Main appended frontend-primitives notes at the same place this branch did. Taking main's file here lets main merge cleanly. The staleness note is restored right after the merge.
A Docker host whose agent stopped reporting kept showing its last CPU,
memory and disk bars as if they were live, with only an orange dot to
hint otherwise. The tables now read the backend's telemetry_stale
reason: that host's metric cells are dimmed, Uptime shows how long it
has been silent, and its container group header says "No report for 1h".
Health could only carry that reason when nothing outranked it, so a
silent host with an offline alert lost the signal. The verdict still
leads with the alert, and a stale source now adds a trailing
telemetry_stale reason. The first reason, which the state summary
reports, is unchanged.
Grouped by host, the containers table also repeated the host name and
engine on every row, about a quarter of its width. Those columns are
dropped in grouped mode and the group header names the engine once;
flat mode keeps them, and a saved sort on either hidden column no longer
reorders grouped rows.
The overview is where a notification lands, but each active alert was a
tall tinted card with five buttons, every card repeated "Notification
delivery not turned on", and a three-row stats table sat above the list,
so three alerts fit on a 1440x900 screen and about one on a phone.
When delivery is off the overview now says so once, with the shared
paused-delivery banner (overview wording, a link to set up destinations,
Turn on delivery), and rows drop the per-alert line for those global
holds. Alert-specific holds such as cooldown or quiet hours still show.
Rows are compact: severity on a left edge, a locale-aware start age on
the overview's minute clock, Acknowledge, Snooze and Investigate
visible,
and Timeline and monitoring policy behind a More disclosure. A summary
line counts open alerts by severity beside the heading; the override
count, which is configuration, leaves the overview.
The banner copy now comes from the en/de/es catalogs, and with alerts
switched off it no longer claims Pulse is still detecting them (the
destinations tab said the same). The banner title was near invisible
(text-amber-900/25) and is readable again.
Verified in a browser on a mock estate (19 active alerts, delivery not
activated) at 1440x900 and 390x844 dark, in English and German;
More/Timeline/Less exercised. Five alerts now fit above the fold at
1440x900, up from three. Ledger: rcourtman/pulse-pro
FEATURE_REQUESTS.md, Answer-first presentation across platform pages.
The storage table's default priority order compared only the incident
priority, which is zero for almost every record, then broke ties by name
with the sort direction applied, so the default view was reverse
alphabetical: an 89%-full pool sat second and an 85% one twelfth. Rows
with an open alert were tinted with no reason, while the alert engine
already knew "projected to fill in about 4 days" or "over the 85%
limit".
The default order now puts open alerts first by severity, then the
record's incident priority, then usage, with ties reading A to Z under
every sort key. A highlighted row says why in its State cell: "Full in
~3
days" from the forecast alert's metadata, "Over 85% usage limit" for a
threshold alert, otherwise the alert text, in a compact form on phones.
A Ceph pool folded into the storage that mounts it used to drop its
alerts with it, so the surviving row lost the highlight. Consolidation
now carries the folded pools' alert identities onto that row.
Verified in a browser on a mock estate at 1440x900 and 390x844 (receipt
included). Ledger: rcourtman/pulse-pro FEATURE_REQUESTS.md, Answer-first
presentation across platform pages.
The overview change moved the summary line into the active-alerts
section, dropped the override count and gave alert cards a neutral
background with a severity edge. Two guard and coverage tests still
pinned the old stats table placement, the override field and the tinted
card classes, so the Frontend check failed on the pull request.
The storage table's default priority order compared only the incident
priority, which is zero for almost every record, then broke ties by name
with the sort direction applied, so the default view was reverse
alphabetical: an 89%-full pool sat second and an 85% one twelfth. Rows
with an open alert were tinted with no reason, while the alert engine
already knew "projected to fill in about 4 days" or "over the 85% limit".
The default order now puts open alerts first by severity, then the
record's incident priority, then usage, with ties reading A to Z under
every sort key. A highlighted row says why in its State cell: "Full in ~3
days" from the forecast alert's metadata, "Over 85% usage limit" for a
threshold alert, otherwise the alert text, in a compact form on phones.
