Preserve malformed timestamp evidence through resource projection and label future, invalid or unusable dates as unknown in existing row indicators, tooltips and drawer protection. Keep explicit absence, configured age thresholds and running activity distinct. Validate real API and canonical snapshot replacements with parent controls and production-component browser fixtures; no native backup or thaw claim.
Change-source: pulse-maintainer
Accept exact Core candidate fcd9b65b82 with retained semantic, allocation, race, monitoring-suite and actual embedded build evidence. Preserve observations and caller isolation; no native performance or release acceptance is asserted.
Change-source: pulse-maintainer
Reject mismatched resource, range and metric envelopes and malformed samples at the shared client boundary. Preserve explicit Kubernetes compatibility, real access failures, valid empty history and measured zero. Exercise drawer, single-metric and row-cache consumers, and inspect desktop and phone-emulated browser renders.
Change-source: pulse-maintainer
Count retained samples before allocating detached snapshots for guest, node, disk and storage readers. Preserve exclusive cutoffs, unordered inputs, original observations and empty arrays. Cover public series, snapshot isolation, connected chart/window consumers and same-executable allocation comparisons; no SQL, retention or source-selection change.
Change-source: pulse-maintainer
Contract-Neutral: In-memory History copy allocation only; public API/JSON shape, sample order/cutoffs, retention and observation authority are unchanged.
Preserve the exact Web candidate and its parent-bound browser receipt; retain the unrelated backup-date timeout and source-proof exit discrepancy as adverse evidence.
Change-source: pulse-maintainer
Accept exact PI candidate b27387d8fc and ancestor ad4fbff6be. Existing help now matches observation-location selection, server-dependent notification delivery, bounded buffering and Mobile retirement. Retain source-_7_dmsnc and inspected desktop/phone-emulated Docs render evidence; no runtime behaviour or native delivery acceptance is claimed.
Contract-Neutral: Integrate existing help, shipped mirrors and their verification without changing runtime, API semantics, entitlement or alert policy.
Change-source: pulse-maintainer
Preserve exact upstream 24723dd642 alongside the clean reviewed canonical tip. This is a bounded batch-start reconciliation; source content is unchanged.
Change-source: pulse-maintainer
Withdraw another target’s service and URL while its replacement is loading or unavailable. Preserve final access status without denied bodies, label same-target transient evidence and offer an in-place retry. Dispose per-guest forms and the replaced discovery consumer without cancelling or repeating server operations. Preserve existing same-target query reuse and independent saved operator URLs. Add connected identity/access regressions, contracts and exact-content desktop/phone browser evidence.
Change-source: pulse-maintainer
Fresh editor and API inspection shows that local and remote paths can coexist, including in published v6.4.5. Explain the actual location picker, per-path uncertainty and safe canonical-versus-legacy update fields, and validate the linked target-field instructions in the Docs renderer.
Contract-Neutral: Documentation, shipped mirrors and guidance verification only; existing observation and API semantics are unchanged.
Change-source: pulse-maintainer
## What changed and why
- Guest filesystem History distinguishes paused/retained readings from
current observations. Incomplete readings stay unavailable rather than
appearing as healthy empty disks; measured zero and known capacity
remain useful. Related to #2439 and #1723.
- Installation help removes the minimal root-server service recipe,
explains the existing hardened installer and distinguishes a missing
unit from a loaded root service. Removal guidance preserves persistent
data by default, explains temporary container storage and Helm claim
ownership, requires a consistent private full-state backup and separates
disabling the service from destructive erasure.
- TrueNAS setup help distinguishes a successful system-information
connection test from collected inventory/metrics and preserves polling
evidence. Passive VM preflight rejects malformed configuration before
concluding that an agent setting or backup lock is absent. Related to
#2382 and #2439.
- The native backup evidence checker requires observed post-task
filesystem and memory reads, not merely fresh-looking timestamps.
- Add an exact-published-RC browser update/recovery workflow with
authenticated archives, reviewed control identity, a dedicated narrow CI
registration, self-only Serve and terminal refusal handling. It is a
qualification route, not a qualification result.
