Preserve contradictory rows before monitoring constructs its endpoint trust map. A final matching row must not mask earlier disagreement during saved-view consolidation. Cover both merge orders and retain the existing agreeing-format path; strengthen lifecycle configuration ownership checks.
Change-source: pulse-maintainer
Carry exact duplicate-row conflicts into owned client trust before map deduplication. Keep unresolved saved trust through initialization, missing-client retry and topology refresh without replacing pins or stopping trusted siblings. Cover actual monitor lifecycle routes and member projections alongside client TLS controls.
Change-source: pulse-maintainer
Resolve all saved pins for an endpoint before credential-bearing construction. Contradictory trust is an explicit failure, not a missing-pin fallback or first-use opportunity. Preserve independent authorities, agreeing formats and saved configuration; prove zero provider work, sibling monitoring and normal reload through the member projection.
Change-source: pulse-maintainer
Use scoped, detached producer tuples for canonical guests on failed nodes instead of publishing enrichment-only projections as readings. Keep original metric provenance, guest collection state and observation times, without cloning unrelated fleet data or changing guest command safety. The connected admission proof exposed and now covers this complete preservation path.
Change-source: pulse-maintainer
Require whole bounded, unambiguous enumerations on the efficient and node fallback routes. Preserve scoped empty inventories, LXC integer compatibility and ordinary counter/receipt semantics. Validate retained readings, History, breaches and template policy through actual fallback and recovery.
Change-source: pulse-maintainer
Consume the bounded response through EOF before admitting nodes or a cluster probe. Reject missing, ambiguous and incomplete inventories without leaking response details, retain scoped empty arrays and provider metadata, and cover trusted startup, recovery, cached reads and consuming endpoint projection.
Change-source: pulse-maintainer
Contract-Neutral: Tightens existing node-inventory and recovery-health admission without changing the public response schema, API surface, permissions, TLS or guest-command policy.
Require the actual nodes/login probe to succeed at startup, recovery and lazy selection instead of accepting guest-like response text. Retain failed single-endpoint health until an ordinary request succeeds, preserving cached last-resort reads, real guest error handling, temporary rate-limit handling and trust policy. Add producing-path and connected projection regressions and revise the old nodes-as-guest fixture contract.
Change-source: pulse-maintainer
The projection fixture now uses the actual saved ClusterEndpoint schema. Give each malformed-filesystem fixture an independent base path so reused listener ports cannot borrow a previous live uncertainty fence; all real guard state and response assertions remain.
Contract-Neutral: Test-only schema correction and independent synthetic endpoint identity; no production policy, deadline, wire or configuration changes.
Change-source: pulse-maintainer
Use one bounded first-use probe for constructor and nodes-read pin failures at startup, recovery and lazy selection. Keep capture credential-free, primary and saved pins immutable, and full polling-session acceptance separate. Qualify all existing auth encodings and refusal, cancellation and consuming projection controls.
Change-source: pulse-maintainer
The containing proof completed every client/TLS/parser race suite, vet and real-embed build, but the new monitoring fixture used only one shortened retry delay. Its next client check took the production cap, exhausting the poll context. Include both fixture checks and assert a live caller before polling; production retry/caller policy is unchanged.
Contract-Neutral: Correct the monitoring test schedule only; no production session, TLS, retry cadence, polling, guest safety or History contract delta.
Change-source: pulse-maintainer
Reject incomplete or ambiguous 200 login bodies before replacing ticket, CSRF, expiry and PVE generation. Preserve retained sessions, joined renewal failures, normal encoding fallback and later ordinary recovery; cover real pinned startup/poll/broadcast consumption.
Contract-Neutral: Restore existing complete-session and failed-renewal preservation guarantees; no API/wire schema, TLS trust, credential authority, guest lifecycle, polling cadence or History contract delta.
Change-source: pulse-maintainer
Carry cancellation through PVE/PBS construction, cluster probes and retained sessions, startup retries and port fallback. Preserve prior health/errors on caller termination; accepted clients retain independent ordinary reads and full timeouts. Cover real pinned HTTPS cancellation, deadlines, form fallback and first-poll publication.
