Buffered package logs cannot map the API stress-test failure to resource telemetry. Stream Go events and retain a bounded target lifecycle with distinct event, receipt and resource collection times, while preserving readable output and pipeline failure status. Synthetic decoder and worker tests cover pass, skip, failure and unavailable telemetry; this does not clear historical qualification or authorise a replay.
Change-source: pulse-maintainer
Persistent authenticated WebSockets sent nothing between polls, allowing idle-timeout appliances to discard them before the next refresh. Send bounded control pings for each authenticated session and stop the sender on disposal without treating pongs as fresh inventory.
Successful refreshes also added a full interval after completion. Target start-to-start cadence while preserving up to five seconds of minimum idle time, unchanged failure backoff and honest completion timestamps. Authenticated idle-timeout and cadence regressions failed before the repairs; focused transport and poller race tests pass. Addresses the reproduced paths in #1893, not native appliance or reporter confirmation.
Change-source: pulse-maintainer
The queue and health API expose server_error, but the delivery UI treated it as unclassified. Preserve that diagnosis and direct operators to service availability and server logs before retrying retained deliveries. Add focused label and health guidance regression coverage.
Change-source: pulse-maintainer
Give users a public account of beta, RC and stable expectations so they can
choose an update channel and understand how releases earn promotion.
Document fixed candidates, observation periods and rollback guidance, with
links from the main documentation entry points and matching shipped docs.
Webhook transport already retries HTTP 421, 423 and 425, but shared classification marked them terminal and discarded the remaining queue retry budget. Align these exceptions with retryable connectivity or receiver failure classes. A synthetic 400-599 transport matrix reproduces the three mismatches and verifies permanent rejections remain terminal without starting storage workers.
Change-source: pulse-maintainer
A truncated diagnostic body currently erases a received HTTP rejection, causing terminal failures such as 403 to consume extra delivery attempts and report a connectivity class. Preserve the HTTP verdict and wrapped read error so existing retry rules still apply. Transport-only regressions reproduce the extra attempt, verify transient recovery and retain successful-response read-error behaviour.
Change-source: pulse-maintainer
The reload watcher exits with the parent context, so unconditional request and reply waits could strand callers during shutdown. Select on that same context at both waits and reject calls before Start; retain buffered completion for an in-flight reload.
Channel-only regression fixtures reproduce the old hang and verify cancellation, late completion and unchanged result propagation without starting monitors or storage. Update the monitoring contract with the bounded lifecycle guarantee and its limits.
Change-source: pulse-maintainer
Recovery handlers retained the startup monitor after router reload, unlike normal notification handlers. Stopping that monitor cleared its queue and left Retry/Dismiss returning 503 even when the replacement notifier was available. Refresh the stable handler in both replacement paths and synchronise its owner reads. Add stopped-owner regression, concurrent replacement and scope proofs; keep queue persistence semantics unchanged.
Change-source: pulse-maintainer
The JSON mirror fast path avoided file replacement but still dirtied directory metadata on every save through chmod. Check the current permissions before repairing them, retaining correction of unsafe modes. A Linux regression reproduces the ctime change and verifies unchanged metadata and permission repair. This is a narrow contributor to #1966, not a claim that aggregate write amplification is resolved.
Change-source: pulse-maintainer
Verify saved email and HTTP Apprise receiver configuration through the real constructor alongside routing intent, without transport calls or reapplying setters.
Change-source: pulse-maintainer
Exercise the production monitor constructor twice from persisted routing, resolve, activation and webhook filtering choices without reapplying notification setters. Document that constructor restoration does not establish browser saving, process restart or destination delivery.
Change-source: pulse-maintainer
HTTP 503 can advertise a recovery delay through Retry-After, but the transport previously ignored it and retried after the default second. Use the existing bounded parser for 503 as well as 429 without changing retry budgets or terminal-error classification. Add request-spacing coverage for valid and malformed 503 hints and both zero-hint status sequences. The valid 503 test fails before the repair (1.0005s versus 2s); focused race tests pass three times. This longstanding interoperability repair is main-only, not a release-candidate regression backport.
Change-source: pulse-maintainer
Align the public transparency page and shipped copy with the standing
publication and issue-reply grant. Keep ownership, qualification and
verification responsibilities explicit.
The default-branch schedule rejected main before any product checks. Resolve the governed branch to one commit, check its VERSION against policy and retain exact event-source checks for manual dispatches. Report workflow and tested source separately and exercise selection against local Git fixtures in governance CI.
