One vCenter connection spans many ESXi hosts, so the Infrastructure source
row now lists them the way Proxmox cluster rows list their nodes: an
expandable member list with per-host state, aliases, and last-seen. Members
are API-side composition only — no primary marker, no agent connection, and
the member subtitle reads 'vSphere host' instead of cluster-node wording.
TrueNAS keeps no member composition because that connection monitors exactly
one machine.
Mock mode now feeds its vCenter and TrueNAS fixtures into the connections
aggregator (only when no real instances are configured), so the mock ledger
shows the same platform source rows a real deployment would instead of
omitting vSphere and TrueNAS entirely.
vSphere ESXi hosts and TrueNAS boxes rendered as standalone rows under
'Pulse Agent hosts' in Infrastructure settings even though no Pulse Agent
runs on them. The rows were unmanageable duplicates of their owning platform
connection: they carry no credentials, pause, or remove semantics, and they
can never attach to their vSphere/TrueNAS system because attachment requires
a shared host while the machine hostname differs from the vCenter address.
They also inflated connected-system counts.
buildConnections now skips hosts with a non-empty IntegrationSource, so the
ledger and grouped systems represent those machines solely through their
owning platform connection. Per-machine visibility is unchanged on the
vSphere/TrueNAS platform pages and Machines, which read the unified fabric
directly. Connection.integrationSource stays declared as defense-in-depth
for agent-only client workflows. No alert impact: agent-type rows were
already dropped from alert snapshots.
The connections ledger derives agent rows from the unified fabric, which
includes machines whose telemetry comes from platform integrations (vSphere
ESXi hosts, TrueNAS). Agent Doctor rendered every one as a permanent
'Unknown / no structured reason' row, while agents the ledger does not carry
(Docker-only, Kubernetes-only) were silently dropped from the fleet view.
- Expose HostView.IntegrationSource() (source-set based: only SourceAgent
ingest counts, since integration providers fabricate an Agent payload) and
plumb it through models.Host to the connections ledger as the optional
integrationSource field.
- Agent Doctor skips integration-backed connections and appends
diagnostics-only agents, honoring scope, so the doctor covers exactly the
real Pulse Agent fleet.
- Update readiness agent checks no longer count integration-backed machines
as registered agents.
- Humanize doctor copy: plain-language stale message with '10m 2s'-style
durations, offline wording without enum leakage, no 'Supported target:
Unknown' cell when no target is published, host-local command banner only
when a command is actually offered, and a compact non-zero summary strip.
Contracts updated for unified-resources, monitoring, api-contracts,
agent-lifecycle, and dependent storage-recovery; verification via
views_test.go, monitor_host_agents_test.go, state_host_test.go,
contract_test.go, and the frontend connections API test.
The metrics store capped its SQLite pool at one connection, so every UI
history read queued behind every buffered-write commit, and behind the
WAL checkpoints those commits pick up at the 4000-page threshold. On
write-heavy installs (many Docker agents with churning containers) that
serialization presented as sustained 120-260ms COMMIT warnings and an
unresponsive UI even with idle CPU and fast disks. Writes were never the
risk: flush, rollup, retention, and maintenance already funnel through
the single background worker goroutine, and the WriteBatchSync poller
path serializes on the WAL write lock via busy_timeout.
Raising the pool exposed a second bug: auto_vacuum(INCREMENTAL) in the
per-connection DSN pragmas replays as a database-header write whenever
the pool opens a new connection, which blocks connection creation behind
the active writer for up to the full 30s busy_timeout. auto_vacuum is a
persistent database property that migrateAutoVacuum already establishes
once at startup, so the per-connection copy is dropped.
Refs #1601
Contract-Neutral: behavioral fix: metrics store read concurrency and per-connection auto_vacuum pragma removal, no public contract delta (#1601)
PVE's disks/list endpoint labels healthy SCSI/SAS drives OK while ATA
drives say PASSED, and failing ATA drives come back as FAILED! with the
bang. Pulse ingested those raw strings, so a healthy SAS drive rendered
as health Unknown even though the Proxmox UI showed S.M.A.R.T. OK. The
host agent and TrueNAS paths already normalize their health text; the
PVE ingestion was the only entry that did not.
