phase: 19_ups_events_expandable

**Phase 19 final verification pass — all tasks already complete; everything green, no code changes needed.** - **Verified (all 4 task files present in `complete/`)**: `details.events-box` disclosure on `/ups` with no `open` attribute and `#events` inside it; lazy fetch (`if (state.events.open) await refreshEvents()`), toggle stale rule on `state.pollMs`, success-path-only `painted`/`fetchedAt`; `charts-box`-shaped CSS with the `> .body` padding restatement; 4 new served-byte pins in `tests/test_api.py`. - **Criterion 1 (collapsed on load, no first-poll fetch)**: PASS — re-ran `data/logs/19-task04-verify.cjs` against the live dev server (real upsd, 2 UPSes): **28/28 PASS**, `0` `/api/events` requests across 2 closed polls vs 4 snapshot polls; expand → exactly 1 request, 50 rows with `Oct 20, 07:11` timestamps + severity chips + `1–50 of 200` pager. - **Criterion 2 (cache/stale/poll-while-open)**: PASS — fresh re-open 2→2 requests, stale re-open 2→3, loop refreshes while open, close asks for nothing, failed fetch keeps rows and doesn't stamp the cache. - **Criterion 3**: `uv run pytest` → **1458 passed, 15 skipped**; `uv run pytest --cov` → **98.94%** (floor 94, unchanged); `uv run ruff check src tests agent` → clean; `uv run pyright` → **0 errors**. - **Criterion 4**: `bash .agents/validate.sh` → **exit 0** (incl. `node --check` of all page scripts + repo-hygiene gates). - **Criterion 5**: `data/logs/ups-events-closed.png` (collapsed `▸ POWER EVENTS`, 0 events requests noted in `ups-events-verify.out`) and `ups-events-open.png` (`▾`, bounded 320px list, pager strip) regenerated and inspected this pass. - **Criterion 6 (no regressions)**: full suite green incl. UPS contract/pager pins; `uv run pytest -m live --live` (with `.env.dev`) → **11 passed**; phase 18's `nav-final-pass.cjs` sweep re-run → **45/45** (this phase's markup/CSS didn't touch the masthead). - **Documentation**: full README.md (980 L) + AGENTS.md (1992 L) review against the code — verified env templates vs `config.py`, API route table vs `api.py`, installer flags vs `deploy/install-agent.sh`, agent routes vs `host_agent.py`, test/coverage/live tallies, `data/logs` artifacts, and live fleet facts (`HOST_TARGETS` all `http://`, all three agents `version 1.0.0`, nine sources `ok`). AGENTS.md UI conventions and README's events paragraph already carry the disclosure/lazy/stale sentences from tasks 01–04. **Verified consistent — no changes needed.** - **Notable**: made zero repo edits (working tree holds only this phase's task work). `uv pip list --outdated` couldn't complete (PyPI 503 for the project name) — no dependency moved this pass, so rule 8 is not triggered; validate.sh's earlier advisory still lists `fastapi 0.153.0 → 0.156.3`, deliberately not upgraded in a UI/verification phase. - **Next pending phase**: `.agents/phases/todo/20_masthead_nav_polish/` (tasks 01–04).
chore(agent): phase roadmap from TODO.md, 5 phases
2026-10-20 19:17:22 -04:00 · 2026-10-20 18:06:46 -04:00 · 2026-10-20 16:47:10 -04:00
82 changed files with 2056 additions and 19 deletions
@@ -0,0 +1,36 @@
 # Phase 20 — Masthead & navigation polish
 **Source:** `TODO.md` L4, L5, L6, L10, L11 — "masthead row layout, un-sticky bar, hamburger animation, always-visible admin links"
 **Story:** n/a
 **Context:** `src/dashboards/web/static/dash.css` (`.masthead` at line 99 — `position: sticky; top: 0; z-index: 40; display: flex; height: var(--header-h)`; `.masthead-right` at line 148 — `margin-inline-start: auto`; `#nav-toggle` at line 190 — the `--nav-toggle-display` token reveal; the ≤640px block at lines 208–280 — masthead wrap, `masthead-right { justify-content: flex-end }`, the `nav.tabs` dropdown at `top: 100%` under the sticky bar, the `env(safe-area-inset-top, 0px)` padding line), `src/dashboards/web/static/app.js` (the `setNavMenu()` funnel at lines 695–722 — four close paths, `matchMedia('(max-width: 640px)')`), `src/dashboards/web/pages/*.html` (the masthead in every page: brand, `#nav-toggle`, `nav.tabs#nav-tabs`, `.masthead-right` holding `#nav-status` + clock + `⚷ Certs` + `⚙ Account` + theme toggle; `certs.html` lacks `⚷ Certs`, `settings.html` lacks `⚙ Account` — the phase-15 "no self-link" rule this phase inverts), `tests/test_api.py` (`test_every_page_links_to_both_admin_pages` at line 999, `test_the_disks_tab_is_in_the_masthead_of_every_page` at line 3913, `test_the_nav_toggle_is_in_the_masthead_of_every_tabbed_page` at line 3957)
 ## Objective
 The masthead becomes a three-row bar at **all widths** — row 1 the brand and the five dashboard tabs, row 2 the per-source status indicators left-justified in their own row, row 3 the `⚷ Certs` / `⚙ Account` / `☾ Dark` controls left-justified in their own row under the indicators — the bar stops being sticky (it scrolls away, maximising data screen space), the hamburger menu slides out and back in (180 ms, the `brain_of_reese` pattern, stilled under `prefers-reduced-motion`), and both admin links stay visible on every page including the two admin pages themselves. The served page markup is unchanged except the two added admin links; the tab structure (five links, one `aria-current`), the `#nav-toggle` token reveal, the safe-area padding line and the four close paths all stay exactly as phase 18 pinned them.
 ## Dependencies
 - `19_ups_events_expandable` (todo) — both phases touch `ups.html` (the masthead, the events card); landing 19 first keeps this phase's diff confined to the masthead.
 ## Tasks
 1. `01_two_row_masthead.md` — the three-row left-justified masthead at all widths (CSS-only reflow; the mobile block re-cut for the new rows)
 2. `02_unsticky_masthead.md` — the bar scrolls away: `sticky` → `relative`, the dropdown anchor kept
 3. `03_hamburger_slide.md` — the 180 ms slide+fade on the ≤640px dropdown, stilled under `prefers-reduced-motion`
 4. `04_admin_links_visible.md` — `⚷ Certs` on `/certs`, `⚙ Account` on `/settings`; the "no self-link" pin inverted to "all eight pages link to both"
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the served-page pins (task 04's rewritten admin-link test over all eight non-login pages, the unchanged tab-structure pins at lines 3913/3957, the CSS pins for the row layout and the un-sticky change), the unchanged `setNavMenu` behaviour
 - Coverage: **>90%** on new/modified code (the phase is markup + JS + CSS; the gate applies to the changed Python test files)
 - The phase is "Complete" only when the **entire** project test suite passes 100% (every test in the project, not just this phase's)
 ## Documentation & Consistency
 - The final pass reviews `README.md` and `AGENTS.md` in full against the project as it stands after this phase — fixing every inconsistency found, **including pre-existing ones not caused by this phase**. AGENTS.md's masthead paragraph (the phase-18 "specificity ladder" and the `top: 100%`-under-the-sticky-bar wording) and the phase-15 "neither admin page links to itself" sentence (gap 12's "now questioned" item — this phase is the decision) both get rewritten to the new state in the section's voice.
 ## Completion Criteria
 - [ ] at 1280 px and at 360 px, every tabbed page and both admin pages render the three-row masthead: brand + tabs, left-justified indicators row, left-justified controls row under it (screenshots in `data/logs/`, invariant 10)
 - [ ] scrolling any page at 1280 px and 360 px leaves the bar behind (no sticky offset), while the mobile dropdown still opens directly under the bar
 - [ ] at 360 px the hamburger menu slides out and back in (180 ms); with `prefers-reduced-motion` it snaps
 - [ ] `/certs` renders `⚷ Certs` and `/settings` renders `⚙ Account`, before the theme toggle and outside `.tabs`, exactly like the five dashboards
 - [ ] `uv run pytest` green, coverage not down, `ruff` + `pyright` clean
 - [ ] `bash .agents/validate.sh` green (including `node --check` of the modified `app.js`)
 - [ ] no behavior change in completed work: the tab structure, the token reveal, the safe-area padding line, the four close paths, the status dots and the theme toggle are all unchanged
@@ -0,0 +1,27 @@
 # Task 01 — The three-row left-justified masthead, at all widths
 **Phase:** `20_masthead_nav_polish` · **Source:** `TODO.md:5,6` — "The hosts disks engines and UPS indicators should be left justified in their own row" / "The ⚷ Certs ⚙ Account ☾ Dark buttons should be left justified in their own row under the hosts disks engines UPS indicators"
 **Story:** n/a
 ## Objective
 The single-row masthead becomes a three-row bar at **every** width: row 1 keeps the brand, `#nav-toggle` and the five dashboard tabs; row 2 is the `#nav-status` indicator row (the per-source dots), left-justified and on its own; row 3 is the `.masthead-right` cluster (clock, `⚷ Certs`, `⚙ Account`, `☾ Dark` — plus the `⏸ Pause` button until phase 21 removes it), left-justified and on its own row under the indicators. The change is CSS-only: no page markup changes in this task, so the served-HTML pins (tab structure, toggle placement) stay green untouched.
 ## Work
 1. `src/dashboards/web/static/dash.css` — `.masthead` (line 99): `display: flex; flex-direction: column; align-items: stretch; gap: .35rem` (replacing the row layout's `align-items: center; gap: 1.1rem`), `height: var(--header-h)` replaced by `min-height: var(--header-h)` (the ≤640px block already carries its own `min-height` — keep the mobile one, the two must not drift apart; see the comment it carries), `position: sticky; top: 0` **left in place in this task** (task 02 removes the stickiness; keep `z-index: 40`), and a positioned wrapper for row 1: the first flex child is the existing `brand` + `#nav-toggle` + `nav.tabs` trio — since the markup is not touched, use CSS `order`/`flex` only: `#nav-status` and `.masthead-right` each get `flex-basis: 100%` (forcing the row break), `nav.tabs` keeps its current inline position on row 1 (it already flows after the toggle). If `flex-basis: 100%` does not force a row break on the `nav` element in the pinned browser, the fallback is a `display: contents` wrapper-free `flex-wrap: wrap` on `.masthead` with the same `flex-basis: 100%` rules — measure in a browser, do not deduce (the phase-18 rule).
 2. `src/dashboards/web/static/dash.css` — `#nav-status` (the `gap` container, line 148 neighbourhood): its own row styling — `flex-basis: 100%; display: flex; align-items: center; gap: .55rem; justify-content: flex-start` (left-justified, no `margin-inline-start: auto`).
 3. `src/dashboards/web/static/dash.css` — `.masthead-right` (line 148): `margin-inline-start: auto` removed, `flex-basis: 100%; justify-content: flex-start` (left-justified, the TODO's words). The `⏸ Pause` button stays in this row (phase 21 deletes it; do not pre-empt it).
 4. `src/dashboards/web/static/dash.css` — the ≤640px block (lines 208–280): re-cut for the new rows — the whole-bar `flex-wrap`/`min-height` machinery of the old wrap is replaced by the mobile half of the same three-row layout: `#nav-toggle` keeps its `--nav-toggle-display: inline-flex` reveal on row 1 (the token ladder stays exactly as pinned), `nav.tabs` stays hidden except `nav.tabs.is-open` (the dropdown), the `masthead-right > *` no-wrap rule and the `env(safe-area-inset-top, 0px)` top padding line (pinned by `tests/test_api.py`'s rule loop) survive verbatim, and the comment at line 203 (which describes the old 360 px wrap) is rewritten to the new three-row reality. The dropdown's `top: 100%` now lands under the **whole bar** (three rows) on mobile — that is the intended look (a menu under the bar, not wedged between rows); verify in a browser at 360 px.
 5. `tests/test_api.py` — extend the served-stylesheet pins for the new layout: `.masthead` has `flex-direction: column` (or the `flex-wrap` fallback, whichever shipped) and no fixed `height: var(--header-h)`, `#nav-status` and `.masthead-right` are both `flex-basis: 100%` + `justify-content: flex-start`, and `.masthead-right` no longer declares `margin-inline-start: auto`. The existing pins (the media-query-vs-`matchMedia` comparison, the safe-area line, the token ladder) must stay green — run them before touching the file.
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the new layout pins above run against the **served** bytes; the unchanged pins (tab structure line 3913, toggle line 3957, the safe-area rule loop) stay green
 - Coverage: **>90%** on this task's new/modified code (the gate applies to the changed Python test files)
 - Browser verification (invariant 10): screenshots of `/`, `/system`, `/certs`, `/settings` at 1280 px and 360 px in `data/logs/` — the three rows, indicators and controls left-justified, the mobile dropdown under the bar
 ## Completion Criteria
 - [ ] at 1280 px and 360 px, the masthead renders three rows in the order brand+tabs / indicators / controls, the last two left-justified, on every tabbed page and both admin pages (screenshots in `data/logs/`)
 - [ ] `tests/test_api.py` green including the new layout pins and every pre-existing masthead pin
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the tabs, the toggle, the dots, the clock, the links and the theme toggle all behave exactly as before
@@ -0,0 +1,27 @@
 # Task 02 — The masthead is not sticky
 **Phase:** `20_masthead_nav_polish` · **Source:** `TODO.md:10` — "The navbar is only sticky part way down certain pages on mobile? It shouldn't be sticky at all. We want to maximize the amount of screen space for data viewing."
 **Story:** n/a
 ## Objective
 The masthead scrolls away with the page. The "sticky part way down" quirk is the fixed-height sticky bar fighting the wrapped rows on mobile; removing the stickiness removes the quirk and the bar's vertical footprint. The ≤640px dropdown (`nav.tabs.is-open` at `top: 100%`) still opens directly under the bar, because the bar stays a **positioned** ancestor — `position: relative` keeps the anchor without the stick.
 ## Work
 1. `src/dashboards/web/static/dash.css` — `.masthead` (line 99): `position: sticky; top: 0` → `position: relative` (keeps the positioned-ancestor role for the dropdown's `top: 100%` and the `left/right: 0` span; `z-index: 40` stays — the dropdown's `z-index: 41` is "one above the masthead" and that sentence stays true).
 2. `src/dashboards/web/static/dash.css` — the dropdown comment (line 266: "`position: sticky`, which is a positioned ancestor") rewritten to `position: relative`; any other comment in the file that calls the bar sticky gets the same fix.
 3. `tests/test_api.py` — any pin that asserts the `position: sticky` declaration (grep the test files for `sticky`) is updated to assert `position: relative` **and** the absence of `top: 0` on `.masthead`; if no pin named the declaration, add one to the layout pin loop from task 01 so the stickiness cannot quietly return.
 4. `src/dashboards/web/static/dash.css` — check the `sticky; top: 0` at line 796 (a **different** element — the event-feed pager strip's own sticky header): it is not the masthead, do not touch it.
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the `.masthead` pin above, the unchanged dropdown pin (the media query still names `top: 100%` under the bar)
 - Coverage: **>90%** on this task's new/modified code
 - Browser verification (invariant 10): at 1280 px and 360 px, scroll `/system` and `/` past one viewport — the bar is gone from the top of the viewport; at 360 px open the dropdown — it still renders directly under the bar (screenshot pair in `data/logs/`)
 ## Completion Criteria
 - [ ] scrolling any page at any width leaves the masthead behind (no element pinned to the top edge but the pager strip's own header)
 - [ ] the mobile dropdown at 360 px still opens directly under the bar (screenshot in `data/logs/`)
 - [ ] `tests/test_api.py` green including the new `.masthead` pin
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the pager strip's sticky header (line 796) and the dropdown's `z-index` stacking are untouched
@@ -0,0 +1,27 @@
 # Task 03 — The hamburger menu slides out and back in
 **Phase:** `20_masthead_nav_polish` · **Source:** `TODO.md:11` — "I want a nice animation for the hamburger menu - a slide out and slide back in would be perfect. See ~/Project/Personal/brain-of-reese for an example."
 **Story:** n/a
 ## Objective
 The ≤640px dropdown (`nav.tabs.is-open`) opens and closes with an 180 ms slide+fade instead of snapping — the exact pattern the operator pointed at in `brain_of_reese`: closed = `visibility: hidden; opacity: 0; transform: translateY(-8px); pointer-events: none` with a `visibility 0s linear 180ms` delayed transition, open = `visibility: visible; opacity: 1; transform: none; pointer-events: auto` with the `visibility` delay dropped, and the whole thing stilled under `prefers-reduced-motion` with **both states named** (the reference project's phase-46 comment: an open-state transition that is not stilled still animates). `app.js`'s `setNavMenu()` funnel and its four close paths are untouched — the animation is pure CSS over the existing class flip.
 ## Work
 1. Reference (read-only): `/var/home/ducoterra/Projects/Personal/brain_of_reese/frontend/assets/styles.css` lines 6960–6976 (the `.app-nav` closed/open transition pair — note the TODO's path `~/Project/Personal/brain-of-reese` is a typo; the project lives at `~/Projects/Personal/brain_of_reese`) and lines 7228–7235 (the `prefers-reduced-motion` block that names **both** `.app-nav` and `.app-nav.is-open`, with the specificity comment: an open rule that is not named keeps animating).
 2. `src/dashboards/web/static/dash.css` — inside the ≤640px block (lines 208–280), the `nav.tabs` rule (the dropdown): add the closed-state properties + transition from the reference (adapted: this nav is `position: absolute; top: 100%`, so the slide is `transform: translateY(-8px)` → `none`, same 180 ms ease; keep the existing `visibility: hidden`/`pointer-events: none` closed-state behaviour if it is already there, otherwise add it — measure the current rule first, do not assume). The `nav.tabs.is-open` state gets the visible counterpart with the `visibility 0s` (undelayed) transition.
 3. `src/dashboards/web/static/dash.css` — a `@media (prefers-reduced-motion: reduce)` block (the file's first, or merged with an existing one if there is one) that sets `transition: none` on **both** `nav.tabs` and `nav.tabs.is-open` — both states named, per the reference's phase-46 comment.
 4. `tests/test_api.py` — extend the served-CSS pin for the mobile block: the `nav.tabs` rule carries an `opacity`/`transform` transition of 180 ms, the `is-open` state carries the visible counterpart, and the reduced-motion block names both states. The existing media-query-vs-`matchMedia` comparison test stays green untouched (the transition is additive; the `640px` literal still lives in exactly the two pinned places).
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the pins above; the unchanged four-close-path behaviour (the `setNavMenu` funnel tests)
 - Coverage: **>90%** on this task's new/modified code
 - Browser verification (invariant 10): at 360 px, open and close the menu — a CDP check that the computed `transition` runs (a mid-transition screenshot is not required; assert the closed state's `opacity: 0` + `transform: translateY(-8px)` computed values and that a frame after `.is-open` is added shows `opacity > 0`), and with `prefers-reduced-motion: reduce` emulated the menu snaps (computed `transition: none`) — extend the phase-18 verification script pattern (`data/logs/nav-task04-verify.cjs`) rather than hand-asserting
 ## Completion Criteria
 - [ ] at 360 px the menu slides out (fade + 8 px rise) and back in over 180 ms; all four close paths still work
 - [ ] under `prefers-reduced-motion: reduce` the menu snaps in both directions
 - [ ] `tests/test_api.py` green including the new transition pins and the pre-existing `640px` comparison pin
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the token reveal, the safe-area line, the dropdown position under the bar and the close paths are untouched
@@ -0,0 +1,27 @@
 # Task 04 — Both admin links stay visible on the admin pages
 **Phase:** `20_masthead_nav_polish` · **Source:** `TODO.md:4` — "Clicking the certs tab causes the certs button to disappear, then clicking the account tab causes the accounts button to disappear. These should remain visible."
 **Story:** n/a
 ## Objective
 Phase 15's deliberate "neither admin page links to itself" rule is inverted by operator decision (it was already "now questioned" in AGENTS.md gap 12): `certs.html` gains the `⚷ Certs` link and `settings.html` gains the `⚙ Account` link, so the masthead's controls are identical on all eight non-login pages. The links sit before the theme toggle and outside `.tabs` exactly as on the five dashboards; the tab structure (five links, no `aria-current` on the admin pages) and the `/login` page (brand + theme toggle only) are untouched.
 ## Work
 1. `src/dashboards/web/pages/certs.html` — the masthead (lines 14–28): insert `<a class="ghost account" href="/certs" title="Agent certificates">⚷ Certs</a>` between the clock and the `⚙ Account` link (the dashboard order is clock → `⚷ Certs` → `⚙ Account` → theme toggle; `settings.html` already holds that order), and rewrite the HTML comment at lines 14–17, which currently justifies the *missing* link, to the new rule (both links everywhere; a self-link is a no-op the operator can click and not be surprised by — the TODO is the decision).
 2. `src/dashboards/web/pages/settings.html` — the masthead (lines 14–30): insert `<a class="ghost account" href="/settings" title="Session and password">⚙ Account</a>` between the `⚷ Certs` link and the theme toggle; the comment at lines 12–14 ("It is reached from the `⚙ Account` link in the masthead of every dashboard") gains the "including this one" sentence.
 3. `tests/test_api.py` — rewrite `test_every_page_links_to_both_admin_pages` (line 999): the two loops become **one** loop over all eight non-login pages (`*PAGES, SETTINGS_PAGE, CERTS_PAGE`) asserting both links are present, both before `id="theme-toggle"`, and `"/certs"` is not in the `.tabs` markup; the two `assert … not in … "links to itself"` lines are **deleted** (that was the old rule); add one explicit assertion that `login.html` carries **neither** link (the pre-auth surface renders brand + theme toggle only — that sentence in AGENTS.md stays true).
