[catinspace-au]

Every one of these was found by remediating a real host against these scripts. Each either did nothing while looking like it worked, or quietly discarded something.

Pinning and nag suppression were welded together

The APT hook gated on the pinning file existing:

[ -f "/etc/apt/preferences.d/proxmox-conservative" ] || exit 0

So a host that wanted latest packages got the subscription warnings back with no way to say otherwise. They are independent concerns -- new ui-only / ui-disable commands, and the hook now gates on the customisation's own marker.

Verified on nested PVE 9.2.5: ui-only installs with 0 pinning entries; deleting the served JS and script tag then running apt --reinstall pve-manager restored both with APT_EXIT=0.

The served JS also lives in a pve-manager-owned directory and is deleted by package updates. A master copy outside dpkg's control means the hook restores it rather than only logging that it is gone.

Cleanup could silently drop tuning

It classified superseded sysctl files by generation, not content. Run against the live host:

[KEEP] /etc/sysctl.d/99-proxmox-tweaks.conf
       overrides 98-proxmox-optimize.conf, but sets 5 key(s) it does not:
         fs.inotify.max_user_instances
         net.ipv4.tcp_keepalive_intvl
         net.ipv4.tcp_keepalive_probes
         vm.dirty_expire_centisecs
         vm.dirty_writeback_centisecs

All five would have gone. A backup makes that recoverable, not safe.

Drive addressing reverted to Derek's original approach

His incident scripts addressed drives by /dev/disk/by-id and matched the udev rule on ID_MODEL. Both were better than what this generated:

• Kernel names are not stable across reboots, so a boot-time unit keyed on sdX can assert SCT ERC against the wrong disk
• A per-serial udev rule leaves a replacement drive of the same model unprotected until someone remembers to re-run this -- fitting a replacement disk is exactly when nobody is thinking about kernel timeouts

SATA link power management on VM disks

Found live on all four members of the pool carrying every VM (med_power_with_dipm). ALPM parks the SATA link between commands and adds wake latency to every I/O, working directly against the bounded retry times disk-errors configures.

The sysfs policy does not survive a reboot, so setting it once at install time was not enough -- it is now reasserted from the generated boot script, ZFS-aware.

Baseline is now a superset

optimize carries the keepalive probe/interval pair and the inotify instance limit. Deliberately not the dirty writeback intervals: holding dirty pages longer is defensible with a UPS and reckless without, so it stays an operator decision rather than a default.

Tests

121 checks, no Proxmox / root / network needed. Cleanup gains coverage for the key-loss guard, driven by the real content of the two files that exposed it.

Not verified

• Cluster coordination -- still only run on a standalone node
• Browser behaviour of the override -- parses under node, every hook guarded, but nothing proves a warning is relabelled on screen

[github-actions]

🎉 This PR is included in version 2.6.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