Merge branch 'master' into feat/issue-639-webui-system-health-dashboard

Resolve the #638 shell landing against the #639 dashboard:

- webui/layout.py: drop the flat NAV_ITEMS tuple in favor of master's
  grouped NAV_GROUPS nav-config module.
- webui/nav.py: register /system-health as a live item in the Health
  group, satisfying issue #639 AC5 through the canonical nav source.
- docs/webui-local-dev.md: keep both additive sections (#638 shell and
  #639 dashboard).
- tests/test_webui_system_health_dashboard.py: assert the nav entry via
  iter_nav_items() instead of the removed NAV_ITEMS tuple.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

control_plane_db.py

@@ -599,35 +599,6 @@ class ControlPlaneDB:
                 (_ts(), session_id),
             )
 
-    def list_sessions(
-        self,
-        *,
-        statuses: Sequence[str] | None = None,
-        limit: int = 500,
-    ) -> list[dict[str, Any]]:
-        """List session rows for restart / impact analysis (#658).
-
-        Read-only. Sessions are the process-level unit an MCP restart
-        disrupts, so the restart coordinator inventories them to compute blast
-        radius. Optional ``statuses`` filter (e.g. ``('active',)``) narrows to
-        live rows. Never returns secrets — only operational metadata.
-        """
-        clauses: list[str] = []
-        params: list[Any] = []
-        if statuses:
-            placeholders = ", ".join("?" for _ in statuses)
-            clauses.append(f"status IN ({placeholders})")
-            params.extend(statuses)
-        where = ("WHERE " + " AND ".join(clauses)) if clauses else ""
-        sql = (
-            f"SELECT * FROM sessions {where} "
-            "ORDER BY last_heartbeat_at DESC LIMIT ?"
-        )
-        params.append(max(1, int(limit)))
-        with self._tx(immediate=False) as conn:
-            rows = conn.execute(sql, params).fetchall()
-            return [dict(r) for r in rows]
-
     # ── work items ────────────────────────────────────────────────────────
 
     def upsert_work_item(

docs/mcp-restart-coordinator.md

@@ -1,95 +0,0 @@
-# MCP restart coordinator and impact analysis (#658)
-
-Before any sanctioned MCP restart, a central coordinator evaluates the live
-control-plane state and produces an **impact preview** so operators and the web
-console (#642 / #652) can see the blast radius *before* concurrent LLM work is
-disrupted. Uncoordinated restarts destroy in-flight author/reviewer/merger work
-and give operators no way to see what they are about to break.
-
-This lands the coordinator + impact DTO + a dry-run MCP tool. It is the single
-sanctioned entry point for restart evaluation post-#657 (which inventoried the
-restart/reload/kill paths). The **mutative apply** path — actually performing a
-restart — is a later child gated by a drain proof and is explicitly out of
-scope here.
-
-## Components
-
-| Piece | Where | Responsibility |
-|-------|-------|----------------|
-| `restart_coordinator.evaluate_restart_impact` | `restart_coordinator.py` | Pure classification: inventory → impact report DTO. No I/O, no restart. |
-| `RestartImpactReport` / `SessionImpact` / `LeaseImpact` | `restart_coordinator.py` | Console-facing DTO (`.as_dict()` is JSON-serializable). |
-| `ControlPlaneDB.list_sessions` | `control_plane_db.py` | Read-only session inventory (the process-level unit a restart kills). |
-| `gitea_request_mcp_restart` | `gitea_mcp_server.py` | MCP tool: gathers inventory from the #613 DB, calls the coordinator, returns the report. Dry-run only. |
-
-## Dimensions evaluated
-
-The coordinator classifies the inventory across the dimensions #658 requires:
-
-- **Sessions** — every active MCP session; a restart terminates all of them.
-  Liveness = `status == active` **and** the owner pid is alive **and** the
-  heartbeat is fresh (default window 15 min). Dead/stale sessions do not count
-  toward blast radius.
-- **Leases / locks** — control-plane leases joined with work items and their
-  freshness (`lease_lifecycle.classify_lease_freshness`). Only `active` (live
-  owner) leases are *disruptive*; expired / released / dead-process leases never
-  withhold a restart.
-- **Issue / PR work** — the issues and PRs behind disruptive leases.
-- **Mutations / critical sections** — a live lease carrying an author worktree
-  or a mutating phase (`implementing`, `publishing`, `merging`, …) is a
-  critical section a restart must not sever.
-- **Terminal (merge) lock** — an active terminal lock always makes a restart
-  unsafe.
-- **Prior recovery attempts** — narrower recovery already tried (e.g. sanctioned
-  client reconnects) is echoed so the operator sees the escalation history.
-
-## Verdict
-
-Exactly three verdicts, matching the acceptance criteria:
-
-| Verdict | `allow_restart` | Meaning |
-|---------|-----------------|---------|
-| `safe` | `true` | No other live sessions, no live leases, no terminal lock. |
-| `unsafe` | `false` | Live work would be disrupted and no operator override is present — **or** the inventory could not be completed (fail closed). |
-| `override` | `true` | Live work present, but an operator override accepts the blast radius. |
-
-`override_would_allow` tells the console whether an override path exists for the
-current state. `blast_radius` is a `none` / `low` / `medium` / `high` severity
-band derived from the affected session and work counts.
-
-### Fail closed
-
-If the control-plane inventory cannot be completed (DB unavailable, a listing
-failed), `inventory_complete` is `false` and the verdict is `unsafe` / deny. An
-incomplete evaluation must never green-light a restart.
-
-### Operator override authority
-
-Override authority is read from the environment variable
-`GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION` and **never** from a tool
-argument. A worker session cannot set an environment variable on an
-already-running daemon, so override cannot be self-asserted (same pattern as the
-#630 daemon-maintenance authorization). The `request_override` tool argument only
-expresses caller intent; it takes effect solely when the environment
-authorization is present.
-
-## The tool
-
-```text
-gitea_request_mcp_restart(remote, host, org, repo,
-                          dry_run=True, request_override=False,
-                          session_id=None, limit=200)
-```
-
-Read-only, dry-run, and it **never restarts anything**. `apply_supported` is
-always `false`; passing `dry_run=False` performs no restart and reports that
-apply is gated by a drain proof (a separate child).
-
-## Audit
-
-Every evaluation carries an `audit_record` (event, coordinator version, verdict,
-allow decision, blast radius, counts, timestamp) so restart decisions are
-auditable. No secrets flow through the coordinator — session ids, pids, and
-profiles are operational metadata only.
-
-A representative dry-run report is in
-[`mcp-restart-impact-sample.json`](./mcp-restart-impact-sample.json).

docs/mcp-restart-impact-sample.json

@@ -1,148 +0,0 @@
-{
-  "coordinator_version": "1.0.0-issue-658",
-  "evaluated_at": "2026-07-24T06:00:00+00:00",
-  "dry_run": true,
-  "restart_performed": false,
-  "inventory_complete": true,
-  "incomplete_reasons": [],
-  "verdict": "unsafe",
-  "allow_restart": false,
-  "override_would_allow": true,
-  "operator_override": false,
-  "blast_radius": "high",
-  "reasons": [
-    "live work would be disrupted; restart denied without operator override",
-    "1 critical section(s) in flight (active lease with a live owner)"
-  ],
-  "affected_sessions": [
-    {
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "profile": "prgs-author",
-      "pid": 1,
-      "status": "active",
-      "alive": true,
-      "heartbeat_stale": false,
-      "is_requester": false,
-      "live": true
-    },
-    {
-      "session_id": "prgs-reviewer-4157-0ce9",
-      "role": "reviewer",
-      "profile": "prgs-reviewer",
-      "pid": 1,
-      "status": "active",
-      "alive": true,
-      "heartbeat_stale": false,
-      "is_requester": true,
-      "live": true
-    }
-  ],
-  "affected_leases": [
-    {
-      "lease_id": "lease-abc",
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "phase": "implementing",
-      "freshness": "active",
-      "work_kind": "issue",
-      "work_number": 658,
-      "worktree_path": "/repo/branches/feat-issue-658",
-      "disruptive": true,
-      "is_mutation": true,
-      "is_critical_section": true
-    },
-    {
-      "lease_id": "lease-dead",
-      "session_id": "prgs-author-91485",
-      "role": "author",
-      "phase": "allocated",
-      "freshness": "stale_dead_process",
-      "work_kind": "issue",
-      "work_number": 651,
-      "worktree_path": null,
-      "disruptive": false,
-      "is_mutation": false,
-      "is_critical_section": false
-    }
-  ],
-  "critical_sections": [
-    {
-      "lease_id": "lease-abc",
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "phase": "implementing",
-      "freshness": "active",
-      "work_kind": "issue",
-      "work_number": 658,
-      "worktree_path": "/repo/branches/feat-issue-658",
-      "disruptive": true,
-      "is_mutation": true,
-      "is_critical_section": true
-    }
-  ],
-  "affected_issues": [
-    658
-  ],
-  "affected_prs": [],
-  "mutations": [
-    {
-      "lease_id": "lease-abc",
-      "session_id": "prgs-author-30988-d6f43c25",
-      "role": "author",
-      "phase": "implementing",
-      "freshness": "active",
-      "work_kind": "issue",
-      "work_number": 658,
-      "worktree_path": "/repo/branches/feat-issue-658",
-      "disruptive": true,
-      "is_mutation": true,
-      "is_critical_section": true
-    }
-  ],
-  "terminal_lock": null,
-  "ack_state": {
-    "prgs-author-30988-d6f43c25": "pending"
-  },
-  "prior_recovery_attempts": [
-    {
-      "kind": "client_reconnect",
-      "at": "2026-07-24T06:00:00+00:00",
-      "outcome": "insufficient"
-    }
-  ],
-  "counts": {
-    "sessions_total": 2,
-    "sessions_live_other": 1,
-    "leases_total": 2,
-    "leases_disruptive": 1,
-    "critical_sections": 1,
-    "mutations": 1,
-    "affected_issues": 1,
-    "affected_prs": 0,
-    "prior_recovery_attempts": 1
-  },
-  "audit_record": {
-    "event": "restart_impact_evaluated",
-    "coordinator_version": "1.0.0-issue-658",
-    "evaluated_at": "2026-07-24T06:00:00+00:00",
-    "dry_run": true,
-    "operator_override": false,
-    "requesting_session_id": "prgs-reviewer-4157-0ce9",
-    "inventory_complete": true,
-    "verdict": "unsafe",
-    "allow_restart": false,
-    "blast_radius": "high",
-    "counts": {
-      "sessions_total": 2,
-      "sessions_live_other": 1,
-      "leases_total": 2,
-      "leases_disruptive": 1,
-      "critical_sections": 1,
-      "mutations": 1,
-      "affected_issues": 1,
-      "affected_prs": 0,
-      "prior_recovery_attempts": 1
-    }
-  }
-}