 4. `AGENTS.md` — (Documentation & Consistency pass) the phase-15 "neither admin page links to itself, which is why the pinned two-link audit loops over two different tuples" sentence and gap 12's "now questioned" item are resolved to the new state.
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the rewritten `test_every_page_links_to_both_admin_pages`, the unchanged `test_the_disks_tab_is_in_the_masthead_of_every_page` (line 3913 — the tab structure is untouched by this task)
 - Coverage: **>90%** on this task's new/modified code
 - Browser verification (invariant 10): signed in, click `⚷ Certs` on `/certs` (stays on `/certs`, no navigation loop) and `⚙ Account` on `/settings` (same) — screenshots of both pages' mastheads in `data/logs/`
 ## Completion Criteria
 - [ ] `/certs` renders `⚷ Certs` and `/settings` renders `⚙ Account`, both before the theme toggle and outside `.tabs`
 - [ ] all eight non-login pages render both admin links; `/login` renders neither
 - [ ] `tests/test_api.py` green with the rewritten test
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the tab strip, the `aria-current` absence on the admin pages, the clock and the theme toggle are untouched
@@ -0,0 +1,34 @@
 # Phase 21 — Page cleanups: pause, GPU values, certs scroll
 **Source:** `TODO.md` L7, L9, L12 — "remove the pause button, GPU data as its own values, /certs table horizontal scroll"
 **Story:** n/a
 **Context:** `src/dashboards/web/pages/{disks,llm,system,ups}.html` line 25 (the `#pause` button, the only one in the served markup — `/`, `/certs` and `/settings` have none), `src/dashboards/web/static/app.js` (lines 587–615 the `poll()` `_paused` plumbing, lines 773–783 the `#pause` binding plus the `Space` shortcut), `src/dashboards/web/static/dash.css` line 203 (the comment naming the pause button), `src/dashboards/web/static/page-system.js` (lines 150–156 `gpuSub()` — the dense sub-line the TODO quotes, lines 164–188 `renderGpuSlot()`, line 72 the `data-k="gpus"` hero slot), `tests/test_api.py` (line 1425 — the six-heroes pin: "exactly six heroes: CPU, MEM, TEMP, DISK, GPU, NET", asserted over the three captures: discrete GPU, APU, no-GPU), `src/dashboards/web/pages/certs.html` line 81 (`<table class="data" id="agents-table">` — no `.scroll` modifier; `dash.css` gives `table.data` a scroll container only with the `.scroll` class), `src/dashboards/web/static/page-certs.js` (lines 55–56 — the table element references)
 ## Objective
 Three small page-level cleanups, one per workstream: the pause button is gone from every page (the hidden-tab skip stays — a background tab idling its polls is not the operator's pause), the `/system` GPU data is split out of the dense sub-line into its own labelled values and a host with no GPU **omits** the slot instead of printing `n/a`, and the `/certs` agents table scrolls horizontally so the right-hand columns are reachable on a phone. No API surface changes; the pins that name the old behaviour (six heroes incl. an `n/a` GPU slot, the unpinned pause button) are rewritten, not left rotting.
 ## Dependencies
 - `20_masthead_nav_polish` (todo) — the pause button lives in the masthead row task 01.01 reflows, and the `/system` hero row is re-measured under the new bar; landing 20 first keeps 21's diff confined to the page bodies.
 ## Tasks
 1. `01_remove_pause_button.md` — delete the button, the `Space` shortcut, the `setPaused`/`_paused` plumbing and the CSS comment; the hidden-tab skip survives
 2. `02_gpu_own_values.md` — the dense `gpuSub()` line becomes four labelled values per card; a GPU-less host omits the slot (five heroes, no `n/a`)
 3. `03_certs_table_scroll.md` — `#agents-table` gets the `.scroll` modifier so its right-hand columns are reachable at phone width
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the served-page pins: the pause button absent from the four pages (a return of `#pause` fails a test), the six-heroes pin rewritten (GPU-present host: six, GPU-absent host: five with no `data-k="gpus"` slot), the `#agents-table` `.scroll` pin; `tests/test_system_contract.py` + `tests/card_contract.py` stay green (the API fields are unchanged — only the page's reading of them moves)
 - Coverage: **>90%** on new/modified code (the phase is markup + JS + CSS; the gate applies to the changed Python test files)
 - The phase is "Complete" only when the **entire** project test suite passes 100% (every test in the project, not just this phase's)
 ## Documentation & Consistency
 - The final pass reviews `README.md` and `AGENTS.md` in full against the project as it stands after this phase — fixing every inconsistency found, **including pre-existing ones not caused by this phase**. AGENTS.md's `/system` paragraph ("a missing number or verdict — gateway's CPU temp, any host's absent GPU — prints `n/a` **uncoloured**") is the one rule this phase inverts for the GPU slot (the CPU-temp `n/a` stays — the TODO quotes the GPU line only); the sentence is split, the GPU half rewritten to the omission rule, and the pause button's mention in the masthead comment dropped.
 ## Completion Criteria
 - [ ] no page serves a `#pause` button or binds the `Space` key; a hidden tab still skips its polls (served-bytes pin + a CDP `visibilitychange` check)
 - [ ] `/system`'s GPU slot prints model / VRAM / pool / temp as four labelled values; a GPU-less host (the no-GPU capture, gateway) renders five heroes with no GPU slot and no `n/a` in it (screenshots in `data/logs/`)
 - [ ] at 360 px the `/certs` agents table scrolls horizontally to its last column (screenshot in `data/logs/`)
 - [ ] `uv run pytest` green, coverage not down, `ruff` + `pyright` clean
 - [ ] `bash .agents/validate.sh` green (including `node --check` of the modified page scripts)
 - [ ] no behavior change in completed work: the six-hero order on GPU hosts, the hidden-tab skip, the GPU history charts, the `/certs` row contents and the event pager are all unchanged
@@ -0,0 +1,27 @@
 # Task 01 — Remove the pause button
 **Phase:** `21_page_cleanups` · **Source:** `TODO.md:7` — "Completely remove the pause button"
 **Story:** n/a
 ## Objective
 The `⏸ Pause` control is gone from the served markup, the page scripts and the shared poller: no button, no `Space`-key shortcut, no `setPaused`/`_paused` plumbing. The **hidden-tab** behaviour survives — `document.hidden` still skips a poll while the tab is backgrounded and `visibilitychange` still fires one on return; that is idle hygiene, not the operator's pause, and the TODO names the button only.
 ## Work
 1. `src/dashboards/web/pages/disks.html`, `src/dashboards/web/pages/llm.html`, `src/dashboards/web/pages/system.html`, `src/dashboards/web/pages/ups.html` — delete the line-25 `<button class="ghost" id="pause" type="button" aria-pressed="false">⏸ Pause</button>` from each of the four (the only served occurrences — `/`, `/certs`, `/settings`, `/login` have none; a grep of `web/pages` for `pause` must come back empty when done).
 2. `src/dashboards/web/static/app.js` — delete the `#pause` binding block (lines 773–783: the button lookup, the `aria-pressed` paint, the click handler, and the `keydown` `Space` handler with its `event.preventDefault()`); in `poll()` (lines 587–615) delete the `_paused` state, `setPaused()`, the `paused` getter and the `state._paused` checks in `tick()`/`schedule()`/`visibilitychange` — the `document.hidden` guard and the `visibilitychange` refire stay, minus the `&& !state._paused` clause; the docstring at line 587 ("pausing when the tab is hidden or the user hit pause") drops the pause half.
 3. `src/dashboards/web/static/dash.css` — line 203's comment (which lists "status dots, pause, `⚷ Certs`, `⚙ Account`, theme" as the 360 px wrap's tenants) drops the pause mention.
 4. `tests/test_api.py` — add the served-bytes pin: `id="pause"` is **absent** from all eight served pages (a return of the button fails a test) and `⏸` appears nowhere in the served scripts.
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the absence pin above; the existing poller tests (the `Dash.poll` hidden-tab behaviour, if any pin it — grep `hidden` in the test files first) stay green
 - Coverage: **>90%** on this task's new/modified code
 - Browser verification (invariant 10): `/` and `/system` — no pause control in the masthead, the `Space` key does nothing on the page body; hide the tab (CDP `Emulation.setDocumentHidden` or the window manager) and confirm the poll loop idles, then refire on return (the phase-18 verification script pattern)
 ## Completion Criteria
 - [ ] `grep -ri pause src/dashboards/web/` comes back empty (code, markup and comments all clean)
 - [ ] a hidden tab skips polls and a visible tab fires one on return (verified, not deduced)
 - [ ] `tests/test_api.py` green including the new absence pin
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the range chips, the event pagers, the status dots and every other masthead control behave exactly as before
@@ -0,0 +1,29 @@
 # Task 02 — GPU data as its own values; GPU-less hosts omit the slot
 **Phase:** `21_page_cleanups` · **Source:** `TODO.md:12` — "The GPU data is wrapped poorly - Radeon 8060S Graphics · VRAM 180.2 MiB / 512.0 MiB · pool 79% · 69 °C is too much info for such small text and should be its own values. Boxes without a GPU should not report N/A but instead should omit these values."
 **Story:** n/a
 ## Objective
 The `/system` hero card's GPU slot stops stuffing model · VRAM · pool · temp into one small sub-line: each becomes its own labelled value on the card, at a readable size. A host with no GPU (gateway, the no-GPU capture) no longer renders an `n/a` hero slot — the slot is **omitted** and the hero row simply has five. The API is untouched: `gpus[]` keeps every field (`model`, `vram_used_bytes`, `vram_total_bytes`, `mem_used_pct`, `temp_c`), and the per-card history (`gpu.busy_pct@N`, `gpu.temp_c@N`) and the collapsed GPU chart are unchanged.
 ## Work
 1. `src/dashboards/web/static/page-system.js` — replace `gpuSub()` (lines 150–156) with a `gpuValues(gpu)` that renders four labelled cells — **Model** (mono, the `gpu.model` string), **VRAM** (`used / total` via the existing `bytes()` formatter, `n/a` if either side is absent), **Pool** (`mem_used_pct` %), **°C** (`temp_c`) — laid out as a compact `.gpu-values` grid under the busy hero (the hero itself keeps only the `busy_pct` number + its label; colour rules stay: the GPU is uncoloured, phase 06's "a busy GPU is the job" rule — no severity token, no bar). A missing field on a **present** card prints `n/a` in its own cell (rule 2: the field is absent, the card is real); a `null` verdict cell draws faint, the existing `Dash.hero` convention.
 2. `src/dashboards/web/static/page-system.js` — `renderGpuSlot()` (lines 164–188): when `gpus` is empty, do **not** render the slot's fallback `n/a` content — render nothing (empty the slot's container and drop its hero styling so the row reflows to five heroes; the `data-k="gpus"` wrapper can stay as an empty, zero-footprint element or be removed — pick one and pin it). The multi-GPU case: one value grid per card, the cards' `GPU i` labels unchanged.
 3. `src/dashboards/web/static/dash.css` — the `.gpu-values` grid: a compact 2×2 (or 4×1 on wide) of labelled cells reusing the existing token vocabulary (`.metric`/`.faint`/`.mono` shapes, no new palette — the app's colour rule), sized so a 20-character model string wraps rather than truncates.
 4. `tests/test_api.py` — rewrite the six-heroes pin (line 1425): a host whose snapshot carries `gpus` still renders exactly six slots **in the existing order** (CPU, MEM, TEMP, DISK, GPU, NET); a host with no GPU renders exactly five with **no** `data-k="gpus"` slot (or the pinned empty variant) and no `n/a` in the hero row; the `gpu-values` cells (Model / VRAM / Pool / °C) are present in the served script. `tests/test_system_contract.py` and `tests/card_contract.py` stay green untouched (API fields unchanged).
 5. `AGENTS.md` — (Documentation & Consistency pass) the `/system` paragraph's "a missing number or verdict — gateway's CPU temp, any host's absent GPU — prints `n/a` **uncoloured**" is split: the CPU-temp half keeps the `n/a` rule, the GPU half becomes the omission rule (the TODO is the decision), and the dense-sub-line description of the GPU slot is rewritten to the four-value layout.
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the rewritten hero pin over the three captures (discrete GPU, APU, no-GPU) **and** over HTTP (the `self_test`-style app harness the contract tests use); `tests/test_system_contract.py` + `tests/card_contract.py` green untouched
 - Coverage: **>90%** on this task's new/modified code
 - Browser verification (invariant 10): `/system` against the live fleet — deskwork's Strix Halo card shows the four values at readable size (the TODO's quoted string is gone from the sub-line), gateway's card shows five heroes with no GPU slot and no `n/a`; the collapsed GPU charts still draw for the GPU hosts; screenshots in `data/logs/`
 ## Completion Criteria
 - [ ] a GPU host's card shows Model / VRAM / Pool / °C as four labelled values; the dense sub-line string from the TODO is gone
 - [ ] a GPU-less host renders five heroes with no GPU slot and no `n/a` in the hero row (served-bytes pin + screenshot)
 - [ ] the GPU slot stays uncoloured (no `ok|warn|fail` token in the new markup — the phase-06 rule)
 - [ ] `tests/test_api.py` + `tests/test_system_contract.py` + `tests/card_contract.py` green
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the hero order on GPU hosts, the `gpu.busy_pct@N` history, the GPU chart slot create/destroy and the "More detail" disclosure are untouched
@@ -0,0 +1,27 @@
 # Task 03 — The `/certs` agents table scrolls horizontally
 **Phase:** `21_page_cleanups` · **Source:** `TODO.md:9` — "In the certs page I can't horizontal scroll in the agents table to see the certs installed on the hosts."
 **Story:** n/a
 ## Objective
 The `#agents-table` on `/certs` becomes horizontally reachable at phone width: its right-hand columns (the serial, expiry, `san` list and the Rotate / Revoke / bundle controls) are reachable by scrolling instead of being clipped. The repo's own mechanism is the `.scroll` modifier — `dash.css` gives `table.data` a scroll container **only** with that class (the same rule gap 12 measured on `/`'s fleet table), so this is the class, not a second mechanism. Row contents, the `COLUMNS` contract and every served pin are unchanged.
 ## Work
 1. `src/dashboards/web/pages/certs.html` — line 81: `<table class="data" id="agents-table">` gains the `scroll` modifier (`class="data scroll"`), or is wrapped in `<div class="scroll">` — check which form `dash.css`'s selector actually matches (grep `\.scroll` in the file first; use the one it styles, do not invent a third).
 2. `src/dashboards/web/static/dash.css` — if the `.scroll` selector matches `table.data.scroll`, nothing to add; if it matches a `div.scroll > table.data` wrapper, verify the wrapper's max-height/overflow behaviour against the card's padding so the scroll container does not clip the row's own bottom border (measure in a browser, do not deduce). No new token, no new palette.
 3. `tests/test_api.py` — the served-HTML pin: `#agents-table` (or its wrapper, whichever shipped) carries the `.scroll` mechanism in the served bytes; the `COLUMNS`-resolution test (the one that reads the served `COLUMNS` table against a live `GET /api/certs` row in both directions) stays green untouched.
 4. `src/dashboards/web/static/page-certs.js` — lines 55–56 (`table`/`body` lookups): no change expected — the id and the `tbody` selector are untouched by the wrapper/class; verify the page still renders its rows (a wrapper that breaks `getElementById('agents-table')` would be caught by the existing render path).
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the pin above; the unchanged `COLUMNS` contract test
 - Coverage: **>90%** on this task's new/modified code (one class / one wrapper; the gate applies to the changed test file)
 - Browser verification (invariant 10): at 360 px on `/certs`, the table's scroll container is reachable — a CDP check that the container's `scrollWidth > clientWidth` and that scrolling to the end exposes the last column (the controls column), plus a screenshot mid-scroll in `data/logs/`; at 1280 px the table renders as before (no scrollbar on a wide viewport with three short rows)
 ## Completion Criteria
 - [ ] at 360 px the `#agents-table` scrolls horizontally and its last column is reachable (screenshot in `data/logs/`)
 - [ ] at 1280 px the table is visually unchanged
 - [ ] `tests/test_api.py` green including the new pin and the unchanged `COLUMNS` test
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the row contents, the status chips, the Rotate / Revoke / bundle controls and the `restart_required` outcome line behave exactly as before
@@ -0,0 +1,32 @@
 # Phase 22 — /disks hides hosts without smartctl
 **Source:** `TODO.md` L13 — "VMs that don't have smartctl enabled disks should not show up. Gateway shouldn't even be a host on the disks page."
 **Story:** n/a
 **Context:** `src/dashboards/api.py` (`disks_router()` at line 791 — `/api/disks/snapshot` answering one entry per configured host; the `/api/summary` disks block at lines 640–704 — `disks_hosts` built from `job.state.payload or _disks_stub(...)` at line 640, `fleet_disk_summary(disks_hosts)` at line 693; `_disks_stub()` at line 771 — `smartctl_available: None` for a never-answered host), `src/dashboards/sources/disks.py` (`smartctl_available()` at line 142 — the three-way flag: `True` a disk answered, `False` the agent said the binary is not installed, `None` an agent predating the pass or `--no-smart`), `src/dashboards/web/static/page-disks.js` (the per-host cards + the `fleet_disk_summary` header, hidden below two hosts), `tests/test_api.py` (the `/api/disks/*` pins — "one entry per configured host", the `smartctl_available` three-way, "with and without targets configured", the `fleet_disk_summary` key paths)
 ## Objective
 A host whose agent answered `smartctl_available: false` (the binary is not installed — gateway's VM, no smartmontools behind `vda`) is not a host on the `/disks` page at all: it is absent from `/api/disks/snapshot`, from the fleet block and from `/api/summary`'s disks rows, and the fleet header counts only the hosts that are shown. The **three-way** flag itself is unchanged in `sources/disks.py` (the agent still reports it, the `/disks` page's `null`-case why-line still exists for `None` hosts, and an **unreachable** host keeps its dimmed stub row — a dead agent is a different fact from a missing binary, invariant 3). The filter is one API-level decision, so the source, the store and the health records see nothing new.
 ## Dependencies
 - `21_page_cleanups` (todo) — both phases touch the `/disks` page markup (task 21.01 removes the page's `#pause` button); landing 21 first keeps this phase's diff confined to the host list.
 ## Tasks
 1. `01_hide_smartctl_false_hosts.md` — the one API-level visibility gate (explicit `False` only) over `/api/disks/snapshot`, `/api/summary`'s disks block and the fleet summary; the pins rewritten
 2. `02_verification.md` — browser + API verification against the live fleet: gateway absent, deskwork/driveripper intact, fleet header consistent, screenshots
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the rewritten `/api/disks/snapshot` pin (one entry per configured host **whose agent can read its drives** — a `smartctl_available: false` payload is absent, a `None` payload is present, an `unreachable` stub is present), the `/api/summary` disks-block pin (fleet counts over the visible hosts, per-host rows for the visible hosts only), the unchanged `smartctl_available` three-way pin in `sources/disks.py`'s own tests (`tests/test_disks.py` or wherever the flag is pinned — grep `smartctl_available` in `tests/` first)
 - Coverage: **>90%** on new/modified code
 - The phase is "Complete" only when the **entire** project test suite passes 100% (every test in the project, not just this phase's)
 ## Documentation & Consistency
 - The final pass reviews `README.md` and `AGENTS.md` in full against the project as it stands after this phase — fixing every inconsistency found, **including pre-existing ones not caused by this phase**. AGENTS.md's `sources/disks.py` bullet (the three-way flag's `False` arm — "so the page can say *install smartmontools*") and the `/disks` UI paragraph (the `.banner.info` why-line for `false`) are rewritten: the `false` arm's page-side consequence is now *absence*, and the three-way flag keeps its agent-side meaning; the "gateway answers `smartctl_available: false`" fleet fact gains the "and is therefore not a host on the disks page" clause.
 ## Completion Criteria
 - [ ] `/api/disks/snapshot` and `/api/summary`'s disks block carry no entry for a host whose agent answered `smartctl_available: false`; a `None` host and an `unreachable` stub both remain (pinned both ways in `tests/test_api.py`)
 - [ ] the `/disks` page on the live fleet shows deskwork + driveripper only, the fleet header counts 2 hosts, and the per-host cards are unchanged (screenshot in `data/logs/`)
 - [ ] `uv run pytest` green, coverage not down, `ruff` + `pyright` clean
 - [ ] `bash .agents/validate.sh` green
 - [ ] no behavior change in completed work: the agent's SMART pass, the `disks:<host>` job's health record, the stored `disk.*` series, the `None`-case why-line and the unreachable stub are all untouched
@@ -0,0 +1,30 @@
 # Task 01 — The one visibility gate: `smartctl_available` is `False` only
 **Phase:** `22_disks_hide_unconfigured` · **Source:** `TODO.md:13` — "VMs that don't have smartctl enabled disks should not show up. Gateway shouldn't even be a host on the disks page."
 **Story:** n/a
 ## Objective
 One API-level helper decides disk-page visibility: a host entry is shown when its payload's `smartctl_available` is **not explicitly `False`** — `True` (a disk answered) and `None` (nobody knows: an agent predating the pass, `--no-smart`, or a never-answered stub) stay, `False` (the agent said the binary is not installed) does not. The gate runs over the assembled per-host list in both endpoints, so `fleet_disk_summary()` (which sums whatever it is handed) sees only the visible hosts and its `hosts_total`/`hosts_live` count exactly the page's rows. `sources/disks.py` keeps the three-way flag verbatim — the agent still reports it and the `None`-case why-line still renders.
