Avoid cloning and ingesting twenty known non-host Kubernetes metadata kinds in temporary per-report matching registries, while preserving all publication and canonical matching. Clone only the selected native record for exact host reads and detach mutable host update, module and config state. Pin reference equivalence, live report publication, ownership and allocation scaling with connected controls.
Change-source: pulse-maintainer
Compare complete canonical host views with a full-snapshot reference and pin current replacement. Measure unrelated Kubernetes metadata and peer-host allocation growth before repairing report lookups.
Change-source: pulse-maintainer
Resolve the prior non-Linux skip in favor of the exact reviewed real-registration refusal fixture. Preserve candidate a2608c9 and runtime safety contracts.
Change-source: pulse-maintainer
The correctly fingerprinted receipt already preserves the exact browser evidence. Remove only the new invalid duplicate in a separate additive pruning commit; preserve all reviewed history and production source.
Change-source: pulse-maintainer
Correct the new publication receipt filename and immediate parent binding without rerunning or changing its verified production bytes. The initial invalid receipt remains historical evidence, not coverage.
Change-source: pulse-maintainer
Verify exact combined production drawer after additive published upstream integration: Chromium desktop and WebKit phone keep saved service access distinct from backup/read precautions and explicit Discovery admission. Eight inspected captures and synthetic safe/absent/unsafe URL controls; no native guest or service operation.
Change-source: pulse-maintainer
Preserve exact upstream drawer-header Open action and every reviewed guest-observation commit. The existing Discovery precaution remains separate from the saved service link.
Change-source: pulse-maintainer
Phone and narrow workload rows hide the adjacent web link so guest names
stay distinguishable. On a phone that left a saved service reachable
only from the URL field on the drawer's Manage tab, three taps deep and
behind a settings form.
The guest drawer header now carries an Open action whenever a URL is
saved. It is built from the shared `WebInterfaceLink` and the
drawer-header action class, so the service is one tap from the expanded
row with a 44px phone target (32px from the `sm` breakpoint up). Rows
are unchanged: showing the row link at 393px truncated names until
`checkout-web-01` and `checkout-web-02` read the same.
- Renders only for a saved URL. Unsafe or malformed values show the
existing warning, never a link.
- Opening it does not collapse the drawer.
- Adds no fetch, polling or per-row work.
Verified on a private mock stack at 375, 393 and 1280px widths (receipt
`frontend-modern/browser-verification/758aa0a8df357dc4.json`).
`GuestDrawer.test.tsx` covers target and rel, the no-URL and whitespace
cases, the unsafe-URL warning, and that the drawer stays open.
Refs #1556.
PR2472 build run 37239183545 extracts no wrapped TrueNAS recipes; exercise all three current blocks and retain synthetic HTTP response bodies only in private files, including 201 save and error controls. Native run 37239183481 expects a Linux QGA capability on macOS and Windows; assert non-Linux agents do not advertise it and scope the connected PVE fixture to its actual Linux runtime. Production safety and documentation remain unchanged.
Contract-Neutral: Test-only reconciliation of already-reviewed private-response recipes and existing Linux-only guest-execution capability; no product contract change.
Change-source: pulse-maintainer
Preserve reviewed guest-observation ancestry and the human-authored vSphere label repair at the exact upstream frontier.
Change-source: pulse-maintainer
On the vSphere overview every ESXi host group header carried a chip
naming the host's first VM (esxi-01.lab.local [etl-batch-01]) where the
cluster belongs. The workload adapter took the cluster from
getPreferredResourceClusterName, which falls back to the resource's own
name. That fallback suits a cluster resource, but a vSphere VM keeps its
cluster in vmware.clusterName, which the helper never reads, so the VM
became its own cluster. Standalone Proxmox guests had the same problem
in their context label.
Workloads now take the cluster only from an explicit source: the vSphere
facet, then the existing explicit helper. The grouping instance keeps
its old fallback chain, so group keys do not move.
Verified in a browser on a mock estate at 1440 and 390 widths; receipt
included.
Preserve exact Core candidate f1e221a0fb. Retained source-ji23nb_c proves failed and unusable refresh controls, connected suites, focused races, vet and builds. Existing canonical-only frontend changes are disjoint; no frontend resolution or new browser proof is needed. Native guest recovery remains with Delivery.
