` (`showModal()`) whose body is: the row's inbound word and endpoint, the config's own `selectors`, the diff in a labelled ``, the route's `hint`, and a `input[type="text"].confirm` asking for `DANGER`;
+ 3. submit only when the typed word is exactly `DANGER` (client-side check of the *client's* convenience; the server re-checks, always);
+ 4. switch `aria-busy="true"`, `POST` with `danger: "DANGER"`, `dry_run: false`;
+ 5. paint from the **response**: `applied: true` → the row's `enabled` flips on the next poll (and immediately, optimistically **only** for the switch's own `aria-checked`, with `aria-busy` cleared and a note that the config is applied and the page re-reads); `applied: false` → nothing flips, the refusal prints verbatim through `textContent`;
+ 6. `await refresh()` so the numbers come from the agent's next reading rather than from the click.
+ - No optimistic colour, ever: the page does not turn a line green or red because a button was pressed. `pending` is the only state a click may create, and `aria-busy` is how it says so.
+ - A `429`/`409`/`403`/`422` prints the server's `detail` + `hint` in the dialog (`role="alert"`), leaves the dialog open so the operator can read it, and returns focus to the confirm field — the `/login` lesson about a form that eats its own error.
+2. `src/dashboards/web/pages/gateway.html`
+ - One `` with the four slots the script fills, shipped `hidden`/closed; no per-row dialogs (the same rows are patched, so one dialog is the whole surface, and a dialog per row is 33 focus targets in the tab order).
+ - Footer paragraph 3 becomes the truth and stays **one** paragraph:
+ > `the switch edits that route in its own config file, validates it with the proxy's own checker and reloads that proxy — nothing is restarted, and no route goes off unless GATEWAY_ALLOW_WRITES is set on the dashboard.`
+ - The `#gate-empty` setup block is untouched.
+3. `src/dashboards/web/static/dash.css`
+ - `#gate-switch-dialog pre` — mono, `overflow-x: auto`, `max-height` bounded, added/removed lines tinted from the **existing** tokens only (`.diff-add`/`.diff-del` deriving from `--gate-on`/`--gate-off`, the phase-30 existence pair, so no new colour enters the map and the diff reads as the same red/green the rows do);
+ - `button.gate-switch:not([aria-disabled="true"]):hover` and `cursor: pointer` — added **only** under that selector, so a writes-off switch never grows a hover affordance it cannot honour;
+ - any new transition (dialog, knob while `aria-busy`) is named in the file's one `@media (prefers-reduced-motion: reduce)` block — naming one and missing the other is the phase-18 lesson, and there is a test for it;
+ - at ≤640 px the dialog stays inside the viewport (`width: calc(100% - 2rem)` is already the shared rule) and the diff scrolls in its own box, never the document (phase 27's rule).
+4. `tests/test_api.py`
+ - `test_the_switch_is_built_and_explicitly_unwired` is **replaced** by `test_the_switch_is_wired_only_when_the_deployment_enables_writes`: with `writes_enabled: false` the served script keeps `aria-disabled="true"`, the `GATEWAY_ALLOW_WRITES` sentence, and no listener; with it true the listener exists, `aria-disabled` is gone, and the accessible name states the state and the consequence. The old test's *intent* survives: a dead-looking-live control still fails.
+ - `test_a_toggle_asks_for_a_preview_then_the_word_then_sends_once` — the served script issues `dry_run: true` before any `DANGER` send, requires the exact word, and sends exactly once per activation (no retry loop in the handler).
+ - `test_the_row_is_painted_from_the_answer_not_the_click` — no code path sets `off`/`on` other than the payload/`applied` pass; `applied: false` leaves `aria-checked` untouched.
+ - `test_the_switch_sentence_matches_the_routes_refusal` — the writes-off `title` and `api.py`'s `GATEWAY_ALLOW_WRITES` refusal are the same string, read from both files.
+ - `test_no_gateway_count_is_coloured_by_a_verdict` gains the reachable-`off` fact and keeps every assertion: the diff tints are `--gate-*`, no `.ok/.warn/.fail` or `--ok/--warn/--fail` enters the gateway section, and the warnings panel's `.warn` stays the one exception.
+ - `test_the_pipe_animation_stills_in_both_states_under_reduced_motion` extended to the new transitions (knob busy state, dialog) — and it still asserts there is **one** such block in the file.
+ - `test_the_gateway_page_is_exactly_two_connection_panels_and_a_warnings_list` and the footer-paragraph pin stay green (three paragraphs, one dialog, `` count unchanged).
+ - The orphan-`id` audit must find `#gate-switch-dialog` referenced by the script; every slot inside it is `[data-k=…]`, not an `id`.
+
+## Testing & Quality
+- Unit: the pins above; a fixture render for each arm (writes on/off, `enabled: false` from the payload, `applied: false` from the response) asserting class, `aria-checked`, `aria-busy`, `title` and the accessible name.
+- Integration: the dev server against a stub agent (the `tests/conftest.py` fake) answering `applied: true` then a payload with the row `enabled: false` — the row turns red **because of the payload**, and the second read of the switch's name says `off`.
+- Coverage: `node --check` clean; floor does not fall.
+
+## Completion Criteria
+- [ ] With `GATEWAY_ALLOW_WRITES=0` the page is indistinguishable from phase 32's: `aria-disabled`, the `GATEWAY_ALLOW_WRITES` sentence, no click effect, no hover affordance.
+- [ ] With it `=1` (and the fake agent): clicking shows the one-line diff and the `DANGER` field; the wrong word sends nothing; the right word sends once; the row's colour changes on the payload that follows and never before.
+- [ ] A stubbed `applied: false, validated: false, restored: true` leaves every row exactly as it was and prints the route's own sentence.
+- [ ] Tab order: dialog opens with focus in the confirm field, Escape closes it without a request, focus returns to the switch. At 360 px the dialog and its diff stay inside the viewport and the document scrolls no sideways pixels.
+- [ ] `uv run pytest` **100% passing**, coverage not down; `node --check` and `bash .agents/validate.sh` green.
+- [ ] README.md/AGENTS.md's `/gateway` paragraph describes the wired switch and both arms (replacing the "unwired" sentence task 05 deleted — the two must not coexist) — the phase's final pass re-checks both project-wide.
+- [ ] No behaviour change in completed work: tallies, warnings panel, charts, filters, colour semantics, and the other seven pages.
diff --git a/.agents/phases/todo/33_gateway_route_switching/07_rehearse_then_drill_on_the_live_ingress.md b/.agents/phases/todo/33_gateway_route_switching/07_rehearse_then_drill_on_the_live_ingress.md
new file mode 100644
index 0000000..313d112
--- /dev/null
+++ b/.agents/phases/todo/33_gateway_route_switching/07_rehearse_then_drill_on_the_live_ingress.md
@@ -0,0 +1,52 @@
+# Task 07 — Install the helper, prove it from both sides, and drill one named route with the operator watching
+
+**Phase:** `33_gateway_route_switching` · **Source:** AGENTS.md's rollout discipline (phases 24 and 28) applied to the one change in this repo that can take the fleet's ingress down
+**Story:** n/a
+
+## Objective
+
+`gateway` runs agent **1.4.0** with the socket-activated helper, and one route is switched off and back on **for real**, with the live ingress ending the task in the state it started in. The drill is not a formality: it is the only proof that `ReadWritePaths`, `SocketMode`, `SO_PEERCRED`, `nginx -t` and the reload all line up on a machine, which no sandbox can tell us. **If the operator is not present in the session, this task stops after step 3 and reports — that is the correct outcome, not a failure**, and ntfy is not a way to ask (it is outbound-only).
+
+## Work
+
+1. **Backups first, hashed.** On `gateway-ops` as root:
+ `cp -a /etc/haproxy /root/dashboards-33-backup-/haproxy && cp -a /etc/nginx /root/dashboards-33-backup-/nginx`, then `sha256sum` every file that the helper can edit (`haproxy.cfg`, `nginx.conf`, `conf.d/*.conf`, `stream.d/*.conf`) into the transcript. This is the restore point for every later step.
+2. **Sandbox rehearsal on the box** (writes nothing real): run the helper with `--apply` against a copy tree (`--root /tmp/dashboards-33-rehearsal`) with the *real* `nginx -t` and `haproxy -c` binaries on `PATH`, for each of the three marker arms and the `default` refusal. Record the three diffs. A checker that fails on a copied tree for path reasons is expected and is *not* the rehearsal's point — the arms and the restore byte-equality are.
+3. **Install, read-only-verified first**:
+ - re-stage `/home/ops/agent-install/` (repo `agent/host_agent.py` **1.4.0**, `deploy/install-agent.sh`, `deploy/dashboards-routectl.py`, the two unit files), leaving `*.20261023-backup` copies sudo will not execute;
+ - `systemctl cat dashboards-agent` → record its sha256 and the four security directives verbatim;
+ - `sudo /home/ops/agent-install/deploy/install-agent.sh --bind 10.1.1.27 --port 9120 --allow-writes --with-routectl` (arguments read back off the unit; **no** `--cert-bundle`, the bundle on disk is what drives the TLS lines — the phase-28 finding);
+ - the guard's diff is inspected before `--force`: the only legitimate change to the agent unit is the added `--allow-writes` in `ExecStart` — if `NoNewPrivileges`, `ProtectSystem`, `PrivateDevices`, `SystemCallFilter` or `CapabilityBoundingSet` moved, **stop** and report: the sandbox was not traded for this feature;
+ - `sudo systemctl restart dashboards-agent`; `systemctl is-active` for it and for `dashboards-routectl.socket`;
+ - reachability both ways: as `dashboards-agent`, connect to `/run/dashboards-routectl.sock` and call `list` (must answer `[]`); as any other non-root uid, connect and get `EACCES` (the mode is the first gate and the peer check is the second);
+ - read-only probes: CA-only `--status` answers **1.4.0**; the dashboard's mTLS read shows `agent_version 1.4.0`, every section intact with live numbers, `disabled: false` everywhere, and `/api/gateway/snapshot` rendering identically to phase 32's.
+4. **Preconditions for the drill — all checked, all recorded, any failure stops it:**
+ - the operator has said go, in this session, in words;
+ - `nut` is not on battery and no UPS event is in the last hour (the same "don't do the risky thing during a power event" rule the UPS commands keep);
+ - `gateway`, `host:gateway`, `disks:gateway` all `ok` and fresh; `warnings == []`;
+ - `nginx -t` and `haproxy -c -f /etc/haproxy/haproxy.cfg` pass on the box before anything is touched;
+ - `routectl list` is empty (no half-finished state from an earlier attempt);
+ - the drill target is **`iperf3-5201`** (`haproxy:5201->web.reeselink.com:5201`) — a benchmark service with no human dependency. **Never** the auth, git, alerts or file routes: not `keycloak*`, `gitea*`, `forgejo*`, `ntfy*`, `nextcloud*`, `immich*`, `brain*`, `keycloak`, or any `map` entry an operator would notice within a minute. If even `iperf3` is in doubt, the drill does not run and the task reports that instead.
+5. **The drill, in order, with the page open:**
+ 1. `dry_run` through `POST /api/gateway/route` → the diff, and the page's dialog shown;
+ 2. apply with `DANGER`; the helper answers `applied/validated/reloaded`;
+ 3. prove it four independent ways: `routectl list` names the route; the marked line is in `haproxy.cfg` with `was:`; `haproxy -c` still passes; `curl -sv --resolve :25565:127.0.0.1` (or the drill port) from the box connects and is refused/closed rather than proxied;
+ 4. the page: the row is **red** within one poll, its live count drains to `0` on its own, no other row changed, and `/api/summary`'s `gateway.disabled` is `1`;
+ 5. re-enable through the page; `routectl list` empty; `sha256sum` of every file equal to step 1's capture, byte-for-byte;
+ 6. the page green again, `disabled` back to `0`, and `journalctl -u 'dashboards-routectl@*'` showing exactly the two activations.
