Preserve the exact Product Intelligence candidate and its source-lb_bcbds proof. Existing server and Docker failure guidance now reuses bounded log readers, checks actual state before another attempt, and requires matched stopped-service recovery. No runtime or new product surface changes.
Contract-Neutral: Integrate reviewed documentation and help regression checks only; no runtime, API, configuration or subsystem contract change.
Change-source: pulse-maintainer
Completed PR2576 checks exposed a workflow-shell fixture running outside the checkout root, two unformatted test files, and the missing monitoring contract for accepted 26ae5b1aa2. Run the real classifier helper in its actual Actions context and assert Go compilation admission alongside strict dependency-audit decisions. Record collected metadata with empty series and retained-only exclusion without changing runtime or synthesizing samples. All reviewed commit identities remain unchanged; final source proof and exact-head hosted checks remain required.
Change-source: pulse-maintainer
Accept the exact Core candidate 20261007T043911Z-core-runtime with usable-observation ownership, report-ordered revocation and per-metric handover attribution. Retained alerts race, differential, real builds and final monitor/History proof remain bound to their original commits; canonical changes since the candidate base do not overlap. Source integration is not publication or native delivery.
Change-source: pulse-maintainer
Route server update errors through bounded log readers, distinguish updater status from the running service, and require a matched stopped-service recovery rather than a guessed restore. Keep the existing Docker help on the same bounded reader.
Contract-Neutral: Documentation and help regression checks only; no runtime, API, configuration or subsystem contract change.
Change-source: pulse-maintainer
Retain exact specialist commit and source-uvo644ts proof. Bound the remaining severity-filtered journal recipe, withhold failed partial output, and avoid incident-time reinstall or full-unit disclosure. No runtime or new product surface changes.
Change-source: pulse-maintainer
Keep warning-priority evidence within the existing incident reader's deadline, record limit and failure handling. Explain info-priority legacy units without requesting a full secret-bearing unit or an incident-time installer rerun.
Contract-Neutral: Documentation and copied-reader regression tests only; no runtime, API, setting, permission or lifecycle contract changes.
Change-source: pulse-maintainer
Adapt remaining PR2599/2586 behavior to current source: evidence-bound ownership, report-ordered link outcomes, immediate configuration revocation, direct/inherited override precedence and canonical/shadow pending/intent reset. Close node-side alerts as transfer to a real per-metric owner rather than observed recovery. Preserve volatile metric status, child identity and observation-gap interruption.
Actual entry-point controls cover overlap, unknown values, saved direct filesystem disable, missing thresholds and real monitor lifecycle/History transfers. Preserve per-type default normalization: this is not a new Off setting. PR2567 is already merged and held SMART collection/native work is not revived.
Source-Provenance: additive adaptation of PR2599 at 765ac23046 over bd3432ab22
Change-source: pulse-maintainer
Document once-per-occurrence cooldown-off semantics, the independent hourly limit and recovery eligibility without treating missing messages as workload health. Verify rendered links, shipped mirrors and the actual saved/reloaded schedule.
Contract-Neutral: Documentation and verification only; existing alert policy, notification routing, runtime and API contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact reviewed docs and test commits, retaining current bounded diagnostic guidance. Acknowledge and snooze are notification holds, not workload recovery.
Change-source: pulse-maintainer
The general help checklist bypassed the deadline and failure-handling recipes already on the same page. Link that existing path without requiring a request ID or repeated action, and exercise its actual copied readers.
Contract-Neutral: Documentation and regression checks only; no runtime, API, setting, or service-lifecycle change.
Change-source: pulse-maintainer
Preserve the exact Product Intelligence commits and retained deadline and identity controls without adding a product surface.
Change-source: pulse-maintainer
Retain the reviewed Core candidate exactly, including its contributor provenance repair and same-tree proof attribution.
Change-source: pulse-maintainer
The native matrix consumes the frontend manifests on every platform and uses their test runtime for Windows PowerShell command acceptance, but its event filters omit graph-only changes. Admit those two exact inputs on both PR and main while leaving UI-only changes and all existing native steps unchanged. Regression controls independently remove each input/event and exclude the graph.
Contract-Neutral: Native CI admission coverage only; installer inputs, runtime behaviour, service authority and recovery contracts are unchanged.
