**Bound signed manual-update bootstrap downloads**
Keep both bootstrap requests within curl's connection and whole-request
deadlines, without ambient retry settings. Arm cleanup before allocation
so a second mktemp failure cannot strand the first input. Exercise the
emitted helper's signed success, partial download failures, allocation
failures and signature rejection without native or production execution.
**Keep native recovery proof aligned with bounded manual downloads**
Admit only the manual helper's exact new curl envelope in the existing
closed transport fixture. Require a signed emitted-helper round trip and
reject altered deadlines, retries and TLS flags through the registered
installer suite; do not widen the adapter or execute a native journey.
**Preserve each configuration-backup safety control's deadline**
The containing installer suite exhausted a single 30-second Python-class
budget after eleven controls and killed the last. Use the existing
serial discovery runner with all twelve required methods, retaining each
control's 30-second bound and the existing inner shell bounds rather
than treating cumulative class time as a safety deadline.
---
Fleet candidate `20261025T062429Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`b6618c19a3f2925fff019db2651d885ad1ede9b8` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Read only the selected feedback option rather than bug-like words in
link destinations, titles, prose or withdrawn examples. Preserve all
current dropdown choices, legacy Bug and Regression values, maintainer
classifications and unrelated Community labels. Registered consumer
controls exercise the silent label delta without contact or release
inference.
Contract-Neutral: Silent issue-label metadata only; no product runtime,
frontend, dependency, access or canonical subsystem contract delta.
---
Fleet candidate `20261025T064010Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`41acf9ca6f261bf7355369cad498cff90a1e504d` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Read only the selected feedback option rather than bug-like words in link destinations, titles, prose or withdrawn examples. Preserve all current dropdown choices, legacy Bug and Regression values, maintainer classifications and unrelated Community labels. Registered consumer controls exercise the silent label delta without contact or release inference.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
The containing installer suite exhausted a single 30-second Python-class budget after eleven controls and killed the last. Use the existing serial discovery runner with all twelve required methods, retaining each control's 30-second bound and the existing inner shell bounds rather than treating cumulative class time as a safety deadline.
Change-source: pulse-maintainer
Admit only the manual helper's exact new curl envelope in the existing closed transport fixture. Require a signed emitted-helper round trip and reject altered deadlines, retries and TLS flags through the registered installer suite; do not widen the adapter or execute a native journey.
Change-source: pulse-maintainer
Keep both bootstrap requests within curl's connection and whole-request deadlines, without ambient retry settings. Arm cleanup before allocation so a second mktemp failure cannot strand the first input. Exercise the emitted helper's signed success, partial download failures, allocation failures and signature rejection without native or production execution.
Change-source: pulse-maintainer
**Reproduce destructive acceptance of incomplete configuration backups**
Assert that authenticated null, incomplete and mistyped backup envelopes
leave persisted settings, credentials, metadata and transaction
artifacts unchanged. These controls are expected to fail before
validating the archive shape.
**Reject incomplete configuration backups before replacement**
Require the five sections emitted by every supported archive before
starting a transaction. Preserve null webhook inventories, deliberate
empty configurations, legacy optional fields and best-effort forward
compatibility. Exercise encrypted rejected imports, byte-identical
persistent state, unchanged runtime, failure audits and legacy recovery.
Contract-Neutral: Rejects incomplete non-backup payloads before the
existing replacement transaction; emitted archive formats, supported
complete legacy backups, API response shape and tenant authority remain
unchanged.
**Exercise backup validation without bypassing empty-node protection**
The initial control is already protected when saved Proxmox nodes block
an empty replacement. Model an installation with no Proxmox nodes, where
invalid envelopes can reach the settings and credential writes. Keep the
existing empty-node safeguard intact and use that legitimate empty
inventory for legacy compatibility controls.
