// SPEC: PJ2026-01060307 控制面模块化 draft-2026-06-25-p0. git-mirror module for scripts/src/hwlab-node-impl.ts.

// Moved mechanically from scripts/src/hwlab-node-impl.ts:2800-3280 for #903.

// SPEC: PJ2026-01060505 Workbench Performance draft-2026-06-17-p0.
// SPEC: PJ2026-01060508 Web哨兵 draft-2026-06-25-p0-web-probe-sentinel.
// Responsibility: YAML-first node/lane operations, including Workbench observability control commands.
import { createHash, randomBytes } from "node:crypto";
import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
import { dirname, join } from "node:path";
import { repoRoot, rootPath, type Config } from "../config";
import { runCommand, type CommandResult } from "../command";
import { startJob } from "../jobs";
import { classifySshTcpPoolFailure } from "../ssh";
import { HWLAB_NODE_CONTROL_PLANE_CONFIG_PATH, hwlabNodeControlPlaneInfraHelp, runHwlabNodeControlPlaneInfra } from "../hwlab-node-control-plane";
import { hwlabRuntimeLaneConfigPath, hwlabRuntimeLaneIds, hwlabRuntimeLaneSpec, hwlabRuntimeLaneSpecForNode, hwlabRuntimeNodeIds, isHwlabRuntimeLane, type HwlabRuntimeLane, type HwlabRuntimeLaneSpec, type HwlabRuntimeObservabilityRecordingRuleSpec, type HwlabRuntimeObservabilitySpec, type HwlabRuntimeObservabilityWarningAlertSpec, type HwlabRuntimePublicExposureSpec, type HwlabRuntimeWebProbeAlertThresholdsSpec, type HwlabRuntimeWebProbeProjectManagementSpec } from "../hwlab-node-lanes";
import { nodeWebProbeScriptRunnerSource } from "../hwlab-node-web-probe-runner-source";
import { nodeWebObserveAnalyzerSource } from "../hwlab-node-web-observe-analyzer-source";
import { nodeWebObserveRunnerSource } from "../hwlab-node-web-observe-runner-source";
import { nodeWebObserveCollectViewNodeScript, parseNodeWebProbeObserveCollectView, type NodeWebProbeObserveCollectView } from "../hwlab-node-web-observe-collect";
import { withWebObserveCollectRendered, withWebObserveCommandRendered, withWebObserveStatusRendered } from "../hwlab-node-web-observe-render";
import { buildWebObserveWrapperForObserveOptions, webObserveWrapperStateDirFromStatus } from "../hwlab-node-web-observe-wrapper";
import { renderWebObserveWrapperContract } from "../hwlab-node-web-observe-wrapper-render";
import { runWebProbeSentinelCommand, type WebProbeSentinelOptions } from "../hwlab-node-web-sentinel-cicd";
import { hwlabNodeHelp, hwlabNodeObservabilityHelp, hwlabNodeWebProbeHelp } from "../hwlab-node-help";
import { compactWebProbeResult, compactWebProbeScriptResult } from "../hwlab-node-web-probe-summary";
import { nodeObservabilityRecordingRuleExpression, nodeObservabilityRecordingRuleSummaries, nodeObservabilityWarningAlertExpression, nodeObservabilityWarningAlertSummaries } from "../hwlab-node-observability-promql";
import { runDelegatedHwlabNodeCommand, type DelegatedNodeDomain } from "../hwlab-node-transport";
import type { RenderedCliResult } from "../output";

import { formatElapsedMs, isCommandSuccess, nodeRuntimePipelineRunName, nodeRuntimeRerunPipelineRunName, resolveNodeRuntimeLaneHead, shortValue } from "./cleanup";
import { nodeRuntimeApply, nodeRuntimeRefresh } from "./control-actions";
import { NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS, NODE_RUNTIME_TRIGGER_SEVERE_WARNING_MS } from "./entry";
import { parseNodeScopedDelegatedOptions } from "./plan";
import { compactNodeRuntimeTaskRunDiagnostic, nodeRuntimeControlPlaneStatus, nodeRuntimePipelineFailureSummary } from "./render";
import { compactRuntimeCommand } from "./runtime-common";
import { compactNodeRuntimeGitMirrorObservation, compactNodeRuntimeGitMirrorRun, nodeRuntimeEnsureGitMirrorFlushed, nodeRuntimeEnsureGitMirrorSourceCurrent, nodeRuntimeExternalPostgresSecretRows, nodeRuntimeGitMirrorRun, nodeRuntimeGitMirrorStatus, nodeRuntimeOpportunisticGitMirrorFlush, nodeRuntimeOpportunisticGitMirrorSync, nodeScopedFullOutput, type NodeRuntimeGitMirrorRunOptions } from "./status";
import { parseJsonObject, record, statusText } from "./utils";
import { webObserveTable } from "./web-observe-render";
import { createNodeRuntimePipelineRun, getNodeRuntimePipelineRun, nodeRuntimePipelineRunManifest, printNodeRuntimeTriggerProgress, waitForNodeRuntimePipelineRunTerminal } from "./web-probe";
import { webObserveShort, webObserveText } from "./web-probe-observe";

export function nodeRuntimeTriggerCurrentOutput(scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): Record<string, unknown> | RenderedCliResult {
  const result = nodeRuntimeTriggerCurrent(scoped);
  if (nodeScopedFullOutput(scoped)) return result;
  return withNodeRuntimeTriggerRendered(result, scoped);
}

