From e366f599f368dbe78a9d94e9c276ebba15849f8e Mon Sep 17 00:00:00 2001
From: ducoterra <git@ducoterra.net>
Date: Fri, 23 Oct 2026 22:56:21 -0400
Subject: [PATCH] phase: 30_gateway_connection_map
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

**Phase 30 final verification pass — all 6 tasks already in `complete/`, so this was the phase-completion pass.**

- **Verified (re-run, not trusted):** `/gateway` serves exactly two panels (nginx→haproxy, `GATEWAY_CARD_KEYS`); haproxy rows `.solo` straight across, nginx `:443` branched with one tick per leaf (18 live, fixture 17); every pipe computes the theme `--ok` in dark+light, animates only at count ≥1, fully static under `prefers-reduced-motion`; switch = `role="switch"`+`aria-checked`+`aria-disabled`, no listener, footer+title name the missing write path; zero non-GET requests anywhere.
- **Live read-only re-run** (`data/logs/30-final-live-verify.out`): 17 PASS — `warnings: []`, 6 haproxy frontends→own `server`, `:443` 18 map leaves incl. `default→127.0.0.1:4443`, `:4443` 6 / `:8443` 3, `:80` bare listener, no `unmatched`/`outbound`/`by_port`/`partial`, no `9120`; inbound reconciliation **page 16 = kernel 16**; `gateway` block = the 12 declared keys; no `gateway:config` alert on a clean config. `git diff --stat agent/ deploy/` empty; agents 1.2.0 (gateway) / 1.1.0 ×2, all `tls`, `bundle_rev 2`.
- **Tests/lint (exact):** `uv run pytest` → **1791 passed, 16 skipped**, exit 0 · `bash .agents/validate.sh` → **exit 0**, `--cov` **98.94%** (floor 94), `ruff check src tests agent` clean, `pyright` 0 errors, `node --check` all page scripts, hygiene clean · `uv run pytest -m live --live` → **12 passed** · `uv pip list --outdated` empty · `./scripts/dev-server.sh status` → **10 sources ok**, `gateway` included · browser pass `30-connection-map.out` 63 PASS/0 FAIL (5 screenshots at 1440/360) · `30-final-mobile-audit.out` 371 PASS/0 FAIL/0 FINDING, exit 0, nine pages.
- **Docs fixed:** README `alerts.py` bullet omitted phase 30's keyword-only `gateway_payload` and its one `warn` config-integrity row (+suppression) — added; overview ingress line labelled a dated reading. AGENTS gap 13 corrected 391 px → **361 px** (task 05's pill took 30 px), "task 06 measured" → "phase 29 measured", coverage figure un-pinned to 98.9 %, live-suite count noted (12 today), "all five pages" severity sentence clarified for `/gateway`'s existence-only palette. Everything else reviewed in full and **verified consistent**.
- **Defect fixed:** duplicated footer-assertion block at the end of `tests/test_api.py::test_the_switch_is_built_and_explicitly_unwired` (one copy removed).
- **Notable:** `NOTES.md` is empty in the working tree — both items in it (non-mTLS agents, disappearing admin links) landed in phases 24 and 20; left cleared. Fixture/live `map`-count drift (17 vs 18) is recorded in AGENTS.md, not silently re-captured.
- **Next pending phase:** none — `30_gateway_connection_map` was the only entry in `.agents/phases/todo/`.
---
 .../30_gateway_connection_map/00_phase.md     |   64 +
 .../01_the_connection_graph.md                |   78 +
 .../02_the_join_simplified.md                 |   43 +
 .../03_config_warnings.md                     |   63 +
 .../04_page_two_tables.md                     |   68 +
 .../05_lines_and_switches.md                  |   96 ++
 .../06_docs_and_verify.md                     |   52 +
 ...30_gateway_connection_map__00_phase.a1.err |    0
 .../30_gateway_connection_map__00_phase.a1.md |    9 +
 ...eway_connection_map__00_phase.a1.md.status |    1 +
 ...teway_connection_map__00_phase.a1.validate |   69 +
 ...ection_map__01_the_connection_graph.a1.err |    0
 ...nection_map__01_the_connection_graph.a1.md |   17 +
 ..._map__01_the_connection_graph.a1.md.status |    1 +
 ...n_map__01_the_connection_graph.a1.validate |   74 +
 ...nection_map__02_the_join_simplified.a1.err |    0
 ...nnection_map__02_the_join_simplified.a1.md |   15 +
 ...n_map__02_the_join_simplified.a1.md.status |    1 +
 ...on_map__02_the_join_simplified.a1.validate |   74 +
 ..._connection_map__03_config_warnings.a1.err |    0
 ...y_connection_map__03_config_warnings.a1.md |   22 +
 ...ction_map__03_config_warnings.a1.md.status |    1 +
 ...ection_map__03_config_warnings.a1.validate |   74 +
 ..._connection_map__04_page_two_tables.a1.err |    0
 ...y_connection_map__04_page_two_tables.a1.md |   22 +
 ...ction_map__04_page_two_tables.a1.md.status |    1 +
 ...ection_map__04_page_two_tables.a1.validate |   75 +
 ...nnection_map__05_lines_and_switches.a1.err |    0
 ...onnection_map__05_lines_and_switches.a1.md |   26 +
 ...on_map__05_lines_and_switches.a1.md.status |    1 +
 ...ion_map__05_lines_and_switches.a1.validate |   75 +
 ..._connection_map__06_docs_and_verify.a1.err |    0
 ...y_connection_map__06_docs_and_verify.a1.md |   13 +
 ...ction_map__06_docs_and_verify.a1.md.status |    1 +
 ...ection_map__06_docs_and_verify.a1.validate |   69 +
 AGENTS.md                                     |  467 ++++--
 README.md                                     |  148 +-
 src/dashboards/alerts.py                      |   68 +-
 src/dashboards/api.py                         |  152 +-
 src/dashboards/sources/gateway.py             |  911 ++++++++----
 src/dashboards/web/pages/gateway.html         |  153 +-
 src/dashboards/web/static/dash.css            |  272 +++-
 src/dashboards/web/static/page-gateway.js     |  887 +++++++-----
 src/dashboards/web/static/page-index.js       |   46 +-
 tests/test_alerts.py                          |  186 ++-
 tests/test_api.py                             | 1262 ++++++++++++++---
 tests/test_collectors.py                      |    2 +-
 tests/test_gateway_source.py                  |  999 +++++++++++--
 tests/test_live_fleet.py                      |   62 +-
 tests/test_poller.py                          |   28 +-
 uv.lock                                       |  190 +--
 51 files changed, 5419 insertions(+), 1519 deletions(-)
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/00_phase.md
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/01_the_connection_graph.md
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/02_the_join_simplified.md
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/03_config_warnings.md
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/04_page_two_tables.md
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/05_lines_and_switches.md
 create mode 100644 .agents/phases/complete/30_gateway_connection_map/06_docs_and_verify.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.validate
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.validate
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.validate
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.validate
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.validate
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.validate
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.err
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md.status
 create mode 100644 .agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.validate

diff --git a/.agents/phases/complete/30_gateway_connection_map/00_phase.md b/.agents/phases/complete/30_gateway_connection_map/00_phase.md
new file mode 100644
index 0000000..bbce773
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/00_phase.md
@@ -0,0 +1,64 @@
+# Phase 30 — The gateway connection map: two config-derived tables, joined lines, green = in the config
+
+**Source:** operator request, 2026-10-23 (post-phase-29 review of `/gateway`)
+**Story:** n/a
+**Context:** `src/dashboards/sources/gateway.py` (the join this phase rewrites), `agent/host_agent.py` **1.2.0** (its `haproxy` / `nginx` / `sockets` sections — the *only* upstream this phase reads, and it needs **no agent change**), `tests/fixtures/gateway_haproxy.cfg` + `gateway_nginx_main.conf` + `gateway_nginx_conf_d_http.conf` + `gateway_nginx_stream_d_stream.conf` + `gateway_proc_net_tcp{,6}.txt` (the verbatim captures the graph is pinned to), `src/dashboards/api.py` (`/api/gateway/*`, the `/api/summary` `gateway` block), `src/dashboards/alerts.py` (the reachability-only rule this phase changes by decision), `src/dashboards/web/pages/gateway.html` + `static/page-gateway.js` + `static/dash.css` (the pipe vocabulary), `tests/test_gateway_source.py`, `tests/test_api.py` (the served-bytes pins this phase deliberately rewrites).
+
+## Objective
+
+`/gateway` becomes the **connection map** it was meant to be: **two tables — nginx and haproxy** — in which every row is a connection **that exists in a config file**, drawn as a line that physically joins its inbound end to its outbound end (haproxy straight across; nginx branching out of `:443` to the services the stream `map` routes to), each line **green because the config says it exists**, each line carrying the **switch** shape from the operator's sketch (built, visible, not yet wired). The socket table is demoted to a number beside the line instead of deciding its colour or its existence; the `stream map` card and the `unmatched` card are gone; anything the two configs do not describe is **not reported at all**, and the warnings that remain are **config-integrity** problems — a backend no frontend routes to, a `proxy_pass $var` with no `map` — surfaced as a warnings panel on the page and one alert row on `/`.
+
+## Scope decisions taken with the operator (binding for this phase)
+
+| # | Decision | Consequence |
+|---|----------|-------------|
+| 1 | **Green means "in the config."** | Every configured connection draws green. Colour is an **existence state**, not a verdict: `severity.py` still has no `gateway.*` row and no payload key carries `severity`. Red is the **off** state (a route switched out of the config), styled now, unreachable until the write path exists. |
+| 2 | **Motion means "a socket is open this instant."** | The dash animates while that pipe's live count is ≥ 1 and sits still otherwise. No rolling/recent-peak derivation, no speed tied to volume. |
+| 3 | **The switch is built, not wired.** | Real `<button role="switch">` per connection, `aria-checked="true"` (in config = on), `aria-disabled="true"` (not `disabled`, which would drop it from the a11y tree), no click handler, a `title` naming why. The UPS controls are the precedent for a gated control; the write path is a **later phase**. |
+| 4 | **Live counts stay, demoted.** | The inbound trunk carries the real ESTABLISHED count + client addresses; the 24 h per-card chart stays; the header keeps tallies. A leaf endpoint written as a **name** shows `—` (never `0`, never a fake `n/a` column). |
+| 5 | **Only the unambiguous socket join survives.** | Inbound = the socket's local port is a configured listen port. Outbound = the socket's remote `(address, port)` **equals a target the config wrote as an address**. `by_port`, `unmatched.inbound`, `unmatched.outbound`, `unmatched.groups`, `partial`, `unmatched_listeners` are **deleted**. |
+| 6 | **Anything outside the two configs is ignored.** | `9120` (this app's own agent), `2222`, DHCP/mDNS/whatever else listens is neither drawn, nor counted, nor warned about. `sockets.listens` / `sockets.established` stay in the payload as the kernel's raw totals for programmatic consumers only. |
+| 7 | **The warnings list is config integrity.** | Seven kinds (`03_config_warnings.md`) plus three explicit refusals where the payload cannot tell broken from merely unreadable; all derived from config text, all actionable. Panel on `/gateway`, and **one** `warn` row in `/api/summary`'s `alerts` — which changes the "a `gateway` alert is reachability only" rule in `alerts.py` and in `AGENTS.md`. |
+
+**Out of scope:** any change to `agent/host_agent.py` (1.2.0 already publishes everything needed, including `upstreams` and `maps`), any write path or config edit, any new dependency, any new sample family (the existing `gateway.in_conns@<port>` / `gateway.out_conns@<host>:<port>` names stay, so stored history keeps its meaning).
+
+## Dependencies
+
+- `28_gateway_agent_proxy` (complete) — agent 1.2.0's `haproxy` / `nginx` / `sockets` sections and the captured fixtures.
+- `29_gateway_dashboard_page` (complete) — the `gateway` poller job, `/api/gateway/*`, the page's chrome, the six-tab masthead. This phase **reshapes** that payload and page; it does not remove the job, the routes, the tab, or the gauges.
+- `27_mobile_tables_and_audit` (complete) — the 360 px audit script `data/logs/27-task02-mobile-audit.cjs` must still exit 0 with `/gateway`'s new rows in it.
+
+## Tasks
+
+1. `01_the_connection_graph.md` — `sources/gateway.py`: the config-derived graph — `listeners[]` + `connections[]` (haproxy `frontend → backend → server`, nginx vhost `server_name → proxy_pass`, stream `proxy_pass $var → map` entries, `proxy_pass <pool> → upstream` servers), with no counts yet.
+2. `02_the_join_simplified.md` — the surviving socket join (inbound by local port, outbound by exact address only), the shared-endpoint rule, the deletion of `outbound` / `by_port` / `unmatched` / `partial`, the gauges re-pointed, and `/api/summary`'s `gateway` block plus the overview's one line reshaped in the same commit.
+3. `03_config_warnings.md` — `warnings()`: the seven config-integrity kinds (and three refusals), empty on this fleet's captured configs (a pinned assertion), plus one `warn` overview row from `alerts.py`.
+4. `04_page_two_tables.md` — `gateway.html` + `page-gateway.js` + structural CSS: exactly **two** panels (nginx, haproxy), trunk → leaf rows, the warnings panel on the shared `ul.alerts` vocabulary, four header tallies, the degradation arms kept.
+5. `05_lines_and_switches.md` — `dash.css` + `page-gateway.js`: the connecting line (straight across for haproxy, branched for nginx), the green `--gate-on`/`--gate-off` existence pair, `live` motion, the switch built to the sketch and pinned as unwired. The `ok|warn|fail`-in-the-pipe-section pin is **restated**, not deleted.
+6. `06_docs_and_verify.md` — `AGENTS.md` (the `sources/gateway.py`, `api.py`, `alerts.py`, metric-naming, UI-conventions and gap-13 passages) + `README.md`, the browser pass at 1440 px and 360 px with screenshots, the mobile-audit re-run, and the read-only live verification against the real ingress.
+
+## Testing & Quality
+
+- Unit: `tests/test_gateway_source.py` is **rewritten around the graph** — every connection the captured configs declare is present and no other; the join identity is restated as *"the inbound counts sum to the ESTABLISHED sockets whose local port a config names"* (the old `inbound + outbound + unmatched == the table` identity dies with `unmatched`); `socket.getaddrinfo` stays spied and **never called**; the six warning kinds each get a synthetic broken config and the captured configs pin **zero** warnings. `tests/test_api.py`'s gateway pins are rewritten in the same tasks that change the payload/page — including `GATEWAY_PAGE_FIELDS`, `GATEWAY_FIELDS`, the stub/answer key-parity pin, the no-verdict/no-window walk, and the colour pin (restated per decision 1).
+- Integration: the page renders from a fixture-driven dev store; the warnings panel appears only when a warning exists; the chart disclosure stays collapsed-lazy-one-request-per-card.
+- Coverage: **>90%** on new/modified Python (`sources/gateway.py`, `alerts.py`, `api.py`).
+- The phase is "Complete" only when the **entire** project test suite passes 100% (every test in the project, not just this phase's) and `bash .agents/validate.sh` is green, coverage floor included.
+
+## Documentation & Consistency
+
+- The final pass reviews `README.md` and `AGENTS.md` in full against the project as it stands after this phase — fixing every inconsistency found, **including pre-existing ones not caused by this phase**. For this phase that specifically means: `AGENTS.md`'s `sources/gateway.py` bullet (the payload keys, the join, the deleted `unmatched`/`by_port`/`partial`), its `api.py` `/api/gateway/*` paragraph and the `/api/summary` `gateway` block field list, its `alerts.py` bullet (the gateway alert is no longer reachability-only), the `/gateway` UI-conventions paragraph (two tables, joined lines, green = in the config, the unwired switch), the metric-naming paragraph, and **gap 13** (the clipped-pipe-label gap, which the new row layout either resolves or restates honestly).
+- Tasks update `README.md`/`AGENTS.md` immediately when their own changes are user-visible.
+
+## Completion Criteria
+
+- [ ] `/gateway` serves and renders **exactly two** cards, `nginx` and `haproxy`; no `stream map` card, no `unmatched` card, no third table.
+- [ ] Every haproxy row draws its line **straight across** from `:<bind port>` to its `server` target; the nginx `:443` trunk **branches** to each `map` entry (16 on this fleet) and each http vhost trunk to its `proxy_pass` target — measured in the browser pass, not asserted in prose.
+- [ ] Every configured line is **green**; it animates only while its live count ≥ 1; both states still static under emulated `prefers-reduced-motion: reduce`. No `severity` key at any depth of the payload; no `severityFrom`/`severityFor` in the page script.
+- [ ] One switch per connection, `role="switch"` + `aria-checked="true"` + `aria-disabled="true"`, no click handler bound, `title` naming the missing write path — and a test that fails if it becomes clickable without a handler or stops saying it is unwired.
+- [ ] `POST` nothing: the verb-enumeration pin still finds `/api/ups/command` as the app's only upstream write, and `/gateway` dials only `/api/gateway/snapshot` + `/api/gateway/history`.
+- [ ] `GET /api/gateway/snapshot` on the live ingress: `warnings == []`, every one of the 6 haproxy frontends connected to its `server`, `:443` connected to the 17 `map` entries, `:4443`/`:8443` connected to their `proxy_pass` targets, and no `unmatched` / `by_port` / `partial` key anywhere.
+- [ ] A `gateway` `warn` row appears in `/api/summary.alerts` **iff** `warnings` is non-empty, and disappears when they are; a stale/stopped `gateway` job still alerts exactly as before.
+- [ ] `uv run pytest` (incl. `--cov` ≥ 94 floor), `uv run ruff check src tests agent`, `uv run pyright`, `node --check` on the changed scripts, `bash .agents/validate.sh` — all green.
+- [ ] `data/logs/30-*.png` screenshots at 1440 px and 360 px; `data/logs/27-task02-mobile-audit.cjs` still exits 0 with `/gateway` in its sweep.
+- [ ] README.md and AGENTS.md are accurate and consistent with the whole project (verified in the final pass).
+- [ ] No behaviour change in completed work: the other five dashboards and `/settings`/`/certs` render as before; `host:*`, `disks:*`, `llm:*`, `nut` still read `ok` in `./scripts/dev-server.sh status` (10 sources, `gateway` included).
diff --git a/.agents/phases/complete/30_gateway_connection_map/01_the_connection_graph.md b/.agents/phases/complete/30_gateway_connection_map/01_the_connection_graph.md
new file mode 100644
index 0000000..58b170f
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/01_the_connection_graph.md
@@ -0,0 +1,78 @@
+# Task 01 — The connection graph: `listeners` and `connections`, derived from config text only
+
+**Phase:** `30_gateway_connection_map` · **Source:** operator request 2026-10-23 — "the dotted line connections need to connect to their counterparts… for nginx you'll need to branch the lines from `:443` to the services they connect to… this is just 'exists in config therefore it is a connection'"
+**Story:** n/a
+
+## Objective
+
+`sources/gateway.py` learns the thing it never published: **which outbound target belongs to which inbound listener**. It gains `connections[]` — one entry per connection the two configs actually declare, each carrying its inbound port, its outbound endpoint, and the config's own selector for it (a haproxy backend name, an nginx `server_name`, a stream `map` key) — and renames `inbound` to `listeners`, because "inbound" was a direction and this is a thing the page draws a trunk for. Task 01 adds the graph and renames; task 02 deletes the guessing socket join. **No agent change**: everything needed is already in agent 1.2.0's `haproxy` / `nginx` sections, including `upstreams` and `maps`.
+
+## The graph, stated exactly
+
+**`listeners[]`** — one per configured listen port, same claim rule as today's `inbound`, same `metric` string:
+
+```
+{"port": 443, "source": "nginx", "domains": ["_"], "connections": 0|int|None,
+ "clients": [...], "metric": "gateway.in_conns@443"}
+```
+
+**`connections[]`** — one per `(source, in_port, out_host, out_port)`, selectors merged, in config order:
+
+```
+{"id": "nginx:443->reeseapps-homepage.reeselink.com:443",
+ "source": "nginx",                                  # the card it belongs to: "haproxy" | "nginx"
+ "in": {"port": 443},
+ "out": {"host": "reeseapps-homepage.reeselink.com", "port": 443,
+         "name": None,                                # the haproxy `server` name when there is one
+         "kind": "map",                               # "backend" | "server_name" | "pool" | "map"
+         "selectors": ["homepage.reeseapps.com"],     # the config's own word(s) that reach this target
+         "address": False},                           # True when the config wrote an IP literal
+ "connections": None,                                 # filled by task 02; task 01 always None
+ "metric": "gateway.out_conns@reeseapps-homepage.reeselink.com:443"}
+```
+
+Derivation, per config family:
+
+1. **haproxy** — `frontend → routes → backend → server`. For every frontend row (one per `bind` port, `routes` = `default_backend` then each `use_backend` name, which `haproxy_frontends()` already builds — note the agent's own `frontend.backends` holds **only** the `use_backend` names and keeps `default_backend` separate, which is why that insert exists) and every `server` of each routed backend block: a connection with `in.port = the bind port`, `out = {host: server.target, port: server.port, name: server.name, kind: "backend", selectors: [backend name]}`. This needs `haproxy_targets()` to stop dropping the backend it was declared in — change its rows to `{name, host, port, backend}`.
+2. **nginx http vhost** — for every `server` **block**, for every `proxy_passes` entry with a concrete `target` and a port: one connection **per `listen` port of that block**, `out.selectors = the block's server_names` verbatim (the catch-all `_` included), `kind: "server_name"`.
+3. **nginx pool** — a `proxy_pass http://<name>` with **no port** names an `upstream` block. When an `upstreams[]` entry has that name: one connection **per upstream `server` host:port**, `kind: "pool"`, `selectors: [<pool name>]`. When none does: **no connection** (that is task 03's `nginx_pool_undeclared`).
+4. **nginx stream map** — a `proxy_pass` with `variable` set: find the `maps[]` block whose `variable` matches after `lstrip("$")`. For each of its `entries` with a target, one connection **per `listen` port of the block that wrote the `proxy_pass`**, `kind: "map"`, `selectors: [entry.key]`. The key `default` is kept **verbatim** — it is the config's own word for "everything nobody mapped", not a guess. A map no `proxy_pass` names contributes nothing (the `$connection_upgrade` rule, unchanged), and an entry with a null target contributes nothing (task 03 warns about it).
+5. **Never** invent a connection for what the payload cannot decide: a `proxy_pass` with neither `target` nor `variable` (a unix socket, a bare word) yields nothing and **no warning**; a haproxy frontend whose only routing is a fetch expression (`use_backend %[req.hdr(host),map_dom(...)]`, which the agent reports as no name) yields its **listener** and **no connections** — the page draws that trunk alone, and `AGENTS.md` rule 2 is why it is not a warning: "no name" and "no routing directive" are one value in this payload.
+
+Merge rule: identical `(source, in_port, host, port)` is **one** connection whose `selectors` are the union in first-seen order (one vhost's two names arriving at one pool is one line, not two). Never merge across `in_port` — `:4443 → keycloak:8080` and `:8443 → keycloak:8080` are two pipes on two socket spaces (the `minecraft` 25565/25566 lesson).
+
+## Work
+
+1. `src/dashboards/sources/gateway.py`
+   - `haproxy_targets()`: rows gain `backend`; docstring says the backend name is what makes the frontend→server join possible.
+   - New `nginx_server_blocks(section)` returning one row per **server block** — `{ports: [int], names: [str], proxies: [entry]}` — so the block's `listen`, `server_name` and `proxy_pass` stay associated (today's `nginx_listen_ports()` merges names across blocks and loses exactly the fact this task needs; keep it if the echo still needs it, or derive the echo from `nginx_server_blocks()` — do not keep two readers of the same block).
+   - New `config_connections(snapshot_haproxy, snapshot_nginx) -> list[dict]` implementing rules 1–5 + the merge, pure and clock-free, with the module docstring gaining a **"The connection graph"** section stating the four derivations, the merge rule, and the two refusals (rule 5).
+   - `parse()`: rename the `inbound` payload key to `listeners` (its rows keep every field they had, including `metric`), add `payload["connections"] = config_connections(...)`, and keep `outbound` and `unmatched` **untouched for this task** (task 02's business). `connections[].connections` stays `None` here — say so in a comment so task 02's owner sees where the count lands.
+   - `_skeleton()`: add `"listeners": []` and `"connections": []` (replacing `"inbound": []`) so `stub()` grows the same key set — the key-parity test fails otherwise.
+2. `src/dashboards/api.py` — the mechanical rename in every reader of the payload: `/api/gateway/snapshot` (it passes the payload through plus `states`), the `/api/summary` `gateway` block (its `inbound`/`outbound` totals now read `payload["listeners"]` / `payload["outbound"]`; **keep the block's field names as they are** — task 04 reshapes that block deliberately, and this task must not change `/api/summary`'s shape).
+3. `src/dashboards/web/static/page-gateway.js` — the minimum that keeps the page honest while task 05 rewrites it: `familyPipes()` reads `snapshot.listeners` instead of `snapshot.inbound`, and `renderHeader()`'s inbound tally does too. Nothing else about the drawing changes.
+4. `tests/test_gateway_source.py` — keep every existing assertion working under the rename, and **add the graph pins** (this task's real product):
+   - `test_every_connection_the_captured_configs_declare_is_drawn` — against the real `gateway_snapshot` fixture, **32** connections total, asserted as the **set** of `(in_port, out.host, out.port)` so a missing or extra one fails by name:
+     - **6** haproxy, one `server` each: `:22 → reeseapps-gitea.reeselink.com:2222` (`gitea`), `:2000 → stackexpected-gitea.reeselink.com:2222`, `:5201 → web.reeselink.com:5201`, `:8080 → unifi-external.reeselink.com:8080`, `:25565 → minecraft.reeselink.com:25565`, `:25566 → minecraft.reeselink.com:25566`
+     - **17** on nginx `:443` from the stream map — the 16 `*.reeselink.com:443` entries **plus** `default → 127.0.0.1:4443`
+     - **6** on nginx `:4443` (nextcloud `:11000`, gitea `:3000`, jellyfin `:8096`, bricktracker `:3333`, keycloak `:8080`, emmaleaf `:80`) and **3** on `:8443` (nextcloud `:11001`, `127.0.0.1:8081`, keycloak `:8080`), each with its own `server_name` in `selectors`
+     - `:80` (nginx, `server_name _`) is a **listener with no connection** — it declares no `proxy_pass`. That is this fleet's live instance of refusal rule 5 and it gets its own assertion: the trunk exists, `connections` names port 80 nowhere.
+   - `test_a_haproxy_connection_carries_the_backend_and_the_server_name` — `out.name == "gitea"`, `out.kind == "backend"`, `selectors == ["gitea-2222"]`.
+   - `test_the_stream_default_entry_is_kept_verbatim` — a connection whose `selectors == ["default"]` to `127.0.0.1:4443`, `out.address is True`.
+   - `test_a_pool_names_its_upstream_servers_and_an_undeclared_pool_draws_nothing` — synthetic nginx config with `upstream backend_pool { server 10.0.0.1:3000; server 10.0.0.2:3000; }` + `proxy_pass http://backend_pool;` → two connections `kind == "pool"`; and `proxy_pass http://no_such_pool;` → no connection at all (and **no** invented host).
+   - `test_two_names_one_target_one_port_is_one_connection` (selectors merged, first-seen order) and `test_the_same_target_on_two_listen_ports_is_two_connections` (the `admin.keycloak` / `keycloak` pair from the real `http.conf`).
+   - `test_a_frontend_that_routes_by_expression_is_a_listener_with_no_connection` and `test_a_proxy_pass_with_neither_target_nor_variable_draws_nothing` — the two refusals.
+   - `test_no_connection_is_ever_invented_for_a_port_no_config_names` — walk every `connections[].in.port` and assert it is in `listeners`.
+5. `tests/test_api.py` — the rename only: `GATEWAY_PAGE_FIELDS`' `inbound…` paths → `listeners…`, the stub/answer key-parity pin's expected key set, `test_the_gateway_stub_and_the_answer_share_one_key_set`, `test_the_gateway_snapshot_carries_no_verdict_and_no_window` (walk `connections` too), `test_gateway_snapshot_answers_the_pipes_the_projection_joined`, and `/api/summary`'s `GATEWAY_FIELDS` **unchanged in names** (only its derivation moved).
+
+## Testing & Quality
+- Unit/integration: the pins above; `uv run pytest tests/test_gateway_source.py tests/test_api.py -q` then the full suite. Coverage **>90%** on `sources/gateway.py`'s new branches (all four derivations, both refusals, the merge, the undeclared-pool arm).
+- `uv run ruff check src tests agent && uv run pyright` clean; `node --check src/dashboards/web/static/page-gateway.js`.
+
+## Completion Criteria
+- [ ] `GET /api/gateway/snapshot` on the dev server (live ingress) returns `listeners` (10 rows today), `connections` (**32** on the captured configs — 6 haproxy + 17 stream-map + 9 vhost; the *test* asserts the captured fixture's set, the live read is a recorded observation, not an assertion, because `/etc/nginx` on a router changes), and `outbound` still present.
+- [ ] Every connection's `in.port` appears in `listeners`; every haproxy connection names its backend; every stream connection names its map key; `default` survived.
+- [ ] `stub()` and `parse()` answer the same key set (pinned).
+- [ ] `uv run pytest` **100% passing**, coverage not down; ruff + pyright + `node --check` clean.
+- [ ] `README.md`/`AGENTS.md` — no user-visible change yet (the page still draws the old cards); note nothing here, task 04/05 do the doc updates.
+- [ ] No behaviour change in completed work: the other pages byte-identical, the 10 sources `ok`.
diff --git a/.agents/phases/complete/30_gateway_connection_map/02_the_join_simplified.md b/.agents/phases/complete/30_gateway_connection_map/02_the_join_simplified.md
new file mode 100644
index 0000000..7925dfb
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/02_the_join_simplified.md
@@ -0,0 +1,43 @@
+# Task 02 — Delete the guessing socket join: inbound by port, outbound by exact address, nothing else counted
+
+**Phase:** `30_gateway_connection_map` · **Source:** operator request 2026-10-23 — "This isn't live tracking, this is just 'exists in config therefore it is a connection'… I don't know what the unmatched section is" + the two follow-up decisions: *"exact-address match stays"* and *"ignore anything not in haproxy or nginx configs"*
+**Story:** n/a
+
+## Objective
+
+The socket table stops deciding the page's shape. `sources/gateway.py` keeps **exactly two** sound attributions — a socket's **local port** names a configured listener (inbound), and a socket's remote `(address, port)` **equals a target the config wrote as an address** (outbound) — and ignores every other socket: not counted, not totalled, not warned about. `outbound[]`, `unmatched`, `unmatched.groups`, `partial`, `unmatched_listeners`, `by_port` and `MAX_GROUP_HOSTS` leave the payload; `AGENTS.md`'s "the join is the whole honesty of the module" passage is rewritten in task 06 against this file.
+
+**Why the deleted arms went** (state this in the module docstring, because the reason is the rule): a config writes `reeseapps-brain.reeselink.com:443` and `/proc` reports `10.1.1.106:443`. Nothing in this stack resolves a name (pinned by the `socket.getaddrinfo` spy), and 16 map entries share port 443, so the old `by_port` arm could only credit a port — which the module itself refused to attribute and dumped in `unmatched.outbound`. On the live router that residual was **mostly this app talking to itself**: the "listeners no config names" were `9120` (the dashboards agent's own port) and `2222`. A residual that is mostly other software is not a signal, and a card of it teaches the operator to ignore the panel.
+
+## Work
+
+1. `src/dashboards/sources/gateway.py`
+   - `join_sockets(listeners, endpoints, established)` — rewrite to the two arms above and **return nothing**; it stamps counts in place. Signature docs state the new identity: *"every socket is counted at most once; inbound + outbound ≤ `established`; a socket that matches neither is not counted at all, by decision."* Keep the `continue`-after-count discipline (a loopback hop is two `/proc` rows and must not be drawn down one pipe twice).
+   - Build `endpoints: dict[(host, port), {"connections": int, "routes": int}]` from the **address-written** `connections` only (`out.address is True`); `routes` counts how many connections claim the endpoint. After the pass, stamp `conn["connections"] = endpoint["connections"]` and `conn["shared"] = endpoint["routes"] > 1`. A name-written connection keeps `connections: None` — the truth, not a zero.
+   - Delete: `outbound` / `_outbound_pipe()` / `_groups()` / `MAX_GROUP_HOSTS` / `live_listen_ports()` (its only job was the unmatched direction test) / the `unmatched` key from `_skeleton()`. Add `payload["endpoints_live"]`? **No** — nothing needs it; the page reads the count off each connection.
+   - `samples()`: gauges from `listeners[].metric` (`gateway.in_conns@<port>`) and `connections[].metric` (`gateway.out_conns@<host>:<port>`) whenever the value is a number. Consequence to state in the docstring **and** in task 06's `AGENTS.md` pass: **name-keyed `gateway.out_conns@<domain>:<port>` series stop being written**, because the number they carried was the port's, not the target's; existing rows age out under the unchanged retention policy, so no schema or prune change (invariant 9).
+   - Module docstring: replace "The join, and where its honesty lives" with the two surviving arms + the ignore rule + the loopback-hop note; keep "No DNS, ever" and "No verdict" verbatim (they are unchanged rules).
+2. `src/dashboards/api.py`
+   - `/api/gateway/snapshot`: passes the payload through plus `states` — update to the new key set (drop `unmatched`), nothing else.
+   - `/api/summary`'s `gateway` block becomes exactly: `{configured, host, href, supported, unreachable, listeners, connections, live_in, live_out, map_targets, states}` — `listeners`/`connections` are the row counts, `live_in`/`live_out` are the sums of the counts that answered (**`None`, never `0`,** when the socket table did not answer or nothing answered), `map_targets` stays the stream-map entry count, `href` still comes from `alerts.HREF`. `unmatched`, `unmatched_listeners` and `partial` are **deleted**. (`warnings` joins this block in task 03.)
+   - `/api/config`'s `gateway` row is unchanged (it never named a pipe field).
+3. `src/dashboards/web/static/page-index.js` — the one line under the fleet table reads the new block: `gateway <listeners> ports · <connections> routes · <live_in> live`, every figure `n/a` when the block says `null`, the shared `.stale` dim when `unreachable`, and **nothing at all** when `configured: false` (invariant 3, unchanged). `href` comes from the block; the page invents no route and no number.
+4. `src/dashboards/web/static/page-gateway.js` — **compatibility only**, so the page stays truthful while task 04 rebuilds it: the outbound column reads `snapshot.connections` filtered by `source` (map each to the shape the existing row renderer wants, or inline a small renderer — do not add new visual vocabulary here), the `by port` chip and its `title` are **deleted**, the `unmatched` card is deleted from the JS and its `<article>` from `gateway.html`, the header's `unmatched` tally cell is deleted, and `sumConnections()` reads `listeners` / `connections`. Any deleted id must leave no orphan container (the orphan-`id` audit).
+5. `tests/test_gateway_source.py` — rewrite the join pins:
+   - **delete** `test_a_domain_target_is_matched_on_port_alone_and_labelled_by_port`, `test_a_port_shared_by_several_names_resolves_none_of_them`, `test_the_group_host_list_is_bounded_and_reports_the_real_total`, `test_a_listening_port_no_config_claims_stays_visible`, `test_a_connection_on_a_port_no_config_names_is_reported_not_dropped`.
+   - **add** `test_a_name_target_is_never_credited_for_a_socket_on_its_port` (the 16-way `:443` fan-out keeps `connections: None`, and the sockets are not counted anywhere — assert the sum over `connections` is unchanged by their presence), `test_a_port_no_config_names_is_neither_counted_nor_reported` (add a LISTEN row on 9120 to a synthetic table: nothing in the payload mentions it), `test_an_endpoint_written_as_an_address_is_matched_exactly_and_carries_its_count` (no `by_port` key exists any more — assert its absence), `test_two_connections_sharing_an_endpoint_say_so_and_repeat_the_count_never_split_it` (`shared: true`, both carry the endpoint's number), `test_the_loopback_hop_counts_once_on_each_side` (`:4443` inbound and `127.0.0.1:4443` outbound each take their own `/proc` row, and no row is counted twice).
+   - **restate** `test_the_live_counts_reconcile_with_the_socket_table` as: every inbound count's port is a configured listener, `sum(listeners) + sum(endpoint counts) <= established`, and `sockets.listens` / `sockets.established` equal the fixture's raw row counts. Keep `test_no_join_ever_asks_a_resolver` exactly as it is.
+6. `tests/test_api.py` — `GATEWAY_PAGE_FIELDS` and `GATEWAY_FIELDS` to the new key sets; the stub/answer key-parity pin; `test_the_gateway_snapshot_carries_no_verdict_and_no_window` walks `connections` too (recursive: no `severity`, no `window_seconds` at any depth); `test_the_summary_gateway_block_is_the_payloads_sums_not_the_pages_arithmetic`, `…_is_the_stub_of_a_source_that_never_answered`, `…_of_the_captured_ingress_reads_the_live_join`; `test_a_dead_gateway_host_is_one_overview_line_not_three` (the `disks`/`gateway` echo-suppression rule is unchanged — a dead host's `gateway` job still adds nothing new); `test_the_gateway_counts_grow_no_verdict_alert_even_with_verdicts_in_the_payload` now injects `severity` into `listeners` **and** `connections`; the overview-line pin `test_the_overview_line_reads_the_gateway_block_it_claims` resolves `GATEWAY_FIELDS` against a live document and `page-index.js`'s readers; `/gateway`'s markup pins for the deleted unmatched card and `by port` chip (the **absence** of both, now).
+
+## Testing & Quality
+- Unit/integration: the pins above; the full suite plus the **live** read (`uv run pytest -m live --live`) confirms `gateway` still reads `ok` and the snapshot's `listeners` counts match `ss -tan` on the router for configured ports.
+- Coverage: **>90%** on `sources/gateway.py` (both arms, the shared-endpoint arm, the sockets-silent arm), `api.py`'s changed block, `page-index.js` pinned on served bytes.
+
+## Completion Criteria
+- [ ] `grep -rn "unmatched\|by_port\|MAX_GROUP_HOSTS" src/ tests/` finds nothing outside a comment explaining what was removed and why.
+- [ ] `GET /api/gateway/snapshot` (live): no `unmatched`, no `outbound`, no `by_port`; `connections[].connections` is a number **only** for the address-written endpoints (`127.0.0.1:4443`, `127.0.0.1:8081` today) and `null` for every name.
+- [ ] `GET /api/summary` → `gateway` block has exactly the 11 fields listed above; `unmatched` / `unmatched_listeners` / `partial` are gone; the overview page's one line prints ports / routes / live and vanishes when unconfigured.
+- [ ] Nothing in the payload mentions port `9120` or any other port the two configs do not name (live check + pinned).
+- [ ] `uv run pytest` **100% passing** incl. `--cov` ≥ 94 floor; ruff + pyright + `node --check` on both changed scripts.
+- [ ] `AGENTS.md`'s `sources/gateway.py` / `api.py` `/api/gateway/*` / `/api/summary` passages no longer describe `unmatched`/`by_port`/`partial` (full rewrite lands in task 06; this task must not leave a sentence that **contradicts** the shipped payload).
+- [ ] No behaviour change in completed work: the five other dashboards and the two admin pages unchanged, 10 sources `ok`.
diff --git a/.agents/phases/complete/30_gateway_connection_map/03_config_warnings.md b/.agents/phases/complete/30_gateway_connection_map/03_config_warnings.md
new file mode 100644
index 0000000..c24365b
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/03_config_warnings.md
@@ -0,0 +1,63 @@
+# Task 03 — Config-integrity warnings: seven kinds, from the config text, on the page and one row on `/`
+
+**Phase:** `30_gateway_connection_map` · **Source:** operator request 2026-10-23 — "I don't know what the unmatched section is, there should be nothing unmatched, but if there is that should be called out in a **list of warnings to address** like other things in this dashboard project" + the follow-up decision *"Ignore anything not in haproxy or nginx configs"* and *"Config integrity, yes"*
+**Story:** n/a
+
+## Objective
+
+With everything outside the two configs ignored (task 02), the only warning left worth an operator's attention is a config that **does not connect to itself**. `sources/gateway.py` gains `warnings(snapshot)` — seven kinds, each derived from config text alone, each actionable — the payload carries them, `/api/summary` counts them, and `alerts.py` raises **one** `warn` row for them. That row is the deliberate change to the documented "a `gateway` alert is reachability only" rule, and task 06 rewrites that rule in `AGENTS.md` against this file.
+
+## The seven kinds
+
+Each warning is `{"id", "kind", "subject", "message"}`; `id = f"{kind}:{subject}"` is the page's stable DOM key; `message` is operator-facing prose written in this file's voice, carrying the config's own words verbatim.
+
+| kind | condition | message shape |
+|------|-----------|---------------|
+| `haproxy_route_dangling` | a frontend's `default_backend` or any `use_backend` name no `backend` block declares | `frontend haproxy-22 routes to backend "gitea-2222", which no backend block declares` |
+| `haproxy_backend_orphan` | a backend that declares ≥ 1 `server` and appears in no frontend's routes | `backend "old-tunnel" has 2 servers and no frontend routes to it` |
+| `haproxy_backend_empty` | a backend block with no `server` line at all | `backend "gitea-2222" declares no server — it routes nowhere` |
+| `nginx_server_unlistened` | an nginx `server` block with `server_name` and/or `proxy_pass` and **no** `listen` | `nginx server "nextcloud.example.com" proxy_passes but never listens` |
+| `nginx_pool_undeclared` | a `proxy_pass http://<name>` with no port and no matching `upstream` block (task 01 draws no connection for it) | `nginx listen 4443 proxy_passes to pool "backend_pool", which no upstream block declares` |
+| `nginx_variable_unmapped` | a `proxy_pass $var` with no `map` block defining that variable | `nginx listen 443 proxy_passes $targetBackend, which no map block defines` |
+| `nginx_map_route_missing` | an entry in a **referenced** map whose target is null | `map $targetBackend entry "x.example.com" names no address to route to` |
+
+**Three deliberate non-warnings** (each gets a comment where the check would have gone, because the absence is the rule):
+
+- an nginx `server` block with a `listen` and no `proxy_pass` — it may be a static or redirect vhost, and this payload cannot tell the two apart, so a warning would invent a fault;
+- a haproxy `frontend` whose only routing is a fetch expression (`use_backend %[req.hdr(host),map_dom(…)]`, which agent 1.2.0 reports as **no name**) — "no name" and "no routing directive" are one value on the wire, so warning about it blames a config this agent cannot read; making this distinguishable is an agent change (a `routes_dynamic` flag), not a source-level guess;
+- a `proxy_pass` with neither `target` nor `variable` (a unix socket, a bare word) — legitimate, undrawable, not broken.
+
+A section is judged **only** when its own `available` is `True`. `predates`, `no file`, and `unreadable config` produce **no** warnings — a host that cannot be read has not been found guilty of anything (invariant 3).
+
+## Work
+
+1. `src/dashboards/sources/gateway.py`
+   - New pure `warnings(haproxy_section, nginx_section) -> list[dict[str, str]]` implementing the table above with the three refusals, deterministic order (haproxy kinds in config order, then nginx kinds in config order), deduplicated by `id`.
+   - `parse()`: `payload["warnings"] = warnings(haproxy, nginx)` when supported, `[]` in the predates arm and whenever the socket/config halves did not answer; `_skeleton()` gains `"warnings": []` so `stub()` matches (the key-parity pin).
+   - Docstring: a short **"What this module warns about"** section — the seven kinds, the three refusals, and the sentence *"a warning here is a config that does not connect to itself; nothing outside the two configs is reported at all."*
+2. `src/dashboards/alerts.py`
+   - `build(...)` gains `gateway_payload: Mapping[str, Any] | None = None` (keyword, last, defaulted, so every existing caller and test keeps working).
+   - One row, emitted **only when the payload exists, the job is currently answering, and `warnings` is non-empty**: `{id: "gateway:config", severity: "warn", source: "gateway", message: f"{n} proxy config {problem/problems} to address — {first['message']}", href: HREF["gateway"], at: <payload ts when it has one>}`. When the `gateway` job is failing or stale the reachability row it already produces is the **only** line (the existing "a dead source gets exactly one line" rule), so a dead agent never yields two.
+   - This module still holds **no thresholds** and no `severity.py` row: a config warning is a structural fact, not a graded number. Update this module's docstring rule list — it currently says the gateway source has "no verdict rule and none is wanted"; it now says: *reachability plus config-integrity, no graded number, ever.*
+3. `src/dashboards/api.py` — pass the gateway payload to `alerts.build(...)` from `/api/summary`; add `warnings` (the count) to the `gateway` block; `GATEWAY_FIELDS` pin extended in the same commit.
+4. `src/dashboards/web/static/page-index.js` — the overview's one gateway line appends ` · N to address` **only when `warnings > 0`**, so a clean ingress's line does not grow a permanent zero.
+5. `tests/test_gateway_source.py` — one test per kind, each on a **synthetic** config written into the fake `--root` tree the `gateway_snapshot` fixture uses (or a hand-built section dict where the agent's parser would only be in the way, which is legitimate for a pure function over sections — say which you used in the test docstring), plus:
+   - `test_the_captured_configs_produce_no_warnings` — the real fixture asserts `warnings == []` **and** the exact reason per kind (this is the pin that keeps the seven checks from being a lie about this fleet);
+   - `test_an_unreadable_or_absent_section_warns_about_nothing` (`no_haproxy` / `no_nginx` / `predates` modes),
+   - `test_a_listen_with_no_proxy_pass_is_not_a_warning` and `test_a_frontend_routing_by_fetch_expression_is_not_a_warning` (the refusals, pinned in the direction that they produce **no** warning while still producing their listener),
+   - `test_warnings_are_deterministic_deduplicated_and_json_serialisable`.
+6. `tests/test_alerts*.py` (whichever file holds the `alerts.build` suite today) — the row appears for one warning and for seven; **one** row, not one-per-warning; `severity == "warn"`; `href == "/gateway"`; a failing/stale `gateway` job yields its reachability row and **not** the config row; an unconfigured gateway yields nothing (invariant 3); the `disks`/`gateway` echo-suppression table is unchanged.
+7. `tests/test_api.py` — `/api/summary` with a mutated gateway payload (the `self_test_app` precedent: swap the collector so a poll cannot overwrite what the test set) yields exactly one new `warn` row linking to `/gateway`, and the same mutation with an empty `warnings` list yields none. **Both directions**, per the project's testing policy.
+
+## Testing & Quality
+- Unit/integration: as listed; the alert row's two directions are mandatory.
+- Coverage: **>90%** on `warnings()`, the `alerts.build()` branch, and the `api.py` wiring.
+
+## Completion Criteria
+- [ ] `GET /api/gateway/snapshot` on the live ingress answers `warnings: []`, and `GET /api/summary` carries **no** `gateway:config` alert row.
+- [ ] Injecting one synthetic dangling `use_backend` into the fixture produces exactly one `haproxy_route_dangling` warning, one `warn` row on `/api/summary` whose `href` is `/gateway`; removing it produces none (both pinned).
+- [ ] A `gateway` job that is failing produces its reachability row and **no** config row (pinned).
+- [ ] `test_the_captured_configs_produce_no_warnings` is green and names why each of the seven kinds cannot fire on this fleet.
+- [ ] `uv run pytest` **100% passing**, coverage not down; ruff + pyright clean.
+- [ ] `AGENTS.md`'s `alerts.py` bullet updated in this task (it documents a rule this task changes) — task 06 re-checks the whole file.
+- [ ] No behaviour change in completed work: no other source's alert rows change shape or count, the overview's two-panel structure is intact.
diff --git a/.agents/phases/complete/30_gateway_connection_map/04_page_two_tables.md b/.agents/phases/complete/30_gateway_connection_map/04_page_two_tables.md
new file mode 100644
index 0000000..e174f5f
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/04_page_two_tables.md
@@ -0,0 +1,68 @@
+# Task 04 — Two panels, not four: the nginx and haproxy connection tables, grouped trunk → leaves
+
+**Phase:** `30_gateway_connection_map` · **Source:** operator request 2026-10-23 — "the stream map shouldn't be its own table, it's part of nginx. There should be only 2 tables: nginx and haproxy"
+**Story:** n/a
+
+## Objective
+
+`/gateway` becomes two panels and one warnings list. The `stream map` card is gone — a `map` is part of nginx, so its 17 entries are drawn as the leaves of nginx's `:443` trunk — and the `unmatched` card is gone (task 02 deleted the data behind it). Each card lists its **listeners**, and under each listener the **connections** that listener's config declares, so the structure of the page *is* the structure of the file. This task ships the markup and the render pass with the connectors present but plainly styled; task 05 gives them the green line, the elbows and the switches.
+
+> **On the word "table":** these are `.card` panels with a header row and one row per connection, **not** `<table>` elements. A `<table>` cannot draw an elbow from `:443` to sixteen rows, and `AGENTS.md` pins `table.data` to the horizontal-scroll rules (phase 27) which a graph row does not want. The visual reading is a table — heading, aligned rows, a right-hand number column — and the orphan-`id` / every-`<table>`-carries-`data` pins stay green because no `<table>` is introduced.
+
+## Work
+
+1. `src/dashboards/web/pages/gateway.html`
+   - `#gate-cards` holds **exactly two** `<article class="card gate-card">`: `data-gate="nginx"` then `data-gate="haproxy"` (the operator named nginx first, and it is the bigger fan-out). Delete the `map` and `unmatched` articles and every id/class only they used.
+   - Each card body: `<div class="gate-map" data-k="map">` (groups injected here) + the `data-k="empty"` sentence + the existing `details.charts-box` block, unchanged in shape.
+   - New warnings panel, **above** the cards, shipped `hidden`:
+     ```html
+     <section class="card" id="gate-warnings" hidden>
+       <header><h3>Warnings to address</h3><span class="chip" id="warnings-count"></span></header>
+       <div class="body"><ul class="alerts" id="warnings-list"></ul></div>
+     </section>
+     ```
+     Its rows use the overview's vocabulary verbatim — `<li class="warn"><span class="src">haproxy</span><span class="msg">…</span></li>` — because "like other things in this dashboard project" is the instruction and `ul.alerts` *is* that thing. Clean means **hidden**, not an empty card.
+   - `#tallies` becomes four cells: `ports` (configured listeners), `connections` (config-declared connections), `live` (ESTABLISHED sockets on configured ports), `warnings`. `#t-listeners` / `#t-established` / `#t-unmatched` and their JS are deleted; `#sub` keeps `host · agent · N connections`.
+   - `<footer class="pagefoot">`: delete the `by port` sentence. Keep/rewrite three, each one sentence: the animation rule; **"only an endpoint the config wrote as an address can be matched to a socket — a name is never resolved, so its line carries no number"**; and **"the switch shows what the config says; toggling a route needs a config write path and is not wired up yet."**
+2. `src/dashboards/web/static/page-gateway.js`
+   - `CARDS = [{key: 'nginx', …}, {key: 'haproxy', …}]` and no third entry; `pruneCards` unchanged in behaviour.
+   - New `groupsFor(snapshot, key)` → `[{port, listener, connections: [...]}]`, ordered: ports ascending, connections in payload order. A listener with **no** connections still produces a group (this fleet's `:80` vhost with no `proxy_pass` is the live case) and its leaf list renders the one faint sentence `no target named in the config` — a refusal, never a blank row.
+   - `renderGroup(card, group)` builds once and patches afterwards (the `page-disks.js` / slot-grid discipline: keyed `Map` per card, `appendChild` reorders rather than rebuilds, so a 17-row fan-out is not re-created every 30 s). Row structure:
+     ```
+     <li class="gate-link" data-id="{connection.id}">
+       <span class="gate-elbow" aria-hidden="true"></span>
+       <span class="gate-switch-slot"></span>          <!-- task 05 fills this -->
+       <svg class="pipe on">…</svg>                    <!-- task 05 styles it -->
+       <span class="gate-target">
+         <span class="pipe-name mono">{host}:{port}</span>
+         <span class="gate-selector faint">{selectors joined} · {kind}</span>
+       </span>
+       <span class="pipe-count">{count or '—'}</span>
+     </li>
+     ```
+     Trunk: `:{port}` + the live count (`14 live` / `n/a`) + up to `CLIENTS_SHOWN` client addresses + the domains count (`16 names`, full list in `title`). Every upstream string (`server_name`, `proxy_pass`, map key, client address) goes out through `textContent`/`title` only, and the row's `title` + `aria-label` carry the **whole** endpoint even when CSS ellipsises it (gap 13's rule, re-measured in task 06).
+   - A count that is `null` prints `—` with `title` = `not attributed: the config names this endpoint as a name, and nothing here resolves names` — never `0`, and not a repeated `n/a` column of twelve identical words. A number prints through `countText`.
+   - `renderWarnings(snapshot)`: fills `#warnings-list` with one `li.warn` per payload warning (`src` = the config family word, `msg` = `warning.message`), sets `#warnings-count` to `N` , and keeps `#gate-warnings` `hidden` when the list is empty. The page renders `warnings` and never re-derives one.
+   - `renderHeader()` → the four tallies; the `.stale` dim and the three degradation arms (`why` banner, `unreachable` dim, `404 {configured:false}` → `#gate-empty` naming `GATEWAY_HOST` and agent **1.2.0**) keep their exact current behaviour. A failed poll still re-draws nothing (last good map stays).
+   - `cardStreams()` (the chart series list) reads `listeners` + `connections` for that source; one `/api/gateway/history` request per card per refresh, plot built only while the disclosure is open, `ariaLabel` on every plot — the phase-29 discipline, unchanged.
+3. `src/dashboards/web/static/dash.css` — the **structure** only in this task: `.gate-map` (grid, `min-width: 0`), `.gate-group` (two columns: trunk `minmax(0, 9.5rem)` + leaves `minmax(0, 1fr)`), `.gate-leaves` (list-style none, `display: grid`, gap), `.gate-link` (`display: grid`, `align-items: center`, columns for elbow / switch / pipe / target / count), `.gate-target` (`min-width: 0`), `.gate-selector` (11 px, ellipsis), `.gate-trunk` (`min-width: 0`), `@media (max-width: 640px)` stacking the group to one column with the trunk above its leaves. No colours, no dashed borders, no switch rules yet — task 05's job, so the two are reviewable separately.
+4. `tests/test_api.py` — rewrite the page-shape pins in the same commit:
+   - `test_the_gateway_page_is_a_card_per_source_family_with_a_reconciliation_row` → **`test_the_gateway_page_is_exactly_two_connection_panels_and_a_warnings_list`**: exactly two `[data-gate]` articles and they are `nginx` + `haproxy` (assert the list, ordered, so a third card fails); no `[data-gate="map"]`, no `[data-gate="unmatched"]`; `#gate-warnings` + `#warnings-list` exist and ship `hidden`; the four tally ids exist and the three deleted ones do not; every id on the page is referenced by the script or the stylesheet (the standing orphan audit must stay green by inspection of its own list).
+   - `test_the_gateway_page_prints_every_field_the_projection_publishes` → `GATEWAY_PAGE_FIELDS` resolves against a live payload, now including `connections[].in.port`, `connections[].out.host/port/name/kind/selectors/address`, `connections[].connections`, `warnings[].kind/subject/message`, `listeners[].domains/clients/connections`.
+   - `test_the_gateway_page_renders_each_degradation_arm_in_the_payloads_own_words` — still all four arms, on the new markup.
+   - `test_the_gateway_page_keeps_its_last_drawing_when_a_poll_fails` — unchanged behaviour, new selectors.
+   - **new** `test_the_stream_map_is_rendered_inside_nginx_and_nowhere_else` — the served script contains no `map` card key and the live payload's map-sourced connections are drawn under `source: "nginx"`; and `test_a_listener_with_no_declared_target_says_so_instead_of_drawing_nothing` (the `:80` arm), `test_warnings_render_in_the_overviews_alert_vocabulary_and_hide_when_clean` (both directions), `test_an_unattributed_endpoint_prints_a_dash_and_never_a_zero`.
+   - `test_no_page_narrates_its_own_pipeline` — the new footer sentences must pass the existing deleted-sentence list (they are operator-facing why-lines, not pipeline narration) and no removed sentence comes back.
+
+## Testing & Quality
+- Unit: served-bytes pins above (no JS runner in this repo — task 06's browser pass is the behavioural proof).
+- Coverage: the changed Python is nil-or-minimal here; the pins are the product. `node --check src/dashboards/web/static/page-gateway.js` clean.
+
+## Completion Criteria
+- [ ] `/gateway` renders **two** panels; the nginx panel's `:443` group lists 17 leaves on the live config, `:4443` six, `:8443` three, haproxy six groups of one, and `:80` shows its refusal sentence.
+- [ ] No `stream map` card, no `unmatched` card, no `by port` chip anywhere (grep + pin).
+- [ ] `#gate-warnings` is hidden with the live (clean) configs and appears with rows when a warning is injected into a fixture payload.
+- [ ] No sideways document scroll at 360 px with the 17-row fan-out open (measured now, re-measured in task 06).
+- [ ] `uv run pytest` **100% passing**, coverage not down; ruff + pyright + `node --check` clean.
+- [ ] README/AGENTS: the `/gateway` UI paragraph gains "two panels, nginx + haproxy, map is nginx's" in this task if the sentence already contradicts the shipped page; task 06 does the full pass.
+- [ ] No behaviour change in completed work: the other five dashboards + `/settings` + `/certs` byte-identical, 10 sources `ok`.
diff --git a/.agents/phases/complete/30_gateway_connection_map/05_lines_and_switches.md b/.agents/phases/complete/30_gateway_connection_map/05_lines_and_switches.md
new file mode 100644
index 0000000..ba40411
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/05_lines_and_switches.md
@@ -0,0 +1,96 @@
+# Task 05 — The line and the switch: green because it is in the config, joined trunk to leaf, unwired by design
+
+**Phase:** `30_gateway_connection_map` · **Source:** operator request 2026-10-23 — "the orange dashes look great but they should be **green if the connection is active**. 'Active' means it exists in the nginx config… the dotted line connections need to connect to their counterparts. This is easy for haproxy — just draw the line straight across. For nginx you'll need to branch the lines from `:443` to the services they connect to" + the sketch (`/tmp/pi-clipboard-…png`: green boxes + horizontal pill = on, red boxes + vertical pill = off) + "build the switches in now but don't wire them up"
+**Story:** n/a
+
+## Objective
+
+Every connection row draws a **green dashed line from its inbound end to its outbound end** — straight across for a haproxy frontend with one `server`, **branched** from the `:443` trunk into one tick per map entry for nginx — with the **switch** from the sketch sitting in the middle of it. Colour is an **existence state** taken from the config (green = in the config, red = out of it), never a verdict on a number; motion still means "a socket is open this instant" (decision 2). The switch is real markup, real ARIA, red-and-green styled, **and unwired**: `aria-disabled="true"`, no handler, a `title` that says so.
+
+## Work
+
+1. `src/dashboards/web/static/dash.css`
+   - In the `:root` block that declares `--ok`/`--fail`, add the **existence pair** with a comment naming what it is *not*:
+     ```css
+     /* The gateway's existence pair — deliberately NOT the severity vocabulary. Green means the
+        route is written in a proxy config; red means it is out of the config. No gateway figure
+        is graded (`severity.py` has no `gateway.*` row), so nothing here may reach for --ok,
+        --warn or --fail directly: the pair is one indirection whose name says what it answers. */
+     --gate-on: var(--ok);
+     --gate-off: var(--fail);
+     ```
+     (The standing "no rule reaches for a token `:root` does not declare" pin sees both new tokens; per-theme `--ok` substitution happens on the root element, so light/dark both follow without a second declaration.)
+   - Rewrite the `gateway pipes` section's colour half:
+     ```css
+     .pipe.on   .pipe-path { stroke: var(--gate-on); }
+     .pipe.off  .pipe-path { stroke: var(--gate-off); }
+     .pipe.live .pipe-path { animation: pipe-flow 1.2s linear infinite; }
+     .pipe.still .pipe-path { stroke-dasharray: 4 8; }   /* a route with nothing on it right now */
+     ```
+     `.pipe-path`'s base rule keeps **no** `animation` and **no** verdict colour; the `live`/`still` classes stay (their meaning is now "a socket is open this instant" — restate that in the comment, because the class name no longer says "idle route").
+   - The connectors, all of it pure CSS (no JS coordinate maths, no `ResizeObserver`, nothing measured at runtime):
+     ```css
+     .gate-group { position: relative; display: grid; column-gap: 0;
+                   grid-template-columns: minmax(0, 9.5rem) minmax(0, 1fr); }
+     .gate-leaves { position: relative; padding-inline-start: 26px; }
+     .gate-link { position: relative; }
+     /* each row carries its own half of the branch, so the spine starts at the first branch and
+        stops at the last without a mask, a magic height or a background-coloured eraser */
+     .gate-link::before { content: ""; position: absolute; left: -26px; top: 0; height: 50%;
+                          border-left: 2px dashed var(--border-strong); }
+     .gate-link::after  { content: ""; position: absolute; left: -26px; top: 50%; bottom: 0;
+                          border-left: 2px dashed var(--border-strong); }
+     .gate-link:first-child::before, .gate-link:last-child::after { display: none; }
+     .gate-elbow { align-self: center; height: 0; border-top: 2px dashed var(--border-strong); }
+     .gate-trunk { position: relative; }        /* its own tick reaches the spine at right: 0 */
+     /* straight across: a group with one leaf is not a branch, so it draws no vertical at all */
+     .gate-group.solo .gate-link::before, .gate-group.solo .gate-link::after { display: none; }
+     ```
+     `.gate-group.solo` is added by the JS when a group has exactly one connection (every haproxy group on this fleet). The `.gate-link` grid columns are `26px auto minmax(2rem, 4.5rem) minmax(0, 1fr) auto` — elbow, switch, the animated run, the target, the count.
+   - The switch, keyed on `[aria-checked]` and **never** on `:enabled` (a not-yet-wired switch must still look green when it is on), and tinted from the same pair so the gateway owns one colour vocabulary:
+     ```css
+     .gate-switch { width: 34px; height: 18px; padding: 2px; border-radius: 999px;
+                    border: 1px solid var(--gate-on); display: inline-flex; align-items: center;
+                    background: color-mix(in srgb, var(--gate-on) 14%, transparent);
+                    cursor: not-allowed; }
+     .gate-switch-thumb { width: 12px; height: 12px; border-radius: 50%;
+                    background: var(--gate-on); transform: translateX(16px);
+                    transition: transform .16s ease; }
+     .gate-switch[aria-checked="false"] { border-color: var(--gate-off);
+                    background: color-mix(in srgb, var(--gate-off) 14%, transparent); }
+     .gate-switch[aria-checked="false"] .gate-switch-thumb { transform: translateX(0); }
+     ```
+     `color-mix` (already the sheet's idiom) is why no `--ok-soft` / `--fail-soft` appears in a gateway rule: the soft fill derives from the existence pair rather than borrowing the verdict tints.
+   - The existing `@media (prefers-reduced-motion: reduce)` block gains `.gate-switch-thumb { transition: none; }` beside its two `.pipe` rules (it must name every animated thing on the page — naming one and leaving the thumb sliding is the phase-18 lesson).
+   - `@media (max-width: 640px)`: the group stacks (task 04's rule) and the spine's `top` reaches up into the group gap so the trunk above still reads as connected; the switch and its row do not shrink and nothing scrolls sideways.
+2. `src/dashboards/web/static/page-gateway.js`
+   - `gateLink()` builds the row in task 04's order and fills `.gate-switch-slot`:
+     ```html
+     <button class="gate-switch" type="button" role="switch" aria-checked="true" aria-disabled="true"
+             title="Toggling a route is not wired up yet — it needs a config write path. This switch shows what the config says.">
+       <span class="gate-switch-thumb"></span>
+     </button>
+     ```
+     `aria-checked` is `true` because the row exists at all (drawn ⇒ in the config); the `false` styling is present and unreachable until the write phase. `aria-label` names the endpoint, the selector and the config family (`"nextcloud.reeseapps.com → nextcloud.reeselink.com:11000, in the nginx config, on"`), since a switch with no accessible name is silence. **No click handler is bound, anywhere.**
+   - `renderGroup()` toggles `.solo` on the group from its own leaf count, and toggles `live`/`still` **and** `on`/`off` on the row's `<svg class="pipe">` (`on` always today; `off` is a one-line seam for the write phase).
+   - `pipeAria()` gains the state word and keeps every existing fact (port / target / domains / clients / count), so an unattributed count is still announced as unknown and never as zero.
+3. `tests/test_api.py` — **restate, do not delete**, the colour pin:
+   - `test_no_gateway_count_is_coloured_by_a_verdict` keeps every current assertion (no `--ok|--warn|--fail|.ok|.warn|.fail|severity` inside the `gateway pipes` section, no `severityFrom`/`severityFor`/`.severity` in the script, no verdict class in the markup) and its docstring is rewritten to say the pipes/switches colour from `--gate-on`/`--gate-off`, that the pair is an **existence** state and not the severity vocabulary, and that the one place `.warn` legitimately appears is the warnings panel's `ul.alerts` rows (which are `alerts.py`'s verdict, not a number's).
+   - **new** `test_a_connection_is_green_because_it_is_in_the_config` — `.pipe.on .pipe-path` stroke is `var(--gate-on)`, `.pipe.off .pipe-path` is `var(--gate-off)`, `:root` declares both, and `.pipe-path`'s base rule declares no `stroke` verdict; the script sets `on` unconditionally for a drawn connection.
+   - **new** `test_haproxy_draws_straight_across_and_nginx_branches` — served CSS: `.gate-group.solo` hides `.gate-link::before`/`::after`; the branch halves and `.gate-elbow` exist; and the script's `.solo` toggle reads the group's own leaf count.
+   - **new** `test_the_switch_is_built_and_explicitly_unwired` — `role="switch"`, `aria-checked`, `aria-disabled="true"` (and **not** `disabled`, which would drop it from the a11y tree), the `title` names the missing write path, and no `addEventListener` in the file names `gate-switch` / binds a click on it. This is the pin that fails the day someone ships a dead-looking-live control.
+   - `test_the_pipe_animation_stills_in_both_states_under_reduced_motion` — both pipe states **and** `.gate-switch-thumb` are named in the file's one reduced-motion block.
+   - `test_a_pipe_moves_only_while_it_carries_a_connection` — unchanged claim, new class pairs (`live` animates, `still` does not, colour comes from `on`/`off`).
+   - The orphan-`id` audit and the CDN-reference pin stay green.
+
+## Testing & Quality
+- Unit: served-CSS + served-script pins above; the behavioural proof is task 06's browser pass (computed stroke colour, animation running, elbow geometry, 360 px).
+- Coverage: no new Python; `node --check` clean; `bash .agents/validate.sh` (which runs `node --check` over `web/static`) green.
+
+## Completion Criteria
+- [ ] On live data: every haproxy row's line runs **straight** from `:22`-style trunk to its `server` with no vertical segment; the nginx `:443` trunk has a spine reaching every one of its 17 ticks; each row has exactly one switch.
+- [ ] Every drawn pipe computes to the green of `--gate-on` in both themes; a row with ≥ 1 live connection animates and one with 0 or `null` does not; with `prefers-reduced-motion: reduce` emulated, nothing moves (pipes and thumb).
+- [ ] `grep -n "disabled" src/dashboards/web/static/page-gateway.js` shows `aria-disabled` and no `disabled` attribute; no click listener exists for the switch; the `title` sentence is on every switch.
+- [ ] The severity vocabulary is still absent from the pipes section, the script and the markup — and its absence is pinned with the restated docstring, not removed.
+- [ ] `uv run pytest` **100% passing**, coverage not down; ruff + pyright + `node --check` clean.
+- [ ] No behaviour change in completed work; the other pages byte-identical.
diff --git a/.agents/phases/complete/30_gateway_connection_map/06_docs_and_verify.md b/.agents/phases/complete/30_gateway_connection_map/06_docs_and_verify.md
new file mode 100644
index 0000000..b2e30f1
--- /dev/null
+++ b/.agents/phases/complete/30_gateway_connection_map/06_docs_and_verify.md
@@ -0,0 +1,52 @@
+# Task 06 — Documentation, the browser pass, and the live read-only verification
+
+**Phase:** `30_gateway_connection_map` · **Source:** `AGENTS.md` definition of done (browser screenshot against live data; README/AGENTS updated when a rule, command, gap or fleet fact changed)
+**Story:** n/a
+
+## Objective
+
+Make the record match the shipped page: `AGENTS.md` and `README.md` rewritten where phase 30 changed a rule (two panels, config-derived connections, green = in the config, the unwired switch, the deleted `unmatched`/`by_port`/`partial`, the new `gateway` config-integrity alert, name-keyed outbound gauges no longer written), and the whole thing proven in a real browser at 1440 px and 360 px plus a read-only pass against the actual router.
+
+## Work
+
+1. `data/logs/30-connection-map.cjs` — the browser pass (Playwright, the repo's idiom: `NODE_PATH=/var/home/ducoterra/.agents/skills/interactive-browser/node_modules node data/logs/30-connection-map.cjs`, `DASH_BASE`/`DASH_PW` from `.env.dev`, transcript to `data/logs/30-connection-map.out`, **fails non-zero on any FAIL**). Checks, in this order, each with a message that names what broke:
+   - exactly two `[data-gate]` panels are visible, `nginx` then `haproxy`; no `map`/`unmatched` panel;
+   - **straight across:** every `.gate-group.solo` leaf has `display: none` on `::before`/`::after` (read through `getComputedStyle(el, '::before')`) and its trunk, elbow, switch, pipe and target share one horizontal centre line (`top` of each within 2 px) — haproxy's rows are the case;
+   - **branched:** nginx's `:443` group has a spine and one tick per leaf, the ticks are 26 px wide and land at each row's centre, and the first/last row's halves are suppressed (so the spine starts and stops at a branch);
+   - **green from the config:** every `.pipe-path` computes to the theme's `--ok` rgb, in `dark` **and** after clicking the theme toggle to `light`; the pipe never computes the accent orange;
+   - **motion:** `getAnimations()` (or `animation-name`) is `pipe-flow` on exactly the rows whose printed count is ≥ 1 and `none` on the rest; with `page.emulateMedia({ reducedMotion: 'reduce' })` every pipe and every `.gate-switch-thumb` reports no animation;
+   - **switch:** one `.gate-switch` per connection row, all `role=switch` + `aria-checked="true"` + `aria-disabled="true"` + a non-empty `title` + a non-empty accessible name; clicking one changes nothing on screen and issues **no** network request (assert on the page's request log);
+   - **warnings:** intercept `/api/gateway/snapshot` with `page.route` to inject two synthetic `warnings` entries — the panel appears with two `li.warn` rows in the `ul.alerts` vocabulary — and with the unmutated response it is `hidden`;
+   - **degradation:** intercept to `404 {configured:false}` → `#gate-empty` names `GATEWAY_HOST` and `1.2.0`, no cards; intercept `supported:false` → the `why` banner and every count `—`/`n/a`, nothing red;
+   - **360 px:** document `scrollWidth === clientWidth` on every state above with the 17-row `:443` group expanded, no element painted past the viewport that is not inside a horizontal scroll container, and every ellipsised label carries its full text in `title`;
+   - screenshots: `data/logs/30-connection-map-{desktop,light,phone,warnings,predates}.png`.
+2. `data/logs/27-task02-mobile-audit.cjs` — re-run as-is and require **exit 0** with `/gateway` in the sweep (its per-table and per-disclosure claims must hold for the new rows). Transcript to `data/logs/30-final-mobile-audit.out`.
+3. `AGENTS.md` — the full pass, task by task's own edits included. Sections that are now wrong and must be rewritten against the shipped code (read each one, do not patch a phrase):
+   - the **`/gateway` row of the page table** (what question it answers, and its source),
+   - the **`sources/gateway.py`** bullet — the payload's real key set (`listeners`, `connections`, `warnings`), the two surviving join arms, the ignore rule, the seven warning kinds and the three refusals, the shared-endpoint rule, and **the deletion of `unmatched` / `by_port` / `partial` / `MAX_GROUP_HOSTS`** (the bullet currently describes all four as the module's honesty),
+   - the **metric-naming paragraph** — `gateway.in_conns@<port>` and `gateway.out_conns@<host>:<port>` stay, and the paragraph must say name-keyed outbound gauges are **no longer written** and why, with the rows aging out under unchanged retention (invariant 9 — no schema change),
+   - the **`api.py`** bullet's `/api/gateway/*` paragraph and the `/api/summary` `gateway` block field list,
+   - the **`alerts.py`** bullet — reachability **and** config-integrity now, still no thresholds and no graded number,
+   - the **UI conventions** `/gateway` paragraph — two panels, trunk→leaf rows, the line joins its endpoints (straight across / branched), green = in the config via `--gate-on`/`--gate-off` and *why that is not the severity vocabulary*, motion = a socket open this instant, the switch built-and-unwired, the dash-for-unattributed rule,
+   - **gap 13** (the clipped pipe labels): re-measure with `data/logs/graph-probe.py` + the browser pass and either close it or restate it with today's numbers (the row layout gives a long `server_name → target` string a whole column now, so the residual is probably smaller — write the measured count, not a hope),
+   - any other inconsistency the full read turns up, including pre-existing ones.
+4. `README.md` — the `/gateway` row and the "what each page answers" prose; the `GATEWAY_HOST` configuration row is unchanged (no new env setting was added by this phase — say so in the pass note); the rollout/agent sections are unchanged (no agent version change).
+5. **Live, read-only** verification against the real ingress (no writes, no config edits, no battery-tests, nothing restarted):
+   - `GET /api/gateway/snapshot`: `warnings == []`; no `unmatched` / `outbound` / `by_port` / `partial` key anywhere; every haproxy frontend connected to exactly its `server`; `:443` connected to the 17 map entries (`default → 127.0.0.1:4443` among them); `:4443`/`:8443` connected to their `proxy_pass` targets; `:80` present as a listener with no connection; no figure mentions `9120` or `2222`.
+   - Reconcile the inbound counts with the kernel: `ssh gateway-ops "cat /proc/net/tcp /proc/net/tcp6"` (the same world-readable read the agent makes, recorded read-only) and assert `sum(listeners[].connections)` equals the ESTABLISHED rows whose local port is a configured listen port, allowing for the seconds between the two reads — record both numbers in the note.
+   - `./scripts/dev-server.sh status` → **10 sources `ok`**, `gateway` among them; `GET /api/summary` → no `gateway:config` alert row on a clean config, and one after a fixture mutation (the suite pins both).
+   - `git diff --stat agent/ deploy/` → **empty**: this phase touched no agent and no installer.
+   - Write the transcript to `data/logs/NOTES-30-connection-map.md` (the numbers, the screenshots, the reconciliation, and the two facts the next phase will need: that the switch markup exists and where its one `off` seam is).
+6. Commit the phase with the repo's convention (`--no-gpg-sign`, `LLM-Generated: true` trailer) once everything below is green.
+
+## Testing & Quality
+- The browser pass and the mobile audit are the phase's behavioural proof; the hermetic suite remains the contract. No new Python is expected in this task, so coverage is verified, not raised.
+
+## Completion Criteria
+- [ ] `data/logs/30-connection-map.out` ends in a 0-exit with every check named above PASS, and `data/logs/30-connection-map-{desktop,light,phone,warnings,predates}.png` exist.
+- [ ] `data/logs/27-task02-mobile-audit.out`-style re-run (`data/logs/30-final-mobile-audit.out`) exits 0 with `/gateway` swept at both widths.
+- [ ] `AGENTS.md` contains no sentence that contradicts the shipped payload or page (grep for `unmatched`, `by_port`, `partial`, `stream map` card, "four cards" — none may survive outside a historical note), and `README.md` matches.
+- [ ] Live read: `warnings: []`, the connection sets above, and the inbound reconciliation recorded in `data/logs/NOTES-30-connection-map.md`.
+- [ ] `./scripts/dev-server.sh status` → 10 sources `ok`; `git diff --stat agent/ deploy/` empty.
+- [ ] `uv run pytest` **100% passing**, `uv run pytest --cov` ≥ 94 floor, `uv run ruff check src tests agent` + `uv run pyright` clean, `bash .agents/validate.sh` green, `uv pip list --outdated` empty (no dependency moved this phase — verify, don't assume).
+- [ ] No behaviour change in completed work: the other five dashboards, `/settings`, `/certs` and `/login` render as before; `host:*`, `disks:*`, `llm:*`, `nut` unchanged; `/api/health` shape untouched.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md
new file mode 100644
index 0000000..4394995
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md
@@ -0,0 +1,9 @@
+**Phase 30 final verification pass — all 6 tasks already in `complete/`, so this was the phase-completion pass.**
+
+- **Verified (re-run, not trusted):** `/gateway` serves exactly two panels (nginx→haproxy, `GATEWAY_CARD_KEYS`); haproxy rows `.solo` straight across, nginx `:443` branched with one tick per leaf (18 live, fixture 17); every pipe computes the theme `--ok` in dark+light, animates only at count ≥1, fully static under `prefers-reduced-motion`; switch = `role="switch"`+`aria-checked`+`aria-disabled`, no listener, footer+title name the missing write path; zero non-GET requests anywhere.
+- **Live read-only re-run** (`data/logs/30-final-live-verify.out`): 17 PASS — `warnings: []`, 6 haproxy frontends→own `server`, `:443` 18 map leaves incl. `default→127.0.0.1:4443`, `:4443` 6 / `:8443` 3, `:80` bare listener, no `unmatched`/`outbound`/`by_port`/`partial`, no `9120`; inbound reconciliation **page 16 = kernel 16**; `gateway` block = the 12 declared keys; no `gateway:config` alert on a clean config. `git diff --stat agent/ deploy/` empty; agents 1.2.0 (gateway) / 1.1.0 ×2, all `tls`, `bundle_rev 2`.
+- **Tests/lint (exact):** `uv run pytest` → **1791 passed, 16 skipped**, exit 0 · `bash .agents/validate.sh` → **exit 0**, `--cov` **98.94%** (floor 94), `ruff check src tests agent` clean, `pyright` 0 errors, `node --check` all page scripts, hygiene clean · `uv run pytest -m live --live` → **12 passed** · `uv pip list --outdated` empty · `./scripts/dev-server.sh status` → **10 sources ok**, `gateway` included · browser pass `30-connection-map.out` 63 PASS/0 FAIL (5 screenshots at 1440/360) · `30-final-mobile-audit.out` 371 PASS/0 FAIL/0 FINDING, exit 0, nine pages.
+- **Docs fixed:** README `alerts.py` bullet omitted phase 30's keyword-only `gateway_payload` and its one `warn` config-integrity row (+suppression) — added; overview ingress line labelled a dated reading. AGENTS gap 13 corrected 391 px → **361 px** (task 05's pill took 30 px), "task 06 measured" → "phase 29 measured", coverage figure un-pinned to 98.9 %, live-suite count noted (12 today), "all five pages" severity sentence clarified for `/gateway`'s existence-only palette. Everything else reviewed in full and **verified consistent**.
+- **Defect fixed:** duplicated footer-assertion block at the end of `tests/test_api.py::test_the_switch_is_built_and_explicitly_unwired` (one copy removed).
+- **Notable:** `NOTES.md` is empty in the working tree — both items in it (non-mTLS agents, disappearing admin links) landed in phases 24 and 20; left cleared. Fixture/live `map`-count drift (17 vs 18) is recorded in AGENTS.md, not silently re-captured.
+- **Next pending phase:** none — `30_gateway_connection_map` was the only entry in `.agents/phases/todo/`.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.validate
new file mode 100644
index 0000000..384731f
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__00_phase.a1.validate
@@ -0,0 +1,69 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  3%]
+........................................................................ [  7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+..s..................................................................... [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+.................................ssssssssssss........................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+.....................sss................................................ [ 99%]
+.......                                                                  [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               201      0   100%
+src/dashboards/api.py                  499      3    99%   220, 250, 253
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      4    98%   324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      463      4    99%   518, 529, 637, 1129
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 4063     43    99%
+Required test coverage of 94% reached. Total coverage: 98.94%
+1791 passed, 16 skipped, 1 warning in 172.29s (0:02:52)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md
new file mode 100644
index 0000000..b397813
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md
@@ -0,0 +1,17 @@
+Task complete. Everything green.
+
+**Implemented**
+- `sources/gateway.py`: new `config_connections()` derives the connection graph from config text only — 4 derivations (haproxy `frontend→routes→backend→server`, nginx vhost `proxy_pass` per `listen` port of *its own block*, port-less `proxy_pass` → `upstream` servers, `proxy_pass $var` → `map` entries incl. verbatim `default`), merge rule `(source,in_port,host,port)` with selectors unioned first-seen, plus the two silent refusals. Module docstring gained a "The connection graph" section.
+- `haproxy_targets()` rows gained `backend` (the frontend→server join key); `nginx_listen_ports()` replaced by `nginx_server_blocks()` (`{ports, names, proxies}`) — one reader of a block, the port echo now derived from it.
+- Payload: `inbound` → **`listeners`**, new **`connections[]`** (`id`, `source`, `in.port`, `out.{host,port,name,kind,selectors,address}`, `metric`, `connections: null` until task 02); `_skeleton()`/`stub()`/`samples()` follow the rename.
+- `api.py`: mechanical rename of the payload reader (`/api/summary`'s block field names unchanged); `page-gateway.js` reads `snapshot.listeners`.
+- Tests: ~15 new graph pins in `test_gateway_source.py` (32-connection set on the captured configs, backend/server-name, `default` verbatim + `address: true`, pool + undeclared-pool, merge, two-ports-two-connections, both refusals, no-orphan walk, junk arms); `test_api.py` renamed `GATEWAY_PAGE_FIELDS`, plus served-graph/32/orphan/no-`by_port` pins.
+- Live read-only verification (`data/logs/verify-30-task01.py` → `30-task01-live.out`): 10 listeners, **32** connections (6 backend / 17 map / 9 server_name), zero orphans, `:80` trunk with no connection, `outbound`+`unmatched` still present, 10/10 sources `ok`.
+
+**Checks** — `uv run pytest`: 1764 passed, 16 skipped · `--cov`: total 99.07 % (floor 94), `sources/gateway.py` / `api.py` / `alerts.py` 100 % · `ruff check src tests agent`: clean · `pyright`: 0 errors · `node --check page-gateway.js`: ok · `bash .agents/validate.sh`: exit 0 · `pytest -m live --live`: 12 passed.
+
+**Docs** — AGENTS.md (`sources/gateway.py` bullet: `listeners` + `connections[]`, the four derivations/merge/refusals, `nginx_server_blocks()`; `api.py` `/api/gateway/*` paragraph) and README.md (`/api/gateway/snapshot` field list) updated for the payload rename. Page/UI prose left for tasks 04–06 as the phase directs.
+
+**Notes** — Dropped the planned "name back-fill on merge" arm: haproxy always claims before nginx, so first-seen `kind`/`name` is lossless and the arm was unreachable; the code says so. `/api/summary`'s `gateway` block shape is deliberately untouched (task 02 reshapes it). Dependency-advisory lines in validate.sh are pre-existing and not failures.
+
+Next pending task: `30_gateway_connection_map/02_the_join_simplified.md`.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.validate
new file mode 100644
index 0000000..4a90f0d
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__01_the_connection_graph.a1.validate
@@ -0,0 +1,74 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  4%]
+........................................................................ [  8%]
+........................................................................ [ 12%]
+........................................................................ [ 16%]
+........................................................................ [ 20%]
+........................................................................ [ 24%]
+........................................................................ [ 28%]
+........................................................s............... [ 32%]
+........................................................................ [ 36%]
+........................................................................ [ 40%]
+........................................................................ [ 44%]
+........................................................................ [ 48%]
+........................................................................ [ 52%]
+........................................................................ [ 56%]
+........................................................................ [ 60%]
+........................................................................ [ 64%]
+........................................................................ [ 68%]
+........................................................................ [ 72%]
+......ssssssssssss...................................................... [ 76%]
+........................................................................ [ 80%]
+........................................................................ [ 84%]
+........................................................................ [ 88%]
+........................................................................ [ 93%]
+..................................................................sss... [ 97%]
+....................................................                     [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               182      0   100%
+src/dashboards/api.py                  491      0   100%
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      5    98%   323-324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      400      0   100%
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 3973     37    99%
+Required test coverage of 94% reached. Total coverage: 99.07%
+1764 passed, 16 skipped, 1 warning in 166.53s (0:02:46)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+  certifi   2026.10.19 2026.10.23 wheel
+coverage  7.16.2     7.17.0     wheel
+fastapi   0.153.0    0.161.1    wheel
+pycparser 3.11       3.12       wheel
+ruff      0.17.1     0.17.2     wheel
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md
new file mode 100644
index 0000000..ce62647
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md
@@ -0,0 +1,15 @@
+All checks green. Final state:
+
+**Implemented** — `sources/gateway.py`: the join is now two attributions only (inbound = socket's local port names a listener; outbound = remote `(address, port)` equals a config address target), one exclusive pass, everything else ignored. Deleted `outbound[]`, `by_port`, `unmatched`(+`.groups`/`.other`), `partial`, `unmatched_listeners`, `MAX_GROUP_HOSTS`; `connections[]` now carries `connections` + `shared`, and `samples()` writes `gateway.out_conns@<host>:<port>` **only** for address endpoints. `api.py`: `/api/summary`'s block is `listeners/connections/live_in/live_out/map_targets`, with `live_out` summed over **distinct endpoints** (`_endpoint_values`) so one socket is never booked twice. Page: two cards (`haproxy`, `nginx`), four tallies, one footnote, no `by port` chip; `/`'s line reads `10 listeners · 33 connections · 9 live in · 3 live out`.
+
+**Defects fixed from task 01** — `test_gateway_source.py` had no pin for the pool derivation, the merge rules, the captured 32-route graph or the two refusals (the report claimed them, and their lines were uncovered); added 6 tests, plus the loopback double-hop and endpoint-sharing pins this task needs.
+
+**Tests** — rewrote the summary/snapshot/history/page/live pins for the new shape and pinned the absences by name (`no `by_port` vocabulary`, `nothing reconciles to established`, `a null is never 0`).
+
+**Checks** — `uv run pytest`: 1758 passed, 16 skipped · `--cov` 98.91 % (floor 94), `sources/gateway.py` 99 %, `api.py` 99 % · `ruff` clean · `pyright` 0 errors · `node --check` ok · `bash .agents/validate.sh` **exit 0** · `pytest -m live --live` 12 passed.
+
+**Live (read-only)** — `data/logs/verify-30-task02.py` → `30-task02-live.out`: 16 PASS / 0 FAIL (10 listeners, 33 routes, 2 address endpoints counted, no `by_port`/`unmatched`/`partial` in the payload, and the 13 name-keyed gauges' last write is *before* the restart while address-keyed ones keep landing). Browser `data/logs/verify-30-task02.cjs` → `30-task02-browser.out`: 26 PASS / 0 FAIL at 1440 px and 360 px — two cards, four tallies, one footnote, every uncounted route `n/a` and never `0`, every painted count the payload's own, no console errors; screenshots `30-task02-gateway-{desktop,phone}.png`, `30-task02-overview.png`. Phase-27 sweep re-run with `/gateway` in it: **371 PASS / 0 FAIL / 0 FINDING** (`30-task02-mobile-audit.out`).
+
+**Docs** — AGENTS.md (join bullet, retired gauges in the metric-naming section, `/api/summary` block, testing policy, `/gateway` UI conventions, gap 13 corrected: the column split was **not** widened) and README.md (API list, page description, test section, overview line).
+
+**No live infra was changed**; no git index/history mutation. Next pending task: `30_gateway_connection_map/03_config_warnings.md`.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.validate
new file mode 100644
index 0000000..99c50f6
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__02_the_join_simplified.a1.validate
@@ -0,0 +1,74 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  4%]
+........................................................................ [  8%]
+........................................................................ [ 12%]
+........................................................................ [ 16%]
+........................................................................ [ 20%]
+........................................................................ [ 24%]
+........................................................................ [ 28%]
+.........................................................s.............. [ 32%]
+........................................................................ [ 36%]
+........................................................................ [ 40%]
+........................................................................ [ 44%]
+........................................................................ [ 48%]
+........................................................................ [ 52%]
+........................................................................ [ 56%]
+........................................................................ [ 60%]
+........................................................................ [ 64%]
+........................................................................ [ 68%]
+........................................................................ [ 73%]
+ssssssssssss............................................................ [ 77%]
+........................................................................ [ 81%]
+........................................................................ [ 85%]
+........................................................................ [ 89%]
+........................................................................ [ 93%]
+............................................................sss......... [ 97%]
+..............................................                           [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               182      0   100%
+src/dashboards/api.py                  498      3    99%   220, 250, 253
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      5    98%   323-324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      362      4    99%   471, 482, 590, 873
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 3942     44    99%
+Required test coverage of 94% reached. Total coverage: 98.88%
+1758 passed, 16 skipped, 1 warning in 162.31s (0:02:42)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+  certifi   2026.10.19 2026.10.23 wheel
+coverage  7.16.2     7.17.0     wheel
+fastapi   0.153.0    0.162.0    wheel
+pycparser 3.11       3.12       wheel
+ruff      0.17.1     0.17.2     wheel
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md
new file mode 100644
index 0000000..c550098
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md
@@ -0,0 +1,22 @@
+Task 03 complete. Full gate green.
+
+**Implemented**
+- `src/dashboards/sources/gateway.py` — `haproxy_warnings()` / `nginx_warnings()` / `warnings()`: the seven kinds (`haproxy_route_dangling`, `haproxy_backend_orphan`, `haproxy_backend_empty`, `nginx_server_unlistened`, `nginx_pool_undeclared`, `nginx_variable_unmapped`, `nginx_map_route_missing`), rows `{id, kind, subject, message}` with `id = "<kind>:<subject>"`, deterministic haproxy-then-nginx order, deduped by `id`; only a section with `available is True` is judged; the three refusals carry comments naming why; `payload["warnings"]` in every arm incl. `stub()`; new "What this module warns about" docstring section.
+- `alerts.py` — keyword-only `gateway_payload`; `_gateway_alerts` emits **one** `warn` row (`gateway:config`, `href /gateway`, payload `ts`) only while the job is configured/ok/not-stale; docstring rule list rewritten to "reachability plus config integrity, no graded number, ever".
+- `api.py` — `/api/summary`'s `gateway` block grew `warnings` (a count; `null` in the unconfigured/never-answered/unsupported arms, a real `0` when the configs connect), and passes the payload to `alerts.build`.
+- `page-index.js` — the overview line appends ` · N to address` only when `Number.isInteger && > 0`.
+
+**Tests / gate (exact)**
+- `uv run pytest` → **1783 passed, 16 skipped** (baseline 1758; +25). Coverage **98.94%** (floor 94%); `alerts.py` 100%, `sources/gateway.py` 99% (4 remaining misses are pre-existing task-01/02 arms).
+- `ruff check src tests agent` → All checks passed. `pyright` → 0 errors. `node --check web/static/*.js` → clean. `bash .agents/validate.sh` → green.
+- Both alert-row directions pinned in `test_alerts.py` (1 vs 7 warnings = 1 row; failing/stale/unconfigured = no config row) and in `test_api.py` (inject a dangling `use_backend` → exactly one `warn` row + `warnings: 1`; remove it → `[]` + 0). Failing-job-keeps-one-row pinned through the real hub.
+- Live, read-only: `data/logs/verify-30-task03.py` → `30-task03-verify.out` (15/15: seven kinds from one-line mutations of the **captured** configs via the real agent parser, clean capture = `[]`, three refusals, absent/unreadable arms); `data/logs/30-task03-warnings.cjs` → `30-task03-warnings.out` (23/23 at 1440 px and 360 px) + `overview-30-task03-1440.png`, `gateway-30-task03-{1440,360}.png`; `data/logs/30-task03-acceptance.out`.
+
+**Docs** — `AGENTS.md` (`alerts.py`, `sources/gateway.py`, `api.py` bullets, overview-line paragraph — this task changes the documented "gateway alerts are reachability only" rule) and `README.md` (gateway block, `/api/gateway/snapshot`, `/` line).
+
+**Decisions/deviations**
+- `haproxy_backend_empty` and `haproxy_backend_orphan` are mutually exclusive (an empty backend is not *also* an orphan) — stated in code and tests.
+- A frontend whose only routing is a fetch expression and a vhost with a `listen` and no `proxy_pass` produce no warning, per the task's refusals; making the former distinguishable needs an agent flag, not a source guess.
+- No live infrastructure changed beyond restarting the local dev server; the fleet's real ingress reads `warnings: []`.
+
+**Next pending task** — `.agents/phases/todo/30_gateway_connection_map/04_page_two_tables.md`.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.validate
new file mode 100644
index 0000000..a21a0db
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__03_config_warnings.a1.validate
@@ -0,0 +1,74 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  4%]
+........................................................................ [  8%]
+........................................................................ [ 12%]
+........................................................................ [ 16%]
+........................................................................ [ 20%]
+........................................................................ [ 24%]
+........................................................................ [ 28%]
+..................................................................s..... [ 32%]
+........................................................................ [ 36%]
+........................................................................ [ 40%]
+........................................................................ [ 44%]
+........................................................................ [ 48%]
+........................................................................ [ 52%]
+........................................................................ [ 56%]
+........................................................................ [ 60%]
+........................................................................ [ 64%]
+........................................................................ [ 68%]
+........................................................................ [ 72%]
+.........................ssssssssssss................................... [ 76%]
+........................................................................ [ 80%]
+........................................................................ [ 84%]
+........................................................................ [ 88%]
+........................................................................ [ 92%]
+........................................................................ [ 96%]
+.............sss.......................................................  [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               201      0   100%
+src/dashboards/api.py                  499      3    99%   220, 250, 253
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      5    98%   323-324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      463      4    99%   518, 529, 637, 1129
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 4063     44    99%
+Required test coverage of 94% reached. Total coverage: 98.92%
+1783 passed, 16 skipped, 1 warning in 166.68s (0:02:46)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+  certifi   2026.10.19 2026.10.23 wheel
+coverage  7.16.2     7.17.0     wheel
+fastapi   0.153.0    0.162.0    wheel
+pycparser 3.11       3.12       wheel
+ruff      0.17.1     0.17.2     wheel
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md
new file mode 100644
index 0000000..aa82d2e
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md
@@ -0,0 +1,22 @@
+**Task 04 complete — `/gateway` is now two trunk→leaf panels plus one warnings list.**
+
+Implementation
+- `web/pages/gateway.html`: exactly two `article[data-gate]` panels (`nginx` then `haproxy`), `map`/`unmatched` deleted; new `section.card#gate-warnings` (ships `hidden`, `ul.alerts#warnings-list`); four tallies `#t-ports/#t-connections/#t-live/#t-warnings` (`#t-listeners/#t-established/#t-unmatched` gone); footer rewritten to three sentences.
+- `web/static/page-gateway.js`: `groupsFor()` (ports ascending, a no-target listener still gets a group → `no target named in the config`), `renderGroup/renderTrunk/renderLeaves` built-once-and-patched via keyed `Map`s + `appendChild`, `renderWarnings()` in the overview's `li.warn/.src/.msg` vocabulary, `countText()`→`null` so a name endpoint prints `—` with its why-title (never `0`), drawn-and-inert switch (`buildSwitch()`, `aria-hidden`, no listener), charts discipline unchanged.
+- `dash.css`: `.gate-map/.gate-group (minmax(0,9.5rem) minmax(0,1fr))/.gate-leaves/.gate-link/.gate-target/.gate-selector` + ≤640px stacking; only switch ink added (needed so the drawn switch isn't a black blob) — elbows/colour stay task 05.
+- `tests/test_api.py`: rewrote the page-shape/degradation/clipped-label/live-sum pins; added 5 tests (two-panels+warnings, stream-map-inside-nginx, `:80` refusal, warnings both directions, dash-not-zero, switch-inert); fixed the stale `wait:` selectors in `data/logs/27-task02-mobile-audit.cjs` and `30-task03-warnings.cjs` so both standing sweeps stay runnable.
+
+Checks
+- `bash .agents/validate.sh` → rc 0: 1789 passed / 16 skipped, coverage 98.94% (floor 94), ruff clean, pyright 0 errors, `node --check` clean.
+- Browser, live fleet: `data/logs/30-task04-panels.cjs` → **49/49** (`30-task04-panels.out`; `gateway-30-task04-{1440,360,reduced}.png`): nginx 4 ports·27 routes (`:443` 18 leaves — the live map today — `:4443` 6, `:8443` 3, `:80` refusal), haproxy 6 groups of one, 31 `—` vs 2 numbered, warnings panel hidden live and raised by one injected row, 0 px sideways scroll at 1440/360; FINDING: 0/33 labels clip at 1440, 27/33 at 360.
+- Mobile audit re-run: 370 PASS / 0 FAIL / 0 FINDING; task-03 sweep 23/23; dev server restarted, **10 sources `ok`**.
+
+Docs
+- README `/gateway` paragraph and AGENTS.md UI-conventions paragraph rewritten (two panels, map is nginx's, trunk→leaf, warnings in alert vocabulary, drawn-not-wired switch); gap 13 updated (desktop arm closed by measurement, phone residue re-numbered) and gap 12 records this audit re-run.
+
+Decisions/deviations
+- Switch is drawn now (task 04 requires it) with minimal ink; task 05 still owns geometry/colour/elbows.
+- History request stays one per visible panel per refresh with the plot gated on `chartsOpen()` — phase-29 rule, verified by measurement rather than changed.
+- No dependency changes, so `uv pip list --outdated` advisory was left alone; no `<table>` introduced; other pages byte-identical.
+
+Next pending task: `05_lines_and_switches.md`.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.validate
new file mode 100644
index 0000000..2987171
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__04_page_two_tables.a1.validate
@@ -0,0 +1,75 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  3%]
+........................................................................ [  7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+s....................................................................... [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+...............................ssssssssssss............................. [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+...................sss.................................................. [ 99%]
+.....                                                                    [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               201      0   100%
+src/dashboards/api.py                  499      3    99%   220, 250, 253
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      5    98%   323-324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      463      4    99%   518, 529, 637, 1129
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 4063     44    99%
+Required test coverage of 94% reached. Total coverage: 98.92%
+1789 passed, 16 skipped, 1 warning in 166.82s (0:02:46)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+  certifi   2026.10.19 2026.10.23 wheel
+coverage  7.16.2     7.17.0     wheel
+fastapi   0.153.0    0.162.0    wheel
+pycparser 3.11       3.12       wheel
+ruff      0.17.1     0.17.2     wheel
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md
new file mode 100644
index 0000000..a21343b
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md
@@ -0,0 +1,26 @@
+Done. Task 05 (`/gateway` connection lines and switches) is implemented, tested, and verified against the live ingress.
+
+```
+Changed  src/dashboards/web/static/dash.css        --gate-on/--gate-off existence pair (+ --gate-leaf-gap/
+         row-gap); spine = each .gate-link's ::before/::after halves meeting across the leaf gap, first/last
+         dropped, .gate-group.solo → straight across; pipe colour from on/off, motion from live/still only.
+         page-gateway.js          routeInConfig() → every drawn row `on`; switch is now <button role="switch"
+         aria-checked aria-disabled="true"> + knob, named ("endpoint, reached by <selector>, in the nginx
+         config, on"); renderGroups sets .solo from the group's own leaf count; no new listener.
+         tests/test_api.py        new: test_a_connection_is_green_because_it_is_in_the_config,
+         test_haproxy_draws_straight_across_and_nginx_branches; rewrote test_the_switch_is_built_and_explicitly_
+         unwired (was the aria-hidden SVG mark), the motion pin (two class pairs) and the reduced-motion pin
+         (+.gate-switch-thumb, + "nothing in the map animates that isn't stilled"), and the no-verdict docstring.
+         AGENTS.md / README.md    the /gateway UI paragraphs now say colour=config existence, motion=socket,
+         and describe the real-but-unwired switch and the branch geometry.
+Green    uv run pytest → 1791 passed, 16 skipped · coverage 98.92% (floor 94) · ruff clean · pyright 0 errors ·
+         bash .agents/validate.sh → exit 0.
+Live     data/logs/30-task05-lines.cjs → 46 PASS / 0 FAIL (exit 0; gateway-30-task05-{1440,360,reduced}.png):
+         33/33 lines compute to --gate-on in BOTH themes; 1 live line animates, 32 resting stay green;
+         reduced motion stills pipes AND knob; 6 haproxy groups solo/straight; nginx :443/18, :4443/6, :8443/3
+         spines at one x (186 = trunk right = tick left), continuous, stopping at first/last; 33 rows × 1 switch;
+         Playwright itself refused the click as "not enabled", forced → nothing changed, 0 non-GET requests;
+         360 px 0px sideways scroll, stacked trunk still connected. 27-task02-mobile-audit re-run: 371 PASS /
+         0 FAIL / 0 FINDING; 30-task04-panels re-run (its one switch check updated to the shipped shape): 49/0.
+Left     .agents/phases/todo/.../05_lines_and_switches.md untouched (not my file to move); task 06 still to run.
+```
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.validate
new file mode 100644
index 0000000..2876c48
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__05_lines_and_switches.a1.validate
@@ -0,0 +1,75 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  3%]
+........................................................................ [  7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+..s..................................................................... [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+.................................ssssssssssss........................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+.....................sss................................................ [ 99%]
+.......                                                                  [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               201      0   100%
+src/dashboards/api.py                  499      3    99%   220, 250, 253
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      4    98%   324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      463      4    99%   518, 529, 637, 1129
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 4063     43    99%
+Required test coverage of 94% reached. Total coverage: 98.94%
+1791 passed, 16 skipped, 1 warning in 169.28s (0:02:49)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
+advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
+  certifi   2026.10.19 2026.10.23 wheel
+coverage  7.16.2     7.17.0     wheel
+fastapi   0.153.0    0.162.0    wheel
+pycparser 3.11       3.12       wheel
+ruff      0.17.1     0.17.2     wheel
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.err b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.err
new file mode 100644
index 0000000..e69de29
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md
new file mode 100644
index 0000000..9c1cefb
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md
@@ -0,0 +1,13 @@
+Done. Task 06 complete.
+
+**Implementation (docs + verification only — no behaviour change):**
+- `AGENTS.md`: rewrote the `/gateway` page-table row (two panels, trunk→leaf), the `/api/summary` gateway block key list (now the twelve it serves, `warnings` included), `sumConnections()`→`sumLive()`, gap 12's audit re-run, gap 13 with today's measurements (1440 px 0/33+0/33 in a 361 px column; 360 px 31/33+22/33 in 139 px — the switch's 34+26 px — every row still carrying its full text on `title`), the fixture-vs-live drift note (fixture 17 map entries, live 18), and the commands block's counts.
+- `README.md`: page-table row, ingress line figures, dropped hard-coded domain counts; `dash.css` + `gateway.html` comments likewise de-numbered. `GATEWAY_HOST` config row unchanged — the phase added no env setting.
+- New: `data/logs/30-connection-map.cjs` (**63 PASS / 0 FAIL**, 5 screenshots), `data/logs/verify-30-connection-map.py` (**17 PASS**), `data/logs/30-final-mobile-audit.out` (**371 PASS / 0 FAIL / 0 FINDING**), `data/logs/NOTES-30-connection-map.md`.
+- Live read-only: `warnings: []`; no `unmatched`/`outbound`/`by_port`/`partial`; 6 haproxy frontends → exactly their own `server`; 18 `map` entries = 18 `:443` leaves incl. `default → 127.0.0.1:4443`; `:4443` 6 / `:8443` 3; `:80` listener with no connection; no `9120`. **Inbound reconciliation: page 17 = kernel 17** (`ssh gateway-ops cat /proc/net/tcp{,6}`, bracketed reads in the transcript). 10 sources `ok`; `git diff --stat agent/ deploy/` empty.
+
+**Tests/lint:** `bash .agents/validate.sh` exit 0 — 1791 passed, 16 skipped; coverage 98.94% (floor 94); ruff + pyright + `node --check` clean; `uv pip list --outdated` empty.
+
+**Notable decisions:** rule 8 forced a lock refresh (certifi/coverage/fastapi 0.153→0.162/pycparser/ruff) and re-verified everything, including the browser pass, after a dev-server restart; that exposed a fixed-sleep flake in `tests/test_poller.py`'s maintenance tests, now a `_wait_for()` predicate on the real claim (no production code moved). Fixture/live map-count drift is recorded, not silently re-captured. Git commit left to the operator (harness forbids mutating the repo history).
+
+**Next pending:** none — 06 was the last task in `.agents/phases/todo/30_gateway_connection_map/`.
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md.status b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md.status
new file mode 100644
index 0000000..9766475
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.md.status
@@ -0,0 +1 @@
+ok
diff --git a/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.validate b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.validate
new file mode 100644
index 0000000..7b778d8
--- /dev/null
+++ b/.agents/reports/30_gateway_connection_map/30_gateway_connection_map__06_docs_and_verify.a1.validate
@@ -0,0 +1,69 @@
+== uv run pytest --cov (hermetic: no network, live tests skip) ==
+........................................................................ [  3%]
+........................................................................ [  7%]
+........................................................................ [ 11%]
+........................................................................ [ 15%]
+........................................................................ [ 19%]
+........................................................................ [ 23%]
+........................................................................ [ 27%]
+........................................................................ [ 31%]
+..s..................................................................... [ 35%]
+........................................................................ [ 39%]
+........................................................................ [ 43%]
+........................................................................ [ 47%]
+........................................................................ [ 51%]
+........................................................................ [ 55%]
+........................................................................ [ 59%]
+........................................................................ [ 63%]
+........................................................................ [ 67%]
+........................................................................ [ 71%]
+.................................ssssssssssss........................... [ 75%]
+........................................................................ [ 79%]
+........................................................................ [ 83%]
+........................................................................ [ 87%]
+........................................................................ [ 91%]
+........................................................................ [ 95%]
+.....................sss................................................ [ 99%]
+.......                                                                  [100%]
+=============================== warnings summary ===============================
+.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
+  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
+    from starlette.testclient import TestClient as TestClient  # noqa
+
+-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
+================================ tests coverage ================================
+_______________ coverage: platform linux, python 3.14.4-final-0 ________________
+
+Name                                 Stmts   Miss  Cover   Missing
+------------------------------------------------------------------
+src/dashboards/__init__.py               3      0   100%
+src/dashboards/__main__.py              14      1    93%   32
+src/dashboards/alerts.py               201      0   100%
+src/dashboards/api.py                  499      3    99%   220, 250, 253
+src/dashboards/app.py                  190      0   100%
+src/dashboards/auth.py                 265      0   100%
+src/dashboards/certs.py                292      0   100%
+src/dashboards/collectors.py           216      5    98%   323-324, 328-329, 346
+src/dashboards/config.py               126      0   100%
+src/dashboards/debug.py                 14      0   100%
+src/dashboards/poller.py               165      3    98%   192-194, 279
+src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
+src/dashboards/rates.py                 73      0   100%
+src/dashboards/severity.py              49      0   100%
+src/dashboards/sources/__init__.py       0      0   100%
+src/dashboards/sources/disks.py        134      0   100%
+src/dashboards/sources/gateway.py      463      4    99%   518, 529, 637, 1129
+src/dashboards/sources/host.py         209      0   100%
+src/dashboards/sources/llm.py          178      1    99%   285
+src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
+src/dashboards/sources/nut_sim.py      134      0   100%
+src/dashboards/store.py                313      2    99%   553-554
+------------------------------------------------------------------
+TOTAL                                 4063     44    99%
+Required test coverage of 94% reached. Total coverage: 98.92%
+1791 passed, 16 skipped, 1 warning in 168.76s (0:02:48)
+== uv run ruff check src tests agent ==
+All checks passed!
+== uv run pyright ==
+0 errors, 0 warnings, 0 informations
+== node --check src/dashboards/web/static/*.js ==
diff --git a/AGENTS.md b/AGENTS.md
index 517f2dc..5c5689f 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -29,7 +29,7 @@ file — plus an overview page that says which of the five you need:
 | `/disks`   | Are any of my physical disks failing, and which one — health, temp, hours, wear | the same agents, `smartctl -i -A -H` per whole drive (never a partition) |
 | `/llm`     | Tokens/sec, active sessions, queue depth, KV pressure, latency percentiles      | gufo `/metrics` + `/slots`, vLLM `/metrics`      |
 | `/ups`     | Battery health, runtime left, power events, battery-test buttons                | NUT `upsd` (our own wire-protocol client; 3051 here, not 3493) |
-| `/gateway` | What is coming in through the router, and where does it go — frontends, `server_name`s, the SNI map, live pipes | the same agent (1.2.0) on the one host `GATEWAY_HOST` names: its `haproxy` + `nginx` config sections joined to its `/proc/net/tcp{,6}` sockets |
+| `/gateway` | Which domains come in on which port, and where each one goes — **two connection tables, one per proxy config file** (`nginx`, then `haproxy`), a trunk per bound port with its configured endpoints branching off it, each line carrying the config's own word for the route and its live socket count | the same agent (1.2.0) on the one host `GATEWAY_HOST` names: its `haproxy` + `nginx` config sections joined to its `/proc/net/tcp{,6}` sockets |
 
