a11y: keyboard-accessible panel toggles, region landmarks in inspector

- Add role="button" tabindex="0" aria-expanded to .link-host-title in both static and JS-rendered panels (host panels + UniFi switches) - Sync aria-expanded in togglePanel(), restoreCollapseState(), collapseAll(), and expandAll() - Add keydown handler (Enter/Space) so panel headers are keyboard-operable - Add role="region" aria-label to inspector main chassis area - Add role="complementary" aria-label to inspector port detail panel - Replace last inline date-parse in renderLinks() with _toIso() helper Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
security: escape user input in 403 error response to prevent XSS
2026-05-10 23:44:23 -04:00 · 2026-05-10 23:41:31 -04:00 · 2026-05-10 23:39:52 -04:00 · 2026-05-10 23:37:32 -04:00 · 2026-05-10 23:34:16 -04:00 · 2026-05-10 23:21:27 -04:00
9 changed files with 817 additions and 599 deletions
@@ -5,11 +5,13 @@ management UI. Authentication via Authelia forward-auth headers.
 All monitoring and alerting is handled by the separate monitor.py daemon.
 """
 import hashlib
+import html
 import ipaddress
 import json
 import logging
 import os
 import re
+import tempfile
 import threading
 import time
 import uuid
@@ -72,8 +74,8 @@ def _purge_old_jobs_loop():
            for jid, j in list(_diag_jobs.items()):
                if j['status'] == 'running' and j.get('created_at', 0) < stuck_cutoff:
                    j['status'] = 'done'
-                    j['result'] = {'status': 'error', 'error': 'Diagnostic timed out (thread crash)'}
-                    logger.error(f'Diagnostic job {jid} appeared stuck; marked as errored')
+                    j['result'] = {'status': 'error', 'error': 'Diagnostic abandoned — no activity for 5 minutes.'}
+                    logger.error(f'Diagnostic job {jid} stuck (no activity for 5 min); marked done/error')


 _purge_thread = threading.Thread(target=_purge_old_jobs_loop, daemon=True)
@@ -131,10 +133,12 @@ def require_auth(f):
            )
        allowed = _config().get('auth', {}).get('allowed_groups', ['admin'])
        if not any(g in allowed for g in user['groups']):
+            safe_user   = html.escape(user['username'])
+            safe_groups = html.escape(', '.join(allowed))
            return (
                f'<h1>403 – Access denied</h1>'
-                f'<p>Your account ({user["username"]}) is not in an allowed group '
-                f'({", ".join(allowed)}).</p>',
+                f'<p>Your account ({safe_user}) is not in an allowed group '
+                f'({safe_groups}).</p>',
                403,
            )
        return f(*args, **kwargs)
@@ -142,12 +146,31 @@ def require_auth(f):


 # ---------------------------------------------------------------------------
-# Page routes
+# Helpers
 # ---------------------------------------------------------------------------

 _PAGE_LIMIT = 200  # max events returned per request


+def _annotate_suppressions(events: list, suppressions: list) -> None:
+    """Annotate each event dict in-place with an is_suppressed bool."""
+    for ev in events:
+        sup_type = (
+            'unifi_device' if ev.get('event_type') == 'unifi_device_offline'
+            else 'interface' if ev.get('event_type') == 'interface_down'
+            else 'host'
+        )
+        ev['is_suppressed'] = db.check_suppressed(
+            suppressions, sup_type,
+            ev.get('target_name', ''), ev.get('target_detail', '') or '',
+        )
+
+
+# ---------------------------------------------------------------------------
+# Page routes
+# ---------------------------------------------------------------------------
+
+
@app.route('/')
@require_auth
 def index():
@@ -159,6 +182,7 @@ def index():
    last_check = db.get_state('last_check', 'Never')
    snapshot = json.loads(snapshot_raw) if snapshot_raw else {}
    suppressions = db.get_active_suppressions()
+    _annotate_suppressions(events, suppressions)
    recent_resolved = db.get_recent_resolved(hours=24, limit=10)
    return render_template(
        'index.html',
@@ -213,6 +237,8 @@ def suppressions_page():
@require_auth
 def api_status():
    active = db.get_active_events(limit=_PAGE_LIMIT)
+    suppressions = db.get_active_suppressions()
+    _annotate_suppressions(active, suppressions)
    last_check = db.get_state('last_check', 'Never')
    return jsonify({
        'summary': db.get_status_summary(),
@@ -458,7 +484,7 @@ def api_avatar():

    # Build a safe cache filename from the username (alphanumeric + - _ .)
    safe_name = re.sub(r'[^a-zA-Z0-9._-]', '_', username)
-    cache_dir = ldap_cfg.get('cache_dir', '/tmp/gandalf_avatars')
+    cache_dir = ldap_cfg.get('cache_dir', os.path.join(tempfile.gettempdir(), 'gandalf_avatars'))
    os.makedirs(cache_dir, exist_ok=True)
    cache_file = os.path.join(cache_dir, f'user_{safe_name}.jpg')
    sentinel    = os.path.join(cache_dir, f'user_{safe_name}.none')
@@ -222,10 +222,17 @@ def get_status_summary() -> dict:
                   WHERE resolved_at IS NULL GROUP BY severity"""
            )
            counts = {r['severity']: r['cnt'] for r in cur.fetchall()}
+            cur.execute(
+                """SELECT COUNT(*) as cnt FROM network_events
+                   WHERE resolved_at IS NOT NULL
+                   AND resolved_at > DATE_SUB(NOW(), INTERVAL 24 HOUR)"""
+            )
+            resolved_24h = cur.fetchone()['cnt']
            return {
                'critical': counts.get('critical', 0),
                'warning': counts.get('warning', 0),
                'info': counts.get('info', 0),
+                'resolved_24h': resolved_24h,
            }


@@ -92,8 +92,10 @@ function updateStatusBar(summary, lastCheck, daemonOk) {
  // Update stat cards
  const scCrit = document.getElementById('stat-critical-val');
  const scWarn = document.getElementById('stat-warning-val');
+  const scRes  = document.getElementById('stat-resolved-val');
  if (scCrit) scCrit.textContent = critCount;
  if (scWarn) scWarn.textContent = warnCount;
+  if (scRes && summary.resolved_24h !== null && summary.resolved_24h !== undefined) scRes.textContent = summary.resolved_24h;
  const statCritCard = document.getElementById('stat-critical');
  if (statCritCard) statCritCard.classList.toggle('lt-stat-card--alert', critCount > 0);

@@ -205,7 +207,7 @@ function updateEventsTable(events, totalActive) {
    return;
  }

-  const truncated = totalActive != null && totalActive > active.length;
+  const truncated = totalActive !== null && totalActive !== undefined && totalActive > active.length;
  const countNotice = truncated
    ? `<div class="pagination-notice">Showing ${active.length} of ${totalActive} active alerts &mdash; <a href="/api/events?limit=1000">view all via API</a></div>`
    : '';
@@ -220,9 +222,12 @@ function updateEventsTable(events, totalActive) {
      ? `<a href="${lt.escHtml(ticketBase)}${lt.escHtml(String(e.ticket_id))}" target="_blank"
            class="ticket-link">#${e.ticket_id}</a>`
      : '–';
+    const supBadge = e.is_suppressed
+      ? `<span class="lt-badge badge-suppressed" title="Alert suppressed">🔕 sup</span>`
+      : '';
    return `
-      <tr class="row-${e.severity}">
-        <td><span class="lt-badge badge-${e.severity}">${e.severity}</span></td>
+      <tr class="row-${e.severity}${e.is_suppressed ? ' row-suppressed' : ''}">
+        <td><span class="lt-badge badge-${e.severity}">${e.severity}</span>${supBadge}</td>
        <td>${lt.escHtml(e.event_type.replace(/_/g,' '))}</td>
        <td><strong>${lt.escHtml(e.target_name)}</strong></td>
        <td>${lt.escHtml(e.target_detail || '–')}</td>
@@ -271,9 +276,12 @@ function openSuppressModal(type, name, detail) {
  updateSuppressForm();
  lt.modal.open('suppress-modal');

-  document.querySelectorAll('#suppress-modal .pill').forEach(p => p.classList.remove('active'));
+  document.querySelectorAll('#suppress-modal .pill').forEach(p => {
+    p.classList.remove('active');
+    p.setAttribute('aria-pressed', 'false');
+  });
  const manualPill = document.querySelector('#suppress-modal .pill-manual');
-  if (manualPill) manualPill.classList.add('active');
+  if (manualPill) { manualPill.classList.add('active'); manualPill.setAttribute('aria-pressed', 'true'); }
  const hint = document.getElementById('duration-hint');
  if (hint) hint.textContent = 'Suppression will persist until manually removed.';
 }
@@ -292,8 +300,11 @@ function updateSuppressForm() {

 function setDuration(mins, el) {
  document.getElementById('sup-expires').value = mins || '';
-  document.querySelectorAll('#suppress-modal .pill').forEach(p => p.classList.remove('active'));
-  if (el) el.classList.add('active');
+  document.querySelectorAll('#suppress-modal .pill').forEach(p => {
+    p.classList.remove('active');
+    p.setAttribute('aria-pressed', 'false');
+  });
+  if (el) { el.classList.add('active'); el.setAttribute('aria-pressed', 'true'); }
  const hint = document.getElementById('duration-hint');
  if (hint) {
    if (mins) {
@@ -332,6 +343,10 @@ async function submitSuppress(e) {
  }
 }

+// ── Suppress form – wired here so the modal works from any page ──────
+document.getElementById('suppress-form')?.addEventListener('submit', submitSuppress);
+document.getElementById('sup-type')?.addEventListener('change', updateSuppressForm);
+
 // ── Global click delegation ───────────────────────────────────────────
 document.addEventListener('click', e => {
  // Refresh button
@@ -83,16 +83,91 @@
  .lt-main.lt-container { padding-top: calc(46px + var(--space-sm)); }
 }

-/* ── Refresh button loading state ────────────────────────────────── */
-[data-action="refresh"].is-loading {
+/* ── Button loading state ─────────────────────────────────────────── */
+[data-action="refresh"].is-loading,
+.lt-btn.is-loading {
  opacity: .5;
  pointer-events: none;
  cursor: wait;
+  position: relative;
 }
-[data-action="refresh"].is-loading::after {
+[data-action="refresh"].is-loading::after,
+.lt-btn.is-loading::after {
  content: '…';
 }

+/* ── Secondary button – dark-mode definition ─────────────────────────
+   base.css only defines .lt-btn-secondary in its light-theme block,
+   so dark mode falls back to the default cyan primary appearance.
+   This restores a visually distinct secondary look in dark mode. */
+.lt-btn-secondary {
+  background: var(--cyan-dim);
+  border-color: rgba(0,212,255,.28);
+  color: var(--cyan);
+}
+.lt-btn-secondary:hover {
+  background: rgba(0,212,255,.18);
+  border-color: rgba(0,212,255,.5);
+}
+
+/* ── ⌘K hint button in header ────────────────────────────────────── */
+.lt-cmd-hint-btn {
+  font-size: 0.65rem;
+  opacity: 0.55;
+  letter-spacing: 0.03em;
+  padding: 0.2rem 0.45rem;
+}
+
+/* ── Form group modifiers ────────────────────────────────────────── */
+.lt-form-group--last { margin-bottom: 0; }
+
+/* ── Search input size variant ───────────────────────────────────── */
+.lt-search-input--sm { width: 180px; }
+
+/* ── Notification panel helpers ──────────────────────────────────── */
+.lt-notif-empty {
+  padding: 1rem;
+  font-size: 0.75rem;
+  color: var(--text-muted);
+  text-align: center;
+}
+.lt-notif-view-all {
+  width: 100%;
+  text-align: center;
+  display: block;
+  font-size: 0.72rem;
+}
+.lt-notif-dot {
+  border-radius: 50%;
+  margin-top: 4px;
+  flex-shrink: 0;
+}
+
+/* ── Divider variants ────────────────────────────────────────────── */
+.lt-divider--compact { margin: 1rem 0 0.75rem; }
+.lt-divider--unifi   { margin: 20px 0 12px; }
+.lt-divider-label--unifi { color: var(--cyan); letter-spacing: .1em; }
+
+/* ── Stats grid spacing variant ──────────────────────────────────── */
+.lt-stats-grid--mb { margin-bottom: 16px; }
+
+/* ── Topology section collapse toggle ────────────────────────────── */
+.topo-collapse-btn {
+  margin-left: auto;
+  font-size: .7em;
+  color: var(--text-muted);
+  background: transparent;
+  border: 1px solid var(--border-color);
+  padding: 2px 8px;
+  cursor: pointer;
+  font-family: var(--font);
+  letter-spacing: .04em;
+  transition: border-color .15s, color .15s;
+}
+.topo-collapse-btn:hover { border-color: var(--amber); color: var(--amber); }
+.topo-collapsible { overflow: hidden; transition: max-height .25s ease; }
+.topo-collapsible.is-collapsed { display: none; }
+
 /* ── Animations used by custom components ─────────────────────────── */
@keyframes pulse-red {
  0%,100% { box-shadow: 0 0 0 0 rgba(255,45,85,.5); }
@@ -139,17 +214,9 @@
  padding: 1px 7px;
 }
 .g-section-actions  { margin-left: auto; }
-.events-filter-bar  { display: flex; align-items: center; gap: 8px; flex-wrap: wrap; }
-.events-filter-bar .lt-input-sm { width: 220px; }
 .sev-pills          { display: flex; gap: 4px; }
-.g-page-header { margin-bottom: 20px; }
-.g-page-title {
-  font-size: 1em;
-  font-weight: bold;
-  color: var(--text-accent);
-  letter-spacing: .06em;
-}
 .g-page-sub { font-size: .78em; color: var(--text-muted); margin-top: 4px; }
+.g-page-sub-aside { font-size: .78em; color: var(--text-muted); margin-left: 8px; }

 /* ── Badge severity color variants (used with lt-badge) ───────────── */
 .badge-critical { color: var(--red);    border-color: var(--red);    text-shadow: var(--glow-red); }
@@ -168,6 +235,8 @@
 .lt-table tr.row-warning  td              { background: rgba(255,107,0,.04); }
 .lt-table tr.row-warning  td:first-child  { border-left: 2px solid var(--orange); }
 .lt-table tr.row-resolved td              { opacity: .65; }
+.lt-table tr.row-suppressed td            { opacity: .6; }
+.lt-table tr.row-suppressed td:first-child{ border-left-color: var(--text-muted) !important; }

