Fix ping-only hosts polled twice per cycle with inconsistent parameters

_collect_snapshot called pulse.ping(count=1) independently from
_process_ping_hosts which called pulse.ping(count=3). This doubled
network load and could show a host as 'up' in the dashboard while
simultaneously firing an 'unreachable' alert, or vice versa.

Now ping_states is computed once in run() using the alert-quality
parameters (count=3) and shared by both snapshot and alert processing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.eslintrc.json

@@ -0,0 +1,21 @@
+{
+  "env": {
+    "browser": true,
+    "es2021": true
+  },
+  "globals": {
+    "lt": "readonly",
+    "GANDALF_CONFIG": "readonly",
+    "CSS": "readonly"
+  },
+  "rules": {
+    "no-undef": "error",
+    "no-unused-vars": ["warn", { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_" }],
+    "no-console": "off",
+    "eqeqeq": ["error", "always", { "null": "ignore" }]
+  },
+  "parserOptions": {
+    "ecmaVersion": 2021,
+    "sourceType": "script"
+  }
+}

app.py

@@ -155,6 +155,17 @@ def require_auth(f):
     return wrapper
 
 
+def require_admin(f):
+    """Decorator: require require_auth AND membership in the 'admin' group."""
+    @wraps(f)
+    def wrapper(*args, **kwargs):
+        user = _get_user()
+        if 'admin' not in user.get('groups', []):
+            return jsonify({'error': 'Admin access required'}), 403
+        return f(*args, **kwargs)
+    return wrapper
+
+
 # ---------------------------------------------------------------------------
 # Helpers
 # ---------------------------------------------------------------------------
@@ -163,17 +174,26 @@ _PAGE_LIMIT = 200  # max events returned per request
 
 
 def _annotate_suppressions(events: list, suppressions: list) -> None:
-    """Annotate each event dict in-place with an is_suppressed bool."""
+    """Annotate each event dict in-place with an is_suppressed bool.
+
+    Mirrors the suppression check order in monitor.py exactly:
+      interface_down  → interface OR host
+      unifi_device_*  → unifi_device
+      everything else → host
+    """
     for ev in events:
-        sup_type = (
-            'unifi_device' if ev.get('event_type') == 'unifi_device_offline'
-            else 'interface' if ev.get('event_type') == 'interface_down'
-            else 'host'
-        )
-        ev['is_suppressed'] = db.check_suppressed(
-            suppressions, sup_type,
-            ev.get('target_name', ''), ev.get('target_detail', '') or '',
-        )
+        etype = ev.get('event_type', '')
+        name = ev.get('target_name', '')
+        detail = ev.get('target_detail', '') or ''
+        if etype == 'interface_down':
+            ev['is_suppressed'] = (
+                db.check_suppressed(suppressions, 'interface', name, detail) or
+                db.check_suppressed(suppressions, 'host', name)
+            )
+        elif etype == 'unifi_device_offline':
+            ev['is_suppressed'] = db.check_suppressed(suppressions, 'unifi_device', name, detail)
+        else:
+            ev['is_suppressed'] = db.check_suppressed(suppressions, 'host', name, detail)
 
 
 # ---------------------------------------------------------------------------
@@ -228,6 +248,7 @@ def inspector():
 
 @app.route('/suppressions')
 @require_auth
+@require_admin
 def suppressions_page():
     user = _get_user()
     active = db.get_active_suppressions()
@@ -291,7 +312,7 @@ def api_links():
             return jsonify(json.loads(raw))
         except Exception as e:
             logger.error(f'Failed to parse link_stats JSON: {e}')
-    return jsonify({'hosts': {}, 'updated': None})
+    return jsonify({'hosts': {}, 'unifi_switches': {}, 'updated': None})
 
 
 @app.route('/api/events')
@@ -323,6 +344,7 @@ def api_get_suppressions():
 
 @app.route('/api/suppressions', methods=['POST'])
 @require_auth
+@require_admin
 def api_create_suppression():
     user = _get_user()
     data = request.get_json(silent=True) or {}
@@ -371,6 +393,7 @@ def api_create_suppression():
 
 @app.route('/api/suppressions/<int:sup_id>', methods=['DELETE'])
 @require_auth
+@require_admin
 def api_delete_suppression(sup_id: int):
     user = _get_user()
     db.deactivate_suppression(sup_id)
@@ -612,7 +635,8 @@ def api_avatar():
         avatar_data = avatar_data.encode('latin-1')
     if avatar_data[:3] != b'\xFF\xD8\xFF':
         logger.warning(f'Non-JPEG avatar data for {username}')
-        open(sentinel, 'w').close()
+        with open(sentinel, 'w'):
+            pass
         return '', 404
 
     with open(cache_file, 'wb') as f:

db.py

@@ -3,7 +3,7 @@ import json
 import logging
 import threading
 from contextlib import contextmanager
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 from typing import Optional
 
 import pymysql
@@ -182,7 +182,7 @@ def get_active_events(limit: int = 200, offset: int = 0) -> list:
             for r in rows:
                 for k in ('first_seen', 'last_seen'):
                     if r.get(k) and hasattr(r[k], 'isoformat'):
-                        r[k] = r[k].isoformat()
+                        r[k] = r[k].isoformat() + 'Z'
             return rows
 
