From d20b15b1e6b96ded1e533efe5a17d7481e32694a Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Sun, 4 Oct 2026 18:05:57 +0100
Subject: [PATCH] Complete Discovery compilation and accept canonical PVE
 config keys

The first exact proof established all ten parent no-admission failures and registered-session controls, then stopped on a missing strings import. Complete that import and preserve ordinary hyphenated PVE dictionary keys while keeping duplicate/case-conflicting lock rejection.

Contract-Neutral: Preserves the guest safety protocol and its lock, identity, budget and dispatch requirements; completes compilation and accepts canonical hyphenated config keys.
Change-source: pulse-maintainer
---
 internal/hostagent/guest_exec_guard.go      | 2 +-
 internal/hostagent/guest_exec_guard_test.go | 1 +
 internal/servicediscovery/deep_scanner.go   | 1 +
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/internal/hostagent/guest_exec_guard.go b/internal/hostagent/guest_exec_guard.go
index 94285746d9..0f3457aff5 100644
--- a/internal/hostagent/guest_exec_guard.go
+++ b/internal/hostagent/guest_exec_guard.go
@@ -137,7 +137,7 @@ func guestExecConfigLock(config []byte) (string, bool) {
 			return "", false
 		}
 		for _, c := range key {
-			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '_') {
+			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '_' || c == '-') {
 				return "", false
 			}
 		}
diff --git a/internal/hostagent/guest_exec_guard_test.go b/internal/hostagent/guest_exec_guard_test.go
index 7a03b532ef..08d27a1e30 100644
--- a/internal/hostagent/guest_exec_guard_test.go
+++ b/internal/hostagent/guest_exec_guard_test.go
@@ -20,6 +20,7 @@ func TestGuestExecConfigLockDictionary(t *testing.T) {
 	}{
 		{"unlocked", "cores: 2\nname: home-assistant\n", "", true},
 		{"unicode name", "name: café\nmemory: 8192\n", "", true},
+		{"hyphenated PVE key", "name: vm\namd-sev: type=sev\n", "", true},
 		{"backup", "name: vm\nlock: backup\n", "backup", true},
 		{"other operation", "lock: migrate\n", "migrate", true},
 		{"comment", "# lock: backup\nname: vm\n", "", true},
diff --git a/internal/servicediscovery/deep_scanner.go b/internal/servicediscovery/deep_scanner.go
index e091af1791..794e0aac6b 100644
--- a/internal/servicediscovery/deep_scanner.go
+++ b/internal/servicediscovery/deep_scanner.go
@@ -3,6 +3,7 @@ package servicediscovery
 import (
 	"context"
 	"fmt"
+	"strings"
 	"sync"
 	"time"