 /* ── Table size modifier ─────────────────────────────────────────── */
 .lt-table-sm th,
@@ -177,7 +246,6 @@
 .ts-cell    { color: var(--text-muted); font-size: .75em; white-space: nowrap; }
 .desc-cell  { max-width: 280px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .ticket-link{ color: var(--amber); text-shadow: var(--glow-amber); font-weight: bold; }
-.empty-state { padding: 28px; text-align: center; color: var(--text-muted); font-size: .82em; }
 .pagination-notice { font-size: .8em; color: var(--text-muted); padding: 6px 0 8px; }
 .pagination-notice a { color: var(--amber); }

@@ -374,6 +442,9 @@
  background: linear-gradient(to bottom, var(--cyan), var(--green));
  opacity: .7;
 }
+.topo-vc-wire--wan  { background: linear-gradient(to bottom, var(--cyan), rgba(0,212,255,.3)); opacity: .7; }
+.topo-vc-wire--10g  { background: var(--amber); opacity: .6; }
+.topo-vc-wire--mgmt { background: var(--border-color); opacity: .5; }
 /* Blurred copy of the wire for a soft glow halo */
 .topo-vc-wire::before {
  content: '';
@@ -431,6 +502,7 @@
 .topo-v2-sub   { font-size: .58em; color: var(--text-muted); letter-spacing: .02em; }
 .topo-v2-vlan  { font-size: .54em; color: var(--cyan); opacity: .75; }

+.topo-v2-host--bus { min-width: 80px; max-width: 96px; }
 .topo-v2-internet { border-color: var(--cyan);  color: var(--cyan);  text-shadow: var(--glow-cyan); box-shadow: 0 0 12px rgba(0,212,255,.12); }
 .topo-v2-router   { border-color: var(--cyan);  color: var(--cyan);  text-shadow: var(--glow-cyan); box-shadow: 0 0 12px rgba(0,212,255,.14); }
 .topo-v2-switch   { border-color: var(--amber); color: var(--amber); text-shadow: var(--glow-amber); box-shadow: 0 0 12px rgba(255,179,0,.12); }
@@ -480,6 +552,7 @@
 /* Bus rails */
 .topo-bus-section {
  width: 100%;
+  max-width: 860px;
  display: flex;
  flex-direction: column;
  align-items: stretch;
@@ -560,6 +633,10 @@
  color: var(--text-muted);
  font-family: var(--font);
 }
+.topo-legend-item--offrack {
+  border: 1px dashed var(--border-color);
+  padding: 1px 5px;
+}
 .topo-legend-line-10g { width: 24px; height: 2px; background: var(--green); display: inline-block; box-shadow: 0 0 4px rgba(0,255,136,.5); }
 .topo-legend-line-1g  { width: 24px; height: 0; border-top: 2px dashed var(--amber); display: inline-block; }
 .topo-legend-line-wan { width: 24px; height: 2px; background: linear-gradient(to right, var(--cyan), var(--green)); display: inline-block; }
@@ -587,7 +664,6 @@
 .panel-toggle   { font-size: .65em; color: var(--text-muted); flex-shrink: 0; margin-left: 6px; padding: 0 4px; border: 1px solid var(--border-color); }
 .link-host-panel.collapsed > .link-ifaces-grid { display: none; }

-.link-collapse-bar { display: flex; gap: 8px; margin-bottom: 10px; }

 .link-ifaces-grid {
  display: grid;
@@ -706,38 +782,7 @@
 .poe-bar-warn { background: var(--amber); }
 .poe-bar-crit { background: var(--red); }

-/* UniFi section divider */
-.unifi-section-header {
-  display: flex;
-  align-items: center;
-  gap: 12px;
-  margin: 24px 0 12px;
-  color: var(--cyan);
-  font-size: .75em;
-  letter-spacing: .1em;
-}
-.unifi-section-header::before,
-.unifi-section-header::after {
-  content: '';
-  flex: 1;
-  height: 1px;
-  background: linear-gradient(90deg, transparent, var(--cyan), transparent);
-}

-/* Link health summary */
-.link-summary-panel {
-  background: var(--bg2);
-  border: 1px solid var(--border-color);
-  padding: 12px 16px;
-  margin-bottom: 12px;
-}
-.link-summary-panel.link-summary-has-alerts { border-color: var(--amber); }
-.link-summary-grid  { display: flex; flex-wrap: wrap; gap: 20px; align-items: flex-end; }
-.link-summary-stat  { min-width: 80px; }
-.link-summary-stat.lss-alert .lss-label { color: var(--amber); }
-.lss-label { display: block; font-size: .62em; color: var(--text-muted); text-transform: uppercase; letter-spacing: .05em; margin-bottom: 2px; }
-.lss-value { font-size: 1.2em; font-weight: bold; color: var(--text); }
-.lss-sub   { font-size: .7em; color: var(--text-muted); font-weight: normal; }

 .link-loading { padding: 20px; text-align: center; color: var(--text-muted); font-size: .8em; }
 .link-loading::after { content: ' ...'; animation: blink 1s step-end infinite; }
@@ -73,7 +73,6 @@
        <a href="{{ url_for('index') }}"
           class="lt-brand-title lt-glitch"
           data-text="GANDALF"
-           style="text-decoration:none"
           aria-label="GANDALF home">GANDALF</a>
        <span class="lt-brand-subtitle">Network Monitor // LotusGuild</span>
      </div>
@@ -96,28 +95,6 @@
          Inspector
        </a>
        {% if user.groups and 'admin' in user.groups %}
-        <div class="lt-nav-dropdown" data-action="toggle-nav-dropdown">
-          <a href="#"
-             class="lt-nav-link{% if request.endpoint == 'suppressions_page' %} active{% endif %}"
-             role="button"
-             aria-haspopup="true"
-             aria-expanded="false"
-             aria-controls="lt-admin-dropdown-menu">
-            Admin &#x25BE;
-          </a>
-          <ul class="lt-nav-dropdown-menu"
-              id="lt-admin-dropdown-menu"
-              role="menu"
-              aria-label="Admin menu">
-            <li role="none">
-              <a href="{{ url_for('suppressions_page') }}" role="menuitem"
-                 class="{% if request.endpoint == 'suppressions_page' %}active{% endif %}">
-                Suppressions
-              </a>
-            </li>
-          </ul>
-        </div>
-        {% else %}
        <a href="{{ url_for('suppressions_page') }}"
           class="lt-nav-link{% if request.endpoint == 'suppressions_page' %} active{% endif %}"
           {% if request.endpoint == 'suppressions_page' %}aria-current="page"{% endif %}>
@@ -156,21 +133,20 @@
            <button type="button" class="lt-notif-panel-clear" id="lt-notif-clear-btn">Mark all read</button>
          </div>
          <div class="lt-notif-panel-list" id="lt-notif-list">
-            <div style="padding:0.75rem;font-size:0.75rem;color:var(--text-muted);text-align:center">Loading&hellip;</div>
+            <div class="lt-notif-empty">Loading&hellip;</div>
          </div>
          <div class="lt-notif-panel-footer">
-            <a href="{{ url_for('index') }}" class="lt-btn lt-btn-ghost lt-btn-sm" style="width:100%;text-align:center;display:block;font-size:0.72rem">View dashboard</a>
+            <a href="{{ url_for('index') }}" class="lt-btn lt-btn-ghost lt-btn-sm lt-notif-view-all">View dashboard</a>
          </div>
        </div>
      </div>

      <!-- ⌘K affordance -->
      <button type="button"
-              class="lt-btn lt-btn-ghost lt-btn-sm"
+              class="lt-btn lt-btn-ghost lt-btn-sm lt-cmd-hint-btn"
              title="Command palette (Ctrl+K)"
              aria-label="Open command palette"
-              onclick="if(window.lt&&lt.cmdPalette)lt.cmdPalette.open()"
-              style="font-size:0.65rem;opacity:0.55;letter-spacing:0.03em;padding:0.2rem 0.45rem">&#x2315;&nbsp;K</button>
+              onclick="if(window.lt&&lt.cmdPalette)lt.cmdPalette.open()">&#x2315;&nbsp;K</button>

      <button type="button" class="lt-theme-btn" id="lt-theme-btn"
              aria-label="Toggle theme" title="Toggle light/dark mode">&#x2600;</button>
@@ -210,7 +186,7 @@
        <span class="lt-footer-sep">|</span>
        <span class="lt-footer-hint"><span class="lt-footer-key">[ S ]</span> SUPPRESS</span>
        <span class="lt-footer-sep">|</span>
-      {% elif request.endpoint == 'links_page' %}
+      {% elif request.endpoint in ('links_page', 'inspector') %}
        <span class="lt-footer-hint"><span class="lt-footer-key">[ R ]</span> REFRESH</span>
        <span class="lt-footer-sep">|</span>
      {% endif %}
@@ -221,6 +197,59 @@
    <span>GANDALF &mdash; TDS v1.2</span>
  </footer>

+  <!-- QUICK-SUPPRESS MODAL — available on all pages via [S] shortcut -->
+  <div id="suppress-modal" class="lt-modal-overlay"
+       role="dialog" aria-modal="true" aria-labelledby="suppress-modal-title" aria-hidden="true">
+    <div class="lt-modal">
+      <div class="lt-modal-header">
+        <h3 class="lt-modal-title" id="suppress-modal-title">Suppress Alert</h3>
+        <button type="button" class="lt-modal-close" data-modal-close aria-label="Close">&#x2715;</button>
+      </div>
+      <form id="suppress-form">
+        <div class="lt-modal-body">
+          <div class="lt-form-group">
+            <label class="lt-label" for="sup-type">Target Type</label>
+            <select class="lt-select" id="sup-type" name="target_type">
+              <option value="host">Host (all interfaces)</option>
+              <option value="interface">Specific Interface</option>
+              <option value="unifi_device">UniFi Device</option>
+              <option value="all">Global Maintenance</option>
+            </select>
+          </div>
+          <div class="lt-form-group" id="sup-name-group">
+            <label class="lt-label" for="sup-name">Target Name</label>
+            <input type="text" class="lt-input" id="sup-name" name="target_name" placeholder="e.g. large1">
+          </div>
+          <div class="lt-form-group" id="sup-detail-group" style="display:none">
+            <label class="lt-label" for="sup-detail">Interface <span class="lt-field-hint">(interface type only)</span></label>
+            <input type="text" class="lt-input" id="sup-detail" name="target_detail" placeholder="e.g. enp35s0">
+          </div>
+          <div class="lt-form-group">
+            <label class="lt-label" for="sup-reason">Reason <span class="required">*</span></label>
+            <input type="text" class="lt-input" id="sup-reason" name="reason"
+                   placeholder="e.g. Planned switch reboot" required>
+          </div>
+          <div class="lt-form-group lt-form-group--last">
+            <label class="lt-label">Duration</label>
+            <div class="duration-pills" role="group" aria-label="Select suppression duration">
+              <button type="button" class="pill" data-duration="30" aria-pressed="false">30 min</button>
+              <button type="button" class="pill" data-duration="60" aria-pressed="false">1 hr</button>
+              <button type="button" class="pill" data-duration="240" aria-pressed="false">4 hr</button>
+              <button type="button" class="pill" data-duration="480" aria-pressed="false">8 hr</button>
+              <button type="button" class="pill pill-manual active" data-duration="" aria-pressed="true">Manual &#x221E;</button>
+            </div>
+            <input type="hidden" id="sup-expires" name="expires_minutes" value="">
+            <div class="lt-field-hint" id="duration-hint">Persists until manually removed.</div>
+          </div>
+        </div>
+        <div class="lt-modal-footer">
+          <button type="button" class="lt-btn lt-btn-secondary" data-modal-close>Cancel</button>
+          <button type="submit" class="lt-btn lt-btn-primary">Apply</button>
+        </div>
+      </form>
+    </div>
+  </div>
+
  <!-- KEYBOARD SHORTCUTS MODAL -->
  <div id="lt-keys-help" class="lt-modal-overlay" aria-hidden="true">
    <div class="lt-modal" role="dialog" aria-modal="true" aria-labelledby="keys-help-title">
@@ -229,11 +258,11 @@
        <button type="button" class="lt-modal-close" data-modal-close aria-label="Close">&#x2715;</button>
      </div>
      <div class="lt-modal-body">
-        <table class="lt-table" style="width:100%">
+        <table class="lt-table">
          <thead><tr><th>Shortcut</th><th>Action</th></tr></thead>
          <tbody>
            <tr><td>Ctrl / &#x2318; + K</td><td>Command palette</td></tr>
-            <tr><td>R</td><td>Refresh data (Dashboard / Link Debug)</td></tr>
+            <tr><td>R</td><td>Refresh data (Dashboard / Link Debug / Inspector)</td></tr>
            <tr><td>S</td><td>Quick-suppress alert (Dashboard)</td></tr>
            <tr><td>*</td><td>Open settings</td></tr>
            <tr><td>?</td><td>Show this help</td></tr>
@@ -257,26 +286,22 @@
      <div class="lt-modal-body">
        <div class="lt-form-group">
          <label class="lt-label">Auto-refresh interval</label>
-          <div class="duration-pills" id="settings-refresh-pills">
-            <button type="button" class="pill" data-refresh-interval="15">15 s</button>
-            <button type="button" class="pill" data-refresh-interval="30">30 s</button>
-            <button type="button" class="pill" data-refresh-interval="60">1 min</button>
-            <button type="button" class="pill" data-refresh-interval="300">5 min</button>
-            <button type="button" class="pill" data-refresh-interval="0">Off</button>
+          <div class="duration-pills" id="settings-refresh-pills" role="group" aria-label="Select auto-refresh interval">
+            <button type="button" class="pill" data-refresh-interval="15" aria-pressed="false">15 s</button>
+            <button type="button" class="pill" data-refresh-interval="30" aria-pressed="false">30 s</button>
+            <button type="button" class="pill" data-refresh-interval="60" aria-pressed="false">1 min</button>
+            <button type="button" class="pill" data-refresh-interval="300" aria-pressed="false">5 min</button>
+            <button type="button" class="pill" data-refresh-interval="0" aria-pressed="false">Off</button>
          </div>
          <div class="lt-field-hint" id="settings-refresh-hint"></div>
        </div>
-        <div class="lt-divider" style="margin:1rem 0 0.75rem"></div>
+        <div class="lt-divider lt-divider--compact"></div>
        <div class="lt-kv-grid">
-          <div class="lt-kv-row">
-            <span class="lt-kv-label">User</span>
-            <span class="lt-kv-value lt-text-cyan">{{ user.name or user.username }}</span>
-          </div>
+          <span class="lt-kv-key">User</span>
+          <span class="lt-kv-val lt-kv-val--cyan">{{ user.name or user.username }}</span>
          {% if user.groups %}
-          <div class="lt-kv-row">
-            <span class="lt-kv-label">Groups</span>
-            <span class="lt-kv-value">{{ user.groups | join(', ') }}</span>
-          </div>
+          <span class="lt-kv-key">Groups</span>
+          <span class="lt-kv-val">{{ user.groups | join(', ') }}</span>
          {% endif %}
        </div>
      </div>
@@ -299,7 +324,7 @@
      lt.init({ bootName: 'GANDALF' });

