{% extends 'generic/object.html' %}
{% load helpers %}
{% load i18n %}

{% block title %}{{ object }} - {% trans "Scope Reconciliation" %}{% endblock %}

{% block extra_controls %}
  <a class="btn btn-outline-secondary" href="{{ object.get_absolute_url }}">
    <i class="mdi mdi-arrow-left" aria-hidden="true"></i>&nbsp;{% trans "Sync" %}
  </a>
{% endblock extra_controls %}

{% block content %}
<div class="row mb-3">
  <div class="col col-12">
    <div class="card">
      <div class="card-body d-flex align-items-center justify-content-between">
        <div>
          {% if report_error %}
            <span class="badge text-bg-danger">{% trans "Failed" %}</span>
            <span class="ms-2">{{ report_error }}</span>
          {% elif report_pending %}
            <span class="badge text-bg-secondary">{% trans "Not run" %}</span>
            <span class="ms-2 text-muted">
              {% trans "This report queries Forward for every device and endpoint, so it runs in the background rather than on page load." %}
            </span>
          {% else %}
            <span class="badge text-bg-success">{% trans "Report ready" %}</span>
            <span class="ms-2 text-muted">
              {# Naming the producer as well as the time: every completed sync #}
              {# now refreshes this, so "generated" three days ago means the   #}
              {# post-sync job has been failing, not that nobody pressed a     #}
              {# button. Without the source those two look identical.          #}
              {% trans "Generated" %} {{ report_generated_at }}{% if report_source %} {% blocktrans %}by {{ report_source }}{% endblocktrans %}{% endif %}
            </span>
          {% endif %}
        </div>
        <form method="post" action="{{ refresh_report_url }}">
          {% csrf_token %}
          <button type="submit" class="btn btn-primary">
            <i class="mdi mdi-refresh" aria-hidden="true"></i>&nbsp;{% trans "Refresh report" %}
          </button>
        </form>
      </div>
    </div>
  </div>
</div>
<div class="row mb-3">
  <div class="col col-md-6">
    <div class="card">
      <h5 class="card-header">{% trans "Device Scope Reconciliation" %}</h5>
      <div class="card-body">
        <table class="table table-hover attr-table">
          <tr>
            <th scope="row">{% trans "Include tags" %}</th>
            <td>{{ payload.include_tags|join:", "|placeholder }}</td>
          </tr>
          <tr>
            <th scope="row">{% trans "NetBox devices" %}</th>
            <td>{{ payload.netbox_device_count }}</td>
          </tr>
          <tr>
            <th scope="row">{% trans "In scope (collected)" %}</th>
            <td>{{ payload.forward_in_scope_completed }}</td>
          </tr>
          {% if payload.forward_in_scope_endpoints %}
            <tr>
              <th scope="row">{% trans "In scope (SNMP endpoints)" %}</th>
              <td>{{ payload.forward_in_scope_endpoints }}</td>
            </tr>
          {% endif %}
          <tr>
            <th scope="row">{% trans "Tagged but backfilled" %}</th>
            <td>
              {{ payload.forward_tagged_backfilled }}
              {% if payload.netbox_present_backfilled %}
                &nbsp;<a href="{{ backfilled_tag_url }}" class="text-decoration-none">{% blocktrans with count=payload.netbox_present_backfilled %}view {{ count }} tagged{% endblocktrans %}</a>
                &nbsp;<a href="#backfilled-sample" class="text-decoration-none small">{% trans "why?" %}</a>
              {% endif %}
            </td>
          </tr>
          <tr>
            <th scope="row">{% trans "Out of scope (orphans)" %}</th>
            <td>
              {% if payload.netbox_out_of_scope %}
                {# Straight to the card carrying the cause badges and the full list. #}
                <a href="#out-of-scope-sample" class="badge text-bg-warning text-decoration-none">{{ payload.netbox_out_of_scope }}</a>
              {% else %}
                <span class="badge text-bg-success">0</span>
              {% endif %}
              {% include 'forward_netbox/inc/count_trend.html' with trend=out_of_scope_trend %}
            </td>
          </tr>
          <tr>
            <th scope="row">{% trans "Empty orphan sites" %}</th>
            <td>
              {% if payload.netbox_empty_orphan_site_count %}
                <span class="badge text-bg-warning">{{ payload.netbox_empty_orphan_site_count }}</span>
              {% else %}
                <span class="badge text-bg-success">0</span>
              {% endif %}
            </td>
          </tr>
          <tr>
            <th scope="row">{% trans "In scope, missing from NetBox" %}</th>
            <td>{{ payload.forward_missing_in_netbox }}</td>
          </tr>
          {% if payload.unmanaged.untagged_total %}
          <tr title="{% trans 'Devices carrying neither include tag. Split by whether this sync created them: one is ours and worth investigating, the other is not ours to reason about. Orphans can read zero while this is large, because a device this sync never claimed is not an orphan of it.' %}">
            <th scope="row">{% trans "Carry no include tag" %}</th>
