line.
|
||||
|
||||
## Proxmox node History
|
||||
|
||||
- Unified Proxmox node resources now retain canonical metrics coordinates in
|
||||
the frontend model.
|
||||
- API-collected Proxmox nodes target the `node` store family instead of an
|
||||
inferred `agent` family. Explicit agent targets remain available when that is
|
||||
the actual stored source.
|
||||
- Existing History groups continue to omit node disk I/O where that series is
|
||||
not supported.
|
||||
|
||||
## Proxmox Backup Server History
|
||||
|
||||
- The Backups resource query now includes standalone PBS agent telemetry.
|
||||
- A PBS system can correlate to a uniquely identified standalone agent or an
|
||||
agent-bearing VM or system container.
|
||||
- Duplicate resource snapshots are removed before the Backups model is built.
|
||||
- CPU and memory series can plot without disk data. Missing network and disk
|
||||
series remain visible as collecting.
|
||||
- Ambiguous or absent identity evidence does not guess a History target.
|
||||
|
||||
## Monitoring lifecycle synchronization
|
||||
|
||||
- Monitoring state snapshots now use the same synchronization boundary as
|
||||
startup and reset writes.
|
||||
- The correction removes a race found during release validation. The first
|
||||
beta.3 candidate was rejected and was not published.
|
||||
|
||||
## Verification scope
|
||||
|
||||
- Focused Go race checks cover canonical metrics targets.
|
||||
- Focused monitoring race checks cover concurrent startup, snapshot reads, and
|
||||
mock-state reset.
|
||||
- Focused frontend model, adapter, drawer, and Proxmox surface checks cover
|
||||
node and PBS target selection, missing data, and ambiguity guards.
|
||||
- Source-built Chromium checks at desktop and phone widths verify the exact
|
||||
VM and agent History requests and CPU and memory plotting without disk data.
|
||||
- These checks use synthetic inventory and History responses. Installed
|
||||
Proxmox and PBS acceptance remains a beta observation task.
|
||||
|
||||
## Carried reliability repairs
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete copies stay out of recoverable latest-backup
|
||||
pointers (#1815).
|
||||
- Separate standalone sites that reuse one short node name and one enrollment
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404. Canonical
|
||||
executable assets and detached signatures remain available (#1820).
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Installed History rendering for API-only nodes, agent-linked nodes,
|
||||
standalone PBS systems, and PVE-hosted PBS systems is not yet confirmed.
|
||||
- Beta.2 alert acceptance passed on a controlled installation, but ordinary
|
||||
email-provider and reporter acceptance remain incomplete.
|
||||
- Issue #1966 aggregate write volume and duplicate-incident evidence remain
|
||||
unresolved and are not claimed as repaired by this checkpoint.
|
||||
- The retained beta.2 metrics-handler advisory result remains open before RC.
|
||||
- Paired candidate measurements repeatedly show slower low-level route-segment
|
||||
normalization with unchanged allocations. Focused full History middleware
|
||||
measurements did not reproduce a slowdown, and no installed or user-facing
|
||||
regression is established. Preserve both the adverse and bounding evidence
|
||||
for RC disposition.
|
||||
- Permanent SMTP failures may still consume the inner retry budget before final
|
||||
queue handling.
|
||||
- No governed mobile, Relay, pairing, approval, push, or onboarding contract
|
||||
changed.
|
||||
|
||||
## Release metadata
|
||||
|
||||
- Version: `v6.4.4-beta.3`
|
||||
- Previous published preview: `v6.4.4-beta.2`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while the
|
||||
standing SignPath-unavailable policy applies
|
||||
- Mobile decision: `no-mobile-impact`. No product mobile contract changed, so
|
||||
no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,102 @@
|
||||
# Pulse v6.4.4-beta.4
|
||||
|
||||
This changelog describes the changes since published `v6.4.4-beta.2`.
|
||||
Beta.3 did not complete publication. Beta.4 fixes that History checkpoint
|
||||
forward with metrics-statistics connection isolation while retaining the alert,
|
||||
recovery, API, host, update, identity, reconnect, and accessibility repairs from
|
||||
beta.2. It also carries the complete `v6.4.2` change set through the published
|
||||
preview line.
|
||||
|
||||
## Proxmox node History
|
||||
|
||||
- Unified Proxmox node resources now retain canonical metrics coordinates in
|
||||
the frontend model.
|
||||
- API-collected Proxmox nodes target the `node` store family instead of an
|
||||
inferred `agent` family. Explicit agent targets remain available when that is
|
||||
the actual stored source.
|
||||
- Existing History groups continue to omit node disk I/O where that series is
|
||||
not supported.
|
||||
|
||||
## Proxmox Backup Server History
|
||||
|
||||
- The Backups resource query now includes standalone PBS agent telemetry.
|
||||
- A PBS system can correlate to a uniquely identified standalone agent or an
|
||||
agent-bearing VM or system container.
|
||||
- Duplicate resource snapshots are removed before the Backups model is built.
|
||||
- CPU and memory series can plot without disk data. Missing network and disk
|
||||
series remain visible as collecting.
|
||||
- Ambiguous or absent identity evidence does not guess a History target.
|
||||
|
||||
## Metrics statistics isolation
|
||||
|
||||
- Metrics tier statistics now use one dedicated read-only connection rather
|
||||
than sharing the bounded History and write pool.
|
||||
- The reader returns current committed counts and rejects writes; it does not
|
||||
introduce a cache or estimate.
|
||||
- Normal and timed-out shutdown paths close both owned database handles.
|
||||
- The existing 500-node mixed-endpoint workload and its latency budgets remain
|
||||
unchanged.
|
||||
|
||||
## Monitoring lifecycle synchronization
|
||||
|
||||
- Monitoring state snapshots use the same synchronization boundary as startup
|
||||
and reset writes.
|
||||
- The correction removes a race found during release validation.
|
||||
|
||||
## Verification scope
|
||||
|
||||
- Focused Go race checks cover canonical metrics targets and monitoring
|
||||
lifecycle synchronization.
|
||||
- Focused metrics-store checks hold every History connection while validating
|
||||
current committed statistics, read-only behavior, clearing, and closure.
|
||||
- Three controlled hosted comparisons completed 30 of 30 candidate checks and
|
||||
kept mixed statistics p95 below the existing four-second budget.
|
||||
- Focused frontend model, adapter, drawer, and Proxmox surface checks cover
|
||||
node and PBS target selection, missing data, and ambiguity guards.
|
||||
- Source-built Chromium checks at desktop and phone widths verify the exact VM
|
||||
and agent History requests and CPU and memory plotting without disk data.
|
||||
- These checks use synthetic inventory and History responses. Installed
|
||||
Proxmox and PBS acceptance remains a beta observation task.
|
||||
|
||||
## Carried reliability repairs
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete copies stay out of recoverable latest-backup
|
||||
pointers (#1815).
|
||||
- Separate standalone sites that reuse one short node name and one enrollment
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404. Canonical
|
||||
executable assets and detached signatures remain available (#1820).
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Installed History rendering for API-only nodes, agent-linked nodes,
|
||||
standalone PBS systems, and PVE-hosted PBS systems is not yet confirmed.
|
||||
- Installed high-request-rate statistics behavior is not established. Active
|
||||
long-running reads can extend shutdown, and query cancellation and constructor
|
||||
fault injection remain RC follow-up items.
|
||||
- An advisory paired comparison measured route normalization at 2.495 ns versus
|
||||
2.185 ns. Route code is unchanged and no user-facing regression is
|
||||
established; preserve the adverse result for RC disposition.
|
||||
- Beta.2 alert acceptance passed on a controlled installation, but ordinary
|
||||
email-provider and reporter acceptance remain incomplete.
|
||||
- Issue #1966 aggregate write volume and duplicate-incident evidence remain
|
||||
unresolved and are not claimed as repaired by this checkpoint.
|
||||
- Permanent SMTP failures may still consume the inner retry budget before final
|
||||
queue handling.
|
||||
- No governed mobile, Relay, pairing, approval, push, or onboarding contract
|
||||
changed.
|
||||
|
||||
## Release metadata
|
||||
|
||||
- Version: `v6.4.4-beta.4`
|
||||
- Previous published preview: `v6.4.4-beta.2`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while the
|
||||
standing SignPath-unavailable policy applies
|
||||
- Mobile decision: `no-mobile-impact`. No product mobile contract changed, so
|
||||
no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,105 @@
|
||||
# Pulse v6.4.5-beta.1
|
||||
|
||||
This changelog describes the changes since `v6.4.1`. It carries the complete
|
||||
`v6.4.2` change set and the inherited published preview repairs. The previous
|
||||
published preview is `v6.4.4-beta.2`; beta.3 and beta.4 did not publish and beta.5
|
||||
was withdrawn. This version does not claim those failed checks were cleared.
|
||||
|
||||
## TrueNAS CORE snapshots
|
||||
|
||||
Non-object REST alert arguments no longer abort snapshots (#2077). Alert text
|
||||
is preserved and only object fields supply disk identity or SMART evidence.
|
||||
|
||||
## Proxmox node History
|
||||
|
||||
- Unified Proxmox node resources now retain canonical metrics coordinates in
|
||||
the frontend model.
|
||||
- API-collected Proxmox nodes target the `node` store family instead of an
|
||||
inferred `agent` family. Explicit agent targets remain available when that is
|
||||
the actual stored source.
|
||||
- Existing History groups continue to omit node disk I/O where that series is
|
||||
not supported.
|
||||
|
||||
## Proxmox Backup Server History
|
||||
|
||||
- The Backups resource query now includes standalone PBS agent telemetry.
|
||||
- A PBS system can correlate to a uniquely identified standalone agent or an
|
||||
agent-bearing VM or system container.
|
||||
- Duplicate resource snapshots are removed before the Backups model is built.
|
||||
- CPU and memory series can plot without disk data. Missing network and disk
|
||||
series remain visible as collecting.
|
||||
- Ambiguous or absent identity evidence does not guess a History target.
|
||||
|
||||
## Metrics statistics isolation
|
||||
|
||||
- Metrics tier statistics now use one dedicated read-only connection rather
|
||||
than sharing the bounded History and write pool.
|
||||
- The reader returns current committed counts and rejects writes; it does not
|
||||
introduce a cache or estimate.
|
||||
- Normal and timed-out shutdown paths close both owned database handles.
|
||||
- The existing 500-node mixed-endpoint workload and its latency budgets remain
|
||||
unchanged.
|
||||
|
||||
## Monitoring lifecycle synchronization
|
||||
|
||||
- Monitoring state snapshots use the same synchronization boundary as startup
|
||||
and reset writes.
|
||||
- The correction removes a race found during release validation.
|
||||
|
||||
## Verification scope
|
||||
|
||||
- Focused Go race checks cover canonical metrics targets and monitoring
|
||||
lifecycle synchronization.
|
||||
- Focused metrics-store checks hold every History connection while validating
|
||||
current committed statistics, read-only behavior, clearing, and closure.
|
||||
- Three controlled hosted comparisons completed 30 of 30 candidate checks and
|
||||
kept mixed statistics p95 below the existing four-second budget.
|
||||
- Focused frontend model, adapter, drawer, and Proxmox surface checks cover
|
||||
node and PBS target selection, missing data, and ambiguity guards.
|
||||
- Source-built Chromium checks at desktop and phone widths verify the exact VM
|
||||
and agent History requests and CPU and memory plotting without disk data.
|
||||
- These checks use synthetic inventory and History responses. Installed
|
||||
Proxmox and PBS acceptance remains a beta observation task.
|
||||
|
||||
## Carried reliability repairs
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete copies stay out of recoverable latest-backup
|
||||
pointers (#1815).
|
||||
- Separate standalone sites that reuse one short node name and one enrollment
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404. Canonical
|
||||
executable assets and detached signatures remain available (#1820).
