Try both loopback families for IPv6 wildcard listeners without changing explicit or IPv4-only binds. Reserve each family a share of the API deadline, keep all later checks on the responding address, and retry a failed observation once with a fresh bounded budget in the telemetry background runner.
Keep genuine API, UI and asset failures visible and report only a closed timeout category, never transport details. Cover both real listener families, startup recovery, failure and privacy boundaries; synchronise the disclosure and subsystem contract.
Change-source: pulse-maintainer
Use TrueNAS default summaries for reporting queries so SCALE 25.04 can validate its History responses. Preserve raw samples, time windows, CORE live telemetry and existing error boundaries.
Refs #2346
Change-source: pulse-maintainer
A missing or zero total must not erase package or severity findings. Require a complete typed zero verdict, retain bounded outage handling for unknown reports, and keep raw metadata out of workflow annotations. Add executable regression coverage and update the installability contract.
Change-source: pulse-maintainer
Batch WebSocket identity decoding from the encoded arrays and retain decoder-owned entry buffers. Keep canonical metadata refresh on every resource clone while replacing membership maps with small scope slices and a single sensitivity-tag scan. Preserve delta identity, scope ordering, policy precedence and clone isolation with reference/fuzz and transition tests.
Adapt the remaining performance work proposed in Pulse PR #2342 for issue #2199. The contributor's first-ID check cannot verify a stale tail; this candidate uses standard JSON decoding for every encoded identity instead. Keep the imported contributor history and branch unchanged.
Co-authored-by: Andy Prosser <andy.prosser@icloud.com>
Based-on: https://github.com/rcourtman/Pulse/pull/2342
Original-Commit: 0cbfa43186
Change-source: pulse-maintainer
Use a private header file and an authenticated read-only summary rather than passing tokens in argv to a public health check. Exercise both header formats, file permissions, preserved content and failing HTTP auth errors with synthetic local fixtures.
Contract-Neutral: API authentication, routes, scopes and CSRF enforcement are unchanged; this updates existing usage guidance and executable documentation checks.
Change-source: pulse-maintainer
Preserve the exact reviewed Product intelligence candidate and its deployment-specific, credential-safe help. No runtime or new product surface changes.
Change-source: pulse-maintainer
Remove the full service-environment dump, which can expose authentication and integration credentials. Explain listener precedence, the separate agent port, systemd reloads, and Docker port recreation without changing the image or deleting persistent data. Keep the shipped guide identical and protect these boundaries with documentation tests.
Contract-Neutral: Guidance and verification for existing port configuration only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Render escaped, allowlisted details from the captured audit response instead of making a second registry call outside the wall-clock watchdog. Preserve every advisory failure and outage policy; executable fixtures pin single-request diagnostics, missing detail, transport-error precedence and annotation-safe output.
Change-source: pulse-maintainer
A fixed ten-entry history made accepted higher thresholds unreachable and silently disabled storm suppression. Bound retained observations to the configured threshold while preserving the existing diagnostic allowance, expiry and one-shot cooldown. Verify normal config updates, callback admission, delivery diagnosis, window expiry, rearming and threshold changes, and register the focused proof owner.
Change-source: pulse-maintainer
Preserve the exact reviewed documentation candidate and its focused proof while retaining the current canonical frontier.
Change-source: pulse-maintainer
The agent prefers its saved identity before deriving one from the OS. The old live machine-ID deletion recipe could disrupt unrelated services while leaving a Pulse collision unchanged. Explain managed overrides, precedence, private evidence and distinct-host verification in both shipped guides; cover the safe path with documentation and real-browser checks.
Contract-Neutral: Guidance and verification for existing agent identity options only; no runtime, authentication, schema or frontend behaviour changes.
Change-source: pulse-maintainer
Compose the retained PBS identity repair with current reviewed source without rewriting its history. The continuation requires terminal exact-source race validation before this candidate is complete.
Change-source: pulse-maintainer
Direct PBS host correlation could lend Agent History and SMART ownership through loopback, Docker-local or stale address evidence, and a stale Agent could block its fresh replacement. Reuse the provider address filter and the five-minute observation boundary, preserve IPv6 URL hosts, and cover unsafe evidence, private management controls, link replacement and the three-PBS/nine-Agent topology.
Change-source: pulse-maintainer
Remove the obsolete inline recovery-token curl recipe: recovery sessions are client-bound, so it neither unlocks a separate browser nor needs a credential copied into command history. Point to deployment-specific bootstrap recovery and give symptom-specific, reviewed and sanitized incident reporting steps without requiring dangerous repeats.
Contract-Neutral: Documentation and verification only; clarifies existing browser-bound recovery and sanitized diagnostics without changing authentication, API, schema or runtime behaviour.
Change-source: pulse-maintainer
A user-chosen PBS label could attach an unrelated Agent before the exact guest-IP/Agent link was evaluated, putting host History and SMART ownership on the wrong server. Use reported node and endpoint evidence instead, and cover both the collision and label-only cases.
Change-source: pulse-maintainer
When a PBS API token cannot report nodeName and the in-guest Agent omits interface addresses, use a unique running PVE VM at the exact PBS endpoint IP plus its state-owned Agent link. Reject stale or ambiguous observations instead of guessing from display names. This restores the source-native host target for corroborated PBS VMs while preserving the separate PBS service target.
Change-source: pulse-maintainer
Do not infer success from a registry badge clearing while a receipt is pending. Keep the action review reachable from the row, preserve inconclusive outcomes, and show completion only from the recorded audit. Add focused state tests and desktop/phone browser proof.
Change-source: pulse-maintainer
Persist measured PBS CPU and memory on the service metrics target when node status succeeds. Keep host-agent history separate and avoid false samples on unavailable status. Cover service reads, denial and recovery.
