Age-based housekeeping deleted continuing conditions when automatic acknowledgement was disabled. Require last-observation inactivity as well as occurrence age, retain legacy timestamp fallback and inactive cleanup, and document the unchanged acknowledgement/recovery boundaries. Regression exercises cached, absent and failed Docker registry reports, callback/history identity and actual checkpoint restart.
Change-source: pulse-maintainer
## Changes and why
- Bound asynchronous active-alert checkpoints to one worker and one
requested follow-up during a burst. Current-state snapshots, immediate
lifecycle durability, failure recovery and the final shutdown save
remain intact. A blocked-writer fixture reproduced 512 workers for 512
requests before the repair; this removes that amplification without
claiming to resolve the installed CPU/write symptoms in #1966, #2112 or
#2113.
- Correct both ZFS help copies after discussion #2354 exposed a promise
of discovering every local pool. Explain the configured-Proxmox-storage
boundary, the host agent's mounted capacity view and the separate
unregistered-pool health-alert gap. The read-only guidance does not ask
users to alter their storage configuration.
- Permit a bounded, exact-source release-path watchdog check on demand,
retaining the scheduled no-publication/no-mutation envelope, rejecting
candidate/exception overrides and skipping candidate builds. This
addresses missing timely coverage after a prior watchdog ordering
failure; it does not publish a release.
## Included source
Complete range
`cfaad6b46d6c47ef9aed400cb57e1c5b54bd02f2..6fa78a01f813f373fda64922533f060963ff32fc`:
- Alert checkpoint candidate `5dea312f2b17323a25e616b81324855b4ca939da`.
- ZFS guidance candidate `cf8a3f9a6cca47509efc10df62ba24bb00f9aa09`.
- Watchdog candidate `40037f003581f8f553bb41de313c927256a0d3c2` through
`2043f3dd767d3f0970e4008a4d9067c5f7327c32`.
The additive integrations preserve every reviewed commit and include
upstream History publication `cfaad6b46d6c47ef9aed400cb57e1c5b54bd02f2`
without rewriting it.
## Validation and limits
- `source-gdu65a_x`: 25 focused race repetitions, complete
alerts/config/eventlog/reducer/specs race suites and vet pass.
`source-ezs4tqqg` retains the original blocked-worker reproduction.
- `source-_7_yx4oh`: 112 release-control Python tests and selected Go
install checks pass, including actual workflow
admission/source-selection checks.
- `source-y0mu1jos` observes the existing ZFS limits and configured
controls; `source-s2wg_5ix` passes 26 docs/card tests.
- Publication provenance and complete-range whitespace checks pass.
Integrated executable/test files match the validated candidates; the
only later watchdog contract-doc change is an already-published updater
section. The two help copies match.
Sufficient candidate evidence is reused, not rerun merely for batching.
Exact-head CI and independent review still govern landing. These checks
do not establish installed alert/write recovery, complete PBS
acceptance, restored operational watchdog coverage or release
qualification.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve exact reviewed candidate d38e2ec61a and retain both History and update-progress browser evidence. Only the shared receipt file needed resolution; frontend runtime content matches the candidate receipt.
Change-source: pulse-maintainer
## What changed and why
History drawers now keep correctly attributed, previously loaded charts
visible when a refresh fails, show a clear warning, and offer a scoped
keyboard-safe retry. A background poll that supersedes a manual refresh
also settles its loading state, so the drawer does not remain stuck.
Inspection and regression-first tests found these recovery defects in
the existing History renderer. This improves the PBS/host History
experience associated with #1723 without borrowing points from another
host or time range, exposing private diagnostics, or bypassing license
limits. It does not claim complete resolution of the reported
PBS/VirtualBox estate outcomes.
## Included candidate and complete range
Starting reviewed range:
`f3c92a242ebf9b7062dfc9f6ff711a56639f536c..a81c5227a517fcbd4cccd1e3030a64b7cd864e2f`.