Change-source: pulse-maintainer
Preserve the exact source tree validated at 5989d928108acf80dc38b99cef40935fe17e6e32 while repairing the rejected isolated candidate's integration provenance. Apply rcourtman's original PR2628 proposal daa44ab26c alongside the bounded host-identifiable email repair and current-policy fixture corrections. Original contributor history remains untouched; this new commit records the maintainer's source integration, not a contributor identity change or a new runtime change.
Original-Proposal: daa44ab26c
Change-source: pulse-maintainer
Document existing incident holds, hidden active alerts, bulk scope and the local-calendar snooze preset. Link delivery troubleshooting to the controls and verify the rendered help and acknowledgement readback.
Contract-Neutral: Existing help and verification only; no alert runtime, API, schema or frontend control changes.
Change-source: pulse-maintainer
Read counters directly under an already authorised account instead of elevating a child reader inside an unprivileged timeout. A denied read remains unavailable; no sudoers, service permissions or credential change is suggested. Preserve the original sudo recipe only as synthetic parent-control evidence.
Contract-Neutral: Existing passive diagnostic instructions and their synthetic controls only; no runtime, API, permission or frontend behaviour changes.
Change-source: pulse-maintainer
The exact-source TERM-ignoring control returned 124, not the intended kill result. Use GNU timeout's whole-group KILL deadline for these read-only collectors and verify that the owned synthetic reader is no longer running. Retain the adverse initial proof rather than relaxing its assertion.
Contract-Neutral: Diagnostic recipes and their synthetic deadline controls only; no runtime, API, permissions or frontend behaviour delta.
Change-source: pulse-maintainer
Document saved metric Off values, override inheritance, inclusive hysteresis boundaries, pending saves and separate delivery verification. Bind the copied CPU example to actual metric evaluation and test the rendered bundled guidance.
Contract-Neutral: Existing help and example verification only; no alert runtime, API, schema or editor behaviour changes.
Change-source: pulse-maintainer
Withhold incomplete write/container counter pairs, reject reader and identity failures, and pin Docker stats to the full running container ID. Preserve the 60-second passive window and data-safety guidance without changing monitoring or permissions.
Contract-Neutral: Existing diagnostic documentation and synthetic recipe tests only; no runtime, API, permission or UI behaviour changes.
Change-source: pulse-maintainer
Retain exact Web commits b0f7a63181 and f6e8a3c9f4. The existing guide and copied PSA template preserve member close reasons and successor identity, with an explicit v6.5.0 applicability warning. Retained sender and rendered-source proof is adequate; no runtime or browser-source resolution is needed.
Contract-Neutral: Existing public and bundled webhook help and regression tests only; no runtime, API, delivery-policy, navigation or permissions contract change.
Change-source: pulse-maintainer
The actual v6.5.0 source lacks NotRecovered and member Resolution. Warn against pasting the newer example into that version or blindly retrying failed renders; a web guide is not evidence that containing software has shipped.
Contract-Neutral: Version-applicability guidance and rendered regression coverage only; no runtime or delivery contract change.
Change-source: pulse-maintainer
Capture both local log streams before presenting notification excerpts or request-ID matches. A reader error or deadline reports unavailability without a partial excerpt; missing GNU timeout has no unbounded fallback. Exercise copied recipes with successful, empty, partial-failure, missing-tool and hung readers, including termination grace.
Contract-Neutral: Existing read-only troubleshooting recipes and shipped mirror only; no runtime, API, permissions, settings or navigation contract changes.
Change-source: pulse-maintainer
The sender already carries moved_to_agent reasons, but the public PSA template discarded them and described every resolved occurrence as recovered. Preserve each member's reason and successor, explain mixed and unknown outcomes, and exercise copied templates through the real sender plus the shipped Markdown renderer.
Contract-Neutral: Existing webhook help and copied-template regression coverage only; no runtime, endpoint, schema or delivery policy change.
Change-source: pulse-maintainer
Compose the unchanged memory recipe repair with notification privacy guidance, preserving original commits and retained deadline controls.
Change-source: pulse-maintainer
Preserve exact Web commits and retained rendered/build proof; URL masking is not a guarantee that provider text is public-safe.
