release 1.23.0: daily GOA /monitoring-ladder and /monitoring-max-ladder

Host-agent wrappers + daily timers publish classic and max-search amount ladder reports on bank/exchange/taler.hacktivism.ch. Install enables timers and starts the first round immediately. monpages path allow + goa catalog; Caddy bare redirs for ladder paths.
2026-07-19 15:03:05 +02:00 · 2026-07-19 15:03:05 +02:00 · 617d066a70
commit 617d066a70
parent dfc7595990
16 changed files with 237 additions and 19 deletions
--- a/2
+++ b/2
@ -1 +1 @@
-1.22.1
+1.23.0
--- a/VERSIONS.md
+++ b/VERSIONS.md
@ -17,6 +17,7 @@ Git tags: `vMAJOR.FEATURE.FIX` (e.g. `v1.8.0`). File `VERSION` omits the `v` pre

 | Tag | Date (UTC) | Notes |
 |-----|------------|--------|
+| **v1.23.0** | 2026-07-19 | **Feature:** GOA daily mon pages **`/monitoring-ladder/`** (classic) + **`/monitoring-max-ladder/`** (max-search) on bank/exchange/taler.hacktivism.ch. Host-agent timers once/day + install starts first round immediately. monpages catalog/path allow; Caddy bare redirs. |
 | **v1.22.1** | 2026-07-19 | **Bugfix (UX):** pay wait after withdraw no longer looks hung — shows **withdraw board in start order** (OK/OK_BANK from TSV) with live wallet status (`pendingIncoming` → `done`) + timer + aggregate available/pendingIncoming on the **same** wallet DB. Short `run-pending` nudge only (no run-until-done). Default wait 90s (`LADDER_PAY_WAIT_AVAILABLE_S`). |
 | **v1.22.0** | 2026-07-19 | **Feature:** modular amount ladder — `ladder/lib_pay.sh` (pay) + withdraw in `check_amount_ladder.sh`; `ladder/extract_rpubs.py`. **max-ladder** hunts highest **withdrawable** and highest **payable** (≤ wallet available). GOA pays use public free-amount template **`goa-free`** (`LADDER_FREE_TEMPLATE`). Classic still default 23-rung wd+pay. Phase alias `goa-ladder` → amount ladder (shim removed). |
 | **v1.21.0** | 2026-07-19 | **Feature:** generic **amount ladder** (`check_amount_ladder.sh`; compat shim `check_goa_ladder.sh`). Default **classic** 23-rung withdraw (+ pay when enabled); **max-search** (`max-ladder` / `LADDER_MODE=max`) hunts highest mintable amount (probes default 32, `0`=until timeout). **Pay:** never overspend — soft `SKIP_BALANCE` if amount &gt; wallet available. **Alt units:** report/logs show human names (e.g. `8.15 Tera-GOA (GOA:…)`) + raw. **Fixes bundled:** external extract (no stdin SyntaxError); force-select multi-rpub; soft `CEILING_REJECT` on mint 5110/P0001; crash-proof report. CLI-AUTOMATION-NOTES §3/3a/3b/§15–18. |
--- a/check_monitoring_pages.sh
+++ b/check_monitoring_pages.sh
@ -100,14 +100,18 @@ _host_allowed() {
 }

 # Public mon URL families (suite name "taler-monitoring" ≠ a public path):
-#   1) /monitoring(+_err)           — landing hosts (bare + slash)
-#   2) /taler-monitoring-surface(+_err)  — taler.hacktivism.ch only
-#   3) /taler-monitoring-aptdeploy(+_err) — taler.hacktivism.ch only
+#   1) /monitoring(+_err)              — landing hosts (bare + slash)
+#   2) /monitoring-ladder(+_err)       — GOA classic amount ladder (daily)
+#   3) /monitoring-max-ladder(+_err)   — GOA max-search ladder (daily)
+#   4) /taler-monitoring-surface(+_err)  — taler.hacktivism.ch only
+#   5) /taler-monitoring-aptdeploy(+_err) — taler.hacktivism.ch only
 # No /taler-monitoring page. No /taler-monitoring-mail|mattermost pages.