Final proposal range against current upstream:
`2dd77df0247bb54302da131d4e46256a7d4bb6ce..d80b49835cb8becf3cd151d8a4bad0869c6949cd`:
- Reviewed Web candidate `20260930T210243Z-web-product`, source
`744160fa0ebf599ebc36e82c9f12178947a533e6`.
- Additive integration `0d3e5a801ab8fd1c1d224ef561cbf99e169c589f` and
upstream integration `a81c5227a517fcbd4cccd1e3030a64b7cd864e2f`.
During publication, upstream advanced to
`2dd77df0247bb54302da131d4e46256a7d4bb6ce` (already-landed
update-progress repair #2347). The ancestry check refused the stale head
before push. Additive merge `d80b49835cb8becf3cd151d8a4bad0869c6949cd`
incorporates that exact upstream commit; its sole conflict was the
browser-receipt record. Both original parent-bound proofs are retained
without inventing new browser execution. The upstream update-progress
changes are already on main, not new product scope selected by this
proposal. All accepted identities and ancestry are preserved.
## Validation
The reviewed source's recorded offline proof `source-47j38yd_` passed
install, type-check, lint, 21,553 tests (three existing skips), embedded
build and bundle budgets. `source-iql94lcs` passed
formatting/header/duplication checks. Regression-first proofs recorded
seven initial failures and the superseding-read loading defect.
The production renderer/query browser proof covered desktop and phone
widths in light/dark themes with 12 screenshots recorded as inspected:
failed polling, held/repeated activation, recovery/focus, overlapping
reads, target withdrawal and license locks. Parent-bound content
comparisons and the final range browser guard confirm those proved
source files are unchanged. Earlier broader fixture/browser execution
failures remain limits, not successful installed evidence.
Because upstream changed the dependency lock after the reviewed frontend
proof, publication ran an additional focused combined-source offline
proof, `source-hfmynznu`, at exact head
`a81c5227a517fcbd4cccd1e3030a64b7cd864e2f`: locked install, type-check,
39 History refresh/shared-query/dependency-security tests, embedded
build and bundle budgets all pass. Earlier upstream Build and Test run
`36786204046` passed; incoming #2347 also had passing
frontend/backend/security/governance/E2E/benchmark checks (provider-pair
Docker acceptance was skipped). Final merged-head proof
`source-gp1tz3hx` passed locked install, type-check and all 60 tests
across five History/query/security/update-progress/readiness files at
`d80b49835cb8becf3cd151d8a4bad0869c6949cd`. Provenance, canonical
completion, range browser verification and whitespace checks pass.
## Landing and release limits
Independent review and exact-head functional/security CI govern landing.
Source/browser fixtures are not installed PBS/VirtualBox acceptance or
real upgrade/rollback through Tailscale Serve. This later recovery
improvement is not an additional prerequisite for the instructed v6.4.6
repair quartet, does not replace an RC, and does not publish or qualify
a release. Existing owners retain those installed and release outcomes.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Coalesce full active-alert snapshots into one worker and one requested follow-up instead of queueing a goroutine per mutation. Preserve immediate lifecycle durability, fresh snapshots, failure recovery and the final shutdown save; reproduce the old burst amplification and validate the new admission and persistence boundaries.
Change-source: pulse-maintainer
Expose existing stored history through labelled native observation controls and dated accessible descriptions. Keep missing samples distinct from live or neighbouring readings, preserve the selected timestamp through refreshes and reset selection at resource/range boundaries. Cover input state and real native browser interaction without changing collection or licence gates.
Change-source: pulse-maintainer
Explain the configured-storage boundary, the existing agent capacity path and the separate pool-health gap. Keep data-only pools unchanged and put storage membership ahead of permission changes in troubleshooting.
Change-source: pulse-maintainer
Preserve accepted History recovery and current upstream ancestry after the publication boundary detected an upstream advance. Resolve the browser receipt collision by retaining both original parent-bound records without claiming new browser execution.
Change-source: pulse-maintainer
Updating through Tailscale Serve left the modal stuck on "Downloading
update... 10%" while the update finished in the background. The SSE
endpoint now sends status on connect, flushes each event, heartbeats
every 15s and disables proxy buffering. The modal falls back to polling
when the stream goes quiet, only enters the restart phase on real
restart evidence, and never auto-reloads on unconfirmed completion
without a pre-update version baseline. Planned for v6.4.6.
