Mock-mode reset replaces the state pointer while API and mock-alert readers can still be active. Capture the initialized pointer under the monitor lock and preserve its fallback alerts rather than reading the replaceable pointer again.
Reproduce the race without Start workers, verify reset snapshot isolation, and retain live alert-manager precedence. This repairs the beta.3 preparation failure without masking its test cleanup schedule or changing monitoring schemas.
Contract-Neutral: Synchronization-only snapshot repair; resource identity, API fields, alert policy and canonical ownership are unchanged.
Change-source: pulse-maintainer
The backend supports authenticated Ollama servers but the provider editor omitted its credential fields. Expose write-only password editing with explicit clearing and preserve unchanged credentials. Verify Settings persistence, authenticated connection tests and the Patrol streaming factory using synthetic endpoints.
Change-source: pulse-maintainer
Repair stale transport-only availability fixtures without weakening runtime planner or policy checks. Exercise planner removal with execute authority, transport-only provider projections, and read-only policy with an installed planner.
Change-source: pulse-maintainer
Exercise shared-IP org and runtime-capability requests through universal middleware, including production and development saturation and independent login enforcement.
Contract-Neutral: Regression coverage for existing development-only E2E budget isolation; no production behaviour or limit changes.
Change-source: pulse-maintainer
PR #2034 source-build exclusion exposes five tests that implicitly assume a published checkout. Give ordinary-release fixtures an explicit restored version so CI source identity cannot suppress their release discovery. Keep this correction separate from the pending diagnostic implementation and its frontend verification.
Change-source: pulse-maintainer
Replaces google/gemini-2.5-flash with deepseek/deepseek-v4.1-flash (released 2026-09-10) as the diagnosticModel for the hosted lifecycle diagnostic and its synthetic fixture/wire tests.
The hosted synthetic lifecycle diagnostic offered no control tool despite an installed canonical planner: availability still depended on retired execution transports. Match exposure to the plan-only boundary while preserving read-state and control-level policy. Assert provider and gateway tool offers so scripted calls cannot hide this mismatch, and retain literal-search behaviour as separate evidence.
Change-source: pulse-maintainer
Saved enrollment records can correlate with a live Proxmox host after a
reinstall. The continuity overlay then replaced its current agent payload
with an older offline identity, hiding metrics and marking the node offline.
Use canonical matching to add only absent continuity resources. Preserve
current identity, telemetry and provider links without deleting history or
changing token admission. Cover repeated reads and identity collisions.
Refs #1913
Manual checks previously bypassed only the browser cache, so a newly
published preview could remain hidden behind a fresh-looking server result.
Carry explicit freshness to the provider, retain prior evidence on failure,
and omit unknown dates instead of rendering year one.
Distinguish logical adapter-call and provider-neutral request limits from transport retries, compatibility fallbacks, and provider billing attempts. Keep the hosted fixture behavior unchanged.\n\nChange-source: pulse-maintainer
Change-source: pulse-maintainer
Use production Assistant instructions with synthetic inventory and approval-only planning. Keep gateway inference distinct from native Gemini transport, retain adverse output, and enforce fixed session and token budgets. Hosted execution remains opt-in; local regressions cover model-owned continuation, wire planning and hard call limits.
Change-source: pulse-maintainer
Record clean, consistent releases as the highest current objective.
Keep release consistency explicitly unconfirmed until actual release
and recovery evidence establishes dependable delivery.
Revalidate policy, active occurrence, acknowledgement and snooze at the monitoring callback boundary. Preserve current routing and cooldown behaviour with live-incident fixtures. Pin pre-deadline policy changes and queued email routing versus resolution independently.
Change-source: pulse-maintainer
First-run setup saved the configured administrator but left the router authorizer on its startup identity. This split Settings capability checks: administrator-only panels remained visible while API Access and Pulse Intelligence were denied until restart. Keep the captured authorizer aligned when setup commits the identity, and clear its prior bypass on successful development reset.
