feat(homepage): recategorise on "do I open this?", collapse the API groups

The board mixed tools with endpoints. A vLLM seat whose href is a /docs page sat in the same band as ComfyUI; the MQTT broker and the RustDesk relay, which have no page at all, sat in Apps; and `Service Networking` was thirteen members spanning three AdGuards, five Dockges, two Traefiks and four headless agents. Every group is now one of two kinds and they never mix. TOOLS are expanded and sit at the top of their tab. ENDPOINTS — an API, a broker, a background agent, an href that is /docs or /ping or nothing — carry `initiallyCollapsed: true` and sit at the bottom. Collapsed is not hidden: the eyebrow and its rule still render, so the tab still says the thing exists and one click expands it. A second rule fell out of the same pass and now shapes the group boundaries: a group's members should all carry a widget or none should. A stat strip makes a card ~50px taller, so one widget card in a row of plain ones opens a void under the plain ones. That is why AdGuard and Traefik get their own groups rather than sharing one with Dockge, and it is most of why the old Service Networking band looked broken. AdGuard (ANA) was the last short card in its row and now carries the same query/blocked/latency strip as its two siblings — one infra-ops AdGuard login authenticates against all three instances, verified against each; it lives in that stack's .env on the host and is vaulted. The sixteen GPU-backed model seats were deliberately NOT relabelled. `homepage.group` is read at container creation, so clearer names for `AI - Inference` and friends would have cost a recreate on six vLLM seats, four eval seats and four TTS engines — multi-minute model reloads on endpoints peers reach through the gateway. Order plus `initiallyCollapsed` buys the same separation for nothing, so those names stay as they are on purpose. 28 containers that ARE cheap to bounce were relabelled, across five hosts, via rerunnable elway playbooks. Their label steps are gated on the old value still being present, so a second run reports skipped rather than churning. Two verify steps were wrong on first contact and are fixed with the reason recorded: the traefik check raced its own recreate, and asserting a model seat is "running" cannot answer "did I bounce it" when a seat may be legitimately stopped — container age can, and now does. The canonical stacks/ tree was synced to the deployed labels afterwards, so intent and reality agree again on all fourteen tracked stacks. Also documents the real nature of the post-recreate blank dashboard, which cost ~25 minutes here and an hour on 2026-08-19. `initialSettings":{}` in the served HTML is the catch branch of the page's data loader, not a warm-up and not a cache — and the error can vanish entirely, because the logger is assigned inside the same try and the catch only logs if the logger exists. Ruled out by measurement this time: all four API routes return 200 with correct content while the page serves {}, and the previous known-good settings.yaml reproduces it identically. The README now carries the one-command test and the next lead. Before/after, all four tabs: http://10.100.10.50:8090/b/homepage-relayout/
2026-08-24 08:54:06 -07:00
parent f6f2f69649
commit 39da1d4a97
25 changed files with 1022 additions and 111 deletions
@@ -0,0 +1,16 @@
+# AdGuard Home — Anaheim. Copy to `.env` on ana-docker at
+# /opt/docker/compose/adguard-ana/.env and chmod 600. Never commit the real file.
+
+# Web UI / API port. compose.yaml defaults to 8053 if unset.
+AG_WEB_PORT=8053
+
+# Password for the `infra-ops` AdGuard login, used ONLY by the Homepage
+# query/blocked/latency widget (homepage.widget.password in compose.yaml).
+# One credential authenticates against all three fleet instances (ANA, ESH,
+# NH3) — verified 2026-08-24. Fetch it from the vault rather than copying it
+# between boxes:
+#
+#   secret get nh3-dev/adguard-infra-ops-password
+#
+# (`secret` is services/secrets-broker/secret on nh3-dev.)
+ADGUARD_WIDGET_PASSWORD=
@@ -39,12 +39,26 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Service Networking
+      - homepage.group=DNS & Filtering
      - homepage.name=AdGuard (ANA)
-      - homepage.icon=mdi-dns
+      # si-adguard, matching the ESH and NH3 instances. This carried mdi-dns
+      # and was the only one of the three wearing a different mark.
