Backport-of: c590a01f33
Protect the existing release-line repair d33f81709e for candidate regression #1882 across repeated registry rebuilds and SQLite close/reopen. No runtime or product scope change.
Validation: focused test passes; restoring rebuild timestamps fails with 18 samples instead of 3; lifecycle and canonical-storage tests pass three race repetitions.
Contract-Neutral: regression coverage for existing observation-time behaviour.
Change-source: pulse-maintainer
Preserve the reviewed reconnect navigation backport while incorporating the canonical merge of the critical-transition alert repair.
Change-source: pulse-maintainer
Reproduced on release candidate 7f44ccd047: WARNING to EMERGENCY retained severity but dispatched only once instead of twice. Backport the existing delivery repair and acknowledgement/rate-budget lifecycle regression coverage; no new product scope.
Backport-of: 4752d5b4b7 (code and tests), b116d05592
Validation: five focused race repetitions passed; pre-fix active transition failed. Appliance/provider receipt and restarted candidate soak remain outstanding.
Change-source: pulse-maintainer
Backport runtime mapping and regression tests from 65a024b3d3. Candidate v6.4.3-rc.1 and stable v6.4.1 omit the documented EMERGENCY severity. Include release-line monitoring and unified-resource contracts for the repaired projection and recovery boundary.
Reproduced omitted projection, zero notification callbacks and false recovery before the fix. Affected package suites and focused race tests passed in the initial turn. Appliance and external-provider receipt remain unqualified.
Change-source: pulse-maintainer
The INFO and NOTICE repairs need lifecycle coverage beyond isolated severity transitions. Verify that escalation retains identity and that renewed actionable evidence interrupts recovery, preventing a later single INFO observation from clearing the incident.
Change-source: pulse-maintainer
(cherry picked from commit 62c66d2a48)
Correct the INFO backport so native TrueNAS NOTICE remains actionable while retaining informational canonical severity. Preserve the provider level as optional evidence and pin projection, JSON compatibility, alert activation, and confirmed recovery boundaries.
Adapted from ff1d010dd9 for release/v6.4.
Change-source: pulse-maintainer
Issue #1892 reports successful replication information requiring acknowledgement. Preserve provider information on resources while excluding TrueNAS INFO-level conditions from active alert synchronisation. Warning conditions still activate and clear when downgraded to information.
Resource-incident timeline events contain numeric placeholders, not threshold evidence. Avoid displaying these as a fictitious 0 >= 0 trigger while retaining numeric metric formatting. Focused regressions reproduce both failures and pass with these changes.
Change-source: pulse-maintainer
(cherry picked from commit 7726539f83)
TrueNAS emits FINISHED for successful replication, but the recovery mapper treated it as unknown. Recognise that provider state while preserving error precedence and the missing-run guard; add regression coverage reproducing the reported outcome.
Change-source: pulse-maintainer
(cherry picked from commit 62c6e07477)
Issue #1895 reports parity alerts when mdNumDisks=0 on a pool-only Unraid system. Array service state alone does not establish that a parity array exists.
Preserve the optional disk count from collection through canonical runtime conversion and suppress only the no-parity warning for an explicit zero. Missing or malformed counts retain legacy behaviour, and disk failure reasons remain active.
Validated focused Unraid tests in hostagent, storagehealth, monitoring, unifiedresources and alerts, including JSON zero preservation and canonical round trip. The new pool-only regression fails against the previous warning condition. Both agent and server need this change; no release or reporter retest is claimed.
Change-source: pulse-maintainer
(cherry picked from commit 3334cccfd9)
Near-synchronous host and Docker reports consumed a shared CPU baseline, measuring collection bursts rather than each module's reporting interval. Retain a collector per host collector and a separate Docker module collector while preserving the package-level convenience API and disk filters.
Add an interleaved-counter regression covering both collection entry points. It fails when routed through the shared baseline and passes with isolated state. All hostmetrics, hostagent and dockeragent tests pass, as do the focused CPU regression tests under the race detector.
