@oneuptime/common 13.0.8 → 14.0.1

package/build/dist/Server/Utils/Monitor/MonitorCriteriaEvaluator.js

@@ -26,6 +26,8 @@ import ExternalStatusPageMonitorCriteria from "./Criteria/ExternalStatusPageMoni
 import MonitorCriteriaMessageBuilder from "./MonitorCriteriaMessageBuilder";
 import MonitorCriteriaDataExtractor from "./MonitorCriteriaDataExtractor";
 import MonitorCriteriaMessageFormatter from "./MonitorCriteriaMessageFormatter";
+import AffectedResourceList from "./AffectedResourceList";
+import RootCauseList from "./RootCauseList";
 import MonitorCriteriaInstance from "../../../Types/Monitor/MonitorCriteriaInstance";
 import MonitorStep from "../../../Types/Monitor/MonitorStep";
 import FilterCondition from "../../../Types/Filter/FilterCondition";
@@ -1113,9 +1115,7 @@ ${contextBlock}
                 samples: breachingSamples,
                 totalSamples: ctx.totalSamplesInWindow,
                 unit: ctx.unit,
-                metricName: ctx.metricName,
                 unitHeuristicMetricName: unitHeuristicMetricName,
-                alias: ctx.alias,
                 components: ctx.components || [],
             })}`);
         }
@@ -1151,24 +1151,41 @@ ${contextBlock}
         return sections.join("\n");
     }
     /**
-     * Build the **Breaching Samples** markdown section — a table of
-     * timestamps, values, and any group-by attributes. Caps the row count
-     * so a 30-minute window at 1-second granularity doesn't dump thousands
-     * of lines onto the root-cause page; the caller can always drill in
-     * via the metric explorer link.
+     * Build the **Breaching Samples** markdown section — a numbered list of
+     * the samples that breached, oldest first. Caps the list so a 30-minute
+     * window at 1-second granularity doesn't dump thousands of lines onto
+     * the root-cause page; the caller can always drill in via the metric
+     * explorer link.
+     *
+     *     1. `2026-08-14T10:30:00.000Z` — **1.07 GB**
+     *        - `a`: 537 MB
+     *        - `b`: 1.5 sec
+     *        - `k8s.pod.name`: `web-1`
+     *
+     * It used to be a table — Timestamp | Metric | Alias | Value, a column
+     * per formula component and one per attribute key — which grew wider
+     * with every attribute and read badly in the email card, in Slack and on
+     * the dashboard (see RootCauseList). Its Metric and Alias columns
+     * repeated the same two values on every row, the ones the Metric
+     * Details list directly above already states, so the list leaves them
+     * out; and a component or attribute a sample has no value for is left
+     * out rather than printed as "-".
      *
      * Timestamps are emitted as inline code wrapping ISO 8601 strings so
      * the client-side markdown viewer can localize them to the viewer's
      * timezone (without losing the canonical instant).
      */
     static formatBreachingSamplesSection(input) {
-        const MAX_ROWS = 20;
+        const MAX_SAMPLES_SHOWN = 20;
         // Sort chronologically and de-duplicate any accidental repeats
         const sorted = [...input.samples].sort((a, b) => {
             return (new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime());
         });
-        const displayedSamples = sorted.slice(0, MAX_ROWS);
-        // Collect attribute keys that appear on any displayed sample
+        const displayedSamples = sorted.slice(0, MAX_SAMPLES_SHOWN);
+        /*
+         * Collect attribute keys that appear on any displayed sample, so every
+         * item lists the attributes it has in the same order.
+         */
         const attrKeySet = new Set();
         for (const s of displayedSamples) {
             for (const k of Object.keys(s.attributes || {})) {
@@ -1176,94 +1193,64 @@ ${contextBlock}
             }
         }
         const attrKeys = Array.from(attrKeySet);
-        /*
-         * Escape pipe characters that could appear in the metric display
-         * name (formulas like "a | b" are unlikely but possible) so they
-         * don't break GitHub-flavored-markdown tables.
-         */
-        const escapeCell = (value) => {
-            return value.replace(/\|/g, "\\|");
-        };
-        /*
-         * Column layout:
-         *   Timestamp | Metric | Alias | Value | <component_1> | ... | <attr_1> | ...
-         *
-         * The component columns let the reader see what each variable of a
-         * formula resolved to at the breach time — e.g. "when c = a + b
-         * breached 100, a was 55, b was 46". They are omitted for plain
-         * metric criteria.
-         */
-        const headerCells = [
-            "Timestamp",
-            "Metric",
-            "Alias",
-            "Value",
-        ];
-        /*
-         * The component columns carry no unit in their header any more. Each
-         * cell now names the unit it actually landed on, and auto-scaling
-         * means neighbouring rows can land on different ones — a header that
-         * read "a (By)" over cells reading "900 KB" and "1.2 MB" states a
-         * unit that neither row uses. The configured unit is not lost: the
-         * Components bullet list above the table still records it.
-         */
-        for (const component of input.components) {
-            headerCells.push(component.alias);
-        }
-        headerCells.push(...attrKeys);
-        const headerRow = `| ${headerCells.join(" | ")} |`;
-        const dividerRow = `| ${headerCells
-            .map(() => {
-            return "---";
-        })
-            .join(" | ")} |`;
-        const metricCell = `\`${escapeCell(input.metricName)}\``;
-        const aliasCell = input.alias
-            ? `\`${escapeCell(input.alias)}\``
-            : "-";
-        const dataRows = displayedSamples.map((s) => {
-            const timestampIso = new Date(s.timestamp).toISOString();
-            const cells = [
-                `\`${timestampIso}\``,
-                metricCell,
-                aliasCell,
-                MetricValueFormatter.format({
-                    value: s.value,
-                    unit: input.unit,
-                    metricName: input.unitHeuristicMetricName,
-                }),
-            ];
+        const items = displayedSamples.map((s) => {
+            const details = [];
+            /*
+             * What each variable of a formula resolved to at the breach time —
+             * e.g. "when c = a + b breached 100, a was 55, b was 46". Absent
+             * for plain metric criteria.