+6. **Abort rules, written where they can be followed:** if any step fails, restore from the step-1 backup (`cp -a` back, `haproxy -c`, reload), re-read the page, and write down what happened. Never leave a marked line behind without saying so in the transcript's first line. Never run two drills at once, never run one while the `gateway` job is stale, and never re-run an apply to "make sure" — the helper is the place idempotence lives, and the answer tells you which state you are in.
+7. `data/logs/NOTES-33-switching.md`: the hashes before and after, the unit diff that was guarded, the socket's owner/mode, both probe transcripts, the four proofs, the `journalctl` window, the screenshots' names, and — if the drill did not run — **exactly** which precondition stopped it, so the next operator can finish it deliberately.
+8. `tests/test_live_fleet.py`: `test_the_switch_round_trip_on_one_named_route`, marked `live` **and** gated on a separate `--allow-live-writes` flag, skipped by default with a reason naming the route it would touch, restoring in a `finally`. The default live suite stays read-only.
+
+## Testing & Quality
+- This task's code change is the one opt-in live test; everything else is procedure plus transcript.
+- After it: `uv run pytest`, `uv run pytest -m live --live` (green, round-trip **skipped**), `./scripts/dev-server.sh status` (ten sources `ok`).
+
+## Completion Criteria
+- [ ] `systemctl cat dashboards-agent` shows the four security directives **identical** to step 3's capture, with `--allow-writes` as the only added argument, and its pre/post sha256 pair is in the note.
+- [ ] `dashboards-routectl.socket` is `active`, owned `dashboards-agent:dashboards-agent` mode `0600`; a non-agent uid gets `EACCES`; the agent's own uid gets a JSON answer.
+- [ ] The drill's four proofs are in the transcript, plus the byte-identical `sha256sum` restore of every editable config file, and `routectl list` is empty at the end.
+- [ ] `/gateway` showed the row red and its count draining, and returned to green — screenshotted at both states.
+- [ ] `uv run pytest -m live --live` passes with the round-trip **skipped** by default; `uv run pytest -m live --live --allow-live-writes` passes too, if and only if the drill ran.
+- [ ] `data/logs/NOTES-33-switching.md` exists and its first line states the final state of the ingress (`all routes enabled`, or exactly what is off and why).
+- [ ] No repo file changed except the opt-in live test and `data/logs/`.
diff --git a/.agents/phases/todo/33_gateway_route_switching/08_docs_and_live_verify.md b/.agents/phases/todo/33_gateway_route_switching/08_docs_and_live_verify.md
new file mode 100644
index 0000000..5a59373
--- /dev/null
+++ b/.agents/phases/todo/33_gateway_route_switching/08_docs_and_live_verify.md
@@ -0,0 +1,47 @@
+# Task 08 — Docs that describe a dashboard which can change the fleet, the browser pass, the full gate
+
+**Phase:** `33_gateway_route_switching` · **Source:** AGENTS.md definition of done + the fact that this phase changed an invariant, so the documents are part of the change rather than a summary of it
+**Story:** n/a
+
+## Objective
+
+`README.md` and `AGENTS.md` describe the write path honestly — what it touches, what refuses, how to turn it off entirely, and how to recover a route by hand at 03:00 when the dashboard is the thing that is broken. Then the browser pass measures the wired page in both arms, the mobile audit re-runs, and every gate is green.
+
+## Work
+
+1. `AGENTS.md` — the full consistency pass, with these named as the passages this phase makes stale if left:
+ - **invariant 1** — two exceptions, both gated, the gate list, and the reason a typed word survives in the design (`Hiding a button is not a safety control`);
+ - `agent/host_agent.py` bullet — **1.4.0**, the marker grammar (`ROUTE_MARKER`, `split_marker`, `config_line_index`), `disabled` on every target, `POST /route` behind certificate + `--allow-writes`, the single peer call and its no-retry rule;
+ - the new deploy surface — `deploy/dashboards-routectl.py` (verbs, marker + `was:`, validate-restore-reload, never restart, the sink file, drift refusal), the two units, `--with-routectl`/`--without-routectl`, and the sentence that the agent's unit lost no security directive and gained no sudoers line;
+ - `sources/gateway.py` bullet — `enabled`, the merge rule with mixed states, the marker-aware warnings table, the `/api/summary` `disabled` field;
+ - `api.py` bullet — the two fleet writes, `/api/gateway/route`'s gate order, the fixed-shape audit events with no config text, `/api/config.gateway.writes_enabled`;
+ - `collectors.py` bullet — `post_route` and the shared revoke-before-socket rule;
+ - `config.py` paragraph + README's table — `GATEWAY_ALLOW_WRITES` (default off) and `GATEWAY_WRITE_TIMEOUT_SECONDS` (and why it exceeds the agent's own timeout);
+ - the `/gateway` UI-conventions paragraph — the switch is wired, the preview-then-`DANGER`-then-paint-from-the-answer flow, `off`'s appearance, the writes-disabled arm's sentence, the diff box scrolling in its own container;
+ - the **fleet record** — `gateway` at **1.4.0** with the helper units installed, the unit's directives re-read, the drill result and `NOTES-33-switching.md`;
+ - **gap list** — name-route switching **closed**, and the honest limits written as gaps: one admin (gap 6 unchanged, so anyone with the session can switch a route), no scheduler, no per-host kill switch, no runtime haproxy state (a hand reload cannot undo a marker), and `GATEWAY_ALLOW_WRITES` off by default means the feature is invisible on a fresh deployment until it is deliberately enabled.
+2. `README.md` + both tracked env templates — `.env.example` and `.env.dev.example` gain `GATEWAY_ALLOW_WRITES` with its default and a comment naming exactly what enabling it authorises, and `tests/test_auth_docs.py` gains the pin (the same device that keeps the auth settings declared in the templates), because a write gate no template names is a write gate nobody finds — and never a value, only the declaration. Then the operator-facing half: the `/gateway` table row (routes can be switched off **and on**), a short *Switching a route* subsection (what the dialog does, what `DANGER` means here, that the edit is persistent across reload and reboot, and the three recovery commands: `routectl list`, `routectl verify`, `routectl enable --id …` on the box), the *Enabling it* subsection (`GATEWAY_ALLOW_WRITES=1`, `--with-routectl`, the two units, how to undo everything), and the configuration table's two new rows. Also: the sentence that a route off is a **deliberate outage** and appears in the event feed, so an operator does not mistake it for an incident.
+3. `data/logs/33-switching.cjs` — Playwright pass (house shape, exit non-zero on FAIL, prints what it measured):
+ - writes-**off** arm: `aria-disabled`, the `GATEWAY_ALLOW_WRITES` sentence, a click does nothing (no request on the wire), no hover affordance;
+ - writes-**on** arm against the stubbed agent: the dialog opens with the diff and focus in the confirm field; the wrong word sends nothing; the right word sends exactly one request; the row's colour changes only after the payload says `enabled: false`; `applied: false` leaves the row untouched and prints the route's sentence; Escape closes with no request and returns focus;
+ - `off` colour contract: spine halves, tick, run, switch and diff tint all compute to the same `--gate-off` value in dark **and** light, and an `on` row is fully `--gate-on` — no fifth colour, no verdict token anywhere in the section;
+ - reduced motion: nothing animates, including the dialog and the busy knob;
+ - 360 px: the dialog and its `` stay inside the viewport, the diff scrolls in its own box, and the document scrolls zero sideways pixels;
+ - screenshots `data/logs/33-gateway-{writes-off,dialog,danger,off,off-light,refused,phone,phone-dialog}.png`, transcript `data/logs/33-switching.out`.
+4. Re-run `data/logs/27-task02-mobile-audit.cjs` (nine pages, both widths): exit 0, **0 FAIL / 0 FINDING**, tally recorded — the dialog is new markup and the audit is what catches a fact painted past a card edge.
+5. The whole gate, recorded in the transcript:
+ `uv run pytest`, `uv run pytest --cov`, `uv run pytest -m live --live`, `uv run ruff check src tests agent deploy`, `uv run pyright`, `bash .agents/validate.sh`, `uv pip list --outdated` (empty — no dependency is added by this phase, and `deploy/dashboards-routectl.py` is stdlib on a host's Python 3.10).
+6. `./scripts/dev-server.sh status` with writes **off** → ten sources `ok` and no change; with `GATEWAY_ALLOW_WRITES=1` and the fake agent → still ten `ok`, and a write through `curl` round-trips.
+
+## Testing & Quality
+- Integration: this task is the phase's proof that the documents and the shipped page agree; every completion-criteria number comes from `33-switching.out`, `NOTES-33-switching.md` or a gate's own output.
+- Coverage: floor green with the phase's new modules included; no `# pragma: no cover` added to reach it.
+
+## Completion Criteria
+- [ ] `grep -n "one exception\|exactly one write" AGENTS.md` finds nothing; invariant 1 names **two** endpoints and their gates, and the `/gateway` paragraph no longer says the switch is unwired (the two statements must not coexist).
+- [ ] `grep -n "GATEWAY_ALLOW_WRITES" README.md AGENTS.md .env.example .env.dev.example` — declared in both templates with its default and a comment saying what enabling it authorises, and documented in both documents.
+- [ ] `data/logs/33-switching.out` exits 0 with the both-arms results, the `--gate-off`/`--gate-on` equalities in both themes, the reduced-motion pass and 0 px sideways scroll at 360 px; the eight screenshots exist.
+- [ ] `data/logs/27-task02-mobile-audit.cjs` exits 0, 0 FAIL / 0 FINDING, tally recorded.
+- [ ] All five gates green, `uv pip list --outdated` empty, and the live suite green with the round-trip skipped by default.
+- [ ] A full read of `README.md` and `AGENTS.md` finds no inconsistency anywhere, including pre-existing ones, fixed in this phase's commits.
+- [ ] No behaviour change in completed work: the UPS write path and its four gates, the other five dashboards, `/settings`, `/certs`, `/login`, and every read route's payload are exactly as phases 31–32 left them.
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.err b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.md b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.md
new file mode 100644
index 0000000..a33e99a
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.md
@@ -0,0 +1,18 @@
+**Phase 31 verification complete — all 5 tasks already in `complete/`; this was the final verification pass.**
+
+Verified / changed
+- Re-ran every phase-31 artifact live and green: `verify-31-page-only.py` 6 PASS/0 FAIL; browser pass `31-route-readability.cjs` **64 PASS / 0 FAIL** (exit 0); `27-task02-mobile-audit.cjs` **371 PASS / 0 FAIL / 0 FINDING** (exit 0); rebuilt `data/logs/31-route-readability.out` as the 4-part transcript.
+- Added the 4 degradation-arm screenshots the criterion asked for but the pass lacked (`31-gateway-{unconfigured,unreachable,no-nginx,sockets-quiet}.png`) — 12 frames now, one per arm.
+- Grep criteria: no gateway connector rule uses `border-strong`; no verdict token in the gateway CSS section or `page-gateway.js` beyond the `alerts.py`-owned `.warn`; exactly 4 `addEventListener` calls (none for the switch); `routeInConfig()` returns `true`; **no `.py` under `src/dashboards/` changed**.
+
+Tests / lint (all 100% green)
+- `uv run pytest` → **1796 passed, 16 skipped**; `--cov` → **98.94%** (floor 94); `ruff check src tests agent` → All checks passed; `pyright` → 0 errors; `node --check` clean; `bash .agents/validate.sh` → **exit 0**.
+- `uv run pytest -m live --live` → **12 passed / 0 failed**; `./scripts/dev-server.sh status` → all **10 sources ok**.
