nornir 0.4.50

//! 🧬 **`nornir` root pane** — the server/root operations that are *not*
//! workspace-scoped data views: workspace **lifecycle** (Add / Kill), **Populate**
//! and **Refresh/Poll-now**, plus the server **status / version**.
//!
//! Every other pane is a *view onto one workspace's data*; this one is where a
//! workspace is born and where it dies. (The user notes it could equally have
//! been called "server" — it holds the root, server-level operations.)
//!
//! # Operation layout (decision: ops live in the pane they belong to)
//! * **Add workspace** — form (name + descriptor path/URL + mode + poll) →
//!   `Workspaces.Register` (eager populate). CLI: `nornir workspace add`.
//! * **Kill workspace** — a confirm-gated de-register → `Workspaces.Remove`.
//!   CLI: `nornir workspace rm`.
//! * **Populate** — clone members now, build async → `Workspaces.Fetch{background}`.
//!   CLI: `nornir workspace populate`.
//! * **Refresh / Poll-now** — force a fetch+rebuild now → `Workspaces.Fetch{force}`.
//!   CLI: `nornir workspace fetch`.
//! * **Server status** — `Health.Ping` (version + repo count + status).
//!
//! All are **remote-only** (they drive a running `nornir-server`); in local mode
//! the pane shows the same one-line hint as the other server-backed panes.
//!
//! Follows the facett discovery contract the test matrix walks: a `*View`-named
//! type with `local()`/`remote()` ctors, a [`state_json`](NornirRootView::state_json)
//! that reports every button + form field + last result (LAW #6 — "see what the
//! user sees" as data), so the headless matrix mechanically discovers the pane and
//! its operations.

use std::path::PathBuf;

use eframe::egui::{self};

use super::action_log::{ActionLog, Kind};
use super::facett_theme::{Theme, GREEN, RED};
use super::ops_tabs::Server;
use super::remote;
use crate::warehouse::clone_events::CloneEventRow;
// The job list is the reusable, nornir-agnostic facett component; we only map
// our `jobs::JobRecord` onto its `JobEntry` and let it render.
use facett_jobview::{Facet, JobEntry, JobList, JobStatus};

/// 🧬 The `nornir` root pane state. Remote-only; holds the Add-workspace form,
/// the kill-confirm latch, and the last result of each root operation so the
/// rendered outcome survives between frames and is reported in `state_json`.
pub struct NornirRootView {
    /// Add-workspace form fields.
    new_name: String,
    new_descriptor: String,
    new_mode: String, // "monitored" | "pushed" | "external"
    new_poll: String,
    /// The workspace selected for the (confirm-gated) Kill button.
    kill_target: String,
    /// Two-step confirm latch for Kill (a destructive root op).
    kill_armed: bool,
    /// Last result of each operation (rendered + reported), `Ok(msg)`/`Err(msg)`.
    last_add: Option<Result<String, String>>,
    last_kill: Option<Result<String, String>>,
    last_populate: Option<Result<String, String>>,
    last_refresh: Option<Result<String, String>>,
    /// Cached `Health.Ping` server identity, fetched on demand.
    server_info: Option<Result<remote::ServerInfo, String>>,
    /// PLAN #6: cached per-member populate status (`clone_events`) for the active
    /// workspace — `Ok(rows)` newest-first, or the load error. Loaded on demand via
    /// `Viz.CloneEvents` (remote) or the local warehouse (local mode).
    clone_events: Option<Result<Vec<CloneEventRow>, String>>,
    /// The workspace the cached `clone_events` belong to (so a workspace switch
    /// invalidates the cache).
    clone_events_ws: String,
    /// 🧰 The unified job list — the reusable `facett-jobview` component (no
    /// nornir UI code). Fed from `Viz.Jobs` (remote) or the local `jobs.redb`
    /// (lock-tolerant) on a ~1.5s poll; we only map `jobs::JobRecord → JobEntry`.
    jobs_view: JobList,
    /// Workspace the cached job list belongs to (a switch forces a reload).
    jobs_ws: String,
    /// Last job poll (throttles the ~1.5s refresh — swappable to skade streaming).
    jobs_last_poll: Option<std::time::Instant>,
    /// Last job-load error (shown above the list), or `None`.
    jobs_error: Option<String>,
    theme: Theme,
}