            <td>
              {{ payload.unmanaged.untagged_total }}
              {% if payload.unmanaged.owned_untagged %}
                <a href="{{ uncovered_tag_url }}" class="badge text-bg-warning text-decoration-none">{% blocktrans with count=payload.unmanaged.owned_untagged %}{{ count }} created by this sync{% endblocktrans %}</a>
                {# The cause of this number, and the cleanup for it, are in a #}
                {# card further down the page - which is the half a customer  #}
                {# reading only the summary never reached.                    #}
                <a href="#uncovered-owned" class="text-decoration-none small">{% trans "why? / clean up" %}</a>
                {% include 'forward_netbox/inc/count_trend.html' with trend=uncovered_trend %}
              {% endif %}
              {% if payload.unmanaged.unclaimed %}
                <a href="{{ unclaimed_devices_url }}" class="badge text-bg-secondary text-decoration-none">{% blocktrans with count=payload.unmanaged.unclaimed %}{{ count }} not claimed by this sync{% endblocktrans %}</a>
                <a href="#uncovered-unclaimed" class="text-decoration-none small">{% trans "why?" %}</a>
              {% endif %}
            </td>
          </tr>
          {% endif %}
        </table>
      </div>
      <div class="card-footer text-end">
        {% if perms.dcim.change_device %}
        <form method="post" action="{{ tag_backfilled_url }}" class="d-inline">
          {% csrf_token %}
          <button type="submit" class="btn btn-outline-warning"{% if not payload.netbox_present_backfilled and not payload.netbox_out_of_scope %} disabled{% endif %}>
            <i class="mdi mdi-tag-outline" aria-hidden="true"></i>&nbsp;{% trans "Reconcile device scope tags" %}
          </button>
        </form>
        {% endif %}
        {% if perms.ipam.change_prefix %}
        <form method="post" action="{{ tag_delete_eligible_ipam_url }}" class="d-inline"
              title="{% trans 'Audits global IPAM (prefixes/VLANs/VRFs) against the latest Forward fetch and tags stale objects forward-delete-eligible for manual review. Never deletes.' %}">
          {% csrf_token %}
          <button type="submit" class="btn btn-outline-danger">
            <i class="mdi mdi-tag-remove-outline" aria-hidden="true"></i>&nbsp;{% trans "Tag delete-eligible IPAM" %}
          </button>
        </form>
        {% endif %}
        {% if dlm_available and perms.netbox_dlm.delete_hardwarenotice %}
        <form method="post" class="d-inline"
              action="{% url 'plugins:forward_netbox:forwardsync_prune_stale_hardware_notices' pk=object.pk %}"
              title="{% trans 'Asks Forward which hardware notices it still reports, and removes the ones it does not. A notice is derived data; if it still applied, Forward would still be emitting it. Device types are never deleted.' %}"
              onsubmit="return confirm('{% trans 'Remove DLM hardware notices Forward no longer reports? The job lists what it clears, and device types are kept.' %}');">
          {% csrf_token %}
          <button type="submit" class="btn btn-outline-danger">
            <i class="mdi mdi-delete-sweep-outline" aria-hidden="true"></i>&nbsp;{% trans "Clear stale hardware notices" %}
          </button>
        </form>
        {% endif %}
        {% if perms.dcim.delete_device %}
        <form method="post" class="d-inline"
              action="{% url 'plugins:forward_netbox:forwardsync_prune_orphans' pk=object.pk %}"
              {# Counts what the prune will act on - the devices Forward no    #}
              {# longer reports - not every out-of-scope device. The ones      #}
              {# Forward still has under different tags are a scoping          #}
              {# decision and are never deleted.                               #}
              onsubmit="return confirm('{% blocktrans with dev_count=payload.out_of_scope_absence.absent_from_snapshot|default:0 site_count=payload.netbox_empty_orphan_site_count %}Delete {{ dev_count }} device(s) Forward no longer reports, and {{ site_count }} empty site(s)? This also removes their interfaces and IP addresses.{% endblocktrans %}');">
          {% csrf_token %}
          {% comment %} The override is offered only when something is actually being
             held, and only here. A scheduled prune has no way to set it - that is
             the whole point, because the unattended path is the one that deleted
             devices which were merely disabled for maintenance. {% endcomment %}
          {% if payload.out_of_scope_quarantine.held %}
            <div class="form-check d-inline-block me-2 align-middle">
              <input class="form-check-input" type="checkbox" name="include_quarantined" id="include_quarantined" value="1">
              <label class="form-check-label small" for="include_quarantined"
                     title="{% trans 'A device disabled in Forward is indistinguishable from one that was removed, so an absence has to persist before the prune will act on it.' %}">
