Retain exact Delivery candidate and its reviewed history. Offline packet, lifecycle and Tailnet controls pass; unchanged Chromium refusal receipts remain bound to their executed source. Native collection still requires protected publication, host activation and credential-administrator confirmation of dedicated tag:ci-deploy scope and self-only access.
Change-source: pulse-maintainer
Accept exact Product intelligence commits a6959e571b and 01adf338a4. Existing installation help now uses the signed non-root server path and protects custom installation state. Retained 55 documentation controls and inspected desktop Chromium and phone WebKit proof are adequate for this documentation-only change.
Change-source: pulse-maintainer
Use a dedicated Auth Keys write client restricted to tag:ci-deploy, never the broader demo registration. Reject missing configuration and validate the actual running Self tag and DNS before Serve. Keep exact-source, denial-stop, no-replay and cleanup contracts, with connected offline registration and Serve controls.
Change-source: pulse-maintainer
Preserve the reviewed denial and recovery corrections for an additive least-privilege registration repair. No native acceptance is inferred.
Change-source: pulse-maintainer
Do not report an absent lock or agent setting after malformed current-configuration output. Preserve passive bounded host reads, private output, unknown well-formed fields and the distinction from guest responsiveness or thaw.
Contract-Neutral: The operator-only helper now enforces its existing incomplete-read failure semantics; polling, guest-agent admission, API and storage contracts are unchanged.
Change-source: pulse-maintainer
Visual review found the bounded systemctl example clipped its option lines on a phone. Give each property its own line and distinguish a missing unit from a loaded root service before interpreting its settings.
Contract-Neutral: Documentation and focused verification only; no installer, runtime, API, persistence or security contract delta.
Change-source: pulse-maintainer
Replace the root-only hand-written service example with the signed server install path and bounded effective-unit checks. Explain that existing custom units survive updates and cannot be migrated safely by changing User alone. Exercise the real rendered guide and retain state and credential safeguards.
Contract-Neutral: Existing installation help and documentation verification only; no installer, runtime, API, persistence or security contract changes.
Change-source: pulse-maintainer
## What changes and why
- Keep VM filesystem readings visibly **Last known** or **Unavailable**
in bars, sparklines and history lenses, including compact phone rows.
Assistive text retains the full safe explanation; retained values are no
longer described as current. Inline charts yield space to their numeric
value without enlarging the row or adding a collector or interaction.
- Include fully cached Patrol runs in usage events, next-run budget
checks and cost-history projections. Zero ordinary-input tokens do not
make cache reads/writes free. Successful and partial runs retain their
disjoint usage buckets; empty and expired history stays excluded, with
existing five-minute prices unchanged.
The guest change addresses misleading freshness and clipped values
observed in the existing workload UI. The Patrol change follows the
accounting omissions in the existing usage/budget path.
Related to #2439
Related to #2118
Related to #2350
## Included source
Complete unpublished range:
`614d68a55e25f625f410ab5b38b792e274e56c8d..d77f56bee4e2e79c9c41f1244f9a1b3e65b60dbb`.
- Web candidate `031de38ec1dfb8185c200badc27ccdade55f9ff3`,
implementation `10f181b5007b4102340c779ae058d63958b0dd86`, based on
`5311a7c6febc5dfd7fcd81b10ca188d925e34527`. Includes the corrected
VM-only type narrowing, not the uncorrected implementation alone.
- Core candidate `e7c2b37cf6241a33c31abe05214364a8b8e4efb9`, based on
`da49bcdf8c2440212c40f5f7daeb1c196d5e0be9`.
- Additive integrations `da49bcdf8c2440212c40f5f7daeb1c196d5e0be9`,
`d5e0b4a19a763b1812d89aa4d528b6ad93041bb2` and
`d77f56bee4e2e79c9c41f1244f9a1b3e65b60dbb` preserve reviewed commits and
the published main frontier unchanged. Final tree equals the reviewed
Core candidate, with unchanged reviewed frontend bytes.
## Validation and remaining limits
Reviewed Web evidence `source-5qnwtk4f`: 342 tests, full types, focused
style, copy and row-accessibility audits, production frontend/embed
build and budgets. Its corrected-source 96-state Chromium/phone-WebKit
browser proof covers freshness, touch disclosure, assistive values and
dense-row geometry; all twelve final screenshots were inspected by the
source owner. The earlier type-check and clipping failures remain
recorded and were corrected before final acceptance.
Reviewed Core evidence `source-m_se_bxv`: parent omission reproduction
and final race controls at Patrol result, usage ledger, next-run budget
and projection boundaries. `source-_ghfb36e` supplies frontend
types/build and real embed assets.
Publication checks: provenance and whitespace checks passed; own-parent
canonical completion checks passed for all three source commits,
honoring the recorded type-only correction declaration; cumulative
browser guard confirms both final frontend paths match in-range
receipts. Existing sufficient source proofs were not repeated merely to
combine the batch.