Change-source: pulse-maintainer
Phone and narrow workload rows hide the adjacent web link so guest
names stay distinguishable. On a phone that left a saved service
reachable only from the URL field on the drawer's Manage tab, three
taps deep and behind a settings form.
The guest drawer header now carries an Open action whenever a URL is
saved, built from the shared WebInterfaceLink and drawer-header action
class, so the service is one tap from the expanded row with a 44px
phone target. Rows are unchanged: showing the row link at 393px
truncated names until checkout-web-01 and checkout-web-02 read the
same.
Refs #1556.
On the vSphere overview every ESXi host group header carried a chip
naming the host's first VM (esxi-01.lab.local [etl-batch-01]) where the
cluster belongs. The workload adapter took the cluster from
getPreferredResourceClusterName, which falls back to the resource's own
name. That fallback suits a cluster resource, but a vSphere VM keeps its
cluster in vmware.clusterName, which the helper never reads, so the VM
became its own cluster. Standalone Proxmox guests had the same problem
in their context label.
Workloads now take the cluster only from an explicit source: the vSphere
facet, then the existing explicit helper. The grouping instance keeps
its old fallback chain, so group keys do not move.
Contract-Neutral: Behavioral bug fix: workload cluster labels stop falling back to the workload's own name; no contract delta.
Split series at actual in-panel stored times without that metric, retaining every isolated and measured-zero observation. Explain gaps visibly and accessibly without guessing cadence, outage cause or duration. Live recovery cannot fill stored gaps. Production drawer browser proof and connected controls preserve source/access isolation, exact-time inspection, independent readings and the request budget.
Change-source: pulse-maintainer
Retain metadata values and the last useful observation time through failed, empty and unusable refreshes. Apply the existing retry backoff separately instead of making retained identity new guest-agent evidence or a fresh complete-cache hit. Preserve useful partial responses, normal cache hits and OS failure policy, with HTTP polling and recovery controls.
Contract-Neutral: Behavioural correction to existing guest metadata observation timestamps and retry scheduling; no schema, API, route, field, guest command, admission, duration, retention or numeric source-selection contract delta.
Change-source: pulse-maintainer
Mounted regressions distinguish actual stored gaps from elapsed-time guesses, live numeric carriers, valid zero rates and missing values at a dated inspection. Pin segment and isolated-observation rendering through recovery and denied/transient reads.
Change-source: pulse-maintainer
Preserve the exact reviewed Web commits and their parent-bound browser receipt. Retained filesystem usage is labelled last known without current health bars; unavailable usage retains identity and capacity only.
Change-source: pulse-maintainer
Preserve exact reviewed Core commit and its retained source-nt5khbio proof. Retained or failed readings must not become fresh History samples; independent current readings and legacy policy remain. No frontend content change or native recovery claim.
Change-source: pulse-maintainer
The runtime source passed the entire frontend test suite before two newly added partial telemetry fixtures failed type checking. Supply the existing six-field availability shape without changing runtime bytes, weakening assertions or rebinding the browser receipt.
Change-source: pulse-maintainer
Native Windows and macOS correctly advertise no PVE guest guard, so their real-server fixture must assert refusal before any config or QGA handoff. Keep the existing Linux admission, outcome and resumption assertions and exercise foreign platform labels without changing runtime capability policy.
Contract-Neutral: Test-only platform evidence repair; guest execution and Discovery runtime contracts, capability advertisement and safety gates are unchanged.
Change-source: pulse-maintainer
Label retained guest usage beside each mount and remove current utilization bars and threshold colours until a fresh read. Do not promote numeric carriers on failed or explicitly unavailable reads; retain identity and known capacity, current/LXC controls and the existing safe read explanation. Production drawer browser proof, mounted regressions and pure builder controls preserve the local request budget.
Change-source: pulse-maintainer
Use the existing producer-owned memory observation and filesystem validity in the native Proxmox History writer. Preserve old points and legacy unannotated policy while keeping independent current memory, CPU, valid I/O and measured-zero recovery. Controls reproduce the unchanged-parent failures through real HTTP polling, in-memory and persisted series, and short/long chart reads.
