Keep the shared direct-curl recorder compatible with the other existing guides while binding API requests to its reviewed private helper. Update the temperature selector to the reviewed fail-closed temporary download and retain disable-first TLS and mode checks. The first broad proof caught both adapter faults before publication.
Contract-Neutral: Test-only adapters for existing reviewed guide contracts; no runtime, guide, dependency or frontend change.
Change-source: pulse-maintainer
Repair deterministic governance and script-smoke failures against the reviewed guides without restoring public response output, literal credential commands or clobbering downloads. Exercise the actual shared API helper and independently verify private, unique response files, methods, bodies and hostile curl defaults.
Contract-Neutral: Update test adapters for the existing reviewed credential-private guide contract; no runtime or guide change.
Change-source: pulse-maintainer
Light-mode text on tinted callouts, banners and selection cards drew at
25% alpha: CalloutCard titles and bodies in every tone (the Security
overview's "Recommended hardening steps"), the Alerts thresholds help,
the update-channel card titles, Patrol and Action banners. The Tailwind
v3 config redefined each colour's 900 and 950 shades as 25% alpha so
dark-mode backgrounds could tint, which also faded every light-mode
text-*-900. The Tailwind 4 migration kept that parity by rewriting the
usages to -900/25.
Every light-mode text-*-900/25 and text-*-950/25, hover included, now
uses the solid shade. Dark variants, backgrounds, borders and rings keep
their tint, so dark mode is unchanged.
Contract-Neutral: restores light-mode text colour tokens only; no
behaviour, data, route or contract change
Accept exact Core commits with connected suites, races, copying and freshness controls. Retain the cold List-only cost regression and native CPU/RSS limitations; this is not whole-estate relief.
Change-source: pulse-maintainer
vCenter alarms only appeared on the vSphere page's fourth tab, Health.
The Overview fetched hosts and VMs alone, so a host tinted yellow there
had no visible reason and datastore or network alarms were not on the
page at all.
While the Overview is open it now also reads the Health tab's resources,
and when vCenter reports any signals the existing health table leads the
page above the hosts, without its filter toolbar. Nothing is added when
vCenter is quiet, and filtering stays on the Health tab. This is the
pattern the TrueNAS Overview already uses for its health alerts.
Verified in a browser on a mock vCenter at 1440 and 390 (receipt
included); full frontend suite passes apart from the known Mac-only
agentInstallCommand cases.
Assert refreshed status and CPU on the same canonical VM instead of requiring a Proxmox rename that the existing source-priority merge intentionally rejects. Use the mock runtime's supported maximum cadence. The initial fixture and assertion failures remain retained; no production behaviour is changed.
Refs: #2199
Contract-Neutral: Correct independent test assumptions only; no runtime or resource contract delta.
Change-source: pulse-maintainer
Every lane appends to the end of this contract, so a note there conflicts with each merge to main. Taking main's file with the note placed beside the platform-page sections lets main merge cleanly now and later.
Compose the exact current upstream head additively, preserving reviewed local ancestry and independently landed alert and backup presentation.
Change-source: pulse-maintainer
Light-mode text on tinted callouts, banners and selection cards drew at
25% alpha: CalloutCard titles and bodies in every tone (the Security
overview's "Recommended hardening steps"), the Alerts thresholds help,
the update-channel card titles, Patrol and Action banners. The Tailwind
v3 config redefined each colour's 900 and 950 shades as 25% alpha so
dark-mode backgrounds could tint, which also faded every light-mode
text-*-900. The Tailwind 4 migration kept that parity by rewriting the
usages to -900/25.
Every light-mode text-*-900/25 and text-*-950/25, hover included, now
uses the solid shade. Dark variants, backgrounds, borders and rings keep
their tint, so dark mode is unchanged.
Contract-Neutral: restores light-mode text colour tokens only; no behaviour, data, route or contract change
Keep the assigned-base typed-view rebuild as an independent benchmark reference. Measure warm reads, dirty List-only reads and dirty List plus typed views rather than claiming that moving derivation removes cold cost. Pin stale and between-record freshness, canonical policy detachment and arbitrary clone refresh.
Refs: #2199
Contract-Neutral: Extend independent validation of unchanged resource schemas and existing freshness/ownership guarantees; runtime source is unchanged.
