Prepare v6.1.2 stable patch release

docs/RELEASE_NOTES.md

@@ -7,10 +7,12 @@ For historical v4 notes that previously lived in this repo, see:
 `docs/releases/RELEASE_NOTES_v4.md`
 
 For the current stable v6 packet, see:
-- `docs/releases/RELEASE_NOTES_v6.1.1.md`
-- `docs/releases/V6_CHANGELOG_v6.1.1.md`
+- `docs/releases/RELEASE_NOTES_v6.1.2.md`
+- `docs/releases/V6_CHANGELOG_v6.1.2.md`
 
 For earlier stable v6.1 packets, see:
+- `docs/releases/RELEASE_NOTES_v6.1.1.md`
+- `docs/releases/V6_CHANGELOG_v6.1.1.md`
 - `docs/releases/RELEASE_NOTES_v6.1.0.md`
 - `docs/releases/V6_CHANGELOG_v6.1.0.md`
 

docs/UPGRADE_v6.md

@@ -4,11 +4,13 @@ This guide covers practical upgrade steps for existing Pulse installs moving to
 
 For the current stable v6 packet, see:
 
-- `docs/releases/RELEASE_NOTES_v6.1.1.md`
-- `docs/releases/V6_CHANGELOG_v6.1.1.md`
+- `docs/releases/RELEASE_NOTES_v6.1.2.md`
+- `docs/releases/V6_CHANGELOG_v6.1.2.md`
 
 For earlier stable v6 packets and rollout references, see:
 
+- `docs/releases/RELEASE_NOTES_v6.1.1.md`
+- `docs/releases/V6_CHANGELOG_v6.1.1.md`
 - `docs/releases/RELEASE_NOTES_v6.1.0.md`
 - `docs/releases/V6_CHANGELOG_v6.1.0.md`
 - `docs/releases/RELEASE_NOTES_v6.0.5.md`

docs/release-control/v6/internal/subsystems/deployment-installability.md

@@ -1080,31 +1080,29 @@ host-local redirect contract as runtime token minting and exchange. Proof input
 must reject absolute, scheme-relative, backslash-authority, encoded-separator,
 and control-character targets before constructing the handoff request.
 
-The active stable `v6.1.1` cut sets the repo-root `VERSION`, repo-root
+The active stable `v6.1.2` cut sets the repo-root `VERSION`, repo-root
 `docker-compose.yml` image default, `scripts/install-docker.sh` fallback, and
-Helm chart release metadata to the same `6.1.1` release version. This patch
-release uses the stable hotfix path with `rollback_version=v6.1.0`,
+Helm chart release metadata to the same `6.1.2` release version. This patch
+release uses the stable hotfix path with `rollback_version=v6.1.1`,
 `hotfix_exception=true`, a release-owner reason, and no fabricated
-same-version RC tag. It fixes manual Unified Agent updates that received a
-distribution identifier instead of the canonical Linux platform family and
-durable Docker update actions that could remain stuck after a terminal
-digest-drift preflight refusal. The exact stable `main` SHA must pass the
-integrated release checks and immutable-candidate build before the single-build
-workflow crosses its public mutation boundary. The same workflow must finish
-Docker, Helm, stable demo, install-smoke, public-health, floating-tag,
-paid-runtime, and definitive-verdict lanes before the cut is complete.
-The `v6.1.1` release is `existing-mobile-build-compatible`: no production
-relay or mobile trust contract changed from `v6.1.0`, the matched mobile-facing
-path is test-only expiry branch coverage, and Pulse Mobile `1.0.0` iOS build
-`11` and Android versionCode `9` remain the compatible candidate builds without
-a companion upload or public store rollout.
-The release owner separately approved a `v6.1.1`-only unsigned-Windows
-exception because SignPath configuration remains unavailable. Windows assets
-must remain exact-SHA and manifest-bound with checksums, detached
-`.sig`/`.sshsig` signatures, and published-digest verification; the release
-notes must disclose the Unknown Publisher state. Stable `v6.1.2` and later
-restore Authenticode unless policy records another explicit version-bound
-decision.
+same-version RC tag. It consolidates the post-`v6.1.1` Proxmox, TrueNAS,
+metrics, availability, agent lifecycle, operator-state, and security fixes.
+The exact stable `main` SHA must pass the integrated release checks and
+immutable-candidate build before the single-build workflow crosses its public
+mutation boundary. The same workflow must finish Docker, Helm, stable demo,
+install-smoke, public-health, floating-tag, paid-runtime, and
+definitive-verdict lanes before the cut is complete. No mobile-facing path
+changed from `v6.1.1`, so the release decision is `no-mobile-impact` and no
+companion build or public mobile-store rollout is required. Stable `v6.1.2`
+restores mandatory Windows Authenticode signing through SignPath; no unsigned
+exception is authorized, and the release candidate must fail closed when the
+signing configuration or returned signer proof is unavailable.
+
+The preceding stable `v6.1.1` cut used the stable hotfix path with
+`rollback_version=v6.1.0` and an owner-approved, version-bound unsigned Windows
+exception. Pulse Mobile `1.0.0` iOS build `11` and Android versionCode `9`
+remained the compatible candidate builds without a companion upload or public
+store rollout.
 
