Persist endpoint-scoped decisions alongside discovery pins, including explicit CA mode, without clearing unrelated member trust or accepting renewed certificates automatically. Use the same policy for saved-credential probes, qualify their scope, and keep failed saves out of live PVE configuration.
Change-source: pulse-maintainer
**Keep retained PVE archives bound to their guest kind**
Select local guest backup dates within the explicit archive kind. Keep a
removed VM or LXC archive on its historical typed recovery subject
instead of borrowing a replacement occupant identity or placement.
Preserve archive facts, normal collection and legacy untyped matching;
exercise both replacement directions and the consuming lifecycle.
Contract-Neutral: Correct existing typed backup attribution without
changing public JSON, archive IDs or dates, posture policy, provider
access or agent lifecycle. Monitoring and storage contracts document the
behaviour; model, mapper and poll/ingest lifecycle tests cover it.
**Preserve archive kind during final state placement alignment**
The coupled archive lifecycle caught state publication reassigning
opposite-kind archives to the new occupant node after the collector had
kept their origin. Apply the same explicit-kind fence during final
alignment and share model normalisation with date selection. Cover
aliases, both directions, untyped compatibility, connection isolation
and caller-input preservation.
Contract-Neutral: Complete the existing typed backup attribution repair
without changing public JSON, archive IDs or dates, posture policy,
access or agent lifecycle. Monitoring/storage contracts and direct
state/lifecycle tests cover this final publication path.
---
Fleet candidate `20261027T060005Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `c571c086ef551282160c154b9188bc724e43317f` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Recompose the two Dependabot digest-only refreshes on current main,
update the stale Node proof pin, and bind all six Alpine consumers to
the same selected runtime image. Keep governed tag lines, release keys
and exact-candidate consumption unchanged; source contracts do not claim
a hosted image build or installed recovery.
---
Fleet candidate `20261027T044029Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`8f3f67db926abe0dd795d7f2edbf05f452c36ff4` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Resolve only the shared storage contract insertion: retain current main's prune-retention and verification guarantees, followed by the archive-kind attribution guarantees from PR3389. Preserve both imported source commits without amendment and retain every runtime/test blob unchanged.
Contract-Neutral: Compose independently verified backup repairs; the only conflict resolution is additive contract prose, with unchanged runtime, APIs, permissions and policies. Existing source and own-parent browser receipts remain attributed to their commits.
Change-source: pulse-maintainer
**Distinguish local-login hiding from SSO-only enforcement**
Explain the existing authentication boundary beside the visibility
setting, preserving the independent administrator recovery path. Add a
rendered-guide regression to keep that distinction next to the setting
and its local-form escape.
Contract-Neutral: Documentation and rendered-guide regression only;
authentication behaviour, endpoints and subsystem contracts are
unchanged.
**Record local-login guidance browser verification**
Bind the shipped OIDC visibility warning to its production Docs
consumer, desktop and narrow keyboard interactions and two native pixel
inspections.
Contract-Neutral: Source-bound browser receipt only; runtime, guide
content and subsystem contracts are unchanged.
---
Fleet candidate `20261027T041050Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`871c94edaaf80f9adfd33c41cd3fd05c48e6cf59` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Recompose the two Dependabot digest-only refreshes on current main, update the stale Node proof pin, and bind all six Alpine consumers to the same selected runtime image. Keep governed tag lines, release keys and exact-candidate consumption unchanged; source contracts do not claim a hosted image build or installed recovery.
Change-source: pulse-maintainer
The coupled archive lifecycle caught state publication reassigning opposite-kind archives to the new occupant node after the collector had kept their origin. Apply the same explicit-kind fence during final alignment and share model normalisation with date selection. Cover aliases, both directions, untyped compatibility, connection isolation and caller-input preservation.
Contract-Neutral: Complete the existing typed backup attribution repair without changing public JSON, archive IDs or dates, posture policy, access or agent lifecycle. Monitoring/storage contracts and direct state/lifecycle tests cover this final publication path.
Change-source: pulse-maintainer
Explain the existing authentication boundary beside the visibility setting, preserving the independent administrator recovery path. Add a rendered-guide regression to keep that distinction next to the setting and its local-form escape.
Contract-Neutral: Documentation and rendered-guide regression only; authentication behaviour, endpoints and subsystem contracts are unchanged.
