The connected suite exposed three public-host success cases that depended on external DNS. Resolve fixture-only public, private, mixed and missing names through in-process DNS responses while exercising the real parser/resolver and all existing SSRF checks; production resolution and its failures are unchanged.
Contract-Neutral: Test-only deterministic DNS fixtures preserve production URL resolution, SSRF address policy, fetch transport and public interfaces.
Change-source: pulse-maintainer
A zero qm CLI exit may return only a handed-off PID or an unverified guest result. Preserve actual CLI output/exit semantics but pause uncertain terminal dictionaries without another QGA command; accept complete canonical termination evidence and keep native thaw acceptance separate.
Change-source: pulse-maintainer
A cancellation before or during postflight config verification must not become an ordinary optional Discovery failure with usable output, especially on the final probe. Preserve fixed safety classification and no-handoff truth on canceled local admission.
Contract-Neutral: Completes the existing cancellation and unavailable-evidence requirements without changing protocol fields, guard version, lock/identity admission, time budgets or command catalogues.
Change-source: pulse-maintainer
Retain nested Docker VM scanner deferral controls without treating that execution-only type as a public Discovery/store identity. Exercise saved/manual/background preservation on canonical VM requests; runtime and API scope are unchanged.
Change-source: pulse-maintainer
The first exact proof established all ten parent no-admission failures and registered-session controls, then stopped on a missing strings import. Complete that import and preserve ordinary hyphenated PVE dictionary keys while keeping duplicate/case-conflicting lock rejection.
Contract-Neutral: Preserves the guest safety protocol and its lock, identity, budget and dispatch requirements; completes compilation and accepts canonical hyphenated config keys.
Change-source: pulse-maintainer
Require local current-node lock evidence and registered guard support before QGA execution. Serialise VM probes, stop on deferral, retain actual in-flight outcomes and saved Discovery evidence, and pause uncertain completion without replay. Config checks do not reserve QGA or prove native thaw; the existing backup monitoring-outage precaution remains.
Change-source: pulse-maintainer
Approvals and trusted Discovery commands currently cross QGA handoff without evidence of a local unlocked guest. Assert explicit no-handoff deferral without contacting a native target.
Change-source: pulse-maintainer
Preserve exact 7c9922f55d history. Resolve the two form-link overlaps to its reviewed self-contained text, retaining every safety/privacy warning and all fields. Source-stznewur proves the intake and documentation contracts; catalogue proof is discovery, not runtime acceptance.
Change-source: pulse-maintainer
Correct the report-form branch-tip documentation links rejected by PR2463 script smoke tests. Pin both links to the retained reviewed troubleshooting guide and keep its safe-collection fragment and all reporting guidance unchanged.
Change-source: pulse-maintainer
An online source status without a valid original receipt time cannot assert current memory freshness. Preserve its numeric availability and existing selection while omitting unknown/future time; cover both cases at the linked view. Remove the stray adapter-test comment copied during test relocation.
Contract-Neutral: Completes the optional memory-observation semantics and wire shape documented with 43ccc6c39a; no new contract or selection delta.
Change-source: pulse-maintainer
Expose current, last-known and unavailable memory through raw guest and selected unified metrics without renewing QGA evidence during repeated backup deferrals. Preserve independent PVE/linked-agent source times, numeric selection, History and alert policy. Annotate selected metrics as well as raw facets so cross-source fallback cannot inherit another source freshness. Add connected observation, source ownership, clone and wire controls and update the shared subsystem contracts.
Change-source: pulse-maintainer
The first control panicked at an uninitialised synthetic Monitor map before reaching the provenance assertions. Supply the same map as production and retain that failed attempt without claiming a product regression.
Change-source: pulse-maintainer
Remove the redundant main-branch troubleshooting links from both report forms while retaining live-collection precautions and local attachment privacy review. Regression controls reject branch-tip guidance without weakening the repository drift guard.
Contract-Neutral: Report form guidance and its safety regressions only; diagnostic runtime, public API, and installation contracts are unchanged.
