Compose current main e2f4bdff03 additively. Retain both subsystem records and the held change-age control while withdrawing only the obsolete Discovery identification test. Reviewed identities and ancestry, canonical guest History ownership and upstream feature removal remain intact.
Change-source: pulse-maintainer
Retain recovery before unknown or unavailable timeout/sysrc observations, require bounded PID records, and align the existing daemon-supervisor assertion with checked signal delivery rather than ignored errors. Every source control remains mandatory.
Change-source: pulse-maintainer
Continue #1099: stop and disable the actual legacy manager before remote deregistration or local erasure, recheck after confirmation, and retain PID/service/credential material on refusal or unknown state. Check collector and supervisor absence, exact runlevel ownership and rendered signal failures with confined production-function controls. Appliance bootstrap and native acceptance remain separate.
Change-source: pulse-maintainer
The 2026-10-10 server service discovery change lists the two historical
unit names with one pattern read and refuses to continue when that read
exits non-zero. systemctl list-unit-files exits 1, printing nothing on
stdout or stderr, when none of the named unit files exist. That is every
fresh host, so install.sh refused with "Cannot identify the Pulse systemd
service: unit inventory failed" before it did any work. The first beta's
install.sh smoke test caught it on a clean Debian 12 container; no
release carries it, and v6.5.0 listed the whole inventory and grepped it.
The tests could not see it. Their systemctl double reports "no units" as
exit 0, and test_partial_failed_inventory_is_not_absence asserted that an
empty inventory with exit 1 must be refused, which is the defect itself.
Add one inventory read shared by the installer and the unattended
updater, and use it for the auto-update mask check, which had the same
hazard. It accepts exactly the silent exit 1 as an empty inventory, and
only after a second read confirms there is still no output and no
message. A timeout, a signal, any other status, or an exit 1 that carries
output or a message stays a failed inventory, so a real failure still
cannot pass as absence.
Make the doubles model systemd: a failure now prints its message, silent
exit 1 is absence, and a new test runs real systemctl --root over an
empty unit root for both scripts. Run against the unfixed scripts, the
four new fresh-host tests fail; the rest of the suite is unchanged.
The registered runtime proofs for install.sh and the unattended updater,
which drive this suite, now require the fresh-host controls to have run
and passed, so they cannot be skipped or deleted unnoticed.
Refs: #2785
Separate the existing display-hour controls from alert-day thresholds and preserve the v6.5.0 critical-Off safety caveat. Validate the guide, mirror and three-day example against the existing freshness model.
Contract-Neutral: Existing backup guidance and documentation tests only; no runtime, alert policy or backup contract changes.
Change-source: pulse-maintainer
A polling budget is not connection retirement. Retain the original 40 ms and 250 ms large-cluster controls: deadline expiry may finish local authoritative-inventory publication, but explicit cancellation, runtime end and client replacement still withdraw it, and no new read is admitted after expiry.
Change-source: pulse-maintainer
Use the existing Workloads fallback and reporting-lease rules for linked Pulse-agent filesystem aggregates on Proxmox VMs and containers. Preserve native stopped withdrawal, platform-list precedence, measured zero and stored observations.
Add live/silent producer, power and mounted-drawer controls, plus own-parent desktop and phone browser evidence. This is presentation maintenance, not collection or native recovery.
Change-source: pulse-maintainer
Stage both enumeration routes' guest readings, snapshots, alerts, backup eligibility and History until their complete cycle is admitted. Retirement, runtime replacement and transport changes cancel obsolete reads and serialize state withdrawal against admitted effects without holding the monitor mutex through callbacks.
Retain authoritative inventory after detail-budget expiry, independent agents and accepted cache safety; cancellation is not command completion. Add deterministic late-reply and publication-order controls.
Change-source: pulse-maintainer
Keep alert-owned percentages separate from the table basis and preserve the owning Web browser receipt and exact source.
Change-source: pulse-maintainer
Preserve the exact Core candidate and its retained controlled race proof; declared Go 1.26.9 and native recovery remain separate obligations.