+             */
             for (const component of input.components) {
                 const match = (s.componentValues || []).find((cv) => {
                     return cv.alias === component.alias;
                 });
-                if (match && typeof match.value === "number") {
-                    /*
-                     * Each component keeps its OWN unit. Component values are
-                     * indexed off the per-query series and never go through the
-                     * sample→threshold-unit conversion the main Value column
-                     * does, so they are in the component's legendUnit — mixing
-                     * units across the row is deliberate, and is why every cell
-                     * has to say which one it is in.
-                     */
-                    cells.push(MetricValueFormatter.format({
+                if (!match || typeof match.value !== "number") {
+                    continue;
+                }
+                /*
+                 * Each component keeps its OWN unit. Component values are
+                 * indexed off the per-query series and never go through the
+                 * sample→threshold-unit conversion the sample's value does, so
+                 * they are in the component's legendUnit — which is why each
+                 * one names the unit it is in. Its configured unit is in the
+                 * Components list of the Metric Details above.
+                 */
+                details.push({
+                    label: RootCauseList.code(component.alias),
+                    value: MetricValueFormatter.format({
                         value: match.value,
                         unit: component.unit,
                         metricName: MonitorCriteriaEvaluator.metricNameForUnitHeuristics({
                             metricName: component.name,
                             isFormula: component.isFormula,
                         }),
-                    }));
-                }
-                else {
-                    cells.push("-");
-                }
+                    }),
+                });
             }
+            /*
+             * The attributes identify the series the sample came from. Keys
+             * and values are telemetry, so both go in code spans:
+             * RootCauseList.code keeps whatever they contain inside the span.
+             */
             for (const k of attrKeys) {
                 const v = s.attributes[k];
-                cells.push(v === undefined || v === null ? "-" : String(v));
+                if (v === undefined || v === null) {
+                    continue;
+                }
+                details.push({
+                    label: RootCauseList.code(k),
+                    value: RootCauseList.code(String(v)),
+                });
             }
-            return `| ${cells.join(" | ")} |`;
+            return {
+                title: RootCauseList.code(new Date(s.timestamp).toISOString()),
+                value: `**${MetricValueFormatter.format({
+                    value: s.value,
+                    unit: input.unit,
+                    metricName: input.unitHeuristicMetricName,
+                })}**`,
+                details: details,
+            };
         });
         const lines = [
             `**Breaching Samples**`,
@@ -1272,12 +1259,14 @@ ${contextBlock}
                 totalSamples: input.totalSamples,
             }),
             "",
-            headerRow,
-            dividerRow,
-            ...dataRows,
+            RootCauseList.render(items),
         ];
         if (sorted.length > displayedSamples.length) {
-            lines.push(`\n_Showing the first ${displayedSamples.length} of ${sorted.length} breaching samples._`);
+            /*
+             * The blank line matters: without it the note is a lazy
+             * continuation of the last item, not a paragraph of its own.
+             */
+            lines.push("", `_Showing the first ${displayedSamples.length} of ${sorted.length} breaching samples._`);
         }
         return lines.join("\n");
     }
@@ -1436,7 +1425,7 @@ ${contextBlock}
         return ` _(scope partially carried — not applied: ${dropped.join(", ")})_`;
     }
     /**
-     * The unit for a value in a per-platform "Affected Resources" table.
+     * The unit for a value in a per-platform "Affected Resources" list.
      *
      * These rows are NOT the same numbers as the criteria's breaching
      * samples: the worker collects them with a raw `MetricService.findBy`
@@ -1475,10 +1464,11 @@ ${contextBlock}
         }
     }
     /**
-     * Render one cell of a platform breakdown table's Value column.
+     * Render the value of one resource in a platform "Affected Resources"
+     * list.
      *
-     * Bold, because that is how these tables have always drawn the value —
-     * it is the one number in the row a reader scans for.
+     * Bold, because that is how the breakdown has always drawn the value —
+     * it is the one number on the line a reader scans for.
      */
     static formatPlatformResourceValue(input) {
         return `**${MetricValueFormatter.format({
@@ -1490,6 +1480,78 @@ ${contextBlock}
             metricName: input.metricName,
         })}**`;
     }
+    /*
+     * One Kubernetes resource as an "Affected Resources" list item.
+     *
+     * The item is titled by the most specific object the series names —
+     * container, then pod, then workload, then node, then namespace — because
+     * that is the thing that is actually breaching; everything above it in
+     * the hierarchy is listed underneath as context. A series with no
+     * Kubernetes identity at all is a cluster-level series, so it is titled
+     * by the cluster.
+     *
+     * A container is titled together with its pod. Every replica of a
+     * workload runs a container of the same name, so "Container `checkout`"
+     * alone would title three crash-looping replicas identically and leave
+     * the pod that tells them apart buried in the bullets.
+     */
+    static getKubernetesAffectedResourceEntry(input) {
+        const resource = input.resource;
+        // "Deployment", "StatefulSet", ... — the worker only ever sets one of those.