Change-source: pulse-maintainer
The renewed #1126 report shows seven-day alerts beside 33/34-day globals. Cover absent, sparse and preexisting divergent overrides through JSON decoding and evaluation so a global screenshot is not mistaken for effective guest configuration. Clarify that differing persisted values do not prove user intent; preserving them avoids silently deleting deliberate overrides. This reproduces a possible configuration path, not the reporter environment.
Change-source: pulse-maintainer
Incoming webhook destinations can repeatedly return 429. Cover exhaustion for explicit and default retry budgets so response hints cannot reset the attempt ceiling or misreport failed delivery history. Verify each attempt preserves payload and event identity. Correct the transport comment's off-by-one ceiling and remove its delivery guarantee; runtime behaviour is unchanged.
Change-source: pulse-maintainer
Validate the decoded URL path so encoded fail/start/log suffixes cannot pass the existing success-endpoint guard. Cover encoded separators, valid base URLs, and runtime rejection without transport or token disclosure.
Change-source: pulse-maintainer
Incorporate protected PR #1973 while preserving every reviewed local alert and notification commit in history. Reconcile its failed-read state with per-request ownership and retain exact combined browser evidence.
Change-source: pulse-maintainer
Record the landed implementation, passing final CI and exact local proof.
Retain the original benchmark failure and API timeouts, and keep model
reliability and independent-environment readiness limits explicit.
Refs #1782
PR #1973 introduced resource incident error state independently of the request lifecycle repair. Reconcile its state with this branch's ownership guards so superseded or disposed reads cannot report a false current failure. Reset clears errors and retry preserves cached history while clearing the failure indicator.
Extend lifecycle assertions for error ownership, retry and superseded success after a current failure. Focused incident hook and panel tests pass: 3 files, 17 tests. Full merged UI browser acceptance remains separate.
Change-source: pulse-maintainer
A zero Retry-After on a rate-limited response reset the exponential schedule to zero, causing subsequent transient failures to consume retries immediately. Apply the response delay only to its own wait and retain the normal schedule for later failures. Local HTTP regressions cover both a subsequent 503 and a headerless 429; focused retry tests pass with the race detector over three repetitions.
Change-source: pulse-maintainer
Invalidate pending reads on reset and disposal, and gate success, failure and loading writes per resource. Convert the four reproductions to ordinary tests and retain reset/reopen and stale-failure controls. Qualify the real hook and panel with 14 Chromium lifecycle cases; register that exact browser surface proof without broadening path policies. This does not qualify installed delivery or PR1973's absent error accessor.
Change-source: pulse-maintainer
Filter canonical history before selecting occurrences, preserve source evidence
and expose bounded reads and failures. Reconcile duplicate saved shells without
splitting one alert lifecycle, and keep note identity and canonical risk intact.
Carry attributed operator notes into Assistant. Preserve mobile investigations
across layout changes, transfer composer focus on handoff and keep long event
text readable. Record scoped qualification and its unresolved wider limits.
Refs #1782
Issue #1966 reports excessive idle writes. Canonicalise complete alert records and compare bounded existing bytes before replacing a secure regular recovery mirror. Preserve changed-state writes, missing/corrupt-file repair, failed-write retries and the directory durability barrier.
JSON-only regression failed before the repair and passes with repeated race coverage; existing load/save identity and permission tests pass. This is not a total disk-write measurement or a request to widen the selected beta.
Change-source: pulse-maintainer
Retain unordered and subsecond recurrence boundaries through incident-store reconstruction; assert unchanged projected identity and zero checkpoint replacements after replay. Canonical events remain in memory, with no durable event-store or installed write-rate claim.
Change-source: pulse-maintainer
A canonical snapshot can omit memory after the producer marks its Proxmox
facet unavailable. Retaining the previous display metric hides withdrawal
and leaves a stale percentage visible. Clear that explicit transition in
full and fast merges and emit the corresponding store operation, preserving
ordinary partial omission and trusted canonical metrics including zero.
Pin withdrawal and recovery with adapter tests and desktop/narrow Chromium
acceptance. Workload details remain canonical-only; do not invent raw totals
or Usage UI. Record inspected screenshots and matching subsystem contracts.
Change-source: pulse-maintainer
The real monitoring lifecycle dispatcher reproduces a closed incident reopening when its next occurrence fires: canonical projection selected all later events for the same alert. Bound retained-shell projections to their exact start and the next retained start, keeping subsecond recurrence and historical acknowledgement separate. Add in-memory callback coverage with both projections attached; twenty race repetitions pass along with focused incident tests. No retention migration, canonical-only fallback rewrite, notification-delivery claim or aggregate write-byte claim.