Change-source: pulse-maintainer
(cherry picked from commit 0f972f42f2)
Issue #1890 reports macOS agent updates stopping because the root group does not exist. Use numeric superuser ownership in the two shared lifecycle writes without relaxing failure handling or the least-privilege group boundary. Add a regression fixture that rejects named root ownership and checks that chown failures still prevent replacement.
Change-source: pulse-maintainer
(cherry picked from commit 19c2b6a925)
The release line carries an additional oversized-metadata regression fixture. Model its published archive HEAD response so the backported existence check retains coverage without treating that fixture as a deleted release.
Refs: #1881
Contract-Neutral: backport test adaptation only
Change-source: pulse-maintainer
GitHub's Atom feed can retain entries for deleted releases. Probe the deterministic runtime archive without following redirects before exposing a feed candidate, and continue to the next published version when the candidate is stale. Keep custom update servers from falling through to the public feed on a 403.
Contract-Neutral: Update discovery validation only; no wire, persisted-data, or subsystem contract change
Refs: #1881
Change-source: pulse-maintainer
(cherry picked from commit 3193db66b0)
GitHub's release list now exceeds the update check's 1 MiB safety limit,
causing valid installations to report that updates are unavailable. Keep the
bound and use the existing bounded Atom feed only for the typed over-limit
condition so malformed metadata remains a hard error.
Accept both release-name and bare-tag feed entries, and do not substitute the
public GitHub feed for a configured custom update server.
Contract-Neutral: Update discovery error handling only; no wire, persisted-data, or subsystem contract change
Refs: #1881
Change-source: pulse-maintainer
(cherry picked from commit a186bd205e)
Operators can explicitly select tmpfs paths that automatic filesystem
filtering would otherwise hide. Multiple such mounts commonly share both the
generic tmpfs device name and capacity, so applying normal storage
deduplication to them silently dropped configured disks from collection.
Limit device-and-capacity deduplication to normally visible storage while
preserving it for NAS bind mounts and subvolumes.
Change-source: issue #1875
Backport of the main-branch guard. pkg/server tests boot the real server
through Run() with the version literal "test-version", which normalizes to
0.0.0-test-version, and each test runs against its own t.TempDir(), so
every run mints a fresh install ID. The service-health failure reporter
sends synchronously from a deferred handler as soon as Run() returns an
error, so any test exercising a startup failure posts one ping.
This line still emitted after main was fixed: release-line lane work runs
pkg/server tests on this branch, and those pings arrive with the old
version classifier too, so they land mislabelled as ordinary prereleases
and re-contaminate install-population reads that were just corrected.
send() now refuses the production endpoint whenever testing.Testing()
reports true. The check compares against productionPingEndpoint, so
telemetry's own tests keep asserting on ping content through a redirected
endpoint. Verified on this branch: three runs of the failing-startup
tests, zero pings received.
Backport of the main-branch guard. pkg/server tests boot the real server
through Run() with the version literal "test-version", which normalizes to
0.0.0-test-version, and each test runs against its own t.TempDir(), so
every run mints a fresh install ID. The service-health failure reporter
sends synchronously from a deferred handler as soon as Run() returns an
error, so any test exercising a startup failure posts one ping.
This line still emitted after main was fixed: release-line lane work runs
pkg/server tests on this branch, and those pings arrive with the old
version classifier too, so they land mislabelled as ordinary prereleases
and re-contaminate install-population reads that were just corrected.
send() now refuses the production endpoint whenever testing.Testing()
reports true. The check compares against productionPingEndpoint, so
telemetry's own tests keep asserting on ping content through a redirected
endpoint. Verified on this branch: three runs of the failing-startup
tests, zero pings received.
Canonical registry rebuilds can run several times between PBS polls. Reuse the metric source sighting time so unchanged datastore capacity does not create a fresh raw sample on every rebuild.
Contract-Neutral: behavioral regression fix; metric contract and agent lifecycle boundaries unchanged
Change-source: pulse-maintainer
Exclude the SSH connection deadlock advisories published against x/crypto versions before v0.56.0.
