model

type Action struct {
	Summary string
	Command string // optional runnable command
}

type ActiveSession struct {
	User    string
	TTY     string
	From    string
	LoginAt string
	Idle    string
	Command string
}

type AnalysisResult struct {
	Health     HealthLevel
	Confidence int // 0-100

	// Coverage reports which collector mode produced this analysis and which
	// signal classes were not observable (e.g. lean/fleet mode omits several
	// collectors). Lets consumers avoid over-reading a reduced-signal verdict.
	Coverage CoverageInfo `json:"coverage,omitempty"`

	// PrimaryVerified is true when the formal verifier confirmed the primary
	// bottleneck's cause (Tier A/B). The verifier is additive — Health is still
	// score-driven — so when this is false on a degraded/critical result, the
	// UI/API should label the verdict "unverified".
	PrimaryVerified bool `json:"primary_verified"`

	// Facts is the typed-evidence layer (NEXTGEN Phase 2). Each entry
	// is a single observation with full provenance — see Fact in
	// model/fact.go. Phase 2 emits these in parallel to the legacy
	// Evidence/EvidenceV2 fields; Phase 4 makes them the canonical
	// input to the verifier gates.
	Facts []Fact `json:"facts,omitempty"`

	// Entities is the host-local entity graph (NEXTGEN Phase 3) — a
	// snapshot of the ownership tree at the time of this analysis.
	// Verifier gates consult it for ownership-consistency + blast-
	// radius checks. Built once per tick from snap.Processes + cgroups.
	Entities *EntityGraph `json:"entities,omitempty"`

	// VerifiedCauses is the verifier's output (NEXTGEN Phase 4). One
	// entry per candidate cause that went through the multi-level
	// gate system. Tier A entries are the only ones counted toward
	// the engine's precision target — everything weaker is abstention.
	VerifiedCauses []VerifiedCause `json:"verified_causes,omitempty"`

	// Primary diagnosis
	PrimaryBottleneck string
	PrimaryScore      int
	PrimaryEvidence   []string
	PrimaryChain      []string
	PrimaryCulprit    string
	PrimaryPID        int
	PrimaryProcess    string
	PrimaryAppName    string // resolved app name for primary culprit

	// Sustained pressure tracking
	Sustained      bool // true if pressure persisted >10 ticks
	SustainedTicks int  // number of recent ticks with elevated pressure

	// Next risk (early warning)
	NextRisk string

	// All RCA results ranked
	RCA []RCAEntry

	// Capacity headroom
	Capacities []Capacity

	// Top owners per subsystem
	CPUOwners []Owner
	MemOwners []Owner
	IOOwners  []Owner
	NetOwners []Owner

	// Warnings
	Warnings []Warning

	// Suggested actions
	Actions []Action

	// Causal chain
	CausalChain string
	CausalDAG   *CausalDAG // structured causal chain (nil = not computed)

	// Anomaly tracking
	AnomalyStartedAgo int    // seconds since primary bottleneck first appeared (0=not active)
	AnomalyTrigger    string // which signal first crossed threshold
	CulpritSinceAgo   int    // seconds since culprit became top consumer

	// Deployment correlation: process that started near anomaly onset
	RecentDeploy    string // e.g. "node server.js"
	RecentDeployPID int    // PID of recently deployed process
	RecentDeployAge int    // seconds since the process started

	// Hidden latency detection (metrics look fine but threads are waiting)
	HiddenLatency     bool    // true if hidden latency detected
	HiddenLatencyDesc string  // human-readable explanation
	HiddenLatencyPct  float64 // estimated off-CPU wait percentage
	HiddenLatencyComm string  // top waiting process

	// Stability tracking
	StableSince      int            // seconds system has been continuously OK (0=not stable)
	BiggestChange    string         // description of biggest metric change in last 30s
	BiggestChangePct float64        // magnitude of the biggest change
	TopChanges       []MetricChange // top N biggest changes for "what changed?" display

	// Predictive exhaustion
	Exhaustions []ExhaustionPrediction

	// Slow degradation warnings
	Degradations []DegradationWarning

	// CLOSE_WAIT leaker data (for actions access)
	CloseWaitLeakers []CloseWaitLeaker

	// DiskGuard
	DiskGuardMounts []MountRate
	DiskGuardWorst  string // worst state across all mounts: "OK", "WARN", "CRIT"
	DiskGuardMode   string // "Monitor", "Contain", "Action"

	// Watchdog auto-trigger state
	Watchdog WatchdogState

	// System identity
	SysInfo *SysInfo

	// Narrative engine output
	Narrative *Narrative

	// ConfigDriftSuggestions holds "SUGGESTED: ..." remediation lines produced
	// by config-drift correlation, which runs before the narrative is built.
	// They are appended to Narrative.Evidence after BuildNarrative. Transient.
	ConfigDriftSuggestions []string `json:"-"`

	// Temporal causality chain
	TemporalChain *TemporalChain

	// Cross-signal correlation
	CrossCorrelations []CrossCorrelation

	// Blame attribution
	Blame []BlameEntry

	// Statistical intelligence (v0.31.0)
	BaselineAnomalies []BaselineAnomaly    // Evidence deviating from learned baseline
	Correlations      []MetricCorrelation  // Discovered metric correlations
	ZScoreAnomalies   []ZScoreAnomaly      // Statistically unusual values vs recent window
	ProcessAnomalies  []ProcessAnomaly     // Processes deviating from learned profile
	AppAnomalies      []AppBehaviorAnomaly `json:"app_anomalies,omitempty"` // Phase 4: per-app baseline deviations
	AppRCA            []AppRCAFinding      `json:"app_rca,omitempty"`       // per-app rule-engine findings
	ProbeResults      []ProbeResult        `json:"probe_results,omitempty"` // Phase 6: active investigation captures

	// Lifecycle echo from the incident recorder. Populated each tick by the
	// engine after IncidentRecorder.Record so downstream consumers (fleet
	// client, trace dump) don't need to plumb the recorder through.
	// IncidentState is one of "" (no incident), "suspected", "confirmed", "resolved".
	IncidentState       string               `json:"incident_state,omitempty"`
	IncidentConfirmedAt time.Time            `json:"incident_confirmed_at,omitempty"`
	GoldenSignals       *GoldenSignalSummary // Approximated Golden Signal metrics

	// USE Method checklist (v0.36.6)
	USEChecks []USECheck `json:"use_checks,omitempty"`

	// Change detection (v0.36.6)
	Changes []SystemChange `json:"changes,omitempty"`

	// Impact quantification (v0.36.6)
	ImpactSummary string `json:"impact_summary,omitempty"`

	// Historical context — short human-readable summary from past similar incidents.
	HistoryContext string `json:"history_context,omitempty"`

	// IncidentDiff is a structured comparison of the current incident against
	// the last N similar ones (same signature). Nil if no prior matches exist.
	IncidentDiff *IncidentDiff `json:"incident_diff,omitempty"`

	// Runbook is the best-matching operator runbook for this incident (if any
	// were loaded from ~/.xtop/runbooks/). The engine populates this field;
	// the UI reads it to show a "see runbook: <name>" hint and can load the
	// full content via the engine's RunbookLibrary.Lookup(path).
	Runbook *RunbookMatch `json:"runbook,omitempty"`

	// Guard reports what the resource guard decided this tick (level, skip
	// flags, reason). Populated only when XTOP_GUARD=1. Nil otherwise so
	// status lines cleanly hide the indicator when it's off.
	Guard *GuardStatus `json:"guard,omitempty"`

	// TraceSamples are OpenTelemetry trace summaries that overlap the current
	// incident window, loaded by the engine's TraceCorrelator from a simple
	// JSONL feed. xtop never speaks OTLP directly — any existing OTel pipeline
	// can be pointed at ~/.xtop/otel-samples.jsonl to enable correlation.
	TraceSamples []TraceSample `json:"trace_samples,omitempty"`

	// LogExcerpts are notable lines pulled from app log files during an
	// incident. The engine's log tailer scans a small set of well-known paths
	// (nginx/apache error logs, mysql/postgres logs, systemd journal of the
	// culprit unit), filters for severity keywords, and attaches the top
	// matches here so the UI can show "the RCA says mysql, and here's what
	// mysql's error.log said at the same moment."
	LogExcerpts []LogExcerpt `json:"log_excerpts,omitempty"`

	// Set when UI is showing a pinned result after recovery (sticky RCA).
	// Value is seconds since health returned to OK. 0 = live incident.
	PinnedResolvedSec int `json:"pinned_resolved_sec,omitempty"`

	// Baseline readiness: 0.0 = all metrics warming up, 1.0 = fully ready
	BaselineReadiness float64 `json:"baseline_readiness,omitempty"`

	// Forecast warning from Holt-Winters trend prediction
	ForecastWarning string `json:"forecast_warning,omitempty"` // e.g. "Memory will hit 95% in ~45s at current rate"

	// Cross-host correlation: related incidents on other hosts
	CrossHostCorrelation string `json:"cross_host_correlation,omitempty"` // e.g. "Host db-server also reports IO bottleneck (score 78)"

	// JournalFindings are structured log findings for the top suspect services
	// under active RCA investigation (Tier-1 journal evidence, P2.4).
	// Each entry is a single finding extracted from systemd journald.
	JournalFindings []DiagFinding `json:"journal_findings,omitempty"`
}

type AppBehaviorAnomaly struct {
	AppName      string  `json:"app_name"`
	CgroupPath   string  `json:"cgroup_path,omitempty"`
	Metric       string  `json:"metric"` // "cpu_pct", "rss_mb"
	Current      float64 `json:"current"`
	HourBaseline float64 `json:"hour_baseline"` // mean for this hour-of-week
	HourStdDev   float64 `json:"hour_stddev"`
	Sigma        float64 `json:"sigma"`
	HourOfWeek   int     `json:"hour_of_week"`   // 0..167 (mon 00:00 = 0)
	Note         string  `json:"note,omitempty"` // e.g. "frozen-during-incident", "cold-start"
}

type AppDockerContainer struct {
	ID            string  `json:"id"`
	Name          string  `json:"name"`
	Image         string  `json:"image"`
	State         string  `json:"state"`  // running, exited, paused, etc.
	Status        string  `json:"status"` // "Up 7 weeks", "Exited (0) 12 months ago"
	Health        string  `json:"health"` // healthy, unhealthy, none
	CPUPct        float64 `json:"cpu_pct"`
	MemUsedBytes  float64 `json:"mem_used_bytes"`
	MemLimitBytes float64 `json:"mem_limit_bytes"`
	MemPct        float64 `json:"mem_pct"`
	NetRxBytes    float64 `json:"net_rx_bytes"`
	NetTxBytes    float64 `json:"net_tx_bytes"`
	BlockRead     float64 `json:"block_read"`
	BlockWrite    float64 `json:"block_write"`
	PIDs          int     `json:"pids"`
	RestartCount  int     `json:"restart_count"`
	ExitCode      int     `json:"exit_code"`

	// From container inspect
	Ports         []DockerPort         `json:"ports,omitempty"`
	Mounts        []DockerMount        `json:"mounts,omitempty"`
	Networks      []DockerContainerNet `json:"networks,omitempty"`
	RestartPolicy string               `json:"restart_policy"` // no/always/unless-stopped/on-failure
	User          string               `json:"user"`
	Privileged    bool                 `json:"privileged"`
	Entrypoint    string               `json:"entrypoint"`
	Command       string               `json:"command"`
	MemLimit      uint64               `json:"mem_limit"` // bytes, 0 = unlimited
	CPUQuota      float64              `json:"cpu_quota"` // cores, 0 = unlimited
	CreatedAt     string               `json:"created_at"`
	HasHealthChk  bool                 `json:"has_health_check"`
	RWLayerSize   int64                `json:"rw_layer_size"`
	StackName     string               `json:"stack_name"` // compose project or "standalone"
	StackType     string               `json:"stack_type"` // compose/swarm/k8s/standalone
	ImageSize     int64                `json:"image_size"`
}

type AppIdentity struct {
	PID         int
	Comm        string // raw comm from /proc/PID/stat
	AppName     string // resolved application name ("Elasticsearch")
	AppVersion  string // version if detectable
	BinaryPath  string // /proc/PID/exe target
	Cmdline     string // full cmdline (truncated to 256 chars)
	ServiceUnit string // systemd unit name
	ContainerID string // container ID prefix (12 chars)
	ParentComm  string // parent process comm
	ParentPID   int
	CgroupPath  string
	DisplayName string // pre-formatted: "Elasticsearch [java, elasticsearch.service]"
}

type AppInstance struct {
	ID          string `json:"id"`           // "mysql-1", "nginx-0"
	AppType     string `json:"app_type"`     // "mysql", "nginx", etc.
	DisplayName string `json:"display_name"` // "MySQL (1)", "Nginx"
	PID         int    `json:"pid"`
	Port        int    `json:"port"`
	Status      string `json:"status"` // "active"
	Version     string `json:"version"`
	UptimeSec   int64  `json:"uptime_sec"`