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Installed History rendering for API-only nodes, agent-linked nodes,
|
||||
standalone PBS systems, and PVE-hosted PBS systems is not yet confirmed.
|
||||
- Installed high-request-rate statistics behavior is not established. Active
|
||||
long-running reads can extend shutdown, and query cancellation and constructor
|
||||
fault injection remain RC follow-up items.
|
||||
- An advisory paired comparison measured route normalization at 2.495 ns versus
|
||||
2.185 ns. Route code is unchanged and no user-facing regression is
|
||||
established; preserve the adverse result for RC disposition.
|
||||
- Beta.2 alert acceptance passed on a controlled installation, but ordinary
|
||||
email-provider and reporter acceptance remain incomplete.
|
||||
- Issue #1966 aggregate write volume and duplicate-incident evidence remain
|
||||
unresolved and are not claimed as repaired by this checkpoint.
|
||||
- Permanent SMTP failures may still consume the inner retry budget before final
|
||||
queue handling.
|
||||
- No governed mobile, Relay, pairing, approval, push, or onboarding contract
|
||||
changed.
|
||||
|
||||
## Release metadata
|
||||
|
||||
- Version: `v6.4.5-beta.1`
|
||||
- Previous published preview: `v6.4.4-beta.2`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while the
|
||||
standing SignPath-unavailable policy applies
|
||||
- Mobile decision: `no-mobile-impact`. No product mobile contract changed, so
|
||||
no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,125 @@
|
||||
# Pulse v6.4.5-beta.2
|
||||
|
||||
This changelog describes the changes since `v6.4.5-beta.1`. It carries the
|
||||
complete `v6.4.2` change set.
|
||||
|
||||
## Reliability corrections since beta.1
|
||||
|
||||
- **Creating tenant API tokens avoids inventory startup** - Session-authenticated
|
||||
token creation no longer starts a tenant monitor. Organization membership,
|
||||
lifecycle, CSRF, token ownership and scopes remain enforced.
|
||||
- **Tenant inventory starts with one provider fill** - Initial resource-store
|
||||
wiring batches supplemental providers while preserving synchronous readiness.
|
||||
- **Notification severity preferences stay saved** - Email and webhook settings
|
||||
preserve “Warnings and critical alerts” through save, reload and display (#2069).
|
||||
- **Fewer unchanged alert checkpoint writes** - Byte-identical pending-intent
|
||||
checkpoints are not rewritten. Changed state still persists and stale files are
|
||||
repaired. This does not resolve all reported write volume (#1966).
|
||||
- **More disks remain visible** - Disks without a serial number keep distinct
|
||||
inventory identities (#2076).
|
||||
- **All disk mounts stay reachable** - The Disks card no longer clips its mount
|
||||
list inside a nested scroller. Mounts remain in the outer scrolling flow,
|
||||
including keyboard access to the final mount (#2051).
|
||||
- **Container image checks tolerate registry differences** - Digest discovery
|
||||
can fall back to a validated manifest response when HEAD lacks a digest (#2048).
|
||||
- **VM-linked agent memory is used correctly** - Fresh available agent memory can
|
||||
supply the linked VM reading without confusing provider instances (#1962).
|
||||
|
||||
## TrueNAS CORE snapshots
|
||||
|
||||
Non-object REST alert arguments no longer abort snapshots (#2077). Alert text
|
||||
is preserved and only object fields supply disk identity or SMART evidence.
|
||||
|
||||
## Proxmox node History
|
||||
|
||||
- Unified Proxmox node resources now retain canonical metrics coordinates in
|
||||
the frontend model.
|
||||
- API-collected Proxmox nodes target the `node` store family instead of an
|
||||
inferred `agent` family. Explicit agent targets remain available when that is
|
||||
the actual stored source.
|
||||
- Existing History groups continue to omit node disk I/O where that series is
|
||||
not supported.
|
||||
|
||||
## Proxmox Backup Server History
|
||||
|
||||
- The Backups resource query now includes standalone PBS agent telemetry.
|
||||
- A PBS system can correlate to a uniquely identified standalone agent or an
|
||||
agent-bearing VM or system container.
|
||||
- Duplicate resource snapshots are removed before the Backups model is built.
|
||||
- CPU and memory series can plot without disk data. Missing network and disk
|
||||
series remain visible as collecting.
|
||||
- Ambiguous or absent identity evidence does not guess a History target.
|
||||
|
||||
## Metrics statistics isolation
|
||||
|
||||
- Metrics tier statistics now use one dedicated read-only connection rather
|
||||
than sharing the bounded History and write pool.
|
||||
- The reader returns current committed counts and rejects writes; it does not
|
||||
introduce a cache or estimate.
|
||||
- Normal and timed-out shutdown paths close both owned database handles.
|
||||
- The existing 500-node mixed-endpoint workload and its latency budgets remain
|
||||
unchanged.
|
||||
|
||||
## Monitoring lifecycle synchronization
|
||||
|
||||
- Monitoring state snapshots use the same synchronization boundary as startup
|
||||
and reset writes.
|
||||
- The correction removes a race found during release validation.
|
||||
|
||||
## Verification scope
|
||||
|
||||
- Focused Go race checks cover canonical metrics targets and monitoring
|
||||
lifecycle synchronization.
|
||||
- Focused metrics-store checks hold every History connection while validating
|
||||
current committed statistics, read-only behavior, clearing, and closure.
|
||||
- Three controlled hosted comparisons completed 30 of 30 candidate checks and
|
||||
kept mixed statistics p95 below the existing four-second budget.
|
||||
- Focused frontend model, adapter, drawer, and Proxmox surface checks cover
|
||||
node and PBS target selection, missing data, and ambiguity guards.
|
||||
- Source-built Chromium checks at desktop and phone widths verify the exact VM
|
||||
and agent History requests and CPU and memory plotting without disk data.
|
||||
- These checks use synthetic inventory and History responses. Installed
|
||||
Proxmox and PBS acceptance remains a beta observation task.
|
||||
|
||||
## Carried reliability repairs
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete copies stay out of recoverable latest-backup
|
||||
pointers (#1815).
|
||||
- Separate standalone sites that reuse one short node name and one enrollment
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404. Canonical
|
||||
executable assets and detached signatures remain available (#1820).
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Installed History rendering for API-only nodes, agent-linked nodes,
|
||||
standalone PBS systems, and PVE-hosted PBS systems is not yet confirmed.
|
||||
- Installed high-request-rate statistics behavior is not established. Active
|
||||
long-running reads can extend shutdown, and query cancellation and constructor
|
||||
fault injection remain RC follow-up items.
|
||||
- An advisory paired comparison measured route normalization at 2.495 ns versus
|
||||
2.185 ns. Route code is unchanged and no user-facing regression is
|
||||
established; preserve the adverse result for RC disposition.
|
||||
- Beta.1 alert acceptance passed on a controlled installation, but ordinary
|
||||
email-provider and reporter acceptance remain incomplete.
|
||||
- Issue #1966 aggregate write volume and duplicate-incident evidence remain
|
||||
unresolved and are not claimed as repaired by this checkpoint.
|
||||
- Permanent SMTP failures may still consume the inner retry budget before final
|
||||
queue handling.
|
||||
- No governed mobile, Relay, pairing, approval, push, or onboarding contract
|
||||
changed.
|
||||
|
||||
## Release metadata
|
||||
|
||||
- Version: `v6.4.5-beta.2`
|
||||
- Previous published preview: `v6.4.5-beta.1`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while the
|
||||
standing SignPath-unavailable policy applies
|
||||
- Mobile decision: `no-mobile-impact`. No product mobile contract changed, so
|
||||
no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,127 @@
|
||||
# Pulse v6.4.5-beta.3
|
||||
|
||||
This changelog describes the changes since `v6.4.5-beta.2`. The
|
||||
`v6.4.5-beta.2` preparation did not complete publication, so the previous
|
||||
published preview remains `v6.4.5-beta.1`. It carries the complete `v6.4.2`
|
||||
change set.
|
||||
|
||||
## Reliability corrections since beta.1
|
||||
|
||||
- **Creating tenant API tokens avoids inventory startup** - Session-authenticated
|
||||
token creation no longer starts a tenant monitor. Organization membership,
|
||||
lifecycle, CSRF, token ownership and scopes remain enforced.
|
||||
- **Tenant inventory starts with one provider fill** - Initial resource-store
|
||||
wiring batches supplemental providers while preserving synchronous readiness.
|
||||
- **Notification severity preferences stay saved** - Email and webhook settings
|
||||
preserve “Warnings and critical alerts” through save, reload and display (#2069).
|
||||
- **Fewer unchanged alert checkpoint writes** - Byte-identical pending-intent
|
||||
checkpoints are not rewritten. Changed state still persists and stale files are
|
||||
repaired. This does not resolve all reported write volume (#1966).
|
||||
- **More disks remain visible** - Disks without a serial number keep distinct
|
||||
inventory identities (#2076).