---
Fleet candidate `20261025T050006Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `38a8b01ca3cd72180dcfd2a680f08f7cb398e8ca` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Keep unavailable VM inventory out of successful downloads**
Reject missing selected-organization inventory with non-cacheable
structured guidance, matching saved inventory reports. Preserve genuine
empty fleets and populated CSV exports, and cover the existing consuming
warning path.
Contract-Neutral: Restores the existing organization-bound inventory
contract: unavailable source data is not a successful empty fleet;
schemas, CSV columns, routes, authorization and scheduling are
unchanged.
**Format the inventory availability regression**
Apply the locked formatter to the new consumer-side regression; product
source and test assertions are unchanged.
**Keep the inventory CSV contract fixture available**
Use an available empty organization for the stable CSV-header contract.
An absent monitor is no longer a successful inventory source; header,
filename and column assertions are unchanged.
---
Fleet candidate `20261025T044640Z-web-product` from the `web-product`
lane. Reviewed tip `78397cf67eb78cc444e80efe5ad56e1b6d826e66` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Cold seven-day mock workload charts synthesized 914 values per series
before discarding most of them. Selecting the existing timestamp grid
before synthesis preserves the retained readings, newest point and
complete history window while bounding expensive work. The controlled
native request fell from 8.9 seconds to 1.3 seconds.
The strict chart query gate also exceeded its 90 ms p95 limit. Profiling
showed repeated SQLite row decoding, so raw fleet value reads now carry
the series and timestamp in one integer per observation. This
statement-local transport preserves exact values, negative-epoch
timestamps, tier reconciliation, resource scope and ordering, with
separate columns when a window could overflow. Full metrics-store tests
and targeted monitoring/API regressions pass, including boundary and
prepared-query cache controls. The 90 ms limit remains unchanged.
Organization browser fixtures arrange activated API fixtures before
their first workspace load. Explicit activation and deletion bounds
cover the existing server deadlines. Cleanup owns partial preparation,
attempts every tracked organization and retains failures. Native backend
teardown retains its final log. CI executes all 63 authentication,
organization and backend lifecycle controls before browser fanout.
Browser OS acquisition uses the hosted runner's existing signed Ubuntu
source definition. An unrelated Microsoft feed returning 403 can no
longer stop browser setup. Missing, unreadable or empty Ubuntu
definitions and incomplete Ubuntu index updates still fail. Existing
mirror, TLS, signature and cached archive hash checks remain in force.
Real apt acquisition controls, 17 package cache tests, 11 ownership
tests and normal commit/push checks pass.
The mock target lookup benchmark keeps fixture lifecycle logs out of
Go's result stream. A combined stdout/stderr control reproduces the lost
original observations and parses all ten corrected observations with
identical 4,731 lookups per operation. The benchmark work and comparison
thresholds remain unchanged.
Current-build browser verification covers
`/proxmox/workloads?type=vm&platform=proxmox-pve` at 1440×1000 and
390×844: seven-day trends, row drawer expansion, history range
selection, oldest/latest keyboard inspection and drawer dismissal.
Twelve organization-route cases cover organization settings, access,
sharing and billing across Chromium, mobile Chrome and mobile Safari
with retries disabled.
The [full stable/probation browser
run](https://github.com/rcourtman/Pulse/actions/runs/40160832317)
passed: 530 passed, 392 skipped, zero failures and no retry/flaky
markers in all eight shard logs. Agent registration and organization
provisioning also passed. This evidence covers product code at 64c0a3f9.
The later correction changes only a Go benchmark fixture and its
performance contract.
The [final-head stable E2E
run](https://github.com/rcourtman/Pulse/actions/runs/40163545118) also
passed all eight shards, agent registration and organization
provisioning: 186 passed, 183 skipped, zero failures.
All nine required source checks passed. The [final-head build and test
run](https://github.com/rcourtman/Pulse/actions/runs/40163545117)
passed, including benchmark comparison and strict chart qualification.
The chart result on valid hosted capacity was p50 38.31 ms, p95 51.01 ms
and p99 52.28 ms against the unchanged 90 ms p95 limit. The retained
artifact binds the measured binary to the tested synthetic merge commit.
