Test caller-native and bound delegated click handlers on separate rows rather than combining JSX event props rejected by the existing duplicate-prop rule. The touch-row runtime and its parent-bound browser receipt are unchanged.
Change-source: pulse-maintainer
Mark clickable table rows as native WebKit touch targets without moving their actions out of Solid's delegated event ordering. Preserve keyboard disclosure, embedded controls, dynamic action removal and explicit native handlers; cover the shared table and data grid, and record production PBS drawer browser proof.
Change-source: pulse-maintainer
## What changed and why
Keep manual and automatic acknowledgements on incidents that are still
active during hourly tracking cleanup. Previously the canonical
acknowledgement could expire after 24 hours even while the incident
continued, causing a short recovery and recurrence to notify again.
Active canonical identities now receive the same protection as legacy
identities and ordinary cleanup. Inactive expiry and explicit
unacknowledgement are unchanged.
This repairs a reproduced defect in existing alert behavior. It is not a
diagnosis of the whole daily alert cycle reported in #2353 or a claim of
installed notification recovery.
The periodic-history persistence test also now uses virtual time with
the real ticker, verifies two exact persisted snapshots before shutdown,
and drains its worker. This replaces a scheduling-sensitive 750 ms poll
without changing production intervals or persistence behavior.
## Included source
Complete range
`7667114fe6dc45e9542d1c7531511964ca6f35ed..1c8f51bf1ff12d559cfbd0a47cf25b879c710fdd`:
- Runtime and regression candidate
`e256e9fc509cf35143b9bcde638d24baa562f1ae`.
- Test-only correction `da685d6d12147d945692df81be13392124bd36cd`.
- Reviewed additive integration
`1c8f51bf1ff12d559cfbd0a47cf25b879c710fdd`.
All reviewed identities and ancestry are preserved. Current upstream
remains the range base.
## Validation and limits
Recorded baseline `source-zk09jitb` reproduces acknowledgement loss and
duplicate dispatch. Final offline proof `source-406x6wbt` passes ten
focused race repetitions, complete alerts/notifications/monitoring race
suites, vet and affected-library builds. Eighty modeled recurrence
cycles cover manual/automatic acknowledgement, JSON/durable checkpoint
restart, zero duplicate dispatches, explicit unacknowledgement and seven
retention controls. The earlier full proof `source-74ad7ohd` failed the
periodic-history polling deadline; the additive test correction is
included, not an unchanged favorable rerun.
The final integrated alert, notification and monitoring source matches
the proved candidate; integration adds only already-published frontend
work outside these paths. Complete-range provenance/whitespace,
per-commit canonical contract guards and browser applicability checks
pass (no frontend delta). Sufficient source evidence was reused rather
than repeated solely for publication. Proof Go was 1.26.7 rather than
declared 1.26.8; required exact-head CI still must validate the declared
toolchain and source before landing.
Independent review and exact-head checks govern merge. Source checks do
not establish installed recovery, complete reporter acceptance or
release qualification. No release, tag or deployment is changed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the exact reviewed documentation candidate and its synthetic recipe evidence. Existing TrueNAS help becomes credential-safe and distinguishes capacity from observed telemetry; no runtime change.
Change-source: pulse-maintainer
The first exact offline suite passed the metadata cases but the clean-tree assertion saw Python import bytecode because the fixture omitted the real .gitignore. Copy that existing policy into the fixture, retaining the source/no-mutation assertion.
Contract-Neutral: Fixture setup now copies the existing repository ignore policy; runtime and deployment contracts are unchanged.
Change-source: pulse-maintainer
The exact no-mutation watchdog failed at published 6.4.5 because the release line has pending repairs but still declares its stable VERSION. Observe that governed source and its preceding stable reference without inventing a new promotion, while keeping candidate resolver gates unchanged and watchdog artifacts out of promotion-readiness records.
Change-source: pulse-maintainer
Use the fulfilled API window and a common observed envelope across metric groups so sparse samples cannot look like a full selected range. Show dated endpoints, retain them with matching failed-refresh data, and clear them on range replacement. Preserve edge observations and reject non-date geometry.
Pin mounted/model regressions, update both affected contracts, and retain production PBS drawer browser proof with its installed-acceptance limits.