 History is a first-class feature, not a sparkline afterthought: every number worth graphing
 is stored, rolled up (raw → 1m → 1h), and served from `/api/*/history`.
@@ -472,39 +472,97 @@ Responsibilities, one line each:
   arithmetic and a dead agent never shrinks a fleet total.
 - `sources/gateway.py` — the same snapshot projected onto the **connection topology** of the one
   host `GATEWAY_HOST` names (phase 29): `parse(snapshot, host)` joins agent 1.2.0's `haproxy`
-  frontends and `nginx` `listen`s into **inbound** pipes (one per listen port, carrying the
-  `server_name` domains and the live ESTABLISHED count + distinct client addresses) and haproxy
-  `server` lines, concrete `proxy_pass` targets and the `$var`→`map` entries into **outbound**
-  pipes, plus the `unmatched` tallies (`inbound` = connections on a listening port no config
-  names, `outbound` = connections to something no target claims, `other` = live listeners no
-  config claims — phase 28's "an unclaimed socket stays visible as one"). `count` semantics are
-  the whole honesty of the module: **no DNS** (the spy test pins `socket.getaddrinfo` is never
-  called — `ipaddress` decides "is this already an address", and it never asks), an exact
-  `(address, port)` match for a target written as an address (`by_port: false`), a port-only
-  match for a **name** and only when that port has exactly one configured host
-  (`by_port: true`), and **no attribution at all** when several names share a port (the real
-  `stream.conf` map's sixteen `*.reeselink.com:443`): those pipes carry `connections: null`, the
-  sockets go to `unmatched.outbound`, and `unmatched.groups` says once per port how many and
-  among which candidates — picking one would be rule 2, and repeating the port's total on
-  sixteen pipes reads as sixteen times the traffic. A pipe is `null` (never `0`) whenever the
-  socket table did not answer or the join could not decide, and publishes **no sample** then, so
-  a chart cannot draw a zero for an unknown. The classification is one exclusive pass
-  (`join_sockets`), which is what makes "inbound + outbound + unmatched = the socket table"
-  hold — the identity task 06 checks against a direct `/proc/net/tcp` read. `supported: false`
+  frontends and `nginx` `listen`s into **`listeners`** (one per listen port, carrying the
+  `server_name` domains and the live ESTABLISHED count + distinct client addresses — the key was
+  `inbound` until phase 30 task 01 renamed it, because "a port a config names" is the thing the
+  page draws a trunk for, not a direction) and haproxy
+  and the config-declared routes into **`connections[]`**. **The join is two attributions and
+  nothing else** (phase 30 task 02 — the operator called the phase-29 version overengineered, and it
+  was). Inbound: a socket's **local** port names a configured listener, which is a fact (`/proc`
+  states it, no config reading needed). Outbound: a socket's remote `(address, port)` **equals a
+  target written as an address** in one of the two config files — the only outbound match that
+  claims nothing, because the target of a `server` line, a `proxy_pass` or an `upstream` member *is*
+  the endpoint the gateway opened. `join_sockets()` still partitions the table in **one** pass, so a
+  socket classified both ways would be counted twice — which is exactly what `127.0.0.1:8443` is:
+  the stream `map`'s `default` sends `:443` to that port and the box's own http vhosts listen on it,
+  so the loopback hop counts **once as one inbound and once as one outbound**, a pipe on each card,
+  neither claiming the other's number. Everything else is **ignored**: not counted, not totalled,
+  not warned about. What that retires is the guessing and the bookkeeping it existed to explain —
+  the port-only guess for a name target, `unmatched` / `unmatched.groups` / `partial` /
+  `unmatched_listeners`, and `by_port` with its `MAX_GROUP_HOSTS` chip. A **name** target
+  (`reeseapps-immich.reeselink.com:443`) is therefore never credited: crediting it needs DNS (which
+  the module still never calls, spy-pinned) and every name here resolves back through this same
+  router, so the count would be attributed to something the config never said. Two consequences the
+  page and the tests both depend on: **`live_out` is not the bandwidth** and the socket table never
+  reconciles to it — a pipe count means "this route has N live connections" and nothing more — and
+  several `(listen, endpoint)` lines reaching one endpoint carry one count **repeated** with
+  `shared: true` (never a split nobody measured), which is why `/2`'s totals and the tests sum
+  **distinct endpoints**. A pipe is `null` (never `0`) whenever the socket table did not answer or no
+  line reaches its endpoint, and publishes **no sample** then, so a chart cannot draw a zero for an
+  unknown. `supported: false`
   (a 1.1.0 agent, or `--no-proxy`) keeps every key with empty lists and null counts plus
   `WHY_PREDATES`, `available: false`/`null` per section becomes a `why` sentence and the agent's
   own line in `section_errors`, and nothing here carries a `severity` (`net.*` precedent: a busy
-  proxy is the job) or a `window_seconds` (a count is not a rate). Gauges: `gateway.in_conns@<port>`
-  and `gateway.out_conns@<host>:<port>` — the port **is** in the outbound name, because this
-  fleet's two haproxy Minecraft backends share `minecraft.reeselink.com` on 25565 and 25566 and
-  two gauges on one name would overwrite each other in silence. `parse_gateway_snapshot()` is the
+  proxy is the job) or a `window_seconds` (a count is not a rate). **`connections[]`** (phase 30
+  task 01) is the graph the pipe lists never stated: one row per route the two config files
+  actually declare, from `config_connections()`, each carrying its `in.port`, its `out`
+  `{host, port, name, kind, selectors, address}` (`kind` is `backend` / `server_name` / `pool` /
+  `map`, `selectors` the config's own word(s) — a haproxy backend name, an nginx `server_name`, a
+  stream `map` key, the literal `default` kept verbatim), its own `metric`, and `connections: null`
+  until task 02 re-points the socket join at it. Four derivations (haproxy `frontend → routes →
+  backend → server`, an nginx vhost's concrete `proxy_pass` per `listen` port of **its own block**
+  — which is why `nginx_server_blocks()` replaced the per-port `nginx_listen_ports()` — a
+  port-less `proxy_pass` naming an `upstream`, and a `proxy_pass $var` fanning out through the
+  `map` whose `variable` matches), one merge rule (identical `(source, in_port, host, port)` is one
+  line whose selectors union in first-seen order; **never** merged across `in_port`) and two silent
+  refusals (a `proxy_pass` with neither target nor variable, and a haproxy frontend that routes by
+  a fetch expression, which the agent reports as no name — that trunk is drawn alone, because "no
+  name" and "no routing directive" are one value in this payload). **Name-keyed outbound gauges are
+  retired** (phase 30 task 02): `gateway.out_conns@<host>:<port>` is written **only** for an endpoint
+  the config wrote as an address (`out.address` true), because the sole reason a name-keyed gauge
+  existed was the port-only guess the join no longer makes — such a series would be a chart of a
+  number that is always `null`. `gateway.in_conns@<port>` is unchanged, and the port **stays** in the
+  outbound name, because this fleet's two haproxy Minecraft backends share `minecraft.reeselink.com`
+  on 25565 and 25566 and two gauges on one name would overwrite each other in silence; lines sharing
+  an endpoint write the same value to the same name (they are one count, not two) and `samples()`
+  de-duplicates by metric. `parse_gateway_snapshot()` is the
   `Result` the poller consumes; there are **no events** (a connection count has no transition
   worth a line — a proxy that stops routing shows up as its host's own poll failing). The
   never-answered arm is `stub(host, ts)` — the **same skeleton** `parse` fills in, plus
   `unreachable: true`, `supported: null` and `WHY_NO_ANSWER` — because the route that serves a host
   with no payload yet must not hand the page a shape with keys missing, and `WHY_NO_ANSWER` is not
   `WHY_PREDATES`: an agent that has not replied has not said it has no sections (invariant 3's two
-  facts staying two sentences).
+  facts staying two sentences). **`warnings()`** (phase 30 task 03) is the payload's other half: the
+  two config files judged against **themselves**, seven kinds and nothing else —
+  `haproxy_route_dangling` (a `default_backend`/`use_backend` name no `backend` declares, one row per
+  frontend→backend line, `subject` `"<frontend>-><backend>"`), `haproxy_backend_orphan` (a `backend`
+  no frontend routes to, its server count from the config), `haproxy_backend_empty` (a `backend` with
+  no `server` — deliberately *not* also an orphan: `orphan` needs a server to have nowhere to go),
+  `nginx_server_unlistened` (a `server` block with a `server_name` and no `listen`, in both its
+  proxying and non-proxying arms), `nginx_pool_undeclared` (a `proxy_pass` whose value has no port —
+  the shape task 01's `out.kind: "pool"` already draws no line for — naming no `upstream`; a block
+  with two such `listen`s is **one** warning, `subject` `"<pool>@<port>+<port>"`, because the repair
+  is one line), `nginx_variable_unmapped` (a `proxy_pass $var` no `map` defines — the `map` *is* this
+  fleet's router, so that is a broken route and not a style note) and `nginx_map_route_missing` (an
+  entry of a **referenced** `map` whose value is not an address). Every row is
+  `{id, kind, subject, message}` with `id = "<kind>:<subject>"`, `message` complete on its own because
+  `alerts.py` quotes `warnings[0]` verbatim, `kind` the vocabulary the page groups by and `subject`
+  the config's own name for the thing, never a paraphrase of the message. Three things it refuses to
+  do, each pinned from the real capture and not only from a fake section: it never **joins** a warning
+  to `connections[]` or `listeners[]` (a page indexes one row by its own `id`; a boolean beside a
+  hundred rows is a second source of truth about the same route), it never guesses a **name
+  target**'s address (the module still never calls `socket.getaddrinfo`, spy-pinned), and it stays
+  silent about the three shapes that are legal or unreadable rather than broken — a vhost with a
+  `listen` and no `proxy_pass` (a `:80` `return 301` is identical here), a frontend whose only routing
+  is a fetch expression (agent 1.2.0 reports *no name*, the same value "no routing directive" has, so
+  distinguishing them is an agent change and not a source-level guess), and an entry of a `map` no
+  `proxy_pass` names (the `$connection_upgrade` map's `upgrade`/`close` are header words, not missing
+  routes). Like the socket half, a section whose `available` is not `True` is **not judged** — a host
+  that cannot be read has not been found guilty of anything — so `warnings` is `[]` for an absent,
+  unreadable or pre-1.2.0 config and the page cannot tell "clean" from "unreadable" by that list
+  alone; it reads `sections` for that, the same pair `supported`/`why` already form. Order is
+  deterministic (haproxy kinds in config order, then nginx kinds) and rows are deduplicated by `id`,
+  because the page keys its DOM on it and the alert quotes the first.
 - `sources/llm.py` — gufo + vLLM field maps (`GUFO_SERIES`, `VLLM_SERIES`,
   `VLLM_HISTOGRAMS`), measured Δ rates **diffed per label set** (`rate_key()` keys the
   estimator on the resolved name plus its labels; the cell is the Σ of the per-series
@@ -705,9 +763,22 @@ Responsibilities, one line each:
   A missing `host:<name>` record suppresses nothing — "I cannot find the host's job" is not evidence
   the host is fine. The gateway source has **no verdict rule and none is wanted**, the same shape as
   the disk rule: its payload publishes no `severity`, `severity.THRESHOLDS` has no `gateway.*` row,
-  `alerts.build` takes no gateway payload at all, so a `gateway` alert can only ever be
-  reachability — stale past 3× its own 30 s interval or stopped answering — and 400 connections on
-  an ingress is the job, not a fault.
+  so 400 connections on an ingress is the job, not a fault. What phase 30 task 03 added is the one
+  non-reachability voice it *can* have without a threshold — **config integrity** — because "a proxy
+  config that does not connect to itself" is a structural fact, not a graded number: `alerts.build`
+  gained a keyword-only `gateway_payload`, and one `warn` row (`id` `gateway:config`, `href`
+  `/gateway`, `at` the payload's own timestamp so the line does not reset every 30 s) exists exactly
+  when that payload carries `warnings` **and** its job is configured, `ok` and not stale. One row
+  whatever the count — seven dangling routes are one config to fix and the page lists all seven —
+  reading `"{n} proxy config {problem|problems} to address — {first message}"`, with the message
+  built by `sources/gateway.py` and only quoted here. It is suppressed whenever the job's own
+  reachability row is on screen (`ok: false` or stale past 3× its interval), because a router that is
+  not answering is the operator's problem and re-listing warnings from a reading they cannot refresh
+  is noise beside it; the page keeps showing them beside the last good numbers the whole time. So
+  `alerts.build`'s signature is now the boundary that keeps the *counts* out: no `severity` reaches
+  it and no `gateway.*` threshold can be consulted, which is what
+  `test_a_gateway_payload_with_a_fabricated_verdict_alerts_nothing` re-pins after it replaced the
+  older "takes no gateway payload at all" wording.
 - `store.py` — `sample(source,host,metric,res,ts)` + `event` + `meta`, rollups, pruning. The
   `meta` table is the only durable key/value state in the app and is reached through three
   named helpers — `get_meta`/`set_meta`/`delete_meta` (the last returns its rowcount, because
@@ -849,10 +920,14 @@ Responsibilities, one line each:
   lists — the third is phase 15's, and it writes `meta` rows and nothing else).
   `/api/gateway/*` (phase 29 task 03) is the ingress pair, and it is the same two rules on a
   single-host source. `/snapshot` answers `sources/gateway.parse`'s payload for the one
-  `GATEWAY_HOST` entry — the haproxy frontends and the nginx `listen`/`map` echo, the inbound pipes
-  (port, domains, live count, up to `MAX_CLIENTS` client addresses), the outbound pipes (`by_port`
-  naming which half of the match is a socket fact), each pipe's own `metric`, the `unmatched`
-  tallies, and `supported`/`sections`/`why` — with `states` appended and the payload's own `ts`
+  `GATEWAY_HOST` entry — the haproxy frontends and the nginx `listen`/`map` echo, the `listeners`
+  (port, domains, live count, up to `MAX_CLIENTS` client addresses), the `connections` graph (one row
+  per route the configs declare, its `in.port` always one of those listeners, its own `metric`,
+  `shared` when more than one line reaches its endpoint), and the `warnings` list (phase 30 task 03:
+  seven kinds of config that does not connect to itself, each `{id, kind, subject, message}` with
+  `id = "<kind>:<subject>"`, empty for a pre-1.2.0 agent and for a section that did not answer) —
+  with `states` appended and the payload's own
+  `ts`
   left alone, because that is when the agent took the reading and it is what the page ages. Three
   arms reach it and none of them is red: `404 {"configured": false}` **in the route's first line**
   when `GATEWAY_HOST` names no `HOST_TARGETS` entry (unset and wrong-name are both spy-pinned to
@@ -862,7 +937,9 @@ Responsibilities, one line each:
   and minus only the `agent_version` nobody published, every count `null` because an agent that has
   not spoken has not reported an idle gateway (rule 2). Nothing in the payload carries a `severity`
   or a `window_seconds`, at any depth (pinned by a recursive walk: a busy proxy is the job and no
-  Δ was ever measured). `/history` serves the `gateway.in_conns@<port>` /
+  Δ was ever measured). Phase 30 task 02 took `outbound[]`, `unmatched` and `by_port` out of it: the
+  flat list duplicated the graph with a worse count, and the residual existed only to explain a
+  guessing rule that no longer runs. `/history` serves the `gateway.in_conns@<port>` /
   `gateway.out_conns@<host>:<port>` gauges with `hosts=` defaulting to the ingress **alone** (the
   name the samples are stored under — defaulting to every target would draw empty plots for
   machines nobody asked to route), and it carries no configured gate because it dials nothing:
@@ -896,20 +973,35 @@ Responsibilities, one line each:
   `system.hosts`/`llm.engines` exactly as `/api/system/snapshot` does, so `hosts_total`
   counts the machines there are and `hosts_live` the ones answering.
   The **`gateway` block** (phase 29 task 02) is additive in the same way: `{configured, host, href,
-  supported, unreachable, inbound, outbound, map_targets, unmatched, unmatched_listeners, partial,
-  states}`. Task 02 wrote it for programmatic consumers (the page itself reads
+  supported, unreachable, listeners, connections, live_in, live_out, map_targets, warnings, states}`
+  — twelve keys, `warnings` added by task 03. The middle six were renamed by phase 30 task 02 from
+  `inbound`/`outbound`/`unmatched`/`unmatched_listeners`/`partial`, because the first pair now counts
+  a graph and not a flat pipe list and the residual no longer exists; `tests/test_api.py` pins the
+  set, so a thirteenth field is a decision and not an accident. `listeners` and `connections` are **row counts** ("how many trunks / routes does
+  this gateway declare", which is what the overview's one line prints) and `live_in`/`live_out` are
+  the two socket-derived totals; Task 02 wrote it for programmatic consumers (the page itself reads
   `/api/gateway/snapshot`, task 03); task 05 gave it one page-side reader, the single line `/`
   renders under the fleet table, so `href` joined the block — derived from `alerts.HREF`, the one
   table that writes a dashboard's route, so the overview's link and an alert about the same source
   cannot spell the page differently (`test_the_gateway_block_links_to_the_page_the_alert_row_links_to`,
   and the page half reads only block keys: `test_the_overview_line_reads_the_gateway_block_it_claims`
-  resolves the served `GATEWAY_FIELDS` against a live document). `inbound`/`outbound` are the sums of the pipes' own counts and `map_targets` counts the stream
-  map's routing entries; every figure is `null` — never `0` — in the arms that did not measure
-  (unconfigured, configured-but-never-answered, a 1.1.0/`--no-proxy agent, a silent socket table),
-  and `partial: true` says a total had to leave an unknown pipe out (a port whose configured targets
-  cannot be told apart) rather than pretend to be the whole number. `unmatched` counts
-  *connections* and `unmatched_listeners` counts *ports*, so they are two fields and never one sum,
-  and nothing in the block carries a `severity`. `/api/config` grew the matching row (`enabled`,
+  resolves the served `GATEWAY_FIELDS` against a live document). `live_in` sums the listeners and
+  `live_out` the **distinct outbound endpoints** — never the connection lines — because several
+  `(listen, endpoint)` lines carry one socket count repeated with `shared: true`, and summing the
+  lines would book the same sockets once per line and print a router busier than it is (the same
+  rule that keys the outbound gauges by `(address, port)`); `api._endpoint_values()` is the one
+  reader of that, and a line with no `metric` (its target is a name the join can never count) is
+  absent rather than an unmeasured endpoint holding the total hostage. `map_targets` counts the
+  stream map's routing entries. Every figure is `null` — never `0` — in the arms that did not
+  measure (unconfigured, configured-but-never-answered, a 1.1.0/`--no-proxy agent, a silent socket
+  table), and a total is `null` rather than a part of itself when any countable endpoint is unknown
+  (`page-gateway.js`'s `sumLive()` mirrors it for the one tally the page paints — the page has no
+  outbound total of its own, so only the inbound half is summed there). Task 30.03 added the
+  twelfth field, `warnings` — the **count** of `sources/gateway.warnings()` rows, which is what the
+  page's `warnings` head tally and the overview's ` · N to address` suffix both read (the overview
+  prints it only above zero; a permanent `0 to address` is the ink the empty-state rules exist to
+  avoid). Nothing in the
+  block carries a `severity`. `/api/config` grew the matching row (`enabled`,
   `host`, `url`, `interval_seconds`, `timeout_seconds`), where `url` is the named entry's
   `Target.display_url` and `null` when no target carries the name — invariant 6's boundary applies
   to a name-only source exactly as it does to a URL-bearing one, because this body is what a browser
@@ -1058,9 +1150,11 @@ Responsibilities, one line each:
   to a threshold. `Dash.severityFor(value, warnAt, failAt)` is the documented fallback for
   values the API does not rate, and **no page script calls it any more** — `/` was converted
   in phase 02, `/system` in phase 03, `/llm` in phase 04, `/ups` in phase 05 and `/disks`
-  shipped that way from its first commit, so every colour on all five pages comes from a
+  shipped that way from its first commit, so every colour on those five pages comes from a
   `severity` verdict the API sent
-  (`tests/test_api.py` fails if a page script names it again). A value the API should rate
+  (`tests/test_api.py` fails if a page script names it again). The sixth dashboard colours nothing
+  by verdict at all — `/gateway`'s only colour pair is existence (`--gate-on`/`--gate-off`), and it
+  carries no `severity` token anywhere. A value the API should rate
   gets a row in `severity.py`, never a bound in JS.
   **The masthead is three rows at every width, the two control rows flush right** (phase 20 task
   01 made the rows, `TODO.md:5-6`; phase 25 task 02 re-justified them, `TODO.md:4` — "I made a
@@ -1223,7 +1317,10 @@ dashboard family — `host`, `llm`, `ups`, `disks` for the SMART series
 `disk.uncorrectable@…`, `disk.percentage_used@…`), and `gateway` for the phase-29 connection
 gauges (`gateway.in_conns@<listen-port>`, `gateway.out_conns@<host>:<port>` — the port belongs
 in the outbound name because two services on one host are two facts and one name would make the
-second insert overwrite the first). Those keep their own family instead of
+second insert overwrite the first; since phase 30 task 02 the outbound gauge is written **only** for
+an endpoint the config wrote as an **address**, so no name-keyed `gateway.out_conns@…` name is ever
+inserted again — a host that had one before this change keeps the old series until `maintain()` ages
+it out, and its chart simply stops growing points). Those keep their own family instead of
 sitting beside `host`'s `disk.used_pct@/mount` because the cadences differ thirty-fold and
 `GET /api/metrics?source=disks` has to answer "what does *this page* have history for".
 That scheme is the history API's key — treat it as a public interface.
@@ -1260,7 +1357,8 @@ That scheme is the history API's key — treat it as a public interface.
   `/usr/local/lib/dashboards-agent/host_agent.py` installed at 13:27, and then its bearer token
   went into `HOST_TARGETS`' URL userinfo — so `host:driveripper` and `disks:driveripper` are
   **`ok`** and the `live` suite is **11 passed / 0 failed** (it was 9/2 on the missing token that
-  morning, and 8/3 on the ConnectError before that). The unit reads
+  morning, and 8/3 on the ConnectError before that; the suite has grown since — `uv run pytest -m
+  live --live` reads **12 passed / 0 failed** on 2026-10-23). The unit reads
   `--host 10.1.0.126 --port 9120 --token-file /etc/dashboards-agent.token` (`640
   root:dashboards-agent`, the mode `deploy/install-agent.sh` writes) and is still in the `disk`
   group (`getent group disk` → `disk:x:6:dashboards-agent`) — but it does **not** run as that
@@ -1518,9 +1616,9 @@ uv run python scripts/dev-certs-export.py --url http://127.0.0.1:8090 \
                                           # GET /api/certs/<name>/bundle and writes
                                           # data/certs/<name>.bundle at 0600 — mints nothing
 
-uv run pytest                             # hermetic: 1746 passed + 16 skipped (12 live,
+uv run pytest                             # hermetic: 1791 passed + 16 skipped (12 live,
                                           # 4 store_perf), no network
-uv run pytest --cov                       # coverage gate (99.08%; floor 94%)
+uv run pytest --cov                       # coverage gate (98.9%; floor 94%)
 uv run pytest -m live --live              # opt-in: real fleet / engines / upsd
 uv run pytest -m store_perf --store-perf  # opt-in: the store hot-path timings over the seeded
                                           # store, priced against `store_perf.BUDGETS` (the cached
@@ -1639,14 +1737,26 @@ branch `main`); there is no CI on it, so `bash .agents/validate.sh` is the only
   `test_the_real_drives_answer_every_number_the_disks_page_prints` asserts every number
   `/disks` prints comes out of real drive output — that test is what caught the parser
   reading the end of an attribute row instead of its annotated RAW_VALUE column.
-- **A join is pinned by the identity it must satisfy and by the one question it may never ask**
-  (phase 29). `tests/test_gateway_source.py` runs the captured gateway configs and the recorded
-  `/proc/net/tcp{,6}` tables through the **real** `host_agent` parsers, so the join is compared with
-  the agent's document and not with a copy of its field names, and then demands the arithmetic:
-  inbound + outbound + unmatched equals the socket table's own ESTABLISHED count, a port no config
-  claims stays visible in `unmatched.other`, several names sharing one port answer `null` rather than
-  picking a favourite, and `socket.getaddrinfo` is spied so the day the join resolves a name the run
-  fails — deciding "already an address, or a name?" is all that module may ask (rule 2).
+- **A join is pinned by the rules it applies and the one question it may never ask** (phase 29,
+  simplified by phase 30 task 02). `tests/test_gateway_source.py` runs the captured gateway configs
+  and the recorded `/proc/net/tcp{,6}` tables through the **real** `host_agent` parsers, so the join
+  is compared with the agent's document and not with a copy of its field names, and then demands the
+  two attributions and nothing beyond them: a socket whose **local** port names a listener is
+  inbound, a socket whose remote `(address, port)` equals a configured target is outbound, and
+  **every other socket is ignored** — the capture's `established` (18 that day) and the two totals
+  (9 in, 2 out) are therefore both printed and deliberately never reconciled, because the identity
+  this suite used to demand (in + out + unmatched = the table) was the arithmetic of a guessing rule.
+  The rules that must never come back are pinned as absences: no `by_port`/`partial`/`unmatched`
+  vocabulary in the payload or on the page, no `0` for a pipe the join could not count, and
+  `socket.getaddrinfo` spied so the day the join resolves a name the run fails — a name is never
+  credited with a connection (rule 2), which is why 14 of this fleet's 18 live sockets are nobody's
+  pipe and why **`live_out` is not the bandwidth**. One number in that suite is a **date**, not a fact:
+  the captured `stream.conf` has 17 `map` entries (so 32 connections and 17 leaves on `:443`), while the
+  live router answered **18** entries / 33 connections on 2026-10-23 (`data/logs/30-live-verify.out`)
+  because a domain was added after the capture. That is the designed difference between a fixture and a
+  reading — folding the drift in means re-running `./scripts/capture-gateway-config.sh` **and**
+  re-tallying `tests/test_gateway_source.py` in the same commit, never editing a test to match a live
+  read.
 - Anything that needs a failure mode — upsd refusing a command, an engine 500ing, a host
   rebooting mid-poll, a counter reset — is a fake in `tests/conftest.py`.
 - **A verdict the operator sees is pinned on the surface that shows it, in both directions.**
@@ -1881,9 +1991,18 @@ two-panel shape against the served HTML.
 
 Under the fleet table sits the **ingress's one line** (phase 29 task 05): `#fleet-gate`, filled by
 `renderGateway()` from `/api/summary`'s `gateway` block with the block's own `href`, so the page
-invents neither a route nor a number (`gateway 14 inbound · 4 outbound`, `n/a` for a count the
-source did not measure, the shared `.stale` dim when the agent stopped answering, and the reason in
-its `title` when it is `partial`). `configured: false` renders **nothing at all** — the `disks`
+invents neither a route nor a number (`gateway 10 listeners · 33 connections · 17 live in · 2 live
+out` as the live ingress answered on 2026-10-23 — those four figures are a *reading*, the same way a
+listener count is, and only the field names behind them are a contract — since phase 30 task 02
+reshaped the block to say what the configs declare as well as what
+the sockets are doing, `n/a` for a count the source did not measure, the shared `.stale` dim when
+the agent stopped answering). A non-zero `warnings` appends ` · N to address` through its own
+one-row table, `GATEWAY_WARNING_FIELD`, and **only** when `Number.isInteger` and `> 0`: a clean
+ingress and an ingress that never answered both print nothing, because a permanent `0 to address`
+is the ink the empty-state rules exist to avoid and a permanent sentence about checks that did not
+fire trains the eye to skip the one that did (phase 30 task 03 — the same file also pins that the
+tally is read through the table, so a rename fails there rather than printing nothing forever).
+`configured: false` renders **nothing at all** — the `disks`
 block's invariant-3 rule, no row and no red one to learn to ignore — and the row is a `<p>` inside
 the fleet panel because the page is two panels, not three (the pin counts `<section>`s).
 
@@ -2038,40 +2157,116 @@ repaints only when charge / verdict / state change (`drawGlyph()` keys a `data-d
 charge float jitters every `NUT_INTERVAL_SECONDS`, and rebuilding the `<svg>` on that re-announces
 an accessible name for a difference no eye can see.
 
-**The `/gateway` page draws pipes, and a pipe's only claim is a count** (phase 29): four cards keyed
-on the payload's own `source` word (`haproxy`, `nginx`, `map`) plus `unmatched`, each shipping
-`hidden` and appearing on the poll that has pipes for it — a gateway with no nginx in it spends no
-panel saying so, and a section that did not answer at all is the page's one `why` line rather than a
-card repeating it in a smaller font. A row is inbound (`:<listen port>`, its `server_name`s as the
-domains, up to `MAX_CLIENTS` client addresses as the footnote) or outbound (the target **as the
-config wrote it**, with the SNI name the stream map matched on in front of it when exactly one key
-routes there), and its count is `countText()` — a `null` from the join prints `n/a` and never `0`
-(rule 2). The pipe is hand-rolled SVG (`role="img"` + its own `aria-label` naming port/target,
-domains, clients and the count), it **animates only while the count is ≥ 1**, and it is **never
-coloured by a verdict**: `severity.py` has no `gateway.*` row, the payload carries no `severity` at
-any depth, and `tests/test_api.py::test_no_gateway_count_is_coloured_by_a_verdict` fails the day a
-`severity`/`ok|warn|fail` token appears in the page or the script (a busy ingress is the job, the
-`net.*` and GPU precedents). A target matched on its socket **port** alone carries a `by port` chip,
-because that count is the port's and not the target's (`by_port`, and the reason a shared `:443`
-fan-out prints `n/a` instead of repeating one number sixteen times). The page head's five tallies are
-the socket table's own totals (`listeners`, `established`) beside the totals the pipes carry (`pipes
-in`, `pipes out`) plus `unmatched`, so the page prints its reconciliation rather than asserting it,
-and the `unmatched` card's three cells stay three (`other` counts **ports**, the other two
-**connections**). A label gets its **line**: `.pipe-label` wraps and `.pipe-name` is based on `max-content`, so a short
-`:22` sits beside its count and a long target takes the whole column with the `by port` chip, the
-config's own `server` name and the count beneath it (task 06 measured the alternative — one `nowrap`
-line, seven characters of a hostname — and `data/logs/29-task06-card-haproxy.png` is the result). What
-still does not fit a ~150px column is ellipsised and not lost: `renderPipeRow` puts the whole string
-on the element as `title` and `pipeAria` carries the whole endpoint, which is what
-`test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins along with the two declarations;
-the residual and the options for it are gap 13. Charts follow `/system`: one
-collapsed `Charts` `<details>` per card, built and
-painted only while open, fed by **one** `/api/gateway/history` request per card per refresh naming
-that card's own gauges, the legend naming pipes because the card heading already says which config
-family it is. Every degradation arm uses the payload's own words — the `why` sentence for a
-pre-1.2.0/`--no-proxy` agent or a silent section, the `unreachable` dim for a host that has never
-answered, and `#gate-empty` (naming `GATEWAY_HOST` and agent **1.2.0**) for `404 {configured: false}`
-— and a failed poll re-draws nothing, so the last topology stays on screen.
+**The `/gateway` page is the config's own tree, and a line's only claim is a count** (phase 29;
+joined differently by phase 30 task 02; laid out as trunk→leaf panels by phase 30 task 04): **exactly
+two panels**, one per config file, in the order `nginx` then `haproxy` (`GATEWAY_CARD_KEYS`), each
+shipping `hidden` and appearing on the poll that has rows for it — a gateway with no nginx in it
+spends no panel saying so, and a section that did not answer at all is the page's one `why` line
+rather than a card repeating it in a smaller font. There is **no `map` panel and no `unmatched` one**:
+the stream `map` is nginx config, so its fan-out is the nginx panel's `:443` leaves
+(`out.kind: "map"`, its SNI key as the selector) read beside the port they reach, and a residual was
+the left-over of a rule the join stopped applying.
+
+Inside a panel the rows are **groups** (`groupsFor()` → `renderGroups()` → `renderTrunk()` +
+`renderLeaves()`): a *trunk* is one port that file binds (`:<port>`, its live count, up to
+`MAX_CLIENTS` client addresses, and its `server_name` count with the whole list on `title`), and the
+*leaves* hanging off it are the endpoints that port names, each with the config's own word for the
+route above it (a haproxy `server` name, a vhost's `server_name`, a stream `map` key) and its own
+`metric`. The page draws what the config declares and nothing else: the deleted `0`-padding
+(listeners with no connection, endpoints no line reaches) is gone because a group *is* a listener and
+an unrendered endpoint has no row to sit in. **A trunk whose config names no target is a fact and not
+a gap in the drawing** — this fleet's nginx `:80` is a `return 301`, so its leaf list renders the
+script's own "no target named in the config" rather than an empty box (the payload publishes no row
+for it; `sources/gateway.py` refuses to warn about that shape for the same reason). Groups are keyed
+on the port, and rows on the connection's own `id`, in per-panel `Map`s (`state.groups`,
+`state.rows`):
+built once, patched afterwards, reordered with `appendChild` of the existing node and pruned once per
+panel by id, because rebuilding a 17-row fan-out every 30 s re-announces all of it to assistive tech
+for a difference of one connection (the `/llm` slot-grid rule). `pruneCards()` wiping a panel's whole
+map is the only bulk clear, for the case where the family itself left the payload.
+
+A count is printed by `countText()`, which answers `null` for anything that is not a finite number —
+**never `0`** (rule 2) — and the two unknowns stay two sentences: a **trunk** whose socket table went
+quiet prints `n/a` (`setTxt`'s own word), while a **leaf** whose endpoint the config wrote as a
+**name** prints an em dash (`NO_COUNT`) whose `title` says `connections not attributed — the config
+writes a name and nothing here resolves names`. That is the normal look of 31 of this ingress's 33
+lines, and a column of `n/a` would be twelve identical words competing with the page's one footnote.
+The line itself is hand-rolled SVG (`role="img"` + an `aria-label` naming the inbound port, the
+endpoint, the selector and the count) and it carries **two independent class pairs** (phase 30 task
+05), because the operator's green and the socket count are two different facts:
+
+* `live` / `still` — "≥ 1 ESTABLISHED socket on this pipe right now" — decides **motion only**. One
+  `pipe-flow` keyframe whose sole property is `stroke-dashoffset`; the live rule declares no `stroke`,
+  so a busy line and a resting line are the same colour and motion can never become a verdict.
+* `on` / `off` — "a proxy config declares this route" — decides **stroke only**, through the sheet's
+  own existence pair `--gate-on` / `--gate-off` (declared once in `:root` as a substitution of the
+  theme colours, so both themes follow and no gateway rule names `--ok`). `routeInConfig()` answers
+  `true` unconditionally, which is honest rather than a stub: `connections[]` **is** the config's
+  declaration list, so `off` is the styled seam the write phase will fill and never a second state in
+  use. The base `.pipe-path` declares no `stroke` at all, which is what makes the state class the only
+  way a colour can arrive.
+
+So the page is **green because the route exists**, never because a number is good: `severity.py` has
+no `gateway.*` row, the payload carries no `severity` at any depth, and
+`test_no_gateway_count_is_coloured_by_a_verdict` fails the day a `severity`/`ok|warn|fail` token
+appears in the page or the script — the one `warn` in the file is the class `renderWarnings` takes
+from `alerts.py`, pinned by count. The **switch** at each line's head (`buildSwitch()`) is the
+control from the operator's sketch and it is **built, not wired**: a real `<button type="button"
+role="switch">` pill with a knob, keyed on `[aria-checked]` (never `:enabled`, which would paint every
+one of them off) and coloured from the same existence pair, carrying a full accessible name
+(`endpoint, reached by <selector>, in the nginx config, on`) because a colour cannot say that to a
+screen reader. It is `aria-disabled="true"` — **never** the `disabled` attribute, which would take the
+reading out of the a11y tree — with a `title` naming the missing write path, no listener (the file's
+only `addEventListener` calls are the charts `toggle` and `DOMContentLoaded`) and no `:hover` or
+`cursor: pointer` anywhere in the map, because invariant 1 means no browser can disable a route:
+`haproxy.cfg` and the nginx `server` block are the only switches on this fleet. The one `transition`
+is the knob's, and the reduced-motion block names it beside both pipe states.
+
+The branch is four CSS rules and no JavaScript: each `.gate-link` carries its own upper and lower half
+of the spine at the gutter's left edge (`::before` / `::after`, each reaching half a leaf gap past its
+row so consecutive halves meet), the first and last rows drop theirs so the spine starts at the first
+branch and stops at the last with no mask, no measured height and no background-coloured eraser —
+which is also why it stays right on the poll that adds a leaf — and `.gate-group.solo`, set by the
+script from the group's own leaf count, takes the vertical away so a one-route port runs **straight
+across** (every haproxy frontend here). `.gate-group { column-gap: 0 }` is what makes the trunk's
+right edge and the spine the same x, so each tick starts *at* its trunk, and at ≤640px the stacked
+trunk is reconnected by bringing the first row's upper half back at `top: calc(var(--gate-row-gap) * -1)`.
+
+The head's **four** tallies are the payload's own figures and nothing is summed twice: `ports` =
+`listeners.length`, `connections` = `connections.length`, `live` = `sumLive()` over the listener rows
+that publish a `metric` (`null` — never `0` — when none measured, dimmed `stale` with a tooltip naming
+the port when some did not), and `warnings` = `warnings.length`. `#gate-warnings` sits **above** the
+panels and ships `hidden`: a non-empty `warnings` list raises it, rendered through
+`ul.alerts#warnings-list` in **the overview's own row vocabulary** (`li.warn` with a `.src` from
+`familyWord(kind)` and a `.msg` carrying `warning.message` verbatim) because "a backend no frontend
+routes to" is the same kind of sentence as an alert and must not grow a second look; back to clean it
+hides and its rows go with it (both directions pinned, and the live ingress is clean, so the panel is
+off). Charts follow `/system` exactly: one collapsed `Charts` `<details>` per panel, **no** window
+chips (a fixed 24 h named by the chip beside the toggle), the request
+fired **once per visible panel per refresh** naming that panel's own gauges and cached so the first
+expand paints from data in hand, while the `LineChart` is built and painted only while the disclosure
+is open (`drawCardCharts()` returns at `chartsOpen(key)` — a `display:none` container measures 0 px),
+and the legend names pipes because the panel heading already says which config file this is. Every
+degradation arm uses the payload's own words — the `why` sentence for a pre-1.2.0/`--no-proxy` agent or
+a silent section, the `unreachable` dim for a host that has never answered, and `#gate-empty` (naming
+`GATEWAY_HOST` and agent **1.2.0**) for `404 {configured: false}` — and a failed poll re-draws nothing,
+so the last topology stays on screen. The footer is **three** paragraphs and no more: why a line is
+drawn and what its motion means; why a **name** endpoint carries no number; and that the switch is not
+wired. The layout is three load-bearing declarations (`minmax(0, 9.5rem) minmax(0, 1fr)` per group so
+a fan-out lines its leaves up instead of re-flowing them to the widest target, `minmax(0, …)` on every
+track so a 40-character hostname ellipsises instead of growing the card — phase 27's rule — and one
+column with the trunk above its leaves at ≤640 px). Task 04 measured that layout with
+`data/logs/30-task04-panels.cjs` (transcript `30-task04-panels.out`, screenshots
+`gateway-30-task04-{1440,360,reduced}.png`) and task 06 re-measured it, with the switches and the
+pipe states in place, in `data/logs/30-connection-map.cjs` (transcript `30-connection-map.out`,
+screenshots `30-connection-map-{desktop,light,warnings,predates,phone}.png` — the phase's own pass:
+two panels, straight haproxy rows, one branched nginx `:443`, green in both themes, motion only where
+a socket is live, dead switches, injected warnings, both degradation arms, 63 checks, 0 px of sideways
+document scroll at 1440 px and 360 px). What it printed on 2026-10-23: 10
+listeners / 33 connections, nginx 4 ports · 27 routes (`:443` 18 leaves, `:4443` 6, `:8443` 3, `:80`
+the refusal sentence), haproxy 6 groups of one, 31 dashes beside 2 numbered lines, every line keeping
+its full text on `title`, and **0 px** of sideways document scroll at both widths with the widest
+fan-out and both charts open.
 