Change-source: pulse-maintainer
Replace automatic hardware detection with existing-driver reads, keep SSH forced-key trust intact, and prevent incomplete legacy cleanup downloads from replacing a saved helper. Validate the copied commands against synthetic tools and HTTPS peers.
Contract-Neutral: Existing help and copied-command safety only; sensor collection, authentication, installer interfaces and runtime schemas are unchanged.
Change-source: pulse-maintainer
Keep full inventory and arbitrary clone refresh. Detach materialized identity and policy under the existing registry lock, invalidate between batch records and on stale-source transitions, and keep List-only reads independent of typed view construction. Compare every field and wire payload with an independent fresh-clone oracle across all demo providers.
Refs: #2199
Change-source: pulse-maintainer
Contract-Neutral: Registry-internal copying and invalidation repair existing freshness and ownership guarantees; canonical resource fields, wire schemas, identity rules, policy derivation, telemetry and alert evaluation are unchanged.
The Thresholds page opened on a ten-select CPU evaluation grid, and
every resource group started collapsed showing only a name and a count,
so the limits that decide what alerts were invisible until a group was
opened one at a time.
Each collapsed group header now states its defaults ("CPU 80% · Memory
85% · Disk 90%"), built by one helper from the same columns and defaults
the group's table edits. It drops metrics the engine treats as off and
hides the line while the group is disabled. Rules whose zero means a
fallback are stated as whole rules with their effective values: Docker's
restart loop and memory-limit, and backup age by its alerting days
rather than the dashboard-only fresh/stale hours.
CPU averaging becomes one collapsed line stating the effective window
and how many profile overrides exist, with the same selects inside.
Docker and Machines list their groups before Docker-only rules and the
SMART card.
Retain the pre-change fresh-clone oracle for every derived field, incremental ingestion and detached reads. Expose repeated canonical derivation in a 1000-resource bulk read before altering production code.
Refs: #2199
Contract-Neutral: Add independent regression controls and paired measurements; runtime and public contracts are unchanged.
Change-source: pulse-maintainer
Main appended frontend-primitives notes at the same place this branch did. Taking main's file here lets main merge cleanly. The vSphere note is restored right after the merge.
Bound the existing passive preflight before Bash can discard NULs or accept unlimited configuration output. Preserve producer errors independently, isolate the byte reader from Python startup hooks, and keep the copied helper and mirrored help private and off the guest-agent channel.
Contract-Neutral: Operator diagnostics and existing help only; Proxmox polling, guest-agent coordination, APIs, storage and service behaviour are unchanged.
Change-source: pulse-maintainer
Integrate exact candidate aece6b5217. Retained installer/vet and scoped Docs receipts cover the unchanged documentation recipes and tests; no runtime or product-surface change.
Change-source: pulse-maintainer
"17 attention / 10 unprotected" were counts without a rule, and users
have asked what Pulse treats as stale. The Backup health strip now
carries one line built from the server's posture policy window that
names the causes internal/recovery/posture.go evaluates for attention,
unprotected and unknown. Nothing renders until the policy loads, so the
page never shows a guessed window.
The coverage table showed up to four time columns (last backup, PBS
snapshot, PVE file, guest snapshot). A fresh green guest snapshot beside
an amber stale backup read as protection that posture does not grant.
Rows now carry the one counted backup age. The row expansion keeps the
newest point and the newest completed point of every source in its
bounded evidence list, so neither a run of snapshots nor a running or
failed job can hide the latest usable backup.
The Thresholds page opened on a ten-select CPU evaluation grid, and
every resource group started collapsed showing only a name and a count,
so the limits that decide what alerts were invisible until a group was
opened one at a time.
Each collapsed group header now states its defaults ("CPU 80% · Memory
85% · Disk 90%"), built by one helper from the same columns and defaults
the group's table edits. It drops metrics the engine treats as off and
hides the line while the group is disabled. Rules whose zero means a
fallback are stated as whole rules with their effective values: Docker's
restart loop and memory-limit, and backup age by its alerting days
rather than the dashboard-only fresh/stale hours.
CPU averaging becomes one collapsed line stating the effective window
and how many profile overrides exist, with the same selects inside.
Docker and Machines list their groups before Docker-only rules and the
SMART card.
