@oneuptime/common 14.0.3 → 14.0.6

package/build/dist/Server/Utils/Monitor/MonitorCriteriaEvaluator.js

@@ -6,8 +6,10 @@ import CustomCodeMonitoringCriteria from "./Criteria/CustomCodeMonitorCriteria";
 import IncomingEmailCriteria from "./Criteria/IncomingEmailCriteria";
 import IncomingRequestCriteria from "./Criteria/IncomingRequestCriteria";
 import IncomingRequestIncidentGrouping from "./IncomingRequestIncidentGrouping";
+import { IOT_DEVICE_ID_ATTRIBUTE_KEY } from "./IoTDeviceAbsenceSeries";
 import PerEntityCriteriaFanOut from "./PerEntityCriteriaFanOut";
 import SSLMonitorCriteria from "./Criteria/SSLMonitorCriteria";
+import CompareCriteria from "./Criteria/CompareCriteria";
 import ServerMonitorCriteria from "./Criteria/ServerMonitorCriteria";
 import SyntheticMonitoringCriteria from "./Criteria/SyntheticMonitor";
 import LogMonitorCriteria from "./Criteria/LogMonitorCriteria";
@@ -49,6 +51,10 @@ import { getProxmoxMetricByMetricName } from "../../../Types/Monitor/ProxmoxMetr
 import { getVMwareMetricByMetricName } from "../../../Types/Monitor/VMwareMetricCatalog";
 import { getCephMetricByMetricName } from "../../../Types/Monitor/CephMetricCatalog";
 import { getDockerSwarmMetricByMetricName } from "../../../Types/Monitor/DockerSwarmMetricCatalog";
+import PlatformMetricUnitUtil from "../../../Utils/Monitor/PlatformMetricUnitUtil";
+import MetricUnitUtil from "../../../Utils/MetricUnitUtil";
+import PlatformResourceIdentity from "../../../Utils/Monitor/PlatformResourceIdentity";
+import MetricFormulaEvaluator from "../../../Utils/Metrics/MetricFormulaEvaluator";
 export default class MonitorCriteriaEvaluator {
     static async processMonitorStep(input) {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
@@ -208,6 +214,7 @@ export default class MonitorCriteriaEvaluator {
                 monitorStep: input.monitorStep,
                 monitor: input.monitor,
                 criteriaInstance: criteriaInstance,
+                perSeriesMatches: perSeriesMatches,
             });
             /*
              * For metric monitors, render the metric identity (name, unit,
@@ -499,6 +506,9 @@ ${contextBlock}
                 labels: entry.labels,
                 rootCause: rootCauseLines.join("\n"),
                 metricContext: (_e = matched[0]) === null || _e === void 0 ? void 0 : _e.context,
+                metricContexts: matched.map((r) => {
+                    return r.context;
+                }),
             });
         }
         return matches;
@@ -927,6 +937,10 @@ ${contextBlock}
         if (input.monitor.monitorType === MonitorType.Podman) {
             return MonitorCriteriaEvaluator.buildPodmanRootCauseContext(input);
         }
+        // Handle IoT device monitors with fleet / device context
+        if (input.monitor.monitorType === MonitorType.IoTDevice) {
+            return MonitorCriteriaEvaluator.buildIoTRootCauseContext(input);
+        }
         // Handle Proxmox monitors with resource context
         if (input.monitor.monitorType === MonitorType.Proxmox) {
             return MonitorCriteriaEvaluator.buildProxmoxRootCauseContext(input);
@@ -1026,20 +1040,23 @@ ${contextBlock}
         }
         return sections.join("\n");
     }
-    static buildMetricRootCauseContext(input) {
+    /*
+     * The first populated metric context across the instance's filters.
+     * Only metric-value filters populate this at evaluation time, so this
+     * effectively returns the context for the filter that ran.
+     */
+    static getMetricCriteriaContext(criteriaInstance) {
         var _a;
-        /*
-         * Pick the first populated metric context across the instance's filters.
-         * Only metric-value filters populate this at evaluation time, so this
-         * effectively returns the context for the filter that ran.
-         */
-        const ctx = (((_a = input.criteriaInstance.data) === null || _a === void 0 ? void 0 : _a.filters) || [])
+        return (((_a = criteriaInstance === null || criteriaInstance === void 0 ? void 0 : criteriaInstance.data) === null || _a === void 0 ? void 0 : _a.filters) || [])
             .map((f) => {
             return f.metricCriteriaContext;
         })
             .find((c) => {
             return Boolean(c);
         });
+    }
+    static buildMetricRootCauseContext(input) {
+        const ctx = MonitorCriteriaEvaluator.getMetricCriteriaContext(input.criteriaInstance);
         if (!ctx) {
             return null;
         }
@@ -1117,11 +1134,16 @@ ${contextBlock}
                 unit: ctx.unit,
                 unitHeuristicMetricName: unitHeuristicMetricName,
                 components: ctx.components || [],
+                seriesLabelKeys: [
+                    ...ctx.groupBy,
+                    ...Object.keys(ctx.seriesLabels || {}),
+                ],
             })}`);
         }
         const deepLink = MonitorCriteriaEvaluator.buildMetricExplorerDeepLink({
             monitor: input.monitor,
             ctx,
+            monitorStep: input.monitorStep,
         });
         if (deepLink) {
             sections.push(`\n\n[Open metric in dashboard](${deepLink})`);
@@ -1175,6 +1197,41 @@ ${contextBlock}
      * the client-side markdown viewer can localize them to the viewer's
      * timezone (without losing the canonical instant).
      */
+    /**
+     * The attributes worth printing under a breaching sample.
+     *
+     * A grouped monitor's sample does not carry its group-by values at the
+     * top level: the worker nests the datapoint's whole attribute map under
+     * a single `attributes` key. Printed as-is that became
+     * "`attributes`: `[object Object]`" under every sample — the one line
+     * that should have said which host breached. The series' own label keys
+     * are lifted out of it instead; the rest of the datapoint's attributes
+     * (every resource attribute the exporter stamped) are not what the
+     * reader is looking for here.
+     */
+    static flattenSampleAttributes(input) {
+        const flattened = {};
+        for (const key of Object.keys(input.attributes)) {
+            const value = input.attributes[key];
+            if (value && typeof value === "object" && !Array.isArray(value)) {
+                for (const nestedKey of Object.keys(value)) {
+                    const nestedValue = value[nestedKey];
+                    if (input.seriesLabelKeys.has(nestedKey) &&
+                        flattened[nestedKey] === undefined &&
+                        nestedValue !== undefined &&
+                        nestedValue !== null &&
+                        typeof nestedValue !== "object") {
+                        flattened[nestedKey] = nestedValue;
+                    }
+                }
+                continue;
+            }
+            if (flattened[key] === undefined) {
+                flattened[key] = value;
+            }
+        }
+        return flattened;
+    }
     static formatBreachingSamplesSection(input) {
         const MAX_SAMPLES_SHOWN = 20;
         // Sort chronologically and de-duplicate any accidental repeats
@@ -1186,14 +1243,22 @@ ${contextBlock}
          * Collect attribute keys that appear on any displayed sample, so every
          * item lists the attributes it has in the same order.
          */
+        const seriesLabelKeys = new Set(input.seriesLabelKeys || []);
+        const sampleAttributes = new Map();
         const attrKeySet = new Set();
         for (const s of displayedSamples) {
-            for (const k of Object.keys(s.attributes || {})) {
+            const flattened = MonitorCriteriaEvaluator.flattenSampleAttributes({
+                attributes: s.attributes || {},
+                seriesLabelKeys: seriesLabelKeys,
+            });
+            sampleAttributes.set(s, flattened);
+            for (const k of Object.keys(flattened)) {
                 attrKeySet.add(k);
             }
         }
         const attrKeys = Array.from(attrKeySet);
         const items = displayedSamples.map((s) => {
+            var _a;
             const details = [];
             /*
              * What each variable of a formula resolved to at the breach time —
@@ -1233,7 +1298,7 @@ ${contextBlock}
              * RootCauseList.code keeps whatever they contain inside the span.
              */
             for (const k of attrKeys) {
-                const v = s.attributes[k];
+                const v = (_a = sampleAttributes.get(s)) === null || _a === void 0 ? void 0 : _a[k];
                 if (v === undefined || v === null) {
                     continue;
                 }
@@ -1290,17 +1355,39 @@ ${contextBlock}
          * for its own URL round-trip — so this deep link can never drift
          * from what the explorer parses.
          */
-        const queryConfig = {
-            metricQueryData: {
-                filterData: Object.assign({ metricName: input.ctx.metricName, attributes: MetricExplorerUrl.sanitizeAttributes(input.ctx.filterAttributes) }, (input.ctx.aggregationType
-                    ? { aggegationType: input.ctx.aggregationType }
-                    : {})),
+        let queryConfigs = [
+            {
+                metricQueryData: {
+                    filterData: Object.assign({ metricName: input.ctx.metricName, attributes: MetricExplorerUrl.sanitizeAttributes(input.ctx.filterAttributes) }, (input.ctx.aggregationType
+                        ? { aggegationType: input.ctx.aggregationType }
+                        : {})),
+                },
             },
-        };
+        ];
+        let formulaConfigs = [];
+        /*
+         * A formula's metricName is its EXPRESSION, not a metric the explorer
+         * can chart — linking it as one opened an empty chart. Open the
+         * step's own queries and formulas instead, which is what the formula
+         * was computed from. With no step config to rebuild it from, no link
+         * beats a dead one.
+         */
+        if (input.ctx.isFormula) {
+            const metricViewConfig = MonitorStep.getMetricsViewConfig(input.monitorStep);
+            if (!metricViewConfig ||
+                !(metricViewConfig.formulaConfigs || []).some((formula) => {
+                    var _a;
+                    return ((_a = formula.metricAliasData) === null || _a === void 0 ? void 0 : _a.metricVariable) === input.ctx.alias;
+                })) {
+                return null;
+            }
+            queryConfigs = metricViewConfig.queryConfigs || [];
+            formulaConfigs = metricViewConfig.formulaConfigs || [];
+        }
         const breachWindow = MonitorCriteriaEvaluator.getMetricBreachExplorerWindow(input.ctx);
         const urlParams = MetricExplorerUrl.buildQueryParamsFromMetricViewData({
-            queryConfigs: [queryConfig],
-            formulaConfigs: [],
+            queryConfigs: queryConfigs,
+            formulaConfigs: formulaConfigs,
             startAndEndDate: new InBetween(breachWindow.startTime, breachWindow.endTime),
         });
         const params = new URLSearchParams();
@@ -1425,7 +1512,8 @@ ${contextBlock}
         return ` _(scope partially carried — not applied: ${dropped.join(", ")})_`;
     }
     /**
-     * The unit for a value in a per-platform "Affected Resources" list.
+     * The unit for a value in a per-platform "Affected Resources" list built
+     * from the worker's raw datapoint scan.
      *
      * These rows are NOT the same numbers as the criteria's breaching
      * samples: the worker collects them with a raw `MetricService.findBy`
@@ -1435,50 +1523,632 @@ ${contextBlock}
      * query's legendUnit would therefore attach a confidently wrong unit to
      * a correct number.
      *
-     * The catalog is the right source precisely because it also declares
+     * The catalog is the first source precisely because it also declares
      * the native unit. It is the same lookup, on the same metric name, that
      * the worker already ran to resolve `metricFriendlyName`, so the unit
      * shown here can never disagree with the metric name shown beside it.
+     * The unit the worker recorded on the breakdown — the one the exporter
+     * declared — covers every metric the catalog does not know, which is
+     * how k8s.node.allocatable_memory reads "258 GB" instead of the bare
+     * "257760964608" it used to.
      */
     static getPlatformMetricUnit(input) {
+        /*
+         * The vcenter receiver's utilization metrics are already 0–100
+         * percentages (unit "%"), never [0, 1] ratios — the catalog says "%"
+         * and the formatter renders it as-is, so 92.5 reads "92.50%" and
+         * never "9250.00%".
+         */
+        return (PlatformMetricUnitUtil.getCatalogUnit({
+            platform: input.platform,
+            metricName: input.metricName,
+        }) ||
+            input.metricUnit ||
+            undefined);
+    }
+    /**
+     * Render the value of one resource from the worker's raw scan, in the
+     * unit getPlatformMetricUnit resolves. Unemphasised: the list bolds it
+     * (it is the one number on the line a reader scans for), a sentence
+     * may not.
+     */
+    static formatPlatformMetricValue(input) {
+        return MetricValueFormatter.format({
+            value: input.value,
+            unit: MonitorCriteriaEvaluator.getPlatformMetricUnit({
+                platform: input.platform,
+                metricName: input.metricName,
+                metricUnit: input.metricUnit,
+            }),
+            metricName: input.metricName,
+        });
+    }
+    /**
+     * The catalog's human name for a platform metric, or undefined when the
+     * catalog does not know it.
+     */
+    static getPlatformMetricFriendlyName(input) {
         var _a, _b, _c, _d, _e;
         switch (input.platform) {
             case "kubernetes":
-                return (_a = getKubernetesMetricByMetricName(input.metricName)) === null || _a === void 0 ? void 0 : _a.unit;
+                return (_a = getKubernetesMetricByMetricName(input.metricName)) === null || _a === void 0 ? void 0 : _a.friendlyName;
             case "proxmox":
-                return (_b = getProxmoxMetricByMetricName(input.metricName)) === null || _b === void 0 ? void 0 : _b.unit;
+                return (_b = getProxmoxMetricByMetricName(input.metricName)) === null || _b === void 0 ? void 0 : _b.friendlyName;
             case "vmware":
-                /*
-                 * The vcenter receiver's utilization metrics are already 0–100
-                 * percentages (unit "%"), never [0, 1] ratios — the catalog
-                 * says "%" and the formatter renders it as-is, so 92.5 reads
-                 * "92.50%" and never "9250.00%".