Contract-Neutral: Behavioural repair consuming existing guest observation and filesystem validity in the existing History path; no schema, API, route, numeric source selection, guest-agent admission, alert threshold, timestamp precision or retention contract delta.
Change-source: pulse-maintainer
Keep the malformed/retained regression controls tied to actual formatted values and the stable drawer, without assuming internal detail rows retain object identity. The original adverse proof is retained.
Change-source: pulse-maintainer
Exercise the shipped guest Overview with retained, unavailable and fresh filesystem evidence. Cover reason-only clearance, explicit telemetry unavailability and independent LXC/current controls without a native guest operation.
Change-source: pulse-maintainer
Preserve the reviewed published ancestry without changing canonical source content. Later upstream reconciliation belongs to the publication gate.
Change-source: pulse-maintainer
## What changed and why
Guest-command and Discovery results now distinguish the actual guest
exit/output from transport success, retain ambiguous or cancelled
execution as a safety deferral, and avoid replacing saved observations
with failed probe evidence. The owning host agent serializes guarded VM
execution and requires terminal guest status before releasing admission.
This responds to the guest-agent safety report without claiming a
reservation shared with backups or native recovery.
Guest-memory presentation preserves the selected source and original
observation time through raw, API and canonical projections. Overview
and History distinguish current, retained, unknown and unavailable
readings instead of calling retained readings live. Pulse's own service
alerts remain separate from monitored resources in Overview, History and
explanation actions.
TrueNAS CORE inventory no longer disappears merely because optional disk
rotation metadata is `"unknown"` or a numeric string. Required-field,
HTTP and malformed-JSON errors remain failures. Complete snapshots and
ordinary polling preserve identities, topology and unknown observations,
recover correctly and remove disabled inventory. Mixed alert decoding
already works and is not presented as a new repair.
Read-only resource metadata helpers avoid full-resource copies while
preserving sensitivity precedence, platform scopes and clone ownership.
Existing MSP diagnostic recipes use private header files, verified HTTPS
and bounded read-only requests. Retained report-intake safety contracts
and their completion records remain aligned with the reviewed source.
## Included reviewed source
Published base `1e56e9ec9f1e22837c87828fbd7f9a2982c663aa` → reviewed tip
`106f1908b3d8ddc9ae94f5e504019fb14aaf283f`: all 33 unpublished commits,
preserving their original identities and ancestry. Additive
reconciliation already includes current main.
Reviewed candidates include:
- Report-intake completion `89b8151f19bdcc1a0ae653b26baf75c0f12d735c`
through `37b271f4fc5e5a7d3797d3e4741a9e0783a4b040`,
`f8c5e98819d986398486bce23ae8c68f8c0898fd` and
`3fe74bf208764295d7a1ae915cd521b6b91d5f1f`, integrated at
`5060e1b6b8bcc7eff8cc68954f778370d0dc6fde`.
- Owning-agent execution and Discovery safeguards
`def087ed90b022043f4edde4a964516e940447c8` through
`8b6513581c8a53842a2db84556b171fa6cd0a0c3`, integrated at
`91816df826f3ce8366b807a129e3337dee9cec6b`; command-evidence completion
`4188c2a9bad3ec78e37bc1a4956e9098a4a46a94` →
`d7ef00f2f28ad1711c52eb12b660fc8db3e0c125`.
- Guest-memory and system-alert presentation: retained scope
`63443e8712dbb6d3866bdc5fce9f2b89c13be51c` →
`813846485825aab066890e00b1c1b13615e59b4f`; completion
`617f72c57f80551706614edbe3323f6b039551dd` →
`c6e1b71cb6b44ae9e067e10a3a83edd594918b11`; memory
`3d846f76d724b1853a3ea58201cfc6eb7e25b084` →
`835f88576f1975b7c98f05468968de6b3d17fa25` →
`dd2f442bac7790bf007ac60b352cdb7debd2a162`, integrated at
`d78f044abb9ffa50e7104867419abe5de9cd9821`.
- MSP guidance `5e6d5af3b53e33c4acb4afb03f5b03609674a894`, integrated at
`f00390f1feb41bac52849548d98143bab2546986`.