Replace two stale schema assertions with explicit watchdog omission and ordinary candidate rollback requirements. The actual workflow admission/source-selection shell tests preserve the fail-closed distinction.
Contract-Neutral: Tests and explanatory comments reflect the already recorded watchdog admission contract; no further runtime contract change.
Change-source: pulse-maintainer
Updating to v6.4.5-rc.5 and then v6.4.5 left the progress modal on
"Downloading update... 10%" even though the update finished in the
background. The status stream could go silent behind a proxy (Tailscale
Serve, nginx buffering) and the modal only advanced on stream events.
Backend: the update SSE endpoint now sends the current status on connect,
writes events through one ordered writer with an explicit flush, sends a
15s heartbeat and sets X-Accel-Buffering: no.
Frontend: a silence watchdog falls back to status polling, the restart
phase is entered only on real restart evidence (restarting status, the
server going away, or a version change) rather than a single failed poll,
and the page never auto-reloads on unconfirmed completion without a
pre-update version baseline to compare against.
## Current combined outcome
Keep PBS History attached only to its corroborated host and active
range; make startup health checks work with bounded IPv4/IPv6 fallback;
restore supported TrueNAS SCALE reporting queries; honor configured
alert storm thresholds; and make troubleshooting and server update
guidance safe to follow. Snapshot/metadata maintenance also reduces
allocations without trusting identity hints, addressing the performance
evidence in #2199 and contributor PR #2342.
The prior proposal head `5cc1f2f7b06b6b6d98f08ed177e8326beea407e1`
cannot land independently: completed Build and Test run `36672563104`
fails its frontend dependency audit on high-severity brace-expansion
advisories. This is not a retryable outage. Current reviewed source
already additively incorporates published #2349
(`8d5969fb3b27422f7d9e5ef55fd4ce09af5b25a6`), including brace-expansion
1.1.21/5.0.12 and DOMPurify 3.4.16. Updating the blocked proposal once
with this coherent reviewed range repairs that source defect; this is
not repeated advancement of a healthy checking head.
## Current source range and newly included candidates
Complete unpublished main range
`8d5969fb3b27422f7d9e5ef55fd4ce09af5b25a6..66ec68c813cacf6c1a0f98cfb5f6da494584c9ac`.
The already proposed PBS/guidance range below remains included
unchanged. Newly included reviewed candidates:
- `ffc44a0f8c02`: honor configured flapping thresholds above ten,
retaining expiry/cooldown semantics.
- `173290127a3a`, `6ef79688a5d1`, `18f519e3496b`: bounded captured audit
diagnostics and fail-closed positive-advisory precedence, with
release-asset guard reconciliation. These diagnostic changes alone do
not fix advisories.
- `9bc6f6ed647b`, `45b2fae8dbb5`: safe deployment-specific port
diagnostics and credential-file API examples, with matching shipped
guides.
- `901274ee927d`: safe allocation-bounded snapshot/metadata maintenance;
retains contributor credit and full identity decoding.
- `21a35494aecb335755de773dd099e1364e65b3e0`: supported TrueNAS
reporting summaries for #2346, preserving raw samples, windows and error
boundaries.
- `9d77f09b4f6b`: reject unscoped updater examples in authored release
bodies.
- `4ba830bfd31c0d2df71b4ed426b7b9ad31c8b4ed`: isolate drawer History
across target/range changes and cancel obsolete reads; fixes reproduced
former-host cache contamination in the #1723 investigation.
- `fffaa64e57ef` and additive test repair
`b0a4d2f3928f080dc093b561ba855b84f1443b41`: dual-stack bounded
service-health probes and one bounded background retry; genuine
API/UI/asset failures remain visible.
- `66ec68c813cacf6c1a0f98cfb5f6da494584c9ac`: reviewed additive
incorporation of full upstream #2349. The dependency
manifests/security-floor tests exactly match current published main.