                {% blocktrans count counter=payload.out_of_scope_quarantine.held %}Also delete {{ counter }} device still in quarantine{% plural %}Also delete {{ counter }} devices still in quarantine{% endblocktrans %}
              </label>
            </div>
          {% endif %}
          <button type="submit" class="btn btn-danger"{% if not payload.out_of_scope_absence.absent_from_snapshot and not payload.netbox_empty_orphan_site_count %} disabled{% endif %}>
            <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i>&nbsp;{% trans "Prune orphans" %}
          </button>
        </form>
        {% endif %}
      </div>
    </div>
  </div>
  <div class="col col-md-6">
    <div class="card" id="out-of-scope-sample">
      <h5 class="card-header">{% trans "Out-of-Scope Sample" %}</h5>
      <div class="card-body">
        {% if payload.out_of_scope_sample %}
          {% if payload.out_of_scope_absence.available %}
            {% comment %} Which kind of absence, because all three look identical here and
               only one of them means the device really left. {% endcomment %}
            <p class="mb-2">
              {% if payload.out_of_scope_absence.absent_from_snapshot %}
                <span class="badge text-bg-secondary">{% blocktrans count counter=payload.out_of_scope_absence.absent_from_snapshot %}{{ counter }} gone from Forward{% plural %}{{ counter }} gone from Forward{% endblocktrans %}</span>
              {% endif %}
              {% if payload.out_of_scope_absence.present_untagged %}
                <span class="badge text-bg-warning">{% blocktrans count counter=payload.out_of_scope_absence.present_untagged %}{{ counter }} in Forward but untagged{% plural %}{{ counter }} in Forward but untagged{% endblocktrans %}</span>
              {% endif %}
              {% if payload.out_of_scope_absence.vendor_excluded %}
                <span class="badge text-bg-info">{% blocktrans count counter=payload.out_of_scope_absence.vendor_excluded %}{{ counter }} custom-command source{% plural %}{{ counter }} custom-command source{% endblocktrans %}</span>
              {% endif %}
            </p>
            {% if payload.out_of_scope_absence.present_untagged %}
              <p class="text-muted small mb-2">{% trans "Devices Forward still has but no longer reports under these tags. A Forward-side tag edit and a narrowed query look identical here — confirm in Forward before pruning." %}</p>
            {% endif %}
            {% if payload.out_of_scope_absence.absent_detail %}
              <p class="text-muted small mb-2">
                {% blocktrans count counter=payload.out_of_scope_absence.absent_still_tagged %}Of those gone from the snapshot, Forward's device configuration still lists {{ counter }} under an include tag:{% plural %}Of those gone from the snapshot, Forward's device configuration still lists {{ counter }} under an include tag:{% endblocktrans %}
                {% for row in payload.out_of_scope_absence.absent_detail %}
                  <span class="badge text-bg-light border" title="{{ row.sample|join:', ' }}">{{ row.count }} — {{ row.label }}</span>
                {% endfor %}
                {% trans "Forward's UI shows these as tagged; the sync reads the snapshot, which does not carry them. A disabled device stays here until collection is re-enabled or it is pruned." %}
              </p>
            {% endif %}
          {% endif %}
          {% comment %} How long the absence has lasted, which is a different question
             from what kind of absence it is, and the one that decides whether the
             prune may act yet. {% endcomment %}
          {% if payload.out_of_scope_quarantine.held %}
            <p class="mb-2">
              <span class="badge text-bg-primary">{% blocktrans count counter=payload.out_of_scope_quarantine.held %}{{ counter }} in quarantine{% plural %}{{ counter }} in quarantine{% endblocktrans %}</span>
              {% if payload.out_of_scope_quarantine.prune_eligible %}
                <span class="badge text-bg-danger">{% blocktrans count counter=payload.out_of_scope_quarantine.prune_eligible %}{{ counter }} prune-eligible{% plural %}{{ counter }} prune-eligible{% endblocktrans %}</span>
              {% endif %}
            </p>
            <p class="text-muted small mb-2">{% blocktrans with runs=payload.out_of_scope_quarantine.required_runs hours=payload.out_of_scope_quarantine.required_hours %}A device disabled in Forward disappears exactly as a removed one does, so an absence must persist for {{ runs }} consecutive syncs and {{ hours }} hours before the prune will delete it. Devices that reappear leave quarantine automatically.{% endblocktrans %}</p>
          {% endif %}
          <ul class="mb-0">
            {% for name in payload.out_of_scope_sample %}<li><code>{{ name }}</code></li>{% endfor %}
          </ul>
          {% if payload.netbox_out_of_scope > payload.out_of_scope_sample|length %}
            <p class="text-muted mt-2 mb-0">{% blocktrans with shown=payload.out_of_scope_sample|length total=payload.netbox_out_of_scope %}Showing {{ shown }} of {{ total }}.{% endblocktrans %}</p>
          {% endif %}
          {% if payload.netbox_out_of_scope %}