The preceding runtime qualification also passed at p95 86.55 ms on its
runner. The benchmark comparison found no regression above the existing
10% and p<0.05 threshold. The corrected lookup fixture supplied all ten
observations without parser warnings.
After main advanced with scoped authentication and tenant runtime
changes, a native compatibility proof composed this exact head with
c809d3c93b. API, configuration API and
monitoring regressions passed. All twelve organization browser cases
passed again with retries disabled. A fresh embedded runtime passed the
desktop and phone seven-day chart matrix with both endpoints accessible.
The reviewed combined tree is 2e9a154b1c.
The initial control is already protected when saved Proxmox nodes block an empty replacement. Model an installation with no Proxmox nodes, where invalid envelopes can reach the settings and credential writes. Keep the existing empty-node safeguard intact and use that legitimate empty inventory for legacy compatibility controls.
Change-source: pulse-maintainer
Assert that authenticated null, incomplete and mistyped backup envelopes leave persisted settings, credentials, metadata and transaction artifacts unchanged. These controls are expected to fail before validating the archive shape.
Change-source: pulse-maintainer
Use an available empty organization for the stable CSV-header contract. An absent monitor is no longer a successful inventory source; header, filename and column assertions are unchanged.
Change-source: pulse-maintainer
**Reproduce tenant configuration import runtime contamination**
Exercise a complete synthetic archive through the authorised router with
distinct default and tenant runtimes, persisted credentials and
consuming settings readback. Disabled nodes prevent monitored-workload
traffic. The new control is expected to fail before the scoped runtime
repair.
**Apply configuration imports only to the selected tenant runtime**
Reload non-default organisations through their own persisted runtime
rather than copying the default config and restarting shared monitoring.
Use the same scoped loader at cold start, retain process environment
locks and instance identity, and fail closed when a scoped apply is
unavailable. Keep the default instance reload and existing archive/auth
contracts.
Contract-Neutral: Restores the existing selected-organisation isolation
and recovery contract without changing archive formats, public API
fields, authorization or guest/lifecycle guarantees.
**Compare detached runtime snapshots consistently in import regression**
Config.DeepCopy normalises empty discovery slices, so compare detached
snapshots on both sides rather than mistaking nil-versus-empty clone
representation for a non-target runtime mutation. The separate parent
controls still reproduce default settings, paths and credentials in the
selected tenant and the shared reload call.
**Verify imported tenant connections through the consuming node API**
Use the actual organisation-scoped node route for access and
rendered-field readback, including stored-credential redaction and TLS
verification. Keep the separate instance-wide system-settings surface
unchanged; internal runtime settings are not a substitute for its public
route.
**Preserve instance-wide settings during tenant recovery**
The actual system-settings route deliberately owns instance-wide policy.
Keep those effective values and process locks in the tenant runtime;
restore only scoped nodes, tokens and storage ownership. This removes an
unnecessary settings overlay and keeps the real scoped node consumer as
the recovery proof.
Contract-Neutral: Preserves existing instance-wide settings ownership
while restoring the existing tenant resource, credential and storage
isolation contract; no public schema, authority or lifecycle delta.
**Cover scoped token read failure and distinct instance policy**
Pin a non-default instance cadence and origin, and reject an unreadable
tenant token inventory instead of borrowing the default credential set.
**Use detached snapshots for loader non-mutation assertion**
The token clone normalises legacy empty scope metadata, just as
discovery cloning normalises empty slices. Compare the default snapshots
on both sides, retaining explicit path, identity, policy, token and
alias checks.
**Revalidate tenant credentials against their live scoped runtime**
A valid tenant token passed auth-context extraction but failed protected
routes because checkAuth checked only the global inventory. Retain the
middleware-selected tenant inventory owner privately and revalidate the
actual presented token against its live cached config at route
enforcement. Keep global fallback, explicit-credential priority, tenant
binding and scope enforcement; reject unvalidated context claims,
revocation and stale runtime owners.