- CORE inventory `1ab97537d7d6fbfd781eb998ce89130eb5fa2b01`, metadata
read repair `b0c5eb1a82ad983e5979a1e8bf653a46bae666e3`, and
recovery-fixture completion `c0f5e98d5db585162672038a0622c1862f821403`,
integrated at the final tip.
## Validation
- Reviewed Core `source-tq7h_5do`: full connected suites,
snapshot/ordinary-poll and API controls, focused races/vet, types, real
embed and server/agent builds. Final backend and Go manifests are
byte-identical to that proven candidate.
- Reviewed command/Discovery `source-kakpcr_8` and guard
`source-ylb00ezk` cover connected execution truth and safety deferral
paths. Native QGA acceptance remains separate.
- Reviewed Web `source-5g83wcr_`: 4,240 connected tests, types,
lint/audits, formatting, embed/build and bundle checks; 24 browser cases
and twelve inspected desktop/390px/320px captures. Final frontend
runtime, scripts, manifests and browser-tested files match; final range
browser guard verifies all 15 changed production files against their
parent-bound receipts.
- Reviewed MSP installer/vet `source-e1x7r92a`, scoped docs
`source-oypceg0j`, and Chromium/WebKit rendering are retained; the final
guide, shipped mirror and recipe tests match their candidate.
- Exact final-head publication proof `source-sbsnw11t`: offline npm
installation without lifecycle scripts, types, real frontend build and
bundle budgets pass, with complete output and guest stop. Exact
final-head `source-1mf9ptz6` also passes the full installer suite and
vet, with complete hash-matched output and guest stop.
- Full-range provenance, clean source, whitespace, per-commit
preparation/governance, contract/registry audits and browser guard pass.
The 65 completion-history and release-policy fixture tests pass; an
initial wrong-directory invocation failed imports before execution and
is retained separately. Current main was independently read and needs no
additional merge.
## Remaining outcomes
Parent regressions, earlier fixture/copy-audit failures, adverse hosted
benchmarks and unavailable historical results remain evidence, not
retrospective passes. The ten-pair component study supports lower helper
cost, not hosted benchmark clearance or fleet CPU relief; no favourable
replay was used. Required exact-head CI and independent administrative
review still govern landing.
This is source delivery, not installed or release acceptance. The
guest-agent guard is process-local, does not reserve QGA against backups
and does not retain uncertainty across restart. Native overlap,
independent thaw, fresh writes on every backed-up filesystem, workload
liveness and safe resumption remain required; keep the monitoring-outage
precaution until those are established. CORE appliance acceptance,
matching installed server/agent and containing release evidence also
remain separate. Reporter follow-up will use actual published contents,
not issue links or source inclusion as completion claims.
Related to #2439
Related to #2466
Related to #2199
Related to #2465
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the exact three candidate commits. Retained source-p58_phvc covers connected alert, producer, recovery and explicit-disablement controls; retained readings are not fresh incident or removal evidence. Native and containing-release outcomes remain separate.
Change-source: pulse-maintainer
Preserve the exact seven candidate commits and their own-parent browser receipts. Retained source-gy5x8buj and the final browser matrices cover the existing drawer pause, visible failures and asynchronous target/run ownership; native backup safety remains separately owned.
Change-source: pulse-maintainer
Preserve both exact reviewed PI commits. Retain full installer/vet and desktop/mobile Docs proof for unchanged guidance; existing CORE repair and metadata-read integration does not overlap these files.
Change-source: pulse-maintainer
The complete runtime suite passed all 22,527 tests, then TypeScript rejected the new Promise<void> notes fixture because the actual API returns ResourceDiscovery. Supply that real type and saved response without altering the browser-verified production bytes or assertions; retain the adverse proof and finish connected tests, full types, lint and production build on this exact final source.
Change-source: pulse-maintainer
Separate operator policy from retained numeric evidence. Apply a filesystem disable override without evaluating its old usage or treating absent deferred inventory as authoritative removal.