The documentation and filesystem changes address unsafe implications in
existing surfaces; no new product route or feature is added. The browser
route supports the required release update/recovery journey.
## Included source
Range:
`13df84e9038be8017110105186b44f626154a3f6..c0ceff669774cec9f3b71f0bade244133f9949bb`.
All previously reviewed identities and their ancestry are retained:
- TrueNAS candidates `1c999113` / `59a27e2c`, integration `22f16541`,
additive published-main merge `a6b83db5`, passive preflight `adcd0ddf`
(the original PR head).
- Installation candidates `a6959e57` / `01adf338`, integration
`6cf691ec`; data-preserving removal candidate `fa6282b7`, integration
`0f3575bd`.
- Filesystem/History candidates `28bb0fb5` / `81b07e8a`, compositions
`ba8b9fcd` / `5d1b03c1`, integration `53cfdf60`.
- Browser-route candidate sequence `fdf46457`, `619133aa`, `729b2cf7`,
`f0ff1934`, `73b790b8`, `d855d322`, `30ca9681`, `a847b05e`, `2fb4bf9e`,
integration `b42563d9`.
- Backup-resumption checker `1920db3c`, integration `acace4d4`.
- New additive publication correction `c0ceff66` normalizes only
Markdown whitespace and capitalization in the TrueNAS safety assertions.
Every required warning and diagnostic field remains checked;
documentation/runtime content is unchanged by this correction.
## Validation and remaining limits
Recorded reviewed source evidence includes full TypeScript checking, 407
filesystem/UI regressions across fifteen relevant families, production
embedded build and unchanged bundle budgets (`source-bnh7z6xi`); 58
removal-help controls/types/build/budgets (`source-f_l3trzu`); inspected
desktop Chromium and phone-emulated WebKit help and filesystem states;
57 connected browser-route controls/workflow trust (`source-agx1sbr6`);
and nineteen focused backup-checker methods. These remain evidence at
their original source bindings. Publication comparisons confirm
unchanged validated runtime, removal guidance and qualification-route
bytes; the final browser guard covers all four changed frontend runtime
files with their in-range receipts.
Exact final-source offline smoke receipt `source-ljvxb1yx` at
`c0ceff669774cec9f3b71f0bade244133f9949bb` ran 59 families: 57 passed,
two failed; exit 1 with complete output and confirmed guest stop. All
changed smoke families, including the corrected seven TrueNAS tests and
new browser-route controls, passed. The failures concern unchanged
historical Git fingerprints (unavailable objects in the disposable
source input) and an extra synthetic npm-audit invocation. The same
unchanged tests passed in the original hosted PR run and all 21 pass in
a confined lightweight native-Git comparison. The npm observation
remains unresolved with Delivery; the complete VM suite is **not**
reported as a pass or replaced by the comparison.
Publication also verifies provenance, clean committed source, upstream
and starting-reviewed-tip ancestry, matching documentation mirrors and
whitespace. Removing either affected safety warning still fails the
corrected assertion. Sufficient completed frontend/browser proofs were
not repeated just because their changes share this batch.
The original PR's completed run `37175962472` failed required script
smoke on capitalization/line wrapping, now corrected additively. Its
advisory benchmark reported
`HandleMetricsHistory_MemoryFallback/all-metrics` +12.58% (p=0.019, ten
samples). No Go or benchmark source differs between that original head
and its base; this is not a causal diagnosis or a passing measurement.
The adverse result remains with Delivery for independent disposition.
The old head has finished checks and cannot land independently because
of the required smoke failure, so this proposal advances once to include
the coherent reviewed batch and correction, rather than restarting
still-running CI.
