The Go linker's dsymutil step writes DWARF output under TMPDIR rather
than GOTMPDIR, so backend builds failed with ENOSPC on the
space-constrained boot volume even with GOCACHE and GOTMPDIR already on
the Development SSD. hot-dev now exports TMPDIR from the machine's
configured GOTMPDIR when one exists, keeping every build temp file on
the same volume as the rest of the build state.
Projection replay walked the entire alert event log on every boot, twice
(monitor start and the resource-store boundary), synchronously on the
serving path, and every replayed event queued a full incident-store JSON
rewrite. A 64k-event log made startup exceed the dev supervisor's
health-kill window, so the backend restarted forever and never served.
The event log now owns per-consumer projection watermarks in
alert_store_meta, WalkOldest takes an AfterID cursor, and the single
catch-up pass runs in the background at the canonical resource-store
boundary with periodic watermark checkpoints. The watermark only
advances when both the incident store and the canonical change recorder
are attached, so partial-surface passes repair without marking events
applied, and lowering the watermark forces a full repair replay.
Incident-store saves now coalesce: a burst of mutations queues one
whole-store serialization instead of one per event, live paths included.
Registers the alert-lifecycle-replay-startup-scalability coverage gap
and amends the alerts and monitoring subsystem contracts accordingly.
Fail closed when provider endpoints are IP addresses or repeated single-label names, since those values are commonly reused across independent private estates. Preserve the candidate's qualified-endpoint continuity and add coverage for the short-endpoint collision.
Refs #1753
Contract-Neutral: narrows internal durable identity recovery evidence
Scope durable Proxmox identity-pin recovery to exact provider endpoints or established cluster identity. Record full named endpoints in new host pins and fail closed on legacy short-hostname pins, preventing the first reporting agent from canonically absorbing another standalone estate during provider-first boot windows.\n\nRefs #1753\n\nContract-Neutral: narrows internal canonical identity recovery without changing API or extension shapes
The Standalone and AvailabilitySettingsPanel chunks grew past their budgets
with the availability history and fleet view (712f1a3bfe) and
multi-location service delivery evidence (16a1574a18) features. Earlier
unit-test and formatting failures in the Frontend job masked the budget
step until now. Baseline refreshed from the current build.
Restoring a configuration backup onto a Pulse instance with a new address
makes every agent vanish until each agent's configured --url (PULSE_URL for
containers) is updated, because agents dial the address they were installed
with. The post-migration checklist covered the token but not the address.
Refs #1813
The notification delivery warning renders on the alerts overview, but its
Retry and Dismiss queue actions only existed on the notifications tab, so
the card people actually see offered nothing but a refresh button.
Hoist the retained-queue actions into the shared delivery health hook and
wire them into the overview card, with the notifications tab reusing the
same implementation plus its delivery log reload.
Refs #1812
A PBS-to-PBS sync that fails mid-snapshot leaves a manifest-less copy of an
already-completed backup on the target datastore. That copy has the same
signature as a snapshot being written right now (no size, no
index.json.blob), so the guest showed Backup Running indefinitely until the
sync was repaired.
An in-flight snapshot only reports the guest as backing up when it is newer
than the guest's last completed backup and within the same 24h cutoff that
already ages out stale running vzdump tasks. A genuine in-progress backup is
always newer than the last completed one; a partial sync copy never is.
Refs #1815
Three consecutive main runs were red because landed features outran their
guardrails while change detection kept the affected shards out of their own
runs.
- Resync shipped copies of API.md, CODE_SIGNING_POLICY.md, and
PRODUCTION_SECURITY.md from repo docs.
- Track the schema v16 telemetry disclosure (workload-history adoption
counts) in the settings architecture guardrail.
- Track route-scoped TrueNAS hydration queries and the conditional Kind
column class in the platform overview layout guardrails.
- Track the contained command-authority copy (legacy combined command
profile) in the installer and setup guide tests.
- Match the sentence-split delivery retention copy in AlertDeliveryLogCard.
- Provide selectedAgentUrl, insecureMode, and customCaPath in the
InfrastructureWorkspace operations mock for the safe-collector commands.
- Include the resource list facets block in the two API contract snapshots,
normalizing the direct-marshal fixture the way every handler does.
- Require the fail-closed installer checksum wording in the
AGENT_SUBSTRATE doc contract.
rcourtman