## Outcome
Saved TrueNAS and VMware connections continue ordinary monitoring when
optional organisation metadata is malformed. Storage-key discovery no
longer lets one tenant's damaged metadata suppress another tenant's
provider or prevent connection disable/removal. Strict
account/authentication metadata readers, encrypted configuration, tenant
isolation and read-failure handling remain intact.
Proxmox Backups now keeps unavailable, malformed and future dates
visibly unknown in Coverage, location filters and By date. An undated
completed point cannot silently make an older point look latest, or
count as observed activity. Updated inventory clears uncertainty without
remounting or extra reads; completion, verification and server
protection remain separate. Compact layouts retain readable uncertainty
labels.
## Why and included source
Related to #2382. Its interval-only response prompted saved-connection
discovery controls. Fixtures reproduce a failure family, not either
reporter's installed cause: the old discovery fragments also existed in
6.4.1. Backup chronology inspection separately found misleading
freshness/absence and shared latest-pointer reconciliation.
Publication range:
`ee63f32afc3b3d576eb5fc85ac9d24f6dd7ef3f3..02f67062c2be5b1b9d04a36a9fa9a24a18c20677`.
- Core candidate `453eccbba153431ddc6f560efd83e089e19c8947`.
- Web range
`1ff46c4261e11b4a8edcd573df415a217ecd34cd..dd6d0c6fcf245a554ff99baddbe5cfa90d9472ed`
(three commits).
- Additive upstream composition and integration commits preserve every
reviewed identity. Existing published PBS History fixture correction is
retained, not repeated.
## Validation and limits
- Core parent reproduction: twelve failing leaf controls, two normal
controls passing. Final `source-d118p80u`: 25 new controls, 116
connected API/tenant leaves, full configuration/TrueNAS/VMware suites,
selected platform pollers, focused races, vet and embedded
frontend/server builds passed.
- Web final `source-jtym7kql`: 670 connected tests, types, targeted
lint, seven audits, production build and unchanged budgets passed. Final
Chromium desktop and WebKit 390px/320px phone fixtures cover 21 groups
and nine inspected screenshot contents. Earlier failed
aggregates/preparation attempts remain adverse evidence.
- Publication inspection confirms all 25 candidate paths equal their
proven bytes; upstream added only a separate History E2E fixture
correction. Final browser receipt hashes, provenance, diff whitespace
checks and aggregate canonical/browser guards pass. Non-overlapping
sufficient proofs were not repeated.
Required exact-head CI and independent publication review still apply.
These are source/fixture results, not native appliance,
backup/restore/thaw, installed user acceptance or release qualification.
No issue closure or release availability is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the three reviewed Web commits and their parent-bound browser receipts. Unknown or future dates remain visible without asserting freshness, absence or a latest backup; server protection and completion stay independent. Retained exact-source connected qualification and browser evidence are adequate for this non-overlapping integration.
Change-source: pulse-maintainer
Guest-agent GETs enqueue serial work: ordinary HTTP pooling, stream recovery and redirects can resend a command despite the application single-attempt guard. Use an isolated single-use HTTP/1 transport with the configured TLS, proxy, dial and timeout policy, and defer redirects without contacting their destination. Keep ordinary API recovery and current CPU/I/O counter presence/receipts unchanged. Pin wire-level lost replies, all read/redirect paths, TLS trust and connected deferred cache/History behaviour.
Change-source: pulse-maintainer
Separate cautionary help into sentences and describe backup entries without implying incomplete artifacts are restorable. Refresh the browser proof for the exact final copy.
Contract-Neutral: Copy-only clarification and matching controls; date selection, completion, protection, API and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Scope the new warning assertion to its own status rather than unrelated status regions. Preserve exactly-now and window-start activity edges while explicitly rejecting the obsolete future same-day expectation.
Contract-Neutral: Test-only fixture and selector corrections; runtime, wire, presentation and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Preserve unknown and future restore-point dates through Coverage, location selection and By date. Keep completion, verification and server protection independent, prevent shared latest-pointer reconciliation from overwriting newer PBS evidence, and make uncertainty readable on narrow phones. Exact-parent controls, connected recovery suites and inspected browser fixtures verify the existing surfaces.