 _path_allowed() {
  case "$1" in
    monitoring|monitoring_err|\
+    monitoring-ladder|monitoring-ladder_err|\
+    monitoring-max-ladder|monitoring-max-ladder_err|\
    taler-monitoring-surface|taler-monitoring-surface_err|\
    taler-monitoring-aptdeploy|taler-monitoring-aptdeploy_err) return 0 ;;
    # explicit deny (never invent a mon page here)
@ -148,6 +152,8 @@ _catalog_urls() {
    goa)
      for h in bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch; do
        printf 'https://%s/monitoring/\n' "$h"
+        printf 'https://%s/monitoring-ladder/\n' "$h"
+        printf 'https://%s/monitoring-max-ladder/\n' "$h"
      done
      # ecosystem surface (versions / software) + apt-src deploy mon page
      printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n'
@ -165,6 +171,12 @@ _catalog_urls() {
      while IFS= read -r h; do
        [ -n "$h" ] || continue
        printf 'https://%s/monitoring/\n' "$h"
+        case "$h" in
+          *.hacktivism.ch)
+            printf 'https://%s/monitoring-ladder/\n' "$h"
+            printf 'https://%s/monitoring-max-ladder/\n' "$h"
+            ;;
+        esac
      done < <(_landing_allowed)
      printf 'https://taler.hacktivism.ch/taler-monitoring-surface/\n'
      printf 'https://taler.hacktivism.ch/taler-monitoring-aptdeploy/\n'
--- a/host-agent/README.md
+++ b/host-agent/README.md
@ -23,9 +23,28 @@ Thin wrappers only set stack defaults:
 | `run-aptdeploy.sh` | CLI: ensure + **aptdeploy** (no HTML) | local if hostname=koopa, else **ssh $DEPLOY_SSH** |
 | `run-aptdeploy-monitoring.sh` | apt-src tests → `/taler-monitoring-aptdeploy*` | `hernani` @ koopa (4h) |
 | `run-surface-monitoring.sh` | **surface** → only `/taler-monitoring-surface*` (ecosystem + mail + mattermost + versions) | `hernani` @ koopa (hourly) |
+| `run-ladder-monitoring.sh` | GOA **classic** amount ladder → `/monitoring-ladder/` on bank/exchange/taler | `hernani` @ koopa (**daily**) |
+| `run-max-ladder-monitoring.sh` | GOA **max-search** ladder → `/monitoring-max-ladder/` on bank/exchange/taler | `hernani` @ koopa (**daily**) |

 Deprecated mail/mattermost wrappers: **`../meta/deprecated/`** (not installed).

+### GOA amount ladder pages (daily)
+
+| URL | Phase | Timer |
+|-----|-------|-------|
+| `https://{bank,exchange,taler}.hacktivism.ch/monitoring-ladder/` | `ladder` (classic) | `taler-monitoring-ladder.timer` (~05:15 + jitter) |
+| `https://{bank,exchange,taler}.hacktivism.ch/monitoring-max-ladder/` | `max-ladder` | `taler-monitoring-max-ladder.timer` (~06:30 + jitter) |
+
+```bash
+systemctl --user enable --now taler-monitoring-ladder.timer
+systemctl --user enable --now taler-monitoring-max-ladder.timer
+# first round now:
+systemctl --user start taler-monitoring-ladder.service
+systemctl --user start taler-monitoring-max-ladder.service
+```
+
+Needs explorer secrets (`SECRETS_ROOT` / bank-explorer password). Long wall: classic ~2h, max ~3h (`RUN_TIMEOUT`).
+
 ### apt-src deploy tests (hacktivism `/monitoring`)

