Updating through Tailscale Serve left the modal stuck on "Downloading
update... 10%" while the update finished in the background. The SSE
endpoint now sends status on connect, flushes each event, heartbeats
every 15s and disables proxy buffering. The modal falls back to polling
when the stream goes quiet, only enters the restart phase on real
restart evidence, and never auto-reloads on unconfirmed completion
without a pre-update version baseline. Planned for v6.4.6.
Updating to v6.4.5-rc.5 and then v6.4.5 left the progress modal on
"Downloading update... 10%" even though the update finished in the
background. The status stream could go silent behind a proxy (Tailscale
Serve, nginx buffering) and the modal only advanced on stream events.
Backend: the update SSE endpoint now sends the current status on connect,
writes events through one ordered writer with an explicit flush, sends a
15s heartbeat and sets X-Accel-Buffering: no.
Frontend: a silence watchdog falls back to status polling, the restart
phase is entered only on real restart evidence (restarting status, the
server going away, or a version change) rather than a single failed poll,
and the page never auto-reloads on unconfirmed completion without a
pre-update version baseline to compare against.
## Current combined outcome
Keep PBS History attached only to its corroborated host and active
range; make startup health checks work with bounded IPv4/IPv6 fallback;
restore supported TrueNAS SCALE reporting queries; honor configured
alert storm thresholds; and make troubleshooting and server update
guidance safe to follow. Snapshot/metadata maintenance also reduces
allocations without trusting identity hints, addressing the performance
evidence in #2199 and contributor PR #2342.
The prior proposal head `5cc1f2f7b06b6b6d98f08ed177e8326beea407e1`
cannot land independently: completed Build and Test run `36672563104`
fails its frontend dependency audit on high-severity brace-expansion
advisories. This is not a retryable outage. Current reviewed source
already additively incorporates published #2349
(`8d5969fb3b27422f7d9e5ef55fd4ce09af5b25a6`), including brace-expansion
1.1.21/5.0.12 and DOMPurify 3.4.16. Updating the blocked proposal once
with this coherent reviewed range repairs that source defect; this is
not repeated advancement of a healthy checking head.
## Current source range and newly included candidates
Complete unpublished main range
`8d5969fb3b27422f7d9e5ef55fd4ce09af5b25a6..66ec68c813cacf6c1a0f98cfb5f6da494584c9ac`.
The already proposed PBS/guidance range below remains included
unchanged. Newly included reviewed candidates:
- `ffc44a0f8c02`: honor configured flapping thresholds above ten,
retaining expiry/cooldown semantics.
- `173290127a3a`, `6ef79688a5d1`, `18f519e3496b`: bounded captured audit
diagnostics and fail-closed positive-advisory precedence, with
release-asset guard reconciliation. These diagnostic changes alone do
not fix advisories.
- `9bc6f6ed647b`, `45b2fae8dbb5`: safe deployment-specific port
diagnostics and credential-file API examples, with matching shipped
guides.
- `901274ee927d`: safe allocation-bounded snapshot/metadata maintenance;
retains contributor credit and full identity decoding.
- `21a35494aecb335755de773dd099e1364e65b3e0`: supported TrueNAS
reporting summaries for #2346, preserving raw samples, windows and error
boundaries.
- `9d77f09b4f6b`: reject unscoped updater examples in authored release
bodies.
- `4ba830bfd31c0d2df71b4ed426b7b9ad31c8b4ed`: isolate drawer History
across target/range changes and cancel obsolete reads; fixes reproduced
former-host cache contamination in the #1723 investigation.
- `fffaa64e57ef` and additive test repair
`b0a4d2f3928f080dc093b561ba855b84f1443b41`: dual-stack bounded
service-health probes and one bounded background retry; genuine
API/UI/asset failures remain visible.
- `66ec68c813cacf6c1a0f98cfb5f6da494584c9ac`: reviewed additive
incorporation of full upstream #2349. The dependency
manifests/security-floor tests exactly match current published main.