Change-source: pulse-maintainer
Exercise normal cache reads, repeated backup deferrals, expired evidence, source-independent PVE memory and resumption through the shared guest builder and real unified broadcast conversion. These are synthetic monitoring controls, not native thaw acceptance.
Change-source: pulse-maintainer
Preserve exact Web candidate f9f53befbb with retained connected source and browser proof. Current backend lock evidence remains intact; no native recovery or delivery claim.
Change-source: pulse-maintainer
The runtime preserves canonical backup inventory scope in recovery_rollups.go; update the existing ownership guard to follow that call and require both PVE/PBS callers rather than the former duplicated literal.
Change-source: pulse-maintainer
For #2465, select latest provider evidence with the existing scope index
rather than ranking every retained payload. Preserve history and evidence
validation. Share complete, failure-preserving backup alert evaluation
across PVE/PBS/mock polls and expose unavailable reads through the existing
deduplicated system warning; keep existing age alerts until a complete read.
Contract-Neutral: Application query and existing system-alert behaviour only; no API, schema, resource identity, agent lifecycle, entitlement or notification contract shape changes. The new warning uses the existing open system-alert type, identity and metadata contract. Semantic contracts and connected verification are included.
Change-source: pulse-maintainer
Correct the two TypeScript narrowing errors observed after 1,901 connected tests passed. Recheck the corrected runtime bytes in Chromium and WebKit, with isolated fixture WebSocket traffic, and retain the original failed full proof.
Contract-Neutral: Complete VM-only type narrowing and typed regressions; no rendering, API or public contract delta.
Change-source: pulse-maintainer
The complete browser failure reached Settings but correctly excluded Diagnostics because its offline session omitted diagnosticsRead. Supply that fixture capability without changing production access checks or authentication.
Contract-Neutral: Offline browser fixture only; no production authorization change.
Change-source: pulse-maintainer
Capture final rendered state on every desktop and phone case, plus disabled exports during refresh. Bound the offline driver to leave time for owned teardown and retain its runner identity without retries or broader production claims.
Contract-Neutral: Integration proof capture only; production behavior and API contracts unchanged.
Change-source: pulse-maintainer
Compose the explicitly retained three-commit test candidate additively with current guest safety work. Production safeguards and unrelated integration type failures remain unchanged; final browser and exact-source acceptance follow.
Contract-Neutral: Test-only candidate restoration; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Distinguish observed agent metadata, assigned parent-node actions and current Proxmox guest-read state. Keep a visible backup/uncertain-completion precaution across drawer tabs, with existing guidance and independent thaw/covered-write limits. Do not start a diagnostic, infer memory provenance or claim native recovery.
Record state/replacement regressions, connected production-component browser proof and matching frontend/performance contracts.
Change-source: pulse-maintainer
Preserve exact Core candidate b77e6908e6. Retained source-41amnzmb covers all readers, connected continuity, full affected suites, races and embedded builds; canonical changes since its parent are frontend-only and non-overlapping. This integration is source safety, not native thaw or delivered release evidence.
Change-source: pulse-maintainer
Exercise explicit guest-agent states alongside old version metadata, parent action ownership and same-guest replacement. Require visible backup precautions across drawer tabs without running a guest check.
Contract-Neutral: Regression tests only; no runtime or public contract change.
Change-source: pulse-maintainer
Guest lock verification used ordinary redirect-following config reads and last-key-wins JSON decoding. Refuse redirected or ambiguous lock evidence before dispatch and after a complete guest response, without changing ordinary config redirects, pooled TLS policy or session recovery. Cover all six readers and connected cache/History continuity and fresh resumption; this source hardening does not establish native backup thaw.
Change-source: pulse-maintainer
Replace order-dependent substring and display-name attribution with exact PVE connection/native-node ownership and unique PBS namespace matching. Preserve ambiguous artifacts in distinct source-scoped, IDREF-safe rows and explain unmatched evidence without claiming that the guest was deleted. Keep migrated backups, independent server posture and unique-VMID PBS compatibility. Include connected controls, dependent contracts and inspected desktop/phone browser proof.
Change-source: pulse-maintainer
The full-export response includes populated identity arrays, so its route fixture must not inherit the empty response's never-array inference. Keep both payload shapes type-checked without suppressing compiler diagnostics.
