Preserve contradictory rows before monitoring constructs its endpoint trust map. A final matching row must not mask earlier disagreement during saved-view consolidation. Cover both merge orders and retain the existing agreeing-format path; strengthen lifecycle configuration ownership checks.
Change-source: pulse-maintainer
Carry exact duplicate-row conflicts into owned client trust before map deduplication. Keep unresolved saved trust through initialization, missing-client retry and topology refresh without replacing pins or stopping trusted siblings. Cover actual monitor lifecycle routes and member projections alongside client TLS controls.
Change-source: pulse-maintainer
Resolve all saved pins for an endpoint before credential-bearing construction. Contradictory trust is an explicit failure, not a missing-pin fallback or first-use opportunity. Preserve independent authorities, agreeing formats and saved configuration; prove zero provider work, sibling monitoring and normal reload through the member projection.
Change-source: pulse-maintainer
Use scoped, detached producer tuples for canonical guests on failed nodes instead of publishing enrichment-only projections as readings. Keep original metric provenance, guest collection state and observation times, without cloning unrelated fleet data or changing guest command safety. The connected admission proof exposed and now covers this complete preservation path.
Change-source: pulse-maintainer
Require whole bounded, unambiguous enumerations on the efficient and node fallback routes. Preserve scoped empty inventories, LXC integer compatibility and ordinary counter/receipt semantics. Validate retained readings, History, breaches and template policy through actual fallback and recovery.
Change-source: pulse-maintainer
Consume the bounded response through EOF before admitting nodes or a cluster probe. Reject missing, ambiguous and incomplete inventories without leaking response details, retain scoped empty arrays and provider metadata, and cover trusted startup, recovery, cached reads and consuming endpoint projection.
Change-source: pulse-maintainer
Contract-Neutral: Tightens existing node-inventory and recovery-health admission without changing the public response schema, API surface, permissions, TLS or guest-command policy.
Require the actual nodes/login probe to succeed at startup, recovery and lazy selection instead of accepting guest-like response text. Retain failed single-endpoint health until an ordinary request succeeds, preserving cached last-resort reads, real guest error handling, temporary rate-limit handling and trust policy. Add producing-path and connected projection regressions and revise the old nodes-as-guest fixture contract.
Change-source: pulse-maintainer
The projection fixture now uses the actual saved ClusterEndpoint schema. Give each malformed-filesystem fixture an independent base path so reused listener ports cannot borrow a previous live uncertainty fence; all real guard state and response assertions remain.
Contract-Neutral: Test-only schema correction and independent synthetic endpoint identity; no production policy, deadline, wire or configuration changes.
Change-source: pulse-maintainer
Use one bounded first-use probe for constructor and nodes-read pin failures at startup, recovery and lazy selection. Keep capture credential-free, primary and saved pins immutable, and full polling-session acceptance separate. Qualify all existing auth encodings and refusal, cancellation and consuming projection controls.
Change-source: pulse-maintainer
The containing proof completed every client/TLS/parser race suite, vet and real-embed build, but the new monitoring fixture used only one shortened retry delay. Its next client check took the production cap, exhausting the poll context. Include both fixture checks and assert a live caller before polling; production retry/caller policy is unchanged.
Contract-Neutral: Correct the monitoring test schedule only; no production session, TLS, retry cadence, polling, guest safety or History contract delta.
Change-source: pulse-maintainer
Reject incomplete or ambiguous 200 login bodies before replacing ticket, CSRF, expiry and PVE generation. Preserve retained sessions, joined renewal failures, normal encoding fallback and later ordinary recovery; cover real pinned startup/poll/broadcast consumption.
Contract-Neutral: Restore existing complete-session and failed-renewal preservation guarantees; no API/wire schema, TLS trust, credential authority, guest lifecycle, polling cadence or History contract delta.
Change-source: pulse-maintainer
Carry cancellation through PVE/PBS construction, cluster probes and retained sessions, startup retries and port fallback. Preserve prior health/errors on caller termination; accepted clients retain independent ordinary reads and full timeouts. Cover real pinned HTTPS cancellation, deadlines, form fallback and first-poll publication.
Contract-Neutral: Restore existing caller cancellation and usable-session guarantees; no wire/API schema, agent lifecycle, TLS trust, guest safety, polling cadence or History contract delta.
Change-source: pulse-maintainer
The poll stores the provider ratio unchanged, while the canonical broadcast converts it to the percentage consumed by the table. Assert both boundaries without changing runtime values, reducing coverage or redoing the completed predecessor controls.