Every accepted commit identity, original author and ancestor is
preserved. No release, tag or deployment is changed by this proposal.
## Combined validation judgment
Sufficient component evidence is reused rather than rerunning it solely
for batching:
- Existing original-range source/race/browser evidence is retained
below.
- TrueNAS: `source-j4j1btoe` / `source-lxeal7q5` affected/full race and
modeled red/green evidence; final `source-8ouijs8p` vet/recovery proof.
Same source tree across the message correction.
- Drawer isolation: `source-z1ldgp56`, offline install/type-check/lint,
21,541 tests, embed build and bundle budgets; `source-2caj4cbp` /
`source-z9xqxyun` formatting/header/duplication checks; real-renderer
mock-backed desktop/phone browser proof, ten recorded inspected
screenshots.
- Health: final `source-txxwlqa3` complete server/telemetry race suites,
40 telemetry-report tests and vet; real frontend embed build/docs
evidence `source-k2aprplj`.
- Published #2349 exact proposal CI: run `36767849067` passed the
complete dependency audit with zero reported vulnerabilities and 21,504
frontend tests (three skipped); its functional/E2E/security checks
passed. The containing main range does not change its manifests or
security-floor tests.
This turn also passed 17 executable audit-wrapper fixtures and all 40
release-body renderer tests under `pulse-maintainer-proof`. The API-auth
documentation tests reached three denied socket operations in that
native fixture environment; those failures are execution-context
evidence, not successful tests. An optional guest-local recheck through
the supported source-proof executor is queued behind occupied proof
slots, not a pass. It is not needed to repeat the existing candidate
evidence; its outcome remains separate from exact-head CI.
Publication provenance, complete-range whitespace and aggregate
parent-bound browser coverage pass. All 22 unpublished non-merge commits
pass canonical-completion checks using only their recorded, accurate
Contract-Neutral reasons where applicable. An unqualified range-wide
canonical invocation reported two cross-scope requirements; the required
per-commit checks and parent/content-bound browser range check pass, not
a blanket exemption.
The current exact frontend snapshot is unavailable locally
(`0bd5f30a…`); no final combined offline npm build/audit is claimed. The
independently tested upstream graph and reviewed component proofs
support proposing this composition, not merging without its fresh
exact-head checks. Actual local VM Go remains 1.26.7 rather than the
declared 1.26.8 floor. Fresh exact-head CI and independent review must
resolve the complete proposal before landing. Prior failed checks remain
evidence, not green checks or release qualification.
These source/mock proofs do not establish installed
PBS/VirtualBox/disk/network/I/O recovery, TrueNAS appliance acceptance,
Tailscale Serve upgrade/rollback, or release readiness. Eligible patch
placement remains separate; this main batch does not replace a published
RC or expand v6.4.6 scope.
<details>
<summary>Retained earlier proposal scope and validation
history</summary>
## What changed and why
PBS host History and SMART ownership now require corroborated machine
identity: reject stale Agent observations and host-local addresses,
preserve IPv6 endpoints, and withdraw retained History when the backend
link disappears. The frontend also rejects editable labels and
endpoint-token guesses, permits fresh exact reported machine names or
explicit backend Agent links, and isolates row snapshots so
reconciliation cannot corrupt later withdrawal. This addresses
wrong-host risks found investigating #1723; it does not claim installed
relief for every PBS History symptom or the reporter's VirtualBox
topology.
Troubleshooting now explains browser-bound recovery and bounded
sanitized incident reporting rather than ineffective credential-copying
or risky repeats. Clone guidance follows saved Agent identities and
persistent overrides instead of deleting the operating system's machine
ID. Source and in-app guides match.
## Reviewed source included
Complete main range
`fa1d9eb36d4c2f55e648f10cfe7400983551b877..5cc1f2f7b06b6b6d98f08ed177e8326beea407e1`:
- Retained-History withdrawal
`62fb6cdb12dd3db90d2be598df1efc0210be37f1`, integrated by
`7a646013062d667f7c053def80aab405c488d3e8`.
