Two fixes from one support report.
- Link unpinned cluster members to their Proxmox address. Under strict
TLS a member without its own certificate pin is dialed by its bare node
name, and the frontend then guessed a browser address from the node
interfaces, picking a bridge every member shares (a report had the
newest node open 172.16.0.1). The runtime link now uses the address
Proxmox reports for that member, keeping the dial scheme and port.
Dialing is unchanged.
- Keep the system hostname when migrating to the safe profile. Migration
pinned hostname -f, so migrated hosts switched to their FQDN while
root-profile hosts kept the short name. It now pins the system hostname
the agent already reports. An explicit --hostname still wins. Hosts
migrated earlier keep their stored name.
**Prevent configuration-import replays from overwriting newer edits**
Keep one active import per workspace through persistence and runtime
apply. Reject equal committed archive/passphrase requests for ten
minutes, including after lost responses or failed apply, rather than
repeat writes/reloads or report a cached success. Bound process-local
admission without evicting live protection and release uncommitted
failures for corrected retries. Preserve existing authentication, CSRF,
tenant scope and complete legacy archives. Cover the real handler with
response-loss, overlap, newer-edit, router and admission controls.
**Complete synthetic node credentials in import-replay controls**
The real loader correctly requires both token name and value, including
for disabled fixture nodes. Supply the missing synthetic names so the
controls reach runtime apply rather than fail validation. No runtime
behavior or assertion is changed.
**Use a non-empty backup in scoped replay contract controls**
Keep the existing empty-node wipe defence intact. The contract fixture
targets populated tenants, so give its shared archive a fully
authenticated disabled synthetic node rather than expect an empty export
to remove their inventory. Runtime and admission logic are unchanged.
---
Fleet candidate `20261025T081822Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `d2ae24d62d15f79932f8ec8b9452605604d3bc2e` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Under strict TLS a cluster member without its own certificate pin is
dialed by its bare node name, which is what happens to a node that joins
after the others were pinned. Its runtime link was left empty, so the
frontend swapped the bare name for an address guessed from the node's
interfaces and picked a bridge every member shares. A support report
had the newest node's web interface link open 172.16.0.1 instead of
the node's management address.
When neither the member nor the connection has a link override and the
dial URL is a bare label, use the address Proxmox reports for that
member, keeping the dial scheme and port. Dialing is unchanged.
Promote v6.6.0-rc.6 to stable after its 24-hour soak. Only release metadata changes.
Contract-Neutral: Release-only v6.6.0 version, release notes and distribution metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Keep one active import per workspace through persistence and runtime apply. Reject equal committed archive/passphrase requests for ten minutes, including after lost responses or failed apply, rather than repeat writes/reloads or report a cached success. Bound process-local admission without evicting live protection and release uncommitted failures for corrected retries. Preserve existing authentication, CSRF, tenant scope and complete legacy archives. Cover the real handler with response-loss, overlap, newer-edit, router and admission controls.
Change-source: pulse-maintainer
The containing installer suite exhausted a single 30-second Python-class budget after eleven controls and killed the last. Use the existing serial discovery runner with all twelve required methods, retaining each control's 30-second bound and the existing inner shell bounds rather than treating cumulative class time as a safety deadline.
Change-source: pulse-maintainer
Admit only the manual helper's exact new curl envelope in the existing closed transport fixture. Require a signed emitted-helper round trip and reject altered deadlines, retries and TLS flags through the registered installer suite; do not widen the adapter or execute a native journey.
Change-source: pulse-maintainer
Insert the two transfer files into the existing case-insensitive sorted ownership list so the real registry audit accepts the candidate. Membership, path policies, proof requirements and frontend content are unchanged.
Change-source: pulse-maintainer
Keep both bootstrap requests within curl's connection and whole-request deadlines, without ambient retry settings. Arm cleanup before allocation so a second mktemp failure cannot strand the first input. Exercise the emitted helper's signed success, partial download failures, allocation failures and signature rejection without native or production execution.
Change-source: pulse-maintainer
Capture the target before file or CSRF preparation, freeze submitted inputs and use the existing strict non-retrying API path. Keep one operation pending, suppress late downloads/reloads after scope changes or teardown, and require explicit resubmission after token entry.
An unconfirmed import may have applied: retain that warning rather than claiming no work occurred. Browser reset controls show transport-level replay despite one application fetch; server-side single-application protection remains a separate Core assessment.
