Accept exact reviewed Delivery commit 56fec40f2d with retained offline selector, signed-recipe and resilience controls. No third-party helper repair or installed update is claimed.
Change-source: pulse-maintainer
Use one complete-metadata selector for installer URLs and server archives. Exclude chart and draft releases, reject unusable metadata and transport bodies, and preserve explicit pins, signed assets and downgrade refusal. Exercise the actual selectors with bounded offline controls and retain native installation as separate acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Restore server-only discovery within existing stable/preview channels; installer authority, signatures, architecture admission, downgrade refusal and state contracts are unchanged.
Use the ownership-checked existing-installation procedure for LXC and systemd update help instead of unconditional /bin/update commands. Explain chart selection without asserting a latest-pointer cause, and preserve exact signed downloads, private editions and existing state.
Contract-Neutral: Documentation-only update guidance and regression checks; no installer, updater, API or frontend runtime behaviour changes.
Change-source: pulse-maintainer
The managed proof pack behind `npm run dev:verify` still named
tests/17-recovery-layout.spec.ts, which 1c38d79937 replaced with
tests/17-proxmox-backups-layout.spec.ts in July. The registered proof for
scripts/hot-dev-bg.sh pinned the stale path, so nothing flagged it.
The stale path did not fail the pack. Playwright treats each spec path as
a filter, so `test --list` with main's arguments reports 10 tests in 2
files and exits 0: the Proxmox backups layout guard had silently dropped
out of dev:verify.
The replacement spec reads the mock-mode estate, while dev:verify attaches
to the managed runtime in whatever mode it was left in. Under the managed
runtime it now skips with a `npm run mock:on` hint when mock mode is off,
instead of flipping modes in place: Monitor.SetMockMode clears the
runtime's active alerts and in-memory history on every switch. The Core
E2E harness runs mock mode and is unaffected.
test-hot-dev-bg.sh now pins the new spec and checks that every spec the
default verify command names exists under tests/integration; against
main's hot-dev-bg.sh that check fails on the retired path. The integration
README and its pin, the deployment-installability contract clause, and two
unused RECOVERY_PRODUCT_SURFACE_EXACT_FILES lists naming deleted files are
brought in line.
Distinguish global cancellation from quiet-hours holds, queued policy skips from provider receipt, and settings changes from recall or credential revocation. Add connected sender and persistent-queue controls, and run the existing notification guidance suites in docs-only CI.
Contract-Neutral: Documentation, mirrors, tests and documentation-only CI describe existing notification behaviour; no runtime, API, permission, schema, dependency or user-visible feature contract changes.
Change-source: pulse-maintainer
Describe the integrated collector gates, explicit opt-out readback, legacy mail defaults and next-poll limits without treating dataset switches as a connection pause. Retain the verified v6.5.0 warning and incomplete-reading/alert safeguards in the existing guide and shipped mirror.
Contract-Neutral: Documentation and source-bound guidance tests only; no runtime, API, schema, permission or navigation change.
Change-source: pulse-maintainer
Preserve the exact reviewed candidate. Combine PBS and audit safety selections without dropping prior agent-profile coverage, matching both trigger lists, command and adapter. Pro remains unchanged; source help is not installed delivery acceptance.
Change-source: pulse-maintainer
Preserve the exact two-commit candidate and retained final documentation proof. Resolve safety-list conflicts by retaining both agent-profile and PBS suites in triggers, command and adapter; no frontend source resolution.
Change-source: pulse-maintainer
Distinguish audit forwarding from alert notifications, document bounded best-effort delivery and safe reconciliation, and correct receiver, signature and key-storage advice. Bind the existing guide to source and run its safety checks in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no audit runtime, API, signature, queue, authority or deployment behaviour changes.
Change-source: pulse-maintainer
Correct the inherited PBS-via-PVE badge assumption using the production source presentation and inventory read states. Preserve the existing help anchor, distinguish PVE files from guest snapshots, and bind guidance regressions to actual source labels.
Change-source: pulse-maintainer
Replace the unconditional direct-connection fix with existing-source, evaluation and identity checks. Preserve backups, credentials and deployment state while collecting bounded evidence, and select the existing PBS recipe suite in docs-only CI.
Change-source: pulse-maintainer
Distinguish metrics from commands, live host refresh from startup-only settings, and desired configuration from verified application. Preserve local privacy opt-outs and make profile API IDs, scopes, uncertain writes and removal limits explicit in both existing help entry points. Exercise the source-bound safety guidance in docs-only CI.
Contract-Neutral: Documentation and static guidance checks only; no agent authority, runtime, API or deployment contract changes.
Change-source: pulse-maintainer
Keep failed age evaluation separate from backup failure, retained alerts and native recovery. Reuse bounded incident logs and preserve the intended policy, backup data and guest-safety checks. Cover the missing guidance and reconcile its existing cleanup source assertions with the reviewed fail-closed helper.
Change-source: pulse-maintainer
Include the new production boundary suite in the existing Public docs path triggers and smoke command. Check actual command selection and fail-closed handling with disposable adapters, without dependency installation or provider operations.
