Removing a Docker host blocks its reports, but the report path only ever
consulted the in-memory block and offered no way for a legitimate
re-enroll to clear it: reinstalling the agent with a newly generated
token kept being rejected until a server restart happened to wipe the
in-memory map, which read as the Docker tab staying missing until the
Pulse server was rebooted. The restart also silently lifted deliberate
blocks, because the persisted entry was never consulted on report.
Docker reports now follow the host-agent rule from #1581: the block
check consults both the in-memory map and the persisted store, and a
token minted after the removal is explicit re-enroll intent that clears
the block from both. A still-running old agent presenting its
pre-removal token stays blocked, including across restarts.
Refs #1728
When the Proxmox node inventory and the unified resource registry both
project the same machine as a system member, the merge paired the most
severe state from one plane with the newest LastSeen from the other. A
lapsed projection, such as an orphaned registry entry left behind by a
remove/re-enroll cycle, could therefore permanently render a member as
Stale beside a heartbeat seconds old, and the cluster rollup inherited
the contradiction onto the parent row.
The plane that has seen the machine more recently now decides liveness.
Severity still decides when neither side carries evidence or the
timestamps tie, so genuinely offline members keep their state.
Refs #1728
Wire outbound alert callbacks before a monitor is published so immediately reconnecting agents cannot create active warnings in the constructor-to-Start gap. Add a pre-Start custom-sensor regression and bind the ordering in monitoring and agent lifecycle contracts.
Change-source: pulse-maintainer
Name every outbound alert-quality field in both operator-facing privacy documents, lock the current schema value in verification, and align the alert-manager adoption test with the telemetry contract.
Change-source: pulse-maintainer
Authenticate global API tokens before cold tenant runtime resolution, lock the cross-org behavior into integration coverage, and refresh schema-14 telemetry browser proof.
Contract-Neutral: Restores bounded cross-org token authorization and records verification without changing the API contract
Change-source: pulse-maintainer
Price Sonnet 5 at its current first-party rate and recognize Fable 5 and Mythos 5 so current models cannot prematurely stop Patrol or make budget enforcement unknown. Refresh the surfaced pricing review date and cover the budget behavior.
Refs #1789
Persist canonical token IDs, scopes, and organization bindings before admitting them to startup or watcher state. Fail configuration load rather than weakening token-only authentication when credential storage cannot be read or migrated.
Contract-Neutral: hardens credential migration failure handling without changing successful API payloads or extension contracts
Commit restart-time token revocation before clearing live authentication or sessions. Restore auth environment files and remove the staged bootstrap credential when token persistence fails, preserving a usable retry path.
Contract-Neutral: hardens development reset failure handling without changing successful API payloads or extension contracts
Restore the complete live token inventory when durable writes fail during legacy regeneration, quick security setup, and container-runtime token preparation. Return an error instead of exposing or claiming an unpersisted credential.
Contract-Neutral: hardens internal failure handling without changing successful API payloads or extension contracts
Cache unchanged inactive container detail between live telemetry cycles so NAS hosts with large historical inventories do not re-inspect every stopped container every 30 seconds. Keep running state live, fail open to fresh inspection when lifecycle evidence is incomplete, and clear daemon-scoped caches on reconnect.
Refs #1729.
Contract-Neutral: Bounds internal daemon call cadence without changing report or operator contracts
Use unique provider-observed node interface addresses to restore automatic
host-agent linking when standalone sites share a short hostname but use
distinct FQDN endpoints. Keep reused addresses ambiguous and fail closed.
Refs #1753
Contract-Neutral: narrows internal agent-to-node identity reconciliation without changing API or extension shapes
Sequentially adding standalone Proxmox estates with the same native node name could lend the first site agent to the second through the short-hostname fallback. Both provider nodes then shared one agent identity and collapsed into one state slot. Require exact endpoint, certificate, or agent-bridged full endpoint evidence before a cross-instance standalone merge; reject and self-heal guessed links that already belong to another node.
Refs #1753
Contract-Neutral: narrows internal Proxmox node/agent identity reconciliation without changing API shapes or extension contracts
Richard Courtman