Change-source: pulse-maintainer
The complete alerts race suite failed the existing 750 ms filesystem-poll deadline. Use Go virtual time with the real periodic worker and configured interval instead of widening the deadline or rerunning unchanged source. Assert no pre-tick write, exact first- and second-tick history content before shutdown, and drain the worker for cleanup. Runtime saving and production intervals are unchanged.
Contract-Neutral: Use virtual time to strengthen the periodic-history persistence test; no runtime or contract delta.
Change-source: pulse-maintainer
## What changed and why
Make existing drawer History readable with keyboard and touch, and keep
every inspected metric attributed to one actual stored time. Missing
sibling observations remain unavailable rather than borrowing
neighbouring or live values. Selection survives same-source refreshes
and clears at resource/range boundaries; refresh-failure warnings remain
intact.
Keep continuing unacknowledged alerts through retention cleanup.
Age-only cleanup could remove an observed condition and cause another
notification on the next failing poll. Cleanup now also requires
observation inactivity, preserving configured acknowledgement and
affirmative recovery behavior.
These repairs follow reproduced History attribution/accessibility and
alert-retention defects. They improve existing behavior, not new product
scope. They do not establish complete #1723 PBS/VirtualBox acceptance or
diagnose all of #2353's reported daily cycle.
## Included source
Complete range
`6f4e2f25c558d7c69717984c47d06a94c179c4ca..00f82e2afc3cd75035c997e9e245c6e0eeffffa9`:
- History inspection candidate
`d38e2ec61a933b1621895cc71c17ec366a8e99ce`, followed by common-time
correction `02090fe3515e324159225acab0130f4b82e444fb`.
- Alert retention candidate `7cbde2e3bf368e9ee36a34b4fc9dcf87d3089497`.
- Reviewed additive integrations
`0dc858cb366a394b159d2c911c5d85b3020e7881`,
`3e01f02cfca620bd0777db97257d52d63fc32ef7`,
`00f82e2afc3cd75035c997e9e245c6e0eeffffa9`, and upstream incorporation
`cf1e9b4ca3ea0c4277731a366d6fdd0daf8e24a8`.
All reviewed commit identities and ancestry are retained.
## Validation and limits
Recorded source proof `source-fcbetfv8` passes offline installation,
type-check, lint, 21,592 tests (three existing skips), build, bundle
budgets and formatting/header/duplication checks. Its final frontend
content matches the integrated tree. Chromium/Firefox desktop and
Chromium/WebKit phone proofs cover eight width/engine/theme cases with
16 screenshots recorded as inspected. Earlier keyboard/touch proof
`source-0cyn9bst` passed 21,567 tests; its behavior is included in the
later proof. Baseline `source-5g7tw1c0` records eight failures and two
passing controls before the pointer correction.
Alert proof `source-lh_dko1x` passes ten focused race repetitions, full
alerts/notifications/monitoring race suites, vet and affected builds;
baseline `source-rz64y65n` reproduces five callbacks where the corrected
behavior emits one. Final alert source matches the reviewed candidate.
Complete-range provenance, whitespace, canonical contract and
parent-bound browser receipt checks pass. Existing sufficient evidence
was reused, not repeated solely for batching. Proof Go was 1.26.7, not
the declared 1.26.8; matching toolchain preparation remains separate.
Required exact-head CI and independent review still govern landing.
Synthetic source/browser checks are not installed recovery, complete
reporter acceptance or release qualification. No release, tag or
deployment is changed here.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace token and API-key shell arguments with private header and payload files, verify the exact test/save recipes with synthetic credentials, and separate hardware capacity from actual usage and History. Bound local logs and keep sanitized evidence and trusted HTTPS as the troubleshooting path.
Contract-Neutral: Documentation and synthetic recipe checks only; no runtime, API, transport or metric contract changes.
Change-source: pulse-maintainer
The hourly sweep pruned canonical acknowledgement records after 24 hours even while their incidents remained active. Preserve active tracking identities as the ordinary cleanup already does, so a short recovery and recurrence retain the operator decision. Keep inactive expiry, legacy timestamp fallback and explicit unacknowledgement unchanged. Validate manual and automatic acknowledgements through provider-native pool incident reconciliation, JSON and durable checkpoint restart, dispatch counters and retention bounds; update the alert contract in the same commit.