A Ceph pool folded into the storage that mounts it used to drop its
alerts with it, so the surviving row lost the highlight. Consolidation
now carries the folded pools' alert identities onto that row.
The demo scenario renamed every generated deployment to one of four
curated names and every pod to one of ten, cycling by index. With the
default 14 deployments and 40 pods per cluster the Kubernetes overview
listed checkout-api four times in one namespace, and the curated
pending and crash-looping pods appeared more than once. Kubernetes
itself refuses duplicate names in a namespace, so the public demo
looked broken.
Ten more healthy services fill out the default deployment count, a
numeric suffix keeps any larger count unique, and pods past the curated
story become healthy ReplicaSet-style replicas of the cluster's own
deployments on ready nodes, so each curated failure appears once.
Checked on a mock stack: the Kubernetes overview lists 14 distinct
deployments and every pod name once, with the curated pending pod shown
once. The new test covers the default, 30/60, 0/40 and 15/631 shapes, a
single crash loop across the estate, healthy repeats, ready-node
placement and name stability across a metric refresh.
The overview is where a notification lands, but each active alert was a
tall tinted card with five buttons, every card repeated "Notification
delivery not turned on", and a three-row stats table sat above the list,
so three alerts fit on a 1440x900 screen and about one on a phone.
When delivery is off the overview now says so once, with the shared
paused-delivery banner (overview wording, a link to set up destinations,
Turn on delivery), and rows drop the per-alert line for those global
holds. Alert-specific holds such as cooldown or quiet hours still show.
Rows are compact: severity on a left edge, a locale-aware start age on
the overview's minute clock, Acknowledge, Snooze and Investigate visible,
and Timeline and monitoring policy behind a More disclosure. A summary
line counts open alerts by severity beside the heading; the override
count, which is configuration, leaves the overview.
The banner copy now comes from the en/de/es catalogs, and with alerts
switched off it no longer claims Pulse is still detecting them (the
destinations tab said the same). The banner title was near invisible
(text-amber-900/25) and is readable again.
Phone and narrow workload rows hide the adjacent web link so guest names
stay distinguishable. On a phone that left a saved service reachable
only from the URL field on the drawer's Manage tab, three taps deep and
behind a settings form.
The guest drawer header now carries an Open action whenever a URL is
saved. It is built from the shared `WebInterfaceLink` and the
drawer-header action class, so the service is one tap from the expanded
row with a 44px phone target (32px from the `sm` breakpoint up). Rows
are unchanged: showing the row link at 393px truncated names until
`checkout-web-01` and `checkout-web-02` read the same.
- Renders only for a saved URL. Unsafe or malformed values show the
existing warning, never a link.
- Opening it does not collapse the drawer.
- Adds no fetch, polling or per-row work.
Verified on a private mock stack at 375, 393 and 1280px widths (receipt
`frontend-modern/browser-verification/758aa0a8df357dc4.json`).
`GuestDrawer.test.tsx` covers target and rel, the no-URL and whitespace
cases, the unsafe-URL warning, and that the drawer stays open.
Refs #1556.
On the vSphere overview every ESXi host group header carried a chip
naming the host's first VM (esxi-01.lab.local [etl-batch-01]) where the
cluster belongs. The workload adapter took the cluster from
getPreferredResourceClusterName, which falls back to the resource's own
name. That fallback suits a cluster resource, but a vSphere VM keeps its
cluster in vmware.clusterName, which the helper never reads, so the VM
became its own cluster. Standalone Proxmox guests had the same problem
in their context label.
Workloads now take the cluster only from an explicit source: the vSphere
facet, then the existing explicit helper. The grouping instance keeps
its old fallback chain, so group keys do not move.
Verified in a browser on a mock estate at 1440 and 390 widths; receipt
included.
The demo scenario renamed every generated deployment to one of four
curated names and every pod to one of ten, cycling by index. With the
default 14 deployments and 40 pods per cluster the Kubernetes overview
listed checkout-api four times in one namespace, and the curated
pending and crash-looping pods appeared more than once. Kubernetes
itself refuses duplicate names in a namespace, so the public demo
looked broken.