Change-source: pulse-maintainer
## What changed and why
Monitoring should not interpret unusable telemetry as healthy protection
or reliable alert evidence.
- Treat NaN, infinities, invalid authoritative History samples and
overflowing metric averages as unknown. Preserve the last trusted
incident and notification state, then resume normal evaluation when
finite observations return. Explicit rule disabling still works.
- Keep malformed, future or otherwise unusable backup completion
timestamps distinct from genuine absence. Existing workload rows,
tooltips and guest details show cautionary uncertainty rather than
healthy protection or an invented completion date. Running activity and
valid freshness thresholds remain distinct.
These are repairs to existing alert and backup-safety surfaces, not new
features or native backup/thaw acceptance.
## Included source
Complete range:
`0f58485b52a59a21b944e73ed45637a8914b8a88..a1cde2ffe0bf86ea76bbd678e4bb0eb72860e72f`.
- Alert candidate `1265ff10145c270f38666acfb68c13f2eb2399b6`, integrated
at `f80f4b75ff46acaf7dd324208983f52a3be7171c`.
- Backup timestamp candidate `a0b3c09e07bd700374a587db7908fa780d6d7631`,
integrated at `1ff46c4261e11b4a8edcd573df415a217ecd34cd`.
- Upstream reconciliation `01bf594d67c39ac4a63ab0b5611ee22eda790ea9`
retains published main and every reviewed commit unchanged.
- Additive test-fixture repair
`a1cde2ffe0bf86ea76bbd678e4bb0eb72860e72f` supplies the real History
response envelope to the PBS target E2E test. PR2457 run `37188438472`
failed both chart assertions in three browser projects; its mock omitted
range/start/end required by the reviewed response validator. Product
validation, target checks and both-chart assertions are unchanged.
## Validation
The combined product source passes the complete alerts package and
frontend type checking plus 220 focused backup/workload tests in offline
disposable source proofs. Retained backup-candidate evidence includes
548 connected tests, lint/audits, production build/budgets, 13 parent
regressions and ten legitimate controls, plus twelve Chromium/WebKit
production-component fixture paths. Browser receipt hashes match the
final product files.
The fixture correction is checked separately against the unchanged
production History validator, including rejection of the old envelope
and wrong-target/selection or missing-bound controls. This is a
response-contract check, not a full E2E or chart-render pass. Exact-head
hosted CI must verify the complete E2E journey. A cancelled earlier
benchmark is not a pass. Local browser preparation failures from
unavailable canonical dependencies remain explicit limitations.
Provenance, clean-source, additive ancestry and diff checks pass. No
accepted commit was rewritten; unchanged proofs were not repeated solely
to combine candidates.
## Remaining limits
No containing release, installed alert/notification relief, native
backup/restore or guest thaw is established. Existing backup safety
guidance and independent native acceptance remain necessary.
Related to #2439
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain the exact Core candidate identity and its parent/final polling, revocation and tenant-isolation proof. Optional organisation metadata no longer controls saved TrueNAS and VMware inventory discovery; strict account and authentication metadata loading is unchanged.
Change-source: pulse-maintainer
PR2457 Core E2E run 37188438472 fails both PBS chart assertions in three browser projects because its mock omits range and start/end fields required by the reviewed response admission contract. Supply the real response envelope and one consistent point interval; retain target identity checks and all chart assertions. No product validator or release gate changes.
Change-source: pulse-maintainer
Saved TrueNAS and VMware connections belong to validated tenant storage keys, not optional organisation metadata. A malformed org.json could prevent provider creation and block authoritative disable or removal in an unrelated tenant. Enumerate storage identities while retaining strict metadata/account readers, tenant isolation and config/credential failure handling.
Synthetic probe, polling and API controls reproduce the interval-only response family in #2382. They do not establish either reporter installation’s cause or native appliance acceptance.
Change-source: pulse-maintainer
## What changed and why
- Guest discovery stays bound to the selected target.
Replacement/loading/denied targets cannot display another guest's
service or suggested URL; same-target transient evidence is labelled,
and retry remains available. Saved operator URLs remain independent.