Change-source: pulse-maintainer
Preserve the exact reviewed Web candidate and its browser receipts. Existing PBS History pointer readings now share one stored timestamp; absent sibling observations remain unavailable.
Change-source: pulse-maintainer
Resolve pointer inspection against the group's actual stored timestamps. Missing series stay unavailable instead of borrowing neighbours or live readings, while keyboard focus, single samples and scoped refresh recovery remain intact. Add mounted regressions, the shared contract and exact-content browser receipts.
Change-source: pulse-maintainer
Age-based housekeeping deleted continuing conditions when automatic acknowledgement was disabled. Require last-observation inactivity as well as occurrence age, retain legacy timestamp fallback and inactive cleanup, and document the unchanged acknowledgement/recovery boundaries. Regression exercises cached, absent and failed Docker registry reports, callback/history identity and actual checkpoint restart.
Change-source: pulse-maintainer
## Changes and why
- Bound asynchronous active-alert checkpoints to one worker and one
requested follow-up during a burst. Current-state snapshots, immediate
lifecycle durability, failure recovery and the final shutdown save
remain intact. A blocked-writer fixture reproduced 512 workers for 512
requests before the repair; this removes that amplification without
claiming to resolve the installed CPU/write symptoms in #1966, #2112 or
#2113.
- Correct both ZFS help copies after discussion #2354 exposed a promise
of discovering every local pool. Explain the configured-Proxmox-storage
boundary, the host agent's mounted capacity view and the separate
unregistered-pool health-alert gap. The read-only guidance does not ask
users to alter their storage configuration.
- Permit a bounded, exact-source release-path watchdog check on demand,
retaining the scheduled no-publication/no-mutation envelope, rejecting
candidate/exception overrides and skipping candidate builds. This
addresses missing timely coverage after a prior watchdog ordering
failure; it does not publish a release.
## Included source
Complete range
`cfaad6b46d6c47ef9aed400cb57e1c5b54bd02f2..6fa78a01f813f373fda64922533f060963ff32fc`:
- Alert checkpoint candidate `5dea312f2b17323a25e616b81324855b4ca939da`.
- ZFS guidance candidate `cf8a3f9a6cca47509efc10df62ba24bb00f9aa09`.
- Watchdog candidate `40037f003581f8f553bb41de313c927256a0d3c2` through
`2043f3dd767d3f0970e4008a4d9067c5f7327c32`.
The additive integrations preserve every reviewed commit and include
upstream History publication `cfaad6b46d6c47ef9aed400cb57e1c5b54bd02f2`
without rewriting it.
## Validation and limits
- `source-gdu65a_x`: 25 focused race repetitions, complete
alerts/config/eventlog/reducer/specs race suites and vet pass.
`source-ezs4tqqg` retains the original blocked-worker reproduction.
- `source-_7_yx4oh`: 112 release-control Python tests and selected Go
install checks pass, including actual workflow
admission/source-selection checks.
- `source-y0mu1jos` observes the existing ZFS limits and configured
controls; `source-s2wg_5ix` passes 26 docs/card tests.
- Publication provenance and complete-range whitespace checks pass.
Integrated executable/test files match the validated candidates; the
only later watchdog contract-doc change is an already-published updater
section. The two help copies match.
Sufficient candidate evidence is reused, not rerun merely for batching.
Exact-head CI and independent review still govern landing. These checks
do not establish installed alert/write recovery, complete PBS
acceptance, restored operational watchdog coverage or release
qualification.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve exact reviewed candidate d38e2ec61a and retain both History and update-progress browser evidence. Only the shared receipt file needed resolution; frontend runtime content matches the candidate receipt.
Change-source: pulse-maintainer
## What changed and why
History drawers now keep correctly attributed, previously loaded charts
visible when a refresh fails, show a clear warning, and offer a scoped
keyboard-safe retry. A background poll that supersedes a manual refresh
also settles its loading state, so the drawer does not remain stuck.