Contract-Neutral: Restore existing caller cancellation and usable-session guarantees; no wire/API schema, agent lifecycle, TLS trust, guest safety, polling cadence or History contract delta.
Change-source: pulse-maintainer
The poll stores the provider ratio unchanged, while the canonical broadcast converts it to the percentage consumed by the table. Assert both boundaries without changing runtime values, reducing coverage or redoing the completed predecessor controls.
Change-source: pulse-maintainer
The connected fixture must read state with its actual mock-mode epoch before passing it to the unchanged production broadcast boundary. Keep the original failed result and every lifecycle/TLS assertion; do not weaken the fence or alter runtime recovery.
Change-source: pulse-maintainer
A provider that returns after the five-minute startup window was permanently outside polling until Pulse restarted. Preserve the capped retry cadence, cancellation, paused connections and saved TLS trust; connect the registered contract proof to six-minute virtual-time recovery and the real PBS constructor, scheduler and broadcast producer.
Change-source: pulse-maintainer
Preserve accepted 0efe3f7a12 and exact upstream ebfdc9d669 additively. Keep quiet unavailable captions, keyboard and touch reading explanations, stopped-agent provenance and primary CPU readings. Preserve stable denied-update help outside Details and all regression assertions.
Change-source: pulse-maintainer
Retain the actual authentication refusal and existing client when the full-timeout session cannot be constructed after a successful short probe. Cover pinned HTTPS rejection, malformed and form-refused sessions, later ordinary recovery and the monitor endpoint projection.
Change-source: pulse-maintainer
Retain the exact existing safety candidate after returned final drawer proof; preserve current consuming source and mock History refinements. Native restart, every-volume History and independent thaw remain unverified.
Change-source: pulse-maintainer
Three rules chose a node's single CPU temperature. Node history took
CPUMax first, agent history took cpu_package first, and the node drawer
recomputed the maximum of package, CPUMax and every core in the
browser. On an agent-fed node CPUMax is built from cores alone and can
sit below the package, and elsewhere a core can run above the package,
so the drawer's CPU temperature headline could disagree with the line
drawn beneath it and with the History tab. Node alerts and the CPU
low/record tracking used yet another package-first rule.
models.PrimaryCPUTemperatureCelsius is now the one rule: the hottest
usable package, CPU-maximum or core reading, with a sensor-map form for
agents. Node and agent history, the router's live fallbacks, the
unified resource temperature, node temperature alerts and the CPU
low/record tracking all call it. The drawer reads the resource value
through a new Node.cpuTemperature field instead of recomputing it, and
getCpuTemperature is removed.
Mock mode wrote a second package reading under a cpu.package key into
every agent host, including node-linked ones, from a series unrelated
to the node's static reading. A node and its linked agent now carry one
reading, sampled from the agent's series under the agent's real keys,
and both histories seed from that series, so the current reading
continues the line.
Record the actual privileged Bash reader from the selected tool and send HUP/TERM to it while retaining the controlling terminal. Whole-session termination cannot supply the same restoration observation. Keep the adverse whole-group result, full mode/privacy assertions and every caller control.
Change-source: pulse-maintainer
Non-interactive PTY sessions dispatch through sh while history sessions use bash. Supply both in the closed PATH so tool/mode controls exercise the producer rather than failing at child creation; retain all privacy and complete-terminal assertions. Preserve the observed failed suite.
Change-source: pulse-maintainer
Mirror the qualified Unix reader in setup, Proxmox and container producers: select one terminal tool, distinguish missing terminal/tool/mode failures, restore its complete state before installation and on cleanup, and retain silent overflow draining. Emit the isolated privileged body once without changing tokens, trust, scopes, profiles or state. Cover serialized contracts and actual consumer payloads.