      // Theme toggle
-      var themeBtn = document.getElementById('lt-theme-btn');
+      const themeBtn = document.getElementById('lt-theme-btn');
      if (themeBtn) themeBtn.addEventListener('click', function() { lt.theme.toggle(); });

      // Command palette
@@ -318,9 +343,9 @@

    // ── Global footer + key actions ───────────────────────────────────────
    document.addEventListener('click', function(e) {
-      var btn = e.target.closest('[data-action]');
+      const btn = e.target.closest('[data-action]');
      if (!btn) return;
-      var action = btn.getAttribute('data-action');
+      const action = btn.getAttribute('data-action');
      if (action === 'show-keyboard-help' && window.lt)  lt.modal.open('lt-keys-help');
      if (action === 'open-settings' && window.lt)       lt.modal.open('lt-settings-modal');
    });
@@ -341,8 +366,8 @@

    // ── Settings modal ────────────────────────────────────────────────────
    (function() {
-      var LS_KEY = 'gandalf_settings';
-      var DEFAULT = { refreshInterval: 30 };
+      const LS_KEY = 'gandalf_settings';
+      const DEFAULT = { refreshInterval: 30 };

      function loadSettings() {
        try { return Object.assign({}, DEFAULT, JSON.parse(localStorage.getItem(LS_KEY) || '{}')); }
@@ -356,9 +381,11 @@

      function applyRefreshPillUI(interval) {
        document.querySelectorAll('#settings-refresh-pills .pill').forEach(function(p) {
-          p.classList.toggle('active', parseInt(p.dataset.refreshInterval) === interval);
+          const isActive = parseInt(p.dataset.refreshInterval) === interval;
+          p.classList.toggle('active', isActive);
+          p.setAttribute('aria-pressed', isActive ? 'true' : 'false');
        });
-        var hint = document.getElementById('settings-refresh-hint');
+        const hint = document.getElementById('settings-refresh-hint');
        if (hint) {
          if (interval === 0)        hint.textContent = 'Auto-refresh disabled.';
          else if (interval < 60)    hint.textContent = 'Refreshes every ' + interval + ' seconds.';
@@ -367,16 +394,16 @@
      }

      // Init pill UI from saved settings
-      var _settings = loadSettings();
+      const _settings = loadSettings();
      applyRefreshPillUI(_settings.refreshInterval);

      // Expose for pages that need to read it (e.g. index.html for autoRefresh)
      window.gandalfSettings = _settings;

      document.addEventListener('click', function(e) {
-        var pill = e.target.closest('#settings-refresh-pills .pill[data-refresh-interval]');
+        const pill = e.target.closest('#settings-refresh-pills .pill[data-refresh-interval]');
        if (!pill) return;
-        var interval = parseInt(pill.dataset.refreshInterval);
+        const interval = parseInt(pill.dataset.refreshInterval);
        _settings.refreshInterval = interval;
        saveSettings(_settings);
        applyRefreshPillUI(interval);
@@ -385,16 +412,16 @@

    // ── Notification Bell — shows active monitoring alerts ────────────────
    (function() {
-      var bell     = document.getElementById('lt-notif-bell');
-      var panel    = document.getElementById('lt-notif-panel');
-      var list     = document.getElementById('lt-notif-list');
-      var clearBtn = document.getElementById('lt-notif-clear-btn');
-      var wrapEl   = document.getElementById('lt-notif-wrap');
+      const bell     = document.getElementById('lt-notif-bell');
+      const panel    = document.getElementById('lt-notif-panel');
+      const list     = document.getElementById('lt-notif-list');
+      const clearBtn = document.getElementById('lt-notif-clear-btn');
+      const wrapEl   = document.getElementById('lt-notif-wrap');
      if (!bell || !panel) return;

-      var _open      = false;
-      var _lastEvents = [];
-      var LS_READ_KEY = 'gandalf_notif_read_before';
+      let _open       = false;
+      let _lastEvents = [];
+      const LS_READ_KEY = 'gandalf_notif_read_before';

      function getReadBefore() {
        try { return parseInt(localStorage.getItem(LS_READ_KEY) || '0'); } catch(_) { return 0; }
@@ -413,31 +440,31 @@
      }

      function fmtAgo(dateStr) {
-        var diff = Math.floor((Date.now() - toMs(dateStr)) / 1000);
+        const diff = Math.floor((Date.now() - toMs(dateStr)) / 1000);
        if (diff < 60)    return diff + 's ago';
        if (diff < 3600)  return Math.floor(diff/60) + 'm ago';
        if (diff < 86400) return Math.floor(diff/3600) + 'h ago';
        return Math.floor(diff/86400) + 'd ago';
      }

-      var SEV_DOT = { critical: 'var(--red)', warning: 'var(--amber)' };
+      const SEV_DOT = { critical: 'var(--red)', warning: 'var(--amber)' };

      function renderAlerts(events) {
        _lastEvents = events || [];
-        var readBefore = getReadBefore();
-        var active = _lastEvents.filter(function(e) { return e.severity !== 'info'; });
-        var unreadCount = active.filter(function(e) { return toMs(e.last_seen) > readBefore; }).length;
+        const readBefore = getReadBefore();
+        const active = _lastEvents.filter(function(e) { return e.severity !== 'info'; });
+        const unreadCount = active.filter(function(e) { return toMs(e.last_seen) > readBefore; }).length;
        lt.notif.set(bell, unreadCount);

        if (!active.length) {
-          list.innerHTML = '<div style="padding:1rem;font-size:0.75rem;color:var(--text-muted);text-align:center">&#x2714; No active alerts</div>';
+          list.innerHTML = '<div class="lt-notif-empty">&#x2714; No active alerts</div>';
          return;
        }
        list.innerHTML = active.slice(0, 25).map(function(e) {
-          var isUnread = toMs(e.last_seen) > readBefore;
-          var dotColor = SEV_DOT[e.severity] || 'var(--text-muted)';
+          const isUnread = toMs(e.last_seen) > readBefore;
+          const dotColor = SEV_DOT[e.severity] || 'var(--text-muted)';
          return '<div class="lt-notif-item' + (isUnread ? ' lt-notif-item--unread' : '') + '">' +
-            '<div class="lt-notif-dot' + (isUnread ? '' : ' lt-notif-dot--read') + '" style="background:' + dotColor + ';border-radius:50%;margin-top:4px"></div>' +
+            '<div class="lt-notif-dot' + (isUnread ? '' : ' lt-notif-dot--read') + '" style="background:' + dotColor + '"></div>' +
            '<div class="lt-notif-item-body">' +
              '<div class="lt-notif-item-title">' + esc(e.target_name) + (e.target_detail ? ' &middot; ' + esc(e.target_detail) : '') + '</div>' +
              '<div class="lt-notif-item-time">' + esc(e.event_type.replace(/_/g,' ')) + ' &middot; ' + fmtAgo(e.last_seen) + '</div>' +
@@ -449,19 +476,19 @@
        fetch('/api/status', { credentials: 'same-origin' })
          .then(function(r) { return r.json(); })
          .then(function(data) {
-            var events = data.events || [];
+            const events = data.events || [];
            if (andRender) {
              renderAlerts(events);
            } else {
              _lastEvents = events;
-              var readBefore = getReadBefore();
-              var active = events.filter(function(e) { return e.severity !== 'info'; });
-              var unread = active.filter(function(e) { return toMs(e.last_seen) > readBefore; }).length;
+              const readBefore = getReadBefore();
+              const active = events.filter(function(e) { return e.severity !== 'info'; });
+              const unread = active.filter(function(e) { return toMs(e.last_seen) > readBefore; }).length;
              lt.notif.set(bell, unread);
            }
          })
          .catch(function() {
-            if (andRender) list.innerHTML = '<div style="padding:0.75rem;font-size:0.75rem;color:var(--text-muted);text-align:center">Could not load</div>';
+            if (andRender) list.innerHTML = '<div class="lt-notif-empty">Could not load</div>';
          });
      }

@@ -31,288 +31,38 @@
  <div class="lt-stat-card{% if summary.critical %} lt-stat-card--alert{% endif %}"
       id="stat-critical" role="button" tabindex="0"
       data-stat-filter="critical" aria-label="{{ summary.critical or 0 }} critical alerts">
-    <span class="lt-stat-icon" aria-hidden="true" style="color:var(--red);text-shadow:var(--glow-red)">●</span>
+    <span class="lt-stat-icon lt-text-red" aria-hidden="true">●</span>
    <div class="lt-stat-info">
-      <span class="lt-stat-value" id="stat-critical-val" style="color:var(--red)">{{ summary.critical or 0 }}</span>
+      <span class="lt-stat-value lt-text-red" id="stat-critical-val">{{ summary.critical or 0 }}</span>
      <span class="lt-stat-label">Critical</span>
    </div>
  </div>
  <div class="lt-stat-card"
       id="stat-warning" role="button" tabindex="0"
       data-stat-filter="warning" aria-label="{{ summary.warning or 0 }} warning alerts">
-    <span class="lt-stat-icon" aria-hidden="true" style="color:var(--amber)">●</span>
+    <span class="lt-stat-icon lt-text-amber" aria-hidden="true">●</span>
    <div class="lt-stat-info">
-      <span class="lt-stat-value" id="stat-warning-val" style="color:var(--amber)">{{ summary.warning or 0 }}</span>
+      <span class="lt-stat-value lt-text-amber" id="stat-warning-val">{{ summary.warning or 0 }}</span>
      <span class="lt-stat-label">Warning</span>
    </div>
  </div>
  <div class="lt-stat-card" id="stat-hosts" aria-label="Monitored hosts">
-    <span class="lt-stat-icon" aria-hidden="true" style="color:var(--cyan)">⬡</span>
+    <span class="lt-stat-icon lt-text-cyan" aria-hidden="true">⬡</span>
    <div class="lt-stat-info">
-      <span class="lt-stat-value" id="stat-hosts-val" style="color:var(--cyan)">{{ snapshot.hosts | length }}</span>
+      <span class="lt-stat-value lt-text-cyan" id="stat-hosts-val">{{ snapshot.hosts | length }}</span>
      <span class="lt-stat-label">Hosts</span>
    </div>
  </div>
  <div class="lt-stat-card" id="stat-resolved" aria-label="{{ recent_resolved | length }} alerts resolved in last 24 hours">
-    <span class="lt-stat-icon" aria-hidden="true" style="color:var(--green);text-shadow:var(--glow)">✔</span>
+    <span class="lt-stat-icon lt-text-green" aria-hidden="true">✔</span>
    <div class="lt-stat-info">
-      <span class="lt-stat-value" id="stat-resolved-val" style="color:var(--green)">{{ recent_resolved | length }}</span>
+      <span class="lt-stat-value lt-text-green" id="stat-resolved-val">{{ recent_resolved | length }}</span>
      <span class="lt-stat-label">Resolved 24h</span>
    </div>
  </div>
 </div>