            {# The red button below deletes every one of these; the sample is 25. #}
            <p class="mt-2 mb-0"><a href="{{ out_of_scope_devices_url }}" class="btn btn-sm btn-outline-danger"><i class="mdi mdi-format-list-bulleted" aria-hidden="true"></i>&nbsp;{% blocktrans with count=payload.netbox_out_of_scope %}List all {{ count }}{% endblocktrans %}</a></p>
          {% endif %}
        {% else %}
          <p class="text-muted mb-0">{% trans "No out-of-scope devices." %}</p>
        {% endif %}
      </div>
    </div>
  </div>
</div>
<div class="row mt-3">
  <div class="col col-md-6">
    <div class="card">
      <h5 class="card-header">{% trans "Post-Upgrade Catalog Reconciliation" %}</h5>
      <div class="card-body">
        <table class="table table-hover attr-table mb-0">
          <tr>
            <th scope="row">{% trans "Mode" %}</th>
            <td><span class="badge text-bg-info">{% trans "Read only" %}</span></td>
          </tr>
          <tr>
            <th scope="row">{% trans "Platforms with manufacturer" %}</th>
            <td>{{ upgrade_reconciliation.platforms.with_manufacturer }} / {{ upgrade_reconciliation.platforms.total }}</td>
          </tr>
          <tr>
            <th scope="row">{% trans "Platforms without manufacturer" %}</th>
            <td>{{ upgrade_reconciliation.platforms.without_manufacturer }}</td>
          </tr>
          <tr>
            <th scope="row">{% trans "Stale endpoint DeviceTypes" %}</th>
            <td>
              {% if upgrade_reconciliation.stale_endpoint_device_types.candidate_count %}
                <span class="badge text-bg-warning">{{ upgrade_reconciliation.stale_endpoint_device_types.candidate_count }}</span>
              {% else %}
                <span class="badge text-bg-success">0</span>
              {% endif %}
            </td>
          </tr>
          <tr>
            <th scope="row">{% trans "DLM status" %}</th>
            <td><code>{{ upgrade_reconciliation.dlm.status }}</code></td>
          </tr>
          {% if upgrade_reconciliation.dlm.available %}
            <tr>
              <th scope="row">{% trans "Software versions" %}</th>
              <td>{{ upgrade_reconciliation.dlm.software_versions.total }}</td>
            </tr>
            <tr>
              <th scope="row">{% trans "Versions without devices" %}</th>
              <td>{{ upgrade_reconciliation.dlm.software_versions.without_devices }}</td>
            </tr>
            <tr>
              <th scope="row">{% trans "Protected versions without devices" %}</th>
              <td>{{ upgrade_reconciliation.dlm.software_versions.protected_without_devices }}</td>
            </tr>
            <tr>
              <th scope="row">{% trans "Unreferenced version candidates" %}</th>
              <td>
                {% if upgrade_reconciliation.dlm.software_versions.unreferenced_without_devices %}
                  <span class="badge text-bg-warning">{{ upgrade_reconciliation.dlm.software_versions.unreferenced_without_devices }}</span>
                {% else %}
                  <span class="badge text-bg-success">0</span>
                {% endif %}
              </td>
            </tr>
            <tr>
              <th scope="row">{% trans "CVEs" %}</th>
              <td>{{ upgrade_reconciliation.dlm.cves.total }}</td>
            </tr>
            <tr>
              <th scope="row">{% trans "CVEs with vulnerabilities" %}</th>
              <td>{{ upgrade_reconciliation.dlm.cves.with_vulnerabilities }}</td>
            </tr>
            <tr>
              <th scope="row">{% trans "CVEs with affected software" %}</th>
              <td>{{ upgrade_reconciliation.dlm.cves.with_affected_software }}</td>
            </tr>
            <tr>
              <th scope="row">{% trans "Unlinked CVEs" %}</th>
              <td>{{ upgrade_reconciliation.dlm.cves.unlinked }}</td>
            </tr>
          {% endif %}
        </table>
      </div>
    </div>
  </div>
  <div class="col col-md-6">
    <div class="card">
      <h5 class="card-header">{% trans "Review Candidates" %}</h5>
      <div class="card-body">
        {% if upgrade_reconciliation.stale_endpoint_device_types.sample %}
          <h6>{% trans "Stale endpoint DeviceTypes" %}</h6>
          <ul>
            {% for item in upgrade_reconciliation.stale_endpoint_device_types.sample %}
              <li><code>{{ item.manufacturer__name }} / {{ item.model }}</code></li>
            {% endfor %}
          </ul>
        {% endif %}
        {% if upgrade_reconciliation.dlm.software_versions.unreferenced_sample %}
          <h6>{% trans "Unreferenced software versions" %}</h6>
          <ul>
            {% for item in upgrade_reconciliation.dlm.software_versions.unreferenced_sample %}
              <li><code>{{ item.platform__name }} / {{ item.version }}</code></li>
            {% endfor %}
          </ul>
        {% endif %}
        {% if upgrade_reconciliation.dlm.software_versions.protected_sample %}
          <h6>{% trans "Protected software versions without devices" %}</h6>
          <ul>
            {% for item in upgrade_reconciliation.dlm.software_versions.protected_sample %}