Inspection and regression-first tests found these recovery defects in
the existing History renderer. This improves the PBS/host History
experience associated with #1723 without borrowing points from another
host or time range, exposing private diagnostics, or bypassing license
limits. It does not claim complete resolution of the reported
PBS/VirtualBox estate outcomes.
## Included candidate and complete range
Starting reviewed range:
`f3c92a242ebf9b7062dfc9f6ff711a56639f536c..a81c5227a517fcbd4cccd1e3030a64b7cd864e2f`.
Final proposal range against current upstream:
`2dd77df0247bb54302da131d4e46256a7d4bb6ce..d80b49835cb8becf3cd151d8a4bad0869c6949cd`:
- Reviewed Web candidate `20260930T210243Z-web-product`, source
`744160fa0ebf599ebc36e82c9f12178947a533e6`.
- Additive integration `0d3e5a801ab8fd1c1d224ef561cbf99e169c589f` and
upstream integration `a81c5227a517fcbd4cccd1e3030a64b7cd864e2f`.
During publication, upstream advanced to
`2dd77df0247bb54302da131d4e46256a7d4bb6ce` (already-landed
update-progress repair #2347). The ancestry check refused the stale head
before push. Additive merge `d80b49835cb8becf3cd151d8a4bad0869c6949cd`
incorporates that exact upstream commit; its sole conflict was the
browser-receipt record. Both original parent-bound proofs are retained
without inventing new browser execution. The upstream update-progress
changes are already on main, not new product scope selected by this
proposal. All accepted identities and ancestry are preserved.
## Validation
The reviewed source's recorded offline proof `source-47j38yd_` passed
install, type-check, lint, 21,553 tests (three existing skips), embedded
build and bundle budgets. `source-iql94lcs` passed
formatting/header/duplication checks. Regression-first proofs recorded
seven initial failures and the superseding-read loading defect.
The production renderer/query browser proof covered desktop and phone
widths in light/dark themes with 12 screenshots recorded as inspected:
failed polling, held/repeated activation, recovery/focus, overlapping
reads, target withdrawal and license locks. Parent-bound content
comparisons and the final range browser guard confirm those proved
source files are unchanged. Earlier broader fixture/browser execution
failures remain limits, not successful installed evidence.
Because upstream changed the dependency lock after the reviewed frontend
proof, publication ran an additional focused combined-source offline
proof, `source-hfmynznu`, at exact head
`a81c5227a517fcbd4cccd1e3030a64b7cd864e2f`: locked install, type-check,
39 History refresh/shared-query/dependency-security tests, embedded
build and bundle budgets all pass. Earlier upstream Build and Test run
`36786204046` passed; incoming #2347 also had passing
frontend/backend/security/governance/E2E/benchmark checks (provider-pair
Docker acceptance was skipped). Final merged-head proof
`source-gp1tz3hx` passed locked install, type-check and all 60 tests
across five History/query/security/update-progress/readiness files at
`d80b49835cb8becf3cd151d8a4bad0869c6949cd`. Provenance, canonical
completion, range browser verification and whitespace checks pass.
## Landing and release limits
Independent review and exact-head functional/security CI govern landing.
Source/browser fixtures are not installed PBS/VirtualBox acceptance or
real upgrade/rollback through Tailscale Serve. This later recovery
improvement is not an additional prerequisite for the instructed v6.4.6
repair quartet, does not replace an RC, and does not publish or qualify
a release. Existing owners retain those installed and release outcomes.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Coalesce full active-alert snapshots into one worker and one requested follow-up instead of queueing a goroutine per mutation. Preserve immediate lifecycle durability, fresh snapshots, failure recovery and the final shutdown save; reproduce the old burst amplification and validate the new admission and persistence boundaries.
Change-source: pulse-maintainer
Expose existing stored history through labelled native observation controls and dated accessible descriptions. Keep missing samples distinct from live or neighbouring readings, preserve the selected timestamp through refreshes and reset selection at resource/range boundaries. Cover input state and real native browser interaction without changing collection or licence gates.
Change-source: pulse-maintainer
Explain the configured-storage boundary, the existing agent capacity path and the separate pool-health gap. Keep data-only pools unchanged and put storage membership ahead of permission changes in troubleshooting.