Broad backend proof is unfinished: two guest-readiness failures returned
no command result. These are not test passes; executor recovery remains
owned separately, and required exact-head GitHub checks must pass before
landing. Synthetic controls establish neither native guest thaw nor
installed billing/provider savings. Release qualification, containing
release and installed acceptance remain separate obligations; this
proposal makes no issue-completion or release-readiness claim.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Retain both exact specialist commits and their rendered-help evidence. Existing documentation and verification only; no runtime, dependency or product-surface expansion. Full frontend suites/build remain unverified after two guest-readiness failures; rendered Chromium/WebKit and focused static evidence are proportionate to this diff.
Contract-Neutral: Existing help and verification only; no runtime contract changes.
Change-source: pulse-maintainer
Preserve published commit identity alongside already reviewed local guest provenance changes; published merge adds no new content.
Change-source: pulse-maintainer
A denial arriving as the browser closes must leave a failed bounded receipt and suppress recovery authentication. Exercise real late HTTP401/403 responses alongside the earlier navigation and API controls.
Contract-Neutral: Enforces the existing all-response refusal contract through final context disposal; no new acceptance route or permission.
Change-source: pulse-maintainer
The browser sandbox has no jq. Retain all browser control receipts and execute the actual harness guard in the offline source-proof VM with their explicit input binding, checking denied and permitted process/auth preparation. Browser context cleanup failure also remains a failed receipt.
Contract-Neutral: Existing refusal, bounded evidence and cleanup contract is unchanged; this connects its proof across the browser and source-proof runtimes.
Change-source: pulse-maintainer
The first phone setup screenshot caught the light-to-dark transition, while the later polling screenshot was settled. Await the actual theme animations before capture so the browser receipt represents the displayed help rather than an intermediate colour frame.
Contract-Neutral: Browser verification timing only; no product source or runtime contract change.
Change-source: pulse-maintainer
Bind anonymous probes at request start, record bounded navigation/API/SSE denial, close the page immediately and suppress recovery authentication when the upgrade receipt is refused or unavailable. Exercise real Chromium response controls through the actual shell recovery guard.
Change-source: pulse-maintainer
Remove the one-cycle data guarantee at the first setup steps, explain which ordinary reads a successful system-information probe has not exercised, and retain the published 6.4.1/6.4.5 probe-timestamp warning without applying it to repaired builds. Preserve read-only, credential-free polling checks and verify their shipped rendering and keyboard path.
Contract-Neutral: Existing help and its verification only; no runtime, API, polling, access, persistence or retention change.
Change-source: pulse-maintainer
Follow up #2118/#2350: ordinary input can be zero while cache writes or reads remain billable. Preserve cache-only successful and partial results, record them in the usage ledger, and include them in the history median and triggered-spend rate. Keep genuinely empty/expired history excluded and retain the existing five-minute prices and budget semantics.
Change-source: pulse-maintainer
## What changed and why
- Podman one-shot stats can report a zero percentage while CPU counters
advance. The collector now retains a baseline on every sample and uses
valid CPU-time/wall-clock intervals when the compatibility percentage is
zero, absent or invalid. Positive native percentages keep their existing
units; container restarts rebaseline and duplicate/backward samples
cannot manufacture spikes. Docker calculations remain unchanged.
- A saved TrueNAS connection test reads system information through a
separate client, not the scheduled inventory poller. Its success or
failure now stays in the probe response rather than clearing runtime
errors, advancing freshness/readiness or postponing inventory polling.
Real runtime polling still owns those state changes. Stored-secret and
tenant boundaries remain intact.
- Matching subsystem contracts and regression fixtures distinguish a
successful connection probe from actual inventory collection.
Related to #2447.
Related to #2382.
These changes address demonstrated source mechanisms. Native Podman
payload, graph/alert acceptance and the original TrueNAS
appliance/session failure remain unverified. The probe conflation also
existed in 6.4.1 and is not attribution of the reported 6.4.5
regression; the other TrueNAS session reports remain separate.
## Included source
Base `7fa6d164628588ac65872fb4e67a15aa3f92e2c8` → reviewed tip
`e382a5cd458f72e72235cb363121acc6f2f23ad5`.
Core candidate `ac51a2d37847d2bdc639ce81908d66161ae62a03` comprises:
- `ab978b6cfc4a27749e653f975d729609c8d53f52`: Podman interval CPU.
- `9677b5cd60758f01fd9f3dd9eeeeb58e82ae3ed7`: probe/runtime evidence
separation.
- `afd6cf975744836a2b5e461890563e2e1c3ce33f` and
`ac51a2d37847d2bdc639ce81908d66161ae62a03`: legacy-key and API contract
fixture reconciliation.
Integration `e382a5cd` preserves all reviewed commit identities and
published main ancestry.
## Validation and limits
Core's completed candidate proofs `source-ogv54f5k` / `source-r72b93x8`
report 5,942 top-level passes, 12,059 passing case events and 24
explicit native/load/SLO skips, including all 3,803 API tests across
five disjoint shards, races, vet and release/agent/helper builds. Its
frontend proof `source-3yj9h19f` covers that candidate's unchanged
frontend; intervening frontend changes are already published, not newly
claimed by this proposal.
