## What changes and why
- Keep backup-age checks fast and make failed or partial evaluations
visible through one existing system warning, without clearing retained
age alerts. Indexed latest-observation reads preserve retention, schema
and the read budget. This responds to the recurring missed checks
reported in #2465; synthetic timing is not proof of relief on the
reporter's Pi.
- Defer guest-agent commands after uncertain HTTP results and require
same-target, unambiguous backup-lock evidence before guest reads. Keep
guest coverage truthful when only remembered versions or a parent-node
assignment exist. Preserve the original observation time/source of
retained memory through existing backend projections. These changes
advance #2439 safety, but do not establish native thaw or recovery.
- Attribute Proxmox backups using native connection/node and unique PBS
namespace evidence, retaining ambiguous artifacts rather than assigning
them by substring or display name. Show unreliable PBS capacity as
Unknown/Unavailable, while retaining valid measured zero and readable
phone warnings.
- Restore existing TrueNAS and VMware connection alerts using the
constructed runtime pollers. This does not resolve the distinct
monitoring cause reported in #2382.
- Keep safe report collection and attachment guidance self-contained,
and make manual backup pause/resumption precautions usable. Repair the
Diagnostics integration journey's outdated controls, download assertions
and session capability, without changing production authorization.
## Included source
Published base `61146105c74a5968d877691e02963c41f8e66076` → exact final
head `af73b0e6c618da83c4fc5e702ba464257481851c`.
The previous proposal head `dcde1d0157d5e3c4cd626d6b920a45016a3f0437`
and all reviewed ancestry remain unchanged. This advances the proposal
once after its workflows completed with demonstrated failures; it does
not interrupt a checking head.
Reviewed candidates include:
- Previous batch: guest HTTP `cd1e3ba12f`, runtime alerts `7f5c8a0cf1`,
safe intake `496ba1e73e`, PBS capacity/render sequence `8f09a59996`
through `d2f7e456b3a`.
- Manual pause `3fd44b8325`; native backup ownership `c5e83ceb3a` /
`6198a3ce22`; authoritative locks `b77e6908e6`; truthful guest coverage
`ba3e2d2c1c` / `8f9a9a6a1e` / `f9f53befbb`.
- Backup evaluation/query `5774b6bc4b` / `7a19a06631`; Diagnostics
sequence `ed168c8d7e` through `a3bbcae0c9`; memory provenance
`abee023634` through `80d8ad0f59`; self-contained intake `7c9922f55d`.
- Starting reviewed canonical tip
`8003a4037bf2e6628d47ca6c7da239a11096168e` is retained. Four additive
publication corrections (`745ddc982a` through `79091f7b03`) supply the
report-form contract, connected docsLinks regression and exact
historical completion pair. The first completion's section placement
failed the checker; its substantive-section correction passes. No
accepted commit was amended or recreated.
## Validation and remaining gates
The previous proposal's completed runs remain adverse: Build/Test
`37204956836` failed the documentation drift assertion; E2E
`37204956824` failed Diagnostics shards 3/6/8 (download/obsolete
Run-control timeouts). These warrant the admitted changed-source
repairs, not an unchanged retry.
Retained reviewed evidence includes guest transport/connected/race/build
(`source-5_ta7via`), runtime alert connected proof (`source-s0xmdftf`),
PBS source/render evidence (`source-_9ekxhcy`), manual-pause
source/render (`source-ifgmfzhw`), all-reader authoritative-lock proof
(`source-41amnzmb`), guest coverage's 1,901 connected tests/full
types/lint/build and inspected Chromium/WebKit desktop/phone renders
(`source-3y6kfagt`), backup recovery/alerts/monitoring/races/vet/real
builds (`source-vc1jlsz9`), and memory
models/unified-resource/alerts/monitoring/races/vet/types/real
embed/build (`source-5swnugj9`). Diagnostics retains nine passing
full-app journeys with matching source hashes; catalogue
`source-cyehgbio` discovers 916 test/project identities, including all
nine Diagnostics cases, but is not runtime acceptance. Intake
`source-stznewur` retains two intended parent failures and passing
policy/documentation/mirror checks.
