Fix vSphere workload first paint

docs/release-control/v6/internal/subsystems/frontend-primitives.md

@@ -71,14 +71,15 @@ shared filter rail must remove that route value along with the other active
 facets; the feature must not replace the shared rail with a page-local select.
 
 Large-estate platform pages must keep one canonical inventory snapshot for the
-initial read and explicit refresh path. The Proxmox overview owns its unified
-resource request and passes that snapshot into the shared workloads state; the
-workloads adapter may map the snapshot into the legacy guest boundary, but must
-not issue a second workload inventory request or create a second infrastructure
-poll. Refreshing the overview must invalidate that owner snapshot and update
-both the node and guest regions from the same result, so a large estate cannot
-render contradictory counts or pay duplicate transport and reconciliation
-costs.
+initial read and explicit refresh path. The Proxmox and VMware vSphere
+overviews own their source-scoped unified-resource requests and pass those
+snapshots into the shared workloads state; the workloads adapter may map the
+snapshot into the legacy guest boundary, but must not issue a second workload
+inventory request or create a second infrastructure poll. Refreshing an
+overview must invalidate that owner snapshot and update both the host/node and
+guest regions from the same result, so a large estate cannot render
+contradictory counts, flash a false empty workload state, or pay duplicate
+transport and reconciliation costs.
 The overview's bounded structural summary remains ahead of its long virtualized
 inventory at desktop and narrow widths. In particular, Proxmox must show up to
 six phone rows or twelve larger-layout rows before the guest list instead of

docs/release-control/v6/internal/subsystems/performance-and-scalability.md

@@ -1360,6 +1360,19 @@ an interim unknown or never-backed-up state while waiting for a WebSocket
 tick. This correction adds no request, subscription, retry, or resource scan;
 `useUnifiedResources.test.ts` and `useWorkloads.test.ts` pin the boundary.
 
+### vSphere owner snapshots avoid duplicate estate enumeration
+
+The VMware vSphere overview owns one `type=agent,vm,storage,network` resource
+query scoped to `source=vmware-vsphere` and passes the resulting canonical
+snapshot into its embedded Workloads state. Host and VM regions therefore
+paint from one paged generation and explicit refresh path; the Workloads owner
+must not launch the generic all-platform workload pagination or its generic
+infrastructure snapshot. The shared unified-resource hook projects the same
+type-and-source filter from canonical WebSocket state, so this request
+reduction adds no polling fallback or freshness regression. Contract tests pin
+the request shape, realtime projection, snapshot injection, and refresh
+handoff.
+
 ### Command-session liveness lookup stays bounded and in-memory
 
 The connections ledger's command-channel liveness check

docs/release-control/v6/internal/subsystems/storage-recovery.md

@@ -25,6 +25,15 @@ The shared `internal/api/` helper-binary download route is isolated from
 storage and recovery semantics. `/download/pulse-agent-helper` serves a signed
 Linux runtime artifact only; it cannot read, mutate, restore, export, or select
 storage state, recovery timelines, backup providers, or repository scope.
+The parallel `/download/pulse-agent-runner` artifact route and
+`/api/agents/action-runner/credential` issuance route are also adjacent
+API/agent-lifecycle boundaries. A signed runner binary or host-bound typed
+action credential is not a backup, snapshot, recovery point, restore grant,
+retention decision, or repository selector. Safe-profile inspect/apply/rollback
+preserves collector identity and installation files only; it must not rewrite
+storage/recovery evidence or reinterpret a restored legacy collector profile as
+recovery success. Typed `host.storage_cleanup` remains governed remediation,
+not storage-recovery authority inferred from the credential itself.
 
 First-run authentication always writes the canonical `.env` persistence
 artifact before runtime state changes. Root systemd installation may also
@@ -53,6 +62,14 @@ workload or infrastructure inventory request. Backup and recovery tables keep
 their domain-specific evidence requests, while an overview refresh must update
 all overview regions from the same owner snapshot rather than mixing reads
 from different inventory generations.
+The vSphere overview follows the same read-side ownership rule for its host,
+VM, datastore, and network regions. Its canonical snapshot is constrained to
+the `vmware-vsphere` source at the resource API boundary, and the embedded
+workloads adapter consumes that page-owned snapshot instead of issuing a
+second generic inventory request. Source aliases used to project a canonical
+websocket snapshot are transport filtering only: a VMware datastore remains
+descriptive inventory and does not gain backup, protection, recovery-point,
+or restore semantics from that projection.
 The physical-disks surface consumes every page in the server-declared unified
 resource result, scopes same-named Proxmox nodes by instance, and never hides a
 disk behind a client-side page ceiling. Search includes vendor, WWN, transport,

docs/release-control/v6/internal/subsystems/unified-resources.md

@@ -2046,6 +2046,14 @@ without waiting for a later WebSocket merge; REST and WebSocket delivery must
 not disagree about already-authoritative fields. The boundary is pinned by
 `useUnifiedResources.test.ts` and `useWorkloads.test.ts`.
 
+Source-scoped platform owners remain canonical realtime consumers. The shared
+frontend hook locally projects supported `type` plus `source` filters from the
+canonical WebSocket snapshot, including the public `vmware-vsphere` alias for
+the raw `vmware` source, rather than degrading a source-scoped page to periodic
+REST refreshes. VMware Overview passes that same source-scoped snapshot into
+the embedded Workloads state, so hosts and VMs share one inventory generation
+and one explicit refresh path.
+
 ### Agent libvirt domains use a provider-neutral VM facet
 
 The registry projects a host's validated libvirt domains as `vm` resources