Change-source: pulse-maintainer
Cover setup, Proxmox and container callers with a real PTY, isolated standalone and BusyBox tool selection, distinct fail-closed modes, private root/sudo history and one bounded command body. These controls expose the unchanged backend reader before its repair.
Change-source: pulse-maintainer
Preserve the exact reviewed tip and incorporate current upstream History default, marker shape and readout behavior additively.
Change-source: pulse-maintainer
Mock chart history thinned each metric with LTTB on its own. LTTB keeps
the points whose values stand out, so cpu, memory and disk of one guest
kept different timestamps: on the public demo a 24h container history
had eight ~48-point series spread over 162 distinct timestamps. The
drawer History panels break a line wherever another series in the panel
has a reading this one lacks, so every mock chart drew as dots with a
"Missing observations" note. Real history does not do this because the
poller writes all of a resource's metrics at the same times.
Thin mock series onto an epoch-aligned grid instead: keep the first
reading in each bucket plus the newest reading, at their own
timestamps. Which readings survive now depends only on when they were
taken, so series sampled together keep identical timestamps, values
stay real readings, and point targets are unchanged. The synthetic
generator no longer pre-thins to 500 points, since every caller thins
onto the grid.
The typed-reply fixture keeps the successful memory cache untouched, so the selector legitimately retains guest-agent-meminfo provenance rather than the expired-cache previous-snapshot label. Require that exact source while preserving strict last-known state, original observation time, unchanged cache and History checks.
Contract-Neutral: Fixture expectation and proof description only; runtime source selection, guest admission, observation ages, API and History semantics are unchanged.
Change-source: pulse-maintainer
Validate result/content/truncated types before shared guest-command admission is released. Scalar results must not become empty inventories, and wrongly typed file fields must not release admission before decoder failure. Preserve compatible empty/null rows and completed but unusable measurements. Add six-reader, alias/expiry and actual-state polling/broadcast/History controls with untouched healthy-read origins. Native thaw and restart recovery remain separately unverified.
Change-source: pulse-maintainer
Preserve exact reviewed d636bfdaea and published 0a44d276db ancestry. Retain both contract additions, readable System evidence and stable accessible update help alongside upstream alert-first trends, facts and Details.
Change-source: pulse-maintainer
The chosen source proof runs with umask 077. Explicitly chmod the inert pre-update binaries so failure controls can require exact preservation of a 0755 executable rather than assuming WriteFile overrides the caller's mask. This changes only fixture setup; production permission, trust and recovery assertions are retained.
Change-source: pulse-maintainer
Avoid rewriting an already-replaced QNAP executable through an aliased persistent path. Stage split QNAP and Unraid copies in owned same-directory temporaries, set execute permissions before atomic replacement, and clean every failed stage without changing saved state or update trust. Add authenticated HTTPS and real child-exec regressions plus persistence failure and recovery controls. Native appliance and old-installed-updater recovery remain separate.
Change-source: pulse-maintainer
Patrol's operator-state projection dereferenced the one-shot
MaintenanceStartAt/EndAt whenever IsInMaintenanceAt was true. A
recurring window also reports active but leaves those fields nil, so
the first finding Patrol evaluated during a recurring occurrence
panicked the provider. The projection now takes its bounds from the
active occurrence.
Alerts already silence guests under a host window scoped to
resource_and_descendants, but Patrol read only the exact resource, so
the same planned work dismissed a guest's alerts and still raised its
Patrol findings. Both now resolve maintenance through one rule,
unifiedresources.ActiveMaintenanceCoverageAt: own window plus
descendant-scoped ancestor windows, latest active end wins. Only
maintenance is inherited; monitoring mode, lifecycle and remediation
locks stay exact-resource state. An inherited dismissal says the window
is on a parent resource and names it on the lifecycle event, and the
Manage help now says descendants' new Patrol findings are dismissed
too.
The advisory Benchmarks check failed #2884 on NormalizeRoute/with_uuid
alone, +12.25% (p=0.000), though that PR changed only AI handler code.