Cover the exact split with real file-backed RBAC policy and session setup, preserve outsider denial and identity replacement, and synchronise concurrent policy reads. Extension implementations still require independent compatibility review; this is not installation or release acceptance.
Change-source: pulse-maintainer
Cleanup only marked the active alert acknowledged, leaving recurrence retention and reducer state unlike manual acknowledgement. A short recovery and refire consequently reopened it unacknowledged. Mirror automatic acknowledgements into both tracking paths and request persistence before callbacks.
Regression fails before the repair at short recovery/refire. Focused cleanup, manual acknowledgement and automatic acknowledgement race tests pass.
Change-source: pulse-maintainer
The regression temporarily replaces zerolog's global logger. A prior WebSocket
handler can still be finishing after its own test returns, so joining only this
probe's handler does not prevent a race with that earlier log write. Run the
hook in a bounded child invocation of the same race-instrumented test binary.
Change-source: pulse-maintainer
A session was discoverable before its registration acknowledgement reserved the write lock. An immediate dispatch could therefore become the first frame, which the unified client rejects while awaiting registration. Reserve the new connection write lock under the session-map lock so no dispatcher can overtake the handshake.
The deterministic publication-window regression fails before the repair. Agentexec package race tests and real unified-agent typed receipt replay/cancellation tests pass after it; no timeout thresholds or admission checks are relaxed.
Change-source: pulse-maintainer
The existing scripted-provider tests do not cover Gemini wire translation after read-only discovery. Exercise the actual adapter with synthetic SSE replies to prove canonical reboot planning retains approval and to record the distinct tool-free model conclusion limitation without manufacturing actions. This is orchestration evidence, not hosted-model or customer acceptance; no production behaviour changes.
Change-source: pulse-maintainer
Replace the sleeping evaluator and elapsed-time comparison with a client-released evaluation gate. Real HTTP headers and keepalive bytes must arrive before evaluation can finish; a bounded request context only guards against deadlock. Always release evaluation before server cleanup on assertion failure.
A controlled 350ms pre-stream delay fails the former assertion with otherwise correct transport and passes the gated test. Buffered-body and unstarted-response negative controls both fail under the race detector; all seven Issue1640 tests pass ten repetitions after restoring production source.
Contract-Neutral: Test-only ordering repair; readiness transport and runtime contracts are unchanged.
Change-source: pulse-maintainer
Split the remaining non-database dependency proposal into a coherent main candidate. Retain testify's required YAML update and prove history ID round trips, OAuth refresh rotation and cancellation alongside existing concurrency consumers.
Contract-Neutral: Dependency and compatibility-test maintenance only; no authentication policy, API, deployment, platform support or privacy contract changes.
Change-source: pulse-maintainer
Update gopsutil and x/sys together with the purego version required by Darwin. Keep all other selected module versions unchanged and exercise real Linux CPU, memory, network and mount parsers alongside existing collector regressions.
Contract-Neutral: Dependency and compatibility-test maintenance only; no API, collection policy, platform support, deployment or privacy contract changes.
Change-source: pulse-maintainer
Separate Docker SDK maintenance from the grouped dependency update so unrelated modules remain pinned. Preserve older-daemon negotiation and container recreation payloads with real HTTP compatibility fixtures, and ensure dependency-only changes invalidate cached development binaries.
Change-source: pulse-maintainer
Keep topology capacity bands as resource risk rather than duplicate parent and datastore alerts. The existing live PBS capacity evaluator owns thresholds, aliases and hysteresis; retain datastore state failures and reconcile old duplicates normally.
Reproduce the 97.9% report with real registry projection and exercise threshold changes through synthetic PBS HTTP polling. Release adaptations require the live-poll evaluator, not this filter alone.