 
@@ -210,7 +210,7 @@ def get_recent_resolved(hours: int = 24, limit: int = 50) -> list:
             for r in rows:
                 for k in ('first_seen', 'last_seen', 'resolved_at'):
                     if r.get(k) and hasattr(r[k], 'isoformat'):
-                        r[k] = r[k].isoformat()
+                        r[k] = r[k].isoformat() + 'Z'
             return rows
 
 
@@ -252,7 +252,7 @@ def get_active_suppressions() -> list:
             for r in rows:
                 for k in ('created_at', 'expires_at'):
                     if r.get(k) and hasattr(r[k], 'isoformat'):
-                        r[k] = r[k].isoformat()
+                        r[k] = r[k].isoformat() + 'Z'
             return rows
 
 
@@ -267,7 +267,7 @@ def get_suppression_history(limit: int = 50) -> list:
             for r in rows:
                 for k in ('created_at', 'expires_at'):
                     if r.get(k) and hasattr(r[k], 'isoformat'):
-                        r[k] = r[k].isoformat()
+                        r[k] = r[k].isoformat() + 'Z'
             return rows
 
 
@@ -281,7 +281,7 @@ def create_suppression(
 ) -> int:
     expires_at = None
     if expires_minutes:
-        expires_at = datetime.utcnow() + timedelta(minutes=int(expires_minutes))
+        expires_at = datetime.now(timezone.utc) + timedelta(minutes=int(expires_minutes))
     with get_conn() as conn:
         with conn.cursor() as cur:
             cur.execute(

diagnose.py

@@ -68,7 +68,7 @@ class DiagnosticsRunner:
             f' echo "=== ip_route ===";'
             f' ip route show dev {q} 2>/dev/null;'
             f' echo "=== dmesg ===";'
-            f' dmesg 2>/dev/null | grep {q} | tail -50;'
+            f' dmesg 2>/dev/null | grep -F -- {q} | tail -50;'
             f' echo "=== lldpctl ===";'
             f' lldpctl 2>/dev/null || echo "lldpd not running";'
             f' echo "=== end ==="'
@@ -78,7 +78,7 @@ class DiagnosticsRunner:
             f'ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 '
             f'-o BatchMode=yes -o LogLevel=ERROR '
             f'-o ServerAliveInterval=10 -o ServerAliveCountMax=2 '
-            f'root@{ip_q} \'{remote_cmd}\''
+            f'root@{ip_q} {shlex.quote(remote_cmd)}'
         )
 
     # ------------------------------------------------------------------
@@ -221,8 +221,6 @@ class DiagnosticsRunner:
                 data['auto_neg'] = (val.lower() == 'on')
             elif key == 'Link detected':
                 data['link_detected'] = (val.lower() == 'yes')
-            elif 'Supported link modes' in key:
-                data.setdefault('supported_modes', []).append(val)
         return data
 
     @staticmethod

monitor.py

@@ -12,7 +12,7 @@ import logging
 import re
 import shlex
 import time
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Dict, List, Optional
 
 import requests
@@ -215,7 +215,10 @@ class TicketClient:
             resp.raise_for_status()
             data = resp.json()
             if data.get('success'):
-                tid = data['ticket_id']
+                tid = data.get('ticket_id')
+                if not tid:
+                    logger.warning(f'Ticket API success but no ticket_id in response: {data}')
+                    return None
                 logger.info(f'Created ticket #{tid}: {title}')
                 return tid
             if data.get('existing_ticket_id'):
@@ -377,7 +380,7 @@ class LinkStatsCollector:
             f'ssh -o StrictHostKeyChecking=accept-new -o ConnectTimeout=5 '
             f'-o BatchMode=yes -o LogLevel=ERROR '
             f'-o ServerAliveInterval=10 -o ServerAliveCountMax=2 '
-            f'root@{ip} "{shell_cmd}"'
+            f'root@{ip} {shlex.quote(shell_cmd)}'
         )
         output = self.pulse.run_command(ssh_cmd)
         if output is None:
@@ -615,7 +618,7 @@ class LinkStatsCollector:
         return {
             'hosts':          result_hosts,
             'unifi_switches': unifi_switches,
-            'updated':        datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S UTC'),
+            'updated':        datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M:%S UTC'),
         }
 
     def _compute_unifi_rates(self, raw: Dict[str, dict], now: float) -> Dict[str, dict]:
@@ -650,7 +653,7 @@ class LinkStatsCollector:
 # Helpers
 # --------------------------------------------------------------------------
 def _now_utc() -> str:
-    return datetime.utcnow().strftime('%Y-%m-%d %H:%M:%S UTC')
+    return datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M:%S UTC')
 