- History clients reject wrong-resource, wrong-range, wrong-metric and
malformed success bodies before charting or caching them, while
preserving measured zero, observed empty history and explicit Kubernetes
compatibility. In-memory History readers allocate detached, right-sized
snapshots without changing observations, ordering or cutoffs.
- External-probe help distinguishes missing observations from a target
outage, server-dependent notification delivery and the volatile
200-observation buffer. It matches the existing Observation locations
editor and shipped documentation mirrors.
- Webhook help no longer recommends permanently deduplicating on a
reused correlation header. Copyable templates preserve every member,
full-precision occurrence and severity changes, escape JSON correctly,
and explain conditional recovery. Runtime headers, signing and
notification behaviour are unchanged.
- Build-check fixtures accept a stable exact Node version only within
the governed major and isolate fake audit timing from caller budgets. A
formatting-only follow-up repairs PR2457's deterministic Frontend
failure.
These are existing-surface safety and efficiency improvements found by
source review, plus repairs to observed validation defects. They add no
feature. Related to #1723, #1803, #2199 and #2439; no native symptom
resolution is claimed.
## Included source
Published base `0a722be97c973bff9961e0fcd4063f6daa9fc5ac` → final head
`841b5d6644df8d7fc8d02ba427b9e4c988181983`.
Reviewed candidates and integration points:
- Delivery `9213a6d75a6ced2bd9c937101be5c0a422dc1cdd` →
`f312a70ae5e67f3f890b1214816193c4f7fb4a8c`.
- Probe guidance `ad4fbff6be447b9c7e93fa845c70c88dff7cc1dc` /
`b27387d8fc489a683d7fba591afb4bc1fc7bb4a5` →
`7ca8945f0da2036a779e7a9ea7e76643ce60f2e2`.
- Guest discovery `9230aca96dd8e756f1032aa4d300928ab6cfd588` →
`9d5fd627f01cb176e5f28b1923a3407fc0867c3a`.
- History allocation `fcd9b65b828f92219ffd2c6b1ef97cb7d40f298a` →
`3db021ba53ff416f2e3b7f95bea93ee57c62ccb5`.
- History response admission `866da85c26d96821c00917306b04098e1896f1c8`
→ `fe42207eb4bfb04461cc780f3f32d3d7bcbe4d4b`.
- Webhook guidance range
`94a14c78c7f80f5ba8b32af3d06ccb5f1390468b..c7bb48f0b4dc1790ba26d4f6138dba88ee1df3b8`,
including its first commit → `a93ab070f6008e8ca26f72e93ea5bded8362a623`.
- Additive published-main composition
`50b1ebbf1f8eac39f55de5f0bc6a69af6eec848b` /
`b47dc7a410357473f301032f3c07dd2a93795d07`; formatting correction
`841b5d6644df8d7fc8d02ba427b9e4c988181983`.
All original reviewed commit identities and ancestry remain intact. The
previous proposal head completed CI with a reproducible formatting
failure in run `37185009631`, not a retry-worthy environmental failure.
This update includes the newer independently reviewed range rather than
restarting a still-running workflow.
## Validation and limits
- Provenance, clean-source, retained-ancestry and whitespace checks
pass. Shipped guidance mirrors and parent-bound browser content hashes
remain consistent.
- Probe receipt `source-_7_dmsnc`: 64 Docs controls,
lint/types/build/budgets and six inspected desktop/phone-emulated
renders.
- Delivery final composition `source-2wejypna`: three actual Go
build-contract controls and 21 Python audit-fixture controls pass.
Earlier `source-4s7r3n08` remains aggregate exit 1 at unavailable
root-module Playwright, despite successful Go/script stages and a
separate synthetic browser proof.
- Web History receipt `source-pj25wjfz`: 379 connected tests, types,
targeted lint, frontend audits, build/budgets, plus twenty browser
checks and eight inspected screenshots. Final browser-bound
implementation files are byte-identical. The prior backup-date timeout
and `source-hy2sts4n` exit discrepancy remain adverse.