Change-source: pulse-maintainer
Preserve accepted History recovery and current upstream ancestry after the publication boundary detected an upstream advance. Resolve the browser receipt collision by retaining both original parent-bound records without claiming new browser execution.
Change-source: pulse-maintainer
Updating through Tailscale Serve left the modal stuck on "Downloading
update... 10%" while the update finished in the background. The SSE
endpoint now sends status on connect, flushes each event, heartbeats
every 15s and disables proxy buffering. The modal falls back to polling
when the stream goes quiet, only enters the restart phase on real
restart evidence, and never auto-reloads on unconfirmed completion
without a pre-update version baseline. Planned for v6.4.6.
Replace two stale schema assertions with explicit watchdog omission and ordinary candidate rollback requirements. The actual workflow admission/source-selection shell tests preserve the fail-closed distinction.
Contract-Neutral: Tests and explanatory comments reflect the already recorded watchdog admission contract; no further runtime contract change.
Change-source: pulse-maintainer
Updating to v6.4.5-rc.5 and then v6.4.5 left the progress modal on
"Downloading update... 10%" even though the update finished in the
background. The status stream could go silent behind a proxy (Tailscale
Serve, nginx buffering) and the modal only advanced on stream events.
Backend: the update SSE endpoint now sends the current status on connect,
writes events through one ordered writer with an explicit flush, sends a
15s heartbeat and sets X-Accel-Buffering: no.
Frontend: a silence watchdog falls back to status polling, the restart
phase is entered only on real restart evidence (restarting status, the
server going away, or a version change) rather than a single failed poll,
and the page never auto-reloads on unconfirmed completion without a
pre-update version baseline to compare against.
## Current combined outcome
Keep PBS History attached only to its corroborated host and active
range; make startup health checks work with bounded IPv4/IPv6 fallback;
restore supported TrueNAS SCALE reporting queries; honor configured
alert storm thresholds; and make troubleshooting and server update
guidance safe to follow. Snapshot/metadata maintenance also reduces
allocations without trusting identity hints, addressing the performance
evidence in #2199 and contributor PR #2342.
The prior proposal head `5cc1f2f7b06b6b6d98f08ed177e8326beea407e1`
cannot land independently: completed Build and Test run `36672563104`
fails its frontend dependency audit on high-severity brace-expansion
advisories. This is not a retryable outage. Current reviewed source
already additively incorporates published #2349
(`8d5969fb3b27422f7d9e5ef55fd4ce09af5b25a6`), including brace-expansion
1.1.21/5.0.12 and DOMPurify 3.4.16. Updating the blocked proposal once
with this coherent reviewed range repairs that source defect; this is
not repeated advancement of a healthy checking head.
## Current source range and newly included candidates
Complete unpublished main range
`8d5969fb3b27422f7d9e5ef55fd4ce09af5b25a6..66ec68c813cacf6c1a0f98cfb5f6da494584c9ac`.
The already proposed PBS/guidance range below remains included
unchanged. Newly included reviewed candidates:
- `ffc44a0f8c02`: honor configured flapping thresholds above ten,
retaining expiry/cooldown semantics.
- `173290127a3a`, `6ef79688a5d1`, `18f519e3496b`: bounded captured audit
diagnostics and fail-closed positive-advisory precedence, with
release-asset guard reconciliation. These diagnostic changes alone do
not fix advisories.
- `9bc6f6ed647b`, `45b2fae8dbb5`: safe deployment-specific port
diagnostics and credential-file API examples, with matching shipped
guides.
- `901274ee927d`: safe allocation-bounded snapshot/metadata maintenance;
retains contributor credit and full identity decoding.
- `21a35494aecb335755de773dd099e1364e65b3e0`: supported TrueNAS
reporting summaries for #2346, preserving raw samples, windows and error
boundaries.
- `9d77f09b4f6b`: reject unscoped updater examples in authored release
bodies.
- `4ba830bfd31c0d2df71b4ed426b7b9ad31c8b4ed`: isolate drawer History
across target/range changes and cancel obsolete reads; fixes reproduced
former-host cache contamination in the #1723 investigation.
- `fffaa64e57ef` and additive test repair
`b0a4d2f3928f080dc093b561ba855b84f1443b41`: dual-stack bounded
service-health probes and one bounded background retry; genuine
API/UI/asset failures remain visible.