export function nodeRuntimeTriggerCurrent(scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): Record<string, unknown> {
  const spec = scoped.spec;
  const triggerStartedAt = Date.now();
  const triggerElapsedMs = () => Date.now() - triggerStartedAt;
  const triggerDeadlineMs = triggerStartedAt + (nodeRuntimeCicdWaitSeconds(scoped) * 1000);
  const remainingTriggerSeconds = () => Math.max(0, Math.floor((triggerDeadlineMs - Date.now()) / 1000));
  const triggerGitMirrorOptions = nodeRuntimeTriggerGitMirrorOptions(triggerDeadlineMs);
  const sourceSnapshotSync = scoped.dryRun ? null : nodeRuntimeSourceSnapshotSync(scoped, triggerDeadlineMs, triggerGitMirrorOptions);
  if (sourceSnapshotSync !== null && sourceSnapshotSync.ok !== true) {
    return {
      ok: false,
      command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
      node: scoped.node,
      lane: scoped.lane,
      phase: "source-snapshot-sync",
      degradedReason: "node-runtime-source-snapshot-sync-failed",
      sourceSnapshotSync: nodeScopedFullOutput(scoped) ? sourceSnapshotSync : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
    };
  }
  printNodeRuntimeTriggerProgress(spec, { stage: "source-head", status: "started" });
  const head = resolveNodeRuntimeLaneHead(spec);
  const sourceCommit = head.sourceCommit;
  if (sourceCommit === null) {
    printNodeRuntimeTriggerProgress(spec, { stage: "source-head", status: "failed" });
    return {
      ok: false,
      command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
      node: scoped.node,
      lane: scoped.lane,
      phase: "source-head",
      degradedReason: "node-runtime-source-head-unresolved",
      headProbe: compactRuntimeCommand(head.result),
      sourceSnapshotSync: sourceSnapshotSync === null ? null : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
    };
  }
  const basePipelineRun = nodeRuntimePipelineRunName(spec, sourceCommit);
  const pipelineRun = scoped.rerun ? nodeRuntimeRerunPipelineRunName(spec, sourceCommit) : basePipelineRun;
  printNodeRuntimeTriggerProgress(spec, { stage: "source-head", status: "succeeded", sourceCommit, pipelineRun });
  printNodeRuntimeTriggerProgress(spec, { stage: "probe-existing-pipelinerun", status: "started", sourceCommit, pipelineRun });
  const before = getNodeRuntimePipelineRun(spec, pipelineRun);
  printNodeRuntimeTriggerProgress(spec, { stage: "probe-existing-pipelinerun", status: "succeeded", sourceCommit, pipelineRun, existingStatus: before.status ?? null });
  if (scoped.dryRun) {
    const gitMirror = nodeRuntimeGitMirrorStatus(scoped);
    return {
      ok: true,
      command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
      node: scoped.node,
      lane: scoped.lane,
      mode: "dry-run",
      sourceCommit,
      pipelineRun,
      rerunOf: scoped.rerun ? basePipelineRun : null,
      rerun: scoped.rerun,
      before,
      gitMirror: nodeScopedFullOutput(scoped) ? gitMirror : compactNodeRuntimeGitMirrorObservation(gitMirror),
      sourceSnapshotSync: sourceSnapshotSync === null ? null : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
      manifest: nodeRuntimePipelineRunManifest(spec, sourceCommit, pipelineRun),
      next: { triggerCurrent: `bun scripts/cli.ts hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane} --confirm` },
    };
  }
  if (!scoped.rerun && before.exists === true && (before.status === "True" || before.status === "Unknown")) {
    const pipelineWait = before.status === "Unknown"
      ? waitForNodeRuntimePipelineRunTerminal(spec, pipelineRun, remainingTriggerSeconds(), {
        opportunisticPostSync: () => nodeRuntimeOpportunisticGitMirrorSync(scoped, sourceCommit, pipelineRun, triggerGitMirrorOptions),
        opportunisticPostFlush: () => nodeRuntimeOpportunisticGitMirrorFlush(scoped, sourceCommit, pipelineRun, triggerGitMirrorOptions),
      })
      : { ok: true, status: "already-succeeded", pipelineRun: before, polls: 0, elapsedMs: 0 };
    const waitedPipelineRun = record(pipelineWait.pipelineRun);
    const pipelineFailureSummary = nodeRuntimePipelineFailureSummary(pipelineWait);
    const postFlush = waitedPipelineRun.status === "True"
      ? nodeRuntimeEnsureGitMirrorFlushed(scoped, "post", sourceCommit, pipelineRun, null, triggerGitMirrorOptions)
      : null;
    const closeout = waitedPipelineRun.status === "True" && (postFlush === null || postFlush.ok === true)
      ? waitForNodeRuntimeCicdCloseout(scoped, pipelineRun, sourceCommit, triggerDeadlineMs, { allowRefresh: true })
      : null;
    const pipelinePending = pipelineWait.status === "pending";
    const closeoutPending = closeout?.status === "pending";
    const ok = pipelineWait.ok === true && (postFlush === null || postFlush.ok === true) && closeout?.ok === true;
    const elapsedMs = triggerElapsedMs();
    const triggerWarning = pipelinePending || closeoutPending ? null : nodeRuntimeTriggerElapsedWarning(spec, pipelineRun, elapsedMs);
    if (triggerWarning !== null) printNodeRuntimeTriggerProgress(spec, { stage: "trigger-current", status: "warning", ...triggerWarning });
    return {
      ok,
      command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
      node: scoped.node,
      lane: scoped.lane,
      mode: "confirmed-trigger",
      completion: pipelinePending || closeoutPending ? "pending" : ok ? "completed" : "failed",
      warning: pipelinePending
        ? pipelineWait.warning ?? nodeRuntimeCicdWaitWarning(spec, pipelineRun, pipelineWait)
        : closeoutPending
          ? nodeRuntimeCloseoutWaitWarning(spec, pipelineRun, closeout)
          : triggerWarning ?? undefined,
      triggerElapsedMs: elapsedMs,
      deadlineMs: triggerDeadlineMs,
      sourceCommit,
      pipelineRun,
      before,
      pipelineWait,
      pipelineFailureSummary,
      postFlush,
      closeout,
      sourceSnapshotSync: sourceSnapshotSync === null ? null : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
      skipped: true,
      reason: before.status === "True" ? "existing-pipelinerun-succeeded" : "existing-pipelinerun-running",
      skipPolicy: "source-commit-only",
      skipExplanation: "An existing PipelineRun for this HWLAB source commit was reused. If UniDesk node/lane YAML or other render inputs changed without a HWLAB source commit change, rerun the controlled publish with --rerun.",
      rerunAvailable: true,
      rerunCommand: `bun scripts/cli.ts hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane} --confirm --rerun`,
      degradedReason: ok
        ? undefined
        : pipelinePending
          ? "node-runtime-existing-pipelinerun-not-succeeded"
          : postFlush !== null && postFlush.ok !== true
            ? "node-runtime-git-mirror-post-flush-failed"
            : closeoutPending
              ? "node-runtime-cicd-closeout-pending"
              : "node-runtime-cicd-closeout-failed",
      next: {
        status: `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${pipelineRun}`,
        rerun: `bun scripts/cli.ts hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane} --confirm --rerun`,