Change-source: pulse-maintainer
Cold seven-day mock workload charts synthesized 914 values per series
before discarding most of them. Selecting the existing timestamp grid
before synthesis preserves the retained readings, newest point and
complete history window while bounding expensive work. The controlled
native request fell from 8.9 seconds to 1.3 seconds.
The strict chart query gate also exceeded its 90 ms p95 limit. Profiling
showed repeated SQLite row decoding, so raw fleet value reads now carry
the series and timestamp in one integer per observation. This
statement-local transport preserves exact values, negative-epoch
timestamps, tier reconciliation, resource scope and ordering, with
separate columns when a window could overflow. Full metrics-store tests
and targeted monitoring/API regressions pass, including boundary and
prepared-query cache controls. The 90 ms limit remains unchanged.
Organization browser fixtures arrange activated API fixtures before
their first workspace load. Explicit activation and deletion bounds
cover the existing server deadlines. Cleanup owns partial preparation,
attempts every tracked organization and retains failures. Native backend
teardown retains its final log. CI executes all 63 authentication,
organization and backend lifecycle controls before browser fanout.
Browser OS acquisition uses the hosted runner's existing signed Ubuntu
source definition. An unrelated Microsoft feed returning 403 can no
longer stop browser setup. Missing, unreadable or empty Ubuntu
definitions and incomplete Ubuntu index updates still fail. Existing
mirror, TLS, signature and cached archive hash checks remain in force.
Real apt acquisition controls, 17 package cache tests, 11 ownership
tests and normal commit/push checks pass.
The mock target lookup benchmark keeps fixture lifecycle logs out of
Go's result stream. A combined stdout/stderr control reproduces the lost
original observations and parses all ten corrected observations with
identical 4,731 lookups per operation. The benchmark work and comparison
thresholds remain unchanged.
Current-build browser verification covers
`/proxmox/workloads?type=vm&platform=proxmox-pve` at 1440×1000 and
390×844: seven-day trends, row drawer expansion, history range
selection, oldest/latest keyboard inspection and drawer dismissal.
Twelve organization-route cases cover organization settings, access,
sharing and billing across Chromium, mobile Chrome and mobile Safari
with retries disabled.
The [full stable/probation browser
run](https://github.com/rcourtman/Pulse/actions/runs/40160832317)
passed: 530 passed, 392 skipped, zero failures and no retry/flaky
markers in all eight shard logs. Agent registration and organization
provisioning also passed. This evidence covers product code at 64c0a3f9.
The later correction changes only a Go benchmark fixture and its
performance contract.
The [final-head stable E2E
run](https://github.com/rcourtman/Pulse/actions/runs/40163545118) also
passed all eight shards, agent registration and organization
provisioning: 186 passed, 183 skipped, zero failures.
All nine required source checks passed. The [final-head build and test
run](https://github.com/rcourtman/Pulse/actions/runs/40163545117)
passed, including benchmark comparison and strict chart qualification.
The chart result on valid hosted capacity was p50 38.31 ms, p95 51.01 ms
and p99 52.28 ms against the unchanged 90 ms p95 limit. The retained
artifact binds the measured binary to the tested synthetic merge commit.
The preceding runtime qualification also passed at p95 86.55 ms on its
runner. The benchmark comparison found no regression above the existing
10% and p<0.05 threshold. The corrected lookup fixture supplied all ten
observations without parser warnings.
After main advanced with scoped authentication and tenant runtime
changes, a native compatibility proof composed this exact head with
c809d3c93b. API, configuration API and
monitoring regressions passed. All twelve organization browser cases
passed again with retries disabled. A fresh embedded runtime passed the
desktop and phone seven-day chart matrix with both endpoints accessible.
The reviewed combined tree is 2e9a154b1c.
Mock estate lifecycle logs split Go's benchmark name from its iteration count, causing benchstat to discard every sample. Keep the fixture logger quiet across setup, calibration and cleanup, then restore it.
The merged stdout/stderr control loses all ten original observations and accepts all ten corrected observations, with identical 4,731 lookups per operation. Timed work, reported metrics and regression thresholds remain unchanged.
An unrelated Microsoft repository returned 403 during fresh-index admission and stopped a browser shard before any test could run. Load the hosted runner's existing Ubuntu Deb822 definition for browser packages, preserving its mirrors and signature policy. Fail when that definition is missing, unreadable or empty and keep strict index and archive hash checks.