-<!-- ── Network topology + host grid ───────────────────────────────── -->
-<section class="g-section">
-  <div class="g-section-header">
-    <h2 class="g-section-title">Network Hosts</h2>
-  </div>
-
-  <div class="topology" id="topology-diagram">
-  <div class="topo-v2">
-
-    {%- set topo_h = snapshot.hosts if snapshot.hosts else {} -%}
-
-    <!-- ══════════════════════════════════════════════════════════════
-         TIER 1: Internet (WAN edge)
-         ══════════════════════════════════════════════════════════ -->
-    <div class="topo-tier">
-      <div class="topo-v2-node topo-v2-internet">
-        <span class="topo-v2-icon">◈</span>
-        <span class="topo-v2-label">INTERNET</span>
-        <span class="topo-v2-sub">WAN uplink</span>
-      </div>
-    </div>
-
-    <!-- WAN wire: cyan → green gradient, labeled -->
-    <div class="topo-vc">
-      <div class="topo-vc-wire" style="background:linear-gradient(to bottom,var(--cyan),rgba(0,212,255,.3)); opacity:.7;"></div>
-      <span class="topo-vc-label">WAN · 10G SFP+</span>
-    </div>
-
-    <!-- ══════════════════════════════════════════════════════════════
-         TIER 2: Router – UDM-Pro
-         ══════════════════════════════════════════════════════════ -->
-    <div class="topo-tier">
-      <div class="topo-v2-node topo-v2-router">
-        <span class="topo-v2-icon">⬡</span>
-        <span class="topo-v2-label">UDM-Pro</span>
-        <span class="topo-v2-sub">Dream Machine Pro</span>
-        <span class="topo-v2-sub">RU24</span>
-      </div>
-    </div>
-
-    <!-- UDM-Pro → USW-Agg (10G SFP+) -->
-    <div class="topo-vc">
-      <div class="topo-vc-wire" style="background:var(--amber);opacity:.6;"></div>
-      <span class="topo-vc-label">10G SFP+</span>
-    </div>
-
-    <!-- ══════════════════════════════════════════════════════════════
-         TIER 3: USW-Aggregation
-         ══════════════════════════════════════════════════════════ -->
-    <div class="topo-tier">
-      <div class="topo-v2-node topo-v2-switch" id="topo-switch-agg">
-        <span class="topo-v2-icon">⬡</span>
-        <span class="topo-v2-label">USW-Agg</span>
-        <span class="topo-v2-sub">Aggregation · RU22</span>
-        <span class="topo-v2-sub">8 × 10G SFP+</span>
-        <span class="topo-v2-vlan">VLAN90 · 10.10.90.x/24</span>
-      </div>
-    </div>
-
-    <!-- USW-Agg → Pro 24 PoE (10G trunk) -->
-    <div class="topo-vc">
-      <div class="topo-vc-wire" style="background:var(--amber);opacity:.6;"></div>
-      <span class="topo-vc-label">10G trunk</span>
-    </div>
-
-    <!-- ══════════════════════════════════════════════════════════════
-         TIER 4: Pro 24 PoE
-         ══════════════════════════════════════════════════════════ -->
-    <div class="topo-tier">
-      <div class="topo-v2-node topo-v2-switch" id="topo-switch-poe">
-        <span class="topo-v2-icon">⬡</span>
-        <span class="topo-v2-label">Pro 24 PoE</span>
-        <span class="topo-v2-sub">24-Port · RU23</span>
-        <span class="topo-v2-sub">24 × 1G PoE</span>
-        <span class="topo-v2-vlan">DHCP · mgmt</span>
-      </div>
-    </div>
-
-    <!-- Pro 24 PoE → host bus section -->
-    <div class="topo-vc">
-      <div class="topo-vc-wire" style="background:var(--border-color);opacity:.5;"></div>
-    </div>
-
-    <!-- ══════════════════════════════════════════════════════════════
-         TIER 4 connecting bus – two rails (10G green + 1G amber dashed)
-         showing dual-homing for all 6 servers
-         ══════════════════════════════════════════════════════════ -->
-    <div class="topo-bus-section" style="max-width:860px;">
-
-      <!-- 10G storage bus (Agg → VLAN90) -->
-      <div class="topo-bus-10g">
-        <span class="topo-bus-10g-label">← USW-Agg · 10G SFP+ · VLAN90 →</span>
-        <div class="topo-bus-10g-line"></div>
-      </div>
-
-      <!-- 1G management bus (PoE → DHCP) -->
-      <div class="topo-bus-1g">
-        <span class="topo-bus-1g-label">← Pro 24 PoE · 1G · DHCP mgmt →</span>
-        <div class="topo-bus-1g-line"></div>
-      </div>
-
-      <!-- ── Host nodes with drop wires ── -->
-      <div class="topo-v2-hosts">
-        {%- set all_defs = [
-          ('compute-storage-gpu-01', 'csg-01',    'RU4–12',    'Ceph · VLAN90', False),
-          ('compute-storage-01',     'cs-01',     'RU14–17',   'Ceph · VLAN90', False),
-          ('storage-01',             'sto-01',    'rack',      'Ceph · VLAN90', False),
-          ('monitor-01',             'mon-01',    'ZimaBoard', 'mgmt',          False),
-          ('monitor-02',             'mon-02',    'ZimaBoard', 'mgmt',          False),
-          ('large1',                 'large1',    'off-rack',  'table',         True),
-        ] -%}
-        {%- for hname, hlabel, hsub, hvlan, off_rack in all_defs -%}
-        {%- set st = topo_h[hname].status if hname in topo_h else 'unknown' -%}
-        <div class="topo-v2-host-wrap">
-          <!-- dual-homing wires: 10G solid green + 1G dashed amber -->
-          <div class="topo-v2-host-wires">
-            <div class="topo-v2-wire-10g" data-host="{{ hname }}" title="10G SFP+ → USW-Agg"></div>
-            <div class="topo-v2-wire-1g"  data-host="{{ hname }}" title="1G → Pro 24 PoE"></div>
-          </div>
-          <!-- host box -->
-          <div class="topo-v2-node topo-v2-host topo-host topo-v2-status-{{ st }}{{ ' topo-v2-offrack' if off_rack else '' }}"
-               data-host="{{ hname }}" style="min-width:80px; max-width:96px;">
-            <span class="topo-v2-icon">▣</span>
-            <span class="topo-v2-label">{{ hlabel }}</span>
-            <span class="topo-v2-sub">{{ hsub }}</span>
-            <span class="topo-v2-vlan">{{ hvlan }}</span>
-            <span class="topo-badge topo-badge-{{ st }}">{{ st if st != 'unknown' else '–' }}</span>
-          </div>
-        </div>
-        {%- endfor -%}
-      </div>
-
-    </div><!-- /topo-bus-section -->
-
-    <!-- ── Legend ── -->
-    <div class="topo-legend">
-      <div class="topo-legend-item"><span class="topo-legend-line-wan"></span> WAN / uplink</div>
-      <div class="topo-legend-item"><span class="topo-legend-line-10g"></span> 10G SFP+ (Ceph / VLAN90)</div>
-      <div class="topo-legend-item"><span class="topo-legend-line-1g"></span> 1G DHCP (mgmt)</div>
-      <div class="topo-legend-item" style="border:1px dashed var(--border-color); padding:1px 5px; font-size:.56em; color:var(--text-muted);">dashed border = off-rack</div>
-    </div>
-
-  </div><!-- /topo-v2 -->
-  </div>
-
-  <!-- Host cards -->
-  <div class="host-grid" id="host-grid">
-    {% for name, host in snapshot.hosts.items() %}
-    {% set suppressed = suppressions | selectattr('target_name', 'equalto', name) | list %}
-    <div class="host-card host-card-{{ host.status }}" data-host="{{ name }}">
-      <div class="host-card-header">
-        <div class="host-name-row">
-          <span class="host-status-dot dot-{{ host.status }}"></span>
-          <span class="host-name">{{ name }}</span>
-          {% if suppressed %}
-          <span class="badge-suppressed" title="Suppressed">🔕</span>
-          {% endif %}
-        </div>
-        <div class="host-meta">
-          <span class="host-ip">{{ host.ip }}</span>
-          <span class="host-source source-{{ host.source }}">{{ host.source }}</span>
-        </div>
-      </div>
-
-      {% if host.interfaces %}
-      <div class="iface-list">
-        {% for iface, state in host.interfaces.items() | sort %}
-        <div class="iface-row">
-          <span class="iface-dot dot-{{ state }}"></span>
-          <span class="iface-name">{{ iface }}</span>
-          <span class="iface-state state-{{ state }}">{{ state }}</span>
-        </div>
-        {% endfor %}
-      </div>
-      {% else %}
-      <div class="host-ping-note">ping-only / no node_exporter</div>
-      {% endif %}
-
-      <div class="host-actions">
-        <button class="lt-btn lt-btn-ghost lt-btn-sm btn-suppress"
-                data-sup-type="host"
-                data-sup-name="{{ name }}"
-                data-sup-detail=""
-                title="Suppress alerts for this host">
-          🔕 Suppress
-        </button>
-        <a href="{{ url_for('links_page') }}#{{ name }}"
-           class="lt-btn lt-btn-secondary lt-btn-sm" style="text-decoration:none">
-          ↗ Links
-        </a>
-      </div>
-    </div>
-    {% else %}
-    <div class="lt-empty-state lt-empty-state--sm">
-      <div class="lt-empty-state-icon">⌛</div>
-      <div class="lt-empty-state-title">No host data yet</div>
-      <div class="lt-empty-state-body">The monitor daemon may still be starting up.</div>
-    </div>
-    {% endfor %}
-  </div>
-</section>
-
-<!-- ── UniFi devices ────────────────────────────────────────────────── -->
-{% if snapshot.unifi %}
-<section class="g-section">
-  <div class="g-section-header">
-    <h2 class="g-section-title">UniFi Devices</h2>
-  </div>
-  <div class="lt-table-wrap">
-    <table class="lt-table" id="unifi-table">
-      <caption class="lt-sr-only">UniFi network devices</caption>
-      <thead>
-        <tr>
-          <th>Status</th>
-          <th>Name</th>
-          <th>Type</th>
-          <th>Model</th>
-          <th>IP</th>
-          <th>Actions</th>
-        </tr>
-      </thead>
-      <tbody>
-        {% for d in snapshot.unifi %}
-        <tr class="{% if not d.connected %}row-critical{% endif %}">
-          <td>
-            <span class="dot-{{ 'up' if d.connected else 'down' }}"></span>
-            {{ 'ONLINE' if d.connected else 'OFFLINE' }}
-          </td>
-          <td><strong>{{ d.name }}</strong></td>
-          <td>{{ d.type }}</td>
-          <td>{{ d.model }}</td>
-          <td>{{ d.ip }}</td>
-          <td>
-            {% if not d.connected %}
-            <button class="lt-btn lt-btn-ghost lt-btn-sm btn-suppress"
-                    data-sup-type="unifi_device"
-                    data-sup-name="{{ d.name }}"
-                    data-sup-detail="">
-              🔕 Suppress
-            </button>
-            {% endif %}
-          </td>
-        </tr>
-        {% endfor %}
-      </tbody>
-    </table>
-  </div>
-</section>
-{% endif %}
-
-<!-- ── Active alerts ───────────────────────────────────────────────── -->
+<!-- ── Active alerts ─────────────────────────────── (above the fold) -->
 <section class="g-section">
  <div class="g-section-header">
    <h2 class="g-section-title">Active Alerts</h2>
@@ -323,12 +73,13 @@
    <div class="lt-toolbar-left">
      <div class="lt-search">
        <input type="search" class="lt-input lt-search-input" id="events-search"
-               placeholder="Filter by target, type, description…" autocomplete="off">
+               placeholder="Filter by target, type, description…" autocomplete="off"
+               aria-label="Filter active alerts">
      </div>
-      <div class="sev-pills">
-        <button type="button" class="pill active" data-sev="">All</button>
-        <button type="button" class="pill" data-sev="critical">Critical</button>
-        <button type="button" class="pill" data-sev="warning">Warning</button>
+      <div class="sev-pills" role="group" aria-label="Filter by severity">
+        <button type="button" class="pill active" data-sev="" aria-pressed="true">All</button>
+        <button type="button" class="pill" data-sev="critical" aria-pressed="false">Critical</button>
+        <button type="button" class="pill" data-sev="warning" aria-pressed="false">Warning</button>
      </div>
    </div>
  </div>
@@ -361,8 +112,11 @@
        <tbody>
          {% for e in events %}
          {% if e.severity != 'info' %}
-          <tr class="row-{{ e.severity }}">
-            <td><span class="lt-badge badge-{{ e.severity }}">{{ e.severity }}</span></td>
+          <tr class="row-{{ e.severity }}{% if e.is_suppressed %} row-suppressed{% endif %}">
+            <td>
+              <span class="lt-badge badge-{{ e.severity }}">{{ e.severity }}</span>
+              {% if e.is_suppressed %}<span class="lt-badge badge-suppressed" title="Alert suppressed">🔕 sup</span>{% endif %}
+            </td>
            <td>{{ e.event_type | replace('_', ' ') }}</td>
            <td><strong>{{ e.target_name }}</strong></td>
            <td>{{ e.target_detail or '–' }}</td>
@@ -410,6 +164,274 @@
  </div><!-- /.lt-frame -->
 </section>