	// Tier 1: process-level (always available)
	CPUPct      float64 `json:"cpu_pct"`
	RSSMB       float64 `json:"rss_mb"`
	Threads     int     `json:"threads"`
	FDs         int     `json:"fds"`
	Connections int     `json:"connections"`

	// Resource share — populated by engine.EnrichAppResourceShare() after all
	// apps are collected. See docs/USAGE.md §6 for the SRE framing.
	Share AppResourceShare `json:"share,omitempty"`

	// Tier 2: deep metrics (needs credentials)
	HasDeepMetrics bool              `json:"has_deep_metrics"`
	DeepMetrics    map[string]string `json:"deep_metrics,omitempty"`

	// Health
	HealthScore  int      `json:"health_score"`
	HealthIssues []string `json:"health_issues,omitempty"`

	// Runtime is where the app runs: "docker", "containerd", "podman", "k8s",
	// "lxc", or "native" (bare host process). Derived from the PID's cgroup.
	Runtime string `json:"runtime,omitempty"`

	// DeepPending is true for a tier-1-lite instance (first tick or guardian
	// throttling deep probes): version and connection count were NOT measured
	// yet, so consumers must render them as "—", not a misleading 0.
	DeepPending bool `json:"deep_pending,omitempty"`

	// Config
	ConfigPath string `json:"config_path,omitempty"`
	NeedsCreds bool   `json:"needs_creds"`

	// Docker containers (only for Docker app type)
	Containers []AppDockerContainer `json:"containers,omitempty"`

	// Docker stacks (grouped containers)
	Stacks []DockerStack `json:"stacks,omitempty"`

	// Docker orchestration type: "standalone", "compose", "swarm", "k8s", "mixed"
	OrchestrationType string `json:"orchestration_type,omitempty"`

	// Websites (for hosting panels, nginx, apache, php-fpm)
	Websites []WebsiteMetrics `json:"websites,omitempty"`
}

type AppMetrics struct {
	Instances []AppInstance `json:"instances,omitempty"`
}

type AppRCAFinding struct {
	App       string  `json:"app"`              // app instance ID, e.g. "mongodb-0"
	AppType   string  `json:"app_type"`         // mongodb / mysql / redis / etc.
	Rule      string  `json:"rule"`             // rule ID, stable for filtering / dedup
	Severity  string  `json:"severity"`         // info | warn | crit
	Title     string  `json:"title"`            // one-line headline
	Detail    string  `json:"detail"`           // measured value + threshold context
	Action    string  `json:"action,omitempty"` // recommended next step
	Metric    string  `json:"metric,omitempty"`
	Value     float64 `json:"value,omitempty"`
	Threshold float64 `json:"threshold,omitempty"`
}

type AppResourceShare struct {
	// Absolute per-dimension usage
	CPUCoresUsed float64 `json:"cpu_cores_used"` // e.g. 2.80 (out of NumCPUs)
	MemRSSBytes  uint64  `json:"mem_rss_bytes"`  // RSS in bytes
	ReadMBs      float64 `json:"read_mbs"`       // disk read rate
	WriteMBs     float64 `json:"write_mbs"`      // disk write rate
	NetConns     int     `json:"net_conns"`      // established TCP/UDP connections

	// Share-of-capacity (0..100) per dimension
	CPUPctOfSystem float64 `json:"cpu_pct_of_system"` // (CoresUsed/NumCPUs)*100
	MemPctOfSystem float64 `json:"mem_pct_of_system"` // (RSS/MemTotal)*100
	IOPctOfBusiest float64 `json:"io_pct_of_busiest"` // app IO / worst disk MB/s

	// Headroom — what's still available on THIS host after this app
	CPUCoresHeadroom float64 `json:"cpu_cores_headroom"`
	MemBytesHeadroom uint64  `json:"mem_bytes_headroom"`

	// Rank across all apps (1 = highest consumer on that dimension).
	// Zero = not ranked (fewer than N apps on that dimension).
	RankCPU int `json:"rank_cpu,omitempty"`
	RankMem int `json:"rank_mem,omitempty"`
	RankIO  int `json:"rank_io,omitempty"`
	RankNet int `json:"rank_net,omitempty"`

	// Composite operator-ready impact score from process rates (0..100).
	// Not a sum of dimensions — it's the engine's ImpactScore, already a
	// well-calibrated "how much is this contributing to pain" measure.
	Impact float64 `json:"impact"`

	// BottleneckShare is the % contribution this app makes to the CURRENT
	// primary bottleneck dimension. Populated only when an incident is
	// active. Lets the UI answer "who's causing 72% of the IO pressure?"
	BottleneckDimension string  `json:"bottleneck_dimension,omitempty"` // "cpu" | "memory" | "io" | "network"
	BottleneckSharePct  float64 `json:"bottleneck_share_pct,omitempty"`
}

type AuditRule struct {
	Domain      OptDomain  `json:"domain"`
	Name        string     `json:"name"`
	Description string     `json:"description"`
	Current     string     `json:"current"`
	Recommended string     `json:"recommended"`
	Impact      string     `json:"impact"`
	Fix         string     `json:"fix,omitempty"` // one-liner remediation command
	Status      RuleStatus `json:"status"`
	Weight      int        `json:"weight"` // 1=minor, 5=important, 10=critical
}

type BaselineAnomaly struct {
	EvidenceID string  // e.g. "cpu.busy"
	Value      float64 // current value
	Baseline   float64 // EWMA mean
	StdDev     float64 // sqrt(EWMA variance)
	ZScore     float64 // (value - mean) / stddev
	Sigma      float64 // how many sigma above baseline
}

type BeaconIndicator struct {
	PID            int     `json:"pid"`
	Comm           string  `json:"comm"`
	DstIP          string  `json:"dst_ip"`
	DstPort        uint16  `json:"dst_port"`
	AvgIntervalSec float64 `json:"avg_interval_sec"`
	Jitter         float64 `json:"jitter"`
	SampleCount    int     `json:"sample_count"`
}

type BigDir struct {
	Path      string
	SizeBytes uint64
	FileCount int // number of regular files counted in the subtree
}

type BigFile struct {
	Path      string
	Dir       string
	SizeBytes uint64
	ModTime   int64 // unix timestamp
}

type BlameEntry struct {
	Comm       string
	AppName    string // resolved app name from identity
	PID        int
	CgroupPath string
	Metrics    map[string]string // "cpu" → "45.2%", "io" → "12 MB/s"
	ImpactPct  float64
}

type CPUMetrics struct {
	Total   CPUTimes
	PerCPU  []CPUTimes
	LoadAvg LoadAvg
	NumCPUs int
	// CtxSwitches is the cumulative total system context switches
	// from /proc/stat's "ctxt N" line — the canonical kernel counter.
	// The prior implementation estimated this from per-process
	// VoluntaryCtxSwitches+NonVoluntaryCtxSwitches sums, which
	// chronically undercounts on hosts with many kernel threads
	// (the per-pid scan can miss short-lived workers and PSI-stalled
	// ksoftirqd/k* tasks). Use this for the rate computation; fall
	// back to the per-process sum only if this is zero.
	CtxSwitches uint64
}

type CPUTimes struct {
	User      uint64
	Nice      uint64
	System    uint64
	Idle      uint64
	IOWait    uint64
	IRQ       uint64
	SoftIRQ   uint64
	Steal     uint64
	Guest     uint64
	GuestNice uint64
}

type Capacity struct {
	Label   string
	Pct     float64 // % remaining (0-100)
	Current string  // current value string
	Limit   string  // limit/max string
}

type CausalDAG struct {
	Nodes       []CausalNode
	Edges       []CausalEdge
	LinearChain string // human-readable "→"-joined string
}

type CausalEdge struct {
	From   string
	To     string
	Rule   string
	Weight float64
}

type CausalNode struct {
	ID          string
	Label       string
	Type        CausalNodeType
	Domain      Domain
	EvidenceIDs []string
}

type CausalNodeType string

type CgThrottleEntry struct {
	CgID   uint64
	CgPath string
	Count  uint64
	Rate   float64
}

type CgroupMetrics struct {
	Path string
	Name string // leaf name for display

	// CPU
	UsageUsec     uint64
	UserUsec      uint64
	SystemUsec    uint64
	ThrottledUsec uint64
	NrThrottled   uint64
	NrPeriods     uint64

	// Memory
	MemCurrent uint64
	MemLimit   uint64 // max or high, whichever is set
	MemSwap    uint64
	OOMKills   uint64
	PgFault    uint64
	PgMajFault uint64

	// IO (aggregated across devices)
	IORBytes uint64
	IOWBytes uint64
	IORIOs   uint64
	IOWIOs   uint64

	// PIDs
	PIDCount uint64
	PIDLimit uint64

	// Kubernetes attribution — populated when the cgroup is under
	// kubepods.slice (or the cgroup-v1 equivalent). Empty on non-k8s hosts.
	PodName       string
	PodNamespace  string
	ContainerName string
	PodQoS        string // "Guaranteed", "Burstable", "BestEffort"
}

type CgroupRate struct {
	Path         string
	Name         string
	CPUPct       float64
	ThrottlePct  float64
	MemPct       float64
	IORateMBs    float64
	IOWRateMBs   float64
	OOMKillDelta uint64 // OOM kills since last tick (delta, not cumulative)
}

type CloseWaitLeaker struct {
	PID        int
	Comm       string
	Count      int      // CW sockets held
	OldestAge  int      // seconds
	NewestAge  int      // seconds
	TopRemotes []string // up to 3 remote IPs
}

type CloseWaitTrend struct {
	Current    int
	GrowthRate float64 // sockets/sec EWMA
	Growing    bool
}

type CollectionHealth struct {
	Total        int
	Succeeded    int
	Failed       int
	AvgLatencyMs float64
}

type ConntrackDissection struct {
	Available   bool
	TCPCount    int
	UDPCount    int
	ICMPCount   int
	OtherCount  int
	AgeLt10s    int // TTL remaining < 10s
	Age10s60s   int // 10s-60s
	Age1m5m     int // 1m-5m
	AgeGt5m     int // >= 5m
	TopSrcIPs   []ConntrackIPCount
	TopDstIPs   []ConntrackIPCount
	CTStates    map[string]int // "ESTABLISHED" -> count
	TotalParsed int
}

type ConntrackIPCount struct {
	IP    string
	Count int
}

type ConntrackStats struct {
	Count         uint64
	Max           uint64
	Buckets       uint64 // hash table buckets (ideal max ~= buckets * 4)
	Found         uint64
	Invalid       uint64
	Insert        uint64
	InsertFailed  uint64 // failed inserts (table full)
	Delete        uint64
	Drop          uint64
	EarlyDrop     uint64 // evicted before timeout
	SearchRestart uint64 // hash contention / CPU pressure
}

type ConntrackTimeouts struct {
	Available   bool
	Established int // default 432000 (5 days!)
	TimeWait    int // default 120
	Close       int
	CloseWait   int
	SynSent     int
	SynRecv     int
	FinWait     int
	LastAck     int
}

type CoverageInfo struct {
	Mode           string   `json:"mode"`                      // "full" | "lean"
	OmittedSignals []string `json:"omitted_signals,omitempty"` // collectors not run in this mode
}

type CrossCorrelation struct {
	Cause       string  `json:"cause"`                  // evidence ID of the leading signal
	Effect      string  `json:"effect"`                 // evidence ID of the lagging signal
	LeadTimeSec float64 `json:"lead_time_sec"`          // seconds the cause preceded the effect
	Confidence  float64 `json:"confidence"`             // 0-1 confidence in the correlation
	Explanation string  `json:"explanation"`            // human-readable description
	LeadSamples int     `json:"lead_samples,omitempty"` // lag in samples where cross-correlation peaks (positive = cause leads)
	LaggedR     float64 `json:"lagged_r,omitempty"`     // Pearson R at the best lag
}