 The preceding stable `v6.1.0` cut used
 `promoted_from_tag=v6.1.0-rc.4`, `rollback_version=v6.0.5`, and the
@@ -1218,8 +1216,8 @@ compose image default, standalone installer fallback constant, and packaged
 Helm metadata. A draft release workflow failure caused by stale image or chart
 pins is a release-packet blocker until the defaults, tests, and evidence
 record are refreshed from the new branch head.
-For the active stable `v6.1.1` cut, the repo-root compose default and
-`scripts/install-docker.sh` fallback must both pin `6.1.1` until the next
+For the active stable `v6.1.2` cut, the repo-root compose default and
+`scripts/install-docker.sh` fallback must both pin `6.1.2` until the next
 governed stable cut moves them forward. The stable promotion guard remains in
 force and rejects leftover `-rc.` defaults.
 The RC7 packet refresh records `fc10de9b5477613316473267b72b05b6b2b7aaff`

docs/releases/RELEASE_NOTES_v6.1.2.md

@@ -0,0 +1,88 @@
+# Pulse v6.1.2 Release Notes
+
+`v6.1.2` is a stable patch release following `v6.1.1`. It consolidates
+monitoring, storage, agent-lifecycle, security, and operator-experience fixes
+completed since the previous stable cut.
+
+## Highlights
+
+- Proxmox monitoring is more authoritative across cluster membership, guest
+  sampling, Ceph MON/MGR counts, physical disks, backup posture, and scheduled
+  multi-guest `vzdump` jobs.
+- TrueNAS monitoring uses the supported JSON-RPC transport, restores pool and
+  replication health classification, and keeps storage topology and SMART
+  evidence aligned.
+- Unified Agent enrollment and update recovery are more resilient. Constrained
+  QNAP and Unraid installs now fail early on insufficient disk space and use
+  bounded rotating logs instead of unbounded watchdog output.
+- Polling cadence changes apply to live monitors immediately, connection
+  staleness scales with the configured interval, and PBS health remains owned
+  by current probe evidence.
+- Resource links, availability summaries, organization switching, recovery
+  posture, and operator overrides behave consistently across the main
+  infrastructure surfaces.
+
+## Changed
+
+- Evidence-based pool-health alerts preserve the provider's authoritative
+  topology and health discriminator.
+- Scheduled Proxmox backup jobs are projected into stable per-guest task
+  records, including running, completed, and failed guest outcomes.
+- SATA devices behind SAS HBAs retain SATA transport handling for SMART
+  collection, while native Unraid and TrueNAS topology remains authoritative.
+- Metrics persistence reduces SQLite write amplification and keeps bounded
+  history caches without weakening current-state freshness.
+- Local AI provider readiness checks exercise the representative Patrol
+  runtime path and provide more actionable compatibility results.
+
+## Fixed
+
+- Changing backup and PBS polling intervals now updates active monitors without
+  requiring a service restart (#1619).
+- Proxmox Quincy and Squid Ceph status payloads report the correct MON and MGR
+  counts (#1626).
+- Scheduled multi-guest Proxmox backup jobs no longer disappear from
+  guest-centric coverage and alert-intent views.
+- QNAP and Unraid agent installs detect insufficient temporary or destination
+  space before downloading, honor `TMPDIR`, and prevent appliance watchdog logs
+  from growing without bound (#1617).
+- Operator-state reads normalize an absent automatic-action policy to
+  `capabilityNames: []`, preventing expanded resource rows from crashing.
+  Intentionally-offline and never-auto-remediate controls remain available for
+  stopped Docker containers (#1621, #1622).
+- Proxmox cluster membership, guest CPU rate sampling, physical-disk identity,
+  agent registration, and workload refresh remain coherent across nodes.
+- TrueNAS boot-pool, replication, pool-health, disk, and alert-threshold
+  evidence no longer falls back to stale or unsupported interpretations.
+- Availability summaries no longer write into the live resource registry,
+  grace-period guests stop generating metrics, and configured discovery
+  suppression fails closed.
+- Webhook URLs and PBS probe failures are redacted from logs and diagnostics,
+  local-provider requests retain SSRF protections, and legacy RBAC recovery
+  remains reachable when an old import fails.
+- Resource web-interface links are canonicalized consistently, and live queries
+  refresh after an organization switch.
+
+## Upgrade Notes
+
+Use the normal v6 install or update flow for `v6.1.2`.
+
+Windows Unified Agent binaries in `v6.1.2` are required to be
+Authenticode-signed. The governed release workflow fails closed unless the
+SignPath configuration is present and every returned executable verifies
+against the expected signer.
+
+The rollback target for this patch release is `v6.1.1`. The exact rollback
+reinstall command is:
+
+```bash
+./scripts/install.sh --version v6.1.1
+```
+
+The server/mobile decision is `no-mobile-impact`. No mobile-facing relay,
+pairing, onboarding, or trust-contract path changed from `v6.1.1`, so this
+release does not upload a companion mobile build or start a public
+mobile-store rollout.
+
+Paid Pulse Pro, Relay, and eligible legacy customers should continue to use the
+private download page and private runtime image for paid runtime features.