Change-source: pulse-maintainer
Issue #1966 reports distinct incident IDs for one occurrence. Deterministic lifecycle replay creates eleven shells for one resolved start, including after JSON restart; open-only matching also lets an old resolution close a newer occurrence. Match exact lifecycle starts and retain closed identity on replay, without changing legacy zero-start matching or retention. Add recurrence, restart and canonical-shell regression coverage; focused incident race tests pass for twenty repetitions. This does not establish total write savings or migrate existing duplicates.
Change-source: pulse-maintainer
Backfill could save a stale List snapshot after manual discovery repaired a service, restoring unknown identity and dropping its URL and engine version. Derive and persist missing suggestions from the current record under the store lock instead, without holding it across monitor reads.
Add a deterministic SetReadState/manual-refresh interleaving and encrypted restart assertions, plus coverage for current identity, dismissed proposals, deletion and persistence failure. The discovery package passes twenty race-enabled repetitions.
Change-source: pulse-maintainer
Repeated alert lifecycle evaluations retain one occurrence but still replace the whole incident file. Compare bounded existing bytes before replacement, preserving changed-state saves and retry after failure or file loss.
Focused regression reproduced 21 replacements for one initial save plus 20 unchanged evaluations before the fix. Repeated race-enabled incident tests cover unchanged checkpoints, metadata, restart, resolution, recurrence and failed-write retry. This does not establish the cause of all writes or duplicate incidents reported in #1966.
Change-source: pulse-maintainer
Incorporate the protected release-snapshot workflow landing while preserving every reviewed maintenance commit and the additive governance correction in local history.
Change-source: pulse-maintainer
# Conflicts:
# docs/release-control/v6/internal/subsystems/deployment-installability.md
Read agent-owned memory and source freshness from VM views when correlation removes the standalone host row. Preserve preferred guest memory sources and reject stale, offline or unavailable agent evidence. Reproduce issue #1962 through registry merge, next-poll diagnostics, card projection and memory alerts.
Change-source: pulse-maintainer
Continuous development must not change the source of an admitted release.
Allow the workflow to run at the qualified preparation PR head after its
normal merge, verifying exact source and workflow identity, canonical PR
provenance, and ancestry in the governed release line. Later branch commits
remain outside that release. Document the immutable-candidate contract and
verify source workflow compatibility before qualification.
Validation: snapshot identity and workflow contract tests passed, including
wrong-head, wrong-base, fork, unmerged and unbound dispatch rejection. The
existing release workflow promotion policy test also passed.
Incorporate the landed Patrol qualification record while preserving every reviewed alert recovery, credential-redaction and release-evidence commit and its ancestry.
Change-source: pulse-maintainer
Incorporate the landed Patrol planning work while preserving every reviewed alert recovery, credential-redaction and release-evidence commit and its ancestry.
Change-source: pulse-maintainer
# Conflicts:
# docs/release-control/v6/internal/subsystems/agent-lifecycle.md
# docs/release-control/v6/internal/subsystems/api-contracts.md
# docs/release-control/v6/internal/subsystems/storage-recovery.md
# frontend-modern/browser-verification.json
Reconcile the executable plan with the merged implementation and exact
qualification evidence. Keep the independent-environment rollout gate open
and preserve failed attempts, measurement limits and provider refusal.
Preserve the requested reservation for independent release snapshot work.
Refs #1782
Literal-only query matching and the separate resolved ntfy transport caller leaked recognised URL credentials. Decode each query name once and project ntfy transport errors before logging or returning them, without changing destinations or error causes. Add synthetic sink-matrix and HTTP projection regressions plus the bounded notification contract in this commit.
Change-source: pulse-maintainer
Pin useful diagnostic context and credential masking at the HTTP boundary, and document the API, agent and retained-history boundaries omitted from a2dbb27. This supplement must be packaged with that source commit for per-commit governance; it does not clear the historical hosted failure.
Change-source: pulse-maintainer
Normalize whitespace in required wiring snippets so gofmt alignment changes
do not fail the model-only handoff contract. Preserve the same required
identifiers and forbidden adapter checks.
Refs #1782
PR #1959 exposed that the URL-only redactor was called with a complete delivery error, causing safe but unhelpful replacement of the whole diagnostic. Redact embedded webhook URLs separately so credentials stay masked and non-secret failure context remains available; malformed URLs continue to fail closed.
Change-source: pulse-maintainer
pulse-triage[bot]