 | Container | Mode |
--- a/host-agent/ROOT-APPLY-MONITORING.md
+++ b/host-agent/ROOT-APPLY-MONITORING.md
@ -48,9 +48,13 @@ There is **no** public page `/taler-monitoring`. Each family needs **bare and sl
 | Family | Paths | Host | Source timer |
 |--------|-------|------|----------------|
 | **monitoring** | `/monitoring` · `/monitoring/` · `/monitoring_err` · `/monitoring_err/` | bank + exchange + taler (and other landings) | `taler-monitoring-hacktivism.timer` (4h) |
+| **monitoring-ladder** | `/monitoring-ladder` · `/` · `_err` | bank + exchange + taler (**GOA**) | `taler-monitoring-ladder.timer` (**daily**) |
+| **monitoring-max-ladder** | `/monitoring-max-ladder` · `/` · `_err` | bank + exchange + taler (**GOA**) | `taler-monitoring-max-ladder.timer` (**daily**) |
 | **taler-monitoring-surface** | bare + slash + `_err` | **taler.hacktivism.ch only** | `taler-monitoring-surface.timer` (1h) |
 | **taler-monitoring-aptdeploy** | bare + slash + `_err` | **taler.hacktivism.ch only** | `taler-monitoring-aptdeploy.timer` (4h) |

+Served via existing Caddy `handle /monitoring*` (file_server under `/var/www/monitoring-sites/{host}/`).
+
 HTML is generated as **hernani** into  
 `$DEPLOY_STAGING (or $HOME/monitoring-sites-staging)/`.

--- a/host-agent/apply-monitoring-live.sh
+++ b/host-agent/apply-monitoring-live.sh
@ -57,6 +57,12 @@ urls=(
  https://taler.hacktivism.ch/monitoring/
  https://bank.hacktivism.ch/monitoring/
  https://exchange.hacktivism.ch/monitoring/
+  https://taler.hacktivism.ch/monitoring-ladder/
+  https://bank.hacktivism.ch/monitoring-ladder/
+  https://exchange.hacktivism.ch/monitoring-ladder/
+  https://taler.hacktivism.ch/monitoring-max-ladder/
+  https://bank.hacktivism.ch/monitoring-max-ladder/
+  https://exchange.hacktivism.ch/monitoring-max-ladder/
  https://taler.hacktivism.ch/taler-monitoring-surface
  https://taler.hacktivism.ch/taler-monitoring-surface/
  https://taler.hacktivism.ch/taler-monitoring-surface_err/
--- a/host-agent/install-host-agent.sh
+++ b/host-agent/install-host-agent.sh
@ -63,11 +63,19 @@ install_local() {
  # optional aptdeploy (not a public mon page layout — v1.8.0 simplified overview)
  install -m 644 "$ROOT/taler-monitoring-aptdeploy.service" "$home_unit/"
  install -m 644 "$ROOT/taler-monitoring-aptdeploy.timer" "$home_unit/"
+  # GOA amount ladder pages (daily)
+  install -m 644 "$ROOT/taler-monitoring-ladder.service" "$home_unit/"
+  install -m 644 "$ROOT/taler-monitoring-ladder.timer" "$home_unit/"
+  install -m 644 "$ROOT/taler-monitoring-max-ladder.service" "$home_unit/"
+  install -m 644 "$ROOT/taler-monitoring-max-ladder.timer" "$home_unit/"
+  chmod +x "$ROOT/run-ladder-monitoring.sh" "$ROOT/run-max-ladder-monitoring.sh" 2>/dev/null || true
  systemctl --user daemon-reload
  systemctl --user enable --now taler-monitoring-hacktivism.path
  systemctl --user enable --now taler-monitoring-hacktivism.timer
  systemctl --user enable --now taler-monitoring-surface.timer
  systemctl --user enable --now taler-monitoring-aptdeploy.timer
+  systemctl --user enable --now taler-monitoring-ladder.timer
+  systemctl --user enable --now taler-monitoring-max-ladder.timer
  # Remove leftover mail/mattermost units if present (moved to meta/deprecated/)
  systemctl --user disable --now taler-monitoring-mattermost.timer 2>/dev/null || true
  systemctl --user disable --now taler-monitoring-mail.timer 2>/dev/null || true
@ -81,20 +89,28 @@ install_local() {
  systemctl --user start taler-monitoring-hacktivism.service || true
  systemctl --user start taler-monitoring-surface.service || true
  systemctl --user start taler-monitoring-aptdeploy.service || true
+  # first ladder rounds immediately (classic then max-search; both daily thereafter)
+  systemctl --user start taler-monitoring-ladder.service || true
+  systemctl --user start taler-monitoring-max-ladder.service || true