Map OK/PASS to PASSED and FAIL-containing values to FAILED at ingestion,
and accept OK as healthy in the disk presentation layer as defense for
state produced by older servers.
Refs #1595
Contract-Neutral: behavioral fix: normalize PVE disk health strings at ingestion, no public contract delta (#1595)
The requirements table named an Enterprise license but the pricing page
only sells Community, Relay, and Pro, leaving no visible path to the
capability. A Pro buyer purchased today expecting multi-org on the
strength of this doc. State plainly that the self-serve tiers do not
include the capability and where to ask for Enterprise licensing.
Contract-Neutral: docs-only: state how the Enterprise multi_tenant license is obtained; no runtime change
smartctl reports SAS drives with device protocol SCSI, so detectDiskType
fell through to its blanket sata default, and that non-empty type also
masked the text-output transport evidence the fallback parser had
already extracted. The wrong sata label then blocked the merge layer
from promoting the smartctl serial over the SAS transport address
Proxmox reports.
Classify SCSI-protocol devices via the scsi_transport_protocol
descriptor, let the text and sysfs refinements upgrade a generic scsi
label, and apply the legacy sata default only after all evidence is
exhausted. Parse the SCSI log-page fields (power-on hours, grown defect
count, endurance used) that SCSI drives report instead of an ATA
attribute table, and let agent-reported sas replace coarse hdd/ssd/sata
types during the disk merge.
Refs #1595
Contract-Neutral: behavioral fix: SAS transport detection and SCSI attribute parsing in host agent SMART collection; no public contract delta (#1595)
Agent Doctor withheld the manual update command whenever an eligible
agent had auto-update on and an update pending, including agents idle
until their next scheduled check or stuck mid-convergence, leaving no
manual escape hatch. Block the command only while the updater reports
state updating with a fresh attempt timestamp, and restore it once an
in-flight attempt is older than ten minutes.
Refs #1564
Contract-Neutral: behavioral fix: Agent Doctor manual command gate now blocks only live in-flight updates; no public contract delta (#1564)
Patrol's verdict contract required the model to echo finding IDs like
update-analysis-docker:<uuid>/<64-hex-digest> exactly. Smaller models
(reported with Gemini 2.5 Flash-Lite) drop the key prefix or digest
tail, every patrol_assess_finding call fails, and the whole run ends
with 'Patrol finding assessment incomplete'. Resolve an ID that
unambiguously identifies one active in-scope finding (case-insensitive,
prefix, or separator-suffix match), record the canonical ID so the
verdict accounting and duplicate guard still hold, and list the valid
active IDs in the lookup error so the model can self-correct instead of
guessing. Hallucinated or ambiguous IDs still fail closed.
Refs support report from Johannes Strasser, 2026-07-20
Contract-Neutral: behavioral fix: tolerant patrol assessment ID resolution for weak models; fail-closed contract unchanged
The workloads metadata state still listened for the legacy
pulse:metadata-changed event, which no code dispatches since URL saves
moved to dispatchResourceMetadataChanged, and its handler rewrote
3-part canonical guest ids into the v5-era instance-vmid shape that no
lookup uses. In-page saves only stayed live through the drawer's direct
callback; any other dispatcher was invisible. Listen for
pulse:resource-metadata-changed and apply updates under the dispatched
metadata id, ignoring agent-kind events that never key workload rows.
Refs #1556
Contract-Neutral: behavioral fix: workloads metadata state listened for a legacy event nothing dispatches; no public contract change (#1556)
Agents report network interfaces sorted by name, which places docker0
and br-* bridges ahead of eth*/en* interfaces, and every consumer of
ResourceIdentity.IPAddresses treats the first entry as the host's
primary address. Docker hosts therefore showed a 172.x bridge IP in
the Machines and Docker tables instead of the machine's LAN address.
Collect physical-looking interfaces first so bridge and overlay
addresses never lead the list.