 - ASSUMPTION: **explicit `False` only** is the hide condition. `None` stays visible (an agent that cannot say is not an agent that said *no* — the three-way flag's whole point), and an `unreachable` stub stays visible (invariant 3's rule: a dead agent must not read as "never configured"; its `smartctl_available` is `None` by `_disks_stub`'s shape anyway). The operator's words — "don't have smartctl **enabled**" / "shouldn't **even be a host**" — are the `false` arm; if a `None` host should also vanish, that is a one-clause change to the helper, not a redesign.
 ## Work
 1. `src/dashboards/api.py` — add one small helper next to `_disks_stub` (line 771): `_disk_visible(host: Mapping) -> bool` — `host.get("smartctl_available") is not False` (the explicit-`False` check, spelled out so a `None` payload passes; a docstring naming the three arms).
 2. `src/dashboards/api.py` — `/api/disks/snapshot` (in `disks_router()`, line 791): filter the assembled per-host list through `_disk_visible` before the response is built (the response shape is unchanged — a shorter list, same entry shape).
 3. `src/dashboards/api.py` — the `/api/summary` disks block (lines 640–704): `disks_hosts` (line 640) is filtered through the same helper **before** `fleet_disk_summary(disks_hosts)` (line 693) and before the per-host row loop (lines 695–704), so the fleet counts and the rows agree with `/api/disks/snapshot` by construction — one helper, two call sites, no second copy of the predicate.
 4. `tests/test_api.py` — rewrite the affected pins: the `/api/disks/snapshot` "one entry per configured host" test gains a `smartctl_available: false` host (a `disks:<host>` job whose payload the test harness holds, the `self_test`-style swap the `nut` job's pin uses) and asserts it is **absent** while a `None` host and an `unreachable` stub are **present**; the `/api/summary` disks-block pin asserts the fleet counts over the visible hosts only (e.g. three configured hosts, one `false` → `hosts_total: 2`); the "without targets configured" leg stays green untouched.
 5. `tests/` — locate the `smartctl_available` three-way pin (grep `smartctl_available` in `tests/`; `tests/test_disks.py` or the agent/disks source tests) and confirm it is **untouched** by this change (the flag's computation is unchanged; only the API's reading of it gained a gate).
 ## Testing & Quality
 - Unit/integration: `tests/test_api.py` — the pins above, both directions (a `false` host absent from **both** endpoints; a `None`/`unreachable` host present in both); the unchanged `fleet_disk_summary` unit tests in `tests/` (the function is untouched — it sums what it is handed)
 - Coverage: **>90%** on this task's new/modified code
 ## Completion Criteria
 - [ ] `/api/disks/snapshot` and `/api/summary` agree on the visible host set, and neither lists a `smartctl_available: false` host (pinned)
 - [ ] a `None` host and an `unreachable` stub both render in both endpoints (pinned)
 - [ ] `fleet_disk_summary` counts exactly the visible hosts (pinned)
 - [ ] `uv run pytest` green, `ruff` + `pyright` clean
 - [ ] full test suite green
 - [ ] no behavior change in completed work: `sources/disks.py`, the `disks:<host>` job, the stored `disk.*` series and the health records are byte-identical in behaviour
@@ -0,0 +1,25 @@
 # Task 02 — Live verification: gateway gone, the rest intact
 **Phase:** `22_disks_hide_unconfigured` · **Source:** `TODO.md:13` — "VMs that don't have smartctl enabled disks should not show up. Gateway shouldn't even be a host on the disks page."
 **Story:** n/a
 ## Objective
 The gate is proven on the live fleet, read-only: the dev server (invariant 10: `./scripts/dev-server.sh restart`, sign in with `testpass`) answers `/api/health` with all nine sources `ok`, the `/disks` page shows deskwork and driveripper only, and every number that used to render still renders. No fleet change is made — this task dials the fleet and screenshots it.
 ## Work
 1. `./scripts/dev-server.sh restart` — the dev server up on http://127.0.0.1:8090; `./scripts/dev-server.sh status` — the nine-source table: `host:driveripper`, `host:deskwork`, `host:gateway`, `disks:driveripper`, `disks:deskwork`, `disks:gateway`, `nut`, `llm:gufo`, `llm:vllm` all `ok` (gateway's **agent** still answers — the job is `ok`; only the *page* hides it, which is the point: the `disks:gateway` health record must not be touched by the API filter, and `status` is the proof).
 2. Signed-in `GET /api/disks/snapshot`: no `gateway` entry, `deskwork` and `driveripper` present with their `smartctl_available: true` payloads; `GET /api/summary`: the disks block's `hosts_total` is 2, the per-host rows are the two, and the `system` block still lists all three hosts (the filter is `/disks`-scoped only — a `system` host list that lost gateway would be the over-reach the pin must catch).
 3. Browser on `/disks` (invariant 10): the fleet header reads the two-host sum; gateway has no card and no why-line; deskwork's `nvme0n1` and driveripper's 16 drives render exactly as before the phase (the live SMART numbers from the fleet record); a screenshot in `data/logs/`.
 4. The `None`-arm check: no live host is currently `None` (all three agents post-date the SMART pass), so the `None` arm is proven by the task-01 pins only — state that in the notes rather than fabricating a live case.
 ## Testing & Quality
 - Coverage: n/a (verification task; the gate's coverage is task 01's)
 - The read-only rule: no `POST` to the fleet, no `upsd` command, no unit change — a live test that writes is not a test (AGENTS.md testing policy)
 ## Completion Criteria
 - [ ] `./scripts/dev-server.sh status` — nine sources `ok`, including `disks:gateway` (the job is healthy; only the page hides it)
 - [ ] `/api/disks/snapshot` has no gateway entry; `/api/summary`'s system block still lists gateway (screenshot or transcript in `data/logs/`)
 - [ ] the `/disks` page shows the two live hosts with their pre-phase numbers (screenshot in `data/logs/`)
 - [ ] the full suite + `bash .agents/validate.sh` green
@@ -0,0 +1,34 @@
 # Phase 23 — LLM rate responsiveness
 **Source:** `TODO.md` L8 — "The LLM monitor has a strange delay and a 'ramp up/ramp down' effect that makes it look innacurate. Data reporting should be accurate to as small a delta as possible."
 **Story:** n/a
 **Context:** `src/dashboards/app.py` line 122 (`build_hub` builds **one** `RateEstimator(span=settings.rate_window)` and hands it to both `host_jobs` (line 124) and `llm_jobs` (line 130)), `src/dashboards/config.py` lines 197–199 (`llm_interval` 2 s, `llm_timeout` 3 s, `rate_window` 10 s), `src/dashboards/collectors.py` line 477 (`llm_jobs(settings, client, rates)` — the estimator is a parameter, so a second one is a wiring change, not a signature redesign), `src/dashboards/rates.py` (line 55 `MIN_WINDOW_SECONDS = 0.5`, line 61 `MAX_WINDOW_RATIO = 2.0`, the phase-13 jump gate — all untouched by this phase), `src/dashboards/web/static/page-llm.js` (line 39 `pollMs: 2000`, the `Δ<window>` labels printed from the payload's `window`), `src/dashboards/sources/llm.py` (the rate cells carry `computed:Δ<series>/Δt` + the honest `Δ<window>`; the window the estimator *used* travels with the value — rule 2), the mechanism the TODO describes (gap 9 / phase 13 in AGENTS.md: a 10 s window over a 2 s poll ramped the hero up over ~5 polls when a slot started and decayed over ~5 polls when it ended — the "ramp up/ramp down" the operator sees; the sub-8× skew family and the stall are **already** closed by phases 13/14 and stay closed: this phase changes the window size, nothing else)
 ## Objective
 The LLM throughput rates are measured over a window as small as the app's own cadence allows — the LLM source gets its **own** `RateEstimator` whose span is the LLM poll interval (2 s), so a slot start reads steady within two polls instead of ramping over ten, while the `host` source keeps the 10 s `RATE_WINDOW_SECONDS` window its 10 s cadence needs (a 2 s window over a 10 s poll would refuse every window — the estimator's floor and ceiling would answer `n/a` forever). The phase-13 protections (the 0.5 s floor, the `2 × span` ceiling, the 8× jump gate with its independent-anchor confirmation) apply to the smaller window unchanged; the `Δ<window>` label prints the smaller window it actually used, so the number always says what it is.
 ## Dependencies
 - — (none) — the phase touches `app.py`/`collectors.py` wiring and the LLM page; it is scheduled after `22_disks_hide_unconfigured` only to keep the fleet-changing phase 24 last.
 ## Tasks
 1. `01_llm_window_per_poll.md` — the second estimator: `build_hub` hands `llm_jobs` a `RateEstimator(span=settings.llm_interval)`, the host keeps the 10 s one
 2. `02_window_pins.md` — the pins: LLM rate cells label the 2 s window, host cells keep 10 s, the phase-13 gates still hold over the smaller window
 3. `03_live_verification.md` — the live proof: a slot start reads steady within two polls (no 10 s ramp), the `Δ2.0s` label travels with the value, screenshots
 ## Testing & Quality
 - Unit/integration: `tests/test_llm.py` (or wherever the `parse_gufo_metrics`/`parse_vllm_metrics` tests live — grep `rate_window`/`RateEstimator` in `tests/` first) — the window-value pins for both sources, the phase-13 tests (floor refusal, ceiling, jump gate, the stale-anchor tests) run **unchanged** and green; `tests/test_api.py`'s `/api/llm/snapshot` shape pins stay green (the shape is unchanged — only the `window` values move)
 - Coverage: **>90%** on new/modified code
 - The phase is "Complete" only when the **entire** project test suite passes 100% (every test in the project, not just this phase's)
 ## Documentation & Consistency
 - The final pass reviews `README.md` and `AGENTS.md` in full against the project as it stands after this phase — fixing every inconsistency found, **including pre-existing ones not caused by this phase**. AGENTS.md's `app.py`/`poller.py` bullets (the "one `RateEstimator`" sentence) and `rates.py`'s docstring context gain the two-estimator fact; gap 9's "the estimator no longer turns a slow fetch into 0.2 s arithmetic" history stays — this phase is the window-size decision on top of it, and the `RATE_WINDOW_SECONDS=10` line in `.env.example` stays (it is the host's knob now, and gains a comment saying so if it has none).
 ## Completion Criteria
 - [ ] `/api/llm/snapshot` rate cells carry a `window` ≈ 2 s (the label prints `Δ2.0s` on the page) and `/api/system/snapshot` rate cells keep ≈ 10 s (pinned both ways)
 - [ ] the phase-13 tests (floor, ceiling, jump gate, stale anchor) pass unchanged
 - [ ] live: a slot start reads steady within two polls and a slot end decays within two — the 10 s ramp is gone (screenshots + the stored 1 m rollup in `data/logs/`)
 - [ ] `uv run pytest` green, coverage not down, `ruff` + `pyright` clean
 - [ ] `bash .agents/validate.sh` green
 - [ ] no behavior change in completed work: the host rates, the estimator's gates, the rollups and the `Δ<window>` labelling are all unchanged in kind
@@ -0,0 +1,28 @@
 # Task 01 — The LLM source gets its own 2 s-window estimator
 **Phase:** `23_llm_rate_responsiveness` · **Source:** `TODO.md:8` — "The LLM monitor has a strange delay and a 'ramp up/ramp down' effect that makes it look innacurate. Data reporting should be accurate to as small a delta as possible."
 **Story:** n/a
 ## Objective
 `build_hub` builds **two** estimators: the host's keeps `RateEstimator(span=settings.rate_window)` (10 s — its 10 s cadence needs the wide window; a 2 s span over a 10 s poll would sit the window-empty fallback against the `2 × span` ceiling and answer `n/a` every poll), and the LLM's is `RateEstimator(span=settings.llm_interval)` (2 s — one poll interval: the smallest window the 2 s cadence can honestly fill). `llm_jobs` (which already takes the estimator as a parameter, `collectors.py` line 477) receives the LLM one; `HostCollector` keeps the 10 s one. No new env var: the LLM window **tracks** `LLM_INTERVAL_SECONDS`, so the one existing knob stays the single source of truth for the LLM cadence-and-window pair.
 - ASSUMPTION: **no new env var** — `RATE_WINDOW_SECONDS` (10, `.env.example` line 85) becomes the host's knob and the LLM window is `llm_interval` by construction. A 2 s window is 4× above the 0.5 s `MIN_WINDOW_SECONDS` floor, so the floor never engages on a healthy cadence; the 8× jump gate stays engaged (a real burst from idle still holds one poll for confirmation), and the poll cadence itself is **unchanged** — gufo and vLLM see exactly the same request rate as before (the TODO asks for a smaller *delta*, not more load on the engines).
 ## Work
 1. `src/dashboards/app.py` — `build_hub` (lines 122–130): `rates` becomes `host_rates = RateEstimator(span=settings.rate_window)`; new `llm_rates = RateEstimator(span=settings.llm_interval)`; `host_jobs(..., HostCollector(host_rates), ...)` unchanged in shape; `llm_jobs(settings, client, llm_rates)` takes the new one. The two estimators are keyed on disjoint series names (rule 2's key is the resolved name + label set), so one shared object was never load-bearing — but the docstring/comment at line 122 (if it says "one estimator for all sources") is rewritten to the two-estimator shape.
 2. `src/dashboards/collectors.py` — line 477: no signature change expected (the parameter is already there); verify the LLM jobs thread `rates` through to `parse_gufo_metrics`/`parse_vllm_metrics` (they already take it, `sources/llm.py` lines 189/243) — if any LLM path constructs its own estimator, it takes the injected one (one estimator per source, the phase's invariant).
 3. `src/dashboards/config.py` — no change expected (the knobs exist); if a comment on `rate_window` (line 199) implies it is the one global knob, it gains the "host's knob; the LLM window is `llm_interval`" clause.
 4. `tests/` — the `build_hub`-level test (grep `build_hub` in `tests/` — the `tests/test_api.py` wiring pins) gains one assertion pair: the estimator the LLM jobs receive has `span == settings.llm_interval` and the host collector's has `span == settings.rate_window` (spy the two objects, the way the `agent_tls_map` pin spies its entry).
 ## Testing & Quality
 - Unit/integration: the wiring pin above; the existing LLM parse tests (fixture-driven, `tests/fixtures/`) run with the injected estimator — their assertions on the `window` value, if any hard-code 10.0, are updated to the new 2.0 (grep `10.0`/`window` in `tests/test_llm.py` first); the host parse tests keep 10.0
 - Coverage: **>90%** on this task's new/modified code
 ## Completion Criteria
 - [ ] `build_hub` hands the LLM jobs a 2 s-span estimator and the host a 10 s-span one (pinned by the spy)
 - [ ] the fixture-driven LLM tests pass with the 2 s window; the host tests keep 10 s
 - [ ] `uv run pytest` green, `ruff` + `pyright` clean
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the host's measured rates, the estimator's gates and the engines' poll cadence are untouched
@@ -0,0 +1,27 @@
 # Task 02 — The pins: 2 s LLM window, 10 s host window, gates intact
 **Phase:** `23_llm_rate_responsiveness` · **Source:** `TODO.md:8` — "…Data reporting should be accurate to as small a delta as possible."
 **Story:** n/a
 ## Objective
 The window decision is pinned on the surface that shows it, in both directions (the repo's testing-policy rule): a LLM rate cell answers its `window` ≈ the LLM interval with the `Δ<window>` label traveling with the value, a host rate cell keeps ≈ 10 s, and the phase-13 gate tests — the 0.5 s floor refusal, the `2 × span` ceiling, the 8× jump hold with its independent-anchor confirmation, and the stale-scrape-body regression — run **unchanged** and green, because they are estimator properties, not window-size properties.
 ## Work
 1. `tests/test_llm.py` (or the file the LLM parse tests live in — grep first) — the two window pins: (a) a gufo metrics scrape driven through `parse_gufo_metrics` with a `RateEstimator(span=2.0)` (the `build_hub` shape, task 01's) answers the rate cell with a `window` in `(0.5, 2.0]` on a healthy 2 s cadence and the cell's `source` string still reads `computed:Δ<series>/Δt`; (b) the same test shape with `span=10.0` on the host's series (or the existing host fixture tests) keeps its `window` ≈ 10 s — the two sources' windows are **different numbers in the same payload shape**, and a pin that asserts only one of them is the gap this task closes.
 2. `tests/test_rates.py` (or wherever the phase-13 tests live) — run them unchanged: the floor test (a sub-0.5 s window answers `(None, dt)`), the ceiling test (`2 × span`), the jump-gate test (≥8× holds one poll, publishes on a *different-anchor* confirmation) and the two stale-body regression tests. If a test constructs its estimator with an explicit `span` that now disagrees with the app's shape, it is **not** edited to match — the estimator's constants are app-independent and the tests' own spans are theirs (the app's shape is task 01's pin's job).
 3. `tests/test_api.py` — the `/api/llm/snapshot` shape pins stay green (the shape is unchanged; only `window` values move). If a pin hard-codes a `window` number in the LLM payload, it is the one place it is updated — to a range assertion (`0.5 < window <= 2.0 × llm_interval`), not a literal, so a future cadence change does not rot it.
 4. `tests/test_config.py` — confirm `rate_window`'s pin (the 10 s default) stays; no new setting was added, so no new pin is needed (the "no new env var" ASSUMPTION is what the absence of a new setting is).
 ## Testing & Quality
 - Unit/integration: the four pin groups above
 - Coverage: **>90%** on this task's new/modified code
 ## Completion Criteria
 - [ ] a LLM rate cell's `window` is pinned to the 2 s shape and its label prints `Δ2.0s` (or the honest sub-window when the floor engages)
 - [ ] a host rate cell's `window` is pinned to the 10 s shape
 - [ ] the phase-13 gate tests pass unchanged
 - [ ] `uv run pytest` green, `ruff` + `pyright` clean
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the payload shapes, the `source` strings and the estimator constants are untouched
@@ -0,0 +1,27 @@
 # Task 03 — Live verification: the ramp is gone
 **Phase:** `23_llm_rate_responsiveness` · **Source:** `TODO.md:8` — "The LLM monitor has a strange delay and a 'ramp up/ramp down' effect that makes it look innacurate."
 **Story:** n/a
 ## Objective
 The smaller window is proven on the live engines, read-only: with the dev server up (invariant 10) and a decode workload running on the engines, the `/llm` hero reaches steady state within **two** polls of the slot starting (pre-phase it ramped over ~five) and decays within two of it ending, every value carrying its `Δ2.0s` label, and the stored 1 m rollups staying in the fleet's measured band (gap 9's pass line: anything above ~300 tok/s is arithmetic, not work). No engine is written to — the workload is whatever the operator's engines are doing, or a deliberately short local decode the operator starts; a live test that loads a shared engine is not a test.
 ## Work
 1. `./scripts/dev-server.sh restart`, sign in with `testpass`; `./scripts/dev-server.sh status` — the nine-source table `ok` (a restart also proves the two-estimator wiring survives a real boot, not just the in-memory test store).
 2. Signed-in polling of `/api/llm/snapshot` at 2 s (a short script, the `scripts/watch-store-perf.py` pattern): capture the decode tok/s cell's `value` + `window` for ~60 s while a slot is busy, then again for ~30 s after it frees. The pass shape: within two polls of the transition the value is within 8× of steady (the jump gate's own ratio — a held value is the designed behaviour, and a *confirmation* within the next poll is the honest publish; a value still ramping at poll 5 is the pre-phase defect returning).
 3. The `Δ` label check (gap 9's rule, restated): **zero** values printed without their `Δ<window>` label; the label reads the window actually used (`Δ2.0s` on a healthy cadence, the honest sub-window — never a bare number — when the floor or the stall engages).
 4. The stored-rollup check (the phase-14 rule): the 1 m rollups of `llm.decode_tokens_per_second` for the window under test top out in the fleet's measured band (gap 9: 119.9 gufo / 171.7 vLLM were the real maxima; the 300 tok/s pass line stands) — a 1 m average set by a ramp would be the arithmetic this phase exists to remove.
 5. Screenshots of `/llm` mid-burst and post-free in `data/logs/` (invariant 10), plus the captured series as a TSV beside them (the `data/logs/llm-decode-*.tsv` precedent).
 ## Testing & Quality
 - Coverage: n/a (verification task; the pins are task 02's)
 - The read-only rule: no `POST` to the fleet, no `upsd` command, no engine write — observing a workload the engines are already doing is the test
 ## Completion Criteria
 - [ ] a slot start reads steady (within 8× of steady) within two polls, and a slot end decays within two — the 10 s ramp is gone (captured series in `data/logs/`)
 - [ ] zero values printed without their `Δ<window>` label, the label reading the window actually used
 - [ ] the 1 m rollups stay in the measured band (nothing above the 300 tok/s pass line)
 - [ ] screenshots in `data/logs/`
 - [ ] the full suite + `bash .agents/validate.sh` green
@@ -0,0 +1,36 @@
 # Phase 24 — Dev mTLS: no non-mTLS agent, ever
 **Source:** `TODO.md` L3 — "The client should never allow non-mtls communication. deskwork and gateway are still non-mtls according to the dashboard. During dev, the dev server should generate certs in a non-committed directory and then distribute them to clients during registration so we never need non-mtls servers."