Contract-Neutral: Repairs the existing tenant-token authentication path
and credential precedence without changing public fields, supported
authorities, scope grants or organisation membership rules.
**Keep tenant authentication bound to the current runtime owner**
Use the configuration handler's locked monitor-manager reference for
auth-context extraction and route revalidation, rather than capturing
the manager that an instance reload replaces. Add synthetic
old/new-owner, between-check replacement and removed-reference controls
without exercising native reload or altering membership/scope rules.
Contract-Neutral: Maintains the existing current-owner credential
validation and tenant-isolation invariants across monitor replacement;
no public fields, scope grants, membership or reload policy change.
**Give invalid-bearer auth controls their own session stores**
The focused auth batch panicked before reaching request enforcement
because these two controls relied on another test to initialise the
global session store. Initialise real temporary persistence in each
fixture and own its shutdown, without weakening the invalid-credential
assertions or changing runtime bootstrap.
**Model resolved tenant context in route-auth unit controls**
The full consuming router import now passes. Direct auth controls must
also supply TenantMiddleware's resolved organisation before testing
route enforcement; missing context correctly denotes the default scope.
Keep the positive, revocation, replacement and forged-context assertions
without relaxing runtime validation.
**Cover concurrent tenant route authentication and token metadata**
Exercise four concurrent callers through route revalidation and
middleware with cached synthetic tenant owners. Preserve token identity,
organisation, owner, scope checks and live usage metadata, with a
global-inventory control and no monitored runtime.
**Serialize tenant API token validation and usage metadata**
Use the same exclusive config writer for tenant and global token
normalization and LastUsedAt updates. Clone the validated record before
releasing it, then recheck the cached tenant owner across the lock
transition. Keep live revocation, organisation, owner and scope
enforcement and explicit credential precedence.
Contract-Neutral: Restores the existing concurrency, live-owner and
tenant-isolation guarantees without changing public fields, token
authority, organisation membership, archive formats or reload policy.
**Keep tenant storage guard aligned with the scoped runtime loader**
The reviewed recovery candidate moves tenant setup into
loadTenantRuntimeConfig. The existing guard still demands an inline
MetricsDBPath clear, so containing rest-1 CI fails despite the loader
retaining the isolation boundary. Check the non-default loader wiring
and execute the real loader for two tenants with and without the process
override, preserving default paths and instance rollup policy without
starting a monitor or database.
Contract-Neutral: Test-only repair follows the existing scoped loader
and executes its unchanged storage isolation contract; no runtime or
public contract changes.
---
Fleet candidate `20261025T041413Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `c5d38323f42c77c082f4566f6d7666a45c6d1b70` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Reject missing selected-organization inventory with non-cacheable structured guidance, matching saved inventory reports. Preserve genuine empty fleets and populated CSV exports, and cover the existing consuming warning path.
Contract-Neutral: Restores the existing organization-bound inventory contract: unavailable source data is not a successful empty fleet; schemas, CSV columns, routes, authorization and scheduling are unchanged.
Change-source: pulse-maintainer
Mock estate lifecycle logs split Go's benchmark name from its iteration count, causing benchstat to discard every sample. Keep the fixture logger quiet across setup, calibration and cleanup, then restore it.
The merged stdout/stderr control loses all ten original observations and accepts all ten corrected observations, with identical 4,731 lookups per operation. Timed work, reported metrics and regression thresholds remain unchanged.
**Keep report CSV text from becoming spreadsheet formulas**
Escape formula-like external text in single-resource, fleet and VM
inventory CSV exports, including saved inventory reports. Preserve field
boundaries, numeric measurements, ordinary text and the runtime
inventory.
Contract-Neutral: Restores safe literal-text handling in existing report
CSV cells; columns, numeric values, endpoints, authorization, archive
formats and scheduling contracts are unchanged.