              <li><code>{{ item.platform__name }} / {{ item.version }}</code> <span class="text-muted">({{ item.protected_by }})</span></li>
            {% endfor %}
          </ul>
        {% endif %}
        {% if not upgrade_reconciliation.stale_endpoint_device_types.sample and not upgrade_reconciliation.dlm.software_versions.unreferenced_sample and not upgrade_reconciliation.dlm.software_versions.protected_sample %}
          <p class="text-muted mb-0">{% trans "No post-upgrade review candidates." %}</p>
        {% endif %}
      </div>
    </div>
  </div>
</div>
<div class="row mt-3">
  <div class="col col-md-6">
    <div class="card">
      <h5 class="card-header">{% trans "Backfill Reason Breakdown" %}</h5>
      <div class="card-body">
        {% if payload.backfilled_reason_breakdown %}
          <p class="text-muted mt-0">{% trans "Why these in-scope devices were not freshly collected by Forward. This is a Forward collection-health signal, not a sync error — fix collection in Forward (rotate credentials for AUTHENTICATION_FAILED, check reachability for CONNECTION_TIMEOUT, finish onboarding for INCOMPLETE_SETUP)." %}</p>
          <table class="table table-hover attr-table mb-0">
            {% for reason, count in payload.backfilled_reason_breakdown.items %}
              <tr>
                <th scope="row"><code>{{ reason }}</code></th>
                <td><span class="badge text-bg-warning">{{ count }}</span></td>
              </tr>
            {% endfor %}
          </table>
        {% else %}
          <p class="text-muted mb-0">{% trans "No backfilled devices in the latest snapshot." %}</p>
        {% endif %}
      </div>
    </div>
  </div>
  <div class="col col-md-6">
    <div class="card" id="backfilled-sample">
      <h5 class="card-header">{% trans "Tagged-but-Backfilled Sample" %}</h5>
      <div class="card-body">
        {% if payload.present_backfilled_detail_sample %}
          <p class="text-muted mt-0">{% trans "In NetBox but not freshly collected in the latest snapshot (serving last-known-good data). Days = how stale the served data is." %}</p>
          <table class="table table-hover attr-table mb-0">
            <thead>
              <tr><th>{% trans "Device" %}</th><th>{% trans "Reason" %}</th><th>{% trans "Stale" %}</th></tr>
            </thead>
            <tbody>
              {% for item in payload.present_backfilled_detail_sample %}
                <tr>
                  <td><code>{{ item.name }}</code></td>
                  <td><code>{{ item.reason }}</code></td>
                  <td>{% if item.stale_days is not None %}{% blocktrans count days=item.stale_days %}{{ days }} day{% plural %}{{ days }} days{% endblocktrans %}{% else %}<span class="text-muted">&mdash;</span>{% endif %}</td>
                </tr>
              {% endfor %}
            </tbody>
          </table>
          {% if payload.netbox_present_backfilled > payload.present_backfilled_detail_sample|length %}
            <p class="text-muted mt-2 mb-0">{% blocktrans with shown=payload.present_backfilled_detail_sample|length total=payload.netbox_present_backfilled %}Showing {{ shown }} of {{ total }}.{% endblocktrans %}</p>
          {% endif %}
          {% if payload.netbox_present_backfilled %}
            <p class="mt-2 mb-0"><a href="{{ present_backfilled_devices_url }}" class="btn btn-sm btn-outline-secondary"><i class="mdi mdi-format-list-bulleted" aria-hidden="true"></i>&nbsp;{% blocktrans with count=payload.netbox_present_backfilled %}List all {{ count }}{% endblocktrans %}</a></p>
          {% endif %}
        {% else %}
          <p class="text-muted mb-0">{% trans "No backfilled devices in NetBox." %}</p>
        {% endif %}
      </div>
    </div>
  </div>
</div>
{% if catalogue_cleanup.entry_count %}
<div class="row mt-3">
  <div class="col col-md-12">
    <div class="card" id="routing-policy-outside-scope">
      <h5 class="card-header">{% trans "Routing Policy Outside Scope" %}</h5>
      <div class="card-body">
        <p class="text-muted mt-0">
          {% blocktrans with count=catalogue_cleanup.entry_count %}{{ count }} prefix-list, community-list or route-map entries in NetBox belong to definitions that no device inside this sync's scope holds, as of the latest dependency preview. The sync never removes them on its own.{% endblocktrans %}
        </p>
        <ul class="small mb-2">
          {% for model, count in catalogue_cleanup.by_model %}{% if count %}<li><code>{{ model }}</code>: {{ count }}</li>{% endif %}{% endfor %}
        </ul>
        <p class="small mb-2">
          {% trans "Removing them re-reads Forward first, and deletes only entries this sync created, that no sync still asserts, and that no route map outside the cleanup still matches on. Anything else is held and counted in the job result." %}
        </p>
        {% if perms.netbox_routing.delete_prefixlist %}
          <form method="post"
                action="{% url 'plugins:forward_netbox:forwardsync_prune_out_of_scope_catalogue' pk=object.pk %}"
                onsubmit="return confirm('{% blocktrans with count=catalogue_cleanup.entry_count %}Remove up to {{ count }} routing policy entries no in-scope device holds? Held entries are kept.{% endblocktrans %}');">