impl Default for NornirRootView {
    fn default() -> Self {
        Self {
            new_name: String::new(),
            new_descriptor: String::new(),
            new_mode: "monitored".into(),
            new_poll: "60s".into(),
            kill_target: String::new(),
            kill_armed: false,
            last_add: None,
            last_kill: None,
            last_populate: None,
            last_refresh: None,
            server_info: None,
            clone_events: None,
            clone_events_ws: String::new(),
            jobs_view: JobList::new("Jobs"),
            jobs_ws: String::new(),
            jobs_last_poll: None,
            jobs_error: None,
            theme: Theme::default(),
        }
    }
}

impl NornirRootView {
    /// Local-warehouse ctor (no server → the pane shows the server-backed hint).
    pub fn local() -> Self {
        Self::default()
    }

    /// Remote (thin-client) ctor — identical state; the live `Server` handle is
    /// passed per-frame to [`draw`](Self::draw), mirroring the other ops panes.
    pub fn remote() -> Self {
        Self::default()
    }

    /// Re-skin with a facett palette (broadcast from the top-bar picker).
    pub fn set_palette(&mut self, t: Theme) {
        self.theme = t;
    }

    /// Render the root pane. `srv` is `None` in local mode (shows the hint).
    /// `workspaces` is the current picker list (the kill-target choices).
    /// Returns `true` when an operation mutated the server's workspace set (Add /
    /// Kill / Populate / Refresh succeeded) so the caller can re-list workspaces +
    /// reload the view immediately, the same contract `WorkspacePanel::draw_controls`
    /// uses for ⟳ Sync now.
    #[must_use]
    pub fn draw(
        &mut self,
        ui: &mut egui::Ui,
        srv: Option<&Server>,
        workspaces: &[String],
        active_ws: &str,
        local_warehouse: Option<&PathBuf>,
        log: &ActionLog,
    ) -> bool {
        let theme = self.theme;
        ui.heading("🧬 nornir — server & workspace operations");

        // ── Populate status (clone_events, PLAN #6) ──────────────────────────
        // Works in BOTH modes: remote reads `Viz.CloneEvents`, local reads the
        // workspace warehouse (lock-tolerant). Shows per-member ok/failed + the
        // error detail + when, so a thin client sees *why* a member didn't
        // populate instead of only missing data.
        self.draw_populate_status(ui, srv, active_ws, local_warehouse, log);

        // ── 🧰 Jobs (the facett-jobview component) — works in BOTH modes, so it
        // renders before the local-mode early return below.
        self.draw_jobs(ui, srv, active_ws, local_warehouse);

        let Some(srv) = srv else {
            ui.add_space(20.0);
            ui.label(
                "The nornir root pane's lifecycle ops are server-backed — launch the viz against \
                 a running nornir-server (NORNIR_SERVER=…) to add/kill/populate workspaces.",
            );
            return false;
        };
        let mut mutated = false;

        // ── Server status (Health.Ping) ──────────────────────────────────────
        ui.separator();
        ui.horizontal(|ui| {
            ui.strong("server:");
            if ui.button("⟳ status").on_hover_text("Health.Ping — version + repo count").clicked() {
                log.push(Kind::Rpc, "Health.Ping".to_string());
                self.server_info =
                    Some(remote::ping(&srv.endpoint, &srv.token).map_err(|e| format!("{e:#}")));
            }
            match &self.server_info {
                Some(Ok(i)) => {
                    ui.colored_label(
                        GREEN,
                        format!("{} · nornir {} · {} repo(s)", i.status, i.version, i.repo_count),
                    );
                }
                Some(Err(e)) => { ui.colored_label(RED, e); }
                None => { ui.colored_label(theme.text_dim, format!("{}", srv.endpoint)); }
            }
        });