Exercise the real apt parser, exclusion of unrelated feeds, missing definitions and incomplete index failures in private acquisition directories. Register the package helper and policy with their exact verification routes, and update the fixture helper's governance assertion to its scoped proof contract.
Profiling the strict workload chart regression showed repeated SQLite column decoding on every observation. Carry the statement-local series number and timestamp in one integer for bounded raw value reads, while retaining separate columns whenever the requested window could overflow.
Preserve negative-epoch timestamps, current metric bindings, tier reconciliation, extrema readers and exact metric values. The paired cold-service benchmark falls from 63.5 ms to 60.6 ms. Full metrics-store tests and targeted monitoring/API chart regressions pass, including boundary and SQL-cache reuse controls.
Arrange activated organizations before the first workspace load and retain ownership when preparation fails. Give activation and graceful tenant deletion explicit request bounds matching the existing server deadlines, while preserving overall journey deadlines and failure verdicts.
Attempt every owned cleanup and retain the final native backend log before teardown removes its runtime. Controlled fixture and backend lifecycle tests pass, and all twelve organization-route cases pass across Chromium, mobile Chrome and mobile Safari with retries disabled.
The cold seven-day workload chart generated 914 values per series before
discarding most of them. Across the default demo estate the request took
8.9 seconds and exceeded the browser request budget in CI.
Select the existing timestamp grid before evaluating the canonical metric
model. Preserve every retained timestamp and value, full-window coverage,
fresh terminal readings and dense historical seeding. Regression controls
reject the old work bound and verify canonical values across resource types.
Scrolling through a long platform drawer could unmount its owning row
and close the detail being read. REST resource projection also dropped
source provenance, hiding vCenter context and host placement from
owning-snapshot consumers. Diagnostic commands lacked keyboard
scrolling, and dark-theme text and several Patrol control names failed
accessibility checks.
Measure summary rows and inline details together in the shared bounded
window, preserve canonical resource sources, make diagnostic command
blocks focusable, and repair shared contrast and visible control naming.
Browser fixtures await mounted authentication and keep synthetic
provider inventory authoritative. Journey assertions follow current
read-only capabilities, technical disclosures and composed resource
queries. Long settings audits traverse the actual scroll extent; curated
estate checks use native inventory disclosures and search; disk proofs
follow canonical serial-bound shared history; the published
completed-restore-point calendar checks remain intact, including day
selection and filter reset. Update API proofs no longer mount an
unrelated dashboard before each request.
Fresh password login now waits for mounted bootstrap too. The
delayed-bootstrap regression owns and revokes its own token, so it runs
with cookie-only and primary-token fixtures without replacing the
fixture credential. Update API cases share an admitted cookie fixture.
Growth assertions use the current fixed-window header, LXC refresh
assertions use the fixture's canonical identity, and the gated-panel
observer follows actual gate readiness while still detecting visible
unlocked controls. The Docker browser stack explicitly opts into a
bounded development update budget for its shared bridge IP. Production
and login limits remain unchanged.
The remaining recovered failures exposed three test synchronization
defects. Alerts now leaves the whole editor before judging a staged
change and exercises its sibling-focus contract. Protected panel
assertions wait for mounted bootstrap before their existing readiness
timeout. The delayed-token regression uses its own page, avoiding
interception of reads from a departing setup document. CI retains
failed-attempt HTML diagnostics after a successful retry and small JUnit
results for each completed tier, including stable receipts before
probation starts.
Validation includes negative controls for the original drawer,
provenance and password-bootstrap defects, 335 focused frontend tests,
23 authentication-fixture tests, type-checking and a production build.
The cookie-only follow-up matrix passed 39 cases across Chromium, mobile
Chrome and mobile Safari with 18 existing skips. Twelve additional
onboarding cases passed with no retries, and the token-bootstrap matrix
passed 12 cases with cookies alone and 12 with a primary token. Native
Chromium and WebKit checks exercise the gated-panel detector's positive
and negative controls. The earlier remaining-failures matrix passed 31
cases with 10 existing skips, and both disk-history cases passed on
desktop.
Current-build browser verification covers onboarding, accessibility,
VMware context and exclusion boundaries, demo commercial isolation,
persisted Alerts settings, Patrol, availability and background refresh.