**Match CSV export safety assertions to canonical runtime identity**
Use the real registry's canonical VM ID and normalized node name in the
download/saved-schedule regression. The first executable control exposed
incorrect fixture expectations; production CSV escaping is unchanged.
---
Fleet candidate `20261025T034027Z-web-product` from the `web-product`
lane. Reviewed tip `477be1e7c3e83ff17657c442f4611246b0fed768` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
The reviewed recovery candidate moves tenant setup into loadTenantRuntimeConfig. The existing guard still demands an inline MetricsDBPath clear, so containing rest-1 CI fails despite the loader retaining the isolation boundary. Check the non-default loader wiring and execute the real loader for two tenants with and without the process override, preserving default paths and instance rollup policy without starting a monitor or database.
Contract-Neutral: Test-only repair follows the existing scoped loader and executes its unchanged storage isolation contract; no runtime or public contract changes.
Change-source: pulse-maintainer
Preserve reviewed scoped import and credential race repairs while addressing the returned backend guard failure on current main.
Change-source: pulse-maintainer
Admit the complete index and patch reads, and drain pattern matches
before interpreting their result under pipefail. Preserve sensitive-file
and fallback-secret blocks and required docs, governance and lint
admission; distinguish an empty filtered patch from a failed read.
Exercise the actual hook with bounded synthetic large inputs and
retained failure exits.
Contract-Neutral: Local hook input handling only; existing secret
patterns, required checks and production contracts are unchanged.
---
Fleet candidate `20261025T032005Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`7adfe647fefed8af96ea906a6a08fd98627e3351` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Read the visible text of a single inline-formatted paragraph before
classifying explicit no-topic answers. Preserve qualifiers, images and
block evidence, completed reviews and every genuine revised topic
without public contact.
Contract-Neutral: Silent issue-label metadata only; no product runtime,
frontend, dependency, access or canonical subsystem contract delta.
---
Fleet candidate `20261025T032003Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`0696163d691619d3d6541a9ef429ff86f8820ff7` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
An unrelated Microsoft repository returned 403 during fresh-index admission and stopped a browser shard before any test could run. Load the hosted runner's existing Ubuntu Deb822 definition for browser packages, preserving its mirrors and signature policy. Fail when that definition is missing, unreadable or empty and keep strict index and archive hash checks.
Exercise the real apt parser, exclusion of unrelated feeds, missing definitions and incomplete index failures in private acquisition directories. Register the package helper and policy with their exact verification routes, and update the fixture helper's governance assertion to its scoped proof contract.
Use the real registry's canonical VM ID and normalized node name in the download/saved-schedule regression. The first executable control exposed incorrect fixture expectations; production CSV escaping is unchanged.
Change-source: pulse-maintainer
Escape formula-like external text in single-resource, fleet and VM inventory CSV exports, including saved inventory reports. Preserve field boundaries, numeric measurements, ordinary text and the runtime inventory.
Contract-Neutral: Restores safe literal-text handling in existing report CSV cells; columns, numeric values, endpoints, authorization, archive formats and scheduling contracts are unchanged.
Change-source: pulse-maintainer
Profiling the strict workload chart regression showed repeated SQLite column decoding on every observation. Carry the statement-local series number and timestamp in one integer for bounded raw value reads, while retaining separate columns whenever the requested window could overflow.
Preserve negative-epoch timestamps, current metric bindings, tier reconciliation, extrema readers and exact metric values. The paired cold-service benchmark falls from 63.5 ms to 60.6 ms. Full metrics-store tests and targeted monitoring/API chart regressions pass, including boundary and SQL-cache reuse controls.
Admit the complete index and patch reads, and drain pattern matches before interpreting their result under pipefail. Preserve sensitive-file and fallback-secret blocks and required docs, governance and lint admission; distinguish an empty filtered patch from a failed read. Exercise the actual hook with bounded synthetic large inputs and retained failure exits.
Contract-Neutral: Local hook input handling only; existing secret patterns, required checks and production contracts are unchanged.