        // ── Add workspace (Workspaces.Register, eager populate) ───────────────
        ui.separator();
        ui.strong("➕ add workspace");
        egui::Grid::new("nornir_add_ws").num_columns(2).spacing([8.0, 4.0]).show(ui, |ui| {
            ui.label("name:");
            ui.add(egui::TextEdit::singleline(&mut self.new_name).desired_width(220.0).hint_text("workspace name"));
            ui.end_row();
            ui.label("descriptor:");
            ui.add(
                egui::TextEdit::singleline(&mut self.new_descriptor)
                    .desired_width(360.0)
                    .hint_text("server-readable nornir-workspace.toml path/URL"),
            );
            ui.end_row();
            ui.label("mode:");
            egui::ComboBox::from_id_salt("nornir_add_mode")
                .selected_text(self.new_mode.clone())
                .show_ui(ui, |ui| {
                    for m in ["monitored", "pushed", "external"] {
                        ui.selectable_value(&mut self.new_mode, m.to_string(), m);
                    }
                });
            ui.end_row();
            ui.label("poll:");
            ui.add(egui::TextEdit::singleline(&mut self.new_poll).desired_width(100.0).hint_text("60s"));
            ui.end_row();
        });
        if ui
            .button("➕ Add workspace")
            .on_hover_text("Workspaces.Register (eager populate) — CLI: nornir workspace add")
            .clicked()
            && !self.new_name.trim().is_empty()
        {
            log.push(Kind::Rpc, format!("Workspaces.Register name={}", self.new_name));
            self.last_add = Some(
                remote::register_workspace(
                    &srv.endpoint,
                    &srv.token,
                    self.new_name.trim(),
                    self.new_descriptor.trim(),
                    &self.new_mode,
                    self.new_poll.trim(),
                )
                .map(|(name, mode, members)| format!("registered `{name}` ({mode}, {members} member(s))"))
                .map_err(|e| format!("{e:#}")),
            );
            mutated |= matches!(self.last_add, Some(Ok(_)));
        }
        result_line(ui, theme, &self.last_add);

        // ── Kill workspace (Workspaces.Remove, confirm-gated) ─────────────────
        ui.separator();
        ui.strong("🗑 kill workspace");
        if self.kill_target.is_empty() {
            self.kill_target = workspaces.first().cloned().unwrap_or_default();
        }
        ui.horizontal(|ui| {
            egui::ComboBox::from_id_salt("nornir_kill_target")
                .selected_text(if self.kill_target.is_empty() { "—".into() } else { self.kill_target.clone() })
                .show_ui(ui, |ui| {
                    for w in workspaces {
                        ui.selectable_value(&mut self.kill_target, w.clone(), w);
                    }
                });
            if !self.kill_armed {
                if ui.button("🗑 Kill…").clicked() && !self.kill_target.trim().is_empty() {
                    self.kill_armed = true;
                }
            } else {
                ui.colored_label(RED, format!("⚠ remove `{}`?", self.kill_target));
                if ui.button("✓ confirm kill").clicked() {
                    log.push(Kind::Rpc, format!("Workspaces.Remove name={}", self.kill_target));
                    self.last_kill = Some(
                        remote::remove_workspace(&srv.endpoint, &srv.token, self.kill_target.trim())
                            .map(|()| format!("removed `{}`", self.kill_target))
                            .map_err(|e| format!("{e:#}")),
                    );
                    mutated |= matches!(self.last_kill, Some(Ok(_)));
                    self.kill_armed = false;
                }
                if ui.button("✕ cancel").clicked() {
                    self.kill_armed = false;
                }
            }
        });
        result_line(ui, theme, &self.last_kill);