Pixel and interaction review covers infrastructure, Agent Doctor,
Patrol, Docker, Kubernetes and vSphere at desktop, tablet and phone
widths in both themes where applicable. Existing timeouts, skips,
mounted-row limits and the 90 ms chart budget remain in place.
The final recovered-failure matrix passed 27 cases with 14 existing
mobile skips using cookies alone, followed by 12 passes with a primary
token, all without retries. The forced desktop table control reproduces
the old focus failure and passes after leaving the editor. The preceding
qualified tree completed all required source checks and the full
stable/probation matrix. Its executed strict chart proof measured p95
61.1 ms against 90 ms with valid capacity. The updated head is being
qualified again before landing.
Governed work: L12 journey verification and the shared L10 windowing
proof. This source change does not publish a release.
A mounted cookie shell can still be waiting for its default workspace
redirect. Admitting that entry races the next deep link in WebKit. Wait
for the destination and retain controlled missing-admission and resource
snapshot coverage, including rejection of the old helper predicate.
Use the shared content-owner geometry audit for infrastructure onboarding
and assert SPA route changes without waiting for the document load event.
**Clarify the target and authority for configuration recovery**
Put installation and organisation checks before backup transfer.
Separate session management authority, API scopes and archive
decryption; disclose excluded membership state and retained token
bindings. Link the checklist from Recovery and API help, with registered
renderer and mirror controls.
Contract-Neutral: Documents existing configuration-transfer scope and
authorization only; no runtime, route, API, permission or recovery
contract changes.
**Match the documentation viewer routing marker in access controls**
The focused run found that data-doc-link is an empty presence marker,
not the string true. Assert presence without weakening the exact
destination checks, and apply the locked formatter output to the long
token-binding assertion.
Contract-Neutral: Registered test expectation and formatting repair
only; rendered documentation and runtime contracts are unchanged.
---
Fleet candidate `20261025T000604Z-web-product` from the `web-product`
lane. Reviewed tip `bc0e53e577d7f8a4e4810af2853a7e3874f2ee84` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Exercise Chromium and WebKit geometry once after browser installation,
before the first shard admits its runtime fixture. Content growth must
complete the new scroll extent and unchanged-extent resets must still fail.
Keep static and forecast occurrences and timing honest when a storage
percentage has missing or contradictory byte counters. Preserve
empty-store recovery and let explicit usage disablement release an alert
without requiring telemetry. Add real-manager controls and give existing
positive-reading fixtures actual capacity.
Contract-Neutral: Refine admission to the existing capacity lifecycle;
no new alert policy, API, schema, collector, transport or subsystem
shape. The existing alerts contract and registered manager controls
document and verify the boundary.
---
Fleet candidate `20261024T233026Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `e2684f689369d77c876376ff0e3d29753a5d539c` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Finish content that reflows after native settings traversal before judging
its width. Measure bottom position and horizontal overflow together, and
keep unchanged-extent scroll resets as failures.
Native Chromium and WebKit controls reproduce the separate-read race,
verify the newly revealed footer, and retain overflow and reset detection.
Put installation and organisation checks before backup transfer. Separate session management authority, API scopes and archive decryption; disclose excluded membership state and retained token bindings. Link the checklist from Recovery and API help, with registered renderer and mirror controls.
Contract-Neutral: Documents existing configuration-transfer scope and authorization only; no runtime, route, API, permission or recovery contract changes.
Change-source: pulse-maintainer
**Explain completed backup counts without losing incomplete evidence**
Distinguish the loaded inventory, completed-point totals, dated activity
and reported-size volume in the shipped Recovery guide. Keep snapshots,
unknown chronology, list filters and guest safety separate. Register
consumer/model checks for the explanation and its existing safety links.
Contract-Neutral: Documents existing Proxmox completion and display
semantics only; no runtime, API, policy, permission, retention or
recovery contract changes.
**Keep the registered backup guidance assertions readable**
Wrap the new long assertions and section traversal for the locked
formatter. The host formatter file is unreadable; exact offline-source
checks remain the validation route.
Contract-Neutral: Test formatting only; no runtime or contract change.
**Match the named backup help entry instead of its position**
CI for PR 3224 selected the new PBS evidence link because it shares the
existing health-help destination. Keep both useful links and assert that
each guide still has one health-help entry with the exact PBS target and
documentation routing attribute.