Change-source: pulse-maintainer
Keep the existing safety boundaries and legacy Protected-label warning while describing Kept, explicit verification and separate Prune protection. Couple the normal guide test to all three actual state outcomes.
Contract-Neutral: Shipped guidance and its regression check align with the preceding backup presentation repair; no additional runtime or subsystem contract delta.
Change-source: pulse-maintainer
Select local guest backup dates within the explicit archive kind. Keep a removed VM or LXC archive on its historical typed recovery subject instead of borrowing a replacement occupant identity or placement. Preserve archive facts, normal collection and legacy untyped matching; exercise both replacement directions and the consuming lifecycle.
Contract-Neutral: Correct existing typed backup attribution without changing public JSON, archive IDs or dates, posture policy, provider access or agent lifecycle. Monitoring and storage contracts document the behaviour; model, mapper and poll/ingest lifecycle tests cover it.
Change-source: pulse-maintainer
Show explicit verification ahead of the prune flag in restore-point rows and drawers. Call retention without a verdict Kept, retain the legacy search alias, and keep workload protection server-owned. Four consuming parent witnesses exposed misleading Protected states; non-retained and running controls passed. Correct the search fixture so its name cannot satisfy the queried status.
Contract-Neutral: Backup presentation repair only. Canonical resource identity, ownership, schema, navigation and provider contracts are unchanged; frontend/storage presentation contracts and consuming verification are updated.
Change-source: pulse-maintainer
Use bounded local and PBS artifact discriminators with exact PBS format
fallback. Keep archive facts, identities, host handling and admission
unchanged. Exercise the poller, typed confirmations and recovery
lifecycle, including partial reads and accepted absence.
Contract-Neutral: Correct existing archive guest classification without
changing public JSON shape, IDs, timestamps, posture policy or provider
access. New poller and lifecycle tests exercise the repair; existing
protection-evidence semantics are unchanged.
---
Fleet candidate `20261027T024026Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `74eead69df9a3d816c489c6e5d123001fb2d13d7` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
**Reproduce unknown backup sizes hiding completed activity**
Exercise the existing inventory consumer with unavailable and mixed
sizes, source scopes and day selection before changing presentation.
Contract-Neutral: Regression tests only; existing runtime and subsystem
contracts are unchanged.
**Keep unavailable backup sizes distinct from zero activity**
Retain completed activity and Count controls when sizes are missing.
Mark unknown-size days separately, label measured bytes as known volume
and avoid exact source shares for incomplete totals.
**Select the existing backup source accessible name in regression
tests**
Use the full production aria-label rather than its shorter visible
caption. The first two parent witnesses reproduced the defect; the third
initial failure was a test selector mistake.
Contract-Neutral: Test selector correction only; runtime and contracts
are unchanged.
**Record unknown-size backup activity browser verification**
Bind desktop Chromium and narrow WebKit checks and native pixel
inspection to the final runtime content. Retain the two proof-script
assertion mistakes and continue only unfinished checks.
Contract-Neutral: Browser evidence only for the preceding backup-size
repair; no runtime or contract delta.
**Use the existing copy style for unknown backup sizes**
The complete tests and types passed, but copy lint rejected semicolons.
Use sentences for the notice and a visual separator for known volume and
unknown-size counts.
Contract-Neutral: Copy-style correction only; the unknown-size contract
and behavior are unchanged, with matching test expectations.
**Verify final unknown-size backup copy in both browsers**
Inspect final sentence-based notice and mixed-volume separator at
desktop and phone widths. Preserve the earlier source-bound interaction
proof and its adverse records.
Contract-Neutral: Fresh browser evidence for the copy-style correction
only; no runtime or contract delta.
**Keep backup size guidance consistent with the live chart**
Repair the full-suite documentation assertion missed by the scoped
unknown-size proof. Explain the Known volume label, unknown-size
markers, and chart/filter scope in both shipped guide copies, and retain
executable count-versus-volume evidence in the guide test.
Contract-Neutral: Align shipped documentation and its regression checks
with the composed backup activity behaviour; no runtime or subsystem
contract change.
**Name the chart's verification filters precisely in recovery help**
The existing pills are Verified and Unverified, not running/failed
entry-state controls. Use verification in the facet explanation and its
consistency assertion.
Contract-Neutral: Correct documentation terminology and its assertion
only; backup runtime and contracts are unchanged.