+
+Completion criteria: colour (33/33 rows every segment `--gate-on`, dark `rgb(63,185,80)` + light `rgb(26,127,55)`, zero grey dashes) ✔ · inbound-first rows + filter (33/33 line 1 = `out.selectors`, line 2 = `→ host:port · kind`; `stackexpected` → **6** rows, not the overview's "five" — the capture declares 6 such routes; tallies byte-identical `10/33/16/0`, zero requests) ✔ · trunk motion truth table + `null` arm prints `n/a` never `0` + reduced-motion stills 43 paths and every knob ✔ · screenshots/transcripts ✔ · payload page-only ✔ (literal byte-diff of a live socket table can never pass; answered by the no-`.py`-diff + shape-equality proof, as recorded in the transcript) · no behaviour change elsewhere ✔.
+
+Docs: fixed 6 inconsistencies — two identifiers split across line breaks (`test_the_pipe_animation_stills_in_both_states_under_reduced_motion`, `32_gateway_resolved_target_liveness`), stale "sixteen routes" count, stale "four machines/hosts" in README **and** AGENTS (fleet is three), "three fields"→"three field types", gap-14 headline wording; updated the pass's screenshot list.
+
+Deviations: `uv pip list --outdated` shows one advisory (`starlette 1.9.0 → 1.10.0`) — not upgraded, this phase moved no dependency (rule 8 / DoD apply "if deps moved"). `TODO.md` carries two new operator disk requests, left untouched.
+
+Next pending phase: `32_gateway_resolved_target_liveness`.
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.md.status b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.validate b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.validate
new file mode 100644
index 0000000..9c940eb
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__00_phase.a1.validate
@@ -0,0 +1,71 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [ 3%]
+........................................................................ [ 7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+.......s................................................................ [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+......................................ssssssssssss...................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+..........................sss........................................... [ 99%]
+............ [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+ /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+ from starlette.testclient import TestClient as TestClient # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.8-final-0 ________________
+
+Name Stmts Miss Cover Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py 3 0 100%
+src/dashboards/__main__.py 14 1 93% 32
+src/dashboards/alerts.py 201 0 100%
+src/dashboards/api.py 499 3 99% 220, 250, 253
+src/dashboards/app.py 190 0 100%
+src/dashboards/auth.py 265 0 100%
+src/dashboards/certs.py 292 0 100%
+src/dashboards/collectors.py 216 4 98% 324, 328-329, 346
+src/dashboards/config.py 126 0 100%
+src/dashboards/debug.py 14 0 100%
+src/dashboards/poller.py 165 3 98% 192-194, 279
+src/dashboards/prom.py 112 5 96% 126, 163, 177, 180, 183
+src/dashboards/rates.py 73 0 100%
+src/dashboards/severity.py 49 0 100%
+src/dashboards/sources/__init__.py 0 0 100%
+src/dashboards/sources/disks.py 134 0 100%
+src/dashboards/sources/gateway.py 463 4 99% 518, 529, 637, 1129
+src/dashboards/sources/host.py 209 0 100%
+src/dashboards/sources/llm.py 178 1 99% 285
+src/dashboards/sources/nut.py 413 20 95% 153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py 134 0 100%
+src/dashboards/store.py 313 2 99% 553-554
+------------------------------------------------------------------
+TOTAL 4063 43 99%
+Required test coverage of 94% reached. Total coverage: 98.94%
+1796 passed, 16 skipped, 1 warning in 164.04s (0:02:44)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+ starlette 1.9.0 1.10.0 wheel
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.err b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.md b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.md
new file mode 100644
index 0000000..4d79fad
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.md
@@ -0,0 +1,16 @@
+**Implemented (task 01 — whole route is green)**
+- `dash.css` `gateway pipes`: base `.gate-link::before`/`::after`/`.gate-elbow` now `2px dashed transparent` (geometry, no colour); four new rules colour spine halves + tick from the **row's** `on`/`off` via `--gate-on`/`--gate-off`; zero `--border-strong` left in the section; header/mobile comments state decision 2 (shared spine may colour, never move).
+- `page-gateway.js`: `renderLeaf` toggles `on`/`off` on the ` ` beside the ``, same value, same pass; `leafRow()` ships no state class; `renderGroups` comment records why rows need no class pruning; header docstring restated.
+- `tests/test_api.py`: restated `test_haproxy_draws_straight_across_and_nginx_branches` (transparent base borders), extended `test_no_gateway_count_is_coloured_by_a_verdict` (connectors read the pair; `--border-strong` absent; all six connector selectors present), **new** `test_the_whole_route_takes_one_existence_class` (row+svg from one value, `transparent` base, switch `[aria-checked]` re-pinned).
+- Browser proof on the live ingress: `data/logs/31-task01-green.cjs` → `31-task01-green.out` **27 PASS / 0 FAIL** — 48 spine halves + 33 ticks + 33 runs + 33 switches all `rgb(63,185,80)` dark and `rgb(26,127,55)` light, 81 dashed segments 0 grey, `off` moves all four to red, stateless row computes `rgba(0,0,0,0)`/`stroke:none`, 360 px restored half green, 0 px sideways scroll; screenshots `31-task01-{dark,light,phone}.png`.
+
+**Verification**
+- `uv run pytest` → **1792 passed, 16 skipped**; `bash .agents/validate.sh` → exit 0, coverage **98.94%** (floor 94), ruff clean, pyright 0 errors, `node --check` clean.
+- `uv run pytest -m live --live` → **12 passed**; `./scripts/dev-server.sh status` → all **10 sources ok**; mobile audit re-run **371 PASS / 0 FAIL / 0 FINDING** (`data/logs/31-task01-mobile-audit.out`).
+- No Python changed — `git status` shows only `web/static/dash.css`, `web/static/page-gateway.js`, `tests/test_api.py`, `AGENTS.md`, `README.md` (so `/api/gateway/snapshot` is byte-identical); switch still unwired, `routeInConfig()` still `true`.
+
+**Docs**: AGENTS.md `/gateway` conventions (colour covers the whole row, motion stays on the run, `transparent` base rules, no per-width colour) and README's `/gateway` paragraph.
+
+**Decisions/deviations**: used the four explicit state rules rather than the `--gate-line` custom property (a new token would need a `:root` default for `test_no_stylesheet_rule_uses_an_undeclared_token` and would duplicate the `transparent` default); left the pre-existing `starlette 1.9.0→1.10.0` advisory untouched (phase decision 7 forbids dependency/Python changes).
+
+**Next pending task**: `31_gateway_route_readability/02_the_inbound_word_leads_the_row.md`.
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.md.status b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.validate b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.validate
new file mode 100644
index 0000000..6ed64b1
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__01_the_whole_route_is_green.a1.validate
@@ -0,0 +1,71 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [ 3%]
+........................................................................ [ 7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+...s.................................................................... [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+..................................ssssssssssss.......................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+......................sss............................................... [ 99%]
+........ [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+ /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+ from starlette.testclient import TestClient as TestClient # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.8-final-0 ________________
+
+Name Stmts Miss Cover Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py 3 0 100%
+src/dashboards/__main__.py 14 1 93% 32
+src/dashboards/alerts.py 201 0 100%
+src/dashboards/api.py 499 3 99% 220, 250, 253
+src/dashboards/app.py 190 0 100%
+src/dashboards/auth.py 265 0 100%
+src/dashboards/certs.py 292 0 100%
+src/dashboards/collectors.py 216 5 98% 323-324, 328-329, 346
+src/dashboards/config.py 126 0 100%
+src/dashboards/debug.py 14 0 100%
+src/dashboards/poller.py 165 3 98% 192-194, 279
+src/dashboards/prom.py 112 5 96% 126, 163, 177, 180, 183
+src/dashboards/rates.py 73 0 100%
+src/dashboards/severity.py 49 0 100%
+src/dashboards/sources/__init__.py 0 0 100%
+src/dashboards/sources/disks.py 134 0 100%
+src/dashboards/sources/gateway.py 463 4 99% 518, 529, 637, 1129
+src/dashboards/sources/host.py 209 0 100%
+src/dashboards/sources/llm.py 178 1 99% 285
+src/dashboards/sources/nut.py 413 20 95% 153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py 134 0 100%
+src/dashboards/store.py 313 2 99% 553-554
+------------------------------------------------------------------
+TOTAL 4063 44 99%
+Required test coverage of 94% reached. Total coverage: 98.92%
+1792 passed, 16 skipped, 1 warning in 165.46s (0:02:45)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+ starlette 1.9.0 1.10.0 wheel
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.err b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.md b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.md
new file mode 100644
index 0000000..08e7e69
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.md
@@ -0,0 +1,18 @@
+**Implemented** (task 31/02 — page-only, no Python touched)
+- `page-gateway.js`: replaced `selectorText()` with `inboundText()` (`out.selectors` joined → fallback `out.kind`, never `out.host`) and `counterpartText()` (`→ host:port · kind`); added `ARROW`/`SHARED_WHY` constants; `renderLeaf()` now writes the inbound word to `.pipe-name` (endpoint only as the null-inbound fallback, so the primary line is never empty) and the counterpart to a new `.pipe-end mono` span; `leafTitle()` carries **both ends** + kind + sharing sentence; `leafAria()` unchanged in facts, now sharing one `SHARED_WHY` string.
+- `dash.css`: new `.pipe-end` rule (11px, mono class, same truncation trio) beside `.gate-selector`; `.gate-selector` comment now scopes it to the trunk; `.pipe-name` comment restated for the new rank/gap 13.
+- `gateway.html`: footer paragraph 2 rewritten to the operator's dash sentence (still exactly 3 paragraphs); card comments above both `.gate-map`s record the reading order.
+- `tests/test_api.py`: strengthened `test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` (both ends whole in `title` *and* `aria-label`, no string-cutting in the helpers, longest-endpoint control over the live capture); new `test_the_leaf_row_leads_with_the_inbound_word` (helper sources, call sites, `GATEWAY_PAGE_FIELDS` both directions, `brain.reeseapps.com → …:443`, haproxy backend names, `default` verbatim, no empty primary line, `:80` refusal intact) + `rendered_leaf()` second-reading mirror. Negative controls confirmed both tests fail on reverted code.
+
+**Verification**: `bash .agents/validate.sh` exit 0 — `uv run pytest --cov --cov-fail-under=94` **1793 passed, 16 skipped**, coverage **98.94%**; `ruff check src tests agent` clean; `pyright` 0 errors; `node --check` clean. Live browser pass `data/logs/31-task02-inbound-row.cjs` → `31-task02-inbound-row.out`: **21/21 PASS**, 33/33 rows read inbound→counterpart, no console errors/non-GET, 0 px sideways scroll at 360 px; screenshots `31-task02-gateway-{1440,360}.png`. `27-task02-mobile-audit.cjs` re-run → exit 0, 0 FAIL / 0 FINDING (`31-task02-mobile-audit.out`). `dev-server.sh status`: all ten sources `ok`.
+
+**Docs**: README `/gateway` table row + UI-conventions paragraph and AGENTS.md table row + `/gateway` conventions paragraph now state line 1 = inbound word, line 2 = `→ host:port · kind`, both carried whole; AGENTS.md test count 1791→1793. Also corrected a stale claim in both files (haproxy's inbound word is the `backend` name, not the `server` name).
+
+**Decisions/deviations**
+- Arrow is rendered `→ host:port` (one space) rather than the task snippet's `→host:port`, matching the phase's completion-criterion rendering and the live transcript; `ARROW = '→'` stays as specified.
+- `GATEWAY_PAGE_FIELDS` already named all four `connections.out.*` paths, so I pinned the two-directional resolution in the new test + documented the second use instead of duplicating entries.
+- Task said the fleet's longest endpoint is `reeseapps-brain-of-code.reeselink.com:443`; the capture's longest is actually `reeseapps-brain-of-reese.reeselink.com:443` (42 chars) — pinned by length+family so either neighbour satisfies the control.
+- gap 13 measurement for task 05: 1440 px → 0 clipped; 360 px → 19/33 inbound and 33/33 counterpart lines ellipsised, every one keeping full text in `title` + `aria-label`.
