Retained full-suite proof reports an inherited agent-cooldown before the invalid-UTF8 lock case dispatches any command. Give each synthetic case a distinct base path, keeping all clients in that case on its shared key. A same-listener control retains the prior uncertainty fence unchanged. No runtime guest guard, native target or assertion is weakened.
Change-source: pulse-maintainer
The retained 277ec211 source proof times out on a correctly retained target, with injected requests zero and its pin unchanged. This test owns routing and trust, not a latency SLO. Use explicit five-second client and ten-second caller fixture bounds, record elapsed work, and retain every routing/pin/guest assertion. Runtime timeouts and timeout controls are unchanged; the original failed receipt remains adverse evidence, not a diagnosed host fault.
Change-source: pulse-maintainer
Preserve contradictory rows before monitoring constructs its endpoint trust map. A final matching row must not mask earlier disagreement during saved-view consolidation. Cover both merge orders and retain the existing agreeing-format path; strengthen lifecycle configuration ownership checks.
Change-source: pulse-maintainer
Carry exact duplicate-row conflicts into owned client trust before map deduplication. Keep unresolved saved trust through initialization, missing-client retry and topology refresh without replacing pins or stopping trusted siblings. Cover actual monitor lifecycle routes and member projections alongside client TLS controls.
Change-source: pulse-maintainer
Resolve all saved pins for an endpoint before credential-bearing construction. Contradictory trust is an explicit failure, not a missing-pin fallback or first-use opportunity. Preserve independent authorities, agreeing formats and saved configuration; prove zero provider work, sibling monitoring and normal reload through the member projection.
Change-source: pulse-maintainer
Preserve exact Delivery commit 8d8a1790ad and composition ancestry. Retained source qualification supports service-state and running-executable admission; raw output equality and installed recovery remain unverified. Infra tip is already canonical ancestry.
Change-source: pulse-maintainer
Preserve reviewed tip 11e0946999 and incorporate exact current upstream 59ed65739c additively. Publication remains subject to combined-source validation and outstanding exact-head check repairs.
Change-source: pulse-maintainer
A History reply carries its source: the history store, readings Pulse
holds in memory because the store has none for the range, or a lone
current reading when no history exists yet. The drawer readout ignored
it and always said "Latest stored", so memory and live readings were
presented as stored history. The canvas charts did badge the source, but
as "Buffer" and "Live", words a reader has no reason to know.
One shared vocabulary now covers both. Stored history (and demo data)
keeps "Latest stored" / "Stored". Memory readings read "Latest recorded"
/ "Recorded", with one line above the drawer charts saying the store has
none for this range yet, and a "Recent only" badge on canvas charts. A
lone current reading reads "Current", badged "Current only".
The drawer charts gained a min-max band (#2917) and a phone fold
(#2923); the storage disk and pool charts, drawn by the canvas
HistoryChart, had neither.
Band: each stored point is a bucket average with its lowest and highest
reading. When any bucket spreads, the chart now draws a 20% band between
them behind the line, so a short spike survives downsampling. The area
fill under the line is gone, so storage charts read like the drawer
charts; a flat series is a line alone.
Phone fold: a disk detail stacked five charts on a phone. It now shows
the first History chart plus any chart whose SMART card is out of
bounds, and folds the rest, Live I/O included, behind one button. Folded
charts read nothing until opened. The button is a shared
PhoneChartsToggle that the drawer History now uses too.
The visual pass also caught short windows repeating a time label
("Oct 2" four times); the time axis now states each label once.
The canvas History chart always drew four time labels, so in a narrow
card, such as a disk's live I/O charts three abreast, they ran together
("12:04 PM12:07 PM12:10 PM12:14 PM"). It now measures its labels and
draws as many evenly spaced times as the plot fits, down to the first
and last.
The drawer charts format sub-kilobyte rates as "<1K/s" on purpose, so a
quiet link printed "<1K/s" on two gridlines, which tells the reader
nothing. Both chart kinds now blank a middle gridline label that repeats
a neighbour; the gridline stays and the end labels always remain.
The range-label test imported two storage modules inside its body and
timed out under load; they are now static imports.
A History chart sizes its point cap from its width, and the cap was part
of the selection that decides when a chart starts over. Any resize, a
window drag, a drawer or sidebar change, even a full-page screenshot,
cleared the readings and showed a "Loading history" spinner until the
re-read at the new cap returned.
The cap now only shapes the request. The series a chart shows (target,
metric, range, organisation, lock) decides when it starts over, so a
resize re-reads the same series quietly with its readings on screen.
Pointer inspection still resets on a resize, because its pixel positions
moved.
The guest-storage-2263 browser proof now narrows and restores the
viewport and takes a full-page capture with a disk open: the old hook
showed spinners, the new one keeps the charts.
Use scoped, detached producer tuples for canonical guests on failed nodes instead of publishing enrichment-only projections as readings. Keep original metric provenance, guest collection state and observation times, without cloning unrelated fleet data or changing guest command safety. The connected admission proof exposed and now covers this complete preservation path.