**Record composed backup guidance browser verification**
The final shipped guide preserves protected-main scope and safety
guidance alongside the known-volume correction. Verify its production
Docs consumer at desktop Chromium and narrow WebKit; all seven captures
were inspected natively. Existing chart receipts remain unchanged.
Source-suite completion still awaits the original executor readback.
Contract-Neutral: source-bound browser receipt only; no additional
contract or runtime change.
---
Fleet candidate `20261027T030018Z-web-product` from the `web-product`
lane. Reviewed tip `90f4ea4404147833c52453a97d67900d33e41579` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace only exact top-level generated launches, retaining ambiguous
boot content and recovery on failure. Stage and validate replacement
before rename, preserve unrelated jobs and existing modes without
assuming FAT supports chmod, and stop installation before claiming
unconfirmed boot persistence. Cover compound commands, launch-like data,
write faults, FAT permission limits and caller failure in the normal
installer inventory.
---
Fleet candidate `20261027T020029Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`f56b7e2b38bce8f3dff3d0a3900470367250807b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use bounded local and PBS artifact discriminators with exact PBS format fallback. Keep archive facts, identities, host handling and admission unchanged. Exercise the poller, typed confirmations and recovery lifecycle, including partial reads and accepted absence.
Contract-Neutral: Correct existing archive guest classification without changing public JSON shape, IDs, timestamps, posture policy or provider access. New poller and lifecycle tests exercise the repair; existing protection-evidence semantics are unchanged.
Change-source: pulse-maintainer
Preserve the fuller current-main filter, location, date-range and protection-policy explanation alongside Known volume, selectable missing-size points and lower-bound totals. Retain both sets of regression assertions and identical shipped guides. Chart source and existing own-parent receipts are unchanged.
Contract-Neutral: additive composition of the already documented backup activity contract; no additional runtime behaviour beyond the retained candidate.
Change-source: pulse-maintainer
**Explain filtered backup activity without changing protection policy**
Distinguish the filtered chart and list from inventory-wide Backup
health. Explain day selection, chart range, clearing filters and
ambiguous saved locations in the shipped Recovery guide.
Contract-Neutral: Operator guidance and its rendered-copy regression
assertions only; backup collection, activity filters and protection
contracts are unchanged.
**Format the backup guidance regression assertion**
Keep the extended guide assertion compatible with the frontend formatter
so the documentation repair does not introduce style drift.
Contract-Neutral: Prettier-only test formatting; shipped guidance,
runtime and contracts are unchanged.
**Record filtered backup guidance browser verification**
Bind the shipped guide to its production Docs consumer at desktop and
narrow widths, including keyboard evidence and safety links. Retain the
unchanged collection and protection boundary.
Contract-Neutral: Source-bound browser receipt only; runtime, guide
content and subsystem contracts are unchanged.
---
Fleet candidate `20261027T010009Z-product-intelligence` from the
`product-intelligence` lane. Reviewed tip
`fba0c39222f0a3e73fa2ea5edcf829af932f1c19` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace only exact top-level generated launches, retaining ambiguous boot content and recovery on failure. Stage and validate replacement before rename, preserve unrelated jobs and existing modes without assuming FAT supports chmod, and stop installation before claiming unconfirmed boot persistence. Cover compound commands, launch-like data, write faults, FAT permission limits and caller failure in the normal installer inventory.
Change-source: pulse-maintainer
The existing pills are Verified and Unverified, not running/failed entry-state controls. Use verification in the facet explanation and its consistency assertion.
Contract-Neutral: Correct documentation terminology and its assertion only; backup runtime and contracts are unchanged.
Change-source: pulse-maintainer
Repair the full-suite documentation assertion missed by the scoped unknown-size proof. Explain the Known volume label, unknown-size markers, and chart/filter scope in both shipped guide copies, and retain executable count-versus-volume evidence in the guide test.
Contract-Neutral: Align shipped documentation and its regression checks with the composed backup activity behaviour; no runtime or subsystem contract change.
Change-source: pulse-maintainer
Replace substring and unterminated-range boot deletion with exact
owned-entry admission and staged same-filesystem replacement. Preserve
ambiguous content and failed staging for recovery, and check append plus
flash unmount before claiming persistence. Exercise production
writer/caller failures and keep the existing NAS removal fixtures
composed. Native QNAP acceptance remains separate.
