Expose current, last-known and unavailable memory through raw guest and selected unified metrics without renewing QGA evidence during repeated backup deferrals. Preserve independent PVE/linked-agent source times, numeric selection, History and alert policy. Annotate selected metrics as well as raw facets so cross-source fallback cannot inherit another source freshness. Add connected observation, source ownership, clone and wire controls and update the shared subsystem contracts.
Change-source: pulse-maintainer
The first control panicked at an uninitialised synthetic Monitor map before reaching the provenance assertions. Supply the same map as production and retain that failed attempt without claiming a product regression.
Change-source: pulse-maintainer
Exercise normal cache reads, repeated backup deferrals, expired evidence, source-independent PVE memory and resumption through the shared guest builder and real unified broadcast conversion. These are synthetic monitoring controls, not native thaw acceptance.
Change-source: pulse-maintainer
Preserve exact Web candidate f9f53befbb with retained connected source and browser proof. Current backend lock evidence remains intact; no native recovery or delivery claim.
Change-source: pulse-maintainer
The runtime preserves canonical backup inventory scope in recovery_rollups.go; update the existing ownership guard to follow that call and require both PVE/PBS callers rather than the former duplicated literal.
Change-source: pulse-maintainer
For #2465, select latest provider evidence with the existing scope index
rather than ranking every retained payload. Preserve history and evidence
validation. Share complete, failure-preserving backup alert evaluation
across PVE/PBS/mock polls and expose unavailable reads through the existing
deduplicated system warning; keep existing age alerts until a complete read.
Contract-Neutral: Application query and existing system-alert behaviour only; no API, schema, resource identity, agent lifecycle, entitlement or notification contract shape changes. The new warning uses the existing open system-alert type, identity and metadata contract. Semantic contracts and connected verification are included.
Change-source: pulse-maintainer
Correct the two TypeScript narrowing errors observed after 1,901 connected tests passed. Recheck the corrected runtime bytes in Chromium and WebKit, with isolated fixture WebSocket traffic, and retain the original failed full proof.
Contract-Neutral: Complete VM-only type narrowing and typed regressions; no rendering, API or public contract delta.
Change-source: pulse-maintainer
The complete browser failure reached Settings but correctly excluded Diagnostics because its offline session omitted diagnosticsRead. Supply that fixture capability without changing production access checks or authentication.
Contract-Neutral: Offline browser fixture only; no production authorization change.
Change-source: pulse-maintainer
Capture final rendered state on every desktop and phone case, plus disabled exports during refresh. Bound the offline driver to leave time for owned teardown and retain its runner identity without retries or broader production claims.
Contract-Neutral: Integration proof capture only; production behavior and API contracts unchanged.
Change-source: pulse-maintainer
Compose the explicitly retained three-commit test candidate additively with current guest safety work. Production safeguards and unrelated integration type failures remain unchanged; final browser and exact-source acceptance follow.
Contract-Neutral: Test-only candidate restoration; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Distinguish observed agent metadata, assigned parent-node actions and current Proxmox guest-read state. Keep a visible backup/uncertain-completion precaution across drawer tabs, with existing guidance and independent thaw/covered-write limits. Do not start a diagnostic, infer memory provenance or claim native recovery.
Record state/replacement regressions, connected production-component browser proof and matching frontend/performance contracts.
Change-source: pulse-maintainer
Preserve exact Core candidate b77e6908e6. Retained source-41amnzmb covers all readers, connected continuity, full affected suites, races and embedded builds; canonical changes since its parent are frontend-only and non-overlapping. This integration is source safety, not native thaw or delivered release evidence.
Change-source: pulse-maintainer
Exercise explicit guest-agent states alongside old version metadata, parent action ownership and same-guest replacement. Require visible backup precautions across drawer tabs without running a guest check.
Contract-Neutral: Regression tests only; no runtime or public contract change.
Change-source: pulse-maintainer
Guest lock verification used ordinary redirect-following config reads and last-key-wins JSON decoding. Refuse redirected or ambiguous lock evidence before dispatch and after a complete guest response, without changing ordinary config redirects, pooled TLS policy or session recovery. Cover all six readers and connected cache/History continuity and fresh resumption; this source hardening does not establish native backup thaw.
Change-source: pulse-maintainer
Replace order-dependent substring and display-name attribution with exact PVE connection/native-node ownership and unique PBS namespace matching. Preserve ambiguous artifacts in distinct source-scoped, IDREF-safe rows and explain unmatched evidence without claiming that the guest was deleted. Keep migrated backups, independent server posture and unique-VMID PBS compatibility. Include connected controls, dependent contracts and inspected desktop/phone browser proof.