docs/releases/V6_CHANGELOG_v6.1.2.md

@@ -0,0 +1,48 @@
+# Pulse v6.1.2
+
+_This changelog describes stable `v6.1.2` compared with stable `v6.1.1`._
+
+## Changed
+
+- Proxmox and PBS monitoring now uses fresher ownership boundaries for cluster,
+  guest, backup, disk, Ceph, and connection-health state.
+- TrueNAS uses its supported JSON-RPC transport and retains authoritative pool,
+  replication, disk-topology, and SMART evidence.
+- Metrics persistence reduces SQLite write amplification, while polling cadence
+  changes apply immediately to live monitors.
+- Evidence-based pool-health alerts and canonical web-interface links are
+  available across the unified resource surfaces.
+- Patrol readiness checks are representative of the configured local-provider
+  runtime.
+
+## Fixed
+
+- Unified Agent installs on constrained QNAP and Unraid roots preflight free
+  space and keep agent/watchdog logging bounded (#1617).
+- Saved backup and PBS polling intervals take effect without a service restart
+  (#1619).
+- Operator-state payloads keep capability lists iterable, and stopped
+  containers retain intentionally-offline and never-auto-remediate controls
+  (#1621, #1622).
+- Proxmox Quincy and Squid Ceph schemas report correct monitor and manager
+  counts (#1626).
+- Scheduled multi-guest `vzdump` jobs contribute stable per-guest backup status.
+- Proxmox membership, sampling, registration, disk identity, and workload
+  refresh remain coherent across clusters.
+- TrueNAS health, replication, boot-pool, threshold, and disk evidence no
+  longer falls back to stale interpretations.
+- Availability, discovery suppression, RBAC recovery, diagnostic redaction,
+  and organization-switch refresh paths fail safely and consistently.
+
+## Release Metadata
+
+- Version: `v6.1.2`
+- Previous stable: `v6.1.1`
+- Rollback target: `v6.1.1`
+- Rollback command: `./scripts/install.sh --version v6.1.1`
+- Promotion path: stable patch hotfix from `main`, using the integrated
+  exact-SHA candidate and definitive release verdict
+- Windows signing decision: Authenticode is required through SignPath; no
+  unsigned-Windows exception is authorized for `v6.1.2`
+- Mobile decision: `no-mobile-impact`; no companion build upload or public
+  store rollout is required