---
Fleet candidate `20261027T010022Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`89969b6418827843a136e1ff70d3e3b59145ae75` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Replace substring and unterminated-range boot deletion with exact owned-entry admission and staged same-filesystem replacement. Preserve ambiguous content and failed staging for recovery, and check append plus flash unmount before claiming persistence. Exercise production writer/caller failures and keep the existing NAS removal fixtures composed. Native QNAP acceptance remains separate.
Change-source: pulse-maintainer
**Keep identical local backup paths independent across PVE nodes**
Scope local archive deduplication and opaque IDs to the exact
connection, storage read node, storage and volume tuple. Keep shared
repository identities unchanged and let only complete accepted scans
retire obsolete legacy IDs. Exercise VM/LXC polling, recovery history,
partial reads, migration, absence, exact tuples and direct-PBS controls.
**Correct the local archive fixture's read-node parameter**
Preserve the requested node when exercising same-path storage reads. The
first exact-candidate proof stopped at compilation before any tests ran;
this changes only the regression fixture, not the runtime repair.
---
Fleet candidate `20261026T234756Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `afdabbe4caac1958af4514d57dfc58c79e27b0ee` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Distinguish the filtered chart and list from inventory-wide Backup health. Explain day selection, chart range, clearing filters and ambiguous saved locations in the shipped Recovery guide.
Contract-Neutral: Operator guidance and its rendered-copy regression assertions only; backup collection, activity filters and protection contracts are unchanged.
Change-source: pulse-maintainer
Retain completed activity and Count controls when sizes are missing. Mark unknown-size days separately, label measured bytes as known volume and avoid exact source shares for incomplete totals.
Change-source: pulse-maintainer
Retain the exact 2dbdd3b4 chart/list candidate and its own-parent browser proof after the human agent-authority correction landed first. Preserve protected main's complete storage/access contract, including disabled local reads and PBS continuity, alongside the original activity scope section. No frontend merge resolution or runtime reimplementation.
Change-source: pulse-maintainer
**Cover readable single-attempt SSO save recovery**
Exercise create/edit OIDC and SAML through the real Settings state and
API client, including structured/plain failures, malformed and upstream
responses, draft retention and explicit retry.
Contract-Neutral: Consuming regression tests only; runtime and existing
contracts are unchanged.
**Show readable SSO save guidance without replaying failed writes**
Use the existing API error parser, keep only bounded human guidance in
the active editor, and leave diagnostic envelopes out of browser logs.
Preserve drafts and explicit retry for both provider types; do not infer
no-save after a lost response. Give ordinary phone recovery guidance
more room above the existing controls.
Contract-Neutral: Correct existing SSO failure presentation and
single-submission behaviour; routes, API payloads, access rules,
saved-secret handling and shared Settings shell interfaces are
unchanged.
**Record consuming SSO save recovery browser verification**
Bind exact human-message, fallback, draft and deliberate retry proof to
the production panel at desktop and narrow widths. Native pixel
inspection covers every retained capture.
Contract-Neutral: Browser evidence only; runtime, public interfaces and
verification policies are unchanged.
---
Fleet candidate `20261026T214841Z-web-product` from the `web-product`
lane. Reviewed tip `a4acf08599d0d6451e456d987b4504b24dc9352a` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Do not let a successful same-named peer erase an unread local disk or
qualify its backup history as complete. Resolve ambiguous disabled-node
membership from the bounded datacenter catalogue without querying
disabled content; preserve unknown scopes, accepted shared reads and
cancellation.
---
Fleet candidate `20261026T213457Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `24610bdf267b5dc9c6373a460e752e34010a2542` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Require organization administration for session and proxy callers on collector ingest, acknowledgements and agent configuration while preserving scoped agent token access.
Use the existing API error parser, keep only bounded human guidance in the active editor, and leave diagnostic envelopes out of browser logs. Preserve drafts and explicit retry for both provider types; do not infer no-save after a lost response. Give ordinary phone recovery guidance more room above the existing controls.
Contract-Neutral: Correct existing SSO failure presentation and single-submission behaviour; routes, API payloads, access rules, saved-secret handling and shared Settings shell interfaces are unchanged.