Canonical-head offline proof `source-cfgfywcu` additionally passes
focused race checks in `internal/dockeragent`, `internal/monitoring` and
`internal/api` at exact head `e382a5cd458f72e72235cb363121acc6f2f23ad5`,
with complete output and stopped guest. It uses the standard dummy
frontend test assets, not a release build. It covers CPU
decoding/collection, TrueNAS runtime summaries and
saved-probe/list/contract controls. Relevant collector/poller/handler
implementation bytes match the validated Core candidate.
Provenance, whitespace and all four per-commit canonical completion
guards pass. Browser verification correctly skips this backend-only
range. Earlier adverse attempts remain retained in Core's outcome; none
is relabelled a pass. Exact-head protected CI and independent review
remain landing gates. Source publication does not establish reporter
resolution, native fleet relief, deployment or release readiness.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Use the established setup-node disable contract: no explicit cache backend and package-manager-cache false. The empty cache value was rejected by the workflow trust guard; retain the guard and add an omission check.
Contract-Neutral: The exact published-RC browser, credential isolation and cache prohibition contract is unchanged; this fixes its setup-node representation.
Change-source: pulse-maintainer
Live stable and RC archive metadata exceed 256 MiB; retain a streaming bounded 512 MiB archive/16 KiB signature/1 GiB binary contract instead. Disable automatic setup caches in the CI credential job and encode derived command outputs with the reviewed writer. Add regressions; do not relax workflow or release guards.
Change-source: pulse-maintainer
The final-source controls passed 342 tests but type-check reported TS2339: WorkloadGuest also includes containers without diskStatusReason. Read the existing VM-only field after the local guest passes its type guard, preserving reactive identity and presentation. Record a fresh inspected browser pass on the corrected bytes; the earlier failed proof remains retained.
Change-source: pulse-maintainer
Contract-Neutral: Type-only correction to the existing VM-only provenance memo; no surface, contract or safety semantics change.
## Outcome and why
- **Guest details open on the first phone tap.** Give VM and container
rows the same native click eligibility as shared table rows while
preserving delegated actions, keyboard disclosure and nested-link
isolation. The observed touch-browser failure hid existing backup and
disk safety details.
- **Container-update help states the real recovery limits.** Put
independent application-data backups before updates. Explain shared
mounts, five-minute old-container removal, best-effort rollback and
limited readiness checks; distinguish image-update suppression from
command authority. The preceding guide promised recovery guarantees the
agent does not provide.
- **Promotion controls preserve billing state.** Strengthen the existing
read-only entitlement and integrity assertions after an obsolete
assertion blocked the preceding reviewed batch. No production billing or
release authority changes.
Related to #1891. Its installed failed-update and durable recovery
outcomes remain unfinished. Related to #2439. Opening safety details is
not native guest thaw or a demonstrated fix for that report. No issue is
intentionally closed.
## Reviewed range and reconciliation
Complete range:
`dd00f9fccd6a7e66eb8841d230cb82d0d3b46cf1..5311a7c6febc5dfd7fcd81b10ca188d925e34527`.
Includes:
- Delivery candidate `c5bd6f1d99eecd49b5907c3091197dcbf55a6511`,
integrated at `a131e4be7dd83c323af9d3613f1b4b5e95624bbd` with the union
of overlapping test assertions.
- Container-help candidate
`c211bfe5229b2823975a708a6fa5c11435396b3d..1b97f2d94b3f4600ac0be45b31e16f4283c2c6f9`,
integrated at `4c3d6f10c4a979d1ed02d82229eeeb2f78acdbed`.
- Guest-row repairs `d856689f5b3b200c942db4151a0b657cfdacf1c4` and
`826eaf2a1275b59dfc22f372958665223a0ebbe8`, qualified together at
`116211d7f2585481b79f28c7c441aa6efbb879a1` and integrated at the final
head.
- Additive upstream composition
`6de9771e76340d83d53730ebb2acbe78ae253487` retains the current published
main and every reviewed identity. No accepted history was rewritten;
dependency manifests are unchanged.
## Validation and limits
Retained owning proof `source-vrim01em` passes 137 GuestRow tests, full
types, focused lint/format, copy and row accessibility audits,
production frontend/embed build and budgets. Original own-parent browser
receipts cover the exact unchanged final row bytes: six
guest/full-drawer cases plus four shared-row controls, desktop Chromium
and phone WebKit, first/repeated taps, keyboard disclosure and
propagation isolation. This is emulated browser evidence, not a physical
phone or native backup operation.
Retained help proof `source-34vo9thj` passes 59 rendered-doc controls,
types, focused lint/format/copy, production build/budgets and mirrors.
Its inspected desktop Chromium and phone WebKit witness covers help
rendering, keyboard navigation and overflow, not an actual container
update or rollback. Retained Delivery proof `source-o60c8bal` passes 60
promotion controls, 58 connected demo-transaction controls and two
install contracts. Earlier setup failures and corrected intermediate
lint/theme observations remain adverse history, not passes.