- Recovery/reporting guidance
`d707df9577ddbf9b4b7ba7c1c055131318bd66e1`, harness correction
`5fe29c558d146664320ff8beda49f4a36613737b`, integrated by
`78434304f1afbac5b58b17ce885424be17b4dff7`.
- Backend identity safety `a0081d676b450f58d8f3593918334152df0de4d3`,
composed at `3ea52c25b565d614304b23350012ce942f828e6b`.
- Clone guidance `25a2e56d5ef62b2674a4deba655a121ecb7c8761`, integrated
by `6e81f06e095a009233067a539ef7cc47502583d5`.
- Frontend identity boundaries: regression fixtures
`6ade01cbd4d02cd25b691f9ff5919206cceae764`, repair/browser receipt
`3df86570396a3e7f600abf8a3c7c8d3ea957106c`, retained-fixture correction
`be18333570be6ba428c690942d7b4def64d4a678`, integrated by
`105e59bffb9b476ee3c9606cde95e3412e1664ac`.
- Additive formatting-only correction
`17f2d7a45d93ebd53347096edf46e44c8a0ef6fc`. The earlier #2341 head
failed Frontend formatting in completed run 36658394047 on
docsLinks.test.ts. A retry would not fix it; this correction preserves
assertions and every accepted commit. The newer reviewed PBS range is
included with the necessary repair rather than advancing an otherwise
independently landable checking head.
## Validation and limits
Recorded source evidence reused:
- `source-3a9ej4nh`: offline frontend install, 21,506 tests, lint,
type-check/build; mock-backed desktop/phone retained-History proof and
inspected screenshots.
- `source-sksnquh_`: full unifiedresources/pkg/pbs race suites and three
polling regressions, exit 0. Final Go source is identical to that
candidate. VM Go 1.26.7 differs from declared 1.26.8, so configured CI
remains necessary.
- Recovery/reporting: 20 documentation tests and 15 real-document
desktop/phone checks. Clone guidance: `source-j3xvikj1` passed 47
documentation tests; `source-8hmpoki1` passed agent
configuration/persistence tests; 21 browser assertions and four
inspected screenshots.
- Final reviewed PBS frontend candidate: `source-_pyutny3` passed 21,530
tests, lint/type-check/build; 24 desktop/phone target/layout checks with
six inspected screenshots. Earlier red fixtures, snapshot-mutation
failure and obsolete positive-fixture failures were retained and
repaired.
At prior proposal head `17f2d7a45d93ebd53347096edf46e44c8a0ef6fc`:
`source-2kpt0am7` passed offline install, full locked formatting check
and 21 docs tests; `source-hcai5s0y` passed both PBS table/drawer files,
48 tests. Provenance, whitespace and aggregate parent-bound browser
coverage passed. Per-commit canonical checks used the reviewed
Contract-Neutral reasons for bounded behavior-only frontend repairs;
backend contracts were updated. Direct host attempts to run existing
browser scripts stopped at denied loopback listeners, produced no visual
proof and are not passes; the recorded confined browser evidence above
remains separate.
Exact-head functional/security CI and independent review govern landing;
advisory results remain evidence, not release approval. These are
source/mock proofs, not installed acceptance or release shipment. The
frozen v6.4.5 RC.5 is not expanded by this main batch.
## Additive integration correction and current CI evidence
The proposal's completed Core E2E run 36660586289 failed all six
desktop/phone PBS History cases in shards 3, 6 and 8. The fixture
supplied only presentation labels and a non-contract `pbs.hostname`,
whereas the reviewed identity repair deliberately requires a reported
`pbs.nodeName` or explicit backend Agent link. Commit
`5cc1f2f7b06b6b6d98f08ed177e8326beea407e1` supplies the reported node
name, retaining the expected guest/standalone History targets and
wrong-target rejection. Runtime source is unchanged. No-content merge
`80e654381b94e1a61ef6727cbc69b54d0fa7eb10` preserves Delivery's reviewed
race-proof candidate. Every original reviewed identity and ancestry is
retained.