+        const workloadLabel = resource.workloadType || "Workload";
+        let kind = "Cluster";
+        let name = AffectedResourceList.code(input.clusterName);
+        if (resource.containerName) {
+            kind = "Container";
+            name = resource.podName
+                ? `${AffectedResourceList.code(resource.containerName)} in pod ${AffectedResourceList.code(resource.podName)}`
+                : AffectedResourceList.code(resource.containerName);
+        }
+        else if (resource.podName) {
+            kind = "Pod";
+            name = AffectedResourceList.code(resource.podName);
+        }
+        else if (resource.workloadName) {
+            kind = workloadLabel;
+            name = AffectedResourceList.code(resource.workloadName);
+        }
+        else if (resource.nodeName) {
+            kind = "Node";
+            name = AffectedResourceList.code(resource.nodeName);
+        }
+        else if (resource.namespace) {
+            kind = "Namespace";
+            name = AffectedResourceList.code(resource.namespace);
+        }
+        const details = [];
+        if (resource.namespace && kind !== "Namespace") {
+            details.push({
+                label: "Namespace",
+                value: AffectedResourceList.code(resource.namespace),
+            });
+        }
+        const titledByWorkload = !resource.containerName &&
+            !resource.podName &&
+            Boolean(resource.workloadName);
+        if (resource.workloadName && !titledByWorkload) {
+            details.push({
+                label: workloadLabel,
+                value: AffectedResourceList.code(resource.workloadName),
+            });
+        }
+        if (resource.nodeName && kind !== "Node") {
+            details.push({
+                label: "Node",
+                value: AffectedResourceList.code(resource.nodeName),
+            });
+        }
+        return {
+            kind: kind,
+            name: name,
+            value: input.value,
+            details: details,
+        };
+    }
     static async buildKubernetesRootCauseContext(input) {
         var _a;
         const metricResponse = input.dataToProcess;
@@ -1508,94 +1570,56 @@ ${contextBlock}
         sections.push(`**Kubernetes Cluster Details**\n${clusterDetails.join("\n")}`);
         // Affected resources
         if (breakdown.affectedResources && breakdown.affectedResources.length > 0) {
-            const resourceLines = [];
-            // Sort by metric value descending (worst first) and filter out zero-value resources
-            const sortedResources = [
-                ...breakdown.affectedResources,
-            ]
+            /*
+             * Keep the rows that satisfy the criteria that just matched, worst
+             * first — NOT simply the non-zero rows. k8s-node-not-ready fires on
+             * `k8s.node.condition_ready = 0`, so the zero rows are the NotReady
+             * nodes; the old hardcoded `> 0` dropped exactly those and named a
+             * healthy node in the analysis below.
+             */
+            const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+                floorEqualityFiresOnFall: true,
+            });
+            const sortedResources = breakdown.affectedResources
+                .map((r) => {
+                var _a;
+                /*
+                 * A fall criteria breached on the resource's lowest sample
+                 * in the window, not its highest.
+                 */
+                return breach.worstIsLowest
+                    ? Object.assign(Object.assign({}, r), { metricValue: (_a = r.lowestMetricValue) !== null && _a !== void 0 ? _a : r.metricValue }) : r;
+            })
                 .filter((r) => {
-                return r.metricValue > 0;
+                return breach.matches(r.metricValue);
             })
                 .sort((a, b) => {
-                return b.metricValue - a.metricValue;
+                return breach.worstIsLowest
+                    ? a.metricValue - b.metricValue
+                    : b.metricValue - a.metricValue;
             });
             if (sortedResources.length === 0) {
                 return sections.join("\n");
             }
             // Show top 10 affected resources
-            const resourcesToShow = sortedResources.slice(0, 10);
-            // Determine which columns are present across all resources
-            const hasNamespace = resourcesToShow.some((r) => {
-                return r.namespace;
-            });
-            const hasWorkload = resourcesToShow.some((r) => {
-                return r.workloadType && r.workloadName;
-            });
-            const hasPod = resourcesToShow.some((r) => {
-                return r.podName;
-            });
-            const hasContainer = resourcesToShow.some((r) => {
-                return r.containerName;
-            });
-            const hasNode = resourcesToShow.some((r) => {
-                return r.nodeName;
-            });
-            // Build table header
-            const headerCells = [];
-            if (hasNamespace) {
-                headerCells.push("Namespace");
-            }
-            if (hasWorkload) {
-                headerCells.push("Workload Type");
-                headerCells.push("Workload");
-            }
-            if (hasPod) {
-                headerCells.push("Pod");
-            }
-            if (hasContainer) {
-                headerCells.push("Container");
-            }
-            if (hasNode) {
-                headerCells.push("Node");
-            }
-            headerCells.push("Value");
-            const headerRow = `| ${headerCells.join(" | ")} |`;
-            const separatorRow = `| ${headerCells
-                .map(() => {
-                return "---";
-            })
-                .join(" | ")} |`;
-            resourceLines.push(headerRow);
-            resourceLines.push(separatorRow);
-            for (const resource of resourcesToShow) {
-                const cells = [];
-                if (hasNamespace) {
-                    cells.push(resource.namespace ? `\`${resource.namespace}\`` : "-");
-                }
-                if (hasWorkload) {
-                    cells.push(resource.workloadType ? `${resource.workloadType}` : "-");
-                    cells.push(resource.workloadName ? `\`${resource.workloadName}\`` : "-");
-                }
-                if (hasPod) {
-                    cells.push(resource.podName ? `\`${resource.podName}\`` : "-");
-                }
-                if (hasContainer) {
-                    cells.push(resource.containerName ? `\`${resource.containerName}\`` : "-");
-                }
-                if (hasNode) {
-                    cells.push(resource.nodeName ? `\`${resource.nodeName}\`` : "-");
-                }
-                cells.push(MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                    platform: "kubernetes",
-                    metricName: breakdown.metricName,
-                    value: resource.metricValue,
-                }));
-                resourceLines.push(`| ${cells.join(" | ")} |`);
-            }
-            if (sortedResources.length > 10) {
-                resourceLines.push(`\n*... and ${sortedResources.length - 10} more affected resources*`);
-            }
-            sections.push(`\n\n**Affected Resources** (${sortedResources.length} total)\n\n${resourceLines.join("\n")}`);
+            const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
+            sections.push(AffectedResourceList.render({
+                heading: "Affected Resources",
+                overflowNoun: "affected resources",
+                totalCount: sortedResources.length,
+                entries: resourcesToShow.map((resource) => {
+                    return MonitorCriteriaEvaluator.getKubernetesAffectedResourceEntry({
+                        resource: resource,
+                        clusterName: breakdown.clusterName,
+                        value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
+                            platform: "kubernetes",
+                            metricName: breakdown.metricName,
+                            value: resource.metricValue,
+                        }),
+                    });
+                }),
+            }));
             // Add root cause analysis based on metric type
             const analysis = MonitorCriteriaEvaluator.buildKubernetesRootCauseAnalysis({
                 breakdown: breakdown,
@@ -1771,6 +1795,75 @@ ${contextBlock}
         }
         return sections.length > 0 ? sections.join("\n") : null;
     }
+    /*
+     * What a Proxmox resource is, from the `pve.type` / `pve.scope` the
+     * agent's transform/pve-identity processor derives from its `id`
+     * (node/…, qemu/…, lxc/…, storage/…, cluster/…). A value that processor
+     * does not produce is shown as it arrived rather than guessed at.