Change-source: pulse-maintainer
Keep the sampled counters and process identity behind a read-only deadline. Hanging readers and a missing timeout utility produce an unavailable result, while privacy, PID-reuse and measured-zero controls remain. Preserve the ten-second test assertion and clean up the test-owned shell on timeout.
Contract-Neutral: Documentation and copied-recipe verification only; no runtime collection, memory accounting, service lifecycle or API contract changes.
Change-source: pulse-maintainer
Preserve the exact Core candidate commits with the existing main frontier. Retained source-0ipbo9gk covers ownership, cancellation, scheduler recovery and served warnings; integration validation remains separate from native recovery and publication.
Change-source: pulse-maintainer
Incorporate exact published upstream while retaining starting reviewed tip 1364ee12f7 and every accepted commit. Preserve PVE disk history isolation and authoritative active-alert replacement alongside the reviewed monitoring batch. Composition does not establish browser, native or publication acceptance.
Change-source: pulse-maintainer
PVE disk health and wearout alerts reference the disk by instance, node
and device path (`<instance>:<node>:disk:<device key>`). Operator mutes
resolve that reference to the disk at the path (#2112), but resource
history leaves it unbound, so a physical disk's history (facets,
timeline and intelligence APIs, Assistant resource context) does not
show its own SMART and wearout alerts.
This records why that stays the decision, and pins it with a test.
- A device path is not hardware identity. A replacement disk in the same
slot, or a reboot that reorders devices, takes over the path, and disk
alerts are evaluated before their poll's disks reach the registry, so an
event can resolve against a generation that still places another disk
there.
- A history binding belongs to the reference string and moves to its
latest target, carrying every row journaled under the reference and
every read of it. Bound, the path would put a replaced disk's alerts
into its successor's history, and the Alerts history Resource action
(which reads incidents by the alert's own reference) would show the
successor's incidents for the predecessor's alert.
- A binding guarded by the serial each disk alert records was built and
measured on a mock estate (mock mode needed a build overlay to evaluate
PVE disk alerts at all). It bound correctly while disks kept their
paths, but review found rejected events still joining the currently
bound disk, a removed retained target accepting a successor's event, no
WWN in the alert metadata, a non-atomic check and write, and retry
expiry abandoning rows. That attempt is not in this PR.
Binding these alerts needs ownership per row (each event under the disk
its recorded hardware identity names, rows without usable identity left
under the reference, and a decided read for the Resource action), not a
per-reference binding. The contract paragraph in `unified-resources.md`
says so.
Test: `TestHistoryIdentityLeavesProxmoxDiskAlertReferencesUnbound` (live
event and backfilled legacy row stay under the reference and out of the
disk's history, while `ResolveReferenceID` still resolves the reference
for mutes). It fails against the reverted binding implementation.
Replace the blanket sanitisation promise with the actual recognised-URL masking boundary. Explain provider free text and infrastructure identity risk at both existing troubleshooting entry points, keep the bundled guides exact, and test rendered precautions and links.
Contract-Neutral: Notification delivery, URL masking and API behaviour are unchanged; this corrects existing public guidance to match their privacy limits.
Change-source: pulse-maintainer
The websocket store wrote each incoming active alert with
`setActiveAlerts(id, alert)`. Solid's path setter shallow-merges into
the existing object, so any field the server stops sending kept its old
value in the browser:
- After a backend restart, threshold alerts are restored without
`metricStatus` until their next evaluation (and indefinitely while the
reading is missing). An open tab kept the pre-restart live reading, so
the node drawer's "Needs attention" row and the node table temperature
tooltip went on saying "Temperature 78°C now" for a reading the server
no longer reports.
- An unacknowledge from another session left `ackTime`/`ackUser` behind,
as did a dropped `nodeDisplayName` or `metadata`.
Changes in `frontend-modern/src/stores/websocket.ts`:
- Active and recently resolved alerts are written with `reconcile`, so
omitted keys are removed on the snapshot, keyed-delta and REST recovery
commits alike. `reconcile` diffs nested values in place, so an unchanged
alert's live status no longer re-notifies keyed-store readers on every
frame (the shallow merge swapped in a fresh nested object each time).