        // ── Populate + Refresh/Poll-now (Workspaces.Fetch) ────────────────────
        ui.separator();
        ui.strong("🔄 populate / refresh");
        ui.horizontal(|ui| {
            let target = if self.kill_target.is_empty() {
                workspaces.first().cloned().unwrap_or_default()
            } else {
                self.kill_target.clone()
            };
            if ui
                .button("⬇ Populate")
                .on_hover_text("Workspaces.Fetch{background} — clone members now, build async (CLI: nornir workspace populate)")
                .clicked()
                && !target.trim().is_empty()
            {
                log.push(Kind::Rpc, format!("Workspaces.Fetch(background) name={target}"));
                self.last_populate = Some(
                    fetch(&srv.endpoint, &srv.token, &target, false, true)
                        .map_err(|e| format!("{e:#}")),
                );
                mutated |= matches!(self.last_populate, Some(Ok(_)));
            }
            if ui
                .button("⟳ Refresh / poll-now")
                .on_hover_text("Workspaces.Fetch{force} — poll + rebuild this workspace now (CLI: nornir workspace fetch)")
                .clicked()
                && !target.trim().is_empty()
            {
                log.push(Kind::Rpc, format!("Workspaces.Fetch(force) name={target}"));
                self.last_refresh = Some(
                    fetch(&srv.endpoint, &srv.token, &target, true, false)
                        .map_err(|e| format!("{e:#}")),
                );
                mutated |= matches!(self.last_refresh, Some(Ok(_)));
            }
        });
        result_line(ui, theme, &self.last_populate);
        result_line(ui, theme, &self.last_refresh);

        mutated
    }

    /// PLAN #6: render the per-member **populate status** for `active_ws` — the
    /// `clone_events` outcomes (ok / failed + error detail + when). Loaded on
    /// demand (a ⟳ button), and auto-loaded once when the active workspace
    /// changes, so a thin client sees *why* a member didn't populate.
    /// Poll + render the job list (the `facett-jobview` component). Polls
    /// `Viz.Jobs` (remote) or the local `jobs.redb` (lock-tolerant) at most every
    /// ~1.5s — the `bench_live` cadence, swappable to skade streaming-on-commit.
    fn draw_jobs(
        &mut self,
        ui: &mut egui::Ui,
        srv: Option<&Server>,
        active_ws: &str,
        local_warehouse: Option<&PathBuf>,
    ) {
        use std::time::{Duration, Instant};
        let due = self.jobs_ws != active_ws
            || self.jobs_last_poll.is_none_or(|t| t.elapsed() >= Duration::from_millis(1500));
        if due {
            self.jobs_ws = active_ws.to_string();
            self.jobs_last_poll = Some(Instant::now());
            match load_jobs(srv, active_ws, local_warehouse) {
                Ok(recs) => {
                    self.jobs_error = None;
                    self.jobs_view.set_jobs(recs.iter().map(job_entry).collect());
                }
                Err(e) => self.jobs_error = Some(e),
            }
        }
        ui.separator();
        egui::CollapsingHeader::new("🧰 Jobs").default_open(true).show(ui, |ui| {
            if let Some(e) = &self.jobs_error {
                ui.colored_label(RED, format!("jobs unavailable: {e}"));
            }
            // Drive the facett component through its canonical Facet contract.
            Facet::ui(&mut self.jobs_view, ui);
        });
        // Keep the ~1.5s poll cadence ticking even when idle (no input events).
        ui.ctx().request_repaint_after(Duration::from_millis(1500));
    }

    /// Number of currently-running jobs — drives the app's "ask at close" guard.
    pub fn running_jobs(&self) -> usize {
        self.jobs_view.count(JobStatus::Running)
    }

