The executable overflow regression and a bounded Bash PTY probe show canonical terminals truncate long input before the size check. Read a bounded character count with echo held off, drain an invalid line before returning to the calling shell, and restore its modes on every exit. Pin maximum-size preservation, overflow history safety and terminal restoration.
Contract-Neutral: Repair bounded private terminal entry, overflow draining and mode restoration; no issuance, scope, install transport or response-shape delta.
Change-source: pulse-maintainer
Reuse the complete-download and preflight private-token entry boundary for both monitoring modes. Keep issued credentials separate and no-store, use the installer-owned token path in the diagnostic service reference, and reject structural unit injection before minting. Add executable root/sudo, history, transport, failure cleanup and systemd grammar regressions alongside the subsystem contracts.
Change-source: pulse-maintainer
Merge Core candidate cf12c37e63 unchanged onto 22380a3546. Resolve only the shared browser receipt to the candidate receipt; changed frontend source exactly matches its non-merge proof-bearing commit. Preserve newer safe API recipes and sparse History source.
Retained focused configapi, hostagent, mock, monitoring and installtests race suites, affected API cases, frontend suite and type-check, builds and PVE/PBS desktop and phone-emulated browser checks cover the changed behaviour. Broad API timeout and output-limit attempts remain unresolved, not passes. No installed recovery, release qualification, publication or deployment is claimed.
Change-source: pulse-maintainer
Preserve exact Delivery candidate 90c80acb49, including bounded grouped notes, operator safety checks and complete qualification source closure. No product or published release changes.
Change-source: pulse-maintainer
Remove only the extra trailing blank line that rejected the candidate's base-to-head diff. The release prose, validation behaviour and published notes are unchanged.
Contract-Neutral: Fixture whitespace only; no release-note validation, qualification policy or product behaviour changes.
Change-source: pulse-maintainer
Complete the prior sparse-History candidate without changing its reviewed commit identity or renderer bytes. Wrap only the existing empty-window assertion for the locked formatter.
Contract-Neutral: Test assertion formatting only; no runtime, API or canonical boundary changes.
Change-source: pulse-maintainer
Exact-source validation found two unbound compiled packages after composing the retained notes repair with current main. Include both in the source manifest and report the whole dependency closure without weakening the check.
Change-source: pulse-maintainer
The full API race run timed out while cloning the entire mock estate and rebuilding every persona for each chart series. Cache one immutable sampler against the canonical graph data version under its publication lock. Preserve values, current revisions, disabled-mode fallback and isolation from private/global persona updates. Pin zero-allocation warm acquisition, reference equivalence and concurrent snapshot binding; compare both paths with the same thousand-VM sample.
Contract-Neutral: Avoid repeated canonical graph cloning and persona reconstruction without changing metric formulas, identity, graph freshness, retention, endpoints or permissions.
Change-source: pulse-maintainer
Require the exact shared artifact command, stdin PVE authorization and correctly delimited normalized URL instead of legacy pipe/header forms or an over-broad path substring. These corrections retain installer, ACL and transport assertions; no runtime change.
Change-source: pulse-maintainer
Use the existing HTTP routes with private header files, JSON on stdin and curl defaults disabled. Separate plan, decision and execution, explain their real permissions and retain uncertain-execution safety. Extend the executable guide tests to cover all seven recipes, both header formats, auth failures and trace-enabled local curl settings.
Contract-Neutral: API routes, authentication, scopes, action authority and runtime execution are unchanged; only existing guidance and its executable documentation checks change.
Change-source: pulse-maintainer
Compose the exact earlier source repair on the current reviewed base for final validation. No published release or source routing is changed.
Change-source: pulse-maintainer
Render lone stored observations at their actual time instead of blank collecting panels. Label live legend fallbacks as current and describe empty windows without claiming collection is active. Preserve source/range isolation and failed-refresh recovery.
Add sparse-observation regressions and scoped browser evidence, and align both canonical contracts with the shared renderer's verification boundary.
Change-source: pulse-maintainer
Retain configured-origin and proxy-spoofing coverage while requiring separate credentials, identical tokenless script URLs and private-input renderers. This aligns remaining routed setup assertions with the credential-safe response; no runtime change.
Change-source: pulse-maintainer
Replace the last pre-repair credentialed-command and hidden-token copy assertions with the implemented separate-input contract. All other architecture and runtime assertions remain; browser-verified frontend content is unchanged.
Change-source: pulse-maintainer
Bind the new compiled notes helper and authored fixture in the rootful source manifest. Repair the visual rollback fixture's missing version and align the internal control-plane page with the active release-reliability target, without changing source routing or published packets.