- Core History receipts `source-j3h0oilb`, `source-cha7xlv5`,
`source-rad3e2a3`: parent allocation witnesses, final
semantics/connected readers, focused races/full monitoring/vet and real
embedded builds. The missing-embed aggregate exit 1 remains recorded;
the separate build/comparison exits 0. Same-executable allocation
measurements are not native CPU/RSS relief.
- Webhook receipts `source-no6npmqe`, `source-xtglyv47`,
`source-782t58q4`, `source-w_lyklsq`, `source-ddchs9rd`: parent template
failures, full notification races, 14 safety controls, 71 Docs controls,
lint/types/real frontend and binary builds, and inspected
Chromium/WebKit renders. Earlier normalisation/missing-embed aggregates
remain exit 1. Proven implementation, guide and manifest content is
unchanged in this composition.
- The formatting correction passes targeted Prettier checks across the
changed frontend source/tests; TypeScript parsed syntax trees confirm
unchanged assertions and literals.
- Attempted exact-final frontend aggregate `source-7czju56e` is
**unavailable**, client exit 2: guest readiness timed out, zero command
output, no observed command exit, guest stop complete. It was not
replayed and is not a passing suite. Existing unchanged-content proofs
and the narrow formatting check support proposing this head; exact-head
CI remains mandatory.
Independent exact-head review and required GitHub checks must pass
before landing. Source/rendered evidence does not establish native
appliance identity/thaw, outage delivery, receiver ticket acceptance,
installed upgrade/recovery, native performance relief or release
readiness. Existing adverse benchmark observations remain separately
owned, not cleared by this batch. No release is published by this PR.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the exact Web candidate and its connected source and production-component browser proof. Unusable completion times stay cautionary in existing rows and drawers; running activity and genuine absence remain distinct.
Change-source: pulse-maintainer
Preserve the exact Core candidate and its retained focused, lifecycle, race, full-alert, monitoring and embedded-build evidence. Non-finite readings remain unknown rather than changing trusted incident state.
Change-source: pulse-maintainer
Repair the deterministic Prettier failure reported by PR2457 run 37185009631 without changing assertions or reviewed source identities.
Contract-Neutral: Test formatting only; runtime and documentation behaviour are unchanged.
Change-source: pulse-maintainer
Preserve malformed timestamp evidence through resource projection and label future, invalid or unusable dates as unknown in existing row indicators, tooltips and drawer protection. Keep explicit absence, configured age thresholds and running activity distinct. Validate real API and canonical snapshot replacements with parent controls and production-component browser fixtures; no native backup or thaw claim.
Change-source: pulse-maintainer
Treat non-finite current observations, authoritative rolling-history samples and overflowing averages as unknown. Preserve trusted incident and notification state instead of opening, recovering or poisoning JSON snapshots. Retain timestamp/duplicate authority, normal finite evaluation and explicit rule disable.
Change-source: pulse-maintainer
Fixes a flaky test in the Frontend job: `credential-free Unix lifecycle
execution > keeps private input out of root/sudo argv, environment,
output and history (uid=1000)` failed on run 37158578995 (PR 2451, a
Go-only change).
**Cause (test harness, not the product).** The history-mode runner types
the install command into an interactive bash, and the tty echoes that
line. The line quotes the prompt text `(paste at this prompt, not in the
command): `. When an output chunk ended inside that quoted text, the
runner's `endswith(prompt)` check matched it and typed the synthetic
token while echo was still on. The failing transcript shows the token
and `exit` echoed straight after the command echo, before bash had
printed `PULSE_TEST$`. The real read then picked up the typed-ahead
token, so the capture still matched and only the no-leak assertion
failed.
The generated command has no echo window: it runs `stty -echo </dev/tty`
before `read -r -s -p` prints the prompt, so the real prompt never
appears while echo is on.
**Fix.** The runner now types input only once the prompt is showing
**and** the stty fixture has recorded the bootstrap's own `stty -echo`.
Nothing else calls `stty -echo`, and readline does not use the stty
binary. At that point the runner also reads the terminal flags. If ECHO
is still on, the run fails with `Bootstrap prompted for the token with
terminal echo enabled`, so a product regression is reported directly
rather than as a timeout.
**Verification (Linux, pulse-dev, Node 24):**
- Forced repro: splitting the command write right after the quoted
prompt text makes the old runner fail all three history-mode tests every
time. With the fix, the same forced split passes.