Change-source: pulse-maintainer
The full-export response includes populated identity arrays, so its route fixture must not inherit the empty response's never-array inference. Keep both payload shapes type-checked without suppressing compiler diagnostics.
Contract-Neutral: Integration fixture typing only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
The locked TypeScript compiler rejects the removed node10 resolution mode before checking any integration tests. Use bundler resolution for the extensionless imports transpiled by Playwright, without changing test runtime or product behaviour.
Contract-Neutral: Test tooling only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
Retain exact Core candidate 3fd44b8325 alongside published guest-memory repairs. Reviewed source-ifgmfzhw and exact built desktop/phone render proof cover the unchanged documentation and test content; no native thaw or installed recovery claim.
Change-source: pulse-maintainer
Replace obsolete exact selectors with the existing accessible privacy controls. Exercise full and review-first file contents, identity redaction and joins, displayed-result-only downloads, keyboard and viewport access, and failed-refresh retention in the real integration spec. Add an offline full-app driver with explicit synthetic bootstrap boundaries.
Contract-Neutral: Integration verification only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
Explain the manual systemd precaution inside the Pulse server LXC, including update timer and in-flight installer checks, stopped-state readback, independent covered-filesystem write checks before restart, and restoration of prior service states. Keep native thaw, recovery and release availability explicitly unproved.
Contract-Neutral: Document existing service controls and safety limits; no runtime, route, API, persistence, permissions or release-gate changes.
Change-source: pulse-maintainer
Repeated backup locks could drop a VM’s memory reading after the first
deferred poll. Preserve the complete last-known value while the original
successful guest-agent cache still supports its identity, values and
age. Retained values stay labelled previous-snapshot and do not renew
the cache timestamp or memory History; fresh polling replaces them after
unlock.
Validation:
- Eight consecutive locked polls after ordinary cache expiry through the
unified resource read-view path, followed by fresh recovery.
- Original-evidence guards for age, source, identity, capacity and
measured zero usage.
- Full monitoring and Proxmox package tests, focused race tests, and
repository commit hooks passed.
This fixes memory retention during backup deferrals. The original native
HAOS freeze race still requires separate qualification.
Preserve the exact Web candidate and final-content browser receipts. Retain both Diagnostics and PBS contract sections in the documentation-only conflict resolution.
Change-source: pulse-maintainer
Retain the complete last-known memory value from the scoped guest snapshot only while the original successful QGA cache supports its values and age. Keep deferrals labelled previous-snapshot without renewing cache timestamps or memory History.
Exercise repeated locks after ordinary cache expiry through unified resource views, with provenance, identity, capacity and expiration controls plus fresh unlocked resumption. Native freeze-race qualification remains separate.
Preserve the reviewed HTTP completion guard alongside the published single-attempt transport and Diagnostics protections.
Change-source: pulse-maintainer
Bind the final production content to six completed Chromium/WebKit direct and canonical controls, with inspected 1365px, 390px and 320px screens, mounted replacements and safe error notices. Retain earlier failed executions separately.
Change-source: pulse-maintainer
Install the default monitor's snapshot callback after both platform pollers exist. Settings already observes their runtime owners; alert checks must not retain startup's nil pointers. Exercise actual saved connections, loopback failures, ledger, monitor confirmation ticks, disable and ordinary scheduled inventory recovery without changing policy or adding a surface.
Contract-Neutral: Restore existing connection-alert wiring; no route, payload, authentication, persistence or detector-policy changes.
Change-source: pulse-maintainer
Name the component-specific fault-admission accessor explicitly instead of shadowing the generic adapter capacity helper. The shared snapshot constructor does not decide this read-evidence policy. Keep the audit and all display semantics unchanged.
Change-source: pulse-maintainer
Contract-Neutral: Names a component-specific datastore read-evidence accessor distinctly from the shared capacity-snapshot adapter; no behaviour, input, wire or public-contract delta.
Report entry still treated sanitized exports as sufficient and named an obsolete Diagnostics action. Warn before live collection during backups or an unresponsive host, reuse displayed results, and require local privacy review of files, screenshots and echoed errors without adding intake requirements.
Contract-Neutral: Community intake guidance only; release, installation and diagnostic runtime contracts are unchanged.
Change-source: pulse-maintainer
Supply the existing required resource display names without changing rendered labels. Bind the six completed desktop and touch context controls to the exact production content, retaining the earlier adverse init and load observations.