Change-source: pulse-maintainer
Read the visible text of a single inline-formatted paragraph before classifying explicit no-topic answers. Preserve qualifiers, images and block evidence, completed reviews and every genuine revised topic without public contact.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
Keep SPA fallback for client routes, including extensionless
documentation viewers, but not missing document files, bundles or other
static resources. Missing resources are not cached, so a later
installation can supply them without a stale negative response.
Contract-Neutral: Correct static-resource failure responses at the
existing SPA boundary; no API, authentication, data schema or supported
client route changes.
---
Fleet candidate `20261025T021357Z-web-product` from the `web-product`
lane. Reviewed tip `d0c3a7fadf683cd0669025200a849611aa6068b7` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Bound reordered topic declarations at all four feature-request context
fields. Extend the registered form-derived parser and consumer controls
to every issue template, preserving cleared reviews on context edits and
restoring review only for a real revised topic.
Contract-Neutral: Silent issue-label metadata only; no product runtime,
frontend, dependency, access or canonical subsystem contract delta.
---
Fleet candidate `20261025T022031Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`b8e64d1fffe90d76a2cddbffd0cd1ba792ef8bc6` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Include the organization request-bound, owned-cleanup and native backend diagnostic controls in the existing fixture validation step. These tests must protect future changes in recurring CI as well as the focused native proof.
Contract-Neutral: CI wiring only: execute existing fixture controls in the existing validation job. Source-bound image distribution, fixture behavior and all runtime and test deadlines are unchanged.
Use the same exclusive config writer for tenant and global token normalization and LastUsedAt updates. Clone the validated record before releasing it, then recheck the cached tenant owner across the lock transition. Keep live revocation, organisation, owner and scope enforcement and explicit credential precedence.
Contract-Neutral: Restores the existing concurrency, live-owner and tenant-isolation guarantees without changing public fields, token authority, organisation membership, archive formats or reload policy.
Change-source: pulse-maintainer
Exercise four concurrent callers through route revalidation and middleware with cached synthetic tenant owners. Preserve token identity, organisation, owner, scope checks and live usage metadata, with a global-inventory control and no monitored runtime.
Change-source: pulse-maintainer
Arrange activated organizations before the first workspace load and retain ownership when preparation fails. Give activation and graceful tenant deletion explicit request bounds matching the existing server deadlines, while preserving overall journey deadlines and failure verdicts.
Attempt every owned cleanup and retain the final native backend log before teardown removes its runtime. Controlled fixture and backend lifecycle tests pass, and all twelve organization-route cases pass across Chromium, mobile Chrome and mobile Safari with retries disabled.
The cold seven-day workload chart generated 914 values per series before
discarding most of them. Across the default demo estate the request took
8.9 seconds and exceeded the browser request budget in CI.
Select the existing timestamp grid before evaluating the canonical metric
model. Preserve every retained timestamp and value, full-window coverage,
fresh terminal readings and dense historical seeding. Regression controls
reject the old work bound and verify canonical values across resource types.
Scrolling through a long platform drawer could unmount its owning row
and close the detail being read. REST resource projection also dropped
source provenance, hiding vCenter context and host placement from
owning-snapshot consumers. Diagnostic commands lacked keyboard
scrolling, and dark-theme text and several Patrol control names failed
accessibility checks.
Measure summary rows and inline details together in the shared bounded
window, preserve canonical resource sources, make diagnostic command
blocks focusable, and repair shared contrast and visible control naming.
Browser fixtures await mounted authentication and keep synthetic
provider inventory authoritative. Journey assertions follow current
read-only capabilities, technical disclosures and composed resource
queries. Long settings audits traverse the actual scroll extent; curated
estate checks use native inventory disclosures and search; disk proofs
follow canonical serial-bound shared history; the published
completed-restore-point calendar checks remain intact, including day
selection and filter reset. Update API proofs no longer mount an
unrelated dashboard before each request.