+      - homepage.icon=si-adguard
      - homepage.description=DNS resolver + .internal zone (colo)
      - homepage.href=http://10.250.50.70:${AG_WEB_PORT:-8053}
      - homepage.siteMonitor=http://10.250.50.70:${AG_WEB_PORT:-8053}
+      # Query/blocked/latency strip, same as ESH and NH3. Added 2026-08-24:
+      # without it this was a short card sitting beside two tall ones, which
+      # is the whole reason the DNS group exists as its own band — a group's
+      # members should all carry a widget or none of them should.
+      # Credential is the fleet AdGuard `infra-ops` login, which authenticates
+      # against all three instances; it lives in this stack's .env on the host
+      # (never in git) and is vaulted at
+      # `secret get nh3-dev/adguard-infra-ops-password`.
+      - homepage.widget.type=adguard
+      - homepage.widget.url=http://10.250.50.70:${AG_WEB_PORT:-8053}
+      - homepage.widget.username=infra-ops
+      - homepage.widget.password=${ADGUARD_WIDGET_PASSWORD}

 volumes:
  adguard_work: {}
@@ -85,7 +85,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=AI - Image & Media
+      - homepage.group=AI - Studios
      - homepage.name=Arbo
      - homepage.icon=mdi-image-multiple-outline
      - homepage.description=Catalog-driven ComfyUI engine (irv-ml1)
@@ -90,7 +90,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=AI - Image & Media
+      - homepage.group=AI - Studios
      - homepage.name=ComfyUI
      - homepage.icon=mdi-image-auto-adjust
      - homepage.description=Node-based SD/Flux inference (irv-ml1)
@@ -27,7 +27,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Service Networking
+      - homepage.group=Compose Consoles
      - homepage.name=Dockge (${DOCKGE_HOST_LABEL})
      - homepage.icon=sh-dockge.png
      - homepage.description=Compose UI on ${DOCKGE_HOST_LABEL}
@@ -27,7 +27,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Toolchain
+      - homepage.group=Agents (no UI)
      - homepage.name=gitea-runner
      - homepage.icon=mdi-cog-play
      - homepage.description=Gitea Actions self-hosted runner (${GITEA_RUNNER_NAME})
@@ -33,11 +33,44 @@ recreated.

 ## Layout

-`conf/settings.yaml` owns tabs, group order, and column counts — `services.yaml`
-owns *what exists*, `settings.yaml` owns *where it sits*. Four tabs: Main, AI,
-Infrastructure, Toolchain. A group listed in `layout:` with no members simply
-renders empty, so a group can look "dead" when its provider host is unreachable
-rather than when the group is wrong.
+`conf/settings.yaml` owns tabs, group order, column counts and collapse state —
+`services.yaml` owns *what exists*, `settings.yaml` owns *where it sits*. Four
+tabs: Main, AI, Infrastructure, Toolchain. A group listed in `layout:` with no
+members simply renders empty, so a group can look "dead" when its provider host
+is unreachable rather than when the group is wrong.
+
+**The organising question is "do I open this?", not "what is it?"** (operator,
+2026-08-24). Every group is either **tools** — expanded, top of its tab — or
+**endpoints** (an API, a broker, a background agent, an href that is a `/docs`
+page or a `/ping` or nothing) — `initiallyCollapsed: true`, bottom of its tab.
+A collapsed group still renders its eyebrow and rule, so the tab tells you the
+thing exists without spending a row on it. `AI - Inference` holds the seats the
+whole fleet runs on and it is collapsed, because you reach them through the
+gateway, not by clicking them.
+
+A second, quieter rule shapes the same block: **a group's members should all
+have widgets or all not have them.** A stat strip makes a card ~50px taller, so
+one widget card in a row of plain ones opens a void under the plain ones. That
+is why AdGuard (3 widget cards) and Traefik (2 widget cards) are separate groups
+from Dockge (5 plain cards) rather than one `Service Networking` band.