Every accepted commit identity, original author and ancestor is
preserved. No release, tag or deployment is changed by this proposal.
## Combined validation judgment
Sufficient component evidence is reused rather than rerunning it solely
for batching:
- Existing original-range source/race/browser evidence is retained
below.
- TrueNAS: `source-j4j1btoe` / `source-lxeal7q5` affected/full race and
modeled red/green evidence; final `source-8ouijs8p` vet/recovery proof.
Same source tree across the message correction.
- Drawer isolation: `source-z1ldgp56`, offline install/type-check/lint,
21,541 tests, embed build and bundle budgets; `source-2caj4cbp` /
`source-z9xqxyun` formatting/header/duplication checks; real-renderer
mock-backed desktop/phone browser proof, ten recorded inspected
screenshots.
- Health: final `source-txxwlqa3` complete server/telemetry race suites,
40 telemetry-report tests and vet; real frontend embed build/docs
evidence `source-k2aprplj`.
- Published #2349 exact proposal CI: run `36767849067` passed the
complete dependency audit with zero reported vulnerabilities and 21,504
frontend tests (three skipped); its functional/E2E/security checks
passed. The containing main range does not change its manifests or
security-floor tests.
This turn also passed 17 executable audit-wrapper fixtures and all 40
release-body renderer tests under `pulse-maintainer-proof`. The API-auth
documentation tests reached three denied socket operations in that
native fixture environment; those failures are execution-context
evidence, not successful tests. An optional guest-local recheck through
the supported source-proof executor is queued behind occupied proof
slots, not a pass. It is not needed to repeat the existing candidate
evidence; its outcome remains separate from exact-head CI.
Publication provenance, complete-range whitespace and aggregate
parent-bound browser coverage pass. All 22 unpublished non-merge commits
pass canonical-completion checks using only their recorded, accurate
Contract-Neutral reasons where applicable. An unqualified range-wide
canonical invocation reported two cross-scope requirements; the required
per-commit checks and parent/content-bound browser range check pass, not
a blanket exemption.
The current exact frontend snapshot is unavailable locally
(`0bd5f30a…`); no final combined offline npm build/audit is claimed. The
independently tested upstream graph and reviewed component proofs
support proposing this composition, not merging without its fresh
exact-head checks. Actual local VM Go remains 1.26.7 rather than the
declared 1.26.8 floor. Fresh exact-head CI and independent review must
resolve the complete proposal before landing. Prior failed checks remain
evidence, not green checks or release qualification.
These source/mock proofs do not establish installed
PBS/VirtualBox/disk/network/I/O recovery, TrueNAS appliance acceptance,
Tailscale Serve upgrade/rollback, or release readiness. Eligible patch
placement remains separate; this main batch does not replace a published
RC or expand v6.4.6 scope.
<details>
<summary>Retained earlier proposal scope and validation
history</summary>
## What changed and why
PBS host History and SMART ownership now require corroborated machine
identity: reject stale Agent observations and host-local addresses,
preserve IPv6 endpoints, and withdraw retained History when the backend
link disappears. The frontend also rejects editable labels and
endpoint-token guesses, permits fresh exact reported machine names or
explicit backend Agent links, and isolates row snapshots so
reconciliation cannot corrupt later withdrawal. This addresses
wrong-host risks found investigating #1723; it does not claim installed
relief for every PBS History symptom or the reporter's VirtualBox
topology.
Troubleshooting now explains browser-bound recovery and bounded
sanitized incident reporting rather than ineffective credential-copying
or risky repeats. Clone guidance follows saved Agent identities and
persistent overrides instead of deleting the operating system's machine
ID. Source and in-app guides match.
## Reviewed source included
Complete main range
`fa1d9eb36d4c2f55e648f10cfe7400983551b877..5cc1f2f7b06b6b6d98f08ed177e8326beea407e1`:
- Retained-History withdrawal
`62fb6cdb12dd3db90d2be598df1efc0210be37f1`, integrated by
`7a646013062d667f7c053def80aab405c488d3e8`.