Change-source: pulse-maintainer
## What changed and why
This maintenance batch makes existing Diagnostics collection and sharing
safer and prevents Proxmox guest-agent commands from being silently
repeated by HTTP transport recovery.
- Guest-agent commands use a separate, single-use HTTP/1 connection with
the configured TLS, proxy, dial and timeout policy. Lost replies are not
transparently replayed, redirects are not followed, and uncertain
results preserve the existing cooldown and last-known monitoring data.
Ordinary API connection pooling and recovery remain unchanged.
- Sanitised Diagnostics downloads redact current token-usage, snapshot,
nested guest and disk identities while retaining measurements and
diagnostic joins. The full download is unchanged. Accessible guidance
distinguishes live checks from local downloads, explains
backup/freeze/thaw risks, and requires manual privacy review before
sharing. The shipped Troubleshooting guide matches the controls.
- The measured Diagnostics lazy-chunk baseline increases from 6,009 to
7,245 gzip bytes for these privacy and safety controls; growth limits,
other baselines, total budgets and startup checks are unchanged.
Related to #2439. This transport correction and collection guidance do
not establish the reported freeze's cause, native thaw or installed
recovery. Sanitisation is not a guarantee that arbitrary text or future
fields are safe to publish.
## Included source
Complete unpublished range:
`1548050727d75814d398a956c2934303b94a0276..79d54eb96f8bde6ae2880b0ff706d6d52e9d0dc3`
(nine commits including additive integration merges).
Reviewed candidates:
- Core:
`8fd6d3c71f363495cb8644953fa4673e5c96e55a..076a4ff94fe447adea787a5d97698fa57bc1d735`,
integrated by `3e31f38f35e956307253b91511cc21cacab5cd56`.
- Diagnostics:
`1ff46c4261e11b4a8edcd573df415a217ecd34cd..ea490f6503d93d6f27440fd2d83b7c30b42da17d`,
integrated by `79d54eb96f8bde6ae2880b0ff706d6d52e9d0dc3`. Implementation
`5cd4b4439042ed9be54773d2bc6dd37c20d9e96c` includes connected fixture,
copy and measured-budget corrections.
All reviewed identities are preserved; published upstream is already an
ancestor.
## Validation
- Exact combined-head offline proof `source-zewnlr8w`: 348 tests across
12 connected Diagnostics/Docs and upstream backup-date suites,
type-check, production build and bundle checks passed. Raw output
collection and guest cleanup completed; marker line-bound limits and
readiness/package/Vite warnings remain recorded.
- Recorded Core proof `source-bej9pci0`: 67 focused leaves, full
Proxmox/TLS suites, connected monitoring controls, focused races, vet
and embedded builds passed. The corresponding tested Proxmox and
monitoring subtrees are byte-identical at this proposal head. Parent
wire proof retained 42 failures reproducing replay/redirect contact with
ordinary recovery controls passing.
- Recorded Diagnostics proof `source-3jjdrd_5`: 200 connected
Diagnostics/Docs tests, full type-check, lint, format, build and bundle
checks passed. Parent comparison retained five privacy failures and two
passing controls. Earlier fixture/type/copy and historical-budget
failures are retained, not counted as passes.
- Recorded production-component browser proof: Chromium desktop and
WebKit phone emulation, 14 behavioural groups, ten inspected screens,
real local JSON downloads, accessible warnings and actual Docs
navigation. Final content hashes and own-parent browser receipts match
this proposal. Emulation is not native iOS acceptance.
- Publication-head provenance, whitespace checks, own-parent canonical
guards using the existing punctuation-only neutral trailer, final
browser bindings, public registry/contracts, status and control-plane
audits passed.
Required exact-head CI and independent review still apply before
landing. This PR publishes source maintenance, not a release or native
recovery acceptance.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain the exact reviewed Core candidate and its source-5_ta7via proof. Defer further guest reads after ambiguous HTTP failures without claiming native freeze or thaw acceptance.
Change-source: pulse-maintainer
Keep the 20-second deadline and all page-error, privacy, state, identity and geometry assertions. Await DOM readiness, the actual table and loaded fonts rather than treating the dev server's generic load event as the product acceptance condition. Retain the earlier load-event timeout.
Change-source: pulse-maintainer
Keep all browser error and geometry assertions; theme setup must tolerate the early WebKit init-script phase. The existing post-load dark-context assertion setup remains unchanged.