Contract-Neutral: Registered test selector repair only; guide copy and
rendered behaviour are unchanged from the composed reviewed candidate.
**Validate repeated named health-help links independently**
The full frontend suite found that Troubleshooting already has two
legitimate links with the same health-help label. Require at least one
named entry in each guide and check every matching entry's exact target
and viewer routing instead of imposing an unsupported uniqueness
constraint.
Contract-Neutral: Registered test assertion correction only; no document
or rendered behaviour change.
---
Fleet candidate `20261024T230015Z-web-product` from the `web-product`
lane. Reviewed tip `d677be8d59303884a1a3580829e91d2b07ffbe44` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Keep static and forecast occurrences and timing honest when a storage percentage has missing or contradictory byte counters. Preserve empty-store recovery and let explicit usage disablement release an alert without requiring telemetry. Add real-manager controls and give existing positive-reading fixtures actual capacity.
Contract-Neutral: Refine admission to the existing capacity lifecycle; no new alert policy, API, schema, collector, transport or subsystem shape. The existing alerts contract and registered manager controls document and verify the boundary.
Change-source: pulse-maintainer
Judge consuming panels after their protected document has mounted, and
give the delayed-token regression its own bootstrap page. Leave the whole
Alerts editor before checking for a staged change, including its desktop
focus and card Save contracts. Keep the existing panel timeouts.
Preserve failed-attempt HTML diagnostics when a first retry succeeds and
retain small JUnit results for every completed tier. Upload stable evidence
before probation starts. Integrate the published node disk observation
repair before qualification.
Compose the retained guide candidate on current main before correcting its existing help-link test. No frontend runtime or contract change.
Contract-Neutral: Source composition only; backup guide behaviour is unchanged from the reviewed candidate.
Change-source: pulse-maintainer
Fresh password login must await the mounted workspace before a caller
opens an onboarding route. Own and revoke the bootstrap regression token
without replacing the primary credential, and bootstrap update API tests
once per worker when CI provides cookies alone.
Opt the synthetic shared-IP stack into a finite development update budget
without changing production, authentication or configuration limits.
Observe gated panels through actual gate readiness. Keep the fixed 24h
growth assertion on its native header and select the retained LXC drawer
with the fixture's canonical resource identity. Integrate the published
filesystem-observation and issue-topic repairs before qualification.
Reuse canonical disk observation admission before node alert evaluation. Missing capacity and contradictory readings preserve trusted occurrences and restart activation timing; measured zero, explicit policy and real linked-agent handover keep their semantics.
Contract-Neutral: Reuse existing disk observation and alert lifecycle contracts; no API, schema or ownership policy shape changes.
Change-source: pulse-maintainer
Distinguish the loaded inventory, completed-point totals, dated activity and reported-size volume in the shipped Recovery guide. Keep snapshots, unknown chronology, list filters and guest safety separate. Register consumer/model checks for the explanation and its existing safety links.
Contract-Neutral: Documents existing Proxmox completion and display semantics only; no runtime, API, policy, permission, retention or recovery contract changes.
Change-source: pulse-maintainer
Preserve published absent-disk, completed-backup and accessible-name fixes
alongside the verified drawer and resource-provenance changes.
Follow native inventory disclosures, full settings scroll geometry and
shared disk-history responses so browser proofs exercise the current UI
without weakening row, layout, signature or chart-latency budgets.
Retain the linked summary filesystem identity when its capacity becomes unavailable. Correct synthetic activation and authoritative-removal fixtures to exercise existing rules: disk recovery stays immediate, and an empty report does not establish removal. No delay, collector or policy change.
Contract-Neutral: Apply established identity and observation rules only; public API, canonical projection, thresholds and recovery policy are unchanged.
Change-source: pulse-maintainer
Preserve source provenance in REST-loaded resources so owning-snapshot
consumers retain provider context and host placement. Keep visible control wording in accessible names and retain readable command
and navigation text in both themes. Token fixtures now await mounted browser
bootstrap before handing control to the next journey.
Measure bounded platform table items together with their inline details so
scrolling down a tall drawer cannot unmount the resource being inspected.
Retain regression coverage for bootstrap timing, drawer state and scroll
extent, responsive controls, Patrol and availability, and align navigation
assertions with current read-only capabilities and composed resource queries.
Provider fixtures retain one authoritative inventory across transport updates.
