Review the VM monitoring intent before suggesting effective read-permission checks. Preserve deliberately restricted tokens, separate a denied reading from guest health, and defer access changes and live checks during backup or guest incidents. Carry the same advice through shipped filesystem help and check current, retained and refreshed production views.
Contract-Neutral: Error-copy and mirrored-help clarification with regression and browser evidence only; collection, API, authorisation, identity, freshness and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Match complete systemctl inventory rows by exact unit field with bounded reads, so updates and reinstalls reach the existing helper refresh. Preserve deliberate timer and updater masks instead of replacing their symlinks. Exercise all five installer consumers, unchanged settings and enablement, failure/timeout controls and actual fixture-root systemctl inventory.
Change-source: pulse-maintainer
Separate selected guest addresses from default-route and reachability evidence. Point API-only LXC users to existing interface/address context, without asking them to alter bridges, install agents or expose network identities.
Contract-Neutral: Documentation and static assertions only; no guest collection, identity, routing, API or frontend runtime contract changes.
Change-source: pulse-maintainer
The departmental-token report in Pulse #2756 distinguishes intended access denials from missing monitoring rights. Explain the existing per-connection selection limit, why display and alert filters do not stop reads, and why those denials do not justify broader grants or unhealthy-node conclusions. Preserve the same boundary in shipped help and a focused documentation assertion.
Contract-Neutral: Documentation-only clarification and its regression assertion; no runtime, API or subsystem contract delta.
Change-source: pulse-maintainer
Keep archive and sidecar downloads in owner-only staging, clean only owned leaves after handled failures and bootstrap exit, and preserve caller-provided inputs. Require the piped LXC installer signature before copying or execution instead of trusting PID-named files in shared tmp.
Exercise the actual download, prefetch and complete container bootstrap through confined offline doubles and real fixture SSH signatures. Preserve version, archive re-verification, staging-before-stop, service recovery, timer consent and removal boundaries; native acceptance remains separate.
Change-source: pulse-maintainer
Accept reviewed Delivery b155982e30 with retained confined menu, selector, signed-update and removal controls. Preserve current documentation frontier and exact candidate ancestry; no frontend source or infrastructure change.
Change-source: pulse-maintainer
Use the reviewed server-only selector in the existing-installation menu and bind automatic selection to available channel rows. A current selected release is a no-op; unavailable metadata or an automatic downgrade stops before mutations. Preview selection retains its channel, numeric beta/RC revisions compare correctly, and deliberate reinstall pins the actual current version.
Execute the actual menu through confined offline transport and stopped mutation boundaries. Preserve explicit version, interactive removal, signature and all-unit quiescence contracts; reconcile the inherited comment-only preview assertion with the real selector consumer.
Change-source: pulse-maintainer
System Logs pauses and clears only its browser display, while Support Bundle exports server logs and configuration. Explain those existing limits, warn about Debug's private guest details, and qualify warn-level suppression without changing runtime or recommending new probes. Keep the three shipped guides in sync and exercise their safety boundaries in the existing docs check.
Contract-Neutral: Documentation and focused guidance checks only; existing log controls, exports, monitoring, API and backup policy are unchanged.
Change-source: pulse-maintainer
Accept exact reviewed Delivery commit 56fec40f2d with retained offline selector, signed-recipe and resilience controls. No third-party helper repair or installed update is claimed.
Change-source: pulse-maintainer
Use one complete-metadata selector for installer URLs and server archives. Exclude chart and draft releases, reject unusable metadata and transport bodies, and preserve explicit pins, signed assets and downgrade refusal. Exercise the actual selectors with bounded offline controls and retain native installation as separate acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Restore server-only discovery within existing stable/preview channels; installer authority, signatures, architecture admission, downgrade refusal and state contracts are unchanged.
Use the ownership-checked existing-installation procedure for LXC and systemd update help instead of unconditional /bin/update commands. Explain chart selection without asserting a latest-pointer cause, and preserve exact signed downloads, private editions and existing state.
Contract-Neutral: Documentation-only update guidance and regression checks; no installer, updater, API or frontend runtime behaviour changes.
Change-source: pulse-maintainer
Preserve the reviewed setup repair and its original parent while composing the advanced assigned main additively. Exact isolated acquisition, E2E and workflow-trust qualification still remains required; no runtime or frontend bytes change. No prior interrupted or unexecuted proof is reclassified.
Change-source: pulse-maintainer
The managed proof pack behind `npm run dev:verify` still named
tests/17-recovery-layout.spec.ts, which 1c38d79937 replaced with
tests/17-proxmox-backups-layout.spec.ts in July. The registered proof for
scripts/hot-dev-bg.sh pinned the stale path, so nothing flagged it.
The stale path did not fail the pack. Playwright treats each spec path as
a filter, so `test --list` with main's arguments reports 10 tests in 2
files and exits 0: the Proxmox backups layout guard had silently dropped
out of dev:verify.
