System · little-sister {{ version }}

{# Server-seeded, same contract as the dashboard's stamp (ADR-0005): this page doesn't navigate on its own, so it always says from when the information below actually is. Under the kiosk layout the slim line already carries it — there must be exactly one #status-updated on the page, because that is what the poller looks for. #} {% if layout != 'kiosk' %} {% endif %} {# The registered check types and who answers for each. A type may come from a separately released package (ADR-0051), so this is the only place an operator can read which code — and which version — is behind a `type:` name in their YAML. Always shown: there are always the built-ins, and the point is the comparison between them and everything else. Split, though. The types this configuration runs come first; the rest fold into a disclosure, because on a small deployment they are most of the card and none of the question being asked. They stay reachable because a registered-but-unused type is the proof a freshly installed plugin took — see `_type_roster`, which owns the reasoning. #} {#- Top-aligned, alone among this page's tables, because alone among them a row here can grow: opening "used by 9 checks" stretches the Type cell down a list of node paths, and centering put Module, Version and From halfway down that list, beside nothing they describe. They answer for the type named at the top of the row, so that is where they sit. -#} {%- macro type_table(rows) %} {% for row in rows %} {%- set origin = row.origin %} {#- "used by", because a bare count under a type name reads as something the *package* brought — two checks shipped — when it is the opposite: how many checks in this deployment's configuration name this type. A package contributing one type to two checks is the ordinary case, so the ambiguous phrasing was wrong most of the time. And the count opens. It is the right summary at a glance, but it was the one number on this page that the page could not substantiate — *two of what?* — while every other card here names its subjects. A disclosure rather than a tooltip: the list is as long as the deployment is large, and it has to survive a keyboard and a screenshot. The unused types below have no list, and say so by not offering one. -#} {#- The loaded path under the module name, because the version beside it is the installed metadata's claim: a source copy earlier on the path shadows an installed distribution of the same name, and then the version is answering for code that is not running. Exactly the case somebody reads this table to diagnose, so the table shows both. Against a root the reader has, not absolutely: the diagnostic is *which root*, and nine tenths of an absolute path is the same prefix on every row — starting with somebody's home directory. The whole string stays one hover away. -#} {% endfor %}

Type	Module	Version	From
{{ origin.type_name }} {%- if row.count %} used by {{ row.count }} check{{ 's' if row.count != 1 else '' }} {#- The node path, not the check's name: the path is the thing the reader can go and look at, so each is a link to that node. -#} {%- for path in row.paths %} {{ path }} {%- endfor %} {%- endif %}	{{ origin.module }} {% if origin.path %} {{ origin.path | loaded_from }}{% endif %}	{% if origin.version %}{{ origin.version }}{% else %}—{% endif %}	{% if origin.builtin %}built-in{% elif origin.distribution %}{{ origin.distribution }}{% else %}source{% endif %}

{%- endmacro %} {# What is installed beside the library. A package reaches this instance through four seams and the tables below are each about one of them, so until this card the *version* of a package that registers no check type was unreadable from the running instance — see `_registering_packages`. One row per installation, not per contribution: the loaded path and the release belong to the package, and printing them on every slot row would say the same thing twice for a package that fills two. Absent when nothing but the library registered anything. #} {% if packages %} {% endif %} {# The extension seams (ADR-0034 / ADR-0035 / ADR-0064), outside #system-info because they are decided at import time and never move while the process runs — re-fetching them on the ~10s poll would say nothing new. Registration is import-order sensitive and each of its failures is a log warning, so the running instance has to be able to answer "did my extension take?" without anyone opening a log file. `slot_fillers` is `all_fillers()` and the library registers its own two unconditionally, so in practice this card is always drawn and the guard is what makes that a *fact about the fillers* rather than an assumption here. The resolver list below is deliberately not part of it: it would make the guard unreachable, and an unreachable condition is one no test can hold. #} {% if slot_fillers or extra_aspects %} {% endif %} {# The ways in (ADR-0069 §6). Always shown, like the policy below and unlike the extensions card above: **a way into an application must not be knowable only by reading the source**, which is the whole reason this card exists — every door an install has is registered in its own `wsgi.py`, and that file is not on the screen when somebody is asking *who can log in here, and how*. No empty state, and the reason is worth writing down rather than rediscovering: an installation that registered **no** door can be started and warns about itself at startup, but nobody can be signed in on it, so nobody reaches this page. Reading this table at all means one of its rows answered for you. One row per door, and the columns are the question the other seam tables answer: what is claimed, and by whom. `Default` rather than a `From` column, because which door `/login` and an unidentified request go to is the fact an operator comes here for, and the package already says whose code answers. #} {# The effective Content-Security-Policy (ADR-0048 §7). Always shown, unlike the extensions card above: there is always a policy, and the reason to print it is that a source may come from a *package* — a request blocked inside somebody else's code is undebuggable from here unless the page says who asked for each origin. The header name is part of the answer: a Report-Only policy reports and blocks nothing. #}