-                 */
-                return (_c = getVMwareMetricByMetricName(input.metricName)) === null || _c === void 0 ? void 0 : _c.unit;
+                return (_c = getVMwareMetricByMetricName(input.metricName)) === null || _c === void 0 ? void 0 : _c.friendlyName;
             case "dockerSwarm":
-                return (_d = getDockerSwarmMetricByMetricName(input.metricName)) === null || _d === void 0 ? void 0 : _d.unit;
+                return (_d = getDockerSwarmMetricByMetricName(input.metricName)) === null || _d === void 0 ? void 0 : _d.friendlyName;
             case "ceph":
-                return (_e = getCephMetricByMetricName(input.metricName)) === null || _e === void 0 ? void 0 : _e.unit;
+                return (_e = getCephMetricByMetricName(input.metricName)) === null || _e === void 0 ? void 0 : _e.friendlyName;
             default:
                 return undefined;
         }
     }
     /**
-     * Render the value of one resource in a platform "Affected Resources"
-     * list.
+     * "Node Memory Usage (`k8s.node.memory.usage`)", or just the code-quoted
+     * name when there is no friendlier one. The old line always printed
+     * both, which is how the email came to read
+     * "k8s.node.allocatable_memory (`k8s.node.allocatable_memory`)".
+     */
+    static describePlatformMetricName(input) {
+        const friendlyName = (input.friendlyName || "").trim();
+        if (!friendlyName || friendlyName === input.metricName) {
+            return `\`${input.metricName}\``;
+        }
+        return `${friendlyName} (\`${input.metricName}\`)`;
+    }
+    /**
+     * What the matched criteria actually measured: the query or formula its
+     * metric-value filter points at, resolved the same way
+     * MetricMonitorCriteria resolves it (alias match, falling back to the
+     * first query when the alias names nothing).
      *
-     * Bold, because that is how the breakdown has always drawn the value —
-     * it is the one number on the line a reader scans for.
+     * Returns null when the criteria has no metric-value filter — the
+     * platform context then falls back to describing the breakdown, as it
+     * always has.
      */
-    static formatPlatformResourceValue(input) {
-        return `**${MetricValueFormatter.format({
-            value: input.value,
-            unit: MonitorCriteriaEvaluator.getPlatformMetricUnit({
-                platform: input.platform,
-                metricName: input.metricName,
+    static resolveCriteriaMetricTarget(input) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+        /*
+         * The step's own config, exactly as MetricMonitorCriteria reads it,
+         * so the target named here is the one the criteria was evaluated on.
+         */
+        const stepConfig = MonitorStep.getMetricsViewConfig(input.monitorStep);
+        const metricViewConfig = stepConfig && ((_a = stepConfig.queryConfigs) === null || _a === void 0 ? void 0 : _a.length) > 0
+            ? stepConfig
+            : input.metricResponse.metricViewConfig || stepConfig;
+        const metricFilters = (((_c = (_b = input.criteriaInstance) === null || _b === void 0 ? void 0 : _b.data) === null || _c === void 0 ? void 0 : _c.filters) || []).filter((f) => {
+            return f.checkOn === CheckOn.MetricValue;
+        });
+        if (metricFilters.length === 0) {
+            return null;
+        }
+        /*
+         * The filter that actually fired, when the criteria has several. An
+         * "Any" criteria (ceph-pg-damaged: PG_DAMAGED > 0 OR OSD_SCRUB_ERRORS
+         * > 0) is described — and its list taken from — whichever of them
+         * breached. Following the first filter instead found no scan for an
+         * inactive PG_DAMAGED check and dropped the list the scrub errors had.
+         * The evaluation leaves each filter's context on it; one with
+         * breaching samples is one that fired.
+         */
+        const firedFilter = metricFilters.find((f) => {
+            const context = f.metricCriteriaContext;
+            return Boolean(((context === null || context === void 0 ? void 0 : context.breachingSamples) && context.breachingSamples.length > 0) ||
+                (context === null || context === void 0 ? void 0 : context.breachingSample));
+        });
+        const filter = firedFilter ||
+            metricFilters.find((f) => {
+                var _a;
+                return Boolean((_a = f.metricMonitorOptions) === null || _a === void 0 ? void 0 : _a.metricAlias);
+            }) ||
+            metricFilters[0];
+        const thresholdUnit = ((_d = filter.metricMonitorOptions) === null || _d === void 0 ? void 0 : _d.thresholdUnit) || undefined;
+        const alias = ((_e = filter.metricMonitorOptions) === null || _e === void 0 ? void 0 : _e.metricAlias) || "";
+        const queryConfigs = (metricViewConfig === null || metricViewConfig === void 0 ? void 0 : metricViewConfig.queryConfigs) || [];
+        const formulaConfigs = (metricViewConfig === null || metricViewConfig === void 0 ? void 0 : metricViewConfig.formulaConfigs) || [];
+        const aliasOf = (config) => {
+            var _a;
+            return ((_a = config.metricAliasData) === null || _a === void 0 ? void 0 : _a.metricVariable) || "";
+        };
+        const query = alias
+            ? queryConfigs.find((q) => {
+                return aliasOf(q) === alias;
+            })
+            : undefined;
+        const formula = !query && alias
+            ? formulaConfigs.find((f) => {
+                return aliasOf(f) === alias;
+            })
+            : undefined;
+        if (formula) {
+            const expression = ((_f = formula.metricFormulaData) === null || _f === void 0 ? void 0 : _f.metricFormula) || "";
+            const components = MetricFormulaEvaluator.getReferencedVariables(expression).map((variable) => {
+                var _a, _b;
+                const componentQuery = queryConfigs.find((q) => {
+                    return aliasOf(q).toLowerCase() === variable.toLowerCase();
+                });
+                return {
+                    alias: componentQuery ? aliasOf(componentQuery) : variable,
+                    metricName: ((_b = (_a = componentQuery === null || componentQuery === void 0 ? void 0 : componentQuery.metricQueryData) === null || _a === void 0 ? void 0 : _a.filterData) === null || _b === void 0 ? void 0 : _b.metricName) || undefined,
+                };
+            });
+            return {
+                alias: alias,
+                isFormula: true,
+                comparisonUnit: thresholdUnit || ((_g = formula.metricAliasData) === null || _g === void 0 ? void 0 : _g.legendUnit) || undefined,
+                metricName: undefined,
+                displayName: MetricMonitorCriteria.getAliasDisplayName({
+                    aliasData: formula.metricAliasData,
+                    metricAlias: alias,
+                }),
+                formulaExpression: expression || undefined,
+                components: components,
+            };
+        }
+        const matchedQuery = query || queryConfigs[0];
+        if (!matchedQuery) {
+            return null;
+        }
+        return {
+            alias: aliasOf(matchedQuery) || alias,
+            isFormula: false,
+            comparisonUnit: thresholdUnit || ((_h = matchedQuery.metricAliasData) === null || _h === void 0 ? void 0 : _h.legendUnit) || undefined,
+            metricName: ((_k = (_j = matchedQuery.metricQueryData) === null || _j === void 0 ? void 0 : _j.filterData) === null || _k === void 0 ? void 0 : _k.metricName) || undefined,
+            displayName: MetricMonitorCriteria.getAliasDisplayName({
+                aliasData: matchedQuery.metricAliasData,
+                metricAlias: aliasOf(matchedQuery) || alias,
             }),
-            metricName: input.metricName,
-        })}**`;
+            formulaExpression: undefined,
+            components: [],
+        };
+    }
+    /**
+     * The metric the platform's root-cause analysis should reason about. For
+     * a plain query that is the query's metric. A formula has no metric name
+     * of its own, so it is analysed as its first query component — the
+     * numerator of every ratio template (k8s.node.memory.usage for
+     * "used ÷ allocatable"), which is what the analysis branches key on.
+     */
+    static getAnalysisMetricName(target) {
+        var _a;
+        if (!target) {
+            return undefined;
+        }
+        if (!target.isFormula) {
+            return target.metricName;
+        }
+        return (_a = target.components.find((component) => {
+            return Boolean(component.metricName);
+        })) === null || _a === void 0 ? void 0 : _a.metricName;
+    }
+    /**
+     * The "- Metric:" lines of a platform's details block.
+     *
+     * They name what the criteria compared. A formula is named by its
+     * legend and spelled out with the metric behind each variable, because
+     * "Node Memory Utilization (%)" is what the threshold was about and the
+     * two metrics are what an engineer greps for. With no criteria to go on,
+     * the breakdown's own metric is named, as before.
+     */
+    static describeCriteriaMetric(input) {
+        const target = input.target;
+        const describeMetric = (metricName) => {
+            var _a;
+            const breakdownFriendlyName = ((_a = input.breakdown) === null || _a === void 0 ? void 0 : _a.metricName) === metricName
+                ? input.breakdown.metricFriendlyName
+                : undefined;
+            return MonitorCriteriaEvaluator.describePlatformMetricName({
+                metricName: metricName,
+                friendlyName: breakdownFriendlyName ||
+                    MonitorCriteriaEvaluator.getPlatformMetricFriendlyName({
+                        platform: input.platform,
+                        metricName: metricName,
+                    }),
+            });
+        };
+        if (target === null || target === void 0 ? void 0 : target.isFormula) {
+            const lines = [
+                `- Metric: ${target.displayName || `\`${target.alias}\``}`,
+            ];
+            if (target.formulaExpression) {
+                lines.push(`- Formula: \`${target.formulaExpression}\``);
+            }
+            for (const component of target.components) {
+                if (component.metricName) {
+                    lines.push(`  - \`${component.alias}\` = ${describeMetric(component.metricName)}`);
+                }
+            }
+            return lines;
+        }
+        if (target === null || target === void 0 ? void 0 : target.metricName) {
+            return [`- Metric: ${describeMetric(target.metricName)}`];
+        }
+        if (input.breakdown) {
+            return [
+                `- Metric: ${MonitorCriteriaEvaluator.describePlatformMetricName({
+                    metricName: input.breakdown.metricName,
+                    friendlyName: input.breakdown.metricFriendlyName,
+                })}`,
+            ];
+        }
+        if (input.fallbackMetricName) {
+            return [`- Metric: \`${input.fallbackMetricName}\``];
+        }
+        return [];
+    }
+    /**
+     * Pick the raw-scan breakdown that measured what the criteria compared.
+     *
+     * The worker returns one breakdown per query, tagged with the query's
+     * alias. Only the one scanned for the criteria's own query may be shown:
+     * a sibling query's scan is a different quantity (allocatable bytes
+     * under a utilization threshold), and a formula has no raw scan at all
+     * — its per-resource values only exist per series.
+     *
+     * A breakdown built before the tag existed is trusted the way it always
+     * was, unless the criteria targets a formula.
+     */
+    static selectPlatformBreakdown(input) {
+        const candidates = input.breakdowns && input.breakdowns.length > 0
+            ? input.breakdowns
+            : input.legacyBreakdown
+                ? [input.legacyBreakdown]
+                : [];
+        if (candidates.length === 0) {
+            return undefined;
+        }
+        const target = input.target;
+        if (!target) {
+            return candidates.length === 1 ? candidates[0] : undefined;
+        }
+        if (target.isFormula) {
+            return undefined;
+        }
+        const byAlias = candidates.find((b) => {
+            return (Boolean(b.metricAlias) &&
+                b.metricAlias.toLowerCase() === target.alias.toLowerCase());
+        });
+        if (byAlias) {
+            return byAlias;
+        }
+        return candidates.find((b) => {
+            return !b.metricAlias;
+        });
+    }
+    /**
+     * The "Affected Resources" rows of a GROUPED platform monitor: one per
+     * series that satisfied the matched criteria.
+     *
+     * This is the list the criteria actually produced. Each row is valued
+     * with its series' worst breaching sample, in the same display unit —
+     * and formatted by the same formatter — as the "Filter Conditions Met"
+     * sentence above it, so the node the sentence says "ranged from 86.26%
+     * to 88.82%" is listed at 88.82%, not at its 257760964608 bytes of
+     * allocatable memory. Series that did not breach are not listed at all.
+     *
+     * The resource is named from the series' group-by labels, the same
+     * attribute keys the worker's raw scan reads, then given whatever
+     * context those labels imply but do not carry (a pod's node and
+     * workload) from one of the series' own datapoints.
+     */
+    static buildSeriesAffectedRows(input) {
+        const targetAlias = (input.targetAlias || "").toLowerCase();
+        const rows = input.perSeriesMatches.map((match) => {
+            var _a;
+            /*
+             * Value the row with the filter the list is about. Under an "Any"
+             * criteria a series may have matched on another filter only; its
+             * value is then a different metric in a different unit, so it is
+             * shown with that metric named and never ranked against the rest.