type DNSAnomalyEntry struct {
	PID            int     `json:"pid"`
	Comm           string  `json:"comm"`
	QueryCount     uint64  `json:"query_count"`
	AvgQueryLen    int     `json:"avg_query_len"`
	TotalRespBytes uint64  `json:"total_resp_bytes"`
	QueriesPerSec  float64 `json:"queries_per_sec"`
}

type DNSTunnelIndicator struct {
	PID         int     `json:"pid,omitempty"`
	Comm        string  `json:"comm,omitempty"`
	SrcIP       string  `json:"src_ip,omitempty"`
	DomainHash  string  `json:"domain_hash,omitempty"`
	TXTRatio    float64 `json:"txt_ratio"`
	AvgQueryLen int     `json:"avg_query_len"`
	QueryRate   float64 `json:"query_rate,omitempty"`
}

type DatabaseInfo struct {
	Engine      string  `json:"engine"`
	Name        string  `json:"name"`
	SizeMB      float64 `json:"size_mb,omitempty"`
	Connections int     `json:"connections,omitempty"`
	ReplicaRole string  `json:"replica_role,omitempty"`
}

type DegradationWarning struct {
	Metric    string  // e.g. "IO latency", "Memory reclaim"
	Direction string  // "rising", "falling"
	Duration  int     // seconds the trend has persisted
	Rate      float64 // change per minute
	Unit      string  // e.g. "ms/min", "%/min"
}

type DeletedOpenFile struct {
	PID       int
	Comm      string
	FD        int
	Path      string
	SizeBytes uint64
}

type DetectedService struct {
	Name       string            `json:"name"`
	Version    string            `json:"version,omitempty"`
	Ports      []int             `json:"ports,omitempty"`
	Running    bool              `json:"running"`
	Healthy    bool              `json:"healthy"`
	Unit       string            `json:"unit,omitempty"`
	BinaryPath string            `json:"binary_path,omitempty"`
	Extra      map[string]string `json:"extra,omitempty"`
}

type DiagFinding struct {
	Severity DiagSeverity
	Category string // "config", "performance", "replication", "memory", "connections"
	Summary  string
	Detail   string
	Advice   string
}

type DiagMetrics struct {
	Services []ServiceDiag
}

type DiagSeverity string

type DirectReclaimEntry struct {
	PID     uint32
	Comm    string
	StallNs uint64
	Count   uint32
}

type DiskRate struct {
	Name       string
	ReadMBs    float64
	WriteMBs   float64
	ReadIOPS   float64
	WriteIOPS  float64
	AvgAwaitMs float64
	UtilPct    float64
	QueueDepth uint64
}

type DiskStats struct {
	Name            string
	ReadsCompleted  uint64
	ReadsMerged     uint64
	SectorsRead     uint64
	ReadTimeMs      uint64
	WritesCompleted uint64
	WritesMerged    uint64
	SectorsWritten  uint64
	WriteTimeMs     uint64
	IOsInProgress   uint64
	IOTimeMs        uint64
	WeightedIOMs    uint64
	// Extended (kernel 4.18+)
	DiscardsCompleted uint64
	DiscardTimeMs     uint64
	FlushesCompleted  uint64
	FlushTimeMs       uint64
}

type DiskType string

type DockerContainer struct {
	ID      string `json:"id"`
	Name    string `json:"name"`
	Image   string `json:"image"`
	Status  string `json:"status"`
	Ports   string `json:"ports,omitempty"`
	Purpose string `json:"purpose,omitempty"` // inferred from image: "vpn", "web", "database", etc.
}

type DockerContainerNet struct {
	Name    string `json:"name"`
	IP      string `json:"ip"`
	Gateway string `json:"gateway"`
}

type DockerMount struct {
	Type     string `json:"type"`   // bind, volume, tmpfs
	Source   string `json:"source"` // host path or volume name
	Target   string `json:"target"` // container path
	ReadOnly bool   `json:"read_only"`
}

type DockerPort struct {
	ContainerPort int    `json:"container_port"`
	HostPort      int    `json:"host_port"`
	HostIP        string `json:"host_ip"`
	Protocol      string `json:"protocol"` // tcp/udp
}

type DockerStack struct {
	Name        string               `json:"name"`         // compose project name or container name
	Type        string               `json:"type"`         // "compose", "swarm", "k8s", "standalone"
	WorkingDir  string               `json:"working_dir"`  // compose file directory
	ComposeFile string               `json:"compose_file"` // compose file path
	Networks    []DockerStackNetwork `json:"networks,omitempty"`
	Containers  []AppDockerContainer `json:"containers,omitempty"`
	HealthScore int                  `json:"health_score"`
	Issues      []string             `json:"issues,omitempty"`
}

type DockerStackNetwork struct {
	Name   string `json:"name"`
	Driver string `json:"driver"`
	Subnet string `json:"subnet"`
}

type Domain string

type DomainScore struct {
	Domain OptDomain   `json:"domain"`
	Score  int         `json:"score"` // 0-100
	Issues int         `json:"issues"`
	Rules  []AuditRule `json:"rules"`
}

type DotNetProcessMetrics struct {
	PID              int     `json:"pid"`
	Comm             string  `json:"comm"`
	GCHeapSizeMB     float64 `json:"gc_heap_size_mb"`
	Gen0GCCount      uint64  `json:"gen0_gc_count"`
	Gen1GCCount      uint64  `json:"gen1_gc_count"`
	Gen2GCCount      uint64  `json:"gen2_gc_count"`
	TimeInGCPct      float64 `json:"time_in_gc_pct"`
	AllocRateMBs     float64 `json:"alloc_rate_mbs"`
	ThreadPoolCount  int     `json:"threadpool_count"`
	ThreadPoolQueue  int     `json:"threadpool_queue"`
	ExceptionCount   uint64  `json:"exception_count"`
	MonitorLockCount uint64  `json:"monitor_lock_count"`
	WorkingSetMB     float64 `json:"working_set_mb"`
	RequestsPerSec   float64 `json:"requests_per_sec"`
	CurrentRequests  int     `json:"current_requests"`
}

type Entity struct {
	// ID is the canonical entity identifier. Stable across ticks for
	// the lifetime of the entity. Required.
	ID string `json:"id"`

	// Kind buckets the entity for verifier dispatch.
	Kind EntityKind `json:"kind"`

	// Name is the human-readable label (process comm, service name,
	// cgroup leaf path, etc.). May be ambiguous; ID is the unique key.
	Name string `json:"name,omitempty"`

	// OwnerID is this entity's parent in the ownership hierarchy.
	// Empty for root entities (the host). Conventions:
	//   process    → cgroup or runtime
	//   cgroup     → parent cgroup, eventually "host"
	//   service    → cgroup
	//   container  → cgroup or pod
	//   pod        → host
	//   socket     → process (owning pid)
	//   mount      → host
	//
	// Resolving an OwnerID via EntityGraph.Lookup yields the parent
	// Entity, which has its own OwnerID, and so on up to "host".
	OwnerID string `json:"owner_id,omitempty"`

	// Tags carries free-form metadata: PID (when ID==cgroup), CPU%
	// rollup, RSS bytes, port number, mount type, etc. Verifier gates
	// read these for the ownership-consistency check.
	Tags map[string]string `json:"tags,omitempty"`
}

type EntityGraph struct {
	// Entities is the flat list, ordered for deterministic serialization.
	Entities []Entity `json:"entities"`
	// contains filtered or unexported fields
}

type EntityKind string

type EphemeralPorts struct {
	RangeLo       int // from /proc/sys/net/ipv4/ip_local_port_range
	RangeHi       int
	InUse         int // count of connections with local port in ephemeral range
	TimeWaitIn    int // TIME_WAIT specifically in ephemeral range
	EstablishedIn int // ESTABLISHED in ephemeral range
	CloseWaitIn   int // CLOSE_WAIT in ephemeral range
	SynSentIn     int // SYN_SENT in ephemeral range
	TopUsers      []PortUser
}

type Event struct {
	ID             string          `json:"id"`
	StartTime      time.Time       `json:"start_time"`
	EndTime        time.Time       `json:"end_time,omitempty"`
	Duration       int             `json:"duration_sec,omitempty"`
	PeakHealth     HealthLevel     `json:"peak_health"`
	Bottleneck     string          `json:"bottleneck"`
	PeakScore      int             `json:"peak_score"`
	Evidence       []string        `json:"evidence,omitempty"`
	CausalChain    string          `json:"causal_chain,omitempty"`
	CulpritCgroup  string          `json:"culprit_cgroup,omitempty"`
	CulpritProcess string          `json:"culprit_process,omitempty"`
	CulpritPID     int             `json:"culprit_pid,omitempty"`
	PeakCPUBusy    float64         `json:"peak_cpu_busy,omitempty"`
	PeakMemUsedPct float64         `json:"peak_mem_used_pct,omitempty"`
	PeakIOPSI      float64         `json:"peak_io_psi,omitempty"`
	Active         bool            `json:"active"`
	Timeline       []TimelineEntry `json:"timeline,omitempty"`
}

type Evidence struct {
	ID         string   // e.g. "io.psi.some", "mem.available.low"
	Message    string   // human-readable description
	Window     string   // time window e.g. "avg10", "1s"
	Domain     Domain   // resource domain
	Severity   Severity // severity level
	Strength   float64  // 0..1 normalized signal strength
	Confidence float64  // 0..1 measurement confidence
	Value      float64  // raw measured value
	Threshold  float64  // critical threshold
	Measured   bool     // true if from direct measurement (BPF/counter)
	Owners     []OwnerAttribution
	Tags       map[string]string // e.g. "weight": "psi", "device": "sda"

	// Sustained-duration tracking (Phase 1: verdict discipline).
	// FirstSeenAt is the wall-clock time this evidence ID first fired in the
	// current incident; zero value means "first-tick onset".
	// SustainedForSec is now() - FirstSeenAt at the moment the verdict is built.
	// Stamped by stampSustainedDurations() in engine, using History.signalOnsets.
	FirstSeenAt     time.Time `json:"first_seen_at,omitempty"`
	SustainedForSec float64   `json:"sustained_for_sec,omitempty"`
}

type EvidenceCheck struct {
	Group      string  // evidence group name (e.g. "PSI", "D-state", "Disk latency")
	Label      string  // human-readable check (e.g. "IO PSI full avg10=0.12")
	Passed     bool    // did this signal fire?
	Value      string  // current value for display
	Confidence string  // "H" = BPF tracepoint, "M" = /proc counter, "L" = heuristic/derived
	Source     string  // "procfs", "sysfs", "bpf", "derived"
	Strength   float64 // 0.0-1.0 signal strength
}

type ExecEventEntry struct {
	PID       uint32
	PPID      uint32
	UID       uint32
	Comm      string
	Filename  string
	Count     uint64
	Timestamp int64
}

type ExhaustionPrediction struct {
	Resource   string  // "FD", "Memory", "Swap", "Conntrack"
	CurrentPct float64 // current usage percent
	TrendPerS  float64 // percentage-point change per second (positive = growing)
	EstMinutes float64 // estimated minutes to exhaustion (-1 = not trending)
	Confidence float64 // 0.0–1.0 confidence in the prediction (based on trend quality)
}

type FDStats struct {
	Allocated uint64
	Max       uint64
}

type Fact struct {
	// ID is a stable, unique identifier. Convention:
	// "<domain>.<metric>" for raw signals, "<domain>.<metric>.<entity>"
	// when scoped. Example: "cpu.psi.avg10", "cpu.runqueue.host".
	ID string `json:"id"`

	// Kind buckets this fact for verifier dispatch.
	Kind FactKind `json:"kind"`

	// Source identifies the producer (collector name, eBPF program,
	// adapter). Used by the verifier to weight conflicting facts.
	// Example: "procfs", "eBPF/biolatency", "mongo-adapter".
	Source string `json:"source"`

	// EntityID is the thing this fact is ABOUT. Empty when host-scope.
	// Conventions:
	//   "host"          — global host fact
	//   "pid:1234"      — about a specific process
	//   "cgroup:/sys/fs/cgroup/system.slice/mongod.service"
	//   "service:mongod"
	//   "mount:/var/lib/mysql"
	EntityID string `json:"entity_id,omitempty"`

	// OwnerID, when set, identifies the owner of EntityID — the upward
	// pointer in the entity graph. Example: a process's cgroup, a
	// mount's owning service.
	OwnerID string `json:"owner_id,omitempty"`