+
+Group *membership* is not in this file — it is the `homepage.group=` label on
+each container, and labels are read at container **creation**. The 2026-08-24
+pass moved 28 services and the playbooks that did it are rerunnable:
+
+```bash
+scripts/elway infra-ops@10.250.50.70 --playbook playbooks/homepage-regroup-ana-docker.yaml
+scripts/elway infra-ops@10.0.50.45   --playbook playbooks/homepage-regroup-esh-docker-vm.yaml
+scripts/elway infra-ops@10.100.50.40 --playbook playbooks/homepage-regroup-nh3-docker.yaml
+scripts/elway infra-ops@10.100.79.3  --playbook playbooks/homepage-regroup-irv-ml1.yaml
+scripts/elway infra-ops@10.250.50.54 --playbook playbooks/homepage-regroup-ana-ml2.yaml
+```
+
+⚠ **The GPU-backed model seats are deliberately still named `AI - Inference`,
+`AI - Eval & Retrieval`, `AI - Speech (TTS)` and `AI - Audio Tools`.** Clearer
+names would cost a recreate on sixteen seats — multi-minute model reloads on
+endpoints peers reach through the gateway. Order and `initiallyCollapsed` buy
+the same separation for free. Don't spend that recreate on a label.

 ## Foot-guns found in the 2026-08-17 audit

@@ -124,18 +157,86 @@ is in the "iteration loop" note below.

 ## The tab bar goes missing after a recreate, then comes back on its own

-**Status: self-healing, cause not pinned, and INTERMITTENT. Do not chase it.**
+**Status: intermittent, self-healing, and now HALF-DIAGNOSED. Still don't chase
+it — but you can now tell in one command whether you are in it.**
+
 After a recreate the client render can come up with no tab bar, no wallpaper
 and no i18n (the search box shows the raw key `search.search`), with groups
 falling back to side-by-side columns. It restores itself with no intervention.

-⚠ **It does not happen every time.** The 2026-08-24 recreate (`compose up -d
--force-recreate homepage`, to land a `settings.yaml` change) came up correct
-within 10 seconds: the fresh `columns: 4` payload was in the served HTML on the
-first poll, and a Playwright pass clicked through all four tabs a minute later
-with the bar present. So do not pre-emptively schedule an hour of ugliness
-around a config change — recreate, check, and only then walk away if it is in
-the broken state.
+### The one-command test
+
+```bash
+curl -s http://10.0.50.45:5100/ | grep -o 'initialSettings":[^,]\{0,20\}'
+```
+
+`initialSettings":{"…` — healthy. `initialSettings":{}` — you are in it.
+
+### What `initialSettings":{}` actually means (found 2026-08-24)
+
+It is **not** a warm-up, a cache, or a partial render. It is the **catch branch**
+of the page's data loader. Decompiled from `/app/.next/server/pages/index.js`:
+
+```js
+async function K() {
+  let a;
+  try {
+    a = logger("index");                    // <-- assigned INSIDE the try
+    let { providers, ...d } = getSettings();
+    ... await servicesResponse(), bookmarksResponse(), widgetsResponse()
+    return { props: { initialSettings: d, ... } };
+  } catch (b) {
+    return a && b && a.error(b),            // <-- guarded on `a`
+           { props: { initialSettings: {}, ... } };
+  }
+}
+```
+
+Two consequences worth knowing:
+
+1. **Something in that try block is throwing.** The page is not "still warming
+   up"; it has already failed and returned a degraded shape.
+2. **The error can be swallowed completely.** `a` is assigned inside the same
+   try, and the catch only logs `if (a)`. If the *logger itself* is what threw,
+   `a` is `undefined` and nothing is written anywhere — which is exactly what
+   was observed on 2026-08-24: catch branch demonstrably taken, and not one
+   `index`-tagged line in `docker logs` or `conf/homepage/logs/homepage.log`.
+
+### What it is NOT — ruled out by measurement, don't re-run these
+
+- **Not the config.** `/api/services`, `/api/bookmarks`, `/api/widgets` and
+  `/api/hash` all return **200 with fully correct content** while the page
+  serves `initialSettings":{}` — including the brand-new group structure, in the
+  right order. Every input the loader awaits works when called directly.
+- **Not the 2026-08-24 layout rewrite.** Restoring the *previous, known-good*
+  `settings.yaml` and recreating reproduced the empty payload identically. (This
+  matches the 2026-08-19 finding that the pre-adoption backup config reproduces
+  it too.)
+- **Not `/api/validate`,** which returns `[]` throughout.