- Recovery/reporting guidance
`d707df9577ddbf9b4b7ba7c1c055131318bd66e1`, harness correction
`5fe29c558d146664320ff8beda49f4a36613737b`, integrated by
`78434304f1afbac5b58b17ce885424be17b4dff7`.
- Backend identity safety `a0081d676b450f58d8f3593918334152df0de4d3`,
composed at `3ea52c25b565d614304b23350012ce942f828e6b`.
- Clone guidance `25a2e56d5ef62b2674a4deba655a121ecb7c8761`, integrated
by `6e81f06e095a009233067a539ef7cc47502583d5`.
- Frontend identity boundaries: regression fixtures
`6ade01cbd4d02cd25b691f9ff5919206cceae764`, repair/browser receipt
`3df86570396a3e7f600abf8a3c7c8d3ea957106c`, retained-fixture correction
`be18333570be6ba428c690942d7b4def64d4a678`, integrated by
`105e59bffb9b476ee3c9606cde95e3412e1664ac`.
- Additive formatting-only correction
`17f2d7a45d93ebd53347096edf46e44c8a0ef6fc`. The earlier #2341 head
failed Frontend formatting in completed run 36658394047 on
docsLinks.test.ts. A retry would not fix it; this correction preserves
assertions and every accepted commit. The newer reviewed PBS range is
included with the necessary repair rather than advancing an otherwise
independently landable checking head.
## Validation and limits
Recorded source evidence reused:
- `source-3a9ej4nh`: offline frontend install, 21,506 tests, lint,
type-check/build; mock-backed desktop/phone retained-History proof and
inspected screenshots.
- `source-sksnquh_`: full unifiedresources/pkg/pbs race suites and three
polling regressions, exit 0. Final Go source is identical to that
candidate. VM Go 1.26.7 differs from declared 1.26.8, so configured CI
remains necessary.
- Recovery/reporting: 20 documentation tests and 15 real-document
desktop/phone checks. Clone guidance: `source-j3xvikj1` passed 47
documentation tests; `source-8hmpoki1` passed agent
configuration/persistence tests; 21 browser assertions and four
inspected screenshots.
- Final reviewed PBS frontend candidate: `source-_pyutny3` passed 21,530
tests, lint/type-check/build; 24 desktop/phone target/layout checks with
six inspected screenshots. Earlier red fixtures, snapshot-mutation
failure and obsolete positive-fixture failures were retained and
repaired.
At prior proposal head `17f2d7a45d93ebd53347096edf46e44c8a0ef6fc`:
`source-2kpt0am7` passed offline install, full locked formatting check
and 21 docs tests; `source-hcai5s0y` passed both PBS table/drawer files,
48 tests. Provenance, whitespace and aggregate parent-bound browser
coverage passed. Per-commit canonical checks used the reviewed
Contract-Neutral reasons for bounded behavior-only frontend repairs;
backend contracts were updated. Direct host attempts to run existing
browser scripts stopped at denied loopback listeners, produced no visual
proof and are not passes; the recorded confined browser evidence above
remains separate.
Exact-head functional/security CI and independent review govern landing;
advisory results remain evidence, not release approval. These are
source/mock proofs, not installed acceptance or release shipment. The
frozen v6.4.5 RC.5 is not expanded by this main batch.
## Additive integration correction and current CI evidence
The proposal's completed Core E2E run 36660586289 failed all six
desktop/phone PBS History cases in shards 3, 6 and 8. The fixture
supplied only presentation labels and a non-contract `pbs.hostname`,
whereas the reviewed identity repair deliberately requires a reported
`pbs.nodeName` or explicit backend Agent link. Commit
`5cc1f2f7b06b6b6d98f08ed177e8326beea407e1` supplies the reported node
name, retaining the expected guest/standalone History targets and
wrong-target rejection. Runtime source is unchanged. No-content merge
`80e654381b94e1a61ef6727cbc69b54d0fa7eb10` preserves Delivery's reviewed
race-proof candidate. Every original reviewed identity and ancestry is
retained.