It was not the only one. Since the bounded route scanner landed on
9 October (01788459f1), normalizeRoute takes 30-180ns a path on CI
runners. In 72
paired CI comparisons that measured internal/api from then until 13
October, the BenchmarkNormalizeRoute rows and their parallel variant
failed the gate 17 times. None of those PRs touched route code, and 6
of the 17 failures did not involve with_uuid: deep_path_truncated,
with_query_params, metrics_history, with_numeric_id and Parallel each
crossed 10% too. with_uuid moved past 10% in 21 of the 72 comparisons,
in both directions.
This is the same layout effect that retired the "/" fast path (#2255)
and NormalizeSegment (#2258). Go aligns functions to 32 bytes, so code
added earlier in the package moves normalizeRoute between the halves of
a 64-byte block. That changes its loops by a cycle per iteration. Every
path shares those loops, so retiring with_uuid alone would leave the
other rows failing. Summed over all six paths, a mixed-path row would
still have moved up to 10%.
BenchmarkNormalizeRoute and BenchmarkNormalizeRoute_Parallel are
removed. Their allocation columns never varied, and they are now pinned
by TestNormalizeRoute_LabelAllocationProfile. For each former path it
requires exactly one allocation, of the same size as a fresh copy of the
label. It runs in the existing isolated child process and takes the
lowest of three windows, so one stray runtime allocation cannot fail it.
BenchmarkFullMiddlewarePath still times the normaliser inside the
request path, with a CI maximum of +8.4% over those 72 runs, and
BenchmarkNormalizeRoute_DiscardedSuffix still times a long discarded
suffix. Gross classification slowdowns are left to those rows: a
doubled UUID scan has no deterministic signal, and the retired row
could not separate one from layout.
Proofs, on pulse-dev with the CI runner narrowed to ./internal/api/ at
30 samples. The probe is an unrelated init-time function in a file
sorted before http_metrics.go. It moves normalizeRoute from 32 to 0 mod
64 in the test binary without changing its size:
- old tree vs old tree plus probe: with_uuid -14.70% (p=0.001). Read the
other way, as a PR that removes the probe, the gate exits 1 on
NormalizeRoute/with_uuid alone, +17.23% (p=0.001). That is #2884's
shape.
- new tree vs new tree plus probe: gate exits 0 in both directions. On
a first run under load 9-15, three millisecond-scale rows that run no
route code flagged at p=0.025-0.046 with spreads of 15-38%. The
repeat came back clean in both directions.
- mutation controls on the final test: sizing the label buffer at twice
the label fails only the new test. The existing at-most-one-allocation
test passes it. Joining the label through an intermediate fails both.
- the route tests pass 20 times plain and 10 times under -race.
The advisory Benchmarks check failed #2884 on NormalizeRoute/with_uuid
alone, +12.25% (p=0.000), though that PR changed only AI handler code.
It was not the only one. Since the bounded route scanner landed on
9 October (01788459f1), normalizeRoute takes 30-180ns a path on CI runners. In 72
paired CI comparisons that measured internal/api from then until 13
October, the BenchmarkNormalizeRoute rows and their parallel variant
failed the gate 17 times. None of those PRs touched route code, and 6
of the 17 failures did not involve with_uuid: deep_path_truncated,
with_query_params, metrics_history, with_numeric_id and Parallel each
crossed 10% too. with_uuid moved past 10% in 21 of the 72 comparisons,
in both directions.
This is the same layout effect that retired the "/" fast path (#2255)
and NormalizeSegment (#2258). Go aligns functions to 32 bytes, so code
added earlier in the package moves normalizeRoute between the halves of
a 64-byte block. That changes its loops by a cycle per iteration. Every
path shares those loops, so retiring with_uuid alone would leave the
other rows failing. Summed over all six paths, a mixed-path row would
still have moved up to 10%.