+- **Not disk, not permissions.** 206 GB free; the container runs as root and a
+  write test into `/app/config/logs` succeeds.
+
+### Timing, measured rather than assumed
+
+Wildly variable, which is the whole trap. On 2026-08-24 one recreate came up
+correct **within 10 seconds**, and three consecutive recreates ~40 minutes later
+were still empty after 60-120s each. The 2026-08-19 session measured a fresh
+container still tab-less at 4m30s twice, and healthy again after roughly an hour.
+`docker ps` reporting `healthy` says nothing about it — the container is serving,
+the page is just wrong.
+
+**Practical rule: recreate, run the one-command test, and if it is empty, go do
+something else and re-check.** Do not start editing config — that is how an hour
+got spent in 2026-08-19 ruling out four causes that were never the cause (the
+config, the v2.0.0 release, `PUID`/`PGID` and Docker discovery, and the server
+side). Every one of those remains ruled out.
+
+**Next lead, for whoever picks this up:** move the `logger("index")` hypothesis
+forward. The winston file logger writes to `conf/homepage/logs/homepage.log`,
+which had grown to 8.6 MB and stopped being appended to at the same time the
+render started failing. Rolling it aside is a one-liner and is the cheapest
+thing left to try:
+`sudo mv /opt/docker/conf/homepage/logs/homepage.log{,.rolled}` then recreate.

 **Timing, measured rather than assumed:** five minutes is NOT enough — a fresh
 container was still tab-less at 4m30s, twice. It was observed healthy again
@@ -27,24 +27,37 @@
      icon: mdi-filmstrip
      siteMonitor: http://10.100.10.50:8090/healthz
      description: Media drop + upload-for-pickup + the standing agent link board — nh3-dev, 24h TTL except kept boards
-  - Voice Design Studio:
-      href: http://10.100.79.3:8216/
-      icon: mdi-microphone
-      siteMonitor: http://10.100.79.3:8216/health
-      description: Mint, audition and keeper-mark synthetic fleet voices — irv-ml1, CPU-only
  - The Henge:
      href: http://park.phasefinal.com:8420/
      icon: mdi-clipboard-check
      siteMonitor: http://park.phasefinal.com:8420/healthz
      description: Durable needs-attention / idea parking (stonehenge-park) — ana-docker
+  # Was its own one-card `Games` group, which burned a full 4-wide row on a
+  # single panel. It is an app you open; this is where apps you open live.
+  - Pterodactyl:
+      href: http://10.250.50.55/
+      icon: mdi-gamepad-square
+      siteMonitor: http://10.250.50.55
+      description: Game server panel

-# The AI tab is fully Docker-auto-discovered. Each inference service carries
-# a homepage.group=AI - <role> label on its compose file (AI - Inference,
-# AI - Eval & Retrieval, AI - Gateways & Chat, AI - Speech (TTS),
-# AI - Audio Tools, AI - Image & Media). Tab assignment, group order, and
-# column counts live in settings.yaml. Do not add entries here or they'll
-# double up. To move a service between AI groups, change the label on its
-# compose file and recreate the container (labels only apply on recreate).
+# The AI tab is otherwise fully Docker-auto-discovered. Each service carries a
+# homepage.group=AI - <role> label on its compose file (AI - Gateways & Chat,
+# AI - Studios, AI - Inference, AI - Eval & Retrieval, AI - Speech (TTS),
+# AI - Audio Tools, AI - Dormant). Tab assignment, group order, columns and
+# collapse state live in settings.yaml. Do not add a labelled container here as
+# well or it renders twice. To move a service between AI groups, change the
+# label on its compose file and recreate the container — labels are read at
+# creation, so `restart` will not do it.
+- AI - Studios:
+  # Manual entry — Voice Design Studio is a user-level systemd service on
+  # irv-ml1, not a Docker-labeled stack, so it cannot auto-discover. It sits
+  # with the other studios rather than in Apps: it is a workspace you open and
+  # produce something in, which is exactly what that group is for.