	// Domain routes this fact to the right detector / verifier gates.
	Domain Domain `json:"domain"`

	// Metric is the human-readable name of what is being measured.
	// Example: "psi.avg10", "rss_bytes", "queue_depth".
	Metric string `json:"metric"`

	// Value is the measurement. Float so we can represent rates,
	// percentages, counts, and durations uniformly. NaN is reserved
	// for "explicitly unknown" — prefer omitting the fact.
	Value float64 `json:"value"`

	// Unit names the unit of Value. "%", "bytes", "ms", "count".
	// Empty when dimensionless or when carried in Tags.
	Unit string `json:"unit,omitempty"`

	// MeasuredAt is the wall-clock time the measurement was taken.
	// Required; zero value indicates a malformed Fact.
	MeasuredAt time.Time `json:"measured_at"`

	// FirstSeenAt is when this signal first crossed its threshold.
	// Tracked by the engine across ticks; for a brand-new fact it
	// equals MeasuredAt. Pointer so omitempty works (zero time.Time
	// isn't treated as empty by encoding/json).
	FirstSeenAt *time.Time `json:"first_seen_at,omitempty"`

	// LastSeenAt is when this signal was last observed above threshold.
	// Distinct from MeasuredAt so the verifier can detect "still active"
	// vs "transient spike". Pointer for omitempty semantics.
	LastSeenAt *time.Time `json:"last_seen_at,omitempty"`

	// Duration is the cumulative time this signal has been active.
	// Used by the temporal-ordering gate (cause must precede effect
	// by at least Duration).
	Duration time.Duration `json:"duration,omitempty"`

	// Severity is how serious this single fact is.
	Severity FactSeverity `json:"severity"`

	// Confidence is the measurement-quality score in [0,1]. See the
	// FactConfidence type docstring for the rubric.
	Confidence FactConfidence `json:"confidence"`

	// BaselineDelta, when set, is how far above baseline this value is.
	// Units match Value's Unit. Used by the baseline-deviation gate.
	// Zero when no baseline is available — distinguish from "exactly
	// at baseline" via Tags["baseline_known"]="true".
	BaselineDelta float64 `json:"baseline_delta,omitempty"`

	// Tags carries free-form metadata that doesn't fit the schema.
	// Examples: device name, cgroup path, weight class, app type.
	Tags map[string]string `json:"tags,omitempty"`
}

type FactConfidence float64

type FactKind string

type FactSeverity string

type FailedAuthSource struct {
	IP    string
	Count int
}

type FilelessProcess struct {
	PID       int
	Comm      string
	ExePath   string   // readlink result, e.g. "/memfd:payload (deleted)"
	IsMemFD   bool     // /memfd: prefix
	IsDeleted bool     // (deleted) suffix, not memfd
	NetConns  int      // ESTABLISHED + SYN_SENT outbound connections
	RemoteIPs []string // up to 5 unique remote IPs
	RSS       uint64   // resident memory, for context
}

type FleetAgentConfig struct {
	HubURL       string   `json:"hub_url"` // e.g. "https://hub.example:9200"
	Token        string   `json:"token"`   // auth token
	Tags         []string `json:"tags,omitempty"`
	QueuePath    string   `json:"queue_path,omitempty"`     // offline queue, default ~/.xtop/fleet-queue.jsonl
	MaxQueueSize int      `json:"max_queue_size,omitempty"` // default 10_000
	// InsecureSkipVerify allows self-signed certs for the hub. Defaults to
	// false (secure); only set via --insecure / --fleet-insecure flags.
	InsecureSkipVerify bool `json:"insecure_skip_verify,omitempty"`
}

type FleetHeartbeat struct {
	// Identity
	Hostname string   `json:"hostname"`
	AgentID  string   `json:"agent_id"` // stable UUID persisted in ~/.xtop/agent-id
	Tags     []string `json:"tags,omitempty"`

	// Versions
	AgentVersion string `json:"agent_version"`
	Kernel       string `json:"kernel,omitempty"`
	OS           string `json:"os,omitempty"`

	// Timestamp
	Timestamp time.Time `json:"timestamp"`

	// Health summary
	Health            HealthLevel `json:"health"`
	PrimaryBottleneck string      `json:"primary_bottleneck,omitempty"`
	PrimaryScore      int         `json:"primary_score"`
	Confidence        int         `json:"confidence"`

	// Top culprit (if any)
	CulpritProcess string `json:"culprit_process,omitempty"`
	CulpritPID     int    `json:"culprit_pid,omitempty"`
	CulpritApp     string `json:"culprit_app,omitempty"`

	// Compact metric summary (for fleet-wide sparklines on hub)
	CPUBusyPct    float64 `json:"cpu_busy_pct"`
	MemUsedPct    float64 `json:"mem_used_pct"`
	IOWorstUtil   float64 `json:"io_worst_util"`
	LoadAvg1      float64 `json:"load_avg_1"`
	NumCPUs       int     `json:"num_cpus"`
	MemTotalBytes uint64  `json:"mem_total_bytes"`

	// Incident cross-ref (set when this tick is part of an ongoing incident)
	ActiveIncidentID string `json:"active_incident_id,omitempty"`

	// Self-resource reporting — xtop's own footprint on the agent host.
	// The web dashboard renders these inline on the host card so operators
	// can verify at a glance that the observability tool isn't competing
	// with the workload it's observing. Zero-valued when the guardian is
	// disabled (XTOP_GUARD off) — UIs should hide the row in that case.
	XtopOwnCPUPct  float64 `json:"xtop_cpu_pct,omitempty"`
	XtopOwnRSSMB   float64 `json:"xtop_rss_mb,omitempty"`
	XtopGuardLevel int     `json:"xtop_guard_level,omitempty"`
	XtopMode       string  `json:"xtop_mode,omitempty"` // "lean" or "rich"
}

type FleetHost struct {
	Hostname     string   `json:"hostname"`
	AgentID      string   `json:"agent_id"`
	Tags         []string `json:"tags,omitempty"`
	AgentVersion string   `json:"agent_version"`
	Kernel       string   `json:"kernel,omitempty"`
	OS           string   `json:"os,omitempty"`

	// Connection liveness
	FirstSeen time.Time  `json:"first_seen"`
	LastSeen  time.Time  `json:"last_seen"`
	Status    HostStatus `json:"status"` // live / stale / expired

	// Latest health snapshot (from last heartbeat)
	Health            HealthLevel `json:"health"`
	PrimaryBottleneck string      `json:"primary_bottleneck,omitempty"`
	PrimaryScore      int         `json:"primary_score"`
	Confidence        int         `json:"confidence"`
	CulpritProcess    string      `json:"culprit_process,omitempty"`
	CulpritApp        string      `json:"culprit_app,omitempty"`

	// Latest metrics
	CPUBusyPct  float64 `json:"cpu_busy_pct"`
	MemUsedPct  float64 `json:"mem_used_pct"`
	IOWorstUtil float64 `json:"io_worst_util"`
	LoadAvg1    float64 `json:"load_avg_1"`
	NumCPUs     int     `json:"num_cpus"`

	// Active incident, if any
	ActiveIncidentID string `json:"active_incident_id,omitempty"`

	// Mirrored self-resource fields (latest known) so UIs can show xtop's
	// own footprint per host without joining against heartbeats.
	XtopOwnCPUPct  float64 `json:"xtop_cpu_pct,omitempty"`
	XtopOwnRSSMB   float64 `json:"xtop_rss_mb,omitempty"`
	XtopGuardLevel int     `json:"xtop_guard_level,omitempty"`
	XtopMode       string  `json:"xtop_mode,omitempty"`
}

type FleetHubConfig struct {
	ListenAddr  string `json:"listen_addr"` // default ":9200"
	TLSCert     string `json:"tls_cert,omitempty"`
	TLSKey      string `json:"tls_key,omitempty"`
	AuthToken   string `json:"auth_token"`              // shared secret for all agents
	AllowNoAuth bool   `json:"allow_no_auth,omitempty"` // skip empty-token guard (NOT for production)

	// Postgres connection (e.g. "postgres://xtop:pw@localhost/xtopfleet")
	PostgresDSN string `json:"postgres_dsn"`

	// SQLite hot cache path (default ~/.xtop/hub-cache.sqlite)
	SQLiteCachePath string `json:"sqlite_cache_path,omitempty"`

	// Retention (default 30d)
	IncidentRetentionDays   int `json:"incident_retention_days,omitempty"`
	HeartbeatRetentionHours int `json:"heartbeat_retention_hours,omitempty"`
}

type FleetIncident struct {
	// Identity (same as heartbeat)
	Hostname string `json:"hostname"`
	AgentID  string `json:"agent_id"`

	// Incident ID — stable across status updates of the same incident.
	// Format: "{hostname}-{unix_sec_start}-{short_signature_hash}"
	IncidentID string `json:"incident_id"`

	// Timestamps
	StartedAt  time.Time  `json:"started_at"`
	ResolvedAt *time.Time `json:"resolved_at,omitempty"` // nil while active
	Timestamp  time.Time  `json:"timestamp"`             // when this payload was generated

	// Core diagnosis
	Bottleneck string      `json:"bottleneck"`
	PeakScore  int         `json:"peak_score"`
	Confidence int         `json:"confidence"`
	Health     HealthLevel `json:"health"`
	Pattern    string      `json:"pattern,omitempty"`

	// Culprit
	Culprit    string `json:"culprit,omitempty"`
	CulpritPID int    `json:"culprit_pid,omitempty"`
	CulpritApp string `json:"culprit_app,omitempty"`

	// Narrative
	RootCause string   `json:"root_cause,omitempty"`
	Evidence  []string `json:"evidence,omitempty"`
	Impact    string   `json:"impact,omitempty"`

	// Signature — stable hash of (bottleneck + top-3 evidence IDs) for
	// cross-incident similarity matching.
	Signature string `json:"signature"`

	// Context at incident peak: top 10 CPU/memory/IO processes.
	// Smaller than full snapshot but enough for drill-down.
	TopProcesses []FleetProcess `json:"top_processes,omitempty"`

	// Raw evidence list for hub-side re-analysis (optional — only sent if
	// FleetClient.IncludeRawEvidence is set).
	RawEvidence []Evidence `json:"raw_evidence,omitempty"`

	// Structured diff vs prior similar incidents on this host. Nil when this
	// signature hasn't been seen before. Lets hub UIs show "this is worse/milder
	// than usual" and "new signals firing" without recomputing.
	Diff *IncidentDiff `json:"diff,omitempty"`

	// Update type — lets hub distinguish new incidents from updates
	UpdateType IncidentUpdateType `json:"update_type"`

	// Lifecycle (Phase 1 of RCA overhaul; Phase 5 of TODOs adds hub schema).
	// State: "suspected" | "confirmed" | "resolved" | "" (legacy).
	// Hubs that don't know these fields ignore them; they live in JSONB too.
	State               string         `json:"state,omitempty"`
	ConfirmedAt         time.Time      `json:"confirmed_at,omitempty"`
	ChangesAtConfirm    []SystemChange `json:"changes_at_confirm,omitempty"`
	FleetPeersAtConfirm string         `json:"fleet_peers_at_confirm,omitempty"`
}

type FleetProcess struct {
	PID    int     `json:"pid"`
	Comm   string  `json:"comm"`
	CPUPct float64 `json:"cpu_pct"`
	RSS    uint64  `json:"rss"`
	State  string  `json:"state,omitempty"`
}

type FlowRateEntry struct {
	PID             int     `json:"pid"`
	Comm            string  `json:"comm"`
	DstIP           string  `json:"dst_ip"`
	ConnectCount    uint64  `json:"connect_count"`
	CloseCount      uint64  `json:"close_count"`
	UniqueDestCount int     `json:"unique_dest_count"`
	Rate            float64 `json:"rate"`
}

type GPUDevice struct {
	Index       int
	Name        string  // e.g., "NVIDIA GeForce RTX 3090"
	Driver      string  // driver version
	UtilGPU     float64 // GPU utilization %
	UtilMem     float64 // memory controller utilization %
	MemUsed     uint64  // bytes
	MemTotal    uint64  // bytes
	Temperature int     // celsius
	PowerDraw   float64 // watts
	PowerLimit  float64 // watts
	FanSpeed    int     // percent (-1 if N/A)
	Processes   []GPUProcess
}

type GPUProcess struct {
	PID     int
	Name    string
	MemUsed uint64 // bytes
}

type GPUSnapshot struct {
	Available bool
	Devices   []GPUDevice
}

type GateResult struct {
	// GateID identifies the gate ("signal_quality", "baseline_deviation",
	// "temporal_ordering", "ownership_consistency", "blast_radius",
	// "counter_evidence", "deep_probe"). Stable across versions.
	GateID string `json:"gate_id"`