Ten more healthy services fill out the default deployment count, a
numeric suffix keeps any larger count unique, and pods past the curated
story become healthy ReplicaSet-style replicas of the cluster's own
deployments on ready nodes, so each curated failure appears once.
Contract-Neutral: Mock fixture naming only: demo Kubernetes deployments and pods get unique names; no runtime contract delta.
Phone and narrow workload rows hide the adjacent web link so guest
names stay distinguishable. On a phone that left a saved service
reachable only from the URL field on the drawer's Manage tab, three
taps deep and behind a settings form.
The guest drawer header now carries an Open action whenever a URL is
saved, built from the shared WebInterfaceLink and drawer-header action
class, so the service is one tap from the expanded row with a 44px
phone target. Rows are unchanged: showing the row link at 393px
truncated names until checkout-web-01 and checkout-web-02 read the
same.
Refs #1556.
On the vSphere overview every ESXi host group header carried a chip
naming the host's first VM (esxi-01.lab.local [etl-batch-01]) where the
cluster belongs. The workload adapter took the cluster from
getPreferredResourceClusterName, which falls back to the resource's own
name. That fallback suits a cluster resource, but a vSphere VM keeps its
cluster in vmware.clusterName, which the helper never reads, so the VM
became its own cluster. Standalone Proxmox guests had the same problem
in their context label.
Workloads now take the cluster only from an explicit source: the vSphere
facet, then the existing explicit helper. The grouping instance keeps
its old fallback chain, so group keys do not move.
Contract-Neutral: Behavioral bug fix: workload cluster labels stop falling back to the workload's own name; no contract delta.
## What changed and why
Guest-command and Discovery results now distinguish the actual guest
exit/output from transport success, retain ambiguous or cancelled
execution as a safety deferral, and avoid replacing saved observations
with failed probe evidence. The owning host agent serializes guarded VM
execution and requires terminal guest status before releasing admission.
This responds to the guest-agent safety report without claiming a
reservation shared with backups or native recovery.
Guest-memory presentation preserves the selected source and original
observation time through raw, API and canonical projections. Overview
and History distinguish current, retained, unknown and unavailable
readings instead of calling retained readings live. Pulse's own service
alerts remain separate from monitored resources in Overview, History and
explanation actions.
TrueNAS CORE inventory no longer disappears merely because optional disk
rotation metadata is `"unknown"` or a numeric string. Required-field,
HTTP and malformed-JSON errors remain failures. Complete snapshots and
ordinary polling preserve identities, topology and unknown observations,
recover correctly and remove disabled inventory. Mixed alert decoding
already works and is not presented as a new repair.
Read-only resource metadata helpers avoid full-resource copies while
preserving sensitivity precedence, platform scopes and clone ownership.
Existing MSP diagnostic recipes use private header files, verified HTTPS
and bounded read-only requests. Retained report-intake safety contracts
and their completion records remain aligned with the reviewed source.
## Included reviewed source
Published base `1e56e9ec9f1e22837c87828fbd7f9a2982c663aa` → reviewed tip
`106f1908b3d8ddc9ae94f5e504019fb14aaf283f`: all 33 unpublished commits,
preserving their original identities and ancestry. Additive
reconciliation already includes current main.
Reviewed candidates include:
- Report-intake completion `89b8151f19bdcc1a0ae653b26baf75c0f12d735c`
through `37b271f4fc5e5a7d3797d3e4741a9e0783a4b040`,
`f8c5e98819d986398486bce23ae8c68f8c0898fd` and
`3fe74bf208764295d7a1ae915cd521b6b91d5f1f`, integrated at
`5060e1b6b8bcc7eff8cc68954f778370d0dc6fde`.
- Owning-agent execution and Discovery safeguards
`def087ed90b022043f4edde4a964516e940447c8` through
`8b6513581c8a53842a2db84556b171fa6cd0a0c3`, integrated at
`91816df826f3ce8366b807a129e3337dee9cec6b`; command-evidence completion
`4188c2a9bad3ec78e37bc1a4956e9098a4a46a94` →
`d7ef00f2f28ad1711c52eb12b660fc8db3e0c125`.