 
 # --------------------------------------------------------------------------
@@ -731,7 +734,7 @@ class NetworkMonitor:
                             f'Interface {iface} on {host} went link-down ({_now_utc()})',
                         )
                         if not sup and consec >= self.fail_thresh:
-                            self._ticket_interface(event_id, is_new, host, iface, consec)
+                            self._ticket_interface(event_id, host, iface, consec)
 
             if host_has_regression:
                 hosts_with_regression.append(host)
@@ -768,7 +771,7 @@ class NetworkMonitor:
             db.resolve_event('cluster_network_issue', self.cluster_name, '')
 
     def _ticket_interface(
-        self, event_id: int, is_new: bool, host: str, iface: str, consec: int
+        self, event_id: int, host: str, iface: str, consec: int
     ) -> None:
         title = (
             f'[{host}][auto][production][issue][network][single-node] '
@@ -786,7 +789,7 @@ class NetworkMonitor:
             f'Please inspect the cable/SFP/switch port for {host}/{iface}.'
         )
         tid = self.tickets.create(title, desc, priority='2')
-        if tid and is_new:
+        if tid:
             db.set_ticket_id(event_id, tid)
 
     # ------------------------------------------------------------------
@@ -807,11 +810,11 @@ class NetworkMonitor:
                     f'UniFi {name} ({d.get("ip","")}) offline ({_now_utc()})',
                 )
                 if not sup and consec >= self.fail_thresh:
-                    self._ticket_unifi(event_id, is_new, d)
+                    self._ticket_unifi(event_id, d)
             else:
                 db.resolve_event('unifi_device_offline', name, d.get('type', ''))
 
-    def _ticket_unifi(self, event_id: int, is_new: bool, device: dict) -> None:
+    def _ticket_unifi(self, event_id: int, device: dict) -> None:
         name = device['name']
         title = (
             f'[{name}][auto][production][issue][network][single-node] '
@@ -828,16 +831,16 @@ class NetworkMonitor:
             f'Please check power and cable connectivity.'
         )
         tid = self.tickets.create(title, desc, priority='2')
-        if tid and is_new:
+        if tid:
             db.set_ticket_id(event_id, tid)
 
     # ------------------------------------------------------------------
     # Ping-only hosts (no node_exporter)
     # ------------------------------------------------------------------
-    def _process_ping_hosts(self, suppressions: list) -> None:
+    def _process_ping_hosts(self, suppressions: list, ping_states: Dict[str, bool]) -> None:
         for h in self.cfg.get('monitor', {}).get('ping_hosts', []):
             name, ip = h['name'], h['ip']
-            reachable = self.pulse.ping(ip)
+            reachable = ping_states.get(name, False)
 
             if not reachable:
                 sup = db.check_suppressed(suppressions, 'host', name)
@@ -847,12 +850,12 @@ class NetworkMonitor:
                     f'Host {name} ({ip}) unreachable via ping ({_now_utc()})',
                 )
                 if not sup and consec >= self.fail_thresh:
-                    self._ticket_unreachable(event_id, is_new, name, ip, consec)
+                    self._ticket_unreachable(event_id, name, ip, consec)
             else:
                 db.resolve_event('host_unreachable', name, ip)
 
     def _ticket_unreachable(
-        self, event_id: int, is_new: bool, name: str, ip: str, consec: int
+        self, event_id: int, name: str, ip: str, consec: int
     ) -> None:
         title = (
             f'[{name}][auto][production][issue][network][single-node] '
@@ -870,7 +873,7 @@ class NetworkMonitor:
             f'Please check the host power, management interface, and network connectivity.'
         )
         tid = self.tickets.create(title, desc, priority='2')
-        if tid and is_new:
+        if tid:
             db.set_ticket_id(event_id, tid)
 
     # ------------------------------------------------------------------
@@ -879,6 +882,7 @@ class NetworkMonitor:
     def _collect_snapshot(
         self, iface_states: Dict[str, Dict[str, bool]],
         unifi_devices: Optional[List[dict]] = None,
+        ping_states: Optional[Dict[str, bool]] = None,
     ) -> dict:
         # Accept pre-fetched devices; fall back to empty list if unavailable
         display_unifi = unifi_devices if unifi_devices is not None else []
@@ -907,7 +911,7 @@ class NetworkMonitor:
 
         for h in self.cfg.get('monitor', {}).get('ping_hosts', []):
             name, ip = h['name'], h['ip']
-            reachable = self.pulse.ping(ip, count=1, timeout=2)
+            reachable = (ping_states or {}).get(name, False)
             hosts[name] = {
                 'ip': ip,
                 'interfaces': {},
@@ -918,7 +922,7 @@ class NetworkMonitor:
         return {
             'hosts': hosts,
             'unifi': display_unifi,
-            'updated': datetime.utcnow().isoformat(),
+            'updated': datetime.now(timezone.utc).isoformat().replace('+00:00', 'Z'),
         }
 