	// Passed is true if the candidate cleared this gate.
	Passed bool `json:"passed"`

	// Reason is a single-sentence operator-facing explanation. When
	// Passed=false, this is the abstention reason.
	Reason string `json:"reason,omitempty"`

	// FactsUsed lists the Fact.ID values consulted. Lets the operator
	// re-run the gate against the same evidence in replay.
	FactsUsed []string `json:"facts_used,omitempty"`
}

type GlobalMetrics struct {
	PSI               PSIMetrics
	CPU               CPUMetrics
	Memory            MemoryMetrics
	VMStat            VMStatMetrics
	Disks             []DiskStats
	Network           []NetworkStats
	TCP               TCPMetrics
	UDP               UDPMetrics
	Sockets           SocketStats
	TCPStates         TCPConnState
	SoftIRQ           SoftIRQStats
	Conntrack         ConntrackStats
	ConntrackDissect  ConntrackDissection
	ConntrackTimeouts ConntrackTimeouts
	FD                FDStats
	EphemeralPorts    EphemeralPorts
	TopRemoteIPs      []RemoteIPStats
	CloseWaitLeakers  []CloseWaitLeaker
	CloseWaitTrend    CloseWaitTrend
	Mounts            []MountStats
	DeletedOpen       []DeletedOpenFile
	BigFiles          []BigFile
	BigDirs           []BigDir
	BigDirsPartial    bool // scan stat-budget exhausted: BigDirs sizes are lower bounds
	FilelessProcs     []FilelessProcess
	Security          SecurityMetrics
	Logs              LogMetrics
	HealthChecks      HealthCheckMetrics
	Sessions          []ActiveSession
	Diagnostics       DiagMetrics
	Sentinel          SentinelData
	DotNet            []DotNetProcessMetrics
	Runtimes          RuntimeMetrics
	Apps              AppMetrics
	AppIdentities     map[int]AppIdentity // PID → resolved identity
	Proxmox           *ProxmoxMetrics     // non-nil only on Proxmox hosts
	Profile           *ServerProfile      // system profiler (optimization audit)
	GPU               GPUSnapshot         // NVIDIA GPU metrics (empty if no GPU)
	PHPFPM            PHPFPMMetrics       // per-pool/per-worker PHP-FPM view
}

type GoldenSignalSummary struct {
	// Latency proxies
	DiskLatencyMs float64 // worst disk await
	TCPRTTMs      float64 // smoothed TCP RTT (if BPF available)
	PSIStallPct   float64 // max PSI stall across domains
	// Traffic proxies
	TCPSegmentsPerSec float64 // in + out segments
	NetBytesPerSec    float64 // total interface throughput
	ConnAcceptRate    float64 // passive opens / sec
	// Error proxies
	ErrorRate float64 // drops + retrans + resets + OOM combined rate
	// Saturation proxies
	SaturationPct       float64          // max of: conntrack%, ephemeral%, runqueue ratio, PSI
	SaturationBreakdown SaturationDetail // per-component saturation detail
}

type GuardStatus struct {
	Level         int      `json:"level"` // 0 none, 1 caution, 2 degraded, 3 minimal
	Reason        string   `json:"reason,omitempty"`
	IntervalSec   int      `json:"interval_sec"`
	OwnCPUPct     float64  `json:"own_cpu_pct"`
	HostLoadRatio float64  `json:"host_load_ratio"`
	Skipped       []string `json:"skipped,omitempty"` // human-readable list of what was skipped
}

type HAProxyInfo struct {
	Running    bool     `json:"running"`
	Version    string   `json:"version,omitempty"`
	ConfigFile string   `json:"config_file"`
	Mode       string   `json:"mode"` // "reverse_proxy", "forward_proxy", "both", "tcp_lb"
	Frontends  []string `json:"frontends,omitempty"`
	Backends   []string `json:"backends,omitempty"`
	BindPorts  []int    `json:"bind_ports,omitempty"`
	Evidence   []string `json:"evidence,omitempty"` // reasons for classification
}

type HealthCheckMetrics struct {
	Probes []HealthProbeResult
}

type HealthLevel int

type HealthProbeResult struct {
	Name         string
	ProbeType    string // "http", "tcp", "dns", "cert"
	Target       string // URL, host:port, or domain
	Status       string // "OK", "WARN", "CRIT", "UNKNOWN"
	LatencyMs    float64
	StatusCode   int // HTTP only
	Detail       string
	LastCheck    time.Time
	CertDaysLeft int // -1 if N/A
}

type HostIncident struct {
	HostID            string
	Health            HealthLevel
	PrimaryBottleneck string
	PrimaryScore      int
	Timestamp         time.Time
	EvidenceIDs       []string
}

type HostStatus string

type ImpactScore struct {
	PID     int
	Rank    int
	Comm    string
	Service string // resolved from cgroup: k8s pod, systemd unit, or docker container
	Cgroup  string

	// Actual metrics
	CPUPct float64 // actual CPU% from process rates

	// Component scores (0-1 normalized)
	CPUSaturation float64
	PSIContrib    float64
	IOWait        float64
	MemGrowth     float64
	NetRetrans    float64

	// Penalties
	NewnessPenalty float64 // +0.15 for processes started <60s ago
	ChangePenalty  float64 // reserved for future use

	// Final score
	Composite float64 // 0-100 weighted sum

	// Context
	Threads  int
	RSS      uint64
	WriteMBs float64
}

type IncidentDiff struct {
	MatchCount           int            `json:"match_count"`
	FirstSeen            time.Time      `json:"first_seen,omitempty"`
	LastSeen             time.Time      `json:"last_seen,omitempty"`
	MedianPeakScore      int            `json:"median_peak_score,omitempty"`
	MaxPeakScore         int            `json:"max_peak_score,omitempty"`
	CurrentPeakScore     int            `json:"current_peak_score,omitempty"`
	ScoreDeltaFromMedian int            `json:"score_delta_from_median,omitempty"`
	MedianDurationSec    int            `json:"median_duration_sec,omitempty"`
	CulpritFrequency     map[string]int `json:"culprit_frequency,omitempty"`
	TopCulprit           string         `json:"top_culprit,omitempty"`
	TopCulpritCount      int            `json:"top_culprit_count,omitempty"`
	CurrentCulprit       string         `json:"current_culprit,omitempty"`
	CulpritIsRepeat      bool           `json:"culprit_is_repeat,omitempty"`
	NewEvidence          []string       `json:"new_evidence,omitempty"`
	MissingEvidence      []string       `json:"missing_evidence,omitempty"`
	SameHourOfDay        int            `json:"same_hour_of_day,omitempty"`
	DriftHint            string         `json:"drift_hint,omitempty"`
}

type IncidentFrame struct {
	// SchemaVersion is the on-disk format version. v1 = the initial
	// Phase 5 ship. Bumped on breaking changes.
	SchemaVersion int `json:"schema_version"`

	// HostID is the host this incident occurred on (snap.HostID).
	HostID string `json:"host_id,omitempty"`

	// EngineVersion is the xtop version that produced this frame.
	// Replays produced by a different version are flagged in the
	// harness output.
	EngineVersion string `json:"engine_version,omitempty"`

	// CapturedAt is wall-clock time when this frame was written. Used
	// for chronological ordering of the corpus, NOT as part of the
	// determinism contract (replay doesn't depend on this).
	CapturedAt time.Time `json:"captured_at"`

	// AnalysisTime is the snap.Timestamp the verifier saw. Replay
	// MUST use this — most facts are wall-clock relative.
	AnalysisTime time.Time `json:"analysis_time"`

	// Facts is the exact Fact slice the verifier received. Lossless
	// JSON roundtrip is enforced by TestFactJSONRoundtrip.
	Facts []Fact `json:"facts"`

	// Entities is the exact entity graph snapshot. The byID index is
	// rebuilt via Reindex() after deserialization.
	Entities *EntityGraph `json:"entities"`

	// VerifiedCauses is what the verifier emitted at capture time.
	// Replay compares fresh output against this for determinism.
	VerifiedCauses []VerifiedCause `json:"verified_causes"`

	// HealthAtCapture is the headline AnalysisResult.Health value at
	// capture time. Used to filter the corpus ("show me all the
	// frames where xtop said Critical").
	HealthAtCapture HealthLevel `json:"health_at_capture"`

	// PrimaryBottleneck and PrimaryScore preserve the legacy verdict
	// for cross-referencing with the audit trail. Phase 4 verdicts
	// (VerifiedCauses) supersede these, but the legacy field is what
	// goes into incident notifications + the fleet hub, so it must
	// be in the corpus.
	PrimaryBottleneck string `json:"primary_bottleneck,omitempty"`
	PrimaryScore      int    `json:"primary_score,omitempty"`

	// Label is operator-provided ground truth ("was this a real
	// incident, and did the engine call it correctly?"). Empty when
	// unlabeled. Used by the replay harness to compute precision per
	// mechanism. See LabelKind for the enum.
	Label LabelKind `json:"label,omitempty"`

	// LabelReason is the operator's free-text note explaining the
	// label. Optional but recommended for FN cases ("real incident
	// the engine missed because X").
	LabelReason string `json:"label_reason,omitempty"`
}

type IncidentUpdateType string

type JA3Entry struct {
	Hash      string `json:"hash"`
	Count     uint64 `json:"count"`
	SampleSrc string `json:"sample_src"`
	SampleDst string `json:"sample_dst"`
	Known     string `json:"known"`
}

type JournalFinding struct {
	Signature string
	Severity  DiagSeverity
	Count     int
	Sample    string // representative message; truncation to ~120 chars is applied by journal.Classify (the producer), not enforced by this field
	PID       int
	FirstSeen time.Time
	LastSeen  time.Time
}

type K8sNodeInfo struct {
	NodeRole   string   `json:"node_role"`
	PodCount   int      `json:"pod_count"`
	Namespaces []string `json:"namespaces,omitempty"`
}

type KeepalivedInfo struct {
	Running   bool     `json:"running"`
	VIPs      []string `json:"vips,omitempty"`
	State     string   `json:"state,omitempty"` // "MASTER", "BACKUP"
	Interface string   `json:"interface,omitempty"`
	Priority  int      `json:"priority,omitempty"`
}

type LabelKind string

type LoadAvg struct {
	Load1   float64
	Load5   float64
	Load15  float64
	Running uint64
	Total   uint64
}

type LogExcerpt struct {
	App       string    `json:"app"`                 // e.g. "mysql", "nginx"
	Path      string    `json:"path"`                // source file
	Line      string    `json:"line"`                // the matched line (trimmed)
	Severity  string    `json:"severity,omitempty"`  // "ERROR", "WARN", "SLOW", "FATAL", "OOM"
	Timestamp time.Time `json:"timestamp,omitempty"` // best-effort parse; zero if unparseable
}

type LogMetrics struct {
	Services []ServiceLogStats
}

type MemoryMetrics struct {
	Total           uint64
	Free            uint64
	Available       uint64
	Buffers         uint64
	Cached          uint64
	SwapTotal       uint64
	SwapFree        uint64
	SwapUsed        uint64
	SwapCached      uint64
	Dirty           uint64
	Writeback       uint64
	Slab            uint64
	SReclaimable    uint64
	SUnreclaim      uint64
	AnonPages       uint64
	Mapped          uint64
	Shmem           uint64
	KernelStack     uint64
	PageTables      uint64
	Bounce          uint64
	HugePages_Total uint64
	HugePages_Free  uint64
	HugepageSize    uint64
	DirectMap4k     uint64
	DirectMap2M     uint64
	DirectMap1G     uint64
	Mlocked         uint64
	Active          uint64
	Inactive        uint64
	ActiveAnon      uint64
	InactiveAnon    uint64
	ActiveFile      uint64
	InactiveFile    uint64
	Unevictable     uint64
	VmallocTotal    uint64
	VmallocUsed     uint64
}