- `66ec68c813cacf6c1a0f98cfb5f6da494584c9ac`: reviewed additive
incorporation of full upstream #2349. The dependency
manifests/security-floor tests exactly match current published main.
Every accepted commit identity, original author and ancestor is
preserved. No release, tag or deployment is changed by this proposal.
## Combined validation judgment
Sufficient component evidence is reused rather than rerunning it solely
for batching:
- Existing original-range source/race/browser evidence is retained
below.
- TrueNAS: `source-j4j1btoe` / `source-lxeal7q5` affected/full race and
modeled red/green evidence; final `source-8ouijs8p` vet/recovery proof.
Same source tree across the message correction.
- Drawer isolation: `source-z1ldgp56`, offline install/type-check/lint,
21,541 tests, embed build and bundle budgets; `source-2caj4cbp` /
`source-z9xqxyun` formatting/header/duplication checks; real-renderer
mock-backed desktop/phone browser proof, ten recorded inspected
screenshots.
- Health: final `source-txxwlqa3` complete server/telemetry race suites,
40 telemetry-report tests and vet; real frontend embed build/docs
evidence `source-k2aprplj`.
- Published #2349 exact proposal CI: run `36767849067` passed the
complete dependency audit with zero reported vulnerabilities and 21,504
frontend tests (three skipped); its functional/E2E/security checks
passed. The containing main range does not change its manifests or
security-floor tests.
This turn also passed 17 executable audit-wrapper fixtures and all 40
release-body renderer tests under `pulse-maintainer-proof`. The API-auth
documentation tests reached three denied socket operations in that
native fixture environment; those failures are execution-context
evidence, not successful tests. An optional guest-local recheck through
the supported source-proof executor is queued behind occupied proof
slots, not a pass. It is not needed to repeat the existing candidate
evidence; its outcome remains separate from exact-head CI.
Publication provenance, complete-range whitespace and aggregate
parent-bound browser coverage pass. All 22 unpublished non-merge commits
pass canonical-completion checks using only their recorded, accurate
Contract-Neutral reasons where applicable. An unqualified range-wide
canonical invocation reported two cross-scope requirements; the required
per-commit checks and parent/content-bound browser range check pass, not
a blanket exemption.
The current exact frontend snapshot is unavailable locally
(`0bd5f30a…`); no final combined offline npm build/audit is claimed. The
independently tested upstream graph and reviewed component proofs
support proposing this composition, not merging without its fresh
exact-head checks. Actual local VM Go remains 1.26.7 rather than the
declared 1.26.8 floor. Fresh exact-head CI and independent review must
resolve the complete proposal before landing. Prior failed checks remain
evidence, not green checks or release qualification.
These source/mock proofs do not establish installed
PBS/VirtualBox/disk/network/I/O recovery, TrueNAS appliance acceptance,
Tailscale Serve upgrade/rollback, or release readiness. Eligible patch
placement remains separate; this main batch does not replace a published
RC or expand v6.4.6 scope.
<details>
<summary>Retained earlier proposal scope and validation
history</summary>
## What changed and why
PBS host History and SMART ownership now require corroborated machine
identity: reject stale Agent observations and host-local addresses,
preserve IPv6 endpoints, and withdraw retained History when the backend
link disappears. The frontend also rejects editable labels and
endpoint-token guesses, permits fresh exact reported machine names or
explicit backend Agent links, and isolates row snapshots so
reconciliation cannot corrupt later withdrawal. This addresses
wrong-host risks found investigating #1723; it does not claim installed
relief for every PBS History symptom or the reporter's VirtualBox
topology.
Troubleshooting now explains browser-bound recovery and bounded
sanitized incident reporting rather than ineffective credential-copying
or risky repeats. Clone guidance follows saved Agent identities and
persistent overrides instead of deleting the operating system's machine
ID. Source and in-app guides match.
## Reviewed source included
Complete main range
`fa1d9eb36d4c2f55e648f10cfe7400983551b877..5cc1f2f7b06b6b6d98f08ed177e8326beea407e1`:
- Retained-History withdrawal
`62fb6cdb12dd3db90d2be598df1efc0210be37f1`, integrated by
`7a646013062d667f7c053def80aab405c488d3e8`.