+  - Voice Design Studio:
+      href: http://10.100.79.3:8216/
+      icon: mdi-microphone
+      siteMonitor: http://10.100.79.3:8216/health
+      description: Mint, audition and keeper-mark synthetic fleet voices — irv-ml1, CPU-only

 - Media:
  - Plex:
@@ -67,13 +80,6 @@
        key: '{{HOMEPAGE_VAR_JELLYFIN_KEY}}'
        enableBlocks: true

- Games:
-  - Pterodactyl:
-      href: http://10.250.50.55/
-      icon: mdi-gamepad-square
-      siteMonitor: http://10.250.50.55
-      description: Game server panel
-
 - Infra - ANA:
  - ANA-Firewall:
      href: https://10.250.250.1
@@ -46,34 +46,55 @@ statusStyle: ""
 # reads as a rendering fault.
 useEqualHeights: false

-# Function-first layout, four-tab split:
-#   Main           - daily-use apps, media, bookmarks, monitoring
-#   AI             - the inference fleet, grouped by role (see below)
-#   Infrastructure - hardware, hypervisors, BMCs (per site)
-#   Toolchain      - backend services running but rarely clicked
+# ===========================================================================
+# THE ORGANISING QUESTION IS "DO I OPEN THIS?" — NOT "WHAT IS IT?"
+# (operator, 2026-08-24: "most of the issues are that tools I use and have a
+# UI are interspersed with API endpoints which are largely informational
+# only. They might even go in their own cards or start collapsed.")
 #
-# The AI tab splits the fleet by function so a 20+ service list reads as
-# sorted groups instead of one endless column. Group membership is set by
-# the homepage.group=AI - <role> label on each service's compose file:
-#   AI - Inference        LLM seats you call (gen, char-rp, char-rp-reasoning, summarizer)
-#   AI - Eval & Retrieval judges, reward, rerank, embed, image-quality
-#   AI - Gateways & Chat  routing gateway, control plane, chat frontends
-#   AI - Speech (TTS)     text-to-speech engines
-#   AI - Audio Tools      speech-to-text + audio dataset tooling
-#   AI - Image & Media    image/video generation + pipelines
-#   AI - Dormant          stopped stacks (rollback seats, retired auditions)
+# Every group on this board is one of two kinds, and they never mix:
 #
-# AI TAB ORDER IS BY CLICKABILITY, NOT BY IMPORTANCE (operator, 2026-08-18).
-# Groups render in the order they appear in this block, so the top of the tab
-# is prime real estate and it should hold the things you actually open in a
-# browser — chat frontends, ComfyUI, the control plane. Most of the model
-# seats below them are vLLM API endpoints whose href is a `/docs` page: they
-# are worth SEEING (status at a glance) but not worth reaching for, so they
-# sink. Order is therefore:
-#   interactive UIs -> mixed -> API-only seats -> dormant
-# If you add an AI group, place it by asking "would I click this?", not by
-# how central the service is to the fleet.
+#   TOOLS — you click the card and do something in the thing it opens.
+#           Expanded, and placed at the TOP of its tab.
+#   ENDPOINTS — an API, a broker, a background agent. Its href is a `/docs`
+#           page, a `/ping`, or nothing at all. The only thing you want from
+#           the card is "is it alive". `initiallyCollapsed: true`, and placed
+#           at the BOTTOM of its tab.
 #
+# A collapsed group is not hidden — the eyebrow and its rule still render, so
+# the tab still tells you the thing exists, and one click expands it. That is
+# the whole point: presence without cost.
+#
+# When you add a service, ask "would I open this in a browser to get work
+# done?" If no, it belongs in a collapsed endpoint group, no matter how
+# central it is to the fleet. `AI - Inference` holds the seats the entire
+# fleet runs on and it is collapsed, because you consume them through the
+# gateway rather than by clicking them.
+#
+# Four tabs:
+#   Main           - what you actually open day to day
+#   AI             - AI tools up top, model/API seats collapsed below
+#   Infrastructure - hardware, hypervisors, BMCs (per site) — all consoles
+#   Toolchain      - the plumbing, split by kind of plumbing
+#
+# ---------------------------------------------------------------------------
+# GROUP MEMBERSHIP LIVES ON THE CONTAINER, NOT HERE.