 An event row names its subject **once**. Every feed (`/system`, `/disks`, `/llm`, `/ups`) renders the
 message through `Dash.eventText(event)`, which drops the `UpstreamError: ` wrapper and a
@@ -2921,8 +3116,15 @@ memory plot; the `cpu.usage_pct@coreN` series is still stored and still queryabl
     (`data/logs/27-task02-mobile-audit.out`, screenshots `mobile-27-*.png`; the first run is kept
     as `27-task02-first-run.out`). Phase 29's completion pass re-ran the same sweep now that
     `/gateway` is in it — **371 PASS / 0 FAIL / 0 FINDING**, 10 skips, nine served pages, exit 0
-    (`data/logs/29-final-mobile-audit.out`) — so the two declarations above still hold on a page
-    this audit was written before, and `data/logs/27-task03-control.cjs` proves the new check is
+    (`data/logs/29-final-mobile-audit.out`) — and phase 30 task 04 re-ran it once that page became two
+    trunk→leaf panels: **370 PASS / 0 FAIL / 0 FINDING**, 10 skips, exit 0, with only its `/gateway`
+    wait selector moved from the deleted `#t-inbound` tally to `#t-ports` (the clip counts inside the
+    new rows are `data/logs/30-task04-panels.out`, not this audit's business). Phase 30's completion
+    pass ran it again after the switches went in — **371 PASS / 0 FAIL / 0 FINDING**, 10 skips, nine
+    served pages, exit 0 (`data/logs/30-final-mobile-audit.out`) — so neither the two-panels rewrite,
+    nor the switch pill in every leaf row, nor the pipe classes reintroduced a clipped fact or a
+    sideways document anywhere on the app. So the two declarations
+    above still hold on a page this audit was written before, and `data/logs/27-task03-control.cjs` proves the new check is
     not vacuous by neutralising both declarations and re-creating the whole first-run findings list
     (3/4/2 header offenders at 360 px, 8 stranded disclosure tables at 1280 px). The served-byte
     pins are `test_a_card_header_wraps_its_facts_instead_of_losing_its_tail` and
@@ -2942,39 +3144,52 @@ memory plot; the `cpu.usage_pct@coreN` series is still stored and still queryabl
     seed one (`tests/test_deploy_scripts.py` keeps it that way). What remains of phase 24 is
     ordinary rotation hygiene, not a missing step.
 
-13. **`/gateway`'s long pipe labels are ellipsised at a desktop width — a column-width question,
-    not a lost fact** (found and half-fixed by phase 29 task 06's live pass,
-    `data/logs/29-task06-live.out`; the picture is `data/logs/29-task06-card-haproxy.png`).
+13. **`/gateway`'s long endpoint labels are ellipsised on a phone — a column-width question, not a
+    lost fact** (found by phase 29 task 06's live pass, **closed at the desktop width by phase 30
+    task 04's trunk→leaf row and re-measured on 2026-10-23 by task 06's pass**;
+    `data/logs/30-connection-map.out` is the current measurement, `data/logs/30-task04-panels.out`,
+    `data/logs/29-task06-live.out` and `data/logs/29-task06-card-haproxy.png` the history).
 
-    What the pass found first: at 1440px the outbound name showed **seven characters**
-    (`reeseapps-…`) for a 40-character `server_name → target` string. `.pipe-label` was one `nowrap`
-    flex row, so the name shrank to whatever the `by port` chip, the config's own `server` name and
-    the `flex: none` count left. Wrapping the *text* inside that box was measured and rejected — it
-    tore one hostname over eleven lines of a word each. What shipped instead is the label getting
-    the line to itself: `flex-wrap: wrap` on `.pipe-label` beside `flex: 1 1 max-content` on
-    `.pipe-name`, so a short label (`:22`) keeps its count on the same line as before and a long one
-    is by itself wider than the column, takes the whole column, and lets the chip, the footnote and
-    the count wrap beneath it. That is ~22 characters instead of 7, the config's own `server` name
-    now reads in full, and nothing was truncated that was not truncated before.
+    **Phase 30 task 04 closed the desktop half by changing the row, not the font.** The two
+    equal-width pipe columns of phase 29 became a group of `minmax(0, 9.5rem) minmax(0, 1fr)` — a
+    trunk that only ever says `:25566 · 4 live`, and a leaf list that gets everything else — so on the
+    live ingress at 1440 px the target column measures **361 px** (391 px when task 04 measured it,
+    before task 05's switch pill took 30 px out of the row) and **0 of 33** endpoint labels and
+    **0 of 33** selector lines are ellipsised. What used to be the whole gap is now one line in a
+    `FINDING` the script prints rather than an assertion, because it is arithmetic about a viewport
+    and not a bug: the longest target here is 42 characters
+    (`reeseapps-brain-of-code.reeselink.com:443`) and it fits.
 
-    **What is left** is arithmetic, not a bug: **28 of 42** labels still show an ellipsis because
-    `.pipe-columns` is `minmax(0, 1fr) auto minmax(0, 1fr)` inside one of three cards across a
-    1440px viewport, which is a ~150px column, and `reeseapps-brain-of-code.reeselink.com:443` is 41
-    characters. No fact is lost — `renderPipeRow` puts the whole string on the element as `title` and
-    `pipeAria` carries the whole endpoint, which is what
-    `tests/test_api.py::test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins, and the
-    two declarations above are pinned beside it so the label cannot be squeezed back to seven
-    characters. In order of cost: (a) give the outbound column more of the card than the inbound one
-    (inbound labels are `:22`-shaped, so `minmax(0, .45fr) auto minmax(0, 1.55fr)` buys ~90px); (b)
-    two cards per row for the fan-out, which is the honest layout for a 17-row map but leaves the
-    third of the viewport empty; (c) accept it — the stream map's rows are read as a set, the
-    left-hand SNI name is the part that fits, and the count is the number the row is about. The
-    ≤640px arm already stacks the two columns into one, where the label gets the whole card and
-    **16 of 42** clip instead of 28 (a stream-map string here runs to 70 characters, so even a 312px
-    column is not enough for the longest few) — measured in the same pass, which prints both counts
-    and demands a `title` on every clipped one. Whoever picks this up re-runs `data/logs/29-task06-live.cjs`: its
-    FINDING lines are the two counts, and the run fails if a clipped label ever stops carrying its
-    full text.
+    The arm that remains is the **phone**, and it got narrower before it got better: task 05's
+    **switch** moved into the leaf row and a group stacks to one column at 360 px, so the same labels
+    now clip at **31 of 33** targets and **22 of 33** selectors in a **139 px** column (this phase's
+    re-run; 27 / 13 in a 177 px column when task 04 measured it, the difference being the switch
+    pill's 34 px and the tick's 26 px taken off the label). Nothing is lost —
+    `renderLeaf()` puts the endpoint *and* the config's own selector on the row as `title` and
+    `leafAria()` carries the whole endpoint on the line, which is what
+    `tests/test_api.py::test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins, alongside
+    the declarations that decide *how much* it clips (`min-width: 0` on `.gate-target`,
+    `minmax(0, 1fr)` on the leaf track, `max-content` on `.pipe-name`, `flex-wrap` on the trunk) so a
+    future edit cannot squeeze a label back to the seven characters phase 29 measured. In order of cost:
+    (a) at ≤640 px let the leaf row put the count on the target's second line instead of its own
+    column, which buys roughly two more characters per label and is a stylesheet-only change;
+    (b) accept it — the fan-out is read as a set, the part that fits is the selector, and the number
+    the row is about is the count. Whoever picks this up re-runs
+    `data/logs/30-connection-map.cjs` (task 06's pass, which supersedes
+    `data/logs/30-task04-panels.cjs`): its two `FINDING` lines are the counts at both widths, and the
+    run **fails** if any line ever stops carrying its full text — 33 of 33 rows carried a `title`
+    naming their whole endpoint at 1440 px and at 360 px as this phase closed, which is the assertion
+    the gap is actually about.
+
+    How it got here, kept because the two rejected fixes are the reason the current shape looks the
+    way it does: at 1440 px phase 29's outbound name showed **seven characters** (`reeseapps-…`) for a
+    40-character `server_name → target` string, because `.pipe-label` was one `nowrap` flex row and the
+    name shrank to whatever the `by port` chip (retired since), the config's own `server` name and the
+    `flex: none` count left. Wrapping the *text* inside that box was measured and rejected — it tore
+    one hostname over eleven lines of a word each — so task 06 gave the label the line to itself
+    (`flex-wrap: wrap` plus `flex: 1 1 max-content`), which reached ~22 characters. Task 04 kept both
+    declarations and removed the reason they were needed: with the trunk in its own track, the leaf's
+    name is the widest thing in a column that is now wide enough for it.
 
 ## Locked decisions (and why)
 
diff --git a/README.md b/README.md
index c3866bc..bcbd8a9 100644
--- a/README.md
+++ b/README.md
@@ -10,7 +10,7 @@ file:
 | `/disks`     | Are any of my **physical** disks failing, and which one — health, temperature, power-on hours, wear, sector alarms | the same agents, running `smartctl -i -A -H` per whole drive (never a partition or a mount); a host whose agent has no `smartctl` is not a host on this page |
 | `/llm`       | Tokens/sec, active sessions, queue depth, KV-cache pressure, latency percentiles | llama.cpp-family (gufo) `/metrics` + `/slots`, vLLM `/metrics` — read-only |
 | `/ups`       | Battery health, runtime left, power events, and battery-test buttons             | NUT `upsd`, on whatever port it really listens on (its own wire-protocol client) |
-| `/gateway`   | Which domains are coming in on which port, and where the traffic goes — the ingress's listeners, `server_name`s and SNI map joined to its live connections | the agent on **one** host, `GATEWAY_HOST` (default `gateway`), reading its `haproxy.cfg` + nginx tree and `/proc/net/tcp{,6}` — so it needs **agent 1.2.0**, and the whole page is *unconfigured* (never red) unless `GATEWAY_HOST` names a `HOST_TARGETS` entry |
+| `/gateway`   | Which domains are coming in on which port, and where each one goes — **two connection tables, one per proxy config file** (`nginx`, then `haproxy`): a trunk per bound port with its configured endpoints branching off it, each line labelled with the config's own word for the route (`server_name`, `server`, `map` key) and its live connection count | the agent on **one** host, `GATEWAY_HOST` (default `gateway`), reading its `haproxy.cfg` + nginx tree and `/proc/net/tcp{,6}` — so it needs **agent 1.2.0**, and the whole page is *unconfigured* (never red) unless `GATEWAY_HOST` names a `HOST_TARGETS` entry |
 
 No Prometheus, no Grafana, no CDN, no build step. Nothing is fetched from the internet at
 runtime; every asset is served by this app.
@@ -207,8 +207,10 @@ not know its domain or its backend, so the **gateway page** is what joins these
 in `sources/gateway.py`, never in the agent: `/snapshot` keeps the three sections as the agent read
 them, `/api/gateway/snapshot` serves the joined topology, and only the counts that join produces are
 stored — as the `gateway.in_conns@<port>` / `gateway.out_conns@<host>:<port>` gauges the page
-charts. Nothing in `/api/system/snapshot` grows a proxy or socket field, and no `sample` row is
-written for a config.
+charts (since phase 30 task 02 the outbound gauge exists **only** for an endpoint the config wrote as
+an address: the name-keyed ones were a chart of the port-only guess the join no longer makes, so they
+would be permanently empty). Nothing in `/api/system/snapshot` grows a proxy or socket field, and no
+`sample` row is written for a config.
 
 All three parsers are pinned to captures rather than to descriptions, and
 `./scripts/capture-gateway-config.sh` re-records them over the `GATEWAY_SSH` alias (default
@@ -806,9 +808,9 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
   **no row on purpose**: a non-zero counter is an alarm chip on presence, zero is the absence
   of a chip and never a green "healthy drive", and an odometer has no bad value.
 * `alerts.py` — "what is wrong right now", as data. `alerts.build(settings, job_states,
-  host_payloads, engine_payloads, ups_payload, recent_events)` is a pure projection of the
-  state the poller already keeps plus the verdicts `severity.py` and the UPS health checks
-  already reached — no I/O, no thresholds of its own — and `/api/summary` returns it as
+  host_payloads, engine_payloads, ups_payload, recent_events, *, gateway_payload=None)` is a pure
+  projection of the state the poller already keeps plus the verdicts `severity.py` and the UPS health
+  checks already reached — no I/O, no thresholds of its own — and `/api/summary` returns it as
   `alerts`, worst first: `{id, severity, source, message, href, at}`. A configured source
   that stopped answering is `fail`; one that is stale but still serving its last good value
   is `warn`; an **unconfigured** source never alerts; a dead source is one line rather than
@@ -819,6 +821,13 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
   answers* keeps its own voice and links to the page that explains it (`/disks` for a wedged SMART
   pass, `/gateway` for a proxy or socket section that went quiet). Staleness is measured in each
   source's own interval, so the gateway page goes amber after 90 quiet seconds and not after 30.
+  The keyword-only `gateway_payload` (phase 30 task 03) is the one non-reachability voice this
+  module has for that source: a non-empty `warnings` list — the two config files not connecting to
+  themselves — is **one** `warn` row (`N proxy config problem(s) to address — <first message>`,
+  `href` `/gateway`), because a dangling backend is a structural fact and not a graded number, and
+  it is emitted only while the job is configured, `ok` and not stale, so a router that has stopped
+  answering keeps its single reachability line instead of growing a second one about a reading the
+  operator cannot refresh. No count of connections can produce a row here at all.
 * `api.py` — the JSON every page reads: `/api/config`, `/api/health`, `/api/events`,
   `/api/history`, `/api/metrics`, `/api/summary`, one `snapshot` + `history` pair per
   dashboard (`/api/system/*`, `/api/disks/*`, `/api/gateway/*`, `/api/llm/*`, `/api/ups/*` —
@@ -860,25 +869,50 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
   was, and the key paths of both are pinned with and without targets configured. Since phase 22
   that block lists the **same hosts** `/api/disks/snapshot` does, and `fleet.hosts_total` is
   that row count, so `/` and `/disks` can never describe two different fleets. `/api/summary` grew a
-  `gateway` block the same way in phase 29 (`configured`, `host`, `supported`, `unreachable`,
-  `inbound`, `outbound`, `map_targets`, `unmatched`, `unmatched_listeners`, `partial`, `states`):
-  the ingress's own tallies, `null` and never `0` in every arm that did not measure, `partial: true`
-  when a total had to leave an unattributable pipe out, and no `severity` anywhere — a connection
-  count is not a graded number. `/api/config` carries the matching row, including
+  `gateway` block the same way in phase 29, reshaped by phase 30 task 02 (`configured`, `host`,
+  `href`, `supported`, `unreachable`, `listeners`, `connections`, `live_in`, `live_out`,
+  `map_targets`, `states`) and given `warnings` by task 03: what the configs declare (`listeners`,
+  `connections`, `map_targets`, `warnings`) beside what the sockets are doing (`live_in`, `live_out`
+  — the latter summed over **distinct endpoints**, since several routes reaching one address is one
+  count and not two). `null` and never `0` in every arm that did not measure — **except**
+  `warnings`, which is a config fact and so reads a real `0` when the two files connect to
+  themselves. No `severity` anywhere: a connection count is not a graded number, and a structural
+  fault needs no threshold because the hardware of a config file either names a thing that exists or
+  it does not. The `unmatched` / `unmatched_listeners` / `partial` fields went out with the
+  guessing rule they existed to explain. `/api/config` carries the matching row, including
   `gateway.interval_seconds`/`timeout_seconds` and the named target's redacted `url`.
   `/api/gateway/*` (phase 29 task 03) is that page's pair. `/snapshot` is one host's whole
   topology — the haproxy frontends and the nginx `listen`/`map` echo the pipes were built from,
-  the inbound pipes (port, its domains, its live connection count, up to 32 client addresses), the
-  outbound pipes (target `host:port`, `by_port` naming which half of the match is a socket fact,
-  the count, the config that named it) each carrying the `metric` it is stored under, the
-  `unmatched` tallies, and `supported`/`sections`/`why` for the degradation arms — and the counts
-  reconcile: inbound + outbound + unmatched == `sockets.established`, so the page's numbers are
-  provable against a direct `/proc/net/tcp` read. `GATEWAY_HOST` naming no `HOST_TARGETS` entry is
+  the `listeners` (port, its domains, its live connection count, up to 32 client addresses), the
+  `connections` graph (phase 30: one row per route the two config files declare, each naming its
+  inbound port, its outbound endpoint, and the config's own selector for it — a haproxy backend
+  name, an nginx `server_name`, a stream `map` key) with its **live count** — the socket table's
+  ESTABLISHED rows, inbound by the socket's local port and outbound only where a remote
+  `(address, port)` equals a target the config wrote as an address. Each row carries the `metric` it
+  is stored under, and `shared: true` when more than one route reaches its endpoint (one count, shown
+  twice, never split). `supported`/`sections`/`why` cover the degradation arms. `warnings` (phase 30
+  task 03) is the list of the two config files **not connecting to themselves** — seven kinds, each
+  one row of `{id, kind, subject, message}` where `id` is `"<kind>:<subject>"` and the message is the
+  sentence the page prints: `haproxy_route_dangling`, `haproxy_backend_orphan`,
+  `haproxy_backend_empty`, `nginx_server_unlistened`, `nginx_pool_undeclared`,
+  `nginx_variable_unmapped`, `nginx_map_route_missing`. Nothing is inferred to fill a gap, so three
+  shapes are deliberately **silent**: a vhost that listens and passes nothing (a `return 301` looks
+  identical here), a frontend that routes by a fetch expression (agent 1.2.0 reports "no name", which
+  is the same value "no routing directive" has), and an entry of a `map` no `proxy_pass` names (the
+  `$connection_upgrade` map's `upgrade`/`close` are header words, not missing routes). An unreadable
+  or absent section warns about nothing — a host that cannot be read has not been found guilty of
+  anything — and a `warnings: []` is therefore the truth, not a shrug. Non-zero, `/` gets **one**
+  amber row (`N proxy config problems to address — <first message>`) and this page gets the list. **Nothing reconciles
+  to `sockets.established` and that is the design**: a connection to a target the config wrote as a
+  name (most of this fleet's fan-out) or on a port no config names is ignored — not counted, not
+totalled, not warned about — so a pipe count means "this route has N live connections" and nothing
+more. `GATEWAY_HOST` naming no `HOST_TARGETS` entry is
   a `404 {"configured": false}` answered before any client is built (both arms spy-pinned), a host
   that has never answered is the `unreachable` stub whose every count is `null`, and a 1.1.0 agent
   is `supported: false` plus its one `why` sentence — three arms, no red among them (invariant 3).
   `/history` serves the `gateway.in_conns@<port>` and `gateway.out_conns@<host>:<port>` gauges —
-  the port in the outbound name because two services on one host are two facts — with `hosts=`
+  the port in the outbound name because two services on one host are two facts, and only ever for an
+  address endpoint — with `hosts=`
   defaulting to the ingress alone, unknown names answering as empty series, and no dial either way
   because history reads only SQLite.
 * `web/` — six static dashboard pages (`/`, `/system`, `/disks`, `/llm`, `/ups`, `/gateway`) plus
@@ -927,9 +961,13 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
   list reads as an explicit "all clear", and a live problem moves the panel above the
   table. A host that is not answering keeps its row — dimmed, every number `n/a` — so the
   fleet never quietly gets smaller and last good values are never mistaken for live ones.
-  Under that table is the ingress's **one line** (`gateway · 14 inbound · 4 outbound`, linked to
-  `/gateway`): the counts are `/api/summary`'s own sums, a count the source did not measure prints
-  `n/a` rather than `0`, and a deployment with no `GATEWAY_HOST` renders no line at all.
+  Under that table is the ingress's **one line** (`gateway · 10 listeners · 33 connections · 17 live
+  in · 2 live out` as the live router answered on 2026-10-23 — a reading, the same way a listener count
+  is, and only the field names behind it are a contract), linked to `/gateway`: every figure is `/api/summary`'s own, a count the source
+  did not measure prints `n/a` rather than `0`, and a deployment with no `GATEWAY_HOST` renders no
+  line at all. A non-zero `warnings` appends ` · N to address` and nothing else — `0` and `null` both
+  print nothing, so a clean ingress never grows a permanent sentence about the checks that did not
+  fire (phase 30 task 03).
   A big colour-coded number is `Dash.hero(el, {...})` on the
   `.hero` / `.hero-bar` styles, coloured by the `severity` in the payload via
   `Dash.severityFrom()` — the only colour vocabulary is `ok` / `warn` / `fail`, and a value
@@ -1036,26 +1074,38 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
   `No test initiated` or no variable at all — says the same "run a battery test" sentence as
   `unknown`. Only a word the map has never seen stays a warning, printed verbatim so it can
   be added.
-  `/gateway` answers the topology question `/system` cannot: which sockets on the ingress face
-  inbound, where each one's traffic goes, and how many connections are live on each. It is four
-  cards keyed on what the **config** said a pipe came from — `haproxy`, `nginx`, the `stream map`,
-  and `unmatched` — each hidden until a poll actually has pipes for it, so a router with no nginx
-  in it spends no panel saying so. An inbound row is a listen port with its `server_name`s and the
-  client addresses on it; an outbound row is the target **exactly as the config wrote it** (the SNI
-  name the stream map matched on in front of it when one key routes there), and a target the join
-  could only match on its socket **port** carries a `by port` chip, because that count belongs to
-  the port and not to that service. A pipe animates while it carries at least one live connection
-  and rests at zero, and **nothing on the page is coloured by a verdict** — a busy ingress is the
-  job, so `severity.py` rates no `gateway.*` metric and no number gets a green/amber/red tint. A
-  count the join did not decide prints `n/a` and never `0`, which is why the fan-out on a port many
-  domains share is `n/a` rather than one number repeated as if it were sixteen. The header's five
-  tallies print the reconciliation instead of asserting it: what the kernel's socket table reported
-  (`listeners`, `established`) beside what the pipes carry (`pipes in`, `pipes out`) and what no
-  config claims (`unmatched` — ports and connections kept as separate cells). Each card's trend is
+  `/gateway` answers the topology question `/system` cannot: which ports on the ingress are open,
+  what routes out of each, and how many connections are live on each. It is **two panels** — one per
+  config file, `nginx` then `haproxy` — each hidden until a poll actually has rows for it, so a router
+  with no nginx in it spends no panel saying so. Inside a panel the rows are **groups**: a *trunk* is
+  one port that file binds, and hanging off it are the *leaves* — the endpoints it names, the endpoint
+  **exactly as the config wrote it** with the config's own word for the route above it (a `server_name`,
+  a haproxy `server` name, a stream `map` key). That is the shape of the file, which is why the stream
+  `map` is not a third panel: its entries are the nginx panel's `:443` leaves, so every SNI domain
+  reads beside the port it reaches. A trunk that names no target — this fleet's `:80` `return 301` —
+  prints "no target named in the config" instead of drawing nothing. Each line is joined to its
+  counterparts: nginx's ports **branch** — a dashed spine down the fan-out with a tick into every
+  endpoint — and haproxy's one-`server` frontends run **straight across**, because a port with one
+  route behind it is not a branch. A line is **green because the config declares the route**, an
+  existence colour of the page's own, and it **animates only while it carries at least one live
+  connection** — motion is the socket, colour is the config, and a resting route keeps the same green
+  as a busy one. **Nothing on the page is coloured by a verdict** — a busy ingress is the job, so
+  `severity.py` rates no `gateway.*` metric and no number gets a green/amber/red tint. A line to an endpoint the config wrote as a **name** prints `—`, never `0`:
+  counting it would need a DNS lookup and the join never asks one, and the row's tooltip says which of
+  the two facts it is looking at. The header's four tallies are `ports`, `connections`, `live` and
+  `warnings`, every one of them the payload's own figure. A `warnings` count above zero raises a panel
+  above the map with the config-integrity rows (`a backend no frontend routes to`, a `proxy_pass` with
+  no `upstream` behind it, an SNI entry that reaches no address) in the overview's alert vocabulary;
+  the live ingress here is clean, so that panel is off. Each panel's trend is
   behind a collapsed **Charts** toggle like `/system`'s, one `/api/gateway/history` request per
-  card per refresh. With no `GATEWAY_HOST` the page is the setup sentence rather than a red panel,
+  panel per refresh. With no `GATEWAY_HOST` the page is the setup sentence rather than a red panel,
   and an ingress running an agent older than **1.2.0** says so in the agent's own words with every
-  count `n/a` and nothing coloured.
+  count `n/a` and nothing coloured. Each line's head carries the sketched **switch** — a real
+  `role="switch"` button, green and to the position because the route is in the config, named in full
+  for a screen reader (`endpoint, reached by <selector>, in the nginx config, on`) — and it is
+  **unwired on purpose**: `aria-disabled` with a tooltip that says so, and this app writes to no
+  upstream, so a route is disabled by editing `haproxy.cfg` or an nginx `server` block and by nothing
+  in a browser.
   The four event feeds (`/system`, `/disks`, `/llm`, `/ups`) are a **paged window** over the `event`
   table rather than a printout of it: the list is a bounded box that scrolls, 50 events to a
   page, with `1–50 of 200` between `‹ prev` and `next ›` (disabled at the ends) underneath.
@@ -1237,14 +1287,18 @@ the page never reads it.
 from both ends. The input is the **captured** gateway — `gateway_haproxy.cfg`, the nginx main config
 plus its included documents, and the two `/proc/net/tcp{,6}` captures — run through the real
 `host_agent` parsers, so the test compares the join against the agent's own document rather than
-against a copy of its field names. The assertions are the join's: the pipes carry exactly the ports,
-`server_name`s and targets those documents name; `inbound + outbound + unmatched` equals the socket
-table's own ESTABLISHED count, so no connection is counted twice or dropped; a listening port no
-config claims stays visible as `unmatched.other`; several names sharing one port produce `null`
-counts and a `unmatched.groups` line rather than one number repeated on sixteen pipes; and **no join
-ever asks a resolver** — `socket.getaddrinfo` is spied on and fails the test, because deciding
-"already an address, or a name?" is the only question that module may ask, and a DNS lookup in the
-poll loop would be rule 2 with a round trip attached.
+against a copy of its field names. The assertions are the join's two rules and the limits around
+them: the graph carries exactly the ports, `server_name`s and targets those documents declare (all
+32 routes on this capture, as a **set**, so a missing or invented route fails by name); a socket is
+inbound by its local port and outbound only when its remote `(address, port)` equals a target the
+config wrote as an address; **every other socket is ignored** — `established`, `live_in` and
+`live_out` are all printed and deliberately never reconciled, because a connection to a name, or on
+a port nobody configured, is not a fact this page may claim; several routes reaching one endpoint
+carry one count repeated with `shared: true` rather than a split nobody measured (so the totals, in
+the source and on `/2`, sum **distinct endpoints**); a name target is never credited, and `0` never
+stands for "not counted"; and **no join ever asks a resolver** — `socket.getaddrinfo` is spied on and
+fails the test, because deciding "already an address, or a name?" is the only question that module
+may ask, and a DNS lookup in the poll loop would be rule 2 with a round trip attached.
 
 `tests/rate_window_contract.py` is the same device for one number rather than a field table: the Δ
 window each source measures its rates over — `RATE_WINDOW_SECONDS` for the host agents,
diff --git a/src/dashboards/alerts.py b/src/dashboards/alerts.py
index 2800678..068add1 100644
--- a/src/dashboards/alerts.py
+++ b/src/dashboards/alerts.py
@@ -28,12 +28,17 @@ The rules, and the reason each exists:
   threshold breaches would pile three more amber lines on top of the red one that already
   names it. Payload-derived alerts are skipped for a source that is not answering. A job that
   dials an agent another job already named (`AGENT_ECHO_DASHBOARDS`) adds no line either.
-* **No verdict of its own, ever.** Nothing here compares a number to a threshold: the host and
-  LLM rules read `severity` dicts and the UPS rule reads `health.checks[]`. That is why a source
-  whose payload carries no verdicts can only ever alert on reachability — the `gateway` page's
-  connection counts are such a source (`severity.py` rates none, the `net.*` precedent), and a
-  busy proxy is the job rather than a fault. There is no `gateway` payload rule and none is
-  wanted: adding one would put a threshold in this module, which the rule above forbids.
+* **No graded number of its own, ever.** Nothing here compares a number to a threshold: the host
+  and LLM rules read `severity` dicts and the UPS rule reads `health.checks[]`. A connection count
+  is therefore silent here whatever its value — `severity.py` rates none (the `net.*` precedent)
+  and 400 connections on an ingress is the job, not a fault.
+* **A `gateway` alert is reachability plus config integrity, and nothing else** (phase 30 task 03).
+  The one structural fact the gateway payload carries is its `warnings` list — routes its two
+  config files declare that do not connect to themselves — and that is a fact, not a graded number:
+  no threshold, no `severity.py` row, one `warn` row naming how many there are and quoting the
+  first. It is emitted **only while the job is answering**, so a source that is failing or stale
+  keeps its single reachability line (the rule above) and never grows a second one about the last
+  good payload.
 * **Bounded and deduped.** One alert per (source, metric) — the `id` is that pair — and at
   most :data:`MAX_ALERTS` of them, the last being a marker that says how many it hid. A
   40-disk fleet must not turn the landing page into a log tail.
@@ -433,6 +438,50 @@ def _ups_alerts(sink: _Sink, payload: Mapping[str, Any],
                      f"{label}: {detail}" if detail else label, HREF["ups"], at)
 
 
+def _gateway_alerts(sink: _Sink, settings: Settings, states: Sequence[Mapping[str, Any]],
+                    payload: Mapping[str, Any] | None) -> None:
+    """One `warn` row for a proxy config that does not connect to itself.
+
+    The row is deliberately *aggregate*: seven dangling routes are one thing to fix (the config),
+    and seven amber lines on `/` would push every other source off the panel to say it. The count
+    and the first message travel together so the operator sees the size of it and a sentence they
+    can act on, and `/gateway` — which the row links to — is where the whole list is drawn.
+
+    Three arms emit nothing, and each is a rule from elsewhere rather than a hedge:
+
+    * **no payload** — the source is unconfigured or has never answered (invariant 3: a thing
+      nobody installed has no config to be broken, and a thing that never replied has not been
+      read);
+    * **the job is failing or stale** — the reachability row `_source_alerts` already wrote is
+      this source's only line, and re-listing a stale payload's warnings beside it would be the
+      "dead source, one alert" rule breaking; an unknown state (no record at all) counts as
+      answering, the same rule `_answering` keeps;
+    * **no warnings** — a clean ingress is silence, not a green line.
+
+    Nothing here reads a threshold: `warnings` is a list of structural facts the config text
+    yielded, and `severity.py` has no `gateway.*` row to consult even if this module wanted to.
+    """
+    if payload is None:
+        return
+    state = next((row for row in states if row.get("dashboard") == "gateway"), None)
+    if state is not None:
+        if not bool(state.get("configured")) or not bool(state.get("ok")):
+            return  # unconfigured (invariant 3) or failing: its own row, or none, says it already
+        age = state.get("age_seconds")
+        interval = _interval(settings, "gateway")
+        if isinstance(age, (int, float)) and age > interval * STALE_FACTOR:
+            return  # stale: the amber "last answered Ns ago" row is this source's only line
+    rows = [row for row in (payload.get("warnings") or []) if isinstance(row, Mapping)]
+    if not rows:
+        return
+    first = rows[0].get("message") or "see /gateway for the list"
+    noun = "problem" if len(rows) == 1 else "problems"
+    at = payload.get("ts") if isinstance(payload.get("ts"), (int, float)) else None
+    sink.add(WARN, "gateway", "config",
+             f"{len(rows)} proxy config {noun} to address — {first}",
+             HREF["gateway"], at)
+
+
 def _config_alerts(sink: _Sink, settings: Settings) -> None:
     for problem in settings.host_target_problems:
         # a typo'd entry is not a dead host: the operator needs to know it is not being
@@ -449,6 +498,7 @@ def build(settings: Settings, hub_states: Sequence[Mapping[str, Any]] = (),
           engine_payloads: Sequence[Mapping[str, Any]] = (),
           ups_payload: Mapping[str, Any] | None = None,
           recent_events: Sequence[Mapping[str, Any]] = (), *,
+          gateway_payload: Mapping[str, Any] | None = None,
           now: float | None = None) -> list[dict[str, Any]]:
     """Everything that is wrong right now, worst first.
 
@@ -460,7 +510,10 @@ def build(settings: Settings, hub_states: Sequence[Mapping[str, Any]] = (),
 
     Inputs are the same objects `/api/summary` already assembles (job states, last good
     payloads, the UPS payload, the short event list), so answering costs nothing extra and
-    the answer cannot disagree with the panels underneath it.
+    the answer cannot disagree with the panels underneath it. `gateway_payload` is keyword-only
+    and defaulted for that reason: every caller written before phase 30 keeps working, and the
+    gateway's contribution is the one non-reachability rule this module has for a source whose
+    numbers it must never grade (see the rule list above).
     """
     sink = _Sink(time.time() if now is None else now)
     _source_alerts(sink, settings, hub_states, recent_events)
@@ -470,5 +523,6 @@ def build(settings: Settings, hub_states: Sequence[Mapping[str, Any]] = (),
         _engine_alerts(sink, engine, hub_states)
     if ups_payload is not None:
         _ups_alerts(sink, ups_payload, hub_states)
+    _gateway_alerts(sink, settings, hub_states, gateway_payload)
     _config_alerts(sink, settings)
     return sink.result()
diff --git a/src/dashboards/api.py b/src/dashboards/api.py
index ca93228..fe11d74 100644
--- a/src/dashboards/api.py
+++ b/src/dashboards/api.py
@@ -17,7 +17,7 @@ import logging
 import math
 import re
 import time
-from collections.abc import Mapping, Sequence
+from collections.abc import Iterable, Mapping, Sequence
 from dataclasses import dataclass, field, replace
 from typing import Any
 from urllib.parse import urlsplit
@@ -210,43 +210,81 @@ def _gateway_url(settings: Settings) -> str | None:
                  if target.name == settings.gateway_host), None)
 
 
-def _pipe_totals(pipes: Any, counting: bool) -> tuple[int | None, bool]:
-    """Σ of a pipe list's connection counts, and whether any pipe's count was unknown.
+def _mappings(value: Any) -> list[Mapping[str, Any]]:
+    """The mappings inside a payload list, ignoring anything that is not one.
 
-    `counting` is the payload's own answer to "did the kernel's socket table reply". When it did
-    not, every count is `null` and so is the total, with nothing left to call partial: a `0` there
-    would print an idle gateway over a source that never measured one (`AGENTS.md` rule 2). When it
-    did, the sum covers the pipes that carry a number and `partial` says at least one other did not
-    (a port whose configured targets cannot be told apart, `sources/gateway.py`) — so a total is
-    never quietly a subtotal, and `partial` only ever qualifies a total that exists.
+    `/api/summary` reads a payload this module does not own, and a drift inside one row must not
+    turn the overview's one line into a 500: a non-mapping contributes nothing to a count.
+    """
+    if not isinstance(value, Sequence) or isinstance(value, str | bytes):
+        return []
+    return [row for row in value if isinstance(row, Mapping)]
+
+
+def _live_total(values: Iterable[Any]) -> int | None:
+    """Σ of the numbers in `values`, or `None` when there is not one among them.
+
+    `None` is a sentence and not a number: a group with nothing in it, or one in which every count
+    is `null` (a socket table that never replied, or outbound targets the config wrote entirely as
+    **names**, which the join can never count), has measured nothing — and a `0` there would print
+    an idle gateway over a source that never made a measurement (`AGENTS.md` rule 2). A `null` in
+    a group that does carry numbers contributes nothing rather than a fake zero.
     """
-    rows = [pipe for pipe in (pipes or []) if isinstance(pipe, Mapping)]
-    if not counting:
-        return None, False
-    values = [pipe.get("connections") for pipe in rows]
     known = [value for value in values
              if isinstance(value, int) and not isinstance(value, bool)]
-    return sum(known), len(known) != len(values)
+    return sum(known) if known else None
+
+
+def _endpoint_values(connections: Any) -> list[Any]:
+    """One connection count per **distinct** outbound endpoint, in first-seen order.
+
+    Several lines can reach one address (`:443 → 10.1.1.9:443` and `:8443 → 10.1.1.9:443`), and
+    `sources/gateway.py` repeats that endpoint's whole count on each of them with `shared: true`
+    rather than splitting a number nobody measured. Summing the **lines** would book the same
+    sockets twice and print a router busier than it is, so the total is taken over the endpoints
+    the lines name — the same reason the outbound gauges are keyed by `(address, port)`.
+    """
+    values: dict[tuple[Any, Any], Any] = {}
+    for row in connections if isinstance(connections, Sequence) else ():
+        if not isinstance(row, Mapping):
+            continue
+        out = row.get("out")
+        if not isinstance(out, Mapping):
+            continue
+        values.setdefault((out.get("host"), out.get("port")), row.get("connections"))
+    return list(values.values())
 
 
 def _gateway_summary(payload: Mapping[str, Any] | None, settings: Settings) -> dict[str, Any]:
     """`/api/summary`'s gateway block: the ingress's totals, or a stub of unknowns.
 
-    Additive in phase 29. The page charts from `/api/gateway/snapshot`, which has one entry per
-    pipe; this block is the **tally** a programmatic consumer (and the overview's one line, task
-    05) reads without walking the pipes. Three arms, and they are three different sentences:
+    Additive in phase 29, reshaped by phase 30 task 02 into eleven fields, with `warnings` joined
+    by task 03 as the twelfth. The page charts
+    from `/api/gateway/snapshot`, which has the rows themselves; this block is the **tally** a
+    programmatic consumer (and the overview's one line) reads without walking them. Three arms, and
+    they are three different sentences:
 
     * **unconfigured** (`GATEWAY_HOST` is not a `HOST_TARGETS` name) — `configured: false`, every
       count `null`, `states: []`. There is no job, so there is nothing to age (invariant 3).
     * **configured, never answered** — the stub `system.hosts` and `/api/disks` use: the source is
       in the deployment, it has no numbers yet, and `unreachable: true` says which of the two facts
       it is. `host` still names the machine, because that is a config fact and not a measurement.
-    * **answering** — the payload's own tallies, summed without inventing anything: `inbound` /
-      `outbound` are the sums of the pipes that have a count, `partial` says one pipe did not, and
-      `map_targets` counts the stream `map`'s routing entries.
+    * **answering** — the payload's own figures, summed without inventing anything.
+      `listeners` / `connections` are **row counts** (what the two config files declare, a fact
+      that does not need a socket), and `live_in` / `live_out` are the connection counts that were
+      actually measured — `null` when nothing was, never `0`. `map_targets` stays the stream map's
+      routing-entry count, and `warnings` is the **count** of config-integrity problems
+      `sources/gateway.warnings()` found — a config fact like the row counts, so `0` there is the
+      truth ("this ingress's configs connect to themselves") and not a missing measurement. The
+      list itself is on `/api/gateway/snapshot`; this block is the tally, and `alerts.py` is what
+      turns a non-empty one into the overview row.
+
+    `unmatched`, `unmatched_listeners` and `partial` left this block with the socket join they
+    described: a connection outside the two config files is no longer reported at all, so there is
+    no residual to total and no total to call partial.
 
     Nothing here carries a `severity`: a connection count is not a graded number (`severity.py`
-    rates none, the `net.*` precedent), and an `unmatched` socket is a report and not a fault.
+    rates none, the `net.*` precedent).
 
     `href` is the row's link, from `alerts.py`'s one table of dashboard routes, so the overview's
     line and an alert about the same source cannot spell the page differently (the rule
@@ -260,15 +298,15 @@ def _gateway_summary(payload: Mapping[str, Any] | None, settings: Settings) -> d
         "href": alert_rules.HREF[GATEWAY_DASHBOARD],
         "supported": None,
         "unreachable": True,
-        "inbound": None,
-        "outbound": None,
+        # row counts (config facts) and live sums (socket facts), kept apart because a gateway can
+        # have thirty declared routes and no measurement of any of them
+        "listeners": None,
+        "connections": None,
+        "live_in": None,
+        "live_out": None,
         "map_targets": None,
-        "unmatched": None,
-        # `unmatched` is connections no configured pipe claimed; `unmatched_listeners` is a
-        # *listener* count (a port this host serves that neither config names). Two units, so two
-        # fields: adding them into one number would be an aggregate of unlike things.
-        "unmatched_listeners": None,
-        "partial": False,
+        # the config-integrity tally; `null` until the agent answers, exactly like the row counts
+        "warnings": None,
     }
     if payload is None:
         return block
@@ -279,18 +317,21 @@ def _gateway_summary(payload: Mapping[str, Any] | None, settings: Settings) -> d
         # A 1.1.0 agent or `--no-proxy`: nothing was read, so "0 map targets" would be a claim
         # about a config nobody looked at. `supported: false` plus nulls is the honest pair.
         return block
-    sockets = payload.get("sockets") or {}
-    counting = (isinstance(sockets.get("established"), int)
-                and not isinstance(sockets.get("established"), bool))
-    block["map_targets"] = len((payload.get("nginx") or {}).get("map_targets") or [])
-    inbound, partial_in = _pipe_totals(payload.get("inbound"), counting)
-    outbound, partial_out = _pipe_totals(payload.get("outbound"), counting)
-    block["inbound"], block["outbound"] = inbound, outbound
-    block["partial"] = partial_in or partial_out
-    unmatched = payload.get("unmatched") or {}
-    block["unmatched"] = (int(unmatched.get("inbound") or 0) + int(unmatched.get("outbound") or 0)
-                          if counting else None)
-    block["unmatched_listeners"] = unmatched.get("other") if counting else None
+    listeners = _mappings(payload.get("listeners"))
+    connections = _mappings(payload.get("connections"))
+    block["map_targets"] = len(_mappings((payload.get("nginx") or {}).get("map_targets")))
+    # A count, not the list: `/` needs to know whether there is anything to address and the page
+    # that lists them reads `/api/gateway/snapshot`. A payload whose `warnings` is missing or
+    # malformed counts as zero rather than raising — this module does not own the projection, and a
+    # drift inside one row must not 500 the overview (see `_mappings`).
+    block["warnings"] = len(_mappings(payload.get("warnings")))
+    # Row counts come from the config and are therefore known whenever the agent answered at all —
+    # `0` here is the truth ("this host declares no listener"), not a missing measurement, so it is
+    # the *live* pair below that carries the nulls.
+    block["listeners"] = len(listeners)
+    block["connections"] = len(connections)
+    block["live_in"] = _live_total(row.get("connections") for row in listeners)
+    block["live_out"] = _live_total(_endpoint_values(connections))
     return block
 
 
@@ -780,8 +821,13 @@ def common_router() -> APIRouter:
         recent_events = [event.as_json() for event in ctx.store.recent_events(12)]
         # "what is wrong right now" is a server-side answer (see alerts.py) so the overview,
         # a mobile view, and a notifier later all agree on the same verdicts
+        # `gateway_payload` is keyword-only and travels because a proxy config that does not
+        # connect to itself is the one non-reachability fact this source may alert on (phase 30
+        # task 03): `alerts.py` reads its `warnings` list and no count in it, so a busy ingress
+        # still says nothing and a dangling `use_backend` says one thing, once.
         summary_alerts = alert_rules.build(ctx.settings, ctx.hub.states(), hosts, engines,
-                                           ups_payload, recent_events)
+                                           ups_payload, recent_events,
+                                           gateway_payload=gateway_payload)
         return {
             "ts": time.time(),
             "system": {"enabled": bool(ctx.settings.host_targets),
@@ -1038,20 +1084,30 @@ def gateway_router() -> APIRouter:
 
     @router.get("/snapshot")
     async def snapshot(ctx: AppContext = Depends(get_context)) -> dict[str, Any]:
-        """The one ingress host's pipes: its configs, its live counts, and what nothing claimed.
+        """The one ingress host's connection map: its configs, and what is live on each route.
 
         The payload is `sources/gateway.parse`'s, verbatim and unread by this module: `haproxy`/
-        `nginx` are the config the agent read, `inbound` one entry per configured listen port (its
-        domains, its live connection count, up to `MAX_CLIENTS` client addresses), `outbound` one
-        entry per configured target (with `by_port` naming which half of the match is a socket
-        fact and which is the config's), `unmatched` the connections and listeners no config
-        names, and each pipe's own `metric` so a chart asks for the series it *is*. Three arms
+        `nginx` are the config the agent read, `listeners` one entry per configured listen port
+        (its domains, its live connection count, up to `MAX_CLIENTS` client addresses),
+        `connections` one entry per route the two configs declare (its inbound port, its outbound
+        endpoint, the config's own selector for it, and a live count **only** where the endpoint is
+        written as an address — a name keeps `null`, because this stack resolves nothing), each row
+        carrying its own `metric` so a chart asks for the series it *is*. There is no outbound pipe
+        list and no `unmatched` tally since phase 30 task 02: the graph carries the outbound side,
+        and a socket neither config file describes is ignored rather than reported. Three arms
         reach the page and they are three different sentences: `404 {"configured": false}` when
         `GATEWAY_HOST` names no target (answered below, before anything that could open a
         socket — invariant 3), `supported: false` for an agent that predates the sections, and
         `unreachable: true` for a host that has never answered — the stub, whose every count is
         `null` because an agent that has not spoken has not reported an idle gateway (rule 2).
 
+        `warnings` is the config-integrity list (`{"id", "kind", "subject", "message"}` per row):
+        routes the two files declare that do not connect to themselves — a `use_backend` naming no
+        `backend`, a `backend` nothing routes to, a `proxy_pass $var` with no `map`. It is a
+        structural fact read out of config text, never a graded number, and it is empty for a host
+        whose configs did not answer: an ingress that cannot be read has not been found guilty of
+        anything (invariant 3).
+
         Nothing here carries a `severity` and nothing carries a `window_seconds`: a connection
         count is neither a graded number nor a measurement over a window, so `/gateway` colours
         nothing and prints no `Δ` (the `net.*` precedent).
diff --git a/src/dashboards/sources/gateway.py b/src/dashboards/sources/gateway.py
index aacd228..a103605 100644
--- a/src/dashboards/sources/gateway.py
+++ b/src/dashboards/sources/gateway.py
@@ -4,9 +4,10 @@
 exists for: **what is coming in through it and where does it go out**. It reads the three
 phase-28 sections of one agent `/snapshot` — `haproxy` (frontends + binds, backends +
 servers), `nginx` (server blocks with `listen`/`server_name`/`proxy_pass`, `map` blocks) and
-`sockets` (`/proc/net/tcp{,6}`'s LISTEN + ESTABLISHED) — and joins them: the **inbound**
-pipes (one per configured listen port, with the domains that port serves and the live client
-addresses) and the **outbound** pipes (one per configured target, with its live count).
+`sockets` (`/proc/net/tcp{,6}`'s LISTEN + ESTABLISHED) — and joins them: the **listeners** (one
+per configured listen port, with the domains that port serves and the live client addresses) and
+the **connections** (one per route the two config files actually declare, below, each with its
+live count where the socket table can supply one).
 
 What this module owns, and what it deliberately does not:
 
@@ -23,53 +24,133 @@ What this module owns, and what it deliberately does not:
   (`tests/test_gateway_source.py` spies `socket.getaddrinfo` and pins that it is not called
   once). That single fact decides the whole outbound join, below.
 
-The join, and where its honesty lives
-------------------------------------
+The join: two arms, and the ignore rule
+---------------------------------------
 
-**Inbound** is unambiguous: a socket's **local port** is the port the config listens on, and
-its **remote address** is the client. A socket whose local port no configured frontend names
-is counted in `unmatched.inbound` — reported, never dropped, because "the gateway is carrying
-traffic on a port no config mentions" is exactly the fact the operator needs.
+Phase 30 task 02 reduced this module to the **two** attributions a kernel socket table can
+actually support, and deleted the rest. What survives, and what is deliberately not counted:
 
-**Outbound** cannot be unambiguous, and pretends otherwise nowhere. The config names targets
-as **domains** (`nextcloud.reeselink.com:11000`) while `/proc` reports **addresses**
-(`10.1.1.164:11000`), and resolving one to the other is the one thing this stack never does.
-So a socket is attributed to at most one pipe, in this order:
+**Inbound** is unambiguous: a socket's **local port** is the port a config listens on, and its
+remote address is the client. `listeners[port]` takes the count and up to `MAX_CLIENTS` distinct
+client addresses.
 
-1. an **exact** `(address, port)` match against a target written as an IP literal
-   (`by_port: false`) — a real, unambiguous join;
-2. a **port-only** match against a target written as a **name**, and only when that port
-   belongs to exactly **one** configured host — the socket fact is real, the host is the
-   config's, and the pipe carries `by_port: true` to say which half is which. A target written
-   as an address never reaches this arm: a miss on the exact match above is a different
-   endpoint, not this one;
-3. a port shared by **several** configured targets — the case the real `stream.conf` map is
-   (sixteen `*.reeselink.com:443` entries). Choosing one of them would be rule 2 with a
-   pipe's clothes on, so nothing is chosen: the socket lands in `unmatched.outbound` and the
-   group is reported once in `unmatched.groups` as `{port, connections, hosts, host_count}`,
-   which is the honest sentence — "N connections on port P, whose configured targets are
-   these M names, unresolved". Those pipes carry `connections: null`, not a share and not a
-   repeat of the port's total (a number drawn on sixteen pipes reads as sixteen times the
-   traffic).
+**Outbound** is sound in exactly one case: the socket's remote `(address, port)` **equals a
+target the config wrote as an address**. That is a fact `/proc` states directly, so the endpoint
+carries it.
 
-A target that names **no port** (`server x host`) is never joinable at all, so its count is
-`null` even when the socket table answered: `0` there would claim a measurement nobody took.
+**Everything else is ignored — not counted, not totalled, not warned about.** A config writes
+`reeseapps-brain.reeselink.com:443`; `/proc` reports `10.1.1.106:443`. Nothing in this stack
+resolves a name (the `socket.getaddrinfo` spy pins that), so a name target can never be matched
+to a socket, and a port several targets share — this fleet's `stream.conf` map, sixteen `:443`
+entries — credits none of them. The arm that used to bridge that gap credited the *port* and
+labelled it `by_port`, and swept every leftover into `unmatched.outbound` /
+`unmatched.groups` / `unmatched.other`. On the live router that residual was mostly this app
+talking to itself (`9120`, the agent's own port, and `2222`): a residual that is mostly other
+software is not a signal, and a card of it teaches the operator to ignore the panel. So
+`unmatched`, `by_port` and `partial` are gone, and a socket outside the two config files draws
+nothing at all.
 
-A pipe's count is therefore `null` — `n/a`, never `0` — whenever the socket table did not
-answer or the join could not decide, and `0` only when the sockets did answer and this pipe
-genuinely has none.
+The consequence for a target written as a **name** is its honest answer: `connections` stays
+`null` — `n/a`, never `0`. An address endpoint carries the number, `0` included when the sockets
+answered and it genuinely has none.
+
+**A shared endpoint repeats its count and never splits it.** Several connections can reach one
+address (`:443 → backend:443` and `:8443 → backend:443`); each carries the endpoint's whole
+count, and `shared: true` says another line carries the same number. Dividing it would be
+arithmetic nobody measured, and a total that summed the repetitions would read as twice the
+traffic — which is why `/api/summary`'s `live_out` sums each endpoint once.
+
+**A loopback hop is two `/proc` rows and is drawn as two pipes.** The socket table counts kernel
+rows, and a connection to a service on the router itself appears once with a configured *local*
+port (the side that was accepted) and once with a configured *remote* address (the side that was
+dialled). That is the same traffic seen from both sides, which is exactly what the two pipes are
+for — and it is why the loop `continue`s the moment a socket is counted: one row may never be
+drawn down two pipes.
+
+The connection graph
+--------------------
+
+A **listener** is a port a config names; a **connection** is the thing the page draws a line for:
+one outbound endpoint reached through one listener. `connections[]` is derived from config text
+alone — no socket, no clock, no resolver — and it is the answer to the question the pipe list never
+answered: *which* target belongs to *which* inbound port. Four derivations, one per way the two
+files express a route:
+
+1. **haproxy** — `frontend → routes → backend → server`. Every `server` of every backend a
+   frontend can reach (`default_backend` plus every `use_backend` name, `haproxy_frontends`) is
+   one connection whose `in.port` is that frontend's bind port and whose `out.selectors` name the
+   backend it was declared in (`haproxy_targets` keeps that name for exactly this join).
+2. **nginx http vhost** — every concrete `proxy_pass host:port` of a `server` block, one
+   connection **per `listen` port of that block**, `out.selectors` the block's own `server_name`s
+   verbatim (the catch-all `_` included).
+3. **nginx pool** — a `proxy_pass http://<name>` with **no** port names an `upstream` block: one
+   connection per that block's `server` host:port, selector the pool name. No `upstream` of that
+   name, no connection: the payload cannot name an endpoint, so it draws none.
+4. **nginx stream map** — a `proxy_pass $var`, joined to the `map` block whose `variable` matches,
+   one connection per entry with a target, selector the entry's own key (the SNI domain, or the
+   literal `default`, which is the config's word for "everything nobody mapped", not a guess).
+
+**Merge rule.** Identical `(source, in_port, host, port)` is **one** connection whose `selectors`
+are the union in first-seen order — one vhost's two names arriving at one pool is one line, not
+two. Never merge across `in_port`: `:4443 → keycloak:8080` and `:8443 → keycloak:8080` are two
+pipes on two socket spaces, which is the `minecraft` 25565/25566 lesson told from the other side.
+
+**Two refusals**, both rule 2, both silent (a warning needs a payload that can tell broken from
+merely unreadable, and neither of these can):
+
+* a `proxy_pass` with neither `target` nor `variable` (a unix socket, a bare word) yields nothing;
+* a haproxy frontend whose only routing is a fetch expression (`use_backend
+  %[req.hdr(host),map_dom(...)]`, which the agent reports as **no** name) yields its listener and
+  no connections — the page draws that trunk alone, because "no name" and "no routing directive"
+  are one value in this payload.
 
 The `$var` → `map` fan-out
 --------------------------
 
 A stream `proxy_pass $targetBackend` has no target in its own right (nginx picks one per
-connection from the map), so it contributes **no literal pipe**. The map whose `variable`
-matches is what carries the fan-out: its entries become `nginx.map_targets`
-(`{key: the SNI domain, host, port}`) *and* one outbound pipe per entry, so the page can draw
+connection from the map), so it contributes **no connection of its own**. The map whose
+`variable` matches is what carries the fan-out: its entries become `nginx.map_targets`
+(`{key: the SNI domain, host, port}`) *and* one connection per entry, so the page can draw
 sixteen domains leaving the gateway and label each with the domain that reaches it. A map no
 `proxy_pass` references (`$connection_upgrade`, whose values are the header words
 `upgrade`/`close`) contributes nothing: it is not a routing table.
 
+What this module warns about
+----------------------------
+
+With everything outside the two config files ignored, the only warning left worth an operator's
+attention is a config that **does not connect to itself**: a route naming a backend nobody
+declares, a backend nothing routes to, a `proxy_pass $var` with no `map` behind it. `warnings()`
+answers the seven such kinds, each derived from config text alone and each actionable:
+
+| kind | condition |
+|------|-----------|
+| `haproxy_route_dangling` | a frontend's `default_backend`/`use_backend` names no `backend` block |
+| `haproxy_backend_orphan` | a backend with `server` lines that no frontend routes to |
+| `haproxy_backend_empty` | a `backend` block with no `server` line at all |
+| `nginx_server_unlistened` | a `server` block with names and/or `proxy_pass` and no `listen` |
+| `nginx_pool_undeclared` | `proxy_pass http://<name>` with no port and no `upstream` of that name |
+| `nginx_variable_unmapped` | `proxy_pass $var` with no `map` block defining `$var` |
+| `nginx_map_route_missing` | an entry of a **referenced** `map` whose target is null |
+
+**Three things it refuses to warn about**, each because the payload cannot tell broken from merely
+unreadable (and a warning is a claim, not a hunch):
+
+* an nginx `server` with a `listen` and no `proxy_pass` — a static or redirect vhost is legal and
+  looks identical here;
+* a haproxy frontend whose only routing is a fetch expression (`use_backend
+  %[req.hdr(host),map_dom(...)]`, which agent 1.2.0 reports as **no** name) — "no name" and "no
+  routing directive" are one value on the wire, so blaming it blames a config this agent cannot
+  read; distinguishing them is an agent change, not a guess here;
+* a `proxy_pass` with neither `target` nor `variable` (a unix socket, a bare word) — legitimate,
+  undrawable, not broken.
+
+A section is judged **only** when its own `available` is `True`: `predates`, `no file` and
+`unreadable config` produce no warnings at all, because a host that cannot be read has not been
+found guilty of anything (invariant 3). And the sentence that bounds the whole list: a warning
+here is a config that does not connect to itself; nothing outside the two configs is reported at
+all.
+
 Series naming
 -------------
 
@@ -80,13 +161,20 @@ work: its two haproxy Minecraft backends are `minecraft.reeselink.com:25565` and
 sockets. One name for both is one `INSERT OR REPLACE` overwriting the other in silence —
 the aggregation failure rule 2 exists to catch. The port is also what makes the name stable
 when the same host later gains or loses a second service.
+
+Only a connection whose endpoint the join could count publishes a gauge, which since task 02
+means **the name-keyed `gateway.out_conns@<domain>:<port>` series stop being written**: the
+number they carried was the port's, not the target's, and storing an unattributable figure
+under a target's name is rule 2 with a series name on it. The rows already stored age out
+under the unchanged retention policy, so nothing here needs a schema or prune change
+(invariant 9).
 """
 
 from __future__ import annotations
 
 import ipaddress
 import time
-from collections.abc import Mapping, Sequence
+from collections.abc import Mapping, MutableMapping, Sequence
 from typing import Any
 
 from ..poller import Result
@@ -113,9 +201,24 @@ SECTION_ERROR_PREFIXES = ("haproxy", "nginx", "sockets")
 #: turn the payload into a client dump.
 MAX_CLIENTS = 32
 
-#: Same bound for one ambiguous port group's candidate host list (the `stream.conf` map's 16
-#: entries fit; `host_count` is the real total either way).
-MAX_GROUP_HOSTS = 20
+#: The four ways a config can express "this inbound port reaches that endpoint", in the two
+#: files' own vocabulary. A page labels a line with its kind, so the words are the config's
+#: (`backend` is a haproxy `use_backend`, `pool` an nginx `upstream`), not four invented ones.
+KIND_BACKEND = "backend"
+KIND_SERVER_NAME = "server_name"
+KIND_POOL = "pool"
+KIND_MAP = "map"
+
+#: The seven config-integrity kinds `warnings()` answers. The words are stable DOM keys on
+#: `/gateway` (`id = f"{kind}:{subject}"`) and the input to a later write path, so a rename is a
+#: payload change, not a copy edit.
+WARN_ROUTE_DANGLING = "haproxy_route_dangling"
+WARN_BACKEND_ORPHAN = "haproxy_backend_orphan"
+WARN_BACKEND_EMPTY = "haproxy_backend_empty"
+WARN_SERVER_UNLISTENED = "nginx_server_unlistened"
+WARN_POOL_UNDECLARED = "nginx_pool_undeclared"
+WARN_VARIABLE_UNMAPPED = "nginx_variable_unmapped"
+WARN_MAP_ROUTE_MISSING = "nginx_map_route_missing"
 
 #: The sentence the unsupported arm prints. Two operator facts in one line — the agent is too
 #: old, or it was told not to look — because both are fixed by reinstalling the agent, one
@@ -301,48 +404,50 @@ def haproxy_frontends(section: Mapping[str, Any] | None) -> list[dict[str, Any]]
 
 
 def haproxy_targets(section: Mapping[str, Any] | None) -> list[dict[str, Any]]:
-    """Every `server` line's `{name, host, port}` — the outbound half of a haproxy config."""
+    """Every `server` line's `{name, host, port, backend}` — the outbound half of a haproxy config.
+
+    `backend` is the name of the `backend` block the `server` was declared in, and it is the only
+    reason the join in `config_connections()` is possible at all: the frontend side speaks backend
+    names (`default_backend` / `use_backend`) and the endpoint side speaks hosts, so without the
+    declaring block's name a `server` line is an endpoint nobody routes to.
+    """
     rows: list[dict[str, Any]] = []
     for backend in _mappings((section or {}).get("backends")):
+        declared_in = _text(backend.get("name"))
         for server in _mappings(backend.get("servers")):
             host = _text(server.get("target"))
             if not host:
                 continue
             rows.append({"name": _text(server.get("name")), "host": host,
-                         "port": _port(server.get("port"))})
+                         "port": _port(server.get("port")), "backend": declared_in})
     return rows
 
 
-def nginx_listen_ports(section: Mapping[str, Any] | None) -> list[tuple[int, list[str]]]:
-    """`(port, server_names)` per nginx `listen`, in config order.
+def nginx_server_blocks(section: Mapping[str, Any] | None) -> list[dict[str, Any]]:
+    """One row per nginx `server` **block**: `{ports, names, proxies}`, in config order.
 
-    `server_names` is kept **verbatim**, the catch-all `_` included — it is what the config
-    says, and a page that wants to call it "any name" can say so without this module editing
-    the file's own text.
-    """
-    rows: list[tuple[int, list[str]]] = []
-    for server in _mappings((section or {}).get("servers")):
-        names = _names(server.get("server_names"))
-        for listen in _mappings(server.get("listen")):
-            port = _port(listen.get("port"))
-            if port is not None:
-                rows.append((port, names))
-    return rows
+    The block, not the port, is the unit here, and keeping the three facts together is the whole
+    point: "which `listen` ports serve this `proxy_pass`, and under which `server_name`s" is a
+    question about one block, and it is exactly what the connection graph needs to draw a line
+    from an inbound port to an outbound endpoint. A per-port reader (`nginx_listen_ports`, which
+    this replaces) merges the names of every block that binds `4443` and cannot say which of them
+    wrote which `proxy_pass`.
 
-
-def nginx_targets(section: Mapping[str, Any] | None) -> list[dict[str, Any]]:
-    """Every `proxy_pass` that names an address: `{name: null, host, port}`.
-
-    A `proxy_pass $var` has `target: null` by the agent's design and contributes no row here;
-    `nginx_map_targets()` is where its fan-out lives.
+    `ports` is deduplicated within the block — `listen 4443 ssl;` and `listen [::]:4443 ssl;` are
+    one port written twice, and two connections for them would draw one pipe twice — `names` is
+    kept **verbatim**, the catch-all `_` included (what the config says, not what this module
+    would call it), and `proxies` is the agent's own `proxy_pass` entries, untouched, so the
+    three arms (`target`, `variable`, neither) stay distinguishable downstream.
     """
     rows: list[dict[str, Any]] = []
     for server in _mappings((section or {}).get("servers")):
-        for proxy in _mappings(server.get("proxy_passes")):
-            target = _target_of(proxy.get("target"))
-            if target is None:
-                continue
-            rows.append({"name": None, "host": target[0], "port": target[1]})
+        ports: list[int] = []
+        for listen in _mappings(server.get("listen")):
+            port = _port(listen.get("port"))
+            if port is not None and port not in ports:
+                ports.append(port)
+        rows.append({"ports": ports, "names": _names(server.get("server_names")),
+                     "proxies": _mappings(server.get("proxy_passes"))})
     return rows
 
 
@@ -398,6 +503,345 @@ def _target_of(node: Any) -> tuple[str, int | None] | None:
     return host, _port(node.get("port"))
 
 
+def _maps_by_variable(section: Mapping[str, Any] | None) -> dict[str, list[Mapping[str, Any]]]:
+    """Every `map` block's entries, keyed by its variable without the `$`.
+
+    `nginx_map_targets()` answers "which entries route"; the graph needs "which entries does
+    *this* `proxy_pass $var` fan out to", which is the same lookup per block rather than one
+    filter over the file — a gateway with two stream `server` blocks routing off two variables
+    would otherwise draw both fan-outs on both trunks.
+    """
+    found: dict[str, list[Mapping[str, Any]]] = {}
+    for block in _mappings((section or {}).get("maps")):
+        variable = _text(block.get("variable"))
+        if not variable:
+            continue
+        found.setdefault(variable.lstrip("$"), []).extend(_mappings(block.get("entries")))
+    return found
+
+
+def _pools(section: Mapping[str, Any] | None) -> dict[str, list[Mapping[str, Any]]]:
+    """The `upstream` blocks by name, each mapped to its `server` rows, in config order."""
+    found: dict[str, list[Mapping[str, Any]]] = {}
+    for block in _mappings((section or {}).get("upstreams")):
+        name = _text(block.get("name"))
+        if not name:
+            continue
+        found.setdefault(name, []).extend(_mappings(block.get("servers")))
+    return found
+
+
+def _connection(source: str, in_port: int, host: str, out_port: int | None, name: str | None,
+                kind: str, selectors: Sequence[str]) -> dict[str, Any]:
+    """One line of the graph: an inbound port, an outbound endpoint, and the config's word for it.
+
+    Three of these fields are set by the join later, and each says so by being `None` now:
+
+    * `connections` — a count is a socket fact and this function reads config text. A line whose
+      endpoint the config wrote as a **name** keeps the `None` forever: `/proc` has addresses,
+      nothing here resolves, so nobody can ever count it.
+    * `shared` — `true` when another line reaches the same endpoint and therefore carries the same
+      number, so a reader never mistakes two lines for twice the traffic.
+    * `metric` — the gauge this line publishes, and **`None` for exactly the lines `connections`
+      can never have**: a series that can only ever be empty is not a series, and asking
+      `/api/gateway/history` for one draws a flat line at nothing. Where it is set, the name
+      carries the port as well as the address, because `:25565` and `:25566` on one host are two
+      services and one name would make the second insert overwrite the first.
+    """
+    suffix = f"{host}:{out_port}" if out_port is not None else host
+    address = _is_ip_literal(host)
+    joinable = address and isinstance(out_port, int) and not isinstance(out_port, bool)
+    return {
+        "id": f"{source}:{in_port}->{suffix}",
+        "source": source,
+        "in": {"port": in_port},
+        "out": {"host": host, "port": out_port, "name": name, "kind": kind,
+                "selectors": list(selectors), "address": address},
+        "connections": None,
+        "shared": False,
+        "metric": f"{SOURCE}.out_conns@{host}:{out_port}" if joinable else None,
+    }
+
+
+def config_connections(haproxy: Mapping[str, Any] | None,
+                       nginx: Mapping[str, Any] | None) -> list[dict[str, Any]]:
+    """Every connection the two configs declare, in config order. Pure, clock-free, resolver-free.
+
+    The four derivations, the merge rule and the two refusals are stated in the module docstring
+    ("The connection graph"); this is that text made executable. What it deliberately does **not**
+    do is join a socket: a connection says the config routes here, which is a fact readable from
+    a file, and never that a connection is open now, which is not.
+    """
+    claims: dict[tuple[str, int, str, int | None], dict[str, Any]] = {}
+
+    def claim(source: str, in_port: int, host: str, out_port: int | None, *, name: str | None,
+              kind: str, selectors: Sequence[str]) -> None:
+        """One line per `(source, in_port, host, out_port)`; selectors union, first-seen order."""
+        key = (source, in_port, host, out_port)
+        seen = claims.get(key)
+        if seen is None:
+            claims[key] = _connection(source, in_port, host, out_port, name, kind, selectors)
+            return
+        merged = seen["out"]["selectors"]
+        for selector in selectors:
+            if selector not in merged:
+                merged.append(selector)
+        # haproxy claims first and its `server` line carries a name an nginx `proxy_pass` to the
+        # same endpoint does not, so a later claim never displaces a name the config has.
+        if name and not seen["out"]["name"]:
+            seen["out"]["name"] = name
+
+    servers_by_backend: dict[str, list[Mapping[str, Any]]] = {}
+    for row in haproxy_targets(haproxy):
+        declared_in = row["backend"]
+        if declared_in:
+            servers_by_backend.setdefault(declared_in, []).append(row)
+    for frontend in haproxy_frontends(haproxy):
+        for route in frontend["routes"]:
+            for target in servers_by_backend.get(route, ()):
+                claim("haproxy", int(frontend["port"]), target["host"], target["port"],
+                      name=target["name"], kind=KIND_BACKEND, selectors=(route,))
+
+    maps = _maps_by_variable(nginx)
+    pools = _pools(nginx)
+    for block in nginx_server_blocks(nginx):
+        for proxy in block["proxies"]:
+            variable = _text(proxy.get("variable"))
+            if variable:
+                # rule 4: the fan-out is the `map`, and its entry keys are the selectors. The
+                # `default` key stays verbatim — it is the config's own word for unmapped SNI.
+                for entry in maps.get(variable.lstrip("$"), ()):
+                    key = _text(entry.get("key"))
+                    target = _target_of(entry.get("target"))
+                    if not key or target is None:
+                        continue
+                    for port in block["ports"]:
+                        claim("nginx", port, target[0], target[1], name=None, kind=KIND_MAP,
+                              selectors=(key,))
+                continue
+            target = _target_of(proxy.get("target"))
+            if target is None:
+                continue  # refusal: neither a target nor a variable names an endpoint
+            if target[1] is not None:
+                # rule 2: a concrete `host:port`, one line per listen port of this block
+                for port in block["ports"]:
+                    claim("nginx", port, target[0], target[1], name=None,
+                          kind=KIND_SERVER_NAME, selectors=block["names"])
+                continue
+            # rule 3: a name with no port is an `upstream` block, and no block of that name is
+            # no endpoint — the payload cannot say where the traffic lands, so it claims nothing
+            # (and warns about nothing: task 03 decides whether that is a config-integrity fault).
+            for member in pools.get(target[0], ()):
+                host = _text(member.get("host"))
+                if not host:
+                    continue
+                for port in block["ports"]:
+                    claim("nginx", port, host, _port(member.get("port")), name=None,
+                          kind=KIND_POOL, selectors=(target[0],))
+    return list(claims.values())
+
+
+def _one_or_many(count: int, singular: str, plural: str | None = None) -> str:
+    """`1 server` / `3 servers` — the config's own noun, pluralised for its own count."""
+    if count != 1:
+        return f"{count} {plural or singular + 's'}"
+    return f"{count} {singular}"
+
+
+def _warning(kind: str, subject: str, message: str) -> dict[str, str]:
+    """One warning: a stable `id`, the `kind` it belongs to, its `subject`, the operator's sentence.
+
+    `id` is `f"{kind}:{subject}"` and is the page's DOM key, which is why `subject` carries every
+    fact that separates two warnings of the same kind — the frontend *and* the backend it names, the
+    pool *and* the listen ports its `proxy_pass` is written in. That is the unit of repair: one
+    broken config line, deduplicated by `id`, never one row per `bind` and never two different faults
+    collapsed into one.
+    """
+    return {"id": f"{kind}:{subject}", "kind": kind, "subject": subject, "message": message}
+
+
+def _listen_phrase(ports: Sequence[int]) -> str:
+    """`listen 4443 ` for a block that names its ports, `` for one that names none.
+
+    Every port of the block is named (`listen 4443, 8443 `) because the unit of repair is the
+    `proxy_pass` line, not the socket space, and a warning that quietly picked one of two ports
+    would understate how many listeners the broken route touches. A block with no `listen` at all
+    gets the empty string rather than `listen None`: that case has its own kind
+    (`nginx_server_unlistened`), and a second sentence must not invent a port.
+    """
+    return "listen " + ", ".join(str(port) for port in ports) + " " if ports else ""
+
+
+def _port_text(ports: Sequence[int]) -> str:
+    """`4443+8443` for the `subject` of a warning, `-` when the block names no port at all."""
+    return "+".join(str(port) for port in ports) if ports else "-"
+
+
+def haproxy_warnings(haproxy: Mapping[str, Any] | None) -> list[dict[str, str]]:
+    """The three haproxy config-integrity kinds, in config order, or ``[]`` if unreadable.
+
+    Judged on `available is True` only: a host with no haproxy config, or one the agent could not
+    read, has not been found guilty of anything (invariant 3).
+
+    **No warning for a frontend whose only routing is a fetch expression.** Agent 1.2.0 reports
+    `use_backend %[req.hdr(host),map_dom(...)]` as *no name* — the same value a frontend with no
+    routing directive at all has — so a warning here would blame a config this agent cannot read.
+    Making the two distinguishable is an agent change (a `routes_dynamic` flag), not a source-level
+    guess, which is why this function stays silent about them.
+    """
+    if haproxy is None or _available(haproxy) is not True:
+        return []
+    backends = _mappings(haproxy.get("backends"))
+    declared = {name for name in (_text(row.get("name")) for row in backends) if name}
+    routed: set[str] = set()
+    found: list[dict[str, str]] = []
+
+    for frontend in _mappings(haproxy.get("frontends")):
+        name = _text(frontend.get("name")) or "(unnamed frontend)"
+        routes = _names(frontend.get("backends"))
+        default = _text(frontend.get("default_backend"))
+        if default and default not in routes:
+            routes.insert(0, default)
+        routed.update(routes)
+        for route in routes:
+            if route in declared:
+                continue
+            found.append(_warning(
+                WARN_ROUTE_DANGLING, f"{name}->{route}",
+                f'frontend {name} routes to backend "{route}", which no backend block declares'))
+
+    for backend in backends:
+        name = _text(backend.get("name"))
+        if not name:
+            continue
+        servers = _mappings(backend.get("servers"))
+        if not servers:
+            # an empty backend routes nowhere whichever frontend names it, so this is the only
+            # thing said about it: `haproxy_backend_orphan` needs a server to have anywhere to go
+            found.append(_warning(
+                WARN_BACKEND_EMPTY, name,
+                f'backend "{name}" declares no server — it routes nowhere'))
+            continue
+        if name in routed:
+            continue
+        found.append(_warning(
+            WARN_BACKEND_ORPHAN, name,
+            f'backend "{name}" has {_one_or_many(len(servers), "server")} and no frontend '
+            f"routes to it"))
+    return found
+
+
+def nginx_warnings(nginx: Mapping[str, Any] | None) -> list[dict[str, str]]:
+    """The four nginx config-integrity kinds, in config order, or ``[]`` if unreadable.
+
+    Same rule as `haproxy_warnings`: only a section that answered `available: True` is judged.
+
+    **Three refusals**, each because this payload cannot tell broken from merely unreadable:
+
+    * a `server` block with a `listen` and no `proxy_pass` — it may be a static or a redirect
+      vhost, and the agent publishes nothing that separates the two (this fleet's own `:80` is
+      a `return 301`, which is exactly that shape);
+    * a `proxy_pass` with neither `target` nor `variable` (a unix socket, a bare word) — legal,
+      undrawable, not broken;
+    * an entry of a map **no** `proxy_pass` names: the `$connection_upgrade` map's `upgrade` and
+      `close` are header words and not addresses by design, and calling that a missing route
+      would be a fault invented from a field this module misread.
+    """
+    if nginx is None or _available(nginx) is not True:
+        return []
+    maps = _maps_by_variable(nginx)
+    pools = _pools(nginx)
+    wanted = proxy_variables(nginx)
+    found: list[dict[str, str]] = []
+
+    for block in nginx_server_blocks(nginx):
+        ports: list[int] = list(block["ports"])
+        names: list[str] = list(block["names"])
+        proxies: list[Mapping[str, Any]] = list(block["proxies"])
+        where = _listen_phrase(ports)
+        # "no `listen`" is "no `listen` that named a port": the agent publishes no entry for
+        # `listen unix:/run/nginx.sock`, so this cannot tell a socket listener from no listener at
+        # all. A TCP-only ingress (every host this dashboard watches) has no such line, and the
+        # alternative — never warning — would let a vhost nobody can reach pass unmentioned.
+        if not ports and (names or proxies):
+            # `and/or` is the condition: a block that only names a domain is as unlistened as one
+            # that proxy_passes, and the sentence says which of the two the config did
+            label = (names[0] if names else "(unnamed server)")
+            verb = "proxy_passes" if proxies else "declares a server_name"
+            found.append(_warning(
+                WARN_SERVER_UNLISTENED, label,
+                f'nginx server "{label}" {verb} but never listens'))
+            # refusal, and it is the same one for every block below with a `listen` and no
+            # `proxy_pass`: a static or redirect vhost is legal and looks identical here, so a
+            # warning would invent a fault out of a file this agent read correctly.
+        for proxy in proxies:
+            variable = _text(proxy.get("variable"))
+            if variable:
+                bare = variable.lstrip("$")
+                if bare not in maps:
+                    found.append(_warning(
+                        WARN_VARIABLE_UNMAPPED, f"{bare}@{_port_text(ports)}",
+                        f"nginx {where}proxy_passes ${bare}, which no map block defines"))
+                continue
+            target = _target_of(proxy.get("target"))
+            if target is None:
+                # refusal: neither a target nor a variable (a unix socket, a bare word) is legal,
+                # undrawable, and not broken — the payload cannot say which of the two it is
+                continue
+            if target[1] is not None:
+                continue  # a concrete host:port — task 01 drew its connection, nothing is broken
+            if target[0] in pools:
+                continue  # a pool that names an `upstream` block is rule 3, not a fault
+            found.append(_warning(
+                WARN_POOL_UNDECLARED, f"{target[0]}@{_port_text(ports)}",
+                f'nginx {where}proxy_passes to pool "{target[0]}", which no upstream block '
+                f"declares"))
+
+    for block in _mappings(nginx.get("maps")):
+        variable = _text(block.get("variable"))
+        if not variable or variable.lstrip("$") not in wanted:
+            continue  # refusal: an unreferenced map is not a routing table
+        bare = variable.lstrip("$")
+        for entry in _mappings(block.get("entries")):
+            if isinstance(entry.get("target"), Mapping):
+                continue
+            key = entry.get("key")
+            key = key if isinstance(key, str) else ""
+            found.append(_warning(
+                WARN_MAP_ROUTE_MISSING, f"{bare}:{key}",
+                f'map ${bare} entry "{key}" names no address to route to'))
+    return found
+
+
+def warnings(haproxy: Mapping[str, Any] | None,
+             nginx: Mapping[str, Any] | None) -> list[dict[str, str]]:
+    """Every config-integrity warning the two configs deserve, haproxy first, deduplicated by `id`.
+
+    Pure over the two agent sections: no socket, no clock, no resolver, no store. Seven kinds, each
+    a config that does not connect to itself (the table and the three refusals are in the module
+    docstring, and each refusal has a comment at the place the check would have gone).
+
+    The order is a contract, not an accident: haproxy kinds in the order the file declares them
+    (frontends, then backends), then nginx kinds (server blocks, then maps), so the page's list and
+    `alerts.py`'s "the first one" both read the same way on every poll. Deduplicating by `id` is
+    what keeps a frontend with three `bind` lines from warning three times about the one backend it
+    names.
+
+    Each row is `{"id", "kind", "subject", "message"}`; `message` is operator-facing prose carrying
+    the config's own words verbatim, and nothing here carries a `severity` — a config that does not
+    connect to itself is a structural fact, not a graded number.
+    """
+    found = [*haproxy_warnings(haproxy), *nginx_warnings(nginx)]
+    seen: set[str] = set()
+    unique: list[dict[str, str]] = []
+    for row in found:
+        if row["id"] in seen:
+            continue
+        seen.add(row["id"])
+        unique.append(row)
+    return unique
+
+
 def socket_rows(section: Mapping[str, Any] | None) -> tuple[list[Mapping[str, Any]],
                                                             list[Mapping[str, Any]]]:
     """`(listens, established)` from the sockets section — both empty when it did not answer."""
@@ -406,17 +850,6 @@ def socket_rows(section: Mapping[str, Any] | None) -> tuple[list[Mapping[str, An
     return _mappings(section.get("listens")), _mappings(section.get("established"))
 
 
-def live_listen_ports(listening: Sequence[Mapping[str, Any]]) -> set[int]:
-    """The ports this host is actually serving, from the kernel's LISTEN rows.
-
-    The set decides the direction of a socket nothing matched (a port here means this host is
-    the one serving it, which makes the connection an inbound one the configs do not name) and
-    is the denominator of `unmatched.other`. Duplicated addresses of one port collapse here:
-    a port is what the configs speak.
-    """
-    return {port for port in (_port(item.get("port")) for item in listening) if port is not None}
-
-
 def _remote(socket: Mapping[str, Any]) -> tuple[str | None, int | None]:
     remote = socket.get("remote")
     if not isinstance(remote, Mapping):
@@ -436,116 +869,68 @@ def _local_port(socket: Mapping[str, Any]) -> int | None:
 
 
 # --------------------------------------------------------------------------- #
-# the join
+# the join: two arms, and the ignore rule
+#
+# `outbound[]`, `by_port`, `unmatched`, `unmatched.groups`, `partial` and `MAX_GROUP_HOSTS`
+# were deleted here in phase 30 task 02. They existed to answer "which configured target does
+# this socket belong to?" for a target the config wrote as a **name**, and the honest answer is
+# that nothing in this stack can know (no DNS, ever). What was left over went into a card of
+# `unmatched` counts that, on the live router, was mostly this app's own agent port and SSH —
+# noise dressed as a signal. A socket the two configs do not describe is now ignored.
 # --------------------------------------------------------------------------- #
 
-def _outbound_key(host: str, port: int | None) -> tuple[str, int | None]:
-    return (host, port)
+def endpoint_of(connection: Mapping[str, Any]) -> tuple[str, int] | None:
+    """The joinable endpoint key `(address, port)` of a connection, or ``None``.
 
