Recovery feedback must remain available without stealing keyboard focus. Cover existing error/warning and success/info live-region distinctions, atomic contextual text and retained focus through the public toast entry point. This protects accessibility behaviour without adding product scope; DOM assertions do not establish screen-reader acceptance.
Change-source: pulse-maintainer
Existing outage coverage exercises attempted deliveries only. Protect held-only histories from appearing readable during an outage, and verify recovery uses the current held state rather than stale rows or a misleading empty result.
Change-source: pulse-maintainer
Replace the superseded local ACL alternative with the exact three files reviewed and merged in PR #1948 (03848a932f). Preserve locked CLI execution, private workspace permissions and failure gates. Rootless daemon identity selects container 0:0; rootful uses the host UID/GID. Probe runtime before expensive qualification. This is main-line reconciliation, not a release-line backport or release qualification.
Change-source: pulse-maintainer
The exact rehearsal passed its test suites and image build but its browser
could not enter the private bind mount. A host UID is remapped to an unrelated
subordinate identity inside rootless Docker. Use the daemon owner's container
identity for rootless Docker and the host UID/GID for rootful Docker.
Execute the locked Playwright CLI directly and probe it during integration
preparation, before expensive suites, so missing dependencies or inaccessible
mounts fail early without fetching an unqualified CLI version.
Rootless Docker maps the unchanged browser UID to a subordinate host UID, so the host-owned 0770 integration tree is inaccessible. Grant that mapped identity POSIX ACL access only within the disposable integration mount, without following symlinks or granting world access. Inherit host access for generated evidence and fail closed on mapping or ACL errors. Preserve container UID/GID, image selection, direct installed CLI, browser gates and failure propagation. Focused fixtures cover identity mapping, subordinate mapping and preparation failures; exact release qualification remains separate.
Change-source: pulse-maintainer
The current notification diagnostic demand records confusion between failed delivery and intentional silence. Pin precedence of current holds over historic dispatch, known event reason labels and unknown-reason fallback so future UI changes do not erase that distinction. This adds regression coverage only; it does not establish recipient delivery.
Change-source: pulse-maintainer
Exact admission attempted to fetch playwright@1.63.0 when the mounted runner was unavailable. Invoke the npm-ci-installed CLI directly so missing or inaccessible dependencies fail closed without substituting a registry package. Preserve the existing container identity and gates; this does not claim to resolve the observed EACCES. Exercise shell arguments and failure propagation with a mocked Docker command.
Change-source: pulse-maintainer
Operator feedback distinguishes successful job completion from protection of every guest. Lock down the existing model boundary with mixed protected, unprotected, failed and unevaluated guests so aggregate success cannot silently erase missing coverage. Task success must not substitute for canonical posture evidence.
Change-source: pulse-maintainer
Copy the reviewed troubleshooting guidance into the shipped frontend mirror so public docs and repository docs remain identical.\n\nChange-source: pulse-maintainer
Change-source: pulse-maintainer
Apply the repository formatter to the accepted stale-delivery evidence regression test. This changes layout only and preserves the reviewed assertions.
Change-source: pulse-maintainer
The exact release tree retains a failed paired UUID benchmark check, while push CI cannot repeat that comparison. Provide a reviewed-source route to collect the requested four-condition hosted layout evidence instead of repeating local samples or changing product order.
Fix source/tree/toolchain identities, isolate diagnostic controls, alternate ten rounds, and retain partial receipts without publishing binaries. Execution still needs separate operator authority; collection success does not dispose of the failed gate. Nine focused harness tests and existing benchmark contract tests pass.
Change-source: pulse-maintainer
Apply the repository formatter to the two reviewed test files that failed the existing proposal check. This changes layout only and preserves the accepted test behavior.
Change-source: pulse-maintainer
Protect notification diagnosis when a refreshed log replaces successful attempts with retries, failures or cancellations. Assert both the new outcome and removal of the old success and alert identity, so stale positive evidence cannot survive a row refresh. All 31 focused delivery-log hook, card and overview tests passed.
Change-source: pulse-maintainer
A provider 403 response mentioning an authentication timeout was treated as a transient network failure and sent again with unchanged credentials. Classify explicit HTTP status before diagnostic text, retaining existing transient status and network fallback behaviour. Add a status/body matrix and a queue-free loopback regression that verifies one request and terminal delivery history.
Change-source: pulse-maintainer
The integrated install handoff must remain demo-only and respect tab-session dismissal. Assert link absence as well as notice absence, and exercise remount and session reset so future banner refactors cannot silently undo those boundaries. Validated with 21 focused DemoBanner and Login tests.