     # ------------------------------------------------------------------
@@ -939,8 +943,14 @@ class NetworkMonitor:
                 # 2. Fetch UniFi devices once — used by both snapshot and alert processing
                 unifi_devices = self.unifi.get_devices()
 
-                # 3. Collect and store snapshot for dashboard
-                snapshot = self._collect_snapshot(iface_states, unifi_devices)
+                # 3a. Ping-only hosts once — shared by snapshot and alert processing
+                ping_states: Dict[str, bool] = {
+                    h['name']: self.pulse.ping(h['ip'])
+                    for h in self.cfg.get('monitor', {}).get('ping_hosts', [])
+                }
+
+                # 3b. Collect and store snapshot for dashboard
+                snapshot = self._collect_snapshot(iface_states, unifi_devices, ping_states)
                 db.set_state('network_snapshot', snapshot)
                 db.set_state('last_check', _now_utc())
 
@@ -956,7 +966,7 @@ class NetworkMonitor:
                 self._process_interfaces(iface_states, suppressions)
                 self._process_unifi(unifi_devices, suppressions)
 
-                self._process_ping_hosts(suppressions)
+                self._process_ping_hosts(suppressions, ping_states)
 
                 # Housekeeping: deactivate expired suppressions and purge old resolved events
                 db.cleanup_expired_suppressions()
@@ -967,6 +977,7 @@ class NetworkMonitor:
             except Exception as e:
                 logger.error(f'Monitor loop error: {e}', exc_info=True)
                 time.sleep(30)
+                continue
 
             time.sleep(self.poll_interval)
 

static/app.js

@@ -220,7 +220,7 @@ function updateEventsTable(events, totalActive) {
       ? GANDALF_CONFIG.ticket_web_url : 'http://t.lotusguild.org/ticket/';
     const ticket = e.ticket_id
       ? `<a href="${lt.escHtml(ticketBase)}${lt.escHtml(String(e.ticket_id))}" target="_blank"
-            class="ticket-link">#${e.ticket_id}</a>`
+            class="ticket-link">#${lt.escHtml(String(e.ticket_id))}</a>`
       : '–';
     const supBadge = e.is_suppressed
       ? `<span class="lt-badge badge-suppressed" title="Alert suppressed">🔕 sup</span>`
@@ -294,18 +294,33 @@ function updateSuppressForm() {
   const type      = document.getElementById('sup-type').value;
   const nameGrp   = document.getElementById('sup-name-group');
   const detailGrp = document.getElementById('sup-detail-group');
+  const nameInput   = document.getElementById('sup-name');
+  const detailInput = document.getElementById('sup-detail');
   if (nameGrp)   nameGrp.style.display   = (type === 'all') ? 'none' : '';
   if (detailGrp) detailGrp.style.display = (type === 'interface') ? '' : 'none';
+  if (nameInput) {
+    const req = (type !== 'all');
+    nameInput.required = req;
+    nameInput.setAttribute('aria-required', String(req));
+  }
+  if (detailInput) {
+    const req = (type === 'interface');
+    detailInput.required = req;
+    detailInput.setAttribute('aria-required', String(req));
+  }
 }
 
-function setDuration(mins, el) {
-  document.getElementById('sup-expires').value = mins || '';
-  document.querySelectorAll('#suppress-modal .pill').forEach(p => {
+function setDuration(mins, el, opts) {
+  const o         = opts || {};
+  const expiresEl = document.getElementById(o.expiresId || 'sup-expires');
+  const pillSel   = o.pillSel || '#suppress-modal .pill';
+  const hint      = document.getElementById(o.hintId || 'duration-hint');
+  if (expiresEl) expiresEl.value = mins || '';
+  document.querySelectorAll(pillSel).forEach(p => {
     p.classList.remove('active');
     p.setAttribute('aria-pressed', 'false');
   });
   if (el) { el.classList.add('active'); el.setAttribute('aria-pressed', 'true'); }
-  const hint = document.getElementById('duration-hint');
   if (hint) {
     if (mins) {
       const h = Math.floor(mins / 60), m = mins % 60;

static/style.css

@@ -217,6 +217,7 @@
 .sev-pills          { display: flex; gap: 4px; }
 .g-page-sub { font-size: .78em; color: var(--text-muted); margin-top: 4px; }
 .g-page-sub-aside { font-size: .78em; color: var(--text-muted); margin-left: 8px; }
+.g-stale-warn { color: var(--orange); font-weight: 600; }
 