Change-source: pulse-maintainer
client-go 0.37 extends the Discovery return interface, which broke the metrics test double in grouped dependency PR #1977. Use the real discovery client over an in-memory HTTP transport so the fixture follows the selected client API without losing metrics and error assertions.
Upgrade only the coordinated Kubernetes modules and their selected transitive dependencies. Leave the unrelated grouped updates unchanged and check cohort alignment in local runtime orchestration, including mixed and incomplete negative cases.
Change-source: pulse-maintainer
Sleeping fixture writers can expose only some updated domains to the second sample, producing false zero watts in CI. Run collection under synctest, wait for its sampling timer, update counters synchronously and join completion before assertions or cleanup.
Retain availability, routing and wraparound assertions, add exact delta checks, and apply the same ordering to AMD fallback and RAPL preference fixtures. Production collection and sampling semantics are unchanged.
Change-source: pulse-maintainer
The report matcher already filters host-local interfaces, but registry inference could lend a trusted agent identity to an unrelated provider using shared loopback, link-local or Docker bridge addresses. Apply the same bounded identity policy to strong and one-way provider corroboration, preserving reciprocal links, private management networks and explicit report-IP hints.
Four cross-provider cases and a one-way mismatched-hostname case fail before the repair. Focused race tests pass after it, including presentation separation and management compatibility. This is a synthetic defect reproduction, not proof of the cause or resolution of issue #1930.
Change-source: pulse-maintainer
A running custom sensor updated its canonical incident from warning to critical without dispatching the new severity (#1801). Enable upward transitions in the shared health adapter while keeping unchanged observations and downgrades quiet. Use the existing hourly budget and dispatch suppression rather than bypassing policy.
Pin CheckHost callback delivery, acknowledgement, snooze, inactive and flapping suppression, and shared ZFS rate exhaustion with focused regressions.
Change-source: pulse-maintainer
Carry the operator include override in disk reports so server filtering does not discard selected tmpfs mounts again. Keep automatic filtering for unmarked reports and agent exclusion precedence. Cover both ingest paths, collection, forwarding and wire compatibility for #1875.
Change-source: pulse-maintainer
Own temporary global and private rate-limit configurations so preceding API tests do not abandon their cleanup goroutines. Exercise both real lazy-initialization fixtures and assert stop signalling and global restoration after cleanup. Before repair all sixteen stop channels remained open; focused rate-limit race tests pass after repair. This does not establish historical SLO causality or qualify a release.
Change-source: pulse-maintainer
The failed #1875 beta retest leaves runtime environment and mount visibility unresolved. Existing fixtures stub partition enumeration, so cover the real gopsutil parser through filtering and capacity projection for single and combined tmpfs includes, missing includes and exclusion precedence. This proves the expected synthetic path, not the reporter installation or a product fix.
Change-source: pulse-maintainer
Diagnostic query masking recognised only lowercase credential names, leaving mixed-case and encoded variants visible in URL and transport-error diagnostics. Match decoded names without case while preserving query spelling, unrelated parameters and the original request URL. Add seven regression cases covering diagnostics and wrapped error identity.
Change-source: pulse-maintainer
An admin-browser update read does not establish access for the monitoring token. Cover the proxied target path, configured token, denial propagation and healthy endpoint retention. Remove the unsupported Sys.Audit diagnostic hint: endpoint access is determined by Proxmox, not general inventory access.
Change-source: pulse-maintainer
Contract-Neutral: Diagnostic wording and method-comment correction plus synthetic regression coverage only; no collection logic, public API, permission policy, freshness or counter semantics change.
Retain a synthetic projection discriminator for #1930 without deleting operator associations. Cover standalone shared bridge identity and a reciprocal retained link, including public provider fields and private link hints.
Change-source: pulse-maintainer
Register shared router cleanup at the password-change constructor boundary so workers are cancelled and joined before temporary state is removed. Add a subtest-boundary regression that fails without cleanup and retain the three affected authorisation tests. No production behaviour or qualification threshold changes.
