phase: 03_system_per_host_panels

**Phase 03 final verification pass — all 4 tasks already in `complete/`; verified criteria, fixed 3 pre-existing defects.**

- **Verified live** (headless Chromium + curl against `:8090`, all 6 sources `ok`): 3 panels × six heroes in order `cpu,mem,temp,disk,gpus,net`; charts per panel `util,net[,gpu]` (gateway: no GPU chart/hole); legends name metrics only — no legend names a foreign host; every `<svg>` `role="img"` + host-scoped `aria-label`; 2 sections, 0 `<select>`; `grep -rn "renderCores|core_usage" src/dashboards/web/` → nothing; console error-free; new shot `data/logs/final-system-panels.png`.
- **Defect fixed (credential hygiene, invariant 6)**: `collectors.py` put the *dialed* URL into every `UpstreamError`, and that string lands in the health record (`/api/health`) and the `event` table (`/api/events` → page); `/api/config` also echoed `GUFO_BASE_URL`/`VLLM_BASE_URL` verbatim. Added `config.strip_userinfo()` (now what `Target.display_url` uses) and redacted all message/config URLs. Tests: `test_a_failing_host_never_echoes_its_token_in_the_message` (×3 paths), `test_a_failing_engine_never_echoes_credentials_in_its_url`, `test_a_dead_host_never_writes_its_token_into_the_feed`, `test_engine_urls_are_redacted_the_same_way_hosts_are`, `test_strip_userinfo_is_the_one_redaction_every_url_leaves_by`. (`parse_targets` already moves `HOST_TARGETS` userinfo into a header, so this is a backstop for hosts and a real fix for engine URLs.)
- **Defect fixed (invariant 2)**: `/system` footnote printed `Δ{HOST_INTERVAL}` as the measurement; it now prints each host's measured `window_seconds` (range when they disagree) — `rates over Δ10.0s · poll 10s`. Pinned by `test_system_footnote_prints_the_window_it_actually_measured`. Also fixed the page's stale "window in each header" note and the empty-state's `--token` (argv) advice → `--token-file`.
- `bash .agents/validate.sh` → **EXIT=0**: **472 passed, 7 skipped**, coverage **96.87%** (floor 94), `ruff check src tests agent` clean, `pyright` 0 errors, `node --check` clean · `uv run pytest -m live --live` → **7 passed** · `uv pip list --outdated` empty.
- Criteria: no multi-host legend ✅ · no per-core visual ✅ · six heroes/panel incl. no-GPU `n/a` uncoloured ✅ · per-core history still queryable ✅ (354 pts) · ≥3 shape screenshots ✅ (`system-driveripper/deskwork/gateway.png` + dark/light/stale) · pytest+coverage+lint ✅ · phases 01/02 unchanged (their pin tests + `/api/summary` shape tests pass; live UPS gap in AGENTS.md re-confirmed read-only against real upsd) ✅.
- **Docs**: AGENTS.md — invariant 6 rewritten to cover message/event redaction, `collectors.py` line, new "Δ is a measurement" rule, "hosts answering total" → "nine-figure fleet-totals panel" (the subtitle still counts hosts), test count 452→472, coverage 96.8→96.9, rewrapped an over-long line. README.md — same fleet-totals wording, `RATE_WINDOW_SECONDS` now covers every measured rate (not just tokens), agent route list completed (`/`, `/schema`, `?top=N`), `LIST CMD` in the diagram, new paragraph on URL redaction.
- **Deviation**: the criterion's literal `curl …/api/system/history?host=…&metric=cpu.usage_pct@core7` uses singular params that endpoint has never accepted (it takes `hosts=`/`metrics=` and ignores unknown ones). Verified 354 points via `…system/history?hosts=driveripper&metrics=cpu.usage_pct@core7&range=1h` and `/api/history?source=host&host=…&metric=…`; I did **not** add singular param aliases (unauthorized API surface). No live infra changes made — reads only.
- **Next pending phase**: `04_llm_chart_readability`.

tests/test_collectors.py

@@ -120,6 +120,44 @@ async def test_a_refused_connection_is_an_upstream_error_not_a_traceback() -> No
                                       HostCollector(RateEstimator()))
 
 
+@pytest.mark.parametrize("failure", ["refused", "timeout", "http-500"])
+async def test_a_failing_host_never_echoes_its_token_in_the_message(failure: str) -> None:
+    """An `UpstreamError` message is not just a log line: the poller keeps it in the health
+    record (`/api/health`) and writes it to the `event` table (`/api/events`), both of which
+    the browser reads — so the URL it names has to be the redacted one, on every failure path
+    (AGENTS.md invariant 6). `parse_targets` normally moves a userinfo token into a header, so
+    this is the backstop that keeps the guarantee true for any `Target` that still carries one.
+    """
+    def handler(request: httpx.Request) -> httpx.Response:
+        if failure == "refused":
+            raise httpx.ConnectError("connection refused")
+        if failure == "timeout":
+            raise httpx.ReadTimeout("too slow")
+        return httpx.Response(500, text="boom")
+
+    target = Target("gw", "http://SEKRIT-AGENT-TOKEN@agent.test")
+    async with client_for(handler) as client:
+        with pytest.raises(UpstreamError) as excinfo:
+            await fetch_host_snapshot(client, target, HostCollector(RateEstimator()))
+    message = excinfo.value.message
+    assert "SEKRIT-AGENT-TOKEN" not in message, f"the token leaked through {failure}"
+    # …and the message still names the machine it failed to reach
+    assert "http://agent.test/snapshot" in message
+
+
+async def test_a_failing_engine_never_echoes_credentials_in_its_url() -> None:
+    """Same rule for the engines: the URL in the message is the redacted one."""
+    def handler(request: httpx.Request) -> httpx.Response:
+        raise httpx.ConnectError("connection refused")
+
+    async with client_for(handler) as client:
+        with pytest.raises(UpstreamError, match="unreachable") as excinfo:
+            await fetch_engine(client, "gufo", "http://SEKRIT-ENGINE-TOKEN@agent.test", "",
+                               RateEstimator())
+    assert "SEKRIT-ENGINE-TOKEN" not in excinfo.value.message
+    assert "http://agent.test/metrics" in excinfo.value.message
+
+
 async def test_a_slow_agent_is_a_gateway_timeout() -> None:
     def handler(request: httpx.Request) -> httpx.Response:
         raise httpx.ReadTimeout("too slow")