Contract-Neutral: Integration fixture typing only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
The locked TypeScript compiler rejects the removed node10 resolution mode before checking any integration tests. Use bundler resolution for the extensionless imports transpiled by Playwright, without changing test runtime or product behaviour.
Contract-Neutral: Test tooling only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
Retain exact Core candidate 3fd44b8325 alongside published guest-memory repairs. Reviewed source-ifgmfzhw and exact built desktop/phone render proof cover the unchanged documentation and test content; no native thaw or installed recovery claim.
Change-source: pulse-maintainer
Replace obsolete exact selectors with the existing accessible privacy controls. Exercise full and review-first file contents, identity redaction and joins, displayed-result-only downloads, keyboard and viewport access, and failed-refresh retention in the real integration spec. Add an offline full-app driver with explicit synthetic bootstrap boundaries.
Contract-Neutral: Integration verification only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
Explain the manual systemd precaution inside the Pulse server LXC, including update timer and in-flight installer checks, stopped-state readback, independent covered-filesystem write checks before restart, and restoration of prior service states. Keep native thaw, recovery and release availability explicitly unproved.
Contract-Neutral: Document existing service controls and safety limits; no runtime, route, API, persistence, permissions or release-gate changes.
Change-source: pulse-maintainer
Repeated backup locks could drop a VM’s memory reading after the first
deferred poll. Preserve the complete last-known value while the original
successful guest-agent cache still supports its identity, values and
age. Retained values stay labelled previous-snapshot and do not renew
the cache timestamp or memory History; fresh polling replaces them after
unlock.
Validation:
- Eight consecutive locked polls after ordinary cache expiry through the
unified resource read-view path, followed by fresh recovery.
- Original-evidence guards for age, source, identity, capacity and
measured zero usage.
- Full monitoring and Proxmox package tests, focused race tests, and
repository commit hooks passed.
This fixes memory retention during backup deferrals. The original native
HAOS freeze race still requires separate qualification.
Preserve the exact Web candidate and final-content browser receipts. Retain both Diagnostics and PBS contract sections in the documentation-only conflict resolution.
Change-source: pulse-maintainer
Retain the complete last-known memory value from the scoped guest snapshot only while the original successful QGA cache supports its values and age. Keep deferrals labelled previous-snapshot without renewing cache timestamps or memory History.
Exercise repeated locks after ordinary cache expiry through unified resource views, with provenance, identity, capacity and expiration controls plus fresh unlocked resumption. Native freeze-race qualification remains separate.
Preserve the reviewed HTTP completion guard alongside the published single-attempt transport and Diagnostics protections.
Change-source: pulse-maintainer
Bind the final production content to six completed Chromium/WebKit direct and canonical controls, with inspected 1365px, 390px and 320px screens, mounted replacements and safe error notices. Retain earlier failed executions separately.
Change-source: pulse-maintainer
Install the default monitor's snapshot callback after both platform pollers exist. Settings already observes their runtime owners; alert checks must not retain startup's nil pointers. Exercise actual saved connections, loopback failures, ledger, monitor confirmation ticks, disable and ordinary scheduled inventory recovery without changing policy or adding a surface.
Contract-Neutral: Restore existing connection-alert wiring; no route, payload, authentication, persistence or detector-policy changes.
Change-source: pulse-maintainer
Name the component-specific fault-admission accessor explicitly instead of shadowing the generic adapter capacity helper. The shared snapshot constructor does not decide this read-evidence policy. Keep the audit and all display semantics unchanged.
Change-source: pulse-maintainer
Contract-Neutral: Names a component-specific datastore read-evidence accessor distinctly from the shared capacity-snapshot adapter; no behaviour, input, wire or public-contract delta.
Report entry still treated sanitized exports as sufficient and named an obsolete Diagnostics action. Warn before live collection during backups or an unresponsive host, reuse displayed results, and require local privacy review of files, screenshots and echoed errors without adding intake requirements.
Contract-Neutral: Community intake guidance only; release, installation and diagnostic runtime contracts are unchanged.