+<!-- ── Network topology + host grid ───────────────────────────────── -->
+<section class="g-section">
+  <div class="g-section-header">
+    <h2 class="g-section-title">Network Hosts</h2>
+    <button type="button" class="topo-collapse-btn" id="topo-toggle-btn"
+            aria-expanded="true" aria-controls="topo-collapsible-wrap">&#x25B4; Collapse</button>
+  </div>
+  <div class="topo-collapsible" id="topo-collapsible-wrap">
+
+  <div class="topology" id="topology-diagram">
+  <div class="topo-v2">
+
+    {%- set topo_h = snapshot.hosts if snapshot.hosts else {} -%}
+
+    <!-- ══════════════════════════════════════════════════════════════
+         TIER 1: Internet (WAN edge)
+         ══════════════════════════════════════════════════════════ -->
+    <div class="topo-tier">
+      <div class="topo-v2-node topo-v2-internet">
+        <span class="topo-v2-icon">◈</span>
+        <span class="topo-v2-label">INTERNET</span>
+        <span class="topo-v2-sub">WAN uplink</span>
+      </div>
+    </div>
+
+    <!-- WAN wire: cyan → WAN gradient -->
+    <div class="topo-vc">
+      <div class="topo-vc-wire topo-vc-wire--wan"></div>
+      <span class="topo-vc-label">WAN · 10G SFP+</span>
+    </div>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         TIER 2: Router – UDM-Pro
+         ══════════════════════════════════════════════════════════ -->
+    <div class="topo-tier">
+      <div class="topo-v2-node topo-v2-router">
+        <span class="topo-v2-icon">⬡</span>
+        <span class="topo-v2-label">UDM-Pro</span>
+        <span class="topo-v2-sub">Dream Machine Pro</span>
+        <span class="topo-v2-sub">RU24</span>
+      </div>
+    </div>
+
+    <!-- UDM-Pro → USW-Agg (10G SFP+) -->
+    <div class="topo-vc">
+      <div class="topo-vc-wire topo-vc-wire--10g"></div>
+      <span class="topo-vc-label">10G SFP+</span>
+    </div>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         TIER 3: USW-Aggregation
+         ══════════════════════════════════════════════════════════ -->
+    <div class="topo-tier">
+      <div class="topo-v2-node topo-v2-switch" id="topo-switch-agg">
+        <span class="topo-v2-icon">⬡</span>
+        <span class="topo-v2-label">USW-Agg</span>
+        <span class="topo-v2-sub">Aggregation · RU22</span>
+        <span class="topo-v2-sub">8 × 10G SFP+</span>
+        <span class="topo-v2-vlan">VLAN90 · 10.10.90.x/24</span>
+      </div>
+    </div>
+
+    <!-- USW-Agg → Pro 24 PoE (10G trunk) -->
+    <div class="topo-vc">
+      <div class="topo-vc-wire topo-vc-wire--10g"></div>
+      <span class="topo-vc-label">10G trunk</span>
+    </div>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         TIER 4: Pro 24 PoE
+         ══════════════════════════════════════════════════════════ -->
+    <div class="topo-tier">
+      <div class="topo-v2-node topo-v2-switch" id="topo-switch-poe">
+        <span class="topo-v2-icon">⬡</span>
+        <span class="topo-v2-label">Pro 24 PoE</span>
+        <span class="topo-v2-sub">24-Port · RU23</span>
+        <span class="topo-v2-sub">24 × 1G PoE</span>
+        <span class="topo-v2-vlan">DHCP · mgmt</span>
+      </div>
+    </div>
+
+    <!-- Pro 24 PoE → host bus section -->
+    <div class="topo-vc">
+      <div class="topo-vc-wire topo-vc-wire--mgmt"></div>
+    </div>
+
+    <!-- ══════════════════════════════════════════════════════════════
+         TIER 4 connecting bus – two rails (10G green + 1G amber dashed)
+         showing dual-homing for all 6 servers
+         ══════════════════════════════════════════════════════════ -->
+    <div class="topo-bus-section">
+
+      <!-- 10G storage bus (Agg → VLAN90) -->
+      <div class="topo-bus-10g">
+        <span class="topo-bus-10g-label">← USW-Agg · 10G SFP+ · VLAN90 →</span>
+        <div class="topo-bus-10g-line"></div>
+      </div>
+
+      <!-- 1G management bus (PoE → DHCP) -->
+      <div class="topo-bus-1g">
+        <span class="topo-bus-1g-label">← Pro 24 PoE · 1G · DHCP mgmt →</span>
+        <div class="topo-bus-1g-line"></div>
+      </div>
+
+      <!-- ── Host nodes with drop wires ── -->
+      <div class="topo-v2-hosts">
+        {%- set all_defs = [
+          ('compute-storage-gpu-01', 'csg-01',    'RU4–12',    'Ceph · VLAN90', False),
+          ('compute-storage-01',     'cs-01',     'RU14–17',   'Ceph · VLAN90', False),
+          ('storage-01',             'sto-01',    'rack',      'Ceph · VLAN90', False),
+          ('monitor-01',             'mon-01',    'ZimaBoard', 'mgmt',          False),
+          ('monitor-02',             'mon-02',    'ZimaBoard', 'mgmt',          False),
+          ('large1',                 'large1',    'off-rack',  'table',         True),
+        ] -%}
+        {%- for hname, hlabel, hsub, hvlan, off_rack in all_defs -%}
+        {%- set st = topo_h[hname].status if hname in topo_h else 'unknown' -%}
+        <div class="topo-v2-host-wrap">
+          <!-- dual-homing wires: 10G solid green + 1G dashed amber -->
+          <div class="topo-v2-host-wires">
+            <div class="topo-v2-wire-10g" data-host="{{ hname }}" title="10G SFP+ → USW-Agg"></div>
+            <div class="topo-v2-wire-1g"  data-host="{{ hname }}" title="1G → Pro 24 PoE"></div>
+          </div>
+          <!-- host box -->
+          <div class="topo-v2-node topo-v2-host topo-host topo-v2-status-{{ st }}{{ ' topo-v2-offrack' if off_rack else '' }} topo-v2-host--bus"
+               data-host="{{ hname }}">
+            <span class="topo-v2-icon">▣</span>
+            <span class="topo-v2-label">{{ hlabel }}</span>
+            <span class="topo-v2-sub">{{ hsub }}</span>
+            <span class="topo-v2-vlan">{{ hvlan }}</span>
+            <span class="topo-badge topo-badge-{{ st }}">{{ st if st != 'unknown' else '–' }}</span>
+          </div>
+        </div>
+        {%- endfor -%}
+      </div>
+
+    </div><!-- /topo-bus-section -->
+
+    <!-- ── Legend ── -->
+    <div class="topo-legend">
+      <div class="topo-legend-item"><span class="topo-legend-line-wan"></span> WAN / uplink</div>
+      <div class="topo-legend-item"><span class="topo-legend-line-10g"></span> 10G SFP+ (Ceph / VLAN90)</div>
+      <div class="topo-legend-item"><span class="topo-legend-line-1g"></span> 1G DHCP (mgmt)</div>
+      <div class="topo-legend-item topo-legend-item--offrack">dashed border = off-rack</div>
+    </div>
+
+  </div><!-- /topo-v2 -->
+  </div>
+
+  <!-- Host cards -->
+  <div class="lt-toolbar" id="host-toolbar">
+    <div class="lt-toolbar-left">
+      <div class="lt-search">
+        <input type="search" class="lt-input lt-search-input lt-search-input--sm" id="host-search"
+               placeholder="Filter hosts…" autocomplete="off" aria-label="Filter hosts">
+      </div>
+    </div>
+  </div>
+  <div class="host-grid" id="host-grid">
+    {% for name, host in snapshot.hosts.items() %}
+    {% set suppressed = suppressions | selectattr('target_name', 'equalto', name) | list %}
+    <div class="host-card host-card-{{ host.status }}" data-host="{{ name }}">
+      <div class="host-card-header">
+        <div class="host-name-row">
+          <span class="host-status-dot dot-{{ host.status }}"></span>
+          <span class="host-name">{{ name }}</span>
+          {% if suppressed %}
+          <span class="badge-suppressed" title="Suppressed">🔕</span>
+          {% endif %}
+        </div>
+        <div class="host-meta">
+          <span class="host-ip">{{ host.ip }}</span>
+          <span class="host-source source-{{ host.source }}">{{ host.source }}</span>
+        </div>
+      </div>
+
+      {% if host.interfaces %}
+      <div class="iface-list">
+        {% for iface, state in host.interfaces.items() | sort %}
+        <div class="iface-row">
+          <span class="iface-dot dot-{{ state }}"></span>
+          <span class="iface-name">{{ iface }}</span>
+          <span class="iface-state state-{{ state }}">{{ state }}</span>
+        </div>
+        {% endfor %}
+      </div>
+      {% else %}
+      <div class="host-ping-note">ping-only / no node_exporter</div>
+      {% endif %}
+
+      <div class="host-actions">
+        <button class="lt-btn lt-btn-ghost lt-btn-sm btn-suppress"
+                data-sup-type="host"
+                data-sup-name="{{ name }}"
+                data-sup-detail=""
+                aria-label="Suppress alerts for {{ name }}">
+          🔕 Suppress
+        </button>
+        <a href="{{ url_for('links_page') }}#{{ name }}"
+           class="lt-btn lt-btn-secondary lt-btn-sm">
+          ↗ Links
+        </a>
+      </div>
+    </div>
+    {% else %}
+    <div class="lt-empty-state lt-empty-state--sm">
+      <div class="lt-empty-state-icon">⌛</div>
+      <div class="lt-empty-state-title">No host data yet</div>
+      <div class="lt-empty-state-body">The monitor daemon may still be starting up.</div>
+    </div>
+    {% endfor %}
+  </div>
+  </div><!-- /#topo-collapsible-wrap -->
+</section>
+
+<!-- ── UniFi devices ────────────────────────────────────────────────── -->
+{% if snapshot.unifi %}
+<section class="g-section">
+  <div class="g-section-header">
+    <h2 class="g-section-title">UniFi Devices</h2>
+  </div>
+  <div class="lt-frame">
+    <span class="lt-frame-bl">&#x255A;</span>
+    <span class="lt-frame-br">&#x255D;</span>
+    <div class="lt-section-header">Device Inventory</div>
+    <div class="lt-table-wrap">
+      <table class="lt-table" id="unifi-table">
+        <caption class="lt-sr-only">UniFi network devices</caption>
+        <thead>
+          <tr>
+            <th>Status</th>
+            <th>Name</th>
+            <th>Type</th>
+            <th>Model</th>
+            <th>IP</th>
+            <th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          {% for d in snapshot.unifi %}
+          <tr class="{% if not d.connected %}row-critical{% endif %}">
+            <td>
+              <span class="dot-{{ 'up' if d.connected else 'down' }}"></span>
+              {{ 'ONLINE' if d.connected else 'OFFLINE' }}
+            </td>
+            <td><strong>{{ d.name }}</strong></td>
+            <td>{{ d.type }}</td>
+            <td>{{ d.model }}</td>
+            <td>{{ d.ip }}</td>
+            <td>
+              {% if not d.connected %}
+              <button class="lt-btn lt-btn-ghost lt-btn-sm btn-suppress"
+                      data-sup-type="unifi_device"
+                      data-sup-name="{{ d.name }}"
+                      data-sup-detail=""
+                      aria-label="Suppress alerts for {{ d.name }}">
+                🔕 Suppress
+              </button>
+              {% endif %}
+            </td>
+          </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
+  </div>
+</section>
+{% endif %}
+
 <!-- ── Recently Resolved (last 24h) ───────────────────────────────── -->
 {% if recent_resolved %}
 <section class="g-section">
@@ -439,65 +461,12 @@
 </section>
 {% endif %}

-<!-- ── Quick-suppress modal ─────────────────────────────────────────── -->
-<div id="suppress-modal" class="lt-modal-overlay"
-     role="dialog" aria-modal="true" aria-labelledby="suppress-modal-title" aria-hidden="true">
-  <div class="lt-modal">
-    <div class="lt-modal-header">
-      <h3 class="lt-modal-title" id="suppress-modal-title">Suppress Alert</h3>
-      <button type="button" class="lt-modal-close" data-modal-close aria-label="Close">✕</button>
-    </div>
-    <form id="suppress-form">
-      <div class="lt-modal-body">
-        <div class="lt-form-group" style="margin-bottom:12px">
-          <label class="lt-label" for="sup-type">Target Type</label>
-          <select class="lt-select" id="sup-type" name="target_type">
-            <option value="host">Host (all interfaces)</option>
-            <option value="interface">Specific Interface</option>
-            <option value="unifi_device">UniFi Device</option>
-            <option value="all">Global Maintenance</option>
-          </select>
-        </div>
-        <div class="lt-form-group" id="sup-name-group" style="margin-bottom:12px">
-          <label class="lt-label" for="sup-name">Target Name</label>
-          <input type="text" class="lt-input" id="sup-name" name="target_name" placeholder="e.g. large1">
-        </div>
-        <div class="lt-form-group" id="sup-detail-group" style="margin-bottom:12px;display:none">
-          <label class="lt-label" for="sup-detail">Interface <span class="lt-field-hint">(interface type only)</span></label>
-          <input type="text" class="lt-input" id="sup-detail" name="target_detail" placeholder="e.g. enp35s0">
-        </div>
-        <div class="lt-form-group" style="margin-bottom:12px">
-          <label class="lt-label" for="sup-reason">Reason <span class="required">*</span></label>
-          <input type="text" class="lt-input" id="sup-reason" name="reason"
-                 placeholder="e.g. Planned switch reboot" required>
-        </div>
-        <div class="lt-form-group" style="margin-bottom:0">
-          <label class="lt-label">Duration</label>
-          <div class="duration-pills">
-            <button type="button" class="pill" data-duration="30">30 min</button>
-            <button type="button" class="pill" data-duration="60">1 hr</button>
-            <button type="button" class="pill" data-duration="240">4 hr</button>
-            <button type="button" class="pill" data-duration="480">8 hr</button>
-            <button type="button" class="pill pill-manual active" data-duration="">Manual ∞</button>
-          </div>
-          <input type="hidden" id="sup-expires" name="expires_minutes" value="">
-          <div class="lt-field-hint" id="duration-hint">Persists until manually removed.</div>
-        </div>
-      </div>
-      <div class="lt-modal-footer">
-        <button type="button" class="lt-btn lt-btn-secondary" data-modal-close>Cancel</button>
-        <button type="submit" class="lt-btn lt-btn-primary">Apply</button>
-      </div>
-    </form>
-  </div>
-</div>
-
 {% endblock %}

 {% block scripts %}
 <script>
  // Start auto-refresh using saved settings interval (default 30 s)
-  var _savedInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 30;
+  const _savedInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 30;
  if (_savedInterval > 0) lt.autoRefresh.start(refreshAll, _savedInterval * 1000);

  // When settings change, restart auto-refresh with new interval
@@ -506,8 +475,28 @@
    if (s.refreshInterval > 0) lt.autoRefresh.start(refreshAll, s.refreshInterval * 1000);
  };

-  document.getElementById('suppress-form')?.addEventListener('submit', submitSuppress);
-  document.getElementById('sup-type')?.addEventListener('change', updateSuppressForm);
+  // ── Topology collapse toggle ───────────────────────────────────
+  (function() {
+    const LS_KEY = 'gandalf_topo_collapsed';
+    const btn    = document.getElementById('topo-toggle-btn');
+    const wrap   = document.getElementById('topo-collapsible-wrap');
+    if (!btn || !wrap) return;
+
+    function setCollapsed(v) {
+      wrap.classList.toggle('is-collapsed', v);
+      btn.setAttribute('aria-expanded', v ? 'false' : 'true');
+      btn.textContent = v ? '▾ Expand' : '▴ Collapse';
+      try { localStorage.setItem(LS_KEY, v ? '1' : '0'); } catch(_) {}
+    }
+
+    let saved = false;
+    try { saved = localStorage.getItem(LS_KEY) === '1'; } catch(_) {}
+    setCollapsed(saved);
+
+    btn.addEventListener('click', function() {
+      setCollapsed(!wrap.classList.contains('is-collapsed'));
+    });
+  })();

  function updateEventAges() {
    document.querySelectorAll('.event-age[data-ts]').forEach(el => {
@@ -553,8 +542,12 @@
  document.querySelector('.sev-pills')?.addEventListener('click', e => {
    const pill = e.target.closest('.pill[data-sev]');
    if (!pill) return;
-    document.querySelectorAll('.sev-pills .pill').forEach(p => p.classList.remove('active'));
+    document.querySelectorAll('.sev-pills .pill').forEach(p => {
+      p.classList.remove('active');
+      p.setAttribute('aria-pressed', 'false');
+    });
    pill.classList.add('active');
+    pill.setAttribute('aria-pressed', 'true');
    _filterSev = pill.dataset.sev;
    applyEventsFilter();
  });
@@ -563,13 +556,25 @@
  new MutationObserver(applyEventsFilter)
    .observe(document.getElementById('events-table-wrap'), { childList: true, subtree: true });