+     */
+    static getProxmoxAffectedResourceKind(resource) {
+        switch (resource.resourceType) {
+            case "qemu":
+                return "Virtual Machine";
+            case "lxc":
+                return "Container";
+            case "node":
+                return "Node";
+            case "storage":
+                return "Storage";
+            default:
+                break;
+        }
+        switch (resource.scope) {
+            case "guest":
+                return "Guest";
+            case "node":
+                return "Node";
+            case "storage":
+                return "Storage";
+            case "cluster":
+                return "Cluster";
+            default:
+                break;
+        }
+        return resource.resourceType || resource.scope || "Resource";
+    }
+    /*
+     * One Proxmox resource as an "Affected Resources" list item: its kind,
+     * its name next to its `qemu/100`-style id, and the node it runs on.
+     */
+    static getProxmoxAffectedResourceEntry(input) {
+        const resource = input.resource;
+        let kind = MonitorCriteriaEvaluator.getProxmoxAffectedResourceKind(resource);
+        let name = AffectedResourceList.codeWithId({
+            name: resource.resourceName,
+            id: resource.resourceId,
+        });
+        if (!name && resource.nodeName) {
+            // A per-node series that carries no id of its own.
+            kind = "Node";
+            name = AffectedResourceList.code(resource.nodeName);
+        }
+        if (!name) {
+            // Nothing narrower than the cluster — a cluster-wide series.
+            kind = "Cluster";
+            name = AffectedResourceList.code(input.clusterName);
+        }
+        const details = [];
+        // A node's own row would only repeat its name as "Node: …".
+        if (resource.nodeName && kind !== "Node") {
+            details.push({
+                label: "Node",
+                value: AffectedResourceList.code(resource.nodeName),
+            });
+        }
+        return {
+            kind: kind,
+            name: name,
+            value: input.value,
+            details: details,
+        };
+    }
     static buildProxmoxRootCauseContext(input) {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         const metricResponse = input.dataToProcess;
@@ -1807,15 +1900,15 @@ ${contextBlock}
             }
             sections.push(`**Proxmox Cluster Details**\n${clusterDetails.join("\n")}`);
         }
-        // Affected resources (Resource / Type / Node / Value)
-        let renderedBreakdownTable = false;
+        // Affected resources: a ranked list of kind, name and node
+        let renderedBreakdownList = false;
         if (breakdown && breakdown.affectedResources.length > 0) {
             /*
              * K8s-parity render: drop zero-value rows, worst (highest)
              * first, top 10. Note that for availability metrics (pve_up)
              * zero-valued rows ARE the down resources — those still drive
              * alerting through the per-series criteria evaluation; this
-             * table is supplementary context only.
+             * list is supplementary context only.
              */
             const sortedResources = [
                 ...breakdown.affectedResources,
@@ -1827,47 +1920,35 @@ ${contextBlock}
                 return b.metricValue - a.metricValue;
             });
             /*
-             * Skip the table when no row carries any identity label
+             * Skip the list when no row carries any identity label
              * (cluster-wide series) — it would add nothing.
              */
             const hasIdentity = sortedResources.some((r) => {
                 return r.resourceId || r.resourceName || r.nodeName;
             });
             if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, 10);
-                const resourceLines = [];
-                resourceLines.push(`| Resource | Type | Node | Value |`);
-                resourceLines.push(`| --- | --- | --- | --- |`);
-                for (const resource of resourcesToShow) {
-                    let resourceCell = "-";
-                    if (resource.resourceName && resource.resourceId) {
-                        resourceCell = `\`${resource.resourceName}\` (\`${resource.resourceId}\`)`;
-                    }
-                    else if (resource.resourceId) {
-                        resourceCell = `\`${resource.resourceId}\``;
-                    }
-                    else if (resource.resourceName) {
-                        resourceCell = `\`${resource.resourceName}\``;
-                    }
-                    const typeCell = resource.resourceType || resource.scope || "-";
-                    const nodeCell = resource.nodeName
-                        ? `\`${resource.nodeName}\``
-                        : "-";
-                    resourceLines.push(`| ${resourceCell} | ${typeCell} | ${nodeCell} | ${MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                        platform: "proxmox",
-                        metricName: breakdown.metricName,
-                        value: resource.metricValue,
-                    })} |`);
-                }
-                if (sortedResources.length > 10) {
-                    resourceLines.push(`\n*... and ${sortedResources.length - 10} more affected resources*`);
-                }
-                sections.push(`\n\n**Affected Resources** (${sortedResources.length} total)\n\n${resourceLines.join("\n")}`);
-                renderedBreakdownTable = true;
+                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
+                sections.push(AffectedResourceList.render({
+                    heading: "Affected Resources",
+                    overflowNoun: "affected resources",
+                    totalCount: sortedResources.length,
+                    entries: resourcesToShow.map((resource) => {
+                        return MonitorCriteriaEvaluator.getProxmoxAffectedResourceEntry({
+                            resource: resource,
+                            clusterName: breakdown.clusterName,
+                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
+                                platform: "proxmox",
+                                metricName: breakdown.metricName,
+                                value: resource.metricValue,
+                            }),
+                        });
+                    }),
+                }));
+                renderedBreakdownList = true;
             }
         }
-        // Metric results summary (fallback context when no table rendered)
-        if (!renderedBreakdownTable &&
+        // Metric results summary (fallback context when no list rendered)
+        if (!renderedBreakdownList &&
             metricResponse.metricResult &&
             metricResponse.metricResult.length > 0) {
             const resultDetails = [];
@@ -1886,8 +1967,8 @@ ${contextBlock}
      * Which vSphere object one VMware breakdown row describes, resolved
      * from the identity attributes the vcenter receiver stamped on it —
      * most specific first, in the same order the ingest inventory scan
-     * uses, so the Kind column here and the inventory's `kind` never
-     * disagree about the same series. A VM row carries its parent host
+     * uses, so the kind an Affected Resources item is titled with and the
+     * inventory's `kind` never disagree about the same series. A VM row carries its parent host
      * (and often a resource pool), so the VM check must run before the
      * host and pool checks.