docs/mcp-tool-inventory.md

@@ -135,7 +135,6 @@ that gates each call, not which tools exist.
 - `gitea_release_merger_pr_lease`
 - `gitea_release_reviewer_pr_lease`
 - `gitea_release_workflow_lease`
-- `gitea_request_mcp_restart`
 - `gitea_resolve_task_capability`
 - `gitea_resume_review_draft`
 - `gitea_review_pr`

docs/webui-local-dev.md

@@ -54,6 +54,7 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/` | Home / operator overview |
 | `/health` | JSON liveness (`status`, `service`, `mode`, `timestamp`, `uptime_seconds`) |
 | `/api/v1/system/health` | Structured read-only system health (#634) |
+| `/system-health` | System-health dashboard — readiness, version/uptime, dependencies, MCP namespaces, stale-runtime parity (#639) |
 | `/queue` | Live PR and issue queue dashboard (#429) |
 | `/api/queue` | JSON queue export with pagination metadata |
 | `/projects` | Project registry list with status and onboarding progress (#427, #635) |
@@ -258,6 +259,37 @@ Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
 surfaces are backed by #636). Mutating methods on stub routes still fail closed
 with `read-only-mvp`.
 
+## System-health dashboard (#639)
+
+`/system-health` renders the same snapshot the `/api/v1/system/health` API
+returns, so the page and the API can never disagree. Cards: overall readiness,
+stale-runtime parity, version and uptime, dependency probes, MCP namespaces,
+probe errors (only when present), and recovery pointers. `?deep=1` opts into
+the network probe exactly as the API does; the plain page load stays cheap.
+
+Field authority and honesty rules:
+
+* `ready` and `readiness_complete` are shown separately. A snapshot whose
+  required probes never ran is not the same as one that ran them and passed,
+  and the page never collapses the two into an unproven green.
+* A probe that did not run appears under **Not probed**, never as healthy.
+* `stale_runtime.mutation_safe` is displayed verbatim from the API. When the
+  runtime is stale, or when parity is indeterminate, the page warns and does
+  not claim mutation safety.
+* MCP namespaces are reported `unproven`: the web process runs outside the
+  IDE-managed MCP client and cannot prove that path (#543).
+
+Redaction is split by field kind. Free text — probe details, readiness and
+parity reasons, probe errors — passes through `system_health.redact`.
+Structured fields — commit SHAs, probe names, statuses, timestamps — are
+HTML-escaped only, because `redact`'s opaque-token rule matches any run of 32
+or more characters and would otherwise blank every 40-character git SHA, which
+is precisely the evidence the parity view exists to show.
+
+The dashboard is read-only: no restart, reload, or process-kill control. Those
+arrive in Phase 2 (#642). Recovery guidance points at the sanctioned client
+reconnect / operator restart path — never a manual daemon kill (#630).
+
 ## Deployment boundary (#435)
 
 MVP serves on loopback by default. Binding `0.0.0.0` or `::` is **refused**

gitea_mcp_server.py

@@ -2040,7 +2040,6 @@ import dependency_graph  # noqa: E402  # #784 durable dependency edges
 import control_plane_db  # noqa: E402
 import lease_lifecycle  # noqa: E402
 import workflow_dashboard  # noqa: E402  # #605 live queue/lease dashboard
-import restart_coordinator  # noqa: E402  # #658 MCP restart coordinator/impact
 import incident_bridge  # noqa: E402
 import sentry_observability  # noqa: E402  (#606 optional Sentry observability)
 import sentry_incident_bridge  # noqa: E402  (#607 Sentry→Gitea incident bridge)
@@ -21490,156 +21489,6 @@ def gitea_workflow_dashboard(
     return payload
 
 
-@mcp.tool()
-def gitea_request_mcp_restart(
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-    dry_run: bool = True,
-    request_override: bool = False,
-    session_id: str | None = None,
-    limit: int = 200,
-) -> dict:
-    """Evaluate a proposed MCP restart and return an impact preview (#658).
-
-    Central restart coordinator: gathers live control-plane state (sessions,
-    leases/locks, in-flight issue/PR work, mutations, worktrees) and returns a
-    blast-radius impact report with a ``safe`` / ``unsafe`` / ``override``
-    verdict, so the console (#642/#652) and operators can see what a restart
-    would disrupt *before* any concurrent LLM work is destroyed.
-
-    This tool is **dry-run and never restarts anything.** The mutative apply
-    path is a separate child gated by a drain proof (non-goal here); calling
-    with ``dry_run=False`` still performs no restart and reports that apply is
-    not yet available.
-
-    Operator override authority is read from the process environment
-    (``GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION``), never self-asserted by
-    the requesting session: ``request_override`` only expresses caller intent
-    and takes effect solely when that environment authorization is present.
-
-    Fails closed: if the control-plane inventory cannot be completed, the
-    verdict is ``unsafe`` / deny (an incomplete evaluation must never green-light
-    a restart).
-    """
-    read_block = _profile_operation_gate("gitea.read")
-    if read_block:
-        return {
-            "success": False,
-            "read_only": True,
-            "dry_run": True,
-            "restart_performed": False,
-            "reasons": read_block,
-            "permission_report": _permission_block_report("gitea.read"),
-        }
-
-    try:
-        h, o, r = _resolve(remote, host, org, repo)
-    except ValueError as exc:
-        return {
-            "success": False,
-            "read_only": True,
-            "dry_run": True,
-            "restart_performed": False,
-            "reasons": [str(exc)],
-        }
-
-    inventory_complete = True
-    incomplete_reasons: list[str] = []
-    sessions: list[dict] = []
-    leases: list[dict] = []
-    terminal_lock: dict | None = None
-
-    db, db_errs = _control_plane_db_or_error()
-    if db is None:
-        inventory_complete = False
-        incomplete_reasons.extend(
-            db_errs or ["control-plane DB unavailable; cannot evaluate restart"]
-        )
-    else:
-        try:
-            sessions = db.list_sessions(statuses=("active",), limit=max(1, int(limit)))
-        except Exception as exc:  # noqa: BLE001
-            inventory_complete = False
-            incomplete_reasons.append(
-                f"session inventory failed: {_redact(str(exc))}"
-            )
-        try:
-            lease_result = lease_lifecycle.list_active_leases(
-                db,
-                remote=remote if remote in REMOTES else remote,
-                org=o,
-                repo=r,
-                role=None,
-                include_non_active=False,
-                limit=max(1, int(limit)),
-            )
-            leases = list(lease_result.get("leases") or [])
-        except Exception as exc:  # noqa: BLE001
-            inventory_complete = False
-            incomplete_reasons.append(
-                f"lease inventory failed: {_redact(str(exc))}"
-            )
-        try:
-            terminal = db.get_active_terminal_lock(
-                remote=remote if remote in REMOTES else remote,
-                org=o,
-                repo=r,
-            )
-            if terminal:
-                terminal_lock = dict(terminal)
-        except Exception as exc:  # noqa: BLE001
-            inventory_complete = False
-            incomplete_reasons.append(
-                f"terminal lock lookup failed: {_redact(str(exc))}"
-            )
-
-    profile = get_profile()
-    profile_name = (profile.get("profile_name") or "").strip() or "session"
-    sid = (session_id or "").strip() or f"{profile_name}-{os.getpid()}"
-
-    # Override authority is read from the environment only — a worker session
-    # cannot set an env var for an already-running daemon, so it cannot be
-    # self-asserted the way a tool argument could (#630/#710 F1 pattern).
-    operator_authorized = bool(
-        (os.environ.get("GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION") or "").strip()
-    )
-    operator_override = bool(request_override and operator_authorized)
-
-    inventory = {
-        "sessions": sessions,
-        "leases": leases,
-        "terminal_lock": terminal_lock,
-        "inventory_complete": inventory_complete,
-        "incomplete_reasons": incomplete_reasons,
-    }
-
-    report = restart_coordinator.evaluate_restart_impact(
-        inventory,
-        operator_override=operator_override,
-        requesting_session_id=sid,
-        dry_run=True,  # coordinator is always analysis-only (#658)
-    )
-
-    payload = report.as_dict()
-    payload["success"] = True
-    payload["read_only"] = True
-    payload["remote"] = remote
-    payload["org"] = o
-    payload["repo"] = r
-    payload["requesting_session_id"] = sid
-    payload["operator_override_requested"] = bool(request_override)
-    payload["operator_override_authorized"] = operator_authorized
-    payload["apply_supported"] = False
-    if not dry_run:
-        payload["reasons"] = list(payload.get("reasons") or []) + [
-            "apply requested but not supported: sanctioned restart apply is "
-            "gated by a drain proof (separate child); no restart performed (#658)"
-        ]
-    return payload
-
-
 @mcp.tool()
 def gitea_inspect_workflow_lease(
     lease_id: str,