+             */
+            const matchedContexts = match.metricContexts && match.metricContexts.length > 0
+                ? match.metricContexts
+                : match.metricContext
+                    ? [match.metricContext]
+                    : [];
+            const targetContext = targetAlias
+                ? matchedContexts.find((c) => {
+                    return (c.alias || "").toLowerCase() === targetAlias;
+                })
+                : matchedContexts[0];
+            const context = targetContext || matchedContexts[0];
+            const valueNote = !targetContext && context
+                ? context.displayName || `\`${context.alias}\``
+                : undefined;
+            const seriesIdentity = input.toIdentity(PlatformResourceIdentity.withBothAttributeSpellings(match.labels || {}));
+            const sample = ((_a = context === null || context === void 0 ? void 0 : context.breachingSamples) === null || _a === void 0 ? void 0 : _a[0]) || (context === null || context === void 0 ? void 0 : context.breachingSample);
+            const sampleAttributes = MonitorCriteriaEvaluator.getSampleRawAttributes(sample);
+            /*
+             * The breaching sample's own datapoint first; then a datapoint of
+             * each of the series' queries, because a FORMULA's sample carries
+             * only the group-by labels — a Proxmox ratio over `id` would
+             * otherwise never learn whether the id is a node or a guest.
+             * with<Platform>Context only ever borrows what the series' labels
+             * guarantee is shared, so a row from any of them is safe.
+             */
+            const contexts = [
+                ...(sampleAttributes ? [sampleAttributes] : []),
+                ...input.seriesContextAttributes(match.fingerprint),
+            ];
+            const identity = contexts.reduce((current, attributes) => {
+                return input.withContext(current, input.toIdentity(PlatformResourceIdentity.withBothAttributeSpellings(attributes)));
+            }, seriesIdentity);
+            const value = MonitorCriteriaEvaluator.getWorstValue({
+                context: context,
+                worstIsLowest: input.worstIsLowest,
+            });
+            const seriesLabels = !input.namesObject(identity)
+                ? MonitorCriteriaEvaluator.getNonEmptyLabels(match.labels)
+                : undefined;
+            return Object.assign(Object.assign(Object.assign({ identity: identity, value: value }, (valueNote ? { valueNote: valueNote } : {})), (seriesLabels ? { seriesLabels: seriesLabels } : {})), { formattedValue: value === null
+                    ? "no data"
+                    : MetricValueFormatter.format({
+                        value: value,
+                        unit: context === null || context === void 0 ? void 0 : context.unit,
+                        metricName: MonitorCriteriaEvaluator.metricNameForUnitHeuristics({
+                            metricName: context === null || context === void 0 ? void 0 : context.metricName,
+                            isFormula: context === null || context === void 0 ? void 0 : context.isFormula,
+                        }),
+                    }) });
+        });
+        return MonitorCriteriaEvaluator.sortAffectedRows({
+            rows: rows,
+            worstIsLowest: input.worstIsLowest,
+        });
+    }
+    /**
+     * The "Affected Resources" rows of an UNGROUPED platform monitor, from
+     * the worker's raw datapoint scan of the criteria's own query: every
+     * resource the matched criteria's direction says breached, worst first.
+     */
+    static buildScanAffectedRows(input) {
+        /*
+         * The scan's values are in the metric's own unit, but the criteria
+         * compared its threshold in the filter's threshold unit (or the
+         * query's legendUnit). Judge each row in that unit — a "< 1 min"
+         * uptime criteria must not test 30 seconds against 1 — and show it in
+         * its own.
+         */
+        const valueUnit = PlatformMetricUnitUtil.getMetricUnit({
+            platform: input.platform,
+            metricName: input.breakdown.metricName,
+            declaredUnit: input.breakdown.metricUnit,
+        });
+        const toComparisonUnit = (value) => {
+            if (!valueUnit ||
+                !input.comparisonUnit ||
+                valueUnit === input.comparisonUnit) {
+                return value;
+            }
+            return MetricUnitUtil.convertToMetricUnit({
+                value: value,
+                fromUnit: valueUnit,
+                metricUnit: input.comparisonUnit,
+            });
+        };
+        const collect = (matches) => {
+            return MonitorCriteriaEvaluator.collectScanRows({
+                platform: input.platform,
+                breakdown: input.breakdown,
+                breach: input.breach,
+                matches: matches,
+                toComparisonUnit: toComparisonUnit,
+            });
+        };
+        let rows = collect(input.breach.matches);
+        if (rows.length === 0 && input.breach.fallbackMatches) {
+            rows = collect(input.breach.fallbackMatches);
+        }
+        return MonitorCriteriaEvaluator.sortAffectedRows({
+            rows: rows,
+            worstIsLowest: input.breach.worstIsLowest,
+        });
+    }
+    /*
+     * One pass of buildScanAffectedRows: the resources `matches` accepts,
+     * each judged in the comparison unit and shown in its own.
+     */
+    static collectScanRows(input) {
+        var _a;
+        const toComparisonUnit = input.toComparisonUnit;
+        const rows = [];
+        for (const resource of input.breakdown.affectedResources) {
+            const highest = resource.metricValue;
+            const lowest = (_a = resource.lowestMetricValue) !== null && _a !== void 0 ? _a : resource.metricValue;
+            /*
+             * A fall criteria breached on the resource's lowest sample in the
+             * window, not its highest.
+             */
+            const end = input.breach.pickEnd
+                ? input.breach.pickEnd({
+                    highest: toComparisonUnit(highest),
+                    lowest: toComparisonUnit(lowest),
+                })
+                : input.breach.worstIsLowest
+                    ? "lowest"
+                    : "highest";
+            const value = end === "lowest" ? lowest : highest;
+            if (!input.matches(toComparisonUnit(value))) {
+                continue;
+            }
+            rows.push({
+                identity: resource,
+                value: value,
+                formattedValue: MonitorCriteriaEvaluator.formatPlatformMetricValue({
+                    platform: input.platform,
+                    metricName: input.breakdown.metricName,
+                    metricUnit: input.breakdown.metricUnit,
+                    value: value,
+                }),
+            });
+        }
+        return rows;
+    }
+    /*
+     * Worst first. Rows valued by another filter (valueNote) follow, in the
+     * order they came — their numbers are in another unit and cannot be
+     * ranked against these — and a series with no value (a no-data trigger)
+     * comes last.
+     */
+    static sortAffectedRows(input) {
+        const group = (row) => {
+            if (row.value === null) {
+                return 2;
+            }
+            return row.valueNote ? 1 : 0;
+        };
+        return [...input.rows].sort((a, b) => {
+            if (group(a) !== group(b)) {
+                return group(a) - group(b);
+            }
+            if (group(a) !== 0 || a.value === null || b.value === null) {
+                return 0;
+            }
+            return input.worstIsLowest ? a.value - b.value : b.value - a.value;
+        });
+    }
+    /*
+     * The value cell of a platform list entry: bold, and — for a row valued
+     * by another filter than the list's — followed by that filter's metric.
+     */
+    static renderAffectedRowValue(row) {
+        return row.valueNote
+            ? `**${row.formattedValue}** (${row.valueNote})`
+            : `**${row.formattedValue}**`;
+    }
+    static getNonEmptyLabels(labels) {
+        const result = {};
+        for (const key of Object.keys(labels || {})) {
+            const value = (labels || {})[key];
+            if (value !== undefined && value !== null && value !== "") {
+                result[key] = value;
+            }
+        }
+        return Object.keys(result).length > 0 ? result : undefined;
+    }
+    /*
+     * A list entry for a series whose labels name no platform object: titled
+     * "Series" and named by its labels (their stored `resource.` prefix
+     * dropped), so rows stay distinguishable.
+     */
+    static getSeriesLabelEntry(input) {
+        const name = Object.keys(input.labels)
+            .map((key) => {
+            const displayKey = key.startsWith("resource.")
+                ? key.substring("resource.".length)
+                : key;
+            return AffectedResourceList.code(`${displayKey}=${String(input.labels[key])}`);
+        })
+            .join(", ");
+        return {
+            kind: "Series",
+            name: name,
+            value: input.value,
+            details: [],
+        };
+    }
+    /**
+     * A series' worst value in the display unit: its worst breaching sample,
+     * or — when the criteria compared an aggregate no single sample crossed
+     * (a Sum) — its worst sample in the window. Null for a series that
+     * matched with no samples at all (the no-data policy).
+     */
+    static getWorstValue(input) {
+        var _a, _b, _c;
+        const breachingValues = (((_a = input.context) === null || _a === void 0 ? void 0 : _a.breachingSamples) ||
+            (((_b = input.context) === null || _b === void 0 ? void 0 : _b.breachingSample) ? [input.context.breachingSample] : []))
+            .map((sample) => {
+            return sample.value;
+        })
+            .filter((value) => {
+            return typeof value === "number" && Number.isFinite(value);
+        });
+        if (breachingValues.length > 0) {
+            return input.worstIsLowest
+                ? Math.min(...breachingValues)
+                : Math.max(...breachingValues);
+        }
+        const range = (_c = input.context) === null || _c === void 0 ? void 0 : _c.sampleValueRange;
+        if (range) {
+            return input.worstIsLowest ? range.min : range.max;
+        }
+        return null;
+    }
+    /**
+     * One datapoint's attributes from each QUERY slot of a series (the
+     * formula slots after them carry only group-by labels). Per-series query
+     * rows keep their datapoint's full attribute map under `attributes`.
+     */
+    static getSeriesQueryRowAttributes(input) {
+        var _a, _b;
+        const series = (input.seriesBreakdown || []).find((s) => {
+            return s.fingerprint === input.fingerprint;
+        });
+        if (!series) {
+            return [];
+        }
+        const result = [];
+        for (let i = 0; i < input.queryCount; i++) {
+            const row = (_b = (_a = series.aggregatedResults[i]) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b[0];
+            const attributes = row === null || row === void 0 ? void 0 : row["attributes"];
+            if (attributes && typeof attributes === "object") {
+                result.push(attributes);
+            }
+        }
+        return result;
+    }
+    /**
+     * The raw datapoint attributes a breaching sample carries. A sample from
+     * a per-series query row keeps the datapoint's full attribute map under
+     * `attributes`; a formula row carries only its group attributes there.
+     */
+    static getSampleRawAttributes(sample) {
+        if (!sample || !sample.attributes) {
+            return undefined;
+        }
+        const nested = sample.attributes["attributes"];
+        if (nested && typeof nested === "object" && !Array.isArray(nested)) {
+            return nested;
+        }
+        return sample.attributes;
+    }
+    /**
+     * The rows of a platform's "Affected Resources" list for the matched
+     * criteria, from whichever source measured what the criteria compared:
+     * the per-series matches of a grouped monitor, else the raw scan of the
+     * criteria's own query. Null when neither applies (an ungrouped formula
+     * has no per-resource values to list).
+     */
+    static getPlatformAffectedRows(input) {
+        var _a, _b, _c, _d;
+        if (input.perSeriesMatches && input.perSeriesMatches.length > 0) {
+            const queryCount = ((_b = (_a = MonitorStep.getMetricsViewConfig(input.monitorStep)) === null || _a === void 0 ? void 0 : _a.queryConfigs) === null || _b === void 0 ? void 0 : _b.length) || 0;
+            return MonitorCriteriaEvaluator.buildSeriesAffectedRows({
+                perSeriesMatches: input.perSeriesMatches,
+                worstIsLowest: input.breach.worstIsLowest,
+                toIdentity: input.toIdentity,
+                withContext: input.withContext,
+                namesObject: input.namesObject,
+                targetAlias: (_c = input.target) === null || _c === void 0 ? void 0 : _c.alias,
+                seriesContextAttributes: (fingerprint) => {
+                    return MonitorCriteriaEvaluator.getSeriesQueryRowAttributes({
+                        seriesBreakdown: input.metricResponse.seriesBreakdown,
+                        fingerprint: fingerprint,
+                        queryCount: queryCount,
+                    });
+                },
+            });
+        }
+        if (!input.breakdown || input.breakdown.affectedResources.length === 0) {
+            return null;
+        }
+        return MonitorCriteriaEvaluator.buildScanAffectedRows({
+            platform: input.platform,
+            breakdown: input.breakdown,
+            breach: input.breach,
+            comparisonUnit: (_d = input.target) === null || _d === void 0 ? void 0 : _d.comparisonUnit,
+        });
     }
     /*
      * One Kubernetes resource as an "Affected Resources" list item.
@@ -1553,247 +2223,372 @@ ${contextBlock}
         };
     }
     static async buildKubernetesRootCauseContext(input) {
-        var _a;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         const metricResponse = input.dataToProcess;
-        const breakdown = metricResponse.kubernetesResourceBreakdown;
-        if (!breakdown) {
+        const target = MonitorCriteriaEvaluator.resolveCriteriaMetricTarget({
+            criteriaInstance: input.criteriaInstance,
+            monitorStep: input.monitorStep,
+            metricResponse: metricResponse,
+        });
+        const breakdown = MonitorCriteriaEvaluator.selectPlatformBreakdown({
+            breakdowns: metricResponse.kubernetesResourceBreakdowns,
+            legacyBreakdown: metricResponse.kubernetesResourceBreakdown,
+            target: target,
+        });
+        const hasSeries = Boolean(input.perSeriesMatches && input.perSeriesMatches.length > 0);
+        /*
+         * Nothing to say only when there is neither a list nor a monitor to
+         * describe. An ungrouped formula criteria has no raw scan of its own
+         * and no series, but its cluster and formula are still worth naming.