- Guest-memory and system-alert presentation: retained scope
`63443e8712dbb6d3866bdc5fce9f2b89c13be51c` →
`813846485825aab066890e00b1c1b13615e59b4f`; completion
`617f72c57f80551706614edbe3323f6b039551dd` →
`c6e1b71cb6b44ae9e067e10a3a83edd594918b11`; memory
`3d846f76d724b1853a3ea58201cfc6eb7e25b084` →
`835f88576f1975b7c98f05468968de6b3d17fa25` →
`dd2f442bac7790bf007ac60b352cdb7debd2a162`, integrated at
`d78f044abb9ffa50e7104867419abe5de9cd9821`.
- MSP guidance `5e6d5af3b53e33c4acb4afb03f5b03609674a894`, integrated at
`f00390f1feb41bac52849548d98143bab2546986`.
- CORE inventory `1ab97537d7d6fbfd781eb998ce89130eb5fa2b01`, metadata
read repair `b0c5eb1a82ad983e5979a1e8bf653a46bae666e3`, and
recovery-fixture completion `c0f5e98d5db585162672038a0622c1862f821403`,
integrated at the final tip.
## Validation
- Reviewed Core `source-tq7h_5do`: full connected suites,
snapshot/ordinary-poll and API controls, focused races/vet, types, real
embed and server/agent builds. Final backend and Go manifests are
byte-identical to that proven candidate.
- Reviewed command/Discovery `source-kakpcr_8` and guard
`source-ylb00ezk` cover connected execution truth and safety deferral
paths. Native QGA acceptance remains separate.
- Reviewed Web `source-5g83wcr_`: 4,240 connected tests, types,
lint/audits, formatting, embed/build and bundle checks; 24 browser cases
and twelve inspected desktop/390px/320px captures. Final frontend
runtime, scripts, manifests and browser-tested files match; final range
browser guard verifies all 15 changed production files against their
parent-bound receipts.
- Reviewed MSP installer/vet `source-e1x7r92a`, scoped docs
`source-oypceg0j`, and Chromium/WebKit rendering are retained; the final
guide, shipped mirror and recipe tests match their candidate.
- Exact final-head publication proof `source-sbsnw11t`: offline npm
installation without lifecycle scripts, types, real frontend build and
bundle budgets pass, with complete output and guest stop. Exact
final-head `source-1mf9ptz6` also passes the full installer suite and
vet, with complete hash-matched output and guest stop.
- Full-range provenance, clean source, whitespace, per-commit
preparation/governance, contract/registry audits and browser guard pass.
The 65 completion-history and release-policy fixture tests pass; an
initial wrong-directory invocation failed imports before execution and
is retained separately. Current main was independently read and needs no
additional merge.
## Remaining outcomes
Parent regressions, earlier fixture/copy-audit failures, adverse hosted
benchmarks and unavailable historical results remain evidence, not
retrospective passes. The ten-pair component study supports lower helper
cost, not hosted benchmark clearance or fleet CPU relief; no favourable
replay was used. Required exact-head CI and independent administrative
review still govern landing.
This is source delivery, not installed or release acceptance. The
guest-agent guard is process-local, does not reserve QGA against backups
and does not retain uncertainty across restart. Native overlap,
independent thaw, fresh writes on every backed-up filesystem, workload
liveness and safe resumption remain required; keep the monitoring-outage
precaution until those are established. CORE appliance acceptance,
matching installed server/agent and containing release evidence also
remain separate. Reporter follow-up will use actual published contents,
not issue links or source inclusion as completion claims.
Related to #2439
Related to #2466
Related to #2199
Related to #2465
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Preserve the exact three reviewed Core commits. Retained source-tq7h_5do proves connected suites, focused races, vet, real embed and builds; synthetic recovery and component cost evidence do not establish native relief or release availability.
Change-source: pulse-maintainer
Reviewed exact PI candidate 5e6d5af3b5. Existing guidance and shipped mirror now use private header files, verified HTTPS and bounded read-only checks. Retain source-e1x7r92a installer/vet, source-oypceg0j docs tests and Chromium/WebKit rendering evidence; no native tenant isolation or publication claim.