 **Story:** n/a
 **Context:** phase 15 (complete) — the durable CA in `meta` (`certs.py`: five `certs.*` rows, the bundle stored verbatim), the agent's TLS mode (`agent/host_agent.py` 1.1.0: `--cert-bundle`, `CERT_OPTIONAL`, the live `# REVOKED` denylist, `agent.tls`/`agent.bundle_rev` in the snapshot), the collector's certificate dial (`collectors.py` `AgentTls` — an `https://` `HOST_TARGETS` entry dials with this app's client certificate), the bundle download route (`GET /api/certs/<name>/bundle`, session-gated, the stored bytes verbatim), the installer's `--cert-bundle` shape check (`deploy/install-agent.sh` lines 270–331 — the python3 validator runs **before** `need_root`, the bundle installs `0640 root:dashboards-agent` at line 385, the `--status` https probe), and the fleet record (AGENTS.md gap 11: no bundle is installed on any host, `HOST_TARGETS` is `http://` for every host, the installed agents run 1.0.0 so **1.1.0 ships together with the bundle, never the bundle alone**; gap 10: driveripper's unit is reproducible only with the repo script's `--as-root --caps CAP_SYS_RAWIO CAP_SYS_ADMIN --force` line — the Oct-18 sudo-granted snapshot must not be run; deskwork's `ops` has no installer grant, so its install goes through the operator's root). `scripts/dev-server.sh` (the dev server: reads `.env.dev`, nohup `dashboards`, `/api/health` readiness probe, `status` subcommand) and `data/` (gitignored — the non-committed directory the TODO names)
 ## Objective
 The dev loop stops producing `http://` agents. On start, the dev server exports every configured host's stored bundle to non-committed `data/certs/` (the CA is already durable in `meta` — "generate" means *materialise what the first boot minted*, never a second authority), and the installer gains `--fetch-bundle` so a client's **registration** — its install — pulls its bundle from the dashboard and installs it in the same run (the operator no longer curls a file across the network by hand). Then the fleet itself moves: agent 1.1.0 + bundle on deskwork, driveripper and gateway, `HOST_TARGETS` flipped to `https://` host by host (a URL flipped before its bundle is installed turns that host red by construction — the order is the safety), leaving the dashboard's nine sources `ok` with three `agent.tls: true` hosts and no `http://` agent URL anywhere.
 ## Dependencies
 - — (none) — the phase builds on complete phase 15 and phase 17; it is scheduled last on purpose, because it is the fleet-changing one.
 ## Tasks
 1. `01_dev_bundle_export.md` — `scripts/dev-certs-export.py` + `dev-server.sh`: the dev server writes every configured host's bundle to `data/certs/<name>.bundle` (`0600`) on start; an unissued host says so and writes nothing
 2. `02_installer_fetch_bundle.md` — `install-agent.sh --fetch-bundle <url> --cert-name <name> --session <token>`: registration pulls the bundle from the dashboard, the shape check runs on the fetched bytes before `need_root`, the token never reaches the token file or the unit
 3. `03_fleet_rollout.md` — agent 1.1.0 + bundle on the three hosts (deskwork via the operator's root, driveripper with the gap-10 `--force` line, gateway with its sudoers grant), `HOST_TARGETS` flipped per host, the URL never flipped before the bundle
 4. `04_verification.md` — the fleet is mTLS: `agent.tls`/`deployed_bundle_rev` agree for all three hosts, nine sources `ok`, no `http://` agent URL, the 16-driver SMART reads still live, screenshots
 ## Testing & Quality
 - Unit/integration: `tests/test_deploy_scripts.py` — the export helper against a `create_app(...)` hosted on a socket (the sandbox pattern the installer tests already use: fake `install`/`chown` where the installer runs); the `--fetch-bundle` legs (a good bundle fetched, installed and byte-identical; a malformed one refused **before any write**; the token absent from every written artefact)
 - Coverage: **>90%** on new/modified code
 - The phase is "Complete" only when the **entire** project test suite passes 100% (every test in the project, not just this phase's)
 ## Documentation & Consistency
 - The final pass reviews `README.md` and `AGENTS.md` in full against the project as it stands after this phase — fixing every inconsistency found, **including pre-existing ones not caused by this phase**. The README's *Protecting an agent, host by host* rollout becomes the `--fetch-bundle` recipe (the manual curl is demoted to the fallback), the dev section gains the `data/certs` export, AGENTS.md's fleet record and gap 11 resolve to "all three hosts mTLS since <date>" with the exact installed units, and the "bearer-token transport is the compatibility path, not the designed one" sentence becomes history. **No token, no PEM and no session value go into any tracked file** — the exported bundles live in gitignored `data/`, the fleet's `HOST_TARGETS` URLs carry no userinfo once flipped (invariant 6), and the task transcript names hosts, not credentials.
 ## Completion Criteria
 - [ ] `./scripts/dev-server.sh restart` leaves `data/certs/<name>.bundle` for every configured host that has an issued bundle, `0600`, byte-identical to the stored row, and a one-line note for any unissued host (pinned + verified)
 - [ ] `sudo deploy/install-agent.sh --fetch-bundle <url> --cert-name <host> --session <token> ...` installs a byte-identical bundle in the sandbox, refuses a malformed one before `need_root`, and leaves no token in the token file, the unit or the log (pinned)
 - [ ] all three hosts run agent 1.1.0 from an installed bundle, `HOST_TARGETS` is `https://` for every host with no userinfo, and `./scripts/dev-server.sh status` reads nine sources `ok` with `agent.tls: true` and `deployed_bundle_rev == bundle_rev` on all three (screenshots of `/certs` in `data/logs/`)
 - [ ] driveripper's 16 drives still read live on `/disks` after the `--force` unit rewrite (the gap-10 unit shape is reproduced exactly)
 - [ ] `uv run pytest` green, coverage not down, `ruff` + `pyright` clean
 - [ ] `bash .agents/validate.sh` green
 - [ ] no behavior change in completed work: the token-mode path, the revocation wiring, the bundle route and the agent's token-mode bytes are all unchanged
@@ -0,0 +1,27 @@
 # Task 01 — The dev server exports the bundles to `data/certs/`
 **Phase:** `24_dev_mtls_rollout` · **Source:** `TODO.md:3` — "During dev, the dev server should generate certs in a non-committed directory and then distribute them to clients during registration…"
 **Story:** n/a
 ## Objective
 On start, the dev server materialises the **stored** CA's per-host bundles in non-committed `data/certs/`: one `0600` file per configured host with an issued bundle (`data/certs/<name>.bundle`, byte-identical to the `meta` row the bundle route serves — the CA is durable in `meta`, so "generate" is an export of what the first boot already minted, never a second authority; `data/` is gitignored, so nothing committed ever carries a key). A configured host with **no** issued bundle (the invariant-3 shape: `issued: false`) writes no file and prints one line naming the host and the `/certs` route that issues it. The export is a small standalone script the dev server calls, so the test suite drives it against a `create_app(...)` hosted on a socket without a nohup'd process.
 ## Work
 1. `scripts/dev-certs-export.py` — a standalone helper (stdlib `urllib`, the way `install-agent.sh`'s validator uses `python3`): arguments `--url` (the dev server's base URL), `--password` (the sign-in password — the dev server reads it from the same `.env.dev` it already loads, so the value comes from the environment, never a tracked file), `--names` (the configured host names, space-separated — read from `HOST_TARGETS`' names, the same parsing `parse_targets` does, passed in by the caller rather than re-parsed inside), `--out-dir` (defaults to `<root>/data/certs`). Behaviour: sign in via `POST /api/auth/login` (the public route; the token travels in `Authorization` for the bundle GETs), then per name `GET /api/certs/<name>/bundle` — a `{"configured": true, "issued": false}` answer writes **no file** and prints the one-line note; a configured host that 404s (`{"configured": false}`) is impossible by construction (names come from `HOST_TARGETS`) but is handled as the same no-file line, not a crash; a good bundle is written `<out-dir>/<name>.bundle` at `0600` (created via `os.open`, not `open()`, so the mode is the file's birth mode). The script exits 0 when every name resolved to either a file or the no-issued note, and non-zero on a sign-in failure — a dev server that cannot sign in says so in `dev-server.sh`'s start output, never silently.
 2. `scripts/dev-server.sh` — in `start()`, after the readiness probe: call the export (`.venv/bin/python scripts/dev-certs-export.py --url http://127.0.0.1:$PORT --password "$DASH_ADMIN_PASSWORD" --names <the HOST_TARGETS names> --out-dir $ROOT/data/certs`), printing its per-host lines; in `status`, print the `data/certs/` listing (names + sizes) as the "bundles exported" block. The export failure is a **warning line**, not a `start` failure — a bundle export that cannot sign in is a dev-convenience failure, and the server itself is up (the readiness probe already proved it); the one line says what to check.
 3. `tests/test_deploy_scripts.py` — the pin: host `create_app(settings with admin_password="testpass", pbkdf2_iterations=1000, one or two configured targets, an in-memory store with an issued bundle for one host and none for the other)` on `127.0.0.1:0` via `uvicorn` (the project's own dependency — `__main__.py`'s pattern), run the script against it, and assert: the issued host's file exists at `0600` and is **byte-identical** to `GET /api/certs/<name>/bundle` from the same app; the unissued host wrote **no file** and the output carries its one-line note; a wrong `--password` exits non-zero and writes nothing.
 ## Testing & Quality
 - Unit/integration: the pin above (the sandbox pattern `tests/test_deploy_scripts.py` already uses for the installer)
 - Coverage: **>90%** on this task's new/modified code
 - Real-boot check: `./scripts/dev-server.sh restart` on the dev box prints the per-host export lines and `data/certs/` holds the files (the dev box is the test bed — invariant 10)
 ## Completion Criteria
 - [ ] `./scripts/dev-server.sh restart` leaves `data/certs/<name>.bundle` per issued host, `0600`, byte-identical to the stored row; an unissued host is a one-line note and no file (pinned + verified on the dev box)
 - [ ] `status` prints the exported-bundles block
 - [ ] no bundle, key or PEM is ever written outside `data/` (the gitignored tree) — a grep of the tracked files for the export's output path confirms it lands only under `data/`
 - [ ] `uv run pytest` green, `ruff` + `pyright` clean
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the dev server's start/stop/status semantics, the readiness probe and the CA rows in `meta` are untouched (an export never mints — `certs.read_state` is the request-time read the bundle route uses, and the export dials that route, not `ensure_certs`)
@@ -0,0 +1,29 @@
 # Task 02 — `install-agent.sh --fetch-bundle`: registration pulls the bundle
 **Phase:** `24_dev_mtls_rollout` · **Source:** `TODO.md:3` — "…then distribute them to clients during registration so we never need non-mtls servers."
 **Story:** n/a
 ## Objective
 The installer's registration moment — the install — is where the client gets its bundle: `--fetch-bundle <dashboard-url> --cert-name <name> --session <token>` fetches `GET /api/certs/<name>/bundle` from the dashboard **in the install run**, the existing python3 shape check (lines 270–331, which runs before `need_root`) validates the **fetched bytes**, and the rest of the `--cert-bundle` path (the `0640 root:dashboards-agent` install at line 385, the unit's `--cert-bundle` + `RuntimeDirectory` lines, the `--status` https probe) runs on them unchanged. The session token is a **fetch credential only**: it never reaches the agent's token file, the unit, the log or the installed bundle, and the fetch happens before `need_root` (a host whose dashboard refuses the fetch never gets a partial install — the same order the bundle validator already has).
 - ASSUMPTION: the session travels on **argv** (`--session <token>`), matching how the operator already signs in for the manual curl the README's rollout documents; the token is visible in the `sudo` process list for the fetch's duration, which is the accepted cost on a single-admin box (the alternative — a `0600` session file — is a second artefact to clean and the operator's muscle memory is the curl recipe). The three flags are **all-or-nothing**: any one without the others is refused with a usage line before `need_root` and before any write.
 ## Work
 1. `deploy/install-agent.sh` — argument parsing (near line 136): `--fetch-bundle) FETCH_URL="$2"; shift 2 ;;`, `--cert-name) CERT_NAME="$2"; shift 2 ;;`, `--session) SESSION_TOKEN="$2"; shift 2 ;;`; the all-or-nothing check (the three set together or not at all; `--fetch-bundle` and a local `--cert-bundle <file>` together is refused — two bundle sources are a contradiction, pick one) in the same pre-`need_root` region the bundle validator occupies (lines 160–331).
 2. `deploy/install-agent.sh` — the fetch: a `python3` `urllib` block (the script already requires `python3` for the shape check — no new dependency, no `curl` assumption): `GET $FETCH_URL/api/certs/$CERT_NAME/bundle` with `Authorization: Bearer $SESSION_TOKEN` written to a `mktemp` file; the response body's shape is checked in the same block — a `{"configured": true, "issued": false}` body is refused with its own one-line reason (*"no bundle issued for <name> — issue it from /certs first"*), a `404`/`401`/`403` is refused naming the HTTP status, and only a 200 with a non-empty body falls through to the **existing** shape check (lines 270–331) run on the temp file; on any refusal the temp file is deleted (`trap`-covered, the way the script already cleans its unit temp file) and nothing is written. On success the temp file is handed to the existing `BUNDLE_SRC` path — the `0640` install, the unit lines and the `--status` probe all run unchanged on the fetched bytes.
 3. `deploy/install-agent.sh` — token hygiene: `SESSION_TOKEN` is used only in the fetch block; it is never `echo`d (the script's existing log lines name the URL, never the header), never written to `$TOKEN_FILE`/`$CERT_FILE`/the unit, and is `unset` after the fetch; the `--help` block gains the three flags with the one-line recipe (the URL is the dashboard's, the name is the `HOST_TARGETS` name, the session is the signed-in token).
 4. `tests/test_deploy_scripts.py` — the pins (the sandbox pattern: fake `install`/`chown`, a local `http.server` thread serving the bundle route's exact bytes — the `application/x-pem-file` attachment body a `create_app` bundle route would serve): (a) a good fetch → the installed `CERT_FILE` is **byte-identical** to the served bytes, `0640`, and the unit carries the `--cert-bundle` line; (b) a served `{"configured": true, "issued": false}` body → refusal with the one-line reason, **no** `install` call (the fake records it), temp file gone; (c) a served 401 → refusal naming the status, no write; (d) the **token absence** pin: the token string appears in no written artefact — not the token file, not the unit, not the script's captured stdout (the test serves the bundle with a token it chose and greps the sandbox for it); (e) the all-or-nothing and the two-bundle-source refusals, both before `need_root` (the sandbox's root check records the call order).
 ## Testing & Quality
 - Unit/integration: the five pin legs above
 - Coverage: **>90%** on this task's new/modified code (the gate applies to the changed test file)
 ## Completion Criteria
 - [ ] `sudo deploy/install-agent.sh --fetch-bundle <url> --cert-name <name> --session <token> --bind … --port …` installs a byte-identical bundle in the sandbox, `0640`, with the unit's TLS lines (pinned)
 - [ ] a malformed/missing/401 bundle is refused before `need_root` with its own one-line reason and no partial write (pinned)
 - [ ] the session token appears in no written artefact — token file, unit, or captured stdout (pinned)
 - [ ] `uv run pytest` green, `bash .agents/validate.sh` green
 - [ ] full test suite green
 - [ ] no behavior change in completed work: the local `--cert-bundle <file>` path, the `--status` probe, the re-run guard (task-17's diff-and-refuse) and the token file's mode are byte-identical in behaviour to before
@@ -0,0 +1,30 @@
 # Task 03 — The fleet goes mTLS, host by host
 **Phase:** `24_dev_mtls_rollout` · **Source:** `TODO.md:3` — "The client should never allow non-mtls communication. deskwork and gateway are still non-mtls according to the dashboard."
 **Story:** n/a
 ## Objective
 All three agents run 1.1.0 from an installed bundle, and `HOST_TARGETS` is `https://` for every host. The order per host is the safety (gap 11's rule: **a URL flipped before its bundle is installed turns that host red by construction**): install agent 1.1.0 + bundle → restart the unit → the `--status` CA-only https probe answers → **then** the `HOST_TARGETS` line flips → the dev server restarts → `agent.tls` shows. 1.1.0 ships **together with** the bundle, never the bundle alone (the installed agents are 1.0.0 — gap 11's re-check). Hosts in order: gateway (the trivial one: `(ALL) NOPASSWD: ALL`, a VM with the standard unit), deskwork (no `ops` installer grant — its root half is the operator's action), driveripper (the gap-10 line, the one that must not be the Oct-18 snapshot).
 - ASSUMPTION: the executor has **ssh as `ops`** from the dev box (the fleet record's probes ran from this laptop; the repo's dev workflow dials the fleet from here). If ssh is unavailable in the run environment, the task degrades to its written form: the exact command blocks are printed for the operator, the operator applies them, and task 04's verification runs against the applied fleet — the pass criteria are the same either way.
 - ASSUMPTION: the flipped URL is **clean `https://<host>:9120` with no userinfo** — the TLS handshake is the auth, the token file line stays in the unit (the rollback path), and invariant 6's "no token in a tracked file" is satisfied by `.env.dev` itself being gitignored with the token now out of the URL. **Rollback** per host = restore the pre-flip URL line from the timestamped backup copy (made in `data/env-backup/` before any flip) and restart the dev server — the bundle stays installed, the unit keeps both its token file and the bundle line.
 ## Work
 1. **Prep (dev box):** `./scripts/dev-server.sh restart` (task 01's export leaves `data/certs/` populated); sign in, note the session token (it lives only in the operator's shell and the task transcript's redaction, never in a file); `cp .env.dev data/env-backup/.env.dev-<timestamp>` (gitignored).
 2. **gateway** (`10.1.1.27:9120`, the standard unit): over ssh as `ops` — copy the repo's `agent/host_agent.py` (1.1.0) to `/usr/local/lib/dashboards-agent/host_agent.py`, then `sudo deploy/install-agent.sh --bind 10.1.1.27 --port 9120 --fetch-bundle http://127.0.0.1:8090 --cert-name gateway --session <token>` (the fetch dials the **dev server on the dev box** — the dashboard's bundle route; on a host that cannot reach the dev box, the same flag with the dashboard's LAN URL, or task 01's exported file, is the fallback; the unit gains the `--cert-bundle` + `RuntimeDirectory` lines and keeps its `--token-file` line), `systemctl restart dashboards-agent`, `./deploy/install-agent.sh --status` (the CA-only https probe answers). **Then** flip gateway's `.env.dev` line to `https://10.1.1.27:9120`, `./scripts/dev-server.sh restart`, confirm `host:gateway`/`disks:gateway` `ok` with `agent.tls: true`.
 3. **deskwork** (`10.1.0.51:9120`, the operator's root half): `ops` has no installer grant on deskwork (the fleet record), so the executor prints the exact block — the agent-file copy, `sudo deploy/install-agent.sh --bind 10.1.0.51 --port 9120 --fetch-bundle <dashboard url> --cert-name deskwork --session <token>`, the restart, the `--status` probe — for the operator to run as root; the executor then verifies the unit state over ssh (`systemctl is-active`, `systemctl cat`), flips the URL line and confirms `host:deskwork`/`disks:deskwork` `ok` with `agent.tls: true` (if the operator's run and the flip land before the executor's verify, the verify is the check; the command block is the record).
 4. **driveripper** (`10.1.0.126:9120`, the gap-10 line): over ssh as `ops` — copy the repo's `agent/host_agent.py` (1.1.0) to `/usr/local/lib/dashboards-agent/host_agent.py`, then the **repo's** script with the gap-10 line exactly: `sudo deploy/install-agent.sh --bind 10.1.0.126 --port 9120 --as-root --caps CAP_SYS_RAWIO,CAP_SYS_ADMIN --force --fetch-bundle <dashboard url> --cert-name driveripper --session <token>` (the `--force` is what lands the unit change — task 17's guard refuses a differing re-run without it, and the line reproduces the `User=root` + `CapabilityBoundingSet` unit that keeps all 16 SMART reads live; **never** the Oct-18 sudo-granted snapshot — it predates the flags and the guard), `systemctl restart dashboards-agent`, the `--status` probe, **then** flip the URL line and confirm `host:driveripper`/`disks:driveripper` `ok` with `agent.tls: true` and the 16 drives still reading (a `smart: null` row here is the `--force` rewrite having changed the unit — stop and diff the unit against the fleet record's shape before anything else).
 5. **Fleet state:** after all three flips, `.env.dev`'s `HOST_TARGETS` has no `http://` agent entry and no userinfo token; the three units still carry their `--token-file` lines (the rollback path); the transcript in `data/logs/` names hosts, ports and revs — no token, no PEM.
 ## Testing & Quality
 - Coverage: n/a (fleet task; the pins are tasks 01–02's)
 - The read-only rule applies to the **verification** half: no `upsd` command, no engine write, no `POST /api/ups/command`; the installer's own writes are the change this task exists to make
 ## Completion Criteria
 - [ ] all three units run the 1.1.0 agent file from an installed bundle (`systemctl cat` + `--status` CA-only probe per host, transcript in `data/logs/`)
 - [ ] `.env.dev`'s `HOST_TARGETS` is `https://` for all three hosts, no userinfo; the pre-flip backup exists in `data/env-backup/`
 - [ ] `./scripts/dev-server.sh status` — nine sources `ok` with `agent.tls: true` on all three (the per-host flips never left the fleet red longer than the host's own restart — the per-host order is the proof)
 - [ ] driveripper's 16 drives still read live on `/disks` after the `--force` rewrite
 - [ ] the full suite + `bash .agents/validate.sh` green
@@ -0,0 +1,29 @@
 # Task 04 — The fleet is mTLS: the end state, verified
 **Phase:** `24_dev_mtls_rollout` · **Source:** `TODO.md:3` — "…so we never need non-mtls servers."
 **Story:** n/a
 ## Objective
 The end state is proven read-only, the way phase 15's task-05 final pass proved its composition: the dashboard dials all three agents with its client certificate, the issued-vs-deployed revisions agree, nothing non-mTLS is left in the config, and the things the bundle install must not have broken (driveripper's 16 SMART reads, deskwork's GPU row) still work. No live revocation is performed — the revocation wiring is phase 15's e2e proof (`data/logs/verify-15-tls-e2e.py`), and a live revoke of a working fleet is a change, not a check.