Final-range provenance, whitespace, canonical completion, exact guide
mirror and cumulative two-file browser coverage pass. The final-source
promotion suite passes all 60 controls. An additional combined frontend
check could not start within the isolated executor capacity window
(`proof-worker-busy`, client exit 2); it is not counted as a pass. The
checked row source/fixtures and guide/witness are byte-identical to
their respective owning proofs, the two changes are disjoint, and
manifests and shared renderer code are unchanged. Those sufficient
build/browser checks are reused; exact-head CI must still complete.
Independent review and required exact-head CI still govern landing. This
proposes source improvements only; containing release, installed
recovery, native thaw and customer acceptance remain separate outcomes.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Show retained or unavailable read context beside filesystem values across bars, sparklines and history lenses, with the full safe reason available to assistive readers and the existing drawer. Announce retained chart values as last known, and let narrow chart plots yield width to the numeric value without growing dense rows. Include fixed-reason regressions, subsystem obligations and inspected final-content Chromium/WebKit proof.
Change-source: pulse-maintainer
Reuse the signed-install lifecycle assertions on a fresh public hosted VM without Docker identity overrides. Bind immutable release assets/control, observe one real UI apply/SSE/modal journey, retain sanitised terminal evidence and stop access refusals without reauthentication. Update the deployment contract and execute its recovery-access guard; release judgment and gates are unchanged.
Change-source: pulse-maintainer
Accept exact Product Intelligence candidate 1b97f2d94b. Existing help now states shared-data, five-minute old-container cleanup, best-effort rollback and separate command-authority limits. Retain owning final-source and rendered-help proof; no native update or release delivery is claimed.
Change-source: pulse-maintainer
Retain the published batch-start frontier and locally reviewed billing-safe governance integration by exact ancestry. No source reconciliation beyond the batch-start frontier.
Change-source: pulse-maintainer
Preserve d856689f and 826eaf2a and their own-parent browser receipts on the supplied current base. Complete the unexecuted final-binding source checks and production embed build without changing the repair or dropping Recovery and release-governance maintenance.
Change-source: pulse-maintainer
## Outcome and why
Make existing monitoring evidence, notification results and recovery
guidance safer and more truthful.
- **Guest-agent reads respect backup activity.** Coordinate guest reads,
defer them around backup locks and incomplete responses, and show
freshness/deferral rather than presenting retained readings as current.
The VM diagnostic helper stays off the guest-agent channel. The serious
frozen-VM report in #2439 motivates this source mitigation; it is not a
reproduced freeze cause or native thaw proof. Advice remains to stop
Pulse before the backup and restart only after independently verified
thaw, with the monitoring/alert outage explained.
- **Current, permission-scoped monitoring details.** Keep drawers on the
current resource snapshot; retain stored disk History independently of
current collection; withdraw History and fallback readings on access
denial; scope fetched History to the active organisation. Improve honest
PBS/NAS, Docker, Kubernetes and guest disk rows, units, wrapping and
unknown/pending states. These address the existing #1723/#2077 panel
concerns without claiming every appliance symptom resolved.
- **Fewer false metadata changes, honest notification results.** Sort
deduplicated label-derived tags while retaining real metadata edits and
clears, addressing #2441's narrow cause and one contributor to #2199.
Keep delayed firing/recovery, pending groups and repeat cooldowns tied
to their alert occurrence. Preserve SMTP final-DATA acceptance despite
cleanup failure and reject interrupted ntfy responses rather than
reporting delivery success. Failed notification-evidence reads remain
visible, not empty success.
- **Safer existing help and recovery.** Explain the actual configuration
archive and its omissions, key/stopped-state requirements, retargeting
and partial-import risks. Keep backup versus snapshot evidence and
rollback consent separate. Use private credential-header files, bounded
failure-aware diagnostics, bootstrap installation authentication and
non-destructive login recovery. Updated instructions cover scheduler,
webhook freshness, deployment, platform navigation and bounded write/CPU
evidence (#1966/#2199); they do not establish runtime performance
relief.
- **Evidence-preserving demo update/recovery.** Route owned signed
runtime transactions through captured baselines, sustained observations
and guarded forward/reverse restoration, including restoration when
receipt writing fails. Add a separate native acceptance workflow without
claiming it has run or that an installed transaction has passed.
Release-note title guards are aligned with the existing signed-runtime
recovery model. No release is selected or published here.
## Reviewed source and upstream reconciliation
The complete current unpublished range is
`8e14b4a63e954c52cf30f0c533b213020abc9397..e597bb2a4beba8679782a453e0653bf53d3f743d`:
**138 commits, 86 non-merge source/proof commits**. Every previously
reviewed identity and ancestor is retained, including starting local tip
`3c0fdcc74255d3ea6192475206326ee176ddaa7c`.
