Keep the configured cluster URL as primary and recover discovered member
endpoints asynchronously while it is healthy. Reset member reachability
evidence when the effective address changes.
Refs #1437 and #1493
Route canonical cooldown refires through one resolved-state critical section and document the m.mu to resolvedMutex invariant. Exercise production refire, recovery, broadcast, alias repair, cleanup, and shutdown paths under the race detector while preserving cooldown history and start-time semantics.
Keep manual check commands active until registry collection completes. Deduplicate replayed and concurrent commands, bound collection and acknowledgement retries, surface registry result counts, and prove timeout, rate-limit, and replay behavior.
Two more frontend modules with a measured residue their existing specs never
reached. Deltas are uncovered counts, module scoped, existing specs versus
existing plus new.
- aiChatDevStreamFixture: branches 32 -> 2 uncovered; abortError and
handleAbort, previously never called, are now covered. The abort tests
assert the real cleanup lifecycle (timer cleared, listener removed, error
shape) rather than only that a promise rejected, and the per-step pacing
arms are exercised across their full cadence table.
- licensePresentation: branches 29 -> 24 uncovered, targeting the licence
expiry, tier and seat-count fallbacks.
No source file is modified. Adversarial review found no rejects. One describe
block in the chat-fixture test was removed before committing: it duplicated
exact event sequences already asserted in aiChat.test.ts and its trailing
checks were tautological with the toEqual above them; re-measuring after the
removal gave an identical delta, confirming it contributed no coverage.
PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT=test-only branch coverage, no source or contract change
Contract-Neutral: test-only branch coverage, no source or contract change
Four more frontend modules with a measured residue their existing specs never
reached, including seven functions no test called at all. Deltas are uncovered
counts, module scoped, existing specs versus existing plus new.
- infrastructureOperationsModel: branches 38 -> 1 uncovered and
createSurfaceScopedRow, previously never called, is now covered. This was
the largest proportional branch gap left in the frontend.
- summaryTableFocus: branches 26 -> 11 uncovered and scheduleViewportRefresh,
previously never called, is now covered.
- thresholdsResourceModel: hasThresholdDiff, dockerContainerOverrideIdCandidates,
findOverrideByCandidates and buildAgentHeaderMeta were all uncalled; covered
branches move 114 -> 130.
- api/charts: getStorageSummaryCharts and timeRangeToMinutes were uncalled;
covered branches move 41 -> 55. The fetch mocking follows the existing specs
and asserts parsed results, not that the mock was called.
No source file is modified. Adversarial review found no rejects; one subtest
duplicating an arm a sibling already covered was removed before committing and
the coverage was re-measured unchanged.
A fifth candidate, resourceBadgePresentation, was written and discarded rather
than landed: 263 tests moved the module by a single branch, because its
residual arms are unreachable defensive fallbacks.
PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT=test-only branch coverage, no source or contract change
Contract-Neutral: test-only branch coverage, no source or contract change
Four frontend models whose existing specs called every exported function but
took only one arm of most conditionals. Deltas are uncovered counts, module
scoped, existing specs versus existing plus new.
- patrolInvestigationContextModel: branches 155 -> 19 uncovered, the largest
single branch gap in the frontend. Covers the nullish-coalescing fallbacks,
ternary alternates, singular and plural boundaries, the resource cap at
MAX_ASSESSMENT_RESOURCES, and the identifier-label fallbacks.
- resourceStateAdapters: branches 51 -> 3 uncovered.
- truenasPageModel: branches 28 -> 7 uncovered.
- contextualFocus: all six previously uncalled DOM scroller helpers now
covered, taking covered branches from 41 to 82. The uncovered count moves
27 -> 29 only because those six dead functions bring their own branches into
scope for the first time.
No source file is modified. Adversarial review found no rejects. Acted on its
findings before committing: a test claiming to cover an identifier-formatter
fallback actually passed through the formatter unchanged, so it is retitled to
say what it does, and the real fallback arm is covered separately by the
separator-only key case; a cross-field consistency assertion that compared two
fields the source assigns from the same local is replaced with the concrete
value; three subtests duplicating an arm a sibling already covered were
removed; and a comment describing the parent-chain walk was corrected, since
resolveScrollableAncestor uses parentElement and never sees the Document.
Re-measuring after the removals gave identical coverage.
PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT=test-only branch coverage, no source or contract change
Contract-Neutral: test-only branch coverage, no source or contract change
Four frontend modules had a small measured residue their existing specs never
reached, including four functions no test called at all. Deltas below are
uncovered counts, module-scoped, existing specs vs existing plus new.
- storagePageState: getActiveStorageNodeOptions was never called; branches
5 -> 1 uncovered, functions 1 -> 0.
- discoveryPresentation: the three suggested-URL class helpers were never
called; branches 3 -> 1 uncovered, functions 3 -> 0.
- infrastructureOnboardingPresentation:
getInfrastructureSourcePickerItemForRouteStep was never called; functions
1 -> 0.
- storageBarPresentation: branches 7 -> 0 uncovered, so the module is now
fully branch-covered.