Change-source: pulse-maintainer
Use selected memory observation state and filesystem read validity at both threshold and filter boundaries. Retained or failed inventory cannot open or resolve incidents, refresh their evidence or remove per-filesystem alerts. Independent current metrics, legacy readings and deliberate disablement retain their existing policy.
Change-source: pulse-maintainer
Exercise production memory/filesystem alert admission, delayed breaches, filters, canonical recovery and the connected HTTP backup-lock polling boundary. Retained evidence is not a new observation or an authoritative filesystem removal.
Change-source: pulse-maintainer
Preserve dispatched work across a same-guest backup precaution, but reject late HTTP, notes, timer and background refresh results after target, feature or run ownership changes. Keep background safety failures visible with saved evidence, distinguish scanner progress from saved HTTP completion, and make error dismissal accessible. The recovered drawer pause and these connected outcomes have current browser proof.
Contract-Neutral: Frontend-only behavioural repair of existing precaution, target/run ownership and error presentation. No resource schema, API, route, feature, command admission, permissions or collection contract changes.
Change-source: pulse-maintainer
Source proofs can supply unrelated input files. Retain recipe mutation controls while reading the exact parent only when its named guide was supplied; unrelated input directories must not become a new full-suite prerequisite.
Contract-Neutral: Test-only optional-input handling; no shipped guidance or product contract change.
Change-source: pulse-maintainer
Preserve the exact three reviewed Core commits. Retained source-tq7h_5do proves connected suites, focused races, vet, real embed and builds; synthetic recovery and component cost evidence do not establish native relief or release availability.
Change-source: pulse-maintainer
Make the existing connection guide fail closed before editing credentials, ignore curl configuration, bound each single POST and retain sensitive responses in new private files. Explain actual test/save status and uncertain-save readback without retrying setup as diagnostics.
Contract-Neutral: Documentation-only credential handling and copied-recipe regression tests; no runtime API, TrueNAS polling, authentication or connection-management contract changes.
Change-source: pulse-maintainer
Exercise late HTTP completion, retained background safety errors, pending refreshes, missing-target state, timer ownership and notes saves against the existing production state owner. These controls isolate truthful Discovery use without sending guest commands or claiming native backup acceptance.
Change-source: pulse-maintainer
Compose the previously unintegrated drawer precaution with the now-integrated memory and owning-agent safeguards. Preserve its original commits and own-parent browser receipt; validate the combined runtime before returning the candidate.
Change-source: pulse-maintainer
Reviewed exact PI candidate 5e6d5af3b5. Existing guidance and shipped mirror now use private header files, verified HTTPS and bounded read-only checks. Retain source-e1x7r92a installer/vet, source-oypceg0j docs tests and Chromium/WebKit rendering evidence; no native tenant isolation or publication claim.
Change-source: pulse-maintainer
A zero test deadline reinstates the real connection interval, so it did not make subsequent cycles due. Use a nonzero expired fixture deadline and assert each cycle reaches the disk endpoint; keep production scheduling and failure/recovery assertions unchanged.
Change-source: pulse-maintainer
Release preparation for `v6.5.0-rc.1`, made by the release train
(`pulse-maintainer-ship`). After this merges the train dispatches the
release workflow at this exact head
`c0b3ddf1e586982ed8dc7c1e8722f468fb2e42d4`.
Scope the inherited mounted-drawer disk resumption assertions to disk. Explicitly preserve unknown legacy memory and prove unchanged coordinates retain one History read. This corrects the old all-metric assertion rather than accepting disk freshness as authority for memory.
Contract-Neutral: Test-only refinement for the existing independent memory/disk provenance contract; no runtime, route, API, monitoring policy or permission delta.
Change-source: pulse-maintainer
Replace inline token arguments and certificate bypasses with private header files and verified HTTPS. Bound the read-only probes, discard bodies, preserve failed curl exits and distinguish an invalid token from a checked tenant boundary. Keep the shipped guide byte-synchronised. Exercise copied commands with a synthetic TLS peer, private-header canaries, hostile curl configuration and refusal/redirect controls; no customer endpoint is used.
Contract-Neutral: Existing diagnostic guidance and regression coverage only; no runtime, public API, token scope or tenant-isolation contract change.
Change-source: pulse-maintainer
pulse-triage[bot]