type MetricChange struct {
	Name     string  // e.g. "mysql IO"
	Delta    float64 // absolute change value
	DeltaPct float64 // percentage change
	Current  string  // current value string
	Unit     string  // e.g. "%", "MB/s", "/s"
	Rising   bool    // true if increasing, false if decreasing
	ZScore   float64 // statistical significance (0 = not computed)
}

type MetricCorrelation struct {
	MetricA     string  // evidence ID A
	MetricB     string  // evidence ID B
	Coefficient float64 // Pearson R (-1 to +1)
	Samples     int64   // number of samples
	Strength    string  // "strong"/"moderate"/"weak"
}

type ModLoadEntry struct {
	Name      string
	Timestamp int64
	Count     uint64
}

type MountRate struct {
	MountPoint        string
	Device            string
	FSType            string
	TotalBytes        uint64
	UsedPct           float64
	FreePct           float64
	FreeBytes         uint64
	InodeUsedPct      float64
	GrowthBytesPerSec float64   // EWMA-smoothed
	PrevGrowthBPS     float64   // previous tick's smoothed rate (for trend detection)
	ETASeconds        float64   // seconds until full (-1 = not growing)
	GrowthStarted     time.Time // when sustained growth first detected
	State             string    // "OK", "WARN", "CRIT"
}

type MountStats struct {
	MountPoint  string
	Device      string
	FSType      string
	TotalBytes  uint64
	FreeBytes   uint64
	AvailBytes  uint64 // available to non-root (statvfs f_bavail)
	UsedBytes   uint64
	TotalInodes uint64
	FreeInodes  uint64
	UsedInodes  uint64
}

type Narrative struct {
	RootCause  string   // e.g. "CPU throttle cascade — cgroup limits saturating run queue"
	Evidence   []string // top 3-4 evidence lines with values
	Impact     string   // e.g. "CPU stall 42%; disk latency +120ms"
	Confidence int
	Pattern    string // matched pattern name (empty if none)
	Temporal   string // temporal chain summary
}

type NetRate struct {
	Name       string
	RxMBs      float64
	TxMBs      float64
	RxPPS      float64
	TxPPS      float64
	RxDropsPS  float64
	TxDropsPS  float64
	RxErrorsPS float64
	TxErrorsPS float64

	// Metadata (passed through from NetworkStats)
	OperState string // "up", "down", "unknown"
	SpeedMbps int    // -1 if unknown
	Master    string // bridge/bond master name
	IfType    string // "physical", "bridge", "bond", "veth", etc.

	// Computed
	UtilPct float64 // link utilization % ((RxMBs+TxMBs)*8*1024/SpeedMbps*100), -1 if unknown
}

type NetworkStats struct {
	Name      string
	RxBytes   uint64
	RxPackets uint64
	RxErrors  uint64
	RxDrops   uint64
	RxFifo    uint64
	RxFrame   uint64
	TxBytes   uint64
	TxPackets uint64
	TxErrors  uint64
	TxDrops   uint64
	TxFifo    uint64
	TxColls   uint64
	TxCarrier uint64

	// Metadata from /sys/class/net/
	OperState string // "up", "down", "unknown"
	SpeedMbps int    // link speed in Mbps (-1 if unknown)
	Master    string // bridge/bond master interface name (empty if none)
	IfType    string // "physical", "bridge", "bond", "veth", "vlan", "tunnel", "virtual"
}

type NewListeningPort struct {
	Port  int
	PID   int
	Comm  string
	Since time.Time
}

type OOMKillEntry struct {
	VictimPID  uint32
	VictimComm string
	TotalVM    uint64
	AnonRSS    uint64
	Timestamp  int64
}

type OptDomain string

type OutboundEntry struct {
	PID         int     `json:"pid"`
	Comm        string  `json:"comm"`
	DstIP       string  `json:"dst_ip"`
	TotalBytes  uint64  `json:"total_bytes"`
	PacketCount uint64  `json:"packet_count"`
	BytesPerSec float64 `json:"bytes_per_sec"`
}

type Owner struct {
	Name   string
	CgPath string
	PID    int
	Pct    float64 // share of total
	Value  string
}

type OwnerAttribution struct {
	Kind       string  // "cgroup", "service", "pid"
	ID         string  // cgroup path, service name, or "pid:1234"
	Share      float64 // 0..1 fraction of observed load
	Confidence float64 // 0..1
}

type PHPFPMApp struct {
	App            string
	PHPVersion     string
	DocRoot        string
	DocRootMissing bool // configured DocRoot does not exist on disk (stale vhost)
	AccessLog      string
	WorkerCount    int
	RunningCount   int
	IdleCount      int
	CPUPct         float64 // sum of LiveCPUPct (% of one core)
	RSSKB          int64
	DiskReadBps    float64
	DiskWriteBps   float64
	RequestsTotal  int64
	AvgDurationMs  float64
	TopURI         string
	// From access log
	AccessReqs    int
	AccessBytes   int64
	Status2xx     int
	Status3xx     int
	Status4xx     int
	Status5xx     int
	TopIPs        []PHPFPMIPHit  // top IPs hitting this site
	TopAccessURIs []PHPFPMURIHit // top URIs in access log
	TopIPURIs     []PHPFPMIPURIHit
	// From slow log
	SlowBlocksTotal int
	TopSlowScripts  []PHPFPMScriptHit
	TopSlowFns      []PHPFPMFunctionHit
	WebShellHits    []PHPFPMWebShellSuspect
	// Filesystem scan of the docroot
	FSWebShells []PHPFPMFSFinding
	FSBinaries  []PHPFPMFSFinding
	// From live FPM status (which scripts have most workers right now)
	TopRunningScripts []PHPFPMScriptHit
	// Issues fired by RCA rules
	Issues []PHPFPMIssue
}

type PHPFPMFSFinding struct {
	Path     string
	Kind     string // "php-shell" | "obfuscated" | "ext-mismatch" | "elf-binary" | "shebang-script"
	Signal   string // why we flagged
	Evidence string // short excerpt
	Size     int64
	ModTime  time.Time
}

type PHPFPMFunctionHit struct {
	Function    string
	Hits        int
	Category    string // framework | render | db | http | fs | exec | regex | image | serialize | other
	Severity    string // normal | heavy | critical
	Explanation string
	Optimize    string
}

type PHPFPMIPHit struct {
	IP       string
	Hits     int
	RDNS     string // reverse-DNS hostname if resolvable
	Provider string // cloud/ASN label inferred from rDNS or CIDR
	Country  string // ISO-2 hint when available
}

type PHPFPMIPURIHit struct {
	IP   string
	URI  string
	Hits int
}

type PHPFPMIssue struct {
	Severity string // "crit" | "warn" | "info"
	Code     string // "phpfpm.bruteforce" | "phpfpm.webshell" | "phpfpm.saturated" | ...
	Message  string
	Detail   string
	Action   string
}

type PHPFPMMaster struct {
	PID         int
	PHPVersion  string // "8.3", "8.2", "8.1", "7.4" — derived from ConfigPath
	ConfigPath  string // e.g. /www/server/php/83/etc/php-fpm.conf
	ListenAddr  string // unix:/tmp/php-cgi-83.sock or 127.0.0.1:9000
	StatusPath  string // /phpfpm_83_status (if pm.status_path set)
	PoolName    string
	WorkerCount int
	StatusOK    bool   // true if last status fetch succeeded
	StatusError string // non-empty on failure
	// State is a high-level classification: "ok" (status fetch worked),
	// "no-status" (pool exists, pm.status_path not configured — fine
	// but uninspectable), "socket-missing", "connect-failed".
	State string
}

type PHPFPMMetrics struct {
	Masters []PHPFPMMaster
	Workers []PHPFPMWorker
	Apps    []PHPFPMApp
}

type PHPFPMScriptHit struct {
	Script string
	Hits   int
}

type PHPFPMURIHit struct {
	URI  string
	Hits int
}

type PHPFPMWebShellSuspect struct {
	Script   string
	Function string
	Frame    string
}

type PHPFPMWorker struct {
	PID           int
	MasterPID     int
	PHPVersion    string
	PoolName      string
	State         string // "Running" | "Idle"
	Script        string // /www/wwwroot/<app>/index.php
	App           string // derived from Script — first dir under /www/wwwroot or docroot
	RequestURI    string
	RequestMethod string
	DurationUs    int64   // microseconds — current request when Running, last when Idle
	LastReqCPUPct float64 // %
	LastReqMemKB  int64
	RequestsTotal int64
	// Live values from /proc
	LiveCPUPct   float64
	LiveRSSKB    int64
	DiskReadBps  float64 // bytes/sec via /proc/<pid>/io rchar delta
	DiskWriteBps float64 // bytes/sec via /proc/<pid>/io wchar delta
}

type PSILine struct {
	Avg10  float64
	Avg60  float64
	Avg300 float64
	Total  uint64 // cumulative microseconds
}

type PSIMetrics struct {
	CPU    PSIResource
	Memory PSIResource
	IO     PSIResource
}

type PSIResource struct {
	Some PSILine
	Full PSILine // cpu has no "full" line
}

type PktDropEntry struct {
	Reason    uint32
	ReasonStr string
	Count     uint64
	Rate      float64
	Benign    bool // true if this is a normal TCP lifecycle drop, not a real problem
}

type PktDropLocation struct {
	Function string  // resolved kernel function name
	Rate     float64 // drops/s at this location
	Count    uint64
}

type PktDropProto struct {
	Proto string  // "IPv4", "IPv6", "ARP"
	Rate  float64 // drops/s for this protocol
	Count uint64
}

type PortScanEntry struct {
	SrcIP             string  `json:"src_ip"`
	RSTCount          uint64  `json:"rst_count"`
	UniquePortBuckets int     `json:"unique_port_buckets"`
	DurationSec       float64 `json:"duration_sec"`
	Rate              float64 `json:"rate"`
}

type PortUser struct {
	PID         int
	Comm        string
	Ports       int // total ephemeral ports held
	Established int
	TimeWait    int // note: TIME_WAIT usually has inode 0, so this tracks indirect attribution
	CloseWait   int
}

type ProbeResult struct {
	Name       string    `json:"name"`        // probe class, e.g. "top_cpu_processes"
	EvidenceID string    `json:"evidence_id"` // evidence ID that triggered this probe
	StartedAt  time.Time `json:"started_at"`
	DurationMs int       `json:"duration_ms"`
	ExitCode   int       `json:"exit_code"`
	Output     string    `json:"output"` // stdout (truncated to 64 KB)
	Stderr     string    `json:"stderr,omitempty"`
	Truncated  bool      `json:"truncated,omitempty"`
	Error      string    `json:"error,omitempty"`
}

type ProcessAnomaly struct {
	PID      int
	Comm     string
	Metric   string // "cpu_pct", "rss_mb", "io_mbs"
	Current  float64
	Baseline float64
	StdDev   float64
	Sigma    float64
}

type ProcessMetrics struct {
	PID        int
	Comm       string
	State      string
	PPID       int
	CgroupPath string

	// CPU (in ticks)
	UTime      uint64
	STime      uint64
	NumThreads int
	Processor  int

	// Memory (in bytes)
	RSS      uint64
	VmSize   uint64
	VmSwap   uint64
	MinFault uint64
	MajFault uint64

	// IO (in bytes)
	ReadBytes  uint64
	WriteBytes uint64
	SyscR      uint64
	SyscW      uint64

	// Context switches
	VoluntaryCtxSwitches    uint64
	NonVoluntaryCtxSwitches uint64

	// File descriptors
	FDCount     int    // count of open FDs from /proc/PID/fd
	FDSoftLimit uint64 // soft limit from /proc/PID/limits

	// Start time (clock ticks since boot, from /proc/PID/stat field 22)
	StartTimeTicks uint64
}

type ProcessRate struct {
	PID           int
	Comm          string
	State         string
	CgroupPath    string
	ServiceName   string // resolved from cgroup: k8s pod, systemd unit, or docker container
	CPUPct        float64
	MemPct        float64
	ReadMBs       float64
	WriteMBs      float64
	FaultRate     float64
	MajFaultRate  float64
	CtxSwitchRate float64
	RSS           uint64
	VmSwap        uint64
	NumThreads    int
	FDCount       int
	FDSoftLimit   uint64
	FDPct         float64 // FDCount / FDSoftLimit * 100
	WritePath     string  // primary file being written to (resolved from /proc/PID/fd)
}

type ProxmoxDiskConf struct {
	Bus    string // "scsi0", "ide2", "virtio0"
	Path   string // "local-lvm:vm-100-disk-0", "/var/lib/vz/..."
	SizeGB int
	Cache  string // "none", "writeback", etc.
}

type ProxmoxFirewall struct {
	ClusterEnabled bool         // whether cluster-level firewall is active
	VMFirewalls    map[int]bool // VMID → firewall enabled
}

type ProxmoxHAResource struct {
	VMID        int
	State       string // "started", "stopped", "error", "fence"
	Group       string // HA group name
	MaxRestart  int    // max restart attempts before giving up
	MaxRelocate int    // max relocate attempts before giving up
}

type ProxmoxMetrics struct {
	IsProxmoxHost bool
	NodeName      string
	PVEVersion    string
	VMs           []ProxmoxVM
	Storage       []ProxmoxStorage