Contract-Neutral: Registers the production documentation regression suite in existing read-only docs CI; no runtime, release or deployment behaviour changes.
Change-source: pulse-maintainer
Make API-only guest-agent activity and backup precautions explicit, isolate disruptive rollout checks, preserve paid runtime and recovery data during updates, and remove retired Relay/Mobile upgrade claims. Bind the existing guide and shipped mirror to safety and edition guidance.
Contract-Neutral: Existing production guidance and regression checks only; no runtime, entitlement, route or deployment contract changes.
Change-source: pulse-maintainer
Share existing list time validation across audit reads so malformed, empty or non-increasing supplied bounds cannot silently widen an investigation. Preserve absent filters, access and tenant gates, export formats and existing pagination boundaries; reject invalid export success booleans before reading events. Pin actual handlers and exporter with fake persistent loggers, including no-query rejection and tenant isolation, and update both copies of the audit guide.
Change-source: pulse-maintainer
Use the existing API helper for list, summary, export and verify examples. Explain list pagination versus export scope and preserve partial/error evidence. Exercise the copied recipes with private synthetic bodies, both auth headers, HTTP errors, redirects and incomplete transfers.
Contract-Neutral: Documentation and copied-recipe safety tests only; no audit runtime, API or frontend behaviour changes.
Change-source: pulse-maintainer
Separate browser-cookie lifetime, sliding server sessions and request-driven token refresh. Remove the false provider-change revocation promise, preserve administrator access and document the existing targeted user-removal boundary and private diagnosis.
Contract-Neutral: Documentation and source-consistency tests only; no authentication, session, authorisation or deployment contract changes.
Change-source: pulse-maintainer
Replace incomplete provider snippets with the existing authenticator and header-replacement requirements. Surface the all-users-admin default before enablement and stop copied diagnostics on bounded transport failure, preserving credentials and actual access checks.
Contract-Neutral: Documentation and synthetic recipe tests only; proxy authentication semantics and runtime contracts are unchanged.
Change-source: pulse-maintainer
The existing argv test now exercises the one documented non-purging cleanup instead of the two removed destructive examples. Retarget and ordinary agent uninstall checks are retained.
Contract-Neutral: Documentation test expectations only; no runtime or installer change.
Change-source: pulse-maintainer
Treat the existing helper as disruptive Proxmox host maintenance: disclose its LXC stop/start and key-removal scope, omit purge and API-account deletion, and require pre-state, private backups and actual postconditions. Exercise copied success/failure arguments with a synthetic helper and bind safety prose to current source.
Contract-Neutral: Documentation and documentation tests only; the cleanup helper, privileges and runtime contracts are unchanged.
Change-source: pulse-maintainer
The exact-source adverse control restored a guessed-account ACL command in inline Markdown without rejection. Parse fenced shell and single-line inline commands separately so triple backticks cannot hide a later permission mutation.
Contract-Neutral: Documentation safety test repair only; no runtime or permission contract delta.
Change-source: pulse-maintainer
Keep the same safety assertion with the lower-case clause used by the guide; the first local assertion failed on capitalisation, not reader behaviour.
Contract-Neutral: Documentation test wording only; no runtime or contract delta.
Change-source: pulse-maintainer
Separate missing storage rows, capacity and pool health; remove blanket guessed-account ACL advice and user-only permission checks. Reuse bounded server log guidance on the actual Pulse host, preserving native health checks and private evidence.
Contract-Neutral: Existing documentation and safety controls only; no runtime, API, feature or permission contract change.
Change-source: pulse-maintainer
Replace indefinite journal followers, a failure-masking search and diagnostic debug/restart advice with one shared deadline-bounded reader. Preserve failed reads and both streams, identify the affected agent host and keep raw errors private. Exercise copied commands with missing-tool, partial-failure, timeout and termination controls; no native recovery claim.
Contract-Neutral: Existing agent-help recipes and executable documentation controls only; agent, installation, collection, command-channel, permission and notification runtime contracts are unchanged.
Change-source: pulse-maintainer
Separate job outcome classification from stale or absent inventory, point to existing native and expanded-row evidence, and keep disruptive diagnostics and broad permissions out of the help path.
Contract-Neutral: Existing mirrored help and rendered guidance checks only; replication runtime, API and authority contracts are unchanged.
Change-source: pulse-maintainer
Keep wrong-node errors, backup attribution and lost agent-backed Docker monitoring separate. Provide passive existing-view comparisons and native fallbacks without renaming hosts, re-enrolling agents or recreating the incident. Bind the help entry points and privacy limits to rendered documentation checks.
Contract-Neutral: Existing help maintenance only; no runtime, identity or provider contract changes.
Change-source: pulse-maintainer
source-2h58772x exposed an outdated copy assertion left behind by 53e1bff13c. Check the current severity/tag guidance and its real help link, retaining both filter conjunction requirements. No reader, guide or routing behaviour changes.
Contract-Neutral: Documentation test repair for existing routing guidance; no runtime or subsystem contract changes.