- `updateAlert` stores a copy of each local update, because in-place
reconciliation would otherwise rewrite the record a snooze keeps for
rollback (its optimistic record shares nested objects with it).
- The pending acknowledgement hold is unchanged.
Tests (`websocket-unified.test.ts`): omitted `metricStatus`,
`nodeDisplayName` and `metadata` clear via snapshot, keyed delta (`null`
patch) and REST recovery; a server-side unacknowledge clears
`ackTime`/`ackUser`; local acknowledge/unacknowledge still wait for
confirmation; the rollback record stays intact; an unchanged alert's
nested reader is not re-notified; recently resolved alerts clear omitted
fields. The omitted-field, unacknowledge, reactivity and resolved tests
fail on the previous store. The rollback test fails if the `updateAlert`
copy is removed. The acknowledgement-hold test passes on both and guards
the existing behaviour.
Browser verification on a private mock stack at 1280×900 and 375×812,
with a local-only overlay that pins a standalone node's evaluated
temperature and lets mock mode restore alerts across restarts. Latch at
78°C (breach 95), restart the backend with the reading missing
(`/api/alerts/active` returns the alert without `metricStatus`), then
restore the reading:
- This change: the open tab's drawer and tooltip drop to "Node
temperature at 95.0°C" within seconds of reconnecting, then show "78°C
now" again on the next delta.
- Previous store, same run: the open tab kept "Temperature 78°C now" for
the full two-minute window.
- Snooze, resume and acknowledge on the Alerts card work with no page
errors. A remote acknowledge/unacknowledge round trip updates the open
tab within 2s.
Seen during verification and not changed here (it reproduces on main):
after acknowledging from the Alerts card, an unacknowledge from another
session does not bring the card back in that tab until a reload. The
cause is the acknowledgement override in `useAlertAcknowledgementState`.
It is tracked as a separate fix.
Follow-up to #2620, which documented both conflations below as
residuals.
## Problem
Two Docker alert producers wrote names into identity slots:
- A container reported without an ID alerted under its Docker host's own
reference, `docker:<host>`. Its alerts showed on the host, joined the
host's resource history (which #2620 binds to the host), were never
cleared when the container left the report (cleanup matches
`docker:<host>/`), and Patrol registered `docker:<host>` on both the
host and the container, so the host's scope alias was ambiguous.
- A Swarm service without an ID put its normalized name in the
`/service/<ID>` slot, so a name equal to another service's Swarm ID
shared that service's alerts and history. #2620's resolver had to treat
every service in such a cluster as a conflict.
Pulse's own agent always sends Docker and Swarm IDs, so this needs a
malformed or third-party report. The registry still shows those
containers and services.
## Change
- `internal/alerts`: `DockerHostResourceID`,
`DockerContainerResourceID(host, id, name)` and
`DockerServiceResourceID` are the only builders. An ID-less container
alerts under `docker:<host>/name:<name>` and an ID-less service under
`docker:<host>/service/name:<normalized name>`. Docker and Swarm IDs
never contain a colon, so neither can equal a host or ID reference. One
with neither an ID nor a name raises no alert.
- The container and service policy switches classify by the first path
segment after the host, so a container name containing `/service/` stays
a container.
- Report cleanup, host removal and the host's offline alert also clear a
pre-upgrade container alert left on exactly `docker:<host>` (recorded
host must match, container ID empty). A pending image update recorded
there keeps its age when the first report still shows it pending.
- Canonical state IDs were split at the first `::`, but colliding Docker
hosts get IDs like `<base>::<suffix>`. Every container alert of such a
host was rewritten to `docker:<base>`, the other host's reference: it
joined that host's history and missed its own host's cleanup.
`splitCanonicalStateID` now splits before the alert's recorded spec ID,
else after its resource ID, so alerts saved the old way also recover on
restore.
- Patrol registers the same builders' output as scope aliases, with the
container's name.
- History: a service slot containing `:` is a name reference (never
binds, never retried), and the cluster-wide conflict for ID-less
services is gone. A real service ID reference now binds even when its
cluster also has an ID-less service.
- Contract notes in alerts, ai-runtime, monitoring and
unified-resources.
Remaining legacy boundary (in the unified-resources contract): rows
journaled before this change keep their old reference. An ID-less
container's old rows stay in its host's history, and an ID-less
service's old rows bind only to a service whose ID equals its normalized
name.