+         */
+        if (!breakdown &&
+            !hasSeries &&
+            !((_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.kubernetesMonitor)) {
             return null;
         }
+        const clusterName = (breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) ||
+            ((_c = (_b = input.monitorStep.data) === null || _b === void 0 ? void 0 : _b.kubernetesMonitor) === null || _c === void 0 ? void 0 : _c.clusterIdentifier) ||
+            "Unknown";
+        /*
+         * The metric the analysis below reasons about: the criteria's own
+         * query, or a formula's numerator. Without a criteria to go on, the
+         * breakdown's metric, as before.
+         */
+        const analysisMetricName = MonitorCriteriaEvaluator.getAnalysisMetricName(target) ||
+            (breakdown === null || breakdown === void 0 ? void 0 : breakdown.metricName) ||
+            "";
         const sections = [];
         // Cluster context
         const clusterDetails = [];
-        clusterDetails.push(`- Cluster: ${breakdown.clusterName}`);
-        clusterDetails.push(`- Metric: ${breakdown.metricFriendlyName} (\`${breakdown.metricName}\`)`);
-        if (breakdown.attributes["k8s.namespace.name"]) {
-            clusterDetails.push(`- Namespace: ${breakdown.attributes["k8s.namespace.name"]}`);
+        clusterDetails.push(`- Cluster: ${clusterName}`);
+        clusterDetails.push(...MonitorCriteriaEvaluator.describeCriteriaMetric({
+            platform: "kubernetes",
+            target: target,
+            breakdown: breakdown,
+        }));
+        /*
+         * The worker records the query's attribute filters under the stored,
+         * `resource.`-prefixed key; the bare key never occurs, which is why
+         * this line never rendered.
+         */
+        const namespaceFilter = (breakdown === null || breakdown === void 0 ? void 0 : breakdown.attributes["resource.k8s.namespace.name"]) ||
+            (breakdown === null || breakdown === void 0 ? void 0 : breakdown.attributes["k8s.namespace.name"]) ||
+            ((_f = (_e = (_d = input.monitorStep.data) === null || _d === void 0 ? void 0 : _d.kubernetesMonitor) === null || _e === void 0 ? void 0 : _e.resourceFilters) === null || _f === void 0 ? void 0 : _f.namespace);
+        if (namespaceFilter) {
+            clusterDetails.push(`- Namespace: ${namespaceFilter}`);
         }
         sections.push(`**Kubernetes Cluster Details**\n${clusterDetails.join("\n")}`);
-        // Affected resources
-        if (breakdown.affectedResources && breakdown.affectedResources.length > 0) {
-            /*
-             * Keep the rows that satisfy the criteria that just matched, worst
-             * first — NOT simply the non-zero rows. k8s-node-not-ready fires on
-             * `k8s.node.condition_ready = 0`, so the zero rows are the NotReady
-             * nodes; the old hardcoded `> 0` dropped exactly those and named a
-             * healthy node in the analysis below.
-             */
-            const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
-                criteriaInstance: input.criteriaInstance,
-                floorEqualityFiresOnFall: true,
-            });
-            const sortedResources = breakdown.affectedResources
-                .map((r) => {
-                var _a;
-                /*
-                 * A fall criteria breached on the resource's lowest sample
-                 * in the window, not its highest.
-                 */
-                return breach.worstIsLowest
-                    ? Object.assign(Object.assign({}, r), { metricValue: (_a = r.lowestMetricValue) !== null && _a !== void 0 ? _a : r.metricValue }) : r;
-            })
-                .filter((r) => {
-                return breach.matches(r.metricValue);
-            })
-                .sort((a, b) => {
-                return breach.worstIsLowest
-                    ? a.metricValue - b.metricValue
-                    : b.metricValue - a.metricValue;
-            });
-            if (sortedResources.length === 0) {
-                return sections.join("\n");
-            }
-            // Show top 10 affected resources
-            const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
-            sections.push(AffectedResourceList.render({
-                heading: "Affected Resources",
-                overflowNoun: "affected resources",
-                totalCount: sortedResources.length,
-                entries: resourcesToShow.map((resource) => {
-                    return MonitorCriteriaEvaluator.getKubernetesAffectedResourceEntry({
-                        resource: resource,
-                        clusterName: breakdown.clusterName,
-                        value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                            platform: "kubernetes",
-                            metricName: breakdown.metricName,
-                            value: resource.metricValue,
-                        }),
+        /*
+         * Keep the rows that satisfy the criteria that just matched, worst
+         * first — NOT simply the non-zero rows. k8s-node-not-ready fires on
+         * `k8s.node.condition_ready = 0`, so the zero rows are the NotReady
+         * nodes; the old hardcoded `> 0` dropped exactly those and named a
+         * healthy node in the analysis below.
+         */
+        const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+            criteriaInstance: input.criteriaInstance,
+            floorEqualityFiresOnFall: true,
+        });
+        const rows = MonitorCriteriaEvaluator.getPlatformAffectedRows({
+            platform: "kubernetes",
+            perSeriesMatches: input.perSeriesMatches,
+            namesObject: (identity) => {
+                return Boolean(identity.containerName ||
+                    identity.podName ||
+                    identity.workloadName ||
+                    identity.nodeName ||
+                    identity.namespace);
+            },
+            metricResponse: metricResponse,
+            monitorStep: input.monitorStep,
+            target: target,
+            breakdown: breakdown,
+            breach: breach,
+            toIdentity: PlatformResourceIdentity.kubernetes,
+            withContext: PlatformResourceIdentity.withKubernetesContext,
+        });
+        if (!rows || rows.length === 0) {
+            return sections.join("\n");
+        }
+        // Show top 10 affected resources
+        const rowsToShow = rows.slice(0, AffectedResourceList.MAX_ENTRIES);
+        sections.push(AffectedResourceList.render({
+            heading: "Affected Resources",
+            overflowNoun: "affected resources",
+            totalCount: rows.length,
+            entries: rowsToShow.map((row) => {
+                return row.seriesLabels
+                    ? MonitorCriteriaEvaluator.getSeriesLabelEntry({
+                        labels: row.seriesLabels,
+                        value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
+                    })
+                    : MonitorCriteriaEvaluator.getKubernetesAffectedResourceEntry({
+                        resource: row.identity,
+                        clusterName: clusterName,
+                        value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
                     });
-                }),
-            }));
-            // Add root cause analysis based on metric type
-            const analysis = MonitorCriteriaEvaluator.buildKubernetesRootCauseAnalysis({
-                breakdown: breakdown,
-                topResource: resourcesToShow[0],
+            }),
+        }));
+        const topRow = rowsToShow[0];
+        const topResource = Object.assign(Object.assign({}, topRow.identity), { metricValue: (_g = topRow.value) !== null && _g !== void 0 ? _g : 0 });
+        /*
+         * Add root cause analysis based on metric type — unless the worst row
+         * is a series that matched with no data at all, or one valued by a
+         * different filter than the one analysed, which no sentence below
+         * ("memory usage is at ...") can describe.
+         */
+        const analysis = topRow.value === null || topRow.valueNote
+            ? null
+            : MonitorCriteriaEvaluator.buildKubernetesRootCauseAnalysis({
+                breakdown: {
+                    clusterName: clusterName,
+                    metricName: analysisMetricName,
+                    metricFriendlyName: ((target === null || target === void 0 ? void 0 : target.isFormula) ? target.displayName : undefined) ||
+                        ((breakdown === null || breakdown === void 0 ? void 0 : breakdown.metricName) === analysisMetricName
+                            ? breakdown.metricFriendlyName
+                            : undefined) ||
+                        MonitorCriteriaEvaluator.getPlatformMetricFriendlyName({
+                            platform: "kubernetes",
+                            metricName: analysisMetricName,
+                        }) ||
+                        analysisMetricName,
+                    affectedResources: [],
+                    attributes: (breakdown === null || breakdown === void 0 ? void 0 : breakdown.attributes) || {},
+                    metricUnit: breakdown === null || breakdown === void 0 ? void 0 : breakdown.metricUnit,
+                },
+                topResource: topResource,
+                topResourceValue: topRow.formattedValue,
+                target: target,
             });
-            if (analysis) {
-                sections.push(`\n\n**Root Cause Analysis**\n${analysis}`);
-            }
-            // Fetch recent container logs for the top affected resource during CrashLoopBackOff
-            if ((breakdown.metricName === "k8s.container.restarts" ||
-                breakdown.metricName.includes("restart")) &&
-                input.monitor.projectId) {
-                const topResource = resourcesToShow[0];
-                try {
-                    const logAttributes = {};
-                    if (breakdown.clusterName) {
-                        logAttributes["resource.k8s.cluster.name"] = breakdown.clusterName;
-                    }
-                    if (topResource.podName) {
-                        logAttributes["resource.k8s.pod.name"] = topResource.podName;
-                    }
-                    if (topResource.containerName) {
-                        logAttributes["resource.k8s.container.name"] =
-                            topResource.containerName;
-                    }
-                    if (topResource.namespace) {
-                        logAttributes["resource.k8s.namespace.name"] =
-                            topResource.namespace;
-                    }
-                    const now = OneUptimeDate.getCurrentDate();
-                    const fifteenMinutesAgo = OneUptimeDate.addRemoveMinutes(now, -15);
-                    const logs = await LogAggregationService.getExportLogs({
-                        projectId: input.monitor.projectId,
-                        startTime: fifteenMinutesAgo,
-                        endTime: now,
-                        limit: 50,
-                        attributes: logAttributes,
-                    });
-                    if (logs.length > 0) {
-                        const logLines = logs.map((log) => {
-                            const timestamp = log["time"] ? String(log["time"]) : "";
-                            const severity = log["severityText"]
-                                ? String(log["severityText"])
-                                : "INFO";
-                            const body = log["body"] ? String(log["body"]) : "";
-                            return `\`${timestamp}\` **${severity}** ${body}`;
-                        });
-                        sections.push(`\n\n**Recent Container Logs** (${topResource.podName || "unknown pod"} / ${topResource.containerName || "unknown container"}, last 15 minutes)\n\n${logLines.join("\n\n")}`);
-                    }
+        if (analysis) {
+            sections.push(`\n\n**Root Cause Analysis**\n${analysis}`);
+        }
+        // Fetch recent container logs for the top affected resource during CrashLoopBackOff
+        if ((analysisMetricName === "k8s.container.restarts" ||
+            analysisMetricName.includes("restart")) &&
+            input.monitor.projectId) {
+            try {
+                const logAttributes = {};
+                if (clusterName) {
+                    logAttributes["resource.k8s.cluster.name"] = clusterName;
                 }
-                catch (err) {
-                    const k8sLogAttributes = {
-                        projectId: (_a = input.monitor.projectId) === null || _a === void 0 ? void 0 : _a.toString(),
-                    };
-                    logger.error("Failed to fetch container logs for root cause context", k8sLogAttributes);
-                    logger.error(err, k8sLogAttributes);
+                if (topResource.podName) {
+                    logAttributes["resource.k8s.pod.name"] = topResource.podName;
+                }
+                if (topResource.containerName) {
+                    logAttributes["resource.k8s.container.name"] =
+                        topResource.containerName;
                 }
+                if (topResource.namespace) {
+                    logAttributes["resource.k8s.namespace.name"] = topResource.namespace;
+                }
+                const now = OneUptimeDate.getCurrentDate();
+                const fifteenMinutesAgo = OneUptimeDate.addRemoveMinutes(now, -15);
+                const logs = await LogAggregationService.getExportLogs({
+                    projectId: input.monitor.projectId,
+                    startTime: fifteenMinutesAgo,
+                    endTime: now,
+                    limit: 50,
+                    attributes: logAttributes,
+                });
+                if (logs.length > 0) {
+                    const logLines = logs.map((log) => {
+                        const timestamp = log["time"] ? String(log["time"]) : "";
+                        const severity = log["severityText"]
+                            ? String(log["severityText"])
+                            : "INFO";
+                        const body = log["body"] ? String(log["body"]) : "";
+                        return `\`${timestamp}\` **${severity}** ${body}`;
+                    });
+                    sections.push(`\n\n**Recent Container Logs** (${topResource.podName || "unknown pod"} / ${topResource.containerName || "unknown container"}, last 15 minutes)\n\n${logLines.join("\n\n")}`);
+                }
+            }
+            catch (err) {
+                const k8sLogAttributes = {
+                    projectId: (_h = input.monitor.projectId) === null || _h === void 0 ? void 0 : _h.toString(),
+                };
+                logger.error("Failed to fetch container logs for root cause context", k8sLogAttributes);
+                logger.error(err, k8sLogAttributes);
             }
         }
         return sections.join("\n");
     }
-    static buildDockerRootCauseContext(input) {
-        var _a, _b, _c, _d, _e, _f, _g;
-        const metricResponse = input.dataToProcess;
+    /**
+     * The "- Metric:" line of a telemetry resource's details block: what
+     * the matched criteria actually compared.
+     *
+     * It used to name `queryConfigs[0]` unconditionally, so a criteria on a
+     * formula — Host CPU busy `(host_cpu_user + host_cpu_system) * 100`,
+     * Docker restarts `max - min` — was reported as its first operand. The
+     * metric context MetricMonitorCriteria records at evaluation time
+     * already says whether the criteria resolved to a query or a formula
+     * (including its fall back to the first query when the alias names
+     * nothing), so the line is read from there.
+     *
+     * A formula is named by its legend, which is what the threshold was
+     * written against ("CPU Busy (%)"); its expression and the metric behind
+     * each variable are spelled out in the Metric Details below. With no
+     * metric context — a criteria with no metric-value filter — the step's
+     * first query is named, as before.