Earlier publication updated PR2429 from
`7a5635b2c0b76e13f510cc7a27b7ca0cd55091ba`; its failures and additive
remedies are retained history. Failed logs identify the VM-diagnostics
fixture lacking authoritative configuration (Build run `37143637085`),
the Deferred badge substring also matching the unreadable-evidence
warning (E2E run `37143637132`), macOS temporary-path aliases (Native
run `37143637054`), and clear-text billing-state rewriting (CodeQL check
`111263223348`). Reviewed additive repairs `091f9877`, `d9a2c786`,
`cd20663a`, and `7d739698` address those paths. Re-running that old head
would not incorporate these repairs.
Later reviewed work is included now because the old batch cannot land
independently:
- Web candidate `0f480d23aff50bd33236d125aafbfd67b1a65fd9` preserves
`c54aa9e3` backup-response validation: unreadable/malformed responses
are not empty success, and one source's failure does not hide another
source's readable inventory. It composes measured disk labels with
paused-read provenance and same-VM resumption.
- Recovery help `2201fd59` distinguishes completed-backup evidence from
safe restore; proxy help `c381995d` keeps navigation aligned with the
forwarded-header trust boundary; independent bounded guest-write witness
`ee069f21` records writes/liveness without issuing guest-agent commands.
None proves native thaw or installed recovery.
- Billing-safe demo profile repair `7d739698` requires an already
admitted demo capability and leaves billing/key material untouched;
canonical encrypted/legacy/HMAC controls remain with the application.
Diagnostic and delivery fixtures assert the real admission/evidence
boundaries without weakening them.
- Core candidate `509c12f1ae7c27fd004890c4db9e6d12312c874c` isolates
strict zero-allocation checks from unrelated background fixture workers.
Current upstream independently adds a related isolation helper at
`8e14b4a6`. Additive merge `49e37ddd` reconciles the upstream entry
point with the reviewed bounded child launcher, measurement witness,
escaping result sink and background-allocation control. No production
normalisation or allocation threshold changes.
Startup-fetched upstream `8e14b4a63e954c52cf30f0c533b213020abc9397` was
merged by full identity. No reviewed commits were rebased, amended or
recreated. No stopped upstream-refresh attempt was replayed or
retrospectively cleared. Final frontend runtime and fixture bytes match
the owning Web candidate; additional upstream receipts are preserved
unchanged.
### Current proposal decision
PR2429 at `49e37dddfcf3ed03f5c47cdcca10a367969da9b5` has completed
validation, not a running batch to preserve. All functional backend/API
shards, frontend, eight E2E shards/verdict, native and CodeQL checks
succeeded. Required governance run `37161775883` failed because its
source assertion still demanded the billing-integrity removal and
entitlement rewrite that reviewed security repair `7d739698`
deliberately removed. Additive correction `e597bb2a` instead requires
read-only admission of an existing demo capability and rejects those
former unsafe writes. Production paths and thresholds are unchanged.
This batch cannot land independently until that required defect is
repaired, so the newer reviewed Recovery link work is included rather
than repeatedly advancing a checking head.
Product Intelligence candidate
`2a9e4183a6ff670d2f08dab3f67f4b95b27f6c1c`, source `48dc32d1`, is
retained by integration `3c0fdcc7`. Both Recovery mirrors now navigate
to the actual rendered safe-evidence heading. Its renderer regression
and Chromium/phone WebKit keyboard-focus controls pass at the owning
exact source; the initial missing dependency and fixture-only full-shell
API500 remain separate adverse setup results. Retained `source-3ytpvq_m`
passes 58 docs controls, types, focused lint/copy, production
build/budgets and mirrors. No released or native recovery claim follows.
Advisory Benchmarks in completed Build/Test run `37161775840` reports
`HandleMetricsHistory_MemoryFallback/single-metric-4` **+15.59%**,
117.0us to 135.3us, p=0.035, n=10. That result is not a pass, diagnosed
noise or release approval. No measurement or workflow was replayed;
Delivery receives the exact head/run/evidence for its existing
performance follow-through. The test-only correction does not remedy
this performance observation. New exact-head CI must run normally.
## Validation and remaining limits
Current lightweight final-source fixture proof via
`pulse-maintainer-proof` at `e597bb2a` passes all **60 release-promotion
policy controls and 58 demo transaction fixture controls** (complete
output; exit 0). The disposable source-proof request remained queued for
capacity at the last observation and has no terminal receipt; it is not
counted as a pass. No new production bytes require repeating already
sufficient heavy functional evidence. A first dirty-source proof
admission was refused before execution, and the initial correction
commit was refused for noncontiguous trailers; the clean committed
correction fixes that metadata, with no accepted commit rewritten.
Current provenance, whitespace, the three added source/proof commits'
own-parent/history guards, 34-path final browser coverage,
contract/registry audits and shipped-doc/public-doc checks pass. Earlier
83-commit governance and unchanged functional evidence are retained, not
claimed as new execution.
Retained reviewed evidence is reused where final bytes are unchanged:
- Earlier Web `source-iad0hwfi` / `source-e56ectzj`: 21,916 frontend
passes / three skips, types/lint/format, real production embed/build and
inspected desktop/phone fixture families. Migration `source-uawz1_yy`
and `source-eb0vj05m` retain types, focused tests, production
build/budgets and inspected combined help/dialog rendering.