Preserve exact Core candidate history and complete published monitoring inventory while removing unrelated temporary metadata copies.
Change-source: pulse-maintainer
"17 attention / 10 unprotected" were counts without a rule, and users
have asked what Pulse treats as stale. The Backup health strip now
carries one line built from the server's posture policy window that
names the causes internal/recovery/posture.go evaluates for attention,
unprotected and unknown. Nothing renders until the policy loads, so the
page never shows a guessed window.
The coverage table showed up to four time columns (last backup, PBS
snapshot, PVE file, guest snapshot). A fresh green guest snapshot beside
an amber stale backup read as protection that posture does not grant.
Rows now carry the one counted backup age. The row expansion keeps the
newest point and the newest completed point of every source in its
bounded evidence list, so neither a run of snapshots nor a running or
failed job can hide the latest usable backup.
Compose the exact upstream merge of PR2472 additively after bounded refresh ceaba22d265cc28a2998eb211569e0b3549f1e6955d927d47f4804d29188cd95. Preserve all reviewed newer PBS and fractional-CPU work for the next publication batch.
Change-source: pulse-maintainer
## What changes and why
Keep guest monitoring truthful while reads are deferred: retained
memory/filesystem values must not become new alert decisions, new
History observations, current filesystem health, or continuous chart
lines across missing readings. Failed or empty metadata refreshes retain
the last useful observation time rather than manufacturing freshness.
Independent current readings and measured-zero recovery keep their
existing behaviour.
Manual guest Discovery pauses during the existing backup/read
precaution, preserves saved evidence, and keeps delayed outcomes
attached to their original guest and run. The published drawer-header
link to a saved web interface remains available separately from live
Discovery. The existing TrueNAS guide and shipped copy keep credentials
and responses private and bound individual requests.
The guest work follows the prolonged freeze reported in #2439 and
reproduced downstream observation/lifecycle gaps. It does not identify
the freeze's cause or prove native recovery. The guidance repair follows
inspection of unsafe existing recipes. No new collector, schema,
retention policy, threshold or product surface is introduced by this
batch.
## Included source and reconciliation
Current published base `efe6fc21ae10a6bf173cc17e6203aaf6c97dc130` →
proposed head `1914f5fb7b278b5fc4cc10a292e909a10714a2f8` (39 introduced
commits, including additive integrations).
- TrueNAS guidance: `cadfd1f4e1d9f909a45977f94aadd4f1324e82ef` →
`d589407a743a12fe492e93785d9e24c12bbb4fb5`.
- Discovery pause/outcome ownership:
`2cb3f6a9043e0bab9c54c5b5ef57b3e1cb994781` →
`bbaee0a3f43dc7906011be5c78d684f9a1327bae`, including additive recovery
and lifecycle controls.
- Alert admission: `b0f8b96c8a159ac242b85f2d09f8dfffd5c29c7a` →
`0fd7768e9d1379f8aa0126b33d4047b4c52c0d87`.
- History writer admission: `a15920eaebea00ab8c353ddd3861b9cd7ff7d379`.
- Filesystem presentation: `2525d76c04a9834c2130e97c1a529e164a9c7796` →
`5b75f21159fda3c01fbe6688aa9cfde68779fba8`.
- Metadata freshness: `f1e221a0fb9b0804f200c13490f8526424cb7e1c`.
- Missing-observation chart presentation:
`0ad41e4c9a309ce459dd717d16d343b46efcac8a` →
`5e7e49650fcdf5131b7c5006fe487336ab660e15`.
- Platform-aware Discovery fixture:
`a2608c9fadf76c242527a636ee08968fa16ddde8`; TrueNAS recipe
reconciliation `1f0d12af85ec7c2ad8df391b8e6958e80fa98179`; additive
upstream/header composition and content-bound browser receipts through
`b01dad904c3436e70bc01588ea1546fffaa05dc6`; batch-start upstream merge
`f1c7e413bac2e3306d2169bcd069c60325e56d5f`, then exact bounded
refreshed-upstream merges `07112b0e3ab2be174a5ac7a11f87ac0837edceb0` and
`1914f5fb7b278b5fc4cc10a292e909a10714a2f8`.
