Derive OIDC and SAML browser-session principals from provider-scoped subjects instead of mutable username or email claims.
Preserve compatibility by migrating legacy username/email RBAC assignments to the stable SSO principal when no authoritative group mapping is present, and pin the invariant in API/security contracts.
Resolve hosted magic-link verification through current organization membership so sessions bind to the stored stable user principal instead of token email.
Add the v6 identity invariant contract and static guards covering hosted handoff, checkout, provisioning, and magic-link boundaries.
Use stable control-plane user IDs as hosted tenant organization principals while preserving email as contact metadata and legacy fallback. Cloud handoff sessions now bind to the signed subject instead of email, seeded tenant orgs store owner/member email separately from durable user IDs, and the subsystem contracts pin that boundary.
Treat OIDC, SAML, and multi-provider SSO as included Community capabilities while retaining advanced_sso as a compatibility key. Remove SAML-specific paywalls and paid-upgrade copy from runtime, settings UI, entitlement snapshots, docs, journey proof, and subsystem contracts.
Refs #1449
Document the continued RC3 issue/discussion sweep after v5.1.29 publication, including the current latest-release state, newest public threads, and confirmation that the remaining v5 maintenance fixes are already covered in v6.
Refs #1447
Use the canonical Docker host identity for token bindings after a matched reconnect, preserve previous/current identity aliases for recreated containers, and keep rejecting token reuse by genuinely different Docker hosts.
Record the RC3 release-gate evidence for the Docker-in-LXC reconnect path.
Preserve the most severe Proxmox connection member state so offline members roll up correctly.
Move history-chart tooltips beside the hovered point when space allows and resolve PBS metric alerts against PBS thresholds during config reevaluation.
Refs #1441
Refs #1452
Refs https://github.com/rcourtman/Pulse/discussions/1448
Operators that look at the same filtered slice repeatedly (stopped
containers on a specific cluster, stale backups in last 30 days,
TrueNAS pools needing attention) now save the current filter state as
a named view and recall it with one click.
The view is the page's URL query string at save time, so saved views
double as shareable URLs: copying the bar URL after applying a view
gives someone else the exact filtered state. Storage is per-browser
localStorage under `pulse:filterbar:saved-views:<key>`. Each catalog
opts in by passing `savedViewsKey` to FilterBar:
Infrastructure: 'infrastructure'
Workloads: 'workloads'
Storage: 'storage'
Recovery Protected items: 'recovery-protected'
Recovery events: 'recovery-events'
The menu lives next to "+ Filter" on the search row. Empty state
prompts the user to save the active filters; populated state lists
saved views with hover-to-reveal X buttons for delete. The save flow
is a small inline dialog (name input + Save / Cancel) so users never
leave the menu.
The hook (useSavedViews) owns localStorage IO, JSON parse hardening,
and URL navigation through @solidjs/router. The menu (SavedViewsMenu)
owns dropdown chrome and click-outside / Escape lifecycle. WorkloadsFilter
unit tests mock @solidjs/router so the menu can render outside a Router
context in test setup.
Implicit "remember last filters" is intentionally not added: defaulting
to yesterday's `Status: Failed` would hide real problems on a monitoring
page. Recently-used auto-tracking and pinned quick-buttons remain
deferred until we see whether named views is enough.
Subsystem contracts updated to reflect the new primitive and the
per-page opt-ins:
- frontend-primitives.md: adds SavedViewsMenu + useSavedViews to
Canonical Files; describes the shared saved-views primitive in
Extension Points.
- performance-and-scalability.md, storage-recovery.md,
unified-resources.md: note that Workloads / Storage / Recovery /
Infrastructure each opt into shared saved views by passing
savedViewsKey.
- Recovery.test.tsx: regression assertion that the events controls
group renders the Saved views menu trigger (verification artifact
for the storage-recovery contract change).
rcourtman