      */
@@ -1912,6 +1993,84 @@ ${contextBlock}
         }
         return undefined;
     }
+    /*
+     * One vSphere object as an "Affected Resources" list item, titled by
+     * the object itself, with the ESXi host and cluster it sits under
+     * listed beneath it.
+     */
+    static getVMwareAffectedResourceEntry(input) {
+        const resource = input.resource;
+        const kind = MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(resource);
+        let name = "";
+        let showHost = false;
+        switch (kind) {
+            case "Virtual Machine":
+                /*
+                 * The VM's display name, falling back to its instance UUID
+                 * (`vcenter.vm.id`) when the receiver stamped no name. The Host
+                 * detail is the ESXi host the VM is running on.
+                 */
+                name = AffectedResourceList.code(resource.vmName || resource.vmId);
+                showHost = true;
+                break;
+            case "Resource Pool":
+                /*
+                 * Pool names are only unique within a parent, so the inventory
+                 * path is shown next to the name. The Host detail is the owner
+                 * host for a pool on a standalone ESXi host (pools under a
+                 * cluster show the cluster).
+                 */
+                name = AffectedResourceList.codeWithId({
+                    name: resource.resourcePoolName,
+                    id: resource.resourcePoolPath,
+                });
+                showHost = true;
+                break;
+            case "Host":
+                // The host IS the resource; a "Host:" detail would repeat it.
+                name = AffectedResourceList.code(resource.hostName);
+                break;
+            case "Datastore":
+                name = AffectedResourceList.code(resource.datastoreName);
+                break;
+            case "Cluster":
+                name = AffectedResourceList.code(resource.clusterName);
+                break;
+            case "Datacenter":
+                name = AffectedResourceList.code(resource.datacenterName);
+                break;
+            default:
+                break;
+        }
+        const details = [];
+        if (showHost && resource.hostName) {
+            details.push({
+                label: "Host",
+                value: AffectedResourceList.code(resource.hostName),
+            });
+        }
+        if (kind !== "Cluster" && resource.clusterName) {
+            details.push({
+                label: "Cluster",
+                value: AffectedResourceList.code(resource.clusterName),
+            });
+        }
+        if (!kind || !name) {
+            // No vSphere identity on the series — it describes the vCenter as a whole.
+            return {
+                kind: "vCenter",
+                name: AffectedResourceList.code(input.vcenterName),
+                value: input.value,
+                details: details,
+            };
+        }
+        return {
+            kind: kind,
+            name: name,
+            value: input.value,
+            details: details,
+        };
+    }
     static buildVMwareRootCauseContext(input) {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
         const metricResponse = input.dataToProcess;
@@ -1959,17 +2118,17 @@ ${contextBlock}
             }
             sections.push(`**vCenter Details**\n${vcenterDetails.join("\n")}`);
         }
-        // Affected resources (Resource / Kind / Host / Cluster / Value)
-        let renderedBreakdownTable = false;
+        // Affected resources: a ranked list of object, host and cluster
+        let renderedBreakdownList = false;
         if (breakdown && breakdown.affectedResources.length > 0) {
             /*
              * K8s/Proxmox-parity render: drop zero-value rows, worst (highest)
              * first, top 10. For count metrics filtered to an unhealthy state
              * (`vcenter.datacenter.host.count{status=red}`) the non-zero rows
-             * ARE the objects with a problem, so the table reads correctly;
+             * ARE the objects with a problem, so the list reads correctly;
              * a zero row means "nothing in that state" and adds nothing. The
              * per-series criteria evaluation is what actually alerts; this
-             * table is supplementary context only.
+             * list is supplementary context only.
              */
             const sortedResources = [
                 ...breakdown.affectedResources,
@@ -1981,7 +2140,7 @@ ${contextBlock}
                 return b.metricValue - a.metricValue;
             });
             /*
-             * Skip the table when no row carries any identity attribute — it
+             * Skip the list when no row carries any identity attribute — it
              * would add nothing. Every vcenter-receiver series carries at
              * least `vcenter.datacenter.name`, so this only trips on a
              * breakdown the worker could not attribute at all.
@@ -1990,77 +2149,28 @@ ${contextBlock}
                 return Boolean(MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(r));
             });
             if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, 10);
-                const resourceLines = [];
-                resourceLines.push(`| Resource | Kind | Host | Cluster | Value |`);
-                resourceLines.push(`| --- | --- | --- | --- | --- |`);
-                for (const resource of resourcesToShow) {
-                    const kind = MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(resource);
-                    let resourceCell = "-";
-                    let hostCell = "-";
-                    switch (kind) {
-                        case "Virtual Machine":
-                            /*
-                             * The VM's display name, falling back to its instance
-                             * UUID (`vcenter.vm.id`) when the receiver stamped no
-                             * name. The Host column carries the ESXi host the VM is
-                             * running on.
-                             */
-                            resourceCell = resource.vmName
-                                ? `\`${resource.vmName}\``
-                                : `\`${resource.vmId}\``;
-                            hostCell = resource.hostName ? `\`${resource.hostName}\`` : "-";
-                            break;
-                        case "Resource Pool":
-                            /*
-                             * Pool names are only unique within a parent, so the
-                             * inventory path is shown next to the name. The Host
-                             * column is the owner host for a pool on a standalone
-                             * ESXi host (pools under a cluster show the cluster).