Fresh password login now waits for mounted bootstrap too. The
delayed-bootstrap regression owns and revokes its own token, so it runs
with cookie-only and primary-token fixtures without replacing the
fixture credential. Update API cases share an admitted cookie fixture.
Growth assertions use the current fixed-window header, LXC refresh
assertions use the fixture's canonical identity, and the gated-panel
observer follows actual gate readiness while still detecting visible
unlocked controls. The Docker browser stack explicitly opts into a
bounded development update budget for its shared bridge IP. Production
and login limits remain unchanged.
The remaining recovered failures exposed three test synchronization
defects. Alerts now leaves the whole editor before judging a staged
change and exercises its sibling-focus contract. Protected panel
assertions wait for mounted bootstrap before their existing readiness
timeout. The delayed-token regression uses its own page, avoiding
interception of reads from a departing setup document. CI retains
failed-attempt HTML diagnostics after a successful retry and small JUnit
results for each completed tier, including stable receipts before
probation starts.
Validation includes negative controls for the original drawer,
provenance and password-bootstrap defects, 335 focused frontend tests,
23 authentication-fixture tests, type-checking and a production build.
The cookie-only follow-up matrix passed 39 cases across Chromium, mobile
Chrome and mobile Safari with 18 existing skips. Twelve additional
onboarding cases passed with no retries, and the token-bootstrap matrix
passed 12 cases with cookies alone and 12 with a primary token. Native
Chromium and WebKit checks exercise the gated-panel detector's positive
and negative controls. The earlier remaining-failures matrix passed 31
cases with 10 existing skips, and both disk-history cases passed on
desktop.
Current-build browser verification covers onboarding, accessibility,
VMware context and exclusion boundaries, demo commercial isolation,
persisted Alerts settings, Patrol, availability and background refresh.
Pixel and interaction review covers infrastructure, Agent Doctor,
Patrol, Docker, Kubernetes and vSphere at desktop, tablet and phone
widths in both themes where applicable. Existing timeouts, skips,
mounted-row limits and the 90 ms chart budget remain in place.
The final recovered-failure matrix passed 27 cases with 14 existing
mobile skips using cookies alone, followed by 12 passes with a primary
token, all without retries. The forced desktop table control reproduces
the old focus failure and passes after leaving the editor. The preceding
qualified tree completed all required source checks and the full
stable/probation matrix. Its executed strict chart proof measured p95
61.1 ms against 90 ms with valid capacity. The updated head is being
qualified again before landing.
Governed work: L12 journey verification and the shared L10 windowing
proof. This source change does not publish a release.
Bound reordered topic declarations at all four feature-request context fields. Extend the registered form-derived parser and consumer controls to every issue template, preserving cleared reviews on context edits and restoring review only for a real revised topic.
Contract-Neutral: Silent issue-label metadata only; no product runtime, frontend, dependency, access or canonical subsystem contract delta.
Change-source: pulse-maintainer
**Run isolated installer safety controls within Go's parallel budget**
Current successful public CI puts the installer package on the backend
critical path for 683-764 seconds. Each registered Python method already
owns a separate process and private fixtures; run those methods through
the existing Go parallel scheduler, starting their unchanged deadlines
only after admission. Keep exhaustive discovery and exact non-skipped
method verdicts, with connected parallel, serial, failure, skip and
cleanup controls.
Contract-Neutral: Test-only scheduling of already isolated fixture
processes; no installer, runtime, service deadline, source selection,
required check or native acceptance contract changes.
**Keep real NAS process-inventory controls serial**
The first exact-source parallel attempt failed the generated Unraid and
QNAP watchdog control. Its real machine-wide process observation is not
isolated by private fixture files. Preserve the entire NAS class's
serial execution and make concurrency explicit only for the seven
modelled-inventory classes. The regression now proves that the serial
helper still preserves ordering, as well as bounded parallelism and
complete failure/skip/cleanup evidence.
Contract-Neutral: Test-only fixture scheduling; real NAS observations,
production manager deadlines, process ownership checks and required test
coverage are unchanged.