+     */
+    static describeCriteriaMetricLine(input) {
+        var _a, _b, _c, _d, _e, _f, _g, _h;
+        const ctx = input.ctx;
+        if (ctx === null || ctx === void 0 ? void 0 : ctx.isFormula) {
+            const formula = (((_a = input.metricViewConfig) === null || _a === void 0 ? void 0 : _a.formulaConfigs) || []).find((f) => {
+                var _a;
+                return ((_a = f.metricAliasData) === null || _a === void 0 ? void 0 : _a.metricVariable) === ctx.alias;
+            });
+            const legend = (((_b = formula === null || formula === void 0 ? void 0 : formula.metricAliasData) === null || _b === void 0 ? void 0 : _b.legend) ||
+                ((_c = formula === null || formula === void 0 ? void 0 : formula.metricAliasData) === null || _c === void 0 ? void 0 : _c.title) ||
+                "").trim();
+            if (legend && legend !== ctx.alias) {
+                return `- Metric: ${legend}`;
+            }
+            return `- Metric: \`${ctx.alias}\` (formula)`;
+        }
+        if (ctx === null || ctx === void 0 ? void 0 : ctx.metricName) {
+            return `- Metric: \`${ctx.metricName}\``;
+        }
+        const firstQueryMetricName = (_h = (_g = (_f = (_e = (_d = input.metricViewConfig) === null || _d === void 0 ? void 0 : _d.queryConfigs) === null || _e === void 0 ? void 0 : _e[0]) === null || _f === void 0 ? void 0 : _f.metricQueryData) === null || _g === void 0 ? void 0 : _g.filterData) === null || _h === void 0 ? void 0 : _h.metricName;
+        return firstQueryMetricName
+            ? `- Metric: \`${firstQueryMetricName}\``
+            : null;
+    }
+    /**
+     * Root-cause context for a telemetry monitor that watches one host,
+     * container set or device fleet: the resource it is scoped to, then the
+     * same Metric Details and Breaching Samples a Metrics monitor gets.
+     *
+     * These monitors used to follow the identity lines with a "Metric
+     * Summary" that only counted the data points in each result — one line
+     * per query AND per formula, so the Host CPU template printed three
+     * identical "- 5 metric data point(s) returned" lines and never the
+     * value that breached. MetricMonitorCriteria fills the filter's metric
+     * context for every metric-backed monitor type, so the unit, formula,
+     * components and unit-formatted samples were there all along.
+     *
+     * `identityLines` is null when the step carries no config for the
+     * monitor type; the metric details are still rendered from the context.
+     */
+    static buildTelemetryResourceRootCauseContext(input) {
         const sections = [];
+        if (input.identityLines) {
+            const metricLine = MonitorCriteriaEvaluator.describeCriteriaMetricLine({
+                ctx: MonitorCriteriaEvaluator.getMetricCriteriaContext(input.criteriaInstance),
+                metricViewConfig: MonitorStep.getMetricsViewConfig(input.monitorStep),
+            });
+            const lines = metricLine
+                ? [...input.identityLines, metricLine]
+                : input.identityLines;
+            sections.push(`**${input.heading}**\n${lines.join("\n")}`);
+        }
+        const metricDetails = input.criteriaInstance
+            ? MonitorCriteriaEvaluator.buildMetricRootCauseContext({
+                criteriaInstance: input.criteriaInstance,
+                monitor: input.monitor,
+                monitorStep: input.monitorStep,
+            })
+            : null;
+        if (metricDetails) {
+            sections.push(sections.length > 0 ? `\n\n${metricDetails}` : metricDetails);
+        }
+        return sections.length > 0 ? sections.join("\n") : null;
+    }
+    static buildDockerRootCauseContext(input) {
+        var _a, _b, _c;
         // Docker host context
         const dockerMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.dockerMonitor;
+        let hostDetails = null;
         if (dockerMonitor) {
-            const hostDetails = [];
-            hostDetails.push(`- Host: ${dockerMonitor.hostIdentifier || "Unknown"}`);
+            hostDetails = [`- Host: ${dockerMonitor.hostIdentifier || "Unknown"}`];
             if ((_b = dockerMonitor.containerFilters) === null || _b === void 0 ? void 0 : _b.containerName) {
                 hostDetails.push(`- Container Name Filter: ${dockerMonitor.containerFilters.containerName}`);
             }
             if ((_c = dockerMonitor.containerFilters) === null || _c === void 0 ? void 0 : _c.containerImage) {
                 hostDetails.push(`- Container Image Filter: ${dockerMonitor.containerFilters.containerImage}`);
             }
-            // Add metric name from the query config
-            if (((_e = (_d = dockerMonitor.metricViewConfig) === null || _d === void 0 ? void 0 : _d.queryConfigs) === null || _e === void 0 ? void 0 : _e.length) > 0 &&
-                dockerMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_g = (_f = dockerMonitor.metricViewConfig
-                    .queryConfigs[0].metricQueryData) === null || _f === void 0 ? void 0 : _f.filterData) === null || _g === void 0 ? void 0 : _g.metricName;
-                if (metricName) {
-                    hostDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
-            sections.push(`**Docker Host Details**\n${hostDetails.join("\n")}`);
         }
-        // Metric results summary
-        if (metricResponse.metricResult && metricResponse.metricResult.length > 0) {
-            const resultDetails = [];
-            for (const result of metricResponse.metricResult) {
-                if (result.data && result.data.length > 0) {
-                    resultDetails.push(`- ${result.data.length} metric data point(s) returned`);
-                }
-            }
-            if (resultDetails.length > 0) {
-                sections.push(`\n\n**Metric Summary**\n${resultDetails.join("\n")}`);
-            }
-        }
-        return sections.length > 0 ? sections.join("\n") : null;
+        return MonitorCriteriaEvaluator.buildTelemetryResourceRootCauseContext({
+            heading: "Docker Host Details",
+            identityLines: hostDetails,
+            monitor: input.monitor,
+            monitorStep: input.monitorStep,
+            criteriaInstance: input.criteriaInstance,
+        });
     }
     static buildHostRootCauseContext(input) {
-        var _a, _b, _c, _d, _e;
-        const metricResponse = input.dataToProcess;
-        const sections = [];
+        var _a;
         // Host context
         const hostMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.hostMonitor;
-        if (hostMonitor) {
-            const hostDetails = [];
-            hostDetails.push(`- Host: ${hostMonitor.hostIdentifier || "Unknown"}`);
-            // Add metric name from the query config
-            if (((_c = (_b = hostMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c.length) > 0 &&
-                hostMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_e = (_d = hostMonitor.metricViewConfig.queryConfigs[0]
-                    .metricQueryData) === null || _d === void 0 ? void 0 : _d.filterData) === null || _e === void 0 ? void 0 : _e.metricName;
-                if (metricName) {
-                    hostDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
-            sections.push(`**Host Details**\n${hostDetails.join("\n")}`);
-        }
-        // Metric results summary
-        if (metricResponse.metricResult && metricResponse.metricResult.length > 0) {
-            const resultDetails = [];
-            for (const result of metricResponse.metricResult) {
-                if (result.data && result.data.length > 0) {
-                    resultDetails.push(`- ${result.data.length} metric data point(s) returned`);
-                }
-            }
-            if (resultDetails.length > 0) {
-                sections.push(`\n\n**Metric Summary**\n${resultDetails.join("\n")}`);
-            }
-        }
-        return sections.length > 0 ? sections.join("\n") : null;
+        return MonitorCriteriaEvaluator.buildTelemetryResourceRootCauseContext({
+            heading: "Host Details",
+            identityLines: hostMonitor
+                ? [`- Host: ${hostMonitor.hostIdentifier || "Unknown"}`]
+                : null,
+            monitor: input.monitor,
+            monitorStep: input.monitorStep,
+            criteriaInstance: input.criteriaInstance,
+        });
     }
     static buildPodmanRootCauseContext(input) {
-        var _a, _b, _c, _d, _e, _f, _g;
-        const metricResponse = input.dataToProcess;
-        const sections = [];
+        var _a, _b, _c;
         // Podman host context
         const podmanMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.podmanMonitor;
+        let hostDetails = null;
         if (podmanMonitor) {
-            const hostDetails = [];
-            hostDetails.push(`- Host: ${podmanMonitor.hostIdentifier || "Unknown"}`);
+            hostDetails = [`- Host: ${podmanMonitor.hostIdentifier || "Unknown"}`];
             if ((_b = podmanMonitor.containerFilters) === null || _b === void 0 ? void 0 : _b.containerName) {
                 hostDetails.push(`- Container Name Filter: ${podmanMonitor.containerFilters.containerName}`);
             }
             if ((_c = podmanMonitor.containerFilters) === null || _c === void 0 ? void 0 : _c.containerImage) {
                 hostDetails.push(`- Container Image Filter: ${podmanMonitor.containerFilters.containerImage}`);
             }
-            // Add metric name from the query config
-            if (((_e = (_d = podmanMonitor.metricViewConfig) === null || _d === void 0 ? void 0 : _d.queryConfigs) === null || _e === void 0 ? void 0 : _e.length) > 0 &&
-                podmanMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_g = (_f = podmanMonitor.metricViewConfig
-                    .queryConfigs[0].metricQueryData) === null || _f === void 0 ? void 0 : _f.filterData) === null || _g === void 0 ? void 0 : _g.metricName;
-                if (metricName) {
-                    hostDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
-            sections.push(`**Podman Host Details**\n${hostDetails.join("\n")}`);
         }
-        // Metric results summary
-        if (metricResponse.metricResult && metricResponse.metricResult.length > 0) {
-            const resultDetails = [];
-            for (const result of metricResponse.metricResult) {
-                if (result.data && result.data.length > 0) {
-                    resultDetails.push(`- ${result.data.length} metric data point(s) returned`);
-                }
+        return MonitorCriteriaEvaluator.buildTelemetryResourceRootCauseContext({
+            heading: "Podman Host Details",
+            identityLines: hostDetails,
+            monitor: input.monitor,
+            monitorStep: input.monitorStep,
+            criteriaInstance: input.criteriaInstance,
+        });
+    }
+    static buildIoTRootCauseContext(input) {
+        var _a, _b, _c, _d, _e, _f;
+        // IoT fleet / device context
+        const iotMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.iotMonitor;
+        let deviceDetails = null;
+        if (iotMonitor) {
+            deviceDetails = [`- Fleet: ${iotMonitor.fleetIdentifier || "Unknown"}`];
+            /*
+             * The device that breached. Every IoT template groups by the
+             * `device.id` label, so the matched series names it; an ungrouped
+             * monitor has no series labels and falls back to the step's own
+             * device filter below.