Refs #1529
Contract-Neutral: behavioral fix: order physical interface IPs before virtual bridges in identity collection; no public contract change (#1529)
Keep macOS notarization mandatory for every release candidate while requiring Windows Authenticode only for stable promotion, matching the publish workflow and RC4 release packet.
vCenter answers a newer-than-supported vim25 release path with 404 on
some builds but HTTP 500 on others: 8.0.x returns 500 for the 9.0.0.0
service-content probe. The negotiation loop only continued on
not_found, so it aborted on the first probe and never tried the 8.0.3
release the server actually speaks, failing the connection test with
'vi-json service content request failed with HTTP 500'.
Continue the probe loop on generic endpoint failures as well as 404;
still abort immediately on auth, permission, TLS, and network errors,
which no release string can fix.
Fixes#1596
Contract-Neutral: behavioral fix: vSphere release negotiation falls through HTTP 500 probe responses (issue #1596); no public contract delta
An agent running inside an LXC measures /proc through the shared kernel
and reports the node's utilisation, not the container's. Because
SourceAgent outranked SourceProxmox in the metric merge, that value
overrode the hypervisor's cgroup-accounted CPU on the guest's canonical
resource, so the workloads row disagreed with the (Proxmox-sourced)
history chart by orders of magnitude on idle guests.
Demote agent-sourced utilisation metrics below the platform source when
the target resource is a hypervisor-managed guest (vm /
system-container). The freshness gate still lets a live agent cover for
a stale platform source.
Fixes#1597
Contract-Neutral: behavioral fix: demote in-guest agent utilisation below platform source on hypervisor-managed guests (issue #1597); no public contract delta
A full V8 branch-coverage regen (18326-test suite clean, so the counts are
ground truth) flagged eight pure frontend modules as the only remaining
defensible coverage gaps. This adds one branchcov test per module, exercising
genuinely-untested exported functions and previously-uncovered branch arms.
Modules and targets covered.
- utils/agentInstallCommand buildPowerShellInstallScriptBootstrap, a
completely untested export, plus its empty-URL throw arm
- i18n/locales resolveSupportedLocale across all four resolution strategies
and the unsupported-base null arm, plus getLocaleFallbackChain
- shared/helpIconModel calculateHelpPopoverPosition geometry (top and bottom
flip arms, horizontal clamp) and resolveHelpContent
- Workloads/workloadsFilterModel countActiveWorkloadsFilters across all eight
filter arms and hasActiveWorkloadsFilters
- Workloads/metricBarModel buildMetricBarPresentation showLabel and
showSublabel threshold arms
- shared/selectionCardGroupModel variant and tone resolvers and the class helpers
- shared/animatedNumberModel sanitizeAnimatedNumberValue non-finite arm
- shared/tagInputModel getTagInputPlaceholder arms, getNextTagsAfterRemove,
canAddTag
Tests only, no source changes. 173 new test cases, all green. tsc and eslint clean.
Test-only (GLM nightly grunt, round 2): new
monitored_system_projection_matchers2_branchcov0720am_test.go covering the
previously-uncovered Docker/TrueNAS/PBS/VMware per-type replacement-selector
matchers and the monitoredSystemReplacementSelectorMatches dispatcher in
internal/unifiedresources. Each per-type predicate drives its nil-source guard,
every OR-chain arm in isolation, no-match, and whitespace-only; the dispatcher
drives each DataSource route plus the unmatched arm. Complements the round-1
Agent/Proxmox/PMG/K8s coverage. No source changed; contract-neutral.
GetLatestActionAuditByOrigin and GetLatestActionAuditByOperationalRecord
were token-for-token identical except for which Origin field they matched,
tripping golangci-lint's dupl check. The scan/latest-selection/clone logic
now lives in latestActionAuditMatching(match); each getter keeps only its
input trimming and predicate.