Exact-head review and protected checks remain required. Earlier
unexecuted readiness attempts are not reconstructed passes. This source
does not establish native thaw, TrueNAS collection, installed recovery,
a containing release or deployment. The browser route still needs its
dedicated registration/ACL prerequisite and activated dispatcher before
native use; the earlier HTTP401 remains adverse and unreplayed. Release
qualification, soak and promotion remain separate.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Additive follow-on batch and final publication check
The completed exact-head Build and Test run `37179468966` cannot land:
its required rest-1 job rejects the browser workflow's Node `24.20.0`
selector under the existing governed `24` parity contract. Correction
`903dc08d23d4278103950e0df6ed5f7b8fb97760` selects the same `24` line as
other workflows and adds a focused trust regression; no parity
assertion, pinned action, browser tooling, privilege or release gate is
weakened. The old head is terminal, not still validating, so the
proposal advances once with this repair and the coherent reviewed
follow-on source.
Final range:
`13df84e9038be8017110105186b44f626154a3f6..903dc08d23d4278103950e0df6ed5f7b8fb97760`.
Additional accepted identities, preserved unchanged:
- Complete VM-configuration response boundary `227f4f7e` / composition
`f7eeabc4`, integrated by `de081296`: do not admit guest reads from an
incomplete unlocked JSON prefix. Related to #2439.
- Token help `74c35227` / `383be305`, integration `630f45a2`: match
seven least-privilege presets, distinguish prompt exposed-token
revocation from planned rotation, and explain kiosk bearer-link and
per-tab limits.
- Guest workload evidence `23235502`, integration `0e41d8d2`: preserve
existing disk-deferral, guest-agent and lock facts through API and
canonical snapshots, clear obsolete omitted facts only after an explicit
new native outcome, and withdraw unavailable numeric bars while
preserving labelled prior and measured-zero readings. Related to #2439
and #1723.
- Used-memory History retention `0ea87307`, integration `768952fd`:
expire byte samples alongside existing series without deleting
still-live byte-only resource entries. This is not an attribution of
reported process memory growth.
Aggregate reviewed evidence adds `source-hctbddnb` for complete-response
parent/final race controls; `source-n8_u1xm9` for 37 token-help
controls, types/build/budgets, with fixture-only syntax
`source-5ws674f3` and six inspected desktop/phone-emulated captures;
`source-c8k64dn9` for types, 761 tests in eighteen relevant files,
lint/audits/build/budgets, forty browser transitions and six inspected
captures; and `source-0qcd2wj7` for adverse parent omissions, final
retention and connected History readers under race/vet/affected-package
build. These retain their original source bindings. Publication
comparisons confirm final changed Web runtime and Core Go bytes match
those tested candidates, and the final browser guard covers all seven
changed frontend runtime files through their own-parent in-range
receipts. Sufficient compiler, build and visual proofs were not repeated
solely for batching.
Exact final-source offline receipt **`source-1_rh272s`** at
`903dc08d23d4278103950e0df6ed5f7b8fb97760` passes the previously failing
Node parity test under race, selected
guest-agent/backup/History/memory/metric-window families in Proxmox and
monitoring under race, 18 browser-packet/Tailnet controls and 43
workflow-trust controls. Exit 0, complete 11,065-byte output and
completed guest stop; this is focused source proof, not a full-suite or
release qualification claim.
The same old-head run also reports advisory `ReportMarshal_Parallel-4`
+23.25% (p=0.009, ten samples, candidate spread 19%). At that old
proposal head, Go/dependency/build-and-test/benchmark source is
unchanged from its base. This establishes no changed benchmark source,
not a passing measurement or a cause. It remains adverse alongside the
earlier +12.58% History result under the existing Delivery disposition
request. No unchanged retry, threshold relaxation or release clearance
is claimed. The newer retention repair changes Go source, so it is not
covered by that unchanged-source comparison. New exact-head required
checks and independent review must finish before landing.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate remote check execution from server-side alert delivery, explain indeterminate and bounded-buffer behaviour, and link independent watchdog coverage without a permanent Mobile or Relay promise. Preserve the existing probe and notification contracts and verify both shipped guides and their keyboard help paths.
Contract-Neutral: Existing help, its shipped mirrors and verification only; no runtime, entitlement, alert policy or API changes.