Contract-Neutral: dependency-only security floor update; no runtime contract changed
Change-source: pulse-maintainer
GitHub's releases API response now exceeds the updater's 1 MiB
metadata limit. This causes v6.4.3-rc.1 update checks to fail even
though the releases Atom feed remains bounded.
Retain the safety cap and use the existing bounded Atom path only for
the default GitHub source. Custom update servers remain fail-closed.
Contract-Neutral: update-source recovery fix only; no public contract change
Change-source: pulse-maintainer
Use the reviewed placeholder-filesystem rule when storage health assesses structured Unraid state, while retaining explicit DISK_NP_MISSING members as critical evidence.
Change-source: pulse-maintainer
Contract-Neutral: Unraid fsType=auto placeholder normalization is applied consistently at storage-health assessment without changing contracts
Treat Unraid's fsType=auto value as a placeholder rather than disk assignment evidence at both agent collection and server ingestion boundaries. Preserve real assigned and explicit missing members.
Change-source: pulse-maintainer
Contract-Neutral: Unraid fsType=auto placeholder normalization fixes false missing-slot alerts without changing wire or subsystem contracts
(cherry picked from commit fd843da7dfc51bba29bb5ddcbcdb4480d0e67079)
(cherry picked from commit 7a6456969d)
Backport the browser-only refresh proof corrections from main. Exercise the
always-present History tab, follow the Proxmox surface's source-scoped canonical
resource query, trigger the metadata refresh path, and await the completed
response before checking drawer and viewport stability.
Contract-Neutral: browser regression coverage only; no runtime or API change.
Change-source: pulse-maintainer
Backport-of: 07c2f9ffa0
Backport-of: cf5e363979
The browser compatibility coalescer could undo the server's provider-scoped split after websocket reconciliation. Honour machine and provider identity before merging same-hostname rows.
(cherry picked from commit 724a8a4960)
A cluster name is an operator-selected display label, not global machine identity. Two independently configured estates using the same label could share one linked agent and then collapse into one presentation row after delayed cluster detection. Require node identity, exact endpoint, or host corroboration across provider instances instead.
Refs #1753
Change-source: pulse-maintainer
(cherry picked from commit 384dc53608)
gopsutil defaults to PID 1's mount table, which differs from the namespace created for Pulse's hardened systemd service. Enumerate the collector's own mount table so explicitly included tmpfs and bind mounts are discoverable, while preserving deliberate host-proc overrides for container deployments.
Change-source: pulse-maintainer
(cherry picked from commit 9d5cdfa088)
The stable-row focus fallback ran after the shared dialog cleanup and could scroll a lower Manage trigger into view. Preserve the existing focus return without changing the operator's viewport, and cover the real desktop and narrow browser path.
Contract-Neutral: frontend focus-restoration bugfix; no API or persisted-data change.
Change-source: pulse-maintainer
(cherry picked from commit da9800ff2f)
Shared subtabs used scrollIntoView for horizontal visibility, allowing remounted or programmatically changed drawers to scroll the whole application shell. Reuse the horizontal rail controller instead, and restore disclosure focus without scrolling when a detail row closes.
Record the shared primitive contract and its registry-approved guardrails, with desktop and narrow Backups browser coverage for visible Overview and Manage states, off-screen tab changes, and non-scrolling focus return.
Change-source: pulse-maintainer
(cherry picked from commit 59e9f5ea2b)
Connection-ledger refreshes replaced the selected connection snapshot and re-ran the credential slot renderer, destroying unsaved form state despite the node-level dirty guard. Keep the editor owner bound to the selected source while allowing the surrounding live row and dialog description to refresh.
Regression coverage advances both lastSeen and the endpoint, proving the form mounts once and retains input while live context updates.
Contract-Neutral: frontend state-lifetime bugfix; no API or persisted-data change.
Change-source: pulse-maintainer
CORE 12 appliances can report versions such as TrueNAS-12.0-U5 without a CORE product marker, and they do not expose the JSON-RPC endpoint required by modern SCALE releases. The existing legacy check therefore rejected a supported REST-capable appliance before collection could begin.