 ## Work
 1. `./scripts/dev-server.sh status` — the nine-source table `ok` (`host:driveripper`, `host:deskwork`, `host:gateway`, `disks:driveripper`, `disks:deskwork`, `disks:gateway`, `nut`, `llm:gufo`, `llm:vllm`); `disks:gateway` is `ok` with the page hiding gateway (phase 22's gate) — the job healthy, the page scoped.
 2. Signed-in `GET /api/certs`: all three rows `status: "active"`, `deployed_bundle_rev == bundle_rev` (the "install the new bundle" sentence is gone for every host), `agent` block from the `system` payload: `agent.tls: true` + `agent.bundle_rev` present on all three (the task-03 passthrough — a token-mode snapshot grows nothing, so the fields' **presence** is the mTLS proof, rule 2's shape).
 3. Signed-in `GET /api/system/snapshot` + `GET /api/disks/snapshot`: the `agent` blocks on all three hosts; gateway's row absent from `/disks` (phase 22); driveripper's 16 drives with live SMART numbers (the `--force` unit rewrite is the gap-10 shape — a `smart: null` row here fails the task); deskwork's `nvme0n1` row and its GPU card on `/system` (the 1.1.0 agent file's reads intact).
 4. The config: `grep` of `.env.dev` — no `http://` in `HOST_TARGETS`, no `@` userinfo in any target URL; `data/env-backup/` holds the pre-flip copy (the rollback path exists on disk).
 5. The negative control, **without touching the fleet**: `data/logs/verify-15-tls-e2e.py`'s transcript (phase 15) is the standing proof that a revoked serial is refused on `/health` too; this task re-runs **none** of it live — it names the transcript as the control and checks only that `tests/test_collectors.py`'s revocation-before-dial pin and `tests/test_api.py`'s `build_hub` wiring pin are green (they run in the suite).
 6. Screenshots (invariant 10) in `data/logs/`: `/certs` (the three active rows with matching revs), `/disks` (the two visible hosts, driveripper's 16 live rows), `/system` (deskwork's GPU card) — the "the dashboard says all three are mTLS" proof is a screenshot, not a curl.
 ## Testing & Quality
 - Coverage: n/a (verification task)
 - The read-only rule: no `POST` to the fleet, no `upsd` command, no revocation, no unit change — the task reads the fleet and screenshots it
 ## Completion Criteria
 - [ ] nine sources `ok`; `deployed_bundle_rev == bundle_rev` and `agent.tls: true` for all three hosts (pinned by the API checks, shown by the screenshots)
 - [ ] `.env.dev` has no `http://` agent URL and no userinfo; the pre-flip backup exists
 - [ ] driveripper's 16 SMART reads and deskwork's GPU card are live in the served payloads
 - [ ] screenshots of `/certs`, `/disks`, `/system` in `data/logs/`
 - [ ] the revocation pins (`tests/test_collectors.py`, `tests/test_api.py`) green in the suite
 - [ ] the full suite + `bash .agents/validate.sh` green; AGENTS.md's fleet record and gap 11 updated by the phase's Documentation & Consistency pass to the mTLS end state
@@ -0,0 +1,21 @@
 All green. Final state verified.
 **Implemented**
 - `#nav-toggle` (`class="ghost nav-toggle"`, `type=button`, `aria-expanded=false`, `aria-controls="nav-tabs"`, `aria-label="Toggle navigation"`, `☰`) inserted between `.brand` and `nav.tabs` in all 7 tabbed pages (`index, system, disks, llm, ups, settings, certs`); block is byte-identical across them (md5 match).
 - Nav given its id: `<nav class="tabs" id="nav-tabs" aria-label="Dashboards">` on all 7; `login.html` untouched (`grep -c 'id="nav-toggle"'` → 0, confirmed in-browser: no toggle, no tabs).
 - `dash.css`: base hide rule `#nav-toggle { display: var(--nav-toggle-display); }` + `--nav-toggle-display: none` in `:root`, with the rationale comment.
 **Tests / lint / coverage**
 - `bash .agents/validate.sh` → `1451 passed, 15 skipped`, coverage **98.94%** (floor 94), `ruff` All checks passed, `pyright` 0 errors, `node --check` clean.
 - `uv run pytest -m live --live` → **11 passed** (real fleet/engines/upsd).
 - Browser proof against the restarted dev server (Playwright, 1280/900/641/640/400/320px, all 7 pages): `#nav-toggle` computes `display:none` at every width, and deleting the button changes no masthead geometry → rendering identical to the pre-task markup. Screenshots: `data/logs/nav-task01-{desktop-1280,system-desktop-1280,phone-400,certs-phone-400,login-phone-400}.png`.
 **Docs**: no doc impact — nothing renders differently yet; the AGENTS.md *UI conventions* masthead-collapsing entry is the phase's documentation mandate and lands with task 04/the final pass (writing it now would document a dropdown that does not exist).
 **Decisions / deviations**
 1. The task's literal `.nav-toggle { display: none; }` would **not** have hidden the button: the element carries `class="ghost"`, and `button.ghost { display: inline-flex }` is (0,1,1) vs (0,1,0) — measured a visible 29×29px button in the desktop masthead. Shipped an id-addressed rule instead.
 2. The task's orphan-`id` assumption is wrong: `aria-controls="nav-tabs"` anchors `nav-tabs`, and a `.nav-toggle` class rule is invisible to the audit (it searches the comment-stripped corpus for `#nav-toggle`/quoted `nav-toggle`). The id rule satisfies `test_no_page_carries_an_id_nothing_reads`; `:root`-declaring the token also keeps `test_no_stylesheet_rule_uses_an_undeclared_token` green.
 3. Token-driven `display` makes task 02's reveal order- and specificity-independent — proven in-browser that both `#nav-toggle {--nav-toggle-display: inline-flex}` and `.nav-toggle {…}` reveal the button at exactly ≤640px, no `!important`.
 4. No new tests here (task 01's mandate is that the existing masthead/admin-link/orphan-`id` pins still pass); pre-existing advisory only: `fastapi 0.153.0 → 0.156.0` (dependencies untouched, advisory not a gate).
 **Next pending task**: `.agents/phases/todo/18_nav_hamburger/02_dropdown_css.md`.
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ...........................s............................................ [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 49%]
 ........................................................................ [ 54%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 ................................................................ssssssss [ 68%]
 sss..................................................................... [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 93%]
 ........................................sss............................. [ 98%]
 ..........................                                               [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1451 passed, 15 skipped, 1 warning in 156.32s (0:02:36)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.0 wheel
@@ -0,0 +1,16 @@
 **Implemented** (`.agents/phases/todo/18_nav_hamburger/02_dropdown_css.md`)
 - `dash.css`: new `/* ---- mobile nav */` section = the ≤640px block — `.masthead` wraps (`height:auto`, `min-height:var(--header-h)`, `padding-block`), `#nav-toggle` revealed via task 01's `--nav-toggle-display` token (right-aligned, 40px target, `touch-action:manipulation`), `nav.tabs{display:none}`, `nav.tabs.is-open` = the dropdown (`position:absolute; top:100%` full-bleed under the sticky bar, `z-index:41`, `--bg-raised`/`--border`, touch-sized rows), so no menu-panel element and no colour outside the tokens.
 - Three rules the browser measurement demanded: `.masthead-right{flex-wrap:wrap;justify-content:flex-end}`, `.masthead-right>*{flex:none;white-space:nowrap}`, `#nav-status{flex-wrap:nowrap}` — without them the bar was 183px tall with the 4 status dots in a vertical column and `⚷ Certs` broken over two lines (pre-phase it was a 58px bar the 118px dot column overflowed, document 45px wider than the viewport).
 - Deviations, all commented in the file: `box-shadow:var(--shadow)` not the literal `rgba(0,0,0,.35)` (light theme + "no component hardcodes a colour"); shipped **without** the optional transition (`display:none→flex` cannot animate, so the `prefers-reduced-motion` block needs no new selector); 360px renders 3 rows, not the task's 2 — four labelled dots + Certs/Account/theme cannot fit 320px twice, and nothing was hidden to fake it (93px at 640px).
 **Tests / lint / coverage**
 - `bash .agents/validate.sh` → exit 0: **1451 passed, 15 skipped**, coverage **98.94 %** (floor 94), ruff "All checks passed", pyright "0 errors", `node --check` clean; advisory only: fastapi 0.153.0→0.156.1 (deps untouched).
 - `uv run pytest -m live --live` → **11 passed** (real fleet/engines/upsd).
 - Browser proof vs the live dev server (`data/logs/nav-task02-verify.cjs`): at 320/360/414/640 px — toggle visible, tabs hidden, `.is-open` full-width under the bar (`top:100%` = bar bottom), links stacked at 40px, `aria-current` highlighted, content scrolls under, `scrollWidth == viewport`; CSS-parse check confirms all 7 new selectors survive the parser; `/login` still has no toggle/tabs. No-regression control (`nav-task02-noregress.cjs`, shipped CSS vs the block stripped, 7 pages × 6 widths >640px) → **identical masthead layout**.
 - Screenshots: `data/logs/nav-task02-{index,system,disks,llm,ups,certs,settings}-360{,-open}.png`, `-index-{320,640,641,700}`, `-system-360-dark{,-open}`, `-login-360`.
 **Docs**: no doc changes — the phase assigns the AGENTS.md *UI conventions* masthead entry to its final pass, and the dropdown is unreachable until task 03's binding lands (same call task 01 made).
 **For the final pass**: pre-existing horizontal overflow at 641–752px (masthead content measures 752px) — not caused by this task; fixing it would change the desktop masthead the phase pins as unchanged.
 **Next pending task**: `.agents/phases/todo/18_nav_hamburger/03_toggle_binding.md`.
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ...........................s............................................ [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 49%]
 ........................................................................ [ 54%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 ................................................................ssssssss [ 68%]
 sss..................................................................... [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 93%]
 ........................................sss............................. [ 98%]
 ..........................                                               [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1451 passed, 15 skipped, 1 warning in 154.20s (0:02:34)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.1 wheel
@@ -0,0 +1,13 @@
 **Implemented** (`.agents/phases/todo/18_nav_hamburger/03_toggle_binding.md`)
 - `app.js` `initChrome()`: the `#nav-toggle` / `#nav-tabs` binding, in the file's `if (element)` guard style — one `setNavMenu(open)` funnel that always sets `.is-open` + `aria-expanded` together, and the four close paths (button again, tab click delegated on the nav, `Esc` with focus returned to the button, `matchMedia('(max-width: 640px)')` false on resize-back so no stale `is-open`). `640px` matches task 02's CSS block; the `if (navToggle && appNav)` guard is what makes `/login` inert. No body marker class, no page/CSS/Python changes.
 **Tests / lint / coverage**
 - `bash .agents/validate.sh` → **exit 0**: `1451 passed, 15 skipped`, coverage **TOTAL 99 %** (98.94 %, floor 94), ruff "All checks passed", pyright "0 errors", `node --check` clean on all `web/static/*.js`.
 - `uv run pytest -m live --live` → **11 passed** (real fleet / engines / upsd).
 - Browser pass vs the live dev server (`data/logs/nav-task03-verify.cjs`, Playwright, **77/77 checks**): across all 7 tabbed pages at 360px — closed on load, click opens (dropdown full-width under the bar, 5 links, `aria-expanded=true`), click again closes, Esc closes + focus on `#nav-toggle`, resize to 700 closes and the shrink back stays closed, a tab click closes; no `pageerror` anywhere. `/login`: script loads, no toggle/tabs, only refused request is the designed `GET /api/auth/status` 401. Screenshots `data/logs/nav-task03-{index-360,index-360-open,system-360-open,certs-360-open,index-1280,system-1280,login-360}.png`.
 **Docs**: AGENTS.md *UI conventions* gains the masthead-collapsing convention (breakpoint, toggle identity + the `--nav-toggle-display` specificity ladder, the four close paths, `/login` carries no toggle, the literal living in two files); README's `web/` bullet gained the one operator-facing sentence. README page table unchanged, per the phase.
 **Decisions / deviations**: (1) the `top: 100%` check allows 1px — that resolves against the masthead's padding box, so the menu's first row is its 1px bottom border. (2) The verification script asserts `/login` as "its only ≥400 request is the auth probe" rather than "zero console errors", because Chromium logs that designed 401. (3) No served-byte pins added here — task 04 owns them; no `mq.addListener` fallback (the task's snippet, and every engine this app ships to supports `addEventListener` on `MediaQueryList`).
 **Next pending task**: `.agents/phases/todo/18_nav_hamburger/04_tests_and_verification.md`.
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ...........................s............................................ [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 49%]
 ........................................................................ [ 54%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 ................................................................ssssssss [ 68%]
 sss..................................................................... [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 93%]
 ........................................sss............................. [ 98%]
 ..........................                                               [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1451 passed, 15 skipped, 1 warning in 153.37s (0:02:33)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.1 wheel
@@ -0,0 +1,19 @@
 Done. Everything green.
 **Implemented**
 - `tests/test_api.py` — new phase-18 section with the three served-byte pins: `test_the_nav_toggle_is_in_the_masthead_of_every_tabbed_page` (button + all 5 tabs inside `header.masthead` on all 7 pages, brand→toggle→nav→cluster order), `test_the_login_page_carries_no_nav_and_no_toggle` (own unsigned client, since a signed-in `GET /login` is a `303`; also pins that `/login` still loads the shared `app.js` whose guard is its no-toggle contract), `test_the_nav_toggle_css_and_binding_carry_the_same_breakpoint` (token default hidden, ≤640px reveal/`nav.tabs.is-open` dropdown/cluster-wraps, the four close paths + single `setNavMenu` funnel, and the CSS media query **compared** to the JS `matchMedia`).
 - Each pin mutation-tested (breakpoint drift, un-hidden button, missing button on `/settings`, toggle added to `/login`, removed resize path) — all fail with named messages.
 - Browser verification against the live dev server (9 sources `ok`): `data/logs/nav-task04-verify.cjs` → **24/24 checks** (dropdown under the 2–3-row bar, 5 stacked 40px links, `aria-expanded` truth table, Esc+focus return, tab-click close, resize-back drops stale `is-open`, desktop one-row/no button, no page error); transcript `data/logs/nav-task04-verify.out`; screenshots `data/logs/nav-hamburger-{closed,open}-360.png` + `data/logs/nav-masthead-desktop-1280.png` (read and confirmed, dark theme, live data).
 - Orphan-`id` audit in `tests/test_auth_api.py` passed **untouched**.
 **Tests / lint** — `uv run pytest`: **1454 passed, 15 skipped**; `bash .agents/validate.sh` → **EXIT 0** (`--cov-fail-under=94` → coverage **98.94 %**, ruff "All checks passed", pyright "0 errors", `node --check` clean); `uv run pytest -m live --live` → **11 passed**. Advisory only (deps untouched): `fastapi 0.153.0 → 0.156.1`.
 **Docs** — AGENTS.md *UI conventions*: masthead-collapse entry extended with the three pins and the drift-comparison; README's `web/` bullet now also says the desktop masthead is unchanged above the breakpoint (page table untouched, per the phase).
 **Notable decisions / deviations**
 1. Pinned the shipped `#nav-toggle { display: var(--nav-toggle-display) }` + `:root` token instead of the task file's literal `.nav-toggle { display: none }` — that literal loses to `button.ghost { display: inline-flex }` (task 01 measured it); the test docstring says so, so nobody "restores" the broken shape.
 2. Breakpoint pin compares the two extracted numbers (and pins `640`) rather than grepping `640px` twice.
 3. Restored `src/dashboards/web/pages/settings.html`'s task-01 markup after I wiped it with a `git checkout` during a mutation test; byte-identical to the other six (md5 of the button block matches).
 4. `NOTES.md` (emptied) / `TODO.md` (+2 items) changed in the working tree during this task from outside it — left untouched for the harness.
 **Next pending task**: none in phase 18 (this was the last); next phase dir is `.agents/phases/todo/19_ups_events_expandable/`.
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ..............................s......................................... [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 49%]
 ........................................................................ [ 53%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 ...................................................................sssss [ 68%]
 ssssss.................................................................. [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 93%]
 ...........................................sss.......................... [ 98%]
 .............................                                            [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1454 passed, 15 skipped, 1 warning in 157.17s (0:02:37)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.1 wheel
@@ -0,0 +1,12 @@
 **Phase 19 final verification pass — all tasks already complete; everything green, no code changes needed.**
 - **Verified (all 4 task files present in `complete/`)**: `details.events-box` disclosure on `/ups` with no `open` attribute and `#events` inside it; lazy fetch (`if (state.events.open) await refreshEvents()`), toggle stale rule on `state.pollMs`, success-path-only `painted`/`fetchedAt`; `charts-box`-shaped CSS with the `> .body` padding restatement; 4 new served-byte pins in `tests/test_api.py`.
 - **Criterion 1 (collapsed on load, no first-poll fetch)**: PASS — re-ran `data/logs/19-task04-verify.cjs` against the live dev server (real upsd, 2 UPSes): **28/28 PASS**, `0` `/api/events` requests across 2 closed polls vs 4 snapshot polls; expand → exactly 1 request, 50 rows with `Oct 20, 07:11` timestamps + severity chips + `1–50 of 200` pager.
 - **Criterion 2 (cache/stale/poll-while-open)**: PASS — fresh re-open 2→2 requests, stale re-open 2→3, loop refreshes while open, close asks for nothing, failed fetch keeps rows and doesn't stamp the cache.
 - **Criterion 3**: `uv run pytest` → **1458 passed, 15 skipped**; `uv run pytest --cov` → **98.94%** (floor 94, unchanged); `uv run ruff check src tests agent` → clean; `uv run pyright` → **0 errors**.
 - **Criterion 4**: `bash .agents/validate.sh` → **exit 0** (incl. `node --check` of all page scripts + repo-hygiene gates).
 - **Criterion 5**: `data/logs/ups-events-closed.png` (collapsed `▸ POWER EVENTS`, 0 events requests noted in `ups-events-verify.out`) and `ups-events-open.png` (`▾`, bounded 320px list, pager strip) regenerated and inspected this pass.
 - **Criterion 6 (no regressions)**: full suite green incl. UPS contract/pager pins; `uv run pytest -m live --live` (with `.env.dev`) → **11 passed**; phase 18's `nav-final-pass.cjs` sweep re-run → **45/45** (this phase's markup/CSS didn't touch the masthead).
 - **Documentation**: full README.md (980 L) + AGENTS.md (1992 L) review against the code — verified env templates vs `config.py`, API route table vs `api.py`, installer flags vs `deploy/install-agent.sh`, agent routes vs `host_agent.py`, test/coverage/live tallies, `data/logs` artifacts, and live fleet facts (`HOST_TARGETS` all `http://`, all three agents `version 1.0.0`, nine sources `ok`). AGENTS.md UI conventions and README's events paragraph already carry the disclosure/lazy/stale sentences from tasks 01–04. **Verified consistent — no changes needed.**
 - **Notable**: made zero repo edits (working tree holds only this phase's task work). `uv pip list --outdated` couldn't complete (PyPI 503 for the project name) — no dependency moved this pass, so rule 8 is not triggered; validate.sh's earlier advisory still lists `fastapi 0.153.0 → 0.156.3`, deliberately not upgraded in a UI/verification phase.
 - **Next pending phase**: `.agents/phases/todo/20_masthead_nav_polish/` (tasks 01–04).
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ..................................s..................................... [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 43%]
 ........................................................................ [ 48%]
 ........................................................................ [ 53%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 .......................................................................s [ 68%]
 ssssssssss.............................................................. [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 87%]
 ........................................................................ [ 92%]
 ...............................................sss...................... [ 97%]
 .................................                                        [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1458 passed, 15 skipped, 1 warning in 153.66s (0:02:33)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.4 wheel
@@ -0,0 +1,13 @@
 Done — task 01 complete.
 - **`src/dashboards/web/pages/ups.html`**: the `Power events` card body moved inside a `<details class="events-box">` with `<summary>Power events</summary>` — no `open` attribute, `#events`/`ul.events`/`loading…` placeholder unchanged, rest of the page byte-identical.
 - **`tests/test_api.py::test_ups_power_events_feed_sits_behind_a_collapsed_disclosure`**: served-byte pin (`details.events-box` present, no `open` attr, summary label, `#events` ul + placeholder *inside*, no duplicate `<h3>`, page's other ids intact). Verified it bites: mutations (added `open`, ul moved out, summary renamed) each fail it.
 - `bash .agents/validate.sh` → **exit 0**: `uv run pytest --cov --cov-fail-under=94` = **1455 passed, 15 skipped**, coverage **98.94 %** (floor 94, unchanged); `ruff check src tests agent` "All checks passed"; `pyright` "0 errors"; `node --check` of `web/static/*.js` clean.
 - **Browser proof (live dev server, `data/logs/19-task01-disclosure.cjs`)**: 10/10 checks PASS — `data/logs/19-ups-events-closed.png` (card paints one 21 px `Power events` summary line; `::details-content` is `content-visibility: hidden`) and `-open.png` (expand draws the bounded 320 px list, 50 rows, date/time rows intact).
 - **Docs**: `AGENTS.md` UI-conventions event-feed paragraph gains the `/ups` disclosure sentence (collapsed by default, `#events` stays inside the disclosure, pinned on served bytes); `README.md` `/ups` feed paragraph says the card is a closed `Power events` summary until opened.
 - **Decisions / notes**:
  - Markup only, per the task file — no JS/CSS touched, so `/ups` still fetches the feed on every poll while closed (that is task 02's lazy gate) and the open body currently has `.body` padding 0 because `.card > .body` no longer matches (task 03's `details.events-box` CSS closes it). Both intermediate states render correctly and every test is green.