  echo "--- status ---"
  systemctl --user status taler-monitoring-hacktivism.path --no-pager -l | head -15
  systemctl --user status taler-monitoring-hacktivism.timer --no-pager -l | head -12
  systemctl --user status taler-monitoring-surface.timer --no-pager -l | head -12
  systemctl --user status taler-monitoring-aptdeploy.timer --no-pager -l | head -12
+  systemctl --user status taler-monitoring-ladder.timer --no-pager -l | head -12
+  systemctl --user status taler-monitoring-max-ladder.timer --no-pager -l | head -12
  systemctl --user list-timers --all | grep taler-monitoring || true
-  echo "OK host-agent (v1.8.0 simplified):"
+  echo "OK host-agent:"
  echo "  · hacktivism 4h → /monitoring on bank/exchange/taler (landing stacks)"
+  echo "  · ladder daily → /monitoring-ladder/ (classic amount ladder, GOA)"
+  echo "  · max-ladder daily → /monitoring-max-ladder/ (max-search, GOA)"
  echo "  · surface 1h → /taler-monitoring-surface* (ecosystem versions/software)"
-  echo "  · aptdeploy 4h (optional tests; not a public mon-page type)"
+  echo "  · aptdeploy 4h (optional tests)"
  echo "  · mail/mattermost: not installed (meta/deprecated/; content in surface)"
  echo "suite: $mon"
-  echo "manual surface: systemctl --user start taler-monitoring-surface.service"
+  echo "manual ladder: systemctl --user start taler-monitoring-ladder.service"
+  echo "manual max-ladder: systemctl --user start taler-monitoring-max-ladder.service"
  echo "after upgrades: $ROOT/touch-software-stamp.sh"
 }