Recorded confined Chromium/WebKit desktop/phone fixture proof reproduces
the old wrong targets and passes the corrected fixture. The separate
Build and Test run 36660586299 failed only
`TestConfigWatcher_WatchForChanges_Live` in rest-1, with expected mock
setting `2` but an empty value. Config source is unchanged in this
batch. Containing-head offline race proof `source-0ou4e1ru` passed 20
repetitions; this neither clears failed CI nor proves the cause. That
failed run has been handed to Delivery for independent assessment. Fresh
exact-head CI and independent review are required for this correction.
Provenance, whitespace, accepted ancestry and aggregate browser-receipt
coverage pass; existing full source proofs were reused where final
source is identical.
The old head cannot land independently because of its deterministic E2E
fixture defect, so updating it with the already-committed correction is
appropriate rather than repeatedly advancing a healthy checking
proposal. No release, OTA, installed acceptance or complete reporter
resolution is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
</details>
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain matching History through failed refreshes and settle superseding reads. Preserve the exact reviewed frontend commit and its browser receipts.
Change-source: pulse-maintainer
Retain the scheduled governed-source selection and no-mutation demo verdict in a separate fixed dispatch mode. Check its control SHA and candidate-free envelope before checkout, preserve ordinary rehearsal rollback and exact event-source guards, and skip candidate builds.
Change-source: pulse-maintainer
Retain only matching stored observations with an explicit refresh-failure warning and a keyboard-safe scoped retry. Settle latest-read loading when polling overtakes a foreground refresh. Preserve target isolation, licence gates and diagnostic containment with regressions and exact-content browser receipts.
Change-source: pulse-maintainer
GHSA-q2hr-2g5m-vwhr in brace-expansion (below 1.1.21, and 4.0.0 to
5.0.11) fails the required frontend dependency audit on every PR. This
moves the locked copies to 1.1.21 and 5.0.12, and DOMPurify from 3.4.15
to 3.4.16 for GHSA-p98j-92pf-mc4p. Lockfile only, with the dependency
security floors and installability contract updated to match.
Retain the two-minute production constant and extract the same background runner with an explicit test-only delay argument. Correct the startup non-blocking regression after exact-source proof found its invalid constant assignment.
Contract-Neutral: Extract the unchanged telemetry background runner for deterministic testing; production scheduling, payload and privacy contracts are unchanged.
Change-source: pulse-maintainer
Try both loopback families for IPv6 wildcard listeners without changing explicit or IPv4-only binds. Reserve each family a share of the API deadline, keep all later checks on the responding address, and retry a failed observation once with a fresh bounded budget in the telemetry background runner.
Keep genuine API, UI and asset failures visible and report only a closed timeout category, never transport details. Cover both real listener families, startup recovery, failure and privacy boundaries; synchronise the disclosure and subsystem contract.
Change-source: pulse-maintainer
Use the existing non-suspending query's source-isolation option so an uncached target or range cannot display or cache former-host observations. Forward AbortSignal to the Charts API without changing matching-cache or same-source polling behaviour.
The assigned-base VM regression has six failures, including former-host cache contamination; the final mock-backed PBS browser check covers delayed reads, withdrawal, failure, late response and locked ranges at desktop and phone widths. Update the shared frontend contract with real renderer/cancellation regressions. Installed #1723 acceptance and the separate exact-graph security repair remain unresolved.
Change-source: pulse-maintainer
GHSA-q2hr-2g5m-vwhr (brace-expansion quadratic {a},b} rewrite, below
1.1.21 and 4.0.0-5.0.11) fails the required frontend dependency audit on
every pull request. Move the locked copies to 1.1.21 and 5.0.12, and
DOMPurify from 3.4.15 to 3.4.16 for GHSA-p98j-92pf-mc4p (IN_PLACE
afterSanitize hook XSS). Lockfile only; the dependency security floors
move with it.
Keep the existing signed installer fallback and require nearby Pulse helper ownership for every install and rollback example, including authored bullets. A distant community-scripts warning must not make an unsafe command publishable.