+             */
+            const breachingDeviceId = (_c = (_b = MonitorCriteriaEvaluator.getMetricCriteriaContext(input.criteriaInstance)) === null || _b === void 0 ? void 0 : _b.seriesLabels) === null || _c === void 0 ? void 0 : _c[IOT_DEVICE_ID_ATTRIBUTE_KEY];
+            if (breachingDeviceId !== undefined &&
+                breachingDeviceId !== null &&
+                String(breachingDeviceId) !== "") {
+                deviceDetails.push(`- Device: ${AffectedResourceList.code(String(breachingDeviceId))}`);
             }
-            if (resultDetails.length > 0) {
-                sections.push(`\n\n**Metric Summary**\n${resultDetails.join("\n")}`);
+            if ((_d = iotMonitor.resourceFilters) === null || _d === void 0 ? void 0 : _d.deviceId) {
+                deviceDetails.push(`- Device ID Filter: ${iotMonitor.resourceFilters.deviceId}`);
+            }
+            if ((_e = iotMonitor.resourceFilters) === null || _e === void 0 ? void 0 : _e.deviceType) {
+                deviceDetails.push(`- Device Type Filter: ${iotMonitor.resourceFilters.deviceType}`);
+            }
+            if ((_f = iotMonitor.resourceFilters) === null || _f === void 0 ? void 0 : _f.scope) {
+                deviceDetails.push(`- Scope Filter: ${iotMonitor.resourceFilters.scope}`);
             }
         }
-        return sections.length > 0 ? sections.join("\n") : null;
+        return MonitorCriteriaEvaluator.buildTelemetryResourceRootCauseContext({
+            heading: "IoT Device Details",
+            identityLines: deviceDetails,
+            monitor: input.monitor,
+            monitorStep: input.monitorStep,
+            criteriaInstance: input.criteriaInstance,
+        });
     }
     /*
      * What a Proxmox resource is, from the `pve.type` / `pve.scope` the
@@ -1865,87 +2660,100 @@ ${contextBlock}
         };
     }
     static buildProxmoxRootCauseContext(input) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         const metricResponse = input.dataToProcess;
-        const breakdown = metricResponse.proxmoxResourceBreakdown;
-        const sections = [];
         // Proxmox cluster context
         const proxmoxMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.proxmoxMonitor;
+        const target = MonitorCriteriaEvaluator.resolveCriteriaMetricTarget({
+            criteriaInstance: input.criteriaInstance,
+            monitorStep: input.monitorStep,
+            metricResponse: metricResponse,
+        });
+        const breakdown = MonitorCriteriaEvaluator.selectPlatformBreakdown({
+            breakdowns: metricResponse.proxmoxResourceBreakdowns,
+            legacyBreakdown: metricResponse.proxmoxResourceBreakdown,
+            target: target,
+        });
+        const clusterName = (breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) || (proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.clusterIdentifier) || "Unknown";
+        const sections = [];
         if (proxmoxMonitor || breakdown) {
             const clusterDetails = [];
-            clusterDetails.push(`- Cluster: ${(breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) || (proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.clusterIdentifier) || "Unknown"}`);
-            if (breakdown) {
-                clusterDetails.push(`- Metric: ${breakdown.metricFriendlyName} (\`${breakdown.metricName}\`)`);
-            }
-            else if (proxmoxMonitor &&
-                ((_c = (_b = proxmoxMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c.length) > 0 &&
-                proxmoxMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_e = (_d = proxmoxMonitor.metricViewConfig
-                    .queryConfigs[0].metricQueryData) === null || _d === void 0 ? void 0 : _d.filterData) === null || _e === void 0 ? void 0 : _e.metricName;
-                if (metricName) {
-                    clusterDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
-            if ((_f = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _f === void 0 ? void 0 : _f.scope) {
+            clusterDetails.push(`- Cluster: ${clusterName}`);
+            clusterDetails.push(...MonitorCriteriaEvaluator.describeCriteriaMetric({
+                platform: "proxmox",
+                target: target,
+                breakdown: breakdown,
+                fallbackMetricName: (_f = (_e = (_d = (_c = (_b = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.metricQueryData) === null || _e === void 0 ? void 0 : _e.filterData) === null || _f === void 0 ? void 0 : _f.metricName,
+            }));
+            if ((_g = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.scope) {
                 clusterDetails.push(`- Scope Filter: ${proxmoxMonitor.resourceFilters.scope}`);
             }
-            if ((_g = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.pveId) {
+            if ((_h = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.pveId) {
                 clusterDetails.push(`- Resource ID Filter: ${proxmoxMonitor.resourceFilters.pveId}`);
             }
-            if ((_h = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.nodeName) {
+            if ((_j = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _j === void 0 ? void 0 : _j.nodeName) {
                 clusterDetails.push(`- Node Filter: ${proxmoxMonitor.resourceFilters.nodeName}`);
             }
-            if ((_j = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _j === void 0 ? void 0 : _j.guestId) {
+            if ((_k = proxmoxMonitor === null || proxmoxMonitor === void 0 ? void 0 : proxmoxMonitor.resourceFilters) === null || _k === void 0 ? void 0 : _k.guestId) {
                 clusterDetails.push(`- Guest ID Filter: ${proxmoxMonitor.resourceFilters.guestId}`);
             }
             sections.push(`**Proxmox Cluster Details**\n${clusterDetails.join("\n")}`);
         }
         // Affected resources: a ranked list of kind, name and node
         let renderedBreakdownList = false;
-        if (breakdown && breakdown.affectedResources.length > 0) {
-            /*
-             * K8s-parity render: drop zero-value rows, worst (highest)
-             * first, top 10. Note that for availability metrics (pve_up)
-             * zero-valued rows ARE the down resources — those still drive
-             * alerting through the per-series criteria evaluation; this
-             * list is supplementary context only.
-             */
-            const sortedResources = [
-                ...breakdown.affectedResources,
-            ]
-                .filter((r) => {
-                return r.metricValue > 0;
-            })
-                .sort((a, b) => {
-                return b.metricValue - a.metricValue;
-            });
-            /*
-             * Skip the list when no row carries any identity label
-             * (cluster-wide series) — it would add nothing.
-             */
-            const hasIdentity = sortedResources.some((r) => {
-                return r.resourceId || r.resourceName || r.nodeName;
-            });
-            if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
-                sections.push(AffectedResourceList.render({
-                    heading: "Affected Resources",
-                    overflowNoun: "affected resources",
-                    totalCount: sortedResources.length,
-                    entries: resourcesToShow.map((resource) => {
-                        return MonitorCriteriaEvaluator.getProxmoxAffectedResourceEntry({
-                            resource: resource,
-                            clusterName: breakdown.clusterName,
-                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                                platform: "proxmox",
-                                metricName: breakdown.metricName,
-                                value: resource.metricValue,
-                            }),
+        /*
+         * The resources the matched criteria breached, worst first, top 10 —
+         * NOT simply the non-zero rows. pve-node-offline fires on `pve_up < 1`,
+         * so the zero rows ARE the down nodes; the old `> 0` listed every
+         * healthy node under it instead.
+         */
+        const rows = MonitorCriteriaEvaluator.getPlatformAffectedRows({
+            platform: "proxmox",
+            perSeriesMatches: input.perSeriesMatches,
+            namesObject: (identity) => {
+                return Boolean(identity.resourceId || identity.resourceName || identity.nodeName);
+            },
+            metricResponse: metricResponse,
+            monitorStep: input.monitorStep,
+            target: target,
+            breakdown: breakdown,
+            breach: MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+            }),
+            toIdentity: PlatformResourceIdentity.proxmox,
+            withContext: PlatformResourceIdentity.withProxmoxContext,
+        });
+        /*
+         * Skip the list when no row carries any identity label
+         * (cluster-wide series) — it would add nothing.
+         */
+        const hasIdentity = (rows || []).some((row) => {
+            return Boolean(row.seriesLabels ||
+                row.identity.resourceId ||
+                row.identity.resourceName ||
+                row.identity.nodeName);
+        });
+        if (rows && rows.length > 0 && hasIdentity) {
+            sections.push(AffectedResourceList.render({
+                heading: "Affected Resources",
+                overflowNoun: "affected resources",
+                totalCount: rows.length,
+                entries: rows
+                    .slice(0, AffectedResourceList.MAX_ENTRIES)
+                    .map((row) => {
+                    return row.seriesLabels
+                        ? MonitorCriteriaEvaluator.getSeriesLabelEntry({
+                            labels: row.seriesLabels,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
+                        })
+                        : MonitorCriteriaEvaluator.getProxmoxAffectedResourceEntry({
+                            resource: row.identity,
+                            clusterName: clusterName,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
                         });
-                    }),
-                }));
-                renderedBreakdownList = true;
-            }
+                }),
+            }));
+            renderedBreakdownList = true;
         }
         // Metric results summary (fallback context when no list rendered)
         if (!renderedBreakdownList &&
@@ -2072,102 +2880,111 @@ ${contextBlock}
         };
     }
     static buildVMwareRootCauseContext(input) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m;
         const metricResponse = input.dataToProcess;
-        const breakdown = metricResponse.vmwareResourceBreakdown;
-        const sections = [];
         // vCenter context
         const vmwareMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.vmwareMonitor;
+        const target = MonitorCriteriaEvaluator.resolveCriteriaMetricTarget({
+            criteriaInstance: input.criteriaInstance,
+            monitorStep: input.monitorStep,
+            metricResponse: metricResponse,
+        });
+        const breakdown = MonitorCriteriaEvaluator.selectPlatformBreakdown({
+            breakdowns: metricResponse.vmwareResourceBreakdowns,
+            legacyBreakdown: metricResponse.vmwareResourceBreakdown,
+            target: target,
+        });
+        const vcenterName = (breakdown === null || breakdown === void 0 ? void 0 : breakdown.vcenterName) || (vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.vcenterIdentifier) || "Unknown";
+        const sections = [];
         if (vmwareMonitor || breakdown) {
             const vcenterDetails = [];
-            vcenterDetails.push(`- vCenter: ${(breakdown === null || breakdown === void 0 ? void 0 : breakdown.vcenterName) || (vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.vcenterIdentifier) || "Unknown"}`);
-            if (breakdown) {
-                vcenterDetails.push(`- Metric: ${breakdown.metricFriendlyName} (\`${breakdown.metricName}\`)`);
-            }
-            else if (vmwareMonitor &&
-                ((_c = (_b = vmwareMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c.length) > 0 &&
-                vmwareMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_e = (_d = vmwareMonitor.metricViewConfig
-                    .queryConfigs[0].metricQueryData) === null || _d === void 0 ? void 0 : _d.filterData) === null || _e === void 0 ? void 0 : _e.metricName;
-                if (metricName) {
-                    vcenterDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
+            vcenterDetails.push(`- vCenter: ${vcenterName}`);
+            vcenterDetails.push(...MonitorCriteriaEvaluator.describeCriteriaMetric({
+                platform: "vmware",
+                target: target,
+                breakdown: breakdown,
+                fallbackMetricName: (_f = (_e = (_d = (_c = (_b = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.metricQueryData) === null || _e === void 0 ? void 0 : _e.filterData) === null || _f === void 0 ? void 0 : _f.metricName,
+            }));
             /*
              * The worker maps each resource filter to an equality on the
              * matching `resource.vcenter.*` attribute; surface the same
              * filters so the incident shows WHAT was scoped.
              */
-            if ((_f = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _f === void 0 ? void 0 : _f.datacenterName) {
+            if ((_g = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.datacenterName) {
                 vcenterDetails.push(`- Datacenter Filter: ${vmwareMonitor.resourceFilters.datacenterName}`);
             }
-            if ((_g = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.clusterName) {
+            if ((_h = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.clusterName) {
                 vcenterDetails.push(`- Cluster Filter: ${vmwareMonitor.resourceFilters.clusterName}`);
             }
-            if ((_h = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.hostName) {
+            if ((_j = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _j === void 0 ? void 0 : _j.hostName) {
                 vcenterDetails.push(`- Host Filter: ${vmwareMonitor.resourceFilters.hostName}`);
             }
-            if ((_j = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _j === void 0 ? void 0 : _j.vmName) {
+            if ((_k = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _k === void 0 ? void 0 : _k.vmName) {
                 vcenterDetails.push(`- Virtual Machine Filter: ${vmwareMonitor.resourceFilters.vmName}`);
             }
-            if ((_k = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _k === void 0 ? void 0 : _k.datastoreName) {
+            if ((_l = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _l === void 0 ? void 0 : _l.datastoreName) {
                 vcenterDetails.push(`- Datastore Filter: ${vmwareMonitor.resourceFilters.datastoreName}`);
             }
-            if ((_l = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _l === void 0 ? void 0 : _l.resourcePoolPath) {
+            if ((_m = vmwareMonitor === null || vmwareMonitor === void 0 ? void 0 : vmwareMonitor.resourceFilters) === null || _m === void 0 ? void 0 : _m.resourcePoolPath) {
                 vcenterDetails.push(`- Resource Pool Filter: ${vmwareMonitor.resourceFilters.resourcePoolPath}`);
             }
             sections.push(`**vCenter Details**\n${vcenterDetails.join("\n")}`);
         }
         // Affected resources: a ranked list of object, host and cluster
         let renderedBreakdownList = false;
-        if (breakdown && breakdown.affectedResources.length > 0) {
-            /*
-             * K8s/Proxmox-parity render: drop zero-value rows, worst (highest)
-             * first, top 10. For count metrics filtered to an unhealthy state
-             * (`vcenter.datacenter.host.count{status=red}`) the non-zero rows
-             * ARE the objects with a problem, so the list reads correctly;
-             * a zero row means "nothing in that state" and adds nothing. The
-             * per-series criteria evaluation is what actually alerts; this
-             * list is supplementary context only.
-             */
-            const sortedResources = [
-                ...breakdown.affectedResources,
-            ]
-                .filter((r) => {
-                return r.metricValue > 0;
-            })
-                .sort((a, b) => {
-                return b.metricValue - a.metricValue;
-            });
-            /*
-             * Skip the list when no row carries any identity attribute — it
-             * would add nothing. Every vcenter-receiver series carries at
-             * least `vcenter.datacenter.name`, so this only trips on a
-             * breakdown the worker could not attribute at all.
-             */
-            const hasIdentity = sortedResources.some((r) => {
-                return Boolean(MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(r));
-            });
-            if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
-                sections.push(AffectedResourceList.render({
-                    heading: "Affected Resources",
-                    overflowNoun: "affected resources",
-                    totalCount: sortedResources.length,
-                    entries: resourcesToShow.map((resource) => {
-                        return MonitorCriteriaEvaluator.getVMwareAffectedResourceEntry({
-                            resource: resource,
-                            vcenterName: breakdown.vcenterName,
-                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                                platform: "vmware",
-                                metricName: breakdown.metricName,
-                                value: resource.metricValue,
-                            }),
+        /*
+         * The objects the matched criteria breached, worst first, top 10. For
+         * count metrics filtered to an unhealthy state
+         * (`vcenter.datacenter.host.count{status=red}`) the non-zero rows ARE
+         * the objects with a problem.
+         */
+        const rows = MonitorCriteriaEvaluator.getPlatformAffectedRows({
+            platform: "vmware",
+            perSeriesMatches: input.perSeriesMatches,
+            namesObject: (identity) => {
+                return Boolean(MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(identity));
+            },
+            metricResponse: metricResponse,
+            monitorStep: input.monitorStep,
+            target: target,
+            breakdown: breakdown,
+            breach: MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+            }),
+            toIdentity: PlatformResourceIdentity.vmware,
+            withContext: PlatformResourceIdentity.withVMwareContext,
+        });
+        /*
+         * Skip the list when no row carries any identity attribute — it
+         * would add nothing. Every vcenter-receiver series carries at
+         * least `vcenter.datacenter.name`, so this only trips on a
+         * breakdown the worker could not attribute at all.