--- a/host-agent/run-hacktivism-monitoring.sh
+++ b/host-agent/run-hacktivism-monitoring.sh
@ -16,10 +16,12 @@ export INSIDE_MODE="${INSIDE_MODE:-local-podman}"
 export LOCAL_STACK="${LOCAL_STACK:-1}"
 export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
 export RUN_TIMEOUT="${RUN_TIMEOUT:-600}"
-# stack checks + full monpages inventory (landings + surface + aptdeploy bare/slash).
+# stack checks + full monpages inventory (landings + ladder + surface + aptdeploy).
 # Specialized pages also have their own timers; full outside-in inventory lives here.
-#   run-aptdeploy-monitoring.sh → monpages job-only for /taler-monitoring-aptdeploy*
-#   run-surface-monitoring.sh   → monpages job-only for /taler-monitoring-surface*
+#   run-ladder-monitoring.sh     → /monitoring-ladder* (daily classic)
+#   run-max-ladder-monitoring.sh → /monitoring-max-ladder* (daily max-search)
+#   run-aptdeploy-monitoring.sh  → monpages job-only for /taler-monitoring-aptdeploy*
+#   run-surface-monitoring.sh    → monpages job-only for /taler-monitoring-surface*
 export PHASES="${PHASES:-urls inside versions monpages}"
 export MON_HOSTS="${MON_HOSTS:-bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch}"
 export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
--- a/host-agent/run-ladder-monitoring.sh
+++ b/host-agent/run-ladder-monitoring.sh
@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# run-ladder-monitoring.sh — GOA classic amount ladder → public HTML
+#
+# Public (landing hosts, same Caddy /monitoring* static root):
+#   https://{bank,exchange,taler}.hacktivism.ch/monitoring-ladder/
+#   https://{bank,exchange,taler}.hacktivism.ch/monitoring-ladder_err/
+#
+# Timer: once daily (taler-monitoring-ladder.timer). Long wall clock.
+#
+set -uo pipefail
+AGENT_DIR=$(cd "$(dirname "$0")" && pwd)
+
+export AGENT_LABEL="${AGENT_LABEL:-ladder-host-agent}"
+export STATE_NAME="${STATE_NAME:-taler-ladder-monitoring}"
+export TALER_DOMAIN="${TALER_DOMAIN:-hacktivism.ch}"
+export TALER_MON_LANG="${TALER_MON_LANG:-en}"
+export TALER_MON_LANG_SET=1
+export INSIDE_PODMAN="${INSIDE_PODMAN:-1}"
+export INSIDE_MODE="${INSIDE_MODE:-local-podman}"
+export LOCAL_STACK="${LOCAL_STACK:-1}"
+export SKIP_SSH="${SKIP_SSH:-0}"
+export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
+# classic 23-rung + pay can run long
+export RUN_TIMEOUT="${RUN_TIMEOUT:-7200}"
+
+export PHASES="ladder monpages"
+export MON_HOSTS="${MON_HOSTS:-bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch}"
+export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
+export DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"
+
+export HTML_OK_DIR="monitoring-ladder"
+export HTML_ERR_DIR="monitoring-ladder_err"
+export HTML_URL_OK="/monitoring-ladder/"
+export HTML_URL_ERR="/monitoring-ladder_err/"
+export PAGE_LABEL="monitoring-ladder"
+export MONPAGES_INVENTORY="job"
+
+# Classic ladder defaults (override in ~/.config/taler-monitoring/env)
+export LADDER_MODE="${LADDER_MODE:-classic}"
+export LADDER_PAY="${LADDER_PAY:-1}"
+export APT_DEPLOY_ENSURE=0
+
+exec bash "$AGENT_DIR/run-host-report.sh" "$@"
--- a/host-agent/run-max-ladder-monitoring.sh
+++ b/host-agent/run-max-ladder-monitoring.sh
@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# run-max-ladder-monitoring.sh — GOA max-search amount ladder → public HTML
+#
+# Public (landing hosts, same Caddy /monitoring* static root):
+#   https://{bank,exchange,taler}.hacktivism.ch/monitoring-max-ladder/
+#   https://{bank,exchange,taler}.hacktivism.ch/monitoring-max-ladder_err/
+#
+# Timer: once daily (taler-monitoring-max-ladder.timer). Long wall clock.
+#
+set -uo pipefail
+AGENT_DIR=$(cd "$(dirname "$0")" && pwd)
+
+export AGENT_LABEL="${AGENT_LABEL:-max-ladder-host-agent}"
+export STATE_NAME="${STATE_NAME:-taler-max-ladder-monitoring}"