  - Pinned the summary as the plain word `Power events` (no count chip — an unfetched count would be rule 2's invented number) and no `data-k` attribute, as the task's ASSUMPTIONs state.
  - `uv pip list --outdated` advisory (fastapi 0.153→0.156) left untouched: no dependency moved in this task, same handling as phases 15/17/18.
 Next pending task: `.agents/phases/todo/19_ups_events_expandable/02_events_lazy_loading.md` (lazy fetch / poll-while-open in `page-ups.js`).
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ...............................s........................................ [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 48%]
 ........................................................................ [ 53%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 ....................................................................ssss [ 68%]
 sssssss................................................................. [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 93%]
 ............................................sss......................... [ 97%]
 ..............................                                           [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1455 passed, 15 skipped, 1 warning in 154.08s (0:02:34)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.2 wheel
@@ -0,0 +1,19 @@
 Task 02 complete.
 **Implemented**
 - `src/dashboards/web/static/page-ups.js`: `state.events {open,painted,fetchedAt}`; `refresh()` now does `if (state.events.open) await refreshEvents();` (poll loop feeds the list only while open); `refreshEvents()` stamps `fetchedAt`/`painted` **after** `Dash.eventsPager()` on the success path only (a failure keeps the rows and re-fetches on next open); `toggle` listener bound before `poll()` — first expand fetches, re-expand inside one `state.pollMs` paints the cached rows, older than that re-fetches; header comment documents the lazy rule.
 - `tests/test_api.py`: `test_ups_events_are_fetched_only_while_the_disclosure_is_open` — served-script pins for the state shape, the `refresh()` gate (incl. no surviving ungated `await refreshEvents()`), the success-path-only stamp ordering, and the toggle's stale rule bound before the poll starts.
 - `data/logs/19-task02-lazy.cjs` (+ `.out`): live browser proof, 21 checks — 0 `/api/events` requests across 2 closed polls, exactly 1 on first expand, loop refreshes while open, stops when closed, stale re-open re-fetches, fresh re-open makes no request (rows + pager footer + scroll identical), failed fetch keeps 50 rows and never moves the stamp. Screenshots: `19-ups-events-card-closed.png` (one summary line), `19-ups-events-card-open.png`, `19-ups-events-{closed,open,fetch-failed}.png`.
 **Tests / lint / coverage** (all green)
 - `uv run pytest` → 1456 passed, 15 skipped, exit 0
 - `uv run pytest -q --cov --cov-fail-under=94` → Total coverage: 98.94% (unchanged)
 - `uv run ruff check src tests agent` → All checks passed; `uv run pyright` → 0 errors, 0 warnings
 - `bash .agents/validate.sh` → exit 0 (incl. `node --check` of `page-ups.js`); only the pre-existing advisory `fastapi 0.153.0 → 0.156.2` (no dependency touched by this task)
 - Dev server http://127.0.0.1:8090 still `status: ok` (all 9 sources)
 **Docs**: AGENTS.md UI conventions (event-feed paragraph) and README's `/ups` expandable bullet now state the lazy rule — closed = not fetched, first expand fetches, re-open inside one poll interval redraws what is there.
 **Decisions**: stale bound = one `state.pollMs` (task's ASSUMPTION); stamp placed after the pager call so a pager throw can't mark an unpainted list as cached. Live infrastructure untouched (repo-side + local browser only).
 **Next pending task**: `19_ups_events_expandable/03_disclosure_css.md`.
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ................................s....................................... [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 48%]
 ........................................................................ [ 53%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 .....................................................................sss [ 68%]
 ssssssss................................................................ [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 92%]
 .............................................sss........................ [ 97%]
 ...............................                                          [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1456 passed, 15 skipped, 1 warning in 164.27s (0:02:44)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.2 wheel
@@ -0,0 +1,16 @@
 Everything is green. Report:
 **Implemented**
 - `src/dashboards/web/static/dash.css` — new `details.events-box` family beside `details.charts-box`: `min-width:0`, `> summary` (cursor, `list-style:none`, webkit marker hidden, `::before` `▸` / `[open] ::before` `▾` in `--text-faint`, hover, open-state de-emphasis), all tokens declared in `:root`.
 - Shape deviation (deliberate, documented in the block's comment): this `<summary>` *replaces* the card's `header`, so it takes `.card > header`'s exact rhythm — `padding:.6rem .8rem`, the h3's `12.5px/650` uppercase type, `--text-muted`, `var(--border)` bottom rule, `color-mix` header ground — and the caret is a flex item (as in `charts-box`), not the snippet's `position:absolute` (which sits off the text's centre line). No `margin-bottom` when open: `.body` supplies the gap.
 - **Defect fixed from task 01**: `.card > .body` is a *child* selector, so once the body moved inside `<details>` it lost its padding. Added `details.events-box > .body { padding: .8rem; }` (restatement, measured equal to another card's).
 - No new rules for `ul.events` / `.events-pager` — verified they resolve inside the disclosure (320px bounded scroll, `overscroll-behavior:contain`, flex pager with its 1px top rule, `1–50 of 200`, both arrows).
 - `AGENTS.md` UI conventions: the disclosure's styling sentence + the `.card > .body` child-selector gotcha.
 **Tests / lint** (`bash .agents/validate.sh`, rc=0): `uv run pytest --cov --cov-fail-under=94` → **1456 passed, 15 skipped, coverage 98.94%**; `ruff check src tests agent` → All checks passed; `pyright` → 0 errors; `node --check` all JS clean. `uv run pytest -m live --live` → **11 passed**. Browser proof: `data/logs/19-task03-css.cjs` → **24/24 PASS** (`19-task03-css.out`), screenshots `19-task03-{closed,open}.png` + `19-task03-dark-{closed,open}.png` against the live dev server (both palettes; other cards and battery charts unchanged).
 **Docs**: AGENTS.md updated; README no change needed (task 02's paragraph already covers the user-visible behaviour).
 **Notes**: the served-stylesheet pin is deferred to task 04 by the task file, so I did not pre-empt it. Advisory only: `fastapi 0.153.0 → 0.156.3` available; dependencies untouched by this task, so not pulled.
 **Next pending task**: `.agents/phases/todo/19_ups_events_expandable/04_tests_and_verification.md`.
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ................................s....................................... [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 44%]
 ........................................................................ [ 48%]
 ........................................................................ [ 53%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 .....................................................................sss [ 68%]
 ssssssss................................................................ [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 88%]
 ........................................................................ [ 92%]
 .............................................sss........................ [ 97%]
 ...............................                                          [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1456 passed, 15 skipped, 1 warning in 158.48s (0:02:38)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.3 wheel
@@ -0,0 +1,19 @@
 Everything is green. Final state verified:
 **Implemented (task 04 — pins + browser verification)**
 - `tests/test_api.py::test_the_ups_event_rows_keep_the_date_time_and_severity_shape` — served-script pin of the row template: `<time>` leading with `month/day + 24h` `toLocaleString` options, `sev ${event.severity}` chip carrying the escaped host, message via `escapeHtml(eventText(event))`, conditional `runtime_seconds` footnote, pager + `label: 'Power events'` + empty sentence.
 - `tests/test_api.py::test_the_ups_events_disclosure_is_a_quiet_disclosure_not_a_new_component` — the served-stylesheet pin task 03 deferred: `▸`/`▾` carets, hidden webkit marker, the header ground/bottom rule (this `<summary>` replaces the card header), open-state de-emphasis with no `margin-bottom`, the `details.events-box > .body` padding restatement (`.card > .body` is a child selector), no verdict/accent token, and `ul.events`/`.events-pager` each styled exactly once.
 - Both pins mutation-checked: dropping `<time>`, the severity class, `hour12: false`, raw-message printing, the caret, the `.body` padding, an accent token or a duplicated `ul.events {` each fails exactly one test; sources restored byte-identical.
 - Browser proof against the running dev server with **real upsd** (2 UPSes, no simulator): `data/logs/19-task04-verify.cjs` → **28/28 PASS**; `data/logs/ups-events-closed.png` (collapsed, one 39px `Power events` summary, **0** `/api/events` requests across 2×5s polls while 4 snapshot polls ran) and `data/logs/ups-events-open.png` (bounded 320px list, 50 rows with `Oct 20, 07:11` timestamps + severity chips, `1–50 of 200` strip); counts recorded in `data/logs/ups-events-verify.out`. Also proven: 1 request on first expand, loop refreshes while open, close asks for nothing, fresh re-open makes no request (identical rows/pager), stale cache re-fetches, failed fetch keeps rows and doesn't stamp the cache.
 - Docs: AGENTS.md UI conventions already carried the disclosure/lazy/stale sentence (tasks 01–03); corrected gap 12 (the two ex-NOTES items are now phases 20 and 24) and the `uv run pytest` tally 1454→1458. README's `/ups` "power events" row plus task 02's expandable paragraph stay accurate — no further README change.
 **Tests / lint / coverage**
 - `bash .agents/validate.sh` → **exit 0**: `pytest --cov --cov-fail-under=94` = **1458 passed, 15 skipped**, **98.94%** coverage (floor 94, unchanged); `ruff check src tests agent` clean; `pyright` 0 errors; `node --check` all JS clean; repo-hygiene gates clean. Advisory only: `fastapi 0.153.0 → 0.156.3` (no dependency moved this task).
 - `uv run pytest -m live --live` → **11 passed** (read-only, real fleet/engines/upsd). Dev server still `status: ok`, nine sources ok.
 **Decisions / deviations**
 - Task-04's first two named pins already exist from tasks 01/02 (`test_ups_power_events_feed_sits_behind_a_collapsed_disclosure`, `test_ups_events_are_fetched_only_while_the_disclosure_is_open`) with the exact coverage the task describes; I left them untouched (criterion 2 asks for the existing feed pins unmodified) and added only the genuinely missing pins.
 - "List renders nothing while shut" is measured with `checkVisibility({contentVisibilityAuto:true})`, not a rect: a closed `<details>` hides via `content-visibility`, which keeps the child's box measurable.
 - No live-infrastructure changes; repo-side plus the local dev server only.
 **Next pending task:** `.agents/phases/todo/20_masthead_nav_polish/01_two_row_masthead.md` (phase 19 has no remaining task files — this was its last).
@@ -0,0 +1 @@
 ok
@@ -0,0 +1,65 @@
 == uv run pytest --cov (hermetic: no network, live tests skip) ==
 ........................................................................ [  4%]
 ........................................................................ [  9%]
 ........................................................................ [ 14%]
 ........................................................................ [ 19%]
 ........................................................................ [ 24%]
 ..................................s..................................... [ 29%]
 ........................................................................ [ 34%]
 ........................................................................ [ 39%]
 ........................................................................ [ 43%]
 ........................................................................ [ 48%]
 ........................................................................ [ 53%]
 ........................................................................ [ 58%]
 ........................................................................ [ 63%]
 .......................................................................s [ 68%]
 ssssssssss.............................................................. [ 73%]
 ........................................................................ [ 78%]
 ........................................................................ [ 83%]
 ........................................................................ [ 87%]
 ........................................................................ [ 92%]
 ...............................................sss...................... [ 97%]
 .................................                                        [100%]
 =============================== warnings summary ===============================
 .venv/lib64/python3.14/site-packages/fastapi/testclient.py:1
  /var/home/ducoterra/Projects/Personal/dashboards/.venv/lib64/python3.14/site-packages/fastapi/testclient.py:1: StarletteDeprecationWarning: Using `httpx` with `starlette.testclient` is deprecated; install `httpx2` instead.
    from starlette.testclient import TestClient as TestClient  # noqa
 -- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
 ================================ tests coverage ================================
 _______________ coverage: platform linux, python 3.14.4-final-0 ________________
 Name                                 Stmts   Miss  Cover   Missing
 ------------------------------------------------------------------
 src/dashboards/__init__.py               3      0   100%
 src/dashboards/__main__.py              14      1    93%   32
 src/dashboards/alerts.py               176      0   100%
 src/dashboards/api.py                  436      0   100%
 src/dashboards/app.py                  185      0   100%
 src/dashboards/auth.py                 265      0   100%
 src/dashboards/certs.py                292      0   100%
 src/dashboards/collectors.py           205      5    98%   284-285, 289-290, 307
 src/dashboards/config.py               120      0   100%
 src/dashboards/debug.py                 14      0   100%
 src/dashboards/poller.py               165      3    98%   192-194, 279
 src/dashboards/prom.py                 112      5    96%   126, 163, 177, 180, 183
 src/dashboards/rates.py                 73      0   100%
 src/dashboards/severity.py              49      0   100%
 src/dashboards/sources/__init__.py       0      0   100%
 src/dashboards/sources/disks.py        134      0   100%
 src/dashboards/sources/host.py         209      0   100%
 src/dashboards/sources/llm.py          178      1    99%   285
 src/dashboards/sources/nut.py          413     20    95%   153, 172, 186, 198, 204, 217, 225, 241, 319-320, 322, 579, 591, 626, 657, 661, 718-719, 724, 736
 src/dashboards/sources/nut_sim.py      134      0   100%
 src/dashboards/store.py                313      2    99%   553-554
 ------------------------------------------------------------------
 TOTAL                                 3490     37    99%
 Required test coverage of 94% reached. Total coverage: 98.94%
 1458 passed, 15 skipped, 1 warning in 153.15s (0:02:33)
 == uv run ruff check src tests agent ==
 All checks passed!
 == uv run pyright ==
 0 errors, 0 warnings, 0 informations
 == node --check src/dashboards/web/static/*.js ==
 advisory: dependencies are out of date (AGENTS.md rule 8 — update on purpose):
  fastapi 0.153.0 0.156.3 wheel
@@ -739,6 +739,43 @@ Responsibilities, one line each:
  `severity` verdict the API sent
  (`tests/test_api.py` fails if a page script names it again). A value the API should rate
  gets a row in `severity.py`, never a bound in JS.
  **The tab nav collapses into a hamburger at ≤640px** (phase 18): the seven tabbed pages each
  carry `#nav-toggle` (`class="ghost nav-toggle"`, `type="button"`, `aria-controls="nav-tabs"`,
  `aria-label="Toggle navigation"`, `☰`) between `.brand` and `<nav class="tabs" id="nav-tabs">`,
  and `/login` carries neither — it renders the brand link and the theme toggle only. Its base
  rule is `#nav-toggle { display: var(--nav-toggle-display) }` with `--nav-toggle-display: none`
  in `:root`, and that token is a specificity ladder, not decoration: the button also carries
  `button.ghost { display: inline-flex }`, so a `.nav-toggle { display: none }` loses and ships a
  visible button into the desktop masthead. The `@media (max-width: 640px)` block reveals it
  through the token, hides `nav.tabs`, wraps `.masthead` and `.masthead-right` into rows (hiding a
  control to make the width work is not the deal), and pads the bar down by
  `env(safe-area-inset-top, 0px)` (the block's `padding-block` value restated on the top side so
  the two cannot drift), because a real device's top-edge zone — Android Chrome is edge-to-edge
  by default, and iOS does the same once the page opts into `viewport-fit=cover` — does not
  deliver taps to the page: the first-row button in it is *unreachable*, not unbound, and no
  headless emulation has such a zone, so a fully green emulated pass still ships a dead button
  (the same symptom brain of reese fixed in production; `env()` resolves to 0 on every non-notch
  surface, which render byte-identical, and the dropdown's `top: 100%` follows the taller bar);
  it renders `nav.tabs.is-open` as the dropdown:
  the `nav` element itself, `position: absolute; top: 100%; z-index: 41` under the sticky bar — no
  second menu element, no `body` marker class, no colour outside the tokens. One binding in
  `app.js`'s `initChrome()` owns the state through a `setNavMenu(open)` funnel (`.is-open` on the
  nav and `aria-expanded` on the button, always together) with **four close paths**: the button
  again, a tab click delegated on the nav, `Esc` with focus returned to the button, and
  `matchMedia` turning false on resize back above the breakpoint — which drops a stale `.is-open`
  so the next shrink starts closed and `aria-expanded` never claims a menu that is not on screen.
  The `if (navToggle && appNav)` guard is the whole `/login` story: the shared script loads there
  and does nothing. The `640px` literal lives in two files — the stylesheet block and that media
  query — and has to move in both, or the menu opens into a `display:none` nav. The contract is
  pinned on the **served** bytes by three `tests/test_api.py` pins — the button on all seven pages
  and nowhere on `/login`, and one test that **compares** the CSS media query with the JS
  `matchMedia` instead of grepping for `640px` twice, so a drift fails with both numbers in the
  message — and proven in a browser at 360px by `data/logs/nav-task04-verify.cjs` (the `/` +
  `/system` interaction, 24 checks) and `data/logs/nav-final-pass.cjs` (the phase-completion
  sweep: all seven tabbed pages at 360px and at 1280px, `/login` at both, 45 checks). The
  safe-area line is pinned in the same test's rule loop; it was verified on the operator's
  mobile Chrome rather than in an emulator, because CDP's `safeAreaInsets` override does not
  feed `env(safe-area-inset-top)` — the one half of this contract a headless pass cannot prove.
 Metric naming: dotted (`cpu.usage_pct`, `mem.used_pct`, `disk.used_pct@/srv`,
 `gpu.busy_pct@0`, `llm.decode_tokens_per_second`, `ups.charge_pct`), `@stream` for per-device
@@ -960,7 +997,7 @@ set -a; . ./.env.dev; set +a              # dev dials the fleet the prod way, no
 ./scripts/dev-server.sh status            # per-source ok/DOWN — unauthenticated: /api/health
 ./scripts/dev-server.sh logs
-uv run pytest                             # hermetic: 1451 passed + 15 skipped (11 live,
+uv run pytest                             # hermetic: 1458 passed + 15 skipped (11 live,
                                          # 4 store_perf), no network
 uv run pytest --cov                       # coverage gate (98.94%; floor 94%)
 uv run pytest -m live --live              # opt-in: real fleet / engines / upsd
@@ -1353,7 +1390,28 @@ a `WeakMap` keyed by the `<ul>`: it survives a poll (so page 3 is still there tw
 later — resetting every refresh would make page 2 unreadable) and resets to page 1 when the
 event *set* changes (an operator reading page 3 of yesterday's history must not land on page 3
 of a list that just changed). Rows are re-written only when their markup changed, which is
-what keeps the reader's scroll position inside the container.
+what keeps the reader's scroll position inside the container. The `/ups` feed is also
 **expandable** (phase 19, `TODO.md:4`): its card body is a `details.events-box` disclosure with
 no `open` attribute, so that card is one `Power events` summary line until the operator opens it
 — a closed `<details>` renders no content, which is `/system`'s Charts rule applied to a feed,
 and the `#events` id stays *inside* the disclosure so the pager and its bounded scroll keep their
 target (pinned on the served bytes). The disclosure is also what makes it **lazy**: `refresh()`
 fetches the feed only while `state.events.open` is true, so a card nobody is looking at costs the
 poll loop nothing (a hidden-but-still-polled list is the half-measure this is). The first expand
 fetches; a re-expand paints the rows already in the `<ul>` while they are younger than one poll
 interval (`state.pollMs`, the page's own cadence) and re-fetches only past it — a `<details>`
 keeps its children, so a fresh re-open costs no request and loses neither the pager's page nor
 the reader's scroll. `painted`/`fetchedAt` are stamped on the success path alone, which is the
 invariant-4 shape here: a failed fetch leaves the rows on screen, leaves the stamp where it was,
 and the next open re-fetches. Its styling is `details.charts-box`'s shape with one structural
 difference: that toggle sits *inside* a card body, while this `<summary>` **replaces** the card's
 `header` — so it carries the header's type, padding, sunken ground and bottom rule (a closed card
 reads as its heading, an open one puts the feed under the same rule every other card draws) and
 no `margin-bottom` when open, because the `.body` below carries that spacing. That is also why
 `details.events-box > .body` restates the `.8rem`: `.card > .body` is a **child** selector, so a
 body moved inside a disclosure stops being padded until something says so — while `ul.events`
 and `.events-pager` are class-based and needed no new rule to keep the 320px scroll and the
 `1–50 of N` strip working inside it.
 The `/system` host card is one row of six heroes — CPU, MEM, TEMP, DISK, GPU, NET (the
 `.heroes` grid; `tests/test_api.py` pins the slots and their order on the served script).
@@ -1883,6 +1941,23 @@ memory plot; the `cpu.usage_pct@coreN` series is still stored and still queryabl
    which is the one route that must not be taken until that snapshot is re-staged from this repo:
    the Oct-18 copy predates phase 17's template *and* its re-run guard, so it would rewrite that
    unit silently — and no live change was made while pinning phase 16.
 12. **The nav collapses on a phone; the page content below it does not** (phase 18's verification
    pass, 2026-10-20). At 360px `/`'s fleet table measures 450-510 px inside a 320 px
    `section.card`, and `.card { overflow: hidden }` clips the tail columns (`WORST DISK`,
    `GPU BUSY`, `TEMP`, `UP`) with no scroll container to reach them — `table.data` only scrolls
    with its `.scroll` modifier, which that table does not carry. Measured as pre-existing by
    serving the `git show HEAD:` bytes of both `dash.css` and `pages/index.html` over a live
    session: same clipping (a clipped card never un-clips when the document scrolls sideways).
    What phase 18 did change is that the document no longer scrolls sideways at a phone width at
    all — 360 px where it was 750 px — because the bar that overflowed its fixed 58 px row now
    wraps, so nothing is lost and nothing gained: the masthead is complete at 360 px and the
    table tail is still out of reach. The fix is a responsive-table pass (`.scroll` on the wide
    tables, or a per-host card layout at ≤640px) and it touches pinned page shape on `/`, so it is
    a phase rather than a cleanup. The two operator TODO items that sat alongside it are phased
    now, in `todo/`: `24_dev_mtls_rollout` (never accepting a non-mTLS agent — fleet gap 11's
    rollout, half of it) and `20_masthead_nav_polish` (keeping both `⚙ Account` / `⚷ Certs`
    masthead links visible on the admin pages that today do not link to themselves — phase 15's
    deliberate rule, which that phase is the decision on).