            {% csrf_token %}
            <button type="submit" class="btn btn-sm btn-danger">
              <i class="mdi mdi-delete-sweep-outline" aria-hidden="true"></i>&nbsp;{% trans "Remove out-of-scope routing policy" %}
            </button>
          </form>
        {% endif %}
      </div>
    </div>
  </div>
</div>
{% endif %}
{% if site_relabel_pairs.available and site_relabel_pairs.pair_count or site_relabel_pairs.available and site_relabel_pairs.held_count %}
<div class="row mt-3">
  <div class="col col-md-12">
    <div class="card" id="site-relabel-duplicates">
      <h5 class="card-header">{% trans "Site-Relabel Duplicates" %}</h5>
      <div class="card-body">
        <p class="text-muted mt-0">
          {% trans "When Forward relabels a device's site, older versions of this plugin created a second device instead of moving the first. The older copy usually keeps the device's primary IP and history. Merging keeps the older device, moves it to the site the sync's device map reports now, and deletes the copy. This repairs existing pairs only - a current sync no longer creates them." %}
        </p>
        {% if site_relabel_pairs.pair_count and perms.dcim.delete_device %}
          <form method="post" class="mt-2"
                action="{% url 'plugins:forward_netbox:forwardsync_merge_site_relabel_duplicates' pk=object.pk %}"
                title="{% trans 'Keeps the older device of each pair at the site the device map reports, and deletes the newer copy - only when the copy carries nothing an operator or another plugin added.' %}"
                onsubmit="return confirm('{% blocktrans with count=site_relabel_pairs.pair_count %}Merge {{ count }} site-relabel duplicate pair(s)? Each pair keeps the older device and deletes the newer copy.{% endblocktrans %}');">
            {% csrf_token %}
            <button type="submit" class="btn btn-sm btn-danger">
              <i class="mdi mdi-call-merge" aria-hidden="true"></i>&nbsp;{% blocktrans with count=site_relabel_pairs.pair_count %}Merge {{ count }} pair(s){% endblocktrans %}
            </button>
          </form>
        {% endif %}
        {% if site_relabel_pairs.last_repair %}
          <p class="mt-3 mb-1">
            {% blocktrans with job=site_relabel_pairs.last_repair.job_pk merged=site_relabel_pairs.last_repair.merged_count failed=site_relabel_pairs.last_repair.failed_count %}Last merge (job #{{ job }}): {{ merged }} merged, {{ failed }} refused.{% endblocktrans %}
          </p>
          {% if site_relabel_pairs.last_repair.routing_rows_released %}
            <p class="mb-1 text-muted">
              {% trans "Routing rows released so the newer copy could be deleted (the next sync rebuilds them on the surviving device):" %}
              {% for model, count in site_relabel_pairs.last_repair.routing_rows_released %}{{ model }} &times; {{ count }}{% if not forloop.last %}, {% endif %}{% endfor %}
            </p>
          {% endif %}
          {% if site_relabel_pairs.last_repair.failed_count %}
            <p class="mb-1 text-muted">
              {% trans "Refused:" %}
              {% for reason, count in site_relabel_pairs.last_repair.failed_by_reason %}{{ reason }} &times; {{ count }}{% if not forloop.last %}, {% endif %}{% endfor %}
              {% if site_relabel_pairs.last_repair.blocking_models %}
                &mdash; {% trans "blocked by" %}
                {% for model, count in site_relabel_pairs.last_repair.blocking_models %}{{ model }} &times; {{ count }}{% if not forloop.last %}, {% endif %}{% endfor %}
              {% endif %}
            </p>
          {% endif %}
        {% endif %}
        {% if site_relabel_pairs.held_count %}
          <p class="mt-3 mb-1">
            {% blocktrans count counter=site_relabel_pairs.held_count %}{{ counter }} duplicated name is held - it cannot be proven safe to merge yet:{% plural %}{{ counter }} duplicated names are held - they cannot be proven safe to merge yet:{% endblocktrans %}
          </p>
          <ul class="mb-0">
            {% for entry in site_relabel_pairs.held_by_reason %}
              <li><strong>{{ entry.count }}</strong> - {{ entry.remedy|default:entry.reason }}
                {% if entry.names %}
                  <div class="text-muted small">{{ entry.names|join:", " }}{% if entry.more_names %}, +{{ entry.more_names }} {% trans "more" %}{% endif %}</div>
                {% endif %}
              </li>
            {% endfor %}
          </ul>
        {% endif %}
      </div>
    </div>
  </div>
</div>
{% endif %}
{% if payload.unmanaged.untagged_total %}
<div class="row mt-3">
  <div class="col col-md-6">
    <div class="card">
      <h5 class="card-header" id="uncovered-owned">{% trans "Uncovered, Created by This Sync" %}</h5>
      <div class="card-body">
        {% if payload.unmanaged.owned_untagged_sample %}
          <p class="text-muted mt-0">{% trans "This sync created these devices, and the current Forward result no longer covers them. A device disabled in Forward looks exactly like this, so they are kept, not pruned — which is why this count grows. Use the tag to list all of them, not just this sample." %}</p>