+export TALER_DOMAIN="${TALER_DOMAIN:-hacktivism.ch}"
+export TALER_MON_LANG="${TALER_MON_LANG:-en}"
+export TALER_MON_LANG_SET=1
+export INSIDE_PODMAN="${INSIDE_PODMAN:-1}"
+export INSIDE_MODE="${INSIDE_MODE:-local-podman}"
+export LOCAL_STACK="${LOCAL_STACK:-1}"
+export SKIP_SSH="${SKIP_SSH:-0}"
+export CONTINUE_ON_ERROR="${CONTINUE_ON_ERROR:-1}"
+# max-search probes + pay hunt
+export RUN_TIMEOUT="${RUN_TIMEOUT:-10800}"
+
+export PHASES="max-ladder monpages"
+export MON_HOSTS="${MON_HOSTS:-bank.hacktivism.ch exchange.hacktivism.ch taler.hacktivism.ch}"
+export HTML_OUT="${HTML_OUT:-$HOME/monitoring-sites-staging}"
+export DEPLOY_WWW_ROOT="${DEPLOY_WWW_ROOT:-/var/www/monitoring-sites}"
+
+export HTML_OK_DIR="monitoring-max-ladder"
+export HTML_ERR_DIR="monitoring-max-ladder_err"
+export HTML_URL_OK="/monitoring-max-ladder/"
+export HTML_URL_ERR="/monitoring-max-ladder_err/"
+export PAGE_LABEL="monitoring-max-ladder"
+export MONPAGES_INVENTORY="job"
+
+export LADDER_MODE=max
+export LADDER_PAY="${LADDER_PAY:-1}"
+export APT_DEPLOY_ENSURE=0
+
+exec bash "$AGENT_DIR/run-host-report.sh" "$@"
--- a/host-agent/taler-monitoring-ladder.service
+++ b/host-agent/taler-monitoring-ladder.service
@ -0,0 +1,19 @@
+[Unit]
+Description=Taler monitoring GOA classic amount ladder → /monitoring-ladder/
+Documentation=file:%h/src/taler-monitoring/host-agent/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+Environment=CONTINUE_ON_ERROR=1
+Environment=RUN_TIMEOUT=7200
+EnvironmentFile=-%h/.config/taler-monitoring/env
+WorkingDirectory=%h/src/taler-monitoring
+ExecStart=%h/src/taler-monitoring/host-agent/run-ladder-monitoring.sh
+Nice=10
+TimeoutStartSec=3h
+
+[Install]
+WantedBy=default.target
--- a/host-agent/taler-monitoring-ladder.timer
+++ b/host-agent/taler-monitoring-ladder.timer
@ -0,0 +1,14 @@
+[Unit]
+Description=Daily GOA classic amount ladder mon page
+Documentation=file:%h/src/taler-monitoring/host-agent/README.md
+
+[Timer]
+# Once per day (CEST morning-ish on typical hosts); randomize to avoid thundering herd
+OnCalendar=*-*-* 05:15:00
+Persistent=true
+AccuracySec=15min
+RandomizedDelaySec=30min
+Unit=taler-monitoring-ladder.service
+
+[Install]
+WantedBy=timers.target
--- a/host-agent/taler-monitoring-max-ladder.service
+++ b/host-agent/taler-monitoring-max-ladder.service
@ -0,0 +1,19 @@
+[Unit]
+Description=Taler monitoring GOA max-search amount ladder → /monitoring-max-ladder/
+Documentation=file:%h/src/taler-monitoring/host-agent/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+Environment=CONTINUE_ON_ERROR=1
+Environment=RUN_TIMEOUT=10800
+EnvironmentFile=-%h/.config/taler-monitoring/env
+WorkingDirectory=%h/src/taler-monitoring
+ExecStart=%h/src/taler-monitoring/host-agent/run-max-ladder-monitoring.sh
+Nice=10
+TimeoutStartSec=4h
+
+[Install]
+WantedBy=default.target
--- a/host-agent/taler-monitoring-max-ladder.timer
+++ b/host-agent/taler-monitoring-max-ladder.timer
@ -0,0 +1,14 @@
+[Unit]
+Description=Daily GOA max-search amount ladder mon page
+Documentation=file:%h/src/taler-monitoring/host-agent/README.md
+
+[Timer]
+# Once per day, after classic ladder window
+OnCalendar=*-*-* 06:30:00
+Persistent=true
+AccuracySec=15min
+RandomizedDelaySec=30min
+Unit=taler-monitoring-max-ladder.service
+
+[Install]
+WantedBy=timers.target
--- a/site-gen/caddy-monitoring-handles.snippet
+++ b/site-gen/caddy-monitoring-handles.snippet
@ -5,6 +5,8 @@
 #
 # CORRECT (site-level named matcher — preferred):
 #   @mon_bare path /monitoring /monitoring_err \
+#       /monitoring-ladder /monitoring-ladder_err \
+#       /monitoring-max-ladder /monitoring-max-ladder_err \
 #       /taler-monitoring-surface /taler-monitoring-surface_err \
 #       /taler-monitoring-aptdeploy /taler-monitoring-aptdeploy_err
 #   redir @mon_bare {path}/ 302
@ -35,6 +37,8 @@