Change-source: pulse-maintainer
The connected fixture must read state with its actual mock-mode epoch before passing it to the unchanged production broadcast boundary. Keep the original failed result and every lifecycle/TLS assertion; do not weaken the fence or alter runtime recovery.
Change-source: pulse-maintainer
A provider that returns after the five-minute startup window was permanently outside polling until Pulse restarted. Preserve the capped retry cadence, cancellation, paused connections and saved TLS trust; connect the registered contract proof to six-minute virtual-time recovery and the real PBS constructor, scheduler and broadcast producer.
Change-source: pulse-maintainer
Preserve accepted 0efe3f7a12 and exact upstream ebfdc9d669 additively. Keep quiet unavailable captions, keyboard and touch reading explanations, stopped-agent provenance and primary CPU readings. Preserve stable denied-update help outside Details and all regression assertions.
Change-source: pulse-maintainer
Retain the actual authentication refusal and existing client when the full-timeout session cannot be constructed after a successful short probe. Cover pinned HTTPS rejection, malformed and form-refused sessions, later ordinary recovery and the monitor endpoint projection.
Change-source: pulse-maintainer
Retain the exact existing safety candidate after returned final drawer proof; preserve current consuming source and mock History refinements. Native restart, every-volume History and independent thaw remain unverified.
Change-source: pulse-maintainer
Three rules chose a node's single CPU temperature. Node history took
CPUMax first, agent history took cpu_package first, and the node drawer
recomputed the maximum of package, CPUMax and every core in the
browser. On an agent-fed node CPUMax is built from cores alone and can
sit below the package, and elsewhere a core can run above the package,
so the drawer's CPU temperature headline could disagree with the line
drawn beneath it and with the History tab. Node alerts and the CPU
low/record tracking used yet another package-first rule.
models.PrimaryCPUTemperatureCelsius is now the one rule: the hottest
usable package, CPU-maximum or core reading, with a sensor-map form for
agents. Node and agent history, the router's live fallbacks, the
unified resource temperature, node temperature alerts and the CPU
low/record tracking all call it. The drawer reads the resource value
through a new Node.cpuTemperature field instead of recomputing it, and
getCpuTemperature is removed.
Mock mode wrote a second package reading under a cpu.package key into
every agent host, including node-linked ones, from a series unrelated
to the node's static reading. A node and its linked agent now carry one
reading, sampled from the agent's series under the agent's real keys,
and both histories seed from that series, so the current reading
continues the line.
Preserve the exact reviewed tip and incorporate current upstream History default, marker shape and readout behavior additively.
Change-source: pulse-maintainer
Mock chart history thinned each metric with LTTB on its own. LTTB keeps
the points whose values stand out, so cpu, memory and disk of one guest
kept different timestamps: on the public demo a 24h container history
had eight ~48-point series spread over 162 distinct timestamps. The
drawer History panels break a line wherever another series in the panel
has a reading this one lacks, so every mock chart drew as dots with a
"Missing observations" note. Real history does not do this because the
poller writes all of a resource's metrics at the same times.
Thin mock series onto an epoch-aligned grid instead: keep the first
reading in each bucket plus the newest reading, at their own
timestamps. Which readings survive now depends only on when they were
taken, so series sampled together keep identical timestamps, values
stay real readings, and point targets are unchanged. The synthetic
generator no longer pre-thins to 500 points, since every caller thins
onto the grid.
The typed-reply fixture keeps the successful memory cache untouched, so the selector legitimately retains guest-agent-meminfo provenance rather than the expired-cache previous-snapshot label. Require that exact source while preserving strict last-known state, original observation time, unchanged cache and History checks.
Contract-Neutral: Fixture expectation and proof description only; runtime source selection, guest admission, observation ages, API and History semantics are unchanged.
Change-source: pulse-maintainer
Validate result/content/truncated types before shared guest-command admission is released. Scalar results must not become empty inventories, and wrongly typed file fields must not release admission before decoder failure. Preserve compatible empty/null rows and completed but unusable measurements. Add six-reader, alias/expiry and actual-state polling/broadcast/History controls with untouched healthy-read origins. Native thaw and restart recovery remain separately unverified.
Change-source: pulse-maintainer
Preserve exact reviewed d636bfdaea and published 0a44d276db ancestry. Retain both contract additions, readable System evidence and stable accessible update help alongside upstream alert-first trends, facts and Details.
Change-source: pulse-maintainer
Patrol's operator-state projection dereferenced the one-shot
MaintenanceStartAt/EndAt whenever IsInMaintenanceAt was true. A
recurring window also reports active but leaves those fields nil, so
the first finding Patrol evaluated during a recurring occurrence
panicked the provider. The projection now takes its bounds from the
active occurrence.