 /* ── Badge severity color variants (used with lt-badge) ───────────── */
 .badge-critical { color: var(--red);    border-color: var(--red);    text-shadow: var(--glow-red); }

templates/base.html

@@ -227,16 +227,16 @@
           <div class="lt-form-group">
             <label class="lt-label" for="sup-reason">Reason <span class="required">*</span></label>
             <input type="text" class="lt-input" id="sup-reason" name="reason"
-                   placeholder="e.g. Planned switch reboot" required>
+                   placeholder="e.g. Planned switch reboot" required aria-required="true">
           </div>
           <div class="lt-form-group lt-form-group--last">
             <label class="lt-label">Duration</label>
             <div class="duration-pills" role="group" aria-label="Select suppression duration">
-              <button type="button" class="pill" data-duration="30" aria-pressed="false">30 min</button>
-              <button type="button" class="pill" data-duration="60" aria-pressed="false">1 hr</button>
-              <button type="button" class="pill" data-duration="240" aria-pressed="false">4 hr</button>
-              <button type="button" class="pill" data-duration="480" aria-pressed="false">8 hr</button>
-              <button type="button" class="pill pill-manual active" data-duration="" aria-pressed="true">Manual &#x221E;</button>
+              <button type="button" class="pill" data-duration="30" aria-pressed="false" aria-label="30 minutes">30 min</button>
+              <button type="button" class="pill" data-duration="60" aria-pressed="false" aria-label="1 hour">1 hr</button>
+              <button type="button" class="pill" data-duration="240" aria-pressed="false" aria-label="4 hours">4 hr</button>
+              <button type="button" class="pill" data-duration="480" aria-pressed="false" aria-label="8 hours">8 hr</button>
+              <button type="button" class="pill pill-manual active" data-duration="" aria-pressed="true" aria-label="Manual, no expiry">Manual &#x221E;</button>
             </div>
             <input type="hidden" id="sup-expires" name="expires_minutes" value="">
             <div class="lt-field-hint" id="duration-hint">Persists until manually removed.</div>

templates/index.html

@@ -92,7 +92,7 @@
     <div id="events-table-wrap">
     {% if events %}
     {% if total_active is defined and total_active > events|length %}
-    <div class="pagination-notice">Showing {{ events|length }} of {{ total_active }} active alerts &mdash; <a href="/api/events?limit=1000">view all via API</a></div>
+    <div class="pagination-notice">Showing {{ events|length }} of {{ total_active }} active alerts — use the search box to filter, or <a href="/api/events?limit=1000" target="_blank" rel="noopener">export all as JSON</a></div>
     {% endif %}
     <div class="lt-table-wrap">
       <table class="lt-table" id="events-table">
@@ -324,6 +324,7 @@
     </div>
   </div>
   <div class="host-grid" id="host-grid">
+    {%- set has_global_sup = suppressions | selectattr('target_type', 'equalto', 'all') | list | length > 0 -%}
     {% for name, host in snapshot.hosts.items() %}
     {% set suppressed = suppressions | selectattr('target_name', 'equalto', name) | list %}
     <div class="host-card host-card-{{ host.status }}" data-host="{{ name }}">
@@ -331,7 +332,7 @@
         <div class="host-name-row">
           <span class="host-status-dot dot-{{ host.status }}"></span>
           <span class="host-name">{{ name }}</span>
-          {% if suppressed %}
+          {% if suppressed or has_global_sup %}
           <span class="badge-suppressed" title="Suppressed">🔕</span>
           {% endif %}
         </div>
@@ -468,7 +469,7 @@
 {% block scripts %}
 <script>
   // Start auto-refresh using saved settings interval (default 30 s)
-  const _savedInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 30;
+  const _savedInterval = window.gandalfSettings?.refreshInterval ?? 30;
   if (_savedInterval > 0) lt.autoRefresh.start(refreshAll, _savedInterval * 1000);
 