Change-source: pulse-maintainer
A zero test deadline reinstates the real connection interval, so it did not make subsequent cycles due. Use a nonzero expired fixture deadline and assert each cycle reaches the disk endpoint; keep production scheduling and failure/recovery assertions unchanged.
Change-source: pulse-maintainer
Release preparation for `v6.5.0-rc.1`, made by the release train
(`pulse-maintainer-ship`). After this merges the train dispatches the
release workflow at this exact head
`c0b3ddf1e586982ed8dc7c1e8722f468fb2e42d4`.
Scope the inherited mounted-drawer disk resumption assertions to disk. Explicitly preserve unknown legacy memory and prove unchanged coordinates retain one History read. This corrects the old all-metric assertion rather than accepting disk freshness as authority for memory.
Contract-Neutral: Test-only refinement for the existing independent memory/disk provenance contract; no runtime, route, API, monitoring policy or permission delta.
Change-source: pulse-maintainer
Replace inline token arguments and certificate bypasses with private header files and verified HTTPS. Bound the read-only probes, discard bodies, preserve failed curl exits and distinguish an invalid token from a checked tenant boundary. Keep the shipped guide byte-synchronised. Exercise copied commands with a synthetic TLS peer, private-header canaries, hostile curl configuration and refusal/redirect controls; no customer endpoint is used.
Contract-Neutral: Existing diagnostic guidance and regression coverage only; no runtime, public API, token scope or tenant-isolation contract change.
Change-source: pulse-maintainer
Preserve the existing authoritative selected-memory annotation through raw, API, unified and canonical frontend projections. Qualify current, last-known, unknown and unavailable drawer context from its own original source/time, not disk deferral or renewed guest LastSeen. Keep retained numbers separate from current legends and stored points, including measured zero, denied history and independent live readings.
Memoize History reads by actual target/range coordinates so same-guest snapshot replacements update without extra reads or chart remounts. Complete connected source controls and owning subsystem contracts; record the inspected 24-case Chromium/WebKit desktop and narrow light/dark proof against this commit's own parent. No route, collector, threshold, retention, permission or native recovery claim.
Change-source: pulse-maintainer
Release candidate cut from main at 2e9404504b. It carries every change merged since stable v6.4.5.
Contract-Neutral: Release-only v6.5.0-rc.1 version, notes and packet metadata generated by pulse-maintainer-release-metadata; no public install or runtime contract changes.
Change-source: pulse-maintainer
Project verified guest status and decoded output instead of qm transport success. Reject ambiguous terminal outcomes without replay; retain known failed or truncated results as failures without inventing uncertainty. Admit only successful stdout to Discovery and preserve saved results when attempted probes yield no evidence. Keep backup precautions, source bounds and native acceptance dependencies unchanged.
Change-source: pulse-maintainer
Add source controls for actual guest exit/output projection, ambiguous terminal receipts, failed probe evidence exclusion, and saved manual/background Discovery through explicit recovery. The fixtures never invoke PVE or QGA.
Contract-Neutral: Test-only regression controls exercise existing command and Discovery boundaries without changing production code, payloads, capabilities or budgets.
Change-source: pulse-maintainer
Exercise original-age and selected-source provenance through both owned projections and mounted History. Pin retained, unavailable and unknown values, same-guest transitions, independent live readings, dated inspection and denied History without starting diagnostics.
Contract-Neutral: Test-only controls for the existing optional guest-memory observation contract. No runtime, route, selection, history or permission change.
Change-source: pulse-maintainer
Replace the synthetic backup-warning semicolon with separate sentences. Keep the exact original reproduction and service-alert runtime ancestry and unchanged production content; complete the previously failed copy audit additively.
Contract-Neutral: Test-fixture punctuation only. No runtime, API, identity, monitoring, notification or frontend contract delta.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate ancestry and compose current assigned main. The previous runtime and synthetic fixture require additive copy-audit completion, not rewritten history.
Change-source: pulse-maintainer
## What changes and why
- Keep backup-age checks fast and make failed or partial evaluations
visible through one existing system warning, without clearing retained
age alerts. Indexed latest-observation reads preserve retention, schema
and the read budget. This responds to the recurring missed checks
reported in #2465; synthetic timing is not proof of relief on the
reporter's Pi.