- Core `source-s1fokff6` / `source-ect7ogdd`: consumer/tag/API/race
controls and real embed/application build. Earlier cleanup and
performance/native limitations remain adverse evidence, not cleared
acceptance.
- Composed fixes `source-00eqpxhc`: 140 frontend tests,
types/build/budgets; `source-zfh88hkq`: diagnostic/billing controls and
58 demo methods. These are retained reviewed proofs at their recorded
source, not a new execution here.
- Final owning Web: unchanged 580-case `source-fi8xj80e`; 467 combined
tests and types completed in `source-9ua5hue8`, which then failed test
formatting; the separate committed correction `source-jq0lly7u` passes.
Chromium/WebKit rendering, eight inspected settled screenshots and
own-parent receipts cover the combined reader/disk content. Trusted
phone row/name taps did not activate the drawer; mouse-click rendering
is not touch acceptance. That unresolved input observation remains with
Web.
- Core allocation candidate: `source-g3lk4tyh` passes connected
controls, full required API shard under races, vet and real application
build; `source-720fc09_` supplies actual frontend assets;
`source-ya9bup8h` passes release-tagged embed/allocation consumers.
Skipped native/load/SLO controls remain explicit.
Previously recorded provenance, whitespace, **all 83**
own-parent/history governance checks, final-content browser coverage for
**34 frontend source files**, 62 shipped-doc mirrors, 211 public
Markdown documents, workflow trust and 16-subsystem contract/registry
audits pass.
Retained exact-source `source-bh_gki5e` at `49e37ddd` passes
normaliser/allocation/background-worker and VM-diagnostic admission
checks, followed by normaliser/allocation race checks: 311 passing case
events, no skips; complete 44,002-byte output is hash-matched and the
guest stop completed. This uses the repository's explicit synthetic
test-assets setup, not a new real production embed or full API-suite
acceptance. The first all-API attempt `source-d2rcrw3i` failed at
compile setup because the clean offline VM lacked generated frontend
assets; no test ran. That failed attempt and an earlier dirty-source
admission failure remain recorded separately. Unchanged
frontend/real-build evidence above is reused, not replaced by the
synthetic test index.
Independent review and required exact-head GitHub checks still govern
landing; old failed checks are not a pass. Source publication
establishes neither a release nor native backup thaw, fleet performance,
installed update/recovery, appliance/panel acceptance or reporter
confirmation. The frozen release candidate is unchanged; containing
all-main release and native follow-through remain separate work. No
issue is intentionally closed by this partial maintenance batch.
<details>
<summary>Complete unpublished non-merge source/proof inventory</summary>
```text
e597bb2a4b Keep release governance aligned with billing-safe demo profiles
2a9e4183a6 Keep the safe-reporting browser check on the Docs fixture
48dc32d1a3 Fix Recovery safe-reporting navigation
0f480d23af Verify composed disk labels without losing paused-read context
c54aa9e3e7 Reject unreadable backup responses before publishing inventory
509c12f1ae Isolate route allocation checks from API fixture workers
d203eeb17a Bind backup read tests to cancellation and independent settlement
d9292ef38c Keep backup inventory failures source-local
2201fd59b4 Make recovery help distinguish backup evidence from safe restore
5355a41c08 Record final browser proof for composed disk and backup presentation
7d73969882 Keep demo runtime profile changes out of signed billing state
091f987798 Exercise authoritative guest-lock admission in VM diagnostics fixtures
d9a2c78612 Assert held delivery rows separately from unreadable evidence
c381995d24 Keep proxy-auth help navigation independent of emoji fragments
cd20663a7e Keep demo recovery fixtures portable across temporary path aliases
ee069f2144 Add independent bounded guest-write evidence for backup thaw
bbf839a261 Keep completed guest backup evidence visible during activity
d36dba5dff Verify trusted-peer proxy help in the shipped Docs viewer
cbbed83add Make reverse-proxy help match the forwarded-header trust boundary
971d4e9f77 Keep auth context tests independent of tenant runtime writers
76484e4e8c Verify combined migration warnings and guides on Tailwind 4
b8eaed71c8 Record final-content browser proof for the composed frontend
1e9c2bdae6 Bind migration browser checks to the composed source graph
e5986b2edc Remove trailing whitespace from migration browser harness
11c7f32dba Format the combined Swarm wrapping regression assertion
26c64634f0 Verify configuration scope without outbound-network assumptions
9a05a5d477 Keep connected metadata controls independent of tag ordering
4e57511d1e Stabilise label-derived tags without hiding metadata changes
73d2c64e0f Make configuration migration warnings match the actual backup
6725576c7e Allow full-width guest freshness explanations in drawer ownership guard
a355525d57 Keep fresh drawer test bytes consistent with its percentage
b22d3b4490 Explain deferred guest reads without unsafe backup advice
3c57c2d207 Defer guest commands after incomplete HTTP error responses
6ec491bdf3 Keep VM disk diagnostics off the guest-agent channel
98e2a5ef69 Keep release guards aligned with signed runtime recovery
a090a67756 Keep guest-agent admission single-attempt for password sessions