Change-source: pulse-maintainer
The root parser's legacy no-token alias accepted a new private-file command beside a legacy download URL. Reject every mixed alias, as the existing coherent-transport contract requires. Preserve backup-permission URL bindings. Align older secret-in-command and shared type fixtures, and exercise the actual wrong server installer parser.
Contract-Neutral: Enforce the already-declared coherent bootstrap transports and correct verification fixtures; no API, scope or documented behaviour delta.
Change-source: pulse-maintainer
Use existing Unix and Windows token-file installers, verified HTTPS downloads and inspection before execution across setup, retarget, profile and cleanup examples. Exercise private files, all profile arguments, rejected TLS and failed downloads with synthetic guest-local fixtures.
Contract-Neutral: Documentation and executable documentation tests only; installer behaviour, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
Bind stable notes to version and operator disclosures rather than obsolete prose. Support bounded grouped customer sections for v6.4.6 and later, align generation and rendering, and preserve published history and all qualification gates.
Change-source: pulse-maintainer
## What changed and why
TrueNAS reporting can return only some metrics, no metrics, or genuine
zero readings. Treating a timestamp as evidence that every metric was
present fabricated zero CPU/network/I/O samples; zero available memory
could also disappear. This repair follows the failed CORE 13 retest in
#2077 and reproduced source cases. It tracks presence per metric through
REST/realtime collection, host rows and History, preserves measured
zero, and keeps optional telemetry failures separate from successful
inventory collection. Diagnostics expose bounded categories/status, not
raw provider text.
The pinned-TLS pipeline fixtures exercise partial readings, failures and
recovery through the client, poller, registry, metric writer and History
readback. A test-only notification receipt watchdog now permits the
existing autonomous queue's two polling cycles while still requiring the
actual webhook payload and incident identity; production scheduling and
latency assertions are unchanged.
## Included source
Complete range
`bfe2b39ee0d110bb2a1fdaf582e04a1d72003126..78f2b7c0323fa130da5ef6313804688e51df10f1`.
Core candidate `20261001T020238Z-core-runtime`: runtime
`22ca07ba7171686f1e0904d1d14eb1f08101e134`, fixture corrections
`dc6a66a62cb18a976ce3e4a6e399e629fdeba16f`,
`00ed443d002b697f21874a4fa2758822ca47a448`,
`5c6e826cc49825fb235a3c5b68a798c8e8081be8`, and final
`28cdde7299364678e00abf33e9f531ea0d47b5c5`. Additive integration
`6b23876ec8104965c7842e194e055f3206134d4f` and upstream reconciliation
`78f2b7c0323fa130da5ef6313804688e51df10f1` preserve every reviewed
identity and published ancestor.
## Validation and limits
Recorded baseline `source-0pul7g9o` reproduced ten faulty cases. Final
`source-_4msx_t4` passed five focused race repetitions, complete
TrueNAS/monitoring race suites, vet and affected-library builds. Earlier
fixture and receipt-watchdog failures remain recorded. The composed
head's entire `internal`, `pkg`, `cmd`, `go.mod` and `go.sum` inputs
equal that tested candidate, so sufficient source validation was not
repeated.
Publication provenance, aggregate canonical completion and whitespace
checks pass. Browser guard correctly skips this backend-only range.
Proof used Go 1.26.7 rather than declared 1.26.8; exact-head CI must
establish the declared toolchain and all required results before
landing. These synthetic proofs are not native appliance acceptance, a
diagnosis of the reporter's response shape, complete #2077 resolution,
installed recovery or release qualification. No release placement is
claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate PVE/PBS setup and telemetry credentials from shell source and download URLs. Use silent root/sudo input, private-file handoff, complete downloads and the agent preflight; preserve scope, TLS defaults, single-line paste and coherent rolling-upgrade metadata. Reveal tokens through the existing dialog and discard late issuance after close. Pin executable shell, history, TLS/registration and browser contracts without using real credentials.
Change-source: pulse-maintainer
Preserve the exact Web candidate, parent-bound browser receipt and lint correction. Restore first-touch disclosure while retaining delegated nested controls and keyboard behaviour.
Change-source: pulse-maintainer
Preserve the exact product-intelligence candidate and its tested private-file recipes. Existing PBS setup and troubleshooting now prefer read-only API access and verified TLS.
Change-source: pulse-maintainer
Preserve reviewed TrueNAS telemetry and exact source identities while incorporating the published integration present at batch start.
Change-source: pulse-maintainer
Test caller-native and bound delegated click handlers on separate rows rather than combining JSX event props rejected by the existing duplicate-prop rule. The touch-row runtime and its parent-bound browser receipt are unchanged.