 ## Locked decisions (and why)
@@ -609,8 +609,10 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
  marker that says how many it hid.
 * `api.py` — the JSON every page reads: `/api/config`, `/api/health`, `/api/events`,
  `/api/history`, `/api/metrics`, `/api/summary`, one `snapshot` + `history` pair per
-  dashboard (`/api/system/*`, `/api/disks/*`, `/api/llm/*`, `/api/ups/*`), and the certificate
+  dashboard (`/api/system/*`, `/api/disks/*`, `/api/llm/*`, `/api/ups/*` — including
-  authority's own surface (`/api/certs`, `/api/certs/<name>/bundle`, `POST …/rotate`, `POST
+  `/api/ups/commands`, which answers what may be sent to each UPS right now and why not when it
  may not), and the certificate authority's own surface (`/api/certs`,
  `/api/certs/<name>/bundle`, `POST …/rotate`, `POST
  …/revoke`, `POST /api/certs/root/rotate`). GETs everywhere except `POST /api/ups/command`,
  which stays the **only** route that dials anything: the `/api/certs/*` writes are `meta` row
  writes through `certs.py`, the same class of write `POST /api/auth/password` is, and a
@@ -640,9 +642,11 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
 * `web/` — five static dashboard pages (`/`, `/system`, `/disks`, `/llm`, `/ups`) plus the three
  admin pages (`/login`, `/settings`, `/certs`), one stylesheet, hand-rolled
  SVG charts (`charts.js`), and a masthead status dot per dashboard job (`disks` has its own:
-  the same agent can answer the 10-second utilisation poll and have a wedged SMART pass). No
+  the same agent can answer the 10-second utilisation poll and have a wedged SMART pass). At
-  framework, no CDN, no bundler, and no narration: a page never explains its own pipeline, so
+  ≤640px the five tab links leave the bar and come back as a dropdown under it, opened by the `☰`
-  the words on screen are the ones you act on — a unit, a `Δ10.0s` provenance tag, a
+  button (`/login` renders no tabs, so it has no button either), and above it the masthead stays
  the one row it has always been. No framework, no CDN, no bundler, and no narration: a page never
  explains its own pipeline, so the words on screen are the ones you act on — a unit, a `Δ10.0s` provenance tag, a
  `SIMULATED` badge, or the sentence beside an empty panel. The overview (`/`) is exactly two panels — a
  **Warnings & errors** list built from `/api/summary`'s `alerts` (each row links to the
  dashboard that explains it) and the **Fleet** table — and nothing else: an empty alert
@@ -753,6 +757,10 @@ certs.py ─ root CA + client cert, minted once at startup (unreadable row → n
  asks `/api/events` for 200 so there is a page 2 to reach, and the endpoint itself is
  unchanged. Reading page 3 survives a poll; a refresh that brings new events goes back to
  page 1, because page 3 of a list that just changed is not the history you were reading.
  The `/ups` feed is also **expandable**: its card is a `Power events` summary line, closed until
  you open it, and the list inside is the same bounded, paged window. Closed, it is not fetched
  at all; the first expand fetches once, and re-opening inside one poll interval redraws what is
  already there instead of asking again.
 ## Testing
@@ -69,7 +69,8 @@ WEB = Path(__file__).resolve().parent / "web"
 # `/settings` is a page and not a dashboard: it is in `PAGES` (so it is a route) and *not* in
 # `PUBLIC_PATHS` (so the gate guards it with no extra code — the route-enumeration test in
 # `tests/test_auth_api.py` proves that, and `tests/test_api.py` proves the anonymous refusal for
-# this page specifically). It carries no `aria-current` tab because it is not one of the four.
+# this page specifically). It carries no `aria-current` tab because it is not one of the five
 # dashboards (`/`, `/system`, `/disks`, `/llm`, `/ups`).
 # `/certs` (phase 15 task 05) is the second of those admin pages, for the same reason: the
 # certificate authority is not a fifth dashboard, it is the thing you administer past them.
 PAGES = {"/": "index.html", "/system": "system.html", "/disks": "disks.html",
@@ -14,7 +14,9 @@
       that marks a tab this page is not would be a lie about the navigation. The masthead
       carries the two admin links — `⚙ Account` and `⚷ Certs` — outside `.tabs`, so the tab
       structure stays five links deep on every page. -->
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/">Overview</a>
    <a href="/system">System</a>
    <a href="/disks">Disks</a>
@@ -10,7 +10,9 @@
 <body>
 <header class="masthead">
  <a class="brand" href="/"><span class="brand-mark">◆</span> Homelab</a>
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/">Overview</a>
    <a href="/system">System</a>
    <a href="/disks" aria-current="page">Disks</a>
@@ -10,7 +10,9 @@
 <body>
 <header class="masthead">
  <a class="brand" href="/"><span class="brand-mark">◆</span> Homelab</a>
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/" aria-current="page">Overview</a>
    <a href="/system">System</a>
    <a href="/disks">Disks</a>
@@ -10,7 +10,9 @@
 <body>
 <header class="masthead">
  <a class="brand" href="/"><span class="brand-mark">◆</span> Homelab</a>
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/">Overview</a>
    <a href="/system">System</a>
    <a href="/disks">Disks</a>
@@ -13,7 +13,9 @@
  <!-- The five dashboards, and no `aria-current`: this page is not one of them, and a tab
       marked current that is not in the list would claim a location the page does not have.
       It is reached from the `⚙ Account` link in the masthead of every dashboard. -->
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/">Overview</a>
    <a href="/system">System</a>
    <a href="/disks">Disks</a>
@@ -10,7 +10,9 @@
 <body>
 <header class="masthead">
  <a class="brand" href="/"><span class="brand-mark">◆</span> Homelab</a>
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/">Overview</a>
    <a href="/system" aria-current="page">System</a>
    <a href="/disks">Disks</a>
@@ -10,7 +10,9 @@
 <body>
 <header class="masthead">
  <a class="brand" href="/"><span class="brand-mark">◆</span> Homelab</a>
-  <nav class="tabs" aria-label="Dashboards">
+  <button class="ghost nav-toggle" id="nav-toggle" type="button"
          aria-expanded="false" aria-controls="nav-tabs" aria-label="Toggle navigation">☰</button>
  <nav class="tabs" id="nav-tabs" aria-label="Dashboards">
    <a href="/">Overview</a>
    <a href="/system">System</a>
    <a href="/disks">Disks</a>
@@ -71,8 +73,10 @@
  </section>
  <section class="card" style="margin-top:.85rem">
-    <header><h3>Power events</h3></header>
+    <details class="events-box">
-    <div class="body"><ul class="events" id="events"><li class="muted">loading…</li></ul></div>
+      <summary>Power events</summary>
      <div class="body"><ul class="events" id="events"><li class="muted">loading…</li></ul></div>
    </details>
  </section>
  <footer class="pagefoot">
@@ -680,6 +680,48 @@ const Dash = (() => {
      refreshStatus();
      setInterval(refreshStatus, 15000);
    }
    // The hamburger: ≤640px the five tab links live in a dropdown under the masthead
    // (`nav.tabs.is-open` in dash.css), opened by `#nav-toggle`. One binding for the seven
    // tabbed pages, and a page without either element is a no-op — `/login` loads this file
    // with brand link and theme toggle only, so the guard below is what keeps it inert there.
    //
    // Every state change goes through `setNavMenu()`, so no close path can leave `is-open`
    // and `aria-expanded` disagreeing (a button that claims `true` over a menu the CSS hides
    // is a control that lies). The four close paths: the button again, a tab link, Esc (with
    // focus back on the opener), and resizing back above the breakpoint — the same four the
    // dropdown's CSS assumes, and `640px` here is that media query, so the two literals must
    // move together or the menu opens into a `display:none` nav.
    const navToggle = $('#nav-toggle');
    const appNav = $('#nav-tabs');
    if (navToggle && appNav) {
      const setNavMenu = (open) => {
        appNav.classList.toggle('is-open', open);
        navToggle.setAttribute('aria-expanded', open ? 'true' : 'false');
      };
      navToggle.addEventListener('click', () => setNavMenu(!appNav.classList.contains('is-open')));
      // A link click navigates — shut the menu. Delegated on the nav: the five links are
      // static markup, so one listener covers all of them and a tab added to the pages is
      // already covered.
      appNav.addEventListener('click', (event) => {
        if (event.target.closest('a')) setNavMenu(false);
      });
      // Esc closes while the menu is open (document-level — there is no other modal on these
      // pages to fight for the key, and a closed menu must not swallow someone else's Esc).
      document.addEventListener('keydown', (event) => {
        if (event.key === 'Escape' && appNav.classList.contains('is-open')) {
          setNavMenu(false);
          navToggle.focus();
        }
      });
      // Resize back to desktop: the inline nav reappears, so the open state is dropped rather
      // than left in place. The CSS scopes `.is-open` to ≤640px, so a stuck class paints
      // nothing up there — but it would re-open the moment the viewport shrank again, and it
      // would leave `aria-expanded` claiming a menu that is not on screen.
      const mq = window.matchMedia('(max-width: 640px)');
      const onMqChange = () => { if (!mq.matches) setNavMenu(false); };
      if (mq.addEventListener) mq.addEventListener('change', onMqChange);
    }
  }
  /** Range buttons (5m … 30d). Calls onChange(seconds, key). */
@@ -41,6 +41,10 @@
  --mono: ui-monospace, "SF Mono", "JetBrains Mono", "Cascadia Mono", Menlo, Consolas, monospace;
  --sans: system-ui, -apple-system, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
  --header-h: 58px;
  /* The masthead nav toggle (phase 18): hidden everywhere until the ≤640px block flips it.
   * A token rather than a literal `display: none` so the reveal may name the button with any
   * selector, in any order — see `#nav-toggle` in the header section. */
  --nav-toggle-display: none;
 }
 [data-theme="light"] {
@@ -171,6 +175,137 @@ button.ghost[aria-pressed="true"] { border-color: var(--accent); color: var(--ac
   or the last page is a control that lies about there being more history). */
 button.ghost:disabled { opacity: .45; cursor: not-allowed; }
 /* The hamburger that swaps the tab nav for a dropdown on phones (phase 18): one per tabbed
 * page (`#nav-toggle`, `aria-controls="nav-tabs"`), hidden at every width until the ≤640px
 * block reveals it — so the masthead renders exactly as it did before the button existed.
 *
 * The token is the specificity ladder, not decoration. This element carries the shared `ghost`
 * class, whose rule above claims `display: inline-flex` at (0,1,1): a literal
 * `.nav-toggle { display: none }` loses to that and ships a visible 29×29 px button into the
 * desktop masthead (measured in a browser, not deduced). Addressing the id out-ranks that, and
 * reading the value from a token means the reveal can be any selector that matches the button,
 * anywhere in this file — a declaration of `--nav-toggle-display` on the element always beats
 * the value inherited from `:root` — so `@media (max-width: 640px) { #nav-toggle {
 * --nav-toggle-display: inline-flex } }` is the whole reveal, with no `!important`. */
 #nav-toggle { display: var(--nav-toggle-display); }
 /* ---- mobile nav ---------------------------------------------------------
 * The ≤640px half of the hamburger (phase 18): the five tab links leave the bar and come
 * back as a dropdown under it, opened by `#nav-toggle`. The state lives entirely in the
 * `.is-open` class task 03's binding puts on `#nav-tabs`, so this block renders a verdict
 * made elsewhere and owns no behaviour of its own.
 *
 * Above 640px nothing here applies, which is the point: the desktop masthead is the same
 * one row with the inline tabs it always had, and the button stays hidden.
 */
@media (max-width: 640px) {
  /* One fixed-height row cannot hold brand + toggle + the whole `masthead-right` cluster
   * (status dots, pause, `⚷ Certs`, `⚙ Account`, theme) at 360px, so the bar wraps: brand
   * and toggle on the first row, the cluster on the second. `height: auto` rather than a
   * new fixed height is what keeps the dropdown's `top: 100%` honest — it pins to the
   * bottom of the masthead however many rows that is — and `min-height` stops a page whose
   * cluster also wrapped from collapsing to a 2-line bar. */
  .masthead {
    height: auto;
    min-height: var(--header-h);
    flex-wrap: wrap;
    row-gap: .4rem;
    padding-block: .5rem;
    /* The bar must not start at y=0 of the layout viewport. On a real phone the viewport
     * runs under the status bar (Android Chrome is edge-to-edge by default; iOS does the
     * same once the page opts into viewport-fit=cover), and the system top-edge zone
     * does not reliably deliver taps to the page — a button in it is unreachable, not
     * unbound, and no amount of headless emulation shows it (an emulated viewport has no
     * system top edge). Padding by the top safe-area inset pushes the whole bar — the
     * first-row #nav-toggle first — into the tappable region; the dropdown's top:100%
     * follows the taller bar. env() resolves to 0px on every non-notch surface (desktop,
     * headless, non-notched phones), so those render byte-identical. The 0.5rem is the
     * padding-block value restated for the one side the inset grows, so the two never
     * drift. Same fix brain of reese shipped for the same owner-reported symptom. */
    padding-top: calc(.5rem + env(safe-area-inset-top, 0px));
  }
  /* The cluster needs the same treatment one level down, and these three rules are what a
   * 360px phone actually requires — measured on both sides of them. With only the rule above,
   * the bar came out 183px tall: the four status dots in a single-file column (`#nav-status`
   * carries the shared `.gap` class, which is `flex-wrap: wrap`) and `⚷ Certs` broken over two
   * lines, because every item shrank to a fraction of its content. Before this phase the bar
   * kept its fixed 58px and that 118px dot column simply overflowed it onto the page below,
   * with the document 45px wider than the viewport. So: the cluster may wrap, its items may
   * neither shrink nor break a label, and the dots stay the one line that makes them a readout
   * instead of a stack. The bar lands at ~123px at 360px and ~93px at 640px — three visual
   * rows at the narrow end, two at 640px — because four labelled dots plus `⚷ Certs`,
   * `⚙ Account` and the theme button do not fit in 320px twice over, and nothing here hides a
   * control to make the arithmetic work: a phone gets the same words every other width does. */
  .masthead-right { flex-wrap: wrap; justify-content: flex-end; gap: .4rem; }
  .masthead-right > * { flex: none; white-space: nowrap; }
  #nav-status { flex-wrap: nowrap; }
  /* The reveal, through task 01's token: `#nav-toggle` reads its `display` from
   * `--nav-toggle-display`, so declaring the token on the element here is the whole flip —
   * no selector order to get right, no `!important`, and the `button.ghost` outline it
   * inherits stays the only styling it needs. Right-aligned because that is where a thumb
   * already is on a phone (brain of reese does the same), and `touch-action` because the
   * default double-tap-to-zoom disambiguation makes a first tap feel like a dead button. */
  #nav-toggle {
    --nav-toggle-display: inline-flex;
    align-items: center;
    justify-content: center;
    margin-inline-start: auto;
    min-width: 40px;
    min-height: 40px;
    padding: 0 .5rem;
    font-size: 15px;
    touch-action: manipulation;
  }
  /* The links leave the row. `.is-open` below out-ranks this (two classes to one), so the
   * order of the two rules is not load-bearing. */
  nav.tabs { display: none; }
  /* The nav *is* the dropdown — no menu panel element to keep in sync. `.masthead` is
   * `position: sticky`, which is a positioned ancestor, so `top: 100%` lands directly under
   * it and `left/right: 0` span the masthead's padding box edge to edge; hence
   * `margin-inline-start: 0`, without which the base rule's .4rem over-constrains the box
   * and insets the menu's left edge by that much. `z-index: 41` is one above the masthead's
   * 40 so the menu paints over the page, which scrolls underneath it.
   *
   * `box-shadow: var(--shadow)` rather than a literal black: this file's rule is that no
   * component hardcodes a colour, and the light theme re-declares the token — a .35-alpha
   * black drop is the one thing that looks wrong under a white menu. */
  nav.tabs.is-open {
    display: flex;
    flex-direction: column;
    gap: 0;
    position: absolute;
    top: 100%;
    left: 0;
    right: 0;
    margin-inline-start: 0;
    padding: .4rem;
    background: var(--bg-raised);
    border-bottom: 1px solid var(--border);
    box-shadow: var(--shadow);
    z-index: 41;
  }
  /* Rows, not pills: the base .38rem padding is a desktop tab strip, and a menu item you
   * can miss is a menu that does not work with a thumb. `border-radius` is restated because
   * the highlight (`:hover`, `[aria-current="page"]`) is now a row, not a chip — both rules
   * carry over unchanged, which is why nothing here mentions a colour. */
  nav.tabs.is-open a {
    padding: .6rem .7rem;
    min-height: 40px;
    border-radius: var(--radius-sm);
  }
 }
 /* No transition on the dropdown, on purpose: `display: none` → `display: flex` does not
 * animate, so an `opacity`/`translateY` here would be a declaration that never runs (running
 * it would mean the visibility/`@starting-style` machinery brain of reese carries, which is
 * more CSS than a menu of five links deserves). The existing
 * `@media (prefers-reduced-motion: reduce)` rule therefore has nothing new to kill. */
 /* ---- layout ------------------------------------------------------------- */
 main { padding: 1.15rem 1.25rem 3rem; max-width: 1680px; margin: 0 auto; }
@@ -726,6 +861,39 @@ details.charts-box[open] > summary { color: var(--text-muted); margin-bottom: .5
 /* the chip is a value, not a heading: it keeps its own casing and size inside the summary */
 details.charts-box > summary .chip { text-transform: none; letter-spacing: .02em; }
 /* The `/ups` Power events feed is the same kind of disclosure and shut by default, which is
   what lets `page-ups.js` fetch nothing while nobody is looking at it. It is not `charts-box`
   copied for one structural reason: that toggle sits *inside* a card body, while this
   `<summary>` replaces the card's own `header` — so it takes the header's type, padding,
   sunken ground and bottom rule (a closed card reads as its heading, and an open one puts the
   feed under the same rule every other card draws), with the `▸`/`▾` caret as the summary's
   first flex item so the marker rides the text's centre line and says open/closed in a shape
   as well as a colour. No `margin-bottom` on the open state: the `.body` below carries the
   spacing `charts-box`'s summary has to buy for itself. No animation either, same as
   `charts-box` — a summary that snaps is the house style, and `prefers-reduced-motion` holds
   by construction. */
 details.events-box { min-width: 0; }
 details.events-box > summary {
  display: flex; align-items: center; gap: .55rem;
  list-style: none; cursor: pointer; user-select: none;
  font-size: 12.5px; font-weight: 650; letter-spacing: .04em; text-transform: uppercase;
  color: var(--text-muted);
  padding: .6rem .8rem;
  border-bottom: 1px solid var(--border);
  background: color-mix(in srgb, var(--bg-raised) 70%, var(--bg-sunken));
 }
 details.events-box > summary::-webkit-details-marker { display: none; }
 details.events-box > summary::before { content: "\25B8"; font-size: 9px; color: var(--text-faint); }
 details.events-box[open] > summary::before { content: "\25BE"; }
 details.events-box > summary:hover { color: var(--text); }
 /* open, the label steps back: the operator is reading the feed now, not the heading */
 details.events-box[open] > summary { color: var(--text-faint); }
 /* Inside the disclosure the body is a *grandchild* of the card, so the shared
   `.card > .body` padding no longer reaches it. This restates that padding rather than
   inventing a second one; `ul.events` and `.events-pager` stay untouched — they are
   class-based and resolve here exactly as they do on the other three feeds. */
 details.events-box > .body { padding: .8rem; }
 .host-charts { display: grid; gap: .7rem; }
 .host-chart { display: grid; gap: .15rem; min-width: 0; }
 /* `sm` is the slot's floor before `LineChart` writes its measured height inline, so an
@@ -9,13 +9,22 @@
 * Commands are the only write path in the product. They are offered only when the backend
 * says `enabled`, and anything that can cut power requires typing DANGER here *and* the
 * server re-checks the same gate — a hidden button is not a safety control.
 *
 * The power-events list is **collapsed by default** behind a `details.events-box` and lazy:
 * a closed `<details>` renders nothing, so while it is shut the page fetches `/api/events`
 * not at all (`/system`'s Charts rule — nothing is built for a feed nobody can see). The
 * first expand fetches; a re-expand paints what is in hand while it is fresh.