+- Left phase 30's `data/logs/30-connection-map.cjs` untouched (its `sels` FINDING still reads `.gate-selector`, absent from leaf rows now — it still exits 0; gap 13's restatement is task 05's).
+
+**Next pending task**: `.agents/phases/todo/31_gateway_route_readability/03_the_trunk_moves_on_a_real_number.md`.
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.md.status b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.validate b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.validate
new file mode 100644
index 0000000..95fbb4a
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__02_the_inbound_word_leads_the_row.a1.validate
@@ -0,0 +1,71 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [ 3%]
+........................................................................ [ 7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+....s................................................................... [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+...................................ssssssssssss......................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+.......................sss.............................................. [ 99%]
+......... [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+ /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+ from starlette.testclient import TestClient as TestClient # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.8-final-0 ________________
+
+Name Stmts Miss Cover Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py 3 0 100%
+src/dashboards/__main__.py 14 1 93% 32
+src/dashboards/alerts.py 201 0 100%
+src/dashboards/api.py 499 3 99% 220, 250, 253
+src/dashboards/app.py 190 0 100%
+src/dashboards/auth.py 265 0 100%
+src/dashboards/certs.py 292 0 100%
+src/dashboards/collectors.py 216 5 98% 323-324, 328-329, 346
+src/dashboards/config.py 126 0 100%
+src/dashboards/debug.py 14 0 100%
+src/dashboards/poller.py 165 3 98% 192-194, 279
+src/dashboards/prom.py 112 5 96% 126, 163, 177, 180, 183
+src/dashboards/rates.py 73 0 100%
+src/dashboards/severity.py 49 0 100%
+src/dashboards/sources/__init__.py 0 0 100%
+src/dashboards/sources/disks.py 134 0 100%
+src/dashboards/sources/gateway.py 463 4 99% 518, 529, 637, 1129
+src/dashboards/sources/host.py 209 0 100%
+src/dashboards/sources/llm.py 178 1 99% 285
+src/dashboards/sources/nut.py 413 20 95% 153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py 134 0 100%
+src/dashboards/store.py 313 2 99% 553-554
+------------------------------------------------------------------
+TOTAL 4063 44 99%
+Required test coverage of 94% reached. Total coverage: 98.92%
+1793 passed, 16 skipped, 1 warning in 179.17s (0:02:59)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+ starlette 1.9.0 1.10.0 wheel
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.err b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.md b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.md
new file mode 100644
index 0000000..6095cd2
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.md
@@ -0,0 +1,16 @@
+**Task 03 complete — all green.**
+
+**Implemented**
+- `page-gateway.js`: `buildPipe(trunk = false)` adds `pipe pipe-trunk` (one builder, one class shape for both lines); `groupElement()` appends the stub as `.gate-trunk`'s last child via DOM (`createElementNS`, commented); new `trunkAria(group)` — three pinned sentences, indexes only `listeners[].connections`; `renderTrunk()` patches `hidden`/`on`/`off`/`live`/`still` + `role="img"` + `aria-label`/`title`, with `measured` separating `0` from `null`; file-header bullet now says motion has two payload paths (leaf `connections[]`, trunk `listeners[]`) and never implies a leaf.
+- `dash.css`: `.pipe-trunk { width: 26px; height: 10px; flex: none; margin-inline-start: auto; }` — no new token, no new keyframe; motion/colour still come from `.pipe.on`/`.pipe.live`.
+- `tests/test_api.py`: new `test_the_trunk_pipe_is_an_accessible_image_of_its_port` (+ `rendered_trunk` mirror) covering both arms over the capture and over real `sockets_silent`; `test_a_pipe_moves_only_while_it_carries_a_connection` restated for the two payload paths with "trunk ≠ leaf" absences; reduced-motion pin now demands descendant selectors and forbids `.pipe-trunk` styling motion; the accessible-image pin now asserts two pipe builders, one `createElementNS`, `role`+`aria`+`title` on both.
+- Browser pass `data/logs/31-task03-trunk.cjs` → `31-task03-trunk.out` (35 PASS / 0 FAIL, exit 0) with `31-task03-trunk-{1440,360,light,sockets-quiet,reduced}.png`: `:443`/`:4443` run, the 8 idle ports sit still, all green `--gate-on` in dark *and* light, same colour either way; every `aria-label` is one of the three sentences and names no endpoint; socket-quiet arm is green, motionless, `n/a`, **0** occurrences of `0 live`; stub flush at the trunk's right edge (= the spine x) even on wrapped trunks, no clipping, 0 px sideways scroll at 360 px; reduced motion stills every stub with no `.pipe-trunk` rule.
+- `data/logs/27-task02-mobile-audit.cjs` re-run: **371 PASS / 0 FAIL / 0 FINDING**, exit 0 (`data/logs/31-task03-mobile-audit.out`).
+
+**Commands / results:** `uv run pytest` → **1794 passed, 16 skipped**; `uv run pytest --cov --cov-fail-under=94` → **98.94%** (floor met, not down); `uv run ruff check src tests agent` → all checks passed; `uv run pyright` → 0 errors; `node --check src/dashboards/web/static/page-gateway.js` → clean; `bash .agents/validate.sh` → **exit 0**. `git diff` touches **no** Python under `src/dashboards/` except `web/`; `routeInConfig()` still returns `true`; no switch listener.
+
+**Docs:** README `/gateway` conventions paragraph and AGENTS.md (the groups paragraph + the `live`/`still` bullet) now state the trunk's own line, its port-only claim and its three sentences.
+
+**Deviations (2, both measured):** added `margin-inline-start: auto` to `.pipe-trunk` — without it a trunk whose text wraps (`:80` live) dropped the dash alone at the trunk's far-left, stranded from the spine; it costs ~6 px of slack on one-line trunks. `aria-label` is set with `setAttribute` (the sketch's `setTxt` writes `textContent`, which an `` has no use for). Left alone: `starlette 1.9.0 → 1.10.0` advisory (pre-existing, `validate.sh` treats it as advisory; this task moves no dependencies).
+
+**Next pending task:** `.agents/phases/todo/31_gateway_route_readability/04_find_a_domain.md`
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.md.status b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.validate b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.validate
new file mode 100644
index 0000000..81135fc
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__03_the_trunk_moves_on_a_real_number.a1.validate
@@ -0,0 +1,71 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [ 3%]
+........................................................................ [ 7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+.....s.................................................................. [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+....................................ssssssssssss........................ [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+........................sss............................................. [ 99%]
+.......... [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+ /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+ from starlette.testclient import TestClient as TestClient # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.8-final-0 ________________
+
+Name Stmts Miss Cover Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py 3 0 100%
+src/dashboards/__main__.py 14 1 93% 32
+src/dashboards/alerts.py 201 0 100%
+src/dashboards/api.py 499 3 99% 220, 250, 253
+src/dashboards/app.py 190 0 100%
+src/dashboards/auth.py 265 0 100%
+src/dashboards/certs.py 292 0 100%
+src/dashboards/collectors.py 216 5 98% 323-324, 328-329, 346
+src/dashboards/config.py 126 0 100%
+src/dashboards/debug.py 14 0 100%
+src/dashboards/poller.py 165 3 98% 192-194, 279
+src/dashboards/prom.py 112 5 96% 126, 163, 177, 180, 183
+src/dashboards/rates.py 73 0 100%
+src/dashboards/severity.py 49 0 100%
+src/dashboards/sources/__init__.py 0 0 100%
+src/dashboards/sources/disks.py 134 0 100%
+src/dashboards/sources/gateway.py 463 4 99% 518, 529, 637, 1129
+src/dashboards/sources/host.py 209 0 100%
+src/dashboards/sources/llm.py 178 1 99% 285
+src/dashboards/sources/nut.py 413 20 95% 153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py 134 0 100%
+src/dashboards/store.py 313 2 99% 553-554
+------------------------------------------------------------------
+TOTAL 4063 44 99%
+Required test coverage of 94% reached. Total coverage: 98.92%
+1794 passed, 16 skipped, 1 warning in 165.70s (0:02:45)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+ starlette 1.9.0 1.10.0 wheel
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.err b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md
new file mode 100644
index 0000000..8cbfb04
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md
@@ -0,0 +1,26 @@
+**Phase 31 task 04 (`04_find_a_domain.md`) is complete and green.**
+
+## What shipped
+
+| File | Change |
+|---|---|
+| `src/dashboards/web/pages/gateway.html` | `#gate-filter` (`type="search"`, `autocomplete="off"`, `spellcheck="false"`, `aria-label`) + `#gate-filter-count` chip in the *Connection map* head; `[data-k="no-match"]` sentence in each panel; the **fourth** footer paragraph |
+| `src/dashboards/web/static/dash.css` | `input[type="search"]` joined the shared field rule; `.gate-filter { max-width: 18rem; min-width: 0 }` + `width: 100%` at ≤640px; no `:hover`/`cursor`/`transition`, no new token |
+| `src/dashboards/web/static/page-gateway.js` | `state.filter`/`state.row`; `haystack()` / `trunkHaystack()` / `leafShown` / `trunkShown`; `renderPanels()` (the one repaint the poll, the keystroke and `Escape` all share); `li.hidden` by index in the patch pass; per-panel no-match; `N of M routes` chip |
+| `tests/test_api.py` | `test_the_filter_narrows_the_map_without_asking_anything`, `test_the_filter_field_is_markup_the_sheet_and_nobody_else_uses`; the switch pin's `addEventListener` set became an allow-list that still forbids `click`; footer pin 3 → 4 |
+| `README.md` / `AGENTS.md` | the filter named in both `/gateway` rows and paragraphs, the refusal to group/sort/colour by suffix, footer=4, the four real bindings, test count 1791 → 1796 |
+
+## Verification
+
+- `bash .agents/validate.sh` → **EXIT=0**: **1796 passed, 16 skipped**, coverage **98.94%** (floor 94), ruff clean, pyright 0 errors, `node --check` clean, hygiene clean. Only advisory: `starlette 1.9.0 → 1.10.0` (pre-existing; this task moves no dependency).
+- `data/logs/31-task04-filter.cjs` → `31-task04-filter.out` **34 PASS / 0 FAIL** on the live ingress (33 routes): `stackexpected` → 6 of 33 with only `nginx:443` + `haproxy:2000` standing; case-insensitive; tallies `10 / 33 / 12 / 0` identical either side of every keystroke; **zero** requests across five keystroke states; `Escape` restores all 33; a client address keeps `:443`'s whole 18-leaf fan-out; `no-such-domain-anywhere` hides 10/10 groups and prints the sentence in both panels; the same filtered view after a real 30 s poll; 360 px → 320 px field, **0 px** sideways scroll. Screenshots `31-task04-filter-{stackexpected,no-match,cleared,360}.png`.
+- `data/logs/27-task02-mobile-audit.cjs` → `31-task04-mobile-audit.out`: **371 PASS / 0 FAIL / 0 FINDING**, 10 skips, exit 0.
+- Report written: `.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md` (+ `.status` = `ok`, + `.a1.validate`).
+- Dev server is up; `/api/gateway/snapshot` untouched — no Python changed (`git diff` under `src/dashboards/` is `web/` only).
+
+## Two things I need your answer on
+
+1. **Phase bookkeeping** (rule 4 — I won't edit `.agents/phases/todo/` unprompted): tick the Completion-Criteria boxes in `04_find_a_domain.md` and move it to `.agents/phases/complete/31_gateway_route_readability/` like tasks 01–03, tick only, or leave the phase tree alone?
+2. **Commit?** HEAD is still `phase: 30_gateway_connection_map`, so phase 31 tasks 01–04 are all uncommitted. Options: leave it, one phase-31-so-far commit, or task 04 only (all with `--no-gpg-sign` + `LLM-Generated: true`).
+
+Next in the phase is `05_docs_and_live_verify.md` (the project-wide README/AGENTS pass, gap 13's re-measurement with the new row + filter, and the read-only live check).