Publication checks: provenance, clean retained ancestry, per-commit
canonical completion/history, registry/contract audits and final
browser-content coverage (nine changed production frontend files) pass.
Earlier proposal-head (`79091f7b`) offline VM proof `source-1fn6chab`
passes 36 docsLinks tests, formatting, 27 intake cases, 211 public
Markdown checks and 62 mirrors, with complete hash-matched output and
guest stop. Its line-index bound is explicit. Earlier `source-yj300mm2`
passed docsLinks but exited 1 when a browser script was mistakenly
invoked in a source VM without Playwright; no browser result is claimed
from that attempt. Earlier local preparation failures and prior
API/embed limitation remain evidence at their own bindings, not green
aggregate results.
Required exact-head CI must run the complete backend/build/frontend,
audit and protected E2E checks, with independent source review, before
landing. Existing sufficient connected/render proof was not repeated
solely for batching. This is source publication, not release
qualification, deployment, native appliance/guest acceptance or
completion of the linked reports. The containing all-main release, Pi
evaluation/failure/recovery, native backup/thaw/covered writes/liveness,
remaining memory drawer consumption and installed whole-panel/alert
results remain separate.
Related to #2465
Related to #2439
Related to #2382
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
## Completed workflow reconciliation and additive smoke repair
The starting proposal head `79091f7b0317807fcc76e36cde52c4ee1cc4c928`
and every reviewed commit remain ancestors of this head. Build/Test
`37219920651` has now completed. All backend partitions, frontend,
governance, security and all eight E2E shards/verdict passed, but script
smoke failed two obsolete whole-guide assertions in
`test_vm_disk_diagnostics.py`; backend build was consequently skipped.
The reviewed manual backup precaution deliberately adds six server/timer
examples. The old passive-helper test counted all seven guide examples
and banned `systemctl` throughout the whole guide. This source mismatch
warrants changed-source repair, not an unchanged retry. Additive
test-only `c4a72995c6bf2465a6540a1b546a9dcd732944af` scopes
passive-helper execution to its named section and admits only the exact
six reviewed manual-pause blocks. Its first local run retained one
failure because a shell comment was mistaken for a heading. Additive
`af73b0e6c618da83c4fc5e702ba464257481851c` parses headings only outside
fenced blocks. All 17 diagnostics/safety controls now pass, including
missing/duplicate headings, shell comments and five prohibited-command
mutations. The passive helper still rejects active guest requests and
service mutations. Production and guidance bytes remain unchanged;
mirrored docs and connected intake checks pass. Both failed
correction/control observations remain recorded, not relabelled.
Final publication provenance, clean retained ancestry, additive
contract/registry audits and the unchanged nine-production-file
browser-content coverage pass. Lightweight confined fixture proof
supplies the full 17-case suite; existing heavy/render proof was not
repeated for this test-only delta. This proposal advances only after the
previous head's workflows completed. Exact new-head CI must rerun its
required checks before landing.
The completed advisory benchmark job is also adverse:
`RefreshPlatformScopes` 294.1 → 325.0 ns (+10.51%) and
`ClassifyResourceSensitivity` 67.68 → 77.20 ns (+14.07%), each p=0.000
with ten samples. Their implementation and benchmark source are
unchanged across the batch; that does not prove noise, intentional cost
or lack of regression. Delivery owns a bounded evidence-based
disposition through the existing lane handoff. No favourable repeat,
threshold change or performance/release approval is claimed.
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned `release/v6.5` line;
- main lacked the published 6.4.4 to 6.4.6 release packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named highlights,
issue numbers, one release's mobile decision) and per-release sentences
in the deployment-installability contract, which changes several times a
day on main.
This maps 6.5 to main, carries the published packets over from
`release/v6.4`, and keeps the packet tests to what the release tooling
generates: version pins, packet pointers, required sections, and the
rollback, signing and mobile sentences.
Checked by preparing 6.5.0-rc.1 and then 6.5.0 on top of this branch
with the release metadata tool: static checks and `go test
./scripts/installtests` pass for both.