-
-def _outbound_pipe(host: str, port: int | None, name: str | None, source: str | None,
-                   *, counting: bool) -> dict[str, Any]:
-    """One configured target, with the live count joined onto it later.
-
-    `metric` travels in the pipe so a page asks `/api/gateway/history` for the series this
-    pipe *is* instead of rebuilding the name (the same reason `/disks` cards and `/llm` cells
-    carry their own keys). `by_port` says how the join will have to work: a target written as
-    an address matches exactly, a target written as a name can only match on its port, and
-    the payload must never let the reader confuse the two.
+    ``None`` means "a name, or an address that names no port": there is nothing in `/proc` to
+    compare it with, so the connection is not an endpoint the join can count.
     """
-    suffix = f"{host}:{port}" if port is not None else host
-    return {
-        "target": {"host": host, "port": port, "name": name,
-                   "by_port": port is not None and not _is_ip_literal(host)},
-        # a target that names no port can never be joined at all, so its count stays unknown even
-        # when the socket table answered — `0` there would claim a measurement nobody took.
-        "connections": 0 if (counting and port is not None) else None,
-        "source": source,
-        "metric": f"{SOURCE}.out_conns@{suffix}",
-    }
+    out = connection.get("out")
+    if not isinstance(out, Mapping) or out.get("address") is not True:
+        return None
+    host = out.get("host")
+    port = out.get("port")
+    if not isinstance(host, str) or not isinstance(port, int) or isinstance(port, bool):
+        return None
+    return host, port
 
 
-def _bump(pipe: dict[str, Any]) -> None:
-    pipe["connections"] = int(pipe["connections"] or 0) + 1
+def join_sockets(listeners: Mapping[int, dict[str, Any]],
+                 endpoints: MutableMapping[tuple[str, int], dict[str, Any]],
+                 established: Sequence[Mapping[str, Any]]) -> None:
+    """One pass over the ESTABLISHED table, stamping counts **in place**. Returns nothing.
 
+    * a socket whose **local port** is a configured listener is inbound: that listener's
+      `connections` goes up by one and its `clients` gains the remote address;
+    * otherwise a socket whose **remote `(address, port)`** is an endpoint the config wrote as
+      an address is outbound: that endpoint's `connections` goes up by one;
+    * anything else is **not counted at all**, by decision — see the module docstring.
 
-def join_sockets(inbound: Mapping[int, dict[str, Any]],
-                 outbound: Mapping[tuple[str, int | None], dict[str, Any]],
-                 established: Sequence[Mapping[str, Any]],
-                 live_listen_ports: set[int]) -> dict[str, Any]:
-    """One pass over the ESTABLISHED table, attributing each socket **at most once**.
-
-    Mutates the pipes' `connections` and `clients` and returns
-    `{inbound, outbound, ambiguous}`: the connections no configured frontend names, the
-    connections no specific configured target claims (the ambiguous ones included), and the
-    per-port tally of the ambiguous fan-out. Decision order and why each arm is honest are in
-    the module docstring; the property that matters to the page is the partition —
-    inbound pipes + outbound pipes + `inbound` + `outbound` == the socket table, so the counts
-    on screen reconcile against a direct `/proc/net/tcp` read (phase 29 task 06 checks exactly
-    that), and no socket is ever drawn down two pipes.
-
-    The port-only arm counts **domain** targets only, and a port whose configured hosts are
-    more than one is never resolved by picking: `/proc` does not know which name the socket
-    was dialled to and neither does anything downstream of it.
+    The identity that follows, and that `tests/test_gateway_source.py` pins: every socket is
+    counted **at most once** (the `continue` after each stamp is what enforces it — a loopback
+    hop is two `/proc` rows and must not be drawn down one pipe twice), and so
+    `sum(listeners) + sum(endpoint counts) <= established`. The old `==` identity died with
+    `unmatched`: the difference is precisely the traffic outside the two config files, which
+    this page no longer reports.
     """
-    hosts_by_port: dict[int, set[str]] = {}
-    for host, port in outbound:
-        if port is not None:
-            hosts_by_port.setdefault(port, set()).add(host)
-
-    ambiguous: dict[int, int] = {}
     clients: dict[int, list[str]] = {}
-    unmatched_in = 0
-    unmatched_out = 0
     for socket in established:
         local_port = _local_port(socket)
         remote_addr, remote_port = _remote(socket)
-        pipe = inbound.get(local_port) if local_port is not None else None
-        if pipe is not None:
-            _bump(pipe)
+        listener = listeners.get(local_port) if local_port is not None else None
+        if listener is not None:
+            listener["connections"] = int(listener["connections"] or 0) + 1
             if remote_addr is not None:
-                seen = clients.setdefault(int(pipe["port"]), [])
+                seen = clients.setdefault(int(listener["port"]), [])
                 if remote_addr not in seen:
                     seen.append(remote_addr)
             continue
-        exact = (outbound.get(_outbound_key(remote_addr, remote_port))
-                 if remote_addr is not None else None)
-        if exact is not None:
-            _bump(exact)
-            continue
-        candidates = hosts_by_port.get(remote_port) if remote_port is not None else None
-        if candidates and remote_port is not None:
-            if len(candidates) > 1:
-                ambiguous[remote_port] = ambiguous.get(remote_port, 0) + 1
-                unmatched_out += 1
-                continue
-            sole = candidates.copy().pop()
-            # a target written as an address was already tried exactly above; a miss there is
-            # a different endpoint, not this one, so only a *name* may be matched by port.
-            named = (outbound.get(_outbound_key(sole, remote_port))
-                     if not _is_ip_literal(sole) else None)
-            if named is not None:
-                _bump(named)
-                continue
-        if local_port is not None and local_port in live_listen_ports:
-            # this host is *serving* the socket, on a port neither config names
-            unmatched_in += 1
-        else:
-            unmatched_out += 1
+        if remote_addr is not None and isinstance(remote_port, int):
+            endpoint = endpoints.get((remote_addr, remote_port))
+            if endpoint is not None:
+                endpoint["connections"] = int(endpoint["connections"]) + 1
     for port, seen in clients.items():
-        inbound[port]["clients"] = sorted(seen)[:MAX_CLIENTS]
-    return {"inbound": unmatched_in, "outbound": unmatched_out, "ambiguous": ambiguous}
-
-
-def _groups(ambiguous: Mapping[int, int],
-            pipes: Mapping[tuple[str, int | None], dict[str, Any]]) -> list[dict[str, Any]]:
-    """The ambiguous port groups, one entry per port with live connections on it."""
-    groups: list[dict[str, Any]] = []
-    for port, count in sorted(ambiguous.items()):
-        hosts = sorted({host for host, target in pipes if target == port})
-        groups.append({"port": port, "connections": count, "hosts": hosts[:MAX_GROUP_HOSTS],
-                       "host_count": len(hosts)})
-    return groups
+        listeners[port]["clients"] = sorted(seen)[:MAX_CLIENTS]
 
 
 def _skeleton(host: str) -> dict[str, Any]:
@@ -565,9 +950,9 @@ def _skeleton(host: str) -> dict[str, Any]:
         "section_errors": [],
         "haproxy": {"frontends": []},
         "nginx": {"servers": [], "map_targets": []},
-        "inbound": [],
-        "outbound": [],
-        "unmatched": {"inbound": None, "outbound": None, "other": None, "groups": []},
+        "listeners": [],
+        "connections": [],
+        "warnings": [],
         "sockets": {"listens": None, "established": None},
     }
 
@@ -592,16 +977,24 @@ def parse(snapshot: Mapping[str, Any], host: str) -> dict[str, Any]:
     """One agent snapshot -> the `/gateway` payload. Pure: no I/O, no clock, no resolver.
 
     The shape is the page's whole world: `haproxy`/`nginx` are the config as the agent read it
-    (the echo the pipes were built from), `inbound`/`outbound` are the pipes with their live
-    counts, `unmatched` is everything no config claimed (plus the ambiguous port groups),
-    `sockets` is the raw size of what the agent saw, and `supported`/`sections`/`why` are the
-    three degradation arms. Counts are `null` — never `0` — when nothing answered, and no
-    count carries a `severity`.
+    (the echo the lines were drawn from), `listeners` is one entry per configured listen port
+    with its live count and client addresses, `connections` is the graph those two configs
+    declare (`config_connections`: which outbound endpoint belongs to which inbound port, with
+    the config's own selector for it and, for an endpoint written as an address, its live count),
+    `sockets` is the raw size of what the agent saw, `warnings` is the config-integrity list
+    (`warnings()`: seven kinds, each a route the files declare that does not connect to itself,
+    empty for a clean ingress and for a host whose configs did not answer), and
+    `supported`/`sections`/`why` are the three degradation arms. Counts are `null` — never `0` —
+    when nothing answered or the join could not decide, and no count carries a `severity`.
 
-    `sockets.established` counts **kernel socket rows**, which is what the reconciliation
-    identity is stated against: a loopback connection is two rows, one per end, so a gateway
-    proxying to a service on itself appears once inbound and once outbound — the same traffic
-    seen from both sides, which is exactly what the two pipes are there to show.
+    There is no `outbound` pipe list and no `unmatched` tally any more (phase 30 task 02): the
+    graph carries the outbound side, and anything neither config file describes is ignored —
+    including by `warnings`, which reports only what the two files do not connect to.
+
+    `sockets.established` stays the kernel's own row count, and it is an **upper bound** on the
+    counts above rather than their sum: a loopback connection is two rows (one per end, drawn as
+    one inbound and one outbound line), and every socket outside the two configs is in the number
+    and on no line.
     """
     status = section_status(snapshot)
     supports = supported(snapshot)
@@ -627,15 +1020,25 @@ def parse(snapshot: Mapping[str, Any], host: str) -> dict[str, Any]:
         return payload
 
     payload["haproxy"]["frontends"] = haproxy_frontends(haproxy)
+    blocks = nginx_server_blocks(nginx)
     server_names: dict[int, list[str]] = {}
-    for port, names in nginx_listen_ports(nginx):
-        merged = server_names.setdefault(port, [])
-        for name in names:
-            if name not in merged:
-                merged.append(name)
+    for block in blocks:
+        for port in block["ports"]:
+            merged = server_names.setdefault(port, [])
+            for name in block["names"]:
+                if name not in merged:
+                    merged.append(name)
     payload["nginx"]["servers"] = [{"port": port, "server_names": names}
                                    for port, names in server_names.items()]
     payload["nginx"]["map_targets"] = nginx_map_targets(nginx)
+    # The graph is config text and nothing else, so it is built before the socket section is
+    # consulted and is the same in the `sockets`-silent arm. Its per-line `connections` is filled
+    # in below, and stays `None` for a target the config wrote as a name.
+    payload["connections"] = config_connections(haproxy, nginx)
+    # Config integrity is config text too, for the same reason: a broken route is just as true when
+    # the socket table never answered. Each half is judged only if its own section did answer, so
+    # this is `[]` — not a guess — for a host with no haproxy, no nginx, or an unreadable file.
+    payload["warnings"] = warnings(haproxy, nginx)
 
     # --- inbound pipes, one per configured listen port -------------------------
     # A port belongs to one socket space whether haproxy or nginx names it (a host cannot
@@ -643,14 +1046,14 @@ def parse(snapshot: Mapping[str, Any], host: str) -> dict[str, Any]:
     # are merged onto that one pipe. `source` is the first config to name it, which is the
     # honest answer to "where did this pipe come from" and nothing more.
     counting = _available(sockets) is True
-    inbound: dict[int, dict[str, Any]] = {}
+    listeners: dict[int, dict[str, Any]] = {}
 
     def claim_port(port: int, source: str, domains: Sequence[str]) -> None:
-        pipe = inbound.get(port)
+        pipe = listeners.get(port)
         if pipe is None:
-            inbound[port] = {"port": port, "source": source, "domains": list(domains),
-                             "connections": 0 if counting else None,
-                             "clients": [], "metric": f"{SOURCE}.in_conns@{port}"}
+            listeners[port] = {"port": port, "source": source, "domains": list(domains),
+                               "connections": 0 if counting else None,
+                               "clients": [], "metric": f"{SOURCE}.in_conns@{port}"}
             return
         merged = pipe["domains"]
         for domain in domains:
@@ -662,91 +1065,79 @@ def parse(snapshot: Mapping[str, Any], host: str) -> dict[str, Any]:
     for port, names in server_names.items():
         claim_port(port, "nginx", names)
 
-    # --- outbound pipes, one per configured target -----------------------------
-    outbound: dict[tuple[str, int | None], dict[str, Any]] = {}
+    payload["listeners"] = list(listeners.values())
 
-    def claim_target(host_name: str, port: int | None, name: str | None,
-                     source: str | None) -> None:
-        """One pipe per configured `host:port`, first claimer wins.
-
-        haproxy is claimed before nginx before the map, which is the order that keeps
-        information rather than overwriting it: a haproxy `server` line carries a name and an
-        nginx `proxy_pass` does not, so a duplicate never displaces a name the config has.
-        The socket space is one pipe either way — a second pipe for the same endpoint would
-        draw the same connections twice.
-        """
-        key = _outbound_key(host_name, port)
-        if key not in outbound:
-            outbound[key] = _outbound_pipe(host_name, port, name, source, counting=counting)
-
-    for row in haproxy_targets(haproxy):
-        claim_target(row["host"], row["port"], row["name"], "haproxy")
-    for row in nginx_targets(nginx):
-        claim_target(row["host"], row["port"], None, "nginx")
-    for row in payload["nginx"]["map_targets"]:
-        claim_target(row["host"], row["port"], None, "map")
+    # --- the endpoints the socket table can be joined to -----------------------
+    # Only an endpoint the config wrote as an **address** is joinable: `/proc` spells addresses,
+    # this stack resolves nothing, and a name is therefore a route with no measurable end. One
+    # entry per `(address, port)` — several lines can reach one endpoint, and `routes` is what
+    # makes `shared` true on every one of them afterwards.
+    endpoints: dict[tuple[str, int], dict[str, Any]] = {}
+    for connection in payload["connections"]:
+        key = endpoint_of(connection)
+        if key is None:
+            continue
+        seen = endpoints.get(key)
+        if seen is None:
+            endpoints[key] = {"connections": 0, "routes": 1}
+        else:
+            seen["routes"] = int(seen["routes"]) + 1
 
     if not counting:
-        # The configs are known and the live half is not: every pipe is drawn, every count is
-        # null, and the tallies say nothing rather than zero (rule 2 — the sockets section
-        # answers "no answer", never "no connections").
-        payload["inbound"] = list(inbound.values())
-        payload["outbound"] = list(outbound.values())
+        # The configs are known and the live half is not: every line is drawn, every count stays
+        # null, and nothing says "no connections" about a table that never answered (rule 2).
         return payload
 
-    # --- the joins -------------------------------------------------------------
-    live_ports = live_listen_ports(listening)
-    tallies = join_sockets(inbound, outbound, established, live_ports)
-    # A port whose live sockets could not be attributed is unknown for **each** of its candidate
-    # targets — not `0` (there are connections; we cannot say whose) and not the port's total
-    # repeated on every pipe (a fan-out drawing reads that as M times the traffic). A port with
-    # no traffic at all keeps its honest `0` on every candidate, because that is a fact.
-    for ambiguous_port in tallies["ambiguous"]:
-        for (_target_host, target_port), pipe in outbound.items():
-            if target_port == ambiguous_port:
-                pipe["connections"] = None
-    payload["inbound"] = list(inbound.values())
-    payload["outbound"] = list(outbound.values())
-    payload["unmatched"] = {
-        "inbound": tallies["inbound"],
-        "outbound": tallies["outbound"],
-        # the listener-level fact, phase 28's "an unclaimed socket stays visible as one":
-        # a port this host listens on that neither config names.
-        "other": len([port for port in live_ports if port not in inbound]),
-        "groups": _groups(tallies["ambiguous"], outbound),
-    }
+    # --- the join: inbound by local port, outbound by exact address, nothing else --
+    join_sockets(listeners, endpoints, established)
+    for connection in payload["connections"]:
+        key = endpoint_of(connection)
+        if key is None:
+            continue  # a name, or an address with no port: never counted, so never a number
+        endpoint = endpoints[key]
+        connection["connections"] = int(endpoint["connections"])
+        connection["shared"] = int(endpoint["routes"]) > 1
     payload["sockets"] = {"listens": len(listening), "established": len(established)}
     return payload
 
 
 def samples(payload: Mapping[str, Any], ts: float | None = None) -> list[Sample]:
-    """One gauge per pipe that has a number.
+    """One gauge per listener and per joinable endpoint that has a number.
 
-    A `null` count publishes **no** sample — "unknown" is not a zero, and a chart of zeros for
-    a dead socket table is the failure mode rule 2 names. The timestamp is the poll's (when the
-    dashboard read the count), carried on `ts`; nothing here is a rate, so nothing here needs a
-    window.
+    Three refusals, and each is a different fact:
+
+    * A `null` count publishes **nothing**. "Unknown" is not a zero, and a chart of zeros for a dead
+      socket table — or of confident zeros for every route whose target the config wrote as a
+      **name** — is the failure mode rule 2 names.
+    * **One sample per metric name.** Several route lines can reach one endpoint and each of them
+      carries that endpoint's whole count (`shared: true`); the gauge is keyed by the endpoint, so
+      emitting per line would store the same number twice under one name for one reading.
+    * A gauge never gets a bool.
+
+    That is also why the name-keyed `gateway.out_conns@<domain>:<port>` series stopped being
+    written in phase 30 task 02: the figure they carried belonged to the port, not the domain.
+    The timestamp is the poll's (when the dashboard read the count), carried on `ts`; nothing here
+    is a rate, so nothing here needs a window.
     """
     when = time.time() if ts is None else ts
+    host = str(payload.get("host") or "")
     rows: list[Sample] = []
-    for pipe in payload.get("inbound") or []:
-        if isinstance(pipe, Mapping):
-            rows.extend(_gauge(payload, pipe, when))
-    for pipe in payload.get("outbound") or []:
-        if isinstance(pipe, Mapping):
-            rows.extend(_gauge(payload, pipe, when))
+    seen: set[str] = set()
+    for group in ("listeners", "connections"):
+        for pipe in payload.get(group) or []:
+            if not isinstance(pipe, Mapping):
+                continue
+            metric = pipe.get("metric")
+            value = pipe.get("connections")
+            if not isinstance(metric, str) or metric in seen:
+                continue
+            if isinstance(value, bool) or not isinstance(value, int | float):
+                continue
+            seen.add(metric)
+            rows.append(Sample(SOURCE, host, metric, float(value), when))
     return rows
 
 
-def _gauge(payload: Mapping[str, Any], pipe: Mapping[str, Any],
-           when: float) -> list[Sample]:
-    value = pipe.get("connections")
-    metric = pipe.get("metric")
-    if not isinstance(metric, str) or isinstance(value, bool) or not isinstance(value, int | float):
-        return []
-    return [Sample(SOURCE, str(payload.get("host") or ""), metric, float(value), when)]
-
-
 def parse_gateway_snapshot(name: str, snapshot: Mapping[str, Any],
                            *, now: float | None = None) -> Result:
     """One snapshot -> (`/gateway` payload, gauges, no events).
diff --git a/src/dashboards/web/pages/gateway.html b/src/dashboards/web/pages/gateway.html
index f474b99..bf709fe 100644
--- a/src/dashboards/web/pages/gateway.html
+++ b/src/dashboards/web/pages/gateway.html
@@ -36,31 +36,32 @@
       <div class="sub" id="sub">reading the ingress…</div>
     </div>
     <div class="spacer"></div>
-    <!-- The socket table's own totals beside the totals the pipes carry, so the page prints its
-         reconciliation instead of asserting it: `listeners` and `established` are what the
-         kernel said, and the two rows under the cards add up to them only when every connection
-         belonged to a configured pipe. No cell is coloured — a connection count is not a graded
-         number (`net.*`'s rule, and `severity.py` has no `gateway.*` row). -->
+    <!-- Four numbers, in the order the page is read: what the two configs **declare** (`ports`,
+         `connections`), what the kernel says is **open right now** on those ports (`live`), and
+         what in the configs does not connect to itself (`warnings`). The first two are config
+         facts and the third is a socket fact, which is why they are three cells and never one
+         total; `warnings` is `0` when the files route to themselves, because a clean ingress has
+         been read and found clean. The kernel's own table size is not here: a socket neither file
+         describes is nobody's pipe (phase 30 task 02), so printing it would invite the eye to
+         reconcile two numbers that were never meant to add up. No cell is coloured — a connection
+         count is not a graded number (`net.*`'s rule, and `severity.py` has no `gateway.*` row).
+         -->
     <div class="gate-tallies" id="tallies">
       <div class="metric">
-        <div class="label">listeners</div>
-        <div class="value sm" id="t-listeners">n/a</div>
+        <div class="label">ports</div>
+        <div class="value sm" id="t-ports">n/a</div>
       </div>
       <div class="metric">
-        <div class="label">established</div>
-        <div class="value sm" id="t-established">n/a</div>
+        <div class="label">connections</div>
+        <div class="value sm" id="t-connections">n/a</div>
       </div>
       <div class="metric">
-        <div class="label">pipes in</div>
-        <div class="value sm" id="t-inbound">n/a</div>
+        <div class="label">live</div>
+        <div class="value sm" id="t-live">n/a</div>
       </div>
       <div class="metric">
-        <div class="label">pipes out</div>
-        <div class="value sm" id="t-outbound">n/a</div>
-      </div>
-      <div class="metric">
-        <div class="label">unmatched</div>
-        <div class="value sm" id="t-unmatched">n/a</div>
+        <div class="label">warnings</div>
+        <div class="value sm" id="t-warnings">n/a</div>
       </div>
     </div>
   </div>
@@ -83,41 +84,29 @@
        the version that reads the proxy configs and the kernel's socket table.</p>
   </div>
 
-  <!-- One card per source family the payload names, `data-gate` keyed on a pipe's own `source`
-       word plus `unmatched`: a pipe is filed by what the config said it came from, not by which
-       card the page would rather it sat on. Every card ships hidden and appears on the poll that
-       has pipes for it (or a config that answered and named none), so a gateway with no nginx in
-       it does not spend a panel saying so. -->
+  <!-- The config-integrity list, in the overview's own vocabulary (`ul.alerts`, one `li.warn` per
+       row) because "a route that does not connect to itself" is the same kind of sentence
+       `/`'s Warnings & errors panel prints and should look like it. The rows are
+       `sources/gateway.warnings()`' words verbatim — the page never re-derives one — and a clean
+       ingress means this section is **hidden**, not an empty card: a permanent "0 warnings" trains
+       the eye to skip the one that fires. -->
+  <section class="card" id="gate-warnings" hidden>
+    <header><h3>Warnings to address</h3><span class="chip" id="warnings-count"></span></header>
+    <div class="body"><ul class="alerts" id="warnings-list"></ul></div>
+  </section>
+
+  <!-- Exactly two cards, one per config file: `data-gate` is keyed on the payload's own `source`
+       word, so a route is filed by the file that declares it and not by which card the page would
+       rather it sat on. nginx first, because its `:443` stream `map` is the widest fan-out on this
+       fleet (every SNI domain the router knows hanging off one trunk) and the file the operator
+       edits most. There is no third card
+       — the stream `map` is nginx config, so its entries are that card's `:443` leaves, and the
+       sockets neither file describes are reported nowhere (phase 30 task 02). Every card ships
+       hidden and appears on the poll that has groups for it (or a config that answered and named
+       none), so a gateway with no nginx in it does not spend a panel saying so. -->
   <section>
     <div class="page-head"><h2 style="font-size:.95rem;margin:0">Connection map</h2></div>
     <div class="grid auto items-start gate-grid" id="gate-cards">
-      <article class="card gate-card" data-gate="haproxy" hidden>
-        <header>
-          <span class="dot idle" data-k="dot"></span>
-          <h3>haproxy</h3>
-          <span class="chip" data-k="counts"></span>
-          <span class="spacer"></span>
-          <span class="faint mono updated"></span>
-        </header>
-        <div class="body stack">
-          <div class="pipe-columns">
-            <div class="pipe-col in" data-k="in"></div>
-            <div class="pipe-node" data-k="node" hidden></div>
-            <div class="pipe-col out" data-k="out"></div>
-          </div>
-          <div class="pipe-empty faint" data-k="empty" hidden></div>
-          <details class="charts-box" data-k="charts">
-            <summary>Charts<span class="chip charts-window" data-k="charts-window"></span></summary>
-            <div class="host-charts">
-              <div class="host-chart">
-                <div class="chart sm" data-chart="conns"></div>
-                <div class="legend" data-legend="conns"></div>
-              </div>
-            </div>
-          </details>
-        </div>
-      </article>
-
       <article class="card gate-card" data-gate="nginx" hidden>
         <header>
           <span class="dot idle" data-k="dot"></span>
@@ -127,11 +116,10 @@
           <span class="faint mono updated"></span>
         </header>
         <div class="body stack">
-          <div class="pipe-columns">
-            <div class="pipe-col in" data-k="in"></div>
-            <div class="pipe-node" data-k="node" hidden></div>
-            <div class="pipe-col out" data-k="out"></div>
-          </div>
+          <!-- One group per listening port: the trunk on the left, the targets its config names
+               hanging off it on the right. This is the structure of the file, not a summary of it.
+               Task 04 ships the rows plainly styled; task 05 draws the line and the switch. -->
+          <div class="gate-map" data-k="map"></div>
           <div class="pipe-empty faint" data-k="empty" hidden></div>
           <details class="charts-box" data-k="charts">
             <summary>Charts<span class="chip charts-window" data-k="charts-window"></span></summary>
@@ -145,23 +133,16 @@
         </div>
       </article>
 
-      <!-- The stream map's pipes are `map`-sourced while the listener they are reached through is
-           an `nginx` one, so this card is the fan-out alone. Joining the `443` listener into it
-           would be the page inventing a relationship the agent never reported. -->
-      <article class="card gate-card" data-gate="map" hidden>
+      <article class="card gate-card" data-gate="haproxy" hidden>
         <header>
           <span class="dot idle" data-k="dot"></span>
-          <h3>stream map</h3>
+          <h3>haproxy</h3>
           <span class="chip" data-k="counts"></span>
           <span class="spacer"></span>
           <span class="faint mono updated"></span>
         </header>
         <div class="body stack">
-          <div class="pipe-columns">
-            <div class="pipe-col in" data-k="in"></div>
-            <div class="pipe-node" data-k="node" hidden></div>
-            <div class="pipe-col out" data-k="out"></div>
-          </div>
+          <div class="gate-map" data-k="map"></div>
           <div class="pipe-empty faint" data-k="empty" hidden></div>
           <details class="charts-box" data-k="charts">
             <summary>Charts<span class="chip charts-window" data-k="charts-window"></span></summary>
@@ -175,43 +156,21 @@
         </div>
       </article>
 
-      <!-- Not pipes: there is no config to draw these from, only the socket table's leftovers.
-           `listeners no config names` counts **ports** and the other two count **connections**,
-           which is why they are three cells and never one sum. -->
-      <article class="card gate-card" data-gate="unmatched" hidden>
-        <header>
-          <span class="dot idle" data-k="dot"></span>
-          <h3>unmatched</h3>
-          <span class="spacer"></span>
-          <span class="faint mono updated"></span>
-        </header>
-        <div class="body stack">
-          <div class="metrics">
-            <div class="metric">
-              <div class="label">listeners no config names</div>
-              <div class="value sm" data-k="um-other">n/a</div>
-            </div>
-            <div class="metric">
-              <div class="label">connections inbound</div>
-              <div class="value sm" data-k="um-in">n/a</div>
-            </div>
-            <div class="metric">
-              <div class="label">connections outbound</div>
-              <div class="value sm" data-k="um-out">n/a</div>
-            </div>
-          </div>
-          <ul class="gate-groups" data-k="groups" hidden></ul>
-        </div>
-      </article>
     </div>
   </section>
 
+  <!-- Three sentences, one per claim the page is allowed to make: what the drawing means and what
+       its motion means (so a resting line is not read as a dead one), why a route written as a
+       domain carries no number (so a dash is not read as a fault), and what the switch does not
+       yet do. No `stale` claim — a socket table that did not answer is the page's one `why` line. -->
   <footer class="pagefoot">
-    <span class="faint">a pipe animates while it carries at least one live connection and rests
-      at zero, and is never coloured by a verdict — a busy ingress is the job.</span>
-    <span class="faint">a <code>by port</code> pipe was matched on its socket port
-      alone: the target is a name, the agent resolves nothing, and that port carries more than one
-      configured host — so the count is the port's, not this target's.</span>
+    <p class="faint">a line is drawn because the config says the route exists, and it animates only
+      while at least one connection is open on it — a resting line is not a dead one, and nothing
+      here is coloured by a verdict: a busy ingress is the job.</p>
+    <p class="faint">only an endpoint the config wrote as an <b>address</b> can be matched to a
+      socket — this page resolves nothing, so a line to a <b>name</b> carries no number.</p>
+    <p class="faint">the switch shows what the config says; toggling a route needs a config write
+      path and is not wired up yet.</p>
   </footer>
 </main>
 
diff --git a/src/dashboards/web/static/dash.css b/src/dashboards/web/static/dash.css
index 0ef74bd..c3f2bc9 100644
--- a/src/dashboards/web/static/dash.css
+++ b/src/dashboards/web/static/dash.css
@@ -27,6 +27,21 @@
   --fail-soft: rgba(248, 81, 73, 0.16);
   --info: #58a6ff;
   --info-soft: rgba(88, 166, 255, 0.15);
+  /* The gateway's existence pair — deliberately NOT the severity vocabulary. Green means the
+     route is written in a proxy config; red means it is out of the config. No gateway figure is
+     graded (`severity.py` has no `gateway.*` row), so nothing here may reach for --ok, --warn or
+     --fail directly: the pair is one indirection whose name says what it answers. Declared once,
+     on the root, as a substitution of the verdict tokens — per-theme --ok replacement happens on
+     the same element, so light and dark both follow without a second declaration (and a second
+     declaration is exactly how a pair like this drifts out of step with its theme). */
+  --gate-on: var(--ok);
+  --gate-off: var(--fail);
+  /* `/gateway`'s own rhythm, declared rather than repeated: the spine's halves extend by half the
+   * leaf gap so consecutive rows meet, and a literal `calc(50% + .15rem)` would keep drawing a
+   * continuous spine the day somebody changed the gap. `--gate-row-gap` is the group's, which is the
+   * distance a stacked phone trunk sits above its first leaf. */
+  --gate-leaf-gap: .3rem;
+  --gate-row-gap: .2rem;
   --series-1: #ff8a3d;
   --series-2: #58a6ff;
   --series-3: #3fb950;
@@ -1260,99 +1275,202 @@ input[type="text"].confirm {
 table.data td.san { white-space: normal; }
 
 /* ---- gateway pipes ---------------------------------------------------------
- * `/gateway` (phase 29 task 04): the connection map. One card per source family, and inside each
- * card two columns of pipes joined by one node — the gateway itself. A pipe is one `<path>` with
- * a travelling dash pattern, so the whole vocabulary here is ink and motion: a connection count
- * is not a graded number, which is why this section draws no coloured verdict on any of it — the
- * `net.*` precedent, and the API sends no verdict for a gateway figure at any depth.
+ * `/gateway` (phase 30 tasks 04-05): the connection map, as two tables — one per config file — whose
+ * rows are the connections that file declares. A group is a trunk (the port the config binds) and
+ * the leaves it names, so the page's structure *is* the file's: nginx's `:443` with the whole fan-out
+ * of its `map` entries hanging off it, haproxy's one-target frontends, this fleet's `:80` vhost with
+ * its refusal sentence in place of a leaf. (No count belongs in this comment: the router's config
+ * gains an entry whenever a domain is added, and the page draws whatever the file says.)
  *
- * Three layout facts are load-bearing, all of them measured in `data/logs/29-task04-pipes.cjs`:
- * the node is one rounded rect that does **not** stretch to the taller column (a 17-target
- * fan-out would otherwise grow a 600 px wall beside a six-pipe side); an empty column collapses
- * and the node moves to the edge it is joined to (`solo`); and at a phone width the three columns
- * stack with the node between them, because 320 px of card has no room for a pipe *and* its
- * label, and an unlabelled pipe is a line nobody can read.
+ * A pipe is one `<path>` with a travelling dash pattern, so the vocabulary here is ink and motion:
+ * a connection count is not a graded number, which is why this section draws no verdict on any of
+ * it — the `net.*` precedent, and the API sends no verdict for a gateway figure at any depth. What
+ * it does colour with is **existence**: `--gate-on` means the route is written in a proxy config
+ * (`sources/gateway.py` drew the row because a config declared it), and `--gate-off` is the
+ * not-in-the-config state the same pair owns. Motion means one thing and one thing only: at least
+ * one ESTABLISHED socket on that pipe right now.
+ *
+ * The branch is pure CSS. Each leaf row carries its own half of the spine (`::before` above its
+ * tick, `::after` below), and the two ends of the list drop theirs, so the spine starts at the
+ * first branch and stops at the last with no mask, no magic height and no background-coloured
+ * eraser — and it stays right when a poll adds or removes a leaf, because it is a property of the
+ * row and not of a measurement. A group with exactly one leaf is not a branch at all: `.solo` takes
+ * the vertical away and the row reads straight across, which is every haproxy frontend on this
+ * fleet.
+ *
+ * Three layout facts are load-bearing and each is measured, not assumed: the trunk column is a
+ * fixed-ish `9.5rem` so a 17-row fan-out lines up its leaves instead of re-flowing them to the
+ * widest target; every track is `minmax(0, …)` because a grid item may not be wider than its column
+ * by default and a 40-character target would otherwise grow the card (phase 27's rule); and at a
+ * phone width the group stacks to one column with the trunk above its leaves, because 320 px of card
+ * has no room for a line *and* its label, and an unlabelled line is one nobody can read.
  */
 .gate-tallies { display: flex; flex-wrap: wrap; gap: .9rem; align-items: flex-end; }
-/* "listeners no config names" is a fact, and `.metric .label` truncates with an ellipsis at a card
-   width that cannot fit it — a clipped label is a clipped fact (phase 27's rule), so these wrap.
-   The five header tallies keep the shared truncating rule: their labels are one word each. */
-.gate-card .metric .label { white-space: normal; }
+/* Phase 30 task 02 deleted the card these belonged to: `unmatched` was the only place a
+   `.metric .label` sat inside a `.gate-card` and the only renderer of a `.gate-groups` list, and
+   the four header tallies that remain are one word each, so they keep the shared truncating rule.
+   A card that grows a long label of its own gets its wrap rule back with it. */
 .gate-grid { min-width: 0; }
-.pipe-columns {
-  display: grid; gap: .5rem 1rem; min-width: 0; align-items: center;
-  grid-template-columns: minmax(0, 1fr) auto minmax(0, 1fr);
+
+/* The panel's groups, one under the other in port order. */
+.gate-map { display: grid; gap: .7rem; min-width: 0; }
+/* Trunk on the left, its leaves on the right. The trunk track is a width rather than `auto` so the
+ * leaves of every group line up vertically — the reading that makes this look like the table it is
+ * standing in for — and `9.5rem` is the widest trunk sentence this page prints (`:25566 · 4 live`).
+ *
+ * `column-gap: 0` is what makes the branch read as one drawing: the trunk's right edge and the
+ * leaves' left edge are the same x, and that x is where the spine lives. The vertical rhythm is all
+ * `row-gap`, which the ≤640px block also reaches into. */
+.gate-group {
+  position: relative;
+  display: grid; row-gap: var(--gate-row-gap); column-gap: 0; min-width: 0; align-items: start;
+  grid-template-columns: minmax(0, 9.5rem) minmax(0, 1fr);
 }
-/* A card with pipes on one side only. The stream map's fan-out is the case that ships: its
- * inbound half is the nginx `443` listener and lives on the nginx card, because the payload never
- * says which listener a map is reached through and the page does not guess one. Two classes, not
- * one, because *which* side is empty decides which grid track the node belongs in. */
-.pipe-columns.solo-out { grid-template-columns: auto minmax(0, 1fr); }
-.pipe-columns.solo-in { grid-template-columns: minmax(0, 1fr) auto; }
-.pipe-col { display: grid; gap: .5rem; min-width: 0; align-content: center; }
-.pipe-node {
-  align-self: center; justify-self: center; text-align: center;
-  min-width: 6rem; max-width: 9rem; padding: .6rem .45rem;
-  border: 1px solid var(--border-strong); border-radius: var(--radius);
-  background: var(--bg-sunken); color: var(--text-muted);
-  font: 600 11.5px var(--mono); letter-spacing: .04em; overflow-wrap: anywhere;
+/* The trunk. `position: relative` because it is the half of the picture the spine is drawn against,
+ * and `padding-inline-end` keeps the port's own text off the spine at the trunk's right edge. */
+.gate-trunk {
+  position: relative; min-width: 0; padding-inline-end: .5rem;
+  display: flex; flex-wrap: wrap; align-items: baseline; gap: .05rem .35rem;
 }
-.pipe-row { display: grid; gap: .12rem; min-width: 0; }
-.pipe-label {
-  display: flex; flex-wrap: wrap; align-items: baseline; gap: .05rem .35rem; min-width: 0;
+/* The leaves carry **no** left padding of their own: the 26 px first column of `.gate-link` *is* the
+ * gutter the spine is drawn in and the tick runs across. Padding here instead would push every tick
+ * 26 px away from the spine it is supposed to reach. */
+.gate-leaves { list-style: none; margin: 0; padding: 0; display: grid; gap: var(--gate-leaf-gap); min-width: 0; }
+/* One leaf: the branch gutter, the switch that says the config has it, the animated run, the
+ * endpoint, the count. `minmax(0, 1fr)` on the target column is what lets a 41-character hostname
+ * ellipsise instead of widening the card, and the whole string stays on the row's `title` and the
+ * pipe's `aria-label` when it does (gap 13). */
+/* `column-gap: 0` is the whole connection: tick, switch, run and label are drawn end to end, so the
+ * line reaches both of its counterparts instead of stopping a gap short of each. The run's own
+ * column (`minmax(2rem, 4.5rem)`) is what separates a switch from a label, and the label keeps a
+ * little padding of its own so a line ends *at* the text rather than inside it. */
+.gate-link {
+  position: relative;
+  display: grid; align-items: center; column-gap: 0; row-gap: .2rem; min-width: 0;
+  grid-template-columns: 26px auto minmax(2rem, 4.5rem) minmax(0, 1fr) auto;
 }
-/* A pipe's label is the page's whole answer — which port, which domain, which target — and this row
-   is what makes the answer readable. Task 06 measured it on live data: as one `nowrap` flex line the
-   name shrank to whatever the `by port` chip, the config's own `server` name and the `flex: none`
-   count left, which drew seven characters of `reeseapps-gitea.reeselink.com:2222`; wrapping the text
-   inside that squeezed box was worse (eleven lines, a word at a time). So the name claims the line:
-   `max-content` as its base size means a name longer than the column is alone on its line and gets
-   the *whole* column (~22 characters), with the chip, the footnote and the count wrapping beneath it,
-   while a short label like `:22` still sits beside its count on one line exactly as before. What is
-   still clipped after that is a target longer than the column, which is a column-width fact
-   (AGENTS.md gap 13) and not a lost one: `renderPipeRow` puts the full string on the element as
-   `title`, `pipeAria` carries the whole endpoint, and
-   `test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins both declarations and both
-   strings. The live pass re-counts the clipped labels on every run. */
-.pipe-name {
-  flex: 1 1 max-content; font-size: 11.5px; min-width: 0;
+/* Each row carries its own half of the spine, at the gutter's left edge — the trunk's own right
+ * edge, since the group sets `column-gap: 0`. Dropping the first row's upper half and the last
+ * row's lower half is the whole start/stop rule: no mask, no measured height, and a leaf added or
+ * removed by the next poll moves the ends with it. */
+/* Each half reaches half a leaf gap past its own row, so two adjacent rows meet and the spine reads
+ * as one line rather than a stack of brackets. The ends of the list drop theirs, so this extension
+ * never draws past a branch. */
+.gate-link::before {
+  content: ""; position: absolute; left: 0;
+  top: calc(var(--gate-leaf-gap) / -2); height: calc(50% + var(--gate-leaf-gap) / 2);
+  border-left: 2px dashed var(--border-strong);
+}
+.gate-link::after {
+  content: ""; position: absolute; left: 0; top: 50%;
+  height: calc(50% + var(--gate-leaf-gap) / 2);
+  border-left: 2px dashed var(--border-strong);
+}
+.gate-link:first-child::before, .gate-link:last-child::after { display: none; }
+/* The tick from that spine to this row's switch, at the row's vertical centre — the same y the two
+ * halves of the spine meet at, so the junction is a `T` and not two near-misses. */
+.gate-elbow { align-self: center; height: 0; border-top: 2px dashed var(--border-strong); }
+/* Straight across: a group with exactly one leaf is not a branch, so it draws no vertical at all —
+ * the tick, the switch and the run land on one horizontal line from the trunk to the endpoint. That
+ * is every haproxy frontend on this fleet (six frontends, one `server` each), and the class is the
+ * JS's one leaf-count test rather than a `:only-child` rule because the *refusal* row
+ * (`.gate-none`) is a second child of the same list and a `:only-child` selector cannot know that. */
+.gate-group.solo .gate-link::before, .gate-group.solo .gate-link::after { display: none; }
+.gate-switch-slot { display: inline-flex; align-items: center; flex: none; }
+/* The switch is a **reading** shaped like a control, and it is the shape the operator sketched: a
+ * pill with a knob, green when the route is in the config. It is keyed on `[aria-checked]` and
+ * **never** on `:enabled`, because a switch this app cannot wire (invariant 1: nothing here writes
+ * to an upstream) must still look green while it is on — styling `:enabled` would paint every one
+ * of them red by accident. `cursor: not-allowed` says what a hover would otherwise promise, and
+ * there is no `:hover` rule and no listener anywhere in `page-gateway.js`. `aria-disabled="true"`
+ * rather than `disabled`, which would drop a real `<button>` out of the a11y tree and make a
+ * reading invisible to the people who most need the sentence. */
+.gate-switch {
+  width: 34px; height: 18px; padding: 2px; border-radius: 999px; flex: none;
+  border: 1px solid var(--gate-on); display: inline-flex; align-items: center;
+  background: color-mix(in srgb, var(--gate-on) 14%, transparent);
+  cursor: not-allowed;
+}
+.gate-switch-thumb {
+  width: 12px; height: 12px; border-radius: 50%; background: var(--gate-on);
+  transform: translateX(16px); transition: transform .16s ease;
+}
+.gate-switch[aria-checked="false"] { border-color: var(--gate-off);
+  background: color-mix(in srgb, var(--gate-off) 14%, transparent); }
+.gate-switch[aria-checked="false"] .gate-switch-thumb { transform: translateX(0); }
+.gate-target { display: grid; min-width: 0; padding-inline-start: .35rem; }
+/* The config's own word for what reaches this endpoint (`server_name`, backend name, `map` key) and
+ * the trunk's domain count — the page's smallest, most-clippable line, so it is the one that names
+ * itself in the row's `title`. */
+.gate-selector {
+  font-size: 11px; min-width: 0;
   overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
 }
-.pipe-detail { font-size: 11px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-/* the count sits at the node end of the label line, so the eye goes from the number straight
-   into the pipe that carries it */
-.pipe-count {
-  margin-inline-start: auto; padding-inline-start: .5rem; flex: none;
-  font: 600 12.5px var(--mono);
-}
-/* The pipe is a grid row of its own, the full width of its column — which is what makes it touch
- * the node, since the inbound column is the node's left and the outbound column its right. */
+/* The run from the switch to the endpoint — the part that moves. The base rule carries the shape
+ * and nothing else: no `stroke`, so colour is a claim a state class has to make. `page-gateway.js`
+ * puts `on` on every pipe it draws (drawn ⇒ in the config), which is the only reason any of them
+ * are visible at all, and `off` is the styled-but-unreachable half of the pair until a config write
+ * path exists. */
 .pipe { display: block; width: 100%; min-width: 0; height: 10px; }
-.pipe-path { fill: none; stroke: var(--border-strong); stroke-width: 2; stroke-dasharray: 7 9; }
-/* One connection is enough to move. The dash travels the pipe's own direction, which is
- * *towards* the node in the inbound column and *away from* it in the outbound one — the node is
- * the far end of one and the near end of the other, so one keyframe is the whole direction
- * story and a reversed second one would only be a second thing to keep in step. */
-.pipe.live .pipe-path { stroke: var(--accent); animation: pipe-flow 1.2s linear infinite; }
-/* Zero is a static, faint line rather than an absent one: "this pipe exists and carries nothing"
- * is a fact the drawing has to be able to say, and it is a different sentence from `n/a`. */
-.pipe.still .pipe-path { stroke: var(--text-faint); stroke-dasharray: 3 7; opacity: .55; }
+.pipe-path { fill: none; stroke-width: 2; stroke-dasharray: 7 9; }
+.pipe.on .pipe-path { stroke: var(--gate-on); }
+.pipe.off .pipe-path { stroke: var(--gate-off); }
+/* One open connection is enough to move, and motion is the **only** thing `live` claims: the colour
+ * comes from `on`/`off`, so a busy pipe and a resting one are the same green. The dash runs from the
+ * switch end to the endpoint end. One keyframe for every line on the page, and a reversed second one
+ * would only be a second thing to keep in step. */
+.pipe.live .pipe-path { animation: pipe-flow 1.2s linear infinite; }
+/* Zero is a static, tighter line rather than an absent one: "the config routes here and nothing is
+ * open on it right now" is a fact the drawing has to be able to say, and it is a different sentence
+ * from the `—` a name target prints. The class says *nothing on it this instant*; it does not say
+ * "idle route", which is why the colour stays the config's green. */
+.pipe.still .pipe-path { stroke-dasharray: 4 8; }
 @keyframes pipe-flow {
   /* one full dash+gap cycle (7 + 9), so the loop is seamless */
   from { stroke-dashoffset: 0; }
   to { stroke-dashoffset: -16; }
 }
+/* The trunk's label line and the leaf's: which port, how many are on it, who is on it, and how many
+   domains it serves. Task 06 measured the alternative on live data — one `nowrap` flex line with a
+   `flex: none` count squeezed the name to seven characters of a 40-character target, and wrapping
+   the text inside that squeezed box tore one hostname over eleven lines. So the name claims the
+   line (`max-content` base size: a name longer than the column is alone on it and gets the whole
+   column) and the count, clients and domain list wrap beneath. What is still clipped after that is a
+   target longer than the column, which is a column-width fact (AGENTS.md gap 13) and not a lost one:
+   the row carries the full string as `title` and the pipe's `aria-label` carries the whole endpoint,
+   which `test_a_clipped_pipe_label_keeps_its_full_text_on_the_element` pins. */
+.pipe-name {
+  flex: 1 1 max-content; font-size: 11.5px; min-width: 0;
+  overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+}
+/* the count sits at the line end of the trunk, so the eye goes from the number straight into the
+   lines that carry it; in a leaf row the count is its own grid column and this is just its type */
+.pipe-count {
+  margin-inline-start: auto; padding-inline-start: .5rem; flex: none;
+  font: 600 12.5px var(--mono);
+}
 .pipe-clients { font-size: 10.5px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+/* The sentence a trunk gets when its config names no target — this fleet's `:80` `return 301`. A
+   refusal is content, so it is the same size as the leaves it stands in for. */
+.gate-none { font-size: 11.5px; }
 .pipe-empty { font-size: 12px; }
-.gate-groups { list-style: none; margin: 0; padding: 0; display: grid; gap: .3rem; }
-.gate-groups li { display: flex; gap: .45rem; align-items: baseline; min-width: 0; }
-.gate-groups .pipe-name { flex: none; }
 
 @media (max-width: 640px) {
-  .pipe-columns,
-  .pipe-columns.solo-out,
-  .pipe-columns.solo-in { grid-template-columns: minmax(0, 1fr); }
-  .pipe-node { max-width: none; width: 100%; }
+  /* One column, trunk above its leaves: 320 px of card has no room for a line and a label side by
+   * side, and an unlabelled line is one nobody can read. DOM order is already trunk-then-leaves, so
+   * the stack needs nothing but the track list. */
+  .gate-group { grid-template-columns: minmax(0, 1fr); }
+  /* The trunk is now *above* the fan-out rather than beside it, so the first row's upper half comes
+   * back and reaches up through the group's `row-gap` — otherwise the spine dangles below a trunk it
+   * is no longer touching. The reach is `var(--gate-row-gap)` rather than a literal, which is what
+   * keeps it exact if the group's rhythm ever moves. */
+  .gate-link:first-child::before {
+    display: block;
+    top: calc(var(--gate-row-gap) * -1); height: calc(50% + var(--gate-row-gap));
+  }
+  /* The switch and its row never shrink: a 34 px pill that squashed to fit a phone would stop
+   * reading as the same control the desktop row draws. */
+  .gate-switch, .gate-switch-thumb { flex: none; }
 }
 
 /* ---- dialog ------------------------------------------------------------- */
@@ -1419,7 +1537,11 @@ footer.pagefoot {
   /* `/gateway`'s pipes, **both states**. The animated rule out-specifies the base one exactly
    * the way `.is-open` out-specifies `nav.tabs`, so stilling the static state alone would leave
    * a live pipe flowing for someone who asked for no motion — the same phase-46 lesson the menu
-   * pair above carries, applied the day a second animated component landed in this sheet. */
+   * pair above carries, applied the day a second animated component landed in this sheet. The
+   * switch's knob is the third animated thing on the page and is named with them: a block that
+   * stills the pipes and leaves the thumb sliding is the same lesson unlearned. */
   .pipe.live .pipe-path,
   .pipe.still .pipe-path { animation: none; }
+
+  .gate-switch-thumb { transition: none; }
 }
diff --git a/src/dashboards/web/static/page-gateway.js b/src/dashboards/web/static/page-gateway.js
index 0ae3ed4..2e4d75a 100644
--- a/src/dashboards/web/static/page-gateway.js
+++ b/src/dashboards/web/static/page-gateway.js
@@ -1,24 +1,39 @@
-/* Gateway page: what this ingress is connected to, and how much is on right now.
+/* Gateway page: the two config files, drawn as the connections they declare.
 
  `/system` answers what the gateway box is doing. This answers the topology question it cannot:
- which sockets face inbound, where each one's traffic goes, and how many connections are live on
- each. The source is `/api/gateway/snapshot` — `sources/gateway.py`'s join of the agent's
- `haproxy` and `nginx` config parses with its `/proc/net/tcp{,6}` tallies.
+ which ports `haproxy.cfg` and the nginx tree open, what each of them routes to, and how many
+ connections are open on that route right now. The source is `/api/gateway/snapshot` —
+ `sources/gateway.py`'s projection of the agent's `haproxy` and `nginx` config parses joined to its
+ `/proc/net/tcp{,6}` tallies.
 
- The page draws **pipes**, and a pipe's only claim is a count. It animates while that count is at
- least one connection and rests at zero; it is never coloured by a verdict (`net.*`'s precedent:
- a busy ingress is the job, and `severity.py` rates no `gateway.*` metric). `n/a` means the join
- did not decide — a socket table that did not answer, or a port whose configured targets cannot be
- told apart — and `n/a` never becomes `0` here (rule 2).
+ **The page is two panels and the structure of each is the structure of its file.** One group per
+ listening port — the trunk — and under it one line per outbound endpoint that port's config names.
+ The stream `map` is not a panel of its own because it is nginx config: its entries are the leaves
+ of nginx's `:443` trunk, sixteen domains plus the `default` the file writes for everything nobody
+ mapped. There is no third panel and no residual: a socket neither file describes is not this
+ page's business (phase 30 task 02), and a socket table that lists more than the map draws is not
+ a fault — it is traffic the ingress does not proxy.
 
- Two rules keep the drawing honest:
+ Three rules keep the drawing honest:
 
-   * **The label is the config's own text.** A bind keeps its port, a `server_name` keeps its
-     domain, a `proxy_pass` keeps the address it was written with, and a target the join matched
-     on its port alone says `by port` rather than pretending the socket named the host.
-   * **The unreconciled remainder is printed, not hidden.** `unmatched` is the connections no
-     configured pipe claims, and it is the operator's fact that the gateway talks to something
-     the configs do not name.
+ * **A line exists because a config says so, and its colour is that fact.** Every row is a route the
+   file declares, whether or not a socket is open on it, so a resting line is not a dead one — it is
+   the same green. `--gate-on` means "written in a proxy config" and `--gate-off` means the opposite;
+   neither is a verdict, because `severity.py` has no `gateway.*` row and the payload carries no
+   `severity` at any depth. Motion means exactly one other thing: at least one ESTABLISHED socket on
+   that pipe right now.
+ * **The label is the config's own text.** A bind keeps its port, a `server_name` keeps its domain,
+   a `proxy_pass` keeps the address it was written with, a stream route keeps the SNI key the `map`
+   matched on — the payload's `selectors`, printed verbatim.
+ * **`—` means nobody could count it, and there is exactly one reason.** The config wrote its target
+   as a **name** — `reeseapps-brain.reeselink.com:443` against the `10.1.1.106:443` `/proc` reports
+   — and nothing in this stack resolves one to the other. It is never `0` (rule 2), and it is not
+   the `n/a` a trunk prints when the socket table itself went quiet.
+
+ The switch on each line says what the config says (in the config = on, and every line the payload
+ sends is on). It is a real `role="switch"` button and it is not wired: toggling a route needs a
+ config write path this app does not have, by invariant 1, so it carries `aria-disabled="true"` and a
+ `title` that says so, and no listener is bound to it anywhere in this file.
 
  Charts follow the `/system` discipline: one collapsed `<details>` per card, painted only while
  open, fed by **one** `/api/gateway/history` request per card per refresh naming every gauge that
@@ -37,7 +52,9 @@ const state = {
   rangeKey: '24h',
   every: 30,                // GATEWAY_INTERVAL_SECONDS, from /api/config — never guessed here
   cards: new Map(),         // card key -> its element (the skeletons the page ships)
-  rows: new Map(),          // card key -> Map(pipe key -> row element): patched, not rebuilt
+  groups: new Map(),        // card key -> Map(port -> group element): reordered, not rebuilt
+  rows: new Map(),          // card key -> Map(connection id -> row element): patched, not rebuilt
+  warnings: new Map(),      // warning id -> its <li>, so a poll patches rather than re-writes
   charts: new Map(),        // card key -> LineChart, built on first expand only
   history: new Map(),       // card key -> { range, response } from the last snapshot pass
   snapshot: null,           // last payload, so a toggle paints without fetching
@@ -47,108 +64,144 @@ const state = {
   pollMs: 15000,
 };
 
-// ---- the cards --------------------------------------------------------------
+// ---- the panels -------------------------------------------------------------
 //
-// One card per source family, keyed on the payload's own `source` word plus `unmatched`. That
-// keying is not a layout preference: `source` is the only fact in the document that says which
-// config a pipe came from, and the stream fan-out's pipes are `map`-sourced while the listener
-// they are reached through is an `nginx` one — so the map card is outbound by construction, and
-// joining the two would be the page inventing a relationship the agent never reported.
+// One panel per config file, keyed on the payload's own `source` word. That keying is not a layout
+// preference: `source` is the only fact in the document that says which file a route was declared
+// in. nginx first because its `:443` stream `map` is this fleet's widest fan-out and the file an
+// operator edits most; there is no third panel, because a `map` route is declared in an nginx
+// `stream` block and filing its fan-out under a heading of its own drew one config's routes as two
+// unrelated lists.
 const CARDS = [
-  { key: 'haproxy', title: 'haproxy', section: 'haproxy',
-    empty: 'haproxy names no listening port on this host' },
   { key: 'nginx', title: 'nginx', section: 'nginx',
     empty: 'nginx names no listening port on this host' },
-  { key: 'map', title: 'the stream map', section: 'nginx',
-    empty: 'the stream map routes to nothing' },
+  { key: 'haproxy', title: 'haproxy', section: 'haproxy',
+    empty: 'haproxy names no listening port on this host' },
 ];
 
 const CHART_HEIGHT = 120;
 const COUNT_FORMAT = (v) => num(v, 0);
 const CLIENTS_SHOWN = 2;
 
+/** The unknown as the leaf prints it: a dash, not a repeated column of identical words. */
+const NO_COUNT = '—';
+
+/** Why a leaf has no number — the same sentence every such line gives, on `title`. */
+const NO_COUNT_WHY = 'not attributed: the config names this endpoint as a name, '
+  + 'and nothing here resolves names';
+
+/** The sentence a trunk with nothing hanging off it gets instead of an empty leaf list. */
+const NO_TARGET = 'no target named in the config';
+
 /** The measured count as text; the unknown is `null` so `setTxt` prints `n/a` and not `0`. */
 function countText(value) {
   return typeof value === 'number' && isFinite(value) ? num(value, 0) : null;
 }
 
-/** One pipe family's pipes, split on the payload's own `source` word. */
-function familyPipes(snapshot, key) {
-  return {
-    inbound: (snapshot.inbound || []).filter((pipe) => pipe.source === key),
-    outbound: (snapshot.outbound || []).filter((pipe) => pipe.source === key),
-  };
+/**
+ * One panel's groups: every listening port the file names, with the connections under it.
+ *
+ * Ports ascending (the order an operator reads a config: 80, 443, 4443…) and connections in payload
+ * order, which is config order. A listener with **no** connection still produces a group: this
+ * fleet's nginx `:80` vhost is a `return 301` with no `proxy_pass`, and drawing nothing for it
+ * would turn "this port serves no target" into "this port does not exist". A connection whose
+ * `in.port` no listener carries also gets its group — the source pins that cannot happen, and if it
+ * ever did, the line belongs on the page rather than in a gap between two loops.
+ */
+function groupsFor(snapshot, key) {
+  const byPort = new Map();
+
+  function groupFor(port) {
+    let group = byPort.get(port);
+    if (!group) {
+      group = { port, listener: null, connections: [] };
+      byPort.set(port, group);
+    }
+    return group;
+  }
+
+  (snapshot.listeners || []).forEach((row) => {
+    if (row.source !== key || typeof row.port !== 'number') return;
+    groupFor(row.port).listener = row;
+  });
+  (snapshot.connections || []).forEach((row) => {
+    const port = (row.in || {}).port;
+    if (row.source !== key || typeof port !== 'number') return;
+    groupFor(port).connections.push(row);
+  });
+  return Array.from(byPort.values()).sort((a, b) => a.port - b.port);
 }
 
-/** `host:port` -> the stream-map keys that route to it, out of `nginx.map_targets`. */
-function mapKeys(snapshot) {
-  const keys = new Map();
-  ((snapshot.nginx || {}).map_targets || []).forEach((entry) => {
-    if (!entry || !entry.key) return;
-    const name = `${entry.host}:${entry.port}`;
-    const list = keys.get(name) || [];
-    list.push(entry.key);
-    keys.set(name, list);
-  });
-  return keys;
+/** The endpoint a line names, spelled the way the config wrote it (`host`, `host:port`). */
+function endpointText(out) {
+  const host = (out || {}).host || '?';
+  const port = (out || {}).port;
+  return `${host}${port == null ? '' : `:${port}`}`;
 }
 
 /**
- * The label a pipe carries.
+ * The line's second row: the config's own word(s) for what reaches this endpoint, then its kind.
  *
- * Inbound is a port, because that is what the config binds. Outbound is the address the config
- * was written with, and for a stream-map target the SNI name the map matched on rides in front of
- * it — both of those strings are the document's own, and nothing here resolves or reverses one.
+ * `selectors` is a haproxy backend name, a vhost's `server_name`s, a stream `map` key, or the
+ * literal `default`; `kind` is which of those it is. Both are the document's text, joined and never
+ * paraphrased — which is the whole reason one target can be read two ways (`:4443 → keycloak`
+ * reached as `keycloak.reeseapps.com` and as `admin.keycloak.reeseapps.com`) without the page
+ * having to know what a vhost is.
  */
-function pipeName(pipe, keys) {
-  if (pipe.port != null) return `:${pipe.port}`;
-  const target = pipe.target || {};
-  const host = target.host || '?';
-  const endpoint = `${host}${target.port == null ? '' : `:${target.port}`}`;
-  const through = keys ? keys.get(`${target.host}:${target.port}`) : null;
-  return through && through.length === 1 ? `${through[0]} → ${endpoint}` : endpoint;
+function selectorText(out) {
+  const selectors = ((out || {}).selectors) || [];
+  const kind = (out || {}).kind || null;
+  const words = selectors.join(' ');
+  if (!words) return kind;
+  return kind ? `${words} · ${kind}` : words;
 }
 
-/** A pipe's stable identity: its own gauge name, unique per listen port and per target. */
-function pipeKey(pipe) {
-  return pipe.metric || `${pipe.port}`;
-}
-
-/** The row's footnote: the haproxy `server` name, or the count of map keys on one endpoint. */
-function pipeDetail(pipe, keys) {
-  const target = pipe.target || {};
-  if (target.name) return `server ${target.name}`;
-  const through = keys ? keys.get(`${target.host}:${target.port}`) : null;
-  if (through && through.length > 1) return `${through.length} map names`;
-  return null;
-}
-
-/** The accessible sentence for one pipe — every figure in it came from the payload. */
-function pipeAria(direction, pipe, keys) {
-  const bits = [direction === 'in' ? 'inbound pipe' : 'outbound pipe'];
-  bits.push(direction === 'in' ? `port ${pipe.port}` : `to ${pipeName(pipe, keys)}`);
-  const domains = pipe.domains || [];
-  if (domains.length) bits.push(`names ${domains.join(', ')}`);
-  const clients = pipe.clients || [];
-  if (clients.length) bits.push(`clients ${clients.join(', ')}`);
-  bits.push(pipe.connections == null ? 'connections unknown'
-                                     : `${pipe.connections} connections`);
+/**
+ * The accessible sentence for one line — every figure in it came from the payload.
+ *
+ * The label is ellipsised by CSS at a desktop width (AGENTS.md gap 13), so this is the version that
+ * never truncates: the whole endpoint, every selector, the inbound port, and whether the count is
+ * a measurement or a `—`.
+ */
+function leafAria(conn, on) {
+  const out = conn.out || {};
+  const bits = [`connection from :${(conn.in || {}).port} to ${endpointText(out)}`];
+  const selectors = out.selectors || [];
+  if (selectors.length) bits.push(`reached by ${selectors.join(', ')}`);
+  if (out.name) bits.push(`server ${out.name}`);
+  if (conn.shared === true) bits.push('this endpoint is shared with another route');
+  // The state word is what the green *means*. A reader who cannot see the colour gets the same
+  // answer it gives, and it is an existence sentence, never a verdict: "in the config", not "good".
+  bits.push(on ? 'in the config' : 'not in the config');
+  bits.push(conn.connections == null ? 'connections not attributed'
+                                     : `${conn.connections} live connections`);
   return bits.join(', ');
 }
 
-/** The pipe itself: hand-rolled SVG — one path, `role="img"`, an `aria-label` of its own. */
+/** The tooltip text for a line: the endpoint and its selectors, the whole string however CSS clips it. */
+function leafTitle(conn) {
+  const text = endpointText(conn.out);
+  const words = selectorText(conn.out);
+  return words ? `${text} — ${words}` : text;
+}
+
+/** The line itself: hand-rolled SVG — one path, `role="img"`, an `aria-label` of its own. */
 function buildPipe() {
   const svg = document.createElementNS(SVG_NS, 'svg');
-  svg.setAttribute('class', 'pipe still');
+  // No `on` here: the state classes are the payload pass's (`renderLeaf`), so a row that is built and
+  // then never rendered draws nothing rather than drawing a confident green line.
+  svg.setAttribute('class', 'pipe');
   svg.setAttribute('viewBox', '0 0 100 10');
   svg.setAttribute('preserveAspectRatio', 'none');
   svg.setAttribute('focusable', 'false');
   const path = document.createElementNS(SVG_NS, 'path');
   path.setAttribute('class', 'pipe-path');
-  // One geometry for both columns: the dash runs from x=0 to x=100, which is *towards* the
-  // gateway node in the inbound column and *away from* it in the outbound one. The node is the
-  // far end of one and the near end of the other, so a single keyframe is the whole direction
-  // story and a reversed second one would be a second thing to keep in step.
+  // Straight across the run: the switch end is x=0 and the endpoint end is x=100, so the dash leaves
+  // the switch and travels to the target. The rest of the connection — the branch's spine, the tick
+  // out of it, the switch, the label — is CSS on the row (`.gate-link::before`/`::after`,
+  // `.gate-elbow`), which is why this path is one horizontal line and not a bent one: the bend is the
+  // *list's* shape (one tick per leaf off one spine) and a measured path would have to re-measure
+  // every poll to stay honest.
   path.setAttribute('d', 'M0 5 H100');
   path.setAttribute('vector-effect', 'non-scaling-stroke');
   svg.appendChild(path);
@@ -156,187 +209,342 @@ function buildPipe() {
 }
 
 /**
- * A pipe row: the label line (name, `by port`, the config's own name for the target, count),
- * the SVG pipe under it, and the client addresses under that. Built once, patched afterwards.
+ * A drawn connection's existence state: green means a proxy config declares the route.
  *
- * The pipe is the full width of its column, which is what makes it touch the node: the inbound
- * column is the node's left and the outbound column its right, so one geometry pointing right
- * runs *into* the gateway in one column and *away from* it in the other.
+ * Every row in `connections[]` came out of one of the two config files — `sources/gateway.py`
+ * publishes no other kind, and the socket table decides a *count*, never an existence — so this is
+ * `true` for everything the page draws, today. It is a function rather than a literal because the
+ * write path lands **here**: switching a route off is a config edit, and until this app can write a
+ * config (invariant 1) it cannot honestly say `off` about a route it has just read from a file. The
+ * `off` styling exists so that day is a one-line change and not a redesign.
  */
-function pipeRow(direction) {
-  const el = document.createElement('div');
-  el.className = `pipe-row ${direction}`;
-  el.innerHTML = `
-    <span class="pipe-label">
-      <span class="pipe-name mono"></span>
-      <span class="chip pipe-flag" hidden></span>
-      <span class="pipe-detail faint" hidden></span>
-      <span class="pipe-count"></span>
-    </span>
-    <span class="pipe-clients faint" hidden></span>`;
-  el.insertBefore(buildPipe(), el.querySelector('.pipe-clients'));
-  return el;
+function routeInConfig() {
+  return true;
 }
 
 /**
- * Patch one row from its pipe.
+ * The switch: the pill from the operator's sketch, and nothing it cannot do.
  *
- * Every string here is upstream-provided — a `server_name`, a `proxy_pass`, a client address —
- * so it goes out through `textContent` and `title`, never through markup.
+ * A real `<button role="switch">` with a real accessible name, because "the config has this route"
+ * is a reading the page is allowed to make and a toggle-shaped `<span>` would hide it. It is
+ * **drawn, not wired**: this app writes to no upstream (invariant 1), so a route is turned off by
+ * editing `haproxy.cfg` or an nginx `server` block and by nothing in a browser. Hence
+ * `aria-disabled="true"` — which keeps it in the a11y tree, where the sentence lives, unlike
+ * `disabled`, which would take that reading away from the people who need it most — a `title` that
+ * names the missing write path instead of promising a click, and **no listener anywhere in this
+ * file** (`test_the_switch_is_built_and_explicitly_unwired` fails the day that changes).
+ * `aria-checked` is written by `renderLeaf`, so the switch says what its row says rather than what a
+ * static attribute guessed.
  */
-function renderPipeRow(el, direction, pipe, keys) {
-  const name = el.querySelector('.pipe-name');
-  const text = pipeName(pipe, keys);
-  if (name.textContent !== text) name.textContent = text;
-  const domains = pipe.domains || [];
-  name.title = domains.length ? domains.join(', ') : text;
-
-  const flag = el.querySelector('.pipe-flag');
-  const byPort = !!(pipe.target && pipe.target.by_port);
-  flag.hidden = !byPort;
-  if (byPort) {
-    setTxt(flag, 'by port');
-    flag.title = 'matched on the port alone — this target is a name and the port carries more '
-      + 'than one configured host, so the count is the port\'s, not this target\'s';
-  } else {
-    flag.removeAttribute('title');
-  }
-
-  // the config's own label for this target — the haproxy `server` name, or how many map names
-  // arrive at one endpoint
-  const detail = el.querySelector('.pipe-detail');
-  const note = pipeDetail(pipe, keys);
-  detail.hidden = note == null;
-  if (note != null) setTxt(detail, note);
-
-  const shown = countText(pipe.connections);
-  setTxt(el.querySelector('.pipe-count'), shown);
-
-  const svg = el.querySelector('.pipe');
-  const live = typeof pipe.connections === 'number' && isFinite(pipe.connections)
-    && pipe.connections > 0;
-  svg.classList.toggle('live', live);
-  svg.classList.toggle('still', !live);
-  svg.setAttribute('role', 'img');
-  const aria = pipeAria(direction, pipe, keys);
-  if (svg.getAttribute('aria-label') !== aria) svg.setAttribute('aria-label', aria);
-
-  // The clients are the row's third line and its tooltip: the addresses are the operator's
-  // shortest path from "this port is busy" to "that machine is busy".
-  const clients = (pipe.clients || []).slice(0, CLIENTS_SHOWN);
-  const rest = (pipe.clients || []).length - clients.length;
-  const track = el.querySelector('.pipe-clients');
-  const shown2 = clients.length ? `${clients.join(' ')}${rest > 0 ? ` +${rest}` : ''}` : '';
-  track.hidden = shown2.length === 0;
-  setTxt(track, shown2);
+function buildSwitch() {
+  const button = document.createElement('button');
+  button.className = 'gate-switch';
+  button.type = 'button';
+  button.setAttribute('role', 'switch');
+  button.setAttribute('aria-disabled', 'true');
+  button.title = 'Toggling a route is not wired up yet — it needs a config write path. '
+    + 'This switch shows what the config says.';
+  const thumb = document.createElement('span');
+  thumb.className = 'gate-switch-thumb';
+  button.appendChild(thumb);
+  return button;
 }
 