Contract-Neutral: dupl lint dedup: extract shared latestActionAuditMatching helper, behavior identical, no public-contract delta
tests/90-operational-trust-protection-posture.spec.ts failed the
stable tier on main in run 29731882505 — the first tiered run. One
incident on main demotes: it rejoins the gate after 10 consecutive
green runs, per the rule above PROBATION_SPECS.
Contract-Neutral: probation demotion per documented tier rule: spec 90 failed on main run 29731882505; CI gating list only, no dev-runtime delta
New scripts/release_control/format_staged_frontend.py mirrors the staged
Go formatter: formats staged frontend-modern/src {ts,tsx,css,json} blobs
through prettier --stdin-filepath, writes results back to the index
directly (no broad restaging), syncs the worktree only when it matches
the previously staged content, and iterates to a fixed point to absorb
prettier's occasional non-idempotence. Skips gracefully when prettier is
not installed (fresh clones, linked worktrees without node_modules).
Wired into .husky/pre-commit after the Go formatter, with unit tests in
the governance battery, a README note, and a .gitignore allowlist entry.
With the one-time sweep in the previous commits, prettier drift can no
longer re-accumulate and make format stays clean on a clean tree.
settingsArchitecture.test.ts picked up an unformatted hunk in the
guardrail prep edit; helpers.branchcov2.test.ts needed a second prettier
pass to reach a fixed point. prettier --check over frontend-modern src
is now fully clean.
One-time sweep: npx prettier --write "src/**/*.{ts,tsx,css}" over
frontend-modern, clearing 611 files of accumulated drift so make format
no longer spuriously dirties the tree. Verified format-only: tsc
--noEmit clean and the full vitest suite green (18326 passed) after the
sweep. A staged-file prettier step lands next to keep drift out.
Contract-Neutral: mechanical prettier formatting sweep, zero behavioral or contract delta (tsc clean, full vitest suite green)
settingsArchitecture and WorkloadsSurface.performance.contract pin exact
source text (JSX copy phrases, a single-line export list) that prettier
line-wraps at printWidth 100. Normalize whitespace for the copy-phrase
guards and match the export list with a wrapping-tolerant regex so a
formatting pass cannot break them. Prep for the repo-wide prettier sweep.
Mined per-spec failure data from the 32 completed Core E2E main runs
since the 2026-07-18 quarantine delist (failed-shard logs; a green
shard means every spec in it passed). 26 specs failed or retry-flaked
within the 10 most recent completed runs; they seed PROBATION_SPECS in
tests/integration/playwright.config.ts. The remaining 62 files form the
stable tier and are the only specs that can fail the e2e-verdict job.
Mechanism extends the existing quarantine list rather than adding a
parallel one: PULSE_E2E_TIER=stable ignores probation specs,
PULSE_E2E_TIER=probation runs only them, unset runs the full suite
(local behavior unchanged). CI runs both tiers per shard against the
same containers; the probation pass sits behind continue-on-error with
its own report/results dirs and artifacts, so a probation flake is
reported in the shard summary without painting main red.
Promotion rule, documented next to the list: a probation spec promotes
to stable after 10 consecutive green main runs with no failure and no
retry-flake; one incident on main demotes a stable spec back. In the
newest completed run (29729544151) every failure was in a probation
spec — under this split that run's verdict is green.
Contract-Neutral: CI-only E2E tier split: gating semantics of push-CI verdict; local npm test behavior and dev-runtime orchestration unchanged, no public contract delta
Playwright HTML reports uploaded on every run at 30-day retention blew
the Actions storage quota (69.8 GB on 2026-07-20). Reports now upload
only when a shard fails, and all report/video/screenshot artifacts
keep a 3-day retention.
Contract-Neutral: Browser qualification keeps the existing deployment, authentication, and mobile layout contracts while reusing the accepted test credential and avoiding a WebKit synchronous-layout probe.
Contract-Neutral: The first-session agent install handoff keeps the existing API and setup contracts while binding runtime handlers to the Router-owned canonical config through startup and monitor reloads.
Contract-Neutral: RC qualification fixes preserve existing public API, tenant, monitoring, and organization contracts while correcting canonical runtime ownership and test fixtures.
rcourtman