Change-source: pulse-maintainer
Mark clickable table rows as native WebKit touch targets without moving their actions out of Solid's delegated event ordering. Preserve keyboard disclosure, embedded controls, dynamic action removal and explicit native handlers; cover the shared table and data grid, and record production PBS drawer browser proof.
Change-source: pulse-maintainer
## What changed and why
- **Safer TrueNAS troubleshooting.** Existing help put Pulse tokens and
TrueNAS keys in shell arguments and requested unbounded logs. It now
uses private credential files, tests before saving, bounds logs, and
distinguishes hardware capacity from actual CPU/memory usage and
History. This also addresses the misleading capacity-versus-usage
evidence seen in #2077 without claiming to fix that appliance's missing
metrics.
- **Accurate drawer History timelines.** Sparse observations were
stretched independently across each panel, making five minutes look like
a full day. Panels now share the fulfilled, dated time window, preserve
real edge observations, retain matching bounds on failed refresh, and
clear them when the target or range changes. Existing keyboard/touch
inspection and polling limits remain.
- **Honest release-watchdog observations.** After stable publication, a
release branch can retain the stable VERSION while repairs accumulate.
The watchdog now observes that exact source and its preceding stable
reference instead of treating it as a new promotion. Candidate promotion
gates remain unchanged; watchdog artifacts cannot serve as
promotion-readiness evidence.
## Included candidates and complete range
Pulse main:
`e085c2e583fde3af58699ccc9c87f28bcb24715b..920aa2f27c6cb717cca7eb8e2cd3f1379d0fdf73`
(four source commits and four additive integration/reconciliation
commits).
- TrueNAS guidance: `19fa6b1c8dffacd10c0a9dbf025b039844eebbce`,
candidate 20261001T010405Z-product-intelligence.
- Dated History window: `5e886b04d67fbf9edf555d7379db932d28117c3b`,
candidate 20261001T010405Z-web-product.
- Watchdog observation and fixture correction:
`4101c37db548ca85ca8500f433b15a3c45fba2ab..e2fb6b2faee62f6da75b62249da85aced3b71fe6`,
including both commits, candidate 20261001T014538Z-delivery-trust.
The reviewed identities and ancestry are preserved. Reconciliation
`ffb6443862e038d5a050e8a941913f9617f46bd8` already incorporates current
published main; no additional upstream merge or source correction was
needed at this gate.
## Validation and limits
Existing sufficient exact-source evidence is reused:
- TrueNAS: `source-kqbglj0r` passes 23 Python/synthetic-recipe checks;
`source-n7uk8dco` passes 22 docs-link tests. Three Docs-renderer browser
cases pass across Chromium/Firefox desktop and WebKit phone emulation;
six screenshots were recorded as inspected.
- History: regression-first `source-fbz6bjig` records ten failures.
`source-4inm_uzq` passes type-check/lint but retains an AIChat
import-hook timeout; `source-x5tvsgds` passes the complete serial suite
(21,604 tests, three existing skips), embed build, bundle budgets,
formatting, headers and duplication checks without loosening assertions.
Eight production-renderer browser cases pass, with 40 screenshots
recorded as inspected. WebKit whole-row touch opening and screen-reader
speech remain unproved.
- Watchdog: final `source-z97o6_t2` passes 121 Python tests and five Go
regressions. The earlier fixture failure remains recorded; its additive
correction copies the existing checkout ignore policy without weakening
the clean-source assertion.
- Combined tip: provenance and whitespace pass; per-source-commit and
aggregate canonical completion checks pass. The range-aware browser
guard confirms both final changed frontend source blobs are covered by
parent-bound in-range receipts. Final blobs match the reviewed
candidates; intervening upstream changes affect alerts, not these
candidates' source or dependency graphs. A confined native-Git fixture
check passes 74 rehearsal/promotion tests. Its initial incorrect Python
import-path invocation failed before running the suites and is retained
separately.
These are synthetic/offline source and UI checks, not actual TrueNAS/PBS
acceptance, restored hosted watchdog coverage, installed update/rollback
proof or release qualification. Exact-head required CI and independent
review still govern landing. This PR changes no release version or tags
and makes no release-readiness claim. The separate v6.5 proposal #2344
remains unchanged and dependency-audit-blocked under its existing repair
ownership; it is not part of this main batch.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Prefer read-only API access, grant Audit to both PBS identities, keep tokens in private files and verify TLS before sending them. Exercise the documented recipes with synthetic tokens, HTTP failures and certificate rejection controls.