- Defer guest-agent commands after uncertain HTTP results and require
same-target, unambiguous backup-lock evidence before guest reads. Keep
guest coverage truthful when only remembered versions or a parent-node
assignment exist. Preserve the original observation time/source of
retained memory through existing backend projections. These changes
advance #2439 safety, but do not establish native thaw or recovery.
- Attribute Proxmox backups using native connection/node and unique PBS
namespace evidence, retaining ambiguous artifacts rather than assigning
them by substring or display name. Show unreliable PBS capacity as
Unknown/Unavailable, while retaining valid measured zero and readable
phone warnings.
- Restore existing TrueNAS and VMware connection alerts using the
constructed runtime pollers. This does not resolve the distinct
monitoring cause reported in #2382.
- Keep safe report collection and attachment guidance self-contained,
and make manual backup pause/resumption precautions usable. Repair the
Diagnostics integration journey's outdated controls, download assertions
and session capability, without changing production authorization.
## Included source
Published base `61146105c74a5968d877691e02963c41f8e66076` → exact final
head `af73b0e6c618da83c4fc5e702ba464257481851c`.
The previous proposal head `dcde1d0157d5e3c4cd626d6b920a45016a3f0437`
and all reviewed ancestry remain unchanged. This advances the proposal
once after its workflows completed with demonstrated failures; it does
not interrupt a checking head.
Reviewed candidates include:
- Previous batch: guest HTTP `cd1e3ba12f`, runtime alerts `7f5c8a0cf1`,
safe intake `496ba1e73e`, PBS capacity/render sequence `8f09a59996`
through `d2f7e456b3a`.
- Manual pause `3fd44b8325`; native backup ownership `c5e83ceb3a` /
`6198a3ce22`; authoritative locks `b77e6908e6`; truthful guest coverage
`ba3e2d2c1c` / `8f9a9a6a1e` / `f9f53befbb`.
- Backup evaluation/query `5774b6bc4b` / `7a19a06631`; Diagnostics
sequence `ed168c8d7e` through `a3bbcae0c9`; memory provenance
`abee023634` through `80d8ad0f59`; self-contained intake `7c9922f55d`.
- Starting reviewed canonical tip
`8003a4037bf2e6628d47ca6c7da239a11096168e` is retained. Four additive
publication corrections (`745ddc982a` through `79091f7b03`) supply the
report-form contract, connected docsLinks regression and exact
historical completion pair. The first completion's section placement
failed the checker; its substantive-section correction passes. No
accepted commit was amended or recreated.
## Validation and remaining gates
The previous proposal's completed runs remain adverse: Build/Test
`37204956836` failed the documentation drift assertion; E2E
`37204956824` failed Diagnostics shards 3/6/8 (download/obsolete
Run-control timeouts). These warrant the admitted changed-source
repairs, not an unchanged retry.
Retained reviewed evidence includes guest transport/connected/race/build
(`source-5_ta7via`), runtime alert connected proof (`source-s0xmdftf`),
PBS source/render evidence (`source-_9ekxhcy`), manual-pause
source/render (`source-ifgmfzhw`), all-reader authoritative-lock proof
(`source-41amnzmb`), guest coverage's 1,901 connected tests/full
types/lint/build and inspected Chromium/WebKit desktop/phone renders
(`source-3y6kfagt`), backup recovery/alerts/monitoring/races/vet/real
builds (`source-vc1jlsz9`), and memory
models/unified-resource/alerts/monitoring/races/vet/types/real
embed/build (`source-5swnugj9`). Diagnostics retains nine passing
full-app journeys with matching source hashes; catalogue
`source-cyehgbio` discovers 916 test/project identities, including all
nine Diagnostics cases, but is not runtime acceptance. Intake
`source-stznewur` retains two intended parent failures and passing
policy/documentation/mirror checks.
Publication checks: provenance, clean retained ancestry, per-commit
canonical completion/history, registry/contract audits and final
browser-content coverage (nine changed production frontend files) pass.