+         */
+        const hasIdentity = (rows || []).some((row) => {
+            return Boolean(row.seriesLabels ||
+                MonitorCriteriaEvaluator.getVMwareAffectedResourceKind(row.identity));
+        });
+        if (rows && rows.length > 0 && hasIdentity) {
+            sections.push(AffectedResourceList.render({
+                heading: "Affected Resources",
+                overflowNoun: "affected resources",
+                totalCount: rows.length,
+                entries: rows
+                    .slice(0, AffectedResourceList.MAX_ENTRIES)
+                    .map((row) => {
+                    return row.seriesLabels
+                        ? MonitorCriteriaEvaluator.getSeriesLabelEntry({
+                            labels: row.seriesLabels,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
+                        })
+                        : MonitorCriteriaEvaluator.getVMwareAffectedResourceEntry({
+                            resource: row.identity,
+                            vcenterName: vcenterName,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
                         });
-                    }),
-                }));
-                renderedBreakdownList = true;
-            }
+                }),
+            }));
+            renderedBreakdownList = true;
         }
         // Metric results summary (fallback context when no list rendered)
         if (!renderedBreakdownList &&
@@ -2226,87 +3043,103 @@ ${contextBlock}
         };
     }
     static buildDockerSwarmRootCauseContext(input) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
         const metricResponse = input.dataToProcess;
-        const breakdown = metricResponse.dockerSwarmResourceBreakdown;
-        const sections = [];
         // Docker Swarm cluster context
         const dockerSwarmMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.dockerSwarmMonitor;
+        const target = MonitorCriteriaEvaluator.resolveCriteriaMetricTarget({
+            criteriaInstance: input.criteriaInstance,
+            monitorStep: input.monitorStep,
+            metricResponse: metricResponse,
+        });
+        const breakdown = MonitorCriteriaEvaluator.selectPlatformBreakdown({
+            breakdowns: metricResponse.dockerSwarmResourceBreakdowns,
+            legacyBreakdown: metricResponse.dockerSwarmResourceBreakdown,
+            target: target,
+        });
+        const clusterName = (breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) ||
+            (dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.clusterIdentifier) ||
+            "Unknown";
+        const sections = [];
         if (dockerSwarmMonitor || breakdown) {
             const clusterDetails = [];
-            clusterDetails.push(`- Cluster: ${(breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) || (dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.clusterIdentifier) || "Unknown"}`);
-            if (breakdown) {
-                clusterDetails.push(`- Metric: ${breakdown.metricFriendlyName} (\`${breakdown.metricName}\`)`);
-            }
-            else if (dockerSwarmMonitor &&
-                ((_c = (_b = dockerSwarmMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c.length) > 0 &&
-                dockerSwarmMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_e = (_d = dockerSwarmMonitor.metricViewConfig
-                    .queryConfigs[0].metricQueryData) === null || _d === void 0 ? void 0 : _d.filterData) === null || _e === void 0 ? void 0 : _e.metricName;
-                if (metricName) {
-                    clusterDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
-            if ((_f = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _f === void 0 ? void 0 : _f.serviceName) {
+            clusterDetails.push(`- Cluster: ${clusterName}`);
+            clusterDetails.push(...MonitorCriteriaEvaluator.describeCriteriaMetric({
+                platform: "dockerSwarm",
+                target: target,
+                breakdown: breakdown,
+                fallbackMetricName: (_f = (_e = (_d = (_c = (_b = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.metricQueryData) === null || _e === void 0 ? void 0 : _e.filterData) === null || _f === void 0 ? void 0 : _f.metricName,
+            }));
+            if ((_g = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.serviceName) {
                 clusterDetails.push(`- Service Filter: ${dockerSwarmMonitor.resourceFilters.serviceName}`);
             }
-            if ((_g = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.nodeName) {
+            if ((_h = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.nodeName) {
                 clusterDetails.push(`- Node Filter: ${dockerSwarmMonitor.resourceFilters.nodeName}`);
             }
-            if ((_h = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.containerName) {
+            if ((_j = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _j === void 0 ? void 0 : _j.containerName) {
                 clusterDetails.push(`- Container Name Filter: ${dockerSwarmMonitor.resourceFilters.containerName}`);
             }
-            if ((_j = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _j === void 0 ? void 0 : _j.containerImage) {
+            if ((_k = dockerSwarmMonitor === null || dockerSwarmMonitor === void 0 ? void 0 : dockerSwarmMonitor.resourceFilters) === null || _k === void 0 ? void 0 : _k.containerImage) {
                 clusterDetails.push(`- Container Image Filter: ${dockerSwarmMonitor.resourceFilters.containerImage}`);
             }
             sections.push(`**Docker Swarm Cluster Details**\n${clusterDetails.join("\n")}`);
         }
         // Affected tasks: a ranked list of task, service and node
         let renderedBreakdownList = false;
-        if (breakdown && breakdown.affectedResources.length > 0) {
-            /*
-             * K8s/Proxmox-parity render: drop zero-value rows, worst (highest)
-             * first, top 10. For the task-down template the breaching rows ARE
-             * the zero-uptime ones — those still drive alerting through the
-             * per-series criteria evaluation; this list is supplementary
-             * context only.
-             */
-            const sortedResources = [
-                ...breakdown.affectedResources,
-            ]
-                .filter((r) => {
-                return r.metricValue > 0;
-            })
-                .sort((a, b) => {
-                return b.metricValue - a.metricValue;
-            });
-            /*
-             * Skip the list when no row carries any identity label
-             * (cluster-wide series) — it would add nothing.
-             */
-            const hasIdentity = sortedResources.some((r) => {
-                return r.containerName || r.serviceName || r.nodeName;
-            });
-            if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
-                sections.push(AffectedResourceList.render({
-                    heading: "Affected Tasks",
-                    overflowNoun: "affected tasks",
-                    totalCount: sortedResources.length,
-                    entries: resourcesToShow.map((resource) => {
-                        return MonitorCriteriaEvaluator.getDockerSwarmAffectedResourceEntry({
-                            resource: resource,
-                            clusterName: breakdown.clusterName,
-                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                                platform: "dockerSwarm",
-                                metricName: breakdown.metricName,
-                                value: resource.metricValue,
-                            }),
+        /*
+         * The tasks the matched criteria breached, worst first, top 10. The
+         * task-down template fires on `container.uptime < 60`, so the worst
+         * task is the one with the LOWEST uptime; the old `> 0`,
+         * highest-first list put the healthiest, longest-running tasks at the
+         * top and pushed the restarting one off the end.
+         */
+        const rows = MonitorCriteriaEvaluator.getPlatformAffectedRows({
+            platform: "dockerSwarm",
+            perSeriesMatches: input.perSeriesMatches,
+            namesObject: (identity) => {
+                return Boolean(identity.containerName || identity.serviceName || identity.nodeName);
+            },
+            metricResponse: metricResponse,
+            monitorStep: input.monitorStep,
+            target: target,
+            breakdown: breakdown,
+            breach: MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+                criteriaInstance: input.criteriaInstance,
+            }),
+            toIdentity: PlatformResourceIdentity.dockerSwarm,
+            withContext: PlatformResourceIdentity.withDockerSwarmContext,
+        });
+        /*
+         * Skip the list when no row carries any identity label
+         * (cluster-wide series) — it would add nothing.
+         */
+        const hasIdentity = (rows || []).some((row) => {
+            return Boolean(row.seriesLabels ||
+                row.identity.containerName ||
+                row.identity.serviceName ||
+                row.identity.nodeName);
+        });
+        if (rows && rows.length > 0 && hasIdentity) {
+            sections.push(AffectedResourceList.render({
+                heading: "Affected Tasks",
+                overflowNoun: "affected tasks",
+                totalCount: rows.length,
+                entries: rows
+                    .slice(0, AffectedResourceList.MAX_ENTRIES)
+                    .map((row) => {
+                    return row.seriesLabels
+                        ? MonitorCriteriaEvaluator.getSeriesLabelEntry({
+                            labels: row.seriesLabels,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
+                        })
+                        : MonitorCriteriaEvaluator.getDockerSwarmAffectedResourceEntry({
+                            resource: row.identity,
+                            clusterName: clusterName,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
                         });
-                    }),
-                }));
-                renderedBreakdownList = true;
-            }
+                }),
+            }));
+            renderedBreakdownList = true;
         }
         // Metric results summary (fallback context when no list rendered)
         if (!renderedBreakdownList &&
@@ -2353,40 +3186,114 @@ ${contextBlock}
      */
     static getAffectedResourceBreachPredicate(input) {
         var _a, _b, _c, _d, _e, _f;
-        const metricFilters = (((_b = (_a = input.criteriaInstance) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.filters) || []).filter((f) => {
-            return f.checkOn === CheckOn.MetricValue && typeof f.value === "number";
+        /*
+         * Thresholds read exactly as the criteria evaluation reads them. The
+         * dashboard's criteria form saves the threshold as a string ("60"), so
+         * a `typeof === "number"` test dropped every filter a user had edited
+         * and quietly put their criteria back on the `> 0`, highest-first rule.
+         */
+        const metricFilters = (((_b = (_a = input.criteriaInstance) === null || _a === void 0 ? void 0 : _a.data) === null || _b === void 0 ? void 0 : _b.filters) || [])
+            .filter((f) => {
+            return f.checkOn === CheckOn.MetricValue;
+        })
+            .map((f) => {
+            return {
+                filter: f,
+                threshold: CompareCriteria.convertMetricThresholdToNumber(f.value),
+            };
+        })
+            .filter((f) => {
+            return f.threshold !== null;
         });
         const opensIncidentOrAlert = ((_d = (_c = input.criteriaInstance) === null || _c === void 0 ? void 0 : _c.data) === null || _d === void 0 ? void 0 : _d.createIncidents) === true ||
             ((_f = (_e = input.criteriaInstance) === null || _e === void 0 ? void 0 : _e.data) === null || _f === void 0 ? void 0 : _f.createAlerts) === true;
         const firesWhenMetricFalls = metricFilters.length > 0 &&
             metricFilters.every((f) => {
-                if (f.filterType === FilterType.LessThan ||
-                    f.filterType === FilterType.LessThanOrEqualTo) {
+                if (f.filter.filterType === FilterType.LessThan ||
+                    f.filter.filterType === FilterType.LessThanOrEqualTo) {
                     return true;
                 }
                 return (input.floorEqualityFiresOnFall === true &&
                     opensIncidentOrAlert &&
-                    f.filterType === FilterType.EqualTo &&
-                    f.value <= 0);
+                    f.filter.filterType === FilterType.EqualTo &&
+                    f.threshold <= 0);
             });
-        if (!firesWhenMetricFalls) {
+        /*
+         * A firing criteria that asks for one exact, non-zero value —
+         * k8s-pod-pending fires on phase `= 1` (Pending) — lists exactly the
+         * rows that were at that value. The `> 0` rule below listed every pod
+         * with a phase, which is all of them, led by the one with the highest
+         * code (Unknown), and sent the reader to `kubectl describe` the wrong
+         * pod.
+         *
+         * A row was at the value if either end of its window was: pod-pending
+         * watches the phase at its Min (a pod that has since started Running
+         * still breached), a memory-pressure `= 1` watches the Max. `= 0` stays
+         * with the floor rule above, which each platform opts into.
+         */
+        const exactValues = metricFilters.map((f) => {
+            return f.threshold;
+        });
+        const firesOnExactValue = !firesWhenMetricFalls &&
+            opensIncidentOrAlert &&
+            metricFilters.length > 0 &&
+            metricFilters.every((f) => {
+                return f.filter.filterType === FilterType.EqualTo && f.threshold > 0;
+            });
+        if (firesOnExactValue) {
             return {
                 matches: (value) => {
-                    return value > 0;
+                    return exactValues.includes(value);
                 },
                 worstIsLowest: false,
+                pickEnd: (ends) => {
+                    return exactValues.includes(ends.highest) ? "highest" : "lowest";
+                },
+            };
+        }
+        /*
+         * A criteria that fires when the metric RISES lists the rows past its
+         * threshold. The blanket `> 0` listed every resource with any value at
+         * all — the healthy nodes at 50% under a "> 90%" alert. When no single
+         * row is past it (the criteria compared a sum or an average across
+         * resources) the list still falls back to the non-zero rows.