    fn draw_populate_status(
        &mut self,
        ui: &mut egui::Ui,
        srv: Option<&Server>,
        active_ws: &str,
        local_warehouse: Option<&PathBuf>,
        log: &ActionLog,
    ) {
        let theme = self.theme;
        ui.separator();
        ui.horizontal(|ui| {
            ui.strong("🩺 populate status");
            ui.colored_label(theme.text_dim, active_ws);
            if ui
                .button("⟳ load")
                .on_hover_text("clone_events — per-member populate outcomes (Viz.CloneEvents / local warehouse)")
                .clicked()
            {
                log.push(Kind::Rpc, format!("Viz.CloneEvents workspace={active_ws}"));
                self.clone_events = Some(load_clone_events(srv, active_ws, local_warehouse));
                self.clone_events_ws = active_ws.to_string();
            }
        });
        // Auto-load once on a workspace switch (or first paint) so the pane shows
        // status without a manual click — matches the other data panes.
        if self.clone_events.is_none() || self.clone_events_ws != active_ws {
            self.clone_events = Some(load_clone_events(srv, active_ws, local_warehouse));
            self.clone_events_ws = active_ws.to_string();
        }
        match &self.clone_events {
            Some(Ok(rows)) if rows.is_empty() => {
                ui.colored_label(theme.text_dim, "no clone/populate events recorded yet");
            }
            Some(Ok(rows)) => {
                let failed = rows.iter().filter(|r| r.status == "error").count();
                if failed == 0 {
                    ui.colored_label(GREEN, format!("✓ all {} member event(s) ok", rows.len()));
                } else {
                    ui.colored_label(RED, format!("✗ {failed} member(s) failed to populate"));
                }
                egui::ScrollArea::vertical().max_height(160.0).show(ui, |ui| {
                    egui::Grid::new("nornir_clone_events").num_columns(4).striped(true).spacing([12.0, 2.0]).show(ui, |ui| {
                        ui.strong("member"); ui.strong("op"); ui.strong("status"); ui.strong("detail");
                        ui.end_row();
                        for r in rows.iter().take(50) {
                            ui.label(&r.member);
                            ui.label(&r.op);
                            if r.status == "error" {
                                ui.colored_label(RED, "✗ error");
                            } else {
                                ui.colored_label(GREEN, "✓ ok");
                            }
                            ui.label(&r.detail);
                            ui.end_row();
                        }
                    });
                });
            }
            Some(Err(e)) => { ui.colored_label(RED, format!("✗ {e}")); }
            None => {}
        }
    }

    /// The `nornir` pane's slice of `state_json` (LAW #6): every button this pane
    /// hosts (so the matrix can mechanically discover the new operation surface),
    /// the Add-workspace form's current field values, the kill-confirm state, and
    /// the last result of each root operation. No "TODO"/"not wired" sentinels.
    pub fn state_json(&self) -> serde_json::Value {
        let res = |r: &Option<Result<String, String>>| match r {
            None => serde_json::json!({ "ran": false }),
            Some(Ok(m)) => serde_json::json!({ "ran": true, "ok": true, "message": m }),
            Some(Err(e)) => serde_json::json!({ "ran": true, "ok": false, "error": e }),
        };
        serde_json::json!({
            "palette": self.theme.name,
            // The operation buttons this pane exposes — id ⇒ the gRPC RPC each
            // fires (CLI parity in the doc). The matrix walks this to prove every
            // root op is wired.
            "buttons": [
                { "id": "server_status",     "rpc": "Health.Ping",          "heavy": false },
                { "id": "add_workspace",     "rpc": "Workspaces.Register",  "heavy": false },
                { "id": "kill_workspace",    "rpc": "Workspaces.Remove",    "heavy": false, "confirm": true },
                { "id": "populate",          "rpc": "Workspaces.Fetch",     "heavy": false },
                { "id": "refresh",           "rpc": "Workspaces.Fetch",     "heavy": false },
                { "id": "populate_status",   "rpc": "Viz.CloneEvents",      "heavy": false },
                { "id": "jobs",              "rpc": "Viz.Jobs",             "heavy": false },
            ],
            // 🧰 The unified job list (the facett-jobview component's own state).
            "jobs": self.jobs_view.state_json(),
            "jobs_error": self.jobs_error,
            "add_form": {
                "name": self.new_name,
                "descriptor": self.new_descriptor,
                "mode": self.new_mode,
                "poll": self.new_poll,
            },
            "kill": { "target": self.kill_target, "armed": self.kill_armed },
            "results": {
                "add": res(&self.last_add),
                "kill": res(&self.last_kill),
                "populate": res(&self.last_populate),
                "refresh": res(&self.last_refresh),
            },
            "server": match &self.server_info {
                None => serde_json::json!({ "pinged": false }),
                Some(Ok(i)) => serde_json::json!({
                    "pinged": true, "ok": true,
                    "status": i.status, "version": i.version, "repo_count": i.repo_count,
                }),
                Some(Err(e)) => serde_json::json!({ "pinged": true, "ok": false, "error": e }),
            },
            // PLAN #6: the per-member populate status this pane renders — every
            // member's clone outcome (ok/error + detail + when) for the active
            // workspace, so the matrix can assert the failed member + error is
            // surfaced ("see what the user sees" as data, LAW #6).
            "populate_status": match &self.clone_events {
                None => serde_json::json!({ "loaded": false }),
                Some(Err(e)) => serde_json::json!({ "loaded": true, "ok": false, "error": e }),
                Some(Ok(rows)) => serde_json::json!({
                    "loaded": true,
                    "ok": true,
                    "workspace": self.clone_events_ws,
                    "total": rows.len(),
                    "failed": rows.iter().filter(|r| r.status == "error").count(),
                    "members": rows.iter().map(|r| serde_json::json!({
                        "member": r.member,
                        "op": r.op,
                        "status": r.status,
                        "detail": r.detail,
                        "remote": r.remote,
                        "ts": crate::warehouse::clone_events::ts_to_rfc3339(r.ts_micros),
                        "elapsed_ms": r.elapsed_ms,
                    })).collect::<Vec<_>>(),
                }),
            },
        })
    }