-/** Make a column's rows match `pipes`, patching the ones that stay and dropping the rest. */
-function renderPipes(card, direction, key, pipes, keys) {
-  const box = card.querySelector(`[data-k="${direction}"]`);
-  const seen = state.rows.get(key) || new Map();
-  state.rows.set(key, seen);
-  const wanted = new Set();
-  pipes.forEach((pipe) => {
-    const id = `${direction}:${pipeKey(pipe)}`;
-    wanted.add(id);
-    let row = seen.get(id);
-    if (!row) {
-      row = pipeRow(direction);
-      seen.set(id, row);
-      box.appendChild(row);
-    }
-    renderPipeRow(row, direction, pipe, keys);
-  });
-  Array.from(seen.keys()).forEach((id) => {
-    if (wanted.has(id) || !id.startsWith(`${direction}:`)) return;
-    seen.get(id).remove();
-    seen.delete(id);
-  });
-  // An empty column collapses rather than holding half the card for nothing — which is what
-  // moves the node to the edge it is being joined to (the `solo` class below).
-  box.hidden = pipes.length === 0;
-  return pipes.length;
-}
-
-/** The gateway node: one rounded rect mid-card, labelled with the host the reading came from. */
-function renderNode(card, snapshot, columns) {
-  const node = card.querySelector('[data-k="node"]');
-  const visible = columns.inCount + columns.outCount > 0;
-  node.hidden = !visible;
-  // One column of pipes only: the node moves to the edge it is joined to instead of floating in
-  // the middle of an empty half-card. Two classes, because *which* half is empty decides which
-  // grid track the node belongs in, and one shared class could only ever be right about one.
-  const frame = card.querySelector('.pipe-columns');
-  frame.classList.toggle('solo-out', visible && columns.inCount === 0);
-  frame.classList.toggle('solo-in', visible && columns.outCount === 0);
-  const label = snapshot.host || 'gateway';
-  if (node.dataset.text !== label) {
-    node.dataset.text = label;
-    node.textContent = label;
-  }
-}
-
-// ---- the unmatched card ------------------------------------------------------
-//
-// Not pipes: there is no config to draw these from, only the socket table's own leftovers. The
-// two tallies are two different facts and never one sum — `other` counts *ports* no config
-// claims, the other counts *connections* the join could not attribute to a target.
-
-/** Does this payload leave anything unaccounted for? An all-zero family gets no card. */
 /**
- * Is there a remainder to report?
+ * The switch's accessible name: endpoint, selectors, which config file, and the state word.
  *
- * A positive count or a group, yes. Three `null`s is not "unknown worth printing" — it is the join
- * having measured nothing at all (a pre-1.2.0 agent, a silent socket table), and a card of three
- * `n/a`s says less than the page's own `why` line above it already says (the dead-cell rule).
+ * A switch with no accessible name is silence with a pill drawn on it, and this one carries the
+ * page's central claim — *this route is in the config*. So: the endpoint as the config wrote it, the
+ * config's own word for how it is reached, which of the two files it was read out of, and whether it
+ * is on. Never a count — the count is the line's own `aria-label`, and the same number in two places
+ * is two chances to disagree.
  */
-function unmatchedVisible(snapshot) {
-  const un = snapshot.unmatched || {};
-  return [un.other, un.inbound, un.outbound].some(
-    (value) => typeof value === 'number' && value > 0) || (un.groups || []).length > 0;
+function switchAria(conn, on) {
+  const bits = [endpointText(conn.out)];
+  const selectors = (conn.out || {}).selectors || [];
+  if (selectors.length) bits.push(`reached by ${selectors.join(', ')}`);
+  bits.push(`in the ${conn.source || 'gateway'} config`);
+  bits.push(on ? 'on' : 'off');
+  return bits.join(', ');
 }
 
-/** One `<li>` of the "could belong to any of N" list — built, not templated: the names are data. */
-function groupRow(group) {
+/**
+ * One leaf row, built once: elbow, switch, line, target, count.
+ *
+ * Static markup only — every string the payload owns is assigned through `textContent` afterwards,
+ * because a `server_name`, a `proxy_pass` and a client address are upstream text and this page is
+ * rendered behind a login that a stranger can aim at.
+ */
+function leafRow() {
   const li = document.createElement('li');
-  const port = document.createElement('span');
-  port.className = 'pipe-name mono';
-  port.textContent = `:${group.port}`;
-  const why = document.createElement('span');
-  why.className = 'faint';
-  const hosts = (group.hosts || []).slice(0, CLIENTS_SHOWN);
-  const rest = (group.hosts || []).length - hosts.length;
-  why.textContent = `${countText(group.connections) || 'n/a'} connections · could be any of `
-    + `${group.host_count} targets${hosts.length ? ` (${hosts.join(', ')}${rest > 0
-      ? ` +${rest}` : ''})` : ''}`;
-  li.appendChild(port);
-  li.appendChild(why);
+  li.className = 'gate-link';
+  const elbow = document.createElement('span');
+  elbow.className = 'gate-elbow';
+  elbow.setAttribute('aria-hidden', 'true');
+  const slot = document.createElement('span');
+  slot.className = 'gate-switch-slot';
+  slot.appendChild(buildSwitch());
+  const target = document.createElement('span');
+  target.className = 'gate-target';
+  const name = document.createElement('span');
+  name.className = 'pipe-name mono';
+  const selector = document.createElement('span');
+  selector.className = 'gate-selector faint';
+  selector.hidden = true;
+  target.appendChild(name);
+  target.appendChild(selector);
+  const count = document.createElement('span');
+  count.className = 'pipe-count';
+  li.appendChild(elbow);
+  li.appendChild(slot);
+  li.appendChild(buildPipe());
+  li.appendChild(target);
+  li.appendChild(count);
   return li;
 }
 
-function renderUnmatched(card, snapshot, row) {
-  const un = snapshot.unmatched || {};
-  card.hidden = false;
-  setDot(card.querySelector('[data-k="dot"]'), dotFor(row, snapshot));
-  setTxt(card.querySelector('.updated'), stalenessText(row));
-  markStale(card, dimmed(snapshot));
-  setTxt(card.querySelector('[data-k="um-other"]'), countText(un.other));
-  setTxt(card.querySelector('[data-k="um-in"]'), countText(un.inbound));
-  setTxt(card.querySelector('[data-k="um-out"]'), countText(un.outbound));
+/** Patch one leaf from its payload row. Nothing here re-derives a fact the payload did not send. */
+function renderLeaf(li, conn) {
+  const id = conn.id == null ? '' : String(conn.id);
+  if (li.dataset.id !== id) li.dataset.id = id;
+  const title = leafTitle(conn);
+  if (li.title !== title) li.title = title;
+  const on = routeInConfig(conn);
 
-  const groups = un.groups || [];
-  const list = card.querySelector('[data-k="groups"]');
-  const wanted = groups.map((group) => `${group.port}|${group.connections}|${group.host_count}`);
-  const same = list.dataset.wanted === wanted.join(',') && list.children.length === groups.length;
-  list.hidden = groups.length === 0;
-  if (same) return;
-  list.dataset.wanted = wanted.join(',');
-  list.textContent = '';
-  groups.forEach((group) => list.appendChild(groupRow(group)));
+  const name = li.querySelector('.pipe-name');
+  const text = endpointText(conn.out);
+  if (name.textContent !== text) name.textContent = text;
+
+  const selector = li.querySelector('.gate-selector');
+  const words = selectorText(conn.out);
+  selector.hidden = words == null;
+  if (words != null) setTxt(selector, words);
+
+  // A `—` is not a measurement of zero and the tooltip says which of the two it is, so the column
+  // of dashes down a `:443` fan-out reads as "these targets are names" rather than "idle".
+  const shown = countText(conn.connections);
+  const count = li.querySelector('.pipe-count');
+  setTxt(count, shown == null ? NO_COUNT : shown);
+  count.title = shown == null ? NO_COUNT_WHY : `${shown} open connection(s) on this endpoint`;
+
+  const svg = li.querySelector('.pipe');
+  const live = typeof conn.connections === 'number' && isFinite(conn.connections)
+    && conn.connections > 0;
+  // Two independent claims, two class pairs. `live`/`still` is "a socket is open on this pipe this
+  // instant" and decides motion only; `on`/`off` is "a config declares this route" and decides
+  // colour only. Keeping them apart is what stops a quiet route from looking like a dead one, and a
+  // busy one from looking healthy: neither number is graded, and `severity.py` has no `gateway.*`.
+  svg.classList.toggle('live', live);
+  svg.classList.toggle('still', !live);
+  svg.classList.toggle('on', on);
+  svg.classList.toggle('off', !on);
+  svg.setAttribute('role', 'img');
+  const aria = leafAria(conn, on);
+  if (svg.getAttribute('aria-label') !== aria) svg.setAttribute('aria-label', aria);
+
+  // The switch is patched with the same `on` the line is coloured from, so a row can never show a
+  // green pipe beside an off switch. `aria-disabled` is static markup from `buildSwitch()` and is
+  // never written here: it says "this control cannot be used", which no poll can change.
+  const sw = li.querySelector('.gate-switch');
+  const checked = on ? 'true' : 'false';
+  if (sw.getAttribute('aria-checked') !== checked) sw.setAttribute('aria-checked', checked);
+  const swAria = switchAria(conn, on);
+  if (sw.getAttribute('aria-label') !== swAria) sw.setAttribute('aria-label', swAria);
 }
 
-// ---- card chrome ---------------------------------------------------------------
+/** One group: the trunk on the left, its leaf list on the right. Static markup only. */
+function groupElement(port) {
+  const wrap = document.createElement('div');
+  wrap.className = 'gate-group';
+  wrap.dataset.port = String(port);
+  wrap.innerHTML = `
+    <div class="gate-trunk">
+      <span class="pipe-name mono"></span>
+      <span class="pipe-count"></span>
+      <span class="pipe-clients faint" hidden></span>
+      <span class="gate-selector faint" hidden></span>
+    </div>
+    <ul class="gate-leaves"></ul>`;
+  return wrap;
+}
+
+/**
+ * The trunk: the port, how many connections are open on it, who is on it, and how many domains.
+ *
+ * The live count is `n/a` and not `—` here on purpose: a trunk's count comes from the socket table,
+ * and a socket table that did not answer is a different fact from a target nobody can count. The
+ * domain list is a count with the whole list on `title` — `:443` serves sixteen names on this fleet
+ * and the sentence they make is the page's, not the operator's reading material.
+ */
+function renderTrunk(el, group) {
+  const listener = group.listener || {};
+  const port = `:${group.port}`;
+  const name = el.querySelector('.pipe-name');
+  if (name.textContent !== port) name.textContent = port;
+  setTxt(el.querySelector('.pipe-count'),
+    countText(listener.connections) == null ? null : `${countText(listener.connections)} live`);
+
+  const clients = listener.clients || [];
+  const shown = clients.slice(0, CLIENTS_SHOWN);
+  const rest = clients.length - shown.length;
+  const track = el.querySelector('.pipe-clients');
+  const list = shown.length ? `${shown.join(' ')}${rest > 0 ? ` +${rest}` : ''}` : '';
+  track.hidden = list.length === 0;
+  if (list) setTxt(track, list);
+  track.title = clients.join(' ');
+
+  // A haproxy frontend binds a port and names no `server_name`, so "how many domains" has no
+  // answer for it — the line is hidden rather than showing `n/a` beside a trunk that already says
+  // everything the config does about itself.
+  const domains = listener.domains || [];
+  const names = el.querySelector('.gate-selector');
+  const words = domains.length
+    ? `${domains.length} ${domains.length === 1 ? 'name' : 'names'}`
+    : null;
+  names.hidden = words == null;
+  if (words != null) setTxt(names, words);
+  names.title = domains.join(', ');
+}
+
+/**
+ * One group's leaf list, patched by connection id.
+ *
+ * Keyed on `conn.id` (`source:port->host:port`) rather than rebuilt, so a 17-row fan-out is not
+ * re-created every 30 s: rebuilding a row re-announces it to assistive tech for a difference of one
+ * connection, which is the slot-grid lesson. `appendChild` of the existing node is what reorders.
+ * A group with no connection gets the refusal sentence instead of an empty list, keyed so it goes
+ * away the poll a target appears.
+ */
+function renderLeaves(listEl, key, group) {
+  const rows = state.rows.get(key);
+  const wanted = new Set();
+  group.connections.forEach((conn) => {
+    const id = conn.id == null ? `n:${group.port}:${endpointText(conn.out)}` : String(conn.id);
+    wanted.add(id);
+    let li = rows.get(id);
+    if (!li) {
+      li = leafRow();
+      rows.set(id, li);
+    }
+    listEl.appendChild(li);
+    renderLeaf(li, conn);
+  });
+  const emptyId = `empty:${group.port}`;
+  if (group.connections.length === 0) {
+    wanted.add(emptyId);
+    let none = rows.get(emptyId);
+    if (!none) {
+      none = document.createElement('li');
+      none.className = 'gate-none faint';
+      setTxt(none, NO_TARGET);
+      rows.set(emptyId, none);
+    }
+    listEl.appendChild(none);
+  }
+  return wanted;
+}
+
+/**
+ * Make a panel's groups and rows match the payload: patch what stayed, move what reordered,
+ * drop what left. Rows are pruned once per panel, because an id belongs to exactly one group and
+ * pruning per group would delete a line that just moved trunk.
+ */
+function renderGroups(card, key, groups) {
+  const box = card.querySelector('[data-k="map"]');
+  const built = state.groups.get(key) || new Map();
+  state.groups.set(key, built);
+  if (!state.rows.has(key)) state.rows.set(key, new Map());
+  const wantedGroups = new Set();
+  const wantedLeaves = new Set();
+  groups.forEach((group) => {
+    const id = `g:${group.port}`;
+    wantedGroups.add(id);
+    let el = built.get(id);
+    if (!el) {
+      el = groupElement(group.port);
+      built.set(id, el);
+    }
+    box.appendChild(el);                       // an existing node moves: that is the reorder
+    renderTrunk(el.querySelector('.gate-trunk'), group);
+    renderLeaves(el.querySelector('.gate-leaves'), key, group)
+      .forEach((leafId) => wantedLeaves.add(leafId));
+    // One leaf is not a branch. `.solo` takes the spine's two halves away so the row runs straight
+    // across from the trunk to its endpoint — every haproxy frontend on this fleet, which binds a
+    // port and names exactly one `server`. The test is the group's own connection count rather than
+    // a `:only-child` selector because a trunk that names no target puts the refusal `<li>` in the
+    // same list, so "one child" and "one route" are not the same thing here.
+    el.classList.toggle('solo', group.connections.length === 1);
+  });
+  Array.from(built.keys()).forEach((id) => {
+    if (wantedGroups.has(id)) return;
+    built.get(id).remove();
+    built.delete(id);
+  });
+  const rows = state.rows.get(key);
+  Array.from(rows.keys()).forEach((id) => {
+    if (wantedLeaves.has(id)) return;
+    rows.get(id).remove();
+    rows.delete(id);
+  });
+}
+
+// ---- the warnings panel -------------------------------------------------------
+
+/**
+ * The config family a warning belongs to, from the payload's own `kind`.
+ *
+ * The seven kinds are prefixed `haproxy_` / `nginx_` by `sources/gateway.py`, which is the same
+ * word the panels are keyed on, so the row says which file to open. Anything unrecognised says
+ * `gateway` rather than inventing a file — the page renders `warnings`, it never re-derives one.
+ */
+function familyWord(kind) {
+  const family = String(kind || '').split('_')[0];
+  return CARDS.some((entry) => entry.key === family) ? family : 'gateway';
+}
+
+/**
+ * The warnings list, in the overview's `ul.alerts` vocabulary, hidden when there are none.
+ *
+ * One row per payload warning: the config family as `.src`, the route's own sentence as `.msg`.
+ * `#gate-warnings` is `hidden` while the list is empty rather than an empty card — a clean ingress
+ * has nothing for an operator to act on, and a permanent "Warnings to address: 0" is the ink the
+ * empty-state rules exist to avoid, and the thing that trains the eye to skip the row that fires.
+ */
+function renderWarnings(snapshot) {
+  const rows = Array.isArray(snapshot.warnings) ? snapshot.warnings : [];
+  const list = $('#warnings-list');
+  const seen = state.warnings;
+  const wanted = new Set();
+  rows.forEach((warning) => {
+    const id = warning.id == null ? `${warning.kind}:${warning.subject}` : String(warning.id);
+    wanted.add(id);
+    let li = seen.get(id);
+    if (!li) {
+      li = document.createElement('li');
+      li.className = 'warn';
+      const src = document.createElement('span');
+      src.className = 'src';
+      const msg = document.createElement('span');
+      msg.className = 'msg';
+      li.appendChild(src);
+      li.appendChild(msg);
+      seen.set(id, li);
+    }
+    list.appendChild(li);
+    setTxt(li.querySelector('.src'), familyWord(warning.kind));
+    setTxt(li.querySelector('.msg'), warning.message);
+  });
+  Array.from(seen.keys()).forEach((id) => {
+    if (wanted.has(id)) return;
+    seen.get(id).remove();
+    seen.delete(id);
+  });
+  setTxt($('#warnings-count'), rows.length);
+  list.hidden = rows.length === 0;
+  $('#gate-warnings').hidden = rows.length === 0;
+}
+
+// ---- panel chrome -------------------------------------------------------------
 
 /** The reachability dot: the job's own health, never a number. */
 function dotFor(row, snapshot) {
@@ -358,7 +566,7 @@ function dimmed(snapshot) {
   return !!snapshot.unreachable || snapshot.supported !== true;
 }
 
-/** Every card skeleton, wired once to the markup the page ships. */
+/** Every panel skeleton, wired once to the markup the page ships. */
 function cardElements() {
   const cards = new Map();
   $$('#gate-cards [data-gate]').forEach((el) => {
@@ -372,25 +580,20 @@ function cardElements() {
 }
 
 /**
- * Paint one card from the snapshot.
+ * Paint one panel from the snapshot.
  *
- * A card appears when it has a fact: pipes of its own. A family whose config section did not
- * answer has none, and the page's own `why` line is the one sentence that says which section —
- * so the card stays off the grid instead of repeating it in a smaller font.
+ * A panel appears when it has a fact: a port its file names, or a route it declares. A family whose
+ * config section did not answer has neither, and the page's own `why` line is the one sentence that
+ * says which section — so the panel stays off the grid instead of repeating it in a smaller font.
  */
 function renderCard(card, snapshot, row) {
   const key = card.dataset.gate;
-  if (key === 'unmatched') {
-    if (unmatchedVisible(snapshot)) renderUnmatched(card, snapshot, row);
-    else card.hidden = true;
-    return;
-  }
   const definition = CARDS.find((entry) => entry.key === key);
-  const { inbound, outbound } = familyPipes(snapshot, key);
-  if (inbound.length + outbound.length === 0) {
-    // Two different nothings. The section answered and named no pipe: that is a fact about this
-    // gateway's config, and the card says it. The section did not answer at all: the page's own
-    // `why` line is the one sentence that says which section, so no card repeats it.
+  const groups = groupsFor(snapshot, key);
+  if (groups.length === 0) {
+    // Two different nothings. The section answered and named no port: that is a fact about this
+    // gateway's config, and the panel says it. The section did not answer at all: the page's own
+    // `why` line is the one sentence that says which section, so no panel repeats it.
     const answered = (snapshot.sections || {})[definition.section] === true;
     card.hidden = !answered;
     if (answered) setTxt(card.querySelector('[data-k="empty"]'), definition.empty);
@@ -398,37 +601,46 @@ function renderCard(card, snapshot, row) {
   }
   card.hidden = false;
   card.querySelector('[data-k="empty"]').hidden = true;
-  const keys = mapKeys(snapshot);
   setDot(card.querySelector('[data-k="dot"]'), dotFor(row, snapshot));
   setTxt(card.querySelector('.updated'), stalenessText(row));
   markStale(card, dimmed(snapshot));
+  const leaves = groups.reduce((total, group) => total + group.connections.length, 0);
   setTxt(card.querySelector('[data-k="counts"]'),
-    `${inbound.length} in · ${outbound.length} out`);
-
-  const columns = {
-    inCount: renderPipes(card, 'in', key, inbound, keys),
-    outCount: renderPipes(card, 'out', key, outbound, keys),
-  };
-  renderNode(card, snapshot, columns);
+    `${groups.length} ports · ${leaves} routes`);
+  renderGroups(card, key, groups);
 }
 
-// ---- per-card charts ------------------------------------------------------------
+// ---- per-panel charts ----------------------------------------------------------
 //
-// One plot per card, one request per card, every refresh: the query names every gauge that card
-// could draw (`/api/gateway/history` answers an unknown name as an empty series on purpose) and
-// the legend names **pipes**, not hosts — the card heading already says which config family this
-// is, and the page is about one machine.
+// One plot per panel, one request per panel, every refresh: the query names every gauge that panel
+// could draw (`/api/gateway/history` answers an unknown name as an empty series on purpose) and the
+// legend names **pipes**, not hosts — the panel heading already says which config file this is, and
+// the page is about one machine.
 
-/** Every gauge this card's pipes publish. */
+/**
+ * Every gauge this panel's groups publish, each labelled with the text its row carries.
+ *
+ * Two refusals, both already the source's: a line whose target the config wrote as a name has no
+ * `metric` at all (nothing ever counted it, so a series for it could only ever be empty and a chart
+ * would draw a flat line at nothing), and several lines reaching one endpoint share one gauge, which
+ * is emitted once for the same reason `samples()` de-duplicates it.
+ */
 function cardStreams(snapshot, key) {
-  const keys = mapKeys(snapshot);
-  const { inbound, outbound } = familyPipes(snapshot, key);
-  return inbound.concat(outbound)
-    .filter((pipe) => !!pipe.metric)
-    .map((pipe) => ({ metric: pipe.metric, label: pipeName(pipe, keys) }));
+  const streams = [];
+  const seen = new Set();
+  const push = (metric, label) => {
+    if (!metric || seen.has(metric)) return;
+    seen.add(metric);
+    streams.push({ metric, label });
+  };
+  groupsFor(snapshot, key).forEach((group) => {
+    if (group.listener) push(group.listener.metric, `:${group.port}`);
+    group.connections.forEach((conn) => push(conn.metric, endpointText(conn.out)));
+  });
+  return streams;
 }
 
-/** The chart inside one card, built the first time that card's stack is open. */
+/** The chart inside one panel, built the first time that panel's stack is open. */
 function cardChart(key) {
   const built = state.charts.get(key);
   if (built) return built;
@@ -458,7 +670,7 @@ function chartsOpen(key) {
   return !!(box && box.open);
 }
 
-/** Opening paints from the response this card already has, so the first expand needs no poll. */
+/** Opening paints from the response this panel already has, so the first expand needs no poll. */
 function chartsToggled(key) {
   if (!chartsOpen(key) || !state.snapshot) return;
   const cached = state.history.get(key);
@@ -481,20 +693,19 @@ function drawCardCharts(key, response) {
   chart.setData(series);
   // The legend names the lines the plot actually drew. A pipe whose join published no sample has
   // no line, and a permanent `n/a` row for it is the dead-cell anti-pattern the vLLM slot grid
-  // avoids; `LineChart`'s own "no samples yet" says the same thing once when none of them did.
-  // `setData` stamps every series with the colour its path uses, so a swatch still matches its
-  // line after the filter instead of sliding to the next one in the palette.
+  // avoids; `setData` stamps every series with the colour its path uses, so a swatch still matches
+  // its line after the filter instead of sliding to the next one in the palette.
   const plotted = chart.series.filter((s) => s.points && s.points.length);
   DashCharts.renderLegend(card.querySelector('[data-legend="conns"]'), plotted, COUNT_FORMAT,
     false);
 }
 
 /**
- * One card's history: one request, named by that card's own pipes.
+ * One panel's history: one request, named by that panel's own pipes.
  *
- * The request is per card per refresh whether or not the disclosure is open — the `/system`
- * shape, whose cached response is what lets the first expand paint from data in hand instead of
- * waiting a poll — while the *plot* is built only while it is open (`drawCardCharts`).
+ * The request is per panel per refresh whether or not the disclosure is open — the `/system` shape,
+ * whose cached response is what lets the first expand paint from data in hand instead of waiting a
+ * poll — while the *plot* is built only while it is open (`drawCardCharts`).
  */
 async function renderCardCharts(key, snapshot) {
   const definitions = cardStreams(snapshot, key);
@@ -504,77 +715,78 @@ async function renderCardCharts(key, snapshot) {
     + `&metrics=${encodeURIComponent(definitions.map((d) => d.metric).join(','))}`
     + `&range=${range}`;
   const response = await fetchJSON(query).catch(() => null);
-  if (!response || !state.cards.has(key)) return;      // the card went away mid-flight
+  if (!response || !state.cards.has(key)) return;      // the panel went away mid-flight
   state.history.set(key, response);
   drawCardCharts(key, response);
 }
 
-// ---- the page header -------------------------------------------------------------
+// ---- the page header -----------------------------------------------------------
 
 /**
- * What the pipes on one side carry: the sum of the ones that answered, plus how many did not.
+ * What the trunk side of the map carries: the live connections on configured ports, plus how many
+ * of those ports did not answer.
  *
- * This is the page's only arithmetic and it is a sum of published gauges — adding two counts is
- * neither a rate nor a verdict. A pipe whose join could not decide contributes nothing and is
- * counted in `unknown`, which is `/api/summary`'s `partial` flag drawn rather than a second
- * opinion: the sockets behind it are already inside the `unmatched` column beside it, so
- * `attributed + unmatched` stays the kernel's number and no figure on the row is invented. The
- * marker is the whole point — a total that quietly left unknowns out reads as the whole number.
+ * Two rules, both rule 2:
+ *
+ *   * **A port with no number is not a zero.** When the socket table went quiet every listener's
+ *     count is `null`, and a total of `0` there would claim an idle ingress the source never saw.
+ *     `unknown === total` therefore yields `null`, and a partial set says so in its tooltip.
+ *   * **Only the inbound side is totalled.** A trunk's count is the ESTABLISHED sockets whose local
+ *     port a config names. The outbound counts are the sockets the gateway *dialed*, and a loopback
+ *     hop is two `/proc` rows — one inbound and one outbound — so adding the two sides would book
+ *     the same traffic twice on the one number the header prints. Each leaf still carries its own.
  */
-function sumConnections(snapshot, side) {
-  const pipes = snapshot[side] || [];
-  if (!pipes.length) return null;
+function sumLive(rows) {
+  const counted = (rows || []).filter((row) => row.metric);
+  if (!counted.length) return null;
   let attributed = 0;
   let unknown = 0;
-  for (const pipe of pipes) {
-    if (typeof pipe.connections === 'number' && isFinite(pipe.connections)) {
-      attributed += pipe.connections;
-    } else {
-      unknown += 1;
-    }
-  }
-  // Nothing answered is not "nothing carrying": with every pipe unknown the side has no number at
-  // all, and `0` here would be a claim about traffic the join never measured (rule 2).
-  return unknown === pipes.length ? null : { attributed, unknown, total: pipes.length };
+  counted.forEach((row) => {
+    if (typeof row.connections === 'number' && isFinite(row.connections)) attributed += row.connections;
+    else unknown += 1;
+  });
+  return unknown === counted.length ? null : { attributed, unknown, total: counted.length };
 }
 
 /**
- * One reconciliation cell: its number, the shared `.stale` dim while it is a partial sum, and the
- * tooltip naming what is missing — `/llm`'s fleet-block idiom for a total that left something out.
+ * One tally: its number, the shared `.stale` dim while it left a port out, and the tooltip naming
+ * what is missing — `/llm`'s fleet-block idiom for a total that is not the whole number.
  */
-function setTally(id, sum) {
-  const el = $(id);
+function setTally(el, sum) {
   setTxt(el, sum == null ? null : sum.attributed);
   const metric = el.closest('.metric');
   if (metric) metric.classList.toggle('stale', !!sum && sum.unknown > 0);
-  el.title = sum == null ? 'the join did not measure this side'
-    : `${sum.attributed} of ${sum.total} pipes answered${sum.unknown
-      ? `; ${sum.unknown} could not be told apart, and their connections are under unmatched`
-      : ''}`;
+  el.title = sum == null ? 'the socket table did not answer, so nothing is measured'
+    : `${sum.attributed} open connection(s) on a port a config names`
+      + (sum.unknown ? `; ${sum.unknown} of ${sum.total} ports did not answer this poll` : '');
 }
 
+/**
+ * The four tallies, every one of them the payload's own figure.
+ *
+ * `ports` and `connections` are row counts — config facts, known whenever the agent answered — and
+ * `warnings` is the config-integrity count from the same reading, so a clean ingress prints a real
+ * `0`. `live` is the one socket fact. All four print `n/a` in the arms that did not measure (a host
+ * that never answered, an agent that predates the sections), because `0 routes` about a config nobody
+ * read is a claim, not an absence.
+ */
 function renderHeader(snapshot) {
-  const sockets = snapshot.sockets || {};
-  const un = snapshot.unmatched || {};
-  const unmatched = un.inbound == null && un.outbound == null
-    ? null : (un.inbound || 0) + (un.outbound || 0);
-  setTxt($('#t-listeners'), countText(sockets.listens));
-  setTxt($('#t-established'), countText(sockets.established));
-  setTally('#t-inbound', sumConnections(snapshot, 'inbound'));
-  setTally('#t-outbound', sumConnections(snapshot, 'outbound'));
-  setTxt($('#t-unmatched'), countText(unmatched));
+  const measured = !dimmed(snapshot);
+  setTxt($('#t-ports'), measured ? (snapshot.listeners || []).length : null);
+  setTxt($('#t-connections'), measured ? (snapshot.connections || []).length : null);
+  setTally($('#t-live'), sumLive(snapshot.listeners));
+  setTxt($('#t-warnings'), measured ? (snapshot.warnings || []).length : null);
   markStale($('#tallies'), dimmed(snapshot));
   $('#sub').textContent = `${snapshot.host || 'gateway'} · agent `
     + `${snapshot.agent_version || 'n/a'} · `
-    + `${(snapshot.inbound || []).length} inbound pipes · `
-    + `${(snapshot.outbound || []).length} outbound`;
+    + `${measured ? `${(snapshot.connections || []).length} connections` : 'n/a'}`;
   const banner = $('#gate-banner');
   const why = snapshot.why || null;
   banner.hidden = why == null;
   if (why != null) setTxt(banner, why);
 }
 
-// ---- snapshot ----------------------------------------------------------------------
+// ---- snapshot --------------------------------------------------------------------
 
 async function refresh() {
   let snapshot;
@@ -596,8 +808,8 @@ async function refresh() {
   (snapshot.states || []).forEach((row) => { states[row.dashboard || row.key] = row; });
   const row = states.gateway;
   renderHeader(snapshot);
+  renderWarnings(snapshot);
   CARDS.forEach((definition) => renderCard(state.cards.get(definition.key), snapshot, row));
-  renderCard(state.cards.get('unmatched'), snapshot, row);
 
   const visible = CARDS.filter((definition) => !state.cards.get(definition.key).hidden)
     .map((definition) => definition.key);
@@ -605,20 +817,21 @@ async function refresh() {
   await Promise.all(visible.map((key) => renderCardCharts(key, snapshot)));
 }
 
-/** Clear the row and chart state of every family that left the payload. */
+/** Clear the group, row and chart state of every family that left the payload. */
 function pruneCards(visible) {
   CARDS.forEach((definition) => {
     if (visible.includes(definition.key)) return;
     const card = state.cards.get(definition.key);
     if (card) {
       card.hidden = true;
-      const rows = state.rows.get(definition.key);
-      if (rows) rows.clear();
+      const box = card.querySelector('[data-k="map"]');
+      if (box) box.innerHTML = '';
     }
+    state.groups.delete(definition.key);
     state.rows.delete(definition.key);
     state.history.delete(definition.key);
-    // The `LineChart` instance stays: a card is hidden rather than removed, so its plot is
-    // built once and repainted whenever the family comes back.
+    // The `LineChart` instance stays: a panel is hidden rather than removed, so its plot is built
+    // once and repainted whenever the family comes back.
   });
 }
 
@@ -631,7 +844,7 @@ document.addEventListener('DOMContentLoaded', async () => {
       state.every = gateway.interval_seconds;
     }
     if (gateway.enabled === false) {
-      // The unconfigured arm before the first request: the setup block, no cards, and no poll
+      // The unconfigured arm before the first request: the setup block, no panels, and no poll
       // loop dialling a route that answers 404 forever (invariant 3).
       $('#sub').textContent = gateway.host
         ? `no host named ${gateway.host} in HOST_TARGETS — set GATEWAY_HOST`
diff --git a/src/dashboards/web/static/page-index.js b/src/dashboards/web/static/page-index.js
index c7f7cd2..fa26fff 100644
--- a/src/dashboards/web/static/page-index.js
+++ b/src/dashboards/web/static/page-index.js
@@ -96,26 +96,39 @@ function renderAlerts(alerts) {
   }).join('');
 }
 
-/* The two figures the overview's ingress line prints, in the order it prints them. Each `key` is
+/* The four figures the overview's ingress line prints, in the order it prints them. Each `key` is
  * a key of `/api/summary`'s `gateway` block, and `tests/test_api.py` resolves this table against
  * the payload the route actually serves (the `SLOT_FIELDS` device): a rename on either side fails
- * there rather than printing `n/a` beside a busy ingress. */
+ * there rather than printing `n/a` beside a busy ingress. The first two are what the two config
+ * files **declare** and the last two what the kernel's socket table **answered**, which is why
+ * they are four fields and never one pair. */
 const GATEWAY_FIELDS = [
-  { key: 'inbound', word: 'inbound' },
-  { key: 'outbound', word: 'outbound' },
+  { key: 'listeners', word: 'listeners' },
+  { key: 'connections', word: 'connections' },
+  { key: 'live_in', word: 'live in' },
+  { key: 'live_out', word: 'live out' },
 ];
 
+/* The fifth figure is not in the table above because it prints **only when it is non-zero**: a
+ * clean ingress has no config to fix, and a permanent ` · 0 to address` would be the ink the
+ * empty-state rules exist to avoid. `key` is still a key of the `gateway` block (the test resolves
+ * it against a live document), and a `null` — an ingress that never answered — is not `> 0`, so
+ * the unknown arm prints nothing rather than a number nobody measured. */
+const GATEWAY_WARNING_FIELD = { key: 'warnings', word: 'to address' };
+
 /**
- * The ingress's one line under the fleet table: the pipe totals `/api/summary` summed, linked to
- * the page that draws them.
+ * The ingress's one line under the fleet table: the ingress's own tallies, linked to the page
+ * that draws the map behind them.
  *
  * Nothing here is counted in the browser and nothing here is a route. The link is the block's own
  * `href` (`alerts.py`'s table is where a dashboard's page is written, the same rule the alert rows
- * keep), the counts are that block's sums of the pipes, and `n/a` is what a `null` prints: an
- * agent that has not answered, one that predates the proxy sections, and a socket table that did
- * not reply all measured **nothing**, which is not the sentence "0 connections" (rule 2).
- * `configured: false` renders no line at all — the `disks` block's invariant-3 rule: an ingress
- * nobody installed gets no row here and no red one to learn to ignore.
+ * keep), the figures are that block's, and `n/a` is what a `null` prints: an agent that has not
+ * answered, one that predates the proxy sections, and a socket table that did not reply all
+ * measured **nothing**, which is not the sentence "0 connections" (rule 2). A route the config
+ * wrote as a name is `null` in the live pair for the same reason — the agent resolves nothing, so
+ * nobody ever counted its sockets. `configured: false` renders no line at all — the `disks`
+ * block's invariant-3 rule: an ingress nobody installed gets no row here and no red one to learn
+ * to ignore.
  */
 function renderGateway(gateway) {
   const row = $('#fleet-gate');
@@ -128,15 +141,16 @@ function renderGateway(gateway) {
   row.hidden = false;
   // the shared dim for "these are the last good numbers" (invariant 4)
   row.classList.toggle('stale', block.unreachable === true);
-  const why = block.unreachable === true ? `${block.host} is not answering`
-    : block.partial ? 'a pipe could not be told from another on its port, so the total leaves it out'
-      : '';
   const counts = GATEWAY_FIELDS
     .map(({ key, word }) => `${num(block[key], 0)} ${word}`).join(' · ');
+  // the config-integrity tally, and only when there is one (`null` and `0` both print nothing)
+  const warn = Number.isInteger(block[GATEWAY_WARNING_FIELD.key])
+    && block[GATEWAY_WARNING_FIELD.key] > 0
+    ? ` · ${block[GATEWAY_WARNING_FIELD.key]} ${GATEWAY_WARNING_FIELD.word}` : '';
   row.innerHTML = `<a href="${DashCharts.escapeHtml(String(block.href || ''))}">`
     + `${DashCharts.escapeHtml(String(block.host || ''))}</a> `
-    + `${DashCharts.escapeHtml(counts)}`;
-  if (why) row.title = why;
+    + `${DashCharts.escapeHtml(counts + warn)}`;
+  if (block.unreachable === true) row.title = `${block.host} is not answering`;
 }
 
 /**
diff --git a/tests/test_alerts.py b/tests/test_alerts.py
index ef8dec6..2f53c38 100644
--- a/tests/test_alerts.py
+++ b/tests/test_alerts.py
@@ -7,9 +7,15 @@ are the ones that make the landing page trustworthy rather than merely busy:
 
 * a source nobody configured is **never** an alert (`AGENTS.md` invariant 3);
 * a source that is stale but still serving is amber, not red;
-* a dead source is **one** line, not one per stale metric in its last good payload;
+* a dead source is **one** line, not one per stale metric in its last good payload (and not one
+  more for the config warnings its last good payload still carries — phase 30 task 03);
 * only `fail` and `warn` come through — `ok`, `unknown`, and a missing number are silence;
 * the list dedupes per (source, metric), is bounded, and says how much it hid.
+
+The one non-reachability rule for a source with no graded numbers is the gateway's config-integrity
+row: a proxy config that does not connect to itself is a structural fact, so it gets exactly one
+amber line naming how many there are and quoting the first, and it is suppressed whenever that
+job's own reachability line is on screen.
 """
 
 from __future__ import annotations
@@ -483,13 +489,154 @@ def test_a_dead_upsd_is_one_alert_and_not_its_stale_cards_too() -> None:
 
 
 # --------------------------------------------------------------------------- #
-# the gateway page: reachability is the only voice, and a dead agent is still one line
+# the gateway page: reachability plus config integrity, and a dead agent is still one line
 # --------------------------------------------------------------------------- #
 def gateway_state(**kwargs: Any) -> dict[str, Any]:
     """The health record of the one `gateway` job (the `nut` shape: key `gateway`, label = host)."""
     return state("gateway", "gateway", "gateway", **kwargs)
 
 
+def gateway_payload(*messages: str, ts: float | None = 1_000.0) -> dict[str, Any]:
+    """A gateway payload carrying exactly `messages` as its config warnings, in that order."""
+    return {"ts": ts, "host": "gateway", "supported": True,
+            "warnings": [{"id": f"synthetic:{index}", "kind": "synthetic",
+                          "subject": str(index), "message": text}
+                         for index, text in enumerate(messages)]}
+
+
+def test_config_warnings_are_one_warn_row_naming_the_count_and_the_first_message() -> None:
+    """`gateway:config`: the one row a proxy config that does not connect to itself earns.
+
+    Phase 30 task 03 changed the documented rule this file used to pin — a `gateway` alert used to
+    be reachability only. What it is now: one `warn` row, `href` `/gateway`, `at` the payload's own
+    timestamp (the config did not change between polls, so an alert whose clock reset every 30 s
+    would be unreadable), the count and the first message in the sentence.
+    """
+    out = alerts.build(Settings(gateway_interval=30.0), [gateway_state()],
+                       gateway_payload=gateway_payload(
+                           'frontend haproxy-22 routes to backend "gone", which no backend '
+                           "block declares",
+                           'backend "old" has 2 servers and no frontend routes to it'),
+                       now=2_000.0)
+    assert out == [{"id": "gateway:config", "severity": "warn", "source": "gateway",
+                    "href": "/gateway", "at": 1_000.0,
+                    "message": ("2 proxy config problems to address — "
+                                'frontend haproxy-22 routes to backend "gone", which no '
+                                "backend block declares")}]
+
+
+def test_one_warning_and_seven_produce_exactly_one_row_either_way() -> None:
+    """The row is aggregate on purpose: seven dangling routes are one config to fix.
+
+    Seven amber lines would push every other source off the overview panel to say one thing, and the
+    page beside them lists all seven — so the count is the number and the first message is the
+    sentence, once.
+    """
+    settings = Settings(gateway_interval=30.0)
+    for count in (1, 2, 7):
+        out = alerts.build(settings, [gateway_state()],
+                           gateway_payload=gateway_payload(*[f"problem {index}" for index
+                                                             in range(count)]),
+                           now=2_000.0)
+        assert len(out) == 1, f"{count} warnings produced {len(out)} rows"
+        assert out[0]["id"] == "gateway:config" and out[0]["severity"] == "warn"
+        assert out[0]["href"] == "/gateway" and out[0]["source"] == "gateway"
+        noun = "problem" if count == 1 else "problems"
+        assert out[0]["message"] == f"{count} proxy config {noun} to address — problem 0", (
+            "the count, the noun that matches it, and the first message verbatim")
+
+
+def test_a_clean_ingress_warns_about_nothing_and_a_missing_payload_does_too() -> None:
+    """Both directions of the row, because an absence-only assertion is satisfied by deleting it."""
+    settings = Settings(gateway_interval=30.0)
+    assert alerts.build(settings, [gateway_state()],
+                        gateway_payload=gateway_payload(), now=2_000.0) == []
+    assert alerts.build(settings, [gateway_state()],
+                        gateway_payload={"host": "gateway", "warnings": None},
+                        now=2_000.0) == [], "a malformed list is not a fault either"
+    assert alerts.build(settings, [gateway_state()], now=2_000.0) == [], (
+        "no payload at all — unconfigured, or configured and never answered — says nothing")
+
+
+def test_a_failing_gateway_job_keeps_its_reachability_row_and_gains_no_config_row() -> None:
+    """A dead source is one line, and the payload it left behind is not a second one.
+
+    Both arms of the rule, in both of its shapes: `ok: false` (the job is down) and stale (`ok: true`
+    past three of its own polls). In each, the reachability row is what the operator sees, and the
+    last good payload's warnings are not re-listed beside it — the warnings will be on `/gateway`
+    when the source answers again, and a second line here would be the invariant the `disks` rule
+    already keeps.
+    """
+    settings = Settings(gateway_interval=30.0)
+    broken = gateway_payload('backend "gone" declares no server — it routes nowhere')
+
+    down = alerts.build(settings, [gateway_state(ok=False, error="UpstreamError: gateway: timed out")],
+                        gateway_payload=broken, now=2_000.0)
+    assert [row["id"] for row in down] == ["gateway:gateway:down"], down
+    assert "timed out" in down[0]["message"]
+
+    stale = alerts.build(settings, [gateway_state(age=100.0)], gateway_payload=broken,
+                         now=2_000.0)
+    assert [row["id"] for row in stale] == ["gateway:gateway:stale"], stale
+    assert "every 30s" in stale[0]["message"]
+
+    # the control: the same payload with a job that IS answering does grow the config row
+    live = alerts.build(settings, [gateway_state(age=4.0)], gateway_payload=broken, now=2_000.0)
+    assert [row["id"] for row in live] == ["gateway:config"]
+
+
+def test_an_unconfigured_gateway_with_a_warning_payload_still_says_nothing() -> None:
+    """Invariant 3 with a payload attached: a source nobody installed has no config to be broken."""
+    out = alerts.build(Settings(gateway_interval=30.0),
+                       [gateway_state(configured=False)],
+                       gateway_payload=gateway_payload("anything"), now=2_000.0)
+    assert out == []
+
+
+def test_a_gateway_config_row_survives_a_dead_host_beside_it_and_sorts_after_the_fail() -> None:
+    """The config row is the gateway's own voice and the outage row is the host's — both stand.
+
+    The echo table suppresses a `gateway` job that failed *because* its agent did; a config warning
+    is not that, so a healthy host with a broken ingress gets exactly one overview row about the
+    ingress and nothing else, and a failing host plus a stale config list stays one row too.
+    """
+    settings = Settings(gateway_interval=30.0)
+    out = alerts.build(settings, [gateway_state(), state("host:gateway", "system", "gateway")],
+                       gateway_payload=gateway_payload("fix me"), now=2_000.0)
+    assert [row["id"] for row in out] == ["gateway:config"]
+
+    host_down = state("host:gateway", "system", "gateway", ok=False, error="unreachable")
+    out = alerts.build(settings, [gateway_state(ok=False), host_down],
+                       gateway_payload=gateway_payload("fix me"), now=2_000.0)
+    assert [row["severity"] for row in out] == ["fail"], "the outage is the only line"
+
+
+def test_a_config_warning_row_is_the_worst_thing_about_a_gateway_never_a_number() -> None:
+    """The rule restated after it changed: reachability plus config integrity, no graded number.
+
+    Three ways, because deleting a rule satisfies an absence-only assertion:
+
+    * `severity.THRESHOLDS` has no `gateway.*` row, so there is no bound for this module to read
+      even if a threshold were added here (and a busy proxy is the job, the `net.*` case);
+    * the row's message is built from `warnings` and nothing else — a payload of nothing but counts
+      yields no row at all;
+    * `alerts.HREF` still carries `/gateway`, so both voices reach the page that explains them.
+    """
+    assert not [name for name in severity.THRESHOLDS if name.startswith("gateway.")], (
+        "a connection count is not a graded number")
+    settings = Settings(gateway_interval=30.0)
+    counts = {"ts": 1_000.0, "host": "gateway", "listeners": [{"connections": 9_999}],
+              "connections": [{"connections": 9_999}], "sockets": {"established": 9_999}}
+    assert alerts.build(settings, [gateway_state()], gateway_payload=counts, now=2_000.0) == []
+    assert alerts.HREF["gateway"] == "/gateway"
+    assert alerts.AGENT_ECHO_DASHBOARDS == ("disks", "gateway"), (
+        "task 03 changed what a gateway may alert ON, not which lines it echoes")
+    # and a gateway with a payload whose rows are junk is silence, not a crash and not a claim
+    assert alerts.build(settings, [gateway_state()],
+                        gateway_payload={"warnings": ["not a mapping", 7]},
+                        now=2_000.0) == []
+
+
 def test_a_stale_gateway_job_is_a_warn_measured_in_its_own_thirty_second_poll() -> None:
     """The pipes are drawn from a 30 s poll, so 60 s of silence is two healthy polls.
 
@@ -539,24 +686,35 @@ def test_an_unconfigured_gateway_source_says_nothing_even_when_its_job_says_down
 
 
 def test_a_gateway_payload_with_a_fabricated_verdict_alerts_nothing() -> None:
-    """The phase's no-verdict rule, asserted as a rule and not only as an absence.
+    """The no-verdict rule restated for the payload this task added a reader for.
 
-    Three ways, because deleting a rule satisfies an absence-only assertion:
-
-    * `alerts.build` takes no gateway payload at all — its signature is the whole surface, so a
-      gateway count can reach an alert only through a threshold added to this module;
-    * `severity.THRESHOLDS` has no `gateway.*` row, so no such threshold could be written without
-      editing the one file that owns thresholds (and a busy proxy is the job, the `net.*` case);
-    * the module's `HREF` does carry `/gateway`, so reachability still reaches the overview.
+    `alerts.build` now *takes* a gateway payload (phase 30 task 03), so the old signature-only pin
+    is gone and what replaces it is stronger and narrower: the parameter is keyword-only with a
+    default (a positional gateway would be a rule this module grew by accident), it is the ONLY
+    gateway input, `severity.THRESHOLDS` still has no `gateway.*` row for it to consult, and a
+    payload with `severity` stamped into it stays silent — the row reads `warnings` and nothing
+    else. An answering gateway with a clean list is the all clear.
     """
-    assert not {"gateway", "gateway_payload"} & set(inspect.signature(alerts.build).parameters)
+    signature = inspect.signature(alerts.build).parameters
+    gateway_argument = signature["gateway_payload"]
+    assert gateway_argument.kind is inspect.Parameter.KEYWORD_ONLY, (
+        "a positional gateway argument would let a caller pass a count where a payload belongs")
+    assert gateway_argument.default is None
+    assert not [name for name in signature
+                if name.startswith("gateway") and name != "gateway_payload"], (
+        "a second gateway input is a new rule in disguise")
     assert not [name for name in severity.THRESHOLDS if name.startswith("gateway.")], (
         "a connection count is not a graded number")
     assert alerts.HREF["gateway"] == "/gateway"
     assert alerts.AGENT_ECHO_DASHBOARDS == ("disks", "gateway")
-    # and an answering gateway with nothing else going on is the all clear
-    assert alerts.build(Settings(gateway_interval=30.0), [gateway_state()], [], [], None, [],
-                        now=2_000.0) == []
+    # a fabricated verdict anywhere in the payload changes nothing: only `warnings` is read
+    rigged = gateway_payload()
+    rigged["severity"] = {"listeners": "fail", "connections": "fail"}
+    rigged["listeners"] = [{"connections": 100, "severity": "fail"}]
+    rigged["connections"] = [{"connections": 100, "severity": "fail"}]
+    settings = Settings(gateway_interval=30.0)
+    assert alerts.build(settings, [gateway_state()], gateway_payload=rigged, now=2_000.0) == []
+    assert alerts.build(settings, [gateway_state()], [], [], None, [], now=2_000.0) == []
 
 
 # --------------------------------------------------------------------------- #
diff --git a/tests/test_api.py b/tests/test_api.py
index 9472637..552a21b 100644
--- a/tests/test_api.py
+++ b/tests/test_api.py
@@ -300,16 +300,21 @@ def test_summary_shape_did_not_shrink(data_client) -> None:
 # `/` paints two panels; the payload is still the whole-fleet contract. Every path here is
 # read by something that is not the overview page: the live suite, an external probe, a
 # notifier later. Deleting a card must never delete a key.
-#: `/gateway`'s entries are the phase-29 block, and they are listed rather than spot-checked
-#: because two consumers read it: a notifier walking the totals, and the overview's one line
-#: (`page-index.js`'s `GATEWAY_FIELDS` + `href`), which is pinned against this same document by
-#: `test_the_overview_line_reads_the_gateway_block_it_claims`.
+#: `/gateway`'s entries are the eleven fields phase 30 task 02 reshaped the block into plus the
+#: `warnings` tally task 03 joined, listed rather than spot-checked because two consumers read it: a
+#: notifier walking the totals, and the overview's one line (`page-index.js`'s `GATEWAY_FIELDS` +
+#: `GATEWAY_WARNING_FIELD` + `href`), which is pinned against this same document by
+#: `test_the_overview_line_reads_the_gateway_block_it_claims`. The pair of **row counts**
+#: (`listeners`, `connections` — what the two configs declare) sits beside the pair of **live sums**
+#: (`live_in`, `live_out` — what the socket table answered) because a gateway can have thirty
+#: declared routes and no measurement of any of them, and `warnings` belongs with the row counts:
+#: a config fact, so `0` there is the truth and only `null` is unknown.
 SUMMARY_CONTRACT = ("system.enabled", "system.fleet", "system.hosts",
                     "disks.enabled", "disks.fleet", "disks.hosts",
                     "gateway.configured", "gateway.host", "gateway.href", "gateway.supported",
-                    "gateway.unreachable", "gateway.inbound", "gateway.outbound",
-                    "gateway.map_targets", "gateway.unmatched", "gateway.unmatched_listeners",
-                    "gateway.partial", "gateway.states",
+                    "gateway.unreachable", "gateway.listeners", "gateway.connections",
+                    "gateway.live_in", "gateway.live_out", "gateway.map_targets",
+                    "gateway.warnings", "gateway.states",
                     "llm.engines", "ups.ups", "recent_events", "alerts")
 
 
@@ -353,7 +358,8 @@ def test_summary_serves_every_path_another_consumer_reads(request, fixture: str)
     # — and the nulls are nulls rather than `0`, because "no job ran" is not "no connections".
     assert dig(body, "gateway.configured") is False
     assert dig(body, "gateway.states") == []
-    assert (dig(body, "gateway.inbound"), dig(body, "gateway.outbound")) == (None, None)
+    assert (dig(body, "gateway.listeners"), dig(body, "gateway.connections")) == (None, None)
+    assert (dig(body, "gateway.live_in"), dig(body, "gateway.live_out")) == (None, None)
     assert dig(body, "llm.engines") == [], "neither fixture configures an engine"
     assert isinstance(dig(body, "recent_events"), list)
     assert isinstance(dig(body, "alerts"), list)
@@ -4927,6 +4933,17 @@ def gateway_block(client: TestClient) -> dict[str, Any]:
     return client.get("/api/summary").json()["gateway"]
 
 
+#: The whole `gateway` block, pinned as a **set** rather than as a list of present keys: phase 30
+#: task 02 deleted `unmatched`, `unmatched_listeners` and `partial` with the socket join they
+#: described and task 03 added `warnings` back as a tally, so a block that grew or lost a field
+#: would do it quietly and this fails instead. Two consumers read these names — `page-index.js`'s
+#: `GATEWAY_FIELDS` / `GATEWAY_WARNING_FIELD` (resolved against a live document below) and any
+#: notifier walking `/api/summary`.
+GATEWAY_BLOCK_FIELDS = {"configured", "host", "href", "supported", "unreachable",
+                        "listeners", "connections", "live_in", "live_out", "map_targets",
+                        "warnings", "states"}
+
+
 def test_the_summary_gateway_block_is_the_stub_of_a_source_that_never_answered(
         tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     """Configured, dialling, nothing in yet: every count is `null` and the row says unreachable.
@@ -4935,6 +4952,10 @@ def test_the_summary_gateway_block_is_the_stub_of_a_source_that_never_answered(
     answered is present with unknowns, because dropping it would read as "never configured" and
     zeroing it would read as an idle gateway. The poll has to have happened for the stub to mean
     what it says, so the test waits for the dead port's sentence first.
+
+    Note which fields are null **here**: the two row counts included. A host that has never
+    replied has not told us what its configs declare either, and `0` would be the sentence "this
+    gateway routes nothing" said about a machine that never said it.
     """
     with make_gateway_client(tmp_path, monkeypatch) as client:
         wait_for_source_error(client, "gateway", "unreachable")
@@ -4943,7 +4964,9 @@ def test_the_summary_gateway_block_is_the_stub_of_a_source_that_never_answered(
         assert block["host"] == "gateway"
         assert block["unreachable"] is True
         assert block["supported"] is None, "nobody has answered, so nobody knows the version"
-        for field in ("inbound", "outbound", "map_targets", "unmatched", "unmatched_listeners"):
+        assert set(block) == GATEWAY_BLOCK_FIELDS
+        for field in ("listeners", "connections", "live_in", "live_out", "map_targets",
+                      "warnings"):
             assert block[field] is None, f"{field} must be unknown, never 0"
         assert [row["key"] for row in block["states"]] == ["gateway"]
         assert block["states"][0]["dashboard"] == "gateway"
@@ -4952,6 +4975,24 @@ def test_the_summary_gateway_block_is_the_stub_of_a_source_that_never_answered(
         assert block["href"] == GATEWAY_HREF
 
 
+def endpoint_sums(payload: dict[str, Any]) -> tuple[int | None, int | None]:
+    """The two live totals, derived here so the block is checked against a **second** reading.
+
+    Inbound is the sum over trunks. Outbound is the sum over the **distinct** `(host, port)` the
+    route lines name: `sources/gateway.py` repeats an endpoint's whole count on every line that
+    reaches it (`shared: true`), so summing the lines would book the same sockets twice and print
+    a router busier than the kernel has connections for. Neither is a sum when nothing answered.
+    """
+    live_in = [row["connections"] for row in payload["listeners"]
+               if isinstance(row["connections"], int)]
+    endpoints: dict[tuple[Any, Any], Any] = {}
+    for row in payload["connections"]:
+        endpoints.setdefault((row["out"]["host"], row["out"]["port"]), row["connections"])
+    live_out = [value for value in endpoints.values() if isinstance(value, int)]
+    return (sum(live_in) if live_in else None,
+            sum(live_out) if live_out else None)
+
+
 @pytest.mark.parametrize("mode", ["full", "predates", "sockets_silent"])
 def test_the_summary_gateway_block_is_the_payloads_sums_not_the_pages_arithmetic(
         tmp_path: Path, monkeypatch: pytest.MonkeyPatch, gateway_snapshot: Any,
@@ -4960,12 +5001,17 @@ def test_the_summary_gateway_block_is_the_payloads_sums_not_the_pages_arithmetic
 
     Driven from `gateway.parse` over the **captured** configs and `/proc` tables rather than a
     hand-written payload, so a rename in the source's shape fails here instead of printing a
-    plausible zero (rule 7). `partial` is the half that keeps a subtotal honest: a port whose
-    configured targets cannot be told apart leaves its pipes unknown, and the total says so.
+    plausible zero (rule 7).
+
+    The split that replaced `partial` is the point of the three arms. `listeners` / `connections`
+    are **row counts** — a fact readable from a config file, so they are numbers even when the
+    socket table never answered — while `live_in` / `live_out` are measurements and go `null` with
+    it. The old block could only report one number per side and needed a `partial` flag to say it
+    was a subtotal; there is no residual to qualify now, because a socket outside the two files is
+    counted nowhere by decision.
     """
     payload = gateway_source.parse(gateway_snapshot(mode), "gateway")
-    counting = (payload["sockets"]["established"] is not None
-                and payload["supported"] is not False)
+    expected_in, expected_out = endpoint_sums(payload)
     with make_gateway_client(tmp_path, monkeypatch) as client:
         answer_as(client, "gateway", payload)
         deadline = time.time() + 10
@@ -4976,23 +5022,31 @@ def test_the_summary_gateway_block_is_the_payloads_sums_not_the_pages_arithmetic
     assert block["configured"] is True and block["unreachable"] is False
     assert block["supported"] is payload["supported"]
     assert block["host"] == "gateway"
+    assert set(block) == GATEWAY_BLOCK_FIELDS, mode
     if not payload["supported"]:
-        # nothing was read, so "no map targets" would be a claim about a file nobody opened
+        # nothing was read, so even "this host declares no listener" would be a claim about a
+        # file nobody opened: `supported: false` and nulls are the honest pair
         assert block["map_targets"] is None
-        assert block["inbound"] is block["outbound"] is None
-        assert block["unmatched"] is block["unmatched_listeners"] is None
+        assert block["listeners"] is block["connections"] is None
+        assert block["live_in"] is block["live_out"] is None
+        assert block["warnings"] is None, "an unread config has not been found guilty of anything"
         return
     assert block["map_targets"] == len(payload["nginx"]["map_targets"])
-    for field, pipes in (("inbound", payload["inbound"]), ("outbound", payload["outbound"])):
-        known = [pipe["connections"] for pipe in pipes if pipe["connections"] is not None]
-        assert block[field] == (sum(known) if counting else None)
-        assert (block[field] is None) is (not counting), "unknown is not zero"
-    unknown = [pipe for pipe in payload["outbound"] if pipe["connections"] is None]
-    assert block["partial"] is (counting and bool(unknown)), (
-        "a total that leaves an unknown pipe out has to say it did")
-    assert block["unmatched"] == ((payload["unmatched"]["inbound"] + payload["unmatched"]["outbound"])
-                                 if counting else None)
-    assert block["unmatched_listeners"] == (payload["unmatched"]["other"] if counting else None)
+    assert block["listeners"] == len(payload["listeners"])
+    assert block["connections"] == len(payload["connections"])
+    # a **count**, not the list: `/` needs to know whether there is anything to address, and the
+    # page that lists them reads `/api/gateway/snapshot`
+    assert block["warnings"] == len(payload["warnings"])
+    assert block["live_in"] == expected_in
+    assert block["live_out"] == expected_out
+    if payload["sockets"]["established"] is None:
+        # the configs answered and the kernel did not: the rows are real, the counts are not
+        assert block["listeners"] > 0 and block["connections"] > 0
+        assert block["live_in"] is block["live_out"] is None, "unknown is not zero"
+    else:
+        assert block["live_in"] is not None
+        assert block["live_in"] + (block["live_out"] or 0) <= payload["sockets"]["established"], (
+            "the reported figures may under-count the kernel's, never exceed it")
 
 
 def test_the_summary_gateway_block_of_the_captured_ingress_reads_the_live_join(
@@ -5000,7 +5054,10 @@ def test_the_summary_gateway_block_of_the_captured_ingress_reads_the_live_join(
     """The real capture, one figure at a time — the block an operator would actually get.
 
     The parametrised test above proves the rule; this one pins the numbers, so a change to the join
-    that moves a total is visible somewhere rather than only in a browser.
+    that moves a total is visible somewhere rather than only in a browser. The outbound figure is
+    small **on purpose**: this capture's configs write almost every target as a domain, and a
+    domain is not something this stack can join to a socket, so only the two `127.0.0.1` endpoints
+    carry a count at all (`:4443` with 2 and `:8081` with 0).
     """
     with make_gateway_client(tmp_path, monkeypatch) as client:
         answer_as(client, "gateway", gateway_source.parse(gateway_snapshot("full"), "gateway"))
@@ -5008,16 +5065,113 @@ def test_the_summary_gateway_block_of_the_captured_ingress_reads_the_live_join(
         while time.time() < deadline and not client.app.state.ctx.hub.jobs["gateway"].state.ok:
             time.sleep(0.05)
         block = gateway_block(client)
-    assert block["inbound"] == 9, "9 of the 18 live sockets are inbound on a configured port"
-    assert block["outbound"] == 4
+    assert block["listeners"] == 10, "6 haproxy binds + 4 nginx listen ports"
+    assert block["connections"] == 32, "every route the two captured configs declare"
+    assert block["live_in"] == 9, "9 of the 18 live sockets face a configured listen port"
+    assert block["live_out"] == 2, "the two loopback endpoints, counted once each"
     assert block["map_targets"] == 17, "the stream map's routing entries are the fan-out"
-    assert block["unmatched"] == 5, "1 on an unclaimed listener, 4 nobody could attribute"
-    assert block["unmatched_listeners"] == 2
-    assert block["partial"] is True, "the shared :443 group is unknown, and the sum says so"
+    assert block["warnings"] == 0, (
+        "this fleet's two config files connect to themselves, and 0 is the truth rather than a "
+        "missing measurement — the overview line prints nothing for it either way")
     assert "severity" not in block
     assert block["href"] == GATEWAY_HREF
 
 
+def gateway_alerts(client: Any) -> list[dict[str, Any]]:
+    """`/api/summary`'s alert rows for an app whose jobs are already in the state we asked for."""
+    return client.get("/api/summary").json()["alerts"]
+
+
+def test_one_dangling_use_backend_is_one_warn_row_on_the_overview(
+        tmp_path: Path, monkeypatch: pytest.MonkeyPatch, gateway_snapshot: Any) -> None:
+    """Both directions of the row, over the **real** projection of the captured configs.
+
+    The `self_test_app` device (swap the collector so a poll cannot overwrite what the test set):
+    the mutation is a `use_backend` naming a backend nobody declares, applied to the haproxy section
+    the agent's own parser produced, so the warning, its message and its count are the source's and
+    not this file's. Then the same document with the mutation removed, because an absence-only
+    assertion is satisfied by deleting the feature.
+    """
+    clean = gateway_source.parse(gateway_snapshot("full"), "gateway")
+    broken_snapshot = gateway_snapshot("full")
+    broken_snapshot["haproxy"]["frontends"][0]["backends"] = ["old-tunnel"]
+    broken = gateway_source.parse(broken_snapshot, "gateway")
+    assert [row["kind"] for row in clean["warnings"]] == []
+    assert [row["kind"] for row in broken["warnings"]] == [gateway_source.WARN_ROUTE_DANGLING]
+
+    with make_gateway_client(tmp_path, monkeypatch) as client:
+        answer_as(client, "host:gateway", {"name": "gateway"})
+        answer_as(client, "disks:gateway", {"name": "gateway", "disks": [], "summary": {}})
+        answer_as(client, "gateway", broken)
+        deadline = time.time() + 15
+        while time.time() < deadline and not client.app.state.ctx.hub.jobs["gateway"].state.ok:
+            time.sleep(0.05)
+        rows = gateway_alerts(client)
+        block = client.get("/api/summary").json()["gateway"]
+        assert len(rows) == 1, rows
+        assert rows[0]["id"] == "gateway:config"
+        assert rows[0]["severity"] == "warn"
+        assert rows[0]["source"] == "gateway"
+        assert rows[0]["href"] == "/gateway"
+        assert rows[0]["message"] == (
+            '1 proxy config problem to address — frontend haproxy-22 routes to backend '
+            '"old-tunnel", which no backend block declares')
+        assert block["warnings"] == 1, "the tally and the row are the same reading of one payload"
+
+        # …and removing the mutation removes the row: the alert is the config, not the test rig
+        answer_as(client, "gateway", clean)
+        deadline = time.time() + 15
+        while time.time() < deadline and client.get("/api/summary").json()["gateway"]["warnings"]:
+            time.sleep(0.05)
+        assert gateway_alerts(client) == [], "a clean ingress is an all clear, not a green line"
+
+
+def test_a_gateway_job_that_stops_answering_keeps_one_row_not_two(
+        tmp_path: Path, monkeypatch: pytest.MonkeyPatch, gateway_snapshot: Any) -> None:
+    """The last good payload still holds its warnings; the overview still says one thing.
+
+    Invariant 4's page side: a failed poll keeps the payload, and `_source_alerts` writes the
+    reachability row for the job. Task 03's rule is that the config row goes quiet then — the
+    operator's problem right now is that the router is not answering, and a second amber line
+    quoting a reading they cannot refresh is noise on top of it.
+    """
+    broken = gateway_source.parse(gateway_snapshot("full"), "gateway")
+    broken["warnings"] = [{"id": "haproxy_backend_orphan:old-tunnel",
+                           "kind": "haproxy_backend_orphan", "subject": "old-tunnel",
+                           "message": 'backend "old-tunnel" has 2 servers and no frontend '
+                                      "routes to it"}]
+    with make_gateway_client(tmp_path, monkeypatch) as client:
+        # the agent answers; only the proxy reading inside it goes quiet, which is the arm this
+        # rule is about — a dead agent is `host:gateway`'s sentence and echoes to nothing
+        answer_as(client, "host:gateway", {"name": "gateway"})
+        answer_as(client, "disks:gateway", {"name": "gateway", "disks": [], "summary": {}})
+        answer_as(client, "gateway", broken)
+        deadline = time.time() + 15
+        while time.time() < deadline and not client.app.state.ctx.hub.jobs["gateway"].state.ok:
+            time.sleep(0.05)
+        assert client.get("/api/summary").json()["gateway"]["warnings"] == 1, (
+            "the control: answering, the config row IS there")
+
+        async def failing() -> Any:
+            raise UpstreamError("gateway: the proxy sections went quiet")
+
+        client.app.state.ctx.hub.jobs["gateway"].fn = failing  # type: ignore[attr-defined]
+        deadline = time.time() + 15
+        while time.time() < deadline:
+            job = client.app.state.ctx.hub.jobs["gateway"]
+            if not job.state.ok and job.state.payload is not None:
+                break
+            time.sleep(0.05)
+        else:
+            pytest.fail("the gateway job never went from answering to failing")
+        alerts = gateway_alerts(client)
+    assert [row["id"] for row in alerts] == ["gateway:gateway:down"], (
+        "the reachability row is the gateway's only line while it is down")
+    assert client.get("/api/gateway/snapshot").json()["warnings"], (
+        "the page still shows the warnings beside the last good numbers — the alert went quiet, "
+        "the fact did not disappear")
+
+
 #: The route the ingress's own line links to, taken from the one table that writes a dashboard's
 #: page (`alerts.py`) rather than from a string this file would have to keep in sync with it.
 GATEWAY_HREF = alerts.HREF["gateway"]
@@ -5091,10 +5245,19 @@ def test_a_gateway_job_that_fails_while_its_host_answers_is_the_only_voice_it_ha
     assert "unreachable" in alerts[0]["message"]
 
 
-#: The two figures the overview's ingress line prints, in the order it prints them. Read back out
+#: The four figures the overview's ingress line prints, in the order it prints them. Read back out
 #: of the served `GATEWAY_FIELDS` and resolved against the block the route answers with, so a
-#: rename on either side fails here instead of printing `n/a` beside a busy gateway.
-GATEWAY_LINE_FIELDS = ("inbound", "outbound")
+#: rename on either side fails here instead of printing `n/a` beside a busy gateway. The first two
+#: are the config's own declarations and the last two what the kernel's socket table answered — the
+#: same split `api._gateway_summary` writes, and the reason one number per side could never say both
+#: things. The words are the **field names** (phase 30 task 02): the line, the block and the page
+#: then say one thing about a route, and a rename on either side fails in three places at once.
+GATEWAY_LINE_FIELDS = ("listeners", "connections", "live_in", "live_out")
+GATEWAY_LINE_WORDS = ("listeners", "connections", "live in", "live out")
+#: The tally beside them, which is NOT in `GATEWAY_FIELDS` because it prints only when non-zero:
+#: the four figures above always have a place on the line, and `N to address` has one only when
+#: there is something to address (phase 30 task 03).
+GATEWAY_LINE_WARNING = ("warnings", "to address")
 
 
 def test_the_overview_line_reads_the_gateway_block_it_claims(client) -> None:
@@ -5112,15 +5275,17 @@ def test_the_overview_line_reads_the_gateway_block_it_claims(client) -> None:
     js = _code(client.get("/static/page-index.js").text)
     table = re.search(r"const GATEWAY_FIELDS = \[(.*?)\n\];", js, re.S)
     assert table, "page-index.js no longer has a GATEWAY_FIELDS table"
-    keys = re.findall(r"key: '(\w+)'", table.group(1))
-    words = re.findall(r"word: '(\w+)'", table.group(1))
-    assert keys == list(GATEWAY_LINE_FIELDS), f"the line prints {keys}, not the pinned pair"
-    assert words == list(GATEWAY_LINE_FIELDS), f"the line labels them {words}"
+    keys = re.findall(r"key: '([\w]+)'", table.group(1))
+    words = re.findall(r"word: '([^']+)'", table.group(1))
+    assert keys == list(GATEWAY_LINE_FIELDS), f"the line prints {keys}, not the pinned four"
+    assert words == list(GATEWAY_LINE_WORDS), f"the line labels them {words}"
 
     body = client.get("/api/summary").json()
     assert "gateway" in body, "/api/summary lost the block the line reads"
-    for key in (*keys, "configured", "href", "host", "unreachable", "partial"):
+    for key in (*keys, "warnings", "configured", "href", "host", "unreachable"):
         assert key in body["gateway"], f"the page names `{key}` and the block does not send it"
+    assert not ({"partial", "unmatched", "unmatched_listeners"} & set(body["gateway"])), (
+        "the block grew back a field the deleted join needed")
 
     line = js[js.index("function renderGateway("):]
     line = line[:line.index("\n}")]
@@ -5132,8 +5297,28 @@ def test_the_overview_line_reads_the_gateway_block_it_claims(client) -> None:
     assert "row.classList.toggle('stale'" in line, (
         "a gateway that stopped answering keeps its last counts, so the row must say they are old")
     assert "severity" not in line, "the ingress line grew a verdict the block does not send"
+    # every figure goes through `num()`, which is what renders a `null` as `n/a` rather than `0`
+    assert "num(block[key], 0)" in line, (
+        "a live count the block did not measure must print n/a, not 0 (rule 2)")
     assert "escapeHtml" in line, "a config string reached innerHTML unescaped"
 
+    # the config-integrity tally: read out of a named table (so a rename fails here, not quietly),
+    # and printed ONLY when it is non-zero — a clean ingress must not grow a permanent `0 to
+    # address`, and a `null` (an ingress that never answered) is not a number to print at all.
+    warning_table = re.search(r"const GATEWAY_WARNING_FIELD = (\{.*?\});", js, re.S)
+    assert warning_table, "page-index.js no longer names the warnings field in a table"
+    warn_key = re.search(r"key: '([\w]+)'", warning_table.group(1))
+    warn_word = re.search(r"word: '([^']+)'", warning_table.group(1))
+    assert warn_key and warn_word, "the tally table lost its key or its word"
+    assert (warn_key.group(1), warn_word.group(1)) == GATEWAY_LINE_WARNING, (
+        f"the line reads {warn_key.group(1)} / {warn_word.group(1)}, not the pinned tally")
+    assert "block[GATEWAY_WARNING_FIELD.key]" in line, (
+        "the renderer stopped reading the tally through its table")
+    assert ("` · ${block[GATEWAY_WARNING_FIELD.key]} ${GATEWAY_WARNING_FIELD.word}`" in line)
+    assert "> 0" in line, "the tally prints even when it is zero — a clean ingress gets no row"
+    assert "Number.isInteger" in line, (
+        "a null tally must not print: `null > 0` is false, and that is the unknown arm")
+
     # …and the element it fills is in the fleet panel and ships hidden, so the row cannot appear
     # before the payload says the source exists.
     html = client.get("/").text
@@ -5154,9 +5339,9 @@ def test_the_gateway_counts_grow_no_verdict_alert_even_with_verdicts_in_the_payl
     precedent). An answering fleet with a fully-populated gateway payload stays all clear.
     """
     payload = gateway_source.parse(gateway_snapshot("full"), "gateway")
-    payload["severity"] = {"inbound": "fail", "outbound": "fail", "unmatched": "fail"}
-    for pipe in (*payload["inbound"], *payload["outbound"]):
-        pipe["severity"] = "fail"
+    payload["severity"] = {"listeners": "fail", "connections": "fail", "sockets": "fail"}
+    for row in (*payload["listeners"], *payload["connections"]):
+        row["severity"] = "fail"
     with make_gateway_client(tmp_path, monkeypatch) as client:
         answer_as(client, "host:gateway", {"name": "gateway"})
         answer_as(client, "disks:gateway", {"name": "gateway", "disks": [], "summary": {}})
@@ -5366,9 +5551,11 @@ def test_gateway_snapshot_answers_the_pipes_the_projection_joined(
 
     Two things are pinned at once. The **shape**: every key the page indexes is there, so a rename
     in the source fails this test rather than printing `n/a` beside a live ingress. And the
-    **reconciliation identity** the phase wrote down — the pipes plus everything unmatched equal the
-    kernel's ESTABLISHED row count — because that is what makes the counts on screen provable
-    against a direct `/proc/net/tcp` read instead of a plausible drawing.
+    **arithmetic** phase 30 task 02 replaced the old equality with:
+    `sum(listeners) + sum(distinct endpoints) <= established`, with the difference reported nowhere
+    — a socket neither config file describes is not a number on this page, and the phase deleted
+    the card that used to hold it. `sockets.established` stays the kernel's own row count beside
+    it, so the reader can see the gap rather than being told the two agree.
     """
     body = gateway_client.get("/api/gateway/snapshot").json()
     assert set(body) - {"states"} == gateway_payload_keys(gateway_snapshot("full")), (
@@ -5377,31 +5564,67 @@ def test_gateway_snapshot_answers_the_pipes_the_projection_joined(
     assert body["host"] == "gateway"
     assert body["why"] is None, "a page with pipes has nothing to apologise for"
     assert body["sections"] == {"haproxy": True, "nginx": True, "sockets": True}
+    assert not ({"outbound", "unmatched", "partial"} & set(body)), (
+        "the deleted join is back in the payload")
 
     # the config half, verbatim from the capture the agent read (phase 28's six frontends, the
     # stream map's 17 routing entries) — the echo the pipes were built from
     assert len(body["haproxy"]["frontends"]) == 6
     assert len(body["nginx"]["map_targets"]) == 17
-    stream = next(pipe for pipe in body["inbound"] if pipe["port"] == 443)
+    stream = next(pipe for pipe in body["listeners"] if pipe["port"] == 443)
     assert stream["connections"] == 6 and stream["metric"] == "gateway.in_conns@443", (
         "the pipe carries the series it is, so the page never rebuilds the name")
     assert stream["clients"], "the inbound pipe names the addresses that are using it"
-    secure = next(pipe for pipe in body["inbound"] if pipe["port"] == 4443)
+    secure = next(pipe for pipe in body["listeners"] if pipe["port"] == 4443)
     assert "nextcloud.reeseapps.com" in secure["domains"], "the listen port carries its server_names"
-    shared = [pipe for pipe in body["outbound"] if pipe["target"]["port"] == 443]
-    assert shared and all(pipe["connections"] is None for pipe in shared), (
-        "a port several configured targets share is unknown on every one of them, never a guess")
 
-    known_in = sum(pipe["connections"] for pipe in body["inbound"]
+    # The graph: every route the two captured configs declare, each line's inbound end a trunk this
+    # same payload draws, and a count on **only** the lines whose endpoint the config wrote as an
+    # address — this capture has exactly two (`127.0.0.1:4443` and `127.0.0.1:8081`).
+    assert len(body["connections"]) == 32
+    listener_ports = {listener["port"] for listener in body["listeners"]}
+    assert listener_ports == {22, 2000, 5201, 8080, 25565, 25566, 80, 443, 4443, 8443}
+    assert all(row["in"]["port"] in listener_ports for row in body["connections"]), (
+        "a connection on a port no listener carries is an orphan the page cannot draw")
+    counted = {row["id"]: row["connections"] for row in body["connections"]
+               if row["connections"] is not None}
+    assert counted == {"nginx:443->127.0.0.1:4443": 2, "nginx:8443->127.0.0.1:8081": 0}, (
+        "a route written as a domain carries no count, and one written as an address carries the "
+        "endpoint's own — 0 included, because the socket table answered")
+    assert all(row["out"]["address"] is True for row in body["connections"]
+               if row["connections"] is not None)
+    assert all(row["metric"] is None for row in body["connections"]
+               if row["connections"] is None), "no series for a number nobody can measure"
+
+    known_in = sum(pipe["connections"] for pipe in body["listeners"]
                    if pipe["connections"] is not None)
-    known_out = sum(pipe["connections"] for pipe in body["outbound"]
-                    if pipe["connections"] is not None)
-    unmatched = body["unmatched"]
-    assert known_in + known_out + unmatched["inbound"] + unmatched["outbound"] == \
-        body["sockets"]["established"], "every socket row is counted exactly once"
+    endpoints = {(row["out"]["host"], row["out"]["port"]) for row in body["connections"]
+                 if row["connections"] is not None}
+    assert known_in + sum(counted.values()) <= body["sockets"]["established"] == 18
+    assert len(endpoints) == 2
     assert [row["key"] for row in body["states"]] == ["gateway"]
 
 
+def test_no_port_the_two_configs_do_not_name_appears_anywhere(gateway_client,
+                                                              gateway_snapshot: Any) -> None:
+    """The live router's own agent port is `9120`, and this payload never mentions it.
+
+    Phase 29 shipped a card that reported it. Phase 30 deleted the reporting: `9120` (and `2222`,
+    and everything else outside the two files) is a fact about the host that `/system` answers, and
+    filed under no pipe, no total and no warning here. Asserted over the **serialised** document,
+    because "not in a field I thought to check" is not the claim.
+    """
+    snapshot = gateway_snapshot("full")
+    live = {row["port"] for row in snapshot["sockets"]["listens"]}
+    assert 9120 in live, "the capture must still contain the unclaimed port for this to mean anything"
+    body = gateway_client.get("/api/gateway/snapshot").json()
+    text = json.dumps(body)
+    assert ":9120" not in text and "@9120" not in text
+    assert 9120 not in {row["port"] for row in body["listeners"]}
+    assert 9120 not in {row["in"]["port"] for row in body["connections"]}
+    assert 9120 not in {row["out"]["port"] for row in body["connections"]}
+
+
 def test_the_gateway_snapshot_carries_no_verdict_and_no_window(gateway_client) -> None:
     """A connection count is neither a graded number nor a rate, at any depth of the payload.
 