-                             */
-                            if (resource.resourcePoolName && resource.resourcePoolPath) {
-                                resourceCell = `\`${resource.resourcePoolName}\` (\`${resource.resourcePoolPath}\`)`;
-                            }
-                            else {
-                                resourceCell = `\`${resource.resourcePoolPath || resource.resourcePoolName}\``;
-                            }
-                            hostCell = resource.hostName ? `\`${resource.hostName}\`` : "-";
-                            break;
-                        case "Host":
-                            // The host IS the resource; repeating it in the Host column adds nothing.
-                            resourceCell = `\`${resource.hostName}\``;
-                            break;
-                        case "Datastore":
-                            resourceCell = `\`${resource.datastoreName}\``;
-                            break;
-                        case "Cluster":
-                            resourceCell = `\`${resource.clusterName}\``;
-                            break;
-                        case "Datacenter":
-                            resourceCell = `\`${resource.datacenterName}\``;
-                            break;
-                        default:
-                            break;
-                    }
-                    const kindCell = kind || "-";
-                    const clusterCell = kind !== "Cluster" && resource.clusterName
-                        ? `\`${resource.clusterName}\``
-                        : "-";
-                    resourceLines.push(`| ${resourceCell} | ${kindCell} | ${hostCell} | ${clusterCell} | ${MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                        platform: "vmware",
-                        metricName: breakdown.metricName,
-                        value: resource.metricValue,
-                    })} |`);
-                }
-                if (sortedResources.length > 10) {
-                    resourceLines.push(`\n*... and ${sortedResources.length - 10} more affected resources*`);
-                }
-                sections.push(`\n\n**Affected Resources** (${sortedResources.length} total)\n\n${resourceLines.join("\n")}`);
-                renderedBreakdownTable = true;
+                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
+                sections.push(AffectedResourceList.render({
+                    heading: "Affected Resources",
+                    overflowNoun: "affected resources",
+                    totalCount: sortedResources.length,
+                    entries: resourcesToShow.map((resource) => {
+                        return MonitorCriteriaEvaluator.getVMwareAffectedResourceEntry({
+                            resource: resource,
+                            vcenterName: breakdown.vcenterName,
+                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
+                                platform: "vmware",
+                                metricName: breakdown.metricName,
+                                value: resource.metricValue,
+                            }),
+                        });
+                    }),
+                }));
+                renderedBreakdownList = true;
             }
         }
-        // Metric results summary (fallback context when no table rendered)
-        if (!renderedBreakdownTable &&
+        // Metric results summary (fallback context when no list rendered)
+        if (!renderedBreakdownList &&
             metricResponse.metricResult &&
             metricResponse.metricResult.length > 0) {
             const resultDetails = [];
@@ -2075,6 +2185,46 @@ ${contextBlock}
         }
         return sections.length > 0 ? sections.join("\n") : null;
     }
+    /*
+     * One Docker Swarm task as an "Affected Tasks" list item, with the
+     * service it belongs to and the node it is scheduled on beneath it.
+     */
+    static getDockerSwarmAffectedResourceEntry(input) {
+        const resource = input.resource;
+        let kind = "Cluster";
+        let name = AffectedResourceList.code(input.clusterName);
+        if (resource.containerName) {
+            kind = "Task";
+            name = AffectedResourceList.code(resource.containerName);
+        }
+        else if (resource.serviceName) {
+            kind = "Service";
+            name = AffectedResourceList.code(resource.serviceName);
+        }
+        else if (resource.nodeName) {
+            kind = "Node";
+            name = AffectedResourceList.code(resource.nodeName);
+        }
+        const details = [];
+        if (resource.serviceName && kind !== "Service") {
+            details.push({
+                label: "Service",
+                value: AffectedResourceList.code(resource.serviceName),
+            });
+        }
+        if (resource.nodeName && kind !== "Node") {
+            details.push({
+                label: "Node",
+                value: AffectedResourceList.code(resource.nodeName),
+            });
+        }
+        return {
+            kind: kind,
+            name: name,
+            value: input.value,
+            details: details,
+        };
+    }
     static buildDockerSwarmRootCauseContext(input) {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         const metricResponse = input.dataToProcess;
@@ -2111,14 +2261,14 @@ ${contextBlock}
             }
             sections.push(`**Docker Swarm Cluster Details**\n${clusterDetails.join("\n")}`);
         }
-        // Affected resources (Task / Service / Node / Value)
-        let renderedBreakdownTable = false;
+        // Affected tasks: a ranked list of task, service and node
+        let renderedBreakdownList = false;
         if (breakdown && breakdown.affectedResources.length > 0) {
             /*
              * K8s/Proxmox-parity render: drop zero-value rows, worst (highest)
              * first, top 10. For the task-down template the breaching rows ARE
              * the zero-uptime ones — those still drive alerting through the
-             * per-series criteria evaluation; this table is supplementary
+             * per-series criteria evaluation; this list is supplementary
              * context only.
              */
             const sortedResources = [
@@ -2131,42 +2281,35 @@ ${contextBlock}
                 return b.metricValue - a.metricValue;
             });
             /*
-             * Skip the table when no row carries any identity label
+             * Skip the list when no row carries any identity label
              * (cluster-wide series) — it would add nothing.