+#
+# This block controls tab, order, columns and collapse. WHICH services are in
+# a group is set by `homepage.group=` on each container's compose file, and
+# labels only apply at container CREATION — moving a service between groups
+# means editing the label and running `docker compose up -d <service>`, not
+# `restart`. The 2026-08-24 pass did 28 of those; the playbooks that did it
+# are `playbooks/homepage-regroup-<host>.yaml` and they are rerunnable.
+#
+# ⚠ THE MODEL SEATS ARE DELIBERATELY STILL NAMED `AI - Inference`,
+# `AI - Eval & Retrieval`, `AI - Speech (TTS)` AND `AI - Audio Tools`.
+# Renaming them to something like "AI API - …" would be clearer, and it would
+# cost a recreate on sixteen GPU-backed seats — multi-minute model reloads on
+# endpoints peers reach through the gateway. Order and `initiallyCollapsed`
+# buy the same separation for free. Do not spend that recreate on a label.
+#
+# ---------------------------------------------------------------------------
 # COLUMNS ARE 4 EVERYWHERE. DO NOT TUNE THEM PER GROUP.
 #
 # `columns: N` is not a density dial — it sets `lg:grid-cols-N` on that one
@@ -97,24 +118,36 @@ useEqualHeights: false
 # still collapses this to 2-up and 1-up on narrow viewports, so 4 is a desktop
 # maximum, not a hard floor.
 #
+# ---------------------------------------------------------------------------
+# GROUPS ARE ALSO KEPT UNIFORM IN CARD HEIGHT, WHICH IS WHY ADGUARD AND
+# TRAEFIK GOT THEIR OWN GROUPS.
+#
+# A service with a widget (AdGuard's query counts, Traefik's router counts,
+# Uptime Kuma's uptime) renders a stat strip that makes its card ~50px taller
+# than a plain link card. Put one of those in a row of three plain cards and
+# you get a void under the plain ones — which is what made the old 13-member
+# `Service Networking` group look broken. Split so that a group's members all
+# have widgets or all do not, and every row comes out flush. That is the real
+# reason `DNS & Filtering` (3 widget cards) and `Reverse Proxies` (2 widget
+# cards) are separate from `Compose Consoles` (5 plain cards).
+#
+# ---------------------------------------------------------------------------
 # EVERY GROUP NEEDS A `tab:` — including bookmark groups, and including groups
 # that arrive from a `homepage.group=` container label rather than from this
 # file. A group with no tab assignment renders on ALL FOUR TABS. That is how
 # UltraSeedbox ended up repeated at the bottom of every tab (fixed 2026-08-18)
 # and how Scriberr's `AI Systems` label did the same from 2026-08-23 (fixed
-# 2026-08-24 by relabelling it into `AI - Audio Tools`). It is Homepage
-# behaviour, not a bug, and it will happen again to the next container labelled
-# with a group name that does not appear below.
+# 2026-08-24). It is Homepage behaviour, not a bug, and it will happen again to
+# the next container labelled with a group name that does not appear below.
 # `GET /api/services` prints the live group list — anything in it that is not a
 # key here is currently leaking onto all four tabs.
+# ===========================================================================
 layout:
-  Notes:
-    icon: mdi-note-text-outline
-    tab: Main
-    style: row
-    columns: 4
-  News:
-    icon: mdi-rss
+  # ---- Main: what you actually open -------------------------------------
+  # Replaces the old Notes (1 member) and News (2) bands, which each burned a
+  # full 4-wide row on a single card.
+  Daily:
+    icon: mdi-coffee-outline
    tab: Main
    style: row
    columns: 4
@@ -123,6 +156,9 @@ layout:
    tab: Main
    style: row
    columns: 4
+  # Absorbed the old one-card Games band (Pterodactyl). Lost SearXNG to Daily,
+  # the two chat frontends to the AI tab, and Mosquitto + the RustDesk relay to
+  # Agents (no UI) — neither of those has a page to open.