## Proof
- `TestDockerAlertsWithoutIDsUseTheirOwnReferences` (real
`CheckDockerHost`: fired and active references, removal cleanup,
pre-upgrade leftover on report and offline, config-save
container/service switches).
- `TestDockerHostIDWithSeparatorKeepsItsAlertReferences`,
`TestDockerAlertsRestoredWithCutShortReferencesRecover` (writes
`active-alerts.json`, restores through `LoadActiveAlerts`) and
`TestDockerContainerWithoutIDKeepsPendingUpdateAgeAcrossUpgrade`.
- `TestOwnerAlertTimelinesUseCanonicalHistoryIdentity`: real producers
into the SQLite history. The ID-less container and the service named
like `web`'s Swarm ID stay out of the host's and `web`'s histories.
- `TestResolvePatrolScopeResolvesDockerAlertResourceIDs`: the host's
alias stays unambiguous, and the ID-less container's name reference
resolves to the container in the unified read state.
-
`TestHistoryIdentityMonitorAdapterResolvesDockerHostAndServiceReferences`:
the ID reference binds before and after the service leaves inventory,
and name references never bind or retry.
- Mutation check: putting back each old behavior fails at least one of
these tests. Covered: host fallback, unmarked service name, no skip for
unidentifiable containers or services, each legacy clause and its host
check, the update-age carry-over, first-`::` splitting with and without
the spec rule, substring classification, the Patrol alias without the
name, and the resolver accepting a `name:` slot.
Use observed HTTP status to distinguish authentication rejection, denial and unknown cause. Point to the actual saved connection and attempted endpoint without prescribing a role, mutating ACLs or exposing token identities or provider text. Preserve inventory and setup semantics and privilege separation; cover custom/manual identities and real-client 401/403/proxy producer paths.
Contract-Neutral: Correct existing diagnostic guidance and expose only internal HTTP-status evidence; no API shape, collection, inventory, setup permission or guest-safety contract changes.
Change-source: pulse-maintainer
Dispatch replication independently of the efficient guest path, coalesce bounded runtime-scoped reads and fence obsolete client/runtime completions. Preserve prior inventory on unavailable input or cancellation; only an explicitly complete empty read clears it. Bind scheduler, replacement and HTTP cancellation controls to this repair.
Contract-Neutral: Repair existing replication scheduling and cancellation ownership; no wire, endpoint, cadence, permission or host-agent lifecycle contract changes.
Change-source: pulse-maintainer
Complete the existing copied schedule with explicit days, timezone and critical-category choices. Explain calendar boundaries, held delivery and safe configuration preservation, and test the example against the actual delivery policy.
Contract-Neutral: Existing quiet-hours behaviour and API are unchanged; this repairs shipped setup guidance and tests its copied configuration.
Change-source: pulse-maintainer
Route current upgrades to current guidance; preserve existing login and monitoring state when diagnosing missing PVE backups. Require endpoint-specific access evidence rather than blanket ACL changes or setup-token rotation.
Contract-Neutral: Documentation and regression checks only; no collector, permission, authentication or upgrade contract changes.
Change-source: pulse-maintainer
Preserve all reviewed identities while incorporating the current published disk-temperature policy. Retain truthful sparse History and collected-only temperature consumers.
Change-source: pulse-maintainer
Preserve monitored connections, credentials, registration state and history during diagnosis. Retain the exact documentation and regression-proof commits; source guidance is not released availability or native recovery.
Change-source: pulse-maintainer
Publish failed and unfinished source-test names in the existing shard artifact without waiting for other workflow jobs. Keep logs, timings, test selection and failure exits unchanged; record unknown completion and omitted unsafe or excess identities explicitly. Pin privacy, bounds, pipefail and timing-refresh compatibility, and align the existing shard contract with current compile admission.
Change-source: pulse-maintainer
Preserve exact Web candidate 8ebd62d141. Its existing-guide correction matches the current queued sender and failure classification; retained source-rqwe9_7d proves the same guide, renderer, tests and frontend manifests. No frontend runtime content is changed by this integration, and inherited browser/native/publication gaps remain open.
Change-source: pulse-maintainer
pulse-triage[bot]