Alerts already silence guests under a host window scoped to
resource_and_descendants, but Patrol read only the exact resource, so
the same planned work dismissed a guest's alerts and still raised its
Patrol findings. Both now resolve maintenance through one rule,
unifiedresources.ActiveMaintenanceCoverageAt: own window plus
descendant-scoped ancestor windows, latest active end wins. Only
maintenance is inherited; monitoring mode, lifecycle and remediation
locks stay exact-resource state. An inherited dismissal says the window
is on a parent resource and names it on the lifecycle event, and the
Manage help now says descendants' new Patrol findings are dismissed
too.
Preserve the exact Core candidate and its source proof. Age both original evidence owners; keep runtime retention, guest-read admission and History policy unchanged.
Change-source: pulse-maintainer
Model elapsed time in both the QGA cache and independently annotated snapshot. Check that cache expiry alone preserves recent last-known provenance, then that fresh diagnostic polls cannot retain fully expired memory or renew percentage/byte History. Keep ordinary recovery and provider-priority controls; no runtime or retention policy changes.
Contract-Neutral: Repair and strengthen the observation lifecycle fixture only; runtime, frontend, schema, retention and admission policy are unchanged.
Change-source: pulse-maintainer
When cluster/resources polling fails, containers come from the per-node
collector, which built memory without a MemoryObservation. The unified
resource layer preserves that absence and the Workloads classifier then
reads every container on the node as "Freshness unknown", although the
same guest polled through the cluster listing reads current.
The fallback now annotates through the shared guestMemoryObservation
builder with the selected source, the listing time, the previous snapshot
and the linked agent, so running containers read current from
cluster-resources (or agent) and stopped ones unavailable from
powered-off. Numeric selection, stabilisation and alerting are unchanged.
Final combined-source race proof source-vvsdkdin passed securityutil, PBS and Proxmox but exposed two older caller controls expecting the healthy-guest note from a one-minute observation. The restored original-source path correctly takes priority there. Place both caller fixtures at three minutes, matching the reviewed helper control and preserving used-memory, source and exact healthy-path assertions. No runtime, deadline, window, provenance or alert behavior changes.
Contract-Neutral: Test-only caller fixture ages select the existing healthy-guest retention branch; product memory and safety contracts are unchanged.
Change-source: pulse-maintainer
The connected 32-case matrix and original-age controls now pass. The older healthy-guest fixture sat exactly at the two-minute boundary and legitimately selected the restored original-source path instead of its expected healthy fallback note. Place that distinct fallback control at three minutes, preserving both windows and assertions.
Contract-Neutral: Test fixture chooses the intended existing healthy-guest branch; runtime, thresholds, deadlines and provenance contracts are unchanged.
Change-source: pulse-maintainer
Reject impossible physical counters and overflowing cache estimates. Keep the original trusted source through repeated failed/negative-cache polls within the unchanged observation-age and capacity fences, instead of clearing the incident on an independent provider fallback after one retained poll.
Exercise all eight refusals through both collectors and both HTTP clients, original percentage/byte History, backup admission, real alert decisions, valid recovery and measured zero. Preserve TLS, operation locks, shared uncertainty, deadlines and native recovery exclusions. This completes the original guest-memory outcome coherently, not a replay of source-xubz2c16.
Change-source: pulse-maintainer
Preserve exact Core candidate bd0220d6be and the starting canonical frontier. Ended callers no longer create unstarted OS-command failures; genuine started outcomes and existing suppression remain intact. Retained source/build and consuming-surface proof support the bounded repair; native thaw and restart recovery remain separate.
Change-source: pulse-maintainer
Retain every reviewed starting commit and the refreshed exact published workload identity source additively. PR2888 remains unchanged pending its completed qualification defects; this unproposed composition requires exact final-source checks before the later publication batch.
Change-source: pulse-maintainer
An exhausted caller context can reach metadata enrichment after its network read completes. Invoking the OS callback with that ended budget records a failure even though no OS command started; repeated polls then permanently suppress OS discovery. Refuse callbacks once their caller budget has ended and retain explicit unstarted evidence, without reclassifying any started command outcome. Exercise both HTTP clients, ordinary collectors, expired and cancelled contexts, cold and retained identity, real rejection suppression and independent readings.
Contract-Neutral: Preserve existing guest read/publication, backoff and OS-command suppression contracts; distinguish an unstarted local callback without changing wire, lock, uncertainty, TLS or retention policy.
Change-source: pulse-maintainer
Keep the current clock and stored-History readout alongside canonical row
selection and resource-owned drawer state.
Use one Git inheritance reader for browser and canonical qualification.