Recorded confined Chromium/WebKit desktop/phone fixture proof reproduces
the old wrong targets and passes the corrected fixture. The separate
Build and Test run 36660586299 failed only
`TestConfigWatcher_WatchForChanges_Live` in rest-1, with expected mock
setting `2` but an empty value. Config source is unchanged in this
batch. Containing-head offline race proof `source-0ou4e1ru` passed 20
repetitions; this neither clears failed CI nor proves the cause. That
failed run has been handed to Delivery for independent assessment. Fresh
exact-head CI and independent review are required for this correction.
Provenance, whitespace, accepted ancestry and aggregate browser-receipt
coverage pass; existing full source proofs were reused where final
source is identical.
The old head cannot land independently because of its deterministic E2E
fixture defect, so updating it with the already-committed correction is
appropriate rather than repeatedly advancing a healthy checking
proposal. No release, OTA, installed acceptance or complete reporter
resolution is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
</details>
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
GHSA-q2hr-2g5m-vwhr in brace-expansion (below 1.1.21, and 4.0.0 to
5.0.11) fails the required frontend dependency audit on every PR. This
moves the locked copies to 1.1.21 and 5.0.12, and DOMPurify from 3.4.15
to 3.4.16 for GHSA-p98j-92pf-mc4p. Lockfile only, with the dependency
security floors and installability contract updated to match.
Retain the two-minute production constant and extract the same background runner with an explicit test-only delay argument. Correct the startup non-blocking regression after exact-source proof found its invalid constant assignment.
Contract-Neutral: Extract the unchanged telemetry background runner for deterministic testing; production scheduling, payload and privacy contracts are unchanged.
Change-source: pulse-maintainer
Try both loopback families for IPv6 wildcard listeners without changing explicit or IPv4-only binds. Reserve each family a share of the API deadline, keep all later checks on the responding address, and retry a failed observation once with a fresh bounded budget in the telemetry background runner.
Keep genuine API, UI and asset failures visible and report only a closed timeout category, never transport details. Cover both real listener families, startup recovery, failure and privacy boundaries; synchronise the disclosure and subsystem contract.
Change-source: pulse-maintainer
Use the existing non-suspending query's source-isolation option so an uncached target or range cannot display or cache former-host observations. Forward AbortSignal to the Charts API without changing matching-cache or same-source polling behaviour.
The assigned-base VM regression has six failures, including former-host cache contamination; the final mock-backed PBS browser check covers delayed reads, withdrawal, failure, late response and locked ranges at desktop and phone widths. Update the shared frontend contract with real renderer/cancellation regressions. Installed #1723 acceptance and the separate exact-graph security repair remain unresolved.
Change-source: pulse-maintainer
GHSA-q2hr-2g5m-vwhr (brace-expansion quadratic {a},b} rewrite, below
1.1.21 and 4.0.0-5.0.11) fails the required frontend dependency audit on
every pull request. Move the locked copies to 1.1.21 and 5.0.12, and
DOMPurify from 3.4.15 to 3.4.16 for GHSA-p98j-92pf-mc4p (IN_PLACE
afterSanitize hook XSS). Lockfile only; the dependency security floors
move with it.
Keep the existing signed installer fallback and require nearby Pulse helper ownership for every install and rollback example, including authored bullets. A distant community-scripts warning must not make an unsafe command publishable.
Change-source: pulse-maintainer
Use TrueNAS default summaries for reporting queries so SCALE 25.04 can validate its History responses. Preserve raw samples, time windows, CORE live telemetry and existing error boundaries.