      },
    };
  }
  printNodeRuntimeTriggerProgress(spec, { stage: "git-mirror-pre-sync", status: "started", sourceCommit, pipelineRun });
  const gitMirror = spec.sourceAuthority?.mode === "giteaSnapshot"
    ? nodeRuntimeEnsureGiteaSourceCurrent(scoped, sourceCommit, pipelineRun, triggerGitMirrorOptions)
    : nodeRuntimeEnsureGitMirrorSourceCurrent(scoped, sourceCommit, pipelineRun, triggerGitMirrorOptions);
  if (gitMirror.ok !== true) {
    printNodeRuntimeTriggerProgress(spec, { stage: "git-mirror-pre-sync", status: "failed", sourceCommit, pipelineRun, reason: gitMirror.degradedReason ?? null });
    return {
      ok: false,
      command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
      node: scoped.node,
      lane: scoped.lane,
      phase: "git-mirror-pre-sync",
      sourceCommit,
      pipelineRun,
      before,
      gitMirror,
      sourceSnapshotSync: sourceSnapshotSync === null ? null : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
      degradedReason: "node-runtime-git-mirror-pre-sync-failed",
    };
  }
  printNodeRuntimeTriggerProgress(spec, { stage: "git-mirror-pre-sync", status: "succeeded", sourceCommit, pipelineRun });
  printNodeRuntimeTriggerProgress(spec, { stage: "control-plane-refresh", status: "started", sourceCommit, pipelineRun });
  const applyScoped = nodeRuntimeScopedForTriggerDeadline(scoped, triggerDeadlineMs, 1);
  const refresh = applyScoped === null
    ? nodeRuntimeTriggerBudgetExhausted(scoped, "control-plane-apply", sourceCommit, pipelineRun)
    : nodeRuntimeApply({ ...applyScoped, action: "apply", dryRun: false });
  if (refresh.ok !== true) {
    const diagnostics = record(refresh.diagnostics);
    printNodeRuntimeTriggerProgress(spec, {
      stage: "control-plane-refresh",
      status: "failed",
      sourceCommit,
      pipelineRun,
      ...(diagnostics.classification === "ssh-tcp-pool-transient"
        ? { reason: "ssh-tcp-pool-transient", failureKind: diagnostics.failureKind ?? null }
        : {}),
    });
    return {
      ok: false,
      command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
      node: scoped.node,
      lane: scoped.lane,
      phase: "control-plane-apply",
      sourceCommit,
      pipelineRun,
      refresh,
      sourceSnapshotSync: sourceSnapshotSync === null ? null : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
      diagnostics: Object.keys(diagnostics).length > 0 ? diagnostics : null,
      degradedReason: "node-runtime-control-plane-apply-before-trigger-failed",
      next: {
        retryTriggerCurrent: `bun scripts/cli.ts hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane} --confirm`,
        ...(diagnostics.classification === "ssh-tcp-pool-transient" ? { sshPoolStatus: `bun scripts/cli.ts debug ssh-pool ${scoped.node}` } : {}),
      },
    };
  }
  printNodeRuntimeTriggerProgress(spec, { stage: "control-plane-refresh", status: "succeeded", sourceCommit, pipelineRun });
  printNodeRuntimeTriggerProgress(spec, { stage: "create-pipelinerun", status: "started", sourceCommit, pipelineRun, rerun: scoped.rerun });
  const create = createNodeRuntimePipelineRun(spec, sourceCommit, pipelineRun, Math.max(1, remainingTriggerSeconds()), scoped.rerun);
  const after = getNodeRuntimePipelineRun(spec, pipelineRun);
  const createObserved = after.exists === true && (after.status === "Unknown" || after.status === "True");
  const createOk = isCommandSuccess(create) || createObserved;
  printNodeRuntimeTriggerProgress(spec, { stage: "create-pipelinerun", status: createOk ? "succeeded" : "failed", sourceCommit, pipelineRun, exitCode: create.exitCode, createObservedAfterTimeout: createObserved && !isCommandSuccess(create) ? true : undefined });
  const pipelineWait = createOk
    ? waitForNodeRuntimePipelineRunTerminal(spec, pipelineRun, remainingTriggerSeconds(), {
      opportunisticPostSync: () => nodeRuntimeOpportunisticGitMirrorSync(scoped, sourceCommit, pipelineRun, triggerGitMirrorOptions),
      opportunisticPostFlush: () => nodeRuntimeOpportunisticGitMirrorFlush(scoped, sourceCommit, pipelineRun, triggerGitMirrorOptions),
    })
    : null;
  const waitedPipelineRun = record(pipelineWait?.pipelineRun);
  const pipelineFailureSummary = nodeRuntimePipelineFailureSummary(pipelineWait);
  const postFlush = waitedPipelineRun.status === "True"
    ? nodeRuntimeEnsureGitMirrorFlushed(scoped, "post", sourceCommit, pipelineRun, null, triggerGitMirrorOptions)
    : null;
  const closeout = waitedPipelineRun.status === "True" && (postFlush === null || postFlush.ok === true)
    ? waitForNodeRuntimeCicdCloseout(scoped, pipelineRun, sourceCommit, triggerDeadlineMs, { allowRefresh: true })
    : null;
  const pipelineReady = pipelineWait !== null && pipelineWait.ok === true;
  const postFlushOk = postFlush === null || postFlush.ok === true;
  const pipelinePending = pipelineWait !== null && pipelineWait.status === "pending";
  const closeoutPending = closeout?.status === "pending";
  const ok = createOk && pipelineReady && postFlushOk && closeout?.ok === true;
  const elapsedMs = triggerElapsedMs();
  const triggerWarning = pipelinePending || closeoutPending ? null : nodeRuntimeTriggerElapsedWarning(spec, pipelineRun, elapsedMs);
  if (triggerWarning !== null) printNodeRuntimeTriggerProgress(spec, { stage: "trigger-current", status: "warning", ...triggerWarning });
  return {
    ok,
    command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
    node: scoped.node,
    lane: scoped.lane,
    mode: "confirmed-trigger",
    completion: pipelinePending || closeoutPending ? "pending" : ok ? "completed" : "failed",
    warning: pipelinePending
      ? pipelineWait?.warning ?? nodeRuntimeCicdWaitWarning(spec, pipelineRun, pipelineWait)
      : closeoutPending
        ? nodeRuntimeCloseoutWaitWarning(spec, pipelineRun, closeout)
        : triggerWarning ?? undefined,
    triggerElapsedMs: elapsedMs,
    deadlineMs: triggerDeadlineMs,
    mutation: createOk,
    sourceCommit,
    pipelineRun,
    sourceSnapshotSync: sourceSnapshotSync === null ? null : compactNodeRuntimeGitMirrorRun(sourceSnapshotSync),
    rerunOf: scoped.rerun ? basePipelineRun : null,
    rerun: scoped.rerun,
    before,
    gitMirror,
    refresh,
    create: compactRuntimeCommand(create),
    after,
    pipelineWait,
    pipelineFailureSummary,
    postFlush,
    closeout,
    createObservedAfterTimeout: createObserved && !isCommandSuccess(create) ? true : undefined,
    degradedReason: ok
      ? undefined
      : !createOk
        ? "node-runtime-pipelinerun-create-failed"
        : pipelinePending
          ? "node-runtime-pipelinerun-not-succeeded"
          : !pipelineReady
          ? "node-runtime-pipelinerun-not-succeeded"
          : !postFlushOk
            ? "node-runtime-git-mirror-post-flush-failed"
            : closeoutPending
              ? "node-runtime-cicd-closeout-pending"
              : "node-runtime-cicd-closeout-failed",
    next: { status: `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${pipelineRun}` },
  };
}

