phase: 10_dev_direct_dial

**Phase 10 final pass — repo green; live criteria blocked off-repo.**

- Verified: `gateway` runs `dashboards-agent` (active/enabled, `10.1.1.27:9120` → `/health` 200, `/snapshot` 401 no-token / 200 bearer on-host, token matches `/etc/dashboards-agent.token`); `driveripper`/`deskwork` inactive, `sudo -n` → "a password is required", `:9120` empty.
- New measurement (transient runtime rule on gateway `firewall-cmd --add-port=9120/tcp`, **reverted** — runtime+permanent port lists verified back to the original set, no rich rules): laptop still gets no SYN through, while `:22`/`:80` on the same address answer in ms ⇒ the block is the lab gateway `10.2.0.1` port filter, not this app/host firewall/agent. No other live change made (no sudoers, no upsd, no UPS command).
- Tests/lint (exact): `bash .agents/validate.sh` → **EXIT 0** — `uv run pytest --cov --cov-fail-under=94` **793 passed, 11 skipped, coverage 98.33 %**; `ruff check src tests agent` clean; `pyright` 0 errors; `node --check` clean; hygiene clean; `uv pip list --outdated` empty (bumped fastapi 0.143.3→0.143.5, `uv.lock` only).
- `uv run pytest -m live --live` (`.env.dev` sourced): **4 passed, 1 skipped, 6 failed** — all six are `:9120`/`:3051` connect timeouts; zero parse/contract failures.
- Dev server restarted on current code: engines `ok`; 3×`host` + 3×`disks` + `nut` `DOWN` with real reasons (designed degradation, stub rows intact, no credential leakage).
- Completion criteria: screenshots ✓ (`data/logs/phase10-{index,system,disks,llm,ups}-live.png`); tunnel-vocabulary grep ✓ outside `.agents/` history (PLAN.md locked line, phase overviews, past reports; fixtures/`uv.lock` hits are digit substrings — `tests/test_deploy_scripts.py` guards operational files); no page-payload change ✓ (contract tests). **Not met, operator-side:** agents on all three hosts, `LIST UPS` from the laptop, `dev-server.sh status` all-ok, live suite green.
- Fixed in this pass: `sources/nut.py` unreachable-upsd message no longer prints a bare `(TimeoutError: )` (now `(timed out after 4s)` / `(ConnectionRefusedError: …)`), pinned by a new test + extended refused-port test.
- Docs: README verified consistent (every env var in `config.py` documented, routes/flags/`--with-llm`/pager sizes checked) — no changes needed. AGENTS.md fixed 4 inconsistencies: per-host sudo reality (gateway grants `NOPASSWD ALL`, which is why it installed without `agent-sudoers`; driveripper scoped; deskwork unrelated), the now-proven firewall finding, `/system` table typo ("agent per host"), gap-4 DB/WAL sizes + test count. `.env.example` `upsd.users` sample now one `instcmds` per line (it contradicted README and the in-app copy). `.env.dev` (gitignored) comment corrected to match the evidence.
- Flagged, untouched (locked): `.agents/PLAN.md` L92–95 still says upsd is "forwarded to `127.0.0.1:3494` in dev" — false after this phase; evidence + exact operator commands appended to `data/logs/NOTES-verify.md` §11.
- Next pending phase: `11_admin_login`.

scripts/capture-fixtures.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Re-record ground-truth captures into tests/fixtures/.
 #
-#   ./scripts/capture-fixtures.sh                # needs the tunnels up: scripts/dev-tunnels.sh start
+#   ./scripts/capture-fixtures.sh                # dials HOST_TARGETS from .env.dev, directly
 #   ./scripts/capture-fixtures.sh --with-llm     # also scrape the live engines' /metrics
 #                                                 # (gufo /slots is captured without the flag)
 #   SMART_HOSTS="deskwork-ops driveripper-ops" ./scripts/capture-fixtures.sh
@@ -19,25 +19,37 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 FIX="$ROOT/tests/fixtures"
 mkdir -p "$FIX"
 
-HOSTS=(driveripper:9121 deskwork:9122 gateway:9123)
-# Engine URLs come from the same env the app uses, so this script carries no deployment
-# detail of its own — and never records a tokenised URL into a fixture by accident.
+# Agents come from the same env the app reads: HOST_TARGETS in .env.dev, `name=url` pairs
+# (space or comma separated — the shape config.parse_targets accepts), the bearer token in
+# the URL userinfo used as-is. Nothing is hard-coded here, so a capture can never come from
+# a different topology than the dashboard polls.
 if [ -f "$ROOT/.env.dev" ]; then
   set -a; . "$ROOT/.env.dev"; set +a
 fi
+HOSTS=()
+targets="${HOST_TARGETS:-}"
+for entry in ${targets//,/ }; do   # space or comma separated, like config.parse_targets
+  HOSTS+=("$entry")
+done
+# Engine URLs come from the same env too, so this script carries no deployment
+# detail of its own — and never records a tokenised URL into a fixture by accident.
 ENGINES=()
 [ -n "${GUFO_BASE_URL:-}" ] && ENGINES+=("gufo:${GUFO_BASE_URL%/}/metrics")
 [ -n "${VLLM_BASE_URL:-}" ] && ENGINES+=("vllm:${VLLM_BASE_URL%/}/metrics")
 
 failed=0
 
+if [ ${#HOSTS[@]} -eq 0 ]; then
+  echo "  (skipped agent captures — HOST_TARGETS unset; see .env.dev.example)"
+fi
 for entry in "${HOSTS[@]}"; do
-  name=${entry%%:*}; port=${entry##*:}
-  url="http://127.0.0.1:${port}/snapshot"
-  if curl -fsS --max-time 8 "$url" -o "$FIX/agent_${name}.json"; then
+  name=${entry%%=*}; url=${entry#*=}
+  # The failure line prints the address without its userinfo: a token belongs in the
+  # dial, not in the terminal scrollback or whatever shells this output into.
+  if curl -fsS --max-time 8 "${url%/}/snapshot" -o "$FIX/agent_${name}.json"; then
     echo "  ✓ agent_${name}.json  ($(wc -c <"$FIX/agent_${name}.json") bytes)"
   else
-    echo "  ✗ agent_${name}.json — no agent on $url (scripts/dev-tunnels.sh start?)"
+    echo "  ✗ agent_${name}.json — no agent answered at ${url#*@} (deploy/install-agent.sh? firewall?)"
     failed=1
   fi
 done
@@ -105,7 +117,7 @@ PY
   then
     : # per-UPS lines above
   else
-    echo "  ✗ nut_*.vars — upsd at $NUT_HOST:${NUT_PORT:-3493} unreachable (scripts/dev-tunnels.sh start?)"
+    echo "  ✗ nut_*.vars — upsd at $NUT_HOST:${NUT_PORT:-3493} unreachable (down? firewall? NUT_PORT is the port upsd really listens on)"
     failed=1
   fi
 else