The previous proposal head `6a20d106242598bd6b466e9ae888ea931d284b30` is
completed-failed, not still validating. Native run `37239183481`
incorrectly required a Linux/PVE capability on Windows/macOS; Build and
Test `37239183545` extracted zero wrapped TrueNAS recipes. Reviewed
additive fixtures correct both without weakening runtime safety. The old
head cannot land independently, so this update includes those
corrections and the coherent observation batch. Every accepted commit
identity and all ancestry are retained. Published cluster labels, saved
guest links, unique demo workload names the newer storage priority/alert
explanations, and the published Alerts overview are preserved. Bounded
refresh receipt
`2916978f4e4b49d084752e973e19a5c0f7dd19f0bf4ac60cc31875876318528d`
completed at the exact observed upstream without changing source; the
subsequent full-SHA merge composes it additively. A second successful
bounded refresh
`59f1939979347921d99e262398d5347077bfce6faf6f42535050840a3a19820b`
incorporates the subsequently published Alerts overview in the same way.
Neither is a replay of a failed or uncertain attempt.
## Validation and remaining gates
Retained evidence includes connected alert/API/producer/recovery
controls (`source-p58_phvc`), Discovery/component/build/browser checks
(`source-gy5x8buj`), installer/docs controls (`source-7s0iorys`,
`source-uo6rxs61`), metadata connected/race/vet/build proof
(`source-ji23nb_c`), and ten connected suites plus focused safety
races/vet and native-target compilation (`source-seboen4h`). Browser
content receipts cover the final seven changed frontend runtime files,
including the composed saved-link/safety header and chart gaps.
The History presentation proof `source-ualisb1k` completed 22,571
frontend tests across 1,234 files, types/lint/format/build and
bundle/integrity checks; its overall exit 1 from trailing nonexistent
optional test paths remains recorded, not converted into a whole-command
pass. Four browser groups/32 checks and eight inspected captures
separately passed. Earlier reproductions, fixture failures and
reporting-limit failures remain evidence.
Publication-gate checks:
- `source-qt6m6mf_`: seven connected TrueNAS recipe controls, full mock
suite, scoped real agent/guest safety, alert observation and
metadata/History tests pass. Backend/docs source is byte-identical in
the final composition; this evidence was not repeated after
frontend-only upstream advances.
- `source-xy1lnmgt`: types pass and 281 of 283 scoped frontend controls
pass; two first-case History tests hit the unchanged 5,000ms timeout.
Exit 1 is retained and the following build did not run. No functional
assertion failure or cause was established.
- One predeclared single-worker/file-serial comparison,
`source-17bch24o`, passes all 23 controls in those two files with
unchanged source, assertions and timeouts. This establishes isolated
functional behaviour, not a diagnosis or clearance of parallel CI.
- `source-dvlfnm5t`: refreshed storage composition passes types, 1,177
tests/56 files and the real production/embed build. The event-parser
line-bound flag is recorded; the complete 26,474 raw bytes independently
match the receipt.
- Final exact-head `source-sjjtzjqm`: types, scoped published Alerts
overview/translation/presentation controls and the real production/embed
build pass. Complete raw output is independently hash-matched and the
guest stopped.
- All executed receipts, including the failed scoped run, retain
complete output and completed guest stop. Provenance, clean source,
diff/ancestry checks, all 24 introduced non-merge commits' parent-bound
canonical guards using only their original recorded trailers, and the
final seven-file browser-content receipt guard pass.
Required exact-head administrative source review and GitHub checks must
complete before landing; this update is not a blind failed-job retry or
a CI waiver. Native overlap, independent thaw, fresh writes on every
covered filesystem, workload liveness, truthful alert delivery and safe
restoration of only prior-active services/timers remain separate. UI
clearance, saved values, an OK backup or these source tests are not
recovery, a containing release or installed/reporter acceptance.
Related to #2439
[How Pulse handles
triage](https://github.com/rcourtman/Pulse/blob/main/docs/AI_TRANSPARENCY.md)
Add the published bulk web-link editor and alerting guest Attention count without changing the checking PR2472 head or any accepted commit. The newer local range remains for the next batch.
Change-source: pulse-maintainer
The guest status chips put a running guest with an open warning or
critical alert under Running, because the Attention bucket looked only
at resource status and failed availability probes. With seven running
guests over a memory threshold the chips still read "Attention 0". The
bucket now also takes running guests whose canonical health names an
open alert. Backup age stays out: it has its own column and tab.