Change-source: pulse-maintainer
Use TrueNAS default summaries for reporting queries so SCALE 25.04 can validate its History responses. Preserve raw samples, time windows, CORE live telemetry and existing error boundaries.
Refs #2346
Change-source: pulse-maintainer
The executable audit fixtures pass, but the release-asset check still pins the superseded total-only parser. Preserve the no-threshold and required-workflow checks while asserting positive package/count precedence and a complete typed clean verdict.
Change-source: pulse-maintainer
A missing or zero total must not erase package or severity findings. Require a complete typed zero verdict, retain bounded outage handling for unknown reports, and keep raw metadata out of workflow annotations. Add executable regression coverage and update the installability contract.
Change-source: pulse-maintainer
Batch WebSocket identity decoding from the encoded arrays and retain decoder-owned entry buffers. Keep canonical metadata refresh on every resource clone while replacing membership maps with small scope slices and a single sensitivity-tag scan. Preserve delta identity, scope ordering, policy precedence and clone isolation with reference/fuzz and transition tests.
Adapt the remaining performance work proposed in Pulse PR #2342 for issue #2199. The contributor's first-ID check cannot verify a stale tail; this candidate uses standard JSON decoding for every encoded identity instead. Keep the imported contributor history and branch unchanged.
Co-authored-by: Andy Prosser <andy.prosser@icloud.com>
Based-on: https://github.com/rcourtman/Pulse/pull/2342
Original-Commit: 0cbfa43186
Change-source: pulse-maintainer
Use a private header file and an authenticated read-only summary rather than passing tokens in argv to a public health check. Exercise both header formats, file permissions, preserved content and failing HTTP auth errors with synthetic local fixtures.
Contract-Neutral: API authentication, routes, scopes and CSRF enforcement are unchanged; this updates existing usage guidance and executable documentation checks.
Change-source: pulse-maintainer
Preserve the exact reviewed Product intelligence candidate and its deployment-specific, credential-safe help. No runtime or new product surface changes.
Change-source: pulse-maintainer
Remove the full service-environment dump, which can expose authentication and integration credentials. Explain listener precedence, the separate agent port, systemd reloads, and Docker port recreation without changing the image or deleting persistent data. Keep the shipped guide identical and protect these boundaries with documentation tests.
Contract-Neutral: Guidance and verification for existing port configuration only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Render escaped, allowlisted details from the captured audit response instead of making a second registry call outside the wall-clock watchdog. Preserve every advisory failure and outage policy; executable fixtures pin single-request diagnostics, missing detail, transport-error precedence and annotation-safe output.
Change-source: pulse-maintainer
A fixed ten-entry history made accepted higher thresholds unreachable and silently disabled storm suppression. Bound retained observations to the configured threshold while preserving the existing diagnostic allowance, expiry and one-shot cooldown. Verify normal config updates, callback admission, delivery diagnosis, window expiry, rearming and threshold changes, and register the focused proof owner.
Change-source: pulse-maintainer
PR #2341 Core E2E run 36660586289 fails its desktop and phone PBS target assertions because the old fixture supplies only labels and a non-contract pbs.hostname. The reviewed identity repair requires reported pbs.nodeName or an explicit Agent link. Supply nodeName and retain the expected guest/standalone History targets and wrong-target rejection. No runtime behavior changes.
Contract-Neutral: Integration-fixture machine identity only; existing History assertions and runtime contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate tip; its PBS identity repair is already integrated, so this merge changes no source content.
Change-source: pulse-maintainer
Pulse PR #2341 run 36658394047 failed the locked Prettier check for docsLinks.test.ts. Format that test without changing its assertions or product behavior, preserving every reviewed commit.
Contract-Neutral: Test-only locked Prettier formatting; no runtime or contract delta.
Change-source: pulse-maintainer
Keep the existing guest deduplication and refresh-omission assertions, supplying a reported node name or unchanged backend Agent link instead of the obsolete endpoint-name guess. Runtime and its parent-bound browser proof are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its focused proof while retaining the current canonical frontier.
Change-source: pulse-maintainer
pulse-triage[bot]