Change-source: pulse-maintainer
PR #2456 run 37179468966 failed TestNodeToolchainParity because the new workflow selected a patch version instead of the existing governed Node 24 line. Match the other workflows and add a focused trust regression without weakening the parity contract.
Contract-Neutral: Correct a workflow toolchain selector to the existing repository contract; no application, permission or release gate changes.
Change-source: pulse-maintainer
Accept exact Core candidate 0ea87307e2. Retained source-0qcd2wj7 proves parent omissions, final retention and connected readers under race, vet and affected-package build; intervening canonical changes do not touch the affected Go source.
Change-source: pulse-maintainer
Accept a stable exact Node pin only within the governed major instead of
comparing its entire string with the major selector. Keep all other lines,
ranges and unresolved selectors rejected. This repairs the deterministic
required-check failure on the published-RC browser workflow without removing
its exact Node pin.
Give fake npm audit tests their own default timing controls and exercise
poisoned caller environments while preserving explicit watchdog tests.
No production audit verdict, dependency graph, benchmark threshold or release
gate changes.
Change-source: pulse-maintainer
Periodic guest and node cleanup omitted raw memory-used samples from both expiry and live-entry checks. Trim them with the existing retention and backing-array policy without deleting a still-live byte series. Cover every supported History series, byte-array reclamation, concurrent cleanup and poll-to-chart/metric-window resumption. No SQL retention, source-selection or wire changes.
Change-source: pulse-maintainer
Forward existing disk deferrals, guest-agent state and VM locks through API and canonical snapshots. Supersede omitted optional fields only on an explicit native VM outcome, consistently across full and fast merges. Withdraw unavailable row numerics while preserving valid prior and measured-zero readings. Add connected hook, merge, mounted and inspected browser controls without issuing guest or backup commands.
Change-source: pulse-maintainer
The real scope table contains the 15 selectable UI scopes plus the wildcard row. Count all 16 entries rather than rejecting the correctly rendered reference. The corrected Chromium and phone-emulated WebKit run passes with all six screenshots inspected; shipped documentation and suite-covered source are unchanged.
Contract-Neutral: Browser-test assertion only; no runtime or user-facing contract delta.
Change-source: pulse-maintainer
Correct the existing configuration help against the live preset model and token client: reporting does not include lifecycle authority, exposed credentials need prompt revocation, and kiosk display preferences do not restrict credentials or guarantee persistence. Keep the shipped mirror and add runtime-model-bound documentation controls and browser help validation.
Contract-Neutral: Documentation and test fixtures only; no runtime token, authorization, navigation or delivery contract changes.
Change-source: pulse-maintainer
PR #2456 run 37175962472 rejected retained safety warnings only because of a line break and sentence capitalization. Normalize prose for these assertions without removing any required warning or diagnostic field.
Contract-Neutral: Documentation test presentation normalization only; no runtime, API or safety-guidance change.
Change-source: pulse-maintainer
Preserve exact reviewed History and incomplete-reading commits with their own-parent browser receipts. Retained final compiler, 407 regressions and production-build proof cover runtime content; preserve current data-retaining removal guidance.
Change-source: pulse-maintainer
Preserve current safety evidence, installer guidance and reviewed release-browser source while validating the previously unexecuted runtime response-boundary correction. No native thaw or old executor cleanup is inferred.
Change-source: pulse-maintainer
Preserve the exact History and incomplete-reading candidates and their own-parent browser receipts while including the current assigned main. No frontend resolution or receipt rebinding.
Change-source: pulse-maintainer
Retain exact Core candidate. Nineteen focused committed-source checker and CLI methods establish rejection of unsupported post-task resumption while preserving calibrated healthy records. No production polling or native thaw acceptance is changed.
Change-source: pulse-maintainer
Retain exact Delivery candidate and its reviewed history. Offline packet, lifecycle and Tailnet controls pass; unchanged Chromium refusal receipts remain bound to their executed source. Native collection still requires protected publication, host activation and credential-administrator confirmation of dedicated tag:ci-deploy scope and self-only access.