|
||||
- **All disk mounts stay reachable** - The Disks card no longer clips its mount
|
||||
list inside a nested scroller. Mounts remain in the outer scrolling flow,
|
||||
including keyboard access to the final mount (#2051).
|
||||
- **Container image checks tolerate registry differences** - Digest discovery
|
||||
can fall back to a validated manifest response when HEAD lacks a digest (#2048).
|
||||
- **VM-linked agent memory is used correctly** - Fresh available agent memory can
|
||||
supply the linked VM reading without confusing provider instances (#1962).
|
||||
|
||||
## TrueNAS CORE snapshots
|
||||
|
||||
Non-object REST alert arguments no longer abort snapshots (#2077). Alert text
|
||||
is preserved and only object fields supply disk identity or SMART evidence.
|
||||
|
||||
## Proxmox node History
|
||||
|
||||
- Unified Proxmox node resources now retain canonical metrics coordinates in
|
||||
the frontend model.
|
||||
- API-collected Proxmox nodes target the `node` store family instead of an
|
||||
inferred `agent` family. Explicit agent targets remain available when that is
|
||||
the actual stored source.
|
||||
- Existing History groups continue to omit node disk I/O where that series is
|
||||
not supported.
|
||||
|
||||
## Proxmox Backup Server History
|
||||
|
||||
- The Backups resource query now includes standalone PBS agent telemetry.
|
||||
- A PBS system can correlate to a uniquely identified standalone agent or an
|
||||
agent-bearing VM or system container.
|
||||
- Duplicate resource snapshots are removed before the Backups model is built.
|
||||
- CPU and memory series can plot without disk data. Missing network and disk
|
||||
series remain visible as collecting.
|
||||
- Ambiguous or absent identity evidence does not guess a History target.
|
||||
|
||||
## Metrics statistics isolation
|
||||
|
||||
- Metrics tier statistics now use one dedicated read-only connection rather
|
||||
than sharing the bounded History and write pool.
|
||||
- The reader returns current committed counts and rejects writes; it does not
|
||||
introduce a cache or estimate.
|
||||
- Normal and timed-out shutdown paths close both owned database handles.
|
||||
- The existing 500-node mixed-endpoint workload and its latency budgets remain
|
||||
unchanged.
|
||||
|
||||
## Monitoring lifecycle synchronization
|
||||
|
||||
- Monitoring state snapshots use the same synchronization boundary as startup
|
||||
and reset writes.
|
||||
- The correction removes a race found during release validation.
|
||||
|
||||
## Verification scope
|
||||
|
||||
- Focused Go race checks cover canonical metrics targets and monitoring
|
||||
lifecycle synchronization.
|
||||
- Focused metrics-store checks hold every History connection while validating
|
||||
current committed statistics, read-only behavior, clearing, and closure.
|
||||
- Three controlled hosted comparisons completed 30 of 30 candidate checks and
|
||||
kept mixed statistics p95 below the existing four-second budget.
|
||||
- Focused frontend model, adapter, drawer, and Proxmox surface checks cover
|
||||
node and PBS target selection, missing data, and ambiguity guards.
|
||||
- Source-built Chromium checks at desktop and phone widths verify the exact VM
|
||||
and agent History requests and CPU and memory plotting without disk data.
|
||||
- These checks use synthetic inventory and History responses. Installed
|
||||
Proxmox and PBS acceptance remains a beta observation task.
|
||||
|
||||
## Carried reliability repairs
|
||||
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete copies stay out of recoverable latest-backup
|
||||
pointers (#1815).
|
||||
- Separate standalone sites that reuse one short node name and one enrollment
|
||||
token no longer collapse into a single host or Docker record (#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404. Canonical
|
||||
executable assets and detached signatures remain available (#1820).
|
||||
|
||||
## Known beta limits
|
||||
|
||||
- Installed History rendering for API-only nodes, agent-linked nodes,
|
||||
standalone PBS systems, and PVE-hosted PBS systems is not yet confirmed.
|
||||
- Installed high-request-rate statistics behavior is not established. Active
|
||||
long-running reads can extend shutdown, and query cancellation and constructor
|
||||
fault injection remain RC follow-up items.
|
||||
- An advisory paired comparison measured route normalization at 2.495 ns versus
|
||||
2.185 ns. Route code is unchanged and no user-facing regression is
|
||||
established; preserve the adverse result for RC disposition.
|
||||
- Beta.1 alert acceptance passed on a controlled installation, but ordinary
|
||||
email-provider and reporter acceptance remain incomplete.
|
||||
- Issue #1966 aggregate write volume and duplicate-incident evidence remain
|
||||
unresolved and are not claimed as repaired by this checkpoint.
|
||||
- Permanent SMTP failures may still consume the inner retry budget before final
|
||||
queue handling.
|
||||
- No governed mobile, Relay, pairing, approval, push, or onboarding contract
|
||||
changed.
|
||||
|
||||
## Release metadata
|
||||
|
||||
- Version: `v6.4.5-beta.3`
|
||||
- Previous published preview: `v6.4.5-beta.1`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while the
|
||||
standing SignPath-unavailable policy applies
|
||||
- Mobile decision: `no-mobile-impact`. No product mobile contract changed, so
|
||||
no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,128 @@
|
||||
# Pulse v6.4.5-rc.1
|
||||
|
||||
This changelog describes the changes since `v6.4.1`, the latest published
|
||||
stable release. The `v6.4.2` tag was staged but never activated as a public
|
||||
release, so this candidate carries the complete `v6.4.2` change set recorded
|
||||
in `V6_CHANGELOG_v6.4.2.md` plus the corrections that landed on the
|
||||
`release/v6.4` line after that tag and the preview corrections exercised in
|
||||
`v6.4.5-beta.1`.
|
||||
|
||||
## Reliability corrections since v6.4.1
|
||||
|
||||
- **Backup age alerts stay truthful** - A guest backed up locally on Proxmox
|
||||
and copied to a PBS is counted once, and a host that stops reporting no
|
||||
longer raises repeated critical backup-age alerts (#1741, #1721, #2136).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list
|
||||
keeps every host row visible while scrolling instead of dropping rows as the
|
||||
window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics and text
|
||||
alignment match the underlying incidents after retries and refreshes
|
||||
(#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent
|
||||
checkpoints and oversized alert event-log snapshots are no longer rewritten
|
||||
on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Guest panels order predictably** - The workload drawer lists Filesystems
|
||||
before Tags, matching the rest of the interface (#2121).
|
||||
- **TrueNAS telemetry is accurate** - AMD temperature aggregates are rejected
|
||||
instead of inflated, CORE memory is read through the legacy REST path, and
|
||||
idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type
|
||||
names, probe the current 8.0.3 release shape, and surface API fault detail
|
||||
instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests
|
||||
are treated as the current image, so PostgreSQL and other containers stop
|
||||
reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards
|
||||
its configuration backup, and a completed update clears its trap so success
|
||||
is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs verify checksums** - The installer verifies
|
||||
downloaded agent checksums without relying on GNU coreutils (#2123).
|
||||
- **Custom sensor warnings are delivered** - Health-assessment escalations for
|
||||
custom sensors now send their warning notifications (#1801).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity
|
||||
honours the removal block, and the event-log volume stays bounded through
|
||||
the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live
|
||||
host state instead of losing continuity (#1913).
|
||||
- **Startup stalls are recoverable** - A startup watchdog records a stalled
|
||||
bootstrap and the delayed browser start offers a truthful retry path
|
||||
(#2129).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached
|
||||
so repeated Patrol runs cost less (#2118).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration,
|
||||
the configured-admin authorizer and security-setup preferences survive save
|
||||
and restart.
|
||||
- **Verify SSL choices persist** - A node's "Verify SSL Certificate" choice is
|
||||
recorded explicitly and preserved through agent re-registration and PVE
|
||||
instance consolidation, so a deliberately disabled or enabled setting is no
|
||||
longer silently overwritten (#2140).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are
|
||||
dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet
|
||||
|
||||
- Infrastructure actions and administrator routes honor the canonical
|
||||
administrator boundary for browser, proxy and SSO sessions, SAML allowlists
|
||||
fail closed without an email claim, and security-sensitive setup request
|
||||
bodies are bounded.
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record, and removing
|
||||
such a record no longer revokes the shared token for every surviving agent
|
||||
(#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404 after
|
||||
upgrading the server: the update endpoint serves the signed `.exe` and its
|
||||
detached signatures from the canonical release assets (#1820).
|
||||
- Same-name standalone Proxmox connections keep their own node labels and
|
||||
agent links after an agent merges into the site.
|
||||
- Disk I/O collection skips numbered partitions of whole devices whose names
|
||||
end in a digit, so MMC, MD and persistent block devices no longer double
|
||||
count partition traffic.
|
||||
- Health evaluation reports `unknown` with a `telemetry_missing` reason
|
||||
instead of green when health telemetry is absent.
|
||||
|
||||
## Changed
|
||||
|
||||
- Machines > Availability defaults estates with 20 or more checks to the
|
||||
compact fleet view, and the chosen table or fleet presentation stays stable
|
||||
across refreshes and shareable through the URL.
|
||||
- A slow application bootstrap shows a recoverable status after ten seconds
|
||||
instead of a blank page.
|
||||
- Platform pages announce filter result counts, help and infrastructure
|
||||
dialogs are keyboard accessible, and the product honors reduced-motion
|
||||
preferences.
|
||||
- Container image checks fall back to a validated manifest response when a
|
||||
registry HEAD request lacks a digest (#2048).
|
||||
|
||||
## Security and release integrity
|
||||
|
||||
- Control-plane, agent-capability, discovery-probe, container-stats, remote
|
||||
configuration, updater metadata, AI provider and Proxmox API responses are
|
||||
read with explicit size bounds.
|
||||
- Typed agent actions run in systemd-contained subprocesses, abandoned typed
|
||||
operations are cancelled, and helper quarantine and rollback recovery state
|
||||
are hardened.
|
||||
- Release activation verifies exact asset bytes, and the private Pro source
|
||||
pair is verified before a draft release object is created.