  Apps:
    icon: mdi-apps
    tab: Main
@@ -133,11 +169,6 @@ layout:
    tab: Main
    style: row
    columns: 4
-  Games:
-    icon: mdi-gamepad-square
-    tab: Main
-    style: row
-    columns: 4
  # Bookmarks. Listed here for the tab pin above all else — without it this
  # group appears on every tab. `style: row` also turns the eight entries
  # from full-width stacked bars into a compact grid.
@@ -146,44 +177,53 @@ layout:
    tab: Main
    style: row
    columns: 4
-  # --- AI tab: ordered interactive -> API-only -> dormant (see note above) ---
-  # Things you open: chat frontends, the control plane, the LiteLLM UI.
+
+  # ---- AI: tools, then collapsed endpoints ------------------------------
+  # Chat frontends and the control plane — Lobe Chat and the ESH Open WebUI
+  # joined from Main on 2026-08-24; they are chat frontends and belong with the
+  # other chat frontends.
  AI - Gateways & Chat:
    icon: mdi-router-network
    tab: AI
    style: row
    columns: 4
-  # ComfyUI is a full node editor and Arbo has a real UI — both get clicked.
-  AI - Image & Media:
-    icon: mdi-image-multiple
+  # Replaces `AI - Image & Media`. Everything here is a workspace you open and
+  # produce something in: ComfyUI's node editor, Arbo, Waterland, the YT
+  # Voice Clipper audition console, Scriberr's transcription UI.
+  AI - Studios:
+    icon: mdi-palette-outline
    tab: AI
    style: row
    columns: 4
-  # Mixed: YT Voice Clipper has an audition console, Parakeet is an API.
-  # Scriberr joined here 2026-08-24 (it was the stray `AI Systems` group).
-  AI - Audio Tools:
-    icon: mdi-waveform
-    tab: AI
-    style: row
-    columns: 4
-  # Below here: model seats whose href is a vLLM `/docs` page. Status at a
-  # glance is the whole value; you consume these through the gateway, not by
-  # clicking them.
+  # ---- collapsed from here down: seats you call, not pages you open ------
+  # Named `AI - Inference` rather than something clearer on purpose — see the
+  # warning above about what renaming these costs.
  AI - Inference:
    icon: mdi-brain
    tab: AI
    style: row
    columns: 4
+    initiallyCollapsed: true
  AI - Eval & Retrieval:
    icon: mdi-scale-balance
    tab: AI
    style: row
    columns: 4
+    initiallyCollapsed: true
  AI - Speech (TTS):
    icon: mdi-account-voice
    tab: AI
    style: row
    columns: 4
+    initiallyCollapsed: true
+  # What is left of the old Audio Tools group after Scriberr and the YT Voice
+  # Clipper moved to Studios: the two ASR API seats.
+  AI - Audio Tools:
+    icon: mdi-waveform
+    tab: AI
+    style: row
+    columns: 4
+    initiallyCollapsed: true
  # Stopped stacks kept for rollback / superseded seats / retired auditions.
  # They stay 'created' (not running) via `docker compose up --no-start`, so
  # they show here as offline cards and revive with `docker compose start`.
@@ -192,6 +232,9 @@ layout:
    tab: AI
    style: row
    columns: 4
+    initiallyCollapsed: true
+
+  # ---- Infrastructure: every card is a console --------------------------
  Infra - ANA:
    icon: si-proxmox
    tab: Infrastructure
@@ -212,13 +255,38 @@ layout:
    tab: Infrastructure
    style: row
    columns: 4
-  Service Networking:
+
+  # ---- Toolchain: the plumbing, split by kind ---------------------------
+  # The old `Service Networking` group was thirteen members mixing three
+  # AdGuards, five Dockges, two Traefiks and four headless agents — widget
+  # cards next to plain ones next to things with no href at all. Split four
+  # ways on 2026-08-24.
+  DNS & Filtering:
+    icon: mdi-dns
+    tab: Toolchain
+    style: row
+    columns: 4
+  Reverse Proxies:
    icon: mdi-transit-connection-variant
    tab: Toolchain
    style: row
    columns: 4
+  Compose Consoles:
+    icon: mdi-docker
+    tab: Toolchain
+    style: row
+    columns: 4
  Toolchain:
    icon: mdi-toolbox
    tab: Toolchain
    style: row
    columns: 4
+  # No href, or an href that is an API. CrowdSec, Mailrise, the restic
+  # rest-server, the Gitea Actions runner, the MQTT broker, the RustDesk relay.