The replacement spec reads the mock-mode estate, while dev:verify attaches
to the managed runtime in whatever mode it was left in. Under the managed
runtime it now skips with a `npm run mock:on` hint when mock mode is off,
instead of flipping modes in place: Monitor.SetMockMode clears the
runtime's active alerts and in-memory history on every switch. The Core
E2E harness runs mock mode and is unaffected.
test-hot-dev-bg.sh now pins the new spec and checks that every spec the
default verify command names exists under tests/integration; against
main's hot-dev-bg.sh that check fails on the retired path. The integration
README and its pin, the deployment-installability contract clause, and two
unused RECOVERY_PRODUCT_SURFACE_EXACT_FILES lists naming deleted files are
brought in line.
The retained PR2697 shard waited on apt indexes for the whole one-hour job without starting a test. Bound HTTP/HTTPS acquisition and retries, reject incomplete indexes, and cap only the browser setup phase at ten minutes in all three hosted journeys. Preserve the existing repositories, authentication, browser selections and test/verdict gates.
Contract-Neutral: Hosted CI dependency acquisition only; no product runtime, installer, release contract or browser-source change.
Change-source: pulse-maintainer
Distinguish global cancellation from quiet-hours holds, queued policy skips from provider receipt, and settings changes from recall or credential revocation. Add connected sender and persistent-queue controls, and run the existing notification guidance suites in docs-only CI.
Contract-Neutral: Documentation, mirrors, tests and documentation-only CI describe existing notification behaviour; no runtime, API, permission, schema, dependency or user-visible feature contract changes.
Change-source: pulse-maintainer
Describe the integrated collector gates, explicit opt-out readback, legacy mail defaults and next-poll limits without treating dataset switches as a connection pause. Retain the verified v6.5.0 warning and incomplete-reading/alert safeguards in the existing guide and shipped mirror.
Contract-Neutral: Documentation and source-bound guidance tests only; no runtime, API, schema, permission or navigation change.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate. Combine PBS and audit safety selections without dropping prior agent-profile coverage, matching both trigger lists, command and adapter. Pro remains unchanged; source help is not installed delivery acceptance.
Change-source: pulse-maintainer
Preserve the exact two-commit candidate and retained final documentation proof. Resolve safety-list conflicts by retaining both agent-profile and PBS suites in triggers, command and adapter; no frontend source resolution.
Change-source: pulse-maintainer
Distinguish audit forwarding from alert notifications, document bounded best-effort delivery and safe reconciliation, and correct receiver, signature and key-storage advice. Bind the existing guide to source and run its safety checks in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no audit runtime, API, signature, queue, authority or deployment behaviour changes.
Change-source: pulse-maintainer
Correct the inherited PBS-via-PVE badge assumption using the production source presentation and inventory read states. Preserve the existing help anchor, distinguish PVE files from guest snapshots, and bind guidance regressions to actual source labels.
Change-source: pulse-maintainer
Replace the unconditional direct-connection fix with existing-source, evaluation and identity checks. Preserve backups, credentials and deployment state while collecting bounded evidence, and select the existing PBS recipe suite in docs-only CI.
Change-source: pulse-maintainer
Distinguish metrics from commands, live host refresh from startup-only settings, and desired configuration from verified application. Preserve local privacy opt-outs and make profile API IDs, scopes, uncertain writes and removal limits explicit in both existing help entry points. Exercise the source-bound safety guidance in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no agent authority, runtime, API or deployment contract changes.
Change-source: pulse-maintainer
Keep failed age evaluation separate from backup failure, retained alerts and native recovery. Reuse bounded incident logs and preserve the intended policy, backup data and guest-safety checks. Cover the missing guidance and reconcile its existing cleanup source assertions with the reviewed fail-closed helper.
Change-source: pulse-maintainer
Include the new production boundary suite in the existing Public docs path triggers and smoke command. Check actual command selection and fail-closed handling with disposable adapters, without dependency installation or provider operations.
Contract-Neutral: Registers the production documentation regression suite in existing read-only docs CI; no runtime, release or deployment behaviour changes.
Change-source: pulse-maintainer
Make API-only guest-agent activity and backup precautions explicit, isolate disruptive rollout checks, preserve paid runtime and recovery data during updates, and remove retired Relay/Mobile upgrade claims. Bind the existing guide and shipped mirror to safety and edition guidance.
Contract-Neutral: Existing production guidance and regression checks only; no runtime, entitlement, route or deployment contract changes.
Change-source: pulse-maintainer
Share existing list time validation across audit reads so malformed, empty or non-increasing supplied bounds cannot silently widen an investigation. Preserve absent filters, access and tenant gates, export formats and existing pagination boundaries; reject invalid export success booleans before reading events. Pin actual handlers and exporter with fake persistent loggers, including no-query rejection and tenant isolation, and update both copies of the audit guide.