|
||||
- Security disclosures route to `security@pulserelay.pro`.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.5-rc.1`
|
||||
- Previous candidate: `v6.4.5-beta.3`, published 2026-09-20. This cut moves the
|
||||
`v6.4.5` line from beta to release candidate
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Unpublished predecessor: `v6.4.2` was tagged but never activated as a
|
||||
public release, so this candidate carries its complete change set
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push or onboarding contract changed from `v6.4.1`,
|
||||
so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,169 @@
|
||||
# Pulse v6.4.5-rc.2
|
||||
|
||||
This changelog describes the changes since `v6.4.5-rc.1`. This candidate
|
||||
adds the notification startup-ordering correction, the escalation-admission and
|
||||
auto-acknowledgement retention backport, the resource-drawer tab retention fix,
|
||||
and the deferred alerting, Proxmox LXC memory, AI Patrol, PBS Verify SSL and
|
||||
release-line qualification corrections listed below. This candidate carries the
|
||||
complete `v6.4.2` change set recorded in `V6_CHANGELOG_v6.4.2.md`, which was
|
||||
staged but never activated as a public release, plus the corrections already
|
||||
exercised across the published `v6.4.5` preview checkpoints.
|
||||
|
||||
## Reliability corrections since v6.4.1
|
||||
|
||||
- **Due notifications survive startup** - A persisted notification already due
|
||||
at startup is no longer processed before saved webhook, email and Apprise
|
||||
destinations are applied, so a grouped recovery is no longer terminally
|
||||
cancelled as "delivery disabled" (#2160).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current
|
||||
rule, occurrence, acknowledgement and snooze state before admitting a delayed
|
||||
escalation, and an automatic acknowledgement is retained across a re-fire
|
||||
instead of being dropped (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps
|
||||
back to Overview when a live data refresh briefly omits a field that gates that
|
||||
tab, such as a merged metrics target on the Proxmox Backups History view
|
||||
(#1723).
|
||||
- **Backup age alerts stay truthful** - A PBS host or config backup no longer
|
||||
raises a repeated guest backup-age alert, while a guest backed up locally and
|
||||
copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the
|
||||
folded alert history instead of re-walking the whole event log, so a large
|
||||
history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list
|
||||
keeps every host row visible while scrolling instead of dropping rows as the
|
||||
window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the
|
||||
underlying incidents, and the alert-card footer Started run shares the
|
||||
baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent
|
||||
checkpoints and oversized alert event-log snapshots are no longer rewritten
|
||||
on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the
|
||||
configured destination and grouping window across restarts instead of
|
||||
creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes
|
||||
critical, the higher severity can bypass only the same-occurrence cooldown and
|
||||
records its destination delivery in notification history (#1801).
|
||||
- **Guest panels order predictably** - The workload drawer lists Filesystems
|
||||
before Tags, matching the rest of the interface (#2121).
|
||||
- **TrueNAS telemetry is accurate** - AMD temperature aggregates are rejected
|
||||
instead of inflated, CORE memory is read through the legacy REST path, and
|
||||
idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type
|
||||
names, probe the current 8.0.3 release shape, and surface API fault detail
|
||||
instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests
|
||||
are treated as the current image, so PostgreSQL and other containers stop
|
||||
reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards
|
||||
its configuration backup, and a completed update clears its trap so success
|
||||
is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs verify checksums** - The installer verifies
|
||||
downloaded agent checksums without relying on GNU coreutils (#2123).
|
||||
- **Custom sensor warnings are delivered** - Health-assessment escalations for
|
||||
custom sensors now send their warning notifications (#1801).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity
|
||||
honours the removal block, and the event-log volume stays bounded through
|
||||
the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live
|
||||
host state instead of losing continuity (#1913).
|
||||
- **Startup stalls are recoverable** - A startup watchdog records a stalled
|
||||
bootstrap and the delayed browser start offers a truthful retry path
|
||||
(#2129).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached
|
||||
so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose
|
||||
in-memory observer was lost or rejected is reconciled from retained intent
|
||||
and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse
|
||||
agent inside a Proxmox LXC supplies the container memory reading instead of
|
||||
the cache-inclusive cluster value when the agent total matches the
|
||||
provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration,
|
||||
the configured-admin authorizer and security-setup preferences survive save
|
||||
and restart.
|
||||
- **Verify SSL choices persist** - A node's "Verify SSL Certificate" choice is
|
||||
recorded explicitly and preserved through agent re-registration and PVE
|
||||
instance consolidation, and an explicit PBS choice is no longer silently
|
||||
overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade
|
||||
documentation warns that `/bin/update` is the community-scripts updater on
|
||||
some Proxmox helper-script containers and points those users at the signed,
|
||||
version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are
|
||||
dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet
|
||||
|
||||
- Infrastructure actions and administrator routes honor the canonical
|
||||
administrator boundary for browser, proxy and SSO sessions, SAML allowlists
|
||||
fail closed without an email claim, and security-sensitive setup request
|
||||
bodies are bounded.
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record, and removing
|
||||
such a record no longer revokes the shared token for every surviving agent
|
||||
(#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404 after
|
||||
upgrading the server: the update endpoint serves the signed `.exe` and its
|
||||
detached signatures from the canonical release assets (#1820).
|
||||
- Same-name standalone Proxmox connections keep their own node labels and
|
||||
agent links after an agent merges into the site.
|
||||
- Disk I/O collection skips numbered partitions of whole devices whose names
|
||||
end in a digit, so MMC, MD and persistent block devices no longer double
|
||||
count partition traffic.
|
||||
- Health evaluation reports `unknown` with a `telemetry_missing` reason
|
||||
instead of green when health telemetry is absent.
|
||||
|
||||
## Changed
|
||||
|
||||
- Machines > Availability defaults estates with 20 or more checks to the
|
||||
compact fleet view, and the chosen table or fleet presentation stays stable
|
||||
across refreshes and shareable through the URL.
|
||||
- A slow application bootstrap shows a recoverable status after ten seconds
|
||||
instead of a blank page.
|
||||
- Platform pages announce filter result counts, help and infrastructure
|
||||
dialogs are keyboard accessible, and the product honors reduced-motion
|
||||
preferences.
|
||||
- Container image checks fall back to a validated manifest response when a
|
||||
registry HEAD request lacks a digest (#2048).
|
||||
|
||||
## Security and release integrity
|
||||
|
||||
- Control-plane, agent-capability, discovery-probe, container-stats, remote
|
||||
configuration, updater metadata, AI provider and Proxmox API responses are
|
||||
read with explicit size bounds.
|
||||
- Typed agent actions run in systemd-contained subprocesses, abandoned typed
|
||||
operations are cancelled, and helper quarantine and rollback recovery state
|
||||
are hardened.
|
||||
- Release activation verifies exact asset bytes, and the private Pro source
|
||||
pair is verified before a draft release object is created.
|
||||
- Release-line release candidates are qualified against their own governed
|
||||
branch, so the secure-runtime qualification no longer requires an
|
||||
`origin/main` ancestor.
|
||||
- Security disclosures route to `security@pulserelay.pro`.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.5-rc.2`
|
||||
- Previous candidate: `v6.4.5-rc.1`, published 2026-09-22. This cut adds the
|
||||
notification startup-ordering correction, the escalation-admission and
|
||||
auto-acknowledgement retention backport and the resource-drawer tab retention
|
||||
fix to the rc.1 candidate, together with the deferred alerting, Proxmox LXC
|
||||
memory, AI Patrol and PBS Verify SSL fixes and the release-line qualification
|
||||
correction
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Unpublished predecessor: `v6.4.2` was tagged but never activated as a
|
||||
public release, so this candidate carries its complete change set
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push or onboarding contract changed from `v6.4.1`,
|
||||
so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,169 @@
|
||||
# Pulse v6.4.5-rc.3
|
||||
|
||||
This changelog describes the changes since `v6.4.5-rc.2`. This candidate carries the complete `v6.4.2` change set, which was tagged but never activated as a public release, along with all previously documented v6.4.5 reliability repairs. Since the prior published RC, this cut adds KnowledgeStore save serialization, PBS History target retention, provider client network isolation and upgrade recovery, hosted agent token scoping, organization-owner settings parity, the stable-promotion resolver repair and a Profile L test timeout correction; stable remains `v6.4.1` until exact qualification, publication and a clean 72-hour soak support promotion.
|
||||
|
||||
## Reliability corrections since v6.4.1
|
||||
|
||||
- **Provider-hosted clients recover through upgrades** - Client workspace networks and health are reconciled during provider MSP upgrades (#2247), while network ownership stays scoped to the installation (#2226).
|
||||
- **Organization and agent setup boundaries hold** - Organization owners reach settings their own routes serve (#2208), and hosted agent install tokens are minted inside the selected client workspace (#2209).
|
||||
- **AI knowledge saves serialize** - Consecutive KnowledgeStore saves no longer race an atomic file rename or cleanup (#2186).
|
||||
- **PBS History remains on its host** - IP- or alias-connected PBS History stays attached to its host target (#2196, #2201).
|
||||
|
||||
- **Due notifications survive startup** - A persisted notification already due
|
||||
at startup is no longer processed before saved webhook, email and Apprise
|
||||
destinations are applied, so a grouped recovery is no longer terminally
|
||||
cancelled as "delivery disabled" (#2160).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current
|
||||
rule, occurrence, acknowledgement and snooze state before admitting a delayed
|
||||
escalation, and an automatic acknowledgement is retained across a re-fire
|
||||
instead of being dropped (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps
|
||||
back to Overview when a live data refresh briefly omits a field that gates that
|
||||
tab, such as a merged metrics target on the Proxmox Backups History view
|
||||
(#1723).
|
||||
- **Backup age alerts stay truthful** - A PBS host or config backup no longer
|
||||
raises a repeated guest backup-age alert, while a guest backed up locally and
|
||||
copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the
|
||||
folded alert history instead of re-walking the whole event log, so a large
|
||||
history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list
|
||||
keeps every host row visible while scrolling instead of dropping rows as the
|
||||
window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the
|
||||
underlying incidents, and the alert-card footer Started run shares the
|
||||
baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent
|
||||
checkpoints and oversized alert event-log snapshots are no longer rewritten
|
||||
on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the
|
||||
configured destination and grouping window across restarts instead of
|
||||
creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes
|
||||
critical, the higher severity can bypass only the same-occurrence cooldown and
|
||||
records its destination delivery in notification history (#1801).
|
||||
- **Guest panels order predictably** - The workload drawer lists Filesystems
|
||||
before Tags, matching the rest of the interface (#2121).