Change-source: pulse-maintainer
Bind the independent-inventory assertions only after the routed server table mounts. Preserve failure, protection, count and recovery assertions; no production or contract change.
Change-source: pulse-maintainer
Preserve the actual HTTP response status rather than trusting quoted API errors. Apply the VM-wide cooldown after request timeouts and unexplained server or gateway failures, while retaining exact command-bound terminal refusals as ordinary errors. Reject ambiguous error envelopes and preserve cached guest observations alongside fresh live counters.
Change-source: pulse-maintainer
Preserve named unavailable and unusable datastore evidence without reporting healthy empty capacity. Keep measured zero, warning thresholds, independent backup inventory and row identity, with readable phone notices and connected contracts and controls.
Change-source: pulse-maintainer
## Outcome
Saved TrueNAS and VMware connections continue ordinary monitoring when
optional organisation metadata is malformed. Storage-key discovery no
longer lets one tenant's damaged metadata suppress another tenant's
provider or prevent connection disable/removal. Strict
account/authentication metadata readers, encrypted configuration, tenant
isolation and read-failure handling remain intact.
Proxmox Backups now keeps unavailable, malformed and future dates
visibly unknown in Coverage, location filters and By date. An undated
completed point cannot silently make an older point look latest, or
count as observed activity. Updated inventory clears uncertainty without
remounting or extra reads; completion, verification and server
protection remain separate. Compact layouts retain readable uncertainty
labels.
## Why and included source
Related to #2382. Its interval-only response prompted saved-connection
discovery controls. Fixtures reproduce a failure family, not either
reporter's installed cause: the old discovery fragments also existed in
6.4.1. Backup chronology inspection separately found misleading
freshness/absence and shared latest-pointer reconciliation.
Publication range:
`ee63f32afc3b3d576eb5fc85ac9d24f6dd7ef3f3..02f67062c2be5b1b9d04a36a9fa9a24a18c20677`.
- Core candidate `453eccbba153431ddc6f560efd83e089e19c8947`.
- Web range
`1ff46c4261e11b4a8edcd573df415a217ecd34cd..dd6d0c6fcf245a554ff99baddbe5cfa90d9472ed`
(three commits).
- Additive upstream composition and integration commits preserve every
reviewed identity. Existing published PBS History fixture correction is
retained, not repeated.
## Validation and limits
- Core parent reproduction: twelve failing leaf controls, two normal
controls passing. Final `source-d118p80u`: 25 new controls, 116
connected API/tenant leaves, full configuration/TrueNAS/VMware suites,
selected platform pollers, focused races, vet and embedded
frontend/server builds passed.
- Web final `source-jtym7kql`: 670 connected tests, types, targeted
lint, seven audits, production build and unchanged budgets passed. Final
Chromium desktop and WebKit 390px/320px phone fixtures cover 21 groups
and nine inspected screenshot contents. Earlier failed
aggregates/preparation attempts remain adverse evidence.
- Publication inspection confirms all 25 candidate paths equal their
proven bytes; upstream added only a separate History E2E fixture
correction. Final browser receipt hashes, provenance, diff whitespace
checks and aggregate canonical/browser guards pass. Non-overlapping
sufficient proofs were not repeated.
Required exact-head CI and independent publication review still apply.
These are source/fixture results, not native appliance,
backup/restore/thaw, installed user acceptance or release qualification.
No issue closure or release availability is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Exact-source source-4x1h3apo measures 7,245 gzip bytes versus the 6,009-byte Diagnostics baseline. Accept the intentional 1,236-byte privacy and safety cost in this existing lazy-loaded panel. Update only its measured baseline, preserving every growth limit, other chunk baseline, total budget and startup-loading check.
Change-source: pulse-maintainer
Preserve the three reviewed Web commits and their parent-bound browser receipts. Unknown or future dates remain visible without asserting freshness, absence or a latest backup; server protection and completion stay independent. Retained exact-source connected qualification and browser evidence are adequate for this non-overlapping integration.
Change-source: pulse-maintainer
Guest-agent GETs enqueue serial work: ordinary HTTP pooling, stream recovery and redirects can resend a command despite the application single-attempt guard. Use an isolated single-use HTTP/1 transport with the configured TLS, proxy, dial and timeout policy, and defer redirects without contacting their destination. Keep ordinary API recovery and current CPU/I/O counter presence/receipts unchanged. Pin wire-level lost replies, all read/redirect paths, TLS trust and connected deferred cache/History behaviour.
Change-source: pulse-maintainer
pulse-triage[bot]