- Negative control: changing the product to prompt with echo on (`stty
echo` after `stty -echo`, no `read -s`) makes both uid variants and the
slow-input test fail with the new message and the echoed token.
- Whole file passes 3/3. The PTY describe block passes 25/25.
Accept exact Core candidate fcd9b65b82 with retained semantic, allocation, race, monitoring-suite and actual embedded build evidence. Preserve observations and caller isolation; no native performance or release acceptance is asserted.
Change-source: pulse-maintainer
The interactive-history variant types the install command into bash, and
the tty echoes that command line, which quotes the token prompt text. When
an output chunk ended inside that quoted text, the runner treated it as the
prompt and typed the synthetic token while echo was still on, so the no-leak
assertion failed (Frontend job of run 37158578995, PR 2451).
The generated command is not at fault: it runs stty -echo before read -s
prints the prompt, and the failing transcript shows the token echoed before
bash had even shown its own prompt. The runner now types input only after
the stty fixture has recorded the bootstrap's stty -echo, and fails the run
if the terminal still echoes at that moment, so a product regression that
prompts with echo on is reported explicitly instead of being masked.
Contract-Neutral: test harness timing only; no runtime or contract change
Keep canonical guidance aligned with the actual unchanged header and copied member-aware templates. Pin the correction in the same safety guard so a later maintainer does not restore permanent header-only deduplication.
Contract-Neutral: Documentation clarification and its verification only; webhook wire format, retry stability and runtime behaviour are unchanged.
Change-source: pulse-maintainer
Reject mismatched resource, range and metric envelopes and malformed samples at the shared client boundary. Preserve explicit Kubernetes compatibility, real access failures, valid empty history and measured zero. Exercise drawer, single-metric and row-cache consumers, and inspect desktop and phone-emulated browser renders.
Change-source: pulse-maintainer
Normalise Markdown emphasis in the safety guard and observe optional runtime imports instead of requiring an auth call on every browser reload. Assert no other backend activity and preserve all console errors.
Contract-Neutral: Validation fixtures only; product and notification behaviour are unchanged.
Change-source: pulse-maintainer
Model the incidental initial security-status read as first-run state instead of depending on an absent backend. Keep console errors asserted; the receipt is offline Docs rendering, not authentication or notification acceptance.
Contract-Neutral: Browser fixture only; no product, notification or security behaviour changes.
Change-source: pulse-maintainer
Count retained samples before allocating detached snapshots for guest, node, disk and storage readers. Preserve exclusive cutoffs, unordered inputs, original observations and empty arrays. Cover public series, snapshot isolation, connected chart/window consumers and same-executable allocation comparisons; no SQL, retention or source-selection change.
Change-source: pulse-maintainer
Contract-Neutral: In-memory History copy allocation only; public API/JSON shape, sample order/cutoffs, retention and observation authority are unchanged.
The legacy correlation header omits occurrence start, severity and group members. Show receivers the existing full-precision member data, preserve later incidents and severity updates, and test the copyable templates through the actual signed sender. Keep the freshness verifier and runtime wire format unchanged.
Contract-Neutral: Help, executable examples, tests and sender comments only; notification behaviour, schemas and webhook headers are unchanged.
Change-source: pulse-maintainer
Preserve the exact Web candidate and its parent-bound browser receipt; retain the unrelated backup-date timeout and source-proof exit discrepancy as adverse evidence.
Change-source: pulse-maintainer
Accept exact PI candidate b27387d8fc and ancestor ad4fbff6be. Existing help now matches observation-location selection, server-dependent notification delivery, bounded buffering and Mobile retirement. Retain source-_7_dmsnc and inspected desktop/phone-emulated Docs render evidence; no runtime behaviour or native delivery acceptance is claimed.
Contract-Neutral: Integrate existing help, shipped mirrors and their verification without changing runtime, API semantics, entitlement or alert policy.
Change-source: pulse-maintainer
Preserve exact upstream 24723dd642 alongside the clean reviewed canonical tip. This is a bounded batch-start reconciliation; source content is unchanged.