+         */
+        const firesWhenMetricRises = metricFilters.length > 0 &&
+            metricFilters.every((f) => {
+                return (f.filter.filterType === FilterType.GreaterThan ||
+                    f.filter.filterType === FilterType.GreaterThanOrEqualTo);
+            });
+        const isNonZero = (value) => {
+            return value > 0;
+        };
+        if (firesWhenMetricRises && !firesWhenMetricFalls) {
+            return {
+                matches: (value) => {
+                    return metricFilters.some((f) => {
+                        return f.filter.filterType === FilterType.GreaterThan
+                            ? value > f.threshold
+                            : value >= f.threshold;
+                    });
+                },
+                worstIsLowest: false,
+                fallbackMatches: isNonZero,
+            };
+        }
+        if (!firesWhenMetricFalls) {
+            return {
+                matches: isNonZero,
+                worstIsLowest: false,
             };
         }
         return {
             matches: (value) => {
                 return metricFilters.some((f) => {
-                    const threshold = f.value;
-                    if (f.filterType === FilterType.EqualTo) {
-                        return value === threshold;
+                    if (f.filter.filterType === FilterType.EqualTo) {
+                        return value === f.threshold;
                     }
-                    return f.filterType === FilterType.LessThan
-                        ? value < threshold
-                        : value <= threshold;
+                    return f.filter.filterType === FilterType.LessThan
+                        ? value < f.threshold
+                        : value <= f.threshold;
                 });
             },
             /*
@@ -2462,87 +3369,107 @@ ${contextBlock}
         };
     }
     static buildCephRootCauseContext(input) {
-        var _a, _b, _c, _d, _e, _f, _g;
+        var _a, _b, _c, _d, _e, _f, _g, _h;
         const metricResponse = input.dataToProcess;
-        const breakdown = metricResponse.cephResourceBreakdown;
-        const sections = [];
         // Ceph cluster context
         const cephMonitor = (_a = input.monitorStep.data) === null || _a === void 0 ? void 0 : _a.cephMonitor;
+        const target = MonitorCriteriaEvaluator.resolveCriteriaMetricTarget({
+            criteriaInstance: input.criteriaInstance,
+            monitorStep: input.monitorStep,
+            metricResponse: metricResponse,
+        });
+        const breakdown = MonitorCriteriaEvaluator.selectPlatformBreakdown({
+            breakdowns: metricResponse.cephResourceBreakdowns,
+            legacyBreakdown: metricResponse.cephResourceBreakdown,
+            target: target,
+        });
+        const clusterName = (breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) || (cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.clusterIdentifier) || "Unknown";
+        const sections = [];
         if (cephMonitor || breakdown) {
             const clusterDetails = [];
-            clusterDetails.push(`- Cluster: ${(breakdown === null || breakdown === void 0 ? void 0 : breakdown.clusterName) || (cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.clusterIdentifier) || "Unknown"}`);
-            if (breakdown) {
-                clusterDetails.push(`- Metric: ${breakdown.metricFriendlyName} (\`${breakdown.metricName}\`)`);
-            }
-            else if (cephMonitor &&
-                ((_c = (_b = cephMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c.length) > 0 &&
-                cephMonitor.metricViewConfig.queryConfigs[0]) {
-                const metricName = (_e = (_d = cephMonitor.metricViewConfig.queryConfigs[0]
-                    .metricQueryData) === null || _d === void 0 ? void 0 : _d.filterData) === null || _e === void 0 ? void 0 : _e.metricName;
-                if (metricName) {
-                    clusterDetails.push(`- Metric: \`${metricName}\``);
-                }
-            }
-            if ((_f = cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.resourceFilters) === null || _f === void 0 ? void 0 : _f.osdId) {
+            clusterDetails.push(`- Cluster: ${clusterName}`);
+            clusterDetails.push(...MonitorCriteriaEvaluator.describeCriteriaMetric({
+                platform: "ceph",
+                target: target,
+                breakdown: breakdown,
+                fallbackMetricName: (_f = (_e = (_d = (_c = (_b = cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.metricViewConfig) === null || _b === void 0 ? void 0 : _b.queryConfigs) === null || _c === void 0 ? void 0 : _c[0]) === null || _d === void 0 ? void 0 : _d.metricQueryData) === null || _e === void 0 ? void 0 : _e.filterData) === null || _f === void 0 ? void 0 : _f.metricName,
+            }));
+            if ((_g = cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.osdId) {
                 clusterDetails.push(`- OSD Filter: ${cephMonitor.resourceFilters.osdId}`);
             }
-            if ((_g = cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.resourceFilters) === null || _g === void 0 ? void 0 : _g.poolId) {
+            if ((_h = cephMonitor === null || cephMonitor === void 0 ? void 0 : cephMonitor.resourceFilters) === null || _h === void 0 ? void 0 : _h.poolId) {
                 clusterDetails.push(`- Pool ID Filter: ${cephMonitor.resourceFilters.poolId}`);
             }
             sections.push(`**Ceph Cluster Details**\n${clusterDetails.join("\n")}`);
         }
         // Affected resources: a ranked list of daemon, pool and host
         let renderedBreakdownList = false;
-        if (breakdown && breakdown.affectedResources.length > 0) {
-            /*
-             * Keep the rows that satisfy the criteria that just matched, worst
-             * first, top 10 — NOT simply the non-zero rows. For ceph_osd_up /
-             * ceph_osd_in / ceph_mon_quorum_status the criteria is `< 1`, so
-             * the zero rows are the whole point of the incident.
-             */
-            const breach = MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
+        /*
+         * Keep the rows that satisfy the criteria that just matched, worst
+         * first, top 10 — NOT simply the non-zero rows. For ceph_osd_up /
+         * ceph_osd_in / ceph_mon_quorum_status the criteria is `< 1`, so
+         * the zero rows are the whole point of the incident.
+         */
+        const rows = MonitorCriteriaEvaluator.getPlatformAffectedRows({
+            platform: "ceph",
+            perSeriesMatches: input.perSeriesMatches,
+            namesObject: (identity) => {
+                return Boolean(identity.daemon ||
+                    identity.poolId ||
+                    identity.poolName ||
+                    identity.hostname);
+            },
+            metricResponse: metricResponse,
+            monitorStep: input.monitorStep,
+            target: target,
+            breakdown: breakdown,
+            breach: MonitorCriteriaEvaluator.getAffectedResourceBreachPredicate({
                 criteriaInstance: input.criteriaInstance,
-            });
-            const sortedResources = [
-                ...breakdown.affectedResources,
-            ]
-                .filter((r) => {
-                return breach.matches(r.metricValue);
-            })
-                .sort((a, b) => {
-                return breach.worstIsLowest
-                    ? a.metricValue - b.metricValue
-                    : b.metricValue - a.metricValue;
-            });
-            /*
-             * Skip the list when no row carries any identity label
-             * (cluster-wide series like ceph_health_status) — it would add
-             * nothing.
-             */
-            const hasIdentity = sortedResources.some((r) => {
-                return r.daemon || r.poolId || r.poolName || r.hostname;
-            });
-            if (sortedResources.length > 0 && hasIdentity) {
-                const resourcesToShow = sortedResources.slice(0, AffectedResourceList.MAX_ENTRIES);
-                sections.push(AffectedResourceList.render({
-                    heading: "Affected Resources",
-                    overflowNoun: "affected resources",
-                    totalCount: sortedResources.length,
-                    entries: resourcesToShow.map((resource) => {
-                        return MonitorCriteriaEvaluator.getCephAffectedResourceEntry({
-                            resource: resource,
-                            clusterName: breakdown.clusterName,
-                            metricName: breakdown.metricName,
-                            value: MonitorCriteriaEvaluator.formatPlatformResourceValue({
-                                platform: "ceph",
-                                metricName: breakdown.metricName,
-                                value: resource.metricValue,
-                            }),
+            }),
+            toIdentity: PlatformResourceIdentity.ceph,
+            withContext: PlatformResourceIdentity.withCephContext,
+        });
+        /*
+         * Skip the list when no row carries any identity label
+         * (cluster-wide series like ceph_health_status) — it would add
+         * nothing.
+         */
+        const hasIdentity = (rows || []).some((row) => {
+            return Boolean(row.seriesLabels ||
+                row.identity.daemon ||
+                row.identity.poolId ||
+                row.identity.poolName ||
+                row.identity.hostname);
+        });
+        /*
+         * Which metric the rows are about, for the entry's "Health Check"
+         * titling: the criteria's own query, else the breakdown's.
+         */
+        const rowsMetricName = MonitorCriteriaEvaluator.getAnalysisMetricName(target) ||
+            (breakdown === null || breakdown === void 0 ? void 0 : breakdown.metricName) ||
+            "";
+        if (rows && rows.length > 0 && hasIdentity) {
+            sections.push(AffectedResourceList.render({
+                heading: "Affected Resources",
+                overflowNoun: "affected resources",
+                totalCount: rows.length,
+                entries: rows
+                    .slice(0, AffectedResourceList.MAX_ENTRIES)
+                    .map((row) => {
+                    return row.seriesLabels
+                        ? MonitorCriteriaEvaluator.getSeriesLabelEntry({
+                            labels: row.seriesLabels,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
+                        })
+                        : MonitorCriteriaEvaluator.getCephAffectedResourceEntry({
+                            resource: row.identity,
+                            clusterName: clusterName,
+                            metricName: rowsMetricName,
+                            value: MonitorCriteriaEvaluator.renderAffectedRowValue(row),
                         });
-                    }),
-                }));
-                renderedBreakdownList = true;
-            }
+                }),
+            }));
+            renderedBreakdownList = true;
         }
         // Metric results summary (fallback context when no list rendered)
         if (!renderedBreakdownList &&
@@ -2576,14 +3503,13 @@ ${contextBlock}
          * kubeletstats cores gauge that four other places in this repo warn
          * is misnamed, so 1.4 cores in use read as "1.4% CPU utilization".
          */
-        const topResourceValue = MetricValueFormatter.format({
-            value: topResource.metricValue,
-            unit: MonitorCriteriaEvaluator.getPlatformMetricUnit({
+        const topResourceValue = input.topResourceValue ||
+            MonitorCriteriaEvaluator.formatPlatformMetricValue({
                 platform: "kubernetes",
                 metricName: metricName,
-            }),
-            metricName: metricName,
-        });
+                metricUnit: breakdown.metricUnit,
+                value: topResource.metricValue,
+            });
         if (metricName === "k8s.container.restarts" ||
             metricName.includes("restart")) {
             lines.push(`Container restart count is elevated, indicating a potential CrashLoopBackOff condition.`);
@@ -2620,6 +3546,12 @@ ${contextBlock}
             lines.push(`Recommended actions: Check node conditions with \`kubectl describe node ${topResource.nodeName || "<node-name>"}\` and verify kubelet status on the node.`);
         }
         else if (metricName === "k8s.node.cpu.utilization" ||
+            /*
+             * The numerator of the "High Node CPU Utilization" ratio template
+             * (k8s.node.cpu.usage ÷ k8s.node.allocatable_cpu × 100), which is
+             * what a formula criteria is analysed as.
+             */
+            metricName === "k8s.node.cpu.usage" ||
             /*
              * Node-scoped ONLY. The bare substring test used to swallow every
              * pod- and container-scoped CPU metric — `k8s.pod.cpu.utilization`,
@@ -2651,8 +3583,16 @@ ${contextBlock}
             lines.push(`Common causes: memory leaks in applications, insufficient memory limits on pods, too many pods scheduled on the node, or growing dataset sizes.`);
             lines.push(`Recommended actions: Check memory consumers with \`kubectl top pods --all-namespaces --sort-by=memory\` and review pod memory limits. Consider scaling the cluster or adding nodes with more memory.`);
         }
-        else if (metricName === "k8s.deployment.unavailable_replicas" ||
-            metricName.includes("unavailable")) {
+        else if (
+        /*
+         * The k8s_cluster receiver has no unavailable-replicas series. The
+         * replica-mismatch template is a formula (`desired - available`),
+         * analysed as its first operand, k8s.deployment.desired, so it lands
+         * in the generic branch below, which names the formula. What still
+         * reaches this one is a custom monitor on an "unavailable" series
+         * such as kube-state-metrics' `kube_deployment_status_replicas_unavailable`.
+         */
+        metricName.includes("unavailable")) {
             lines.push(`Deployment has unavailable replicas, indicating a mismatch between desired and available replicas.`);
             if (topResource.workloadName) {
                 lines.push(`${topResource.workloadType || "Deployment"} \`${topResource.workloadName}\` has **${topResourceValue}** unavailable replica(s).`);
@@ -2689,13 +3629,38 @@ ${contextBlock}
             lines.push(`Recommended actions: Check DaemonSet status with \`kubectl describe daemonset ${topResource.workloadName || "<daemonset>"}\` and verify node labels and taints.`);
         }
         else {
-            // Generic Kubernetes context
-            lines.push(`Kubernetes metric \`${metricName}\` (${breakdown.metricFriendlyName}) has breached the configured threshold.`);
+            /*
+             * Generic Kubernetes context. It names what the criteria compared —
+             * a formula by its legend and expression, since the metric the
+             * branches above key on is only its numerator — and the worst
+             * resource's value, so the reader does not have to find it in the
+             * list above.
+             */
+            const target = input.target;
+            if (target === null || target === void 0 ? void 0 : target.isFormula) {
+                const formulaName = target.displayName || `\`${target.alias}\``;
+                const expression = target.formulaExpression
+                    ? ` (\`${target.formulaExpression}\`)`
+                    : "";
+                lines.push(`${formulaName}${expression} has breached the configured threshold.`);
+            }
+            else {
+                const friendlyName = breakdown.metricFriendlyName &&
+                    breakdown.metricFriendlyName !== metricName
+                    ? ` (${breakdown.metricFriendlyName})`
+                    : "";
+                lines.push(`Kubernetes metric \`${metricName}\`${friendlyName} has breached the configured threshold.`);
+            }
             if (topResource.podName) {
-                lines.push(`Most affected pod: \`${topResource.podName}\``);
+                lines.push(`Most affected pod: \`${topResource.podName}\` (**${topResourceValue}**)`);
+            }
+            else if (topResource.workloadName) {
+                lines.push(`Most affected ${topResource.workloadType || "workload"}: \`${topResource.workloadName}\` (**${topResourceValue}**)`);
             }
             if (topResource.nodeName) {
-                lines.push(`Most affected node: \`${topResource.nodeName}\``);
+                lines.push(topResource.podName
+                    ? `Most affected node: \`${topResource.nodeName}\``
+                    : `Most affected node: \`${topResource.nodeName}\` (**${topResourceValue}**)`);
             }
             lines.push(`Recommended actions: Investigate the affected resources using \`kubectl describe\` and \`kubectl logs\` commands.`);
         }