Retain both exact completion histories and combine their self-contained safety obligations with the parsed-YAML and connected docsLinks controls. Use the reviewed corrected f8c5e988 completion pair; guards and frontend source remain unchanged.
Change-source: pulse-maintainer
The first publication correction retained the two original defects as history but its heading matcher treated the reviewed shell comment as a boundary. Parse headings only outside fenced blocks, and pin comment, duplicate-heading and missing-heading controls. All 17 passive diagnostics and safety-boundary fixtures now pass; no production or guidance bytes changed.
Change-source: pulse-maintainer
The completed PR smoke job demonstrates two obsolete whole-guide assertions after the reviewed manual backup precaution added six server-control examples. Select the unique passive preflight section for helper execution, constrain planned pause examples exactly, and reject active probes or service operations outside that section. Production code and safe guidance remain unchanged.
Change-source: pulse-maintainer
Releases are cut from the head of main since 2 October, but three things
still made every release need hand edits before it could pass:
- the control plane routed 6.5.x to the abandoned release/v6.5 line;
- main lacked the published 6.4.4 to 6.4.6 packets, so rollback
derivation on main still found 6.4.1;
- the packet tests pinned prose from old 6.4.x notes (named
highlights, issue numbers, one release's mobile decision) and the
per-release sentences in the deployment-installability contract,
which changes several times a day on main.
Map 6.5 to main, carry the published packets over from release/v6.4,
and keep the packet tests to what the release tooling generates: version
pins, packet pointers, required sections and the rollback, signing and
mobile sentences.
Contract-Neutral: Release routing and release-packet test scope only; no runtime, install or public contract changes.
Use the exact additive completion that satisfies the unchanged canonical checker. Retain the earlier failed completion and every reviewed commit as history.
Change-source: pulse-maintainer
Correct the completion section placement rejected by the canonical checker and apply the established test formatter. Keep the safety assertions and production source unchanged.
Change-source: pulse-maintainer
Register the exact historical completion pair for governance CI; preserve the intermediate repair and all later accepted source unchanged. Completion checks still require ancestry, substantive contract text and registry-accepted proof.
Change-source: pulse-maintainer
Record the self-contained feedback precautions and a connected docs-link regression so the accepted intermediate form repair has an additive canonical completion. Preserve all final form text, reviewed identities and release gates.
Change-source: pulse-maintainer
Keep the inherited report-form commit untouched and bind its additive completion to the tree with the actual optional attachment field IDs. The existing real guard still requires the contract and executable verification together; no release or runtime acceptance is asserted.
Change-source: pulse-maintainer
The first exact-source suite reached an erroneous common evidence-field assumption: the bug form uses logs while the prerelease form uses evidence. Verify both real identities and their shared label without changing either form, requiring new diagnostics or weakening the optional-evidence assertion. Retain the original failed proof.
Change-source: pulse-maintainer
Use the existing exact-commit completion registry and exercise its real guard, ancestry and substantive verification requirements. Preserve the original documentation-link commit and the final self-contained forms; no history is rewritten and no completion or release check is weakened.
Change-source: pulse-maintainer
Record self-contained collection and privacy safeguards for installed releases and parse both forms to protect their actual inline advice. This additively supplies the missing deployment-installability contract and accepted verification for the retained documentation-link correction without rewriting reviewed history or changing any runtime safeguard.
Change-source: pulse-maintainer
Preserve exact 7c9922f55d history. Resolve the two form-link overlaps to its reviewed self-contained text, retaining every safety/privacy warning and all fields. Source-stznewur proves the intake and documentation contracts; catalogue proof is discovery, not runtime acceptance.
Change-source: pulse-maintainer
Correct the report-form branch-tip documentation links rejected by PR2463 script smoke tests. Pin both links to the retained reviewed troubleshooting guide and keep its safe-collection fragment and all reporting guidance unchanged.
Change-source: pulse-maintainer
An online source status without a valid original receipt time cannot assert current memory freshness. Preserve its numeric availability and existing selection while omitting unknown/future time; cover both cases at the linked view. Remove the stray adapter-test comment copied during test relocation.