Change-source: pulse-maintainer
Use the existing API helper for list, summary, export and verify examples. Explain list pagination versus export scope and preserve partial/error evidence. Exercise the copied recipes with private synthetic bodies, both auth headers, HTTP errors, redirects and incomplete transfers.
Contract-Neutral: Documentation and copied-recipe safety tests only; no audit runtime, API or frontend behaviour changes.
Change-source: pulse-maintainer
Separate browser-cookie lifetime, sliding server sessions and request-driven token refresh. Remove the false provider-change revocation promise, preserve administrator access and document the existing targeted user-removal boundary and private diagnosis.
Contract-Neutral: Documentation and source-consistency tests only; no authentication, session, authorisation or deployment contract changes.
Change-source: pulse-maintainer
Replace incomplete provider snippets with the existing authenticator and header-replacement requirements. Surface the all-users-admin default before enablement and stop copied diagnostics on bounded transport failure, preserving credentials and actual access checks.
Contract-Neutral: Documentation and synthetic recipe tests only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
The existing argv test now exercises the one documented non-purging cleanup instead of the two removed destructive examples. Retarget and ordinary agent uninstall checks are retained.
Contract-Neutral: Documentation test expectations only; no runtime or installer change.
Change-source: pulse-maintainer
Treat the existing helper as disruptive Proxmox host maintenance: disclose its LXC stop/start and key-removal scope, omit purge and API-account deletion, and require pre-state, private backups and actual postconditions. Exercise copied success/failure arguments with a synthetic helper and bind safety prose to current source.
Contract-Neutral: Documentation and documentation tests only; the cleanup helper, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
The exact-source adverse control restored a guessed-account ACL command in inline Markdown without rejection. Parse fenced shell and single-line inline commands separately so triple backticks cannot hide a later permission mutation.
Contract-Neutral: Documentation safety test repair only; no runtime or permission contract delta.
Change-source: pulse-maintainer
Keep the same safety assertion with the lower-case clause used by the guide; the first local assertion failed on capitalisation, not reader behaviour.
Contract-Neutral: Documentation test wording only; no runtime or contract delta.
Change-source: pulse-maintainer
Separate missing storage rows, capacity and pool health; remove blanket guessed-account ACL advice and user-only permission checks. Reuse bounded server log guidance on the actual Pulse host, preserving native health checks and private evidence.
Contract-Neutral: Existing documentation and safety controls only; no runtime, API, feature or permission contract change.
Change-source: pulse-maintainer
Replace indefinite journal followers, a failure-masking search and diagnostic debug/restart advice with one shared deadline-bounded reader. Preserve failed reads and both streams, identify the affected agent host and keep raw errors private. Exercise copied commands with missing-tool, partial-failure, timeout and termination controls; no native recovery claim.
Contract-Neutral: Existing agent-help recipes and executable documentation controls only; agent, installation, collection, command-channel, permission and notification runtime contracts are unchanged.
Change-source: pulse-maintainer
Separate job outcome classification from stale or absent inventory, point to existing native and expanded-row evidence, and keep disruptive diagnostics and broad permissions out of the help path.
Contract-Neutral: Existing mirrored help and rendered guidance checks only; replication runtime, API and authority contracts are unchanged.
Change-source: pulse-maintainer
Keep wrong-node errors, backup attribution and lost agent-backed Docker monitoring separate. Provide passive existing-view comparisons and native fallbacks without renaming hosts, re-enrolling agents or recreating the incident. Bind the help entry points and privacy limits to rendered documentation checks.
Contract-Neutral: Existing help maintenance only; no runtime, identity or provider contract changes.
Change-source: pulse-maintainer
source-2h58772x exposed an outdated copy assertion left behind by 53e1bff13c. Check the current severity/tag guidance and its real help link, retaining both filter conjunction requirements. No reader, guide or routing behaviour changes.
Contract-Neutral: Documentation test repair for existing routing guidance; no runtime or subsystem contract changes.
Change-source: pulse-maintainer
Preserve exact Delivery commits 697608448a and 745c1f9ce5. Same graph and endpoints; only the observed transport-only error can retry. Refusals, integrity failures, unknown output, timeouts and signals remain terminal.
Change-source: pulse-maintainer
Remove the record-limited but indefinitely blocking duplicate commands. Use the existing unfiltered Pulse readers, preserve NAS-specific safety guidance, and exercise the linked source and rendered help against failures, real deadlines, TERM resistance and missing timeout.
Contract-Neutral: Documentation and diagnostic-recipe verification only; no runtime, API, permission or subsystem behaviour changes.
Change-source: pulse-maintainer
A TERM-only timeout relies on the child exiting. Keep a fixed five-second KILL backstop, preserve every timeout as a failure and bind the shell/Go command proofs to the actual bounded invocation.
Contract-Neutral: Internal build timeout containment; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
pulse-triage[bot]