Contract-Neutral: Documentation and synthetic recipe checks only; no runtime API, installer, PBS identity or permission contract changes.
Change-source: pulse-maintainer
The complete race run observed a successful PBS recovery webhook after the functional test watchdog expired. Match the existing notification recovery contract watchdog: two autonomous five-second polls plus callback scheduling, while still requiring the actual HTTP payload and incident identity. No production queue, delivery policy or performance assertion changes.
Contract-Neutral: Test-only functional receipt watchdog for the existing autonomous notification queue; production delivery and API unchanged.
Change-source: pulse-maintainer
Drive each modeled response through a due deadline instead of zeroing it, which legitimately reconstructs the existing future cadence. The production scheduling policy is unchanged.
Contract-Neutral: Test-only due-deadline setup for the telemetry pipeline; production polling and API unchanged.
Change-source: pulse-maintainer
Match the client's existing self-signed pin contract while retaining VerifyConnection. The full TrueNAS suite includes the pin mismatch refusal control; production transport remains unchanged.
Contract-Neutral: Test-only trust configuration for a pinned synthetic TLS endpoint; production transport and API unchanged.
Change-source: pulse-maintainer
Exercise the existing authenticated transport without a plaintext fixture or a verification bypass. Production telemetry and transport behavior are unchanged.
Contract-Neutral: Test-only pinned-TLS fixture for the existing telemetry contract; production transport and API unchanged.
Change-source: pulse-maintainer
Carry per-metric presence through REST and realtime snapshots, canonical host rows and shared History writes. Do not interpret arbitrary numeric object fields as reporting values. Preserve bounded telemetry failure diagnostics without blocking inventory or exposing provider text.
Change-source: pulse-maintainer
## What changed and why
Keep manual and automatic acknowledgements on incidents that are still
active during hourly tracking cleanup. Previously the canonical
acknowledgement could expire after 24 hours even while the incident
continued, causing a short recovery and recurrence to notify again.
Active canonical identities now receive the same protection as legacy
identities and ordinary cleanup. Inactive expiry and explicit
unacknowledgement are unchanged.
This repairs a reproduced defect in existing alert behavior. It is not a
diagnosis of the whole daily alert cycle reported in #2353 or a claim of
installed notification recovery.
The periodic-history persistence test also now uses virtual time with
the real ticker, verifies two exact persisted snapshots before shutdown,
and drains its worker. This replaces a scheduling-sensitive 750 ms poll
without changing production intervals or persistence behavior.
## Included source
Complete range
`7667114fe6dc45e9542d1c7531511964ca6f35ed..1c8f51bf1ff12d559cfbd0a47cf25b879c710fdd`:
- Runtime and regression candidate
`e256e9fc509cf35143b9bcde638d24baa562f1ae`.
- Test-only correction `da685d6d12147d945692df81be13392124bd36cd`.
- Reviewed additive integration
`1c8f51bf1ff12d559cfbd0a47cf25b879c710fdd`.
All reviewed identities and ancestry are preserved. Current upstream
remains the range base.
## Validation and limits
Recorded baseline `source-zk09jitb` reproduces acknowledgement loss and
duplicate dispatch. Final offline proof `source-406x6wbt` passes ten
focused race repetitions, complete alerts/notifications/monitoring race
suites, vet and affected-library builds. Eighty modeled recurrence
cycles cover manual/automatic acknowledgement, JSON/durable checkpoint
restart, zero duplicate dispatches, explicit unacknowledgement and seven
retention controls. The earlier full proof `source-74ad7ohd` failed the
periodic-history polling deadline; the additive test correction is
included, not an unchanged favorable rerun.
The final integrated alert, notification and monitoring source matches
the proved candidate; integration adds only already-published frontend
work outside these paths. Complete-range provenance/whitespace,
per-commit canonical contract guards and browser applicability checks
pass (no frontend delta). Sufficient source evidence was reused rather
than repeated solely for publication. Proof Go was 1.26.7 rather than
declared 1.26.8; required exact-head CI still must validate the declared
toolchain and source before landing.
Independent review and exact-head checks govern merge. Source checks do
not establish installed recovery, complete reporter acceptance or
release qualification. No release, tag or deployment is changed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the exact reviewed documentation candidate and its synthetic recipe evidence. Existing TrueNAS help becomes credential-safe and distinguishes capacity from observed telemetry; no runtime change.
Change-source: pulse-maintainer
The first exact offline suite passed the metadata cases but the clean-tree assertion saw Python import bytecode because the fixture omitted the real .gitignore. Copy that existing policy into the fixture, retaining the source/no-mutation assertion.