restart_coordinator.py

@@ -1,451 +0,0 @@
-"""MCP restart coordinator and impact analysis (#658).
-
-Before any sanctioned MCP restart, a central coordinator must evaluate the
-live control-plane state — active sessions, leases/locks, in-flight issue/PR
-work, mutations, worktrees, and recovery history — and produce an *impact
-preview* so operators (and the web console, #642/#652) can see the blast
-radius **before** concurrent LLM work is disrupted.
-
-Design rules (mirrors the read-only posture of ``workflow_dashboard`` /
-``lease_lifecycle``):
-
-* **Pure classification.** :func:`evaluate_restart_impact` takes an already
-  gathered inventory and returns a structured report. It never touches the
-  network, the filesystem, or a live process, so multi-session fixtures can
-  drive every branch in unit tests. The coordinator *never restarts anything*;
-  a mutative apply path is a later child gated by a drain proof (non-goal here).
-* **Fail closed.** If the inventory is not explicitly complete, the verdict is
-  ``unsafe`` / deny — an incomplete evaluation must never green-light a restart.
-* **No secrets.** Session ids, pids, and profiles are operational metadata, not
-  credentials; nothing secret flows through this module.
-
-The single sanctioned entry point post-#657 is the MCP tool
-``gitea_request_mcp_restart`` (dry-run by default), which gathers the inventory
-from the #613 control-plane DB and calls :func:`evaluate_restart_impact`.
-"""
-
-from __future__ import annotations
-
-from dataclasses import dataclass, field
-from datetime import datetime, timezone
-from typing import Any, Mapping, Sequence
-
-import lease_lifecycle
-
-COORDINATOR_VERSION = "1.0.0-issue-658"
-
-# Restart verdicts. Exactly the three the acceptance criteria name.
-VERDICT_SAFE = "safe"
-VERDICT_UNSAFE = "unsafe"
-VERDICT_OVERRIDE = "override"
-
-# Blast-radius severity bands.
-BLAST_NONE = "none"
-BLAST_LOW = "low"
-BLAST_MEDIUM = "medium"
-BLAST_HIGH = "high"
-
-# A live lease with a live owner process is treated as active in-flight work.
-LEASE_FRESHNESS_LIVE = "active"
-
-# Default staleness window for a session heartbeat (seconds). A session whose
-# last heartbeat is older than this is not counted as live even if its row is
-# still marked ``active`` — it is assumed dead/detached.
-DEFAULT_SESSION_HEARTBEAT_STALE_SECONDS = 900
-
-
-def _utc_now() -> datetime:
-    return datetime.now(timezone.utc)
-
-
-def _parse_ts(value: str | None) -> datetime | None:
-    return lease_lifecycle._parse_ts(value)
-
-
-@dataclass(frozen=True)
-class SessionImpact:
-    """One MCP session a restart would terminate."""
-
-    session_id: str
-    role: str | None
-    profile: str | None
-    pid: int | None
-    status: str | None
-    alive: bool | None
-    heartbeat_stale: bool
-    is_requester: bool
-    live: bool
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "session_id": self.session_id,
-            "role": self.role,
-            "profile": self.profile,
-            "pid": self.pid,
-            "status": self.status,
-            "alive": self.alive,
-            "heartbeat_stale": self.heartbeat_stale,
-            "is_requester": self.is_requester,
-            "live": self.live,
-        }
-
-
-@dataclass(frozen=True)
-class LeaseImpact:
-    """One control-plane lease a restart would disrupt."""
-
-    lease_id: str | None
-    session_id: str | None
-    role: str | None
-    phase: str | None
-    freshness: str | None
-    work_kind: str | None
-    work_number: int | None
-    worktree_path: str | None
-    disruptive: bool
-    is_mutation: bool
-    is_critical_section: bool
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "lease_id": self.lease_id,
-            "session_id": self.session_id,
-            "role": self.role,
-            "phase": self.phase,
-            "freshness": self.freshness,
-            "work_kind": self.work_kind,
-            "work_number": self.work_number,
-            "worktree_path": self.worktree_path,
-            "disruptive": self.disruptive,
-            "is_mutation": self.is_mutation,
-            "is_critical_section": self.is_critical_section,
-        }
-
-
-@dataclass(frozen=True)
-class RestartImpactReport:
-    """Impact preview DTO returned to the console / operator (#642/#652)."""
-
-    coordinator_version: str
-    evaluated_at: str
-    dry_run: bool
-    restart_performed: bool
-    inventory_complete: bool
-    verdict: str
-    allow_restart: bool
-    override_would_allow: bool
-    operator_override: bool
-    blast_radius: str
-    reasons: list[str]
-    affected_sessions: list[SessionImpact]
-    affected_leases: list[LeaseImpact]
-    critical_sections: list[LeaseImpact]
-    affected_issues: list[int]
-    affected_prs: list[int]
-    mutations: list[LeaseImpact]
-    terminal_lock: dict[str, Any] | None
-    ack_state: dict[str, str]
-    prior_recovery_attempts: list[dict[str, Any]]
-    counts: dict[str, int]
-    audit_record: dict[str, Any]
-    incomplete_reasons: list[str] = field(default_factory=list)
-
-    def as_dict(self) -> dict[str, Any]:
-        return {
-            "coordinator_version": self.coordinator_version,
-            "evaluated_at": self.evaluated_at,
-            "dry_run": self.dry_run,
-            "restart_performed": self.restart_performed,
-            "inventory_complete": self.inventory_complete,
-            "incomplete_reasons": list(self.incomplete_reasons),
-            "verdict": self.verdict,
-            "allow_restart": self.allow_restart,
-            "override_would_allow": self.override_would_allow,
-            "operator_override": self.operator_override,
-            "blast_radius": self.blast_radius,
-            "reasons": list(self.reasons),
-            "affected_sessions": [s.as_dict() for s in self.affected_sessions],
-            "affected_leases": [l.as_dict() for l in self.affected_leases],
-            "critical_sections": [l.as_dict() for l in self.critical_sections],
-            "affected_issues": list(self.affected_issues),
-            "affected_prs": list(self.affected_prs),
-            "mutations": [l.as_dict() for l in self.mutations],
-            "terminal_lock": self.terminal_lock,
-            "ack_state": dict(self.ack_state),
-            "prior_recovery_attempts": list(self.prior_recovery_attempts),
-            "counts": dict(self.counts),
-            "audit_record": dict(self.audit_record),
-        }
-
-
-def _classify_session(
-    row: Mapping[str, Any],
-    *,
-    now: datetime,
-    requesting_session_id: str | None,
-    heartbeat_stale_seconds: int,
-) -> SessionImpact:
-    session_id = str(row.get("session_id") or "")
-    pid = row.get("pid")
-    status = (row.get("status") or "").strip().lower() or None
-    alive = lease_lifecycle.is_process_alive(pid) if pid is not None else None
-    hb = _parse_ts(row.get("last_heartbeat_at"))
-    heartbeat_stale = bool(
-        hb is not None and (now - hb).total_seconds() > heartbeat_stale_seconds
-    )
-    live = bool(status == "active" and alive is not False and not heartbeat_stale)
-    return SessionImpact(
-        session_id=session_id,
-        role=row.get("role"),
-        profile=row.get("profile"),
-        pid=pid,
-        status=status,
-        alive=alive,
-        heartbeat_stale=heartbeat_stale,
-        is_requester=bool(
-            requesting_session_id and session_id == requesting_session_id
-        ),
-        live=live,
-    )
-
-
-# Lease phases that represent an active mutation in flight (as opposed to a
-# mere allocation/claim with no work committed yet). An active lease in any of
-# these phases is a critical section a restart must not sever.
-_MUTATING_PHASES = frozenset(
-    {
-        "implementing",
-        "publishing",
-        "pushing",
-        "committing",
-        "reviewing",
-        "merging",
-        "reconciling",
-        "conflict_fix",
-    }
-)
-
-
-def _classify_lease(row: Mapping[str, Any]) -> LeaseImpact:
-    freshness_obj = row.get("freshness")
-    if isinstance(freshness_obj, Mapping):
-        freshness = str(freshness_obj.get("freshness") or "").strip().lower() or None
-    else:
-        freshness = str(freshness_obj or "").strip().lower() or None