Change-source: pulse-maintainer
Supply the existing required resource display names without changing rendered labels. Bind the six completed desktop and touch context controls to the exact production content, retaining the earlier adverse init and load observations.
Change-source: pulse-maintainer
## What changed and why
This maintenance batch makes existing Diagnostics collection and sharing
safer and prevents Proxmox guest-agent commands from being silently
repeated by HTTP transport recovery.
- Guest-agent commands use a separate, single-use HTTP/1 connection with
the configured TLS, proxy, dial and timeout policy. Lost replies are not
transparently replayed, redirects are not followed, and uncertain
results preserve the existing cooldown and last-known monitoring data.
Ordinary API connection pooling and recovery remain unchanged.
- Sanitised Diagnostics downloads redact current token-usage, snapshot,
nested guest and disk identities while retaining measurements and
diagnostic joins. The full download is unchanged. Accessible guidance
distinguishes live checks from local downloads, explains
backup/freeze/thaw risks, and requires manual privacy review before
sharing. The shipped Troubleshooting guide matches the controls.
- The measured Diagnostics lazy-chunk baseline increases from 6,009 to
7,245 gzip bytes for these privacy and safety controls; growth limits,
other baselines, total budgets and startup checks are unchanged.
Related to #2439. This transport correction and collection guidance do
not establish the reported freeze's cause, native thaw or installed
recovery. Sanitisation is not a guarantee that arbitrary text or future
fields are safe to publish.
## Included source
Complete unpublished range:
`1548050727d75814d398a956c2934303b94a0276..79d54eb96f8bde6ae2880b0ff706d6d52e9d0dc3`
(nine commits including additive integration merges).
Reviewed candidates:
- Core:
`8fd6d3c71f363495cb8644953fa4673e5c96e55a..076a4ff94fe447adea787a5d97698fa57bc1d735`,
integrated by `3e31f38f35e956307253b91511cc21cacab5cd56`.
- Diagnostics:
`1ff46c4261e11b4a8edcd573df415a217ecd34cd..ea490f6503d93d6f27440fd2d83b7c30b42da17d`,
integrated by `79d54eb96f8bde6ae2880b0ff706d6d52e9d0dc3`. Implementation
`5cd4b4439042ed9be54773d2bc6dd37c20d9e96c` includes connected fixture,
copy and measured-budget corrections.
All reviewed identities are preserved; published upstream is already an
ancestor.
## Validation
- Exact combined-head offline proof `source-zewnlr8w`: 348 tests across
12 connected Diagnostics/Docs and upstream backup-date suites,
type-check, production build and bundle checks passed. Raw output
collection and guest cleanup completed; marker line-bound limits and
readiness/package/Vite warnings remain recorded.
- Recorded Core proof `source-bej9pci0`: 67 focused leaves, full
Proxmox/TLS suites, connected monitoring controls, focused races, vet
and embedded builds passed. The corresponding tested Proxmox and
monitoring subtrees are byte-identical at this proposal head. Parent
wire proof retained 42 failures reproducing replay/redirect contact with
ordinary recovery controls passing.
- Recorded Diagnostics proof `source-3jjdrd_5`: 200 connected
Diagnostics/Docs tests, full type-check, lint, format, build and bundle
checks passed. Parent comparison retained five privacy failures and two
passing controls. Earlier fixture/type/copy and historical-budget
failures are retained, not counted as passes.
- Recorded production-component browser proof: Chromium desktop and
WebKit phone emulation, 14 behavioural groups, ten inspected screens,
real local JSON downloads, accessible warnings and actual Docs
navigation. Final content hashes and own-parent browser receipts match
this proposal. Emulation is not native iOS acceptance.
- Publication-head provenance, whitespace checks, own-parent canonical
guards using the existing punctuation-only neutral trailer, final
browser bindings, public registry/contracts, status and control-plane
audits passed.
Required exact-head CI and independent review still apply before
landing. This PR publishes source maintenance, not a release or native
recovery acceptance.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain the exact reviewed Core candidate and its source-5_ta7via proof. Defer further guest reads after ambiguous HTTP failures without claiming native freeze or thaw acceptance.
Change-source: pulse-maintainer
pulse-triage[bot]