              */
             const hasIdentity = sortedResources.some((r) => {
                 return r.containerName || r.serviceName || r.nodeName;
             });
             if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, 10);
-                const resourceLines = [];
-                resourceLines.push(`| Task / Container | Service | Node | Value |`);
-                resourceLines.push(`| --- | --- | --- | --- |`);
-                for (const resource of resourcesToShow) {
-                    const taskCell = resource.containerName
-                        ? `\`${resource.containerName}\``
-                        : "-";
-                    const serviceCell = resource.serviceName
-                        ? `\`${resource.serviceName}\``
-                        : "-";
-                    const nodeCell = resource.nodeName
-                        ? `\`${resource.nodeName}\``
-                        : "-";
-                    resourceLines.push(`| ${taskCell} | ${serviceCell} | ${nodeCell} | ${MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                        platform: "dockerSwarm",
-                        metricName: breakdown.metricName,
-                        value: resource.metricValue,
-                    })} |`);
-                }
-                if (sortedResources.length > 10) {
-                    resourceLines.push(`\n*... and ${sortedResources.length - 10} more affected tasks*`);
-                }
-                sections.push(`\n\n**Affected Tasks** (${sortedResources.length} total)\n\n${resourceLines.join("\n")}`);
-                renderedBreakdownTable = true;
+                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
+                sections.push(AffectedResourceList.render({
+                    heading: "Affected Tasks",
+                    overflowNoun: "affected tasks",
+                    totalCount: sortedResources.length,
+                    entries: resourcesToShow.map((resource) => {
+                        return MonitorCriteriaEvaluator.getDockerSwarmAffectedResourceEntry({
+                            resource: resource,
+                            clusterName: breakdown.clusterName,
+                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
+                                platform: "dockerSwarm",
+                                metricName: breakdown.metricName,
+                                value: resource.metricValue,
+                            }),
+                        });
+                    }),
+                }));
+                renderedBreakdownList = true;
             }
         }
-        // Metric results summary (fallback context when no table rendered)
-        if (!renderedBreakdownTable &&
+        // Metric results summary (fallback context when no list rendered)
+        if (!renderedBreakdownList &&
             metricResponse.metricResult &&
             metricResponse.metricResult.length > 0) {
             const resultDetails = [];
@@ -2182,31 +2325,49 @@ ${contextBlock}
         return sections.length > 0 ? sections.join("\n") : null;
     }
     /*
-     * Which rows of the Ceph affected-resources table actually BREACHED.
+     * Which rows of an affected-resources list actually BREACHED.
      *
      * The blanket `metricValue > 0` below is right for every count- or
      * level-style criteria ("> 0 active health checks", "> 85 % used"), but
-     * it is exactly backwards for the availability signals: the OSD Down /
-     * OSD Out / Quorum Degraded criteria fire on `< 1` over ceph_osd_up /
-     * ceph_osd_in / ceph_mon_quorum_status, so the ZERO rows are the down
-     * daemons. Dropping them rendered a table of the HEALTHY daemons under
-     * an incident that tells the reader to "check the root cause for the
-     * affected ceph_daemon label".
+     * it is exactly backwards for the availability signals: the Ceph OSD
+     * Down / OSD Out / Quorum Degraded criteria fire on `< 1` over
+     * ceph_osd_up / ceph_osd_in / ceph_mon_quorum_status, so the ZERO rows
+     * are the down daemons. Dropping them rendered a list of the HEALTHY
+     * daemons under an incident that tells the reader to "check the root
+     * cause for the affected ceph_daemon label".
      *
      * Invert only for a criteria that fires when the metric FALLS.
      * Everything else — every `> 0` health check, PG count, latency and
-     * capacity ratio, and every `= 0` recovery criteria — keeps the
-     * existing `> 0`, worst-highest-first table byte for byte.
+     * capacity ratio, and (by default) every `= 0` recovery criteria —
+     * keeps the existing `> 0`, worst-highest-first list byte for byte.
+     *
+     * `floorEqualityFiresOnFall` additionally counts a FIRING `= 0` (or
+     * below) as a fall. Kubernetes needs it: k8s-node-not-ready and
+     * k8s-etcd-no-leader fire on `= 0` over k8s.node.condition_ready /
+     * etcd_server_has_leader, and zero is the floor of those metrics, so
+     * the only way to reach it is down. It is gated on the criteria opening
+     * an incident or alert because the same `= 0` is also how the restart,
+     * failed-pod and unavailable-replica templates express RECOVERY, and
+     * that all-clear must not become a list of healthy zero rows. Ceph
+     * leaves it off: all of its `= 0` criteria are recoveries.
      */
-    static getCephBreachPredicate(criteriaInstance) {
-        var _a;
-        const metricFilters = (((_a = criteriaInstance === null || criteriaInstance === void 0 ? void 0 : criteriaInstance.data) === null || _a === void 0 ? void 0 : _a.filters) || []).filter((f) => {
+    static getAffectedResourceBreachPredicate(input) {
+        var _a, _b, _c, _d, _e, _f;
+        const metricFilters = (((_b = (_a = input.criteriaInstance) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.filters) || []).filter((f) => {
             return f.checkOn === CheckOn.MetricValue && typeof f.value === "number";
         });
+        const opensIncidentOrAlert = ((_d = (_c = input.criteriaInstance) === null || _c === void 0 ? void 0 : _c.data) === null || _d === void 0 ? void 0 : _d.createIncidents) === true ||
+            ((_f = (_e = input.criteriaInstance) === null || _e === void 0 ? void 0 : _e.data) === null || _f === void 0 ? void 0 : _f.createAlerts) === true;
         const firesWhenMetricFalls = metricFilters.length > 0 &&
             metricFilters.every((f) => {
-                return (f.filterType === FilterType.LessThan ||
-                    f.filterType === FilterType.LessThanOrEqualTo);
+                if (f.filterType === FilterType.LessThan ||
+                    f.filterType === FilterType.LessThanOrEqualTo) {
+                    return true;
+                }
+                return (input.floorEqualityFiresOnFall === true &&
+                    opensIncidentOrAlert &&
+                    f.filterType === FilterType.EqualTo &&
+                    f.value <= 0);
             });
         if (!firesWhenMetricFalls) {
             return {
@@ -2220,6 +2381,9 @@ ${contextBlock}
             matches: (value) => {
                 return metricFilters.some((f) => {
                     const threshold = f.value;
+                    if (f.filterType === FilterType.EqualTo) {
+                        return value === threshold;
+                    }
                     return f.filterType === FilterType.LessThan
                         ? value < threshold
                         : value <= threshold;
@@ -2232,6 +2396,71 @@ ${contextBlock}
             worstIsLowest: true,
         };
     }
+    /*
+     * One Ceph daemon or pool as an "Affected Resources" list item, with
+     * the pool and host it belongs to beneath it.