-    phase = (row.get("phase") or "").strip().lower() or None
-    worktree = row.get("worktree_path")
-    disruptive = freshness == LEASE_FRESHNESS_LIVE
-    # A live lease is a mutation-in-flight if it carries an author worktree or
-    # its phase names a mutating step. All disruptive leases are critical
-    # sections a restart would sever regardless.
-    is_mutation = bool(
-        disruptive and (bool(worktree) or (phase in _MUTATING_PHASES))
-    )
-    number = row.get("work_number")
-    try:
-        number = int(number) if number is not None else None
-    except (TypeError, ValueError):
-        number = None
-    return LeaseImpact(
-        lease_id=row.get("lease_id"),
-        session_id=row.get("session_id"),
-        role=row.get("role"),
-        phase=phase,
-        freshness=freshness,
-        work_kind=(str(row.get("work_kind") or "").strip().lower() or None),
-        work_number=number,
-        worktree_path=worktree,
-        disruptive=disruptive,
-        is_mutation=is_mutation,
-        is_critical_section=disruptive,
-    )
-
-
-def _blast_radius(*, session_count: int, work_count: int, mutation_count: int) -> str:
-    if mutation_count > 0 or work_count >= 3 or session_count >= 3:
-        return BLAST_HIGH
-    if work_count > 0 or session_count == 2:
-        return BLAST_MEDIUM
-    if session_count == 1:
-        return BLAST_LOW
-    return BLAST_NONE
-
-
-def evaluate_restart_impact(
-    inventory: Mapping[str, Any],
-    *,
-    now: datetime | None = None,
-    operator_override: bool = False,
-    requesting_session_id: str | None = None,
-    dry_run: bool = True,
-    session_heartbeat_stale_seconds: int = DEFAULT_SESSION_HEARTBEAT_STALE_SECONDS,
-) -> RestartImpactReport:
-    """Evaluate a proposed MCP restart and return an impact preview.
-
-    ``inventory`` is a mapping with:
-
-    * ``sessions`` — session rows (session_id, role, profile, pid, status,
-      last_heartbeat_at).
-    * ``leases`` — control-plane lease rows, each ideally carrying an enriched
-      ``freshness`` dict (as :func:`lease_lifecycle.list_active_leases` returns);
-      a bare string freshness is also accepted.
-    * ``terminal_lock`` — the active terminal (merge) lock, if any.
-    * ``prior_recovery_attempts`` — narrower recovery attempts already tried
-      (e.g. sanctioned reconnects) so the operator sees escalation history.
-    * ``inventory_complete`` — bool. **Must** be explicitly True; a missing or
-      falsy value forces a deny (fail closed).
-    * ``incomplete_reasons`` — optional reasons the inventory is incomplete.
-
-    The coordinator never restarts anything: ``restart_performed`` is always
-    False and the mutative apply path is a later drain-gated child.
-    """
-    moment = now or _utc_now()
-    reasons: list[str] = []
-
-    inventory_complete = bool(inventory.get("inventory_complete", False))
-    incomplete_reasons = [str(r) for r in (inventory.get("incomplete_reasons") or [])]
-
-    sessions_raw: Sequence[Mapping[str, Any]] = inventory.get("sessions") or []
-    leases_raw: Sequence[Mapping[str, Any]] = inventory.get("leases") or []
-    terminal_lock = inventory.get("terminal_lock") or None
-    prior_recovery_attempts = [
-        dict(a) for a in (inventory.get("prior_recovery_attempts") or [])
-    ]
-
-    session_impacts = [
-        _classify_session(
-            s,
-            now=moment,
-            requesting_session_id=requesting_session_id,
-            heartbeat_stale_seconds=session_heartbeat_stale_seconds,
-        )
-        for s in sessions_raw
-    ]
-    lease_impacts = [_classify_lease(l) for l in leases_raw]
-
-    # Only *other* live sessions and live leases constitute blast radius: a
-    # restart that would kill only the requesting session with no other work in
-    # flight is safe.
-    other_live_sessions = [
-        s for s in session_impacts if s.live and not s.is_requester
-    ]
-    disruptive_leases = [l for l in lease_impacts if l.disruptive]
-    critical_sections = [l for l in lease_impacts if l.is_critical_section]
-    mutations = [l for l in lease_impacts if l.is_mutation]
-
-    affected_issues = sorted(
-        {
-            l.work_number
-            for l in disruptive_leases
-            if l.work_kind == "issue" and l.work_number is not None
-        }
-    )
-    affected_prs = sorted(
-        {
-            l.work_number
-            for l in disruptive_leases
-            if l.work_kind == "pr" and l.work_number is not None
-        }
-    )
-
-    disruptive = bool(disruptive_leases or other_live_sessions or terminal_lock)
-
-    if not inventory_complete:
-        verdict = VERDICT_UNSAFE
-        allow_restart = False
-        reasons.append(
-            "inventory incomplete: restart evaluation cannot confirm blast "
-            "radius — deny (fail closed, #658)"
-        )
-        reasons.extend(incomplete_reasons)
-    elif not disruptive:
-        verdict = VERDICT_SAFE
-        allow_restart = True
-        reasons.append("no other live sessions, live leases, or terminal lock")
-    elif operator_override:
-        verdict = VERDICT_OVERRIDE
-        allow_restart = True
-        reasons.append(
-            "live work present; operator override accepts the blast radius"
-        )
-    else:
-        verdict = VERDICT_UNSAFE
-        allow_restart = False
-        reasons.append(
-            "live work would be disrupted; restart denied without operator "
-            "override"
-        )
-
-    if critical_sections and inventory_complete:
-        reasons.append(
-            f"{len(critical_sections)} critical section(s) in flight "
-            "(active lease with a live owner)"
-        )
-    if terminal_lock:
-        reasons.append("active terminal (merge) lock present")
-
-    override_would_allow = bool(inventory_complete and disruptive)
-
-    blast_radius = _blast_radius(
-        session_count=len(other_live_sessions),
-        work_count=len(affected_issues) + len(affected_prs),
-        mutation_count=len(mutations),
-    )
-
-    # Acknowledgement is a later child (drain protocol); expose per-session
-    # placeholders so the console can render the ack column now.
-    ack_state = {s.session_id: "pending" for s in other_live_sessions}
-
-    counts = {
-        "sessions_total": len(session_impacts),
-        "sessions_live_other": len(other_live_sessions),
-        "leases_total": len(lease_impacts),
-        "leases_disruptive": len(disruptive_leases),
-        "critical_sections": len(critical_sections),
-        "mutations": len(mutations),
-        "affected_issues": len(affected_issues),
-        "affected_prs": len(affected_prs),
-        "prior_recovery_attempts": len(prior_recovery_attempts),
-    }
-
-    audit_record = {
-        "event": "restart_impact_evaluated",
-        "coordinator_version": COORDINATOR_VERSION,
-        "evaluated_at": moment.isoformat(),
-        "dry_run": dry_run,
-        "operator_override": bool(operator_override),
-        "requesting_session_id": requesting_session_id,
-        "inventory_complete": inventory_complete,
-        "verdict": verdict,
-        "allow_restart": allow_restart,
-        "blast_radius": blast_radius,
-        "counts": counts,
-    }
-
-    return RestartImpactReport(
-        coordinator_version=COORDINATOR_VERSION,
-        evaluated_at=moment.isoformat(),
-        dry_run=dry_run,
-        restart_performed=False,
-        inventory_complete=inventory_complete,
-        verdict=verdict,
-        allow_restart=allow_restart,
-        override_would_allow=override_would_allow,
-        operator_override=bool(operator_override),
-        blast_radius=blast_radius,
-        reasons=reasons,
-        affected_sessions=session_impacts,
-        affected_leases=lease_impacts,
-        critical_sections=critical_sections,
-        affected_issues=affected_issues,
-        affected_prs=affected_prs,
-        mutations=mutations,
-        terminal_lock=dict(terminal_lock)
-        if isinstance(terminal_lock, Mapping)
-        else terminal_lock,
-        ack_state=ack_state,
-        prior_recovery_attempts=prior_recovery_attempts,
-        counts=counts,
-        audit_record=audit_record,
-        incomplete_reasons=incomplete_reasons,
-    )