	// HA and cluster-level features
	HAEnabled   bool
	HAResources []ProxmoxHAResource
	Replication []ProxmoxReplication
	Firewall    ProxmoxFirewall
}

type ProxmoxNetConf struct {
	ID     string // "net0"
	Model  string // "virtio", "e1000"
	MAC    string
	Bridge string // "vmbr0"
	Tag    int    // VLAN tag (0=none)
}

type ProxmoxReplication struct {
	VMID     int
	Target   string // target node name
	Schedule string // cron-style schedule (e.g. "*/15")
	LastSync string // timestamp of last successful sync
	Status   string // "ok", "error", "syncing"
}

type ProxmoxStorage struct {
	Name    string
	Type    string // "lvmthin", "dir", "nfs", "zfspool"
	Path    string // mount path or VG/LV
	TotalGB float64
	UsedGB  float64
	AvailGB float64
	UsedPct float64
}

type ProxmoxVM struct {
	VMID   int
	Name   string
	Status string // "running", "stopped", "paused"
	PID    int    // KVM process PID (0 if stopped)

	// Config (from .conf) — basic resources
	CoresAlloc   int
	SocketsAlloc int // CPU sockets
	MemAllocMB   int
	BalloonMinMB int // balloon minimum (0 = ballooning disabled)
	BalloonOn    bool
	DiskConfigs  []ProxmoxDiskConf
	NetConfigs   []ProxmoxNetConf

	// Config (from .conf) — advanced settings
	CPULimit     float64  // cpulimit (0=unlimited)
	CPUUnits     int      // cpuunits (1024=default)
	NUMA         bool     // NUMA topology enabled
	Machine      string   // q35, i440fx
	BIOS         string   // seabios, ovmf
	Protection   bool     // prevent accidental removal
	StartupOrder string   // startup: order=1,up=30
	Description  string   // VM description/notes
	SnapCount    int      // number of snapshots
	Features     string   // features field (e.g. "fuse=1,nesting=1")
	HostPCI      []string // PCI passthrough devices

	// Live metrics (from cgroups + /proc) — CPU
	CPUPct              float64 // current CPU% of total host
	CPUUserPct          float64 // user-space CPU%
	CPUSysPct           float64 // kernel-space CPU%
	CPUThrottledPeriods uint64  // number of throttled periods
	CPUThrottledPct     float64 // percentage of time throttled

	// Live metrics — memory
	MemUsedMB    int    // current RSS
	MemBalloonMB int    // actual memory after ballooning (from cgroup limit or QMP)
	MemPeakMB    int    // peak RSS watermark
	MemSwapMB    int    // swap usage
	MemLimitMB   int    // memory.max in MB (0=unlimited)
	MemHighMB    int    // memory.high in MB (0=unlimited)
	MemOOMKills  uint64 // total OOM kills
	MemOOMEvents uint64 // total OOM events (attempts)

	// Live metrics — PSI (per-VM pressure stall info, avg10)
	PSICPUSome float64
	PSIMemSome float64
	PSIIOSome  float64

	// Live metrics — IO and network
	IOReadMBs  float64
	IOWriteMBs float64
	NetRxMBs   float64
	NetTxMBs   float64

	// Live metrics — cgroup resource controls
	PIDCount    int    // current number of processes
	PIDLimit    int    // pids.max
	IOMaxBps    string // io.max limit if set
	CPUWeight   int    // cpu.weight
	CPUMaxQuota string // cpu.max (e.g. "200000 100000")

	// Live metrics — misc
	UptimeSec int64

	// Computed health
	HealthScore  int      // 0-100 composite health score
	HealthIssues []string // detected issue descriptions
}

type PtraceEventEntry struct {
	TracerPID  uint32
	TracerComm string
	TargetPID  uint32
	TargetComm string
	Request    uint64
	RequestStr string
	Count      uint64
	Timestamp  int64
}

type RCAEntry struct {
	Bottleneck     string
	Score          int
	EvidenceGroups int // how many independent evidence groups fired
	TopCgroup      string
	TopProcess     string
	TopPID         int
	TopAppName     string // resolved app name from identity (empty = use TopProcess)
	Evidence       []string
	Checks         []EvidenceCheck // structured evidence with pass/fail
	Chain          []string
	EvidenceV2     []Evidence // v2 evidence objects (parallel to legacy Checks)
	DomainConf     float64    // v2 domain confidence 0..0.98
	// Facts is the NEXTGEN Phase 2 typed-evidence layer for this domain.
	// Each entry is one observation. Emitted in parallel to EvidenceV2;
	// Phase 4 makes Facts the canonical input to verifier gates.
	Facts []Fact `json:"facts,omitempty"`
}

type RateSnapshot struct {
	DeltaSec float64

	// CPU pcts
	CPUBusyPct    float64
	CPUUserPct    float64
	CPUSystemPct  float64
	CPUIOWaitPct  float64
	CPUSoftIRQPct float64
	CPUIRQPct     float64
	CPUStealPct   float64
	CPUNicePct    float64

	// Scheduling
	CtxSwitchRate float64 // total estimated

	// Memory rates (pages/s → MB/s)
	SwapInRate        float64 // MB/s
	SwapOutRate       float64
	PgFaultRate       float64 // pages/s
	MajFaultRate      float64
	DirectReclaimRate float64 // pages/s
	KswapdRate        float64
	OOMKillDelta      uint64  // OOM kills since last tick (delta, not cumulative)
	AllocStallRate    float64 // alloc stalls/s from VMStat.AllocStall delta
	SUnreclaimDelta   int64   // SUnreclaim change in bytes (slab leak detection)

	// Disks
	DiskRates  []DiskRate
	MountRates []MountRate

	// Network
	NetRates           []NetRate
	RetransRate        float64
	InSegRate          float64
	OutSegRate         float64
	TCPResetRate       float64
	TCPAttemptFailRate float64 // TCP connection attempt failures/s from /proc/net/snmp
	TCPResetRateAgg    float64 // aggregate TCP reset rate from /proc/net/snmp (EstabResets)

	// UDP
	UDPInRate  float64
	UDPOutRate float64
	UDPErrRate float64

	// Conntrack rates
	ConntrackInsertRate        float64
	ConntrackInsertFailRate    float64 // insert_failed/s — table full indicator
	ConntrackDeleteRate        float64
	ConntrackDropRate          float64
	ConntrackEarlyDropRate     float64 // forced evictions/s
	ConntrackInvalidRate       float64
	ConntrackSearchRestartRate float64 // hash contention/s
	ConntrackGrowthRate        float64 // insert - delete (net change)

	// SoftIRQ rates
	SoftIRQNetRxRate float64
	SoftIRQNetTxRate float64
	SoftIRQBlockRate float64

	// Cgroups
	CgroupRates []CgroupRate

	// Processes
	ProcessRates []ProcessRate
}

type RemoteIPStats struct {
	IP          string
	Connections int
	Established int
	TimeWait    int
	CloseWait   int
}

type ReverseShellProc struct {
	PID      int
	Comm     string
	RemoteIP string
	FD0      string
	FD1      string
}

type RoleScore struct {
	Role       ServerRole `json:"role"`
	Score      int        `json:"score"`
	MaxScore   int        `json:"max_score"`
	Confidence int        `json:"confidence"` // percentage 0-100
	Evidence   []string   `json:"evidence"`
}

type RuleStatus int

type RunbookMatch struct {
	Name    string `json:"name"`
	Path    string `json:"path"`
	Score   int    `json:"score"`
	Preview string `json:"preview,omitempty"`
}

type RuntimeEntry struct {
	Name        string                  `json:"name"`         // "jvm", "dotnet", etc.
	DisplayName string                  `json:"display_name"` // "JVM", ".NET", etc.
	Active      bool                    `json:"active"`
	Processes   []RuntimeProcessMetrics `json:"processes"`
}

type RuntimeMetrics struct {
	Entries []RuntimeEntry `json:"entries,omitempty"`
}

type RuntimeProcessMetrics struct {
	PID          int               `json:"pid"`
	Comm         string            `json:"comm"`
	Runtime      string            `json:"runtime"` // "jvm", "dotnet", "python", "node", "go"
	WorkingSetMB float64           `json:"working_set_mb"`
	ThreadCount  int               `json:"thread_count"`
	GCHeapMB     float64           `json:"gc_heap_mb,omitempty"`
	GCPausePct   float64           `json:"gc_pause_pct,omitempty"`
	GCCount      uint64            `json:"gc_count,omitempty"`
	AllocRateMBs float64           `json:"alloc_rate_mbs,omitempty"`
	Extra        map[string]string `json:"extra,omitempty"`
}

type SMARTDisk struct {
	Device      string // e.g., "/dev/sda", "/dev/nvme0n1"
	Name        string // short name: "sda", "nvme0n1"
	ModelFamily string
	ModelNumber string
	SerialNum   string
	DiskType    DiskType

	// Core health
	HealthOK     bool // SMART overall health passed
	Temperature  int  // Celsius
	PowerOnHours int

	// Wear / endurance (NVMe + SSD)
	WearLevelPct int // % life remaining (100=new, 0=dead, -1=unknown)
	PercentUsed  int // % endurance consumed (NVMe: 0=new, 100=EOL, -1=unknown)

	// NVMe-specific health indicators
	AvailableSpare          int    // % spare capacity remaining (NVMe only, -1=unknown)
	AvailableSpareThreshold int    // vendor-set minimum spare % (NVMe only, -1=unknown)
	CriticalWarning         uint8  // NVMe critical_warning bitmap
	MediaErrors             uint64 // NVMe media and data integrity errors
	UnsafeShutdowns         uint64

	// Write endurance data
	DataUnitsWritten  uint64 // NVMe: each unit = 512KB (1000 × 512B sectors)
	TotalBytesWritten uint64 // computed: total bytes written (all disk types)
	TotalBytesRead    uint64

	// SATA-specific
	ReallocSectors int // reallocated sector count
	PendingSectors int // current pending sector count

	// Life estimation (computed)
	EstLifeDays        int     // estimated days of remaining life (-1=unknown)
	WriteTBW           float64 // total terabytes written
	WriteRateTBPerYear float64 // write rate in TB/year (from total_written / power_on_hours)

	// Source of data
	Source      string // "nvme_ioctl", "sata_ioctl", "smartctl"
	ErrorString string // non-empty if collection failed
}

type SUIDBinary struct {
	Path    string
	Owner   string
	ModTime time.Time
}

type SaturationDetail struct {
	ConntrackPct  float64 // conntrack table usage % (0-100)
	EphemeralPct  float64 // ephemeral port usage % (0-100)
	RunqueueRatio float64 // load1 / nCPUs (0-1, clamped)
	PSIMax        float64 // max PSI stall across domains (0-1, normalized from %)
}

type SecurityMetrics struct {
	FailedAuthRate  float64
	FailedAuthTotal int
	FailedAuthIPs   []FailedAuthSource
	NewPorts        []NewListeningPort
	SUIDAnomalies   []SUIDBinary
	ReverseShells   []ReverseShellProc
	BruteForce      bool
	Score           string // "OK", "WARN", "CRIT"

	// Network security watchdog results
	TCPFlagAnomalies    []TCPFlagAnomaly     `json:"tcp_flag_anomalies,omitempty"`
	DNSTunnelIndicators []DNSTunnelIndicator `json:"dns_tunnel_indicators,omitempty"`
	JA3Fingerprints     []JA3Entry           `json:"ja3_fingerprints,omitempty"`
	BeaconIndicators    []BeaconIndicator    `json:"beacon_indicators,omitempty"`
	ThreatScore         string               `json:"threat_score"`
	ActiveWatchdogs     []string             `json:"active_watchdogs,omitempty"`
}

type SentinelConnLatEntry struct {
	PID    uint32
	Comm   string
	Count  uint32
	AvgMs  float64
	MaxMs  float64
	DstStr string
}

type SentinelData struct {
	Active    bool
	AttachErr string

	// Network sentinels
	PktDrops     []PktDropEntry
	PktDropLocs  []PktDropLocation // kernel functions where drops happen
	PktDropProto []PktDropProto    // which protocols are being dropped
	TCPResets    []TCPResetEntry
	StateChanges []SockStateEntry