Two smaller fixes on the same page. The nodes table repeated one cluster
name in a Cluster column on every row; with a single cluster the column
is dropped and the header names the cluster, also while searching. The
VM disk "Unavailable" label was amber for every reason, mostly a missing
guest agent or a stopped VM, and its explanation was screen-reader only;
it is now muted unless the read is genuinely broken, with the reason on
hover.
Verified in a browser on a mock estate (receipt included); full frontend
suite passes apart from the known Mac-only agentInstallCommand cases.
Save every existing reference response privately, including errors and partial POST results. Preserve private header files, reject unsafe preparation and URLs, and stop on redirects or transport errors without retries. Exercise all eight copied GET/POST examples against real synthetic HTTP/TLS peers, including the old response exposure.
Contract-Neutral: Harden existing API documentation recipes and their shipped mirror with connected tests; no runtime, endpoint, authentication, scope, action, dependency or permission contract changes.
Change-source: pulse-maintainer
Saved web-interface links make Pulse a quick way to reach the service a
guest runs, but each link had to be typed into one guest drawer at a
time. This adds one place to set many at once. It ships as a named bet
with no external ask behind it yet.
**What users get**
- An **Edit links** action in the workloads table header. It appears on
the Proxmox and vSphere guest tables, which share that surface.
- A panel listing every guest in the current filtered view (node
selection and filters carry over). Each row shows the guest's type, ID,
node, its saved link, and an IP-based placeholder.
- An **All / Without a link** filter, a count of guests that have a
link, and one Save for every change. Clearing a field removes that link.
- Invalid links block the save with the shared validator's message on
their row. A failed save stays on its row. Closing the panel keeps
unsaved drafts, and the trigger shows "(unsaved)".
- Read-only sessions do not see the action.
**How it fits**
- Saves go through the existing guest metadata API and metadata-changed
event, the same path as the drawer field, so the table updates at once.
- `getWorkloadGuestMetadataRecord` is now the single lookup for a row's
saved link, in both the table and the editor.
- Editor rows only follow live inventory while the panel is open, and
they keep unchanged row objects across ticks. A closed editor adds no
per-tick work, and an open one never remounts the input being typed in.
`WorkloadsSurface.performance.contract.test.tsx` pins this.
**Verification**
- Private mock stack at 1280, 1024 and 375px, covering node scope,
filters, invalid entry, add, correct, remove, and close and reopen.
Receipt: `frontend-modern/browser-verification/743cc04a20d534ac.json`.
- 13 new tests in `workloadWebLinksModel.test.ts` and
`WorkloadWebLinksDialog.test.tsx`.
- Full frontend lint, plus `src/features`, `src/hooks`, `src/__tests__`,
`src/components/shared`, `src/components/Workloads` and
`src/components/Storage`: 515 files and 8,675 tests pass.
Freeze the source expectation as serialized bytes before mutating returned records. A broken clone cannot change both the tested state and its reference, so module, update and applied-config alias regressions must be detected.
Change-source: pulse-maintainer
Accept exact Web candidate 902bba393f with retained connected/static/build and parent-bound browser proof. Keep raw metrics, sorting and alerts unchanged; source acceptance is not native or reporter resolution.
Change-source: pulse-maintainer
Preserve the batch-start published frontier alongside local reviewed integrations; leave any later reconciliation to the publication gate.
Change-source: pulse-maintainer
Every Proxmox, Docker, Kubernetes, TrueNAS, vSphere and Machines tab
opened with a three-line amber warning about hosts on an older Pulse
agent, listing names and a Show all button above the monitoring data.
An outdated agent is maintenance, not an incident, and the warning
competed with real problems for attention on every visit.
The notice is now one sentence in the info tone with the upgrade link
inline. The affected names sit behind a "Which hosts?" toggle, so every
name is still one click away and the inventory starts higher on the
page.
Verified in a browser at 1440 and 390 (receipt included); full frontend
suite passes apart from the known Mac-only agentInstallCommand cases.
vCenter alarms only appeared on the vSphere page's fourth tab, Health.
The Overview fetched hosts and VMs alone, so a host tinted yellow there
had no visible reason and datastore or network alarms were not on the
page at all.