Change-source: pulse-maintainer
Separate staging-file admission from grep no-match in both shipped local
cleanup paths. Resolve shared targets, require intact metadata and
return incomplete results without replacing unrelated keys or caller
resources. Add actual filesystem failure and caller-path controls.
---
Fleet candidate `20261026T204021Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`44b0500abc90788a6fcb257a8ccf931793d2d6e3` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Do not let a successful same-named peer erase an unread local disk or qualify its backup history as complete. Resolve ambiguous disabled-node membership from the bounded datacenter catalogue without querying disabled content; preserve unknown scopes, accepted shared reads and cancellation.
Change-source: pulse-maintainer
**Keep unread PBS namespaces in the live backup inventory**
Carry only transiently unread namespace rows after accepted results,
without renewing their evidence or snapshot-cache clocks. Actual access
rejection and successful empty reads remain authoritative for their raw
scope, including mixed all-failed polls.
Contract-Neutral: Restore scoped live PBS continuity; public API shapes,
identities, limits, policy and access admission are unchanged.
**Cover PBS namespace carry-forward at the live-state bound**
An unread namespace cannot consume the bounded inventory before
independently accepted files. Preserve the newest last-known files
within the unchanged limit.
Contract-Neutral: Regression coverage only; runtime and contracts are
unchanged.
**Keep mixed unread PBS access evidence unknown**
When no namespace can be listed, a transient failure alongside a
rejection does not prove that every datastore was denied. Use fully
terminal datastore counts only for that wholly unread observation;
retain partial-access reporting when another listing succeeds.
Contract-Neutral: Correct existing PBS collection evidence without
changing public API shapes, identities, policy, limits or access
admission.
**Assert the mixed PBS access evidence boundary**
Bind the whole-failure regression and both owning contracts to unknown
access for mixed rejected/transient scopes, not invented universal
denial.
Contract-Neutral: Regression and contract clarification for the existing
collection-evidence correction; public interfaces and access admission
are unchanged.
---
Fleet candidate `20261026T200652Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `4a4af72094090c1f508d640349d35cf177e1047b` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use one filtered inventory for count, volume and the By date list. Keep day selection downstream so the other scoped dates remain selectable, and do not advertise unrelated activity for unresolved locations or empty matches.
Change-source: pulse-maintainer
**Keep backup evidence stable through native scrolling and polling**
Use the canonical keyed measured-row renderer for Coverage and By date,
with an opt-in outer extent reserve derived from all measured keyed
items. Tall evidence remains readable through live inventory replacement
and native window retirement without moving the operator viewport;
closing and filtering release the reserve. Retain the bounded row
budgets and full-result semantics, remove the obsolete helper and stale
ownership references, and exercise both consumers and the shared
primitive in the repository suites.
**Record consuming backup scroll and inventory browser proof**
Bind final source content to desktop Chromium and narrow WebKit journeys
through production backup consumers in the native app scroller,
including real polling, measured departure/return, fully visible estate
endpoints and reserve release. Runtime and tests are unchanged.
---
Fleet candidate `20261026T193406Z-web-product` from the `web-product`
lane. Reviewed tip `f7cfbc14c2f42ff374881f09e523416a553fbb3f` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Separate staging-file admission from grep no-match in both shipped local cleanup paths. Resolve shared targets, require intact metadata and return incomplete results without replacing unrelated keys or caller resources. Add actual filesystem failure and caller-path controls.
Change-source: pulse-maintainer
**Require complete inventory for legacy credential cleanup**
Keep Proxmox API JSON on the parser's stdin and validate every identity
before key cleanup. Failed inventory and key replacement must not become
empty successful cleanup; opted-in API removal propagates failures and
preserves the user when token removal is incomplete.
Exercise cluster discovery, local key preservation and API removal with
closed fixtures, alongside the existing SSH trust and stopped-container
controls.
**Preserve shared SSH key targets during legacy remote cleanup**
Resolve the fixed remote authorized_keys symlink before staging an
atomic target replacement. Fail closed on unresolved, non-file,
filtering, metadata and replacement errors, and leave already-clean
shared keys untouched.
Execute the actual transmitted POSIX payload against closed regular-file
and shared-link fixtures, with unrelated recovery-key and
failure-preservation checks. Exercise its failure through validated
cluster discovery into main without live SSH or customer operations.