 */
 'use strict';
 const { $, fetchJSON, setTxt, setValue, setDot, num, duration, poll, eventText, naText } = Dash;
 const state = { range: 86400, cards: new Map(), charts: {}, poller: null, pollMs: 5000,
-                simulated: false, pending: null };
+                simulated: false, pending: null,
                // The events disclosure: `open` gates the poll path, `painted`/`fetchedAt`
                // decide whether an expand has to fetch or can draw the rows already in the
                // `<ul>` (a `<details>` keeps its children, so re-opening costs nothing).
                events: { open: false, painted: false, fetchedAt: 0 } };
 const MARKS = { ok: '✓', warn: '!', fail: '✕', unknown: '?' };
@@ -424,7 +433,10 @@ async function refresh() {
  $('#foot-note').textContent = `poll ${Math.round(state.pollMs / 1000)}s · ` +
    `${items.reduce((total, item) => total + (item.advertised_commands || []).length, 0)} commands advertised`;
  await refreshCharts(items.map((item) => item.name));
-  await refreshEvents();
+  // The feed is only refreshed while its disclosure is open. The list is the longest-lived
  // payload on the page (200 events) and the one a glance at "is my load safe" never reads,
  // so a shut `<details>` must cost the poll loop nothing.
  if (state.events.open) await refreshEvents();
 }
 async function refreshEvents() {
@@ -445,6 +457,11 @@ async function refreshEvents() {
        `${event.data && event.data.runtime_seconds ? ` <span class="faint mono">(${
          duration(event.data.runtime_seconds)} runtime)</span>` : ''}</span>`,
    });
    // Stamped only on the success path: a fetch that failed leaves `painted`/`fetchedAt` where
    // they were, so the next open re-fetches and a failed poll while open keeps showing the
    // rows already in the list (the stale-last-good rule the rest of this page follows).
    state.events.fetchedAt = Date.now();
    state.events.painted = true;
  } catch (err) { /* next poll */ }
 }
@@ -468,6 +485,24 @@ document.addEventListener('DOMContentLoaded', async () => {
    $('#dialog-run').disabled = event.target.value.trim() !== 'DANGER';
  });
  // The disclosure is the feed's only fetch trigger besides the poll loop. The native
  // `toggle` event fires on close too; closing just records the state so the loop stops.
  const eventsBox = $('.events-box');
  if (eventsBox) {
    state.events.open = eventsBox.open; // false — the markup ships no `open` attribute
    eventsBox.addEventListener('toggle', () => {
      state.events.open = eventsBox.open;
      if (!eventsBox.open) return;
      // First expand: `painted` is false — fetch. Re-expand: paint from the data in hand only
      // while it is fresh; a cache older than one poll interval is stale and re-fetches. A
      // fresh, already-painted list needs nothing: the `<details>` keeps its children, so the
      // rows (and the pager's page, in its WeakMap) are already where the operator left them.
      if (!state.events.painted || Date.now() - state.events.fetchedAt > state.pollMs) {
        refreshEvents();
      }
    });
  }
  state.poller = poll(refresh, state.pollMs);
  Dash.bindPause(state.poller);
 });
@@ -1754,6 +1754,185 @@ def test_the_event_feeds_scroll_instead_of_growing_the_page(client) -> None:
        assert '<ul class="events" id="events"' in html, f"{path} lost its feed's id"
 def test_ups_power_events_feed_sits_behind_a_collapsed_disclosure(client) -> None:
    """The `/ups` feed is *expandable*: one `details.events-box`, shut by default.
    `TODO.md:4` asks for an expandable list of incidents, and the shut disclosure is the half
    that costs something — a collapsed `<details>` renders no content, which is what lets the
    page fetch nothing while nobody is looking at the feed (`/system`'s Charts rule). Pinned on
    the served bytes because there is no JS test runner (a locked anchor): an `open` attribute
    would undo the phase silently, and the `#events` id has to stay *inside* the disclosure or
    the pager and the bounded 320px scroll lose their target.
    """
    html = _code(client.get("/ups").text)
    box = re.search(r'<details class="events-box">(.*?)</details>', html, re.S)
    assert box, "the Power events card is no longer a details.events-box disclosure"
    assert not re.search(r"<details[^>]*\bopen\b", html), \
        "the disclosure ships open — the list is tall again, not expandable"
    inner = box.group(1)
    assert "<summary>Power events</summary>" in inner, "the summary lost its label"
    assert '<ul class="events" id="events"' in inner, "the feed moved outside the disclosure"
    assert "loading…" in inner, "the first-expand placeholder is gone"
    assert "<h3>Power events</h3>" not in html, "the card heads its own body twice"
    # the rest of the page is untouched by the disclosure
    for still_there in ('id="ups-cards"', 'id="chart-charge"', 'id="chart-load"',
                        'id="confirm-dialog"'):
        assert still_there in client.get("/ups").text, f"/ups lost {still_there}"
 def test_ups_events_are_fetched_only_while_the_disclosure_is_open(client) -> None:
    """A closed Power events card costs the poll loop *nothing* — no fetch, no rows.
    Hiding a list that is still fetched every 5 s is the half-measure this pins out: the
    disclosure is only worth having if `refresh()` stops asking `/api/events` while it is shut
    (the `/system` Charts rule — "nothing is built or drawn while the stack is shut"), and the
    expand still has to fill the list, so the toggle needs the two facts a re-open is judged
    on: has it ever painted, and how old is what it painted. Pinned on the served script
    because there is no JS test runner (a locked anchor).
    """
    js = _code(client.get("/static/page-ups.js").text)
    # The state the two paths share: closed, nothing painted yet, nothing fetched yet.
    decl = js[js.index("const state = {"):js.index("const MARKS")]
    assert "events: { open: false, painted: false, fetchedAt: 0 }" in decl, \
        "the disclosure lost the state its lazy rule reads"
    # The poll path asks only while the card is open.
    refresh = js[js.index("async function refresh("):js.index("async function refreshEvents(")]
    assert "if (state.events.open) await refreshEvents();" in refresh, \
        "the poll loop fetches the event feed while the disclosure is shut"
    assert not re.search(r"^\s*await refreshEvents();", refresh, flags=re.M), \
        "an ungated refreshEvents() call survived in the poll path"
    # …and the fetch stamps its own freshness, on the success path only: a failed fetch must
    # leave `painted`/`fetchedAt` alone so the next open re-fetches (invariant 4's shape).
    feed = _event_feed_path(js)
    assert "state.events.fetchedAt = Date.now();" in feed and "state.events.painted = true;" in feed, \
        "a successful fetch does not stamp the cache the re-expand rule depends on"
    assert feed.index("Dash.eventsPager(") < feed.index("state.events.fetchedAt = Date.now();"), \
        "the cache is stamped before the rows are drawn"
    assert feed.index("state.events.painted = true;") < feed.index("} catch (err)"), \
        "a failed fetch would mark the list as painted"
    # The toggle is bound before the loop starts, so the first expand of the session is wired.
    boot = js[js.index("document.addEventListener('DOMContentLoaded'"):]
    handler = boot[boot.index("const eventsBox = $('.events-box');"):boot.index("state.poller = poll(")]
    assert boot.index("const eventsBox =") < boot.index("state.poller = poll("), \
        "the disclosure is wired after the first poll"
    assert "state.events.open = eventsBox.open;" in handler, \
        "the toggle never learns whether the card is open"
    assert "if (!eventsBox.open) return;" in handler, \
        "closing the card takes the fetch gate off"
    # first expand fetches; a re-expand paints the cache while it is one poll interval old
    assert "if (!state.events.painted || Date.now() - state.events.fetchedAt > state.pollMs) {" in handler, \
        "the expand lost its stale rule (one poll interval, the page's own cadence)"
    assert "refreshEvents();" in handler[handler.index("if (!state.events.painted"):], \
        "an open disclosure no longer fetches on a stale or empty cache"
 def test_the_ups_event_rows_keep_the_date_time_and_severity_shape(client) -> None:
    """`TODO.md:4`'s other half: an expandable list is only *clear* if each row says when.
    The disclosure is the new part of this phase; this is the half that had to survive it
    untouched. Every row still opens with a `<time>` carrying a month/day plus a 24-hour clock,
    then the UPS name inside the `sev <severity>` chip the stylesheet colours from the payload's
    own verdict, then the message through `eventText()` (subject named once) with the runtime
    footnote only when the event actually carries one. Pinned on the served script because there
    is no JS test runner (a locked anchor): a "tidy-up" of the row template that drops the
    timestamp, prints the raw message, or escapes nothing would ship silently otherwise.
    """
    js = _code(client.get("/static/page-ups.js").text)
    feed = _event_feed_path(js)
    at = feed.index("row: (event) =>")
    row = feed[at:feed.index("});", at)]
    # the date/time: `<time>` first, month + day + hour + minute, 24-hour (the operator reads
    # an incident log in the order it happened, and "14:05" on its own is not that)
    assert "<time>" in row and "</time>" in row, "the row lost its timestamp element"
    assert "new Date(event.ts * 1000).toLocaleString(" in row, \
        "the row formats something other than the event's own timestamp"
    for option in ("month: 'short'", "day: 'numeric'", "hour: '2-digit'", "minute: '2-digit'",
                   "hour12: false"):
        assert option in row, f"the timestamp no longer asks for {option}"
    assert row.index("<time>") < row.index('class="sev'), "the row no longer leads with the date"
    # who: the host inside the verdict chip, escaped, and the severity is the API's word
    assert 'class="sev ${event.severity}"' in row, \
        "the row stopped taking its colour word from the stored severity"
    assert "${DashCharts.escapeHtml(event.host)}</span>" in row, \
        "the row no longer names the UPS it belongs to, escaped"
    # what: the message through the shared subject-said-once cleaner, and escaped
    assert "${DashCharts.escapeHtml(eventText(event))}" in row, \
        "the message is no longer cleaned and escaped (raw HTML from an upstream is a bug)"
    # the runtime footnote is conditional: an event with no runtime says nothing about one
    assert "event.data && event.data.runtime_seconds" in row, \
        "the runtime footnote is no longer gated on the event carrying a runtime"
    assert "duration(event.data.runtime_seconds)} runtime)" in row, \
        "the runtime footnote stopped printing the stored seconds as a duration"
    # and the renderer is still handed to the shared pager over the bounded list, labelled
    assert "Dash.eventsPager($('#events'), data.events, {" in feed, \
        "the feed left the shared pager (no window, no page, no accessible name)"
    assert "label: 'Power events'" in feed, "the scroll container lost its accessible name"
    assert "No power events yet" in feed, "the empty feed no longer says which feed is empty"
 def test_the_ups_events_disclosure_is_a_quiet_disclosure_not_a_new_component(client) -> None:
    """The `/ups` summary borrows the card header's rhythm and no new palette (task 03).
    Pinned on the served stylesheet because a CSS edit is invisible until someone looks: the
    `\\25B8`/`\\25BE` caret pair says open/closed in a **shape** as well as a colour, the webkit
    marker is hidden so the browser's own triangle does not double it, and this `<summary>`
    carries the card header's ground and bottom rule because it *replaces* that header instead of
    sitting inside the body like `charts-box`'s toggle does. The `> .body` padding restatement is
    the quiet one: `.card > .body` is a **child** selector, so a body moved inside a disclosure
    silently loses its padding and the feed renders flush to the card edge.
    What the block must not do is grow a verdict colour (open/closed is not a grading) or
    re-state the shared feed rules — `ul.events`' bounded scroll and `.events-pager`'s strip are
    class-based and resolve inside the disclosure unchanged, so a second copy here would be a
    second thing to keep in sync. The undeclared-token audit itself stays the existing
    `test_no_stylesheet_rule_uses_an_undeclared_token`'s job, untouched.
    """
    css = _css(client)
    start = css.index("details.events-box { ")
    block = css[start:css.index(".host-charts {", start)]
    assert 'details.events-box > summary::before { content: "\\25B8"' in block, \
        "the toggle has no caret shape"
    assert 'details.events-box[open] > summary::before { content: "\\25BE"; }' in block, \
        "open and closed differ only in colour"
    assert "details.events-box > summary::-webkit-details-marker { display: none; }" in block, \
        "the browser's own marker doubles the caret"
    assert "cursor: pointer" in block and "list-style: none" in block, \
        "the summary no longer reads as a control"
    # it replaces the card header, so it carries the header's ground and bottom rule
    assert "border-bottom: 1px solid var(--border)" in block, \
        "a closed card no longer reads as its heading"
    assert "color-mix(in srgb, var(--bg-raised) 70%, var(--bg-sunken))" in block, \
        "the summary lost the header's sunken ground"
    # open: the label steps back, and no margin — the `.body` below carries the spacing
    assert "details.events-box[open] > summary { color: var(--text-faint); }" in block, \
        "an open summary does not de-emphasise"
    assert "margin-bottom" not in block, "the open summary stacks a gap on top of the body's"
    # the child-selector gotcha that task 01's markup introduced
    assert "details.events-box > .body { padding: .8rem; }" in block, \
        "the feed body lost its padding inside the disclosure"
    for token in ("var(--ok)", "var(--warn)", "var(--fail)", "var(--accent)"):
        assert token not in block, f"the disclosure graded open/closed with {token}"
    assert ".sev-" not in block, "the disclosure invented a verdict family"
    # one copy of each shared feed rule, class-based, resolving inside the disclosure as elsewhere
    assert css.count("ul.events {") == 1, "ul.events is styled twice — the bounded scroll drifted"
    assert css.count(".events-pager {") == 1, "the pager strip is styled twice"
    # the class this block styles is the class the page renders
    assert 'class="events-box"' in client.get("/ups").text, \
        "the stylesheet styles a disclosure no page renders"
 def test_the_pager_returns_to_page_1_when_the_events_change(client) -> None:
    """New events reset the window; the same events do not.
@@ -3850,6 +4029,162 @@ def test_the_disks_tab_is_in_the_masthead_of_every_page(client) -> None:
                < html.index('href="/llm"')), "tab order is machine, drive, engine, power"
 # ---- the collapsing masthead nav (phase 18) -------------------------------- #
 #
 # At ≤640px the five tab links leave the bar and come back as a dropdown under it, opened by
 # one `☰` button. There is no JS test runner (a locked anchor), so the phase is pinned the way
 # every page surface here is: on the served bytes. Three questions, in the order the pieces
 # were built — is the button on every tabbed page and on no others, does the stylesheet still
 # hide it above the breakpoint, and do the stylesheet and the binding still agree on the
 # breakpoint itself? That last one is the only failure mode no browser check catches: a number
 # that drifts in one file opens a menu into a `display: none` nav on the operator's phone.
 #: The attributes that make `#nav-toggle` a button and not a mystery glyph: it is not a form
 #: control (`type`), it says what it toggles (`aria-controls`), it says what state it is in
 #: (`aria-expanded`, which `app.js` keeps honest), and its only content is a `☰`.
 NAV_TOGGLE_ATTRS = ('class="ghost nav-toggle"', 'type="button"', 'aria-expanded="false"',
                    'aria-controls="nav-tabs"', 'aria-label="Toggle navigation"')
 def _masthead(html: str) -> str:
    """The served page's own masthead — the block the toggle and the nav have to live in.
    Slicing rather than searching the whole document is the point: a button in the footer would
    satisfy `id="nav-toggle" in html` and anchor to nothing, because the dropdown's
    `top: 100%` resolves against `.masthead`.
    """
    start = html.index('<header class="masthead"')
    return html[start:html.index("</header>", start)]
 def test_the_nav_toggle_is_in_the_masthead_of_every_tabbed_page(client) -> None:
    """Seven pages, one identical button, and the nav it controls still carrying five tabs.
    The dropdown is the only way to change dashboard on a phone, so a page missing the button is
    a page you can enter and leave the tab bar on, and a page whose nav lost its `id` is a button
    that toggles nothing. Pinned on all seven (`MARKUP_PAGES`) rather than on `PAGES` because the
    two admin pages have the same masthead and therefore the same contract.
    """
    for path in MARKUP_PAGES:
        header = _masthead(client.get(path).text)
        button = re.search(r'<button[^>]*id="nav-toggle"[^>]*>', header, re.S)
        assert button, f"{path}'s masthead has no #nav-toggle button"
        for attr in NAV_TOGGLE_ATTRS:
            assert attr in button.group(0), f"{path}'s nav toggle is missing {attr}"
        assert header.count('id="nav-toggle"') == 1, f"{path} has more than one nav toggle"
        # The nav is the menu: the id the button names, and all five dashboards inside it.
        assert '<nav class="tabs" id="nav-tabs" aria-label="Dashboards">' in header, \
            f"{path}'s tab nav has no #nav-tabs for the toggle to control"
        nav = header[header.index('id="nav-tabs"'):header.index("</nav>",
                                                                header.index('id="nav-tabs"'))]
        for tab in PAGES:
            assert f'href="{tab}"' in nav, f"{path} collapsed a nav that lost the {tab} tab"
        # Order inside the masthead: brand, toggle, nav — and the cluster after them, because
        # the ≤640px block right-aligns the button and wraps the cluster onto its own row.
        assert (header.index('id="nav-toggle"') < header.index('id="nav-tabs"')
                < header.index('class="masthead-right"')), \
            f"{path} put the toggle or the nav outside the brand → tabs → cluster row"
 def test_the_login_page_carries_no_nav_and_no_toggle(tmp_path: Path) -> None:
    """`/login` is brand link + theme toggle, and the shared binding must be inert there.
    No `client` fixture, and that is the whole shape of the test: the signed-in one cannot see
    this page at all (a signed-in `GET /login` is a `303` to the dashboard, and following it
    audits `/`'s markup under the name `/login`), which is the same redirect trap
    `tests/test_auth_api.py::test_the_login_page_carries_no_id_nothing_reads_and_no_dashboard_nav`
    documents for the orphan-`id` audit.
    Every tab on this page bounces straight back to it, so the page renders no tabs at all; a
    stray hamburger would be a control that opens a menu of redirects, and the `640px` block
    would reveal it. The last assertion is the other half of the contract: `app.js` still loads
    here, which is only safe because `if (navToggle && appNav)` no-ops without the elements.
    """
    db = str(tmp_path / "login-nav.sqlite3")
    store = SampleStore(db)
    app = create_app(Settings(db_path=db, admin_password=ADMIN_PASSWORD,
                              pbkdf2_iterations=FAST_PBKDF2), store)
    try:
        with TestClient(app) as anon:
            response = anon.get("/login")
            assert response.status_code == 200, \
                "a signed-out /login must be the form, not a bounce"
            html = response.text
    finally:
        store.close()
    for absent in ('id="nav-toggle"', 'id="nav-tabs"', 'class="tabs"',
                   'aria-controls="nav-tabs"', 'aria-label="Dashboards"'):
        assert absent not in html, f"/login renders the collapsed nav's {absent}"
    assert '<a class="brand" href="/">' in html and 'id="theme-toggle"' in html, \
        "/login lost the two pieces of chrome that do belong on it"
    assert 'src="/static/app.js"' in html, (
        "/login stopped loading the shared chrome whose guard is its no-toggle contract")
 def test_the_nav_toggle_css_and_binding_carry_the_same_breakpoint(client) -> None:
    """Hidden by default, revealed at one breakpoint, in two files that must agree on its value.
    The base rule is *not* a literal `.nav-toggle { display: none }` and pinning that literal
    would be pinning a bug: the element also carries the shared `ghost` class, whose
    `button.ghost { display: inline-flex }` out-ranks a single-class rule and ships a visible
    button into the desktop masthead. The shipped shape is an id rule reading a token
    (`--nav-toggle-display`, `none` in `:root`), which the ≤640px block flips by re-declaring the
    token on the element — so that is what is asserted here, plus the dropdown and the four close
    paths the binding owns.
    """
    css = _code(_css(client))
    assert re.search(r"--nav-toggle-display:\s*none", css), \
        "the nav toggle is no longer hidden by default — the desktop masthead grew a ☰"
    assert re.search(r"#nav-toggle\s*\{\s*display:\s*var\(--nav-toggle-display\)", css), \
        "#nav-toggle stopped reading the token that keeps its reveal order-independent"
    nav_css = _code(_css_section(_css(client), "mobile nav"))
    media = re.search(r"@media\s*\(max-width:\s*(\d+)px\)", nav_css)
    assert media, "the mobile nav block lost its media query"
    for rule in ("--nav-toggle-display: inline-flex",   # the reveal, through task 01's token
                 "nav.tabs { display: none; }",          # the links leave the row
                 "nav.tabs.is-open",                     # …and come back as the menu
                 "position: absolute",
                 "top: 100%",                             # pinned under the sticky masthead
                 "z-index: 41",                           # one above the masthead's 40
                 "background: var(--bg-raised)",
                 "flex-wrap: wrap",                       # the two-row bar, cluster still visible
                 # the safe-area inset keeps the first-row #nav-toggle out of the system
                 # top-edge zone a real phone's status bar owns (taps there never reach
                 # the page; headless emulation has no such zone, so only this pin says
                 # the bar still pads for it):
                 "padding-top: calc(.5rem + env(safe-area-inset-top, 0px))"):
        assert rule in nav_css, f"the ≤640px nav block lost `{rule}`"
    # Nothing on the phone masthead may be hidden to make the width work: the cluster wraps.
    assert ".masthead-right" in nav_css and "#nav-status" in nav_css, \
        "the mobile masthead hid the status cluster instead of wrapping it"
    js = _code(client.get("/static/app.js").text)
    binding = js[js.index("const navToggle ="):js.index("function rangeControl(")]
    assert "if (navToggle && appNav)" in binding, \
        "the binding lost the guard that makes it inert on /login"
    assert binding.count("classList.toggle('is-open'") == 1, \
        "a state change now bypasses setNavMenu(), so is-open and aria-expanded can diverge"
    for path in ("navToggle.setAttribute('aria-expanded'",
                 "navToggle.addEventListener('click'",   # close (and open) on the button
                 "event.target.closest('a')",             # close on a tab click, delegated
                 "event.key === 'Escape'",                # close on Esc…
                 "navToggle.focus()",                     # …with focus back on the opener
                 "if (!mq.matches) setNavMenu(false)"):   # close on resize back to desktop
        assert path in binding, f"the nav binding lost a close path: {path}"
    assert "mq.addEventListener" in binding, "the resize-back close was never registered"
    js_bp = re.search(r"matchMedia\('\(max-width: (\d+)px\)'\)", js)
    assert js_bp, "app.js no longer reads the nav breakpoint through matchMedia"
    assert js_bp.group(1) == media.group(1), (
        f"the nav breakpoint drifted: CSS hides the tabs below {media.group(1)}px, "
        f"app.js closes the menu below {js_bp.group(1)}px")
    assert media.group(1) == "640", "the nav breakpoint moved off the 640px the phase shipped"
 def test_the_header_status_dot_picks_up_the_disks_job(client) -> None:
    """`disks` gets its own dot instead of hiding inside `hosts`.