+     */
+    static getCephAffectedResourceEntry(input) {
+        const resource = input.resource;
+        /*
+         * The worker stores every series' `name` label as poolName, but only
+         * ceph_pool_metadata's `name` is a pool — and that series always
+         * carries pool_id too. On ceph_health_detail, `name` is the health
+         * check (RECENT_CRASH, OSD_NEARFULL, ...), and titling it "Pool" told
+         * the reader a pool called OSD_NEARFULL was the problem. So a name is
+         * treated as a pool only when it arrives with a pool id.
+         */
+        const pool = resource.poolId
+            ? AffectedResourceList.codeWithId({
+                name: resource.poolName,
+                id: resource.poolId,
+            })
+            : "";
+        const otherName = resource.poolId
+            ? ""
+            : AffectedResourceList.code(resource.poolName);
+        const otherNameKind = input.metricName === "ceph_health_detail" ? "Health Check" : "Resource";
+        let kind = "Cluster";
+        let name = AffectedResourceList.code(input.clusterName);
+        if (resource.daemon) {
+            kind = "Daemon";
+            name = AffectedResourceList.code(resource.daemon);
+        }
+        else if (pool) {
+            kind = "Pool";
+            name = pool;
+        }
+        else if (otherName) {
+            kind = otherNameKind;
+            name = otherName;
+        }
+        else if (resource.hostname) {
+            kind = "Host";
+            name = AffectedResourceList.code(resource.hostname);
+        }
+        const details = [];
+        if (pool && name !== pool) {
+            details.push({ label: "Pool", value: pool });
+        }
+        if (otherName && name !== otherName) {
+            details.push({
+                label: otherNameKind === "Resource" ? "Name" : otherNameKind,
+                value: otherName,
+            });
+        }
+        if (resource.hostname && kind !== "Host") {
+            details.push({
+                label: "Host",
+                value: AffectedResourceList.code(resource.hostname),
+            });
+        }
+        return {
+            kind: kind,
+            name: name,
+            value: input.value,
+            details: details,
+        };
+    }
     static buildCephRootCauseContext(input) {
         var _a, _b, _c, _d, _e, _f, _g;
         const metricResponse = input.dataToProcess;
@@ -2262,8 +2491,8 @@ ${contextBlock}
             }
             sections.push(`**Ceph Cluster Details**\n${clusterDetails.join("\n")}`);
         }
-        // Affected resources (Daemon / Pool / Host / Value)
-        let renderedBreakdownTable = false;
+        // Affected resources: a ranked list of daemon, pool and host
+        let renderedBreakdownList = false;
         if (breakdown && breakdown.affectedResources.length > 0) {
             /*
              * Keep the rows that satisfy the criteria that just matched, worst
@@ -2271,7 +2500,9 @@ ${contextBlock}
              * ceph_osd_in / ceph_mon_quorum_status the criteria is `< 1`, so
              * the zero rows are the whole point of the incident.
              */
-            const breach = MonitorCriteriaEvaluator.getCephBreachPredicate(input.criteriaInstance);
+            const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+            });
             const sortedResources = [
                 ...breakdown.affectedResources,
             ]
@@ -2284,7 +2515,7 @@ ${contextBlock}
                     : b.metricValue - a.metricValue;
             });
             /*
-             * Skip the table when no row carries any identity label
+             * Skip the list when no row carries any identity label
              * (cluster-wide series like ceph_health_status) — it would add
              * nothing.
              */
@@ -2292,42 +2523,29 @@ ${contextBlock}
                 return r.daemon || r.poolId || r.poolName || r.hostname;
             });
             if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, 10);
-                const resourceLines = [];
-                resourceLines.push(`| Daemon | Pool | Host | Value |`);
-                resourceLines.push(`| --- | --- | --- | --- |`);
-                for (const resource of resourcesToShow) {
-                    const daemonCell = resource.daemon
-                        ? `\`${resource.daemon}\``
-                        : "-";
-                    let poolCell = "-";
-                    if (resource.poolName && resource.poolId) {
-                        poolCell = `\`${resource.poolName}\` (\`${resource.poolId}\`)`;
-                    }
-                    else if (resource.poolName) {
-                        poolCell = `\`${resource.poolName}\``;
-                    }
-                    else if (resource.poolId) {
-                        poolCell = `\`${resource.poolId}\``;
-                    }
-                    const hostCell = resource.hostname
-                        ? `\`${resource.hostname}\``
-                        : "-";
-                    resourceLines.push(`| ${daemonCell} | ${poolCell} | ${hostCell} | ${MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                        platform: "ceph",
-                        metricName: breakdown.metricName,
-                        value: resource.metricValue,
-                    })} |`);
-                }
-                if (sortedResources.length > 10) {
-                    resourceLines.push(`\n*... and ${sortedResources.length - 10} more affected resources*`);
-                }
-                sections.push(`\n\n**Affected Resources** (${sortedResources.length} total)\n\n${resourceLines.join("\n")}`);
-                renderedBreakdownTable = true;
+                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
+                sections.push(AffectedResourceList.render({
+                    heading: "Affected Resources",
+                    overflowNoun: "affected resources",
+                    totalCount: sortedResources.length,
+                    entries: resourcesToShow.map((resource) => {
+                        return MonitorCriteriaEvaluator.getCephAffectedResourceEntry({
+                            resource: resource,
+                            clusterName: breakdown.clusterName,
+                            metricName: breakdown.metricName,
+                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
+                                platform: "ceph",
+                                metricName: breakdown.metricName,
+                                value: resource.metricValue,
+                            }),
+                        });
+                    }),
+                }));
+                renderedBreakdownList = true;
             }
         }
-        // Metric results summary (fallback context when no table rendered)
-        if (!renderedBreakdownTable &&
+        // Metric results summary (fallback context when no list rendered)
+        if (!renderedBreakdownList &&
             metricResponse.metricResult &&
             metricResponse.metricResult.length > 0) {
             const resultDetails = [];