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md.status b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.validate b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.validate
new file mode 100644
index 0000000..b656ce8
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__04_find_a_domain.a1.validate
@@ -0,0 +1,71 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [ 3%]
+........................................................................ [ 7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+.......s................................................................ [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+......................................ssssssssssss...................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+..........................sss........................................... [ 99%]
+............ [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+ /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+ from starlette.testclient import TestClient as TestClient # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.8-final-0 ________________
+
+Name Stmts Miss Cover Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py 3 0 100%
+src/dashboards/__main__.py 14 1 93% 32
+src/dashboards/alerts.py 201 0 100%
+src/dashboards/api.py 499 3 99% 220, 250, 253
+src/dashboards/app.py 190 0 100%
+src/dashboards/auth.py 265 0 100%
+src/dashboards/certs.py 292 0 100%
+src/dashboards/collectors.py 216 4 98% 324, 328-329, 346
+src/dashboards/config.py 126 0 100%
+src/dashboards/debug.py 14 0 100%
+src/dashboards/poller.py 165 3 98% 192-194, 279
+src/dashboards/prom.py 112 5 96% 126, 163, 177, 180, 183
+src/dashboards/rates.py 73 0 100%
+src/dashboards/severity.py 49 0 100%
+src/dashboards/sources/__init__.py 0 0 100%
+src/dashboards/sources/disks.py 134 0 100%
+src/dashboards/sources/gateway.py 463 4 99% 518, 529, 637, 1129
+src/dashboards/sources/host.py 209 0 100%
+src/dashboards/sources/llm.py 178 1 99% 285
+src/dashboards/sources/nut.py 413 20 95% 153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py 134 0 100%
+src/dashboards/store.py 313 2 99% 553-554
+------------------------------------------------------------------
+TOTAL 4063 43 99%
+Required test coverage of 94% reached. Total coverage: 98.94%
+1796 passed, 16 skipped, 1 warning in 169.82s (0:02:49)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+ starlette 1.9.0 1.10.0 wheel
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.err b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.md b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.md
new file mode 100644
index 0000000..7b77a3c
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.md
@@ -0,0 +1,12 @@
+Phase 31 task 05 is complete. Final state:
+
+**Implemented**
+- `data/logs/31-route-readability.cjs` — read-only live browser pass, **64 checks / 0 FAIL**: computed `--gate-on` on every segment of all 33 rows in **both** themes (`rgb(63,185,80)` / `rgb(26,127,55)`) with **no** dashed border computing `--border-strong`; gap‑13 clip counts at 1440 px (0/33 + 0/33, 361 px column) and 360 px (19/33 + 33/33, 139 px) with 33/33 rows carrying both ends whole; the trunk truth table plus a deterministic arm (7 sockets on `:443`, every leaf count removed → trunk moves, 0/18 leaves do); filter = **zero requests** with byte-identical tallies; reduced motion stills 43 paths + every knob; all degradation arms; 0 px sideways scroll at both widths; **zero non-GET requests**.
+- `data/logs/verify-31-page-only.py` (6/0) — the payload half, explained at the head of the transcript: a literal before/after byte diff of a live socket snapshot can never pass, so it proves the guarded question instead (no `.py` differs from the phase‑30 commit; 571 leaf paths with 0 non-volatile differences across a real poll; key set equal to `30-connection-map.out`).
+- Transcript `data/logs/31-route-readability.out` (4 parts, 222 lines) + 8 screenshots + `31-task05-mobile-audit.out` (audit **371 PASS / 0 FAIL / 0 FINDING**, exit 0).
+- **Real defect found and fixed**: `svg.title = aria` assigned a property `SVGElement` does not reflect — no tooltip ever painted. Now `setAttribute('title', aria)` (leaf + trunk), pinned in `tests/test_api.py`.
+- Docs: AGENTS `/gateway` paragraph (phase‑31 framing, measurement paragraph, dash→phase 32, `setAttribute`), gap 13 restated with the measured numbers, new gaps **14/15** (one line each for `32_gateway_resolved_target_liveness` and `33_gateway_route_switching`); README dash/what-runs-today paragraph (**agent 1.2.0**, no resolution, no switching); `gateway.html` footer comment three→four; stale "17-row fan-out" counts corrected to 18.
+
+**Results**: `uv run pytest` **1796 passed, 16 skipped**, coverage **98.92%** (floor 94) · `ruff` **All checks passed** · `pyright` **0 errors** · `node --check web/static/*.js` clean · `bash .agents/validate.sh` **exit 0** · live suite **12 passed, 0 failed** · dev server restarted, all **10 sources ok**.
+
+**Notes/deviations**: `validate.sh` prints one advisory (`starlette 1.9.0 → 1.10.0`) — not upgraded, this phase touched no dependency (rule 8 applies to dependency changes); `NOTES.md` left empty (this project's log is AGENTS.md + `data/logs/`); the phase dir stays in `todo/` for the harness and the task file is unmodified. Next pending: none in phase 31 — the harness may move it to `complete/`, after which phase 32 is the next work item.
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.md.status b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.validate b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.validate
new file mode 100644
index 0000000..2eeb160
--- /dev/null
+++ b/.agents/reports/31_gateway_route_readability/31_gateway_route_readability__05_docs_and_live_verify.a1.validate
@@ -0,0 +1,71 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [ 3%]
+........................................................................ [ 7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+.......s................................................................ [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+......................................ssssssssssss...................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+..........................sss........................................... [ 99%]
+............ [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+ /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+ from starlette.testclient import TestClient as TestClient # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.8-final-0 ________________
+
+Name Stmts Miss Cover Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py 3 0 100%
+src/dashboards/__main__.py 14 1 93% 32
+src/dashboards/alerts.py 201 0 100%
+src/dashboards/api.py 499 3 99% 220, 250, 253
+src/dashboards/app.py 190 0 100%
+src/dashboards/auth.py 265 0 100%
+src/dashboards/certs.py 292 0 100%
+src/dashboards/collectors.py 216 4 98% 324, 328-329, 346
+src/dashboards/config.py 126 0 100%
+src/dashboards/debug.py 14 0 100%
+src/dashboards/poller.py 165 3 98% 192-194, 279
+src/dashboards/prom.py 112 5 96% 126, 163, 177, 180, 183
+src/dashboards/rates.py 73 0 100%
+src/dashboards/severity.py 49 0 100%
+src/dashboards/sources/__init__.py 0 0 100%
+src/dashboards/sources/disks.py 134 0 100%
+src/dashboards/sources/gateway.py 463 4 99% 518, 529, 637, 1129
+src/dashboards/sources/host.py 209 0 100%
+src/dashboards/sources/llm.py 178 1 99% 285
+src/dashboards/sources/nut.py 413 20 95% 153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py 134 0 100%
+src/dashboards/store.py 313 2 99% 553-554
+------------------------------------------------------------------
+TOTAL 4063 43 99%
+Required test coverage of 94% reached. Total coverage: 98.94%
+1796 passed, 16 skipped, 1 warning in 167.52s (0:02:47)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+ starlette 1.9.0 1.10.0 wheel
diff --git a/AGENTS.md b/AGENTS.md
index 5c5689f..c058c36 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -29,7 +29,7 @@ file — plus an overview page that says which of the five you need:
| `/disks` | Are any of my physical disks failing, and which one — health, temp, hours, wear | the same agents, `smartctl -i -A -H` per whole drive (never a partition) |
| `/llm` | Tokens/sec, active sessions, queue depth, KV pressure, latency percentiles | gufo `/metrics` + `/slots`, vLLM `/metrics` |
| `/ups` | Battery health, runtime left, power events, battery-test buttons | NUT `upsd` (our own wire-protocol client; 3051 here, not 3493) |
-| `/gateway` | Which domains come in on which port, and where each one goes — **two connection tables, one per proxy config file** (`nginx`, then `haproxy`), a trunk per bound port with its configured endpoints branching off it, each line carrying the config's own word for the route and its live socket count | the same agent (1.2.0) on the one host `GATEWAY_HOST` names: its `haproxy` + `nginx` config sections joined to its `/proc/net/tcp{,6}` sockets |
+| `/gateway` | Which domains come in on which port, and where each one goes — **two connection tables, one per proxy config file** (`nginx`, then `haproxy`), a trunk per bound port with its configured routes branching off it, each line reading the config's own **inbound** word (`server_name`, `map` key, `backend` name) over the counterpart it routes to, plus its live socket count, with one filter box above the map that hides the routes whose own labels do not contain what was typed | the same agent (1.2.0) on the one host `GATEWAY_HOST` names: its `haproxy` + `nginx` config sections joined to its `/proc/net/tcp{,6}` sockets |
History is a first-class feature, not a sparkline afterthought: every number worth graphing
is stored, rolled up (raw → 1m → 1h), and served from `/api/*/history`.
@@ -373,8 +373,8 @@ Responsibilities, one line each:
30 s, `GATEWAY_TIMEOUT_SECONDS` 10 s, health and events under the dashboard name `gateway` — but
**one** job rather than one per host (the `nut` shape), dialling the `HOST_TARGETS` entry
`GATEWAY_HOST` names with its `label` set to that host's name, because the page is about the single
- ingress and a record per machine would ask four hosts a question only one can answer. It exists
- only when that name is a target: an unconfigured source has no task that could look red
+ ingress and a record per machine would ask every host a question only one of them can answer. It exists only
+ when that name is a target: an unconfigured source has no task that could look red
(invariant 3), and it is handed no `RateEstimator` because a count is not a rate (rule 2).
The job list is built once (`app.build_hub()`) because it is wired twice — production and
the injected-store test path — and two hand-written copies drifting is how a source ends up
@@ -1616,7 +1616,7 @@ uv run python scripts/dev-certs-export.py --url http://127.0.0.1:8090 \
# GET /api/certs//bundle and writes
# data/certs/.bundle at 0600 — mints nothing
-uv run pytest # hermetic: 1791 passed + 16 skipped (12 live,
+uv run pytest # hermetic: 1796 passed + 16 skipped (12 live,
# 4 store_perf), no network
uv run pytest --cov # coverage gate (98.9%; floor 94%)
uv run pytest -m live --live # opt-in: real fleet / engines / upsd
@@ -2158,7 +2158,8 @@ charge float jitters every `NUT_INTERVAL_SECONDS`, and rebuilding the `` on
an accessible name for a difference no eye can see.
**The `/gateway` page is the config's own tree, and a line's only claim is a count** (phase 29;
-joined differently by phase 30 task 02; laid out as trunk→leaf panels by phase 30 task 04): **exactly
+joined differently by phase 30 task 02; laid out as trunk→leaf panels by phase 30 task 04; made
+readable — whole-row colour, inbound-first rows, a moving trunk, a filter — by phase 31): **exactly
two panels**, one per config file, in the order `nginx` then `haproxy` (`GATEWAY_CARD_KEYS`), each
shipping `hidden` and appearing on the poll that has rows for it — a gateway with no nginx in it
spends no panel saying so, and a section that did not answer at all is the page's one `why` line
@@ -2169,10 +2170,37 @@ the left-over of a rule the join stopped applying.
