Projection replay walked the entire alert event log on every boot, twice
(monitor start and the resource-store boundary), synchronously on the
serving path, and every replayed event queued a full incident-store JSON
rewrite. A 64k-event log made startup exceed the dev supervisor's
health-kill window, so the backend restarted forever and never served.
The event log now owns per-consumer projection watermarks in
alert_store_meta, WalkOldest takes an AfterID cursor, and the single
catch-up pass runs in the background at the canonical resource-store
boundary with periodic watermark checkpoints. The watermark only
advances when both the incident store and the canonical change recorder
are attached, so partial-surface passes repair without marking events
applied, and lowering the watermark forces a full repair replay.
Incident-store saves now coalesce: a burst of mutations queues one
whole-store serialization instead of one per event, live paths included.
Registers the alert-lifecycle-replay-startup-scalability coverage gap
and amends the alerts and monitoring subsystem contracts accordingly.
Fail closed when provider endpoints are IP addresses or repeated single-label names, since those values are commonly reused across independent private estates. Preserve the candidate's qualified-endpoint continuity and add coverage for the short-endpoint collision.
Refs #1753
Contract-Neutral: narrows internal durable identity recovery evidence
Scope durable Proxmox identity-pin recovery to exact provider endpoints or established cluster identity. Record full named endpoints in new host pins and fail closed on legacy short-hostname pins, preventing the first reporting agent from canonically absorbing another standalone estate during provider-first boot windows.\n\nRefs #1753\n\nContract-Neutral: narrows internal canonical identity recovery without changing API or extension shapes
A PBS-to-PBS sync that fails mid-snapshot leaves a manifest-less copy of an
already-completed backup on the target datastore. That copy has the same
signature as a snapshot being written right now (no size, no
index.json.blob), so the guest showed Backup Running indefinitely until the
sync was repaired.
An in-flight snapshot only reports the guest as backing up when it is newer
than the guest's last completed backup and within the same 24h cutoff that
already ages out stale running vzdump tasks. A genuine in-progress backup is
always newer than the last completed one; a partial sync copy never is.
Refs #1815
Three consecutive main runs were red because landed features outran their
guardrails while change detection kept the affected shards out of their own
runs.
- Resync shipped copies of API.md, CODE_SIGNING_POLICY.md, and
PRODUCTION_SECURITY.md from repo docs.
- Track the schema v16 telemetry disclosure (workload-history adoption
counts) in the settings architecture guardrail.
- Track route-scoped TrueNAS hydration queries and the conditional Kind
column class in the platform overview layout guardrails.
- Track the contained command-authority copy (legacy combined command
profile) in the installer and setup guide tests.
- Match the sentence-split delivery retention copy in AlertDeliveryLogCard.
- Provide selectedAgentUrl, insecureMode, and customCaPath in the
InfrastructureWorkspace operations mock for the safe-collector commands.
- Include the resource list facets block in the two API contract snapshots,
normalizing the direct-marshal fixture the way every handler does.
- Require the fail-closed installer checksum wording in the
AGENT_SUBSTRATE doc contract.
Harden release workflow input transport and make native lifecycle proof honor each platform security boundary. Refresh stale telemetry and delivery qualifications.
Contract-Neutral: Formatting-only catalog updates and browser-verified alert copy; release compiler and native lifecycle changes update their owning contracts.
The public demo runs PULSE_MOCK_UPDATE_INTERVAL=60s, which stretches the
10-cohort supplemental rotation to 600s while the unified registry still
marks TrueNAS/VMware/availability sources stale after 120s. Every row those
sources own spent ~80% of each rotation flagged as a degraded stale source,
so the TrueNAS Storage tab read Healthy 0 / Attention 21 (and the vSphere
page all-Attention) despite healthy fixture data.
Rebase provider-backed fixtures every tick once the rotation would outlive
the 120s freshness budget (at slow ticks that is cheaper per wall-clock
second than the default 2s config's once-per-20s cadence), and derive mock
supplemental stale thresholds from the actual refresh cadence the same way
PVE/PBS/PMG thresholds already derive from their polling intervals. Split
the supplemental uptime step so per-tick refreshes do not advance PBS
uptime by the rotation-scaled step.
pulse-triage[bot]