Change-source: pulse-maintainer
Advance the provider control-plane source builder and integration mock builder
on Pulse PR #2275's reviewed 1.26.8 Alpine digest. Keep their exact compiler
image locked by an installability proof and record what this does not qualify.
The published prebuilt runtime path is unchanged.
Change-source: pulse-maintainer
A supported endpoint failure may outlive its primary host incident. When synthesis removes the supported cause, dispatch its first independent notification without reopening the occurrence or duplicating a symptom previously notified before grouping.
Change-source: pulse-maintainer
The supported-cause escalation and queued callback tests live in incident_synthesis_test.go, not escalation_policy_change_test.go. Keep the verification contract aligned with the actual test file.
Change-source: pulse-maintainer
Keep route-selected action details and inbox tabs bound to their latest reads so delayed replies cannot replace a newer review or reopen one after close. Preserve server-authored identity and prove the overlap in focused tests and responsive browser navigation.
Change-source: pulse-maintainer
A verified primary infrastructure alert already owns the initial notification for its supporting symptoms. Apply that same ownership to scheduled escalation, queued callback admission, and quiet-hours replay so a late duplicate cannot be sent. Preserve independent escalation for uncorroborated observation sets.
Change-source: pulse-maintainer
Explain that the signed Proxmox server installer uses the v-tagged server archive and never asks for a GitHub PAT. Tell operators to stop when a different helper selects a chart release or requests a token, and to check for a partly created container before a fresh install.
Change-source: pulse-maintainer
Show an unknown-outcome warning for every receipt-pending review and offer a same-action status re-read without another dispatch. Keep aged audit closure behind its existing admin and server gates, and cover desktop and phone interactions.
Change-source: pulse-maintainer
Treat monitor-only as terminal before quiet-hours replay and flapping, and reject scheduled or queued escalations when the current alert is monitor-only. Align firing, recovery and delivery diagnosis with that policy; cover ordinary and critical-repeat scheduling plus a policy change after callback queueing.
Change-source: pulse-maintainer
Keep resource maintenance, mute and expected-offline policy terminal in the internal alert callback path. Quiet-hours deferral remains replayable, while delivery diagnosis and event history report the actual operator suppression. Cover pre-reconciliation active alerts and unaffected performance signals.
Change-source: pulse-maintainer
The bug and v6 pre-release forms previously required reproduction steps even when a retry could cause a host outage, duplicate update, alert storm or data loss. Ask for the original sequence and safe evidence instead, and mirror the guidance in the public triage document.
Contract-Neutral: Community intake wording only; release and installation contracts unchanged.
Change-source: pulse-maintainer
Avoid configuration-history rows when source merges only reorder identity addresses or represent an absent list as empty. Real identity changes remain recorded. The #2319 serial-bearing disk fixture and registry-generation check cover the tags-only and no-op identity paths.
Change-source: pulse-maintainer
Ask for the attempted release and installer provenance when Pulse never started, without forcing a false running-version attestation or a token-bearing command. Keep public triage guidance aligned and pin both forms in tests.
Contract-Neutral: Issue form provenance and wording change community intake only, not release promotion or artifact dispatch
Change-source: pulse-maintainer
Linked Agent SMART disks inherit a PVE instance for presentation. Restrict skipped-poll readback to actual PVE observations so an empty disks/list cannot alternate fabricated inventory, tags and history rows. Pin repeated cycles and the source boundary in the monitoring contracts.
Change-source: pulse-maintainer
Preserve the registry-corroborated PBS-to-Agent link on the service row while selecting the Agent host metrics target in the Backups drawer. Reject PVE-only name collisions and retain the target through a transient missing host row. Recompose the unchanged #1723 runtime repair on current main with fresh desktop and phone browser proof.
Change-source: pulse-maintainer
Retain the verified #2321 source and its original receipt while incorporating upstream release and browser range validation.
Change-source: pulse-maintainer
Preserve the browser-verified #2321 repair and current protected Relay changes in separate ancestry. Resolve the shared receipt to the current main version; both proofs remain in their original non-merge commits.
Change-source: pulse-maintainer
The maintainer coordinator merges reviewed candidates onto a main that
keeps moving and then ran the browser verification guard once over the
whole range with the merge tip as the commit. No lane can produce a
receipt bound to that merge's parent and covering upstream frontend work
too, so 13 of 13 coordinator browser-guard rollbacks since 28 September
failed on base_sha. This adds a range mode where every changed frontend
file's final content must match a valid receipt from a non-merge commit
inside the range, each validated against its own commit. Merge-authored
receipts never count, and the per-commit and staged modes are unchanged.
The maintainer coordinator integrates reviewed candidates by merge onto a
main that keeps moving, then ran this guard once over before..after with
--commit after. That demands one tip receipt whose base_sha is the tip's
parent and whose paths and digests cover the whole cumulative delta. The
tip is a merge and the range carries the candidate plus upstream work that
was verified on its own, so no lane could ever produce that receipt. 13 of
13 coordinator browser-guard rollbacks since 28 September failed on
base_sha for this reason.
Add --base <range-base> for range mode. Every changed user-visible
frontend file's content at the tip must equal a digest recorded by a valid
receipt in a non-merge commit inside the range, and each receipt is
validated as the per-commit guard validates it at its own commit, bound to
that commit's parent and tree. Merge-authored receipts are never evidence,
so a conflict resolution or a later correction that changes frontend
source still needs fresh proof for the final content. Replaying the three
rolled-back 29 September batches from the host passes, and the existing
per-commit and staged modes are unchanged.
Preserve upstream browser verification for the newer Relay retirement surface; earlier action recovery proof remains in reviewed ancestry. Include current CI sharding and qualification canary without rewriting accepted commits.
Change-source: pulse-maintainer
pulse-triage[bot]