Change-source: pulse-maintainer
Keep stderr and trailing blank records in service-state and running-PID admission. Incomplete reads must not authorise installation, restart, rollback or update success. Require production caller and real-process controls for both read boundaries; preserve existing recovery, trust and deadlines.
Change-source: pulse-maintainer
The guest drawer keeps Overview mounted behind the Manage tab so
switching back does not jump. Its own history charts already paused
there, but an expanded physical disk's charts kept polling every 10-30
seconds and the disk list kept refreshing on live updates, all for a
view nobody could see.
HistoryChart now takes enabled: false aborts its read and stops polling
while keeping the readings it shows, and resuming the same selection
reads at once without a loading spinner before polling again. The
drawer's historyEnabled reaches DiskDetail through GuestPhysicalDisks,
which also holds the list's realtime refresh through
useUnifiedResources' realtimeEnabled.
The guest-storage-2263 browser proof now hides and shows the Overview
with the clock running: the old code read disk history while hidden,
the new code reads none and resumes with the same chart nodes.
Require whole bounded, unambiguous enumerations on the efficient and node fallback routes. Preserve scoped empty inventories, LXC integer compatibility and ordinary counter/receipt semantics. Validate retained readings, History, breaches and template policy through actual fallback and recovery.
Change-source: pulse-maintainer
Run the locked parser and silent triage policy on their complete input changes in a credential-free Build and Test job. Retain issue-event pre-token checks, existing runtime and strict dependency gates; exercise admission and original install/test failure exits.
Change-source: pulse-maintainer
The focus handoff from #2925 tracked Retry focus with focus/blur
handlers. Chromium blurs a focused element when it leaves the DOM, and
the Show branch removes the button before the error effect runs, so the
flag was already false and focus fell to the page. jsdom never blurs on
removal, which is why the unit test passed. Read document.activeElement
when the Retry branch is disposed instead, and make the refresh test
model the removal blur so it fails against the old code.
The worker-browser proofs for history response, pointer, inspection,
window and the three PBS fixtures still clicked the removed History tab
and Refresh button. They now read the charts on Overview, drive reads
through the 30-second poll, select series paths rather than every path
(bands and dots add paths), and mount fixtures in a shared app runtime
(fixtureRuntime.tsx) because drawers read the WebSocket and theme
contexts. The PBS refresh proof is what caught the focus regression.
Preserve the accepted cc6eb37ae9 history while incorporating current published History alert ownership and removal of the refresh control.
Change-source: pulse-maintainer
A final review of the drawer series (screenshots plus the full diff)
and a real alert on the preview found several problems:
- A Docker host drew its container's 85% memory trigger on the host's
own memory chart and turned the host reading red. Needs attention
rightly lists nested alerts; the charts now take triggers only from
getOwnAlertsForUnifiedResource, the resource's exact-key alerts.
- A container drawer listed none of its own alerts. The matcher now
answers to docker:<host>/<container id> (or /name:<name>), the key
the alert engine writes, so it lists them and charts the trigger.
- Docker and resource-detail drawers printed the alert's breach-time
message ("memory at 99.5%") beside a chart reading 70%. They now use
the shared attention copy the Proxmox drawers use: "Memory 70% now,
recovering".
- Disk temperature and storage capacity alerts reached no chart; an
alert line drawn before any history sat at an arbitrary height; the
dashed line had no visible label (the legend now says "alert at
85.0%"); a phone panel shown for an alert hid again when the alert
cleared, under a reader mid-inspection; facts strips stated a used
memory amount for a retained reading.
The Refresh history button is gone: the charts poll every 30 seconds.
Retry history still appears for a failed read, and when a successful
retry removes it, focus moves to the history region instead of the
page. Tests that used Refresh to trigger a read now advance the poll on
a fake interval clock.
Consume the bounded response through EOF before admitting nodes or a cluster probe. Reject missing, ambiguous and incomplete inventories without leaking response details, retain scoped empty arrays and provider metadata, and cover trusted startup, recovery, cached reads and consuming endpoint projection.
Change-source: pulse-maintainer
Contract-Neutral: Tightens existing node-inventory and recovery-health admission without changing the public response schema, API surface, permissions, TLS or guest-command policy.
Replace the repeatedly patched line scanner with the existing exact Marked 17.0.6 GFM lexer. Preserve real legacy values and silent current-thread label deltas while excluding quoted, nested, HTML and multiline-code declarations and upgrade-source title fallback. Install the complete one-package locked graph with scripts disabled and verify triage before minting its existing write token.
Contract-Neutral: Replace the issue metadata scanner within the existing silent classification contract; no product runtime, API, rendered Pulse UI, permissions, retest or disposition-authority change.
Change-source: pulse-maintainer
Keep the original failed transaction command distinct from any later cleanup command. Retain fixed operation labels and require portable controls for command, timeout, assertion, cleanup-only and successful receipts, without changing update transactions or disclosing command output.
Change-source: pulse-maintainer
The drawer tab-retention proof (#1723) and the PBS host history
correlation proof share browser-tests/pbs-host-history-correlation.tsx.