|
||||
- **TrueNAS telemetry is accurate** - AMD temperature aggregates are rejected
|
||||
instead of inflated, CORE memory is read through the legacy REST path, and
|
||||
idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type
|
||||
names, probe the current 8.0.3 release shape, and surface API fault detail
|
||||
instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests
|
||||
are treated as the current image, so PostgreSQL and other containers stop
|
||||
reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards
|
||||
its configuration backup, and a completed update clears its trap so success
|
||||
is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs verify checksums** - The installer verifies
|
||||
downloaded agent checksums without relying on GNU coreutils (#2123).
|
||||
- **Custom sensor warnings are delivered** - Health-assessment escalations for
|
||||
custom sensors now send their warning notifications (#1801).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity
|
||||
honours the removal block, and the event-log volume stays bounded through
|
||||
the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live
|
||||
host state instead of losing continuity (#1913).
|
||||
- **Startup stalls are recoverable** - A startup watchdog records a stalled
|
||||
bootstrap and the delayed browser start offers a truthful retry path
|
||||
(#2129).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached
|
||||
so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose
|
||||
in-memory observer was lost or rejected is reconciled from retained intent
|
||||
and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse
|
||||
agent inside a Proxmox LXC supplies the container memory reading instead of
|
||||
the cache-inclusive cluster value when the agent total matches the
|
||||
provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration,
|
||||
the configured-admin authorizer and security-setup preferences survive save
|
||||
and restart.
|
||||
- **Verify SSL choices persist** - A node's "Verify SSL Certificate" choice is
|
||||
recorded explicitly and preserved through agent re-registration and PVE
|
||||
instance consolidation, and an explicit PBS choice is no longer silently
|
||||
overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade
|
||||
documentation warns that `/bin/update` is the community-scripts updater on
|
||||
some Proxmox helper-script containers and points those users at the signed,
|
||||
version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are
|
||||
dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet
|
||||
|
||||
- Infrastructure actions and administrator routes honor the canonical
|
||||
administrator boundary for browser, proxy and SSO sessions, SAML allowlists
|
||||
fail closed without an email claim, and security-sensitive setup request
|
||||
bodies are bounded.
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record, and removing
|
||||
such a record no longer revokes the shared token for every surviving agent
|
||||
(#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404 after
|
||||
upgrading the server: the update endpoint serves the signed `.exe` and its
|
||||
detached signatures from the canonical release assets (#1820).
|
||||
- Same-name standalone Proxmox connections keep their own node labels and
|
||||
agent links after an agent merges into the site.
|
||||
- Disk I/O collection skips numbered partitions of whole devices whose names
|
||||
end in a digit, so MMC, MD and persistent block devices no longer double
|
||||
count partition traffic.
|
||||
- Health evaluation reports `unknown` with a `telemetry_missing` reason
|
||||
instead of green when health telemetry is absent.
|
||||
|
||||
## Changed
|
||||
|
||||
- Machines > Availability defaults estates with 20 or more checks to the
|
||||
compact fleet view, and the chosen table or fleet presentation stays stable
|
||||
across refreshes and shareable through the URL.
|
||||
- A slow application bootstrap shows a recoverable status after ten seconds
|
||||
instead of a blank page.
|
||||
- Platform pages announce filter result counts, help and infrastructure
|
||||
dialogs are keyboard accessible, and the product honors reduced-motion
|
||||
preferences.
|
||||
- Container image checks fall back to a validated manifest response when a
|
||||
registry HEAD request lacks a digest (#2048).
|
||||
|
||||
## Security and release integrity
|
||||
|
||||
- Control-plane, agent-capability, discovery-probe, container-stats, remote
|
||||
configuration, updater metadata, AI provider and Proxmox API responses are
|
||||
read with explicit size bounds.
|
||||
- Typed agent actions run in systemd-contained subprocesses, abandoned typed
|
||||
operations are cancelled, and helper quarantine and rollback recovery state
|
||||
are hardened.
|
||||
- Release activation verifies exact asset bytes, and the private Pro source
|
||||
pair is verified before a draft release object is created.
|
||||
- Release-line release candidates are qualified against their own governed
|
||||
branch, so the secure-runtime qualification no longer requires an
|
||||
`origin/main` ancestor.
|
||||
- Security disclosures route to `security@pulserelay.pro`.
|
||||
|
||||
## Changes since published v6.4.5-rc.2
|
||||
|
||||
- KnowledgeStore saves are serialized so concurrent AI knowledge writes do not overwrite one another (#2186).
|
||||
- PBS Backups History remains on its host target across refreshes and when a connection uses a hostname, IP address or DNS alias (#1723, #2196, #2201).
|
||||
- Exact RC-to-stable promotion accepts the governed installer pin update and Go `_test.go` changes required by the stable cut (#2184, #2205).
|
||||
- The Profile L row-windowing test receives its declared wait budget under qualification load; product behavior is unchanged.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.5-rc.3`
|
||||
- Previous candidate: `v6.4.5-rc.2`, published 2026-09-23. This cut adds KnowledgeStore serialization, PBS History target retention, provider-hosted client isolation and upgrade recovery, organization-owner settings and hosted agent token scoping, the promotion-resolver repair and a qualification test timeout correction to that published preview.
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Unpublished predecessor: `v6.4.2` was tagged but never activated as a
|
||||
public release, so this candidate carries its complete change set
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push or onboarding contract changed from `v6.4.1`,
|
||||
so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,170 @@
|
||||
# Pulse v6.4.5-rc.4
|
||||
|
||||
This candidate carries the complete `v6.4.2` change set, which was tagged but not published. This changelog describes the changes since `v6.4.5-rc.3`. It records the reviewed changes since that published candidate. That candidate is replaced for the #2282 updater regression and cannot become stable. RC.4 also includes the later reviewed disk alert, TrueNAS, linked-guest storage and notification repairs. Stable remains `v6.4.1` until this exact candidate qualifies, publishes and completes a clean 24-hour soak under the version-specific release plan.
|
||||
|
||||
## Changes since RC.3
|
||||
|
||||
- **Updater archive selection (#2282)** — Read full release metadata, require the matching server archive and select the correct ARMv6/ARMv7 build. Affected older previews may need a manual version-pinned update.
|
||||
- **Disk and alert correctness (#2112, #2237)** — Retain confirmed disk-wear recovery and avoid incidents from retired resources. Installed same-disk and email behavior still needs a field retest.
|
||||
- **TrueNAS and linked-guest visibility (#2077, #2263)** — Preserve CORE CPU and memory data and show linked-agent physical storage evidence in VM and container views.
|
||||
- **Notification startup (#2160)** — Wait for saved destinations before sending due persisted notifications.
|
||||
- **Qualification tests (#2305)** — Stabilise readiness and metric-history assertions under the exact release rehearsal; this is test-only, not an installed-product claim.
|
||||
|
||||
## Reliability corrections since v6.4.1
|
||||
|
||||
- **Provider-hosted clients recover through upgrades** - Client workspace networks and health are reconciled during provider MSP upgrades (#2247), while network ownership stays scoped to the installation (#2226).
|
||||
- **Organization and agent setup boundaries hold** - Organization owners reach settings their own routes serve (#2208), and hosted agent install tokens are minted inside the selected client workspace (#2209).
|
||||
- **AI knowledge saves serialize** - Consecutive KnowledgeStore saves no longer race an atomic file rename or cleanup (#2186).
|
||||
- **PBS History remains on its host** - IP- or alias-connected PBS History stays attached to its host target (#2196, #2201).
|
||||
|
||||
- **Due notifications survive startup** - A persisted notification already due
|
||||
at startup is no longer processed before saved webhook, email and Apprise
|
||||
destinations are applied, so a grouped recovery is no longer terminally
|
||||
cancelled as "delivery disabled" (#2160).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current
|
||||
rule, occurrence, acknowledgement and snooze state before admitting a delayed
|
||||
escalation, and an automatic acknowledgement is retained across a re-fire
|
||||
instead of being dropped (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps
|
||||
back to Overview when a live data refresh briefly omits a field that gates that
|
||||
tab, such as a merged metrics target on the Proxmox Backups History view
|
||||
(#1723).
|
||||
- **Backup age alerts stay truthful** - A PBS host or config backup no longer
|
||||
raises a repeated guest backup-age alert, while a guest backed up locally and
|
||||
copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the
|
||||
folded alert history instead of re-walking the whole event log, so a large
|
||||
history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list
|
||||
keeps every host row visible while scrolling instead of dropping rows as the
|
||||
window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the
|
||||
underlying incidents, and the alert-card footer Started run shares the
|
||||
baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent
|
||||
checkpoints and oversized alert event-log snapshots are no longer rewritten
|
||||
on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the
|
||||
configured destination and grouping window across restarts instead of
|
||||
creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes
|
||||
critical, the higher severity can bypass only the same-occurrence cooldown and
|
||||
records its destination delivery in notification history (#1801).
|
||||
- **Guest panels order predictably** - The workload drawer lists Filesystems
|
||||
before Tags, matching the rest of the interface (#2121).
|
||||
- **TrueNAS telemetry is accurate** - AMD temperature aggregates are rejected
|
||||
instead of inflated, CORE memory is read through the legacy REST path, and
|
||||
idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type
|
||||
names, probe the current 8.0.3 release shape, and surface API fault detail
|
||||
instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests
|
||||
are treated as the current image, so PostgreSQL and other containers stop
|
||||
reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards
|
||||
its configuration backup, and a completed update clears its trap so success
|
||||
is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs verify checksums** - The installer verifies
|
||||
downloaded agent checksums without relying on GNU coreutils (#2123).
|
||||
- **Custom sensor warnings are delivered** - Health-assessment escalations for
|
||||
custom sensors now send their warning notifications (#1801).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity
|
||||
honours the removal block, and the event-log volume stays bounded through
|
||||
the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live
|
||||
host state instead of losing continuity (#1913).
|
||||
- **Startup stalls are recoverable** - A startup watchdog records a stalled
|
||||
bootstrap and the delayed browser start offers a truthful retry path
|
||||
(#2129).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached
|
||||
so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose
|
||||
in-memory observer was lost or rejected is reconciled from retained intent
|
||||
and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse
|
||||
agent inside a Proxmox LXC supplies the container memory reading instead of
|
||||
the cache-inclusive cluster value when the agent total matches the
|
||||
provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration,
|
||||
the configured-admin authorizer and security-setup preferences survive save
|
||||
and restart.
|
||||
- **Verify SSL choices persist** - A node's "Verify SSL Certificate" choice is
|
||||
recorded explicitly and preserved through agent re-registration and PVE
|
||||
instance consolidation, and an explicit PBS choice is no longer silently
|
||||
overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade
|
||||
documentation warns that `/bin/update` is the community-scripts updater on
|
||||
some Proxmox helper-script containers and points those users at the signed,
|
||||
version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are
|
||||
dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet
|
||||
|
||||
- Infrastructure actions and administrator routes honor the canonical
|
||||
administrator boundary for browser, proxy and SSO sessions, SAML allowlists
|
||||
fail closed without an email claim, and security-sensitive setup request
|
||||
bodies are bounded.