tests/test_restart_coordinator.py

@@ -1,340 +0,0 @@
-"""Tests for the MCP restart coordinator and impact analysis (#658).
-
-Multi-session fixtures exercise every verdict branch: safe, unsafe (live work),
-override, and the fail-closed deny on incomplete inventory. Also covers the
-critical-section deny path and the new ``ControlPlaneDB.list_sessions``.
-"""
-
-from __future__ import annotations
-
-import os
-import tempfile
-import unittest
-from datetime import datetime, timedelta, timezone
-
-import restart_coordinator as rc
-from control_plane_db import ControlPlaneDB
-
-
-NOW = datetime(2026, 7, 24, 6, 0, 0, tzinfo=timezone.utc)
-
-
-def _ts(dt: datetime) -> str:
-    return dt.isoformat()
-
-
-def _live_pid() -> int:
-    return os.getpid()
-
-
-def _dead_pid() -> int:
-    # A pid that is essentially never alive. os.kill(0) on it raises
-    # ProcessLookupError → is_process_alive False.
-    return 2_000_000_000
-
-
-def _session(session_id, *, pid, status="active", heartbeat=None, role="author"):
-    return {
-        "session_id": session_id,
-        "role": role,
-        "profile": "prgs-author",
-        "pid": pid,
-        "status": status,
-        "last_heartbeat_at": _ts(heartbeat or NOW),
-    }
-
-
-def _lease(
-    lease_id,
-    *,
-    session_id,
-    freshness,
-    kind="issue",
-    number=658,
-    phase="allocated",
-    worktree=None,
-    role="author",
-):
-    return {
-        "lease_id": lease_id,
-        "session_id": session_id,
-        "role": role,
-        "phase": phase,
-        "work_kind": kind,
-        "work_number": number,
-        "worktree_path": worktree,
-        "freshness": {"freshness": freshness},
-    }
-
-
-class EvaluateRestartImpactTest(unittest.TestCase):
-    def test_incomplete_inventory_denies_fail_closed(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {"inventory_complete": False, "incomplete_reasons": ["db down"]},
-            now=NOW,
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        self.assertFalse(report.restart_performed)
-        self.assertIn("db down", report.incomplete_reasons)
-        self.assertTrue(
-            any("fail closed" in reasoning for reasoning in report.reasons)
-        )
-
-    def test_missing_completeness_flag_denies(self) -> None:
-        # No inventory_complete key at all → treated as incomplete.
-        report = rc.evaluate_restart_impact({}, now=NOW)
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-
-    def test_no_other_work_is_safe(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
-        self.assertTrue(report.allow_restart)
-        self.assertEqual(report.blast_radius, rc.BLAST_NONE)
-        self.assertEqual(report.affected_issues, [])
-
-    def test_dead_foreign_session_and_lease_are_not_disruptive(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("dead", pid=_dead_pid()),
-                ],
-                "leases": [
-                    _lease("l-dead", session_id="dead", freshness="stale_dead_process")
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
-        self.assertTrue(report.allow_restart)
-        self.assertEqual(report.counts["leases_disruptive"], 0)
-        self.assertEqual(report.counts["sessions_live_other"], 0)
-
-    def test_live_foreign_lease_denies_without_override(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("worker", pid=_live_pid()),
-                ],
-                "leases": [
-                    _lease(
-                        "l1",
-                        session_id="worker",
-                        freshness="active",
-                        worktree="/tmp/wt-658",
-                        phase="implementing",
-                    )
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        # Critical section detected: active lease with a live owner.
-        self.assertEqual(len(report.critical_sections), 1)
-        self.assertEqual(report.affected_issues, [658])
-        self.assertEqual(report.counts["mutations"], 1)
-        self.assertTrue(report.override_would_allow)
-        self.assertEqual(report.blast_radius, rc.BLAST_HIGH)
-        # Placeholder ack state for the affected session.
-        self.assertEqual(report.ack_state.get("worker"), "pending")
-
-    def test_operator_override_allows_despite_live_work(self) -> None:
-        inv = {
-            "inventory_complete": True,
-            "sessions": [
-                _session("requester", pid=_live_pid()),
-                _session("worker", pid=_live_pid()),
-            ],
-            "leases": [_lease("l1", session_id="worker", freshness="active")],
-        }
-        report = rc.evaluate_restart_impact(
-            inv,
-            now=NOW,
-            requesting_session_id="requester",
-            operator_override=True,
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_OVERRIDE)
-        self.assertTrue(report.allow_restart)
-        self.assertFalse(report.restart_performed)
-
-    def test_deny_when_critical_section_open(self) -> None:
-        # A single live author lease in a mutating phase is a critical section
-        # that must deny an un-overridden restart.
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("worker", pid=_live_pid())],
-                "leases": [
-                    _lease(
-                        "l1",
-                        session_id="worker",
-                        freshness="active",
-                        phase="merging",
-                        kind="pr",
-                        number=900,
-                    )
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        self.assertEqual(report.affected_prs, [900])
-        self.assertEqual(len(report.critical_sections), 1)
-
-    def test_terminal_lock_makes_restart_unsafe(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-                "terminal_lock": {"terminal_pr": 812},
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertFalse(report.allow_restart)
-        self.assertIsNotNone(report.terminal_lock)
-        self.assertTrue(
-            any("terminal" in reasoning for reasoning in report.reasons)
-        )
-
-    def test_other_live_session_without_lease_is_disruptive(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("idle-but-live", pid=_live_pid()),
-                ],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
-        self.assertEqual(report.counts["sessions_live_other"], 1)
-
-    def test_stale_heartbeat_session_not_counted_live(self) -> None:
-        stale = NOW - timedelta(hours=2)
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [
-                    _session("requester", pid=_live_pid()),
-                    _session("stale", pid=_live_pid(), heartbeat=stale),
-                ],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
-        self.assertEqual(report.counts["sessions_live_other"], 0)
-
-    def test_prior_recovery_attempts_echoed(self) -> None:
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-                "prior_recovery_attempts": [
-                    {"kind": "client_reconnect", "at": _ts(NOW)}
-                ],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(len(report.prior_recovery_attempts), 1)
-        self.assertEqual(report.counts["prior_recovery_attempts"], 1)
-
-    def test_bare_string_freshness_accepted(self) -> None:
-        lease = _lease("l1", session_id="worker", freshness="active")
-        lease["freshness"] = "active"  # bare string, not a dict
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("worker", pid=_live_pid())],
-                "leases": [lease],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.counts["leases_disruptive"], 1)
-
-    def test_as_dict_is_serializable_dto(self) -> None:
-        import json
-
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": [_session("requester", pid=_live_pid())],
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        payload = report.as_dict()
-        # Round-trips through JSON — safe for the console DTO.
-        encoded = json.dumps(payload)
-        decoded = json.loads(encoded)
-        self.assertEqual(decoded["verdict"], rc.VERDICT_SAFE)
-        self.assertIn("audit_record", decoded)
-        self.assertEqual(decoded["audit_record"]["event"], "restart_impact_evaluated")
-        self.assertFalse(decoded["restart_performed"])
-        self.assertIn("coordinator_version", decoded)
-
-
-class ListSessionsTest(unittest.TestCase):
-    def setUp(self) -> None:
-        self._tmp = tempfile.TemporaryDirectory()
-        self.db = ControlPlaneDB(os.path.join(self._tmp.name, "cp.sqlite3"))
-
-    def tearDown(self) -> None:
-        self._tmp.cleanup()
-
-    def test_list_sessions_filters_by_status(self) -> None:
-        self.db.upsert_session(session_id="a", role="author", pid=1, status="active")
-        self.db.upsert_session(session_id="b", role="author", pid=2, status="ended")
-        active = self.db.list_sessions(statuses=("active",))
-        ids = {row["session_id"] for row in active}
-        self.assertEqual(ids, {"a"})
-        every = self.db.list_sessions()
-        self.assertEqual({row["session_id"] for row in every}, {"a", "b"})
-
-    def test_list_sessions_feeds_coordinator(self) -> None:
-        self.db.upsert_session(
-            session_id="requester", role="author", pid=os.getpid(), status="active"
-        )
-        report = rc.evaluate_restart_impact(
-            {
-                "inventory_complete": True,
-                "sessions": self.db.list_sessions(statuses=("active",)),
-                "leases": [],
-            },
-            now=NOW,
-            requesting_session_id="requester",
-        )
-        self.assertEqual(report.counts["sessions_total"], 1)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    unittest.main()