Refs #2346
Change-source: pulse-maintainer
The executable audit fixtures pass, but the release-asset check still pins the superseded total-only parser. Preserve the no-threshold and required-workflow checks while asserting positive package/count precedence and a complete typed clean verdict.
Change-source: pulse-maintainer
A missing or zero total must not erase package or severity findings. Require a complete typed zero verdict, retain bounded outage handling for unknown reports, and keep raw metadata out of workflow annotations. Add executable regression coverage and update the installability contract.
Change-source: pulse-maintainer
Batch WebSocket identity decoding from the encoded arrays and retain decoder-owned entry buffers. Keep canonical metadata refresh on every resource clone while replacing membership maps with small scope slices and a single sensitivity-tag scan. Preserve delta identity, scope ordering, policy precedence and clone isolation with reference/fuzz and transition tests.
Adapt the remaining performance work proposed in Pulse PR #2342 for issue #2199. The contributor's first-ID check cannot verify a stale tail; this candidate uses standard JSON decoding for every encoded identity instead. Keep the imported contributor history and branch unchanged.
Co-authored-by: Andy Prosser <andy.prosser@icloud.com>
Based-on: https://github.com/rcourtman/Pulse/pull/2342
Original-Commit: 0cbfa43186
Change-source: pulse-maintainer
Use a private header file and an authenticated read-only summary rather than passing tokens in argv to a public health check. Exercise both header formats, file permissions, preserved content and failing HTTP auth errors with synthetic local fixtures.
Contract-Neutral: API authentication, routes, scopes and CSRF enforcement are unchanged; this updates existing usage guidance and executable documentation checks.
Change-source: pulse-maintainer
Preserve the exact reviewed Product intelligence candidate and its deployment-specific, credential-safe help. No runtime or new product surface changes.
Change-source: pulse-maintainer
Remove the full service-environment dump, which can expose authentication and integration credentials. Explain listener precedence, the separate agent port, systemd reloads, and Docker port recreation without changing the image or deleting persistent data. Keep the shipped guide identical and protect these boundaries with documentation tests.
Contract-Neutral: Guidance and verification for existing port configuration only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Render escaped, allowlisted details from the captured audit response instead of making a second registry call outside the wall-clock watchdog. Preserve every advisory failure and outage policy; executable fixtures pin single-request diagnostics, missing detail, transport-error precedence and annotation-safe output.
Change-source: pulse-maintainer
A fixed ten-entry history made accepted higher thresholds unreachable and silently disabled storm suppression. Bound retained observations to the configured threshold while preserving the existing diagnostic allowance, expiry and one-shot cooldown. Verify normal config updates, callback admission, delivery diagnosis, window expiry, rearming and threshold changes, and register the focused proof owner.
Change-source: pulse-maintainer
PR #2341 Core E2E run 36660586289 fails its desktop and phone PBS target assertions because the old fixture supplies only labels and a non-contract pbs.hostname. The reviewed identity repair requires reported pbs.nodeName or an explicit Agent link. Supply nodeName and retain the expected guest/standalone History targets and wrong-target rejection. No runtime behavior changes.
Contract-Neutral: Integration-fixture machine identity only; existing History assertions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate tip; its PBS identity repair is already integrated, so this merge changes no source content.
Change-source: pulse-maintainer
Pulse PR #2341 run 36658394047 failed the locked Prettier check for docsLinks.test.ts. Format that test without changing its assertions or product behavior, preserving every reviewed commit.
Contract-Neutral: Test-only locked Prettier formatting; no runtime or contract delta.
Change-source: pulse-maintainer
Keep the existing guest deduplication and refresh-omission assertions, supplying a reported node name or unchanged backend Agent link instead of the obsolete endpoint-name guess. Runtime and its parent-bound browser proof are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its focused proof while retaining the current canonical frontier.