Inside a panel the rows are **groups** (`groupsFor()` → `renderGroups()` → `renderTrunk()` +
`renderLeaves()`): a *trunk* is one port that file binds (`:`, its live count, up to
-`MAX_CLIENTS` client addresses, and its `server_name` count with the whole list on `title`), and the
-*leaves* hanging off it are the endpoints that port names, each with the config's own word for the
-route above it (a haproxy `server` name, a vhost's `server_name`, a stream `map` key) and its own
-`metric`. The page draws what the config declares and nothing else: the deleted `0`-padding
+`MAX_CLIENTS` client addresses, its `server_name` count with the whole list on `title`, and — since
+phase 31 task 03 — a **short `.pipe.pipe-trunk` of its own**, appended through the DOM as the trunk's
+last child because an `` needs `createElementNS` and cannot come out of `groupElement()`'s static
+`innerHTML` template), and the *leaves* hanging off it are the routes that port's config declares,
+each with its own `metric`. That stub is the port's live count drawn as a line: `renderTrunk` puts
+`live` on it when `listeners[].connections >= 1`, `still` when it is `0` **or** when it is `null` —
+never `live` for an unknown, and never a `0` in `.pipe-count` for one either — and `on` always, because
+`listeners[]` contains only ports a config names, so the row existing *is* the existence fact. Its
+claim is **the port and never a leaf**: `trunkAria()` writes
+`:4443 — 9 connections are open on this port right now` / `… no connections are open …` /
+`… connections on this port are unknown: the socket table did not answer` into both `aria-label` and
+`title` — the latter with `setAttribute`, because `title` is a reflected IDL attribute of
+`HTMLElement` and **not** of `SVGElement`, so `svg.title = …` is a JavaScript property no tooltip ever
+reads (task 05's browser pass found the served code doing exactly that) — and it indexes nothing but
+`listeners[].connections`: no `endpointText`, no `out.*`, no client address, because attributing one
+port's sockets to one of the routes hanging under it is a claim `sources/gateway.py` does not make.
+`margin-inline-start: auto` on `.pipe-trunk` is measured, not polish: the trunk wraps, and
+`.pipe-count`'s own auto margin flushes only the item that *starts* a
+line, so without it a two-line trunk (`:80` on the live ingress) dropped the dash alone at the far
+left — ink stranded on the opposite side of the trunk from the spine.
+**A leaf reads inbound first** (phase 31 task 02, correcting phase 30's rank): line 1 is
+`.pipe-name` and carries the config's word for **who reaches** the endpoint — a vhost's
+`server_name`, a stream `map` key (the literal `default` verbatim), or a haproxy `backend` name —
+from `inboundText()`, which joins **every** `out.selectors` entry, falls back to `out.kind`, and
+never to `out.host`; line 2 is `.pipe-end` and carries `counterpartText()`'s
+`→ host:port · kind`, the counterpart it flows to. Both lines are mono so a fan-out of eighteen rows reads
+down its columns, `.pipe-name` stays the primary line of its row for the trunk too (a trunk prints
+its port there), and neither helper cuts a string: CSS clips, and `leafTitle()` / `leafAria()` carry
+**both ends whole** (gap 13). Phase 30 had the two reversed, which buried the domain the operator
+types into a browser under the address they never type. The page draws what the config declares and
+nothing else: the deleted `0`-padding
(listeners with no connection, endpoints no line reaches) is gone because a group *is* a listener and
an unrendered endpoint has no row to sit in. **A trunk whose config names no target is a fact and not
a gap in the drawing** — this fleet's nginx `:80` is a `return 301`, so its leaf list renders the
@@ -2181,7 +2209,8 @@ for it; `sources/gateway.py` refuses to warn about that shape for the same reaso
on the port, and rows on the connection's own `id`, in per-panel `Map`s (`state.groups`,
`state.rows`):
built once, patched afterwards, reordered with `appendChild` of the existing node and pruned once per
-panel by id, because rebuilding a 17-row fan-out every 30 s re-announces all of it to assistive tech
+panel by id, because rebuilding a fan-out the size of this ingress's `:443` every 30 s re-announces
+all of it to assistive tech
for a difference of one connection (the `/llm` slot-grid rule). `pruneCards()` wiping a panel's whole
map is the only bulk clear, for the case where the family itself left the payload.
@@ -2191,20 +2220,44 @@ quiet prints `n/a` (`setTxt`'s own word), while a **leaf** whose endpoint the co
**name** prints an em dash (`NO_COUNT`) whose `title` says `connections not attributed — the config
writes a name and nothing here resolves names`. That is the normal look of 31 of this ingress's 33
lines, and a column of `n/a` would be twelve identical words competing with the page's one footnote.
+The footer's second paragraph is the same sentence in the operator's terms rather than the join's —
+*a dash means the endpoint is written in the config as a name; the page matches sockets by address and
+resolves nothing, so this route is drawn but not counted* — because a column of dashes needs one
+explanation on the page and not thirty-two on the rows, and because it is a **name** that is the reason
+and not a fault. `32_gateway_resolved_target_liveness` is what removes the reason; until then the dash
+stays unexplained-looking by design rather than borrowing the trunk's `n/a` word.
The line itself is hand-rolled SVG (`role="img"` + an `aria-label` naming the inbound port, the
-endpoint, the selector and the count) and it carries **two independent class pairs** (phase 30 task
-05), because the operator's green and the socket count are two different facts:
+endpoint, the selector and the count) and the row carries **two independent class pairs** (phase 30
+task 05, moved onto the `` by phase 31 task 01), because the operator's green and the socket count
+are two different facts:
-* `live` / `still` — "≥ 1 ESTABLISHED socket on this pipe right now" — decides **motion only**. One
- `pipe-flow` keyframe whose sole property is `stroke-dashoffset`; the live rule declares no `stroke`,
- so a busy line and a resting line are the same colour and motion can never become a verdict.
-* `on` / `off` — "a proxy config declares this route" — decides **stroke only**, through the sheet's
- own existence pair `--gate-on` / `--gate-off` (declared once in `:root` as a substitution of the
- theme colours, so both themes follow and no gateway rule names `--ok`). `routeInConfig()` answers
- `true` unconditionally, which is honest rather than a stub: `connections[]` **is** the config's
- declaration list, so `off` is the styled seam the write phase will fill and never a second state in
- use. The base `.pipe-path` declares no `stroke` at all, which is what makes the state class the only
- way a colour can arrive.
+* `live` / `still` — "≥ 1 ESTABLISHED socket on this pipe right now" — decides **motion only**, and it
+ stays on the `` alone. One `pipe-flow` keyframe whose sole property is `stroke-dashoffset`; the
+ live rule declares no `stroke`, so a busy line and a resting line are the same colour and motion can
+ never become a verdict. Motion may not spread: the spine segment between two rows is **shared** by
+ both leaves, so a dash travelling down it could not be attributed to one route, and animating it
+ would put a per-route claim on a per-list structure. There are **two** moving pipes and they read two
+ different payload paths (phase 31 task 03): a leaf's run from `connections[].connections` and a
+ trunk's stub from `listeners[].connections`. One `.pipe` component serves both — `buildPipe(trunk)`
+ adds `pipe-trunk` and nothing else — which is also why the file's single
+ `@media (prefers-reduced-motion: reduce)` block stills the stub without naming it: the stilling rules
+ are descendant selectors (`.pipe.live .pipe-path`), and
+ `test_the_pipe_animation_stills_in_both_states_under_reduced_motion` pins that no `.pipe-trunk` rule
+ may style `animation`/`transition` itself and quietly step outside that block.
+* `on` / `off` — "a proxy config declares this route" — decides **colour for the whole row**, through
+ the sheet's own existence pair `--gate-on` / `--gate-off` (declared once in `:root` as a substitution
+ of the theme colours, so both themes follow and no gateway rule names `--ok`). `renderLeaf` toggles
+ it on the `` **and** the `` off the same value in the same pass, and four rules carry it to
+ the two spine halves and the tick, so a route is green from its trunk to its endpoint — phase 30
+ coloured `.pipe-path` only and the operator read that as two thirds of every route being inactive
+ (`test_the_whole_route_takes_one_existence_class` pins the row class, the four connector rules and
+ that no gateway rule names the structure token any more). `routeInConfig()` answers `true`
+ unconditionally, which is honest rather than a stub: `connections[]` **is** the config's declaration
+ list, so `off` is the styled seam the write phase will fill and never a second state in use. Colour
+ still only ever *arrives* from a state class: the base `.pipe-path` declares no `stroke` and the base
+ `.gate-link::before` / `::after` / `.gate-elbow` rules declare their border `transparent` — an SVG's
+ default stroke is `none` for free, a border's default colour is `currentColor`, so "a row built and
+ never rendered draws nothing" has to be written down for a border.
So the page is **green because the route exists**, never because a number is good: `severity.py` has
no `gateway.*` row, the payload carries no `severity` at any depth, and
@@ -2217,18 +2270,23 @@ one of them off) and coloured from the same existence pair, carrying a full acce
(`endpoint, reached by , in the nginx config, on`) because a colour cannot say that to a
screen reader. It is `aria-disabled="true"` — **never** the `disabled` attribute, which would take the
reading out of the a11y tree — with a `title` naming the missing write path, no listener (the file's
-only `addEventListener` calls are the charts `toggle` and `DOMContentLoaded`) and no `:hover` or
-`cursor: pointer` anywhere in the map, because invariant 1 means no browser can disable a route:
+`addEventListener` calls are exactly four — the charts' `toggle`, `DOMContentLoaded`, and the filter's
+`input`/`keydown` — and `test_the_switch_is_built_and_explicitly_unwired` pins that list as an
+allow-list whose missing member is the point: **no `click` is bound anywhere on this page**) and no
+`:hover` or `cursor: pointer` anywhere in the map, because invariant 1 means no browser can disable a
+route:
`haproxy.cfg` and the nginx `server` block are the only switches on this fleet. The one `transition`
is the knob's, and the reduced-motion block names it beside both pipe states.
-The branch is four CSS rules and no JavaScript: each `.gate-link` carries its own upper and lower half
-of the spine at the gutter's left edge (`::before` / `::after`, each reaching half a leaf gap past its
-row so consecutive halves meet), the first and last rows drop theirs so the spine starts at the first
-branch and stops at the last with no mask, no measured height and no background-coloured eraser —
-which is also why it stays right on the poll that adds a leaf — and `.gate-group.solo`, set by the
-script from the group's own leaf count, takes the vertical away so a one-route port runs **straight
-across** (every haproxy frontend here). `.gate-group { column-gap: 0 }` is what makes the trunk's
+The branch is four CSS rules of geometry plus four of colour, and no JavaScript: each `.gate-link`
+carries its own upper and lower half of the spine at the gutter's left edge (`::before` / `::after`,
+each reaching half a leaf gap past its row so consecutive halves meet), the first and last rows drop
+theirs so the spine starts at the first branch and stops at the last with no mask, no measured height
+and no background-coloured eraser — which is also why it stays right on the poll that adds a leaf — and
+`.gate-group.solo`, set by the script from the group's own leaf count, takes the vertical away so a
+one-route port runs **straight across** (every haproxy frontend here). The ≤640px block restates the
+reaching half's geometry and **no colour**, because a per-width copy of the existence pair is how a
+pair drifts from its theme. `.gate-group { column-gap: 0 }` is what makes the trunk's
right edge and the spine the same x, so each tick starts *at* its trunk, and at ≤640px the stacked
trunk is reconnected by bringing the first row's upper half back at `top: calc(var(--gate-row-gap) * -1)`.
@@ -2250,9 +2308,80 @@ and the legend names pipes because the panel heading already says which config f
degradation arm uses the payload's own words — the `why` sentence for a pre-1.2.0/`--no-proxy` agent or
a silent section, the `unreachable` dim for a host that has never answered, and `#gate-empty` (naming
`GATEWAY_HOST` and agent **1.2.0**) for `404 {configured: false}` — and a failed poll re-draws nothing,
-so the last topology stays on screen. The footer is **three** paragraphs and no more: why a line is
-drawn and what its motion means; why a **name** endpoint carries no number; and that the switch is not
-wired. The layout is three load-bearing declarations (`minmax(0, 9.5rem) minmax(0, 1fr)` per group so
+so the last topology stays on screen. The footer is **four** paragraphs and no more: why a line is
+drawn and what its motion means; why a **name** endpoint carries no number; that the switch is not
+wired; and what the filter box does to the map and what it leaves alone — the sentence is there because
+the field is the one control that could be read as a query, and it is not one.