   // When settings change, restart auto-refresh with new interval

templates/inspector.html

@@ -218,6 +218,7 @@ let _apiData        = null;
 function selectPort(el) {
   const swName = el.dataset.switch;
   const idx    = parseInt(el.dataset.portIdx, 10);
+  if (_diagPollTimer) { clearInterval(_diagPollTimer); _diagPollTimer = null; }
   document.querySelectorAll('.switch-port-block.selected')
     .forEach(e => e.classList.remove('selected'));
   el.classList.add('selected');
@@ -259,7 +260,7 @@ function renderPanel(swName, idx) {
     const poeCurStr = (d.poe_power != null && d.poe_power > 0) ? ` / draw <span class="val-amber">${d.poe_power.toFixed(1)}W</span>` : '';
     poeHtml = `
       <div class="lt-divider"><span class="lt-divider-label">PoE</span></div>
-      <div class="panel-row"><span class="panel-label">Class</span><span class="panel-val">class ${d.poe_class}${poeMaxStr}</span></div>
+      <div class="panel-row"><span class="panel-label">Class</span><span class="panel-val">class ${escHtml(String(d.poe_class))}${poeMaxStr}</span></div>
       ${d.poe_power != null ? `<div class="panel-row"><span class="panel-label">Draw</span><span class="panel-val">${d.poe_power > 0 ? `<span class="val-amber">${d.poe_power.toFixed(1)}W</span>` : '0W'}</span></div>` : ''}
       ${d.poe_mode ? `<div class="panel-row"><span class="panel-label">Mode</span><span class="panel-val">${escHtml(d.poe_mode)}</span></div>` : ''}`;
   }
@@ -428,7 +429,14 @@ function renderInspector(data) {
 
   const updEl = document.getElementById('inspector-updated');
   if (updEl && data.updated) {
-    updEl.textContent = 'Updated: ' + new Date(data.updated + (data.updated.includes('Z') ? '' : 'Z')).toLocaleTimeString();
+    const updMs = new Date(_toIso(data.updated));
+    const ageMin = (Date.now() - updMs) / 60000;
+    const timeStr = updMs.toLocaleTimeString();
+    if (ageMin > 15) {
+      updEl.innerHTML = `<span class="g-stale-warn" title="Data is ${Math.floor(ageMin)} minutes old — monitor may be down">⚠ Stale: ${timeStr}</span>`;
+    } else {
+      updEl.textContent = 'Updated: ' + timeStr;
+    }
   }
 
   if (!Object.keys(switches).length) {
@@ -465,7 +473,7 @@ async function loadInspector() {
 }
 
 loadInspector();
-const _inspInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 60;
+const _inspInterval = window.gandalfSettings?.refreshInterval ?? 60;
 if (_inspInterval > 0) lt.autoRefresh.start(loadInspector, Math.max(_inspInterval, 15) * 1000);
 
 window.onGandalfSettingsChanged = function(s) {
@@ -487,7 +495,13 @@ document.addEventListener('click', e => {
   if (diagBtn) { runDiagnostic(diagBtn.dataset.sw, parseInt(diagBtn.dataset.idx, 10)); return; }
 
   const toggleDiag = e.target.closest('[data-action="toggle-diag"]');
-  if (toggleDiag) { toggleDiag.parentElement.classList.toggle('diag-open'); return; }
+  if (toggleDiag) {
+    const section = toggleDiag.parentElement;
+    const nowOpen = section.classList.toggle('diag-open');
+    const hint = toggleDiag.querySelector('.diag-toggle-hint');
+    if (hint) hint.textContent = nowOpen ? '[collapse]' : '[expand]';
+    return;
+  }
 });
 
 // ── Link Diagnostics ─────────────────────────────────────────────────
@@ -510,7 +524,10 @@ function runDiagnostic(swName, portIdx) {
       pollDiagnostic(resp.job_id, statusEl, resultsEl);
     })
     .catch(e => {
-      statusEl.textContent = 'Error: ' + (e.message || 'Request failed');
+      const msg = (e && e.status === 429)
+        ? 'Rate limit reached — max 5 diagnostics per minute. Please wait.'
+        : 'Error: ' + (e && e.message || 'Request failed');
+      statusEl.textContent = msg;
     });
 }
 
@@ -520,7 +537,13 @@ function pollDiagnostic(jobId, statusEl, resultsEl) {
     attempts++;
     if (attempts > 120) {  // 2min timeout
       clearInterval(_diagPollTimer);
-      statusEl.textContent = 'Timed out waiting for results.';
+      _diagPollTimer = null;
+      statusEl.innerHTML = 'Timed out waiting for results. '
+        + '<button class="lt-btn lt-btn-ghost lt-btn-sm" id="diag-retry-btn">Retry</button>';
+      document.getElementById('diag-retry-btn')?.addEventListener('click', () => {
+        const sel = document.querySelector('.switch-port-block.selected');
+        if (sel) runDiagnostic(sel.dataset.switch, parseInt(sel.dataset.portIdx));
+      });
       return;
     }
     lt.api.get(`/api/diagnose/${jobId}`)
@@ -535,7 +558,12 @@ function pollDiagnostic(jobId, statusEl, resultsEl) {
     .catch(() => {
       clearInterval(_diagPollTimer);
       _diagPollTimer = null;
-      statusEl.textContent = 'Error: lost connection while collecting diagnostics.';
+      statusEl.innerHTML = 'Error: lost connection while collecting diagnostics. '
+        + '<button class="lt-btn lt-btn-ghost lt-btn-sm" id="diag-retry-btn">Retry</button>';
+      document.getElementById('diag-retry-btn')?.addEventListener('click', () => {
+        const sel = document.querySelector('.switch-port-block.selected');
+        if (sel) runDiagnostic(sel.dataset.switch, parseInt(sel.dataset.portIdx));
+      });
     });
   }, 2000);
 }

templates/links.html

@@ -36,7 +36,6 @@
 {% block scripts %}
 <script>
 const escHtml = s => lt.escHtml(s);
-const _toIso  = s => s ? s.replace(' UTC', 'Z').replace(' ', 'T') : s;
 