Change-source: pulse-maintainer
Reject editable labels and endpoint token guesses, preserve current backend links and fresh exact reported machine names, and revoke ambiguous retention. Isolate each reconciled PBS row from reusable service/Agent DTOs so a join cannot corrupt its later service target. Desktop and phone browser proof covers three PBS services, nine Agents and present colliding guests after link withdrawal.
Contract-Neutral: No API, schema, route or canonical ownership delta; PBS presentation requires corroborated machine identity and isolates reconciled rows from source snapshots.
Change-source: pulse-maintainer
The agent prefers its saved identity before deriving one from the OS. The old live machine-ID deletion recipe could disrupt unrelated services while leaving a Pulse collision unchanged. Explain managed overrides, precedence, private evidence and distinct-host verification in both shipped guides; cover the safe path with documentation and real-browser checks.
Contract-Neutral: Guidance and verification for existing agent identity options only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Add adverse History and host-disk fixtures for editable labels, endpoint guesses and a present guest after backend link withdrawal. The following repair completes this regression-first candidate.
Change-source: pulse-maintainer
Compose the retained PBS identity repair with current reviewed source without rewriting its history. The continuation requires terminal exact-source race validation before this candidate is complete.
Change-source: pulse-maintainer
Preserve both exact Product intelligence commits. Replace the obsolete recovery-token recipe with the existing deployment-specific reset path and client-bound recovery facts, and guide users to bounded sanitized evidence with privacy review rather than dangerous retries.
Change-source: pulse-maintainer
Preserve the exact Web candidate and its parent-bound browser receipt. This bounded maintenance fix drops a retained host target when the backend link changes or disappears; it does not establish full PBS History or installed relief.
Change-source: pulse-maintainer
## What changed and why
Docker update rows now remain pending until the governed action has a
recorded outcome, and reopen the same action with GET-only receipt
review instead of inferring success from a cleared registry badge,
elapsed time or a legacy command. This addresses the uncertain update
state reported in #1891 without blindly retrying an operation.
PBS host association now accepts a unique, fresh running PVE guest at
the PBS endpoint IP and its linked Agent as corroboration.
Operator-chosen connection labels no longer count as Agent identity,
preventing another server's History or SMART disks from being attached
by a same-name collision. This is a bounded source repair for the #1723
topology; it does not establish VirtualBox coverage or installed
acceptance.
## Included source
Pulse main range
`ad9c2d9d3e03b76cb88dad1d56065a262d7c948e..e726ccee9feae16206e173f18aa3dd592ea31e29`.
- Web candidate `dcb9399cecc1ece8e366305afc9084a979b7e7a0`, integrated
as `3ab4183d8225f2e27d869b4f1adf4f1778d99fb5`.
- Core guest-correlation candidate
`43634935976f4b184c87e333b21b1bf201bd4958`, integrated as
`c3e8b6dd6dff36b5396ba2eb147d4e58d23001a6`.
- Core identity correction `2ad36fe4d17e802434bad1af8583418cf3f2e0ca`.
- Additive upstream merge `e726ccee9feae16206e173f18aa3dd592ea31e29`
preserves all reviewed identities and incorporates published #2338; it
changes ancestry, not the reviewed tip's tree.
## Validation
- Web committed-source offline VM receipt `source-hffp4sc_`: exact-lock
offline install, 1,195 test files / 21,504 tests, lint, type-check and
production build passed (one file / three tests skipped).
- Mock-backed production-component browser proof: Chromium desktop 1365
and phone 390, pending/review/completed states, GET-only reads, no page
errors or horizontal overflow; six screenshots inspected by the source
owner. Frontend source is unchanged since that proof.
- Core committed-source offline VM receipt `source-m6uckql7` at
`2ad36fe4d1`: full unifiedresources suite passed in 49.309s, with
label-collision and disk-membership regressions. Available Go 1.26.7 was
used; the repository requests 1.26.8. Final proposed tree equals that
tested source tree.
- Gate checks passed: per-commit completion guards, final-range browser
receipt guard, Pulse-scoped contract and registry audits, provenance and
whitespace checks.