Change-source: pulse-maintainer
Compose the exact refreshed upstream with the complete reviewed maintenance batch, retaining every reviewed identity and the additive removal-fixture correction.
Change-source: pulse-maintainer
The Backups health strip reads "17 attention, 11 unprotected", but the
counts were plain text. On a 375px phone the coverage list starts below
the fold and the posture filter sits behind the Filters sheet, so
finding which 11 workloads are unprotected took three taps through a
sheet.
The protected, attention, unprotected and unknown counts are now toggle
buttons for the existing `?posture=` filter, the same state the inline
posture pills and the Filters sheet set.
- From By date, or the bare `/proxmox/backups` route, a count opens the
Coverage route already filtered.
- A zero count stays text unless it is the active filter; checking and
not evaluated have no filter and stay text.
- The legend renders with `Index`, so a focused count keeps focus when
it toggles.
- The rule footnote, the posture sort and the servers table are
unchanged.
The strip still counts the whole estate, so with a node or location
filter active a count can open fewer rows than it shows, which matches
how the strip already reads under those filters.
Verification: browser receipt
`frontend-modern/browser-verification/bd4f5b6bd86ad00f.json` (375 and
1440, light and dark, real taps from By date and Coverage, deep link).
The proxmox and storageBackups suites (87 files) pass, tsc and eslint
are clean, and the new tests fail on the previous code.
Preserve alert-owned readings, observation times and clear rules when the Workloads table uses host memory. Explain the different basis separately instead of calculating a comparison from unrelated current or retained samples.
Production desktop and phone browser checks cover the row, drawer and basis selector. Preserve guest safety guidance and independent memory calculations.
Change-source: pulse-maintainer
Require bounded diagnostic-free service and all-runlevel readback before server removal or local mutation, and reconcile again after remote confirmation while recovery state still exists. Refused stops, disable failures, unknown reads and unexpected init paths retain local material; absent and repeated removal need independent manager/process absence. Add executable confined refusal, ordering, custom-runlevel and timeout-child controls to the registered installer hook and owning contracts. Native OpenRC, Windows, other-manager and installed acceptance remain separate.
Change-source: pulse-maintainer
SSO operators can hold permitted non-administrative write capabilities. The guide now checks the actual instance-administration boundary, without instructing a settings mutation or changing roles.
Change-source: pulse-maintainer
The Backups health strip says "17 attention, 11 unprotected", but the
counts were text. On a 375px phone the coverage list starts below the
fold and the posture filter sits behind the Filters sheet, so finding
which 11 workloads are unprotected took three taps through a sheet.
The protected, attention, unprotected and unknown counts are now small
toggle buttons for the existing ?posture= filter, the same state the
inline posture pills and the Filters sheet set. From By date, or the
bare Backups route, a count opens the Coverage route already filtered.
Zero counts, checking and not evaluated stay text. The legend renders
with Index so a focused count keeps focus when it toggles.
The strip still counts the whole estate, so with a node or location
filter active a count can open fewer rows than it shows; that matches
how the strip already reads under those filters.
The Alerts overview is where a notification lands, and on a 375px phone
each active alert carried Acknowledge, Snooze, Investigate and More on
two wrapped rows. The actions took more height than the alert, so about
three alerts fit on a screen (rows averaged 208px on the mock estate).
Below the sm breakpoint the Investigate split button now joins Timeline
and the monitoring policy inside More, so Acknowledge, Snooze and More
fit on one row. From sm up the row is unchanged. Snooze stays on the row
at every width so its dialog survives a phone rotating across sm; only
Investigate moves, by the shared useBreakpoint width, and renders once.
More names its region through aria-controls only while it is rendered.
Invalidate successful and negative QGA memory caches on guest unavailability, observed stops and connection retirement. Retain and cancel obsolete read owners until completion, discard late/cancelled samples and coalesce overlapping refreshes without weakening transport uncertainty. Verify both collectors, served readings, History and independent linked-agent evidence.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate and its portable proof. Hosted native systemd receipts, matching Go compilation, signed installed-agent transport and Windows recovery remain separate acceptance obligations.