No source file is modified. Adversarial review found no rejects. Three
tautological assertions of the form f() equals f(), one test duplicating an
arm the existing spec already covered, and four cases re-exercising an already
covered arm of a two-arm selector were removed before committing; re-measuring
afterwards produced identical coverage, which confirms they contributed
nothing.
PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT=test-only branch coverage, no source or contract change
Contract-Neutral: test-only branch coverage, no source or contract change
Adds branch-coverage tests for eight packages whose target functions were
measured at 0% before this change. Every named target was verified to move
by running each package's coverage with and without the new file.
- internal/ai/eval: all 36 Scenario constructors and the four PatrolScenario
constructors 0% -> 100%. These are catalog-invariant tests, not literal
echoes: unique names, populated required fields, runnable assertions, tool
references checked against the agentcapabilities registry, and exact
assertion-count deltas across the env-gated conditional appends. A parity
test scans scenarios.go itself, so adding a constructor without registering
it in the table now fails rather than silently going untested.
- cmd/pulse-control-plane: nine MSP and tenant-runtime print helpers
0% -> 100%, covering the nil, empty-slice and optional-field arms.
- internal/ai/memory: RemediationLog GetByID, MarkRolledBack and
GetRollbackable 0% -> 100%, pinning the overwrite-vs-preserve contract on
RollbackInfo and each falsy arm of the rollbackable predicate.
- internal/alerts/config: AlertConfig.UnmarshalJSON 0% -> 90% and
NormalizeAlertConfigAliases 52.9% -> 94.1%.
- internal/config: RunMigrationIfNeeded 0% -> 100%, copyFile 0% -> 88.9%.
- internal/mock: AvailabilityFixtures, FixtureGraph.SupplementalChanges and
generateMockHostRate 0% -> 100%.
- internal/api: testProxmoxPlatformConnection 0% -> 100% through its injected
connect func, so no network is involved.
- internal/servicediscovery: needsDeepScan 0% -> 100% across every return arm
including the confidence boundary.
No source file is modified. Adversarial review found no rejects; two findings
were acted on before committing, replacing a circular catalog-count assertion
with the real source-parity scan and reducing an AllPatrolScenarios test that
compared the function against the same constructors it calls to the ordering
and completeness signal that is actually independent.
PULSE_ALLOW_CONTRACT_NEUTRAL_COMMIT=test-only branch coverage, no source or contract change
Contract-Neutral: test-only branch coverage, no source or contract change
Five new branch-coverage tests over the remaining pure vein, with no source or
existing test touched.
cmd/eval: twelve argument and environment parsers taken to full coverage,
including the two provider-filter variants driven so their differing default
behaviour is proved rather than assumed, the model list and exclude keyword
splitters over empty, whitespace and duplicate input, the selection reason
across every reason it can return, and the provider ordering proved
deterministic across repeated runs over the same map.
internal/actionlifecycle: the plan audit persistence asserted by reading the
record back through the store and by proving a store error is propagated rather
than swallowed, the policy mutation wrapper on both the success and error paths,
and the availability check error unwrapped through errors.Is.
internal/cloudcp: the audit failure accumulator including the monotonic OK flag
and the absence of deduplication, the container health predicate over each state
and health string it recognises with the case sensitivity of the state check
pinned, the tenant display name resolver against a real registry, and the
storage admission guard proved never to reach Docker when disabled.
internal/vmware: the fixture fetcher with independence asserted in both
directions and across consecutive calls, the refresh error wrapping asserted by
sentinel and message, the cached snapshot proved sorted, and the transport close
proved behaviourally by counting accepted connections on a loopback server
rather than by absence of error.
Contract-Neutral: test-only branch coverage, no contract surface touched
Four new branch-coverage tests over internal/unifiedresources, taking the
dispatch binding helpers and the in-memory store's action, loop report and
change counting paths from zero to covered. No source or existing test touched.
The dispatch binding is exercised through every validation failure arm with its
concrete error, a successful bind asserted field by field, a re-bind over an
already bound attempt, and blank identifiers, alongside the operation binding
predicate and the empty policy posture summary proved to hand back independent
pointers.
The in-memory store paths are all write-then-read round trips rather than error
checks: expiry, dispatch receipt lookup, dispatch completion, execution refusal
and lifecycle event recording each assert the stored record afterwards, and the
audit expiry is driven with nothing eligible, a mix of eligible and ineligible
records proving the ineligible ones stay, and limits smaller than the eligible
count.
The loop report lookups pin the triple key exactly, with a window end differing
by a single nanosecond proved not to match, and the user outcome update asserted
through a subsequent read.
The six change counters each cover an empty store, a different resource that
must not be counted, the cutoff boundary on the real comparison, and for every
filtered variant a filter that selects a strict subset so the filtered and
unfiltered results are proved to differ.