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record, and removing
|
||||
such a record no longer revokes the shared token for every surviving agent
|
||||
(#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404 after
|
||||
upgrading the server: the update endpoint serves the signed `.exe` and its
|
||||
detached signatures from the canonical release assets (#1820).
|
||||
- Same-name standalone Proxmox connections keep their own node labels and
|
||||
agent links after an agent merges into the site.
|
||||
- Disk I/O collection skips numbered partitions of whole devices whose names
|
||||
end in a digit, so MMC, MD and persistent block devices no longer double
|
||||
count partition traffic.
|
||||
- Health evaluation reports `unknown` with a `telemetry_missing` reason
|
||||
instead of green when health telemetry is absent.
|
||||
|
||||
## Changed
|
||||
|
||||
- Machines > Availability defaults estates with 20 or more checks to the
|
||||
compact fleet view, and the chosen table or fleet presentation stays stable
|
||||
across refreshes and shareable through the URL.
|
||||
- A slow application bootstrap shows a recoverable status after ten seconds
|
||||
instead of a blank page.
|
||||
- Platform pages announce filter result counts, help and infrastructure
|
||||
dialogs are keyboard accessible, and the product honors reduced-motion
|
||||
preferences.
|
||||
- Container image checks fall back to a validated manifest response when a
|
||||
registry HEAD request lacks a digest (#2048).
|
||||
|
||||
## Security and release integrity
|
||||
|
||||
- Control-plane, agent-capability, discovery-probe, container-stats, remote
|
||||
configuration, updater metadata, AI provider and Proxmox API responses are
|
||||
read with explicit size bounds.
|
||||
- Typed agent actions run in systemd-contained subprocesses, abandoned typed
|
||||
operations are cancelled, and helper quarantine and rollback recovery state
|
||||
are hardened.
|
||||
- Release activation verifies exact asset bytes, and the private Pro source
|
||||
pair is verified before a draft release object is created.
|
||||
- Release-line release candidates are qualified against their own governed
|
||||
branch, so the secure-runtime qualification no longer requires an
|
||||
`origin/main` ancestor.
|
||||
- Security disclosures route to `security@pulserelay.pro`.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.5-rc.4`
|
||||
- Previous candidate: `v6.4.5-rc.3`, published 2026-09-27. This cut replaces that candidate after the updater regression and adds the reviewed #2282 correction, later alert and storage fixes, and test reliability repairs.
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Unpublished predecessor: `v6.4.2` was tagged but never activated as a
|
||||
public release, so this candidate carries its complete change set
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push or onboarding contract changed from `v6.4.1`,
|
||||
so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,174 @@
|
||||
# Pulse v6.4.5-rc.5
|
||||
|
||||
This candidate carries the complete `v6.4.2` change set, which was tagged but not published. This changelog describes the changes since `v6.4.5-rc.4`. RC.4 is replaced for a candidate-only child-alert notification regression. All other product changes are inherited from RC.4. Stable remains `v6.4.1` until exact qualification, publication and a new clean 24-hour soak.
|
||||
|
||||
## Changes since RC.4
|
||||
|
||||
- The protected #2336 repair suppresses duplicate escalation of grouped child alerts and schedules the first notification for a continuing child after primary recovery. Four lifecycle tests cover the corrected behavior. Focused source proof is not installed acceptance.
|
||||
|
||||
## Inherited changes between RC.3 and RC.4
|
||||
|
||||
- **Updater archive selection (#2282)** — Read full release metadata, require the matching server archive and select the correct ARMv6/ARMv7 build. Affected older previews may need a manual version-pinned update.
|
||||
- **Disk and alert correctness (#2112, #2237)** — Retain confirmed disk-wear recovery and avoid incidents from retired resources. Installed same-disk and email behavior still needs a field retest.
|
||||
- **TrueNAS and linked-guest visibility (#2077, #2263)** — Preserve CORE CPU and memory data and show linked-agent physical storage evidence in VM and container views.
|
||||
- **Notification startup (#2160)** — Wait for saved destinations before sending due persisted notifications.
|
||||
- **Qualification tests (#2305)** — Stabilise readiness and metric-history assertions under the exact release rehearsal; this is test-only, not an installed-product claim.
|
||||
|
||||
## Reliability corrections since v6.4.1
|
||||
|
||||
- **Provider-hosted clients recover through upgrades** - Client workspace networks and health are reconciled during provider MSP upgrades (#2247), while network ownership stays scoped to the installation (#2226).
|
||||
- **Organization and agent setup boundaries hold** - Organization owners reach settings their own routes serve (#2208), and hosted agent install tokens are minted inside the selected client workspace (#2209).
|
||||
- **AI knowledge saves serialize** - Consecutive KnowledgeStore saves no longer race an atomic file rename or cleanup (#2186).
|
||||
- **PBS History host handling improves** - IP and alias host-target repairs are inherited (#2196, #2201). Unresolved API-plus-Agent History layouts still need investigation and installed acceptance.
|
||||
|
||||
- **Due notifications survive startup** - A persisted notification already due
|
||||
at startup is no longer processed before saved webhook, email and Apprise
|
||||
destinations are applied, so a grouped recovery is no longer terminally
|
||||
cancelled as "delivery disabled" (#2160).
|
||||
- **Escalations use current policy** - Escalation callbacks re-check the current
|
||||
rule, occurrence, acknowledgement and snooze state before admitting a delayed
|
||||
escalation, and an automatic acknowledgement is retained across a re-fire
|
||||
instead of being dropped (#2173).
|
||||
- **The resource drawer keeps its tab** - Selecting a drawer tab no longer snaps
|
||||
back to Overview when a live data refresh briefly omits a field that gates that
|
||||
tab, such as a merged metrics target on the Proxmox Backups History view
|
||||
(#1723).
|
||||
- **Backup age alerts stay truthful** - A PBS host or config backup no longer
|
||||
raises a repeated guest backup-age alert, while a guest backed up locally and
|
||||
copied to a PBS is still counted once (#1741, #1721, #2136).
|
||||
- **Alert history reads stay bounded** - Repeated attention polls reuse the
|
||||
folded alert history instead of re-walking the whole event log, so a large
|
||||
history no longer starves metric writes or freezes an LXC (#2146).
|
||||
- **Alert thresholds lists stay complete** - The Alert Thresholds instance list
|
||||
keeps every host row visible while scrolling instead of dropping rows as the
|
||||
window estimate drifts (#2130).
|
||||
- **Alerts overview counts and layout align** - Overview statistics match the
|
||||
underlying incidents, and the alert-card footer Started run shares the
|
||||
baseline of the delivery-status run (#2119).
|
||||
- **Alert checkpoint writes are bounded** - Byte-identical pending-intent
|
||||
checkpoints and oversized alert event-log snapshots are no longer rewritten
|
||||
on every cycle, reducing write volume on flash storage (#1966).
|
||||
- **Resolved alert bursts respect grouping** - Concurrent recoveries use the
|
||||
configured destination and grouping window across restarts instead of
|
||||
creating one delivery per alert and overwhelming the queue (#2160).
|
||||
- **Critical escalations are delivered** - When an active warning becomes
|
||||
critical, the higher severity can bypass only the same-occurrence cooldown and
|
||||
records its destination delivery in notification history (#1801).
|
||||
- **Guest panels order predictably** - The workload drawer lists Filesystems
|
||||
before Tags, matching the rest of the interface (#2121).
|
||||
- **TrueNAS telemetry is accurate** - AMD temperature aggregates are rejected
|
||||
instead of inflated, CORE memory is read through the legacy REST path, and
|
||||
idle sessions follow a bounded poll cadence (#2122, #2077, #1893).
|
||||
- **vSphere enrichment recovers** - VMware requests send the expected JSON type
|
||||
names, probe the current 8.0.3 release shape, and surface API fault detail
|
||||
instead of failing with HTTP 500 (#2070).
|
||||
- **Container update checks match the running image** - All local RepoDigests
|
||||
are treated as the current image, so PostgreSQL and other containers stop
|
||||
reporting a false update (#2110).
|
||||
- **Failed updates leave no stale state** - A failed staging attempt discards
|
||||
its configuration backup, and a completed update clears its trap so success
|
||||
is not reported as failure (#2127, #2128).
|
||||
- **FreeBSD and pfSense installs verify checksums** - The installer verifies
|
||||
downloaded agent checksums without relying on GNU coreutils (#2123).
|
||||
- **Custom sensor warnings are delivered** - Health-assessment escalations for
|
||||
custom sensors now send their warning notifications (#1801).
|
||||
- **Derived agent identity heals safely** - Re-enrolling a forked identity
|
||||
honours the removal block, and the event-log volume stays bounded through
|
||||
the heal (#2113, #1586).
|
||||
- **Host continuity survives upgrades** - v5 to v6 upgrade paths preserve live
|
||||
host state instead of losing continuity (#1913).
|
||||
- **Startup stalls are recoverable** - A startup watchdog records a stalled
|
||||
bootstrap and the delayed browser start offers a truthful retry path
|
||||
(#2129).
|
||||
- **AI Patrol prompts are cached** - The stable system prompt prefix is cached
|
||||
so repeated Patrol runs cost less (#2118).
|
||||
- **Saved Patrol objectives recover** - A saved Patrol objective whose
|
||||
in-memory observer was lost or rejected is reconciled from retained intent
|
||||
and rechecked at run admission instead of staying uncovered (#2147).
|
||||
- **Proxmox LXC memory uses the linked agent** - A correlated online Pulse
|
||||
agent inside a Proxmox LXC supplies the container memory reading instead of
|
||||
the cache-inclusive cluster value when the agent total matches the
|
||||
provisioned limit (#2148).
