Mocop 0.10.0

Added

• Added mocop deploy as the fresh-server fast path. After package installation, one
  non-overwriting command configures the current host, enables safe SSH alias/topology
  discovery, creates a fresh capability, and installs and verifies the user service.
• Added non-destructive mocop migrate configuration generation for moving the
  monitor to another machine. It rebinds local identity, drops reported machine-bound
  policy, upgrades bounded topology discovery, preserves host admission by default,
  refuses existing targets/copied capabilities, and never copies secrets or history.
• Added opt-in, cached SSH topology discovery from bounded ssh -G resolution.
  Effective ProxyJump chains and common SSH-backed ProxyCommand forms identify
  infrastructure aliases, keep automatically discovered jump hosts out of the probe
  inventory, build the display tree, and group targets by their closest known hop,
  with shared numbered alias prefixes as a fallback for direct targets.
  Explicit inventory, exclusions, groups, and configured topology remain authoritative;
  group metadata may predeclare auto-discovered aliases without authorizing probes;
  raw commands, users, and addresses are never published.
• Added HTTPS-only trusted_web_hosts suffix entries (for example,
  *.preview.example) for ephemeral Host-rewriting dashboard proxies. Suffix entries
  authorize browser Origin only; exact backend Host validation and Bearer
  authentication remain mandatory.
• Added an explicit dashboard token prompt for bare and forwarded URLs. Submitted
  credentials are retained only after successful API authentication; malformed or
  rejected tokens remain unstored and do not trigger automatic retries.
• Added a capacity watch to the capacity matcher: one saved demand
  (count/model/per-GPU free VRAM) is re-evaluated on every accepted snapshot in
  the browser. The ready edge shows an in-page banner and title marker, sends an
  opt-in browser notification with a 60-second cooldown, re-arms only after the
  demand stops being satisfied, and persists per browser. No new API or SSH
  work is involved.
• Added one-click ssh <alias> copy to capacity candidates and the GPU detail
  dialog. The copied command uses the configured OpenSSH alias; display names
  stay presentation-only.

Changed

• Moved the runtime package to src/mocop (ADR-0025).
  Package names and wheel contents are unchanged. A source checkout still runs
  tests without installation: tests/__init__.py prepends src to sys.path,
  and discovery now names the repository root (python3 -m unittest discover -s tests -t .). Contributor commands reference src/mocop paths.

Fixed

• Applied configured host display names consistently across node navigation, resource
  inventory, heatmap, topology, GPU details, search placement, incidents, and alerts.
• Fixed managed-service shutdown when no host-specific probe timeout is configured.
• Kept the nvidia-smi fallback query from emitting an empty success line when the
  combined query is unsupported and the base query returns no rows.
• Fixed the collection script for hosts without block devices: an empty
  /sys/block glob aborted the system awk pass and dropped every core CPU,
  memory, load, network, and I/O row, permanently misreporting a healthy host
  as failed. Exotic mounts (for example FUSE backends reporting - capacity),
  a malformed nvidia-smi row, and malformed pressure rows now degrade only
  their own section instead of rejecting the whole host sample.
• Restoring SQLite history now drops rows whose required percentage columns are
  NULL (foreign writers or partial corruption) instead of crashing the
  collector on every start until the row was deleted by hand.
• Non-ASCII Bearer credentials now fail closed with the documented 403 instead
  of crashing the comparison and resetting the connection; trusted-host and
  Origin checks now canonicalize the absolute DNS form (trailing dot).
• The generated unit now quotes EnvironmentFile= so configuration paths with
  spaces load webhook credentials instead of being silently ignored, and
  service health polling tolerates malformed HTTP responses during startup.
• Resolved incident transitions now always reach the webhook queue, so an
  alert that recovers inside a maintenance window or silence no longer leaves
  the receiver hanging. Opening a condition now requires consecutively
  confirmable samples, so two isolated spikes separated by a probe-failure gap
  can no longer open an incident. Conditions bound to a GPU identity that left
  a fully observed inventory (a replaced card) now recover instead of pinning
  ghost alerts until a restart.
• The dashboard now establishes its event stream and corrects the connection
  badge after recovering from a failed first snapshot, rejects structurally
  broken snapshots before they can freeze rendering, and backs off snapshot
  polling up to 30 seconds during an outage.