tests/test_webui_system_health_dashboard.py

@@ -0,0 +1,345 @@
+"""Tests for the system-health dashboard view (#639).
+
+Covers the acceptance criteria directly: the page renders the health DTO
+fields (AC1), degraded dependencies are visible (AC2), stale runtime is warned
+prominently and never rendered as mutation-safe (AC3), healthy and degraded
+fixtures both render (AC4), and the shell carries a nav entry (AC5).
+"""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from starlette.testclient import TestClient
+
+from webui.app import create_app
+from webui.deployment_boundary import scan_text_for_client_secrets
+from webui.layout import render_page
+from webui.nav import iter_nav_items
+from webui.system_health import (
+    STATUS_DEGRADED,
+    STATUS_DOWN,
+    STATUS_OK,
+    STATUS_SKIPPED,
+    STATUS_UNPROVEN,
+    DependencyProbe,
+    StaleRuntime,
+    SystemHealthSnapshot,
+    VersionInfo,
+)
+from webui.system_health_views import render_system_health_page
+
+DASHBOARD_PATH = "/system-health"
+
+
+def _version(*, known: bool = True) -> VersionInfo:
+    return VersionInfo(
+        git_sha="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd" if known else None,
+        git_describe="v0.4.1-12-g1c455b6" if known else None,
+        control_plane_schema_version=4 if known else None,
+        python_version="3.13.1",
+        known=known,
+    )
+
+
+def _parity(*, stale: bool = False, determinable: bool = True) -> StaleRuntime:
+    if stale:
+        return StaleRuntime(
+            daemon_head="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            checkout_head="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            remote_head="cccccccccccccccccccccccccccccccccccccccc",
+            stale=True,
+            determinable=True,
+            mutation_safe=False,
+            reasons=("runtime, checkout, and remote commits disagree",),
+        )
+    if not determinable:
+        return StaleRuntime(
+            daemon_head=None,
+            checkout_head=None,
+            remote_head=None,
+            stale=False,
+            determinable=False,
+            mutation_safe=False,
+            reasons=("local checkout HEAD could not be read",),
+        )
+    return StaleRuntime(
+        daemon_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        checkout_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        remote_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        stale=False,
+        determinable=True,
+        mutation_safe=True,
+        reasons=(),
+    )
+
+
+def _snapshot(
+    *,
+    status: str = STATUS_OK,
+    ready: bool = True,
+    readiness_complete: bool = True,
+    readiness_reasons: tuple[str, ...] = (),
+    dependencies: tuple[DependencyProbe, ...] | None = None,
+    parity: StaleRuntime | None = None,
+    namespaces: tuple[dict, ...] = (),
+    probe_errors: tuple[str, ...] = (),
+    version_known: bool = True,
+) -> SystemHealthSnapshot:
+    if dependencies is None:
+        dependencies = (
+            DependencyProbe(
+                name="control_plane_db",
+                kind="sqlite",
+                status=STATUS_OK,
+                detail="schema version 4",
+                required=True,
+                latency_ms=1.25,
+                metadata={"schema_version": 4},
+            ),
+        )
+    return SystemHealthSnapshot(
+        status=status,
+        ready=ready,
+        readiness_complete=readiness_complete,
+        readiness_reasons=readiness_reasons,
+        service="mcp-control-plane-webui",
+        mode="read-only",
+        version=_version(known=version_known),
+        started_at="2026-07-23T19:50:47+00:00",
+        uptime_seconds=3661.5,
+        timestamp="2026-07-23T20:51:48+00:00",
+        deep_probes_requested=False,
+        dependencies=dependencies,
+        mcp_namespaces=namespaces,
+        stale_runtime=parity if parity is not None else _parity(),
+        probe_errors=probe_errors,
+    )
+
+
+class TestHealthyRender(unittest.TestCase):
+    """AC1 / AC4 — every health DTO field reaches the page."""
+
+    def setUp(self):
+        self.html = render_system_health_page(_snapshot())
+
+    def test_readiness_fields_render(self):
+        self.assertIn("System health", self.html)
+        self.assertIn("Ready", self.html)
+        self.assertIn("mcp-control-plane-webui", self.html)
+        self.assertIn("read-only", self.html)
+        self.assertIn("2026-07-23T20:51:48+00:00", self.html)
+
+    def test_version_and_uptime_render(self):
+        self.assertIn("1c455b6ec0f9cb761fe6248de68c17e061fb5ecd", self.html)
+        self.assertIn("v0.4.1-12-g1c455b6", self.html)
+        self.assertIn("3.13.1", self.html)
+        self.assertIn("3661.500s", self.html)
+        self.assertIn("1.02h", self.html)
+
+    def test_dependency_row_renders_with_latency(self):
+        self.assertIn("control_plane_db", self.html)
+        self.assertIn("sqlite", self.html)
+        self.assertIn("schema version 4", self.html)
+        self.assertIn("1.2 ms", self.html)
+
+    def test_healthy_page_shows_no_stale_warning(self):
+        self.assertNotIn("Stale runtime:", self.html)
+        self.assertNotIn("Staleness", self.html)
+
+    def test_unknown_version_is_labelled_not_faked(self):
+        html = render_system_health_page(_snapshot(version_known=False))
+        self.assertIn("unknown", html)
+        self.assertIn("unresolved", html)
+
+
+class TestDegradedRender(unittest.TestCase):
+    """AC2 — a degraded or unrun dependency is visible, not swallowed."""
+
+    def setUp(self):
+        self.deps = (
+            DependencyProbe(
+                name="control_plane_db",
+                kind="sqlite",
+                status=STATUS_OK,
+                detail="schema version 4",
+                required=True,
+                latency_ms=0.9,
+            ),
+            DependencyProbe(
+                name="repository",
+                kind="git",
+                status=STATUS_DOWN,
+                detail="repository root is not a git checkout",
+                required=True,
+                latency_ms=4.0,
+            ),
+            DependencyProbe(
+                name="gitea",
+                kind="http",
+                status=STATUS_SKIPPED,
+                detail="deep probe not requested",
+                required=False,
+            ),
+        )
+        self.html = render_system_health_page(
+            _snapshot(
+                status=STATUS_DEGRADED,
+                ready=False,
+                readiness_complete=False,
+                readiness_reasons=("required dependency 'repository' is down",),
+                dependencies=self.deps,
+            )
+        )
+
+    def test_degraded_banner_names_the_dependency(self):
+        self.assertIn("Degraded dependencies:", self.html)
+        self.assertIn("repository", self.html)
+
+    def test_not_run_probe_is_reported_separately(self):
+        self.assertIn("Not probed:", self.html)
+        self.assertIn("gitea", self.html)
+        self.assertIn("not counted", self.html)
+
+    def test_not_ready_headline_and_reason(self):
+        self.assertIn("Not ready", self.html)
+        self.assertIn("required dependency 'repository' is down", self.html)
+
+    def test_degraded_status_badge_present(self):
+        self.assertIn("badge-health-degraded", self.html)
+        self.assertIn("badge-health-down", self.html)
+
+    def test_ready_but_incomplete_is_not_shown_as_plain_ready(self):
+        html = render_system_health_page(
+            _snapshot(ready=True, readiness_complete=False)
+        )
+        self.assertIn("Ready (incomplete evidence)", html)
+
+
+class TestStaleRuntimeWarning(unittest.TestCase):
+    """AC3 — staleness is prominent and never claims mutation safety."""
+
+    def test_stale_runtime_warns_and_denies_mutation_safety(self):
+        html = render_system_health_page(_snapshot(parity=_parity(stale=True)))
+        self.assertIn("Stale runtime:", html)
+        self.assertIn("do not treat this runtime as mutation-safe", html)
+        self.assertIn("<tr><th>Mutation safe</th><td>False</td></tr>", html)
+
+    def test_indeterminate_parity_is_not_reported_safe(self):
+        html = render_system_health_page(
+            _snapshot(parity=_parity(determinable=False))
+        )
+        self.assertIn("Staleness", html)
+        self.assertIn("<tr><th>Mutation safe</th><td>False</td></tr>", html)
+        self.assertIn("<tr><th>Determinable</th><td>False</td></tr>", html)
+
+    def test_healthy_parity_reports_mutation_safe_true(self):
+        html = render_system_health_page(_snapshot())
+        self.assertIn("<tr><th>Mutation safe</th><td>True</td></tr>", html)
+
+
+class TestNamespacesAndErrors(unittest.TestCase):
+    def test_unproven_namespace_rows_render(self):
+        html = render_system_health_page(
+            _snapshot(
+                namespaces=(
+                    {
+                        "namespace": "gitea-author",
+                        "required_tool": "gitea_lock_issue",
+                        "status": STATUS_UNPROVEN,
+                        "ide_namespace_proven": False,
+                        "reason": "the web console cannot invoke the IDE-managed MCP client",
+                    },
+                )
+            )
+        )
+        self.assertIn("gitea-author", html)
+        self.assertIn("gitea_lock_issue", html)
+        self.assertIn("badge-health-unproven", html)
+
+    def test_no_namespaces_degrades_gracefully(self):
+        html = render_system_health_page(_snapshot(namespaces=()))
+        self.assertIn("No MCP namespaces are declared.", html)
+
+    def test_probe_errors_render_when_present(self):
+        html = render_system_health_page(
+            _snapshot(probe_errors=("probe raised: disk offline",))
+        )
+        self.assertIn("Probe errors", html)
+        self.assertIn("disk offline", html)
+
+    def test_probe_error_card_absent_when_clean(self):
+        self.assertNotIn("Probe errors", render_system_health_page(_snapshot()))
+
+
+class TestReadOnlyAndRedaction(unittest.TestCase):
+    def test_no_restart_or_kill_controls(self):
+        html = render_system_health_page(_snapshot())
+        self.assertNotIn("<button", html)
+        self.assertNotIn("<form", html)
+        self.assertNotIn("pkill", html)
+        self.assertIn("read-only", html)
+
+    def test_recovery_points_at_sanctioned_path(self):
+        html = render_system_health_page(_snapshot())
+        self.assertIn("Reconnect the MCP client", html)
+        self.assertIn("Never kill the daemon process manually", html)
+
+    def test_secret_shaped_detail_is_redacted(self):
+        leaky = DependencyProbe(
+            name="gitea",
+            kind="http",
+            status=STATUS_DOWN,
+            detail="auth failed for token=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
+            required=False,
+            latency_ms=12.0,
+        )
+        html = render_system_health_page(_snapshot(dependencies=(leaky,)))
+        self.assertNotIn("ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", html)
+
+    def test_html_in_detail_is_escaped(self):
+        hostile = DependencyProbe(
+            name="repository",
+            kind="git",
+            status=STATUS_DOWN,
+            detail="<script>alert(1)</script>",
+            required=True,
+        )
+        html = render_system_health_page(_snapshot(dependencies=(hostile,)))
+        self.assertNotIn("<script>", html)
+        self.assertIn("&lt;script&gt;", html)
+
+
+class TestNavAndRoute(unittest.TestCase):
+    """AC5 — the shell links the dashboard, and the route serves it."""
+
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_nav_contains_system_health(self):
+        self.assertIn(
+            (DASHBOARD_PATH, "System health"),
+            [(item.href, item.label) for item in iter_nav_items()],
+        )
+
+    def test_rendered_shell_links_dashboard(self):
+        page = render_page(title="Home", body_html="<p>x</p>")
+        self.assertIn(f'href="{DASHBOARD_PATH}"', page)
+
+    def test_route_renders_dashboard(self):
+        response = self.client.get(DASHBOARD_PATH)
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("System health", response.text)
+        self.assertIn("Stale-runtime parity", response.text)
+
+    def test_route_is_read_only(self):
+        self.assertEqual(self.client.post(DASHBOARD_PATH).status_code, 405)
+
+    def test_live_page_leaks_no_client_secret(self):
+        findings = scan_text_for_client_secrets(self.client.get(DASHBOARD_PATH).text)
+        self.assertEqual(findings, [])
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()