Change-source: pulse-maintainer
Withdraw another target’s service and URL while its replacement is loading or unavailable. Preserve final access status without denied bodies, label same-target transient evidence and offer an in-place retry. Dispose per-guest forms and the replaced discovery consumer without cancelling or repeating server operations. Preserve existing same-target query reuse and independent saved operator URLs. Add connected identity/access regressions, contracts and exact-content desktop/phone browser evidence.
Change-source: pulse-maintainer
Fresh editor and API inspection shows that local and remote paths can coexist, including in published v6.4.5. Explain the actual location picker, per-path uncertainty and safe canonical-versus-legacy update fields, and validate the linked target-field instructions in the Docs renderer.
Contract-Neutral: Documentation, shipped mirrors and guidance verification only; existing observation and API semantics are unchanged.
Change-source: pulse-maintainer
## What changed and why
- Guest filesystem History distinguishes paused/retained readings from
current observations. Incomplete readings stay unavailable rather than
appearing as healthy empty disks; measured zero and known capacity
remain useful. Related to #2439 and #1723.
- Installation help removes the minimal root-server service recipe,
explains the existing hardened installer and distinguishes a missing
unit from a loaded root service. Removal guidance preserves persistent
data by default, explains temporary container storage and Helm claim
ownership, requires a consistent private full-state backup and separates
disabling the service from destructive erasure.
- TrueNAS setup help distinguishes a successful system-information
connection test from collected inventory/metrics and preserves polling
evidence. Passive VM preflight rejects malformed configuration before
concluding that an agent setting or backup lock is absent. Related to
#2382 and #2439.
- The native backup evidence checker requires observed post-task
filesystem and memory reads, not merely fresh-looking timestamps.
- Add an exact-published-RC browser update/recovery workflow with
authenticated archives, reviewed control identity, a dedicated narrow CI
registration, self-only Serve and terminal refusal handling. It is a
qualification route, not a qualification result.
The documentation and filesystem changes address unsafe implications in
existing surfaces; no new product route or feature is added. The browser
route supports the required release update/recovery journey.
## Included source
Range:
`13df84e9038be8017110105186b44f626154a3f6..c0ceff669774cec9f3b71f0bade244133f9949bb`.
All previously reviewed identities and their ancestry are retained:
- TrueNAS candidates `1c999113` / `59a27e2c`, integration `22f16541`,
additive published-main merge `a6b83db5`, passive preflight `adcd0ddf`
(the original PR head).
- Installation candidates `a6959e57` / `01adf338`, integration
`6cf691ec`; data-preserving removal candidate `fa6282b7`, integration
`0f3575bd`.
- Filesystem/History candidates `28bb0fb5` / `81b07e8a`, compositions
`ba8b9fcd` / `5d1b03c1`, integration `53cfdf60`.
- Browser-route candidate sequence `fdf46457`, `619133aa`, `729b2cf7`,
`f0ff1934`, `73b790b8`, `d855d322`, `30ca9681`, `a847b05e`, `2fb4bf9e`,
integration `b42563d9`.
- Backup-resumption checker `1920db3c`, integration `acace4d4`.
- New additive publication correction `c0ceff66` normalizes only
Markdown whitespace and capitalization in the TrueNAS safety assertions.
Every required warning and diagnostic field remains checked;
documentation/runtime content is unchanged by this correction.
## Validation and remaining limits
Recorded reviewed source evidence includes full TypeScript checking, 407
filesystem/UI regressions across fifteen relevant families, production
embedded build and unchanged bundle budgets (`source-bnh7z6xi`); 58
removal-help controls/types/build/budgets (`source-f_l3trzu`); inspected
desktop Chromium and phone-emulated WebKit help and filesystem states;
57 connected browser-route controls/workflow trust (`source-agx1sbr6`);
and nineteen focused backup-checker methods. These remain evidence at
their original source bindings. Publication comparisons confirm
unchanged validated runtime, removal guidance and qualification-route
bytes; the final browser guard covers all four changed frontend runtime
files with their in-range receipts.