    /// Test/headless helper: inject populate-status rows directly (the same rows a
    /// `Viz.CloneEvents` read would yield) so the matrix can assert `state_json`
    /// surfaces a failed member + its error without a live server. (LAW: tests
    /// inject real values + assert real output.)
    pub fn set_clone_events_for_test(&mut self, workspace: &str, rows: Vec<CloneEventRow>) {
        self.clone_events_ws = workspace.to_string();
        self.clone_events = Some(Ok(rows));
    }
}

/// Load the active workspace's `clone_events` populate outcomes: remote via the
/// `Viz.CloneEvents` RPC, local via the workspace warehouse (lock-tolerant
/// `open_read_only`). Returns rows newest-first or a human error string.
fn load_clone_events(
    srv: Option<&Server>,
    active_ws: &str,
    local_warehouse: Option<&PathBuf>,
) -> Result<Vec<CloneEventRow>, String> {
    if let Some(srv) = srv {
        return remote::fetch_clone_events(&srv.endpoint, &srv.token, active_ws)
            .map_err(|e| format!("{e:#}"));
    }
    // Local mode: read the workspace's own warehouse without contending the
    // single-writer lock.
    let Some(root) = local_warehouse else {
        return Ok(Vec::new());
    };
    use crate::warehouse::clone_events::{query_clone_events, CloneSelector};
    let wh = crate::warehouse::iceberg::IcebergWarehouse::open_read_only(root)
        .map_err(|e| format!("open warehouse: {e:#}"))?;
    wh.block_on(query_clone_events(&wh, &CloneSelector::Workspace(active_ws.to_string())))
        .map_err(|e| format!("{e:#}"))
}

/// Load the job ledger for `active_ws`: remote via `Viz.Jobs`, else the local
/// `jobs.redb` beside the warehouse (lock-tolerant read). Newest-first.
fn load_jobs(
    srv: Option<&Server>,
    active_ws: &str,
    local_warehouse: Option<&PathBuf>,
) -> Result<Vec<crate::jobs::JobRecord>, String> {
    if let Some(srv) = srv {
        return remote::fetch_jobs(&srv.endpoint, &srv.token, active_ws, "", 200)
            .map_err(|e| format!("{e:#}"));
    }
    let Some(root) = local_warehouse else {
        return Ok(Vec::new());
    };
    crate::jobs::JobStore::open_read_only(root)
        .and_then(|s| s.list(&crate::jobs::JobSelector::All))
        .map_err(|e| format!("{e:#}"))
}

/// Map a nornir [`crate::jobs::JobRecord`] onto the host-agnostic facett
/// [`JobEntry`]. The `result_ref` becomes a `meta` row when present.
fn job_entry(r: &crate::jobs::JobRecord) -> JobEntry {
    let meta = if r.result_ref.is_empty() {
        Vec::new()
    } else {
        vec![("result".to_string(), r.result_ref.clone())]
    };
    JobEntry {
        id: r.job_id.clone(),
        kind: r.kind.clone(),
        target: r.target.clone(),
        status: JobStatus::parse(&r.status),
        started_micros: r.ts_start_micros,
        elapsed_ms: r.elapsed_ms,
        detail: r.detail_json.clone(),
        meta,
    }
}