577e40edf3 Keep guest-agent continuity guard aligned with backup deferral
41457c8a82 Make copied webhook verification freshness-aware
35914abab7 Validate release notes by their exact first title
2df28d5877 Defer and coordinate Proxmox guest-agent reads around backup locks
ec5c96a290 Keep scheduler diagnostics private and failure-aware
9df89142d3 Keep notification activity truthful when evidence reads fail
3a98883de1 Preserve notification verdicts through SMTP cleanup and ntfy diagnostics
43b81bbb2b Exercise curl header removal and explicit empty roles separately
2789a15fe5 Keep authentication diagnostics private and permission-aware
9c3d79ba6a Scope Swarm browser check to the current-state evidence
2839333474 Make operator-row browser fixture self-contained
480be08288 Preserve REST operator evidence and readable platform rows
462cdfb170 Recover local logins without deleting authentication state
200ce831a8 Keep installation quick starts on bootstrap authentication
aefbb2b6c4 Verify private-auth help through production rendering
f273e86189 Keep Docker setup credentials private across help languages
e899ecb0cf Keep backup evidence and rollback consent truthful on narrow screens
45835634ea Qualify rollback help by updater and backup scope
6e5acd9c02 Keep denied resource evidence out of drawer fallbacks
d16e665e6c Route deployment updates through evidence-preserving procedures
2dda2e6653 Scope fetched History to the active organisation
227657b1b0 Retain the attempted terminal phase on writer failure
5cf724b4e7 Keep recovery independent of its phase writer interface
f827f7150f Restore owned demo runtime despite receipt I/O failure
ae427e6afe Respect the Docs heading inset in recovery visual checks
c71bdbbda7 Capture the recovery procedure after theme and scroll settle
4fbb69a7dd Make server update and rollback help evidence-preserving
a23029a80c Keep demo installation proof aligned with signed runtime operation
ac995ef565 Keep pending notification groups occurrence-qualified
a2fc29b70b Limit guarded demo updates to owned signed runtime files
6f5bf96370 Withdraw History readings when access is denied
63b24757d6 Accept readable wrapped help tables as well as local scrolling
0027f7c9d9 Verify help table cells with the production style configuration
661d7c7b2e Activate paired firing work in the receipt-ordering fixture
1a1b59072b Point monitoring help at the current platform navigation
0dcd592ef2 Keep notification cooldowns ordered by alert occurrence
ee451f8c8c Restore canonical ordering for demo registry entries
7ec246381f Check retained demo profile inside its owning transaction
360721cc91 Bind demo cohost observation to the real Relay health route
c9a0f0bf6a Keep stored disk History independent of current collection
d0d621a7c2 Exercise detector admission in partial-delivery recovery proof
4df3e8974e Add disposable native acceptance for owned demo recovery
1c9440546a Use destination receipts for delayed partial-delivery recovery
2c57a54ec4 Preserve sending-row crash recovery in the occurrence fixture
8f42497b8f Keep delayed alert recovery scoped to its resolved occurrence
b3937a4803 Use the actual lookup receipt shape in demo ownership proof
751fb67523 Bind demo controls without broadening unrelated release proof
f56e28e6af Own demo update and recovery through sustained host observation
286c8a1f51 Make write and CPU troubleshooting bounded and evidence-preserving
0d8d5beb5f Keep open resource details on current snapshots
```
</details>
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Merge exact Delivery candidate c5bd6f1d99. Resolve the overlapping test-only repair by retaining the union of existing and candidate read-only admission and billing-write prohibitions. No runtime or frontend changes.
Contract-Neutral: Test-only integration preserves production behaviour and release authority.
Change-source: pulse-maintainer
PR2429 governance run 37161775883 still required the superseded entitlement rewrite after reviewed repair 7d739698 made profile admission read-only. Require the existing demo capability and reject the former integrity removal and billing rewrite instead. Retain runtime-setting, release and recovery guards unchanged.
Contract-Neutral: Test-only integration reconciliation; production billing and release admission are unchanged.
Change-source: pulse-maintainer
Update the legacy contract assertion exposed by the full API suite. A successful system-info-only probe remains successful but must not invent a runtime attempt, success or observed inventory. The real poll and failure-preservation controls remain unchanged.
Change-source: pulse-maintainer
Wait for the Docs fixture theme transition before retaining phone screenshots. This changes the visual witness only, not rendering, container actions or the guide.
Contract-Neutral: Browser validation only; no runtime or public contract change.
Change-source: pulse-maintainer
PR2429 governance run 37161775883 still requires the removed demo entitlement rewrite and integrity clearing. Require the existing read-only capability gate instead, and reject billing writes or integrity removal. Keep all runtime profile, protected publication and exact-RC controls.
Contract-Neutral: Test-only alignment with the reviewed billing-preserving demo transaction; no runtime, API, deployment authority or release policy delta.