webui/app.py

@@ -53,6 +53,7 @@ from webui.system_health import (
     process_uptime,
     snapshot_to_dict as system_health_to_dict,
 )
+from webui.system_health_views import render_system_health_page
 
 _READ_ONLY_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
 _AUDIT_MUTATION_PATHS = frozenset({"/audit", "/api/audit"})
@@ -161,6 +162,24 @@ async def api_system_health(request: Request) -> JSONResponse:
     return JSONResponse(payload, status_code=200 if snapshot.ready else 503)
 
 
+async def system_health(request: Request) -> HTMLResponse:
+    """Read-only system-health dashboard (#639).
+
+    Shares the #634 snapshot loader with the JSON API so the page can never
+    disagree with it. `?deep=1` opts into the network probe exactly as the API
+    does; the default page load stays cheap. The response is always 200: this
+    is an operator view that must render the degraded state, not withhold it.
+    """
+    deep = _truthy_flag(request.query_params.get("deep"))
+    snapshot = load_system_health(deep=deep)
+    return HTMLResponse(
+        render_page(
+            title="System health",
+            body_html=render_system_health_page(snapshot),
+        )
+    )
+
+
 async def queue(_request: Request) -> HTMLResponse:
     snapshot = load_queue_snapshot()
     return HTMLResponse(render_page(title="Queue", body_html=render_queue_page(snapshot)))
@@ -571,6 +590,7 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/", home, methods=["GET"]),
             Route("/health", health, methods=["GET"]),
             Route(SYSTEM_HEALTH_API_PATH, api_system_health, methods=["GET"]),
+            Route("/system-health", system_health, methods=["GET"]),
             Route("/queue", queue, methods=["GET"]),
             Route("/api/queue", api_queue, methods=["GET"]),
             Route("/projects", projects, methods=["GET"]),

webui/layout.py

@@ -236,6 +236,25 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
     .badge-in-review {{ color: #9ec8f0; border-color: #3d5f7a; }}
     .badge-duplicate {{ color: #e0c27a; border-color: #6b5730; }}
     .badge-stale {{ color: #c9b8e8; border-color: #5a4a78; }}
+    .badge-health-ok {{ color: #8fd19e; border-color: #3d6b4a; }}
+    .badge-health-degraded {{ color: #e0c27a; border-color: #6b5730; }}
+    .badge-health-down {{ color: #f0a8a8; border-color: #7a3b3b; }}
+    .badge-health-skipped {{ color: var(--muted); }}
+    .badge-health-unproven {{ color: #c9b8e8; border-color: #5a4a78; }}
+    .health-card {{
+      margin: 1.25rem 0;
+      padding: 0.85rem 1rem 1rem;
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      background: var(--surface);
+    }}
+    .health-card h3 {{ margin: 0 0 0.5rem; font-size: 1.05rem; }}
+    .health-card h4 {{ margin: 1rem 0 0.35rem; font-size: 0.92rem; color: var(--muted); }}
+    .health-headline {{ color: var(--text); font-size: 1rem; margin: 0 0 0.5rem; }}
+    .health-degraded {{ border-left-color: #e0c27a; }}
+    .health-stale {{ border-left-color: #f0a8a8; }}
+    ul.reasons {{ margin: 0.35rem 0; padding-left: 1.15rem; color: var(--muted); font-size: 0.9rem; }}
+    ul.reasons li {{ margin-bottom: 0.3rem; }}
   </style>
   {extra_head}
 </head>

webui/nav.py

@@ -38,6 +38,7 @@ class NavGroup:
 NAV_GROUPS: tuple[NavGroup, ...] = (
     NavGroup("Health", (
         NavItem("/health", "Liveness"),
+        NavItem("/system-health", "System health"),
     )),
     NavGroup("Traffic", (
         NavItem("/queue", "Queue"),