+
+**`#gate-filter` is an eye, not a query** (phase 31 task 04). 33 routes in config order is not a
+lookup, and the operator's question is always about one domain, so one field above the panels hides the
+rows whose **own payload text** does not contain what was typed: `in.port`, `out.host`, `out.name`,
+`out.kind` and every `out.selectors` entry for a route (`haystack()`), `:${port}` plus
+`listeners[].domains` and `.clients` for a trunk (`trunkHaystack()`). Nothing else is readable and
+nothing else is matched — no DNS, no re-ranking, no rule about `.reeselink.com`, and no page-level
+split by domain suffix, because "`reeseapps.com` vs `stackexpected.com`" is a fact neither config file
+states and grouping by it would be inventing a taxonomy the ingress never declared (rule 2); the
+operator types the suffix and the page hides the rest. A **trunk** that matches keeps its whole
+fan-out: typing `4443` asks for the port, and its routes are the answer. Visibility is applied inside
+the patch pass (`renderLeaves` sets `li.hidden` by index into `group.connections`, `renderGroups` sets
+`el.hidden` and the panel's `[data-k="no-match"]`), so a poll cannot undo the filter, a hidden row
+keeps its identity and its ``, and only the *config* removing a route ever deletes a node. The
+repaint is `renderPanels(state.snapshot, state.row)` — **no** `fetchJSON` and no `refresh()` on the
+filter path, which is what the type of the feature is (`refresh()` would add a history pair per
+keystroke and change nothing), `Escape` clears the field because a filter you cannot leave with the
+keyboard is a trap on a page whose other shortcuts are all keys, `#gate-filter-count` reads
+`N of M routes` (leaf routes, both panels, and hidden while the field is empty), and
+`renderHeader()`/`renderWarnings()` hold no reference to `state.filter` at all: `ports`,
+`connections`, `live` and `warnings` describe the ingress, not the operator's current view of it, and
+the warnings panel is a different claim rather than a shorter version of this one. The field is the
+page's own markup wearing the sheet's shared field skin (`input[type="search"]` joined the
+`input[type="text"], input[type="password"]` rule — the only three field types the app has), it is
+`autocomplete="off" spellcheck="false"` with an `aria-label`, `.gate-filter` caps it at `18rem` on a
+desktop and goes `width: 100%` at ≤640px, and it declares no `:hover`, no `cursor` and no
+`transition` because the connection map owns one interactive-looking thing (the unwired knob) and this
+is not it. `data/logs/31-task04-filter.cjs` measured it on the live ingress (transcript
+`31-task04-filter.out`, screenshots `31-task04-filter-{stackexpected,no-match,cleared,360}.png`):
+`stackexpected` → 6 of 33 rows with `nginx:443` and `haproxy:2000` the only trunks standing, a client
+address → that port's whole fan-out, `no-such-domain-anywhere` → every group hidden with both panels
+saying `no route matches "…"` and neither the tallies (`10 / 33 / 12 / 0`, byte-identical either side
+of every keystroke) nor the warnings panel moving, **zero** requests across five keystroke states, the
+same filtered view after a real 30 s poll as before it, and 0 px of sideways document scroll at 360 px
+where the field is 320 px wide. `34 PASS / 0 FAIL`.
+
+Phase 31's own pass measured the whole map rather than its parts, and is the pin that the three
+readability changes landed together: `data/logs/31-route-readability.cjs` (transcript
+`31-route-readability.out`, which opens with `data/logs/verify-31-page-only.py`'s payload proof,
+screenshots `31-gateway-*.png`, twelve frames — 1440, 360, light, filtered, no-match, trunk-live,
+phone, and one per degradation arm: predates, unconfigured, unreachable, no-nginx, sockets-quiet) —
+signs in and reads **computed** colour, not classes — every segment of all 33 rows (both spine
+halves, the tick, the run, the knob) computes to `--gate-on`, `rgb(63, 185, 80)` in dark and `rgb(26, 127, 55)` after the real
+theme toggle, and **no dashed border anywhere inside `.gate-map` computes `--border-strong`**
+(`rgb(51, 59, 77)` dark / `rgb(195, 202, 214)` light — the grey plumbing the operator read as
+inactivity), with **0** boxes in the map carrying a verdict class in either theme. The motion truth
+table comes out of the DOM against the payload's own numbers: every trunk the kernel reported ≥ 1 for
+animated, every one it reported 0 for drew a motionless line, and each `0 live` string corresponded to
+a port the payload carried 0 for — a reading of traffic, never a stored fact. A second, deterministic
+arm settles the direction of the claim: with `:443` handed 7 sockets and **every** leaf's count set to
+`null`, the trunk animated and 0 of its 18 leaves did, so a port's number provably does not leak into
+its fan-out. The arm where the socket table
+answers nothing draws **ten motionless `n/a` stubs** reading `connections on this port are unknown: the
+socket table did not answer`, with **no** `0 live` ink anywhere, every leaf keeping its `—`, the header's
+`live` tally `n/a` — and no panel taking the shared `stale` class, because the configs *did* answer. It
+then holds that the **leaf** keeps its own claim: with a trunk live and the leaf under it at `—`, the
+trunk animates and that leaf does not, because a port's sockets are not one route's. The filter pass is
+zero requests across five keystroke states with the four tallies byte-identical either side of every
+keystroke and `Escape` clearing the same way; `prefers-reduced-motion: reduce` stills all 43 paths (10 of
+them trunk stubs, through the block's descendant selectors) and every knob; the degradation arms each
+show their own sentence (`404 {configured: false}`, a `supported: false` agent, a silent socket section,
+a never-answered host); and the document scrolls **0 px** sideways at 1440 px and at 360 px with both
+charts open and the widest fan-out on screen. It also found, and fixed, the one defect of the phase that no class-based check could see:
+`svg.title = aria` assigned a JavaScript property and produced **no tooltip**, because `title` is a
+reflected IDL attribute of `HTMLElement` and not of `SVGElement` — the two map tooltips are
+`setAttribute('title', …)` calls now, which is what the browser can show and what
+`tests/test_api.py` demands. Its mobile-audit sibling is `31-task05-mobile-audit.out` (the
+`27-task02-mobile-audit.cjs` sweep, 371 checks, 0 failures, 0 findings, exit 0).
+
+The layout is three load-bearing declarations (`minmax(0, 9.5rem) minmax(0, 1fr)` per group so
a fan-out lines its leaves up instead of re-flowing them to the widest target, `minmax(0, …)` on every
track so a 40-character hostname ellipsises instead of growing the card — phase 27's rule — and one
column with the trunk above its leaves at ≤640 px). Task 04 measured that layout with
@@ -3145,9 +3274,10 @@ memory plot; the `cpu.usage_pct@coreN` series is still stored and still queryabl
ordinary rotation hygiene, not a missing step.
13. **`/gateway`'s long endpoint labels are ellipsised on a phone — a column-width question, not a
- lost fact** (found by phase 29 task 06's live pass, **closed at the desktop width by phase 30
- task 04's trunk→leaf row and re-measured on 2026-10-23 by task 06's pass**;
- `data/logs/30-connection-map.out` is the current measurement, `data/logs/30-task04-panels.out`,
+ lost fact, and the filter is what a clipped label used to block** (found by phase 29 task 06's
+ live pass, **closed at the desktop width by phase 30 task 04's trunk→leaf row and re-measured
+ after phase 31 re-ranked the row on 2026-10-26**; `data/logs/31-route-readability.out` is the
+ current measurement, `data/logs/30-connection-map.out`, `data/logs/30-task04-panels.out`,
`data/logs/29-task06-live.out` and `data/logs/29-task06-card-haproxy.png` the history).
**Phase 30 task 04 closed the desktop half by changing the row, not the font.** The two
@@ -3160,26 +3290,35 @@ memory plot; the `cpu.usage_pct@coreN` series is still stored and still queryabl
and not a bug: the longest target here is 42 characters
(`reeseapps-brain-of-code.reeselink.com:443`) and it fits.
- The arm that remains is the **phone**, and it got narrower before it got better: task 05's
- **switch** moved into the leaf row and a group stacks to one column at 360 px, so the same labels
- now clip at **31 of 33** targets and **22 of 33** selectors in a **139 px** column (this phase's
- re-run; 27 / 13 in a 177 px column when task 04 measured it, the difference being the switch
- pill's 34 px and the tick's 26 px taken off the label). Nothing is lost —
- `renderLeaf()` puts the endpoint *and* the config's own selector on the row as `title` and
- `leafAria()` carries the whole endpoint on the line, which is what
- `tests/test_api.py::test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins, alongside
- the declarations that decide *how much* it clips (`min-width: 0` on `.gate-target`,
- `minmax(0, 1fr)` on the leaf track, `max-content` on `.pipe-name`, `flex-wrap` on the trunk) so a
- future edit cannot squeeze a label back to the seven characters phase 29 measured. In order of cost:
- (a) at ≤640 px let the leaf row put the count on the target's second line instead of its own
- column, which buys roughly two more characters per label and is a stylesheet-only change;
- (b) accept it — the fan-out is read as a set, the part that fits is the selector, and the number
- the row is about is the count. Whoever picks this up re-runs
- `data/logs/30-connection-map.cjs` (task 06's pass, which supersedes
- `data/logs/30-task04-panels.cjs`): its two `FINDING` lines are the counts at both widths, and the
- run **fails** if any line ever stops carrying its full text — 33 of 33 rows carried a `title`
- naming their whole endpoint at 1440 px and at 360 px as this phase closed, which is the assertion
- the gap is actually about.
+ **Phase 31 kept the desktop half closed and moved the phone's clipping to where it belongs.** Its
+ pass (`data/logs/31-route-readability.cjs`, both widths, both themes) reads **0 of 33** inbound
+ lines and **0 of 33** counterpart lines ellipsised at 1440 px in the same **361 px** leaf column,
+ with the longest inbound word 35 characters and the longest counterpart line 50 — the row got a
+ second line and a `→ … · kind` wrapper and still fits. At **360 px** a group stacks and the column
+ is **139 px**, so the two lines now clip at **19 of 33** inbound and **33 of 33** counterpart.
+ That is the intended direction of the trade: phase 31 task 02 made line 1 the config's own short
+ word for *who reaches* the endpoint (`server_name`, `map` key, `backend` name) and demoted the long
+ `host:port` to line 2, so what still fits is the part an operator reads and what clips is the part
+ they read once. Nothing is lost: `renderLeaf()` puts **both** ends whole on the row's `title` and
+ `leafAria()`/`leafTitle()` carry them on the line, which is what
+ `tests/test_api.py::test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins, and the
+ browser pass measured 33 of 33 rows carrying their whole pair at both widths — as a **painted**
+ tooltip now, because that pass found `svg.title = aria` had been assigning a property
+ `SVGElement` does not reflect and showing nothing, and the fix (`setAttribute`) is what makes
+ "nothing is lost" true in a browser rather than only in the DOM. The declarations that decide *how
+ much* clips stay pinned (`min-width: 0` on `.gate-target`, `minmax(0, 1fr)` on the leaf track,
+ `max-content` on `.pipe-name`, `flex-wrap` on the trunk) so a future edit cannot squeeze a label
+ back to the seven characters phase 29 measured. What changed the gap's *cost* is task 04's filter:
+ the reason a clipped label mattered was that a long target could not be **found**, and typing
+ `brain` now hides 31 of 33 rows without one request, matching whole text CSS never showed. In order
+ of cost for what is left: (a) at ≤640 px let the leaf row put the count on the counterpart's second
+ line instead of its own column, which buys roughly two more characters per label and is a
+ stylesheet-only change; (b) accept it — the fan-out is read as a set, the part that fits is the
+ inbound word, and the number the row is about is the count. Whoever picks this up re-runs
+ `data/logs/31-route-readability.cjs` (which supersedes `data/logs/30-connection-map.cjs`): its two
+ `FINDING` lines are the counts at both widths, and the run **fails** if any row ever stops carrying
+ its full pair — 33 of 33 at 1440 px and at 360 px as this phase closed, which is the assertion the
+ gap is actually about.