export function nodeRuntimeCicdWaitSeconds(scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): number {
  return Math.min(scoped.timeoutSeconds, NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS);
}

function nodeRuntimeTriggerGitMirrorOptions(deadlineMs: number): NodeRuntimeGitMirrorRunOptions {
  return { deadlineMs, maxAttempts: 1 };
}

function nodeRuntimeSourceSnapshotSync(
  scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>,
  deadlineMs: number,
  gitMirrorOptions: NodeRuntimeGitMirrorRunOptions,
): Record<string, unknown> {
  const syncScoped = nodeRuntimeScopedForTriggerDeadline(scoped, deadlineMs);
  if (syncScoped === null) return nodeRuntimeTriggerBudgetExhausted(scoped, "source-snapshot-sync", "-", "-");
  if (scoped.spec.sourceAuthority?.mode === "giteaSnapshot") return nodeRuntimeGiteaMirrorSync(scoped, deadlineMs);
  return nodeRuntimeGitMirrorRun({
    ...syncScoped,
    domain: "git-mirror",
    action: "sync",
    confirm: true,
    dryRun: false,
    wait: true,
    discardStaleGitops: scoped.discardStaleGitops === true || scoped.rerun === true,
  }, gitMirrorOptions);
}

function nodeRuntimeGiteaMirrorSync(scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>, deadlineMs: number): Record<string, unknown> {
  const repoKey = scoped.spec.sourceAuthority?.giteaMirrorRepoKey;
  if (typeof repoKey !== "string" || repoKey.length === 0) {
    return {
      ok: false,
      action: "platform-infra-gitea-mirror-sync",
      mode: "gitea-controlled-snapshot-sync",
      mutation: false,
      degradedReason: "node-runtime-gitea-repo-key-missing",
    };
  }
  const timeoutMs = Math.max(1_000, Math.min(120_000, deadlineMs - Date.now()));
  const result = runCommand([
    "bun",
    "scripts/cli.ts",
    "platform-infra",
    "gitea",
    "mirror",
    "sync",
    "--target",
    scoped.node,
    "--repo",
    repoKey,
    "--confirm",
    "--raw",
  ], repoRoot, { timeoutMs });
  const parsedRoot = record(parseJsonObject(statusText(result)));
  const parsed = record(parsedRoot.data ?? parsedRoot);
  const ok = result.exitCode === 0 && (parsed.ok === true || parsedRoot.ok === true);
  return {
    ok,
    action: "platform-infra-gitea-mirror-sync",
    mode: "gitea-controlled-snapshot-sync",
    mutation: ok,
    repoKey,
    sourceAuthority: "gitea-snapshot",
    sourceBundles: parsed.sourceBundles ?? null,
    repositories: parsed.repositories ?? null,
    result: compactRuntimeCommand(result),
    remote: parsed,
    degradedReason: ok ? undefined : "node-runtime-gitea-source-snapshot-sync-failed",
    next: ok ? undefined : {
      status: `bun scripts/cli.ts platform-infra gitea mirror status --target ${scoped.node} --repo ${repoKey}`,
      retry: `bun scripts/cli.ts platform-infra gitea mirror sync --target ${scoped.node} --repo ${repoKey} --confirm`,
    },
  };
}

function nodeRuntimeEnsureGiteaSourceCurrent(
  scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>,
  sourceCommit: string,
  pipelineRun: string,
  options: NodeRuntimeGitMirrorRunOptions,
): Record<string, unknown> {
  const flush = nodeRuntimeEnsureGitMirrorFlushed(scoped, "pre", sourceCommit, pipelineRun, null, options);
  return {
    ok: flush.ok === true,
    mode: "gitea-source-authority",
    sourceAuthority: "gitea-snapshot",
    sourceCommit,
    sourceCurrent: true,
    legacyGitMirrorRole: "gitops-flush-only",
    flush,
    degradedReason: flush.ok === true ? undefined : "node-runtime-git-mirror-pre-flush-failed",
  };
}

function nodeRuntimeScopedForTriggerDeadline(
  scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>,
  deadlineMs: number,
  minRemainingSeconds = 1,
): ReturnType<typeof parseNodeScopedDelegatedOptions> | null {
  const remainingSeconds = Math.floor((deadlineMs - Date.now()) / 1000);
  if (remainingSeconds < minRemainingSeconds) return null;
  return { ...scoped, timeoutSeconds: Math.max(1, Math.min(scoped.timeoutSeconds, remainingSeconds)) };
}

function nodeRuntimeTriggerBudgetExhausted(
  scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>,
  phase: string,
  sourceCommit: string,
  pipelineRun: string,
): Record<string, unknown> {
  return {
    ok: false,
    command: `hwlab nodes control-plane trigger-current --node ${scoped.node} --lane ${scoped.lane}`,
    node: scoped.node,
    lane: scoped.lane,
    phase,
    sourceCommit,
    pipelineRun,
    status: "pending",
    degradedReason: "node-runtime-cicd-budget-exhausted",
    next: { status: `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${pipelineRun} --full` },
  };
}

export function waitForNodeRuntimeCicdCloseout(
  scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>,
  pipelineRun: string,
  sourceCommit: string,
  deadlineMs: number,
  options: { allowRefresh?: boolean } = {},
): Record<string, unknown> {
  const spec = scoped.spec;
  const startedAt = Date.now();
  let polls = 0;
  let lastSummary: Record<string, unknown> | null = null;
  let refresh: Record<string, unknown> | null = null;
  printNodeRuntimeTriggerProgress(spec, { stage: "runtime-closeout", status: "started", pipelineRun, sourceCommit, remainingSeconds: Math.max(0, Math.floor((deadlineMs - Date.now()) / 1000)) });
  while (Date.now() <= deadlineMs) {
    const statusScoped = nodeRuntimeScopedForTriggerDeadline(scoped, deadlineMs, 5);
    if (statusScoped === null) break;
    polls += 1;
    const status = nodeRuntimeControlPlaneStatus({
      ...statusScoped,
      action: "status",
      confirm: false,
      dryRun: true,
      wait: false,
      originalArgs: ["status", "--node", scoped.node, "--lane", scoped.lane, "--source-commit", sourceCommit, "--pipeline-run", pipelineRun],
    });
    const summary = record(record(status).summary ?? status);
    lastSummary = summary;
    const pipeline = record(summary.pipelineRun);
    const argo = record(summary.argo);
    const runtime = record(summary.runtime);
    const publicProbe = record(summary.publicProbe);
    const gitMirror = record(summary.gitMirror);
    const degradedReason = typeof summary.degradedReason === "string" ? summary.degradedReason : null;
    printNodeRuntimeTriggerProgress(spec, {
      stage: "runtime-closeout",
      status: "poll",
      pipelineRun,
      sourceCommit,
      polls,
      elapsedMs: Date.now() - startedAt,
      degradedReason,
      pipelineStatus: pipeline.status ?? null,
      argoSync: argo.syncStatus ?? null,
      argoHealth: argo.health ?? null,
      argoRevision: argo.syncRevision ?? null,
      argoTargetRevision: argo.targetGitopsRevision ?? null,
      runtimeReady: runtime.ready === true,
      publicReady: publicProbe.ready === true,
      gitMirrorPending: gitMirror.pendingFlush ?? null,
      gitMirrorInSync: gitMirror.githubInSync ?? null,
    });
    if (summary.ok === true) {
      printNodeRuntimeTriggerProgress(spec, { stage: "runtime-closeout", status: "succeeded", pipelineRun, sourceCommit, polls, elapsedMs: Date.now() - startedAt });
      return {
        ok: true,
        status: "succeeded",
        pipelineRun,
        sourceCommit,
        polls,
        elapsedMs: Date.now() - startedAt,
        summary,
        refresh,
      };
    }
    const refreshScoped = nodeRuntimeScopedForTriggerDeadline(scoped, deadlineMs, 5);
    if (options.allowRefresh === true && refresh === null && refreshScoped !== null && (degradedReason === "argo-revision-not-observed" || degradedReason === "argo-target-revision-progressing" || degradedReason === "argo-health-progressing")) {
      refresh = nodeRuntimeRefresh({ ...refreshScoped, action: "refresh", confirm: true, dryRun: false, wait: true });
      printNodeRuntimeTriggerProgress(spec, {
        stage: "runtime-closeout-refresh",
        status: refresh.ok === true ? "succeeded" : "failed",
        pipelineRun,
        sourceCommit,
        degradedReason: refresh.degradedReason ?? null,
      });
    }
    if (degradedReason !== null && !nodeRuntimeCloseoutRetryableReason(degradedReason)) {
      printNodeRuntimeTriggerProgress(spec, { stage: "runtime-closeout", status: "failed", pipelineRun, sourceCommit, polls, elapsedMs: Date.now() - startedAt, degradedReason });
      return {
        ok: false,
        status: "failed",
        pipelineRun,
        sourceCommit,
        polls,
        elapsedMs: Date.now() - startedAt,
        summary,
        refresh,
        degradedReason,
        next: { status: `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${pipelineRun} --full` },
      };
    }
    const remainingMs = deadlineMs - Date.now();
    if (remainingMs <= 0) break;
    sleepCloseout(Math.min(5_000, Math.max(1000, remainingMs)));
  }
  const elapsedMs = Date.now() - startedAt;
  printNodeRuntimeTriggerProgress(spec, {
    stage: "runtime-closeout",
    status: "warning",
    pipelineRun,
    sourceCommit,
    polls,
    elapsedMs,
    waitLimitSeconds: NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS,
    degradedReason: lastSummary?.degradedReason ?? null,
  });
  return {
    ok: false,
    status: "pending",
    pipelineRun,
    sourceCommit,
    polls,
    elapsedMs,
    summary: lastSummary,
    refresh,
    waitLimitSeconds: NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS,
    degradedReason: "node-runtime-cicd-closeout-pending",
    next: { status: `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${pipelineRun} --full` },
  };
}