Inherited modes and objects keep their parent proof, while new resolutions
and mode changes remain subject to current contract and proof requirements.
Range checks still qualify the complete proposed change.
Refs #1669
A connection label can contain the metadata-key delimiter. Retiring site must not cancel reads or erase OS-command suppression, backoff and diagnostic origins for site|other. Read metadata ownership from its fixed suffixes and use each diagnostic record's exact Instance. Exercise cached, in-flight and ordinary HTTP collector paths with unrelated labels.
Contract-Neutral: Preserve existing connection-isolated retirement; internal cache ownership only, with no public wire, endpoint, TTL, guest-command completion, backup-lock or TLS policy delta.
Change-source: pulse-maintainer
Treat only an observed HTTP 429 as a temporary request refusal, preserving metadata backoff and real command-safety suppression. Cover ordinary clients and collectors, stale identity, Windows recovery and quoted-status negative controls.
Change-source: pulse-maintainer
Contract-Neutral: Existing OS-command suppression classification only; no public wire shape, capability, deadline, retention or guest-command safety delta.
Use unified resource IDs for workload rows and selection so moving a guest
between Proxmox nodes retains its open drawer and History range. Resolve
existing bookmarks through the registry instead of rebuilding client IDs.
Migrate guest metadata before accepted inventory publication and retain its
operator fields in memory if persistence fails. Native metadata and metrics
coordinates remain explicit compatibility inputs. Operator policy and paid
execution behavior remain intact.
Register the focused publication and writer proofs once. Check proof
acceptance and rejection without copying the registry catalog into tests.
Refs #1669
Publish ticket, CSRF and expiry as one locked snapshot, and bind expiry/401 renewal to the rejected session generation. Concurrent readers share one authentication attempt while retaining their own cancellation and ordinary single-retry behaviour. Keep guest commands single-attempt and token/TLS policy unchanged.
Contract-Neutral: Synchronise existing Proxmox password-session renewal without changing API fields, TLS policy or guest-command admission and replay rules.
Change-source: pulse-maintainer
The previous-state input projected each host's current disk inventory before discarding offline or unlinked hosts. Check those immutable view fields first and keep the linked-host projection, source age and guest selection unchanged. Add exact selection, ownership, withdrawal/recovery and allocation-scaling controls.
Contract-Neutral: Allocation-only early filtering of hosts that never contributed to guest carry-over; linked evidence, wire fields, timestamps, polling and safety rules are unchanged.
Change-source: pulse-maintainer
The exact composed Go 1.26.9 proof source-ji6j004_ fails because the Docker-ingest source guard still requires two direct state updates replaced by reviewed live-owner publication. Require both routes to call the ownership gate and require that gate to retain the canonical state update. No runtime or Docker behavior changes; preserve the failure and all accepted commits.
Change-source: pulse-maintainer
A polling budget is not connection retirement. Retain the original 40 ms and 250 ms large-cluster controls: deadline expiry may finish local authoritative-inventory publication, but explicit cancellation, runtime end and client replacement still withdraw it, and no new read is admitted after expiry.
Change-source: pulse-maintainer
Keep the existing 500-guest, no-detail-call and healthy-connection assertions. Expire the child enrichment budget before collection while leaving the parent publication tail alive, and register the client in the whole-PVE fixture.
Contract-Neutral: Fixture lifecycle correction only; production behaviour and thresholds are unchanged.
Change-source: pulse-maintainer
Supply the metadata cache in the deliberately minimal monitor before installing retained OS-command safety. The first focused source proof stopped at this fixture assignment; keep that failed receipt and validate the corrected control without replaying completed scenarios.
Contract-Neutral: Fixture initialisation only; production behaviour is unchanged.
Change-source: pulse-maintainer
Drive both production enumeration routes through a consumed synthetic filesystem reply. Check cycle withdrawal, retained shared uncertainty, ordinary independent-status publication, per-guest recovery and both History stores.
Contract-Neutral: HTTP regression proof only; production behaviour and interfaces are unchanged.
Change-source: pulse-maintainer
Stage both enumeration routes' guest readings, snapshots, alerts, backup eligibility and History until their complete cycle is admitted. Retirement, runtime replacement and transport changes cancel obsolete reads and serialize state withdrawal against admitted effects without holding the monitor mutex through callbacks.
Retain authoritative inventory after detail-budget expiry, independent agents and accepted cache safety; cancellation is not command completion. Add deterministic late-reply and publication-order controls.
Change-source: pulse-maintainer
Controlled cancellation, retirement and replacement cases exercise the production guest entry point, both enumeration routes and its retained readings, diagnostics, alerts and History.
Contract-Neutral: Regression controls only; production behaviour is unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]