How it got here, kept because the two rejected fixes are the reason the current shape looks the
way it does: at 1440 px phase 29's outbound name showed **seven characters** (`reeseapps-…`) for a
@@ -3191,6 +3330,26 @@ memory plot; the `cpu.usage_pct@coreN` series is still stored and still queryabl
declarations and removed the reason they were needed: with the trunk in its own track, the leaf's
name is the widest thing in a column that is now wide enough for it.
+14. **A route whose endpoint the config writes as a *name* is drawn and never counted —
+ `32_gateway_resolved_target_liveness` is the phase that removes the reason** (recorded by phase
+ 31 task 05, which wrote no design for it). Today 31 of this ingress's 33 routes end in a
+ `server_name`/`map` target and so carry an em dash where a live count would go, because
+ `sources/gateway.py` matches sockets by
+ address and resolves nothing (rule 2 by choice, and pinned as an absence). The follow-on phase is
+ the one that makes such a target answer with its liveness and its live connections anyway — the
+ agent reporting resolved targets on the box that owns the config, which is an `AGENT_VERSION` bump
+ to **1.3.0** and therefore an agent + source + pin change, not a page change. Its acceptance line
+ is that a dash disappears from `/gateway` for a reason and not by hiding the column.
+
+15. **`/gateway`'s switches are knobs with no write behind them — `33_gateway_route_switching` is the
+ phase that decides whether they ever get one** (recorded by phase 31 task 05, no design written).
+ Enabling or disabling a route is a second gated upstream write path in front of the proxy configs,
+ which **amends invariant 1** (today `POST /api/ups/command` is the app's only upstream write, and
+ the route enumeration in `tests/test_api.py` is the pin that says so) and needs the operator's
+ sign-off in `.agents/PLAN.md` **before** it is written as a phase. Until that decision exists the
+ knobs stay `aria-disabled`, unbound, and explained in the footer; the `PATCH`-shaped endpoint, the
+ config writer and the rollback are that phase's work and none of it is here.
+
## Locked decisions (and why)
- **SQLite, not Prometheus/Grafana.** Handful of boxes, 1–10s resolution, one file the
diff --git a/README.md b/README.md
index bcbd8a9..f201e2a 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ file:
| `/disks` | Are any of my **physical** disks failing, and which one — health, temperature, power-on hours, wear, sector alarms | the same agents, running `smartctl -i -A -H` per whole drive (never a partition or a mount); a host whose agent has no `smartctl` is not a host on this page |
| `/llm` | Tokens/sec, active sessions, queue depth, KV-cache pressure, latency percentiles | llama.cpp-family (gufo) `/metrics` + `/slots`, vLLM `/metrics` — read-only |
| `/ups` | Battery health, runtime left, power events, and battery-test buttons | NUT `upsd`, on whatever port it really listens on (its own wire-protocol client) |
-| `/gateway` | Which domains are coming in on which port, and where each one goes — **two connection tables, one per proxy config file** (`nginx`, then `haproxy`): a trunk per bound port with its configured endpoints branching off it, each line labelled with the config's own word for the route (`server_name`, `server`, `map` key) and its live connection count | the agent on **one** host, `GATEWAY_HOST` (default `gateway`), reading its `haproxy.cfg` + nginx tree and `/proc/net/tcp{,6}` — so it needs **agent 1.2.0**, and the whole page is *unconfigured* (never red) unless `GATEWAY_HOST` names a `HOST_TARGETS` entry |
+| `/gateway` | Which domains are coming in on which port, and where each one goes — **two connection tables, one per proxy config file** (`nginx`, then `haproxy`): a trunk per bound port with its configured routes branching off it, each line reading the config's own **inbound** word (`server_name`, `map` key, `backend` name) on line 1 over the counterpart it routes to on line 2 (`→ host:port`), plus its live connection count — and one filter box above the map that hides the routes whose own labels do not contain what you typed, asking nothing of the server | the agent on **one** host, `GATEWAY_HOST` (default `gateway`), reading its `haproxy.cfg` + nginx tree and `/proc/net/tcp{,6}` — so it needs **agent 1.2.0**, and the whole page is *unconfigured* (never red) unless `GATEWAY_HOST` names a `HOST_TARGETS` entry |
No Prometheus, no Grafana, no CDN, no build step. Nothing is fetched from the internet at
runtime; every asset is served by this app.
@@ -732,7 +732,7 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
`alerts.py` is why one dead agent is still one line on the overview rather than two. The gateway
page's job (phase 29) is the **third** reader of that same `/snapshot`, and one job for the whole
deployment rather than one per host — `GATEWAY_HOST` names the single ingress, and a job per host
- would ask four machines a question only one can answer — on its own 30 s cadence with no
+ would ask every machine a question only one of them can answer — on its own 30 s cadence with no
`RateEstimator`, because a connection count is not a rate. And it never quietly *stops*: the task
is that source's only poller, so a SQLite write that gets refused is reported (`ok: false`, the
real reason, the numbers aging, one line in the event log) instead of freezing the source under a
@@ -1078,21 +1078,54 @@ more. `GATEWAY_HOST` naming no `HOST_TARGETS` entry is
what routes out of each, and how many connections are live on each. It is **two panels** — one per
config file, `nginx` then `haproxy` — each hidden until a poll actually has rows for it, so a router
with no nginx in it spends no panel saying so. Inside a panel the rows are **groups**: a *trunk* is
- one port that file binds, and hanging off it are the *leaves* — the endpoints it names, the endpoint
- **exactly as the config wrote it** with the config's own word for the route above it (a `server_name`,
- a haproxy `server` name, a stream `map` key). That is the shape of the file, which is why the stream
+ one port that file binds, and hanging off it are the *leaves* — the routes that port's config names,
+ each reading **inbound first**: line 1 is the config's own word for who reaches the endpoint (a
+ `server_name`, a haproxy `backend` name, a stream `map` key, the literal `default`), and line 2 is
+ the counterpart it flows to, **exactly as the config wrote it**, marked `→ host:port` with the kind
+ of route after it. Both ends are verbatim, and both are carried whole on the row's tooltip and the
+ line's accessible name whichever one CSS has to ellipsise. That is the shape of the file, which is
+ why the stream
`map` is not a third panel: its entries are the nginx panel's `:443` leaves, so every SNI domain
reads beside the port it reaches. A trunk that names no target — this fleet's `:80` `return 301` —
prints "no target named in the config" instead of drawing nothing. Each line is joined to its
counterparts: nginx's ports **branch** — a dashed spine down the fan-out with a tick into every
endpoint — and haproxy's one-`server` frontends run **straight across**, because a port with one
- route behind it is not a branch. A line is **green because the config declares the route**, an
- existence colour of the page's own, and it **animates only while it carries at least one live
- connection** — motion is the socket, colour is the config, and a resting route keeps the same green
- as a busy one. **Nothing on the page is coloured by a verdict** — a busy ingress is the job, so
- `severity.py` rates no `gateway.*` metric and no number gets a green/amber/red tint. A line to an endpoint the config wrote as a **name** prints `—`, never `0`:
- counting it would need a DNS lookup and the join never asks one, and the row's tooltip says which of
- the two facts it is looking at. The header's four tallies are `ports`, `connections`, `live` and
+ route behind it is not a branch. A route is **green because the config declares it**, an existence
+ colour of the page's own, and that green covers **every segment of the row** — spine, tick, line and
+ switch all read one class on the row, so no part of an active route is drawn as grey plumbing — while
+ the line **animates only while it carries at least one live connection**: motion is the socket,
+ colour is the config, and a resting route keeps the same green as a busy one. The trunk carries a
+ **short line of its own** for that reason, and it reads from a *different* field: a leaf moves on its
+ endpoint's count, the trunk's stub moves on `listeners[].connections` — the sockets whose **local**
+ end is that port, which `/proc` states whether or not the route's target is a resolvable address. So
+ a busy port is visibly busy even when every leaf under it carries a `—`, which is the normal look of
+ this fleet's `:443`. That line's claim is about **the port and never about one route**: its
+ accessible name and tooltip say `:4443 — 9 connections are open on this port right now` (or
+ `no connections…`, or `connections on this port are unknown: the socket table did not answer`) and
+ name no endpoint, and the unknown arm prints `n/a` where the count is and no motion at all — never
+ `0`, and never a dash, because "the socket table went quiet" is a different fact from "this target
+ is a name".
+ Above the map, one **filter box** finds a domain among 33 routes (`stackexpected`, `brain`, `4443`,
+ `minecraft`) because the rows are in config order and the question is always about one name. It hides
+ what the payload already sent and asks for **nothing**: no request, no re-derivation, no new route.
+ It matches the strings the config wrote — the inbound word(s), the endpoint, the port, the haproxy
+ `server` name, and a trunk's own domains and client addresses — case-insensitively, so a label CSS
+ ellipsised still matches its whole text. A trunk that matches keeps its **whole fan-out**: typing
+ `4443` asks for the port, and every route hanging off it is the answer. `Escape` clears it, a chip
+ beside the field counts `N of M routes`, and a query that matches nothing leaves both panels standing
+ with `no route matches "…"` in each. What it never touches is the header's four tallies, the warnings
+ panel, or the charts — those describe the ingress, not the operator's current view of it — and it
+ never **groups, sorts or colours** by domain suffix: `reeseapps.com` versus `stackexpected.com` is a
+ fact neither config file states, so the operator types the suffix and the page hides the rest rather
+ than inventing a zone no proxy declared.
+ **Nothing on the page
+ is coloured by a verdict** — a busy ingress is the job, so `severity.py` rates no `gateway.*` metric
+ and no number gets a green/amber/red tint. A line to an endpoint the config wrote as a **name**
+ prints `—`, never `0`: counting it would need a DNS lookup and the join never asks one, and the row's
+ tooltip says which of the two facts it is looking at. Expect that on most of this ingress's routes —
+ 31 of its 33 are written as domains — and read it as *drawn, not counted* rather than as a fault; the
+ footer says the same thing once, in plain terms, because a dash per row needs one explanation and not
+ thirty-two. The header's four tallies are `ports`, `connections`, `live` and
`warnings`, every one of them the payload's own figure. A `warnings` count above zero raises a panel
above the map with the config-integrity rows (`a backend no frontend routes to`, a `proxy_pass` with
no `upstream` behind it, an SNI entry that reaches no address) in the overview's alert vocabulary;
@@ -1105,7 +1138,11 @@ more. `GATEWAY_HOST` naming no `HOST_TARGETS` entry is
for a screen reader (`endpoint, reached by , in the nginx config, on`) — and it is
**unwired on purpose**: `aria-disabled` with a tooltip that says so, and this app writes to no
upstream, so a route is disabled by editing `haproxy.cfg` or an nginx `server` block and by nothing
- in a browser.
+ in a browser. Giving either of those two dashes or knobs a real backing store is deliberately **not**
+ documented here as a thing you can have: name-based liveness needs the agent to report resolved
+ targets (a future agent version), and switching a route needs a second gated write path in front of
+ the proxy configs, which is a change to this app's read-only promise rather than a feature. What runs
+ today is **agent 1.2.0**, no name resolution, and no switching.
The four event feeds (`/system`, `/disks`, `/llm`, `/ups`) are a **paged window** over the `event`
table rather than a printout of it: the list is a bounded box that scrolls, 50 events to a
page, with `1–50 of 200` between `‹ prev` and `next ›` (disabled at the ends) underneath.
diff --git a/src/dashboards/web/pages/gateway.html b/src/dashboards/web/pages/gateway.html
index bf709fe..7648729 100644
--- a/src/dashboards/web/pages/gateway.html
+++ b/src/dashboards/web/pages/gateway.html
@@ -105,7 +105,20 @@
hidden and appears on the poll that has groups for it (or a config that answered and named
none), so a gateway with no nginx in it does not spend a panel saying so. -->