export function nodeRuntimeCloseoutRetryableReason(reason: string): boolean {
  return reason === "argo-revision-not-observed"
    || reason === "argo-target-revision-progressing"
    || reason === "argo-health-progressing"
    || reason === "runtime-workloads-not-ready"
    || reason === "public-probe-not-ready"
    || reason === "git-mirror-pending-flush";
}

function sleepCloseout(ms: number): void {
  const buffer = new SharedArrayBuffer(4);
  Atomics.wait(new Int32Array(buffer), 0, 0, Math.max(0, ms));
}

export function nodeRuntimeCicdWaitWarning(spec: HwlabRuntimeLaneSpec, pipelineRun: string, pipelineWait: unknown): Record<string, unknown> {
  const wait = record(pipelineWait);
  return {
    code: "node-runtime-cicd-wait-over-120s",
    message: `PipelineRun ${pipelineRun} is still non-terminal after ${NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS}s; this is a severe timeout and requires further investigation of Tekton TaskRuns/Pods instead of treating it as normal wait time.`,
    waitedSeconds: NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS,
    elapsedMs: wait.elapsedMs ?? null,
    polls: wait.polls ?? null,
    inspectEnvReuse: `bun scripts/cli.ts hwlab nodes control-plane status --node ${spec.nodeId} --lane ${spec.lane} --pipeline-run ${pipelineRun} --full`,
    inspectGitMirror: `bun scripts/cli.ts hwlab nodes git-mirror status --node ${spec.nodeId} --lane ${spec.lane}`,
  };
}

export function nodeRuntimeCloseoutWaitWarning(spec: HwlabRuntimeLaneSpec, pipelineRun: string, closeout: unknown): Record<string, unknown> {
  const wait = record(closeout);
  const summary = record(wait.summary);
  return {
    code: "node-runtime-cicd-closeout-over-120s",
    message: `PipelineRun ${pipelineRun} reached terminal state, but GitOps/Argo/runtime/public closeout did not converge inside the ${NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS}s one-command CICD budget.`,
    waitedSeconds: NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS,
    elapsedMs: wait.elapsedMs ?? null,
    polls: wait.polls ?? null,
    degradedReason: summary.degradedReason ?? wait.degradedReason ?? null,
    inspectCloseout: `bun scripts/cli.ts hwlab nodes control-plane status --node ${spec.nodeId} --lane ${spec.lane} --pipeline-run ${pipelineRun} --full`,
    inspectGitMirror: `bun scripts/cli.ts hwlab nodes git-mirror status --node ${spec.nodeId} --lane ${spec.lane}`,
  };
}

export function nodeRuntimeTriggerElapsedWarning(spec: HwlabRuntimeLaneSpec, pipelineRun: string, elapsedMs: number): Record<string, unknown> | null {
  if (elapsedMs < NODE_RUNTIME_TRIGGER_SEVERE_WARNING_MS) return null;
  return {
    code: "node-runtime-trigger-over-120s",
    message: `trigger-current total elapsed time exceeded ${NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS}s; this is a severe timeout even if the PipelineRun eventually succeeded and requires follow-up investigation of slow control-plane, Tekton and git-mirror stages.`,
    thresholdMs: NODE_RUNTIME_TRIGGER_SEVERE_WARNING_MS,
    elapsedMs,
    inspectEnvReuse: `bun scripts/cli.ts hwlab nodes control-plane status --node ${spec.nodeId} --lane ${spec.lane} --pipeline-run ${pipelineRun} --full`,
    inspectGitMirror: `bun scripts/cli.ts hwlab nodes git-mirror status --node ${spec.nodeId} --lane ${spec.lane}`,
  };
}