|
||||
- **Ollama and security settings persist** - Ollama Basic Auth configuration,
|
||||
the configured-admin authorizer and security-setup preferences survive save
|
||||
and restart.
|
||||
- **Verify SSL choices persist** - A node's "Verify SSL Certificate" choice is
|
||||
recorded explicitly and preserved through agent re-registration and PVE
|
||||
instance consolidation, and an explicit PBS choice is no longer silently
|
||||
overwritten (#2140).
|
||||
- **Community-scripts update guidance is corrected** - The upgrade
|
||||
documentation warns that `/bin/update` is the community-scripts updater on
|
||||
some Proxmox helper-script containers and points those users at the signed,
|
||||
version-pinned installer flow (#2129).
|
||||
- **Metric samples stay consistent** - Replayed unified metric samples are
|
||||
dropped, and metrics store shutdown, rollups and upgrades are hardened.
|
||||
|
||||
## Carried from the unpublished v6.4.2 packet
|
||||
|
||||
- Infrastructure actions and administrator routes honor the canonical
|
||||
administrator boundary for browser, proxy and SSO sessions, SAML allowlists
|
||||
fail closed without an email claim, and security-sensitive setup request
|
||||
bodies are bounded.
|
||||
- Failed backups and completed PBS-to-PBS sync copies no longer pin a guest in
|
||||
Backup Running, and incomplete artifacts are excluded from recoverable
|
||||
latest-backup pointers (#1815).
|
||||
- Two standalone sites that reuse one short node name and one shared install
|
||||
token no longer collapse into a single host or Docker record, and removing
|
||||
such a record no longer revokes the shared token for every surviving agent
|
||||
(#1753).
|
||||
- Windows Unified Agent auto-update no longer fails with HTTP 404 after
|
||||
upgrading the server: the update endpoint serves the signed `.exe` and its
|
||||
detached signatures from the canonical release assets (#1820).
|
||||
- Same-name standalone Proxmox connections keep their own node labels and
|
||||
agent links after an agent merges into the site.
|
||||
- Disk I/O collection skips numbered partitions of whole devices whose names
|
||||
end in a digit, so MMC, MD and persistent block devices no longer double
|
||||
count partition traffic.
|
||||
- Health evaluation reports `unknown` with a `telemetry_missing` reason
|
||||
instead of green when health telemetry is absent.
|
||||
|
||||
## Changed
|
||||
|
||||
- Machines > Availability defaults estates with 20 or more checks to the
|
||||
compact fleet view, and the chosen table or fleet presentation stays stable
|
||||
across refreshes and shareable through the URL.
|
||||
- A slow application bootstrap shows a recoverable status after ten seconds
|
||||
instead of a blank page.
|
||||
- Platform pages announce filter result counts, help and infrastructure
|
||||
dialogs are keyboard accessible, and the product honors reduced-motion
|
||||
preferences.
|
||||
- Container image checks fall back to a validated manifest response when a
|
||||
registry HEAD request lacks a digest (#2048).
|
||||
|
||||
## Security and release integrity
|
||||
|
||||
- Control-plane, agent-capability, discovery-probe, container-stats, remote
|
||||
configuration, updater metadata, AI provider and Proxmox API responses are
|
||||
read with explicit size bounds.
|
||||
- Typed agent actions run in systemd-contained subprocesses, abandoned typed
|
||||
operations are cancelled, and helper quarantine and rollback recovery state
|
||||
are hardened.
|
||||
- Release activation verifies exact asset bytes, and the private Pro source
|
||||
pair is verified before a draft release object is created.
|
||||
- Release-line release candidates are qualified against their own governed
|
||||
branch, so the secure-runtime qualification no longer requires an
|
||||
`origin/main` ancestor.
|
||||
- Security disclosures route to `security@pulserelay.pro`.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.5-rc.5`
|
||||
- Previous candidate: `v6.4.5-rc.4`, published 2026-09-28. This cut replaces it for the child-alert lifecycle regression and carries the reviewed #2336 repair.
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Unpublished predecessor: `v6.4.2` was tagged but never activated as a
|
||||
public release, so this candidate carries its complete change set
|
||||
- Windows signing decision: prereleases publish checksum- and
|
||||
detached-signature-verified Windows agents without Authenticode while
|
||||
SignPath remains unavailable. Windows Unified Agent binaries may display an
|
||||
Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload,
|
||||
Relay, pairing, approval, push or onboarding contract changed from `v6.4.1`,
|
||||
so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,19 @@
|
||||
# Pulse v6.4.5
|
||||
|
||||
This changelog describes stable `v6.4.5`, which promotes `v6.4.5-rc.5`. It records the changes since stable `v6.4.1`.
|
||||
|
||||
## Changes since stable v6.4.1
|
||||
|
||||
- Stable `v6.4.5` ships the `v6.4.5-rc.5` release candidate. That candidate's changelog, `docs/releases/V6_CHANGELOG_v6.4.5-rc.5.md`, and those of the earlier `v6.4.5` candidates record the changes since stable `v6.4.1`.
|
||||
- The stable cut itself changes only release metadata: version pins, Helm chart metadata, release notes and upgrade pointers.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.5`
|
||||
- Promoted prerelease: `v6.4.5-rc.5`
|
||||
- Previous stable: `v6.4.1`
|
||||
- Rollback target: `v6.4.1`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.1`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: the standing SignPath-unavailable policy publishes unsigned Windows Unified Agent binaries with published checksums and detached signatures. The standing SignPath-unavailable policy applies until availability is explicitly restored. Windows Unified Agent binaries may display an Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload, Relay, pairing, approval, push or onboarding contract changed from `v6.4.1`, so no companion mobile build or store rollout is required
|
||||
@@ -0,0 +1,21 @@
|
||||
# Pulse v6.4.6-rc.1
|
||||
|
||||
This changelog describes the changes since `v6.4.5`. Stable `v6.4.5` remains the rollback target.
|
||||
|
||||
## What's improved
|
||||
|
||||
- Keep PBS History on the corroborated host identity and discard stale retained host mappings.
|
||||
- Follow quiet update streams with status checks and confirm server readiness before reload.
|
||||
- Bound local health probes across IPv4 and IPv6.
|
||||
- Update modernc.org/sqlite to v1.59.0 and modernc.org/libc to v1.75.7.
|
||||
- Require affirmative consent before enabling automatic updates on a new installation.
|
||||
|
||||
## Release Metadata
|
||||
|
||||
- Version: `v6.4.6-rc.1`
|
||||
- Previous stable: `v6.4.5`
|
||||
- Rollback target: `v6.4.5`
|
||||
- Rollback command: `sudo /bin/update --version v6.4.5`
|
||||
- Promotion path: exact-SHA single-build release candidate from `release/v6.4`
|
||||
- Windows signing decision: prereleases publish checksum- and detached-signature-verified Windows agents without Authenticode while SignPath remains unavailable. Windows Unified Agent binaries may display an Unknown Publisher warning
|
||||
- Mobile decision: `no-mobile-impact`. No governed mobile route, payload, Relay, pairing, approval, push or onboarding contract changed from `v6.4.5`, so no companion mobile build or store rollout is required
|
||||
@@ -1221,20 +1221,6 @@ func TestCurrentStablePatchReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md")
|
||||
installabilityRequired := make([]string, 0, 3)
|
||||
installabilityRequired = append(installabilityRequired,
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
if rcDerived {
|
||||
installabilityRequired = append(installabilityRequired, "promoted_from_tag="+promotedTag)
|
||||
} else {
|
||||
installabilityRequired = append(installabilityRequired,
|
||||
"This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.",
|
||||
)
|
||||
}
|
||||
assertFileContainsAllNormalized(t, installabilityPath, installabilityRequired...)