 # --- only inside taler.hacktivism.ch { ... } ---
    @mon_bare path /monitoring /monitoring_err \
+        /monitoring-ladder /monitoring-ladder_err \
+        /monitoring-max-ladder /monitoring-max-ladder_err \
        /taler-monitoring-surface /taler-monitoring-surface_err \
        /taler-monitoring-aptdeploy /taler-monitoring-aptdeploy_err \
        /taler-monitoring-mail /taler-monitoring-mail_err \
@ -59,7 +63,10 @@
    }

 # --- bank + exchange + taler (each site block; set root host dir) ---
-    @mon_bare path /monitoring /monitoring_err
+# /monitoring* already covers /monitoring-ladder* and /monitoring-max-ladder*
+    @mon_bare path /monitoring /monitoring_err \
+        /monitoring-ladder /monitoring-ladder_err \
+        /monitoring-max-ladder /monitoring-max-ladder_err
    redir @mon_bare {path}/ 302

    handle /monitoring_err* {
--- a/site-gen/console_to_html.py
+++ b/site-gen/console_to_html.py
@ -281,11 +281,11 @@ def ui(lang: str, key: str, **kwargs) -> str:
        "mode_redirect": "REDIR",
        "pages_title": "Monitoring pages (suite HTML)",
        "pages_summary": "Public sticky-bar reports · phase monpages · part of taler-monitoring",
-        "pages_i1": "Suite name taler-monitoring ≠ URL. Only three public families (bare + slash each):",
-        "pages_i2": "1) /monitoring(+_err) on landing hosts · 2) /taler-monitoring-surface(+_err) · 3) /taler-monitoring-aptdeploy(+_err) on taler.hacktivism.ch",
-        "pages_i3": "No /taler-monitoring page; no /taler-monitoring-mail|mattermost (folded into surface)",
+        "pages_i1": "Suite name taler-monitoring ≠ URL. Public families (bare + slash each):",
+        "pages_i2": "1) /monitoring(+_err) · 2) /monitoring-ladder(+_err) daily classic · 3) /monitoring-max-ladder(+_err) daily max-search · 4) /taler-monitoring-surface · 5) /taler-monitoring-aptdeploy (surface/aptdeploy on taler.hacktivism.ch)",
+        "pages_i3": "No /taler-monitoring page; no /taler-monitoring-mail|mattermost (folded into surface). Ladder pages on GOA bank/exchange/taler landings.",
        "pages_i4": "monpages: existence + content markers; bare → slash redir (not merchant code 21)",
-        "pages_i5": "Host-agent: staging → DEPLOY_WWW_ROOT; reverse-proxy handles only those three families",
+        "pages_i5": "Host-agent: staging → DEPLOY_WWW_ROOT; Caddy /monitoring* also serves ladder and max-ladder paths",
        "pages_i6": "This page host: {host} · path label: {label}",
        "stage_title": "mytops stage monitoring · {host}",
        "stage_summary": "betel only · CHF stage stack · not lifeline/prod · not GOA",
@ -391,11 +391,11 @@ def ui(lang: str, key: str, **kwargs) -> str:
        "mode_redirect": "REDIR",
        "pages_title": "Pages de monitoring (HTML de la suite)",
        "pages_summary": "Rapports publics sticky-bar · phase monpages · partie de taler-monitoring",
-        "pages_i1": "Nom de suite taler-monitoring ≠ URL. Trois familles publiques seulement (sans et avec /) :",
-        "pages_i2": "1) /monitoring(+_err) · 2) /taler-monitoring-surface(+_err) · 3) /taler-monitoring-aptdeploy(+_err) sur taler.hacktivism.ch",
-        "pages_i3": "Pas de page /taler-monitoring ; pas de /taler-monitoring-mail|mattermost (dans surface)",
+        "pages_i1": "Nom de suite taler-monitoring ≠ URL. Familles publiques (sans et avec /) :",
+        "pages_i2": "1) /monitoring(+_err) · 2) /monitoring-ladder(+_err) quotidien classic · 3) /monitoring-max-ladder(+_err) max-search · 4) surface · 5) aptdeploy (surface/aptdeploy sur taler.hacktivism.ch)",
+        "pages_i3": "Pas de page /taler-monitoring ; pas de /taler-monitoring-mail|mattermost (dans surface). Ladder sur landings GOA bank/exchange/taler.",
        "pages_i4": "monpages : existence + marqueurs ; bare → slash (pas code 21 merchant)",
-        "pages_i5": "Host-agent : staging → DEPLOY_WWW_ROOT ; reverse-proxy seulement ces trois familles",
+        "pages_i5": "Host-agent : staging → DEPLOY_WWW_ROOT ; Caddy /monitoring* sert aussi ladder et max-ladder",
        "stage_title": "Surveillance mytops stage · {host}",
        "stage_summary": "betel uniquement · pile CHF stage · pas lifeline/prod · pas GOA",
        "stage_i1": "Hôte : betel (stage). HTML mon : stage.my.taler-ops.ch + stage.taler-ops.ch /monitoring/",
 @ -1 +1 @@
 .22.1
 .23.0