export function withNodeRuntimeTriggerRendered(result: Record<string, unknown>, scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): RenderedCliResult {
  const pipelineWait = record(result.pipelineWait);
  const pipelineRunRecord = record(pipelineWait.pipelineRun ?? result.after ?? result.before);
  const warning = record(result.warning ?? pipelineWait.warning);
  const postFlush = record(result.postFlush);
  const closeout = record(result.closeout);
  const closeoutSummary = record(closeout.summary);
  const closeoutArgo = record(closeoutSummary.argo);
  const closeoutRuntime = record(closeoutSummary.runtime);
  const closeoutPublic = record(closeoutSummary.publicProbe);
  const closeoutGitMirror = record(closeoutSummary.gitMirror);
  const gitMirror = record(result.gitMirror);
  const gitMirrorSummary = record(postFlush.afterSummary ?? postFlush.beforeSummary ?? gitMirror.statusSummary ?? gitMirror.afterSummary ?? gitMirror.beforeSummary ?? gitMirror.summary);
  const refresh = record(result.refresh);
  const create = record(result.create);
  const next = record(result.next);
  const pipelineStatus = pipelineRunRecord.status ?? pipelineWait.status ?? "-";
  const completion = result.completion ?? (result.ok === true ? "completed" : "failed");
  const topStatus = result.ok === true ? "ok" : completion === "pending" ? "pending" : "failed";
  const renderedText = [
    "hwlab nodes control-plane trigger-current",
    "",
    webObserveTable(
      ["NODE", "LANE", "STATUS", "COMPLETION", "SOURCE", "PIPELINERUN"],
      [[scoped.node, scoped.lane, topStatus, webObserveText(completion), shortValue(result.sourceCommit), webObserveText(result.pipelineRun)]],
    ),
    "",
    webObserveTable(
      ["STAGE", "STATUS", "DETAIL"],
      [
        ["git-mirror", gitMirror.ok === true ? "ok" : gitMirror.ok === false ? "failed" : "-", webObserveText(gitMirror.mode ?? gitMirror.degradedReason)],
        ["refresh", refresh.ok === true ? "ok" : refresh.ok === false ? "failed" : "-", webObserveText(refresh.degradedReason)],
        ["create", create.exitCode === 0 || result.mutation === true ? "ok" : create.exitCode === undefined ? "-" : "failed", result.createObservedAfterTimeout === true ? "observed-after-timeout" : `exit=${webObserveText(create.exitCode)}`],
        ["pipeline-wait", webObserveText(pipelineWait.status), `pipeline=${webObserveText(pipelineStatus)} polls=${webObserveText(pipelineWait.polls)} elapsed=${formatElapsedMs(pipelineWait.elapsedMs)}`],
        ["post-flush", postFlush.ok === true ? "ok" : postFlush.ok === false ? "failed" : "-", webObserveText(postFlush.mode ?? postFlush.degradedReason)],
        ["closeout", closeout.ok === true ? "ok" : closeout.status === "pending" ? "pending" : closeout.ok === false ? "failed" : "-", `reason=${webObserveText(closeoutSummary.degradedReason ?? closeout.degradedReason)} polls=${webObserveText(closeout.polls)} elapsed=${formatElapsedMs(closeout.elapsedMs)}`],
        ["total", result.triggerElapsedMs === undefined ? "-" : "elapsed", formatElapsedMs(result.triggerElapsedMs)],
      ],
    ),
    "",
    Object.keys(warning).length === 0
      ? "WARNING\n-"
      : webObserveTable(
        ["CODE", "MESSAGE"],
        [[webObserveText(warning.code ?? "warning"), webObserveText(warning.message ?? "PipelineRun is still active after the default wait window.")]],
      ),
    "",
    Object.keys(warning).length === 0
      ? "INSPECT\n-"
      : webObserveTable(
        ["CHECK", "COMMAND"],
        [
          ["closeout", webObserveText(warning.inspectCloseout ?? warning.inspectEnvReuse ?? `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${result.pipelineRun} --full`)],
          ["git-mirror", webObserveText(warning.inspectGitMirror ?? `bun scripts/cli.ts hwlab nodes git-mirror status --node ${scoped.node} --lane ${scoped.lane}`)],
        ],
      ),
    "",
    Object.keys(closeoutSummary).length === 0
      ? "CLOSEOUT\n-"
      : webObserveTable(
        ["ARGO", "REV", "RUNTIME", "PUBLIC", "GIT_MIRROR"],
        [[
          `${webObserveText(closeoutArgo.syncStatus)}/${webObserveText(closeoutArgo.health)}`,
          `${shortValue(closeoutArgo.syncRevision)}->${shortValue(closeoutArgo.targetGitopsRevision)}`,
          `${webObserveText(closeoutRuntime.ready)} workloads=${webObserveText(closeoutRuntime.workloadReady)}`,
          webObserveText(closeoutPublic.ready),
          `pending=${webObserveText(closeoutGitMirror.pendingFlush)} inSync=${webObserveText(closeoutGitMirror.githubInSync)}`,
        ]],
      ),
    "",
    Object.keys(gitMirrorSummary).length === 0
      ? "GIT_MIRROR\n-"
      : webObserveTable(
        ["LOCAL_SOURCE", "GITHUB_SOURCE", "LOCAL_GITOPS", "GITHUB_GITOPS", "PENDING", "IN_SYNC"],
        [[
          shortValue(gitMirrorSummary.localSource),
          shortValue(gitMirrorSummary.githubSource),
          shortValue(gitMirrorSummary.localGitops),
          shortValue(gitMirrorSummary.githubGitops),
          webObserveText(gitMirrorSummary.pendingFlush),
          webObserveText(gitMirrorSummary.githubInSync),
        ]],
      ),
    "",
    "NEXT",
    `  ${next.status ?? `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --pipeline-run ${result.pipelineRun}`}`,
    "",
    "Disclosure:",
    "  default view is a bounded CICD summary; use --full or --raw for the complete JSON payload.",
    `  ${NODE_RUNTIME_CICD_WAIT_WARNING_SECONDS}s is the severe timeout warning threshold for both PipelineRun wait and total trigger elapsed time.`,
  ].join("\n");
  return { ...result, renderedText, contentType: "text/plain" };
}

export function withNodeRuntimeControlPlanePlanRendered(result: Record<string, unknown>, scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): RenderedCliResult {
  const checks = record(result.checks);
  const next = record(result.next);
  const renderedText = [
    "hwlab nodes control-plane plan",
    "",
    webObserveTable(
      ["NODE", "LANE", "STATUS", "MODE", "NAMESPACE", "EXT_PG", "PUBLIC"],
      [[
        scoped.node,
        scoped.lane,
        result.ok === true ? "ok" : "failed",
        webObserveText(result.mode),
        webObserveText(checks.runtimeNamespace),
        webObserveText(checks.externalPostgresActive),
        webObserveText(checks.publicExposureDeclared),
      ]],
    ),
    "",
    webObserveTable(
      ["CHECK", "VALUE"],
      [
        ["node-scoped-target", webObserveText(checks.nodeScopedTargetConfigured)],
        ["external-postgres-declared", webObserveText(checks.externalPostgresDeclared)],
        ["external-postgres-active", webObserveText(checks.externalPostgresActive)],
        ["local-postgres-absent", webObserveText(checks.localPostgresExpectedAbsent)],
        ["secret-values-printed", webObserveText(checks.secretValuesPrinted)],
      ],
    ),
    "",
    "NEXT",
    `  ${next.status ?? `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane}`}`,
    "",
    "Disclosure:",
    "  default view is a bounded control-plane plan summary; use --full or --raw for the complete JSON payload.",
  ].join("\n");
  return { ...result, renderedText, contentType: "text/plain" };
}

