phase: 03_system_per_host_panels

**Phase 03 final verification pass — all 4 tasks already in `complete/`; verified criteria, fixed 3 pre-existing defects.**

- **Verified live** (headless Chromium + curl against `:8090`, all 6 sources `ok`): 3 panels × six heroes in order `cpu,mem,temp,disk,gpus,net`; charts per panel `util,net[,gpu]` (gateway: no GPU chart/hole); legends name metrics only — no legend names a foreign host; every `<svg>` `role="img"` + host-scoped `aria-label`; 2 sections, 0 `<select>`; `grep -rn "renderCores|core_usage" src/dashboards/web/` → nothing; console error-free; new shot `data/logs/final-system-panels.png`.
- **Defect fixed (credential hygiene, invariant 6)**: `collectors.py` put the *dialed* URL into every `UpstreamError`, and that string lands in the health record (`/api/health`) and the `event` table (`/api/events` → page); `/api/config` also echoed `GUFO_BASE_URL`/`VLLM_BASE_URL` verbatim. Added `config.strip_userinfo()` (now what `Target.display_url` uses) and redacted all message/config URLs. Tests: `test_a_failing_host_never_echoes_its_token_in_the_message` (×3 paths), `test_a_failing_engine_never_echoes_credentials_in_its_url`, `test_a_dead_host_never_writes_its_token_into_the_feed`, `test_engine_urls_are_redacted_the_same_way_hosts_are`, `test_strip_userinfo_is_the_one_redaction_every_url_leaves_by`. (`parse_targets` already moves `HOST_TARGETS` userinfo into a header, so this is a backstop for hosts and a real fix for engine URLs.)
- **Defect fixed (invariant 2)**: `/system` footnote printed `Δ{HOST_INTERVAL}` as the measurement; it now prints each host's measured `window_seconds` (range when they disagree) — `rates over Δ10.0s · poll 10s`. Pinned by `test_system_footnote_prints_the_window_it_actually_measured`. Also fixed the page's stale "window in each header" note and the empty-state's `--token` (argv) advice → `--token-file`.
- `bash .agents/validate.sh` → **EXIT=0**: **472 passed, 7 skipped**, coverage **96.87%** (floor 94), `ruff check src tests agent` clean, `pyright` 0 errors, `node --check` clean · `uv run pytest -m live --live` → **7 passed** · `uv pip list --outdated` empty.
- Criteria: no multi-host legend ✅ · no per-core visual ✅ · six heroes/panel incl. no-GPU `n/a` uncoloured ✅ · per-core history still queryable ✅ (354 pts) · ≥3 shape screenshots ✅ (`system-driveripper/deskwork/gateway.png` + dark/light/stale) · pytest+coverage+lint ✅ · phases 01/02 unchanged (their pin tests + `/api/summary` shape tests pass; live UPS gap in AGENTS.md re-confirmed read-only against real upsd) ✅.
- **Docs**: AGENTS.md — invariant 6 rewritten to cover message/event redaction, `collectors.py` line, new "Δ is a measurement" rule, "hosts answering total" → "nine-figure fleet-totals panel" (the subtitle still counts hosts), test count 452→472, coverage 96.8→96.9, rewrapped an over-long line. README.md — same fleet-totals wording, `RATE_WINDOW_SECONDS` now covers every measured rate (not just tokens), agent route list completed (`/`, `/schema`, `?top=N`), `LIST CMD` in the diagram, new paragraph on URL redaction.
- **Deviation**: the criterion's literal `curl …/api/system/history?host=…&metric=cpu.usage_pct@core7` uses singular params that endpoint has never accepted (it takes `hosts=`/`metrics=` and ignores unknown ones). Verified 354 points via `…system/history?hosts=driveripper&metrics=cpu.usage_pct@core7&range=1h` and `/api/history?source=host&host=…&metric=…`; I did **not** add singular param aliases (unauthorized API surface). No live infra changes made — reads only.
- **Next pending phase**: `04_llm_chart_readability`.

src/dashboards/web/static/charts.js

@@ -43,7 +43,7 @@ const DEFAULT_FORMAT = (v) => (Math.abs(v) >= 100 ? v.toFixed(0) : v.toFixed(1))
 class LineChart {
   /**
    * container: element to fill (its width is used; height comes from opts.height)
-   * opts: {height, yFormat, xSpan, yMin, yMax, area, legend, showAxis, min, unit}
+   * opts: {height, yFormat, xSpan, yMin, yMax, area, legend, showAxis, min, unit, ariaLabel}
    */
   constructor(container, opts) {
     this.el = typeof container === 'string' ? document.querySelector(container) : container;
@@ -69,6 +69,13 @@ class LineChart {
     this.svg = document.createElementNS('http://www.w3.org/2000/svg', 'svg');
     this.svg.setAttribute('width', '100%');
     this.svg.setAttribute('height', this.opts.height);
+    // A chart is an image to assistive tech, which means silence unless the page names it —
+    // the legend below is a sibling, not a label. `ariaLabel` is optional so pages adopt it
+    // one at a time (`/system` names every chart it draws; see page-system.js).
+    if (this.opts.ariaLabel) {
+      this.svg.setAttribute('role', 'img');
+      this.svg.setAttribute('aria-label', String(this.opts.ariaLabel));
+    }
     this.el.appendChild(this.svg);
     this.empty = document.createElement('div');
     this.empty.className = 'empty';
@@ -337,17 +344,6 @@ function renderLegend(container, series, format, showPeak) {
   }).join('');
 }
 
-/** Column heat bars for per-core usage: 48 cores read as a pattern, not a table. */
-function renderCores(container, values, format) {
-  const f = format || ((v) => (v == null ? 'n/a' : v.toFixed(0) + '%'));
-  container.innerHTML = (values || []).map((v, i) => {
-    const pct = v == null ? 0 : Math.max(0, Math.min(100, v));
-    const hue = pct > 85 ? 'var(--fail)' : pct > 60 ? 'var(--warn)' : 'var(--accent)';
-    return `<span class="core" title="core ${i}: ${escapeHtml(f(v))}">` +
-           `<i style="height:${pct.toFixed(1)}%;background:${hue}"></i></span>`;
-  }).join('');
-}
-
 /** Small non-interactive sparkline for cards where a full chart would shout. */
 function sparkline(container, points, opts) {
   const o = Object.assign({ height: 34, color: cssVar('--series-1'), min: null, max: null }, opts || {});
@@ -374,5 +370,5 @@ function sparkline(container, points, opts) {
   container.innerHTML = svg;
 }
 
-window.DashCharts = { LineChart, niceTicks, renderLegend, renderCores, sparkline, cssVar,
+window.DashCharts = { LineChart, niceTicks, renderLegend, sparkline, cssVar,
                      CHART_COLORS, DEFAULT_FORMAT, escapeHtml };