@@ -5411,8 +5634,17 @@ def test_the_gateway_snapshot_carries_no_verdict_and_no_window(gateway_client) -
     measured when nothing was (rule 2).
     """
     body = gateway_client.get("/api/gateway/snapshot").json()
+    assert body["listeners"] and body["connections"], (
+        "an empty walk would pass this pin for the wrong reason")
+    assert body["warnings"] == [], (
+        "this fleet's captured configs connect to themselves — the seven checks are not a lie "
+        "about the ingress the page draws")
     assert find_keys(body, "severity") == [], "no count on this page is graded"
     assert find_keys(body, "window_seconds") == [], "nothing here was measured over a window"
+    # `by_port` belonged to the join that credited a **port** for a target written as a name. The
+    # graph claims no join on a name at all, so the field has nowhere honest to live.
+    assert find_keys(body, "by_port") == [], "the port-only arm of the join is gone from the payload"
+    assert find_keys(body, "unmatched") == [], "no residual is reported, so no residual is labelled"
 
 
 def test_gateway_snapshot_stubs_the_ingress_that_has_never_answered(
@@ -5433,13 +5665,12 @@ def test_gateway_snapshot_stubs_the_ingress_that_has_never_answered(
     assert body["unreachable"] is True
     assert body["host"] == "gateway", "the name is a config fact, so it survives the outage"
     assert body["supported"] is None, "nobody has read its version"
-    assert body["inbound"] == [] and body["outbound"] == []
+    assert body["listeners"] == [] and body["connections"] == []
     assert body["haproxy"]["frontends"] == []
     assert body["nginx"] == {"servers": [], "map_targets": []}
     assert body["sockets"] == {"listens": None, "established": None}, "unknown, never 0"
-    assert body["unmatched"]["inbound"] is None
-    assert body["unmatched"]["outbound"] is None
-    assert body["unmatched"]["other"] is None
+    assert not ({"outbound", "unmatched", "partial"} & set(body)), (
+        "the stub grew a key the deleted join needed")
     assert body["why"] and "not answered" in body["why"], "a sentence the page can print"
     assert body["ts"] is not None, "the age of the attempt is what the page prints"
     assert [row["key"] for row in body["states"]] == ["gateway"]
@@ -5468,19 +5699,24 @@ def test_gateway_history_serves_the_pipe_gauges_the_store_holds(
     the outbound one **with its port** in the name (two Minecraft backends on one host are two
     facts), and the `source` says the `gateway` family — a page must never ask the 10-second `host`
     series for a connection count.
+
+    The outbound name asked for is an **address** (`127.0.0.1:4443`), and that is the whole point of
+    the phase-30 change to `samples()`: a route whose target the config wrote as a domain publishes
+    no series at all, so a name-keyed `gateway.out_conns@<domain>:<port>` is no longer stored and
+    the store's `gateway` family is exactly the endpoints the join could count.
     """
     store: SampleStore = gateway_client.app.state.ctx.store  # type: ignore[attr-defined]
     body = gateway_client.get("/api/gateway/history", params={
         "hosts": "gateway",
         "metrics": "gateway.in_conns@443,gateway.in_conns@4443,"
-                   "gateway.out_conns@nextcloud.reeselink.com:11000",
+                   "gateway.out_conns@127.0.0.1:4443",
         "range": "1h"}).json()
 
     assert body["hosts"] == ["gateway"]
     assert body["range_seconds"] == 3_600.0
     assert [series["metric"] for series in body["series"]] == [
         "gateway.in_conns@443", "gateway.in_conns@4443",
-        "gateway.out_conns@nextcloud.reeselink.com:11000"], "host-major, metric-minor, request order"
+        "gateway.out_conns@127.0.0.1:4443"], "host-major, metric-minor, request order"
     assert series_source(body) == {"gateway"}, "its own family, never the system one"
     for series in body["series"]:
         rows = store.query("gateway", "gateway", series["metric"], res=RES_RAW)
@@ -5492,8 +5728,8 @@ def test_gateway_history_answers_empty_for_a_pipe_it_never_measured(gateway_clie
     """Unknown names are an empty series, not a 404 — the contract the other routes have.
 
     A card asks for every pipe it could draw in one request: a target with no traffic in the
-    window, a port the configs stopped naming, and a name nobody ever stored all draw an empty
-    plot while the series that do exist still answer.
+    window, a port the configs stopped naming, and a **domain** the source stopped storing because
+    nothing could ever count it all draw an empty plot while the series that do exist still answer.
     """
     body = gateway_client.get("/api/gateway/history", params={
         "hosts": "gateway",
@@ -5593,29 +5829,36 @@ def test_the_gateway_surface_is_gets_only_and_the_write_stays_the_ups_one(
 # tell); every pipe says what it is to assistive tech, because a moving line says nothing to a
 # screen reader; nothing is coloured by a verdict, because `severity.py` rates no `gateway.*`
 # metric and the API sends none; every label is the config's own text, so a rename in
-# `sources/gateway.py` fails here instead of printing `n/a` beside a healthy ingress; and the
-# unreconciled remainder is printed, because the operator's fact is that the gateway talks to
-# something the configs do not name. `data/logs/29-task04-pipes.cjs` is the browser half.
+# `sources/gateway.py` fails here instead of printing `n/a` beside a healthy ingress. Phase 30
+# task 02 removed the last one of those — the unreconciled remainder is no longer printed, because
+# a socket outside the two config files is not this page's business — so the pins below assert its
+# **absence** beside the rules that survived. `data/logs/29-task04-pipes.cjs` is the browser half.
 
-#: Every payload path the page's script indexes, in the arm that measured. Resolved against a
-#: live `GET /api/gateway/snapshot` below rather than written from the source, so the two sides
-#: of the join are checked against each other (`SLOT_FIELDS`' / `COLUMNS`' device).
+#: Every payload path the page's script indexes or keys a row by, in the arm that measured. Resolved
+#: against a live `GET /api/gateway/snapshot` below rather than written from the source, so the two
+#: sides of the join are checked against each other (`SLOT_FIELDS`' / `COLUMNS`' device). Phase 30
+#: task 04 dropped `sockets.listens` / `sockets.established` (the kernel's table size is on no cell
+#: any more — a tally the map cannot reconcile is one an operator learns to skip) and
+#: `nginx.map_targets.*` / `haproxy.frontends.*` (neither is a row any more: the fan-out arrives as
+#: `connections[]` carrying its own `out.kind`, which
+#: `test_the_stream_map_is_rendered_inside_nginx_and_nowhere_else` pins), and added `warnings.*`.
 GATEWAY_PAGE_FIELDS = (
-    "host", "ts", "supported", "why", "agent_version",
-    "sockets.listens", "sockets.established",
-    "inbound.port", "inbound.source", "inbound.domains", "inbound.connections",
-    "inbound.clients", "inbound.metric",
-    "outbound.target.host", "outbound.target.port", "outbound.target.name",
-    "outbound.target.by_port", "outbound.connections", "outbound.source",
-    "outbound.metric",
-    "unmatched.other", "unmatched.inbound", "unmatched.outbound",
-    "nginx.map_targets.key", "nginx.map_targets.host", "nginx.map_targets.port",
-    "haproxy.frontends.name", "haproxy.frontends.port", "haproxy.frontends.backend",
+    "host", "supported", "why", "agent_version",
+    "listeners.port", "listeners.source", "listeners.domains", "listeners.connections",
+    "listeners.clients", "listeners.metric",
+    "connections.id", "connections.source", "connections.in.port",
+    "connections.out.host", "connections.out.port", "connections.out.name",
+    "connections.out.kind", "connections.out.selectors", "connections.out.address",
+    "connections.connections", "connections.shared", "connections.metric",
+    "warnings.id", "warnings.kind", "warnings.subject", "warnings.message",
 )
 
-#: The card families, in the order the page ships them. `unmatched` draws no pipes and so has no
-#: chart; the other three are `source` words the payload itself uses.
-GATEWAY_CARD_KEYS = ("haproxy", "nginx", "map", "unmatched")
+#: The panels, in the order the page ships them: the two config files, keyed on the payload's own
+#: `source` words, nginx first (the operator named it first, and it carries this fleet's widest
+#: fan-out). `map` and `unmatched` are gone (phase 30 task 02) — a stream `map` is nginx config, so
+#: its routes are that panel's `:443` leaves, and there is no residual panel because nothing outside
+#: the two files is reported at all.
+GATEWAY_CARD_KEYS = ("nginx", "haproxy")
 
 
 def _payload_field(node: Any, path: str) -> tuple[bool, list[Any]]:
@@ -5646,30 +5889,76 @@ def _payload_field(node: Any, path: str) -> tuple[bool, list[Any]]:
     return False, []
 
 
-def test_the_gateway_page_is_a_card_per_source_family_with_a_reconciliation_row(
-        client) -> None:
-    """The page's shape, on the bytes it serves.
+def one_real_warning() -> list[dict[str, str]]:
+    """One warning row written by `sources/gateway.warnings()`, not by this file.
 
-    Four cards keyed on `data-gate` — three config families plus `unmatched` — one node and two
-    pipe columns inside each of the three that draws pipes, and the socket table's tallies in the
-    page head so the page prints `listeners` / `established` beside what its pipes carry instead
-    of asserting the two agree. There is no `#range` control and that is a decision, not an
-    omission: the history here is a count trend and one window for every card is the honest
-    default for a source that re-reads every 30 seconds.
+    The page renders `warnings` verbatim, so a fixture has to carry the words the source actually
+    produces — hand-written prose here would pass a page test while the real sentence changed shape.
+    The section is the smallest one that trips `haproxy_route_dangling`: a frontend routing to a
+    backend no `backend` block declares, which is the kind this fleet's capture provably does **not**
+    have (pinned in `tests/test_gateway_source.py`).
+    """
+    broken = {"available": True,
+              "frontends": [{"name": "ssh", "default_backend": "gitea-2222",
+                             "backends": ["gitea-2222"],
+                             "binds": [{"addr": "::", "port": 22}]}],
+              "backends": []}
+    found = gateway_source.warnings(broken, None)
+    assert len(found) == 1 and found[0]["kind"] == "haproxy_route_dangling", found
+    return found
+
+
+def _warnings_section(html: str) -> str:
+    """The warnings panel's own markup, from its opening tag to its `</section>`."""
+    start = html.index('id="gate-warnings"')
+    head = html.rindex("<", 0, start)
+    return html[head:html.index("</section>", start) + len("</section>")]
+
+
+def test_the_gateway_page_is_exactly_two_connection_panels_and_a_warnings_list(client) -> None:
+    """The page's shape, on the bytes it serves: two panels, one warnings list, four tallies.
+
+    Exactly two `[data-gate]` articles — `nginx` then `haproxy`, **ordered**, because the operator
+    named nginx first and it carries this fleet's widest fan-out — each shipping the `gate-map` its
+    trunk→leaf groups are injected into, its `empty` sentence and its chart disclosure. No `stream
+    map` panel and no `unmatched` panel: the `map` is nginx config, so its seventeen entries are that
+    panel's `:443` leaves, and a socket neither file describes is reported nowhere (phase 30 task
+    02). Above the panels sits `#gate-warnings`, which ships `hidden` because a clean ingress has
+    nothing to list and a permanent empty "Warnings to address" is the ink the empty-state rules
+    exist to avoid.
+
+    The four tallies are what the two configs **declare** (`ports`, `connections`), the one number
+    the kernel adds (`live`, the open sockets on a port a config names) and `warnings`. The socket
+    table's own size is not a cell any more: it is not reconcilable with the map, and a tally an
+    operator cannot account for is one they learn to skip. There is also no `#range` control, and
+    that is a decision, not an omission: the history here is a count trend and one window for every
+    panel is the honest default for a source that re-reads every 30 seconds.
     """
     html = _code(client.get(GATEWAY_PAGE).text)
+    keys = re.findall(r'data-gate="([^"]+)"', html)
+    assert keys == list(GATEWAY_CARD_KEYS), (
+        f"/gateway ships {keys}; the page is exactly the two config panels, nginx first")
+    assert 'data-gate="map"' not in html, "the stream map grew a panel of its own back"
+    assert 'data-gate="unmatched"' not in html, "the residual grew a panel back"
     for key in GATEWAY_CARD_KEYS:
-        assert f'data-gate="{key}"' in html, f"/gateway has no {key} card"
-    for key in GATEWAY_CARD_KEYS[:3]:
         card = html[html.index(f'data-gate="{key}"'):]
         card = card[:card.index("</article>")]
-        assert 'class="pipe-columns"' in card, f"the {key} card has no pipe frame"
-        assert 'data-k="node"' in card, f"the {key} card has no gateway node"
-        for column in ("in", "out"):
-            assert f'data-k="{column}"' in card, f"the {key} card has no {column}bound column"
-        assert 'data-chart="conns"' in card, f"the {key} card has no count plot"
-    for tally in ("t-listeners", "t-established", "t-inbound", "t-outbound", "t-unmatched"):
-        assert f'id="{tally}"' in html, f"/gateway lost the {tally} reconciliation cell"
+        assert 'class="gate-map" data-k="map"' in card, f"the {key} panel has no group list"
+        assert 'data-k="empty"' in card, f"the {key} panel has no empty sentence"
+        assert 'data-chart="conns"' in card, f"the {key} panel has no count plot"
+        assert 'data-legend="conns"' in card, f"the {key} panel's plot has no legend"
+
+    panel = _warnings_section(html)
+    assert "hidden" in panel[:panel.index(">")], (
+        "the warnings panel ships visible, so a clean ingress renders an empty card")
+    assert '<ul class="alerts" id="warnings-list">' in panel, (
+        "the warnings rows do not use the overview's `ul.alerts` vocabulary")
+    assert 'id="warnings-count"' in panel
+
+    for tally in ("t-ports", "t-connections", "t-live", "t-warnings"):
+        assert f'id="{tally}"' in html, f"/gateway lost the {tally} tally"
+    for gone in ("t-listeners", "t-established", "t-inbound", "t-outbound", "t-unmatched"):
+        assert f'id="{gone}"' not in html, f"/gateway grew the {gone} cell back"
     assert 'id="range"' not in html, "/gateway grew window chips over a gauge that has no rate"
     assert 'src="/static/page-gateway.js"' in client.get(GATEWAY_PAGE).text
 
@@ -5679,10 +5968,14 @@ def test_the_gateway_page_prints_every_field_the_projection_publishes(
     """Every label the page builds is a key the payload really sends, resolved over HTTP.
 
     This is the rename catcher the slot grid and the `/certs` table already have, and the gateway
-    page needs it more than either: its labels are joined out of three different structures (a
-    pipe's `target`, the stream map's `key`, a group's `hosts`), so a rename in one of them would
-    otherwise draw a plausible pipe with the wrong host on it — worse than `n/a`, because nothing
-    about the picture would look broken.
+    page needs it more than either: a row is joined out of four structures (the trunk's port, the
+    endpoint's `host`/`port`, the config's `selectors`, the join's `connections`), so a rename in one
+    of them would otherwise draw a plausible line with the wrong target on it — worse than `n/a`,
+    because nothing about the picture would look broken.
+
+    The `warnings.*` paths are resolved twice, over a clean document and over one carrying a real
+    row from `sources/gateway.warnings()`: a path into an **empty** list is trivially present, so a
+    single pass over this fleet's clean configs could never catch `subject` becoming `name`.
     """
     payload = gateway_client.get("/api/gateway/snapshot").json()
     assert payload["supported"] is True and payload["host"] == "gateway"
@@ -5690,62 +5983,98 @@ def test_the_gateway_page_prints_every_field_the_projection_publishes(
         found, _values = _payload_field(payload, path)
         assert found, f"/gateway indexes {path}, which the payload does not publish"
 
-    # The three families the cards are keyed on are the payload's own `source` words, and the
-    # card table would silently lose a family if `sources/gateway.py` ever renamed one.
-    sources = {pipe["source"] for pipe in payload["inbound"]}
-    sources |= {pipe["source"] for pipe in payload["outbound"]}
-    assert sources == set(GATEWAY_CARD_KEYS[:3]), \
-        f"the payload's `source` words are {sorted(sources)} and the page ships {GATEWAY_CARD_KEYS[:3]}"
+    broken = gateway_client.get("/api/gateway/snapshot").json()
+    broken["warnings"] = one_real_warning()
+    for path in GATEWAY_PAGE_FIELDS:
+        found, values = _payload_field(broken, path)
+        assert found, f"/gateway indexes {path}, which a warning row does not carry"
+        if path.startswith("warnings."):
+            assert values and all(value for value in values), (
+                f"{path} is empty on the row the source writes — the page would print nothing for it")
+
+    # The two families the panels are keyed on are the payload's own `source` words, and the panel
+    # table would silently lose a family if `sources/gateway.py` ever renamed one. Both sides of the
+    # map use the same words, so a drift between them is caught here too.
+    sources = {row["source"] for row in payload["listeners"]}
+    assert {row["source"] for row in payload["connections"]} <= sources, (
+        "a route is filed under a config family no trunk of this page carries")
+    assert sources == set(GATEWAY_CARD_KEYS), \
+        f"the payload's `source` words are {sorted(sources)} and the page ships {GATEWAY_CARD_KEYS}"
 
 
 def test_every_pipe_is_an_accessible_image_built_from_the_payload(client) -> None:
-    """Each pipe is `role="img"` + an `aria-label` naming its port or target and its count.
+    """Each connection line is `role="img"` + an `aria-label` naming its port, target and count.
 
-    The battery glyph's convention (`DashCharts.battery`), for the same reason: the pipe carries
-    information the markup does not say in words, and here it is worse — a pipe is a *line*, so
-    without a name a screen reader gets a card that says `haproxy` and nothing about the six
-    connections on it. Built with `createElementNS` + `setAttribute`, never `innerHTML`, because
-    the domains and client addresses in that sentence are upstream strings.
+    The battery glyph's convention (`DashCharts.battery`), for the same reason: the line carries
+    information the markup does not say in words, and here it is worse — a line is a *line*, so
+    without a name a screen reader gets a panel that says `nginx` and nothing about the seventeen
+    connections on it. Built with `createElementNS` + `setAttribute`, never `innerHTML`, because the
+    domains, client addresses and `server_name`s in that sentence are upstream strings.
+
+    The trunk's facts (live count, client addresses, domain count) are text rather than an image,
+    so they are pinned as the renderer that assigns them: the same four payload fields have to reach
+    the page whichever component draws them.
     """
     js = _code(client.get("/static/page-gateway.js").text)
-    assert "createElementNS(SVG_NS" in js, "the pipe is no longer hand-rolled SVG"
+    assert "createElementNS(SVG_NS" in js, "the line is no longer hand-rolled SVG"
     assert "http://www.w3.org/2000/svg" in js
-    pipe = js[js.index("function buildPipe("):js.index("function pipeRow(")]
+    pipe = js[js.index("function buildPipe("):js.index("function leafRow(")]
     assert "createElementNS" in pipe and "'path'" in pipe
-    rendered = js[js.index("function renderPipeRow("):js.index("function renderPipes(")]
+    rendered = js[js.index("function renderLeaf("):js.index("function groupElement(")]
     assert "svg.setAttribute('role', 'img')" in rendered
-    assert "aria-label" in rendered and "pipeAria(" in rendered
-    aria = js[js.index("function pipeAria("):js.index("function buildPipe(")]
-    for fact in ("pipe.port", "pipe.connections", "pipe.domains", "pipe.clients"):
-        assert fact in aria, f"the pipe's accessible name stopped saying {fact}"
-    assert "connections unknown" in aria, \
-        "a pipe whose join did not decide must not be announced as a zero"
-    # upstream text reaches the page through textContent and title, and nothing else
+    assert "aria-label" in rendered and "leafAria(" in rendered
+    aria = js[js.index("function leafAria("):js.index("function buildPipe(")]
+    for fact in ("conn.in", "endpointText(out)", "out.selectors", "conn.connections"):
+        assert fact in aria, f"the line's accessible name stopped saying {fact}"
+    assert "conn.shared === true" in aria, (
+        "a line sharing its endpoint with another route must say so out loud, or the two numbers "
+        "read as twice the traffic")
+    assert "connections not attributed" in aria, \
+        "a line whose join could not count its target must not be announced as a zero"
+    trunk = js[js.index("function renderTrunk("):js.index("function renderLeaves(")]
+    for fact in ("listener.connections", "listener.clients", "listener.domains"):
+        assert fact in trunk, f"the trunk stopped saying {fact}"
+    # upstream text reaches the page through textContent and title, and nothing else …
     assert "innerHTML" not in rendered
     assert "textContent" in js and "escapeHtml" not in js, \
         "the page hand-escapes strings it only ever assigns through textContent"
+    # … and the markup the page does template with `innerHTML` is static: no payload string, ever
+    for template in re.findall(r"innerHTML = `([^`]*)`", js):
+        assert "${" not in template, f"a template interpolates upstream text: {template!r}"
 
 
 def test_a_pipe_moves_only_while_it_carries_a_connection(client) -> None:
-    """The animation is the connection, and nothing else.
+    """Motion is the connection; colour is the config. Two class pairs, and neither borrows the other.
 
-    Three declarations and each is one half of the claim: `stroke-dasharray` + an `animation` on
-    the **live** rule and not the base one (so a pipe with no connections cannot inherit motion),
-    a keyframe whose only property is `stroke-dashoffset` (the dash travelling is the whole
-    animation — colour is not part of it, because colour would be a verdict), and a static state
-    that declares no animation and is drawn faint. `vector-effect="non-scaling-stroke"` is in the
-    script: the pipe is stretched to the card's width, and without it the stroke width would scale
-    with it and a wide card would draw a thick pipe.
+    Phase 30 task 05 split what had been one `live`/`still` claim into two, because the operator's
+    green means *the route is in the config* and a resting route is still in the config:
+
+    * `live` / `still` — "a socket is open on this pipe this instant" — decides **motion only**. The
+      `animation` lives on the live rule and nowhere else, the static rule declares none, and the
+      live rule declares no `stroke`: a busy line and a quiet one are the same colour, or motion has
+      become a verdict.
+    * `on` / `off` — "a proxy config declares this route" — decides **stroke only**
+      (`test_a_connection_is_green_because_it_is_in_the_config`).
+
+    The keyframe's only property stays `stroke-dashoffset`: the dash travelling is the whole
+    animation, and animating a colour would put a number's judgement inside a line. And
+    `vector-effect="non-scaling-stroke"` stays in the script: the pipe is stretched to the card's
+    width, so without it a wide card would draw a thick pipe.
     """
     section = _code(_css_section(_css(client), "gateway pipes"))
     live = _declarations(section, ".pipe.live .pipe-path")
     assert live.get("animation", "").startswith("pipe-flow"), \
         "the animated state no longer runs the flow animation"
+    assert live.get("stroke") is None, (
+        "the live rule paints again, so a resting route no longer looks like the configured route "
+        "it is — colour belongs to `on`/`off` and motion belongs to `live`/`still`")
     assert _declarations(section, ".pipe-path").get("animation") is None, \
-        "motion moved onto the base rule: every pipe animates, idle ones included"
+        "motion moved onto the base rule: every pipe animates, resting ones included"
     still = _declarations(section, ".pipe.still .pipe-path")
     assert still.get("animation") is None, "the static state animates — zero is not traffic"
     assert still.get("stroke-dasharray"), "the static pipe lost its dotted rest state"
+    assert still.get("stroke") is None, \
+        "`still` colours itself again: a resting route must keep the config's green"
     keyframes = re.search(r"@keyframes\s+pipe-flow\s*\{(.+?)\n\}", section, re.S)
     assert keyframes, "the flow animation has no keyframes to run"
     body = keyframes.group(1)
@@ -5755,17 +6084,143 @@ def test_a_pipe_moves_only_while_it_carries_a_connection(client) -> None:
     js = _code(client.get("/static/page-gateway.js").text)
     assert "svg.classList.toggle('live', live)" in js
     assert "svg.classList.toggle('still', !live)" in js
-    assert "pipe.connections > 0" in js, \
+    assert "conn.connections > 0" in js, \
         "the live test is no longer the connection count itself"
     assert 'vector-effect' in js
 
 
+def test_a_connection_is_green_because_it_is_in_the_config(client) -> None:
+    """`--gate-on` is the whole colour story, and it answers *does the config say so*.
+
+    The operator's words were "green if the connection is active", with active defined in the phase
+    as *written in the nginx / haproxy config*. That is an **existence** state, so it gets its own
+    pair of tokens (`--gate-on` / `--gate-off`, declared once in `:root` as a substitution of the
+    verdict colours so both themes follow) and it never borrows `--ok` — a route existing is not
+    good news, and a colour the operator reads as a judgement on a number is exactly what
+    `severity.py` refuses to publish for a `gateway.*` metric.
+
+    Four things make the pair mean something rather than merely exist, and each is one of the ways
+    this could silently rot: the base `.pipe-path` rule declares **no** `stroke`, so colour can only
+    arrive through a state class; `.pipe.on` and `.pipe.off` are the two classes that carry it; the
+    script puts `on` on every connection it draws (a row exists because a config declared it, so
+    `off` is a styled seam for the write phase, not a second state in use); and the `off` half is
+    declared, which is the only reason the pair is a pair.
+    """
+    css = _css(client)
+    code = _code(css)
+    light_at = code.index('[data-theme="light"]')
+    root = code[code.index(":root {"):light_at]
+    assert re.search(r"--gate-on:\s*var\(--ok\)", root), (
+        "`--gate-on` stopped being the one indirection over the theme colours — a literal here "
+        "would not follow `[data-theme=\"light\"]` and the page would need a second declaration")
+    assert re.search(r"--gate-off:\s*var\(--fail\)", root), "`--gate-off` is missing from `:root`"
+    assert code.count("--gate-on:") == 1 and code.count("--gate-off:") == 1, \
+        "the existence pair is declared more than once, which is how a pair drifts from its theme"
+
+    section = _code(_css_section(css, "gateway pipes"))
+    assert _declarations(section, ".pipe-path").get("stroke") is None, \
+        "the base rule paints, so a pipe has a colour the state classes did not grant it"
+    assert _declarations(section, ".pipe.on .pipe-path").get("stroke") == "var(--gate-on)", \
+        "the in-the-config state stopped taking its green from the existence pair"
+    assert _declarations(section, ".pipe.off .pipe-path").get("stroke") == "var(--gate-off)", \
+        "the out-of-the-config state has no colour, so the pair is half a vocabulary"
+
+    js = _code(client.get("/static/page-gateway.js").text)
+    assert "svg.classList.toggle('on', on)" in js and "svg.classList.toggle('off', !on)" in js, \
+        "the existence classes are not both driven from one value, so a row can contradict itself"
+    exists = js[js.index("function routeInConfig("):js.index("function buildSwitch(")]
+    assert "return true" in exists, (
+        "a drawn connection is no longer unconditionally in the config — if the payload grew a way "
+        "to say otherwise, this test and `GATEWAY_PAGE_FIELDS` both have to learn about it")
+    assert "const on = routeInConfig(conn)" in js
+
+
+def test_haproxy_draws_straight_across_and_nginx_branches(client) -> None:
+    """The geometry the operator asked for, in four rules and zero JavaScript.
+
+    "The dotted line connections need to connect to their counterparts. This is easy for haproxy —
+    just draw the line straight across. For nginx you'll need to branch the lines from `:443` to the
+    services they connect to." The answer is a spine plus a tick per leaf, and the spine is built out
+    of the rows themselves: each `.gate-link` carries its own upper half (`::before`) and lower half
+    (`::after`) at the gutter's left edge, and the first and last rows drop the half that would stick
+    out of the fan-out. That is why the spine starts at the first branch and stops at the last with
+    no mask, no measured height and no background-coloured eraser — and why it is still right on the
+    poll that adds a leaf, which any `ResizeObserver` version would have to be re-run to discover.
+
+    `.gate-group.solo`, set by the script from the group's own leaf count, takes the two halves away:
+    one route off a port is not a branch, and haproxy's six one-`server` frontends must read as one
+    straight line. `column-gap: 0` on the group is what makes the trunk's right edge and the spine
+    the same x, so the tick starts *at* the trunk rather than a gap short of it.
+    """
+    section = _code(_css_section(_css(client), "gateway pipes"))
+
+    before = _declarations(section, ".gate-link::before")
+    after = _declarations(section, ".gate-link::after")
+    for name, rule in (("::before", before), ("::after", after)):
+        assert rule.get("border-left") == "2px dashed var(--border-strong)", \
+            f"the spine's {name} half lost its dashed border"
+        assert rule.get("position") == "absolute" and rule.get("left") == "0", \
+            f"the spine's {name} half no longer sits in the row's gutter"
+    assert before.get("top") == "calc(var(--gate-leaf-gap) / -2)", \
+        "the upper half no longer starts half a leaf gap above its row"
+    assert after.get("top") == "50%", "the lower half no longer starts at the row's centre"
+    half = "calc(50% + var(--gate-leaf-gap) / 2)"
+    assert before.get("height") == half and after.get("height") == half, (
+        "a half no longer reaches half a gap past its own row, so consecutive rows stop meeting and "
+        "the spine becomes a stack of brackets; and if it reached further it would run past the ends "
+        "of the list, which the rule below is what prevents")
+    assert _declarations(section, ".gate-leaves").get("gap") == "var(--gate-leaf-gap)", \
+        "the leaf list's gap is a literal again, so the spine's reach and the gap can drift apart"
+    assert re.search(r"--gate-leaf-gap:\s*\.3rem", _code(_css(client))), \
+        "`--gate-leaf-gap` is no longer declared in `:root`"
+    assert _declarations(section, ".gate-link:first-child::before, .gate-link:last-child::after").get(
+        "display") == "none", "the fan-out grew a spine past its first and last branch"
+    assert "2px dashed" in _declarations(section, ".gate-elbow").get("border-top", ""), \
+        "the tick from the spine to the switch is gone, so a leaf no longer reaches its trunk"
+
+    solo = _declarations(
+        section, ".gate-group.solo .gate-link::before, .gate-group.solo .gate-link::after")
+    assert solo.get("display") == "none", (
+        "a one-leaf group draws the vertical again — haproxy's six frontends would each grow a "
+        "branch stub where the line is supposed to run straight across")
+    assert _declarations(section, ".gate-group").get("column-gap") == "0", \
+        "the trunk and the spine are no longer the same x, so the tick starts in mid-air"
+    columns = _declarations(section, ".gate-link").get("grid-template-columns", "")
+    assert columns.startswith("26px "), \
+        f"the row's gutter is not a fixed 26px any more ({columns}), so the spine drifts"
+
+    # The phone stacks the trunk *above* its leaves, so the first row's upper half comes back and
+    # reaches into the group's row gap. Pinned inside the media query, because outside it this rule
+    # would be the desktop defect the paragraph above forbids.
+    mobile = section[section.index("@media (max-width: 640px)"):]
+    reach = re.search(r"\.gate-link:first-child::before\s*\{([^}]*)\}", mobile)
+    assert reach, "the stacked phone layout stopped reconnecting the trunk to its spine"
+    rules = _declarations(mobile, ".gate-link:first-child::before")
+    assert rules.get("display") == "block", "the reaching half is still switched off on a phone"
+    assert rules.get("top") == "calc(var(--gate-row-gap) * -1)", (
+        f"the reach is {rules.get('top')!r} rather than the group's own row gap negated — a literal "
+        "would leave the spine short of the trunk the day the rhythm moved")
+    assert "var(--gate-row-gap)" in rules.get("height", ""), \
+        "the reaching half grew by a different number than it moved"
+
+    js = _code(client.get("/static/page-gateway.js").text)
+    assert "el.classList.toggle('solo', group.connections.length === 1)" in js, (
+        "`.solo` is no longer the group's own leaf count, so the straight-across rule is keyed on "
+        "something other than the thing it means")
+    assert "function gateLink" not in js, \
+        "a JS-measured connector came back; the branch is CSS and stays right without measuring"
+
+
 def test_the_pipe_animation_stills_in_both_states_under_reduced_motion(client) -> None:
-    """The one reduced-motion block names `.pipe.live` **and** `.pipe.still`.
+    """The one reduced-motion block names `.pipe.live`, `.pipe.still` **and** `.gate-switch-thumb`.
 
     The menu's pair above (phase 20 task 03) is the precedent and the reason: the animated rule
     out-specifies the base one, so stilling only the static state would leave every busy pipe
     flowing for someone who asked for no motion. Same single block, because two blocks drift.
+
+    Phase 30 task 05 added the third name, and it is not decoration: the switch's knob slides on a
+    `transition` of its own, and a block that stills the pipes while the thumb keeps sliding is the
+    phase-18 lesson half-applied — the operator asked for no motion, not for less of it.
     """
     code = _code(_css(client))
     block = re.search(r"@media\s*\(prefers-reduced-motion:\s*reduce\)\s*\{(.*?)\n\}",
@@ -5779,21 +6234,43 @@ def test_the_pipe_animation_stills_in_both_states_under_reduced_motion(client) -
         f"animating for someone who asked for no motion; got {sorted(named)}")
     assert _declarations(block.group(1), ".pipe.still .pipe-path").get("animation") == "none", \
         "the named rules stopped stilling the animation"
+    assert _declarations(block.group(1), ".gate-switch-thumb").get("transition") == "none", \
+        "the switch's knob still slides when the operator asked for no motion"
+    # …and every animated thing on the page is in this block, counted rather than trusted: a third
+    # `transition` added to the map later has to be named here, not assumed to be covered.
+    animated = {".pipe.live .pipe-path", ".pipe.still .pipe-path", ".gate-switch-thumb"}
+    transitioned = {" ".join(sel.split()) for sel, body in
+                    re.findall(r"([^{}]+)\{([^}]*)\}", _code(_css_section(_css(client),
+                                                                            "gateway pipes")))
+                    if "transition:" in body or "animation:" in body}
+    assert transitioned <= animated, (
+        f"{sorted(transitioned - animated)} animates in the gateway map without being stilled")
 
 
 def test_no_gateway_count_is_coloured_by_a_verdict(client) -> None:
-    """The `net.*` precedent, applied to the fifth dashboard.
+    """The pipes and switches colour from **existence**, and the verdict vocabulary stays out.
 
-    A busy ingress is the job on this fleet, `severity.py` has no `gateway.*` row, and
-    `/api/gateway/snapshot` publishes no `severity` at any depth (task 03 pins that over HTTP);
-    so the page may not colour a pipe, a count, or a tally. What is pinned is the absence of the
-    whole vocabulary — the tokens, the class names, and the two JS helpers that would have applied
-    a verdict — across the stylesheet section, the script and the markup, comments stripped
-    because prose is allowed to *name* a colour the code must not paint.
+    Phase 30 task 05 gave `/gateway` its green, and the whole point of that green is that it is not
+    the severity language: `--gate-on` means *this route is written in a proxy config*, and
+    `--gate-off` means the opposite. It is an existence state, so it lives in its own pair of tokens
+    (`test_a_connection_is_green_because_it_is_in_the_config` pins the pair, where it is declared,
+    and that the base `.pipe-path` carries no colour of its own) and nowhere near `--ok`.
 
-    The reachability **dot** is the one thing here that reads `ok|warn|fail`, and it is not a
-    verdict on a number: it is the job's health, the same dot every other page's card header
-    draws from the same `states` row.
+    So the absence this test exists for is unchanged, and it is now the thing that keeps task 05's
+    green honest: a busy ingress is the job on this fleet, `severity.py` has no `gateway.*` row, and
+    `/api/gateway/snapshot` publishes no `severity` at any depth (task 03 pins that over HTTP), so no
+    line, count, tally or switch may be graded. The whole vocabulary is pinned absent — the tokens,
+    the class names, and the two JS helpers that would have applied a verdict — across the stylesheet
+    section, the script and the markup, comments stripped because prose is allowed to *name* a colour
+    the code must not paint.
+
+    Two things read `ok|warn|fail` and neither is a verdict on a number. The reachability **dot** is
+    the job's health, the same dot every other page's card header draws from the same `states` row.
+    And the **warnings list** borrows the overview's `li.warn` row shape verbatim, because "a route
+    that does not connect to itself" is the same kind of sentence `/` prints and it is `alerts.py`'s
+    verdict, not a number's — so the pin is that exactly one `className` assignment in the whole
+    script says `warn`, and it is inside `renderWarnings`, while every row, line, switch and tally
+    renderer stays free of it.
     """
     section = _code(_css_section(_css(client), "gateway pipes"))
     for token in ("--ok", "--warn", "--fail", ".ok", ".warn", ".fail", "severity"):
@@ -5802,6 +6279,15 @@ def test_no_gateway_count_is_coloured_by_a_verdict(client) -> None:
     for helper in ("severityFrom", "severityFor", ".severity"):
         assert helper not in js, f"/gateway grades a number with {helper}"
     assert "setDot(" in js, "and the reachability dot is still drawn (that one is health)"
+    assigned = re.findall(r"className = '([^']*)'", js)
+    assert assigned.count("warn") == 1, (
+        f"`warn` is painted in {assigned.count('warn')} places; only the warnings list may say it")
+    warn_body = js[js.index("function renderWarnings("):js.index("function dotFor(")]
+    assert "li.className = 'warn'" in warn_body, (
+        "the one `warn` in the script is no longer the warnings row — re-check what is coloured")
+    for cls in assigned:
+        assert cls == "warn" or not any(v in cls for v in ("ok", "fail")), (
+            f"a verdict class ({cls}) entered the map itself")
     html = _code(client.get(GATEWAY_PAGE).text)
     for token in ('class="ok', 'class="warn', 'class="fail', "severity"):
         assert token not in html, f"/gateway markup carries {token}"
@@ -5825,7 +6311,7 @@ def test_gateway_charts_are_collapsed_lazy_and_cost_one_history_request_per_card
     draw = js[js.index("function drawCardCharts("):js.index("async function renderCardCharts(")]
     assert draw.index("if (!chartsOpen(key)") < draw.index("cardChart(key)"), \
         "the paint pass builds charts before it asks whether the stack is open"
-    fetch = js[js.index("async function renderCardCharts("):js.index("function sumConnections(")]
+    fetch = js[js.index("async function renderCardCharts("):js.index("function sumLive(")]
     assert "/api/gateway/history" in fetch and "&range=" in fetch
     assert fetch.count("fetchJSON") == 1, "a card now costs more than one history request"
     assert "snapshot.host" in fetch, \
@@ -5838,86 +6324,93 @@ def test_gateway_charts_are_collapsed_lazy_and_cost_one_history_request_per_card
         "the legend is naming pipes the plot never drew — a permanent `n/a` row per map target"
 
 
-def test_the_unmatched_remainder_is_printed_and_never_folded_into_a_total(
+def test_the_page_reports_no_card_and_no_cell_for_sockets_the_configs_do_not_name(
         client) -> None:
-    """The operator's fact: the gateway talks to something the configs do not name.
+    """The deletion, pinned as an absence so it cannot come back quietly.
 
-    Three cells and never one sum, because `other` counts **ports** while the other two count
-    **connections** — adding them would be a number with no unit. The `groups` list is the
-    "could belong to any of 16 targets" sentence, built node by node out of the payload (the
-    hostnames are upstream strings), and the page hides the whole card when nothing is left over
-    rather than keeping a permanent row of zeroes that trains the eye past the one that matters.
+    Phase 29 shipped an `unmatched` card (three cells: ports no config names, connections inbound,
+    connections outbound) and a `by port` chip, both of which existed to report the residual of a
+    join that could only ever credit a **port**. On the live router that residual was mostly this
+    app's own agent (`:9120`) and SSH — noise dressed as a signal, and a card of it teaches the
+    operator to ignore the panel. So this pins that neither the markup, nor the script, nor the
+    stylesheet carries the vocabulary any more, in the page's own words and in the payload's.
+
+    What replaced it stays pinned too: the header's live tally still refuses to total a side that
+    did not measure (`0` there would be a claim about traffic nobody counted), and still dims when a
+    port that should have had a number did not.
     """
     html = _code(client.get(GATEWAY_PAGE).text)
-    card = html[html.index('data-gate="unmatched"'):]
-    card = card[:card.index("</article>")]
-    for key in ("um-other", "um-in", "um-out", "groups"):
-        assert f'data-k="{key}"' in card, f"the unmatched card lost its {key} field"
-    assert "listeners no config names" in card
-    assert "connections inbound" in card and "connections outbound" in card
-
     js = _code(client.get("/static/page-gateway.js").text)
-    group = js[js.index("function groupRow("):js.index("function renderUnmatched(")]
-    assert "createElement('li')" in group and "innerHTML" not in group
-    assert "host_count" in group and "could be any of" in group
-    visible = js[js.index("function unmatchedVisible("):js.index("function groupRow(")]
-    assert "un.other" in visible and "un.inbound" in visible and "un.outbound" in visible
-    assert "> 0" in visible, "the card is no longer gated on there being something unaccounted for"
-    assert "== null" not in visible, \
-        "an all-unknown remainder opened a card of three n/as — the why-line already says that"
+    css = _code(_css(client))
+    for name, text in (("markup", html), ("script", js), ("stylesheet", css)):
+        for token in ("unmatched", "um-other", "um-in", "um-out", "gate-groups", "by_port",
+                      "by port", "pipe-columns", "pipe-node", "pipe-col", "solo-out", "solo-in"):
+            assert token not in text, f"/gateway's {name} still carries {token!r}"
+    assert 'data-gate="map"' not in html, "the stream map grew its panel back"
 
-    # …and the same two rules one level up, in the header's pipe totals: an unknown pipe adds
-    # nothing to the number and the cell says so (`/llm`'s fleet block drawing `/api/summary`'s
-    # `partial` flag), while a side where nothing measured at all has no total — `0` there would be
-    # a claim about traffic the join never made.
-    sums = js[js.index("function sumConnections("):js.index("function renderHeader(")]
+    # The rules that survived the deletion, in the function that computes the header's live total
+    # and the one that paints it.
+    sums = js[js.index("function sumLive("):js.index("function setTally(")]
     assert "unknown += 1" in sums and "attributed" in sums
-    assert "unknown === pipes.length ? null" in sums, \
+    assert "unknown === counted.length ? null" in sums, \
         "a side where nothing measured started reporting a zero total"
-    assert "classList.toggle('stale'" in sums, \
-        "a partial pipe total stopped saying it was partial"
-
-    # The three names above are sentences, not column headings, and `.metric .label` truncates
-    # with an ellipsis — so in this card they wrap rather than lose their tail (phase 27).
-    wrapped = _declarations(_code(_css(client)), ".gate-card .metric .label")
-    assert wrapped.get("white-space") == "normal", \
-        "an unmatched-card label that does not fit is a clipped fact"
+    assert "filter((row) => row.metric)" in sums, (
+        "a row that publishes no gauge is not an unmeasured port — it is absent, and counting it "
+        "would hold the total hostage")
+    tally = js[js.index("function setTally("):js.index("function renderHeader(")]
+    assert "classList.toggle('stale'" in tally, \
+        "a total that left a port out stopped saying it was partial"
+    assert "sum == null ? null : sum.attributed" in tally, \
+        "an unmeasured side must print n/a, not 0"
 
 
-def test_the_by_port_join_is_explained_once_on_the_page(client) -> None:
-    """The one why-line a count on this page needs, and the one place it is printed.
+def test_the_page_says_where_a_line_comes_from_and_where_its_count_cannot(client) -> None:
+    """Three footnotes, one per claim the page is allowed to make, and not one more.
 
-    `by port` is the join's honest mark for "the socket matched the port and the config, not the
-    address, named the host" (sixteen stream targets share `:443` on this gateway). Without the
-    sentence the count reads as a per-target measurement, which is the same misreading the
-    `unmatched.groups` list exists to prevent. So: a chip on the pipe that carries the mark, a
-    tooltip that says it in full, and one faint footnote in the page footer — the page's single
-    why-line, not a paragraph per card.
+    Why the page draws a line at all (the config declares the route) and what its motion means (a
+    socket is open this instant, so a resting line is not a dead one); why an endpoint written as a
+    **name** carries no number (nothing here resolves one, so a dash is not a fault); and what the
+    switch does **not** do (toggling a route needs a config write path this app does not have).
+    Each lives in the footer exactly once — the page does not repeat a why-line per panel, and it
+    does not need to: an uncounted line prints `—` and the footnote is the sentence that explains it
+    (rule 2).
     """
     html = client.get(GATEWAY_PAGE).text
     footer = html[html.index("<footer"):]
-    assert footer.count("by port") == 1, (
-        "the by-port sentence is the page's single footnote — printed once, in the footer")
+    assert footer.count("resolves nothing") == 1, (
+        "the no-DNS rule is the page's single footnote about a missing count — printed once")
+    assert "animates" in footer, "the animation rule lost its footnote"
+    band = footer[:footer.index("</footer>")]
+    # Three paragraphs and nothing else: one sentence per claim, in one ink band under the panels.
+    assert band.count("<p") == 3, f"the footer is {band.count('<p')} paragraphs, not three"
+    assert "<span" not in band, "the footer grew a second element inside a sentence"
+    assert "the config says the route exists" in band, "the page stopped saying what a line means"
+    assert "not wired up" in band and "write" in band, \
+        "the switch stopped saying it does nothing yet"
+    assert "coloured by a verdict" in band and "address" in band, \
+        "a claim the page still has to make left with the rewrite"
     js = _code(client.get("/static/page-gateway.js").text)
-    assert "setTxt(flag, 'by port')" in js, "the chip that carries the mark is gone"
-    assert "target.by_port" in js
-    assert "matched on the port alone" in js
+    counts = js[js.index("function countText("):js.index("function groupsFor(")]
+    assert "return null" in counts or ": null" in counts, \
+        "an unmeasured count must stay null for setTxt to print n/a"
 
 
 def test_the_gateway_page_renders_each_degradation_arm_in_the_payloads_own_words(
-        client) -> None:
-    """Three arms, three sentences, none of them invented in the browser.
+        client, gateway_client) -> None:
+    """Four arms, four sentences, none of them invented in the browser.
 
     * **unconfigured** — `404 {configured: false}`. The route's own refusal names `GATEWAY_HOST`,
-      and the page's setup block is the other half of the same sentence; the cards stay hidden
+      and the page's setup block is the other half of the same sentence; the panels stay hidden
       because there is nothing to draw and nothing to age (invariant 3).
-    * **a pre-1.2.0 agent / `--no-proxy`** and **a socket table that did not answer** — both
-      arrive as `payload.why`, which `sources/gateway.py` writes (with the agent's own error line
-      when it had one), so the page prints `#gate-banner` from the payload and never re-derives a
-      sentence of its own about someone else's config.
-    * every case that did not measure keeps its numbers as `n/a`, which `setTxt` does with a
-      `null` and which `countText` is the only gate for — there is no `|| 0` anywhere on a count,
-      because a zero is a claim about traffic and `n/a` is not.
+    * **a host that has never answered** and **a pre-1.2.0 / `--no-proxy` agent** — both dim
+      (`unreachable`, or `supported !== true`) rather than redden, and both arrive with
+      `payload.why` already written by `sources/gateway.py` (with the agent's own error line when it
+      had one), so the page prints `#gate-banner` from the payload and never re-derives a sentence of
+      its own about someone else's config.
+    * **a socket table that did not answer** — the configs still draw and only the counts go `n/a`.
+    * every case that did not measure keeps its numbers as `n/a`, which `setTxt` does with a `null`
+      and which `countText` is the only gate for — there is no `|| 0` anywhere on a count, because a
+      zero is a claim about traffic and `n/a` is not.
     """
     html = _code(client.get(GATEWAY_PAGE).text)
     empty = html[html.index('id="gate-empty"'):html.index('</div>', html.index('id="gate-empty"'))]
@@ -5934,11 +6427,27 @@ def test_the_gateway_page_renders_each_degradation_arm_in_the_payloads_own_words
     assert "unreachable" in dimmed and "supported !== true" in dimmed, \
         ("the dim is keyed on something other than the two arms that did not measure — a host that "
          "has never answered and an agent that predates the sections are the `.stale` cases")
-    counts = js[js.index("function countText("):js.index("function familyPipes(")]
+    counts = js[js.index("function countText("):js.index("function groupsFor(")]
     assert "return null" in counts or ": null" in counts, \
         "countText no longer turns the unknown into the `n/a` setTxt prints"
     assert not re.search(r"connections\s*\|\|\s*0", js), "a missing count became a claimed zero"
 
+    # …and the tallies obey the same rule over a real payload: an arm that measured nothing prints
+    # `n/a` in every cell rather than four zeros about a config nobody read.
+    silent = gateway_client.get("/api/gateway/snapshot").json()
+    header = js[js.index("function renderHeader("):js.index("async function refresh(")]
+    assert "measured ?" in header and "!dimmed(snapshot)" in header, (
+        "the tallies are no longer keyed on the two arms that did not measure")
+    assert silent["sockets"]["established"] >= 0, "the control: this payload did measure"
+
+    stub = dict(silent)
+    stub["supported"] = None
+    stub["unreachable"] = True
+    stub["listeners"] = []
+    stub["connections"] = []
+    assert sum(1 for field in ("listeners", "connections") if stub[field]) == 0, (
+        "the stub arm's rows are not empty, so the header's `n/a` would not be about the same thing")
+
 
 def test_the_gateway_page_keeps_its_last_drawing_when_a_poll_fails(client) -> None:
     """Invariant 4 on the fifth page: a failed read leaves the last picture on screen.
@@ -5960,41 +6469,330 @@ def test_the_gateway_page_keeps_its_last_drawing_when_a_poll_fails(client) -> No
 def test_a_clipped_pipe_label_keeps_its_full_text_on_the_element(client) -> None:
     """The ellipsis is only honest while the whole string is on the element, and pinned so.
 
-    Phase 29 task 06 measured this on live data: **29 of 42** pipe labels are ellipsised at 1440px,
-    because two `minmax(0, 1fr)` columns share a third of a card with the node and a
-    40-character `server_name → target` string does not fit in ~150px. Letting the label wrap
-    instead was tried and measured worse — the flex line squeezes the name to whatever the chip,
-    footnote and count leave, which tore one hostname over eleven lines — so the open fix is a
-    layout one (AGENTS.md gap 13), not a `white-space` one.
+    Phase 29 task 06 measured 28 of 42 labels ellipsised at 1440 px and found the old fix (letting the
+    label wrap) worse than the clip — the flex line squeezed the name to seven characters of a
+    40-character target, and wrapping the text inside that box tore one hostname over eleven lines.
+    Phase 30 task 04's trunk→leaf row re-measured it (`data/logs/30-task04-panels.out`): **0 of 33**
+    endpoint labels clip at 1440 px (a 391 px target column) and **27 of 33** do at 360 px (177 px), so
+    what remains is a phone column-width fact (AGENTS.md gap 13) and not a lost one.
 
-    What makes the ellipsis a truncation and not a lost fact is that the *same* string the row
-    renders goes out as the element's `title`, and the pipe's `aria-label` carries the full
-    endpoint whatever the eye can see. Both halves are pinned here, because the day either one
-    goes the ellipsis starts eating the page's answer in silence.
+    What makes the ellipsis a truncation and not a lost fact is that the row carries the whole string
+    — endpoint *and* the config's own selector — as its `title`, and the line's `aria-label` carries
+    the full endpoint whatever the eye can see. Both halves are pinned here, because the day either
+    one goes the ellipsis starts eating the page's answer in silence. Task 06 re-counts the clipped
+    labels on the new row shape.
     """
     css = _code(_css(client))
     assert _declarations(css, ".pipe-name").get("text-overflow") == "ellipsis", \
         ".pipe-name no longer truncates, so re-measure the wrap decision this pin documents"
-    # …and the two declarations that decide *how much* it truncates. Task 06 found the name showing
-    # seven characters of a 40-character target, because a `nowrap` flex row shrinks the name to what
-    # the chip, the footnote and the `flex: none` count leave. `max-content` as its base size means a
-    # name longer than the column is alone on its line and gets the whole column; the chip, footnote
-    # and count wrap beneath it. Losing either declaration puts the seven-character label back.
-    assert "wrap" in _declarations(css, ".pipe-label").get("flex-wrap", ""), \
-        "a long pipe label is squeezed beside its chip again"
+    assert _declarations(css, ".gate-selector").get("text-overflow") == "ellipsis", \
+        "the selector line no longer truncates — the row's tooltip is what makes that honest"
+    # …and the two declarations that decide *how much* it truncates. Task 06 measured the old page
+    # showing seven characters of a 40-character target, because a `nowrap` flex row shrinks the name
+    # to what the chip, the footnote and the `flex: none` count leave. `max-content` as its base size
+    # means a name longer than the column is alone on its line and gets the whole column, with the
+    # count, clients and domain list wrapping beneath; `min-width: 0` on the target column is what
+    # lets a long hostname ellipsise instead of widening the card (phase 27's grid rule).
+    assert "wrap" in _declarations(css, ".gate-trunk").get("flex-wrap", ""), \
+        "a long trunk label is squeezed beside its count again"
     assert "max-content" in _declarations(css, ".pipe-name").get("flex", ""), \
         "the name no longer claims the line, so it shrinks to the leftover width"
+    assert _declarations(css, ".gate-target").get("min-width") == "0", \
+        "a long target widens its card instead of ellipsising inside it"
+    assert "minmax(0, 1fr)" in _declarations(css, ".gate-link").get("grid-template-columns", ""), \
+        "the target track no longer permits 0, so a hostname grows the card"
 
     js = _code(client.get("/static/page-gateway.js").text)
-    row = js[js.index("function renderPipeRow("):js.index("function renderPipes(")]
-    assert "const text = pipeName(pipe, keys)" in row, \
+    row = js[js.index("function renderLeaf("):js.index("function groupElement(")]
+    assert "const text = endpointText(conn.out)" in row, \
         "the label and the tooltip must be built from one string, not two"
-    assert "name.title =" in row, "a clipped pipe label lost the full text on the element"
-    aria = js[js.index("function pipeAria("):js.index("function buildPipe(")]
-    assert "pipeName(pipe, keys)" in aria, \
+    assert "li.title = title" in row, "a clipped connection line lost the full text on the element"
+    title = js[js.index("function leafTitle("):js.index("function buildPipe(")]
+    assert "endpointText(conn.out)" in title and "selectorText(conn.out)" in title, \
+        "the row's tooltip stopped carrying the endpoint and the config's own selector"
+    aria = js[js.index("function leafAria("):js.index("function buildPipe(")]
+    assert "endpointText(out)" in aria, \
         "the accessible sentence stopped carrying the whole endpoint a clipped label truncates"
 
 
+def test_the_switch_is_built_and_explicitly_unwired(client) -> None:
+    """The switch from the sketch, and the pin that keeps it from becoming a lie.
+
+    The operator asked for the control to exist before it works: "build the switches in now but don't
+    wire them up." That is a real `<button role="switch">` with a real accessible name — a
+    toggle-shaped `<span>` would hide the reading "this route is in the config" from the people a
+    colour cannot tell it to — and it is **unwired**, because invariant 1 means no browser may disable
+    a route: `haproxy.cfg` and the nginx `server` block are the only switches on this fleet.
+
+    Four things keep the shape honest, and every one of them is the way a dead control starts looking
+    live:
+
+    * `aria-checked`, written by `renderLeaf` from the same value that colours the line, so a row
+      cannot show a green pipe beside an off switch;
+    * `aria-disabled="true"` and **never** the `disabled` attribute — `disabled` would take the pill
+      out of the a11y tree, which deletes the reading for exactly the people it is for;
+    * a `title` that names the missing write path rather than promising a click;
+    * no listener bound to it, no `:hover` rule anywhere in the map, and no `cursor` but
+      `not-allowed`. The one `transition` is the knob's, and `test_the_pipe_animation_stills_in_both_
+      states_under_reduced_motion` pins that it is stilled on request.
+    """
+    raw = client.get("/static/page-gateway.js").text
+    js = _code(raw)
+    # The completion criterion, asserted rather than grepped: in the code (comments are prose about
+    # the difference, and they are allowed to say the word), every `disabled` carries `aria-` and
+    # none of them is the attribute that would hide the reading.
+    bare = re.findall(r"(?<!aria-)\bdisabled\b", js)
+    assert not bare, (
+        f"the code writes `disabled` {len(bare)} time(s) without the `aria-` prefix — that attribute "
+        "takes the switch out of the a11y tree, which deletes the reading for exactly the people "
+        "a colour cannot tell it to")
+    assert "setAttribute('aria-disabled', 'true')" in js
+    switch = js[js.index("function buildSwitch("):js.index("function switchAria(")]
+    assert "document.createElement('button')" in switch, \
+        "the switch is not a button, so it has no accessible role to carry the reading"
+    assert "button.setAttribute('role', 'switch')" in switch
+    assert "button.setAttribute('aria-disabled', 'true')" in switch
+    assert not re.search(r"\bbutton\.disabled\b|setAttribute\('disabled'", switch), (
+        "the switch grew the `disabled` attribute, which drops it out of the a11y tree — the reading "
+        "would disappear for a screen reader while looking identical")
+    title = re.search(r"button\.title = ([^;]+);", switch)
+    assert title, "the switch lost its `title` outright"
+    assert "Toggling a route is not wired up yet" in title.group(1), \
+        "the tooltip stopped naming the missing write path"
+    assert "config write path" in title.group(1), \
+        "the tooltip promises something and does not say what is missing"
+    assert "gate-switch-thumb" in switch, "the pill lost its knob, so it is no longer the sketch"
+    assert "addEventListener" not in switch
+
+    # `aria-checked` is patched from the payload pass, beside the colour that means the same thing.
+    leaf = js[js.index("function renderLeaf("):js.index("function groupElement(")]
+    assert "sw.setAttribute('aria-checked', checked)" in leaf
+    assert "const on = routeInConfig(conn)" in leaf, \
+        "the switch's state is no longer the value the line is coloured from"
+    assert "sw.setAttribute('aria-label', swAria)" in leaf, \
+        "the switch has no accessible name, so it is a pill with a claim it never states"
+    label = js[js.index("function switchAria("):js.index("function leafRow(")]
+    for fact in ("endpointText(conn.out)", "selectors", "config", "on ? 'on' : 'off'"):
+        assert fact in label, f"the switch's name stopped saying {fact}"
+
+    bound = set(re.findall(r"addEventListener\('(\w+)'", js))
+    assert bound <= {"toggle", "DOMContentLoaded"}, (
+        f"the page now binds {sorted(bound)} — a switch that could be clicked would need a config "
+        "write path this app does not have (invariant 1)")
+    assert not re.search(r"gate-switch[^\n]*\)\s*\.?\s*addEventListener", js), \
+        "a listener was bound to the switch itself"
+
+    css = _code(_css(client))
+    rules = re.findall(r"([^{}]*\.gate-switch[^{}]*)\{([^}]*)\}", css)
+    assert rules, "the switch has no rule at all, so its ink is the browser default"
+    for selector, body in rules:
+        assert ":hover" not in selector, f"the switch grew a hover affordance: {selector.strip()}"
+        assert ":enabled" not in selector and ":disabled" not in selector, (
+            f"{selector.strip()} keys the switch on its enabled state — a switch this app cannot "
+            "wire would then paint every one of them off")
+        cursor = [d for d in body.split(";") if "cursor" in d]
+        assert all("not-allowed" in d for d in cursor), \
+            f"the switch advertises a pointer: {cursor}"
+        for token in re.findall(r"var\((--[a-z0-9-]+)\)", body):
+            assert re.search(rf"^\s*{token}:", css, re.MULTILINE), \
+                f"the switch reads an undeclared colour token: {token}"
+    # The pill and its knob take the existence pair, so the gateway owns one colour vocabulary and
+    # the soft fill derives from it rather than borrowing a verdict tint.
+    assert "var(--gate-on)" in _declarations(css, ".gate-switch").get("border", ""), \
+        "the switch's on-state border is not the existence pair"
+    assert "var(--gate-off)" in _declarations(
+        css, '.gate-switch[aria-checked="false"]').get("border-color", ""), \
+        "the off state has no colour, so `[aria-checked]` is decoration"
+    section = _code(_css_section(_css(client), "gateway pipes"))
+    assert "--ok-soft" not in section and "--fail-soft" not in section, \
+        "a gateway rule reached for a verdict tint instead of deriving its fill from the pair"
+
+    interactive = [sel.strip() for sel, body in re.findall(r"([^{}]+)\{([^}]*)\}", css)
+                   if ("gate-" in sel or ".pipe" in sel)
+                   and (":hover" in sel or "cursor: pointer" in body
+                        or ("transition" in body and "gate-switch-thumb" not in sel))]
+    assert not interactive, (
+        f"the connection map grew an interactive-looking rule: {interactive} — nothing on this page "
+        "writes to the fleet, and the one moving part is the knob, which is stilled on request")
+
+    # …and the page says so, once, in the footer rather than in a tooltip.
+    html = _code(client.get(GATEWAY_PAGE).text)
+    foot = " ".join(html[html.index("<footer class="):].split())
+    assert "toggling a route needs a config write path and is not wired up" in foot, \
+        "the switch stopped saying out loud that it does nothing"
+
+
+def test_the_stream_map_is_rendered_inside_nginx_and_nowhere_else(
+        client, gateway_client) -> None:
+    """The `map` is nginx config, so its fan-out is the nginx panel's `:443` leaves and nothing else.
+
+    Phase 29 drew the stream `map` as a card of its own, which split one file's routes across two
+    headings and left the operator to work out that the sixteen domains on one card left through the
+    port shown on the other. The payload already says it (`out.kind == "map"`, `source == "nginx"`,
+    `in.port == 443`), so the page has no `map` key, no `map_targets` reader, and no third panel.
+
+    Pinned from both ends: the script ships exactly the two panel definitions and never indexes
+    `nginx.map_targets`, and the live document's map connections are all nginx's, all on one port,
+    and exactly as many as the map has routing entries (17 on this capture — 16 `*.reeselink.com`
+    plus the `default` the file writes for SNI nobody mapped).
+    """
+    html = _code(client.get(GATEWAY_PAGE).text)
+    js = _code(client.get("/static/page-gateway.js").text)
+    definitions = js[js.index("const CARDS = ["):js.index("];", js.index("const CARDS = ["))]
+    keys = re.findall(r"key: '(\w+)'", definitions)
+    assert keys == list(GATEWAY_CARD_KEYS), (
+        f"the script ships {keys}; the stream map must not be a panel key")
+    assert "map_targets" not in js, (
+        "the page reads the map's target list again — its fan-out arrives as connections[] now")
+    assert 'data-gate="map"' not in html
+
+    payload = gateway_client.get("/api/gateway/snapshot").json()
+    mapped = [row for row in payload["connections"] if row["out"]["kind"] == "map"]
+    assert mapped, "the captured stream config routes nothing, so this pin proves nothing"
+    assert {row["source"] for row in mapped} == {"nginx"}, (
+        "a `map` route is filed under a config family other than nginx")
+    assert {row["in"]["port"] for row in mapped} == {443}, (
+        "the map's leaves hang off a port that is not the stream server's `listen`")
+    assert len(mapped) == len(payload["nginx"]["map_targets"]), (
+        "the leaves the nginx panel draws are not the map's routing entries — one of the two lists "
+        "is dropping an entry")
+    selectors = {sel for row in mapped for sel in row["out"]["selectors"]}
+    assert "default" in selectors, (
+        "the map's own word for unmapped SNI was paraphrased away instead of printed verbatim")
+
+
+def test_a_listener_with_no_declared_target_says_so_instead_of_drawing_nothing(
+        client, gateway_client) -> None:
+    """A trunk that routes nowhere is a fact, not a gap in the drawing.
+
+    This fleet's nginx `:80` vhost is a `return 301`: it listens, it names `_`, and it writes no
+    `proxy_pass`, so the graph has a listener for it and no connection. Dropping the group would turn
+    "this port serves no target" into "this port does not exist" — the same refusal `sources/gateway.py`
+    keeps for the warning list — so the leaf list renders one faint sentence instead of nothing, and
+    the sentence comes from the script (the payload publishes no row to render).
+    """
+    payload = gateway_client.get("/api/gateway/snapshot").json()
+    untargeted = [row["port"] for row in payload["listeners"]
+                  if not any(conn["in"]["port"] == row["port"] and conn["source"] == row["source"]
+                             for conn in payload["connections"])]
+    assert 80 in untargeted, (
+        f"the capture's :80 vhost is no longer the live case this pin is written against: "
+        f"{untargeted}")
+
+    js = _code(client.get("/static/page-gateway.js").text)
+    groups = js[js.index("function groupsFor("):js.index("function endpointText(")]
+    assert "groupFor(row.port).listener = row" in groups, (
+        "a listener no connection names no longer produces a group")
+    assert not re.search(r"\.filter\([^)]*connections\.length", groups), (
+        "groups with no leaves are being dropped, which is the silence this test exists to stop")
+    leaves = js[js.index("function renderLeaves("):js.index("function renderGroups(")]
+    assert "no target named in the config" in js, "the refusal sentence is gone"
+    assert "group.connections.length === 0" in leaves, (
+        "the empty leaf list no longer renders the sentence instead of nothing")
+
+
+def test_a_fan_out_is_patched_and_reordered_never_rebuilt(client) -> None:
+    """Seventeen rows off one trunk are built once and then patched, in payload order.
+
+    The slot-grid discipline (`/llm`): rebuilding a row on every 30 s poll re-announces it to
+    assistive tech for a difference of one connection, and a 17-row fan-out makes that audible. So
+    groups are keyed by port and rows by the connection's own `id` in per-panel `Map`s, an existing
+    node is moved with `appendChild` rather than re-created, and pruning happens once per panel by
+    id — not by emptying the container, which is the rebuild in slower motion.
+    """
+    js = _code(client.get("/static/page-gateway.js").text)
+    groups = js[js.index("function renderGroups("):js.index("function familyWord(")]
+    leaves = js[js.index("function renderLeaves("):js.index("function renderGroups(")]
+    assert "state.groups" in groups and "state.rows" in groups
+    for name, body in (("group", groups), ("leaf", leaves)):
+        assert "appendChild" in body, (
+            f"the {name} renderer can no longer reorder the rows it already built")
+    assert "built.get(id)" in groups and "let el = built.get(id)" in groups, (
+        "a group is no longer keyed on the element the last poll built")
+    assert "let li = rows.get(id)" in leaves, (
+        "a leaf row is no longer keyed on the element the last poll built")
+    assert ".remove()" in groups, "the panel never prunes the rows and groups that left the payload"
+    assert "box.innerHTML = '';" not in groups, (
+        "a panel's groups are wiped every poll — that is a rebuild, and it re-announces every row")
+    # …and the wipe that IS allowed: a panel whose whole family left the payload.
+    prune = js[js.index("function pruneCards("):js.index("document.addEventListener(")]
+    assert "box.innerHTML = ''" in prune and "state.groups.delete" in prune
+
+
+def test_warnings_render_in_the_overviews_alert_vocabulary_and_hide_when_clean(
+        client, gateway_client) -> None:
+    """The config-integrity list, both directions, on the shape the overview already uses.
+
+    `/gateway`'s warnings are `sources/gateway.warnings()`' rows, rendered as `li.warn` with a
+    `.src` (the config family) and a `.msg` (the row's own sentence) — the markup `page-index.js`
+    uses for an alert, because "a backend no frontend routes to" is the same kind of sentence and
+    should not grow a second look. The page reads `kind` and `message` and invents nothing.
+
+    Both directions are pinned because the absence is half the claim: the captured ingress is clean
+    (`warnings == []`) and the panel must stay `hidden`, and one real row from the source must make
+    it appear with that row's words, four fields and all.
+    """
+    html = _code(client.get(GATEWAY_PAGE).text)
+    panel = _warnings_section(html)
+    assert "hidden" in panel[:panel.index(">")]
+    assert '<ul class="alerts" id="warnings-list">' in panel
+
+    js = _code(client.get("/static/page-gateway.js").text)
+    body = js[js.index("function renderWarnings("):js.index("function dotFor(")]
+    assert "li.className = 'warn'" in body, "the row is not the overview's `.warn` row"
+    assert "src" in body and "msg" in body, "the row lost the overview's two spans"
+    assert "snapshot.warnings" in body, "the page derives a warning instead of rendering one"
+    assert "warning.message" in body and "familyWord(warning.kind)" in body
+    assert "hidden = rows.length === 0" in body, "an empty list no longer hides the panel"
+    assert "innerHTML" not in body and "escapeHtml" not in body, \
+        "the warnings rows interpolate upstream text into markup"
+
+    clean = gateway_client.get("/api/gateway/snapshot").json()
+    assert clean["warnings"] == [], "the captured configs are no longer clean — this arm changed"
+
+    row = one_real_warning()[0]
+    job = gateway_client.app.state.ctx.hub.jobs["gateway"]
+    assert job.state.payload is not None and job.state.payload["warnings"] == []
+    job.state.payload["warnings"] = [row]
+    served = gateway_client.get("/api/gateway/snapshot").json()["warnings"]
+    assert served == [row], "the route does not serve the warning the page would render"
+    assert {"id", "kind", "subject", "message"} <= set(served[0])
+    assert served[0]["kind"].startswith("haproxy"), (
+        "the row the page files under a config family is not filed by one")
+    job.state.payload["warnings"] = []
+
+
+def test_an_unattributed_endpoint_prints_a_dash_and_never_a_zero(client, gateway_client) -> None:
+    """A leaf the join cannot count prints `—`, and the tooltip says why in one sentence.
+
+    Sixteen of this fleet's 17 map entries name a **domain**, and `/proc` reports addresses, so no
+    count exists for them and none can ever exist (nothing here resolves a name). `0` would be a
+    claim about traffic (rule 2) and a column of `n/a` would be twelve identical words competing with
+    the page's one footnote — so the leaf prints an em dash whose `title` names the reason, while the
+    trunk keeps `n/a`, which is a different fact: the socket table itself went quiet.
+    """
+    js = _code(client.get("/static/page-gateway.js").text)
+    head = js[:js.index("function countText(")]
+    assert "const NO_COUNT = '—'" in head, "the unattributed leaf count is no longer an em dash"
+    assert "nothing here resolves names" in head, "the dash stopped explaining itself"
+    leaf = js[js.index("function renderLeaf("):js.index("function groupElement(")]
+    assert "shown == null ? NO_COUNT : shown" in leaf, "a null count is not the dash any more"
+    assert "count.title = shown == null ? NO_COUNT_WHY" in leaf, \
+        "the dash lost the sentence that separates it from a zero"
+    trunk = js[js.index("function renderTrunk("):js.index("function renderLeaves(")]
+    assert "live" in trunk and "n/a" not in trunk, (
+        "the trunk now prints the leaf's dash too — a quiet socket table is a different fact, and "
+        "setTxt turns a null into `n/a` on its own")
+    assert not re.search(r"connections\s*\|\|\s*0", js), "an uncounted endpoint became a claimed 0"
+
+    payload = gateway_client.get("/api/gateway/snapshot").json()
+    unattributed = [row for row in payload["connections"] if row["connections"] is None]
+    assert unattributed, "the captured join counted everything, so this arm has nothing to prove"
+    assert all(row["out"]["address"] is False for row in unattributed), (
+        "an endpoint the config wrote as an address came back with no count — that is the socket "
+        "table's arm, not the name arm, and it prints a different sentence")
+
+
 def test_the_docs_name_the_page_its_knob_and_its_gauges() -> None:
     """The phase's own completion criterion, pinned so it cannot rot quietly.
 
diff --git a/tests/test_collectors.py b/tests/test_collectors.py
index f037879..58b01af 100644
--- a/tests/test_collectors.py
+++ b/tests/test_collectors.py
@@ -437,7 +437,7 @@ async def test_the_gateway_fetch_reads_the_same_agent_snapshot_as_the_other_two(
     assert seen == ["/snapshot"]
     assert result.payload["host"] == "gateway"
     assert result.payload["supported"] is True
-    assert result.payload["inbound"], "the configured pipes arrive with the snapshot"
+    assert result.payload["listeners"], "the configured pipes arrive with the snapshot"
     assert result.samples and all(sample.source == "gateway" for sample in result.samples), (
         "the gauges are their own sample family, not `host`'s")
     assert result.events == [], "a connection count has no transition to report"
diff --git a/tests/test_gateway_source.py b/tests/test_gateway_source.py
index e8c0e26..085843a 100644
--- a/tests/test_gateway_source.py
+++ b/tests/test_gateway_source.py
@@ -1,11 +1,20 @@
-"""`sources/gateway.py`: the config + socket join that becomes the `/gateway` pipes.
+"""`sources/gateway.py`: the two config files plus the socket table, joined into a connection map.
 