Contract-Neutral: Completes the optional memory-observation semantics and wire shape documented with 43ccc6c39a; no new contract or selection delta.
Change-source: pulse-maintainer
Expose current, last-known and unavailable memory through raw guest and selected unified metrics without renewing QGA evidence during repeated backup deferrals. Preserve independent PVE/linked-agent source times, numeric selection, History and alert policy. Annotate selected metrics as well as raw facets so cross-source fallback cannot inherit another source freshness. Add connected observation, source ownership, clone and wire controls and update the shared subsystem contracts.
Change-source: pulse-maintainer
The first control panicked at an uninitialised synthetic Monitor map before reaching the provenance assertions. Supply the same map as production and retain that failed attempt without claiming a product regression.
Change-source: pulse-maintainer
Remove the redundant main-branch troubleshooting links from both report forms while retaining live-collection precautions and local attachment privacy review. Regression controls reject branch-tip guidance without weakening the repository drift guard.
Contract-Neutral: Report form guidance and its safety regressions only; diagnostic runtime, public API, and installation contracts are unchanged.
Change-source: pulse-maintainer
Exercise normal cache reads, repeated backup deferrals, expired evidence, source-independent PVE memory and resumption through the shared guest builder and real unified broadcast conversion. These are synthetic monitoring controls, not native thaw acceptance.
Change-source: pulse-maintainer
Preserve exact Web candidate f9f53befbb with retained connected source and browser proof. Current backend lock evidence remains intact; no native recovery or delivery claim.
Change-source: pulse-maintainer
The runtime preserves canonical backup inventory scope in recovery_rollups.go; update the existing ownership guard to follow that call and require both PVE/PBS callers rather than the former duplicated literal.
Change-source: pulse-maintainer
For #2465, select latest provider evidence with the existing scope index
rather than ranking every retained payload. Preserve history and evidence
validation. Share complete, failure-preserving backup alert evaluation
across PVE/PBS/mock polls and expose unavailable reads through the existing
deduplicated system warning; keep existing age alerts until a complete read.
Contract-Neutral: Application query and existing system-alert behaviour only; no API, schema, resource identity, agent lifecycle, entitlement or notification contract shape changes. The new warning uses the existing open system-alert type, identity and metadata contract. Semantic contracts and connected verification are included.
Change-source: pulse-maintainer
Correct the two TypeScript narrowing errors observed after 1,901 connected tests passed. Recheck the corrected runtime bytes in Chromium and WebKit, with isolated fixture WebSocket traffic, and retain the original failed full proof.
Contract-Neutral: Complete VM-only type narrowing and typed regressions; no rendering, API or public contract delta.
Change-source: pulse-maintainer
The complete browser failure reached Settings but correctly excluded Diagnostics because its offline session omitted diagnosticsRead. Supply that fixture capability without changing production access checks or authentication.
Contract-Neutral: Offline browser fixture only; no production authorization change.
Change-source: pulse-maintainer
Capture final rendered state on every desktop and phone case, plus disabled exports during refresh. Bound the offline driver to leave time for owned teardown and retain its runner identity without retries or broader production claims.
Contract-Neutral: Integration proof capture only; production behavior and API contracts unchanged.
Change-source: pulse-maintainer
Compose the explicitly retained three-commit test candidate additively with current guest safety work. Production safeguards and unrelated integration type failures remain unchanged; final browser and exact-source acceptance follow.
Contract-Neutral: Test-only candidate restoration; no runtime or subsystem contract delta.
Change-source: pulse-maintainer
Distinguish observed agent metadata, assigned parent-node actions and current Proxmox guest-read state. Keep a visible backup/uncertain-completion precaution across drawer tabs, with existing guidance and independent thaw/covered-write limits. Do not start a diagnostic, infer memory provenance or claim native recovery.
Record state/replacement regressions, connected production-component browser proof and matching frontend/performance contracts.
