- lib/common: stamp_applied() now records a _last_applied_config
snapshot alongside the hash; strip_apply_meta() centralizes
bookkeeping-key stripping; deep_diff() reports field-level changes
- state collectors (dnsmasq/nginx/wireguard/networkd) expose
pending_diff so the dashboard can show exactly which fields
changed since the last apply (wireguard diff excludes
private_key paths)
- dashboard pending-changes card renders per-change lines with a
generic fallback when no snapshot is recorded
- firewall: firewalld built-in zones no longer flagged as
unmanaged; public-zone masquerade skipped in pending changes
since apply drives it via nftables propagation
- schema: PendingChange TypedDict; pending_diff on DnsmasqStatus /
WgStatus; tests in test_common.py, test_firewall.py, test_state.py
- daemon: send full snapshot on connect; versions/tick now carry the
full state of one subsystem (subsystem + data); no legacy
updated/subsystems payloads; refresh_state and POST /status/refresh
broadcast per-subsystem versions with data
- client: modelSet() patches models in place; onMessage/topic refresh
retired; 3s initial-load fallback via new POST /api/status/refresh
- schema: lib/schema.py TypedDicts + hoover/schema.js defaults +
docs/state-model.md as single source of truth for state shapes
- system: poll at 1s, volatile metrics registered, dashboard uses a
dedicated system model (status model removed)
- firewall: refuse to strip both https and ssh from the default zone
(409, force override via UI confirm); set_zone_services persists
services to the declarative config; collector exposes default_zone
- UI: pages migrate to flat state shapes; post-mutation modelFetch
refreshes removed (WS delta covers it)
- tests: ws snapshot/delta/broadcast, refresh-state, schema types,
model-set/js ws handler and reconnect fallback
mteehan