 The shape half of these tests runs the **captured** gateway configs and `/proc` tables through
 the real agent `Collector` (the `gateway_snapshot` fixture), so a rename of a section key on
 either side of the wire fails here rather than drawing an empty pipe on a live page. The
 arithmetic half uses synthetic sections, because the point of those tests is which socket lands
-in which pipe and what the source refuses to decide — facts a capture states once and a
+on which pipe and what the source refuses to decide — facts a capture states once and a
 re-capture may lawfully change (the same rule `tests/test_agent.py` holds for the socket tables).
+
+Phase 30 task 02 replaced the guessing join with two sound attributions — a **local port** for
+inbound, an exact **(address, port)** for outbound — and deleted the rest. So the tests for
+`by_port`, for `unmatched`, for the ambiguous-fan-out group list and for the flat `outbound` pipe
+list are gone with the code they described, and what replaces them pins the arithmetic the new
+join still owes: a socket counted **at most** once, a total that never exceeds the kernel's, and an
+endpoint shared by several lines counted once. There is deliberately **no** test that a connection
+outside the two configs is *reported*, because it no longer is —
+`test_a_socket_neither_config_describes_is_counted_nowhere` pins the silence instead.
 """
 from __future__ import annotations
 
@@ -46,9 +55,21 @@ def server(name: str, target: str | None, port: int | None = None) -> dict[str,
 
 
 def nginx_section(servers: Sequence[dict[str, Any]] = (), maps: Sequence[dict[str, Any]] = (), *,
+                  upstreams: Sequence[dict[str, Any]] = (),
                   available: bool | None = True) -> dict[str, Any]:
     return {"available": available, "config": "/etc/nginx/nginx.conf", "files": [],
-            "servers": list(servers), "upstreams": [], "maps": list(maps)}
+            "servers": list(servers), "upstreams": list(upstreams), "maps": list(maps)}
+
+
+def upstream(name: str, members: Sequence[tuple[str, int | None]]) -> dict[str, Any]:
+    """An `upstream <name> { server …; }` block, as the agent publishes it (`{host, port}`)."""
+    return {"name": name, "servers": [{"host": host, "port": port} for host, port in members]}
+
+
+def pool_pass(name: str) -> dict[str, Any]:
+    """`proxy_pass http://<name>;` — a target with **no** port, which is what makes it a pool."""
+    return {"location": "/", "scheme": "http", "target": {"host": name, "port": None},
+            "variable": None}
 
 
 def nginx_server(ports: Sequence[int | None], names: Sequence[str] = (),
@@ -107,18 +128,38 @@ def snapshot(*, haproxy: dict[str, Any] | None = None, nginx: dict[str, Any] | N
     return doc
 
 
-def pipe_by_port(payload: Mapping[str, Any], port: int) -> dict[str, Any]:
-    for pipe in payload["inbound"]:
-        if pipe["port"] == port:
-            return pipe
-    raise AssertionError(f"no inbound pipe on port {port}: {[p['port'] for p in payload['inbound']]}")
+def listener_at(payload: Mapping[str, Any], port: int) -> dict[str, Any]:
+    """The trunk row for one port, or a failure naming the ports the payload does have."""
+    for row in payload["listeners"]:
+        if row["port"] == port:
+            return row
+    raise AssertionError(f"no listener on port {port}: {[r['port'] for r in payload['listeners']]}")
 
 
-def pipe_to(payload: Mapping[str, Any], host: str, port: int | None) -> dict[str, Any]:
-    for pipe in payload["outbound"]:
-        if pipe["target"]["host"] == host and pipe["target"]["port"] == port:
-            return pipe
-    raise AssertionError(f"no outbound pipe to {host}:{port}")
+def routes_to(payload: Mapping[str, Any], host: str) -> list[dict[str, Any]]:
+    """Every route line whose outbound endpoint is `host`, in the graph's own order."""
+    return [row for row in payload["connections"] if row["out"]["host"] == host]
+
+
+def endpoint_count(payload: Mapping[str, Any], host: str, port: int) -> Any:
+    """The count the payload attributes to one **(address, port)** — once, not per line.
+
+    Asserts the invariant that makes `shared` meaningful while returning the number: every line
+    reaching one endpoint carries the *same* count, because that count belongs to the endpoint. A
+    join that split it across the lines would fail here rather than print a route carrying a
+    fraction nobody measured.
+    """
+    rows = [row for row in payload["connections"]
+            if row["out"]["host"] == host and row["out"]["port"] == port]
+    assert rows, f"no route to {host}:{port} in the graph"
+    counts = {row["connections"] for row in rows}
+    assert len(counts) == 1, f"lines reaching one endpoint disagree: {counts}"
+    return counts.pop()
+
+
+def out_metrics(payload: Mapping[str, Any]) -> list[str]:
+    """The outbound gauge names the payload would publish — one per **distinct** endpoint."""
+    return [row["metric"] for row in payload["connections"] if row["metric"] is not None]
 
 
 def walk_keys(node: Any) -> set[str]:
@@ -181,8 +222,8 @@ def test_the_source_reads_the_keys_the_agent_actually_publishes(gateway_snapshot
     assert {row["port"] for row in payload["haproxy"]["frontends"]} == agent_bind_ports
     agent_servers = {(row["name"], row["target"], row["port"])
                      for block in snap["haproxy"]["backends"] for row in block["servers"]}
-    assert {(pipe["target"]["name"], pipe["target"]["host"], pipe["target"]["port"])
-            for pipe in payload["outbound"] if pipe["source"] == "haproxy"} == agent_servers
+    assert {(row["out"]["name"], row["out"]["host"], row["out"]["port"])
+            for row in payload["connections"] if row["source"] == "haproxy"} == agent_servers
     agent_listen_ports = {listen["port"] for server in snap["nginx"]["servers"]
                           for listen in server["listen"]}
     assert {row["port"] for row in payload["nginx"]["servers"]} == agent_listen_ports
@@ -192,45 +233,138 @@ def test_the_source_reads_the_keys_the_agent_actually_publishes(gateway_snapshot
 
 
 def test_the_live_counts_reconcile_with_the_socket_table(gateway_snapshot: Any) -> None:
-    """Every ESTABLISHED row is counted exactly once — in a pipe, or in `unmatched`.
+    """The arithmetic phase 29 task 06 pinned as an equality is now an **inequality**, on purpose.
 
-    This is the property phase 29 task 06 checks against a direct `/proc/net/tcp` read; pinning
-    it on the capture means the arithmetic is already right before anything is dialled.
+    `sum(listeners) + sum(distinct endpoint counts) <= established`. Two things took the equality
+    away and neither is a leak:
+
+    * a socket neither file describes is counted nowhere (the `unmatched` arm is deleted, not
+      hidden), and this gateway has plenty of that — the agent's own `:9120`, the outbound SSH and
+        NTP-style sessions, the loopback pairs;
+    * the endpoints are summed **once each**, so a line reaching an address another line already
+      reached adds nothing a second time.
+
+    What stays pinned is the direction of the error and the absence of a residual: the reported
+    figures are always **under** the kernel's number, and there is no field anywhere that quietly
+    absorbs the difference to make the two agree.
     """
     snap = gateway_snapshot("full")
     payload = gateway.parse(snap, "gateway")
     established = len(snap["sockets"]["established"])
-    in_pipes = sum(pipe["connections"] for pipe in payload["inbound"])
-    out_pipes = sum(pipe["connections"] or 0 for pipe in payload["outbound"])
-    unmatched = payload["unmatched"]
+    configured = {row["port"] for row in payload["listeners"]}
+    assert configured == {22, 2000, 5201, 8080, 25565, 25566, 80, 443, 4443, 8443}
+    assert all(row["port"] in configured for row in payload["listeners"]), (
+        "an inbound count on a port no config names cannot exist in this payload")
+    in_total = sum(row["connections"] for row in payload["listeners"])
+    endpoints = {(row["out"]["host"], row["out"]["port"]): row["connections"]
+                 for row in payload["connections"] if row["metric"] is not None}
+    out_total = sum(value or 0 for value in endpoints.values())
+
     assert payload["sockets"] == {"listens": len(snap["sockets"]["listens"]),
                                   "established": established}
-    assert in_pipes + out_pipes + unmatched["inbound"] + unmatched["outbound"] == established
-    # the ambiguous fan-out is inside `unmatched.outbound`, not on top of it
-    assert sum(group["connections"] for group in unmatched["groups"]) <= unmatched["outbound"]
+    assert in_total + out_total <= established
+    assert in_total + out_total < established, (
+        "this capture has traffic outside both config files; if it ever stops having any, this "
+        "test is proving nothing and should be re-written against a capture that does")
+    assert "unmatched" not in payload and "partial" not in payload
+    # the loopback hop is the case that used to double count: `127.0.0.1:4443` is both a listener's
+    # remote end and an outbound endpoint, and it may be booked on only one of them
+    assert sum(row["connections"] or 0 for row in payload["connections"]) == out_total
 
 
-def test_a_listening_port_no_config_claims_stays_visible(gateway_snapshot: Any) -> None:
-    """Phase 28's "an unclaimed socket stays visible as one", counted, not silently dropped."""
+def test_a_socket_neither_config_describes_is_counted_nowhere(gateway_snapshot: Any) -> None:
+    """Phase 28's "an unclaimed socket stays visible as one" is **not** a live count.
+
+    The agent's own `:9120` is listening and dialled by nobody in either file. It stays in
+    `sockets.listens` — a raw fact about the host, which is what the page prints beside the pipes —
+    and appears in no pipe and no total. That is the whole simplification: an unexplained socket is
+    a reason to look at `/system`, not a number to file under `unmatched`.
+    """
     snap = gateway_snapshot("full")
     payload = gateway.parse(snap, "gateway")
     live = {row["port"] for row in snap["sockets"]["listens"]}
-    configured = {pipe["port"] for pipe in payload["inbound"]}
-    assert payload["unmatched"]["other"] == len(live - configured)
-    # the agent's own port is dialled by nobody in either config, so it is always the example
-    assert 9120 in live - configured
+    configured = {row["port"] for row in payload["listeners"]}
+    assert 9120 in live - configured, "the agent's own port, unclaimed by either config"
+    assert all(row["port"] in configured for row in payload["listeners"])
+    assert "unmatched" not in payload
 
 
-def test_the_map_fanout_becomes_pipes_labelled_by_domain(gateway_snapshot: Any) -> None:
-    """Every map entry is a pipe the page can draw, and `$var` never becomes a host."""
+def test_every_connection_the_captured_configs_declare_is_drawn(gateway_snapshot: Any) -> None:
+    """The graph as a **set**, so a missing or invented route fails by name.
+
+    The join this task rewrote stamps counts onto these rows, so the rows themselves are pinned
+    here too: 6 haproxy `server` lines, 17 stream-`map` entries (the 16 `*.reeselink.com:443` fan-
+    out plus the literal `default` → `127.0.0.1:4443`), and 9 vhost `proxy_pass` targets across
+    `:4443` and `:8443`. `:80` is the refusal that lives on this fleet: the catch-all vhost declares
+    no `proxy_pass`, so it is a trunk with no connection and no invented line beside it.
+    """
     payload = gateway.parse(gateway_snapshot("full"), "gateway")
-    map_pipes = [pipe for pipe in payload["outbound"] if pipe["source"] == "map"]
-    assert len(map_pipes) == len(payload["nginx"]["map_targets"])
-    assert not [pipe for pipe in payload["outbound"]
-                if pipe["target"]["host"] is None or "$" in str(pipe["target"]["host"])], (
-        "a proxy_pass $var carries no address, so it must not become a pipe of its own")
-    brain = pipe_to(payload, "reeseapps-brain-of-reese.reeselink.com", 443)
-    assert brain["target"]["by_port"] is True, "a name can only ever be matched on its port"
+    got = {(row["in"]["port"], row["out"]["host"], row["out"]["port"])
+           for row in payload["connections"]}
+    assert got == {
+        # haproxy: one `server` per frontend, the backend name as the selector
+        (22, "reeseapps-gitea.reeselink.com", 2222),
+        (2000, "stackexpected-gitea.reeselink.com", 2222),
+        (5201, "web.reeselink.com", 5201),
+        (8080, "unifi-external.reeselink.com", 8080),
+        (25565, "minecraft.reeselink.com", 25565),
+        (25566, "minecraft.reeselink.com", 25566),
+        # nginx `:443`: the stream map's fan-out, `default` kept verbatim
+        (443, "127.0.0.1", 4443),
+        (443, "reeseapps-brain-of-code.reeselink.com", 443),
+        (443, "reeseapps-brain-of-reese.reeselink.com", 443),
+        (443, "reeseapps-forgejo.reeselink.com", 443),
+        (443, "reeseapps-gitea.reeselink.com", 443),
+        (443, "reeseapps-homepage.reeselink.com", 443),
+        (443, "reeseapps-immich.reeselink.com", 443),
+        (443, "reeseapps-keycloak.reeselink.com", 443),
+        (443, "reeseapps-litellm.reeselink.com", 443),
+        (443, "reeseapps-ntfy.reeselink.com", 443),
+        (443, "reeseapps-openwebui.reeselink.com", 443),
+        (443, "stackexpected-gitea.reeselink.com", 443),
+        (443, "stackexpected-hedgedoc.reeselink.com", 443),
+        (443, "stackexpected-keycloak.reeselink.com", 443),
+        (443, "stackexpected-nextcloud.reeselink.com", 443),
+        (443, "stackexpected.reeselink.com", 443),
+        (443, "wfc.reeselink.com", 443),
+        # nginx http vhosts: `:4443` and `:8443`, each with its own `server_name`
+        (4443, "bricktracker.reeselink.com", 3333),
+        (4443, "emmaleaf.reeselink.com", 80),
+        (4443, "gitea.reeselink.com", 3000),
+        (4443, "jellyfin.reeselink.com", 8096),
+        (4443, "keycloak.reeselink.com", 8080),
+        (4443, "nextcloud.reeselink.com", 11000),
+        (8443, "127.0.0.1", 8081),
+        (8443, "keycloak.reeselink.com", 8080),
+        (8443, "nextcloud.reeselink.com", 11001),
+    }, "the captured configs declare exactly these routes — no more, no fewer"
+    assert len(payload["connections"]) == len(got), "and no two rows collapse into one key"
+
+    # `default` is the config's own word for "everything nobody mapped", and its endpoint is an
+    # address — which is why it is one of the two lines this capture can count at all.
+    default = next(row for row in payload["connections"] if row["out"]["selectors"] == ["default"])
+    assert (default["out"]["host"], default["out"]["port"]) == ("127.0.0.1", 4443)
+    assert default["out"]["address"] is True and default["out"]["kind"] == gateway.KIND_MAP
+
+    # refusal rule 5 on live config text: a trunk with nothing behind it stays a trunk alone
+    assert 80 in {row["port"] for row in payload["listeners"]}
+    assert 80 not in {row["in"]["port"] for row in payload["connections"]}, (
+        "the `server_name _` vhost declares no proxy_pass, so it draws no connection")
+
+
+def test_the_map_fanout_is_routes_and_never_a_variable_host(gateway_snapshot: Any) -> None:
+    """Every stream-map entry is a line the page can draw, and `$var` never becomes a host."""
+    payload = gateway.parse(gateway_snapshot("full"), "gateway")
+    map_routes = [row for row in payload["connections"] if row["out"]["kind"] == "map"]
+    assert len(map_routes) == len(payload["nginx"]["map_targets"])
+    assert not [row for row in payload["connections"]
+                if row["out"]["host"] is None or "$" in str(row["out"]["host"])], (
+        "a proxy_pass $var carries no address, so it must not become a line of its own")
+    brain = next(row for row in map_routes
+                 if row["out"]["host"] == "reeseapps-brain-of-reese.reeselink.com")
+    assert brain["out"]["address"] is False, "the config wrote a name, and this stack resolves none"
+    assert brain["connections"] is None, "so the line carries no count"
+    assert brain["metric"] is None, "and publishes no series"
 
 
 # --------------------------------------------------------------------------- #
@@ -247,14 +381,13 @@ def test_a_socket_lands_in_the_frontend_that_owns_its_local_port() -> None:
                          conn(("10.1.1.27", 443), ("203.0.113.9", 51001)),
                          conn(("10.1.1.27", 22), ("198.51.100.4", 33000))]))
     payload = gateway.parse(snap, "gateway")
-    https = pipe_by_port(payload, 443)
+    https = listener_at(payload, 443)
     assert https["source"] == "nginx"
     assert https["connections"] == 2
     assert https["clients"] == ["203.0.113.7", "203.0.113.9"], "the client is the remote end"
     assert https["domains"] == ["a.example.test"]
     assert https["metric"] == "gateway.in_conns@443"
-    assert pipe_by_port(payload, 22)["source"] == "haproxy"
-    assert payload["unmatched"] == {"inbound": 0, "outbound": 0, "other": 0, "groups": []}
+    assert listener_at(payload, 22)["source"] == "haproxy"
 
 
 def test_a_frontend_that_is_idle_is_still_a_pipe_with_zero() -> None:
@@ -262,11 +395,17 @@ def test_a_frontend_that_is_idle_is_still_a_pipe_with_zero() -> None:
     snap = snapshot(haproxy=haproxy_section([frontend("ssh", [22])]),
                     sockets=sockets_section(listens=[listen(22)]))
     payload = gateway.parse(snap, "gateway")
-    assert pipe_by_port(payload, 22)["connections"] == 0
+    assert listener_at(payload, 22)["connections"] == 0
 
 
-def test_a_connection_on_a_port_no_config_names_is_reported_not_dropped() -> None:
-    """`unmatched.inbound`: this host is serving something neither file mentions."""
+def test_a_port_no_config_names_is_neither_counted_nor_reported() -> None:
+    """The arm that used to be `unmatched.inbound` is now simply **not a number anywhere**.
+
+    Two sockets on `:8081`, which neither file binds. They are not attributed to the `:443` pipe,
+    not summed into it, and not tallied beside it — the listener reads `0` and the payload carries
+    no residual. That is a deliberate loss of information: an unclaimed socket says something about
+    the host, not about the two config files, and the honest place to read it is `/system`.
+    """
     snap = snapshot(
         nginx=nginx_section([nginx_server([443], ["a.example.test"])]),
         sockets=sockets_section(
@@ -274,9 +413,10 @@ def test_a_connection_on_a_port_no_config_names_is_reported_not_dropped() -> Non
             established=[conn(("10.1.1.27", 8081), ("10.1.0.9", 41000)),
                          conn(("10.1.1.27", 8081), ("10.1.0.9", 41001))]))
     payload = gateway.parse(snap, "gateway")
-    assert pipe_by_port(payload, 443)["connections"] == 0
-    assert payload["unmatched"]["inbound"] == 2, "the page's 'N other connections'"
-    assert payload["unmatched"]["other"] == 1, "8081 is a listener no frontend claims"
+    assert listener_at(payload, 443)["connections"] == 0
+    assert 8081 not in [row["port"] for row in payload["listeners"]]
+    assert sum(row["connections"] or 0 for row in payload["listeners"]) < payload["sockets"]["established"]
+    assert "unmatched" not in payload
 
 
 def test_one_port_named_by_both_configs_is_one_pipe_carrying_both_domains() -> None:
@@ -287,10 +427,10 @@ def test_one_port_named_by_both_configs_is_one_pipe_carrying_both_domains() -> N
         sockets=sockets_section(listens=[listen(80)],
                                 established=[conn(("10.1.1.27", 80), ("203.0.113.1", 1234))]))
     payload = gateway.parse(snap, "gateway")
-    ports = [pipe["port"] for pipe in payload["inbound"]]
+    ports = [row["port"] for row in payload["listeners"]]
     assert ports == [80], "no second pipe, and no socket counted down both"
-    assert pipe_by_port(payload, 80)["connections"] == 1
-    assert pipe_by_port(payload, 80)["domains"] == ["a.example.test"]
+    assert listener_at(payload, 80)["connections"] == 1
+    assert listener_at(payload, 80)["domains"] == ["a.example.test"]
 
 
 def test_the_client_list_is_unique_sorted_and_bounded() -> None:
@@ -300,7 +440,7 @@ def test_the_client_list_is_unique_sorted_and_bounded() -> None:
     many.append(conn(("10.1.1.27", 80), ("203.0.113.1", 45678)))
     snap = snapshot(nginx=nginx_section([nginx_server(ports, ["a.example.test"])]),
                     sockets=sockets_section(listens=[listen(80)], established=many))
-    pipe = pipe_by_port(gateway.parse(snap, "gateway"), 80)
+    pipe = listener_at(gateway.parse(snap, "gateway"), 80)
     assert len(pipe["clients"]) == gateway.MAX_CLIENTS
     assert pipe["clients"] == sorted(pipe["clients"])
     assert pipe["connections"] == len(many), "the count stays the truth when the list is capped"
@@ -310,7 +450,9 @@ def test_the_client_list_is_unique_sorted_and_bounded() -> None:
 # the outbound join
 # --------------------------------------------------------------------------- #
 
-def test_a_target_written_as_an_address_matches_exactly_and_says_by_port_false() -> None:
+def test_an_endpoint_written_as_an_address_is_matched_exactly_and_carries_its_count(
+        ) -> None:
+    """`/proc` writes `(remote address, remote port)`, so a config that writes both can be joined."""
     snap = snapshot(
         nginx=nginx_section([nginx_server([8443], ["app.example.test"],
                                           [proxy_pass(("127.0.0.1", 8081))])]),
@@ -319,16 +461,26 @@ def test_a_target_written_as_an_address_matches_exactly_and_says_by_port_false()
             established=[conn(("10.1.1.27", 39000), ("127.0.0.1", 8081)),
                          conn(("10.1.1.27", 39002), ("10.9.9.9", 8081))]))
     payload = gateway.parse(snap, "gateway")
-    exact = pipe_to(payload, "127.0.0.1", 8081)
-    assert exact["target"]["by_port"] is False
+    exact = routes_to(payload, "127.0.0.1")[0]
+    assert exact["out"]["address"] is True
     assert exact["connections"] == 1, "the one socket dialled to that address"
     assert exact["metric"] == "gateway.out_conns@127.0.0.1:8081"
-    assert payload["unmatched"]["outbound"] == 1, (
+    assert endpoint_count(payload, "127.0.0.1", 8081) == 1, (
         "the same port on a different address is not this target's connection")
+    assert "by_port" not in json.dumps(payload), (
+        "the port-only arm of the join is deleted, not merely unused: a payload that grew the field "
+        "back has grown the ambiguity back with it")
 
 
-def test_a_domain_target_is_matched_on_port_alone_and_labelled_by_port() -> None:
-    """The address half is the config's, the socket half is the kernel's, and `by_port` says so."""
+def test_a_name_target_is_never_credited_for_a_socket_on_its_port() -> None:
+    """The rule that replaced `by_port`, stated as a fact about the payload and not a chip.
+
+    `proxy_pass https://nextcloud.example.test:11000` and the socket to `10.1.0.254:11000` are the
+    same connection in the operator's head and two unrelated strings in this stack. Attributing one
+    to the other needed a resolver, and the port-only guess the old join made in its place was a
+    guess about a **port**, not about a host — which is why its count was the port's and its chip
+    said so. Now the line simply has no number, no gauge, and no apology to render.
+    """
     snap = snapshot(
         nginx=nginx_section([nginx_server([4443], ["cloud.example.test"],
                                           [proxy_pass(("nextcloud.example.test", 11000))])]),
@@ -337,19 +489,24 @@ def test_a_domain_target_is_matched_on_port_alone_and_labelled_by_port() -> None
             established=[conn(("10.1.1.27", 4443), ("10.1.0.4", 55555)),
                          conn(("10.1.1.27", 54340), ("10.1.0.254", 11000))]))
     payload = gateway.parse(snap, "gateway")
-    pipe = pipe_to(payload, "nextcloud.example.test", 11000)
-    assert pipe["target"]["by_port"] is True
-    assert pipe["connections"] == 1
-    assert pipe["source"] == "nginx"
-    assert payload["unmatched"]["groups"] == []
+    row = routes_to(payload, "nextcloud.example.test")[0]
+    assert row["out"]["address"] is False
+    assert row["connections"] is None, "unknown, and not the port's 2 either"
+    assert row["metric"] is None, "and no series for a number that can never exist"
+    assert listener_at(payload, 4443)["connections"] == 1, (
+        "the socket that faces the gateway is still counted where it is measurable")
+    assert "by_port" not in json.dumps(payload)
+    # the socket to `10.1.0.254:11000` is credited to **nothing**: the sum over the outbound side
+    # is unchanged by its presence, which is the difference between "unknown" and "filed somewhere"
+    assert sum(row["connections"] or 0 for row in payload["connections"]) == 0
+    assert out_metrics(payload) == [], "and it publishes no gauge under any name"
 
 
-def test_a_port_shared_by_several_names_resolves_none_of_them() -> None:
-    """The real `stream.conf` shape: sixteen names on 443, and no basis for picking one.
+def test_a_port_shared_by_several_names_still_resolves_none_of_them() -> None:
+    """The real `stream.conf` shape: sixteen names on 443, none of them counted.
 
-    The sockets go to `unmatched.outbound` with a group naming the candidates; each candidate's
-    own count stays `null` — a repeated port total drawn on sixteen pipes reads as sixteen times
-    the traffic, and a split of it is arithmetic nobody measured (rule 2).
+    The answer is the same `null` the old join gave, minus the machinery that produced it and the
+    `unmatched.outbound` total that used to double-count the same sockets.
     """
     entries = [(f"site{i}.example.test", (f"backend{i}.example.test", 443)) for i in range(4)]
     snap = snapshot(
@@ -362,27 +519,11 @@ def test_a_port_shared_by_several_names_resolves_none_of_them() -> None:
                          conn(("10.1.1.27", 50002), ("10.2.2.3", 443))]))
     payload = gateway.parse(snap, "gateway")
     assert len(payload["nginx"]["map_targets"]) == 4
-    for _key, (host, port) in entries:
-        assert pipe_to(payload, host, port)["connections"] is None, "unknown, never 0 and never 2"
-    group = payload["unmatched"]["groups"][0]
-    assert group == {"port": 443, "connections": 2,
-                     "hosts": ["backend0.example.test", "backend1.example.test",
-                               "backend2.example.test", "backend3.example.test"],
-                     "host_count": 4}
-    assert payload["unmatched"]["outbound"] == 2
-    assert payload["unmatched"]["inbound"] == 0
-
-
-def test_the_group_host_list_is_bounded_and_reports_the_real_total() -> None:
-    entries = [(f"site{i}.example.test", (f"backend{i}.example.test", 443))
-               for i in range(gateway.MAX_GROUP_HOSTS + 6)]
-    snap = snapshot(
-        nginx=nginx_section([nginx_server([443], [], [proxy_pass(None, variable="be")])],
-                            maps=[mapping_block("$be", entries)]),
-        sockets=sockets_section(established=[conn(("10.1.1.27", 50000), ("10.2.2.2", 443))]))
-    group = gateway.parse(snap, "gateway")["unmatched"]["groups"][0]
-    assert len(group["hosts"]) == gateway.MAX_GROUP_HOSTS
-    assert group["host_count"] == len(entries)
+    for _key, (host, _port) in entries:
+        assert routes_to(payload, host)[0]["connections"] is None, "unknown, never 0 and never 2"
+    assert out_metrics(payload) == []
+    assert sum(row["connections"] or 0 for row in payload["listeners"]) == 1
+    assert "unmatched" not in payload
 
 
 def test_no_join_ever_asks_a_resolver() -> None:
@@ -419,7 +560,8 @@ def test_no_join_ever_asks_a_resolver() -> None:
 def test_two_services_on_one_host_are_two_pipes_not_one_sum() -> None:
     """The reason the outbound series name carries its port (`minecraft` 25565 and 25566)."""
     snap = snapshot(
-        haproxy=haproxy_section([frontend("mc1", [25565]), frontend("mc2", [25566])],
+        haproxy=haproxy_section([frontend("mc1", [25565], default="testcraft"),
+                                 frontend("mc2", [25566], default="nimcraft")],
                                 [backend("testcraft", [server("mc1", "mc.example.test", 25565)]),
                                  backend("nimcraft", [server("mc2", "mc.example.test", 25566)])]),
         sockets=sockets_section(
@@ -427,37 +569,185 @@ def test_two_services_on_one_host_are_two_pipes_not_one_sum() -> None:
                          conn(("10.1.1.27", 40002), ("10.5.5.5", 25566)),
                          conn(("10.1.1.27", 40004), ("10.5.5.5", 25566))]))
     payload = gateway.parse(snap, "gateway")
-    assert pipe_to(payload, "mc.example.test", 25565)["connections"] == 1
-    assert pipe_to(payload, "mc.example.test", 25566)["connections"] == 2
-    assert [pipe["metric"] for pipe in payload["outbound"]] == [
-        "gateway.out_conns@mc.example.test:25565", "gateway.out_conns@mc.example.test:25566"]
-    names = {pipe["target"]["name"] for pipe in payload["outbound"]}
+    rows = routes_to(payload, "mc.example.test")
+    assert [row["out"]["port"] for row in rows] == [25565, 25566]
+    assert [row["connections"] for row in rows] == [None, None], "a name is never counted"
+    assert [row["metric"] for row in rows] == [None, None]
+    names = {row["out"]["name"] for row in payload["connections"]}
     assert names == {"mc1", "mc2"}, "the config's own server names survive the dedup"
 
 
-def test_a_target_with_no_port_is_a_pipe_with_an_unknown_count() -> None:
+def test_two_services_on_one_address_are_two_endpoints_and_two_gauges() -> None:
+    """The same two Minecraft servers written as **addresses**: now both are measurable.
+
+    The port belongs in the gauge name because one host answering `:25565` and `:25566` is two
+    services, and two gauges on `gateway.out_conns@10.5.5.5` would make the second insert
+    overwrite the first in silence.
+    """
+    snap = snapshot(
+        haproxy=haproxy_section([frontend("mc1", [25565], default="testcraft"),
+                                 frontend("mc2", [25566], default="nimcraft")],
+                                [backend("testcraft", [server("mc1", "10.5.5.5", 25565)]),
+                                 backend("nimcraft", [server("mc2", "10.5.5.5", 25566)])]),
+        sockets=sockets_section(
+            established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 25565)),
+                         conn(("10.1.1.27", 40002), ("10.5.5.5", 25566)),
+                         conn(("10.1.1.27", 40004), ("10.5.5.5", 25566))]))
+    payload = gateway.parse(snap, "gateway")
+    assert endpoint_count(payload, "10.5.5.5", 25565) == 1
+    assert endpoint_count(payload, "10.5.5.5", 25566) == 2
+    assert out_metrics(payload) == ["gateway.out_conns@10.5.5.5:25565",
+                                    "gateway.out_conns@10.5.5.5:25566"]
+
+
+def test_a_target_with_no_port_is_a_line_with_no_count() -> None:
     """`server x host` names no port, so there is nothing to join on and nothing to invent."""
     snap = snapshot(
-        haproxy=haproxy_section([], [backend("be", [server("solo", "solo.example.test")])]),
+        haproxy=haproxy_section([frontend("be", [8080], default="be")],
+                                [backend("be", [server("solo", "solo.example.test")])]),
         sockets=sockets_section(established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 8080))]))
-    pipe = pipe_to(gateway.parse(snap, "gateway"), "solo.example.test", None)
-    assert pipe["target"]["by_port"] is False
-    assert pipe["connections"] is None
-    assert pipe["metric"] == "gateway.out_conns@solo.example.test"
+    row = routes_to(gateway.parse(snap, "gateway"), "solo.example.test")[0]
+    assert row["out"]["port"] is None
+    assert row["out"]["address"] is False
+    assert row["connections"] is None
+    assert row["metric"] is None, "an endpoint with no port has no gauge either"
 
 
-def test_the_same_target_from_two_configs_is_one_pipe() -> None:
+def test_an_address_with_no_port_is_a_line_with_no_count() -> None:
+    """`out.address` says the string is an address; the **join needs the pair**, not one half."""
+    snap = snapshot(
+        haproxy=haproxy_section([frontend("be", [8080], default="be")],
+                                [backend("be", [server("solo", "10.5.5.5")])]),
+        sockets=sockets_section(established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 8080))]))
+    row = routes_to(gateway.parse(snap, "gateway"), "10.5.5.5")[0]
+    assert row["out"]["address"] is True
+    assert row["connections"] is None, "the socket's port is nobody's guess (rule 2)"
+    assert row["metric"] is None
+
+
+def test_two_connections_sharing_an_endpoint_say_so_and_repeat_the_count_never_split_it(
+        ) -> None:
+    """`:4443 -> 10.5.5.5:8080` and `:8443 -> 10.5.5.5:8080` are two lines and **one** count.
+
+    Each line carries the endpoint's whole number — a line showing half of it would be a split
+    nobody measured — and `shared: true` is what tells the totals, the page and any future notifier
+    that the two are the same sockets. Summing the lines doubles the traffic; summing the distinct
+    gauges is the number the kernel has.
+    """
     snap = snapshot(
         nginx=nginx_section([nginx_server([4443], ["a.example.test"],
-                                          [proxy_pass(("keycloak.example.test", 8080))]),
+                                          [proxy_pass(("10.5.5.5", 8080))]),
                              nginx_server([8443], ["admin.a.example.test"],
-                                          [proxy_pass(("keycloak.example.test", 8080))])]),
-        sockets=sockets_section(established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 8080))]))
+                                          [proxy_pass(("10.5.5.5", 8080))])]),
+        sockets=sockets_section(
+            established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 8080)),
+                         conn(("10.1.1.27", 40002), ("10.5.5.5", 8080))]))
     payload = gateway.parse(snap, "gateway")
-    targets = [pipe for pipe in payload["outbound"]
-               if pipe["target"]["host"] == "keycloak.example.test"]
-    assert len(targets) == 1
-    assert targets[0]["connections"] == 1, "one pipe, so one count, so no double draw"
+    rows = routes_to(payload, "10.5.5.5")
+    assert [row["in"]["port"] for row in rows] == [4443, 8443]
+    assert [row["connections"] for row in rows] == [2, 2], "the endpoint's total, twice"
+    assert [row["shared"] for row in rows] == [True, True]
+    assert sum(row["connections"] or 0 for row in rows) == 4, "the lines double-count on purpose"
+    outbound = [g for g in gateway.samples(payload) if g.metric.startswith("gateway.out_conns@")]
+    assert [g.metric for g in outbound] == ["gateway.out_conns@10.5.5.5:8080"], "published once"
+    assert outbound[0].value == 2.0
+
+
+def test_two_names_one_target_one_port_is_one_connection() -> None:
+    """The merge rule, which is what `shared` and the page's line count both depend on.
+
+    One `(source, in_port, host, port)` is **one** line: a vhost with two `server_name`s reaching
+    one `proxy_pass` is one pipe with two selectors, and a second vhost on the same port arriving
+    at the same endpoint adds its name to that line rather than drawing a second one. Selectors
+    union in **first-seen order**, because the config's order is the only ordering there is.
+    """
+    snap = snapshot(nginx=nginx_section([
+        nginx_server([4443], ["a.example.test", "www.a.example.test"],
+                     [proxy_pass(("10.5.5.5", 8080))]),
+        nginx_server([4443], ["b.example.test"], [proxy_pass(("10.5.5.5", 8080))])]))
+    rows = gateway.parse(snap, "gateway")["connections"]
+    assert len(rows) == 1, "two vhosts, one port, one endpoint: one line"
+    assert rows[0]["out"]["selectors"] == [
+        "a.example.test", "www.a.example.test", "b.example.test"], (
+        "selectors are the union in the order the configs wrote them")
+
+
+def test_the_same_target_on_two_listen_ports_is_two_connections() -> None:
+    """Never merge across `in_port`: `:4443` and `:8443` are two socket spaces.
+
+    The real `http.conf` pair — `admin.keycloak` on 8443 and `keycloak` on 4443 both land on
+    `keycloak:8080` — and the `minecraft` 25565/25566 lesson from the other side. One line for
+    both would draw one pipe where the operator has two, and the page could not say which inbound
+    port a connection came in on.
+    """
+    snap = snapshot(nginx=nginx_section([
+        nginx_server([4443], ["keycloak.example.test"], [proxy_pass(("10.5.5.5", 8080))]),
+        nginx_server([8443], ["admin.keycloak.example.test"],
+                     [proxy_pass(("10.5.5.5", 8080))])]))
+    rows = gateway.parse(snap, "gateway")["connections"]
+    assert [row["in"]["port"] for row in rows] == [4443, 8443]
+    assert [row["id"] for row in rows] == [
+        "nginx:4443->10.5.5.5:8080", "nginx:8443->10.5.5.5:8080"]
+    assert [row["out"]["selectors"] for row in rows] == [
+        ["keycloak.example.test"], ["admin.keycloak.example.test"]]
+
+
+def test_the_first_name_a_config_writes_for_an_endpoint_is_the_one_kept() -> None:
+    """A later claim never displaces a name the config already gave the endpoint.
+
+    haproxy claims are built before nginx's, and its `server` line is the only place a name comes
+    from, so the rule has to be "first name wins" rather than "last write wins": a second route to
+    the same endpoint that carries no name must not blank the one that does.
+    """
+    snap = snapshot(haproxy=haproxy_section(
+        [frontend("one", [80], default="be"), frontend("two", [80], default="be")],
+        [backend("be", [server("", "10.5.5.5", 8080), server("app1", "10.5.5.5", 8080)])]))
+    rows = gateway.parse(snap, "gateway")["connections"]
+    assert len(rows) == 1, "both frontends route the same server: one line"
+    assert rows[0]["out"]["name"] == "app1", "the name the config wrote, not the blank that came first"
+
+
+def test_the_loopback_hop_counts_once_on_each_side() -> None:
+    """A connection to a service on the router itself is **two** `/proc` rows and two lines.
+
+    `nginx :4443 → 127.0.0.1:4443` is the fleet's real shape (`stream.conf`'s `default`). One row
+    has local port `4443` (the side that was accepted, whose client is `127.0.0.1`) and another has
+    remote `127.0.0.1:4443` (the side the router dialled). Each belongs on its own pipe — inbound
+    and outbound — and **no single row may be drawn down both**: the inbound arm runs first and
+    `continue`s, which is the whole enforcement, so the two counts here are two each and not four
+    on one side. Summed against the table, the four rows are four counted and zero left over.
+    """
+    snap = snapshot(
+        nginx=nginx_section([nginx_server([4443], ["a.example.test"],
+                                          [proxy_pass(("127.0.0.1", 4443))])]),
+        sockets=sockets_section(
+            listens=[listen(4443)],
+            established=[conn(("127.0.0.1", 41000), ("127.0.0.1", 4443)),
+                         conn(("127.0.0.1", 41002), ("127.0.0.1", 4443)),
+                         conn(("127.0.0.1", 4443), ("127.0.0.1", 41000)),
+                         conn(("127.0.0.1", 4443), ("127.0.0.1", 41002))]))
+    payload = gateway.parse(snap, "gateway")
+    trunk = listener_at(payload, 4443)
+    route = routes_to(payload, "127.0.0.1")[0]
+    assert trunk["connections"] == 2, "the two accepted-side rows, and only those"
+    assert route["connections"] == 2, "the two dialled-side rows, and only those"
+    assert route["in"]["port"] == 4443 and route["out"]["port"] == 4443
+    assert trunk["clients"] == ["127.0.0.1"], "the loopback peer is the client of its own row"
+    total = trunk["connections"] + endpoint_count(payload, "127.0.0.1", 4443)
+    assert total == payload["sockets"]["established"] == 4, (
+        "each row counted at most once; the ≤ identity is an equality here because every row of "
+        "this table belongs to the one configured route")
+
+
+def test_an_endpoint_reached_by_one_line_is_not_shared() -> None:
+    """`shared` is a fact about the graph, not a flag meaning "I did not decide"."""
+    snap = snapshot(
+        nginx=nginx_section([nginx_server([4443], ["a.example.test"],
+                                          [proxy_pass(("10.5.5.5", 8080))])]),
+        sockets=sockets_section(established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 8080))]))
+    row = routes_to(gateway.parse(snap, "gateway"), "10.5.5.5")[0]
+    assert row["shared"] is False
+    assert row["connections"] == 1
 
 
 # --------------------------------------------------------------------------- #
@@ -476,7 +766,7 @@ def test_a_map_no_proxy_pass_references_contributes_nothing() -> None:
         sockets=sockets_section(listens=[listen(443)]))
     payload = gateway.parse(snap, "gateway")
     assert [row["key"] for row in payload["nginx"]["map_targets"]] == ["a.example.test"]
-    assert [pipe["target"]["host"] for pipe in payload["outbound"]] == ["be.example.test"]
+    assert [row["out"]["host"] for row in payload["connections"]] == ["be.example.test"]
 
 
 def test_a_map_entry_with_no_address_is_skipped() -> None:
@@ -488,30 +778,102 @@ def test_a_map_entry_with_no_address_is_skipped() -> None:
     assert [row["key"] for row in payload["nginx"]["map_targets"]] == ["b.example.test"]
 
 
-def test_a_duplicate_endpoint_keeps_the_name_the_config_has() -> None:
-    """haproxy is claimed first, so nginx writing the same endpoint loses nothing."""
+def test_one_endpoint_reached_from_both_configs_is_two_lines_of_one_number() -> None:
+    """haproxy routes `:80` to `app.example.test:9000` and an nginx vhost routes `:8443` there too.
+
+    Two files, two inbound ports, one endpoint: the graph keeps **both lines** (each is a route a
+    reader has to see, and merging them would erase which file declares which) and stamps each with
+    the same endpoint count, `shared`. What the merge rule inside `config_connections` still does is
+    keep the name a claim carries within one `(source, in_port, host, port)` key — tested here on
+    the haproxy line, whose `server` name no other claim has.
+    """
     snap = snapshot(
-        haproxy=haproxy_section([frontend("app", [80])],
+        haproxy=haproxy_section([frontend("app", [80], default="app-be", use=["app-be"])],
                                 [backend("app-be", [server("app1", "app.example.test", 9000)])]),
         nginx=nginx_section([nginx_server([8443], ["app.example.test"],
                                           [proxy_pass(("app.example.test", 9000))])]),
         sockets=sockets_section(established=[conn(("10.1.1.27", 40000), ("10.5.5.5", 9000))]))
     payload = gateway.parse(snap, "gateway")
-    app_pipes = [pipe for pipe in payload["outbound"]
-                 if pipe["target"]["host"] == "app.example.test"]
-    assert len(app_pipes) == 1
-    assert app_pipes[0]["target"]["name"] == "app1"
-    assert app_pipes[0]["source"] == "haproxy"
-    assert app_pipes[0]["connections"] == 1
+    rows = routes_to(payload, "app.example.test")
+    assert [row["source"] for row in rows] == ["haproxy", "nginx"]
+    assert rows[0]["out"]["name"] == "app1", "the haproxy `server` name, kept verbatim"
+    assert rows[0]["in"]["port"] == 80, "one line despite two routes naming the same backend"
+    assert rows[1]["out"]["selectors"] == ["app.example.test"]
 
 
-def test_a_proxy_pass_naming_no_host_is_no_pipe() -> None:
-    """`target: {host: ""}` is drift, and drift yields no pipe rather than a pipe to nowhere."""
+def test_a_pool_names_its_upstream_servers_and_an_undeclared_pool_draws_nothing() -> None:
+    """Derivation 3: `proxy_pass http://<name>` (no port) is an `upstream` block, and its members
+    are the endpoints. No block of that name is **no connection** — and no invented host either.
+
+    The payload cannot say where the traffic lands, so it claims nothing (rule 2). Task 03 decides
+    whether an undeclared pool is a config-integrity warning; this task draws no line for it, and
+    says so by pinning an empty graph rather than a line to `backend_pool:80`.
+    """
+    snap = snapshot(nginx=nginx_section(
+        [nginx_server([4443], ["app.example.test"], [pool_pass("backend_pool")])],
+        upstreams=[upstream("backend_pool", [("10.0.0.1", 3000), ("10.0.0.2", 3000)])]))
+    rows = gateway.parse(snap, "gateway")["connections"]
+    assert [(row["out"]["host"], row["out"]["port"], row["out"]["kind"]) for row in rows] == [
+        ("10.0.0.1", 3000, gateway.KIND_POOL), ("10.0.0.2", 3000, gateway.KIND_POOL)]
+    assert [row["out"]["selectors"] for row in rows] == [["backend_pool"], ["backend_pool"]], (
+        "the pool name is the config's own word for why these two endpoints are here")
+    assert [row["metric"] for row in rows] == [
+        "gateway.out_conns@10.0.0.1:3000", "gateway.out_conns@10.0.0.2:3000"], (
+        "a pool member is an address, so both lines are joinable")
+
+    orphans = snapshot(nginx=nginx_section(
+        [nginx_server([4443], ["app.example.test"], [pool_pass("no_such_pool")])]))
+    payload = gateway.parse(orphans, "gateway")
+    assert payload["connections"] == [], "an undeclared pool names no endpoint, so it draws nothing"
+    assert listener_at(payload, 4443), "and the trunk it hangs off still exists"
+
+
+def test_a_haproxy_connection_carries_the_backend_and_the_server_name(gateway_snapshot: Any) -> None:
+    """Both of the config's own names for a haproxy route survive into the graph.
+
+    `out.name` is the `server` line's name and `out.selectors` the backend the frontend routes to —
+    the two words an operator greps for in `haproxy.cfg`, printed rather than paraphrased.
+    """
+    payload = gateway.parse(gateway_snapshot("full"), "gateway")
+    row = next(row for row in payload["connections"] if row["in"]["port"] == 22)
+    assert row["out"]["name"] == "gitea"
+    assert row["out"]["kind"] == gateway.KIND_BACKEND
+    assert row["out"]["selectors"] == ["gitea-2222"]
+    assert row["source"] == "haproxy"
+
+
+def test_a_frontend_that_routes_by_expression_is_a_listener_with_no_connection() -> None:
+    """Refusal rule 5, synthetic half: a fetch expression names no backend, so nothing is joined.
+
+    The agent reports `use_backend %[req.hdr(host),map_dom(...)]` as **no** name (it interprets no
+    config), and "no name" and "no routing directive" are one value in this payload. Inventing a
+    route here would be rule 2, and inventing a *warning* about it would blame the operator for a
+    thing the payload cannot distinguish.
+    """
+    snap = snapshot(haproxy=haproxy_section([{"name": "expr", "binds": [bind(80)],
+                                              "default_backend": None, "backends": []}]))
+    payload = gateway.parse(snap, "gateway")
+    assert listener_at(payload, 80), "the trunk exists"
+    assert payload["connections"] == [], "and no line is drawn out of it"
+
+
+def test_a_proxy_pass_with_neither_target_nor_variable_draws_nothing() -> None:
+    """The other half of refusal rule 5: a unix socket or a bare word names no endpoint."""
+    snap = snapshot(nginx=nginx_section([nginx_server(
+        [443], ["a.example.test"],
+        [{"location": "/", "scheme": None, "target": None, "variable": None}])]))
+    payload = gateway.parse(snap, "gateway")
+    assert payload["connections"] == []
+    assert listener_at(payload, 443), "the listen port is still a trunk the page draws"
+
+
+def test_a_proxy_pass_naming_no_host_is_no_line() -> None:
+    """`target: {host: ""}` is drift, and drift yields no line rather than a line to nowhere."""
     snap = snapshot(nginx=nginx_section([nginx_server(
         [443], [], [{"location": "/", "scheme": "http", "target": {"host": "  ", "port": 80},
                      "variable": None}])]))
     payload = gateway.parse(snap, "gateway")
-    assert payload["outbound"] == []
+    assert payload["connections"] == []
     assert payload["nginx"]["servers"] == [{"port": 443, "server_names": []}]
 
 
@@ -548,9 +910,7 @@ def test_an_agent_without_the_sections_predates_gateway_support(gateway_snapshot
     assert "predates gateway support" in payload["why"]
     assert payload["haproxy"] == {"frontends": []}
     assert payload["nginx"] == {"servers": [], "map_targets": []}
-    assert payload["inbound"] == [] and payload["outbound"] == []
-    assert payload["unmatched"] == {"inbound": None, "outbound": None, "other": None,
-                                    "groups": []}
+    assert payload["listeners"] == [] and payload["connections"] == []
     assert payload["sockets"] == {"listens": None, "established": None}
     assert payload["sections"] == {"haproxy": None, "nginx": None, "sockets": None}
     assert gateway.samples(payload, 1.0) == [], "an unknown count publishes no gauge"
@@ -565,9 +925,13 @@ def test_a_host_running_no_haproxy_says_so_and_keeps_the_nginx_pipes(gateway_sna
     assert payload["section_errors"], "the agent's own line still travels, verbatim"
     assert any("not found" in line for line in payload["section_errors"])
     assert [row["port"] for row in payload["nginx"]["servers"]] == [80, 443, 4443, 8443]
-    assert [pipe["port"] for pipe in payload["inbound"] if pipe["source"] == "nginx"] == \
+    assert [row["port"] for row in payload["listeners"] if row["source"] == "nginx"] == \
         [80, 443, 4443, 8443]
     assert payload["haproxy"]["frontends"] == []
+    assert [row for row in payload["connections"] if row["source"] == "haproxy"] == [], (
+        "no haproxy file, so no haproxy route — and no invented one to fill the gap")
+    assert [row for row in payload["connections"] if row["source"] == "nginx"], (
+        "the nginx half of the map is untouched by the other file being absent")
 
 
 def test_an_unreadable_config_is_a_different_sentence_from_no_config() -> None:
@@ -577,7 +941,7 @@ def test_an_unreadable_config_is_a_different_sentence_from_no_config() -> None:
     payload = gateway.parse(snap, "gateway")
     assert payload["sections"]["haproxy"] is None
     assert "could not be read or parsed" in (payload["why"] or "")
-    assert [pipe["port"] for pipe in payload["inbound"]] == [80]
+    assert [row["port"] for row in payload["listeners"]] == [80]
 
 
 def test_a_socket_table_that_did_not_answer_leaves_every_count_null(
@@ -587,11 +951,11 @@ def test_a_socket_table_that_did_not_answer_leaves_every_count_null(
     assert payload["sections"]["sockets"] is None
     assert "sockets:" in (payload["why"] or "")
     assert payload["sockets"] == {"listens": None, "established": None}
-    assert payload["inbound"], "the configured pipes are still drawn — the config did answer"
-    assert all(pipe["connections"] is None for pipe in payload["inbound"])
-    assert all(pipe["connections"] is None for pipe in payload["outbound"])
-    assert payload["unmatched"] == {"inbound": None, "outbound": None, "other": None,
-                                    "groups": []}
+    assert payload["listeners"], "the configured ports are still drawn — the config did answer"
+    assert all(row["connections"] is None for row in payload["listeners"])
+    assert payload["connections"], "and so is every route the two files declare"
+    assert all(row["connections"] is None for row in payload["connections"]), (
+        "a silent socket table says nothing about any route, not even about the joinable ones")
     assert gateway.samples(payload, 1.0) == []
 
 
@@ -601,7 +965,8 @@ def test_a_partial_snapshot_names_the_missing_section_only() -> None:
     payload = gateway.parse(snap, "gateway")
     assert payload["supported"] is True
     assert payload["sections"] == {"haproxy": None, "nginx": None, "sockets": True}
-    assert payload["unmatched"]["other"] == 1, "9999 is a listener nothing claims"
+    assert payload["listeners"] == [], "9999 is a listener nothing claims, so it is not a pipe"
+    assert payload["sockets"] == {"listens": 1, "established": 0}, "the kernel's number still travels"
     assert "haproxy" in (payload["why"] or "") and "nginx" in (payload["why"] or "")
 
 
@@ -635,13 +1000,17 @@ def test_samples_are_one_gauge_per_pipe_under_the_gateway_family(gateway_snapsho
     assert {row.source for row in rows} == {gateway.SOURCE}
     assert {row.host for row in rows} == {"gateway"}
     named = {row.metric: row.value for row in rows}
-    assert named["gateway.in_conns@443"] == float(pipe_by_port(payload, 443)["connections"])
-    counted = [pipe for pipe in payload["inbound"] + payload["outbound"]
-               if pipe["connections"] is not None]
-    assert len(named) == len(counted), "one gauge per pipe with a number, and none without"
-    for pipe in counted:
-        assert named[pipe["metric"]] == float(pipe["connections"]), (
-            "the stored gauge is the number the page prints, never a second reading of it")
+    assert named["gateway.in_conns@443"] == float(listener_at(payload, 443)["connections"])
+    # one gauge per **metric name** that has a number: shared endpoints appear on several lines and
+    # must be stored once, or the history doubles the traffic for one reading
+    expected = {row["metric"]: float(row["connections"])
+                for group in ("listeners", "connections") for row in payload[group]
+                if row["metric"] is not None and row["connections"] is not None}
+    assert named == expected, "one gauge per measured endpoint, and none for an unmeasured one"
+    assert len(rows) == len(named), "no metric is emitted twice by one poll"
+    for row in payload["connections"]:
+        if row["metric"] is None:
+            assert row["connections"] is None, "a line with no gauge has no number either"
 
 
 def test_parse_gateway_snapshot_stamps_its_samples_from_the_snapshot() -> None:
@@ -666,7 +1035,7 @@ def test_the_gauges_skip_a_pipe_with_no_number() -> None:
     """No sample for an unknown count — a chart of zeros for a dead socket table is the
     failure mode rule 2 names, and `sources/disks.py` already refuses it for unreadable drives."""
     payload = gateway.parse(snapshot(haproxy=haproxy_section([frontend("ssh", [22])])), "gateway")
-    assert payload["inbound"][0]["connections"] is None
+    assert payload["listeners"][0]["connections"] is None
     assert gateway.samples(payload, 1.0) == []
 
 
@@ -676,9 +1045,8 @@ def test_a_snapshot_whose_sections_are_empty_is_an_honest_empty_page() -> None:
                     sockets=sockets_section())
     payload = gateway.parse(snap, "gateway")
     assert payload["supported"] is True and payload["why"] is None
-    assert payload["inbound"] == [] and payload["outbound"] == []
+    assert payload["listeners"] == [] and payload["connections"] == []
     assert payload["sockets"] == {"listens": 0, "established": 0}
-    assert payload["unmatched"] == {"inbound": 0, "outbound": 0, "other": 0, "groups": []}
 
 
 def test_junk_in_the_sections_yields_no_pipes_and_no_exception() -> None:
@@ -690,23 +1058,26 @@ def test_junk_in_the_sections_yields_no_pipes_and_no_exception() -> None:
                            "sockets": {"available": True, "listens": [None],
                                        "established": [{"local": 5, "remote": None}]}}
     payload = gateway.parse(snap, "gateway")
-    assert payload["inbound"] == [] and payload["outbound"] == []
-    assert payload["unmatched"]["inbound"] == 0
+    assert payload["listeners"] == [] and payload["connections"] == []
     assert payload["sockets"] == {"listens": 0, "established": 1}
 
 
 def test_a_port_of_zero_or_a_name_of_nothing_is_no_match() -> None:
     """`0` is not a port and an empty target is not a host, so neither becomes a pipe (rule 2)."""
     snap = snapshot(
-        haproxy=haproxy_section([frontend("u", [None, 0]), frontend("ok", [22])],
+        haproxy=haproxy_section([frontend("u", [None, 0]), frontend("ok", [22], default="b")],
                                 [backend("b", [server("?", "", 22), server("z", "z.example.test",
                                                                             0)])]),
         sockets=sockets_section(listens=[listen(0), listen(22)]))
     payload = gateway.parse(snap, "gateway")
     assert [row["port"] for row in payload["haproxy"]["frontends"]] == [22]
-    assert [pipe["target"]["host"] for pipe in payload["outbound"]] == ["z.example.test"]
-    assert payload["outbound"][0]["target"]["port"] is None
-    assert payload["unmatched"]["other"] == 0, "a 0 is not a port, claimed or otherwise"
+    assert [row["out"]["host"] for row in payload["connections"]] == ["z.example.test"]
+    row = payload["connections"][0]
+    assert row["out"]["port"] is None, "a 0 is not a port, so the line carries no port"
+    assert row["metric"] is None and row["connections"] is None, (
+        "and therefore nothing to join on and nothing to publish")
+    assert [entry["port"] for entry in payload["listeners"]] == [22], (
+        "a 0 bind is not a listening port either")
 
 
 def test_a_use_backend_map_is_reported_as_routes_not_one_chosen_backend() -> None:
@@ -716,3 +1087,333 @@ def test_a_use_backend_map_is_reported_as_routes_not_one_chosen_backend() -> Non
     row = gateway.parse(snap, "gateway")["haproxy"]["frontends"][0]
     assert row["backend"] == "base-be"
     assert row["routes"] == ["base-be", "blue-be", "green-be"]
+
+
+# --------------------------------------------------------------------------- #
+# config-integrity warnings: seven kinds, each a config that does not connect to itself
+#
+# Each kind gets a synthetic config written in the shape the agent publishes (the builders above
+# are the section document, not a fake tree: `warnings()` is a pure function over sections, and a
+# file round-trip would only re-test the agent's parser). The captured configs then pin that the
+# seven checks are not a lie about THIS fleet: zero warnings, and a stated reason per kind.
+# --------------------------------------------------------------------------- #
+
+def kinds(payload_warnings: Sequence[Mapping[str, str]]) -> list[str]:
+    """The `kind` of every warning, in the order `warnings()` produced them."""
+    return [row["kind"] for row in payload_warnings]
+
+
+def warning_for(payload_warnings: Sequence[Mapping[str, str]], kind: str) -> Mapping[str, str]:
+    """The one warning of `kind`, failing if there is not exactly one of them."""
+    rows = [row for row in payload_warnings if row["kind"] == kind]
+    assert len(rows) == 1, f"expected exactly one {kind}, got {rows}"
+    return rows[0]
+
+
+def test_a_dangling_use_backend_warns_by_frontend_and_backend() -> None:
+    """`haproxy_route_dangling`: a route naming a backend nobody declares.
+
+    Synthetic sections (the pure-function route): the check is over the two lists the agent
+    publishes, and the fault is one line of a file, not a file's layout on disk.
+    """
+    section = haproxy_section(
+        [frontend("haproxy-22", [22], default="gitea-2222"),
+         frontend("haproxy-443", [443], use=("live-be", "gone-be"))],
+        [backend("live-be", [server("s", "10.0.0.1", 80)])])
+    found = gateway.haproxy_warnings(section)
+    assert kinds(found) == [gateway.WARN_ROUTE_DANGLING, gateway.WARN_ROUTE_DANGLING]
+    row = found[0]
+    assert row["id"] == "haproxy_route_dangling:haproxy-22->gitea-2222"
+    assert row["kind"] == gateway.WARN_ROUTE_DANGLING
+    assert row["subject"] == "haproxy-22->gitea-2222"
+    assert row["message"] == ('frontend haproxy-22 routes to backend "gitea-2222", '
+                              "which no backend block declares")
+    assert found[1]["id"] == "haproxy_route_dangling:haproxy-443->gone-be", (
+        "every dangling name is its own warning — collapsing them would hide the second one")
+
+
+def test_a_backend_no_frontend_routes_to_warns_with_its_server_count() -> None:
+    """`haproxy_backend_orphan`: servers with nowhere to come from, counted as the file wrote it."""
+    section = haproxy_section(
+        [frontend("haproxy-22", [22], default="used-be")],
+        [backend("used-be", [server("s", "10.0.0.1", 80)]),
+         backend("old-tunnel", [server("a", "10.0.0.2", 22), server("b", "10.0.0.3", 22)])])
+    row = warning_for(gateway.haproxy_warnings(section), gateway.WARN_BACKEND_ORPHAN)
+    assert row["message"] == ('backend "old-tunnel" has 2 servers and no frontend routes to it')
+    assert row["id"] == "haproxy_backend_orphan:old-tunnel"
+    # the singular, because the message prints the config's own count
+    one = haproxy_section([frontend("f", [22], default="used-be")],
+                          [backend("used-be", [server("s", "10.0.0.1", 80)]),
+                           backend("solo", [server("a", "10.0.0.9", 22)])])
+    assert "has 1 server and no frontend routes to it" in \
+        warning_for(gateway.haproxy_warnings(one), gateway.WARN_BACKEND_ORPHAN)["message"]
+
+
+def test_a_backend_with_no_server_warns_that_it_routes_nowhere() -> None:
+    """`haproxy_backend_empty`: the block exists, so a route to it is not dangling — it just ends."""
+    section = haproxy_section([frontend("haproxy-22", [22], default="gitea-2222")],
+                              [backend("gitea-2222", [])])
+    found = gateway.haproxy_warnings(section)
+    assert kinds(found) == [gateway.WARN_BACKEND_EMPTY], (
+        "an empty backend is not also an orphan: `orphan` needs a server to have anywhere to go")
+    assert found[0]["message"] == 'backend "gitea-2222" declares no server — it routes nowhere'
+
+
+def test_a_server_block_that_never_listens_warns() -> None:
+    """`nginx_server_unlistened`: the vhost is configured and unreachable, in both its shapes."""
+    section = nginx_section([
+        nginx_server([], ["nextcloud.example.com"], [proxy_pass(("10.0.0.5", 11000))]),
+        nginx_server([], ["named-only.example.com"]),
+        nginx_server([443], ["fine.example.com"], [proxy_pass(("10.0.0.6", 443))]),
+    ])
+    found = gateway.nginx_warnings(section)
+    assert kinds(found) == [gateway.WARN_SERVER_UNLISTENED, gateway.WARN_SERVER_UNLISTENED]
+    assert found[0]["message"] == ('nginx server "nextcloud.example.com" proxy_passes '
+                                   "but never listens")
+    assert found[1]["message"] == ('nginx server "named-only.example.com" '
+                                   "declares a server_name but never listens")
+
+
+def test_a_proxy_pass_naming_an_undeclared_pool_warns() -> None:
+    """`nginx_pool_undeclared`: task 01 drew no connection for it, and this says why."""
+    section = nginx_section(
+        [nginx_server([4443], ["app.example.com"], [pool_pass("backend_pool")]),
+         nginx_server([8443], ["other.example.com"],
+                      [pool_pass("backend_pool")])],
+        upstreams=[upstream("a_real_pool", [("10.0.0.7", 3000)])])
+    found = gateway.nginx_warnings(section)
+    assert kinds(found) == [gateway.WARN_POOL_UNDECLARED, gateway.WARN_POOL_UNDECLARED]
+    assert found[0]["message"] == ('nginx listen 4443 proxy_passes to pool "backend_pool", '
+                                   "which no upstream block declares")
+    assert found[0]["id"] == "nginx_pool_undeclared:backend_pool@4443"
+    assert found[1]["id"] == "nginx_pool_undeclared:backend_pool@8443", (
+        "two listen ports reaching the one missing pool are two broken routes and two subjects")
+    # and the same block naming two ports is ONE warning, because the repair is one `proxy_pass`
+    both = nginx_section([nginx_server([4443, 8443], ["app.example.com"],
+                                       [pool_pass("backend_pool")])])
+    row = warning_for(gateway.nginx_warnings(both), gateway.WARN_POOL_UNDECLARED)
+    assert row["id"] == "nginx_pool_undeclared:backend_pool@4443+8443"
+    assert row["message"].startswith("nginx listen 4443, 8443 proxy_passes to pool")
+
+
+def test_a_proxy_pass_variable_no_map_defines_warns() -> None:
+    """`nginx_variable_unmapped`: the stream server routes to a variable nothing fills."""
+    section = nginx_section(
+        [nginx_server([443], [], [proxy_pass(None, variable="$targetBackend")]),
+         nginx_server([8443], [], [proxy_pass(None, variable="mapped")])],
+        maps=[mapping_block("mapped", [("a.example.com", ("10.0.0.8", 443))])])
+    row = warning_for(gateway.nginx_warnings(section), gateway.WARN_VARIABLE_UNMAPPED)
+    assert row["id"] == "nginx_variable_unmapped:targetBackend@443"
+    assert row["message"] == ("nginx listen 443 proxy_passes $targetBackend, "
+                              "which no map block defines"), (
+        "the `$` is nginx's spelling and the message keeps it, whatever the agent publishes")
+
+
+def test_a_referenced_map_entry_with_no_address_warns() -> None:
+    """`nginx_map_route_missing`: the SNI key is routed to nothing."""
+    section = nginx_section(
+        [nginx_server([443], [], [proxy_pass(None, variable="targetBackend")])],
+        maps=[mapping_block("targetBackend",
+                            [("x.example.com", None),
+                             ("ok.example.com", ("10.0.0.9", 443))])])
+    row = warning_for(gateway.nginx_warnings(section), gateway.WARN_MAP_ROUTE_MISSING)
+    assert row["id"] == "nginx_map_route_missing:targetBackend:x.example.com"
+    assert row["message"] == 'map $targetBackend entry "x.example.com" names no address to route to'
+
+
+# --- the three refusals: each produces NO warning while still producing its other output --- #
+
+def test_a_listen_with_no_proxy_pass_is_not_a_warning() -> None:
+    """A static or redirect vhost is legal and looks identical here, so nothing is said about it.
+
+    This fleet's own `:80` catch-all is a `return 301`, and the agent publishes it as a `server`
+    with a `listen`, a `server_name` and no `proxy_pass` — exactly the shape a warning would blame.
+    Pinned in the direction that matters: the listener still exists, and the warning list stays
+    empty.
+    """
+    section = nginx_section([nginx_server([80], ["_"])])
+    assert gateway.nginx_warnings(section) == []
+    payload = gateway.parse(snapshot(nginx=section, sockets=sockets_section(listens=[listen(80)])),
+                            "gateway")
+    assert [row["port"] for row in payload["listeners"]] == [80], "the trunk is still drawn"
+    assert payload["connections"] == [], "and it is drawn alone"
+    assert payload["warnings"] == []
+
+
+def test_a_frontend_routing_by_fetch_expression_is_not_a_warning() -> None:
+    """"no name" and "no routing directive" are one value on this wire, so neither is a fault.
+
+    `use_backend %[req.hdr(host),map_dom(...)]` arrives as a frontend with no backend name — the
+    same document a frontend with no routing at all produces. Warning about it would blame a config
+    this agent cannot read; the fix is an agent change, not a guess here. The listener survives and
+    the warning list stays empty.
+    """
+    section = haproxy_section([frontend("dynamic", [443], use=())])
+    assert gateway.haproxy_warnings(section) == []
+    payload = gateway.parse(snapshot(haproxy=section,
+                                     sockets=sockets_section(listens=[listen(443)])), "gateway")
+    assert [row["port"] for row in payload["listeners"]] == [443]
+    assert payload["connections"] == []
+    assert payload["warnings"] == []
+
+
+def test_a_proxy_pass_with_neither_target_nor_variable_is_not_a_warning() -> None:
+    """A unix socket or a bare word is legitimate, undrawable, and not broken."""
+    bare = {"location": "/", "scheme": None, "target": None, "variable": None}
+    section = nginx_section([nginx_server([9000], ["sock.example.com"], [bare])])
+    assert gateway.nginx_warnings(section) == []
+    assert gateway.config_connections(None, section) == []
+
+
+def test_an_unreferenced_map_with_no_address_entries_warns_about_nothing() -> None:
+    """The `$connection_upgrade` map's `upgrade`/`close` are header words, not missing routes."""
+    section = nginx_section(
+        [nginx_server([80], ["_"], [{"location": "/", "scheme": "http",
+                                     "target": {"host": "10.0.0.4", "port": 80},
+                                     "variable": None}])],
+        maps=[mapping_block("connection_upgrade", [("default", None), ("", None)])])
+    assert gateway.nginx_warnings(section) == [], (
+        "a map no proxy_pass names is not a routing table, and its null targets are its business")
+
+
+# --- the arms that must not be judged, and the pins on this fleet's real configs --- #
+
+def test_an_unreadable_or_absent_section_warns_about_nothing(gateway_snapshot: Any) -> None:
+    """A host that cannot be read has not been found guilty of anything (invariant 3).
+
+    Three arms, driven from the **real** captured tree through the real agent parser, and each one
+    still reports the half it *can* report: `no_haproxy` keeps its nginx warnings-free record,
+    `predates` warns about nothing because nothing was read.
+    """
+    for mode in ("no_haproxy", "no_nginx", "predates"):
+        payload = gateway.parse(gateway_snapshot(mode), "gateway")
+        assert payload["warnings"] == [], mode
+
+    # and the same rule stated on hand-built sections, so it holds for `available: null` beside
+    # `available: false` (the fixture has no arm for "the file is there and unreadable")
+    assert gateway.haproxy_warnings(haproxy_section(
+        [frontend("f", [22], default="nowhere")], available=False)) == []
+    assert gateway.haproxy_warnings(haproxy_section(
+        [frontend("f", [22], default="nowhere")], available=None)) == []
+    assert gateway.haproxy_warnings(None) == []
+    assert gateway.nginx_warnings(nginx_section(
+        [nginx_server([], ["x.example.com"])])) != [], "the control: an available section IS judged"
+    assert gateway.nginx_warnings(nginx_section([nginx_server([], ["x.example.com"])],
+                                                available=None)) == []
+    assert gateway.nginx_warnings(None) == []
+
+
+def test_the_captured_configs_produce_no_warnings(gateway_snapshot: Any) -> None:
+    """This fleet's own ingress is clean, and the reason per kind is part of the pin.
+
+    Seven checks that never fire on a real config would be a lie about this fleet and a source of
+    phantom alerts, so each kind is answered with the fact in the capture that stops it: the six
+    frontends each name a declared backend, the six backends are each routed and each carry a
+    `server`, every nginx `server` block listens, no `proxy_pass` names a pool, the one
+    `proxy_pass $var` has its `map`, and every entry of that referenced map carries an address
+    (the *unreferenced* `$connection_upgrade` map's null targets are not routes at all).
+    """
+    snap = gateway_snapshot("full")
+    payload = gateway.parse(snap, "gateway")
+    assert payload["warnings"] == []
+
+    haproxy, nginx = snap["haproxy"], snap["nginx"]
+    declared = {block["name"] for block in haproxy["backends"]}
+    routed = {frontend["default_backend"] for frontend in haproxy["frontends"]}
+    for frontend in haproxy["frontends"]:
+        routed.update(frontend["backends"])
+    assert declared == routed == {
+        "gitea-2222", "sec-gitea-2000", "iperf3-5201", "unifi-external-8080",
+        "testcraft-25565", "nimcraft-25566"}, "no dangling route and no orphan backend"
+    assert all(block["servers"] for block in haproxy["backends"]), "no backend routes nowhere"
+
+    assert all(server["listen"] for server in nginx["servers"]), "every vhost listens"
+    assert not [proxy for server in nginx["servers"] for proxy in server["proxy_passes"]
+                if proxy["target"] is not None and proxy["target"]["port"] is None], (
+        "no `proxy_pass` names a pool, declared or otherwise, on this gateway")
+    used = gateway.proxy_variables(nginx)
+    defined = {block["variable"].lstrip("$") for block in nginx["maps"]}
+    assert used == {"targetBackend"} and used <= defined, (
+        "the one variable a `proxy_pass` passes IS defined by a map")
+    referenced = [block for block in nginx["maps"] if block["variable"].lstrip("$") in used]
+    assert len(referenced) == 1 and len(referenced[0]["entries"]) == 17
+    assert all(entry["target"] for entry in referenced[0]["entries"]), (
+        "all 17 stream routes name an address, `default` included")
+    unreferenced = [block for block in nginx["maps"] if block not in referenced]
+    assert any(entry["target"] is None for block in unreferenced for entry in block["entries"]), (
+        "the capture must still hold null-target entries on the UNREFERENCED map, or this pin "
+        "proves the refusal rule about nothing")
+
+
+def test_warnings_are_deterministic_deduplicated_and_json_serialisable() -> None:
+    """Same input twice, one output; the same fault twice, one row; every row a plain JSON object.
+
+    The page keys its DOM on `id` and `alerts.py` quotes `warnings[0]`, so a list that reordered
+    between polls would reshuffle the panel and a row that carried a non-JSON value would 500 the
+    route. Deduplication is exercised the way the real configs do it: one frontend with two `bind`
+    lines is one broken route, not two, and two frontends with the same broken name are two.
+    """
+    section_h = haproxy_section(
+        [frontend("twice", [22, 2222], default="gone"),
+         frontend("also", [33], default="gone")],
+        [backend("live", [server("s", "10.0.0.1", 80)])])
+    section_n = nginx_section([nginx_server([], ["x.example.com"], [pool_pass("nope")])])
+    first = gateway.warnings(section_h, section_n)
+    assert gateway.warnings(section_h, section_n) == first, "deterministic"
+    assert gateway.warnings(section_h, section_n) is not first
+    assert len(first) == len({row["id"] for row in first}), "deduplicated by id"
+    assert kinds(first) == [gateway.WARN_ROUTE_DANGLING, gateway.WARN_ROUTE_DANGLING,
+                            gateway.WARN_BACKEND_ORPHAN, gateway.WARN_SERVER_UNLISTENED,
+                            gateway.WARN_POOL_UNDECLARED], (
+        "haproxy kinds first and in config order, then nginx kinds — the order the page lists")
+    assert first[0]["id"] == "haproxy_route_dangling:twice->gone", (
+        "one warning per broken line, never one per bind")
+    assert first[1]["id"] == "haproxy_route_dangling:also->gone"
+    json.dumps(first)
+    assert all(set(row) == {"id", "kind", "subject", "message"} for row in first), (
+        "a fourth key would reach the page and the event feed unnoticed")
+    assert all(isinstance(value, str) for row in first for value in row.values())
+    assert not walk_keys(first) & {"severity", "window_seconds"}, (
+        "a config warning is a structural fact, never a graded number")
+
+
+def test_a_row_that_names_nothing_contributes_nothing_and_a_repeated_row_is_one() -> None:
+    """The two defensive arms of `warnings()`, driven from the shapes a real file can produce.
+
+    A `backend` line with no name is not a backend anybody can repair, and a config that declares
+    the same empty block twice (a copy-paste, an `include` that lands twice on one file) is one
+    fault with one fix — so the deduplication the docstring promises is measured here rather than
+    assumed, and the row that cannot be named is dropped instead of warning as `""`.
+    """
+    section = haproxy_section(
+        [frontend("haproxy-22", [22], default="empty-be")],
+        [{"servers": [server("s", "10.0.0.1", 22)]},          # a backend with no name at all
+         backend("empty-be", []), backend("empty-be", [])])   # the same block declared twice
+    assert len(gateway.haproxy_warnings(section)) == 2, (
+        "the per-section check reports what the file says — it is `warnings()` that owns the dedup")
+    found = gateway.warnings(section, None)
+    assert kinds(found) == [gateway.WARN_BACKEND_EMPTY], found
+    assert found[0]["id"] == "haproxy_backend_empty:empty-be", (
+        "one row for the duplicated block — the page keys its DOM on `id` and two identical rows "
+        "would be one fault counted twice")
+
+
+def test_warnings_travel_in_the_payload_and_the_stub_share_the_key(gateway_snapshot: Any) -> None:
+    """`payload["warnings"]` is there in every arm, and the socket half cannot silence it.
+
+    The stub parity matters because the page renders both arms from one renderer; the sockets arm
+    matters because a config is just as broken when `/proc` will not answer — a warning is a config
+    fact, not a socket fact, and `[]` in the `predates` arm is the same key holding the honest value
+    rather than a missing one.
+    """
+    broken = haproxy_section([frontend("haproxy-22", [22], default="gone")])
+    snap = snapshot(haproxy=broken, nginx=nginx_section(),
+                    sockets=sockets_section(available=None))
+    payload = gateway.parse(snap, "gateway")
+    assert kinds(payload["warnings"]) == [gateway.WARN_ROUTE_DANGLING], (
+        "a silent socket table says nothing about the config, so it changes no warning")
+    assert payload["sockets"] == {"listens": None, "established": None}
+
+    assert gateway.stub("gateway")["warnings"] == []
+    assert gateway.parse(gateway_snapshot("predates"), "gateway")["warnings"] == []
+    assert set(gateway.stub("gateway")) - {"unreachable"} <= set(gateway.parse(snap, "gateway"))
diff --git a/tests/test_live_fleet.py b/tests/test_live_fleet.py
index 33cd05f..6988aee 100644
--- a/tests/test_live_fleet.py
+++ b/tests/test_live_fleet.py
@@ -21,9 +21,11 @@ a unit test.
 from __future__ import annotations
 
 import asyncio
+import json
 import os
 import sqlite3
 from collections.abc import Iterator
+from typing import Any
 
 import httpx
 import pytest
@@ -257,14 +259,17 @@ async def test_disks_source_charts_the_physical_drives_the_agent_reports(
 
 async def test_the_gateway_source_joins_the_live_ingress(settings: Settings,
                                                          agent_tls: dict[str, collectors.AgentTls]) -> None:
-    """Phase 29: `sources/gateway.py` over the **real** gateway agent, read-only.
+    """Phase 29/30: `sources/gateway.py` over the **real** gateway agent, read-only.
 
