The Go linker's dsymutil step writes DWARF output under TMPDIR rather
than GOTMPDIR, so backend builds failed with ENOSPC on the
space-constrained boot volume even with GOCACHE and GOTMPDIR already on
the Development SSD. hot-dev now exports TMPDIR from the machine's
configured GOTMPDIR when one exists, keeping every build temp file on
the same volume as the rest of the build state.
Projection replay walked the entire alert event log on every boot, twice
(monitor start and the resource-store boundary), synchronously on the
serving path, and every replayed event queued a full incident-store JSON
rewrite. A 64k-event log made startup exceed the dev supervisor's
health-kill window, so the backend restarted forever and never served.
The event log now owns per-consumer projection watermarks in
alert_store_meta, WalkOldest takes an AfterID cursor, and the single
catch-up pass runs in the background at the canonical resource-store
boundary with periodic watermark checkpoints. The watermark only
advances when both the incident store and the canonical change recorder
are attached, so partial-surface passes repair without marking events
applied, and lowering the watermark forces a full repair replay.
Incident-store saves now coalesce: a burst of mutations queues one
whole-store serialization instead of one per event, live paths included.
Registers the alert-lifecycle-replay-startup-scalability coverage gap
and amends the alerts and monitoring subsystem contracts accordingly.
Fail closed when provider endpoints are IP addresses or repeated single-label names, since those values are commonly reused across independent private estates. Preserve the candidate's qualified-endpoint continuity and add coverage for the short-endpoint collision.
Refs #1753
Contract-Neutral: narrows internal durable identity recovery evidence
Scope durable Proxmox identity-pin recovery to exact provider endpoints or established cluster identity. Record full named endpoints in new host pins and fail closed on legacy short-hostname pins, preventing the first reporting agent from canonically absorbing another standalone estate during provider-first boot windows.\n\nRefs #1753\n\nContract-Neutral: narrows internal canonical identity recovery without changing API or extension shapes
pulse-triage[bot]