export function withNodeRuntimeControlPlaneStatusRendered(result: Record<string, unknown>, scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): RenderedCliResult {
  const pipelineRun = record(result.pipelineRun);
  const pipelineRunDiagnostics = record(pipelineRun.diagnostics);
  const argo = record(result.argo);
  const argoDiagnostics = record(argo.diagnostics);
  const argoOperation = record(argoDiagnostics.operationState);
  const runtime = record(result.runtime);
  const publicProbe = record(result.publicProbe);
  const gitMirror = record(result.gitMirror);
  const next = record(result.next);
  const publicProbeDetail = nodeRuntimePublicProbeDetail(publicProbe);
  const notReadyWorkloads = Array.isArray(runtime.notReadyWorkloads) ? runtime.notReadyWorkloads.map((item) => webObserveText(item)).filter(Boolean) : [];
  const runtimeDetail = [
    `workloads=${webObserveText(runtime.workloadReady)}`,
    `pg=${webObserveText(runtime.externalPostgresReady ?? runtime.localPostgresReady)}`,
    ...(notReadyWorkloads.length > 0 ? [`notReady=${webObserveShort(notReadyWorkloads.join(","), 80)}`] : []),
  ].join(" ");
  const failedTaskRuns = Array.isArray(pipelineRunDiagnostics.failedTaskRuns) ? pipelineRunDiagnostics.failedTaskRuns.map(compactNodeRuntimeTaskRunDiagnostic).filter(Boolean) : [];
  const pendingTaskRuns = Array.isArray(pipelineRunDiagnostics.pendingTaskRuns) ? pipelineRunDiagnostics.pendingTaskRuns.map(compactNodeRuntimeTaskRunDiagnostic).filter(Boolean) : [];
  const pipelineNext = record(pipelineRunDiagnostics.next);
  const pendingTaskRunCommand = typeof pipelineNext.pendingTaskRun === "string" ? pipelineNext.pendingTaskRun : null;
  const pendingPodCommand = typeof pipelineNext.pendingPod === "string" ? pipelineNext.pendingPod : null;
  const pipelineDetail = [
    webObserveShort(webObserveText(pipelineRun.reason ?? pipelineRun.message), 50),
    ...(failedTaskRuns.length > 0 ? [`failed=${webObserveShort(failedTaskRuns.join(","), 80)}`] : []),
    ...(pendingTaskRuns.length > 0 ? [`pending=${webObserveShort(pendingTaskRuns.join(","), 80)}`] : []),
  ].filter(Boolean).join(" ");
  const status = result.ok === true ? "ok" : result.ok === false ? "failed" : "-";
  const renderedText = [
    "hwlab nodes control-plane status",
    "",
    webObserveTable(
      ["NODE", "LANE", "STATUS", "REASON", "SOURCE", "PIPELINERUN"],
      [[
        scoped.node,
        scoped.lane,
        status,
        webObserveShort(webObserveText(result.degradedReason), 40),
        shortValue(result.sourceCommit),
        webObserveShort(webObserveText(pipelineRun.name), 36),
      ]],
    ),
    ...nodeRuntimeStatusObservationLines(result),
    "",
    webObserveTable(
      ["STAGE", "STATUS", "DETAIL"],
      [
        ["pipeline", pipelineRun.skipped === true ? "skipped" : pipelineRun.ready === true ? "ok" : pipelineRun.exists === true ? webObserveText(pipelineRun.status) : "missing", pipelineDetail],
        ["argo", argo.skipped === true ? "skipped" : argo.ready === true ? "ok" : "failed", `${webObserveText(argo.syncStatus)}/${webObserveText(argo.health)} rev=${shortValue(argo.syncRevision)} target=${shortValue(argo.targetGitopsRevision)} op=${webObserveText(argoOperation.phase)}`],
        ["runtime", runtime.skipped === true ? "skipped" : runtime.ready === true ? "ok" : "failed", runtimeDetail],
        ["public", publicProbe.skipped === true ? "skipped" : publicProbe.ready === true ? "ok" : "failed", publicProbeDetail],
        ["git-mirror", gitMirror.skipped === true ? "skipped" : gitMirror.ready === true ? "ok" : "failed", `snapshot=${webObserveText(gitMirror.sourceSnapshotReady)} pending=${webObserveText(gitMirror.pendingFlush)} inSync=${webObserveText(gitMirror.githubInSync)}`],
      ],
    ),
    ...(pendingTaskRunCommand === null && pendingPodCommand === null ? [] : [
      "",
      "DRILL_DOWN",
      ...(pendingTaskRunCommand === null ? [] : [`  pending TaskRun: ${pendingTaskRunCommand}`]),
      ...(pendingPodCommand === null ? [] : [`  pending Pod: ${pendingPodCommand}`]),
    ]),
    "",
    webObserveTable(
      ["LOCAL_SOURCE", "GITHUB_SOURCE", "SNAPSHOT", "LOCAL_GITOPS", "GITHUB_GITOPS"],
      [[
        shortValue(gitMirror.localSource),
        shortValue(gitMirror.githubSource),
        shortValue(gitMirror.sourceSnapshot),
        shortValue(gitMirror.localGitops),
        shortValue(gitMirror.githubGitops),
      ]],
    ),
    "",
    "NEXT",
    `  ${result.nextAction ?? next.full ?? `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --full`}`,
    "",
    "Disclosure:",
    "  default view is a bounded control-plane status summary; use --json for compact JSON, --full for bounded drill-down, or --raw for complete JSON.",
  ].join("\n");
  return { ...result, renderedText, contentType: "text/plain" };
}