Change-source: pulse-maintainer
Preserve the incoming delivery-health ordering and demo install-link
changes alongside the qualified Patrol action history. Retain prior
source bindings and record the merged build and browser checks so the
shared proof receipt reflects the integrated tree.
Refresh durable investigation lifecycle from authoritative actions while
preserving completed evidence. Keep resolved history reviewable and label
recorded plan facts separately from action outcomes. Follow all resource
pages during qualification and record live approval, rejection and storage
semantic-review results. Integrate current main and preserve its alert
ordering correction.
Community outage reports expose the difference between local delivery health and a monitor surviving site failure. The existing External watchdog has no troubleshooting entry explaining that boundary. Document its current setup, period-plus-grace timing, secret handling and authorised receipt/recovery checks without adding runtime scope or claiming end-to-end qualification.
Change-source: pulse-maintainer
Integrate the web-product regression test over the newer canonical warning-transition coverage while preserving the exact reviewed candidate commit.
Change-source: pulse-maintainer
Previously loaded delivery rows must not look current when a later read fails. Cover the rendered outage and recovery lifecycle, including removal of stale failures and transition to a genuinely empty log, rather than only initial unavailability.
Change-source: pulse-maintainer
Protect suppression after snoozing an active incident and dispatch of recurrence after reactivation. A bypassed activation guard fails the regression; restored lifecycle selection passes 30 race-enabled repetitions.
Contract-Neutral: Regression coverage only; no runtime or public surface changes.
Change-source: pulse-maintainer
Exercise a rejected previous-incident request after a same-resource recurrence has loaded its suppression explanation. Protect the current card from failure handling that clears newer delivery state.
Change-source: pulse-maintainer
Cover pending and snoozed activation through the monitor projection: failures remain visible and current without dispatch, recoveries clear, and recurrences remain suppressed. Bypassing the activation guard fails both cases; restored focused lifecycle tests pass 30 race-enabled repetitions.
Contract-Neutral: Test-only protection for existing delivery-warning activation policy; no runtime or public surface changes.
Change-source: pulse-maintainer
pulserelay.pro sends curious visitors to the public demo, and the demo
was a dead end: once inside, the only way back to installing Pulse was
the browser's history. The demo-mode banner now ends with "Run Pulse on
your own hardware", opening the site's setup steps in a new tab. It is
install guidance rather than an upsell, so it belongs in demo mode where
commercial surfaces are otherwise hidden.
The read-only notice keeps its own element so the existing text lookup
and dismiss behaviour are unchanged. Verified on a DEMO_MODE=true mock
backend behind Vite at 1280x800 and 390x844: the link renders after the
notice, wraps cleanly on a phone, and carries target _blank with rel
noopener noreferrer.
Contract-Neutral: demo banner copy and link only; no public API, config, or contract surface changes
Exercise classified health snapshots through the real alert manager: unchanged and count-only changes stay quiet, new failure classes dispatch, recovery clears, and the same cause starts a new incident. Assert synchronous dispatch timestamps rather than timing asynchronous callbacks. The fingerprint-removal control fails on count drift; restored lifecycle and ordering tests pass 100 race-enabled repetitions.
Change-source: pulse-maintainer
Contract-Neutral: Test-only coverage of existing delivery-warning projection and alert lifecycle semantics; no runtime, public API or product surface changes.
A late diagnosis for a previous incident must not erase the current incident's suppression explanation when both concern the same resource. Pin this rendered boundary: the test passes with request ordering and fails when its version guard is removed. Both focused alert files pass all 16 tests after restoring production code.
Change-source: pulse-maintainer
Live funded qualification found hidden tool results and misleading action
submission outcomes. Share the result-bearing transcript across stored chat
and product history, render the retained evidence, and distinguish captured
proposals from broker acceptance. Keep review usable while Patrol is paused.
Record Gemini route pricing and exact qualification limits. Integrate current
main and repeat browser proof for the incoming login flow. Approved/rejected
recovery remains unqualified without the development command agent.
Concurrent timer and queue callbacks could apply an older health snapshot after a newer one, hiding a new delivery failure or resurrecting a dismissed warning. Serialize the complete read/apply operation without holding the monitor or queue mutex across alert updates.
Add isolated channel-controlled stale-clear and stale-raise regression cases. Removing the lock fails both final-state assertions; restored code passes 100 race-enabled focused repetitions. This does not qualify the integrated release candidate or clear unrelated adverse evidence.
Change-source: pulse-maintainer
Contract-Neutral: Restores monitoring contract extension point 21 immediate canonical delivery-warning reconciliation by serializing existing read/apply operations; no public API, verdict, throttle, alert identity, or agent-lifecycle contract changes. Existing isolated ordering regression tests cover both stale-clear and stale-raise outcomes.
pulse-triage[bot]