Change-source: pulse-maintainer
Copy generated callbacks only after provider save, align group-claim advice with provider-specific scopes, and retain administrator access until separate-session permission checks pass. Keep shipped documentation and regression checks in step without changing authentication or provider behaviour.
Change-source: pulse-maintainer
Preserve the exact reviewed guide and regression-test commits. Retained command controls and browser evidence establish safer credential paths and permission diagnostics without cluster or privilege changes.
Change-source: pulse-maintainer
Preserve the exact reviewed commits and their own-parent browser receipt. Retained source and desktop/phone proofs cover filesystem carrier withdrawal while stored History remains usable.
Change-source: pulse-maintainer
Preserve the five reviewed Core commits exactly. Blank-only bootstrap admission and the matching persistence path retain existing access; authenticated transfer remains unchanged.
Change-source: pulse-maintainer
Run the accepted Unix teardown functions on fresh public Linux x64 and ARM64 CI, with real stop refusal, socket activation, batch reactivation and independent process/file readback. Retain bounded source-bound phase and owned-cleanup receipts; keep synthetic revocation separate from installed TLS, signed-agent and Windows acceptance.
Change-source: pulse-maintainer
The copied token recipe followed linked paths and continued without its own failure boundary. Reject unsafe paths before editing or contacting the cluster, preserve scoped file-only provisioning, and distinguish Kubernetes RBAC from local pod privilege and missing usage. Exercise the exact copied recipes with synthetic inputs and render the served guidance.
Contract-Neutral: Existing Kubernetes help and its regression tests only; no runtime, API, chart, role, deployment profile or feature change.
Change-source: pulse-maintainer
Normalise the selected data directory with the storage path routine before inspection. Raw symlink/.. traversal and trailing separators must not probe an empty peer or hide a linked root while the encrypted importer writes elsewhere. Retain and validate the existing canonical agent credential.
Change-source: pulse-maintainer
Share native VM disk-read admission with Workloads and Alerts, keeping genuine stored observations and independent metrics usable. Cover reactive same-identity snapshots, source precedence and accepted zero with model, mounted drawer and desktop/phone browser controls.
Change-source: pulse-maintainer
Accept exact PI commit 42a1e5e632: existing upgrade guidance now routes to owned recovery procedures and removes unsafe privileged purge/access-erasure shortcuts. Retained selected tests, embed build and desktop/phone proof are adequate for this documentation scope; installed recovery and availability remain separate.
Contract-Neutral: Documentation guidance and focused regression controls only; no runtime or public contract changes.
Change-source: pulse-maintainer
Replace ignored stop and disable failures with bounded complete state observations and independent inactive/non-enabled readback. Reconcile helper socket and service together, and quiesce the full uninstall activation set before remote or local mutation. Preserve failed runner revocation material and existing saved-state, token, trust and platform boundaries. Add executable production-shell refusal, reactivation, timeout and owned-cleanup controls.
Change-source: pulse-maintainer
Require a blank destination instead of using nodes.enc as a first-run sentinel. Recheck before writes, retain unknown or unreadable state, and leave deliberate authenticated transfer unchanged. Keep deployment .env provisioning and encrypted file precedence; explain the separate archive path in canonical and served help.
Change-source: pulse-maintainer
The v4-to-v5 entry point still offered privileged download-and-purge cleanup and duplicate update shortcuts despite safer current procedures. Preserve configuration, credential and workload recovery evidence, separate server and agent paths, and link the inspected local cleanup without broadening it.
Contract-Neutral: Existing customer guidance, shipped Markdown and focused regression checks only; no runtime, API, permission, installer or cleanup contract changes.
Change-source: pulse-maintainer
Accept exact Web candidate with retained own-parent browser proof and focused tests/build. Preserve the unrelated full-suite Storage timeout and all native recovery limits.