---
Fleet candidate `20261025T003446Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`7b64d9b66d39ea4765fbc74c6286c3633f610478` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Keep SPA fallback for client routes, including extensionless documentation viewers, but not missing document files, bundles or other static resources. Missing resources are not cached, so a later installation can supply them without a stale negative response.
Contract-Neutral: Correct static-resource failure responses at the existing SPA boundary; no API, authentication, data schema or supported client route changes.
Change-source: pulse-maintainer
The full consuming router import now passes. Direct auth controls must also supply TenantMiddleware's resolved organisation before testing route enforcement; missing context correctly denotes the default scope. Keep the positive, revocation, replacement and forged-context assertions without relaxing runtime validation.
Change-source: pulse-maintainer
The focused auth batch panicked before reaching request enforcement because these two controls relied on another test to initialise the global session store. Initialise real temporary persistence in each fixture and own its shutdown, without weakening the invalid-credential assertions or changing runtime bootstrap.
Change-source: pulse-maintainer
Use the configuration handler's locked monitor-manager reference for auth-context extraction and route revalidation, rather than capturing the manager that an instance reload replaces. Add synthetic old/new-owner, between-check replacement and removed-reference controls without exercising native reload or altering membership/scope rules.
Contract-Neutral: Maintains the existing current-owner credential validation and tenant-isolation invariants across monitor replacement; no public fields, scope grants, membership or reload policy change.
Change-source: pulse-maintainer
A mounted cookie shell can still be waiting for its default workspace
redirect. Admitting that entry races the next deep link in WebKit. Wait
for the destination and retain controlled missing-admission and resource
snapshot coverage, including rejection of the old helper predicate.
Use the shared content-owner geometry audit for infrastructure onboarding
and assert SPA route changes without waiting for the document load event.
A valid tenant token passed auth-context extraction but failed protected routes because checkAuth checked only the global inventory. Retain the middleware-selected tenant inventory owner privately and revalidate the actual presented token against its live cached config at route enforcement. Keep global fallback, explicit-credential priority, tenant binding and scope enforcement; reject unvalidated context claims, revocation and stale runtime owners.
Contract-Neutral: Repairs the existing tenant-token authentication path and credential precedence without changing public fields, supported authorities, scope grants or organisation membership rules.
Change-source: pulse-maintainer
The token clone normalises legacy empty scope metadata, just as discovery cloning normalises empty slices. Compare the default snapshots on both sides, retaining explicit path, identity, policy, token and alias checks.
Change-source: pulse-maintainer
The first exact-source parallel attempt failed the generated Unraid and QNAP watchdog control. Its real machine-wide process observation is not isolated by private fixture files. Preserve the entire NAS class's serial execution and make concurrency explicit only for the seven modelled-inventory classes. The regression now proves that the serial helper still preserves ordering, as well as bounded parallelism and complete failure/skip/cleanup evidence.
Contract-Neutral: Test-only fixture scheduling; real NAS observations, production manager deadlines, process ownership checks and required test coverage are unchanged.
Change-source: pulse-maintainer
Pin a non-default instance cadence and origin, and reject an unreadable tenant token inventory instead of borrowing the default credential set.
Change-source: pulse-maintainer
The actual system-settings route deliberately owns instance-wide policy. Keep those effective values and process locks in the tenant runtime; restore only scoped nodes, tokens and storage ownership. This removes an unnecessary settings overlay and keeps the real scoped node consumer as the recovery proof.
Contract-Neutral: Preserves existing instance-wide settings ownership while restoring the existing tenant resource, credential and storage isolation contract; no public schema, authority or lifecycle delta.
Change-source: pulse-maintainer
Use the actual organisation-scoped node route for access and rendered-field readback, including stored-credential redaction and TLS verification. Keep the separate instance-wide system-settings surface unchanged; internal runtime settings are not a substitute for its public route.
Change-source: pulse-maintainer
pulse-triage[bot]