Recognise the explicit TrueNAS 12 family while retaining the fail-closed boundary for modern releases, and cover negotiation with the reported version string.
Contract-Neutral: TrueNAS legacy-version negotiation fix; no wire, API, persisted-data, or subsystem contract change
Change-source: pulse-maintainer
Patrol's readiness probe against a GPT 5.6 Luna deployment on Azure AI
Foundry failed with "Unsupported parameter: 'max_tokens' is not supported
with this model. Use 'max_completion_tokens' instead." The provider only
switched fields for o1/o3/o4 models, and only on api.openai.com, so the
GPT-5 family was sent max_tokens everywhere and Azure hosts were treated
as generic OpenAI-compatible endpoints.
Treat the GPT-5 family as reasoning models on the official and Azure
OpenAI hosts. Because an Azure deployment name need not reveal the model,
also act on the API's own instruction: when a 400 names max_completion_
tokens, re-send once in that form, drop the non-default temperature those
models refuse, and remember the answer for the life of the client so later
requests, including Patrol's streaming probes, go straight out correctly.
Refs #1837
Contract-Neutral: OpenAI provider parameter selection fix for issue 1837; no wire, API, or subsystem contract change
The secure-runtime qualification required the candidate commit to be an
ancestor of origin/main. Under the release train a patch candidate is cut
from release/vX.Y and is not on main at all, so v6.4.3-rc.1's
qualification failed at "Verify detached release source" before running
any check, and the steward correctly refused to treat the candidate as
stable-capable. Resolve the branch the control plane maps the version to,
fetch that, check ancestry against it, and hand the same ref to the
attestation so the receipt records the line it was verified against.
Refs #1753
Contract-Neutral: release qualification checks ancestry against the mapped release branch; no product or contract change
(cherry picked from commit 79d87a4a2c)
de41ea1883 replaced the chart-version step's output echoes with
scripts/write_github_output.py, but that step runs before the repository
is checked out, so the script does not exist yet and the Helm publish
fails with "can't open file ... write_github_output.py" on every release.
The v6.4.3-rc.1 run 33580123246 hit it after all other staging succeeded.
Run the checkout first; nothing in it depends on the version outputs.
The v6.4.3-rc.1 dispatch from main (run 33579042375) failed inside the
compiler dispatch: main advanced one minute after the release pipeline
pinned its source SHA, so the exact-SHA identity check on the compiler run
correctly refused the moved head. With the maintainer landing pull requests
every few minutes, a candidate dispatched from main cannot hold its SHA for
the minutes between prepare and compile.
Declare release/v6.4 for the 6.4.3 version prefix, created from main at the
exact-SHA-qualified commit 56e51e622e, so the workflow refuses a v6.4.3
dispatch from any other branch and the compiler binding stays exact. This is
the delivery contract's branch-per-train rule applied to the patch line that
predates the first train; earlier 6.4.x versions keep their historical main
mapping, and the 6.5 train mapping is unchanged.
Stable promotions built whatever the dispatch branch was at that second.
The resolver checked that HEAD descends from the promoted release
candidate but never that its content matches, so v6.4.0 shipped 64
changed files, including product code, that v6.4.0-rc.12 had not
soaked. Every v6 version was mapped to main, which now moves every few
minutes under the autonomous maintainer, so each fix to a candidate
brought everything landed since and stable was never an exact soaked
commit. Five of six stable minor releases shipped under version-bound
owner exceptions that waived the soak.
From v6.5.0 the release train applies (RELEASE_PROMOTION_POLICY.md,
"Release Train"): a two-week train sized to measured velocity, a
release/v6.N branch per train declared in the control plane so the
workflow refuses a dispatch from anywhere else, a stable promotion that
may differ from its candidate only in release metadata unless
hotfix_exception names active customer harm, and a seven day soak for
minor releases. The 6.4.x line stays on main so the v6.4.3-rc.1
candidate already prepared there is unaffected. The gap is registered
as coverage gap release-train-exact-candidate-promotion.
pulse-triage[bot]