 // ── Formatting helpers ────────────────────────────────────────────
 function fmtRate(bytesPerSec) {
@@ -373,14 +372,16 @@ function togglePanel(panel) {
   if (title) title.setAttribute('aria-expanded', isCollapsed ? 'false' : 'true');
   const id = panel.id;
   if (id) {
-    const collapsed = JSON.parse(sessionStorage.getItem('linksCollapsed') || '{}');
+    let collapsed = {};
+    try { collapsed = JSON.parse(sessionStorage.getItem('linksCollapsed') || '{}'); } catch(_) {}
     collapsed[id] = panel.classList.contains('collapsed');
-    sessionStorage.setItem('linksCollapsed', JSON.stringify(collapsed));
+    try { sessionStorage.setItem('linksCollapsed', JSON.stringify(collapsed)); } catch(_) {}
   }
 }
 
 function restoreCollapseState() {
-  const collapsed = JSON.parse(sessionStorage.getItem('linksCollapsed') || '{}');
+  let collapsed = {};
+  try { collapsed = JSON.parse(sessionStorage.getItem('linksCollapsed') || '{}'); } catch(_) {}
   for (const [id, isCollapsed] of Object.entries(collapsed)) {
     const panel = document.getElementById(id);
     if (!panel) continue;
@@ -508,9 +509,11 @@ function collapseAll() {
     if (btn)   btn.textContent = '[+]';
     if (title) title.setAttribute('aria-expanded', 'false');
   });
-  sessionStorage.setItem('linksCollapsed', JSON.stringify(
-    Object.fromEntries([...document.querySelectorAll('.link-host-panel')].map(p => [p.id, true]))
-  ));
+  try {
+    sessionStorage.setItem('linksCollapsed', JSON.stringify(
+      Object.fromEntries([...document.querySelectorAll('.link-host-panel')].map(p => [p.id, true]))
+    ));
+  } catch(_) {}
 }
 
 function expandAll() {
@@ -521,13 +524,13 @@ function expandAll() {
     if (btn)   btn.textContent = '[–]';
     if (title) title.setAttribute('aria-expanded', 'true');
   });
-  sessionStorage.setItem('linksCollapsed', '{}');
+  try { sessionStorage.setItem('linksCollapsed', '{}'); } catch(_) {}
 }
 
 // ── Stale data warning ────────────────────────────────────────────
 function checkLinksStale(updatedStr) {
   if (!updatedStr) return;
-  const age = (Date.now() - new Date(updatedStr + (updatedStr.includes('Z') ? '' : 'Z'))) / 1000;
+  const age = (Date.now() - new Date(_toIso(updatedStr))) / 1000;
   let banner = document.getElementById('links-stale-banner');
   if (age > 120) {
     if (!banner) {
@@ -549,14 +552,14 @@ function checkLinksStale(updatedStr) {
 async function loadLinks() {
   try {
     const data = await lt.api.get('/api/links');
-    if (!data.hosts && !data.unifi_switches) {
+    if ((!data.hosts || !Object.keys(data.hosts).length) && (!data.unifi_switches || !Object.keys(data.unifi_switches).length)) {
       document.getElementById('links-container').innerHTML =
         '<div class="link-no-data">No link data yet — monitor has not completed a full cycle.</div>';
       return;
     }
     const updEl = document.getElementById('links-updated');
     if (updEl && data.updated) {
-      updEl.textContent = 'Updated: ' + new Date(data.updated + (data.updated.includes('Z') ? '' : 'Z')).toLocaleTimeString();
+      updEl.textContent = 'Updated: ' + new Date(_toIso(data.updated)).toLocaleTimeString();
     }
     renderLinks(data);
     checkLinksStale(data.updated);
@@ -568,7 +571,7 @@ async function loadLinks() {
 }
 
 loadLinks();
-const _linksInterval = (window.gandalfSettings && window.gandalfSettings.refreshInterval) || 60;
+const _linksInterval = window.gandalfSettings?.refreshInterval ?? 60;
 if (_linksInterval > 0) lt.autoRefresh.start(loadLinks, Math.max(_linksInterval, 15) * 1000);
 
 window.onGandalfSettingsChanged = function(s) {

templates/suppressions.html

@@ -32,7 +32,7 @@
             <label class="lt-label" for="s-name">Target Name <span class="required">*</span></label>
             <input type="text" class="lt-input" id="s-name" name="target_name"
                    placeholder="hostname or device name" autocomplete="off"
-                   list="target-name-list">
+                   required aria-required="true" list="target-name-list">
             <datalist id="target-name-list">
               {% for name in snapshot.hosts.keys() | sort %}
               <option value="{{ name }}">
@@ -51,7 +51,7 @@
             <label class="lt-label" for="s-reason">Reason <span class="required">*</span></label>
             <input type="text" class="lt-input" id="s-reason" name="reason"
                    placeholder="e.g. Planned switch maintenance, replacing SFP on large1/enp43s0"
-                   required>
+                   required aria-required="true">
           </div>
         </div>
 