|
||||
}
|
||||
|
||||
func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
@@ -1258,11 +1244,6 @@ func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"`v"+version+"` is a stable minor release",
|
||||
"stable `v"+previous+"`",
|
||||
"## What's improved",
|
||||
"Alerts that survive restarts",
|
||||
"More control over notifications",
|
||||
"Earlier resource warnings",
|
||||
"More accurate Proxmox and PBS coverage",
|
||||
"Pulse Mobile iOS build 12 and Android versionCode 9 remain compatible",
|
||||
"not Authenticode-signed",
|
||||
"Unknown Publisher warning",
|
||||
"The rollback target is stable `v"+previous+"`",
|
||||
@@ -1271,8 +1252,8 @@ func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Version: `v"+version+"`",
|
||||
"Previous stable: `v"+previous+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: owner-approved expedited exact-SHA stable cutoff from `main`",
|
||||
"Mobile decision: `existing-mobile-build-compatible`",
|
||||
"Promotion path: ",
|
||||
"Mobile decision: ",
|
||||
"standing SignPath-unavailable policy applies",
|
||||
)
|
||||
assertFileContainsAll(t, repoFile("docs", "RELEASE_NOTES.md"),
|
||||
@@ -1300,15 +1281,6 @@ func TestCurrentStableMinorReleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"`rollback_version=v"+previous+"`",
|
||||
"The integrated single-build workflow must pass its exact-SHA preflight and immutable readiness gates before publication.",
|
||||
"The stable server cut is classified `existing-mobile-build-compatible`.",
|
||||
"explicit version-bound owner decision",
|
||||
"standing unavailable policy",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
}
|
||||
|
||||
func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
@@ -1320,8 +1292,7 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
if !ok {
|
||||
t.Skip("current prerelease does not have a previous stable patch")
|
||||
}
|
||||
stableTarget, _, ok := strings.Cut(version, "-")
|
||||
if !ok {
|
||||
if _, _, ok := strings.Cut(version, "-"); !ok {
|
||||
t.Fatalf("current prerelease %q has no stable target", version)
|
||||
}
|
||||
comparisonVersion, ok := previousPrereleaseVersion(version)
|
||||
@@ -1336,13 +1307,6 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"# Pulse v"+version+" Release Notes",
|
||||
"## What's improved",
|
||||
"## Before you upgrade",
|
||||
"Same-name systems stay separate",
|
||||
"Windows agent delivery is restored",
|
||||
"Large Availability estates scan faster",
|
||||
"Slow starts are recoverable",
|
||||
"Disk I/O totals are more accurate",
|
||||
"carries every change from the `v6.4.2` packet",
|
||||
"map at least one trusted IdP group to the built-in `admin` role",
|
||||
"not Authenticode-signed",
|
||||
"Unknown Publisher warning",
|
||||
"does not require a companion mobile release",
|
||||
@@ -1357,17 +1321,10 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
"Version: `v"+version+"`",
|
||||
"Previous stable: `v"+previous+"`",
|
||||
"Rollback target: `v"+previous+"`",
|
||||
"Promotion path: exact-SHA single-build release candidate from `main`",
|
||||
"Promotion path: ",
|
||||
comparisonSummary,
|
||||
"carries the complete `v6.4.2` change set",
|
||||
"no longer pin a guest in Backup Running",
|
||||
"(#1815)",
|
||||
"no longer collapse into a single host or Docker record",
|
||||
"(#1753)",
|
||||
"Windows Unified Agent auto-update no longer fails with HTTP 404",
|
||||
"(#1820)",
|
||||
"Windows signing decision: prereleases publish checksum- and detached-signature-verified Windows agents without Authenticode",
|
||||
"Mobile decision: `no-mobile-impact`",
|
||||
"Mobile decision: ",
|
||||
"no companion mobile build or store rollout is required",
|
||||
)
|
||||
if version == "6.3.0-rc.6" {
|
||||
@@ -1419,14 +1376,6 @@ func TestCurrentPrereleasePacketTracksInstallMetadata(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"This prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"For the active prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
"No governed mobile-facing path changed from `v"+previous+"`, so the release decision is `no-mobile-impact`",
|
||||
"no companion upload or public mobile-store rollout is part of this candidate.",
|
||||
"The prerelease Windows path retains exact-SHA, checksum, and detached-signature verification without Authenticode. Stable `v"+stableTarget+"` also skips SignPath under the standing unavailable policy",
|
||||
)
|
||||
}
|
||||
|
||||
func TestBackfillReleaseWorkflowRepairsPublishedAssetsWithoutRebuilds(t *testing.T) {
|
||||
|
||||
@@ -414,58 +414,6 @@ func TestInstallDockerScriptFallbackPinsCurrentVersion(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstallDockerProofTracksStablePatchReleaseContract(t *testing.T) {
|
||||
version := currentReleaseVersion(t)
|
||||
if isPrereleaseVersion(version) {
|
||||
t.Skip("current release is a prerelease")
|
||||
}
|
||||
previous, ok := previousStablePatchVersion(version)
|
||||
if !ok {
|
||||
t.Skip("current release is not a stable patch release")
|
||||
}
|
||||
promotedTag, rcDerived := currentStablePatchPromotedPrerelease(t, version)
|
||||
installabilityPath := repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md")
|
||||
|
||||
required := make([]string, 0, 5)
|
||||
required = append(required,
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"`no-mobile-impact`",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
if rcDerived {
|
||||
// An RC-derived stable patch promotes the exercised same-version
|
||||
// candidate, so the active-stable paragraph names the promoted tag
|
||||
// instead of the emergency no-RC hotfix path.
|
||||
required = append(required, "promoted_from_tag="+promotedTag)
|
||||
} else {
|
||||
required = append(required,
|
||||
"This patch release uses the stable hotfix path with `rollback_version=v"+previous+"`, `hotfix_exception=true`, a release-owner reason, and no fabricated same-version RC tag.",
|
||||
"active customer harm",
|
||||
)
|
||||
}
|
||||
assertFileContainsAllNormalized(t, installabilityPath, required...)
|
||||
|
||||
if version == "6.3.1" {
|
||||
assertFileContainsAllNormalized(t, installabilityPath,
|
||||
"the prior `v"+previous+"` decision could not be reused for this patch",
|
||||
"the release owner recorded that separate `v6.3.1` exception",
|
||||
"public Unknown Publisher disclosure",
|
||||
)
|
||||
} else if !rcDerived {
|
||||
assertFileContainsAllNormalized(t, installabilityPath,
|
||||
"standing SignPath-unavailable policy from `v6.3.2` onward",
|
||||
"Public Unknown Publisher disclosure",
|
||||
)
|
||||
}
|
||||
if version == "6.4.2" {
|
||||
assertFileContainsAllNormalized(t, installabilityPath,
|
||||
"The governed branch is `main`",
|
||||
"authenticated non-administrator organization members can reach infrastructure action control",
|
||||
"SSO-only deployments can treat every authenticated IdP user as an instance administrator without an explicit grant",
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func TestInstallDockerProofTracksStableMinorContract(t *testing.T) {
|
||||
version := currentReleaseVersion(t)
|
||||
if isPrereleaseVersion(version) {
|
||||
@@ -475,8 +423,7 @@ func TestInstallDockerProofTracksStableMinorContract(t *testing.T) {
|
||||
if !valid || parts[1] == 0 || parts[2] != 0 {
|
||||
t.Skip("current release is not a stable minor release")
|
||||
}
|
||||
previous, ok := previousStableForPrereleaseVersion(version + "-rc.1")
|
||||
if !ok {
|
||||
if _, ok := previousStableForPrereleaseVersion(version + "-rc.1"); !ok {
|
||||
t.Fatal("stable minor release has no earlier stable rollback packet")
|
||||
}
|
||||
|
||||
@@ -486,57 +433,6 @@ func TestInstallDockerProofTracksStableMinorContract(t *testing.T) {
|
||||
assertFileContainsAll(t, repoFile("scripts", "install-docker.sh"),
|
||||
`CANONICAL_DEFAULT_PULSE_VERSION="`+version+`"`,
|
||||
)
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active stable `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
"`rollback_version=v"+previous+"`",
|
||||
"`hotfix_exception=true` transports that approved waiver through the shared promotion resolver. It does not reclassify v"+version+" as a patch hotfix.",
|
||||
"The integrated single-build workflow must pass its exact-SHA preflight and immutable readiness gates before publication.",
|
||||
"The stable server cut is classified `existing-mobile-build-compatible`.",
|
||||
"Stable `v"+version+"` skips SignPath under the standing unavailable policy and retains exact-SHA, checksum, detached-signature, immutable-manifest, published-digest, and Unknown Publisher disclosure controls.",
|
||||
"For the active stable `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"`",
|
||||
)
|
||||
}
|
||||
|
||||
func TestInstallDockerProofTracksPrereleaseContract(t *testing.T) {
|
||||
version := currentReleaseVersion(t)
|
||||
if !isPrereleaseVersion(version) {
|
||||
t.Skip("current release is stable")
|
||||
}
|
||||
previous, ok := previousStableForPrereleaseVersion(version)
|
||||
if !ok {
|
||||
t.Skip("current prerelease does not have a previous stable patch")
|
||||
}
|
||||
stableTarget, _, ok := strings.Cut(version, "-")
|
||||
if !ok {
|
||||
t.Fatalf("current prerelease %q has no stable target", version)
|
||||
}
|
||||
comparisonVersion, ok := previousPrereleaseVersion(version)
|
||||
comparisonLine := "It follows stable `v" + previous + "` and opens the published `v" + stableTarget + "` candidate line."
|
||||
if !ok {
|
||||
comparisonVersion = previous
|
||||
} else {
|
||||
comparisonLine = "It follows `v" + comparisonVersion + "` on the published `v" + stableTarget + "` candidate line."
|
||||
}
|
||||
if version == "6.4.0-rc.10" {
|
||||
comparisonLine = "The `v6.4.0-rc.9` release staged an immutable draft, tag, and exact-version artifacts but did not activate publicly"
|
||||
}
|
||||
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"The active prerelease `v"+version+"` cut sets the repo-root `VERSION`, repo-root `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and Helm chart release metadata to the same `"+version+"` release version.",
|
||||
comparisonLine,
|
||||
"This prerelease keeps `rollback_version=v"+previous+"`, publishes a versioned public GitHub prerelease plus versioned Docker and Helm artifacts, and does not move stable/latest install pointers or stable semver aliases.",
|
||||
"No governed mobile-facing path changed from `v"+previous+"`, so the release decision is `no-mobile-impact`",
|
||||
"no companion upload or public mobile-store rollout is part of this candidate.",
|
||||
"The prerelease Windows path retains exact-SHA, checksum, and detached-signature verification without Authenticode. Stable `v"+stableTarget+"` also skips SignPath under the standing unavailable policy",
|
||||
"For the active prerelease `v"+version+"` cut, the repo-root compose default and `scripts/install-docker.sh` fallback must both pin `"+version+"` until the next governed stable cut moves them forward.",
|
||||
)
|
||||
if version == "6.3.0-rc.6" {
|
||||
assertFileContainsAllNormalized(t, repoFile("docs", "release-control", "v6", "internal", "subsystems", "deployment-installability.md"),
|
||||
"For `v6.3.0-rc.6`, the release path retains credential-free PVE compilation while requiring the measured memory floor for API race shards after a bounded admission wait.",
|
||||
"Public server and provider control-plane image publication uses independent matrix jobs that each revalidate the exact checkout and candidate manifest.",
|
||||
"Private packaging transfers only the products consumed by Pro assembly, and paid-runtime Docker and direct-binary mismatch proofs execute concurrently without weakening either proof.",
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
func runInstallDockerScript(t *testing.T, workDir string, envVars ...string) {
|
||||
|
||||
@@ -252,11 +252,12 @@ class ControlPlaneAuditTest(unittest.TestCase):
|
||||
"v6.4.6-rc.1", "6.4.6", "v6.4.6+build.1"):
|
||||
with self.subTest(version=version):
|
||||
self.assertEqual(release_branch_for_version(version), "release/v6.4")
|
||||
# Every release from 6.5.0 on is cut from main (founder direction,
|
||||
# 2 October 2026), so later versions need no release-line entry.
|
||||
for version in ("6.4.1", "6.4.2", "6.4.7-rc.1", "6.4.60-rc.1", "6.4.50-beta.1", "6.4.40-beta.1",
|
||||
"6.4.30", "6.3.20", "6.6.0-beta.1"):
|
||||
"6.4.30", "6.3.20", "6.5.0-rc.1", "6.5.0", "6.5.10-beta.1", "6.6.0-beta.1"):
|
||||
with self.subTest(version=version):
|
||||
self.assertEqual(release_branch_for_version(version), "main")
|
||||
self.assertEqual(release_branch_for_version("6.5.10-beta.1"), "release/v6.5")
|
||||
|
||||
def test_forward_patch_workflow_branch_contract(self) -> None:
|
||||
# Execute the real branch-policy shell only, never dispatch a workflow.
|
||||
|
||||
Reference in New Issue
Block a user