/// Render an `Ok`/`Err` result line in the palette colours (shared by the ops).
fn result_line(ui: &mut egui::Ui, theme: Theme, r: &Option<Result<String, String>>) {
    let _ = theme;
    match r {
        Some(Ok(m)) => { ui.colored_label(GREEN, format!("✓ {m}")); }
        Some(Err(e)) => { ui.colored_label(RED, format!("✗ {e}")); }
        None => {}
    }
}

/// Thin wrapper over `Workspaces.Fetch` that yields a one-line human summary
/// (Populate uses `background=true`; Refresh uses `force=true`).
fn fetch(
    endpoint: &str,
    token: &str,
    name: &str,
    force: bool,
    background: bool,
) -> anyhow::Result<String> {
    // `fetch_workspace` only exposes `force`; the background path is the same
    // RPC with `background=true`, surfaced here via the dedicated helper.
    let (fetched, changed, errors, snapshot) = if background {
        remote::populate_workspace(endpoint, token, name)?
    } else {
        remote::fetch_workspace(endpoint, token, name, force)?
    };
    let snap = if snapshot.is_empty() { String::new() } else { format!(" → snapshot {}", &snapshot[..12.min(snapshot.len())]) };
    let errs = if errors.is_empty() { String::new() } else { format!(", {} error(s)", errors.len()) };
    Ok(format!("{} fetched, {} changed{snap}{errs}", fetched, changed.len()))
}

#[cfg(test)]
mod tests {
    use super::*;

    /// LAW 1 (inject-assert) + LAW #6 (components emit what they render): inject a
    /// `clone_events` row-set with one OK and one FAILED member into the pane, then
    /// assert `state_json` surfaces the failed member, its error detail, the
    /// failed-count, and the `Viz.CloneEvents` button — "see what the user sees" as
    /// data. Not a "didn't panic" test.
    #[test]
    fn state_json_surfaces_failed_member_populate_status() {
        let mut view = NornirRootView::remote();
        view.set_clone_events_for_test(
            "nordisk",
            vec![
                CloneEventRow {
                    ts_micros: 2,
                    workspace: "nordisk".into(),
                    member: "korp".into(),
                    remote: "https://github.com/nordisk/korp".into(),
                    op: "clone-fetch".into(),
                    status: "error".into(),
                    detail: "clone-fetch …: Couldn't obtain Username".into(),
                    elapsed_ms: 7,
                },
                CloneEventRow {
                    ts_micros: 1,
                    workspace: "nordisk".into(),
                    member: "facett".into(),
                    remote: "git@github.com:nordisk/facett.git".into(),
                    op: "clone-fetch".into(),
                    status: "ok".into(),
                    detail: "abc123".into(),
                    elapsed_ms: 42,
                },
            ],
        );

        let s = view.state_json();
        let ps = &s["populate_status"];
        assert_eq!(ps["loaded"], true);
        assert_eq!(ps["ok"], true);
        assert_eq!(ps["workspace"], "nordisk");
        assert_eq!(ps["total"], 2);
        assert_eq!(ps["failed"], 1, "one member failed to populate");

        let members = ps["members"].as_array().expect("members array");
        let korp = members
            .iter()
            .find(|m| m["member"] == "korp")
            .expect("failed member korp is surfaced");
        assert_eq!(korp["status"], "error");
        assert!(
            korp["detail"].as_str().unwrap().contains("Couldn't obtain Username"),
            "the error detail is readable in state_json, got: {}",
            korp["detail"]
        );
        assert_eq!(korp["op"], "clone-fetch");
        assert!(korp["ts"].as_str().unwrap().contains('T'), "ts rendered as RFC3339");

        // The populate-status button is discoverable by the matrix.
        let buttons = s["buttons"].as_array().unwrap();
        assert!(
            buttons.iter().any(|b| b["id"] == "populate_status" && b["rpc"] == "Viz.CloneEvents"),
            "the populate-status surface is wired to Viz.CloneEvents"
        );
    }
}