     The production path — the same `fetch_snapshot` the poller will run, through the stored
     mTLS authority — so what fails here is a drift between the agent's sections and the join,
     not a typo in a fixture. The assertions are the ones that hold whatever the traffic is:
-    the agent answers the three sections, every configured frontend is a pipe, and the
-    inbound/outbound/unmatched tallies **partition** the kernel's ESTABLISHED table, which is
-    what lets the page's numbers reconcile against a direct `/proc/net/tcp` read.
+    the agent answers the three sections, every configured frontend and `listen` port is a
+    trunk, and the inbound count **re-derived here** from the snapshot's own ESTABLISHED rows
+    equals the sum the payload prints — the identity of phase 30's simplified join, checked
+    against the kernel rather than against a fixture. The totals are an inequality by design
+    (`sum(listeners) + sum(endpoints) <= established`): a socket neither config file describes
+    is counted nowhere, and on this router that is most of the table.
     """
     target = next((item for item in settings.host_targets if item.name == settings.gateway_host),
                   None)
@@ -283,16 +288,45 @@ async def test_the_gateway_source_joins_the_live_ingress(settings: Settings,
                     "needs 1.2.0's haproxy/nginx/sockets sections (AGENTS.md gap 11's rollout)")
     assert payload["host"] == target.name
     assert payload["sockets"]["established"] == len(snapshot["sockets"]["established"])
-    assert payload["inbound"], "no frontend on either config would leave the page empty"
-    for pipe in payload["inbound"]:
-        assert isinstance(pipe["connections"], int), "the socket table answered, so a count is known"
-    for group in payload["unmatched"]["groups"]:
-        assert group["connections"] > 0 and group["host_count"] > 1, (
-            "a group is only ever the unresolved fan-out of several names on one port")
-    attributed = sum(pipe["connections"] or 0 for pipe in payload["inbound"] + payload["outbound"])
-    assert attributed + payload["unmatched"]["inbound"] + payload["unmatched"]["outbound"] == \
-        payload["sockets"]["established"], "every socket counted exactly once"
-    assert all(sample.source == gateway.SOURCE for sample in gateway.samples(payload, 0.0))
+    assert payload["listeners"], "no frontend on either config would leave the page empty"
+    assert payload["connections"], "the two configs declare no route at all"
+    for trunk in payload["listeners"]:
+        assert isinstance(trunk["connections"], int), "the socket table answered, so a count is known"
+
+    # the join, re-derived from the agent's own rows rather than from the payload's arithmetic
+    configured = {trunk["port"] for trunk in payload["listeners"]}
+    assert configured, "a gateway with no configured port has nothing to reconcile"
+    inbound = [row for row in snapshot["sockets"]["established"]
+               if ((row.get("local") or {}).get("port")) in configured]
+    assert sum(t["connections"] for t in payload["listeners"]) == len(inbound), (
+        "the trunk counts are the ESTABLISHED rows whose local port a config names — no more, "
+        "no less")
+
+    endpoints: dict[tuple[Any, Any], Any] = {}
+    joinable: set[str] = set()
+    for route in payload["connections"]:
+        assert route["in"]["port"] in configured, "a route hangs off no trunk the page draws"
+        out = route["out"]
+        assert (route["connections"] is None) is (out["address"] is not True), (
+            f"{route['id']}: only an endpoint the config wrote as an address can be counted")
+        if out["address"] is True and isinstance(out["port"], int):
+            joinable.add(str(route["metric"]))
+            endpoints.setdefault((out["host"], out["port"]), route["connections"])
+        else:
+            assert route["metric"] is None, "a route nobody can count publishes no series"
+    live_out = sum(value for value in endpoints.values() if isinstance(value, int))
+    assert sum(t["connections"] for t in payload["listeners"]) + live_out \
+        <= payload["sockets"]["established"], "the page may under-count the kernel, never exceed it"
+
+    # and nothing outside the two config files reached the payload at all — this app's own agent
+    # port is the case phase 30 deleted the reporting of
+    text = json.dumps(payload)
+    assert ":9120" not in text and "@9120" not in text, "the agent's own port leaked into the map"
+    stored = gateway.samples(payload, 0.0)
+    assert all(sample.source == gateway.SOURCE for sample in stored)
+    assert {sample.metric for sample in stored if "out_conns" in sample.metric} <= joinable, (
+        "only an address endpoint publishes an outbound gauge — a domain-keyed series is the one "
+        "phase 30 stopped writing, because the figure it carried belonged to the port")
 
 
 @pytest.mark.parametrize("engine", ["gufo", "vllm"])
diff --git a/tests/test_poller.py b/tests/test_poller.py
index 25c15bf..9defdf6 100644
--- a/tests/test_poller.py
+++ b/tests/test_poller.py
@@ -15,7 +15,7 @@ import asyncio
 import logging
 import sqlite3
 import time
-from collections.abc import Iterator
+from collections.abc import Callable, Iterator
 from typing import Any
 
 import pytest
@@ -208,6 +208,24 @@ async def test_states_can_be_filtered_to_one_dashboard(store) -> None:
     assert [s["key"] for s in hub.states("ups")] == ["nut"]
 
 
+async def _wait_for(predicate: Callable[[], bool], deadline: float = 10.0) -> bool:
+    """Poll `predicate` on the loop until it holds or the deadline passes.
+
+    The two maintenance tests below cross a thread boundary (`anyio.to_thread.run_sync`, because a
+    SQLite write must not stall the event loop), so *when* the first pass lands is a property of the
+    machine and of whether coverage is tracing every line — a fixed `asyncio.sleep()` fitted to a
+    quiet laptop is a flake on a loaded one. Waiting for the thing itself is the assertion; the
+    deadline only stops a broken loop hanging the suite.
+    """
+    loop = asyncio.get_running_loop()
+    end = loop.time() + deadline
+    while loop.time() < end:
+        if predicate():
+            return True
+        await asyncio.sleep(0.02)
+    return predicate()
+
+
 async def test_maintenance_failure_is_logged_not_swallowed(store, monkeypatch,
                                                            caplog: pytest.LogCaptureFixture) -> None:
     """A broken rollup means every chart past the raw window is empty. Retrying quietly
@@ -220,12 +238,12 @@ async def test_maintenance_failure_is_logged_not_swallowed(store, monkeypatch,
     task = asyncio.create_task(hub._maintain_loop(interval=0.02))
     try:
         with caplog.at_level(logging.ERROR, logger="dashboards.poller"):
-            await asyncio.sleep(0.15)
+            logged = await _wait_for(lambda: "store maintenance failed" in caplog.text)
     finally:
         task.cancel()
         with pytest.raises(asyncio.CancelledError):
             await task
-    assert "store maintenance failed" in caplog.text
+    assert logged, "a failed rollup must be logged, never retried in silence"
     assert "no such table" in caplog.text, "the log line must carry the real reason"
 
 
@@ -236,12 +254,12 @@ async def test_maintenance_runs_from_the_hub_and_records_its_pass(store) -> None
                                                  "pruned": 0}
     task = asyncio.create_task(hub._maintain_loop(interval=0.02))
     try:
-        await asyncio.sleep(0.1)
+        ran = await _wait_for(lambda: bool(calls))
     finally:
         task.cancel()
         with pytest.raises(asyncio.CancelledError):
             await task
-    assert calls, "the maintenance loop must actually call maintain"
+    assert ran, "the maintenance loop must actually call maintain"
 
 
 async def test_events_written_by_a_job_land_in_the_store(store) -> None:
diff --git a/uv.lock b/uv.lock
index 1b21d04..f640a00 100644
--- a/uv.lock
+++ b/uv.lock
@@ -35,11 +35,11 @@ wheels = [
 
 [[package]]
 name = "certifi"
-version = "2026.10.19"
+version = "2026.10.23"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a6/bd/1436c50cc46699de0230fbaacc1d1de7bfec413176099949e9d5112e88f2/certifi-2026.10.19.tar.gz", hash = "sha256:035c1e85572b141bf1c3a3eff0e33a8eb74917522f2559075ff8d2fea780a1ae", size = 137598, upload-time = "2026-10-20T02:24:16.604Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fd/11/b524cbd9bbdaca58608e4cf4053fd463417549e1959fa8d3aa18319f9555/certifi-2026.10.23.tar.gz", hash = "sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd", size = 136225, upload-time = "2026-10-23T11:36:16.478Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c4/51/29046e48f693c54e5b7412216d447a1d8362c9653148d98c02cdf65fa733/certifi-2026.10.19-py3-none-any.whl", hash = "sha256:42d35340cc5b9ba78e818ddbff0c5b1c2b779de448a340fd1b989f5fa8670e1b", size = 136464, upload-time = "2026-10-20T02:24:15.072Z" },
+    { url = "https://files.pythonhosted.org/packages/32/d1/a3652fe2c19134d0d15922177821d863cbd7e842d53a21bbe7e8e3a1b5ac/certifi-2026.10.23-py3-none-any.whl", hash = "sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1", size = 135082, upload-time = "2026-10-23T11:36:14.763Z" },
 ]
 
 [[package]]
@@ -121,71 +121,79 @@ wheels = [
 
 [[package]]
 name = "coverage"
-version = "7.16.2"
+version = "7.17.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/2f/55/d1eaf3e73781174340a00dc1ba2aee8a65f82fadb18e2797b192b6b3925b/coverage-7.16.2.tar.gz", hash = "sha256:ca64d9f1f384f151b9511bec01126072acd2f313439f8ed015a22d8790aab6fa", size = 971999, upload-time = "2026-09-27T12:29:01.118Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/d2/79/e78bd8f75a9b8e32233ce92d4607f0a21ce88a9156cace2884e7175a82f5/coverage-7.17.0.tar.gz", hash = "sha256:cc010a0a7fbdd9bb8bdfd0d3f04a5151275860213cbd7e2b876b29778489c712", size = 991021, upload-time = "2026-10-22T16:06:50.009Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/59/4c/577fc0803dab4155dcf808faffbdd7b159256781c0874a8586e17b81b149/coverage-7.16.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:4ee546b9e4872ffa194bf07ac87bfa1202ebb824d0795dc1ef22f175545ca90a", size = 224138, upload-time = "2026-09-27T12:27:05.141Z" },
-    { url = "https://files.pythonhosted.org/packages/75/9e/e3785ba3ecba2bd11efc74bfe2801ca4b78c4480b15a375648d809a59da3/coverage-7.16.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:a2fac6895eb299a2e52d7bbb8fb3903502b9da8d3f5309ceb16ec40c646b58ee", size = 224445, upload-time = "2026-09-27T12:27:06.805Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d0/963ff22d3fd27117da3b8cc442f5bdc91196f783321e1a8ff0ec43476772/coverage-7.16.2-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:57ff3783f99d75a1e81dd56a9737eb5665e6736a5d93258ba596b6dcad8fd05b", size = 256112, upload-time = "2026-09-27T12:27:08.43Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/d4/a306940c81c6ae759e82fff27d20b7fdc6896e422b821f51313cce212b6c/coverage-7.16.2-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:35f37886699cb9abd29958247d718628d5bc6f39e623dff66a09e546c42a7e03", size = 258727, upload-time = "2026-09-27T12:27:09.927Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/a3/d3d99d93b02517087aa05bc0cf2d04d372956b849e5443e059079901429b/coverage-7.16.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0fd7a86fdda7cb6d616d178654bd0ad6bc0f3f33c2e478aa598500a1a9e34eda", size = 259909, upload-time = "2026-09-27T12:27:11.55Z" },
-    { url = "https://files.pythonhosted.org/packages/08/44/39dd599181726758dd185ae4dc0c0ab3aeabf7ca70e68e145060feeaaa16/coverage-7.16.2-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ac0f3b379c94acc2f7dce5f5f0b24d44fa1cc6a509717ef83dfee07450c2117c", size = 262481, upload-time = "2026-09-27T12:27:13.17Z" },
-    { url = "https://files.pythonhosted.org/packages/99/e8/91ee43f6ded411460c359d7e1aebde4d6fd8f00a2e5394182d9d212eb23c/coverage-7.16.2-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7d0732c83746bc24123c581a85d9dd96b70ddb538c9076020aa1a041790361e9", size = 256012, upload-time = "2026-09-27T12:27:14.91Z" },
-    { url = "https://files.pythonhosted.org/packages/11/8c/e9499ddc33197bd7eabcb1118ca81756fc874457b324e2b479a4804b2ad2/coverage-7.16.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7b451c68218c150f616bc9649783ec8de76a59792c759b43aa0c9c0466a465e4", size = 257898, upload-time = "2026-09-27T12:27:16.588Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/6e/c081cb5991a0afba99f9c4ad6c74a5fce9513a38ddc64e3e6680c6fed9af/coverage-7.16.2-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:a56ac4fa5a75c7e182e8f62600cfb4aff43c5ed7356a034f3557659c3bec1d90", size = 255938, upload-time = "2026-09-27T12:27:18.19Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/42/1c3d819e8f9b6eb01c2fe90874d67a8882adb9507e0bbb09361ed131ea89/coverage-7.16.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:4cc4f73aa3fabc36e32046d6cd2971405948d8a903636508a3d3b2f9128b3a95", size = 260368, upload-time = "2026-09-27T12:27:19.903Z" },
-    { url = "https://files.pythonhosted.org/packages/19/4f/d70eac07901fd587b6ab05e659b52afe13959992aa5113bf6cce059cc572/coverage-7.16.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:723dcdab91357159b722935b500ee8abc0a66c8c432e1e9fabf4cc7598952de8", size = 255620, upload-time = "2026-09-27T12:27:21.621Z" },
-    { url = "https://files.pythonhosted.org/packages/34/5e/6d87af88317d3d9a9b18a9ca1bc1673eb516917f296e579d0d4a55cb3490/coverage-7.16.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5397e21a90dde0e9c6896b77ded8f0be26b66f8b22b33aed41f6043ed95d55e6", size = 257521, upload-time = "2026-09-27T12:27:23.358Z" },
-    { url = "https://files.pythonhosted.org/packages/79/bb/90c2641170d2fa1a6757b3f8450ba2740197317b0ddd749e9604b914e886/coverage-7.16.2-cp314-cp314-win32.whl", hash = "sha256:848893e1d361448c113dc2f0913503522a6f7be231d0e38333d2a22d9698a011", size = 226248, upload-time = "2026-09-27T12:27:25.153Z" },
-    { url = "https://files.pythonhosted.org/packages/30/08/d8d0478bb02c8eb0ae20a496fc80c40fcf4d3450bd184300d682ba2d28a6/coverage-7.16.2-cp314-cp314-win_amd64.whl", hash = "sha256:5a27b731c171e43dc8b5f32b76a5051dde2ec9b9366c87028f08a7088ebc2c7b", size = 226732, upload-time = "2026-09-27T12:27:26.907Z" },
-    { url = "https://files.pythonhosted.org/packages/32/3f/0001da22155b0a8ce063ec0f7e64ecbe17b373f306e7a74435f6d6accb72/coverage-7.16.2-cp314-cp314-win_arm64.whl", hash = "sha256:1c569a9fd25505f1cd6bea90588818f90373ce90e2632e2cacf19ddbd6e14fdb", size = 226645, upload-time = "2026-09-27T12:27:28.588Z" },
-    { url = "https://files.pythonhosted.org/packages/d7/85/6d8813aff9b8b8586691a9d33c43c5604f7227622574da7cdc3d91a86861/coverage-7.16.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:d93db87adb6b1c1b408dce4763314b55d76a9f589e96783a84ac9e7689e48bdf", size = 224871, upload-time = "2026-09-27T12:27:30.32Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/70/444f3a4981ac2cda40fdcf4cc9b56a4e1a33c222abeb33e51ed3e3eb2a6b/coverage-7.16.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:aa62c85046473959c13ba9edca9dc90a77d5c1095b1ba313556314d77fe5b036", size = 225123, upload-time = "2026-09-27T12:27:32.33Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/c1/980681cd7b33eb66ac835044116ef0a92e11fcc7bdd866cc89d10b1130b9/coverage-7.16.2-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:db76506aa5416081f3e8974ae0f7965c58ada0bb0ef7339ac86099588dbb20d3", size = 265049, upload-time = "2026-09-27T12:27:34.085Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/e3/87679875c33bb2191f0f05544a1cc9adcc940fe0c35443a10f2df753dde5/coverage-7.16.2-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:a0f2285329dac10ab08f79cb11f5692c497018e6c7c511f95e6fd63a70b8f831", size = 267717, upload-time = "2026-09-27T12:27:36.025Z" },
-    { url = "https://files.pythonhosted.org/packages/76/64/5d372776d6eb523d4e93bafba2253f96984e3b18261c4cc56a50863c6d0d/coverage-7.16.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:382d3346d56b0eec1b793d53a4c88799c8053f516aa3a8d7c44315696954bacf", size = 270047, upload-time = "2026-09-27T12:27:37.96Z" },
-    { url = "https://files.pythonhosted.org/packages/be/c1/44082ff0cbf9f97d0043f57970a71204097ec7ba606361a9fd2065393669/coverage-7.16.2-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:648352b94507179d82637292e7ae8802508d95f78e2f00a705a50b6c48011681", size = 271360, upload-time = "2026-09-27T12:27:39.766Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/17/9a215efe25b5e0ecc87c89dbe525c4a87d14d87c8c0c7316ef140a5f6f3e/coverage-7.16.2-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fb2bde05838fffae1a1bf75e5d411a6cac3e4e9bb97e6640fed8cd47888b33f0", size = 264736, upload-time = "2026-09-27T12:27:42.072Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/da/7f0a31af8e448107d4d32844bd684757f51ea907bc0c68c8fd537b2123ff/coverage-7.16.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:6a75180829efb8ae62b4aded25be6ddca1c888d138d2d82e21d93bfbd88f41cb", size = 267600, upload-time = "2026-09-27T12:27:43.85Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/a4/3bfecbd3366b775bacdcb3330394d356cf384b5d8f5b2146ac4b14b252b5/coverage-7.16.2-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:99704f73721e23859112072d522076e11c31744fc96b5652e5dd2018aa4359f7", size = 264767, upload-time = "2026-09-27T12:27:45.768Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/3f/5d62163732d87e4a0c4710a0eab30f0fd6a2d480112abe2029f014fe8c9d/coverage-7.16.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:29309ccc86b7f33df7db12813c299f215bbbc470ed6292d0bedd63ffae1ebf64", size = 269026, upload-time = "2026-09-27T12:27:47.787Z" },
-    { url = "https://files.pythonhosted.org/packages/49/4d/8e4579f225426535085a9be371cc75e3b026d058d679b80affbdfb4c3ef0/coverage-7.16.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:30c1b65d529e46569899fadca59e4a87c1faf2886923f1307ba61e654d4f3c20", size = 264147, upload-time = "2026-09-27T12:27:49.681Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/36/ef1f77e2c3f7bb03c2b13b9a2006f88700fdd75535ef158d70049f425c1c/coverage-7.16.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:dcf4bc2aab4e16b1c4c0c2005918f23a7dd5d7821ddae82caed9e3342dc2fcce", size = 266376, upload-time = "2026-09-27T12:27:51.551Z" },
-    { url = "https://files.pythonhosted.org/packages/be/79/0cb2bf4428830dec971c718c2c841a039c084415c99e67281f5a72841aab/coverage-7.16.2-cp314-cp314t-win32.whl", hash = "sha256:a9cd3de0a5bfe7b0e21ee10e1a14e3d61bf52efc88217ab1d95d6ace6970bd46", size = 226585, upload-time = "2026-09-27T12:27:53.945Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/f9/da17121c16667fd84998e972200ae226a41540f6ea4795776c6d99e8976f/coverage-7.16.2-cp314-cp314t-win_amd64.whl", hash = "sha256:611a44e5229a59d7483ce830160e1a0e85f700562c7a5651c7c63fb8f4eb528c", size = 227378, upload-time = "2026-09-27T12:27:55.778Z" },
-    { url = "https://files.pythonhosted.org/packages/74/89/01179c62d1b7e6e33bd5001566b02d7f778cf33d3ec1e81e94ca170c517f/coverage-7.16.2-cp314-cp314t-win_arm64.whl", hash = "sha256:22957cef43ce038641de78ba995de7568d2d6a37c6ddbf7fa0fd7d1ae2344d91", size = 227064, upload-time = "2026-09-27T12:27:57.496Z" },
-    { url = "https://files.pythonhosted.org/packages/4c/57/52935003c3f627ba6e5203d7179aad32448c10899663a30336aba8e81a2c/coverage-7.16.2-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:414c26dfdb96aac2d570a54e03008f001e32eb2d413705365503648c6bd361d8", size = 224140, upload-time = "2026-09-27T12:27:59.343Z" },
-    { url = "https://files.pythonhosted.org/packages/31/38/df472520f3e626524d7e2fc9d6da0afe7895a2f1489d36b48af8ca40bb41/coverage-7.16.2-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:00d3eb96e9988c45f50cccd1f1496571ac5c1f91386ac02c4d55516eeda19a24", size = 224449, upload-time = "2026-09-27T12:28:01.299Z" },
-    { url = "https://files.pythonhosted.org/packages/0c/aa/3be084d5b82e63ccdad4ed751e4acbae294673573e30481d29f8b7402eec/coverage-7.16.2-cp315-cp315-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:4dbbd1155ca46e6e0b6b89d204428c56ef6a459af21333f365d135a2820e5a09", size = 256060, upload-time = "2026-09-27T12:28:03.185Z" },
-    { url = "https://files.pythonhosted.org/packages/de/29/48fca82a7ebf7ff7b2e35019cc9537e7f65e4d2aa1215cc5a8792c989251/coverage-7.16.2-cp315-cp315-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:8fc15cc8d0d06e873c00ef18e1372d605f9aaf3de27d8c24e50782e75bc8b843", size = 259106, upload-time = "2026-09-27T12:28:05.15Z" },
-    { url = "https://files.pythonhosted.org/packages/06/3d/b2d5986f2dd53fe201aa1be2e4ab204fa1aed5101e67c0dbbb419b850aee/coverage-7.16.2-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9c6afdd69218202bc1758c9a14b86b8cf1084f37ed2ca143e567a103772b16d1", size = 260674, upload-time = "2026-09-27T12:28:06.868Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/7e/b50160be3506ead12e6480d14279af7f0f17627694300a2d1fd2c42d2ff5/coverage-7.16.2-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:aba5c63b7afdc749cc9eae943d5b868cba2b261a176378fa1c5a30bc8bc89982", size = 263139, upload-time = "2026-09-27T12:28:08.771Z" },
-    { url = "https://files.pythonhosted.org/packages/14/5e/7c805ac9a32606de1399bd7e9bd375aa2f973dc61b12680d9e6403c2e891/coverage-7.16.2-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:9174f0af24e5eff248b9dbfe76ec5275a3d19d37edbc2810543f12cf97347a34", size = 256591, upload-time = "2026-09-27T12:28:10.842Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/9e/76f1ed129a2daf658a3ea17122824cf2e3b91fea0460d8d3664fc5a61018/coverage-7.16.2-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:80e9fdb4c3d926b6ba721d4bf7435bdb869c3527ae7803290361d0ab73db13b6", size = 258708, upload-time = "2026-09-27T12:28:12.962Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/b7/8d62e75f48b527619239a65294f842d4b7fd02a0839d43ae1de80184e2df/coverage-7.16.2-cp315-cp315-musllinux_1_2_i686.whl", hash = "sha256:7b3bce4a0d05401d70b7d0d5ca783e686bc9d30e81dbd7d980d532609bf809e4", size = 256562, upload-time = "2026-09-27T12:28:14.934Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/8d/0a15f95c3afb78e947c52644786ba4bc9de259905687dd720d5e6fae2e76/coverage-7.16.2-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:44f21e407b278efdfc1ee5e481e00518bd1d500310a30a5fbf2bcbedfef4aaf0", size = 261077, upload-time = "2026-09-27T12:28:17.215Z" },
-    { url = "https://files.pythonhosted.org/packages/25/00/88389987305a47d732866c07c8a500000ab574df9505e3114ac69c8d027f/coverage-7.16.2-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:59c3926585e1cd1f2190f4b2ac9014de1bbeaf0d5d0587b0dc6b0aa90d17896a", size = 256034, upload-time = "2026-09-27T12:28:19.08Z" },
-    { url = "https://files.pythonhosted.org/packages/92/02/34d079d4952ad461bde037d353f9a6e037a7edc45fe0f9ee8781ff73f028/coverage-7.16.2-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:066429634299e14dd2d511e1e85f8f9cecc500781f6b41907c0dd6f1baea7e63", size = 258034, upload-time = "2026-09-27T12:28:21.242Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/d8/3e59a62879285b464ec1b10fd824fbc1af9ce66e842cd39974f80a0becc4/coverage-7.16.2-cp315-cp315-win32.whl", hash = "sha256:893ea9cf86cb8d2546812ac93d973aaf2ee1fb45110a873b014214fd23e3725e", size = 226252, upload-time = "2026-09-27T12:28:23.102Z" },
-    { url = "https://files.pythonhosted.org/packages/f4/e1/128026e1b2836e9ad6b219207ba9edf1c5e0088a7869e23088aee7fbbe7a/coverage-7.16.2-cp315-cp315-win_amd64.whl", hash = "sha256:01c6908bc613b420c26c818fe948e1b97dfd041a53c98b01c63bd8321f5c9aae", size = 226728, upload-time = "2026-09-27T12:28:25.21Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/f4/c9fa8e7cf525ca7748ac52b0ee89331d13fe09808e45c679830708782e90/coverage-7.16.2-cp315-cp315-win_arm64.whl", hash = "sha256:967d72c835d7a8cf0af99ec813a2d06e3db6df706402f1fe85b31b437645f495", size = 226648, upload-time = "2026-09-27T12:28:27.136Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/13/e96b045447a856666f36f9c653e2a80bdaa732aaaf72412b19aa2c26a473/coverage-7.16.2-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:98d9c97f51b334b0adce7b964442a9af33c1a00c6ac856984cc5dc8d18f81c75", size = 224858, upload-time = "2026-09-27T12:28:29.169Z" },
-    { url = "https://files.pythonhosted.org/packages/23/90/087f6ad1bd3df059632ca3407a4e6552ed1053ee35354de0a771acf35423/coverage-7.16.2-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:3e861f1071dcc2fec1e88bef0920f6b1eaa66a143555b4f8ab79ba2b0f30ef55", size = 225139, upload-time = "2026-09-27T12:28:31.131Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/8e/285dcef0184358044e7cbcd810a1bdc9566bc620f54702d605477155df4a/coverage-7.16.2-cp315-cp315t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:fb9d92ecfe2d5b494367c67f7446f8b75b68d8d0c8cf3bc3e6997478be25d9e2", size = 265090, upload-time = "2026-09-27T12:28:33.04Z" },
-    { url = "https://files.pythonhosted.org/packages/06/b2/cc83f3a6e5789a4e89059c69555bc641c2efcde568405a1c06fc702951ab/coverage-7.16.2-cp315-cp315t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:eb57acff4a74246ae513c142d4b36e18c389c3aed8661914a53f7cd0071031b2", size = 268254, upload-time = "2026-09-27T12:28:35.135Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/41/f548c19530f5d66ac6e3c92bbcbc49da7261de3a458b9f3e54a3efb1a0b2/coverage-7.16.2-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:444889f7f66b74e4455c0a97e0e166dd41177f1dca8c0239a47cff25e05ba7e1", size = 270695, upload-time = "2026-09-27T12:28:36.959Z" },
-    { url = "https://files.pythonhosted.org/packages/94/61/4dc27cf82ef96434d2874110ad0cc10ea4621025705dc5049862bd3bd181/coverage-7.16.2-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a740ea6f083c6db7b926534d159508f80ba275ab35e722522de0d18d0f56e55f", size = 271853, upload-time = "2026-09-27T12:28:38.821Z" },
-    { url = "https://files.pythonhosted.org/packages/38/29/bf8072b1b8bd5f2de8b21460a404460b1a2b97e80a9464c78ec0271f6199/coverage-7.16.2-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8e209591f7c41ae4a9171335cf6156afda0b21de73b02f73f5aa95b2d5fbb08d", size = 265644, upload-time = "2026-09-27T12:28:40.815Z" },
-    { url = "https://files.pythonhosted.org/packages/7c/2f/0aecb8721be5cdeb8afd9d6d9f6b463f074e4d8d37f00f4c42442522709f/coverage-7.16.2-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:396bb16e04ce04efbb3df91456ae4e3da918e69ecdf67fb711b0a0fdf35ccce0", size = 268530, upload-time = "2026-09-27T12:28:42.725Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/0b/92b4b7628268ee711249958e68fc0328779bd3d9a7ab4715379465aedb84/coverage-7.16.2-cp315-cp315t-musllinux_1_2_i686.whl", hash = "sha256:9cdf19874e0d247f32f03609200370343c3c7aa260b191d8c2bb251d36198283", size = 265154, upload-time = "2026-09-27T12:28:44.684Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/d9/41c95c1ab29b3dcd357cd1227181d1c98185632aca41ce670ce671b23a43/coverage-7.16.2-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:fd3d72233eb8b48acc94fa57d44e2d32ce8e7abed02882ccb6d855ccc4ed33ec", size = 269799, upload-time = "2026-09-27T12:28:46.672Z" },
-    { url = "https://files.pythonhosted.org/packages/80/07/ebeb259aa5362b033a137b86d7274ff4b109d59be8cc9913889b783bf75a/coverage-7.16.2-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:bb4ffe96aa663cee727659db5a2afeb38c95f8677b747d447b90d6d4874ea2c5", size = 265196, upload-time = "2026-09-27T12:28:48.996Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/18/8437620f90d023680a072eee02f968055f3658bbfb7d386d0ea34cfb7f30/coverage-7.16.2-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:dba2edfb054f6d4a08df9d1637c39a5aa3865bca6617c13c86be21e45658a59c", size = 267266, upload-time = "2026-09-27T12:28:51.361Z" },
-    { url = "https://files.pythonhosted.org/packages/28/6c/f08e8ee4293e6434035424180bef4d45e028e8ecc006c61bf9453e74405e/coverage-7.16.2-cp315-cp315t-win32.whl", hash = "sha256:251aed777c47c77aba047096d4542889db089227655711dfc2b9c54ef0e15e35", size = 226583, upload-time = "2026-09-27T12:28:53.33Z" },
-    { url = "https://files.pythonhosted.org/packages/f7/fd/3f939c2847f4a72c20cff8b1ac33da78ea91a2d38d9b43336e60db719103/coverage-7.16.2-cp315-cp315t-win_amd64.whl", hash = "sha256:2aca0bdfa9e91621d5b09d815357bf63def4fc0e9cb66da67bf2cf93f3b1a6f5", size = 227374, upload-time = "2026-09-27T12:28:55.158Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/35/b98cdc354c952402132e675a87f2cc3227fb68f959c84aaa491fbe15933d/coverage-7.16.2-cp315-cp315t-win_arm64.whl", hash = "sha256:b88841e654f09732804809e435b3e005a929ffd9998b872b7b213957b8759cb8", size = 227064, upload-time = "2026-09-27T12:28:57.075Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/0c/7a64e1ac90541a8edf50daef0914848011fb057a5bf55284a4811e21939a/coverage-7.16.2-py3-none-any.whl", hash = "sha256:11d28e9123a9156cb405d8d27b44256c9a58fb5decc2073a8f17862057e3aa0f", size = 215754, upload-time = "2026-09-27T12:28:59.075Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/e1/722462fe79912ebebc101497bd16c42413cde2dbae771017f1ec0acb84c2/coverage-7.17.0-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:dc5936491e306f2f6f095bd5fba593de11eb0375cee787ca1f245c3a333a523a", size = 227197, upload-time = "2026-10-22T16:05:09.846Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/74/826b9c09f2ebfea803bccb391d935688a25309bff8e819fc446bc629c108/coverage-7.17.0-cp314-cp314-android_24_x86_64.whl", hash = "sha256:968c5fb6e0c83cab752d79a70209648ce4d90cae815c60fa229b59e264601062", size = 227314, upload-time = "2026-10-22T16:05:11.422Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/19/c8514d7f5e0659a96ff2bc7377119dca6d420e2761c5fc69ae37618734f8/coverage-7.17.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:12cb8a20ad904a5811e6660d829a586b216e5254b9b34b76dde8a4d65d827dc6", size = 225477, upload-time = "2026-10-22T16:05:12.761Z" },
+    { url = "https://files.pythonhosted.org/packages/81/74/ef9433ce599f07d8633b4ce6e6d6921505c4ef3f7f9006f8eb66e2c278cf/coverage-7.17.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:bb5ca66937c55bc85d1a5e9c5900a3e4693a8edf2280a9b3672b7b2661a84b95", size = 225787, upload-time = "2026-10-22T16:05:14.394Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/66/26e58981940e8b3944c6a9941bec5c7f50840e7009a046712e3f3bcd9e6a/coverage-7.17.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:5cc15faaf318ee5040d835a62c75bc6f122d837274f3b5efd47bf9fbd4ac5b85", size = 226019, upload-time = "2026-10-22T16:05:15.798Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/63/fe175310815cc8357b83b773c9b4c20943c269f217dd825a37c4b4bfe324/coverage-7.17.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:7d6d9d396c8b7bcaf76d774a10140b218111484e54c73a5f2a1b75655381748e", size = 226169, upload-time = "2026-10-22T16:05:17.188Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/b0/ac84761f5b4bd226696b0ec4606903d2ef7208abda0aec06c14a4218def4/coverage-7.17.0-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:42e6f170d1ac04b7eb3363310a6c41cdfd82c1fe6bf9ffbc4a86f380bdf091c7", size = 258092, upload-time = "2026-10-22T16:05:18.691Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/58/d8bdd65a661913bc12eaaa3e59742b2cb8b94f2e7f78e62184f0a58ca493/coverage-7.17.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:acdb5f3c96046efff9dc6c572a6acb2b8d0da09372d7b9a9ed7249cf7d17434f", size = 261096, upload-time = "2026-10-22T16:05:20.089Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/15/5d82e2f0a75ea149e0a6412e137e1d610538772fdfd7199737db7fe234da/coverage-7.17.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3393209f6894713161ee82a9b0e673e58237e0f9733c6638e7a6c0c620ef0b33", size = 262080, upload-time = "2026-10-22T16:05:21.568Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/cc/e3ebfd295d1dd47c7bc84a17d73f150465a37ab388dd68fe82b495dc79a0/coverage-7.17.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e9494d9e99389d39e6a96227749af898d8924ff591cb63944f8a98e68582bf0e", size = 264558, upload-time = "2026-10-22T16:05:22.906Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/9d/e2adff76d6544bbc6df7366d74967923c2de37ba889a006bfb875bf5857b/coverage-7.17.0-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:032d4c2db4c677eb71d43f2f8b80bf64e9346f7a3f7b6ebb13f1782f3cc6c274", size = 257855, upload-time = "2026-10-22T16:05:24.343Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/fd/ecd1e9cddf1c36b5d03c438568b1f53e63db84bb3656539d71b454484c7d/coverage-7.17.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:4343a9378b964eb3cb80fa90406385de91c7e982a769ca9314d848f93bc0d3f2", size = 259933, upload-time = "2026-10-22T16:05:25.79Z" },
+    { url = "https://files.pythonhosted.org/packages/40/b6/e17a19dccdbcad494c64691f71c1dba3e55c30625bc29ffbb88ac5a0aa8b/coverage-7.17.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:b609df3d6d900464207532c5170a65c6ede8d2e0b91f151f90008a866395cd76", size = 257972, upload-time = "2026-10-22T16:05:27.185Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/0d/37dac534709a3fa43a937c8b0604839bb44b8670b83d143a4b78fec20d1e/coverage-7.17.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:a01ef92caeedfa4f2ad171a3a8e6fece4565de871d8bca428151bf9929f41048", size = 262271, upload-time = "2026-10-22T16:05:28.619Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/17/7c05186925b4d64a46c271dfd944e3f0c1ad89db9095c31a6df157a75df2/coverage-7.17.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:a3914e2c98c34b94c26d2add3d2a61ccfd3534fc4eaa879ee290bdbb5184ba6c", size = 257604, upload-time = "2026-10-22T16:05:30.07Z" },
+    { url = "https://files.pythonhosted.org/packages/95/65/c241cdee66a0ff86c68f6d37328e735d10e3d30cd6ff66f356039eb688d2/coverage-7.17.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:e8a72b26dc5c9a9422e45472b1d67ba5caf273c524c8668cc04b23062663755e", size = 259714, upload-time = "2026-10-22T16:05:31.402Z" },
+    { url = "https://files.pythonhosted.org/packages/db/09/e93233fe2405574ce0a31ed201c0cba3a860e085db5d2828bf12b7dc0790/coverage-7.17.0-cp314-cp314-win32.whl", hash = "sha256:03baf0688e14a5a44ffd1eefa8928dfc92b14565e521174e072b31b971aa1657", size = 227914, upload-time = "2026-10-22T16:05:32.78Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/77/04979eb217edb94b94afabb4bcc179f60c746f68d3fd0b12688ba9195730/coverage-7.17.0-cp314-cp314-win_amd64.whl", hash = "sha256:3a4459b0f389dd1e51aac3dbfc4ca35b30cae7dc99caa3c0a086d1997a985709", size = 228543, upload-time = "2026-10-22T16:05:34.118Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/38/155f2f2c6769f8c43eca8a5e581443faa0908828650090b97103b4a41376/coverage-7.17.0-cp314-cp314-win_arm64.whl", hash = "sha256:a32ee5831b15ba239bef5d272ae586ca8acea4a661b5f2941f5a0d380e518b23", size = 228396, upload-time = "2026-10-22T16:05:35.951Z" },
+    { url = "https://files.pythonhosted.org/packages/52/55/d6751572d9445485c4c5a51ec6ae11caa5c11b7ef2448cdccc884f7f54d9/coverage-7.17.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:9c083e253e96fdeeaf48133fe836cac86ace2db215d235700e7f7532420a200c", size = 226486, upload-time = "2026-10-22T16:05:37.363Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/a8/82d37760e537bfdb9fdee285fa1e1b45bc153293d23e2331c7befedd1990/coverage-7.17.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:b88fb4d4d7608cbcebdc7ff7dbffc2115e3b81d6c33a79147cd79d54fcb080f4", size = 226861, upload-time = "2026-10-22T16:05:38.777Z" },
+    { url = "https://files.pythonhosted.org/packages/24/96/70ec00a9db6d7bdd3f914eba12057360769f5cb78a98456e71fe1937deb5/coverage-7.17.0-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:2bf3ee38a40c0570c316b9e7507c472469586906a20f289705898528c31aaea8", size = 266849, upload-time = "2026-10-22T16:05:40.285Z" },
+    { url = "https://files.pythonhosted.org/packages/77/d8/d99be3bfbb208512f039c80b31e404138a86678fc929a17acd5b7135a6ae/coverage-7.17.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:7c570293f001ea91598b90e90cb9b98fddee833e90bbede432cbd218331ccd8e", size = 269402, upload-time = "2026-10-22T16:05:41.585Z" },
+    { url = "https://files.pythonhosted.org/packages/82/50/6cbe8b5a5060edbd21ce8109c4e900f8b7656e8b72ede6dc4d82dc0b8bfb/coverage-7.17.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:791f9ee09814dd30d9562b4f4eb037a371485ec1c830b53999d2320d20c4e764", size = 272025, upload-time = "2026-10-22T16:05:42.921Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/05/d3633add01e5518dfdacfdbd1be41cb5c581412dd8bccd663edf6ef7fec8/coverage-7.17.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c7c5672ecf1b497de7a0b37743bef40e3b58e3207e9fe2ed6682cb0420836a88", size = 273515, upload-time = "2026-10-22T16:05:44.324Z" },
+    { url = "https://files.pythonhosted.org/packages/57/d9/b83387780271bf9ea9f96a3aeb01c1c302c4494a927923c4fa70cd170a3f/coverage-7.17.0-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:337f87e62e1c5f43c8198d879f677c342d152f84d3f157add12558853cbb8eaf", size = 266725, upload-time = "2026-10-22T16:05:45.713Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/be/8e80b29764ae3f4d70d44952eee3f3927eb36897490fe799e400adb7f5da/coverage-7.17.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c8a58baa8eb6154c6645eadcc19b6c089deab78c24a612a83206f2a8a5992a7c", size = 269312, upload-time = "2026-10-22T16:05:47.054Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/c9/e702f588fe8d83ca844f133270ad0a49bf650c8cf260551ff6f11a6b6bbf/coverage-7.17.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:fb5745048ee20f796b0e3ab61831049e749acff188563e2af32f58ede957ac1b", size = 266740, upload-time = "2026-10-22T16:05:48.343Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/11/ee13ad14b714d75ef07c490b6e43969574a8b8b8c6d67bc741fcbacbf9c3/coverage-7.17.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:7b5abcae74750302ac4bc77351eaee87c450e4abd3b6225eacde3858e260f8b2", size = 271036, upload-time = "2026-10-22T16:05:49.727Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/bc/854e8912c11c54aaf416e74602000589c6efbbe1f251dc90202fdabddcb6/coverage-7.17.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:4e153f0bd6509dbf837fd585f489b3328bfd98f2a718a0b15ae63032148b285c", size = 266158, upload-time = "2026-10-22T16:05:51.141Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/dd/96432830ddf63bc42654de54eee77a0cd6949cc65769bda06f353323f23a/coverage-7.17.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:e42a835271922fe7bf98c7a05c78d4032f4e52bf5b07fafa1eadfdfc2f0ad22f", size = 268088, upload-time = "2026-10-22T16:05:52.92Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/ee/230c6ec065a6629d41cc89323ceb54d37e2650c104f70fc108f4ee7c5051/coverage-7.17.0-cp314-cp314t-win32.whl", hash = "sha256:5900055351ec89fdffb34b27898815106529ded29a9496464c1ebd6313fd40fa", size = 228229, upload-time = "2026-10-22T16:05:54.255Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/1d/23eb6aadcb3c00764ff2961c0ff55f5dfa2543856d932b949bbc04fa68e9/coverage-7.17.0-cp314-cp314t-win_amd64.whl", hash = "sha256:5ee9c8bd13a59e301dc2aefe7aa8384633406808de051b1982775667094eb673", size = 229154, upload-time = "2026-10-22T16:05:55.682Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/f1/7df117e8e016b7a3ee459e833b3456f3610505afefd071f8727702d98439/coverage-7.17.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a9cb9a0fb58e6fff5442969af36094ecd6976f4907f179e33b27e15355d8f74", size = 228726, upload-time = "2026-10-22T16:05:57.179Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/a1/f9c24911755f91e6f451ca2e2c1804fbcbe9fecbc3310e341bbbbfa1d85b/coverage-7.17.0-cp315-cp315-android_24_arm64_v8a.whl", hash = "sha256:adabc1079ba844b096799ba8638d8df434aca1613f95bb7d5791af320cf05559", size = 227196, upload-time = "2026-10-22T16:05:58.543Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/a5/2b665b40c626e6bb40e5e8e23d91170b48b5f2f57186f46b07f2fac42386/coverage-7.17.0-cp315-cp315-android_24_x86_64.whl", hash = "sha256:6b4593d2871c4c801656dd5861e759f8f5156febd6b6061b02f6a72d64618b7b", size = 227315, upload-time = "2026-10-22T16:06:00.409Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/8c/22b518d61b930b8a4d62905d046c76a03675ef19b466462011dfb16439a3/coverage-7.17.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:c2c48a36bb970b7265b196032bfd4237c0b373f2b25ef7012d7e905b5b35c19c", size = 225490, upload-time = "2026-10-22T16:06:01.743Z" },
+    { url = "https://files.pythonhosted.org/packages/08/5b/d3b141455944e030cd4987f055f8c84a44a1a0b28d81ae93389f44051691/coverage-7.17.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:f8bc2cd4c6aa58be1ca243fb8cddb6c3c42031fe4403991ad9cf2b3baed03d9f", size = 225797, upload-time = "2026-10-22T16:06:03.423Z" },
+    { url = "https://files.pythonhosted.org/packages/03/24/aab2156983f7022361352640c583d08f0238e4cd7463eb921172001b4cfe/coverage-7.17.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:cbf0b83ce927de6053279ba61342d9f8892afde1385fcba9144cd05d4023d109", size = 226025, upload-time = "2026-10-22T16:06:04.76Z" },
+    { url = "https://files.pythonhosted.org/packages/87/db/94697b9ccf4ec94cdad07bf94e2a21b9702247cb212d2d5f18d2b9c3d0de/coverage-7.17.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:66efc0fb99cee34626fc17d3adac9c3cd816bfdad563bb1e983c3ef432f566d4", size = 226193, upload-time = "2026-10-22T16:06:06.167Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/fd/db1c4ade4219831d590fff5aa5b7d9ceaf84586e8e60da6fff71b6182251/coverage-7.17.0-cp315-cp315-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:58a304efdf2253fb2ea03d45d0a04cc174a92a0cd5279c28c5bb893ce7410968", size = 258046, upload-time = "2026-10-22T16:06:07.51Z" },
+    { url = "https://files.pythonhosted.org/packages/95/ee/84ed138990ed752abd73db4adffc1842d6152017d8e21809cc109a413fda/coverage-7.17.0-cp315-cp315-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:aed06129a9f530a948928260d7d2d81c47261355b0127e3c782251b38958463c", size = 261735, upload-time = "2026-10-22T16:06:08.861Z" },
+    { url = "https://files.pythonhosted.org/packages/64/ad/c1e4367bbd1e7d562d6bc979c82b542f2040544e95a8cd995b694caf0e1a/coverage-7.17.0-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f6cdb47a9be2d3313829bed1d296086287682a3ee901ff987b3432b45705b771", size = 262819, upload-time = "2026-10-22T16:06:10.49Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/3a/e8e8509b0940403eab15d86f70022790a01fce3e971a161919c544953f7a/coverage-7.17.0-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:804fbaf81d09b34e2f8b1159d01e211a50713d743d32fd9b2ca6cf0ae507a66f", size = 265194, upload-time = "2026-10-22T16:06:11.847Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/77/d64bbdbb734b1059ebcde2b5df567f142a9948079e51af9b0abf8c9ec17b/coverage-7.17.0-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b2afebb96da9a1bbca142f8cc12320c14e5c215e0a49cded4f191f5a31506a28", size = 258410, upload-time = "2026-10-22T16:06:13.234Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/29/7cf81f08a254532c074eb52cfe6b12bb753d08f2997269c9fac8de359541/coverage-7.17.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:bd04fd23206be9ad3de13b0b39313094fafa66a1f6baf70f5471c004a9fac47d", size = 260697, upload-time = "2026-10-22T16:06:14.595Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/56/bacea6dee2d5ccb31ab0cfffcee87ca7efa80ff048840209c8013aeaf02e/coverage-7.17.0-cp315-cp315-musllinux_1_2_i686.whl", hash = "sha256:5ebfbc87836529a31d25c2dec1262c38eea852ec1c46c0f690a515a7339d9c5b", size = 258649, upload-time = "2026-10-22T16:06:16.265Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/97/fd8a6a63740f9ee177c53b59e2f4d0752369bb0fd154086a1e69aa1fb255/coverage-7.17.0-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:a59c3b470ac3b2432af3598a996affbeb10236cd899a005c1c4e517fcff8b592", size = 262989, upload-time = "2026-10-22T16:06:17.85Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/37/7cd3d3520d45db3788456452b65446182c08f2a7c276f40c9dd11966be02/coverage-7.17.0-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:7fef12cec4b96f59e09761cbd4fc9bdf4788062d1ae435b920241fc16c8a9549", size = 257955, upload-time = "2026-10-22T16:06:19.563Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/b9/80343a55e07d854927a915cc21a52e350ae1db9ead33f0248507b960785f/coverage-7.17.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:a14e8d69464da9cbe1dc29e7116dbd37296d1d51a695327c478e250349085089", size = 260512, upload-time = "2026-10-22T16:06:21.055Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/32/e4c816f0cb3efdc6392bb276ff88359729f9dec605bdd3c1c7a44776f759/coverage-7.17.0-cp315-cp315-win32.whl", hash = "sha256:9a66074231799d8884d267234d49f60c90b43a945dfe069646b72f3058cd4e67", size = 227913, upload-time = "2026-10-22T16:06:22.407Z" },
+    { url = "https://files.pythonhosted.org/packages/43/14/283120142ac281834808584249b89957de997c28573ddd65ae106b622121/coverage-7.17.0-cp315-cp315-win_amd64.whl", hash = "sha256:79cf71e5f9a48877ccfed5baa2c72f45af4feeaa596249e23eb15b473134830e", size = 228532, upload-time = "2026-10-22T16:06:23.756Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/bc/83dbc6c3bd58042afaefcb0cfd7d7a2e3076989a2f3d9bc6e6edac819784/coverage-7.17.0-cp315-cp315-win_arm64.whl", hash = "sha256:09e563b49c81cd0a33734e926d7a4a6ef1778d74304cde2dcc3aff8b30ea1036", size = 228393, upload-time = "2026-10-22T16:06:25.163Z" },
+    { url = "https://files.pythonhosted.org/packages/00/ed/9463d1cb1766a2570343a372c2871c7fb4d561e5051f029399f4d57ce947/coverage-7.17.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:a5e2e0625dfc789af0b2e10acfc106b352f314fffbd19e6392a7961c8cbe5d9a", size = 226481, upload-time = "2026-10-22T16:06:26.563Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/59/6536c7fa87be13236b4184fc395f14d18f622a5b8ef7448a6bfdf5f24ec0/coverage-7.17.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:194562ab1eff0d85aee8a17ce4c5c0bc1ebf70a629a7145257123156ad100fd6", size = 226876, upload-time = "2026-10-22T16:06:27.921Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/bc/4ffae6038f78382c9ab6a4969cb5fc01d50b083d119851085807629abe88/coverage-7.17.0-cp315-cp315t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:85682ca89bc4601125dcdff23fa70e6274e13c9ad502fba845e6c274ab2c6569", size = 267241, upload-time = "2026-10-22T16:06:29.356Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/60/cae4b708b4217d33ebf66b9c57f8910a257346b3eaf054a78d73605ddc4c/coverage-7.17.0-cp315-cp315t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:0d0fac604a962ff546beb038cba9a5a09d88e6e3f01612fb46f7bd4fe5dc8dca", size = 270079, upload-time = "2026-10-22T16:06:30.736Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/84/1225ab04e55a6a2e483e903a5eb0f8f081cb5325df833594534aa288d91c/coverage-7.17.0-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:72edd4f9483ae30cd1ba4f230687840ef7b58a16afb1c9e81131fd6d64655f36", size = 272775, upload-time = "2026-10-22T16:06:32.247Z" },
+    { url = "https://files.pythonhosted.org/packages/94/ad/567f8dd9246a553aa8753732c41f0e0654e98e9a617d6282e64eae0e6aa8/coverage-7.17.0-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:91e487ad07c511da77b574820141a7c2da09bc2a4b4090b5be2424295d100697", size = 274110, upload-time = "2026-10-22T16:06:33.859Z" },
+    { url = "https://files.pythonhosted.org/packages/66/5f/e0ee76895df40601e4aedffb6b8e71ea48e276a629fb4488b92cffffca14/coverage-7.17.0-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1cabb31531002fef5197de5df3c84730aef01e750e25154b9813a2583435aba2", size = 267775, upload-time = "2026-10-22T16:06:35.193Z" },
+    { url = "https://files.pythonhosted.org/packages/19/6d/d19c6e45e940e5b9ba697b7be9a8e63cef73d90bdea45b670a59df466717/coverage-7.17.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:c9ac886242bbd50fb35a2242ba79555a99891e657da33f98b7ca968e3488a350", size = 270268, upload-time = "2026-10-22T16:06:36.597Z" },
+    { url = "https://files.pythonhosted.org/packages/27/a3/b2731bb7aef2db800b330603675c3fa58a6497a05d5b5f8625f3b6285f68/coverage-7.17.0-cp315-cp315t-musllinux_1_2_i686.whl", hash = "sha256:d45cdc495671fc99268ff3653e0da4244972e9fc0e1fc3ea9de18781ad28963a", size = 267298, upload-time = "2026-10-22T16:06:37.973Z" },
+    { url = "https://files.pythonhosted.org/packages/50/75/d0c90a81b6b6607933109914dc8b0ef0a5f4cacf9482ca868ae773ee5d0b/coverage-7.17.0-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:12961f738d717a046d4bf3f8d1727eb3ebe2ed5478ff96cd6233d4dfc39323d3", size = 271899, upload-time = "2026-10-22T16:06:39.389Z" },
+    { url = "https://files.pythonhosted.org/packages/64/1e/f038f3a2614e9ef839a40a184713aca40b8ed79e626ab5cdc388771045df/coverage-7.17.0-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:1ee0a982b0e1230b3edf768a7dd022bd2377303763895327ac62deb5efacee03", size = 267380, upload-time = "2026-10-22T16:06:40.97Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/30/8d636e639b2d8b1934128573402a7caf66c8cfbc794fa02061d84f115c34/coverage-7.17.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:460679f53893081edb94eeed011d26be37228ba649b853fd2aed7e4394fb1f35", size = 268993, upload-time = "2026-10-22T16:06:42.361Z" },
+    { url = "https://files.pythonhosted.org/packages/73/7a/219f6b391cb0636242d06c390a8add5af91afa3e92afd0380dbedd34f487/coverage-7.17.0-cp315-cp315t-win32.whl", hash = "sha256:600e121e412cd6bdb52ec105b95c6a04da0c9710d1534f6e64a42db667907802", size = 228216, upload-time = "2026-10-22T16:06:43.714Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3f/514d294319c5eac11494394545de209079f33993e14526c220eab29b2a96/coverage-7.17.0-cp315-cp315t-win_amd64.whl", hash = "sha256:c3e11b81faafb1f063248735c3e2c5c4183fc1db2c7f46782170dd7760dffcbc", size = 229146, upload-time = "2026-10-22T16:06:45.262Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/82/c0d8bb0a67df838fc7bc6f4060ffc404fd1154fd18e624d83e6abc41aeef/coverage-7.17.0-cp315-cp315t-win_arm64.whl", hash = "sha256:d472ee1c64868a917a47f02ffb4ac8c22b477f7589d57a3eb0c58b1ad4f0137c", size = 228716, upload-time = "2026-10-22T16:06:47.097Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/17/48032919343afa2906112d458aceda2043afdb24a2ee8eb4c60904d8ddf1/coverage-7.17.0-py3-none-any.whl", hash = "sha256:bac487dce0d2aff28ddf1a533a916f771416eee0e493960f611e49037b878e9d", size = 217383, upload-time = "2026-10-22T16:06:48.471Z" },
 ]
 
 [[package]]
@@ -313,7 +321,7 @@ wheels = [
 
 [[package]]
 name = "fastapi"
-version = "0.153.0"
+version = "0.162.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "annotated-doc" },
@@ -323,9 +331,9 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/0a/69/8461d4c25490b5efe65b2178c857273785bd8b42a5555264b6b4f9bf2ed0/fastapi-0.153.0.tar.gz", hash = "sha256:5dbf5dcf6cf86388326c147566077c56a14c55b0f1bef370195da98e724a503f", size = 489663, upload-time = "2026-10-20T13:47:40.029Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e9/eb/2cf8c80abf09b2800aef0a83b41066fbfda8ee5495b7a08b9d1af40f7046/fastapi-0.162.0.tar.gz", hash = "sha256:6a22c1e2e6e32e0633ee7e170f00009a29b8228b16feb219ee42f32fd8d88a8f", size = 527867, upload-time = "2026-10-23T18:47:33.264Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/93/41/c2c2c10be9068304a522dd64893916b5b21549af084ea942c26388aaa5b0/fastapi-0.153.0-py3-none-any.whl", hash = "sha256:77fbc9f41d2e5cd81f0c0a20482e627f8ebbb9b9005ac7586e415ee69dfea4ec", size = 146107, upload-time = "2026-10-20T13:47:38.295Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/4f/3f2c25c9b43970b5e9a08beb5e04776247edea684ddc0930f4f02f0bb6cb/fastapi-0.162.0-py3-none-any.whl", hash = "sha256:3785963de305dd09912426cb81f2d230fce98ab3521cdfe97265c8d14983128c", size = 148912, upload-time = "2026-10-23T18:47:31.734Z" },
 ]
 
 [[package]]
@@ -484,11 +492,11 @@ wheels = [
 
 [[package]]
 name = "pycparser"
-version = "3.11"
+version = "3.12"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/da/a8/c5fdbeee588bb8ada9458774f43adf1bdd30bd59157055142183e769a024/pycparser-3.11.tar.gz", hash = "sha256:d875f09c3507d00e1aba0eecc6dcadc1352f30fff09dc6bff2f1c2935e97c2bc", size = 113796, upload-time = "2026-10-09T12:56:59.539Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cb/27/eeb9f307bf07060f3d9f9aa0fb8c15b01bdfded0a941e4b2719c7f94cacd/pycparser-3.12.tar.gz", hash = "sha256:f03387877eab82ce01bbdfd0ba7252ee55a90b1c708d5129e2ce915475cf1db6", size = 158785, upload-time = "2026-10-22T13:40:03.56Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/90/11/0e6f11117525ff0eec40ebac3d313376f102df93ca44ad9e893ee85e4f89/pycparser-3.11-py3-none-any.whl", hash = "sha256:51d5a8ba2be0bbe440b99d2112604c95bbbc3c2748a64260186c541e1729cd80", size = 51178, upload-time = "2026-10-09T12:56:58.131Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/ae/315bbeee126a769cbde43cf4908acb4b40408d8bf8bbf334dd7368d8dadf/pycparser-3.12-py3-none-any.whl", hash = "sha256:a076f3f489b39b43ed13563a1dafe42447445bec2e294154ec5c57fcdda4c85e", size = 62600, upload-time = "2026-10-22T13:40:02.021Z" },
 ]
 
 [[package]]
@@ -679,27 +687,27 @@ wheels = [
 
 [[package]]
 name = "ruff"
-version = "0.17.1"
+version = "0.17.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/f9/e7/e6d5749983b020e6cb1055abec0a6f361a8e94f0184cdcf56d4760995f02/ruff-0.17.1.tar.gz", hash = "sha256:5bb796c5112e9fb9527f2ef2faa0a130d6312d19de92bcfaddd70dbb2d41020f", size = 5323349, upload-time = "2026-10-15T15:23:18.64Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ae/58/690cf56da80c8f2c8bf12042b6017beac2c34fe961f65420bcb3fb7fac38/ruff-0.17.2.tar.gz", hash = "sha256:84d632402d14c23b488f941db23712d6736a013225162062d34558c3f3c780eb", size = 5333400, upload-time = "2026-10-22T18:38:00.181Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/2e/78/90c46ca6250709f7c37e397b60d06061adee8d0f7d13959ed6a8e49b14fd/ruff-0.17.1-py3-none-linux_armv6l.whl", hash = "sha256:1796c41eafec66f4635125dd1e074a7aa27b8d20c187d484360acf11d247fc4a", size = 10147528, upload-time = "2026-10-15T15:22:33.667Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/d2/a2e28bc35b083ae51fa07dfba5280a667c8b01ecaee7802fc8849dcd5c46/ruff-0.17.1-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:8eadb09a788010be29c895418bdfa513e4e1c65e64b94e5b19e4cd381f6cc7fb", size = 10225974, upload-time = "2026-10-15T15:22:36.328Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/71/7a9029a81c8206ee01a98f6cfeeb56e6c095af86857581a37045c46d7e94/ruff-0.17.1-py3-none-macosx_11_0_arm64.whl", hash = "sha256:29b454f18ca3eeaf37fbf140841dcf27d36109e29dee9aae8acecb68c26c6f74", size = 9270361, upload-time = "2026-10-15T15:22:38.651Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/8c/e075e9c917cb0575297880c96768304e881240171c870cbd8d9b7b54bec2/ruff-0.17.1-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:872e03dd231744d6c5ec5c8af6be52b71323fc6ee096e4c8b34d9f844ee3b978", size = 9938300, upload-time = "2026-10-15T15:22:41.284Z" },
-    { url = "https://files.pythonhosted.org/packages/87/27/0b4bb926a49de2383f161272b4d863571a4c7ecdbf595a6bc58813a13367/ruff-0.17.1-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:4c0d6cb5f8fbac77eec9af49f4fc0eaf856b05545e372b0694d24b4e76b1c640", size = 9948464, upload-time = "2026-10-15T15:22:43.681Z" },
-    { url = "https://files.pythonhosted.org/packages/14/27/518d57e0e02aecb8ea4acac6b57b51a53173d25fa734952bfdd7d531e88e/ruff-0.17.1-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:78beced4a3c94dfedbee4b999b95b6a27b35820fdc0afbacc6d37a8da26c1cd1", size = 10638639, upload-time = "2026-10-15T15:22:46.081Z" },
-    { url = "https://files.pythonhosted.org/packages/01/82/d89a4e498ade59e6cee52d67f8da569019372212b87468c1fdeae884601c/ruff-0.17.1-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7feefc63921202894f0e158b0e32f45a5950d70a7fb693ccb9264816c25b1c05", size = 11337238, upload-time = "2026-10-15T15:22:48.894Z" },
-    { url = "https://files.pythonhosted.org/packages/a2/7c/3b0fdef9352656317c977086fe1d802902406e4f2a0d8578da90c0e6d1c5/ruff-0.17.1-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:684154861a819bf1f433669d2a0ce9c3e54677c65b8ebb866cc2a7ec86345785", size = 10896327, upload-time = "2026-10-15T15:22:51.45Z" },
-    { url = "https://files.pythonhosted.org/packages/62/86/5566290219708ce2928f3a29c4f843a1185b341ec6111c4631a33c5ceced/ruff-0.17.1-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a6ef98e51de8ef38082f90653ceeb84944bd7673783eea13e1647c5b9b064189", size = 10350811, upload-time = "2026-10-15T15:22:54.401Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/d2/ca8462dabb3c413990d49703ba306c30c862195a75448d080fa8fcce9775/ruff-0.17.1-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:8f9aa5b5bd5fa1937803ea609c8f153b8de39bf3e0e149897ae34b0c5b52f467", size = 10569994, upload-time = "2026-10-15T15:22:57.142Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ad/dd1864c1f1db17c8cfb297ce70b352388e6977620f66f7182c52855407df/ruff-0.17.1-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:80e53b0e5faa3c5667f035daaa032893ae42b7cfe708c886d39ed131e54688ab", size = 10059672, upload-time = "2026-10-15T15:23:00.084Z" },
-    { url = "https://files.pythonhosted.org/packages/65/45/3f56cf1d2168c2165cdd5ac6f9668aee66a4cfdd4caf2b2cc5ccb2b1d568/ruff-0.17.1-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:056c5d5fa0ac790051ae165d7035c7bf956d02de2db557f2e9b31d877a505fca", size = 9947803, upload-time = "2026-10-15T15:23:03.132Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/4b/5457cb2be4c1d1ea5e919558131a0f197a4a454a0530d9e30820e8206e4c/ruff-0.17.1-py3-none-musllinux_1_2_i686.whl", hash = "sha256:bd8f5a55b10f371642eacd0e8665a42a8b97da15c9a7187c79e697b77b5e0ce4", size = 10351807, upload-time = "2026-10-15T15:23:05.628Z" },
-    { url = "https://files.pythonhosted.org/packages/49/fb/db15b4f8fa24a1e36b99e1401f42ef6df16ee299a48670d5d262b771e7d7/ruff-0.17.1-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:ce05e6f3973611d9550a600e04bb531061e368baba31610eb57c1509a8f21a0a", size = 10765716, upload-time = "2026-10-15T15:23:08.092Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/e8/1e186578076aff7a80735f625005fde678412ab609cd323ed182eb7d6b87/ruff-0.17.1-py3-none-win32.whl", hash = "sha256:1de0030a8aa78c65c5fecb84b2e5c390ac684c0452875a02afc7c083d49a496a", size = 9895093, upload-time = "2026-10-15T15:23:10.582Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/2e/da3d9589bae8e8b58f3a48bd5bc0b980232fb14a83bf02c3be7660f87c1b/ruff-0.17.1-py3-none-win_amd64.whl", hash = "sha256:5df76f16580fab58d0f6c98a3ac254a4abceb7b2489b8b678335869cff77b3d7", size = 10097955, upload-time = "2026-10-15T15:23:13.309Z" },
-    { url = "https://files.pythonhosted.org/packages/df/c9/0f2a4dea06a5e12c1191ee3d96b1e1233797d0d5e18f97a2b909a95a9836/ruff-0.17.1-py3-none-win_arm64.whl", hash = "sha256:42400b9a6ff8515ff27796f07f92e0195be011c86e81e381606f58ea5502fef4", size = 9853542, upload-time = "2026-10-15T15:23:16.05Z" },
+    { url = "https://files.pythonhosted.org/packages/98/b8/8b6d69c57e8fe1cc6af1aa7493b72a1a5b5a8afe34694e302025441729d4/ruff-0.17.2-py3-none-linux_armv6l.whl", hash = "sha256:96a65e755d8dba094707fb23ab602111d9a31ec2835b3a6992a1914a8fcb211e", size = 10183857, upload-time = "2026-10-22T18:37:14.956Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/61/12cc2ff7b2fa90a268ce1e2162c23aaf76e601d22623f6a31b0eeaa764b0/ruff-0.17.2-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:39c5b55c960515cdb32be16e69efb5734c589c06a0eb38a22694524a336b889d", size = 10210904, upload-time = "2026-10-22T18:37:17.985Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/7c/b8850a8e4ad29f64a827dd6c6902db4a9aa538fb2b9eef4e26084001a3bb/ruff-0.17.2-py3-none-macosx_11_0_arm64.whl", hash = "sha256:92a80d2f44584dabb0189b3a6c393e37e525e04942838482010575cb81945be7", size = 9408439, upload-time = "2026-10-22T18:37:20.964Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/b6/6a64fae86ca5e5e29d5adc311e5481de726cedf9aee607435a16c31c442a/ruff-0.17.2-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b7d0906677d89bbf3cf73cde64b5bbe2ab35df3ae43e49ee2627301e91265bac", size = 10047078, upload-time = "2026-10-22T18:37:23.717Z" },
+    { url = "https://files.pythonhosted.org/packages/10/19/23d376547715175aa1bd46df48df6aacc7c6439d9daf19cac15975180aa5/ruff-0.17.2-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:7cfd783590edf2b77317882631900f6a13ea2e8eacefe6ebf2370d2715299160", size = 9990478, upload-time = "2026-10-22T18:37:26.584Z" },
+    { url = "https://files.pythonhosted.org/packages/93/6c/34cda32cbe13adac5c6b291a307a5570d8ebd37c0c86339f0fe628e55632/ruff-0.17.2-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:122258f6ecde0e0dd1bb60b24263c3edde4338caf723fca711cc729f9bfd414a", size = 10673624, upload-time = "2026-10-22T18:37:29.767Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/10/5d762a4dbc851d8bb47863cf3a28a61bf31c804d393b70d891fac899f5d1/ruff-0.17.2-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7f8fba429d6ac4128ab29cfb8fa6240d2fa671d04adf7f84d3b22fc7b6b6bea4", size = 11351797, upload-time = "2026-10-22T18:37:32.535Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/04/a0e92a81faf5c81c1c98d4374c8401734ccf2b8cca7d0170cb0fec08c6e2/ruff-0.17.2-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:583bd67bb9e7061dd09bc46a0a884bae2bbd214dbcd48e509813612619683869", size = 10949414, upload-time = "2026-10-22T18:37:35.501Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/d8/59894cf630d2d86882457a2a6a0a1533410c5c805bfbac6f6eb4b5aef69d/ruff-0.17.2-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c60f93fec7142dba5b8f487f94bf2f6231dae24dc11e4c48648347c8b0720004", size = 10528000, upload-time = "2026-10-22T18:37:37.88Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/95/d6e30c51e851d37e10762ad91fa1e76ddaad998589b5667962a3cfbc9edd/ruff-0.17.2-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:c555a877f8f41447e318101cfefea9bf12dfa9f82eedf90c376e57e069f917d0", size = 10571779, upload-time = "2026-10-22T18:37:40.444Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/5a/a7e1d74fb464250137d3d4eca645d323536533b672004d04ee0e46e0caf3/ruff-0.17.2-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:ba405cbd5ec7bda1f555d5e52be1fd68d02608d4d95d24591bdac92cfacb579f", size = 10051707, upload-time = "2026-10-22T18:37:42.812Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/f2/02fca29ca7999380f0350a7212fe755c11ab9c22d61327356cce8decdbc6/ruff-0.17.2-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:8c21b4ab24485358f17291a4f8dc5399b834e963b8efedd920fe4fdb02081bb4", size = 9998227, upload-time = "2026-10-22T18:37:45.224Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/00/55aa604a093dfdc1526e570fae0bb7d37a2221c7b4728d5f080b2add16ba/ruff-0.17.2-py3-none-musllinux_1_2_i686.whl", hash = "sha256:5875a16b0de70b43cb81eabea5ae5e8f5d1b2fd1b5e6ed07f80cfe5019d0bd5a", size = 10377692, upload-time = "2026-10-22T18:37:47.704Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/5a/a7a640f47bb906ec8fa233ea84319d503e6dee02b59e3901bd312ebd1f9b/ruff-0.17.2-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:2d086be452eed686aa51271ecf2cbe5037956517cc6ee39a17b4489ac12f8bbe", size = 10790587, upload-time = "2026-10-22T18:37:50.191Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/d4/c3b74e1b4808438ea7f14bb914478025e2d51261f60774a54a0fa222ec46/ruff-0.17.2-py3-none-win32.whl", hash = "sha256:6bce7d1f5165701ae18f5df85c65afe78cddfa6c5fb4b9bdb0014d60388f3edd", size = 9870537, upload-time = "2026-10-22T18:37:52.486Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/9a/c7da96c2c96d20704cf9027f7a5121da272a8c05f1d1531ba949e3b3df04/ruff-0.17.2-py3-none-win_amd64.whl", hash = "sha256:1b59d447f197bef9ef48a22ba1a6016137753c6099e9bac9c36eb566e422424c", size = 10282826, upload-time = "2026-10-22T18:37:55.2Z" },
+    { url = "https://files.pythonhosted.org/packages/81/60/a3604c79cb02777b6cb84da894104021986f06c4bc41375102cc95049a32/ruff-0.17.2-py3-none-win_arm64.whl", hash = "sha256:195ad918027f817c119310ca89a42d347887dfc28934aaa869325e9c5dc9d962", size = 9827036, upload-time = "2026-10-22T18:37:58.031Z" },
 ]
 
 [[package]]