@@ -59,11 +59,11 @@
           <div class="lt-form-group">
             <label class="lt-label">Duration</label>
             <div class="duration-pills" role="group" aria-label="Select suppression duration">
-              <button type="button" class="pill" data-duration="30" aria-pressed="false">30 min</button>
-              <button type="button" class="pill" data-duration="60" aria-pressed="false">1 hr</button>
-              <button type="button" class="pill" data-duration="240" aria-pressed="false">4 hr</button>
-              <button type="button" class="pill" data-duration="480" aria-pressed="false">8 hr</button>
-              <button type="button" class="pill pill-manual active" data-duration="" aria-pressed="true">Manual ∞</button>
+              <button type="button" class="pill" data-duration="30" aria-pressed="false" aria-label="30 minutes">30 min</button>
+              <button type="button" class="pill" data-duration="60" aria-pressed="false" aria-label="1 hour">1 hr</button>
+              <button type="button" class="pill" data-duration="240" aria-pressed="false" aria-label="4 hours">4 hr</button>
+              <button type="button" class="pill" data-duration="480" aria-pressed="false" aria-label="8 hours">8 hr</button>
+              <button type="button" class="pill pill-manual active" data-duration="" aria-pressed="true" aria-label="Manual, no expiry">Manual ∞</button>
             </div>
             <input type="hidden" id="s-expires" name="expires_minutes" value="">
             <div class="lt-field-hint" id="s-dur-hint">Persists until manually removed.</div>
@@ -217,23 +217,16 @@
     const t = document.getElementById('s-type').value;
     document.getElementById('name-group').style.display = (t==='all') ? 'none' : '';
     document.getElementById('detail-group').style.display = (t==='interface') ? '' : 'none';
-    document.getElementById('s-name').required = (t!=='all');
+    const nameInput = document.getElementById('s-name');
+    if (nameInput) {
+      const req = (t !== 'all');
+      nameInput.required = req;
+      nameInput.setAttribute('aria-required', String(req));
+    }
   }
 
   function setDur(mins, el) {
-    document.getElementById('s-expires').value = mins || '';
-    document.querySelectorAll('.duration-pills .pill').forEach(p => {
-      p.classList.remove('active');
-      p.setAttribute('aria-pressed', 'false');
-    });
-    if (el) { el.classList.add('active'); el.setAttribute('aria-pressed', 'true'); }
-    const hint = document.getElementById('s-dur-hint');
-    if (mins) {
-      const h = Math.floor(mins/60), m = mins%60;
-      hint.textContent = `Expires in ${h?h+'h ':''}${m?m+'m':''}`.trim()+'.';
-    } else {
-      hint.textContent = 'Persists until manually removed.';
-    }
+    setDuration(mins, el, { expiresId: 's-expires', pillSel: '#create-suppression-form .pill', hintId: 's-dur-hint' });
   }
 
   function renderActiveRows(rows) {
@@ -302,9 +295,7 @@
       showToast('Suppression applied', 'success');
       form.reset();
       onTypeChange();
-      document.querySelectorAll('.duration-pills .pill').forEach(p => p.classList.remove('active'));
-      document.querySelector('.duration-pills .pill-manual')?.classList.add('active');
-      document.getElementById('s-dur-hint').textContent = 'Persists until manually removed.';
+      setDur(null, document.querySelector('#create-suppression-form .pill-manual'));
       await refreshActive();
     } catch (err) {
       showToast(err.message || 'Error', 'error');

tests/test_diagnose.py

@@ -36,6 +36,12 @@ class TestBuildSshCommand:
         cmd = DiagnosticsRunner.build_ssh_command('10.0.0.1', 'eth0')
         assert 'ethtool' in cmd
 
+    def test_dmesg_uses_fixed_string_grep(self):
+        # grep -F prevents iface names with dots (e.g. eth0.1) being treated as
+        # regex wildcards; -- prevents leading - from being parsed as a flag
+        cmd = DiagnosticsRunner.build_ssh_command('10.0.0.1', 'eth0')
+        assert 'grep -F --' in cmd
+
 
 # ── parse_output ─────────────────────────────────────────────────────────────