Change-source: pulse-maintainer
Require finite capacity and measured used bytes in the existing filesystem list and guest Overview. Missing, invalid and sentinel readings remain unavailable rather than a healthy empty disk; measured zero and valid byte-derived readings stay visible. Preserve the exact retained History correction and add mounted, multi-filesystem and browser controls.
Change-source: pulse-maintainer
Accept exact Product intelligence commits a6959e571b and 01adf338a4. Existing installation help now uses the signed non-root server path and protects custom installation state. Retained 55 documentation controls and inspected desktop Chromium and phone WebKit proof are adequate for this documentation-only change.
Change-source: pulse-maintainer
Reject a resumed disk or memory History claim when the complete native trace lacks the corresponding successful new guest read after backup completion. Preserve calibrated clock bounds, normal later polls, independent filesystem writes and native provenance review; no QGA command or runtime behaviour changes.
Contract-Neutral: Tighten consistency checks for the existing backup-safety measurement only; production polling, interfaces, access boundaries and release gates are unchanged.
Change-source: pulse-maintainer
Use a dedicated Auth Keys write client restricted to tag:ci-deploy, never the broader demo registration. Reject missing configuration and validate the actual running Self tag and DNS before Serve. Keep exact-source, denial-stop, no-replay and cleanup contracts, with connected offline registration and Serve controls.
Change-source: pulse-maintainer
Preserve the exact reviewed History candidate and its own-parent browser receipt. The updated main frontier changes setup help only; executor readiness and complete source qualification remain unfinished.
Change-source: pulse-maintainer
Preserve the reviewed denial and recovery corrections for an additive least-privilege registration repair. No native acceptance is inferred.
Change-source: pulse-maintainer
Do not report an absent lock or agent setting after malformed current-configuration output. Preserve passive bounded host reads, private output, unknown well-formed fields and the distinction from guest responsiveness or thaw.
Contract-Neutral: The operator-only helper now enforces its existing incomplete-read failure semantics; polling, guest-agent admission, API and storage contracts are unchanged.
Change-source: pulse-maintainer
Visual review found the bounded systemctl example clipped its option lines on a phone. Give each property its own line and distinguish a missing unit from a loaded root service before interpreting its settings.
Contract-Neutral: Documentation and focused verification only; no installer, runtime, API, persistence or security contract delta.
Change-source: pulse-maintainer
Replace the root-only hand-written service example with the signed server install path and bounded effective-unit checks. Explain that existing custom units survive updates and cannot be migrated safely by changing User alone. Exercise the real rendered guide and retain state and credential safeguards.
Contract-Neutral: Existing installation help and documentation verification only; no installer, runtime, API, persistence or security contract changes.
Change-source: pulse-maintainer
Separate current and explicitly retained disk evidence in the existing guest drawer. Show the fixed safe read reason beside History, preserve dated observations and access withdrawal, and clear retained provenance only with fresh source evidence. Record desktop and touch browser verification; native backup thaw and release delivery remain separate.
Change-source: pulse-maintainer
## What changes and why
- Keep VM filesystem readings visibly **Last known** or **Unavailable**
in bars, sparklines and history lenses, including compact phone rows.
Assistive text retains the full safe explanation; retained values are no
longer described as current. Inline charts yield space to their numeric
value without enlarging the row or adding a collector or interaction.
- Include fully cached Patrol runs in usage events, next-run budget
checks and cost-history projections. Zero ordinary-input tokens do not
make cache reads/writes free. Successful and partial runs retain their
disjoint usage buckets; empty and expired history stays excluded, with
existing five-minute prices unchanged.
The guest change addresses misleading freshness and clipped values
observed in the existing workload UI. The Patrol change follows the
accounting omissions in the existing usage/budget path.
Related to #2439
Related to #2118
Related to #2350
## Included source
Complete unpublished range:
`614d68a55e25f625f410ab5b38b792e274e56c8d..d77f56bee4e2e79c9c41f1244f9a1b3e65b60dbb`.