Exact final-source offline smoke receipt `source-ljvxb1yx` at
`c0ceff669774cec9f3b71f0bade244133f9949bb` ran 59 families: 57 passed,
two failed; exit 1 with complete output and confirmed guest stop. All
changed smoke families, including the corrected seven TrueNAS tests and
new browser-route controls, passed. The failures concern unchanged
historical Git fingerprints (unavailable objects in the disposable
source input) and an extra synthetic npm-audit invocation. The same
unchanged tests passed in the original hosted PR run and all 21 pass in
a confined lightweight native-Git comparison. The npm observation
remains unresolved with Delivery; the complete VM suite is **not**
reported as a pass or replaced by the comparison.
Publication also verifies provenance, clean committed source, upstream
and starting-reviewed-tip ancestry, matching documentation mirrors and
whitespace. Removing either affected safety warning still fails the
corrected assertion. Sufficient completed frontend/browser proofs were
not repeated just because their changes share this batch.
The original PR's completed run `37175962472` failed required script
smoke on capitalization/line wrapping, now corrected additively. Its
advisory benchmark reported
`HandleMetricsHistory_MemoryFallback/all-metrics` +12.58% (p=0.019, ten
samples). No Go or benchmark source differs between that original head
and its base; this is not a causal diagnosis or a passing measurement.
The adverse result remains with Delivery for independent disposition.
The old head has finished checks and cannot land independently because
of the required smoke failure, so this proposal advances once to include
the coherent reviewed batch and correction, rather than restarting
still-running CI.
Exact-head review and protected checks remain required. Earlier
unexecuted readiness attempts are not reconstructed passes. This source
does not establish native thaw, TrueNAS collection, installed recovery,
a containing release or deployment. The browser route still needs its
dedicated registration/ACL prerequisite and activated dispatcher before
native use; the earlier HTTP401 remains adverse and unreplayed. Release
qualification, soak and promotion remain separate.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Additive follow-on batch and final publication check
The completed exact-head Build and Test run `37179468966` cannot land:
its required rest-1 job rejects the browser workflow's Node `24.20.0`
selector under the existing governed `24` parity contract. Correction
`903dc08d23d4278103950e0df6ed5f7b8fb97760` selects the same `24` line as
other workflows and adds a focused trust regression; no parity
assertion, pinned action, browser tooling, privilege or release gate is
weakened. The old head is terminal, not still validating, so the
proposal advances once with this repair and the coherent reviewed
follow-on source.
Final range:
`13df84e9038be8017110105186b44f626154a3f6..903dc08d23d4278103950e0df6ed5f7b8fb97760`.
Additional accepted identities, preserved unchanged:
- Complete VM-configuration response boundary `227f4f7e` / composition
`f7eeabc4`, integrated by `de081296`: do not admit guest reads from an
incomplete unlocked JSON prefix. Related to #2439.
- Token help `74c35227` / `383be305`, integration `630f45a2`: match
seven least-privilege presets, distinguish prompt exposed-token
revocation from planned rotation, and explain kiosk bearer-link and
per-tab limits.
- Guest workload evidence `23235502`, integration `0e41d8d2`: preserve
existing disk-deferral, guest-agent and lock facts through API and
canonical snapshots, clear obsolete omitted facts only after an explicit
new native outcome, and withdraw unavailable numeric bars while
preserving labelled prior and measured-zero readings. Related to #2439
and #1723.
- Used-memory History retention `0ea87307`, integration `768952fd`:
expire byte samples alongside existing series without deleting
still-live byte-only resource entries. This is not an attribution of
reported process memory growth.
Aggregate reviewed evidence adds `source-hctbddnb` for complete-response
parent/final race controls; `source-n8_u1xm9` for 37 token-help
controls, types/build/budgets, with fixture-only syntax
`source-5ws674f3` and six inspected desktop/phone-emulated captures;
`source-c8k64dn9` for types, 761 tests in eighteen relevant files,
lint/audits/build/budgets, forty browser transitions and six inspected
captures; and `source-0qcd2wj7` for adverse parent omissions, final
retention and connected History readers under race/vet/affected-package
build. These retain their original source bindings. Publication
comparisons confirm final changed Web runtime and Core Go bytes match
those tested candidates, and the final browser guard covers all seven
changed frontend runtime files through their own-parent in-range
receipts. Sufficient compiler, build and visual proofs were not repeated
solely for batching.