	// Sentinel-promoted existing probes
	Retransmits []SentinelRetransEntry
	ConnLatency []SentinelConnLatEntry

	// Security
	ModLoads     []ModLoadEntry
	ExecEvents   []ExecEventEntry
	PtraceEvents []PtraceEventEntry

	// Memory
	OOMKills      []OOMKillEntry
	DirectReclaim []DirectReclaimEntry

	// CPU
	CgThrottles []CgThrottleEntry

	// Network security sentinels
	SynFlood    []SynFloodEntry   `json:"syn_flood,omitempty"`
	PortScans   []PortScanEntry   `json:"port_scans,omitempty"`
	DNSAnomaly  []DNSAnomalyEntry `json:"dns_anomaly,omitempty"`
	FlowRates   []FlowRateEntry   `json:"flow_rates,omitempty"`
	OutboundTop []OutboundEntry   `json:"outbound_top,omitempty"`

	// Aggregate rates (computed from deltas)
	PktDropRate    float64
	TCPResetRate   float64
	RetransRate    float64
	ReclaimStallMs float64
	ThrottleRate   float64
}

type SentinelRetransEntry struct {
	PID    uint32
	Comm   string
	Count  uint32
	Rate   float64
	DstStr string
}

type ServerIdentity struct {
	DiscoveredAt time.Time         `json:"discovered_at"`
	Roles        []ServerRole      `json:"roles"`
	RoleScores   []RoleScore       `json:"role_scores,omitempty"`
	Services     []DetectedService `json:"services"`
	Containers   []DockerContainer `json:"containers,omitempty"`
	K8s          *K8sNodeInfo      `json:"k8s,omitempty"`
	Websites     []WebsiteInfo     `json:"websites,omitempty"`
	Databases    []DatabaseInfo    `json:"databases,omitempty"`
	HAProxy      *HAProxyInfo      `json:"haproxy,omitempty"`
	Keepalived   *KeepalivedInfo   `json:"keepalived,omitempty"`
	VPN          *VPNInfo          `json:"vpn,omitempty"`
	IPForward    bool              `json:"ip_forward"`
	HasNFTables  bool              `json:"has_nftables"`
	HasIPTables  bool              `json:"has_iptables"`
}

type ServerProfile struct {
	Role         ServerRole      `json:"role"`
	RoleDetail   string          `json:"role_detail"`
	PanelName    string          `json:"panel_name"`
	OverallScore int             `json:"overall_score"`
	Domains      []DomainScore   `json:"domains"`
	Services     []ServiceCensus `json:"services"`
}

type ServerRole string

type ServiceCensus struct {
	Name        string  `json:"name"`
	DisplayName string  `json:"display_name"`
	CPUPct      float64 `json:"cpu_pct"`
	RSSMB       float64 `json:"rss_mb"`
	IOPSRead    float64 `json:"iops_read"`
	IOPSWrite   float64 `json:"iops_write"`
	Connections int     `json:"connections"`
	Processes   int     `json:"processes"`
}

type ServiceDiag struct {
	Name      string
	Available bool
	Findings  []DiagFinding
	WorstSev  DiagSeverity
	LastCheck time.Time
	Metrics   map[string]string // key metrics for TUI display
}

type ServiceLogStats struct {
	Name        string
	Unit        string
	ErrorRate   float64
	WarnRate    float64
	TotalErrors int
	TotalWarns  int
	LastError   string
	RateHistory []float64        // ring buffer, 60 entries for sparkline
	Findings    []JournalFinding // Tier-2 structured findings; nil when quiet
}

type Severity string

type Snapshot struct {
	HostID           string // unique identifier for this host (hostname or user-configured)
	Timestamp        time.Time
	Global           GlobalMetrics
	Cgroups          []CgroupMetrics
	Processes        []ProcessMetrics
	SysInfo          *SysInfo
	Errors           []string
	CollectionHealth *CollectionHealth
}

type SockStateEntry struct {
	OldState uint16
	NewState uint16
	OldStr   string
	NewStr   string
	Count    uint64
	Rate     float64
}

type SocketStats struct {
	SocketsUsed int
	TCPInUse    int
	TCPOrphan   int
	TCPTimeWait int
	TCPAlloc    int
	TCPMem      int // pages
	UDPInUse    int
	UDPMem      int
	RawInUse    int
	FragInUse   int
	FragMem     int
}

type SoftIRQStats struct {
	HI       uint64
	TIMER    uint64
	NET_TX   uint64
	NET_RX   uint64
	BLOCK    uint64
	IRQ_POLL uint64
	TASKLET  uint64
	SCHED    uint64
	HRTIMER  uint64
	RCU      uint64
}

type SynFloodEntry struct {
	SrcIP         string  `json:"src_ip"`
	SynCount      uint64  `json:"syn_count"`
	SynAckRetrans uint64  `json:"synack_retrans"`
	HalfOpenRatio float64 `json:"half_open_ratio"`
	Rate          float64 `json:"rate"`
}

type SysInfo struct {
	Hostname       string
	IPs            []string
	Virtualization string // "Bare Metal", "VM (KVM)", "VM (VMware)", "Container (Docker)", etc.
	CloudProvider  string // "AWS", "Hetzner", "DigitalOcean", "GCP", "Azure", etc.
	Kernel         string // kernel version
	OS             string // OS name from /etc/os-release
	Arch           string // architecture
	CPUModel       string // CPU model name
}

type SystemChange struct {
	Type   string    `json:"type"`
	Detail string    `json:"detail"`
	When   time.Time `json:"when"`
	// Domain is the RCA domain for config_drift_* types (memory/cpu/network/io/limits/unknown).
	// Empty for non-drift change types. Omitted from JSON when empty to keep
	// the wire format additive and backward-compatible.
	Domain string `json:"domain,omitempty"`
}

type TCPConnState struct {
	Established int
	SynSent     int
	SynRecv     int
	FinWait1    int
	FinWait2    int
	TimeWait    int
	Close       int
	CloseWait   int
	LastAck     int
	Listen      int
	Closing     int
}

type TCPFlagAnomaly struct {
	SrcIP     string `json:"src_ip"`
	FlagCombo string `json:"flag_combo"`
	Count     uint64 `json:"count"`
}

type TCPMetrics struct {
	RetransSegs  uint64
	InSegs       uint64
	OutSegs      uint64
	ActiveOpens  uint64
	PassiveOpens uint64
	CurrEstab    uint64
	AttemptFails uint64
	EstabResets  uint64
	InErrs       uint64
	OutRsts      uint64
}

type TCPResetEntry struct {
	PID    uint32
	Comm   string
	Count  uint64
	Rate   float64
	DstStr string
}

type TemporalChain struct {
	Events     []TemporalEvent
	Summary    string // e.g. "retransmits (T+0s) → drops (T+3s) → threads blocked (T+12s)"
	FirstMover string // evidence ID that fired first
}

type TemporalEvent struct {
	EvidenceID string
	Label      string
	FirstSeen  time.Time
	Sequence   int
}

type TimelineEntry struct {
	Time    time.Time `json:"time"`
	Message string    `json:"message"`
}

type TraceSample struct {
	TraceID     string    `json:"trace_id"`
	SpanID      string    `json:"span_id,omitempty"`
	Service     string    `json:"service,omitempty"`
	Operation   string    `json:"operation,omitempty"`
	DurationMs  float64   `json:"duration_ms"`
	StatusCode  string    `json:"status_code,omitempty"` // "OK", "ERROR", "UNSET"
	StatusError string    `json:"status_error,omitempty"`
	StartTime   time.Time `json:"start_time"`
	URL         string    `json:"url,omitempty"` // optional deep-link into Jaeger/Tempo
}

type UDPMetrics struct {
	InDatagrams  uint64
	OutDatagrams uint64
	InErrors     uint64
	NoPorts      uint64
	RcvbufErrors uint64
	SndbufErrors uint64
}

type USECheck struct {
	Resource    string  // "CPU", "Memory", "Disk sda", "Network"
	Utilization float64 // percentage (0-100)
	Saturation  float64 // queue length or pressure
	Errors      float64 // error count/rate
	UtilStatus  string  // "ok", "warn", "crit"
	SatStatus   string
	ErrStatus   string
	UtilDetail  string // "25.3% busy"
	SatDetail   string // "runqueue 2/6 (33%)"
	ErrDetail   string // "0 errors"
}

type VMStatMetrics struct {
	PgFault          uint64
	PgMajFault       uint64
	PgPgIn           uint64
	PgPgOut          uint64
	PswpIn           uint64
	PswpOut          uint64
	PgStealDirect    uint64
	PgStealKswapd    uint64
	PgScanDirect     uint64
	PgScanKswapd     uint64
	AllocStall       uint64
	CompactStall     uint64
	OOMKill          uint64
	NrDirtied        uint64
	NrWritten        uint64
	ThpFaultAlloc    uint64
	ThpCollapseAlloc uint64
}

type VPNInfo struct {
	Type      string   `json:"type"`                // "wireguard", "openvpn", "ipsec"
	Interface string   `json:"interface,omitempty"` // "wg0", "tun0", etc.
	Port      int      `json:"port,omitempty"`
	Peers     int      `json:"peers,omitempty"`
	Container string   `json:"container,omitempty"` // container name if containerized
	Evidence  []string `json:"evidence,omitempty"`
}

type VerificationTier string

type VerifiedCause struct {
	// Mechanism is the proposed causal mechanism. Human-readable, e.g.
	// "CPU contention in service mongod" or "swap-induced disk stall
	// impacting nginx". The verifier doesn't generate this — the
	// hypothesis engine (Phase 4 candidate generator) does. The
	// verifier inherits it.
	Mechanism string `json:"mechanism"`

	// Tier is the headline output. Tier A = trust this. Tier D = the
	// engine refused to commit.
	Tier VerificationTier `json:"tier"`

	// RootEntityID is the claimed root cause's entity (from EntityGraph).
	// Empty when no root entity could be identified (Tier D outputs
	// often have an empty root).
	RootEntityID string `json:"root_entity_id,omitempty"`

	// BlastRadius lists the affected entities. Empty for host-scope
	// causes.
	BlastRadius []string `json:"blast_radius,omitempty"`

	// Confidence is a derived 0-100 score combining the gates that
	// passed. NOT a probability — a calibrated heuristic. Operators
	// should use Tier as the trust signal, not this number.
	Confidence int `json:"confidence"`

	// Gates is the full record of every gate that ran against this
	// candidate, in evaluation order. Tier-degradation can be traced
	// back to the first failing gate.
	Gates []GateResult `json:"gates"`

	// EvaluatedAt is when the verifier produced this output.
	EvaluatedAt time.Time `json:"evaluated_at"`
}

type Warning struct {
	Severity string // "info", "warn", "crit"
	Signal   string // short label
	Detail   string // explanation
	Value    string // current value string
}

type WatchdogState struct {
	Active bool
	Domain string
}

type WebsiteInfo struct {
	Domain     string `json:"domain"`
	Port       int    `json:"port"`
	ConfigFile string `json:"config_file"`
	SSLExpiry  string `json:"ssl_expiry,omitempty"`
}

type WebsiteMetrics struct {
	Domain     string  `json:"domain"`
	Active     bool    `json:"active"`
	CPUPct     float64 `json:"cpu_pct"`
	RSSMB      float64 `json:"rss_mb"`
	Workers    int     `json:"workers"`
	MaxWorkers int     `json:"max_workers"`
	HitsPerMin int     `json:"hits_per_min"`
	DBSizeMB   float64 `json:"db_size_mb"`
	DiskMB     float64 `json:"disk_mb"`
	PHPVersion string  `json:"php_version,omitempty"`
}

type ZScoreAnomaly struct {
	EvidenceID string  // e.g. "cpu.busy"
	Value      float64 // current value
	WindowMean float64 // mean over sliding window
	WindowStd  float64 // stddev over sliding window
	ZScore     float64 // (value - mean) / std
}