felhom.eu/REPORT-hub-system-page.md

REPORT — the hub's System page, made readable (2026-10-10)

Before: 3 cards plus one box table with 30 columns that scrolled sideways. Release ids, cancelled TEST approvals and package counts came first. The red „Approve now (guest + host)" sat in the middle of the page. After: 4 parts, in this order:

1. Needs attention.
2. Waiting for you.
3. Boxes: one 7-column table. Each row opens in place.
4. Details: closed by default.

No sideways scroll at 1280 px or at 390 px (measured: scrollWidth == clientWidth at both widths).

Released as hub 0.146.0 on the operator's word („Release the new hub version", 2026-10-10). No box touched.

Baseline

• felhom.eu main @ ec5605d4 after git pull --rebase. The last hub release in hub/CHANGELOG.md is v0.145.0.
• Architecture read: 05-hub-architecture.md §5 (floors, vouched agent), 11-os-updates.md §5.7, §5.8 and §5.11 (System page, lanes, kernel approval), 08-alarm-ladder.md §6.3 (the colours).

What changed

• hub/internal/web/system_view.go (new) is the view model:
  • buildSystemPage takes all the inputs and is pure, so the fixture can feed it.
  • summariseRow makes the box mark and the plain-words reasons, from the same cell colours as before.
  • buildWaiting makes the cards, with the same gate the buttons always had: a set exists, it is not approved, and nothing is waiting.
• hub/internal/web/system.go: the handler fills systemInput. It now also reads the controller version per box (GetCustomers). It reads the candidate package list and the healthy-night count, both only to describe a card.
• hub/internal/web/templates/system.html: the new layout and its page CSS. It uses the hub's colour tokens. The nav wraps on a phone (this page's CSS only).
• Docs: 05 (a short paragraph) and 11 §5.7 (the new layout). hub/CHANGELOG.md: an „Unreleased" entry.

Where each old item went (the Baselines contract)

Old item	Now
Flash / error line	unchanged, at the top
Per box: the 30 columns, the ring button, the updates switch	Boxes: the row opens to all of them. Ring, health, controller + agent, OS updates, kernel and last night are also in the row
Approved releases (ids, packages, by, TEST)	Details
„Approve now (guest + host)"	Details, beside the releases. It now asks: „Approve the guest and host sets now, without the usual 24 h and one night?"
Cancelled approvals (last 7 days)	Details
What ring 0 runs now (counts, first seen, the wait reason)	Details. A set still being tested is also listed under Waiting for you, with the hub's reason
Approve Docker / Proxmox / kernel set	Waiting for you: one card each, when the button is allowed
Version floors, global floor, vouched agent	Details (the #version-floors link opens it)
kernel.panic, oops, crash restarts, crash guard, root files	in each box's row, and also as a table in Details
Legend („unknown" = could not read, never a guess)	under the Boxes title

Same routes and the same _csrf field on every form. Clicking to open works without JavaScript (<details>).

Tests

• go build ./... && go vet ./... && go test ./... in hub/: rc 0. python3 scripts/repo_gates.py --fast: rc 0.
• Pushed as cf6fec8d. CI job 1643 (matched on head_sha): completed, conclusion success.
• New file system_layout_test.go. Each test below was red-proofed: I broke the code on purpose and saw the test fail.
  • Every old item is still on the page. Red: I dropped the containerd line → Boxes lacks ">containerd</dt>".
  • Every form carries _csrf and posts only to the old routes. Red: I removed _csrf from a card → form /os/approve-pve lacks the CSRF or return field.
  • Needs attention: a green box is not listed; amber and red boxes are, with reasons; all green gives one line. Red: I skipped the cells → the amber box (agent behind) is missing.
  • Waiting for you: a card per lane, the not-ready line, nothing once approved, guest/host never a card, and the empty line. Red: I dropped the wait gate → kernel not ready: cards [...].
  • Approve now is inside Details and asks first.
• Changed old assertion: system_trim_test.go now looks for >Last disk trim</dt> (it was </th>). The label moved from a table header into the box panel.

Screenshots (made-up fixture shaped like today: 4 boxes, kernel approved, Docker still testing, Tester 2 „unknown")

All are in documentation/audits/hub-system-page-2026-10-10/. They were taken with a headless Chromium in the scratchpad, from system-fixture*.html. Those pages are written by SYSTEM_PAGE_FIXTURE_OUT=<dir> go test ./internal/web/ -run TestSystemPage_WriteFixture.

• 01-1280.png — the page at 1280 px.
• 02-390.png — the page at 390 px (phone).
• 03-1280-details-open.png — Details open.
• 04-1280-box-open.png — one box (Tester 1) open.
• 05-1280-waiting-card.png — a Proxmox set ready, as a card with its button.

Not done / notes

• Guest and host sets get no card: they approve themselves. Their urgent override („Approve now") is in Details.
• The flash after an approval still says approved <release id>. That text comes from the /os/ route, not from this page, so I left it.
• Teardown: provisioned nothing. No machine, no host, no hub change.

Release (hub 0.146.0)

• Version commit 9fbdee83 (CHANGELOG heading). Image gitea.dooplex.hu/admin/felhom-hub:0.146.0, digest sha256:c31ffdd8…. Manifest commit 2db785da.
• ArgoCD after a hard refresh: OutOfSync on Deployment/hub and on three Secrets (gitea-creds, healthchecks-config, umami-config) and Deployment/umami. So I synced only Deployment/hub (the runbook's R-925 rule). The others are untouched. Sync phase Succeeded; app health Healthy.
• The pod runs felhom-hub:0.146.0, ready. Its log: felhom-hub 0.146.0 starting, Listening on :8080.
• Live check through the ClusterIP with the operator's Basic auth (the endpoint the browser calls): GET /system → 200. All four parts are there; 4 boxes open in place; 9 forms, each with _csrf. Today's real page: 4 boxes amber (three „root files behind the vouched agent's"; Tester 2 „needs a restart since 2026-10-04", „agent behind 0.142.0 → 0.150.0", „could not read: default kernel, root files"). „Nothing waits for your approval." The Docker 29.9.0-1 and Proxmox 9.2.21 sets are still being tested (1 of 2 healthy nights on demo-felhom).
• No button was pressed.

Questions for the operator

1. Look at the five screenshots. Is the order right (problems first, then approvals, then boxes)? OK, or what to change?
2. Tester 2 („agent older than v0.142.0") shows red for „agent behind" plus three amber reasons. Do you want an old agent as one line only, or is the full list useful?