Apply existing canonical disk observation admission to filesystem alert evaluation. Hold incidents across unavailable rows or empty reports, interrupt timed evidence and retain linked-node ownership only for held alerts. Keep measured-zero recovery, policy changes and authoritative removal.
Contract-Neutral: Shares existing disk metric admission and unavailable-observation rules without API, schema, collection or canonical projection changes.
Change-source: pulse-maintainer
**Keep incomplete backup entries out of completed restore totals**
Use the same completion predicate for latest backups, restore-point and
byte totals, PBS coverage and per-day count/volume charts. Keep running
and failed entries visible, with separate counts and honest
inventory-entry labels. Completion is not verification, restore or guest
thaw.
Add registered model and consuming-table regressions for mixed and
incomplete-only inventories, unknown chronology and completion
transitions. Guest operations and server policy are unchanged.
Contract-Neutral: Apply established completion semantics and
inventory-entry wording only; resource transport, identity, persistence
and shared table contracts are unchanged.
**Use supported role-query options in backup completion tests**
The committed-source type check rejected exact on ByRoleOptions. String
role names already match exactly; remove the two unsupported options
without changing assertions or runtime source.
**Verify completed backup totals in production browsers**
Record actual production-asset proof at 1440px Chromium and 320px
WebKit, including count/volume, incomplete-only inventory,
keyboard/touch details and Coverage navigation. Preserve initial driver
failures and targeted follow-up evidence; all fourteen retained captures
were opened natively.
Keep the both-inventories-failed negative assertion matched to the new
completed-point wording, so it still rejects a fabricated zero summary
rather than merely rejecting retired copy.
**Keep visible Infrastructure and Patrol text in accessible action
names**
Name Add shortcuts by their action and group, retain update counts and
affected systems, and let Patrol rows expose their full visible
evidence. Preserve scoped handlers, read-only restrictions and native
selection; keep the WCAG rule unchanged.
Contract-Neutral: Accessible-name correction only at unchanged
agent-lifecycle and API boundaries: no enrollment, update execution, API
payload, authorisation, state or route changes. Frontend and Patrol
contracts and registered consuming tests are updated.
**Keep read-only update indicators inert even with a retained callback**
The new read-only control found that the component relied solely on its
parent to remove Agent Doctor callbacks. Guard both responsive chips
locally. Match the existing registry-routing fixture by its displayed
non-resource-leading title.
Contract-Neutral: Enforce the existing read-only UI invariant only; no
agent lifecycle, API, update execution, payload or permission change.
The frontend contract and registered component and Patrol consuming
tests cover the boundary.
**Align Infrastructure architecture guard with visible Add naming**
The complete frontend suite passed 22,274 tests and failed only this
retired source-string assertion. Keep its route-backed action guard and
require the new visible-action/group accessible name instead.
**Verify accessible Infrastructure and Patrol controls in browsers**
Bind final built producer bytes to desktop Chromium and narrow WebKit
interaction/pixel evidence. Preserve the original backup own-parent
receipt and all adverse fixture, query and manual-review results in the
lane receipts.
---
Fleet candidate `20261024T184532Z-web-product` from the `web-product`
lane. Reviewed tip `5f1c3d36fb69772f1371a5a7bc68368e5866ad93` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep absent host disk readings out of live charts and history**
Share canonical disk admission with host-agent recording and fallback,
preserve measured zero and recorded observations, and check both History
and summary routes.
Contract-Neutral: Restore existing canonical disk-presence semantics; no
new API, authentication, identity, persistence schema or retention
contract.
**Use store precision in host disk preservation regression**
Seed a whole-second observation, as existing metrics-store round-trip
tests do, while retaining the exact timestamp and value assertions.
Production source is unchanged.
---
Fleet candidate `20261024T184532Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `cd4790a9f0a4a409b420113ac4be7f70d108c3d9` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The Highlights guidance used "Resource Overview shows alerts, recent
trends and longer history together" as its example. That is a real
v6.6.0 change, and a test draft of the v6.6.0 notes copied it almost
word for word, so a later release could repeat it as if it were new.
The generator and the release-notes template now describe the shape
instead, the page or feature and then what it now does, and say to
describe only changes in this release. The slogan counterexamples stay,
and the release-assets test pins the new sentence.
Share canonical disk admission with host-agent recording and fallback, preserve measured zero and recorded observations, and check both History and summary routes.