export function withNodeRuntimeControlPlaneStatusFullRendered(result: Record<string, unknown>, scoped: ReturnType<typeof parseNodeScopedDelegatedOptions>): RenderedCliResult {
  const summary = record(result.summary);
  const pipelineRun = record(summary.pipelineRun);
  const argo = record(summary.argo);
  const argoDiagnostics = record(argo.diagnostics);
  const argoOperation = record(argoDiagnostics.operationState);
  const argoProblemResources = arrayRecords(argoDiagnostics.problemResources);
  const argoOperationResources = arrayRecords(argoDiagnostics.operationResources);
  const argoConditions = arrayRecords(argoDiagnostics.conditions);
  const argoEvents = arrayRecords(argoDiagnostics.events);
  const runtimeSummary = record(summary.runtime);
  const publicProbe = record(summary.publicProbe);
  const publicProbeDetail = nodeRuntimePublicProbeDetail(publicProbe);
  const gitMirror = record(summary.gitMirror);
  const runtime = record(result.runtime);
  const bridge = record(runtime.externalPostgresBridge);
  const secrets = record(runtime.externalPostgresSecrets);
  const next = record(summary.next);
  const workloadReadiness = Array.isArray(runtime.workloadReadiness) ? runtime.workloadReadiness.map(record) : [];
  const pipelineDiagnostics = record(record(summary.pipelineRun).diagnostics);
  const pipelineNext = record(pipelineDiagnostics.next);
  const pendingTaskRunCommand = typeof pipelineNext.pendingTaskRun === "string" ? pipelineNext.pendingTaskRun : null;
  const pendingPodCommand = typeof pipelineNext.pendingPod === "string" ? pipelineNext.pendingPod : null;
  const workloadRows = workloadReadiness.length === 0
    ? [["-", "-", "-", "-", "-"]]
    : workloadReadiness.slice(0, 18).map((item) => [
      webObserveText(item.ref),
      item.ready === true ? "ok" : "not-ready",
      webObserveText(item.readyReplicas),
      webObserveText(item.currentReplicas),
      webObserveText(item.desiredReplicas),
    ]);
  const bridgeRows = bridge.required === false
    ? [["not-required", "-", "-", "-", "-"]]
    : [[
      bridge.ready === true ? "ok" : "failed",
      webObserveText(bridge.serviceName),
      webObserveText(bridge.endpointAddress),
      webObserveText(bridge.port),
      `${webObserveText(bridge.expectedEndpointAddress)}:${webObserveText(bridge.expectedPort)}`,
    ]];
  const secretRows = nodeRuntimeExternalPostgresSecretRows(secrets);
  const status = result.ok === true ? "ok" : result.ok === false ? "failed" : "-";
  const renderedText = [
    "hwlab nodes control-plane status --full",
    "",
    webObserveTable(
      ["NODE", "LANE", "STATUS", "REASON", "SOURCE", "PIPELINERUN"],
      [[
        scoped.node,
        scoped.lane,
        status,
        webObserveShort(webObserveText(summary.degradedReason ?? result.degradedReason), 40),
        shortValue(summary.sourceCommit ?? result.sourceCommit),
        webObserveShort(webObserveText(pipelineRun.name ?? result.pipelineRun), 36),
      ]],
    ),
    ...nodeRuntimeStatusObservationLines(result),
    "",
    webObserveTable(
      ["STAGE", "STATUS", "DETAIL"],
      [
        ["pipeline", pipelineRun.skipped === true ? "skipped" : pipelineRun.ready === true ? "ok" : pipelineRun.exists === true ? webObserveText(pipelineRun.status) : "missing", webObserveShort(webObserveText(pipelineRun.reason ?? pipelineRun.message), 80)],
        ["argo", argo.skipped === true ? "skipped" : argo.ready === true ? "ok" : "failed", `${webObserveText(argo.syncStatus)}/${webObserveText(argo.health)} rev=${shortValue(argo.syncRevision)} target=${shortValue(argo.targetGitopsRevision)}`],
        ["runtime", runtimeSummary.skipped === true ? "skipped" : runtimeSummary.ready === true ? "ok" : "failed", `namespace=${webObserveText(runtimeSummary.namespace)} workloads=${webObserveText(runtimeSummary.workloadReady)} pg=${webObserveText(runtimeSummary.externalPostgresReady ?? runtimeSummary.localPostgresReady)}`],
        ["public", publicProbe.skipped === true ? "skipped" : publicProbe.ready === true ? "ok" : "failed", publicProbeDetail],
        ["git-mirror", gitMirror.skipped === true ? "skipped" : gitMirror.ready === true ? "ok" : "failed", `pending=${webObserveText(gitMirror.pendingFlush)} inSync=${webObserveText(gitMirror.githubInSync)}`],
      ],
    ),
    ...(pendingTaskRunCommand === null && pendingPodCommand === null ? [] : [
      "",
      "PIPELINE_DRILL_DOWN",
      ...(pendingTaskRunCommand === null ? [] : [`  pending TaskRun: ${pendingTaskRunCommand}`]),
      ...(pendingPodCommand === null ? [] : [`  pending Pod: ${pendingPodCommand}`]),
    ]),
    "",
    "ARGO_OPERATION",
    webObserveTable(["PHASE", "MESSAGE", "STARTED", "FINISHED", "REVISION"], [[
      webObserveText(argoOperation.phase),
      webObserveShort(webObserveText(argoOperation.message), 120),
      webObserveText(argoOperation.startedAt),
      webObserveText(argoOperation.finishedAt),
      shortValue(argoOperation.syncResultRevision),
    ]]),
    "",
    "ARGO_INVALID_TASKS",
    webObserveTable(
      ["KIND", "NAMESPACE", "NAME", "STATUS", "MESSAGE"],
      argoOperationResources.length === 0
        ? [["-", "-", "-", "-", "-"]]
        : argoOperationResources.slice(0, 8).map((item) => [
          webObserveText(item.kind),
          webObserveText(item.namespace),
          webObserveShort(webObserveText(item.name), 44),
          webObserveText(item.status),
          webObserveShort(webObserveText(item.message), 120),
        ]),
    ),
    "",
    "ARGO_OUT_OF_SYNC",
    webObserveTable(
      ["KIND", "NAMESPACE", "NAME", "SYNC", "HEALTH"],
      argoProblemResources.length === 0
        ? [["-", "-", "-", "-", "-"]]
        : argoProblemResources.slice(0, 8).map((item) => [
          webObserveText(item.kind),
          webObserveText(item.namespace),
          webObserveShort(webObserveText(item.name), 44),
          webObserveText(item.status),
          webObserveText(item.healthStatus),
        ]),
    ),
    "",
    "ARGO_CONDITIONS",
    webObserveTable(
      ["TYPE", "MESSAGE", "TIME"],
      argoConditions.length === 0
        ? [["-", "-", "-"]]
        : argoConditions.slice(0, 6).map((item) => [
          webObserveText(item.type),
          webObserveShort(webObserveText(item.message), 120),
          webObserveText(item.lastTransitionTime),
        ]),
    ),
    "",
    "ARGO_EVENTS",
    webObserveTable(
      ["TYPE", "REASON", "COUNT", "TIME", "MESSAGE"],
      argoEvents.length === 0
        ? [["-", "-", "-", "-", "-"]]
        : argoEvents.slice(0, 6).map((item) => [
          webObserveText(item.type),
          webObserveText(item.reason),
          webObserveText(item.count),
          webObserveText(item.lastTimestamp),
          webObserveShort(webObserveText(item.message), 120),
        ]),
    ),
    "",
    "RUNTIME_WORKLOADS",
    webObserveTable(["REF", "READY", "READY_REPLICAS", "CURRENT", "DESIRED"], workloadRows),
    ...(workloadReadiness.length > workloadRows.length ? [`  ... ${workloadReadiness.length - workloadRows.length} more workloads omitted; use --raw for complete JSON.`] : []),
    "",
    "EXTERNAL_POSTGRES_BRIDGE",
    webObserveTable(["STATUS", "SERVICE", "ENDPOINT", "PORT", "EXPECTED"], bridgeRows),
    "",
    "EXTERNAL_POSTGRES_SECRETS",
    webObserveTable(["ROLE", "SECRET", "KEY", "PRESENT", "VALUES_PRINTED"], secretRows),
    "",
    "NEXT",
    `  ${summary.nextAction ?? next.full ?? `bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --full`}`,
    `  bun scripts/cli.ts hwlab nodes control-plane status --node ${scoped.node} --lane ${scoped.lane} --raw`,
    "",
    "Disclosure:",
    "  --full status is a bounded runtime-workloads drill-down view; use --raw only when complete JSON is required.",
    "  Secret evidence is limited to object metadata, key names, presence, and valuesPrinted=false.",
  ].join("\n");
  return { ...result, renderedText, contentType: "text/plain" };
}

function nodeRuntimeStatusObservationLines(result: Record<string, unknown>): string[] {
  const observation = record(result.observation);
  if (Object.keys(observation).length === 0) return [];
  const processGroup = record(observation.processGroup);
  const worker = record(observation.worker);
  const completed = statusProbeNames(observation.completedProbes);
  const unfinished = statusProbeNames(observation.unfinishedProbes);
  const workerDiagnostic = webObserveText(worker.stderrTail ?? worker.stdoutTail ?? "").replace(/\s+/gu, " ").trim();
  return [
    "",
    "OBSERVATION",
    webObserveTable(
      ["STATE", "PHASE", "ELAPSED", "BUDGET", "REASON", "PROCESS_GROUP"],
      [[
        webObserveText(observation.state),
        webObserveText(observation.currentPhase),
        formatElapsedMs(observation.durationMs),
        `${webObserveText(observation.totalBudgetSeconds)}s`,
        webObserveShort(webObserveText(observation.reason), 48),
        processGroup.cleaned === true ? "cleaned" : processGroup.cleaned === false ? "residual" : "not-requested",
      ]],
    ),
    `  completed=${completed.length === 0 ? "-" : completed.join(",")} unfinished=${unfinished.length === 0 ? "-" : unfinished.join(",")}`,
    ...(workerDiagnostic === "-" ? [] : [`  worker-error=${webObserveShort(workerDiagnostic, 160)}`]),
  ];
}

function statusProbeNames(value: unknown): string[] {
  return Array.isArray(value) ? value.filter((item): item is string => typeof item === "string").slice(0, 12) : [];
}

function nodeRuntimePublicProbeDetail(publicProbe: Record<string, unknown>): string {
  const web = record(publicProbe.web);
  const apiHealth = record(publicProbe.apiHealth);
  const diagnostic = record(publicProbe.diagnostic);
  return [
    `web=${webObserveShort(webObserveText(web.url), 80)}(${webObserveText(web.httpStatus)})`,
    `api=${webObserveShort(webObserveText(apiHealth.url), 80)}(${webObserveText(apiHealth.httpStatus)})`,
    webObserveShort(webObserveText(diagnostic.kind ?? diagnostic.message), 80),
  ].filter((item) => item !== "-").join(" ");
}

function arrayRecords(value: unknown): Record<string, unknown>[] {
  return Array.isArray(value)
    ? value.filter((item): item is Record<string, unknown> => typeof item === "object" && item !== null && !Array.isArray(item))
    : [];
}