+  // Host grid search filter
+  document.getElementById('host-search')?.addEventListener('input', function() {
+    const q = this.value.trim().toLowerCase();
+    document.querySelectorAll('#host-grid .host-card').forEach(card => {
+      const name = (card.dataset.host || '').toLowerCase();
+      card.style.display = (!q || name.includes(q)) ? '' : 'none';
+    });
+  });
+
  // Stat card clicks — filter events table by severity
  document.querySelectorAll('.lt-stat-card[data-stat-filter]').forEach(card => {
    card.addEventListener('click', () => {
      const sev = card.dataset.statFilter;
-      document.querySelectorAll('.sev-pills .pill').forEach(p => p.classList.remove('active'));
+      document.querySelectorAll('.sev-pills .pill').forEach(p => {
+        p.classList.remove('active');
+        p.setAttribute('aria-pressed', 'false');
+      });
      const matchPill = document.querySelector(`.sev-pills .pill[data-sev="${sev}"]`);
-      if (matchPill) matchPill.classList.add('active');
+      if (matchPill) { matchPill.classList.add('active'); matchPill.setAttribute('aria-pressed', 'true'); }
      _filterSev = sev;
      applyEventsFilter();
      document.getElementById('events-table-wrap')?.scrollIntoView({ behavior: 'smooth', block: 'start' });
@@ -6,18 +6,18 @@
 <div class="lt-page-header">
  <div>
    <h1 class="lt-page-title">Network Inspector</h1>
-    <p class="g-page-sub" style="margin-top:4px">
+    <p class="g-page-sub">
      Visual switch chassis diagrams. Click a port to see detailed stats and LLDP path debug.
-      <span id="inspector-updated" style="margin-left:8px"></span>
+      <span id="inspector-updated" class="g-page-sub-aside"></span>
    </p>
  </div>
 </div>

 <div class="inspector-layout">
-  <div class="inspector-main" id="inspector-main">
+  <div class="inspector-main" id="inspector-main" role="region" aria-label="Switch chassis diagrams">
    <div class="link-loading">Loading inspector data</div>
  </div>
-  <div class="inspector-panel" id="inspector-panel">
+  <div class="inspector-panel" id="inspector-panel" role="complementary" aria-label="Port detail panel">
    <div class="inspector-panel-inner" id="inspector-panel-inner"></div>
  </div>
 </div>
@@ -320,7 +320,9 @@ function renderPanel(swName, idx) {
    _apiData.hosts && _apiData.hosts[d.lldp.system_name]);
  const diagHtml = hasDiagTarget ? `
    <div class="diag-bar">
-      <button class="btn-diag" data-action="run-diagnostic" data-sw="${escHtml(swName)}" data-idx="${idx}">Run Link Diagnostics</button>
+      <button class="btn-diag lt-btn lt-btn-secondary lt-btn-sm" data-action="run-diagnostic"
+              data-sw="${escHtml(swName)}" data-idx="${idx}"
+              aria-label="Run link diagnostics for port ${idx} on ${escHtml(swName)}">Run Diagnostics</button>
      <span class="diag-status" id="diag-status"></span>
    </div>
    <div class="diag-results" id="diag-results"></div>` : '';
@@ -427,12 +429,13 @@ function renderInspector(data) {
  const main = document.getElementById('inspector-main');
  const switches = data.unifi_switches || {};

-  const upd = data.updated ? `Updated: ${data.updated}` : '';
  const updEl = document.getElementById('inspector-updated');
-  if (updEl) updEl.textContent = upd;
+  if (updEl && data.updated) {
+    updEl.textContent = 'Updated: ' + new Date(data.updated + (data.updated.includes('Z') ? '' : 'Z')).toLocaleTimeString();
+  }

  if (!Object.keys(switches).length) {
-    main.innerHTML = '<p class="empty-state">No switch data available. Monitor may still be initialising.</p>';
+    main.innerHTML = '<div class="lt-empty-state lt-empty-state--sm"><div class="lt-empty-state-icon">⬡</div><div class="lt-empty-state-title">No switch data available</div><div class="lt-empty-state-body">Monitor may still be initialising.</div></div>';
    return;
  }

@@ -459,13 +462,19 @@ async function loadInspector() {
    renderInspector(data);
  } catch (e) {
    document.getElementById('inspector-main').innerHTML =
-      '<p class="empty-state">Failed to load inspector data.</p>';
+      '<div class="lt-empty-state lt-empty-state--sm"><div class="lt-empty-state-icon">✕</div><div class="lt-empty-state-title">Failed to load inspector data</div></div>';
    lt.toast.error('Failed to load inspector data');
  }
 }

 loadInspector();
-lt.autoRefresh.start(loadInspector, 60000);
+var _inspInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 60;
+if (_inspInterval > 0) lt.autoRefresh.start(loadInspector, Math.max(_inspInterval, 15) * 1000);
+
+window.onGandalfSettingsChanged = function(s) {
+  lt.autoRefresh.stop();
+  if (s.refreshInterval > 0) lt.autoRefresh.start(loadInspector, Math.max(s.refreshInterval, 15) * 1000);
+};
 lt.keys.on('Escape', () => {
  if (document.getElementById('inspector-panel').classList.contains('open')) closePanel();
 });
@@ -6,13 +6,27 @@
 <div class="lt-page-header">
  <div>
    <h1 class="lt-page-title">Link Debug</h1>
-    <p class="g-page-sub" style="margin-top:4px">
+    <p class="g-page-sub">
      Per-interface stats: speed, duplex, SFP optical levels, TX/RX rates, errors, and carrier changes.
-      <span id="links-updated" style="margin-left:8px"></span>
+      <span id="links-updated" class="g-page-sub-aside"></span>
    </p>
  </div>
 </div>

+<div class="lt-toolbar" id="links-toolbar" style="display:none">
+  <div class="lt-toolbar-left">
+    <div class="lt-search">
+      <input type="search" class="lt-input lt-search-input" id="links-search"
+             placeholder="Filter by host or switch name…" autocomplete="off"
+             aria-label="Filter by host or switch name">
+    </div>
+  </div>
+  <div class="lt-toolbar-right">
+    <button class="lt-btn lt-btn-ghost lt-btn-sm" data-action="collapse-all">Collapse All</button>
+    <button class="lt-btn lt-btn-ghost lt-btn-sm" data-action="expand-all">Expand All</button>
+  </div>
+</div>
+
 <div id="links-container">
  <div class="link-loading">Loading link statistics</div>
 </div>
@@ -22,6 +36,7 @@
 {% block scripts %}
 <script>
 const escHtml = s => lt.escHtml(s);
+const _toIso  = s => s ? s.replace(' UTC', 'Z').replace(' ', 'T') : s;

 // ── Formatting helpers ────────────────────────────────────────────
 function fmtRate(bytesPerSec) {
@@ -312,7 +327,7 @@ function renderPortCard(portName, d) {
 function renderUnifiSwitches(unifiSwitches, dataUpdated) {
  if (!unifiSwitches || !Object.keys(unifiSwitches).length) return '';
  const updStr = dataUpdated
-    ? new Date(dataUpdated.replace(' UTC', 'Z').replace(' ', 'T')).toLocaleTimeString()
+    ? new Date(_toIso(dataUpdated)).toLocaleTimeString()
    : '';
  const html = Object.entries(unifiSwitches).map(([swName, sw]) => {
    const ports = sw.ports || {};
@@ -334,7 +349,7 @@ function renderUnifiSwitches(unifiSwitches, dataUpdated) {

    return `
      <div class="link-host-panel" id="panel-${CSS.escape(swName)}">
-        <div class="link-host-title" data-action="toggle-panel">
+        <div class="link-host-title" data-action="toggle-panel" role="button" tabindex="0" aria-expanded="true">
          <span class="link-host-name">${escHtml(swName)}</span>
          <span class="link-host-ip">${escHtml(sw.ip || '')}</span>
          <span class="link-host-upd">${escHtml(sw.model || '')}${updStr ? ' · ' + updStr : ''}${poeLoad}</span>
@@ -345,14 +360,17 @@ function renderUnifiSwitches(unifiSwitches, dataUpdated) {
      </div>`;
  }).join('');

-  return `<div class="unifi-section-header">UNIFI SWITCH PORTS</div>${html}`;
+  return `<div class="lt-divider lt-divider--unifi"><span class="lt-divider-label lt-divider-label--unifi">UNIFI SWITCH PORTS</span></div>${html}`;
 }

 // ── Panel collapse / expand ───────────────────────────────────────
 function togglePanel(panel) {
  panel.classList.toggle('collapsed');
-  const btn = panel.querySelector('.panel-toggle');
-  if (btn) btn.textContent = panel.classList.contains('collapsed') ? '[+]' : '[–]';
+  const isCollapsed = panel.classList.contains('collapsed');
+  const btn   = panel.querySelector('.panel-toggle');
+  const title = panel.querySelector('.link-host-title');
+  if (btn)   btn.textContent = isCollapsed ? '[+]' : '[–]';
+  if (title) title.setAttribute('aria-expanded', isCollapsed ? 'false' : 'true');
  const id = panel.id;
  if (id) {
    const collapsed = JSON.parse(sessionStorage.getItem('linksCollapsed') || '{}');
@@ -368,8 +386,10 @@ function restoreCollapseState() {
    if (!panel) continue;
    if (isCollapsed) {
      panel.classList.add('collapsed');
-      const btn = panel.querySelector('.panel-toggle');
-      if (btn) btn.textContent = '[+]';
+      const btn   = panel.querySelector('.panel-toggle');
+      const title = panel.querySelector('.link-host-title');
+      if (btn)   btn.textContent = '[+]';
+      if (title) title.setAttribute('aria-expanded', 'false');
    }
  }
 }
@@ -384,33 +404,51 @@ function buildLinkSummary(hosts, unifiSwitches) {
      if ((d.tx_errs_rate || 0) > 0 || (d.rx_errs_rate || 0) > 0) errIfaces++;
    }
  }
+  let swTotal = 0, swDown = 0;
  for (const sw of Object.values(unifiSwitches || {})) {
    for (const p of Object.values(sw.ports || {})) {
      totalPoe += p.poe_power || 0;
+      swTotal++;
+      if (!p.up) swDown++;
    }
  }
-  const hasAlerts = downIfaces > 0 || errIfaces > 0;
-  return `
-    <div class="link-summary-panel ${hasAlerts ? 'link-summary-has-alerts' : ''}">
-      <div class="link-summary-grid">
-        <div class="link-summary-stat">
-          <span class="lss-label">Total Interfaces</span>
-          <span class="lss-value">${totalIfaces}</span>
-        </div>
-        <div class="link-summary-stat ${downIfaces ? 'lss-alert' : ''}">
-          <span class="lss-label">Interfaces Down</span>
-          <span class="lss-value ${downIfaces ? 'val-crit' : 'val-good'}">${downIfaces}</span>
-        </div>
-        <div class="link-summary-stat ${errIfaces ? 'lss-alert' : ''}">
-          <span class="lss-label">With Errors</span>
-          <span class="lss-value ${errIfaces ? 'val-warn' : 'val-good'}">${errIfaces}</span>
-        </div>
-        ${totalPoe > 0 ? `
-        <div class="link-summary-stat">
-          <span class="lss-label">PoE Load</span>
-          <span class="lss-value">${totalPoe.toFixed(1)} <span class="lss-sub">W</span></span>
-        </div>` : ''}
+  const allTotal = totalIfaces + swTotal;
+  const allDown  = downIfaces  + swDown;
+  const downCls    = allDown  > 0 ? 'lt-text-red'   : 'lt-text-green';
+  const errCls     = errIfaces > 0 ? 'lt-text-amber' : 'lt-text-green';
+  const downCardCls = allDown  > 0 ? ' lt-stat-card--alert' : '';
+  const poeCard = totalPoe > 0 ? `
+    <div class="lt-stat-card">
+      <span class="lt-stat-icon lt-text-amber" aria-hidden="true">⚡</span>
+      <div class="lt-stat-info">
+        <span class="lt-stat-value lt-text-amber">${totalPoe.toFixed(1)}</span>
+        <span class="lt-stat-label">PoE Load (W)</span>
      </div>
+    </div>` : '';
+  return `
+    <div class="lt-stats-grid lt-stats-grid--mb">
+      <div class="lt-stat-card">
+        <span class="lt-stat-icon lt-text-cyan" aria-hidden="true">⬡</span>
+        <div class="lt-stat-info">
+          <span class="lt-stat-value lt-text-cyan">${allTotal}</span>
+          <span class="lt-stat-label">Interfaces</span>
+        </div>
+      </div>
+      <div class="lt-stat-card${downCardCls}">
+        <span class="lt-stat-icon ${downCls}" aria-hidden="true">●</span>
+        <div class="lt-stat-info">
+          <span class="lt-stat-value ${downCls}">${allDown}</span>
+          <span class="lt-stat-label">Ports Down</span>
+        </div>
+      </div>
+      <div class="lt-stat-card">
+        <span class="lt-stat-icon ${errCls}" aria-hidden="true">▲</span>
+        <div class="lt-stat-info">
+          <span class="lt-stat-value ${errCls}">${errIfaces}</span>
+          <span class="lt-stat-label">With Errors</span>
+        </div>
+      </div>
+      ${poeCard}
    </div>`;
 }