Earlier proposal-head (`79091f7b`) offline VM proof `source-1fn6chab`
passes 36 docsLinks tests, formatting, 27 intake cases, 211 public
Markdown checks and 62 mirrors, with complete hash-matched output and
guest stop. Its line-index bound is explicit. Earlier `source-yj300mm2`
passed docsLinks but exited 1 when a browser script was mistakenly
invoked in a source VM without Playwright; no browser result is claimed
from that attempt. Earlier local preparation failures and prior
API/embed limitation remain evidence at their own bindings, not green
aggregate results.
Required exact-head CI must run the complete backend/build/frontend,
audit and protected E2E checks, with independent source review, before
landing. Existing sufficient connected/render proof was not repeated
solely for batching. This is source publication, not release
qualification, deployment, native appliance/guest acceptance or
completion of the linked reports. The containing all-main release, Pi
evaluation/failure/recovery, native backup/thaw/covered writes/liveness,
remaining memory drawer consumption and installed whole-panel/alert
results remain separate.
Related to #2465
Related to #2439
Related to #2382
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Completed workflow reconciliation and additive smoke repair
The starting proposal head `79091f7b0317807fcc76e36cde52c4ee1cc4c928`
and every reviewed commit remain ancestors of this head. Build/Test
`37219920651` has now completed. All backend partitions, frontend,
governance, security and all eight E2E shards/verdict passed, but script
smoke failed two obsolete whole-guide assertions in
`test_vm_disk_diagnostics.py`; backend build was consequently skipped.
The reviewed manual backup precaution deliberately adds six server/timer
examples. The old passive-helper test counted all seven guide examples
and banned `systemctl` throughout the whole guide. This source mismatch
warrants changed-source repair, not an unchanged retry. Additive
test-only `c4a72995c6bf2465a6540a1b546a9dcd732944af` scopes
passive-helper execution to its named section and admits only the exact
six reviewed manual-pause blocks. Its first local run retained one
failure because a shell comment was mistaken for a heading. Additive
`af73b0e6c618da83c4fc5e702ba464257481851c` parses headings only outside
fenced blocks. All 17 diagnostics/safety controls now pass, including
missing/duplicate headings, shell comments and five prohibited-command
mutations. The passive helper still rejects active guest requests and
service mutations. Production and guidance bytes remain unchanged;
mirrored docs and connected intake checks pass. Both failed
correction/control observations remain recorded, not relabelled.
Final publication provenance, clean retained ancestry, additive
contract/registry audits and the unchanged nine-production-file
browser-content coverage pass. Lightweight confined fixture proof
supplies the full 17-case suite; existing heavy/render proof was not
repeated for this test-only delta. This proposal advances only after the
previous head's workflows completed. Exact new-head CI must rerun its
required checks before landing.
The completed advisory benchmark job is also adverse:
`RefreshPlatformScopes` 294.1 → 325.0 ns (+10.51%) and
`ClassifyResourceSensitivity` 67.68 → 77.20 ns (+14.07%), each p=0.000
with ten samples. Their implementation and benchmark source are
unchanged across the batch; that does not prove noise, intentional cost
or lack of regression. Delivery owns a bounded evidence-based
disposition through the existing lane handoff. No favourable repeat,
threshold change or performance/release approval is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned `release/v6.5` line;
- main lacked the published 6.4.4 to 6.4.6 release packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named highlights,
issue numbers, one release's mobile decision) and per-release sentences
in the deployment-installability contract, which changes several times a
day on main.
This maps 6.5 to main, carries the published packets over from
`release/v6.4`, and keeps the packet tests to what the release tooling
generates: version pins, packet pointers, required sections, and the
rollback, signing and mobile sentences.
Checked by preparing 6.5.0-rc.1 and then 6.5.0 on top of this branch
with the release metadata tool: static checks and `go test
./scripts/installtests` pass for both.
Retain both exact completion histories and combine their self-contained safety obligations with the parsed-YAML and connected docsLinks controls. Use the reviewed corrected f8c5e988 completion pair; guards and frontend source remain unchanged.
Change-source: pulse-maintainer
Keep the generic catalogue-error fixture distinct from unknown timed-out guest handoff, and require the existing canceled-VM control to expose a safety deferral without dispatch. The new completion/cancellation parent failures and full-source adverse result remain retained; no production behavior changes in this commit.