          {% if payload.unmanaged.owned_absence.available %}
            <p class="mb-2">
              <span class="text-muted">{% trans "Why:" %}</span>
              {% if payload.unmanaged.owned_absence.absent_from_snapshot %}
                <span class="badge text-bg-secondary" title="{% trans 'Forward does not have the device at all - disabled, decommissioned, or collection stopped returning it.' %}">{% blocktrans count counter=payload.unmanaged.owned_absence.absent_from_snapshot %}{{ counter }} gone from Forward{% plural %}{{ counter }} gone from Forward{% endblocktrans %}</span>
              {% endif %}
              {% if payload.unmanaged.owned_absence.present_untagged %}
                <span class="badge text-bg-warning" title="{% trans 'Forward has the device but it no longer matches the include tags - a Forward-side tag change.' %}">{% blocktrans count counter=payload.unmanaged.owned_absence.present_untagged %}{{ counter }} in Forward but untagged{% plural %}{{ counter }} in Forward but untagged{% endblocktrans %}</span>
              {% endif %}
              {% if payload.unmanaged.owned_absence.vendor_excluded %}
                <span class="badge text-bg-info" title="{% trans 'Forward classifies the device as a custom-command source, which every bundled query filters out.' %}">{% blocktrans count counter=payload.unmanaged.owned_absence.vendor_excluded %}{{ counter }} custom-command source{% plural %}{{ counter }} custom-command source{% endblocktrans %}</span>
              {% endif %}
            </p>
            {% if payload.unmanaged.owned_absence.endpoint_detail %}
              <p class="text-muted small mb-2">
                {% trans "Of those Forward still has, these are SNMP endpoints the endpoint scope excludes:" %}
                {% for row in payload.unmanaged.owned_absence.endpoint_detail %}
                  <span class="badge text-bg-light border" title="{{ row.sample|join:', ' }}">{{ row.count }} — {{ row.label }}</span>
                {% endfor %}
                {% trans "A console server in that list means its endpoint tags match none of the include tags; a generic endpoint or CIMC controller is excluded by design." %}
              </p>
            {% endif %}
            {% if payload.unmanaged.owned_absence.absent_detail %}
              {% comment %} "Tagged in Forward but not in NetBox" is what a customer reads off
                 Forward's Device Tags page, which shows the configuration; the sync reads
                 the snapshot. Name the configuration fact so the gap is not filed as a
                 sync bug. {% endcomment %}
              <p class="text-muted small mb-2">
                {% blocktrans count counter=payload.unmanaged.owned_absence.absent_still_tagged %}Of those gone from Forward, its device configuration still lists {{ counter }} under an include tag:{% plural %}Of those gone from Forward, its device configuration still lists {{ counter }} under an include tag:{% endblocktrans %}
                {% for row in payload.unmanaged.owned_absence.absent_detail %}
                  <span class="badge text-bg-light border" title="{{ row.sample|join:', ' }}">{{ row.count }} — {{ row.label }}</span>
                {% endfor %}
                {% trans "Forward's UI shows these as tagged; the snapshot the sync reads does not carry them, so they cannot be tagged or updated in NetBox. Re-enable collection in Forward to cover a disabled device again." %}
              </p>
            {% endif %}
          {% elif payload.unmanaged.owned_absence %}
            <p class="text-muted small mb-2">{% trans "The Forward census that classifies the cause did not run for this report." %}</p>
          {% endif %}
          <p class="mb-1">
            <a href="{{ uncovered_devices_url }}" class="btn btn-sm btn-outline-warning"><i class="mdi mdi-format-list-bulleted" aria-hidden="true"></i>&nbsp;{% blocktrans with count=payload.unmanaged.owned_untagged %}List all {{ count }}{% endblocktrans %}</a>
            <a href="{{ uncovered_tag_url }}" class="btn btn-sm btn-outline-secondary"><i class="mdi mdi-tag-outline" aria-hidden="true"></i>&nbsp;{% trans "Filter devices by tag" %}</a>
          </p>
          {# The tag list above is not this sync's count: it is one tag shared  #}
          {# by every sync, so a device another sync uncovered - or one this    #}
          {# sync has since covered again - still carries it and still shows    #}
          {# up there. A customer bulk-deleted from exactly that list reading   #}
          {# "546 uncovered" against a sync whose own card said 107.            #}
          <p class="text-muted small mb-2">
            {% trans "The tag list is shared by every sync and kept from earlier runs; a device another sync uncovered, or one this sync has since covered again, still carries it. List all above is this sync's current count." %}
          </p>
          {% comment %} Only the devices Forward no longer reports at all are eligible, so
             the button counts `absent_from_snapshot` rather than the card's own total.