BenchmarkNormalizeRoute and BenchmarkNormalizeRoute_Parallel are
removed. Their allocation columns never varied, and they are now pinned
by TestNormalizeRoute_LabelAllocationProfile. For each former path it
requires exactly one allocation, of the same size as a fresh copy of the
label. It runs in the existing isolated child process and takes the
lowest of three windows, so one stray runtime allocation cannot fail it.
BenchmarkFullMiddlewarePath still times the normaliser inside the
request path, with a CI maximum of +8.4% over those 72 runs, and
BenchmarkNormalizeRoute_DiscardedSuffix still times a long discarded
suffix. Gross classification slowdowns are left to those rows: a
doubled UUID scan has no deterministic signal, and the retired row
could not separate one from layout.
Proofs, on pulse-dev with the CI runner narrowed to ./internal/api/ at
30 samples. The probe is an unrelated init-time function in a file
sorted before http_metrics.go. It moves normalizeRoute from 32 to 0 mod
64 in the test binary without changing its size:
- old tree vs old tree plus probe: with_uuid -14.70% (p=0.001). Read the
other way, as a PR that removes the probe, the gate exits 1 on
NormalizeRoute/with_uuid alone, +17.23% (p=0.001). That is #2884's
shape.
- new tree vs new tree plus probe: gate exits 0 in both directions. On
a first run under load 9-15, three millisecond-scale rows that run no
route code flagged at p=0.025-0.046 with spreads of 15-38%. The
repeat came back clean in both directions.
- mutation controls on the final test: sizing the label buffer at twice
the label fails only the new test. The existing at-most-one-allocation
test passes it. Joining the label through an intermediate fails both.
- the route tests pass 20 times plain and 10 times under -race.
Preserve the exact Core candidate and its source proof. Age both original evidence owners; keep runtime retention, guest-read admission and History policy unchanged.
Change-source: pulse-maintainer
Expected offline is availability-specific everywhere else: the canonical
ResourceOperatorState doc says it "suppresses availability noise", the
alert runtime suppresses only offline and availability signals, and both
monitoring-policy controls tell the operator it hides availability noise
only, with Mute all as the way to stop Alerts and Patrol. Patrol was the
outlier. Its projection returned a suppression cause for expected_offline
(and the legacy IntentionallyOffline flag) regardless of the finding, so
a disk, memory, backup or security finding on an expected-offline
resource was auto-acknowledged exactly as if the resource were muted.
The suppression decision is now per finding. Retired and muted still
silence every finding; expected_offline and the legacy flag (when no
MonitoringMode is projected, as in the alert runtime) silence only
findings in the shared down condition class that alert mirroring already
uses. The wake path judges the re-detected finding with the same helper,
so findings auto-acknowledged under the old behaviour wake on their next
detection.
That classifier matched "offline" in any reliability title, which would
have read a SMART "offline uncorrectable sectors" report as the resource
being down and hidden a failing disk. SMART findings now fall outside the
down class, which also stops them mirroring an offline alert.
A new test pins the split (availability silenced; disk, memory and SMART
findings visible) with muted as the negative control, plus a muted to
expected-offline transition that wakes only non-availability findings.
Each test fails when the old behaviour, the wake-path scoping or the
SMART guard is reverted.
When cluster/resources polling fails, containers come from the per-node
collector, which built memory without a MemoryObservation. The unified
resource layer preserves that absence and the Workloads classifier then
reads every container on the node as "Freshness unknown", although the
same guest polled through the cluster listing reads current.
The fallback now annotates through the shared guestMemoryObservation
builder with the selected source, the listing time, the previous
snapshot
and the linked agent, so running containers read current from
cluster-resources (or agent) and stopped ones unavailable from
powered-off. Numeric selection, stabilisation and alerting are
unchanged.
Model elapsed time in both the QGA cache and independently annotated snapshot. Check that cache expiry alone preserves recent last-known provenance, then that fresh diagnostic polls cannot retain fully expired memory or renew percentage/byte History. Keep ordinary recovery and provider-priority controls; no runtime or retention policy changes.
Contract-Neutral: Repair and strengthen the observation lifecycle fixture only; runtime, frontend, schema, retention and admission policy are unchanged.