- Recovery/reporting guidance
`d707df9577ddbf9b4b7ba7c1c055131318bd66e1`, harness correction
`5fe29c558d146664320ff8beda49f4a36613737b`, integrated by
`78434304f1afbac5b58b17ce885424be17b4dff7`.
- Backend identity safety `a0081d676b450f58d8f3593918334152df0de4d3`,
composed at `3ea52c25b565d614304b23350012ce942f828e6b`.
- Clone guidance `25a2e56d5ef62b2674a4deba655a121ecb7c8761`, integrated
by `6e81f06e095a009233067a539ef7cc47502583d5`.
- Frontend identity boundaries: regression fixtures
`6ade01cbd4d02cd25b691f9ff5919206cceae764`, repair/browser receipt
`3df86570396a3e7f600abf8a3c7c8d3ea957106c`, retained-fixture correction
`be18333570be6ba428c690942d7b4def64d4a678`, integrated by
`105e59bffb9b476ee3c9606cde95e3412e1664ac`.
- Additive formatting-only correction
`17f2d7a45d93ebd53347096edf46e44c8a0ef6fc`. The earlier #2341 head
failed Frontend formatting in completed run 36658394047 on
docsLinks.test.ts. A retry would not fix it; this correction preserves
assertions and every accepted commit. The newer reviewed PBS range is
included with the necessary repair rather than advancing an otherwise
independently landable checking head.
## Validation and limits
Recorded source evidence reused:
- `source-3a9ej4nh`: offline frontend install, 21,506 tests, lint,
type-check/build; mock-backed desktop/phone retained-History proof and
inspected screenshots.
- `source-sksnquh_`: full unifiedresources/pkg/pbs race suites and three
polling regressions, exit 0. Final Go source is identical to that
candidate. VM Go 1.26.7 differs from declared 1.26.8, so configured CI
remains necessary.
- Recovery/reporting: 20 documentation tests and 15 real-document
desktop/phone checks. Clone guidance: `source-j3xvikj1` passed 47
documentation tests; `source-8hmpoki1` passed agent
configuration/persistence tests; 21 browser assertions and four
inspected screenshots.
- Final reviewed PBS frontend candidate: `source-_pyutny3` passed 21,530
tests, lint/type-check/build; 24 desktop/phone target/layout checks with
six inspected screenshots. Earlier red fixtures, snapshot-mutation
failure and obsolete positive-fixture failures were retained and
repaired.
At prior proposal head `17f2d7a45d93ebd53347096edf46e44c8a0ef6fc`:
`source-2kpt0am7` passed offline install, full locked formatting check
and 21 docs tests; `source-hcai5s0y` passed both PBS table/drawer files,
48 tests. Provenance, whitespace and aggregate parent-bound browser
coverage passed. Per-commit canonical checks used the reviewed
Contract-Neutral reasons for bounded behavior-only frontend repairs;
backend contracts were updated. Direct host attempts to run existing
browser scripts stopped at denied loopback listeners, produced no visual
proof and are not passes; the recorded confined browser evidence above
remains separate.
Exact-head functional/security CI and independent review govern landing;
advisory results remain evidence, not release approval. These are
source/mock proofs, not installed acceptance or release shipment. The
frozen v6.4.5 RC.5 is not expanded by this main batch.
## Additive integration correction and current CI evidence
The proposal's completed Core E2E run 36660586289 failed all six
desktop/phone PBS History cases in shards 3, 6 and 8. The fixture
supplied only presentation labels and a non-contract `pbs.hostname`,
whereas the reviewed identity repair deliberately requires a reported
`pbs.nodeName` or explicit backend Agent link. Commit
`5cc1f2f7b06b6b6d98f08ed177e8326beea407e1` supplies the reported node
name, retaining the expected guest/standalone History targets and
wrong-target rejection. Runtime source is unchanged. No-content merge
`80e654381b94e1a61ef6727cbc69b54d0fa7eb10` preserves Delivery's reviewed
race-proof candidate. Every original reviewed identity and ancestry is
retained.
