# PAT-011 — PVE Webhook Notifications Pipeline Repair

**Trigger**: PVE notifications (esp. vzdump) reach Telegram not / test returns 500.

**Signature diagnosis ladder**:
1. `pvesh create /cluster/notifications/targets/<name>/test` — error taxonomy:
   - `Connection refused` → transport/down (check URL target alive)
   - `failed to render webhook body` → template broken (syntax/base64)
   - `http status: 400` → bridge rejected payload (escaping!)
2. Listener-Sweep über VLAN: `for ip in .xx…; do /dev/tcp/$ip/port probe; done`
3. Byte-Level-Truth via temp mini-sniffer (redirect URL, capture, restore!).

**Hard rules**:
- Mutations an `/etc/pve/notifications.cfg` NUR via `pvesh set` (hand-edits poison
  global deserialization!). Vorher Snapshot.
- `body`/header-values/secrets = **base64 blobs**: `printf '%s' tpl | base64 -w0`.
- Handlebars helpers: `{{escape title}}` (Space!), NICHT `{{escape:title}}`.
- Immer `{{escape title}}`/`{{escape message}}` verwenden — rohe Interpolation bricht
  bei Apostrophen/Multiline (Backup-Reports!).
- Sniffer-Redirect URL IMMER restaurieren.

Reference: `docs/solutions/bug-fixes/2026-09-30-pve-webhook-notifications-drift-base64-escape.md`