Exact-head GitHub checks and independent source review remain required.
These source/browser proofs do not resolve the reporter's old action
receipt, establish installed PBS behaviour, or approve a release. The
separate Backups frontend identity fallback remains with its source
owner.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Direct PBS host correlation could lend Agent History and SMART ownership through loopback, Docker-local or stale address evidence, and a stale Agent could block its fresh replacement. Reuse the provider address filter and the five-minute observation boundary, preserve IPv6 URL hosts, and cover unsafe evidence, private management controls, link replacement and the three-PBS/nine-Agent topology.
Change-source: pulse-maintainer
Resolve Tailwind's relative config from the frontend module before starting Vite, as the existing Docs fixture runner does. Keep the initial overflow failure in the lane receipts and expose the privacy-review step in the phone screenshot.
Contract-Neutral: Browser verification harness only; no product, API, schema or runtime change.
Change-source: pulse-maintainer
Remove the obsolete inline recovery-token curl recipe: recovery sessions are client-bound, so it neither unlocks a separate browser nor needs a credential copied into command history. Point to deployment-specific bootstrap recovery and give symptom-specific, reviewed and sanitized incident reporting steps without requiring dangerous repeats.
Contract-Neutral: Documentation and verification only; clarifies existing browser-bound recovery and sanitized diagnostics without changing authentication, API, schema or runtime behaviour.
Change-source: pulse-maintainer
Retain the Agent target only while the corroborated PBS link remains unchanged. Cover three concurrent PBS guests and fail closed when that link disappears during a host-row refresh gap.
Contract-Neutral: No canonical API or schema delta; this only invalidates a stale frontend correlation when its backend evidence is withdrawn.
Change-source: pulse-maintainer
## What changed
A successful Proxmox Backup Server node-status poll now records observed
CPU and memory into that server's existing service History series.
Failed polls do not fabricate samples. The recovery regression test
checks the changed observed value within the store's second-resolution
bucket.
## Why
Pulse #1723 reports Backup Server drawers stuck at “Collecting History”
on the published RC even while current CPU and memory values appear. The
service target previously received no node-status samples. This source
fix addresses that gap; it does not establish the reporter's installed
result or resolve separate Agent association and disk/network/I/O
history questions.
## Source in this proposal
Reviewed candidate
`5e57a077801e044331965a6926f3cfe2259cba3c..463482f67d15ee27d353625fc06684ae9848ae88`
on main, plus additive merge `ec13932c963494acf77feb17898d95f557813b8a`
of upstream `fef914d5da2e6352ea59f74fae96750574119a5c`. No accepted
commit was rewritten. The newer PBS/PVE Agent association candidate is
not included and remains for separate review.
## Validation and limits
The lane's exact-source offline focused proof `source-b2f8_pk0` passed
three PBS polling/history tests, including persistence and failed-poll
recovery. Combined-head exact-source offline race proof
`source-zja4vzo0` passed focused monitoring/PBS History and incident
tests at `ec13932c963494acf77feb17898d95f557813b8a`. `git diff --check`
and publication provenance passed. This is source validation, not
installed acceptance, release qualification, or a claim that the
published RC contains the fix. Required exact-head CI and independent
review remain before merge.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
A user-chosen PBS label could attach an unrelated Agent before the exact guest-IP/Agent link was evaluated, putting host History and SMART ownership on the wrong server. Use reported node and endpoint evidence instead, and cover both the collision and label-only cases.
Change-source: pulse-maintainer
When a PBS API token cannot report nodeName and the in-guest Agent omits interface addresses, use a unique running PVE VM at the exact PBS endpoint IP plus its state-owned Agent link. Reject stale or ambiguous observations instead of guessing from display names. This restores the source-native host target for corroborated PBS VMs while preserving the separate PBS service target.
Change-source: pulse-maintainer
rcourtman