While the Overview is open it now also reads the Health tab's resources,
and when vCenter reports any signals the existing health table leads the
page above the hosts, without its filter toolbar. Nothing is added when
vCenter is quiet, and filtering stays on the Health tab. This is the
pattern the TrueNAS Overview already uses for its health alerts.
The unchanged-parent allocation controls fail as intended. Its semantic oracle also compared separate wall-clock registry construction timestamps. Retain all source timestamps and canonical payloads while excluding only Resource.UpdatedAt from the full-reference comparison.
Change-source: pulse-maintainer
Compose the second successfully observed upstream advance additively, preserving reviewed ancestry and the existing alert observation contracts.
Change-source: pulse-maintainer
Avoid cloning and ingesting twenty known non-host Kubernetes metadata kinds in temporary per-report matching registries, while preserving all publication and canonical matching. Clone only the selected native record for exact host reads and detach mutable host update, module and config state. Pin reference equivalence, live report publication, ownership and allocation scaling with connected controls.
Change-source: pulse-maintainer
The guest status chips put a running guest with an open warning or
critical alert under Running, because the Attention bucket looked only
at resource status and failed availability probes. With seven running
guests over a memory threshold the chips still read "Attention 0". The
bucket now also takes running guests whose canonical health names an
open alert. Backup age stays out: it has its own column and tab.
Two smaller fixes on the same page. The nodes table repeated one cluster
name in a Cluster column on every row; with a single cluster the column
is dropped and the header names the cluster, also while searching. The
VM disk "Unavailable" label was amber for every reason, mostly a missing
guest agent or a stopped VM, and its explanation was screen-reader only;
it is now muted unless the read is genuinely broken, with the reason on
hover.
Contract-Neutral: Workload status bucket and disk label read existing health and disk-read fields; no performance-path change, so performance-and-scalability.md is unaffected.
The overview is where a notification lands, but each active alert was a
tall tinted card with five buttons, every card repeated "Notification
delivery not turned on", and a three-row stats table sat above the list,
so three alerts fit on a 1440x900 screen and about one on a phone.
When delivery is off the overview now says so once, with the shared
paused-delivery banner (overview wording, a link to set up destinations,
Turn on delivery), and rows drop the per-alert line for those global
holds. Alert-specific holds such as cooldown or quiet hours still show.
Rows are compact: severity on a left edge, a locale-aware start age on
the overview's minute clock, Acknowledge, Snooze and Investigate
visible,
and Timeline and monitoring policy behind a More disclosure. A summary
line counts open alerts by severity beside the heading; the override
count, which is configuration, leaves the overview.
The banner copy now comes from the en/de/es catalogs, and with alerts
switched off it no longer claims Pulse is still detecting them (the
destinations tab said the same). The banner title was near invisible
(text-amber-900/25) and is readable again.
Verified in a browser on a mock estate (19 active alerts, delivery not
activated) at 1440x900 and 390x844 dark, in English and German;
More/Timeline/Less exercised. Five alerts now fit above the fold at
1440x900, up from three. Ledger: rcourtman/pulse-pro
FEATURE_REQUESTS.md, Answer-first presentation across platform pages.
Supply the required displayName in the new connected row/drawer fixture after exact-source TypeScript validation caught the omission. This changes only test data; production content and its parent-bound browser receipt remain unchanged.
Change-source: pulse-maintainer
The editor pushed the WorkloadsSurface chunk to 71.44 kB gzip, past
its 70.23 kB budget. Main already sat at 68.80 kB, so loading every
row of a panel most sessions never open was the wrong cost to put on
the table.
The table-header trigger now keeps only the open flag and unsaved
drafts and lazy-loads the panel, whose state and row model live in a
separate 3.9 kB chunk. The table's saved-link lookup moves to its own
small module so the table does not pull the editor's model back in.
WorkloadsSurface builds at 69.13 kB. Drafts still survive closing the
panel, and typing a link back to its saved value no longer counts as an
unsaved change.
Incorporate the exact bounded refreshed upstream while preserving the complete reviewed batch and original source identities.
Change-source: pulse-maintainer
Compare complete canonical host views with a full-snapshot reference and pin current replacement. Measure unrelated Kubernetes metadata and peer-host allocation growth before repairing report lookups.
Change-source: pulse-maintainer
pulse-triage[bot]