**Match the final legacy-cleanup success message exactly**
The remote failure proof correctly reached main's nonzero incomplete
result. Its broad success substring also matched the truthful
local-file-cleanup warning, so narrow the assertion without changing the
runtime or cleanup contract.
Contract-Neutral: Test-only assertion precision; no runtime or contract
change.
---
Fleet candidate `20261026T194603Z-delivery-trust` from the
`delivery-trust` lane. Reviewed tip
`07e630d34ecf9b304e0f23775141bba7f6da7477` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Bind the whole-failure regression and both owning contracts to unknown access for mixed rejected/transient scopes, not invented universal denial.
Contract-Neutral: Regression and contract clarification for the existing collection-evidence correction; public interfaces and access admission are unchanged.
Change-source: pulse-maintainer
Use the canonical keyed measured-row renderer for Coverage and By date, with an opt-in outer extent reserve derived from all measured keyed items. Tall evidence remains readable through live inventory replacement and native window retirement without moving the operator viewport; closing and filtering release the reserve. Retain the bounded row budgets and full-result semantics, remove the obsolete helper and stale ownership references, and exercise both consumers and the shared primitive in the repository suites.
Change-source: pulse-maintainer
Carry only transiently unread namespace rows after accepted results, without renewing their evidence or snapshot-cache clocks. Actual access rejection and successful empty reads remain authoritative for their raw scope, including mixed all-failed polls.
Contract-Neutral: Restore scoped live PBS continuity; public API shapes, identities, limits, policy and access admission are unchanged.
Change-source: pulse-maintainer
**Keep unread local backup files scoped to their storage node**
A successful listing of local on one PVE node cannot establish absence
on another local disk. Keep runtime read origin distinct from guest
location and retain unread files without renewing evidence, while
accepted sibling catalogue or content removal still takes effect.
Preserve shared and node-restricted behavior, complete-read
reconciliation and public JSON.
Contract-Neutral: Restore existing unread-backup retention and
independent-source isolation with runtime-only provenance; no public
JSON, identity, policy, storage schema or access contract changes.
**Avoid overlapping backup documentation insertions**
Move the local-storage read-origin section below the existing
protection-assessment section so it merges with the published
calendar-date documentation. Preserve every documentation paragraph and
all reviewed runtime and test bytes.
Contract-Neutral: Documentation placement only; no runtime, test,
frontend or contract change.
---
Fleet candidate `20261026T185010Z-core-runtime` from the `core-runtime`
lane. Reviewed tip `c4205208ad6198f29eb2086e8f06b17598163f79` on `main`.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Resolve the fixed remote authorized_keys symlink before staging an atomic target replacement. Fail closed on unresolved, non-file, filtering, metadata and replacement errors, and leave already-clean shared keys untouched.
Execute the actual transmitted POSIX payload against closed regular-file and shared-link fixtures, with unrelated recovery-key and failure-preservation checks. Exercise its failure through validated cluster discovery into main without live SSH or customer operations.
Change-source: pulse-maintainer
Move the local-storage read-origin section below the existing protection-assessment section so it merges with the published calendar-date documentation. Preserve every documentation paragraph and all reviewed runtime and test bytes.
Contract-Neutral: Documentation placement only; no runtime, test, frontend or contract change.
Change-source: pulse-maintainer
Keep Proxmox API JSON on the parser's stdin and validate every identity before key cleanup. Failed inventory and key replacement must not become empty successful cleanup; opted-in API removal propagates failures and preserves the user when token removal is incomplete.
Exercise cluster discovery, local key preservation and API removal with closed fixtures, alongside the existing SSH trust and stopped-container controls.
Change-source: pulse-maintainer
A successful listing of local on one PVE node cannot establish absence on another local disk. Keep runtime read origin distinct from guest location and retain unread files without renewing evidence, while accepted sibling catalogue or content removal still takes effect. Preserve shared and node-restricted behavior, complete-read reconciliation and public JSON.
Contract-Neutral: Restore existing unread-backup retention and independent-source isolation with runtime-only provenance; no public JSON, identity, policy, storage schema or access contract changes.
Change-source: pulse-maintainer
Build consecutive local-date buckets instead of stepping fixed 24-hour intervals. Keep the whole oldest and final local days visible without admitting future or undated evidence. Exercise spring, autumn and half-hour changes across all ranges in the ordinary activity suite.
Change-source: pulse-maintainer
pulse-triage[bot]