Change-source: pulse-maintainer
Preserve exact Core candidate b77e6908e6. Retained source-41amnzmb covers all readers, connected continuity, full affected suites, races and embedded builds; canonical changes since its parent are frontend-only and non-overlapping. This integration is source safety, not native thaw or delivered release evidence.
Change-source: pulse-maintainer
Exercise explicit guest-agent states alongside old version metadata, parent action ownership and same-guest replacement. Require visible backup precautions across drawer tabs without running a guest check.
Contract-Neutral: Regression tests only; no runtime or public contract change.
Change-source: pulse-maintainer
Guest lock verification used ordinary redirect-following config reads and last-key-wins JSON decoding. Refuse redirected or ambiguous lock evidence before dispatch and after a complete guest response, without changing ordinary config redirects, pooled TLS policy or session recovery. Cover all six readers and connected cache/History continuity and fresh resumption; this source hardening does not establish native backup thaw.
Change-source: pulse-maintainer
Replace order-dependent substring and display-name attribution with exact PVE connection/native-node ownership and unique PBS namespace matching. Preserve ambiguous artifacts in distinct source-scoped, IDREF-safe rows and explain unmatched evidence without claiming that the guest was deleted. Keep migrated backups, independent server posture and unique-VMID PBS compatibility. Include connected controls, dependent contracts and inspected desktop/phone browser proof.
Change-source: pulse-maintainer
The full-export response includes populated identity arrays, so its route fixture must not inherit the empty response's never-array inference. Keep both payload shapes type-checked without suppressing compiler diagnostics.
Contract-Neutral: Integration fixture typing only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
The locked TypeScript compiler rejects the removed node10 resolution mode before checking any integration tests. Use bundler resolution for the extensionless imports transpiled by Playwright, without changing test runtime or product behaviour.
Contract-Neutral: Test tooling only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
Retain exact Core candidate 3fd44b8325 alongside published guest-memory repairs. Reviewed source-ifgmfzhw and exact built desktop/phone render proof cover the unchanged documentation and test content; no native thaw or installed recovery claim.
Change-source: pulse-maintainer
Replace obsolete exact selectors with the existing accessible privacy controls. Exercise full and review-first file contents, identity redaction and joins, displayed-result-only downloads, keyboard and viewport access, and failed-refresh retention in the real integration spec. Add an offline full-app driver with explicit synthetic bootstrap boundaries.
Contract-Neutral: Integration verification only; no runtime, API, permissions or product contract change.
Change-source: pulse-maintainer
Explain the manual systemd precaution inside the Pulse server LXC, including update timer and in-flight installer checks, stopped-state readback, independent covered-filesystem write checks before restart, and restoration of prior service states. Keep native thaw, recovery and release availability explicitly unproved.
Contract-Neutral: Document existing service controls and safety limits; no runtime, route, API, persistence, permissions or release-gate changes.
Change-source: pulse-maintainer
Repeated backup locks could drop a VM’s memory reading after the first
deferred poll. Preserve the complete last-known value while the original
successful guest-agent cache still supports its identity, values and
age. Retained values stay labelled previous-snapshot and do not renew
the cache timestamp or memory History; fresh polling replaces them after
unlock.
Validation:
- Eight consecutive locked polls after ordinary cache expiry through the
unified resource read-view path, followed by fresh recovery.
- Original-evidence guards for age, source, identity, capacity and
measured zero usage.
- Full monitoring and Proxmox package tests, focused race tests, and
repository commit hooks passed.
This fixes memory retention during backup deferrals. The original native
HAOS freeze race still requires separate qualification.
Preserve the exact Web candidate and final-content browser receipts. Retain both Diagnostics and PBS contract sections in the documentation-only conflict resolution.
Change-source: pulse-maintainer
Retain the complete last-known memory value from the scoped guest snapshot only while the original successful QGA cache supports its values and age. Keep deferrals labelled previous-snapshot without renewing cache timestamps or memory History.
Exercise repeated locks after ordinary cache expiry through unified resource views, with provenance, identity, capacity and expiration controls plus fresh unlocked resumption. Native freeze-race qualification remains separate.
pulse-triage[bot]