Change-source: pulse-maintainer
When cluster/resources polling fails, containers come from the per-node
collector, which built memory without a MemoryObservation. The unified
resource layer preserves that absence and the Workloads classifier then
reads every container on the node as "Freshness unknown", although the
same guest polled through the cluster listing reads current.
The fallback now annotates through the shared guestMemoryObservation
builder with the selected source, the listing time, the previous snapshot
and the linked agent, so running containers read current from
cluster-resources (or agent) and stopped ones unavailable from
powered-off. Numeric selection, stabilisation and alerting are unchanged.
A guest's per-filesystem disk alert is raised under <guest>-disk-<key>,
which names nothing the resource registry can resolve, so the Alerts
overview left its name linking to the top of the platform page. A full
filesystem is the most common guest alert, and the operator still had to
find the guest among every other one.
CheckGuest now stamps the owning guest on every filesystem alert as
guestResourceId metadata: the same guest ID the guest's own alerts are
raised under, on the canonical-spec and legacy checkMetric paths alike.
The card links a filesystem alert to ?resource=<guestResourceId>, so the
workloads table opens that guest's drawer, where the Filesystems panel
shows the mount that filled. Filesystem alerts raised before this change
carry no stamp and keep the platform page link; the card never falls
back to the filesystem id.
Final combined-source race proof source-vvsdkdin passed securityutil, PBS and Proxmox but exposed two older caller controls expecting the healthy-guest note from a one-minute observation. The restored original-source path correctly takes priority there. Place both caller fixtures at three minutes, matching the reviewed helper control and preserving used-memory, source and exact healthy-path assertions. No runtime, deadline, window, provenance or alert behavior changes.
Contract-Neutral: Test-only caller fixture ages select the existing healthy-guest retention branch; product memory and safety contracts are unchanged.
Change-source: pulse-maintainer
The connected 32-case matrix and original-age controls now pass. The older healthy-guest fixture sat exactly at the two-minute boundary and legitimately selected the restored original-source path instead of its expected healthy fallback note. Place that distinct fallback control at three minutes, preserving both windows and assertions.
Contract-Neutral: Test fixture chooses the intended existing healthy-guest branch; runtime, thresholds, deadlines and provenance contracts are unchanged.
Change-source: pulse-maintainer
Reject impossible physical counters and overflowing cache estimates. Keep the original trusted source through repeated failed/negative-cache polls within the unchanged observation-age and capacity fences, instead of clearing the incident on an independent provider fallback after one retained poll.
Exercise all eight refusals through both collectors and both HTTP clients, original percentage/byte History, backup admission, real alert decisions, valid recovery and measured zero. Preserve TLS, operation locks, shared uncertainty, deadlines and native recovery exclusions. This completes the original guest-memory outcome coherently, not a replay of source-xubz2c16.
Change-source: pulse-maintainer
Validate PVE and PBS hosts before logging them, omit url.Parse input from syntax errors, and keep cluster logging, health snapshots, recovery summaries and returned error labels separate from configured routing and TLS identity. Exercise actual rejected-host constructors, cluster routing/recovery and accepted-host controls with synthetic credentials. Connection policy, authentication and guest safety fences are unchanged.
Change-source: pulse-maintainer
Preserve all reviewed starting commits and incorporate exact current upstream PR2892 additively. The combined source requires final validation before publication.
Change-source: pulse-maintainer
Keep selection on the registry ID through context, sessions and command
routing so same-name resources cannot cross provider boundaries.
Retain native executor coordinates, legacy inputs that resolve uniquely,
policy redaction and paid execution modes.
Refs #2681
Preserve exact Core candidate bd0220d6be and the starting canonical frontier. Ended callers no longer create unstarted OS-command failures; genuine started outcomes and existing suppression remain intact. Retained source/build and consuming-surface proof support the bounded repair; native thaw and restart recovery remain separate.
Change-source: pulse-maintainer
pulse-triage[bot]