That fixture mounted the Backups table without the app runtime context
the drawer Overview reads alerts from, so both proofs threw before the
drawer rendered and had silently stopped proving anything.
The fixture now supplies an explicit offline WebSocket and dark-mode
context and a router, as the other drawer fixtures do. The correlation
proof follows the drawer's current shape: history charts sit on
Overview, so it checks that Overview stays selected with stable chart
paths across refreshes. Since the Identity card shows each identifier
once, the Metrics Target row may be absent; when present it must name
the host series, and the intercepted history request still must.
Both proofs pass at 1280 and 390px on every topology. Negative controls
fail as they should: resetting the tab when the metrics target drops
breaks the retention proof, and charting the PBS service key breaks the
correlation proof.
Require the actual nodes/login probe to succeed at startup, recovery and lazy selection instead of accepting guest-like response text. Retain failed single-endpoint health until an ordinary request succeeds, preserving cached last-resort reads, real guest error handling, temporary rate-limit handling and trust policy. Add producing-path and connected projection regressions and revise the old nodes-as-guest fixture contract.
Change-source: pulse-maintainer
The actual Docs fetch, Markdown renderer and router pass desktop Chromium and 390px WebKit navigation and reading checks. All six original captures were inspected with the native image tool; no host, agent or installed recovery is asserted.
Contract-Neutral: Browser receipt only; no runtime, guide content or subsystem contract delta.
Change-source: pulse-maintainer
The legacy grant-pct path deliberately permits only list and df outside the typed helper. Keep that distinction instead of calling every fallback a full-trust collector, and describe configured mounts rather than promising every mounted filesystem.
Contract-Neutral: Guidance wording only; no telemetry, privilege, API, installer or availability contract delta.
Change-source: pulse-maintainer
The deployment table still calls the typed helper a pct reader, while the implementation uses socket-free discovery and command fallback cannot recover within PrivateNetwork. Link the deployment choice, collector help and support matrix to one shipped explanation of partial, unavailable and older-helper readings, without recommending privilege or state changes.
Contract-Neutral: Guidance and consuming-proof coverage only; no telemetry, privilege, API, installer or availability contract delta.
Change-source: pulse-maintainer
The shared probe must release the health mutex for first-use trust. Retain the prior single construction boundary so joined readers do not duplicate capture and password login. The actual TLS concurrency control checks eight ordinary reads and nonblocking health inspection.
Contract-Neutral: Preserve existing serialized lazy client construction while releasing only the health and trust mutex for first-use capture; no wire, authority, configuration or consumer contract changes.
Change-source: pulse-maintainer
Use one bounded first-use probe for constructor and nodes-read pin failures at startup, recovery and lazy selection. Keep capture credential-free, primary and saved pins immutable, and full polling-session acceptance separate. Qualify all existing auth encodings and refusal, cancellation and consuming projection controls.
Change-source: pulse-maintainer
Match the current Support navigation and phone control labels, explain absent exports, and lead reporting with existing evidence. Keep live-check, full-bundle and privacy limits intact; verify the shipped guide against the actual route and state owners.
Contract-Neutral: Existing help and diagnostic-state tests only; no runtime, renderer, routes, access, exports or live-check behaviour changes.
Change-source: pulse-maintainer
The containing race suite observed a prior cooldown before the invalid-success matrix sent its first HTTP request. Use per-case synthetic base paths instead of recycled listener authority; prove two first admissions and preserved cross-client fences on one shared listener. Production admission keys, aliases and safety state are unchanged.
Contract-Neutral: Isolate synthetic test identities; no production guest admission, TLS, session, polling or History contract delta.
Change-source: pulse-maintainer
Reject incomplete or ambiguous 200 login bodies before replacing ticket, CSRF, expiry and PVE generation. Preserve retained sessions, joined renewal failures, normal encoding fallback and later ordinary recovery; cover real pinned startup/poll/broadcast consumption.
Contract-Neutral: Restore existing complete-session and failed-renewal preservation guarantees; no API/wire schema, TLS trust, credential authority, guest lifecycle, polling cadence or History contract delta.
Change-source: pulse-maintainer
Current 390px consuming pixels showed the free-tier notice still inside a two-line sales gate, clipping the phone-alert alternatives. Use the shared labelled InlineNotice for that existing guidance, retain the entitled configuration and pairing controls, and target the actual notice rather than the hidden mobile page subtitle. No offer, entitlement, billing, configuration or service change is introduced.
Change-source: pulse-maintainer
Carry cancellation through PVE/PBS construction, cluster probes and retained sessions, startup retries and port fallback. Preserve prior health/errors on caller termination; accepted clients retain independent ordinary reads and full timeouts. Cover real pinned HTTPS cancellation, deadlines, form fallback and first-poll publication.
Contract-Neutral: Restore existing caller cancellation and usable-session guarantees; no wire/API schema, agent lifecycle, TLS trust, guest safety, polling cadence or History contract delta.
Change-source: pulse-maintainer
pulse-triage[bot]