Change-source: pulse-maintainer
Replace a claimed 15-minute backup and guaranteed rollback with the implemented five-minute cleanup, shared-data and best-effort limits. Put independent backups and deployment-manager recovery before the action, preserve current-state checks, and distinguish image-update suppression from command authority.
Contract-Neutral: Documentation and validation only; no container runtime, command authority or API changes.
Change-source: pulse-maintainer
Match the existing shared TableRow splitProps pattern so the JSX lint check recognises distinct native eligibility and delegated action handlers. Preserve the same callback ordering, conditional removal, identity and keyboard controls; repeat the production guest/full-drawer browser pass for the final binding.
Change-source: pulse-maintainer
Contract-Neutral: Typed handler forwarding preserves the already-contracted touch eligibility, actions, child isolation, accessibility, row identity and state; no contract delta.
The connected proof passed both probe/poll evidence cases but found one older fixture still expecting a successful stored-key probe to manufacture poll success. Keep its stored-secret, HTTPS and missing-ID controls while requiring untouched runtime timestamps and observations. Retain the adverse proof separately.
Change-source: pulse-maintainer
Preserve exact Product Intelligence commits 48dc32d1a3 and 2a9e4183a6. Correct the existing Recovery link in both shipped mirrors and retain its renderer and desktop/phone keyboard-navigation controls. Reviewed source-3ytpvq_m and content-bound browser evidence remain adequate; no native recovery or released availability is claimed.
Contract-Neutral: Existing help-link repair and regression controls only; no runtime or API contract changes.
Change-source: pulse-maintainer
Preserve reviewed tip 888d918ba1 and startup-fetched upstream 8e14b4a63e unchanged in history. Resolve the allocation-test conflict by retaining the upstream boolean entry point with the reviewed bounded child launcher, strict measurement witness, escaping root sink and background-allocation control. No runtime or threshold changes; no stopped refresh replay.
Contract-Neutral: Test-only additive reconciliation of allocation-isolation repairs; runtime contracts unchanged.
Change-source: pulse-maintainer
`TestNormalizeRoute_RootFastPathDoesNotAllocate` failed in the api-2
shard of #2445 (a frontend-only change) with `normalizeRoute("/")
allocated 419 times per call, want 0`. A rerun passed.
`testing.AllocsPerRun` diffs the process-wide `MemStats.Mallocs`, so it
also counts allocations by parallel tests and by goroutines that earlier
tests left running. Any of them that the scheduler lets in during the
measurement inflates the count. `TestNormalizeSegment_DoesNotAllocate`
has the same exposure.
Both tests now re-run themselves in a child process of the same test
binary (`-test.run=^Name$`), where nothing else allocates. The parent
fails if the child fails or does not report a PASS for the test. The
zero-allocation assertion is unchanged.
Evidence:
- With a leaked allocating goroutine and 30 concurrent processes
(`-count=40` each), the old tests failed in 30 of 30 processes (204
failing checks, for example `normalizeSegment("resources") allocated
8808 times per call`). The new tests passed in 30 of 30.
- Removing the `/` fast path via `-overlay` still fails:
`normalizeRoute("/") allocated 1 times per call, want 0`.
- `go test ./internal/api -run TestNormalizeRoute -count=200` passes on
the Mac and on pulse-dev. `-run DoesNotAllocate -count=200 -race` passes
on pulse-dev.
Merge exact upstream 99927467f5. Resolve only the agent-lifecycle contract append conflict by retaining both monitor recovery ownership and AI usage export clauses. Frontend auto-merges preserve reviewed final bytes; no runtime conflict correction or browser receipt rebinding.
Change-source: pulse-maintainer
Preserve exact Web candidate 0f480d23af and its own-parent browser receipts; retained source and browser evidence covers the final reader and deferred-read label content.
Change-source: pulse-maintainer
A saved connection test reads system.info on a separate client. Keep both probe results out of runtime timestamps, failures, retry cadence and inventory readiness. Preserve stored-secret and tenant boundaries, and validate the existing API evidence through real local client/poller/handler controls. Update the matching API, monitoring, lifecycle and recovery contracts together. This repairs the diagnostic gap in #2382; its native polling/session cause remains unverified.
Change-source: pulse-maintainer
Retain a baseline on every response and fall back to interval counters for zero, absent or invalid compatibility percentages. Preserve positive native units and Docker calculations, rebaseline on restarts and reject out-of-order intervals. Add connected collector controls and the matching monitoring and agent contracts. Addresses the source gap reported in #2447; native payload and reporter acceptance remain unverified.
Change-source: pulse-maintainer
Add owning-Web browser proof for the exact combined model after preserving the reviewed backup-reader and original upstream commits. Exercise measured label fit, independent provenance and settled same-VM resumption in Chromium and phone WebKit, while explicitly retaining failed trusted row-tap evidence. Correct only Prettier layout in the additive test resolution; do not repeat the unchanged backup suite or claim native acceptance.
Change-source: pulse-maintainer
Contract-Neutral: Browser fixtures and own-parent receipt for already composed runtime; Prettier-only assertion layout, with no new contract behaviour.
pulse-triage[bot]