+  # You never open these; you only ever want to know they are up.
+  Agents (no UI):
+    icon: mdi-cog-transfer-outline
+    tab: Toolchain
+    style: row
+    columns: 4
+    initiallyCollapsed: true
@@ -120,7 +120,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Apps
+      - homepage.group=AI - Gateways & Chat
      - homepage.name=Lobe Chat
      - homepage.icon=mdi-chat-processing
      - homepage.description=Chat frontend over the LiteLLM gateway (eval)
@@ -33,7 +33,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Notes
+      - homepage.group=Daily
      - homepage.name=Memos
      - homepage.icon=mdi-note-text-outline
      - homepage.description=Self-hosted note + memo server (ana-docker)
@@ -44,7 +44,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=News
+      - homepage.group=Daily
      - homepage.name=Miniflux
      - homepage.icon=mdi-rss
      - homepage.description=RSS reader (subreddits, blogs, HN)
@@ -106,8 +106,8 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Apps
-      - homepage.name=Open WebUI
+      - homepage.group=AI - Gateways & Chat
+      - homepage.name=Open WebUI (esh)
      - homepage.icon=mdi-chat-question
      - homepage.description=Env-declarative chat frontend over the LiteLLM gateway (eval vs Lobe)
      - homepage.href=http://10.0.50.45:${OPENWEBUI_PORT:-3211}
@@ -52,7 +52,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=Service Networking
+      - homepage.group=Agents (no UI)
      - homepage.name=Restic (rest-server)
      - homepage.icon=mdi-cloud-upload
      - homepage.description=Anaheim restic endpoint (data on NFS)
@@ -90,13 +90,16 @@ services:
    networks:
      - tnet
    labels:
-      # `AI - Audio Tools`, not `AI Systems`. The group name has to match a key
-      # in the dashboard's settings.yaml `layout:` block — a group that appears
-      # nowhere in that block gets no `tab:` assignment, and Homepage renders an
-      # untabbed group on EVERY tab. `AI Systems` did exactly that from
-      # 2026-08-23 until it was caught; transcription belongs with the other ASR
-      # seats anyway (Parakeet, Speaches).
-      - homepage.group=AI - Audio Tools
+      # ⚠ The group name MUST match a key in the dashboard's settings.yaml
+      # `layout:` block. A group that appears nowhere in that block gets no
+      # `tab:` assignment, and Homepage renders an untabbed group on EVERY tab.
+      # This label read `AI Systems` — a group that existed nowhere — from
+      # 2026-08-23 until it was caught on 2026-08-24.
+      # `AI - Studios` and not one of the ASR groups because Scriberr is a
+      # transcription UI you open and work in, which is what Studios collects;
+      # the bare ASR endpoints (Parakeet, Speaches) live in the collapsed
+      # `AI - Audio Tools` group instead.
+      - homepage.group=AI - Studios
      - homepage.name=Scriberr
      - homepage.icon=mdi-microphone-message
      - homepage.description=Audio/video transcription + diarization (ana-ml2, GPU1)
@@ -87,7 +87,7 @@ services:
      - traefik.http.routers.searxng.tls=true
      - traefik.http.routers.searxng.service=searxng
      - traefik.http.services.searxng.loadbalancer.server.port=8080
-      - homepage.group=Apps
+      - homepage.group=Daily
      - homepage.name=SearXNG
      - homepage.icon=si-searxng
      - homepage.description=Privacy-respecting meta-search
@@ -82,7 +82,7 @@ services:
    networks:
      - tnet
    labels:
-      - homepage.group=AI - Image & Media
+      - homepage.group=AI - Studios
      - homepage.name=Waterland Studio
      - homepage.icon=mdi-watercolor
      - homepage.description=Watercolour plate + reveal animation renderer (irv-ml1, A6000)
@@ -29,7 +29,7 @@ services:
      retries: 3
      start_period: 10s
    labels:
-      - homepage.group=AI - Gateways & Chat
+      - homepage.group=AI - Inference
      - homepage.name=Zed FIM Proxy
      - homepage.icon=mdi-code-braces-box
      - homepage.description=Keyless /v1/completions for Zed edit-predictions (coder-fast, ana-docker)