Change-source: pulse-maintainer
Contract-Neutral: Restore existing canonical disk-presence semantics; no new API, authentication, identity, persistence schema or retention contract.
The new read-only control found that the component relied solely on its parent to remove Agent Doctor callbacks. Guard both responsive chips locally. Match the existing registry-routing fixture by its displayed non-resource-leading title.
Contract-Neutral: Enforce the existing read-only UI invariant only; no agent lifecycle, API, update execution, payload or permission change. The frontend contract and registered component and Patrol consuming tests cover the boundary.
Change-source: pulse-maintainer
Name Add shortcuts by their action and group, retain update counts and affected systems, and let Patrol rows expose their full visible evidence. Preserve scoped handlers, read-only restrictions and native selection; keep the WCAG rule unchanged.
Contract-Neutral: Accessible-name correction only at unchanged agent-lifecycle and API boundaries: no enrollment, update execution, API payload, authorisation, state or route changes. Frontend and Patrol contracts and registered consuming tests are updated.
Change-source: pulse-maintainer
Use the same completion predicate for latest backups, restore-point and byte totals, PBS coverage and per-day count/volume charts. Keep running and failed entries visible, with separate counts and honest inventory-entry labels. Completion is not verification, restore or guest thaw.
Add registered model and consuming-table regressions for mixed and incomplete-only inventories, unknown chronology and completion transitions. Guest operations and server policy are unchanged.
Change-source: pulse-maintainer
Contract-Neutral: Apply established completion semantics and inventory-entry wording only; resource transport, identity, persistence and shared table contracts are unchanged.
After a server restart, Pulse showed saved agents offline before they
had a chance to report. Recent enrollments now show “Waiting for first
report” until an accepted report arrives or their existing reporting
lease expires.
The shared read model preserves identity and the historical receipt
without inventing metrics. Live updates carry the same source delivery
state, so a browser left open during an update withdraws its previous
current readings. The expanded drawer keeps stored history available and
shows an informational wait without a fabricated zero-value reading.
Expired agents remain offline, rejected buffered reports cannot end the
wait, removed agents remain absent, and provider errors retain their own
status. Machines, resource details and Settings consume the same state.
Validation: targeted frontend and backend regressions, broader registry
and connection checks, type checking, build, governance checks, and
desktop/mobile browser verification of startup, first report, restart
and expiry.
Refs #2980. This change addresses the startup display and does not
establish the cause of the cluster DNS failure reported there.
An open drawer could retain a current-only reply after its agent entered
the first-report wait. Withdraw live snapshots immediately and refresh on
reporting transitions while preserving real stored observations.
Integrate published main while retaining the webhook acknowledgement and
chart optimizations. Keep guest metric admission under provider ownership.
Refs #2980
Keep database/sql conversion for atypical values and rejection of NULL, malformed and overflowing observations. Compare native and fallback scans against primitive destinations and protect the allocation-free native path.
Contract-Neutral: Retained observations, numeric acceptance and rejection, SQL, sampling, source choice, extrema and access boundaries are unchanged; only application-side numeric assignment avoids per-observation reflection.
Change-source: pulse-maintainer
An expired saved enrollment still has no current telemetry. Keep summary
charts from turning that deadline into zero-valued live samples, while
preserving real stored history. Cover both sides of the reporting lease
and align the remaining pending-label assertions with the shared wording.
Refs #2980
**Keep deleted webhook work bound to its original destination**
Require an enabled saved ID before queued firing or recovery delivery. A
sibling at the same URL cannot release a deleted destination’s retained
payload and credentials. Keep the URL fallback for legacy ID-less work,
preserve admitted snapshots and cancellation history, and prove
restart/operator-retry isolation with real receivers.
**Acknowledge persisted webhook deletion to the destination editor**
Return the explicit success boolean the existing editor requires after
durable and live removal, while retaining the legacy status field. Pin
the response contract so a successful deletion is not displayed as
failed and does not encourage blind retries.
---
Fleet candidate `20261024T150012Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `94a50e75b017901ac31e15e27881aac46abce32c` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Keep retained enrollments unknown while their accepted-report lease is
current, then show offline if no fresh report arrives. Preserve historical
timestamps, removals and report ordering without manufacturing telemetry.
Use the shared first-report state in Machines, resource details and Settings.
Refs #2980
rcourtman