@@ -421,10 +459,6 @@ function renderLinks(data) {
  const parts       = [];

  parts.push(buildLinkSummary(hosts, unifiSwitches));
-  parts.push(`<div class="link-collapse-bar">
-    <button class="lt-btn lt-btn-ghost lt-btn-sm" data-action="collapse-all">Collapse All</button>
-    <button class="lt-btn lt-btn-ghost lt-btn-sm" data-action="expand-all">Expand All</button>
-  </div>`);
  parts.push('<div class="link-host-list">');

  for (const [hostname, ifaces] of Object.entries(hosts)) {
@@ -434,12 +468,12 @@ function renderLinks(data) {
    const sample  = Object.values(ifaces)[0] || {};
    const ip      = sample.host_ip || '';
    const updStr  = data.updated
-      ? new Date(data.updated.replace(' UTC', 'Z').replace(' ', 'T')).toLocaleTimeString()
+      ? new Date(_toIso(data.updated)).toLocaleTimeString()
      : '';

    parts.push(`
      <div class="link-host-panel" id="panel-${CSS.escape(hostname)}">
-        <div class="link-host-title" data-action="toggle-panel">
+        <div class="link-host-title" data-action="toggle-panel" role="button" tabindex="0" aria-expanded="true">
          <span class="link-host-name">${escHtml(hostname)}</span>
          <span class="link-host-ip">${escHtml(ip)}</span>
          <span class="link-host-upd">${updStr}</span>
@@ -453,13 +487,26 @@ function renderLinks(data) {
  parts.push('</div>');
  document.getElementById('links-container').innerHTML = parts.join('');
  restoreCollapseState();
+  document.getElementById('links-toolbar').style.display = '';
+  applyLinksSearch();
+}
+
+// ── Host/switch search filter ─────────────────────────────────────
+function applyLinksSearch() {
+  const q = (document.getElementById('links-search')?.value || '').trim().toLowerCase();
+  document.querySelectorAll('.link-host-panel').forEach(panel => {
+    const text = (panel.querySelector('.link-host-name')?.textContent || '').toLowerCase();
+    panel.style.display = (!q || text.includes(q)) ? '' : 'none';
+  });
 }

 function collapseAll() {
  document.querySelectorAll('.link-host-panel').forEach(p => {
    p.classList.add('collapsed');
-    const btn = p.querySelector('.panel-toggle');
-    if (btn) btn.textContent = '[+]';
+    const btn   = p.querySelector('.panel-toggle');
+    const title = p.querySelector('.link-host-title');
+    if (btn)   btn.textContent = '[+]';
+    if (title) title.setAttribute('aria-expanded', 'false');
  });
  sessionStorage.setItem('linksCollapsed', JSON.stringify(
    Object.fromEntries([...document.querySelectorAll('.link-host-panel')].map(p => [p.id, true]))
@@ -469,8 +516,10 @@ function collapseAll() {
 function expandAll() {
  document.querySelectorAll('.link-host-panel').forEach(p => {
    p.classList.remove('collapsed');
-    const btn = p.querySelector('.panel-toggle');
-    if (btn) btn.textContent = '[–]';
+    const btn   = p.querySelector('.panel-toggle');
+    const title = p.querySelector('.link-host-title');
+    if (btn)   btn.textContent = '[–]';
+    if (title) title.setAttribute('aria-expanded', 'true');
  });
  sessionStorage.setItem('linksCollapsed', '{}');
 }
@@ -519,7 +568,7 @@ async function loadLinks() {
 }

 loadLinks();
-var _linksInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 60;
+const _linksInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 60;
 if (_linksInterval > 0) lt.autoRefresh.start(loadLinks, Math.max(_linksInterval, 15) * 1000);

 window.onGandalfSettingsChanged = function(s) {
@@ -534,5 +583,13 @@ document.addEventListener('click', e => {
  if (e.target.closest('[data-action="collapse-all"]')) { collapseAll(); return; }
  if (e.target.closest('[data-action="expand-all"]'))   { expandAll();   return; }
 });
+
+document.addEventListener('keydown', e => {
+  if (e.key !== 'Enter' && e.key !== ' ') return;
+  const toggleTitle = e.target.closest('[data-action="toggle-panel"]');
+  if (toggleTitle) { e.preventDefault(); togglePanel(toggleTitle.closest('.link-host-panel')); }
+});
+
+document.getElementById('links-search')?.addEventListener('input', applyLinksSearch);
 </script>
 {% endblock %}
@@ -6,7 +6,7 @@
 <div class="lt-page-header">
  <div>
    <h1 class="lt-page-title">Alert Suppressions</h1>
-    <p class="g-page-sub" style="margin-top:4px">Manage maintenance windows and per-target alert suppression rules.</p>
+    <p class="g-page-sub">Manage maintenance windows and per-target alert suppression rules.</p>
  </div>
 </div>

@@ -58,12 +58,12 @@
        <div class="form-row form-row-align">
          <div class="lt-form-group">
            <label class="lt-label">Duration</label>
-            <div class="duration-pills">
-              <button type="button" class="pill" data-duration="30">30 min</button>
-              <button type="button" class="pill" data-duration="60">1 hr</button>
-              <button type="button" class="pill" data-duration="240">4 hr</button>
-              <button type="button" class="pill" data-duration="480">8 hr</button>
-              <button type="button" class="pill pill-manual active" data-duration="">Manual ∞</button>
+            <div class="duration-pills" role="group" aria-label="Select suppression duration">
+              <button type="button" class="pill" data-duration="30" aria-pressed="false">30 min</button>
+              <button type="button" class="pill" data-duration="60" aria-pressed="false">1 hr</button>
+              <button type="button" class="pill" data-duration="240" aria-pressed="false">4 hr</button>
+              <button type="button" class="pill" data-duration="480" aria-pressed="false">8 hr</button>
+              <button type="button" class="pill pill-manual active" data-duration="" aria-pressed="true">Manual ∞</button>
            </div>
            <input type="hidden" id="s-expires" name="expires_minutes" value="">
            <div class="lt-field-hint" id="s-dur-hint">Persists until manually removed.</div>
@@ -85,33 +85,39 @@
  </div>
  <div id="active-sup-wrap">
  {% if active %}
-  <div class="lt-table-wrap">
-    <table class="lt-table" id="active-sup-table">
-      <caption class="lt-sr-only">Active suppression rules</caption>
-      <thead>
-        <tr>
-          <th>Type</th><th>Target</th><th>Detail</th><th>Reason</th>
-          <th>By</th><th>Created</th><th>Expires</th><th>Actions</th>
-        </tr>
-      </thead>
-      <tbody>
-        {% for s in active %}
-        <tr id="sup-row-{{ s.id }}">
-          {%- set _sup_badge = {'host':'badge-warning','interface':'badge-info','unifi_device':'badge-purple','all':'badge-critical'} -%}
-          <td><span class="lt-badge {{ _sup_badge.get(s.target_type, 'badge-neutral') }}">{{ s.target_type }}</span></td>
-          <td>{{ s.target_name or 'all' }}</td>
-          <td>{{ s.target_detail or '–' }}</td>
-          <td>{{ s.reason }}</td>
-          <td>{{ s.suppressed_by }}</td>
-          <td class="ts-cell">{{ s.created_at }}</td>
-          <td class="ts-cell">{% if s.expires_at %}{{ s.expires_at }}{% else %}<em>manual</em>{% endif %}</td>
-          <td>
-            <button class="lt-btn lt-btn-danger lt-btn-sm" data-action="remove-sup" data-sup-id="{{ s.id }}">Remove</button>
-          </td>
-        </tr>
-        {% endfor %}
-      </tbody>
-    </table>
+  <div class="lt-frame">
+    <span class="lt-frame-bl">&#x255A;</span>
+    <span class="lt-frame-br">&#x255D;</span>
+    <div class="lt-section-header">Active Rules</div>
+    <div class="lt-table-wrap">
+      <table class="lt-table" id="active-sup-table">
+        <caption class="lt-sr-only">Active suppression rules</caption>
+        <thead>
+          <tr>
+            <th>Type</th><th>Target</th><th>Detail</th><th>Reason</th>
+            <th>By</th><th>Created</th><th>Expires</th><th>Actions</th>
+          </tr>
+        </thead>
+        <tbody>
+          {% for s in active %}
+          <tr id="sup-row-{{ s.id }}">
+            {%- set _sup_badge = {'host':'badge-warning','interface':'badge-info','unifi_device':'badge-purple','all':'badge-critical'} -%}
+            <td><span class="lt-badge {{ _sup_badge.get(s.target_type, 'badge-neutral') }}">{{ s.target_type }}</span></td>
+            <td>{{ s.target_name or 'all' }}</td>
+            <td>{{ s.target_detail or '–' }}</td>
+            <td>{{ s.reason }}</td>
+            <td>{{ s.suppressed_by }}</td>
+            <td class="ts-cell">{{ s.created_at }}</td>
+            <td class="ts-cell">{% if s.expires_at %}{{ s.expires_at }}{% else %}<em>manual</em>{% endif %}</td>
+            <td>
+              <button class="lt-btn lt-btn-danger lt-btn-sm" data-action="remove-sup" data-sup-id="{{ s.id }}"
+                      aria-label="Remove suppression for {{ s.target_name or 'global' }}">Remove</button>
+            </td>
+          </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
  </div>
  {% else %}
  <div class="lt-empty-state lt-empty-state--sm" id="no-active-msg">
@@ -130,36 +136,41 @@
    <span class="g-section-badge">{{ history | length }}</span>
  </div>
  {% if history %}
-  <div class="lt-table-wrap">
-    <table class="lt-table lt-table-sm">
-      <caption class="lt-sr-only">Suppression history</caption>
-      <thead>
-        <tr>
-          <th>Type</th><th>Target</th><th>Detail</th><th>Reason</th>
-          <th>By</th><th>Created</th><th>Expires</th><th>Active</th>
-        </tr>
-      </thead>
-      <tbody>
-        {% for s in history %}
-        <tr class="{% if not s.active %}row-resolved{% endif %}">
-          <td>{{ s.target_type }}</td>
-          <td>{{ s.target_name or 'all' }}</td>
-          <td>{{ s.target_detail or '–' }}</td>
-          <td>{{ s.reason }}</td>
-          <td>{{ s.suppressed_by }}</td>
-          <td class="ts-cell">{{ s.created_at }}</td>
-          <td class="ts-cell">{% if s.expires_at %}{{ s.expires_at }}{% else %}<em>manual</em>{% endif %}</td>
-          <td>
-            {% if s.active %}
-            <span class="lt-badge badge-ok">Yes</span>
-            {% else %}
-            <span class="lt-badge badge-neutral">No</span>
-            {% endif %}
-          </td>
-        </tr>
-        {% endfor %}
-      </tbody>
-    </table>
+  <div class="lt-frame">
+    <span class="lt-frame-bl">&#x255A;</span>
+    <span class="lt-frame-br">&#x255D;</span>
+    <div class="lt-section-header">Suppression Log</div>
+    <div class="lt-table-wrap">
+      <table class="lt-table lt-table-sm">
+        <caption class="lt-sr-only">Suppression history</caption>
+        <thead>
+          <tr>
+            <th>Type</th><th>Target</th><th>Detail</th><th>Reason</th>
+            <th>By</th><th>Created</th><th>Expires</th><th>Active</th>
+          </tr>
+        </thead>
+        <tbody>
+          {% for s in history %}
+          <tr class="{% if not s.active %}row-resolved{% endif %}">
+            <td>{{ s.target_type }}</td>
+            <td>{{ s.target_name or 'all' }}</td>
+            <td>{{ s.target_detail or '–' }}</td>
+            <td>{{ s.reason }}</td>
+            <td>{{ s.suppressed_by }}</td>
+            <td class="ts-cell">{{ s.created_at }}</td>
+            <td class="ts-cell">{% if s.expires_at %}{{ s.expires_at }}{% else %}<em>manual</em>{% endif %}</td>
+            <td>
+              {% if s.active %}
+              <span class="lt-badge badge-ok">Yes</span>
+              {% else %}
+              <span class="lt-badge badge-neutral">No</span>
+              {% endif %}
+            </td>
+          </tr>
+          {% endfor %}
+        </tbody>
+      </table>
+    </div>
  </div>
  {% else %}
  <div class="lt-empty-state lt-empty-state--sm">
@@ -174,20 +185,27 @@
  <div class="g-section-header">
    <h2 class="g-section-title">Available Targets</h2>
  </div>
-  <div class="targets-grid">
-    {% for name, host in snapshot.hosts.items() %}
-    <div class="target-card">
-      <div class="target-name">{{ name }}</div>
-      <div class="target-type">{{ 'Proxmox Host (prometheus)' if host.source == 'prometheus' else 'Ping-only host' }}</div>
-      {% if host.interfaces %}
-      <div class="target-ifaces">
-        {% for iface in host.interfaces.keys() | sort %}
-        <code class="iface-chip">{{ iface }}</code>
+  <div class="lt-frame">
+    <span class="lt-frame-bl">&#x255A;</span>
+    <span class="lt-frame-br">&#x255D;</span>
+    <div class="lt-section-header">Host &amp; Interface Reference</div>
+    <div class="lt-section-body">
+      <div class="targets-grid">
+        {% for name, host in snapshot.hosts.items() %}
+        <div class="target-card">
+          <div class="target-name">{{ name }}</div>
+          <div class="target-type">{{ 'Proxmox Host (prometheus)' if host.source == 'prometheus' else 'Ping-only host' }}</div>
+          {% if host.interfaces %}
+          <div class="target-ifaces">
+            {% for iface in host.interfaces.keys() | sort %}
+            <code class="iface-chip">{{ iface }}</code>
+            {% endfor %}
+          </div>
+          {% endif %}
+        </div>
        {% endfor %}
      </div>
-      {% endif %}
    </div>
-    {% endfor %}
  </div>
 </section>