Exact final-source offline receipt **`source-1_rh272s`** at
`903dc08d23d4278103950e0df6ed5f7b8fb97760` passes the previously failing
Node parity test under race, selected
guest-agent/backup/History/memory/metric-window families in Proxmox and
monitoring under race, 18 browser-packet/Tailnet controls and 43
workflow-trust controls. Exit 0, complete 11,065-byte output and
completed guest stop; this is focused source proof, not a full-suite or
release qualification claim.
The same old-head run also reports advisory `ReportMarshal_Parallel-4`
+23.25% (p=0.009, ten samples, candidate spread 19%). At that old
proposal head, Go/dependency/build-and-test/benchmark source is
unchanged from its base. This establishes no changed benchmark source,
not a passing measurement or a cause. It remains adverse alongside the
earlier +12.58% History result under the existing Delivery disposition
request. No unchanged retry, threshold relaxation or release clearance
is claimed. The newer retention repair changes Go source, so it is not
covered by that unchanged-source comparison. New exact-head required
checks and independent review must finish before landing.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate remote check execution from server-side alert delivery, explain indeterminate and bounded-buffer behaviour, and link independent watchdog coverage without a permanent Mobile or Relay promise. Preserve the existing probe and notification contracts and verify both shipped guides and their keyboard help paths.
Contract-Neutral: Existing help, its shipped mirrors and verification only; no runtime, entitlement, alert policy or API changes.
Change-source: pulse-maintainer
PR #2456 run 37179468966 failed TestNodeToolchainParity because the new workflow selected a patch version instead of the existing governed Node 24 line. Match the other workflows and add a focused trust regression without weakening the parity contract.
Contract-Neutral: Correct a workflow toolchain selector to the existing repository contract; no application, permission or release gate changes.
Change-source: pulse-maintainer
Accept exact Core candidate 0ea87307e2. Retained source-0qcd2wj7 proves parent omissions, final retention and connected readers under race, vet and affected-package build; intervening canonical changes do not touch the affected Go source.
Change-source: pulse-maintainer
Accept a stable exact Node pin only within the governed major instead of
comparing its entire string with the major selector. Keep all other lines,
ranges and unresolved selectors rejected. This repairs the deterministic
required-check failure on the published-RC browser workflow without removing
its exact Node pin.
Give fake npm audit tests their own default timing controls and exercise
poisoned caller environments while preserving explicit watchdog tests.
No production audit verdict, dependency graph, benchmark threshold or release
gate changes.
Change-source: pulse-maintainer
Periodic guest and node cleanup omitted raw memory-used samples from both expiry and live-entry checks. Trim them with the existing retention and backing-array policy without deleting a still-live byte series. Cover every supported History series, byte-array reclamation, concurrent cleanup and poll-to-chart/metric-window resumption. No SQL retention, source-selection or wire changes.
Change-source: pulse-maintainer
Forward existing disk deferrals, guest-agent state and VM locks through API and canonical snapshots. Supersede omitted optional fields only on an explicit native VM outcome, consistently across full and fast merges. Withdraw unavailable row numerics while preserving valid prior and measured-zero readings. Add connected hook, merge, mounted and inspected browser controls without issuing guest or backup commands.
Change-source: pulse-maintainer
The real scope table contains the 15 selectable UI scopes plus the wildcard row. Count all 16 entries rather than rejecting the correctly rendered reference. The corrected Chromium and phone-emulated WebKit run passes with all six screenshots inspected; shipped documentation and suite-covered source are unchanged.
Contract-Neutral: Browser-test assertion only; no runtime or user-facing contract delta.
Change-source: pulse-maintainer
Correct the existing configuration help against the live preset model and token client: reporting does not include lifecycle authority, exposed credentials need prompt revocation, and kiosk display preferences do not restrict credentials or guarantee persistence. Keep the shipped mirror and add runtime-model-bound documentation controls and browser help validation.
Contract-Neutral: Documentation and test fixtures only; no runtime token, authorization, navigation or delivery contract changes.
Change-source: pulse-maintainer
pulse-triage[bot]