Contract-Neutral: Fixture setup now copies the existing repository ignore policy; runtime and deployment contracts are unchanged.
Change-source: pulse-maintainer
The exact no-mutation watchdog failed at published 6.4.5 because the release line has pending repairs but still declares its stable VERSION. Observe that governed source and its preceding stable reference without inventing a new promotion, while keeping candidate resolver gates unchanged and watchdog artifacts out of promotion-readiness records.
Change-source: pulse-maintainer
Use the fulfilled API window and a common observed envelope across metric groups so sparse samples cannot look like a full selected range. Show dated endpoints, retain them with matching failed-refresh data, and clear them on range replacement. Preserve edge observations and reject non-date geometry.
Pin mounted/model regressions, update both affected contracts, and retain production PBS drawer browser proof with its installed-acceptance limits.
Change-source: pulse-maintainer
The complete alerts race suite failed the existing 750 ms filesystem-poll deadline. Use Go virtual time with the real periodic worker and configured interval instead of widening the deadline or rerunning unchanged source. Assert no pre-tick write, exact first- and second-tick history content before shutdown, and drain the worker for cleanup. Runtime saving and production intervals are unchanged.
Contract-Neutral: Use virtual time to strengthen the periodic-history persistence test; no runtime or contract delta.
Change-source: pulse-maintainer
## What changed and why
Make existing drawer History readable with keyboard and touch, and keep
every inspected metric attributed to one actual stored time. Missing
sibling observations remain unavailable rather than borrowing
neighbouring or live values. Selection survives same-source refreshes
and clears at resource/range boundaries; refresh-failure warnings remain
intact.
Keep continuing unacknowledged alerts through retention cleanup.
Age-only cleanup could remove an observed condition and cause another
notification on the next failing poll. Cleanup now also requires
observation inactivity, preserving configured acknowledgement and
affirmative recovery behavior.
These repairs follow reproduced History attribution/accessibility and
alert-retention defects. They improve existing behavior, not new product
scope. They do not establish complete #1723 PBS/VirtualBox acceptance or
diagnose all of #2353's reported daily cycle.
## Included source
Complete range
`6f4e2f25c558d7c69717984c47d06a94c179c4ca..00f82e2afc3cd75035c997e9e245c6e0eeffffa9`:
- History inspection candidate
`d38e2ec61a933b1621895cc71c17ec366a8e99ce`, followed by common-time
correction `02090fe3515e324159225acab0130f4b82e444fb`.
- Alert retention candidate `7cbde2e3bf368e9ee36a34b4fc9dcf87d3089497`.
- Reviewed additive integrations
`0dc858cb366a394b159d2c911c5d85b3020e7881`,
`3e01f02cfca620bd0777db97257d52d63fc32ef7`,
`00f82e2afc3cd75035c997e9e245c6e0eeffffa9`, and upstream incorporation
`cf1e9b4ca3ea0c4277731a366d6fdd0daf8e24a8`.
All reviewed commit identities and ancestry are retained.
## Validation and limits
Recorded source proof `source-fcbetfv8` passes offline installation,
type-check, lint, 21,592 tests (three existing skips), build, bundle
budgets and formatting/header/duplication checks. Its final frontend
content matches the integrated tree. Chromium/Firefox desktop and
Chromium/WebKit phone proofs cover eight width/engine/theme cases with
16 screenshots recorded as inspected. Earlier keyboard/touch proof
`source-0cyn9bst` passed 21,567 tests; its behavior is included in the
later proof. Baseline `source-5g7tw1c0` records eight failures and two
passing controls before the pointer correction.
Alert proof `source-lh_dko1x` passes ten focused race repetitions, full
alerts/notifications/monitoring race suites, vet and affected builds;
baseline `source-rz64y65n` reproduces five callbacks where the corrected
behavior emits one. Final alert source matches the reviewed candidate.
Complete-range provenance, whitespace, canonical contract and
parent-bound browser receipt checks pass. Existing sufficient evidence
was reused, not repeated solely for batching. Proof Go was 1.26.7, not
the declared 1.26.8; matching toolchain preparation remains separate.
Required exact-head CI and independent review still govern landing.
Synthetic source/browser checks are not installed recovery, complete
reporter acceptance or release qualification. No release, tag or
deployment is changed here.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace token and API-key shell arguments with private header and payload files, verify the exact test/save recipes with synthetic credentials, and separate hardware capacity from actual usage and History. Bound local logs and keep sanitized evidence and trusted HTTPS as the troubleshooting path.
Contract-Neutral: Documentation and synthetic recipe checks only; no runtime, API, transport or metric contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]