Contract-Neutral: test-only branch coverage, no contract surface touched
Five new branch-coverage tests over the packages the telemetry lifecycle drop
touched, taking twenty-two functions to full coverage without touching any
source or existing test.
internal/telemetry: the deployment method precedence chain, the duration bucket
asserted one nanosecond either side of every boundary so the strict comparison
is pinned, every activation stage in its precedence order with the rank
ordering proved strictly increasing, the estate size bucket at each inclusive
boundary, the monitored resource count proved to draw on each counted field
individually, and the update failure classifier through every category arm
including the status short-circuit that wins over error text.
The lifecycle and install-id records are exercised as write-then-read round
trips under a temp directory and a frozen clock: a first-ever ping with nothing
on disk, a later ping against an existing record, an unreadable record, a
directory that cannot be written, and a reset proved to change the identifier
and persist the new one.
internal/monitoring: the alert outcome accumulation across the cutoff boundary
and each classification, and the install outcome accumulation over the arms
reachable without a live monitor.
internal/api: the read state snapshot mapping asserted field by field with
collection independence, both diagnostics collection normalizers, the in-memory
zip entry extraction across a missing entry, a non-zip payload and a zero-length
entry, and the trusted proxy check over IPv4, IPv6 and malformed input.
Contract-Neutral: test-only branch coverage, no contract surface touched
Three new branch-coverage tests taking six previously unreached functions from
zero to covered, with no source or existing test touched.
internal/ai/qualification: the replay bundle loader across a missing path, a
directory where a file is expected, invalid JSON, trailing JSON values and a
valid bundle round-tripped field by field, plus the artifact root creation
including the arm where the parent path is a regular file. Fixtures are written
into a temp directory so nothing outside it is read or created.
internal/api: the in-memory and SQLite magic link stores both deleting expired
entries, with the boundary case of a link expiring exactly at the passed instant
asserted on the real comparison, the valid entries proved still present, and
repeat deletion proved idempotent.
internal/cloudcp/stripe: the subscription mapper resolving a real customer over
the fallback, the fallback when no customer is present, item and price
extraction across empty and multiple item lists, and the two provisioner options
applied and overridden in order.
Reported for follow-up, not fixed here: mapStripeSubscription dereferences its
subscription pointer without a nil guard and is safe only because its single
caller skips nil subscriptions.
Contract-Neutral: test-only branch coverage, no contract surface touched
Eight new branch-coverage tests taking thirty-one previously unreached
functions from zero to covered, with no source or existing test touched.
internal/kubernetesagent: twenty-one pure report helpers, including the pointer
converters proved non-aliasing in both directions, the ingress host and address
collectors across their trim, dedupe and insertion-order arms, the endpoint
slice readiness count where a nil Ready field counts as ready, and the target
role predicate.
internal/agentexec: the sudo long-option value gate over the real option list
including the inline equals form, and the approval grant verification error
unwrapped through errors.Is.
internal/alerts: the alert config alias normalization across the nil config
guard, the empty threshold early return, the blank type-key continue arm and
the legacy-delete versus supported-keep split, asserting both maps stay
independent.
internal/alerts/specs: the resource incident rollup evidence validation, each
failure arm asserted on its concrete error and the check order pinned when
several fields are invalid at once.
internal/cloudcp/docker: the not-found predicate through a wrapped error, the
route host label precedence, and the Traefik host rule parser across quoting
styles, combined matchers, multiple host clauses and malformed input.
internal/cloudcp/portal: the anonymous bootstrap builder, asserting no tenant
or user identity field is ever populated on the anonymous result.
internal/config: the legacy OIDC environment provider, including the arm where
an already-configured provider is present and the redirect derivation from a
public URL with a trailing slash.
internal/dockeragent: the update-all payload decode across wrong-typed and
missing fields, and the docker filter conversion.
Contract-Neutral: test-only branch coverage, no contract surface touched
Five new branch-coverage tests taking previously unreached functions from zero
to covered, with no source or existing test touched.
cmd/pulse-control-plane: the MSP status failure lookup across exact, absent,
case-differing and substring inputs, and the status state ordering proved
deterministic across repeated runs over the same map so a random map iteration
order cannot pass by luck.
internal/ai/eval: the signal coverage assertion driven through both the lazy
quality evaluation path and the supplied-quality path, at the minimum rate
boundary and either side of it, asserting the formatted message rather than
only the pass or fail outcome, plus the approval write command builder.
internal/api: the setup script server name derivation including the fallback
arm, the patrol autonomy level validator, the approval risk assessment across
every level it can return, and the two typed error messages.
internal/hostagent: the token already exists classifier over each phrase it
recognises, a wrapped error carrying the phrase, and near-miss messages that
must not match.
internal/monitoring: the limited temperature buffer including its truncation
boundary and its aliasing behaviour, and the mock series generators asserted on
determinism under a fixed seed and on their value bounds.
Reported for follow-up, not fixed here: the node escalation arm in the approval
risk assessment is unreachable for the current command set, generatePlateauSeries
panics on a negative point count and leaves its tail unclamped, and the limited
temperature buffer returns a slice that aliases its internal storage.
Contract-Neutral: test-only branch coverage, no contract surface touched
rcourtman