webui/system_health_views.py

@@ -0,0 +1,307 @@
+"""HTML views for the system-health dashboard (#639).
+
+Renders the read-only :class:`~webui.system_health.SystemHealthSnapshot`
+produced by the Phase 1 system-health API (#634). The page offers no restart,
+reload, or process-kill control: those are Phase 2 work, and manual process
+kills are the contamination path #630 exists to prevent.
+
+Every free-text field passes through :func:`webui.system_health.redact` before
+it reaches HTML, so a probe detail that captured a token or a credentialed URL
+cannot leak through the dashboard even though the API redacts it already.
+"""
+
+from __future__ import annotations
+
+import html
+
+from webui.system_health import (
+    STATUS_DEGRADED,
+    STATUS_DOWN,
+    STATUS_OK,
+    STATUS_SKIPPED,
+    STATUS_UNPROVEN,
+    DependencyProbe,
+    SystemHealthSnapshot,
+    redact,
+)
+
+_STATUS_BADGE_CLASS = {
+    STATUS_OK: "badge-health-ok",
+    STATUS_DEGRADED: "badge-health-degraded",
+    STATUS_DOWN: "badge-health-down",
+    STATUS_SKIPPED: "badge-health-skipped",
+    STATUS_UNPROVEN: "badge-health-unproven",
+}
+
+
+def _safe(value: object) -> str:
+    """Escape free text for HTML after redacting anything secret-shaped.
+
+    Use this for every value that can carry arbitrary text — probe details,
+    reasons, probe errors — because those are where a credential could ride
+    along.
+    """
+    return html.escape(redact(str(value)))
+
+
+def _esc(value: object) -> str:
+    """Escape a structured field for HTML without redacting it.
+
+    Commit SHAs, probe names, statuses, and timestamps are enumerated or
+    machine-generated, never credential-bearing. They must not go through
+    :func:`redact`: its opaque-token rule matches any 32-plus-character run,
+    so a 40-character git SHA would render as ``[redacted]`` and the parity
+    view — the one thing an operator reads this page for — would be blank.
+    """
+    return html.escape(str(value))
+
+
+def _status_badge(status: str) -> str:
+    css = _STATUS_BADGE_CLASS.get(status, "badge-health-unproven")
+    return f'<span class="badge {css}">{_esc(status)}</span>'
+
+
+def _reason_list(reasons: tuple[str, ...], *, empty: str) -> str:
+    if not reasons:
+        return f"<p class='muted'>{html.escape(empty)}</p>"
+    items = "".join(f"<li>{_safe(reason)}</li>" for reason in reasons)
+    return f"<ul class='reasons'>{items}</ul>"
+
+
+def _readiness_card(snapshot: SystemHealthSnapshot) -> str:
+    """Overall readiness.
+
+    ``ready`` and ``readiness_complete`` are shown separately on purpose: a
+    snapshot whose required probes never ran is not the same as one that ran
+    them and passed, and collapsing the two would render an unproven green.
+    """
+    if snapshot.ready and snapshot.readiness_complete:
+        headline = "Ready"
+    elif snapshot.ready:
+        headline = "Ready (incomplete evidence)"
+    else:
+        headline = "Not ready"
+
+    return (
+        "<section class='health-card'>"
+        f"<h3>Readiness {_status_badge(snapshot.status)}</h3>"
+        f"<p class='health-headline'>{html.escape(headline)}</p>"
+        "<table class='detail'>"
+        f"<tr><th>Service</th><td><code>{_esc(snapshot.service)}</code></td></tr>"
+        f"<tr><th>Mode</th><td>{_esc(snapshot.mode)}</td></tr>"
+        f"<tr><th>Ready</th><td>{_esc(snapshot.ready)}</td></tr>"
+        "<tr><th>Readiness evidence complete</th>"
+        f"<td>{_esc(snapshot.readiness_complete)}</td></tr>"
+        "<tr><th>Deep probes requested</th>"
+        f"<td>{_esc(snapshot.deep_probes_requested)}</td></tr>"
+        f"<tr><th>Observed at</th><td><code>{_esc(snapshot.timestamp)}</code></td></tr>"
+        "</table>"
+        "<h4>Readiness reasons</h4>"
+        f"{_reason_list(snapshot.readiness_reasons, empty='No readiness objections recorded.')}"
+        "</section>"
+    )
+
+
+def _version_card(snapshot: SystemHealthSnapshot) -> str:
+    version = snapshot.version
+    uptime_hours = snapshot.uptime_seconds / 3600.0
+    known = (
+        "resolved"
+        if version.known
+        else "unresolved — version fields could not be read from the checkout"
+    )
+    schema = version.control_plane_schema_version
+    return (
+        "<section class='health-card'>"
+        "<h3>Version and uptime</h3>"
+        "<table class='detail'>"
+        f"<tr><th>Git SHA</th><td><code>{_esc(version.git_sha or 'unknown')}</code></td></tr>"
+        "<tr><th>Git describe</th>"
+        f"<td><code>{_esc(version.git_describe or 'unknown')}</code></td></tr>"
+        "<tr><th>Control-plane schema</th>"
+        f"<td>{_esc(schema if schema is not None else 'unknown')}</td></tr>"
+        f"<tr><th>Python</th><td><code>{_esc(version.python_version)}</code></td></tr>"
+        f"<tr><th>Version status</th><td>{html.escape(known)}</td></tr>"
+        f"<tr><th>Started at</th><td><code>{_esc(snapshot.started_at)}</code></td></tr>"
+        "<tr><th>Uptime</th>"
+        f"<td>{snapshot.uptime_seconds:.3f}s ({uptime_hours:.2f}h)</td></tr>"
+        "</table>"
+        "</section>"
+    )
+
+
+def _dependency_rows(probes: tuple[DependencyProbe, ...]) -> str:
+    if not probes:
+        return "<p class='muted'>No dependency probes were reported.</p>"
+    rows = []
+    for probe in probes:
+        latency = (
+            f"{probe.latency_ms:.1f} ms" if probe.latency_ms is not None else "n/a"
+        )
+        rows.append(
+            "<tr>"
+            f"<td><code>{_esc(probe.name)}</code></td>"
+            f"<td>{_esc(probe.kind)}</td>"
+            f"<td>{_status_badge(probe.status)}</td>"
+            f"<td>{_esc('required' if probe.required else 'optional')}</td>"
+            f"<td>{html.escape(latency)}</td>"
+            f"<td>{_safe(probe.detail)}</td>"
+            "</tr>"
+        )
+    return (
+        "<table class='registry'><thead><tr>"
+        "<th>Dependency</th><th>Kind</th><th>Status</th><th>Requirement</th>"
+        "<th>Latency</th><th>Detail</th>"
+        "</tr></thead><tbody>"
+        f"{''.join(rows)}</tbody></table>"
+    )
+
+
+def _dependency_card(snapshot: SystemHealthSnapshot) -> str:
+    degraded = [probe for probe in snapshot.dependencies if probe.ran and not probe.healthy]
+    not_run = [probe for probe in snapshot.dependencies if not probe.ran]
+
+    banner = ""
+    if degraded:
+        names = ", ".join(sorted(probe.name for probe in degraded))
+        banner += (
+            "<div class='stub health-degraded'><p><strong>Degraded dependencies:</strong> "
+            f"{_esc(names)}</p></div>"
+        )
+    if not_run:
+        names = ", ".join(sorted(probe.name for probe in not_run))
+        banner += (
+            "<div class='stub'><p><strong>Not probed:</strong> "
+            f"{_esc(names)} — these contribute no evidence and are not counted "
+            "as healthy.</p></div>"
+        )
+
+    return (
+        "<section class='health-card'>"
+        "<h3>Dependencies</h3>"
+        f"{banner}"
+        f"{_dependency_rows(snapshot.dependencies)}"
+        "<p class='muted'>Details are redacted at the API boundary and again "
+        "before rendering; credentials are never displayed.</p>"
+        "</section>"
+    )
+
+
+def _namespace_card(snapshot: SystemHealthSnapshot) -> str:
+    if not snapshot.mcp_namespaces:
+        body = "<p class='muted'>No MCP namespaces are declared.</p>"
+    else:
+        rows = []
+        for entry in snapshot.mcp_namespaces:
+            rows.append(
+                "<tr>"
+                f"<td><code>{_esc(entry.get('namespace'))}</code></td>"
+                f"<td><code>{_esc(entry.get('required_tool'))}</code></td>"
+                f"<td>{_status_badge(str(entry.get('status') or STATUS_UNPROVEN))}</td>"
+                f"<td>{_esc(entry.get('ide_namespace_proven'))}</td>"
+                f"<td>{_safe(entry.get('reason'))}</td>"
+                "</tr>"
+            )
+        body = (
+            "<table class='registry'><thead><tr>"
+            "<th>Namespace</th><th>Required tool</th><th>Status</th>"
+            "<th>IDE-proven</th><th>Reason</th>"
+            "</tr></thead><tbody>"
+            f"{''.join(rows)}</tbody></table>"
+        )
+    return (
+        "<section class='health-card'>"
+        "<h3>MCP namespaces</h3>"
+        f"{body}"
+        "<p class='muted'>The web process runs outside the IDE-managed MCP "
+        "client, so namespace health is reported as unproven rather than "
+        "guessed (#543).</p>"
+        "</section>"
+    )
+
+
+def _stale_runtime_card(snapshot: SystemHealthSnapshot) -> str:
+    stale = snapshot.stale_runtime
+    if stale.stale:
+        warning = (
+            "<div class='stub health-stale'><p><strong>Stale runtime:</strong> "
+            "the running code, the checkout, and the remote-tracking commit "
+            "disagree. Capability gates may be evaluating obsolete code — "
+            "do not treat this runtime as mutation-safe.</p></div>"
+        )
+    elif not stale.determinable:
+        warning = (
+            "<div class='stub health-stale'><p><strong>Staleness "
+            "indeterminate:</strong> parity could not be proven, so this "
+            "runtime is not reported as mutation-safe.</p></div>"
+        )
+    else:
+        warning = ""
+
+    return (
+        "<section class='health-card'>"
+        "<h3>Stale-runtime parity</h3>"
+        f"{warning}"
+        "<table class='detail'>"
+        "<tr><th>Daemon head</th>"
+        f"<td><code>{_esc(stale.daemon_head or 'unknown')}</code></td></tr>"
+        "<tr><th>Checkout head</th>"
+        f"<td><code>{_esc(stale.checkout_head or 'unknown')}</code></td></tr>"
+        "<tr><th>Remote head</th>"
+        f"<td><code>{_esc(stale.remote_head or 'unknown')}</code></td></tr>"
+        f"<tr><th>Stale</th><td>{_esc(stale.stale)}</td></tr>"
+        f"<tr><th>Determinable</th><td>{_esc(stale.determinable)}</td></tr>"
+        f"<tr><th>Mutation safe</th><td>{_esc(stale.mutation_safe)}</td></tr>"
+        "</table>"
+        f"{_reason_list(stale.reasons, empty='Runtime, checkout, and remote agree.')}"
+        "</section>"
+    )
+
+
+def _probe_error_card(snapshot: SystemHealthSnapshot) -> str:
+    if not snapshot.probe_errors:
+        return ""
+    return (
+        "<section class='health-card'>"
+        "<h3>Probe errors</h3>"
+        f"{_reason_list(snapshot.probe_errors, empty='')}"
+        "</section>"
+    )
+
+
+def _recovery_card() -> str:
+    """Sanctioned recovery pointers only — never a manual process kill (#630)."""
+    return (
+        "<section class='health-card'>"
+        "<h3>Recovery</h3>"
+        "<p class='muted'>This dashboard is read-only. Restart and reload "
+        "controls arrive in Phase 2 (#642); until then recovery runs through "
+        "the sanctioned client reconnect / operator restart path.</p>"
+        "<ul class='reasons'>"
+        "<li><a href='/runtime'>Runtime and session view</a> — active profile, "
+        "workflow hashes, and shell health.</li>"
+        "<li>Reconnect the MCP client from the IDE, then re-run the blocked "
+        "cycle. Never kill the daemon process manually: unmanaged kills are "
+        "recorded as runtime contamination (#630).</li>"
+        "<li>See <code>docs/webui-local-dev.md</code> for the documented "
+        "recovery sequence.</li>"
+        "</ul>"
+        "</section>"
+    )
+
+
+def render_system_health_page(snapshot: SystemHealthSnapshot) -> str:
+    """Render the full system-health dashboard body."""
+    return (
+        "<h2>System health</h2>"
+        "<p class='meta'>Read-only view of the Phase 1 system-health API "
+        "(<code>/api/v1/system/health</code>). Reload this page to refresh; "
+        "nothing here polls or mutates on your behalf.</p>"
+        f"{_readiness_card(snapshot)}"
+        f"{_stale_runtime_card(snapshot)}"
+        f"{_version_card(snapshot)}"
+        f"{_dependency_card(snapshot)}"
+        f"{_namespace_card(snapshot)}"
+        f"{_probe_error_card(snapshot)}"
+        f"{_recovery_card()}"
+    )