Recorded confined Chromium/WebKit desktop/phone fixture proof reproduces
the old wrong targets and passes the corrected fixture. The separate
Build and Test run 36660586299 failed only
`TestConfigWatcher_WatchForChanges_Live` in rest-1, with expected mock
setting `2` but an empty value. Config source is unchanged in this
batch. Containing-head offline race proof `source-0ou4e1ru` passed 20
repetitions; this neither clears failed CI nor proves the cause. That
failed run has been handed to Delivery for independent assessment. Fresh
exact-head CI and independent review are required for this correction.
Provenance, whitespace, accepted ancestry and aggregate browser-receipt
coverage pass; existing full source proofs were reused where final
source is identical.
The old head cannot land independently because of its deterministic E2E
fixture defect, so updating it with the already-committed correction is
appropriate rather than repeatedly advancing a healthy checking
proposal. No release, OTA, installed acceptance or complete reporter
resolution is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
</details>
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain matching History through failed refreshes and settle superseding reads. Preserve the exact reviewed frontend commit and its browser receipts.
Change-source: pulse-maintainer
Retain the scheduled governed-source selection and no-mutation demo verdict in a separate fixed dispatch mode. Check its control SHA and candidate-free envelope before checkout, preserve ordinary rehearsal rollback and exact event-source guards, and skip candidate builds.
Change-source: pulse-maintainer
Retain only matching stored observations with an explicit refresh-failure warning and a keyboard-safe scoped retry. Settle latest-read loading when polling overtakes a foreground refresh. Preserve target isolation, licence gates and diagnostic containment with regressions and exact-content browser receipts.
Change-source: pulse-maintainer
GHSA-q2hr-2g5m-vwhr in brace-expansion (below 1.1.21, and 4.0.0 to
5.0.11) fails the required frontend dependency audit on every PR. This
moves the locked copies to 1.1.21 and 5.0.12, and DOMPurify from 3.4.15
to 3.4.16 for GHSA-p98j-92pf-mc4p. Lockfile only, with the dependency
security floors and installability contract updated to match.
Retain the two-minute production constant and extract the same background runner with an explicit test-only delay argument. Correct the startup non-blocking regression after exact-source proof found its invalid constant assignment.
Contract-Neutral: Extract the unchanged telemetry background runner for deterministic testing; production scheduling, payload and privacy contracts are unchanged.
Change-source: pulse-maintainer
Try both loopback families for IPv6 wildcard listeners without changing explicit or IPv4-only binds. Reserve each family a share of the API deadline, keep all later checks on the responding address, and retry a failed observation once with a fresh bounded budget in the telemetry background runner.
Keep genuine API, UI and asset failures visible and report only a closed timeout category, never transport details. Cover both real listener families, startup recovery, failure and privacy boundaries; synchronise the disclosure and subsystem contract.
Change-source: pulse-maintainer
Use the existing non-suspending query's source-isolation option so an uncached target or range cannot display or cache former-host observations. Forward AbortSignal to the Charts API without changing matching-cache or same-source polling behaviour.
The assigned-base VM regression has six failures, including former-host cache contamination; the final mock-backed PBS browser check covers delayed reads, withdrawal, failure, late response and locked ranges at desktop and phone widths. Update the shared frontend contract with real renderer/cancellation regressions. Installed #1723 acceptance and the separate exact-graph security repair remain unresolved.
Change-source: pulse-maintainer
GHSA-q2hr-2g5m-vwhr (brace-expansion quadratic {a},b} rewrite, below
1.1.21 and 4.0.0-5.0.11) fails the required frontend dependency audit on
every pull request. Move the locked copies to 1.1.21 and 5.0.12, and
DOMPurify from 3.4.15 to 3.4.16 for GHSA-p98j-92pf-mc4p (IN_PLACE
afterSanitize hook XSS). Lockfile only; the dependency security floors
move with it.
Keep the existing signed installer fallback and require nearby Pulse helper ownership for every install and rollback example, including authored bullets. A distant community-scripts warning must not make an unsafe command publishable.
Change-source: pulse-maintainer
Use TrueNAS default summaries for reporting queries so SCALE 25.04 can validate its History responses. Preserve raw samples, time windows, CORE live telemetry and existing error boundaries.
Refs #2346
Change-source: pulse-maintainer
pulse-triage[bot]