@@ -204,8 +222,11 @@

  function setDur(mins, el) {
    document.getElementById('s-expires').value = mins || '';
-    document.querySelectorAll('.duration-pills .pill').forEach(p => p.classList.remove('active'));
-    if (el) el.classList.add('active');
+    document.querySelectorAll('.duration-pills .pill').forEach(p => {
+      p.classList.remove('active');
+      p.setAttribute('aria-pressed', 'false');
+    });
+    if (el) { el.classList.add('active'); el.setAttribute('aria-pressed', 'true'); }
    const hint = document.getElementById('s-dur-hint');
    if (mins) {
      const h = Math.floor(mins/60), m = mins%60;
@@ -234,18 +255,24 @@
        <td>${lt.escHtml(s.suppressed_by)}</td>
        <td class="ts-cell">${lt.escHtml(s.created_at || '')}</td>
        <td class="ts-cell">${s.expires_at ? lt.escHtml(s.expires_at) : '<em>manual</em>'}</td>
-        <td><button class="lt-btn lt-btn-danger lt-btn-sm" data-action="remove-sup" data-sup-id="${s.id}">Remove</button></td>
+        <td><button class="lt-btn lt-btn-danger lt-btn-sm" data-action="remove-sup" data-sup-id="${s.id}"
+            aria-label="Remove suppression for ${lt.escHtml(s.target_name || 'global')}">Remove</button></td>
      </tr>`).join('');
    wrap.innerHTML = `
-      <div class="lt-table-wrap">
-        <table class="lt-table" id="active-sup-table">
-          <caption class="lt-sr-only">Active suppression rules</caption>
-          <thead><tr>
-            <th>Type</th><th>Target</th><th>Detail</th><th>Reason</th>
-            <th>By</th><th>Created</th><th>Expires</th><th>Actions</th>
-          </tr></thead>
-          <tbody>${tbody}</tbody>
-        </table>
+      <div class="lt-frame">
+        <span class="lt-frame-bl">&#x255A;</span>
+        <span class="lt-frame-br">&#x255D;</span>
+        <div class="lt-section-header">Active Rules</div>
+        <div class="lt-table-wrap">
+          <table class="lt-table" id="active-sup-table">
+            <caption class="lt-sr-only">Active suppression rules</caption>
+            <thead><tr>
+              <th>Type</th><th>Target</th><th>Detail</th><th>Reason</th>
+              <th>By</th><th>Created</th><th>Expires</th><th>Actions</th>
+            </tr></thead>
+            <tbody>${tbody}</tbody>
+          </table>
+        </div>
      </div>`;
  }
Author	SHA1	Message	Date
jared	b51b39c3a7	a11y: keyboard-accessible panel toggles, region landmarks in inspector Lint / Python (flake8) (push) Successful in 43s Details Lint / JS (eslint) (push) Successful in 14s Details Security / Python Security (bandit) (push) Successful in 45s Details Test / Python Tests (pytest) (push) Successful in 50s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - Add role="button" tabindex="0" aria-expanded to .link-host-title in both static and JS-rendered panels (host panels + UniFi switches) - Sync aria-expanded in togglePanel(), restoreCollapseState(), collapseAll(), and expandAll() - Add keydown handler (Enter/Space) so panel headers are keyboard-operable - Add role="region" aria-label to inspector main chassis area - Add role="complementary" aria-label to inspector port detail panel - Replace last inline date-parse in renderLinks() with _toIso() helper Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:44:23 -04:00
jared	41695a3faa	security: escape user input in 403 error response to prevent XSS Lint / Python (flake8) (push) Successful in 40s Details Lint / JS (eslint) (push) Successful in 9s Details Security / Python Security (bandit) (push) Successful in 1m0s Details Test / Python Tests (pytest) (push) Successful in 51s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 2s Details The require_auth decorator was interpolating user['username'] and the allowed_groups list directly into HTML strings. An attacker with a crafted username or control over group names could inject arbitrary HTML. Use html.escape() on both values before insertion. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:41:31 -04:00
jared	c0e59cfa9e	refactor: extract _annotate_suppressions helper, remove orphaned CSS Lint / Python (flake8) (push) Successful in 45s Details Lint / JS (eslint) (push) Successful in 8s Details Security / Python Security (bandit) (push) Successful in 1m0s Details Test / Python Tests (pytest) (push) Successful in 57s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 2s Details - Extract identical suppression-annotation loop from index() and api_status() into _annotate_suppressions() helper to eliminate DRY violation - Improve stuck-job error message: 'thread crash' → 'no activity for 5 minutes' (less alarming, more accurate) - Remove orphaned .events-filter-bar CSS class (never referenced in any template or JS file) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:39:52 -04:00
jared	7ab85cd055	refactor: const/let modernisation and eliminate duplicate date-parse logic Lint / Python (flake8) (push) Successful in 47s Details Lint / JS (eslint) (push) Successful in 9s Details Security / Python Security (bandit) (push) Successful in 1m7s Details Test / Python Tests (pytest) (push) Successful in 58s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 4s Details - Replace all var declarations in base.html, index.html scripts with const/let (const for bindings that are never reassigned, let otherwise) - Add _toIso() helper to links.html script block and replace the two inline .replace(' UTC','Z').replace(' ','T') patterns with it - Replace var with const in links.html _linksInterval Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:37:32 -04:00
jared	68f59c49a2	a11y: aria-pressed for all pill groups, aria-label on search inputs and buttons Lint / Python (flake8) (push) Successful in 46s Details Lint / JS (eslint) (push) Successful in 10s Details Security / Python Security (bandit) (push) Successful in 51s Details Test / Python Tests (pytest) (push) Successful in 1m8s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 4s Details - Add role="group" + aria-label to duration-pills and sev-pills containers - Add aria-pressed to severity filter, duration, and refresh-interval pills - Keep aria-pressed in sync with JS (setDuration, applyRefreshPillUI, modal reset) - Add aria-label to events-search, host-search, links-search inputs - Add aria-label to host and UniFi device suppress buttons in templates - Replace dynamic style color strings in links.html stat cards with TDS utility classes (lt-text-red/green/amber) via downCls/errCls variables Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:34:16 -04:00
jared	a3c0818fef	Fix: inspector empty states and diagnostic button accessibility Lint / Python (flake8) (push) Successful in 57s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 45s Details Test / Python Tests (pytest) (push) Successful in 1m13s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - Replace .empty-state (removed class) with TDS lt-empty-state--sm in both error branches of renderInspector() and loadInspector() - Diagnostic run button: add aria-label, apply lt-btn TDS classes for consistent styling instead of custom btn-diag-only styling Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:21:27 -04:00
jared	4dd7fc16f3	CSS: migrate links.html static inline styles to classes Lint / Python (flake8) (push) Successful in 41s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 40s Details Test / Python Tests (pytest) (push) Successful in 48s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 4s Details - lt-divider--unifi / lt-divider-label--unifi: replace hardcoded margin and cyan label color on the UniFi switch section divider - lt-text-amber / lt-text-cyan on stat card icons and values (matches same migration done in index.html) - lt-stats-grid--mb: margin-bottom:16px on the summary stats grid - g-page-sub-aside: replaces margin-left:8px on the updated timestamp span in links and inspector page subtitle Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:19:32 -04:00
jared	0b33589106	CSS: extract notification panel inline styles to classes Lint / Python (flake8) (push) Successful in 40s Details Lint / JS (eslint) (push) Successful in 8s Details Security / Python Security (bandit) (push) Successful in 1m7s Details Test / Python Tests (pytest) (push) Successful in 1m42s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - lt-notif-empty: replaces all hardcoded padding/font/color/align on the empty-state and loading/error text in the notification bell panel - lt-notif-view-all: replaces width/text-align/display/font-size inline style on the 'View dashboard' footer link - lt-notif-dot: moves border-radius:50%;margin-top from inline style (only background color remains inline, which is dynamic per-severity) - Initial 'Loading…' text in the panel HTML uses lt-notif-empty Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:18:33 -04:00
jared	ca4bcef26c	CSS: replace remaining inline color/size styles with TDS utilities Lint / Python (flake8) (push) Successful in 57s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 53s Details Test / Python Tests (pytest) (push) Successful in 1m13s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 9s Details - Stat card icons and values: style="color:var(--red)" etc replaced with lt-text-red, lt-text-amber, lt-text-cyan, lt-text-green (defined in base.css with both color and glow-shadow) - Host search input: style="width:180px" extracted to .lt-search-input--sm - base.html: suppress modal form groups use lt-form-group--last for last item (already committed); lt-divider--compact applied to settings divider Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:17:22 -04:00
jared	15120a280f	CSS: remove remaining fixable inline styles across templates Lint / Python (flake8) (push) Successful in 48s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 42s Details Test / Python Tests (pytest) (push) Successful in 54s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - Suppress modal form groups: strip margin-bottom:12px (lt-form-group already has margin-bottom in TDS); use lt-form-group--last for the final group where zero margin is needed - Keyboard shortcuts table: remove width:100% (lt-table is already full- width in base.css) - Settings divider: replace style=margin override with .lt-divider--compact - Topology bus section: move max-width:860px into .topo-bus-section rule Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:15:15 -04:00
jared	906869f425	CSS: convert all topology inline styles to modifier classes Lint / Python (flake8) (push) Successful in 41s Details Lint / JS (eslint) (push) Successful in 9s Details Security / Python Security (bandit) (push) Successful in 1m0s Details Test / Python Tests (pytest) (push) Successful in 55s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 4s Details Replace style= attributes on topology wire/node elements with semantic modifier classes: - topo-vc-wire--wan, --10g, --mgmt (wire colour semantics in CSS) - topo-v2-host--bus (bus-section node size constraint) - topo-legend-item--offrack already done in prior commit Zero inline styles remain in the topology section. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:13:24 -04:00
jared	c027b5422a	Feature: show suppression status on active alert rows Lint / Python (flake8) (push) Successful in 45s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 47s Details Test / Python Tests (pytest) (push) Successful in 1m11s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details Active events now carry an is_suppressed boolean (added in api_status() and the index() route via check_suppressed() against the pre-loaded suppression list). The events table renders a muted '🔕 sup' badge next to the severity and dims the entire row (.row-suppressed) so operators can immediately see which firing alerts are silenced. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:11:15 -04:00
jared	d3e8191f26	Cleanup: strip redundant inline styles, add CSS classes Lint / Python (flake8) (push) Successful in 41s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 44s Details Test / Python Tests (pytest) (push) Successful in 52s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - Remove style="margin-top:4px" from .g-page-sub in all three secondary pages (the value is already defined in .g-page-sub rule in style.css) - suppressions.html: replace inline style="padding:12px 14px" with TDS lt-section-body class - index.html topology legend: replace inline dashed-border style with .topo-legend-item--offrack modifier class in style.css Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:09:25 -04:00
jared	ed19838a4e	Redesign: alerts above fold, fix nav, globalise suppress modal Lint / Python (flake8) (push) Successful in 37s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 40s Details Test / Python Tests (pytest) (push) Successful in 53s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 2s Details - Dashboard: reorder sections so Active Alerts appear immediately below stat cards rather than after 200+ lines of topology — primary content is now above the fold on all screen sizes - Network Hosts section gains a collapse toggle (persisted to localStorage) so the topology diagram can be hidden when not needed - Admin nav corrected: admin now gets a direct Suppressions link; non-admin no longer sees the page at all (it was always admin-only) - Suppress modal moved from index.html into base.html so [S] keyboard shortcut works on every page, not just the dashboard; form listeners wired in app.js accordingly - Settings modal KV grid: replaced lt-kv-row/lt-kv-label/lt-kv-value (light-mode only) with lt-kv-key/lt-kv-val (dark-mode defined) - style.css: add lt-btn-secondary dark-mode definition, lt-cmd-hint-btn class for ⌘K button, topology collapse styles; remove dead .g-page-header, .g-page-title, .empty-state classes; strip redundant inline styles Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 23:07:53 -04:00
jared	7b4c263a40	Cleanup: fix eslint warnings, button loading state, inspector footer hint Lint / Python (flake8) (push) Successful in 45s Details Lint / JS (eslint) (push) Successful in 7s Details Security / Python Security (bandit) (push) Successful in 42s Details Test / Python Tests (pytest) (push) Successful in 51s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - app.js: replace != with !== (eqeqeq rule) on resolved_24h null check and totalActive pagination check - style.css: extend loading state to all .lt-btn.is-loading (not just refresh button), so suppressions form submit shows disabled feedback; remove dead .link-collapse-bar rule - base.html: add inspector page to footer R=REFRESH hint; update keyboard shortcut table to include Inspector in refresh shortcut doc Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-10 22:42:40 -04:00
jared	40a0c2af78	Dynamic resolved count, host search filter, lt-divider for UniFi section Lint / Python (flake8) (push) Successful in 38s Details Lint / JS (eslint) (push) Successful in 8s Details Security / Python Security (bandit) (push) Successful in 38s Details Test / Python Tests (pytest) (push) Successful in 50s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - db.py: add resolved_24h to get_status_summary() so each /api/status poll carries the fresh 24h resolved count - app.js: wire stat-resolved-val to update from summary.resolved_24h so the Resolved 24h card stays accurate after auto-refresh - index.html: add lt-toolbar/lt-search above host grid for quick client-side host filtering by name - links.html: replace custom unifi-section-header div with lt-divider - style.css: remove unused .unifi-section-header rules Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-07 18:36:57 -04:00
jared	08543ac25a	Fix B108: replace hardcoded /tmp with tempfile.gettempdir() Lint / Python (flake8) (push) Successful in 40s Details Lint / JS (eslint) (push) Successful in 8s Details Security / Python Security (bandit) (push) Successful in 42s Details Test / Python Tests (pytest) (push) Successful in 1m18s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 8s Details Bandit flags hardcoded /tmp strings as CWE-377 (insecure temp file). Use tempfile.gettempdir() for the avatar cache dir default so the path resolves correctly on all platforms and passes the security scan. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-07 13:34:37 -04:00
jared	760e45bb68	TDS polish: lt-frame tables, links search toolbar, dead CSS cleanup Lint / Python (flake8) (push) Successful in 56s Details Lint / JS (eslint) (push) Successful in 8s Details Security / Python Security (bandit) (push) Failing after 40s Details Test / Python Tests (pytest) (push) Successful in 50s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - index.html: wrap UniFi devices table in lt-frame with section header - links.html: add static lt-toolbar with lt-search filter and collapse controls above the dynamic container; remove collapse bar from renderLinks() since it's now static; add applyLinksSearch() to filter host/switch panels by name as user types - suppressions.html: wrap Available Targets section in lt-frame - style.css: remove unused .link-summary-panel and related rules (replaced by lt-stats-grid in previous commit) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-01 17:39:11 -04:00
jared	c3aa3bea6f	TDS polish: lt-frame tables, lt-stats-grid link summary, settings-aware refresh Lint / Python (flake8) (push) Successful in 40s Details Lint / JS (eslint) (push) Successful in 8s Details Security / Python Security (bandit) (push) Failing after 42s Details Test / Python Tests (pytest) (push) Successful in 50s Details Lint / Notify on failure (push) Has been skipped Details Lint / Deploy (push) Successful in 3s Details - links.html: replace custom link-summary-panel with lt-stats-grid/lt-stat-card showing total interfaces, ports down, errors, and PoE load - suppressions.html: wrap active suppressions and history tables in lt-frame with lt-section-header labels - inspector.html: wire auto-refresh to gandalfSettings (respects interval pill), fix updated timestamp to use locale time Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-01 17:15:48 -04:00