- Web candidate `031de38ec1dfb8185c200badc27ccdade55f9ff3`,
implementation `10f181b5007b4102340c779ae058d63958b0dd86`, based on
`5311a7c6febc5dfd7fcd81b10ca188d925e34527`. Includes the corrected
VM-only type narrowing, not the uncorrected implementation alone.
- Core candidate `e7c2b37cf6241a33c31abe05214364a8b8e4efb9`, based on
`da49bcdf8c2440212c40f5f7daeb1c196d5e0be9`.
- Additive integrations `da49bcdf8c2440212c40f5f7daeb1c196d5e0be9`,
`d5e0b4a19a763b1812d89aa4d528b6ad93041bb2` and
`d77f56bee4e2e79c9c41f1244f9a1b3e65b60dbb` preserve reviewed commits and
the published main frontier unchanged. Final tree equals the reviewed
Core candidate, with unchanged reviewed frontend bytes.
## Validation and remaining limits
Reviewed Web evidence `source-5qnwtk4f`: 342 tests, full types, focused
style, copy and row-accessibility audits, production frontend/embed
build and budgets. Its corrected-source 96-state Chromium/phone-WebKit
browser proof covers freshness, touch disclosure, assistive values and
dense-row geometry; all twelve final screenshots were inspected by the
source owner. The earlier type-check and clipping failures remain
recorded and were corrected before final acceptance.
Reviewed Core evidence `source-m_se_bxv`: parent omission reproduction
and final race controls at Patrol result, usage ledger, next-run budget
and projection boundaries. `source-_ghfb36e` supplies frontend
types/build and real embed assets.
Publication checks: provenance and whitespace checks passed; own-parent
canonical completion checks passed for all three source commits,
honoring the recorded type-only correction declaration; cumulative
browser guard confirms both final frontend paths match in-range
receipts. Existing sufficient source proofs were not repeated merely to
combine the batch.
Broad backend proof is unfinished: two guest-readiness failures returned
no command result. These are not test passes; executor recovery remains
owned separately, and required exact-head GitHub checks must pass before
landing. Synthetic controls establish neither native guest thaw nor
installed billing/provider savings. Release qualification, containing
release and installed acceptance remain separate obligations; this
proposal makes no issue-completion or release-readiness claim.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain both exact specialist commits and their rendered-help evidence. Existing documentation and verification only; no runtime, dependency or product-surface expansion. Full frontend suites/build remain unverified after two guest-readiness failures; rendered Chromium/WebKit and focused static evidence are proportionate to this diff.
Contract-Neutral: Existing help and verification only; no runtime contract changes.
Change-source: pulse-maintainer
Do not admit guest commands or publish their payloads from an unlocked JSON prefix when the authoritative config response is incomplete. Preserve bounded ordinary config reads, live CPU and I/O observations, cache timestamps and healthy resumption.
Change-source: pulse-maintainer
Preserve published commit identity alongside already reviewed local guest provenance changes; published merge adds no new content.
Change-source: pulse-maintainer
A denial arriving as the browser closes must leave a failed bounded receipt and suppress recovery authentication. Exercise real late HTTP401/403 responses alongside the earlier navigation and API controls.
Contract-Neutral: Enforces the existing all-response refusal contract through final context disposal; no new acceptance route or permission.
Change-source: pulse-maintainer
The browser sandbox has no jq. Retain all browser control receipts and execute the actual harness guard in the offline source-proof VM with their explicit input binding, checking denied and permitted process/auth preparation. Browser context cleanup failure also remains a failed receipt.
Contract-Neutral: Existing refusal, bounded evidence and cleanup contract is unchanged; this connects its proof across the browser and source-proof runtimes.
Change-source: pulse-maintainer
The first phone setup screenshot caught the light-to-dark transition, while the later polling screenshot was settled. Await the actual theme animations before capture so the browser receipt represents the displayed help rather than an intermediate colour frame.
Contract-Neutral: Browser verification timing only; no product source or runtime contract change.
Change-source: pulse-maintainer
pulse-triage[bot]