Change-source: pulse-maintainer
Retain exact PI candidate identity and its proof; existing configuration-transfer help now states the real admission gate and replacement limits.
Change-source: pulse-maintainer
Cancel obsolete enrichment contexts on explicit cache invalidation and PVE instance retirement while retaining ownership until completion. Serialize publication and retry scheduling with invalidation, re-read fallback metadata within the reservation, and discard late network, OS and version outcomes without weakening shared guest-command uncertainty fences. Cover late readers, slot waiting, direct/cluster HTTP cancellation and ordinary independent recovery.
Change-source: pulse-maintainer
Share Workloads guest-read admission so retained usage is explicitly last known and unavailable or stopped-VM carriers cannot appear current. Keep saved threshold identities and editors intact, with visible wrapping read guidance on desktop and phone.
Record the alert and dependent frontend contracts, regressions and own-parent browser proof. Synthetic presentation checks do not establish guest collection, backup safety or installed recovery.
Change-source: pulse-maintainer
Retain exact Core commits 96dc74860a and b77a0c3ea3. Reviewed cache activity, observation-age separation, idle eviction, ownership and lock ordering. Retained synthetic race and vet evidence is adequate for this narrow backend repair; Go 1.26.9 and native recovery remain unproved.
Change-source: pulse-maintainer
Non-interactive token-file reading currently erases the supplied credential before permission checks and authenticated removal, including when removal is refused or its result is unknown. Treat token-file ingress as read-only: callers own their bootstrap cleanup, and confirmed removal still deletes only authorised runtime state. Keep token validation, TLS policy, exact record confirmation and credential-free local removal unchanged.
Extend the existing portable removal fixture through the actual parser and token ingress, root refusal and post-confirmation owned cleanup. Parent proof records thirty premature-erasure failures; a separate no-TTY harness control remains distinct. Update both owning contracts and the registered Go inventory hook together. Native Windows, compiled TLS and installed whole-job acceptance remain separate.
Change-source: pulse-maintainer
Document the existing nodes.enc gate, replacement scope, file precedence and non-fatal import errors. Preserve agent identity and excluded state, isolate provisioning from live traffic, and keep one-shot inputs private rather than forcing a reset.
Contract-Neutral: Existing bootstrap and encrypted-import behaviour is unchanged; this corrects canonical and served help, with documentation regression controls.
Change-source: pulse-maintainer
Retain the exact Delivery candidate b3b368c21b and its attributed PR2855 adaptation. Independent review verifies one-read failure retention and unchanged runtime-proof bytes; no native installation or published availability is claimed.
Change-source: pulse-maintainer
Separate metadata-cache activity from successful observation age so empty or failing guest reads cannot erase OS-info suppression or its accumulated failures. Preserve useful and OS evidence ages, ordinary backoff and guest-command fences; expire only idle non-in-flight state and clean activity on explicit invalidation and instance retirement.
Change-source: pulse-maintainer
Adapt rcourtman’s Pulse PR2855 (aef53d0d3e), which diagnosed systemd’s silent exit-one absence. The original contributor commit is unchanged and explicitly credited, not imported, amended or re-parented in this maintainer candidate.
One bounded stdout/stderr observation accepts genuine absence but retains failed first reads, other statuses and blank-line output. Include the existing registered installer/updater verification hooks, real-empty-root controls and missing-unit recovery double in this same source commit. This replaces the rejected foreign-history composition with a normal maintainer-reviewed implementation; no provenance policy, credential or host installation changes.
Source-attribution: rcourtman, https://github.com/rcourtman/Pulse/pull/2855, aef53d0d3e
Change-source: pulse-maintainer
Preserve the exact Core implementation and suppression-fixture correction. Retained source-zo0f05z5 verifies the selected monitoring race contracts and vet on observed Go 1.26.8; declared-Go and native recovery remain separate outstanding evidence.
Change-source: pulse-maintainer
pulse-triage[bot]