Change-source: pulse-maintainer
Preserve exact Delivery commits 697608448a and 745c1f9ce5. Same graph and endpoints; only the observed transport-only error can retry. Refusals, integrity failures, unknown output, timeouts and signals remain terminal.
Change-source: pulse-maintainer
Remove the record-limited but indefinitely blocking duplicate commands. Use the existing unfiltered Pulse readers, preserve NAS-specific safety guidance, and exercise the linked source and rendered help against failures, real deadlines, TERM resistance and missing timeout.
Contract-Neutral: Documentation and diagnostic-recipe verification only; no runtime, API, permission or subsystem behaviour changes.
Change-source: pulse-maintainer
A TERM-only timeout relies on the child exiting. Keep a fixed five-second KILL backstop, preserve every timeout as a failure and bind the shell/Go command proofs to the actual bounded invocation.
Contract-Neutral: Internal build timeout containment; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
Keep the same pinned Go graph and endpoint. Retry only the observed transport-only diagnostic, at most three attempts; stop on refusals, integrity errors, unknown output, timeouts and signals. Execute the actual Docker download command against controlled outcomes and retain its original-base rejection.
Contract-Neutral: Build-only transport recovery; source graph, endpoints, checksum trust and artifact acceptance are unchanged.
Change-source: pulse-maintainer
Bring the general Unix private-file bootstrap up to the existing PBS guide's safety floor. Preserve token and installer files, ignore curl configuration, require verified HTTPS and HTTP 200 before publishing the script, and exercise refusal and partial-download paths.
Contract-Neutral: Documentation and executable documentation tests only; no installer, API, runtime or capability contract changes.
Change-source: pulse-maintainer
Admit a prepared executable and source revision before stopping Pulse. Keep the live binary in place until one same-filesystem rename, and restore only a previously active service after a failed rename. Preserve existing recovery files and exercise staging, stop, rename and recovery failures.
Change-source: pulse-maintainer
Reject signature, extraction, architecture, destination staging and version failures before the service outage. Keep the live executable until a same-filesystem rename succeeds, remove the destructive version retry, and recover only a previously active, confirmed-stopped service if rename fails. Exercise the real archive path with download/local inputs and retained byte/mode/state fault controls; preserve uncertain-stop restrictions and separate native acceptance.
Change-source: pulse-maintainer
Integrate Delivery candidate 7ee03281c0 without re-parenting either reviewed commit. Bounded service-state admission protects archive and source replacement, and manual flows stage before stopping. Retain exact-source installer/race proof source-93q9_bp2 and its stated skips, line-bound warning and native limits; no frontend or infrastructure delta.
Change-source: pulse-maintainer
Remove unscoped Compose and Helm update shortcuts and blind container removal from the installation entry point. Keep exact edition, effective storage, successful staging and current-state checks connected to the maintained procedures; add regression controls for the shipped guidance.
Contract-Neutral: Documentation-only update guidance and regression checks; installer, runtime and deployment behaviour are unchanged.
Change-source: pulse-maintainer
The first exact-source proof passed all replacement controls but the menu fixture shadowed main's choice variable and exited before staging. Use a distinct local selector and retain the fixture stderr on assertion failure.
Contract-Neutral: Fixture-only shell output-variable correction; no runtime or replacement-contract delta.
Change-source: pulse-maintainer
Archive and source installs ignored stop failures, while the manual flows stopped Pulse before staging. Require bounded state reads and a confirmed inactive service before either replacement; keep prior-active attribution and installed metadata on refusal. Exercise both real paths, timeout and uncertain-state controls, and manual staging failures without native or production mutation.
Change-source: pulse-maintainer
Preserve the exact reviewed Product Intelligence candidate. Source-bound documentation, mirror, parent and mutant checks cover the existing FAQ maintenance; browser admission was busy before execution and is not rendered acceptance.
Change-source: pulse-maintainer
Distinguish the web listener from Docker's host port and apply environment handover through the existing deployment, with data, credentials and security overrides preserved. Link the detailed recovery paths and add parent-sensitive documentation checks plus a bounded browser scenario.
Contract-Neutral: Documentation and test-fixture changes only; no configuration, runtime, API, privacy, installation or subsystem contract delta.
Change-source: pulse-maintainer
Distinguish skipped selected tests and passing parents with skipped subtests in the existing CI sidecar. Retain only bounded source names and an aggregate child event count, including on failed or incomplete runs. Preserve shard selection, timings, diagnostics and required verdicts.
Change-source: pulse-maintainer
Contract-Neutral: CI-only additive skip diagnostics; no product installability, test-selection, threshold, privacy allowlist or required-verdict contract change.
Preserve the exact Product intelligence candidate, its unchanged report semantics and performance guard. Combine it with the reviewed SMART alert repair without overlapping source edits.
Change-source: pulse-maintainer
Preserve f2b5080bcc and 580199f07c exactly. Resolve only the shared classifier working-directory comment in favour of main's wording, retaining its compilation assertions and the common checkout-root execution.
Change-source: pulse-maintainer
pulse-triage[bot]