Contract-Neutral: Test-only correction records the existing guest cancellation and ordinary-command error contracts without changing production source, APIs, protocol or time budgets.
Change-source: pulse-maintainer
The first publication correction retained the two original defects as history but its heading matcher treated the reviewed shell comment as a boundary. Parse headings only outside fenced blocks, and pin comment, duplicate-heading and missing-heading controls. All 17 passive diagnostics and safety-boundary fixtures now pass; no production or guidance bytes changed.
Change-source: pulse-maintainer
The completed PR smoke job demonstrates two obsolete whole-guide assertions after the reviewed manual backup precaution added six server-control examples. Select the unique passive preflight section for helper execution, constrain planned pause examples exactly, and reject active probes or service operations outside that section. Production code and safe guidance remain unchanged.
Change-source: pulse-maintainer
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned release/v6.5 line;
- main lacked the published 6.4.4 to 6.4.6 packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named
highlights, issue numbers, one release's mobile decision) and the
per-release sentences in the deployment-installability contract,
which changes several times a day on main.
Map 6.5 to main, carry the published packets over from release/v6.4,
and keep the packet tests to what the release tooling generates: version
pins, packet pointers, required sections and the rollback, signing and
mobile sentences.
Contract-Neutral: Release routing and release-packet test scope only; no runtime, install or public contract changes.
Cancellation before dispatch or server-side expiry before a final agent result must not turn optional VM probes into completed fresh evidence or saved metadata fallback. Preserve the original error and stop subsequent probes while the agent retains its independent uncertainty fence.
Contract-Neutral: Completes the existing Discovery unavailable-evidence and cancellation requirements without changing API identity, statuses, protocol, command catalogue, approvals or non-VM execution.
Change-source: pulse-maintainer
The connected suite exposed three public-host success cases that depended on external DNS. Resolve fixture-only public, private, mixed and missing names through in-process DNS responses while exercising the real parser/resolver and all existing SSRF checks; production resolution and its failures are unchanged.
Contract-Neutral: Test-only deterministic DNS fixtures preserve production URL resolution, SSRF address policy, fetch transport and public interfaces.
Change-source: pulse-maintainer
A zero qm CLI exit may return only a handed-off PID or an unverified guest result. Preserve actual CLI output/exit semantics but pause uncertain terminal dictionaries without another QGA command; accept complete canonical termination evidence and keep native thaw acceptance separate.
Change-source: pulse-maintainer
A cancellation before or during postflight config verification must not become an ordinary optional Discovery failure with usable output, especially on the final probe. Preserve fixed safety classification and no-handoff truth on canceled local admission.
Contract-Neutral: Completes the existing cancellation and unavailable-evidence requirements without changing protocol fields, guard version, lock/identity admission, time budgets or command catalogues.
Change-source: pulse-maintainer
Retain nested Docker VM scanner deferral controls without treating that execution-only type as a public Discovery/store identity. Exercise saved/manual/background preservation on canonical VM requests; runtime and API scope are unchanged.
Change-source: pulse-maintainer
Use the exact additive completion that satisfies the unchanged canonical checker. Retain the earlier failed completion and every reviewed commit as history.
Change-source: pulse-maintainer
Correct the completion section placement rejected by the canonical checker and apply the established test formatter. Keep the safety assertions and production source unchanged.
Change-source: pulse-maintainer
Register the exact historical completion pair for governance CI; preserve the intermediate repair and all later accepted source unchanged. Completion checks still require ancestry, substantive contract text and registry-accepted proof.
Change-source: pulse-maintainer
Record the self-contained feedback precautions and a connected docs-link regression so the accepted intermediate form repair has an additive canonical completion. Preserve all final form text, reviewed identities and release gates.
Change-source: pulse-maintainer
The first exact proof established all ten parent no-admission failures and registered-session controls, then stopped on a missing strings import. Complete that import and preserve ordinary hyphenated PVE dictionary keys while keeping duplicate/case-conflicting lock rejection.
Contract-Neutral: Preserves the guest safety protocol and its lock, identity, budget and dispatch requirements; completes compilation and accepts canonical hyphenated config keys.
Change-source: pulse-maintainer
rcourtman