             Offering the larger number would promise a deletion the gates refuse, which
             is how an operator learns to distrust the panel. {% endcomment %}
          {% if perms.dcim.delete_device %}
            <form method="post" class="mt-2"
                  action="{% url 'plugins:forward_netbox:forwardsync_prune_uncovered' pk=object.pk %}"
                  title="{% trans 'Deletes only the devices Forward no longer reports at all, and only once their absence has outlasted the quarantine. A device Forward still returns without an include tag is a scoping decision and is never deleted, and neither is one this sync did not create.' %}"
                  onsubmit="return confirm('{% blocktrans with count=payload.unmanaged.owned_prune_candidates %}Delete {{ count }} device(s) this sync created that Forward no longer reports? This also removes their interfaces and IP addresses.{% endblocktrans %}');">
              {% csrf_token %}
              {% if payload.unmanaged.owned_quarantine.held %}
                <div class="form-check d-inline-block me-2 align-middle">
                  <input class="form-check-input" type="checkbox" name="include_quarantined" id="include_quarantined_uncovered" value="1">
                  <label class="form-check-label small" for="include_quarantined_uncovered"
                         title="{% trans 'A device disabled in Forward is indistinguishable from one that was removed, so an absence has to persist before the prune will act on it.' %}">
                    {% blocktrans count counter=payload.unmanaged.owned_quarantine.held %}Also delete {{ counter }} device still in quarantine{% plural %}Also delete {{ counter }} devices still in quarantine{% endblocktrans %}
                  </label>
                </div>
              {% endif %}
              {# Counts what the button would actually delete, not what is of #}
              {# the right kind. It used to read "Delete 105" while the       #}
              {# quarantine held all 105, so pressing it deleted nothing.     #}
              <button type="submit" class="btn btn-sm btn-danger"{% if not payload.unmanaged.owned_quarantine.prune_eligible %} disabled{% endif %}>
                <i class="mdi mdi-trash-can-outline" aria-hidden="true"></i>&nbsp;{% blocktrans with count=payload.unmanaged.owned_quarantine.prune_eligible|default:0 %}Delete {{ count }} eligible now{% endblocktrans %}
              </button>
              {% if payload.unmanaged.owned_quarantine.held %}
                <span class="text-muted small ms-2">{% blocktrans count counter=payload.unmanaged.owned_quarantine.held %}{{ counter }} more held by the quarantine{% plural %}{{ counter }} more held by the quarantine{% endblocktrans %}</span>
              {% endif %}
            </form>
          {% endif %}
          {# The orphan card has carried this sentence since the quarantine    #}
          {# shipped; the uncovered card never did, so an operator watching a  #}
          {# count that would not move had nothing on the page explaining why. #}
          {% if payload.unmanaged.owned_quarantine.required_runs is not None %}
            <p class="text-muted small mb-2">{% blocktrans with runs=payload.unmanaged.owned_quarantine.required_runs hours=payload.unmanaged.owned_quarantine.required_hours %}A device disabled in Forward disappears exactly as a removed one does, so an absence must persist for {{ runs }} consecutive syncs and {{ hours }} hours before the prune will delete it. Devices that reappear leave quarantine automatically.{% endblocktrans %}</p>
          {% endif %}
          <ul class="mb-0">
            {% for name in payload.unmanaged.owned_untagged_sample %}<li><code>{{ name }}</code></li>{% endfor %}
          </ul>
          {% if payload.unmanaged.owned_untagged > payload.unmanaged.owned_untagged_sample|length %}
            <p class="text-muted mt-2 mb-0">{% blocktrans with shown=payload.unmanaged.owned_untagged_sample|length total=payload.unmanaged.owned_untagged %}Showing {{ shown }} of {{ total }}.{% endblocktrans %}</p>
          {% endif %}
        {% else %}
          <p class="text-muted mb-0">{% trans "Every device this sync created is covered by the current Forward result." %}</p>
        {% endif %}
      </div>
    </div>
  </div>
  <div class="col col-md-6">
    <div class="card">
      <h5 class="card-header" id="uncovered-unclaimed">{% trans "Uncovered, Not Claimed by This Sync" %}</h5>
      <div class="card-body">
        {% if payload.unmanaged.unclaimed_sample %}
          <p class="text-muted mt-0">{% trans "Devices this sync never created: another source, an operator, or an old SNMP endpoint import. Listed so the count above can be accounted for — this sync makes no claim about them, tags none of them, and never prunes them." %}</p>
          <p><a href="{{ unclaimed_devices_url }}" class="btn btn-sm btn-outline-secondary"><i class="mdi mdi-format-list-bulleted" aria-hidden="true"></i>&nbsp;{% blocktrans with count=payload.unmanaged.unclaimed %}List all {{ count }}{% endblocktrans %}</a></p>
          <ul class="mb-0">
            {% for name in payload.unmanaged.unclaimed_sample %}<li><code>{{ name }}</code></li>{% endfor %}
          </ul>
          {% if payload.unmanaged.unclaimed > payload.unmanaged.unclaimed_sample|length %}
            <p class="text-muted mt-2 mb-0">{% blocktrans with shown=payload.unmanaged.unclaimed_sample|length total=payload.unmanaged.unclaimed %}Showing {{ shown }} of {{ total }}.{% endblocktrans %}</p>
          {% endif %}
        {% else %}
          <p class="text-muted mb-0">{% trans "Every uncovered device was created by this sync." %}</p>
        {% endif %}
      </div>
    </div>
  </div>
</div>
{% endif %}
{% endblock content %}