Change-source: pulse-maintainer
Config-transfer authorization fixtures start router-owned workers but did not register shutdown. Own cleanup at each constructor boundary, including the shared helper used by action authorization, so workers stop before temporary state is removed. Add a subtest-boundary regression that verifies cancellation and worker joining without changing production behavior or qualification thresholds.
Change-source: pulse-maintainer
Register router cleanup before assertions, stop workers before stores and stop the owned monitor last. Add a subtest-boundary lifecycle cancellation and worker-join regression. Focused API tests pass; this fixture isolation repair does not establish causality for historical release stress failures.
Change-source: pulse-maintainer
The failed qualification and isolated API samples used the same setup but lacked comparable phase and per-worker request evidence. Retain UTC setup/load boundaries, execution context and first-attempt versus subsequent successful resource latency without altering workloads, aggregate reports or verdicts. These are observational partitions, not cold-tenant or historical-cause claims.
Focused instrumented API stress passed; JSON assertions verify ordered phases and partition totals. Historical exact-candidate failure remains unresolved.
Change-source: pulse-maintainer
Cold resource store construction held the shared cache mutex and delayed unrelated tenants, including cache hits. A bounded API measurement found 480ms p95 cache-hit mutex wait, while a synthetic blocked constructor reproduced the coordination defect independently of storage internals.
Deduplicate construction per tenant outside the cache mutex, and coordinate eviction with in-flight opens. Add synthetic regressions for unrelated tenants, same-tenant deduplication, retry after failure and close ordering. The resource API race suite passes. This does not establish the cause of the historical release stress failure or qualify a release.
Change-source: pulse-maintainer
Contract-Neutral: Internal tenant-store lock scheduling repair only; routes, payloads, authorization, tenant keys, storage format and eviction semantics are unchanged. Existing race-tested API coordination regressions establish deduplication, retry and close ordering; no frontend surface changes.
Persistent authenticated WebSockets sent nothing between polls, allowing idle-timeout appliances to discard them before the next refresh. Send bounded control pings for each authenticated session and stop the sender on disposal without treating pongs as fresh inventory.
Successful refreshes also added a full interval after completion. Target start-to-start cadence while preserving up to five seconds of minimum idle time, unchanged failure backoff and honest completion timestamps. Authenticated idle-timeout and cadence regressions failed before the repairs; focused transport and poller race tests pass. Addresses the reproduced paths in #1893, not native appliance or reporter confirmation.
Change-source: pulse-maintainer
Exercise the intersection of the interrupted-response and 421/423/425 retry repairs, including queue classification and transport recovery history. Synthetic HTTP fixtures only; no queue scheduling or installed receipt claim.
Change-source: pulse-maintainer
Webhook transport already retries HTTP 421, 423 and 425, but shared classification marked them terminal and discarded the remaining queue retry budget. Align these exceptions with retryable connectivity or receiver failure classes. A synthetic 400-599 transport matrix reproduces the three mismatches and verifies permanent rejections remain terminal without starting storage workers.
Change-source: pulse-maintainer
A truncated diagnostic body currently erases a received HTTP rejection, causing terminal failures such as 403 to consume extra delivery attempts and report a connectivity class. Preserve the HTTP verdict and wrapped read error so existing retry rules still apply. Transport-only regressions reproduce the extra attempt, verify transient recovery and retain successful-response read-error behaviour.
Change-source: pulse-maintainer
The reload watcher exits with the parent context, so unconditional request and reply waits could strand callers during shutdown. Select on that same context at both waits and reject calls before Start; retain buffered completion for an in-flight reload.
Channel-only regression fixtures reproduce the old hang and verify cancellation, late completion and unchanged result propagation without starting monitors or storage. Update the monitoring contract with the bounded lifecycle guarantee and its limits.
Change-source: pulse-maintainer
pulse-triage[bot]