Synthesis

The first layer is pure and stateless: it takes one snapshot of system state
and returns a list of event dictionaries. Nothing is stored, nothing is
remembered.

Three sources feed it. IPMI contributes power-supply faults and sensor
threshold violations, tagged source: "ipmi". Service reachability
contributes the controller, VPP, RADIUS, and uplink-gateway conditions, tagged
source: "service". Captive portal health contributes portal outage and
recovery, tagged source: "captive_portal".

Event identifiers are stable, namespaced strings — this is what makes
acknowledgement and correlation possible:

service:controller_unreachable
service:vpp_disconnected
service:radius_auth_unreachable
service:radius_acct_unreachable
service:uplink_gateway_unreachable
psu:PSU1
sensor:FAN2
captive_portal:<portal-ip>:<epoch-of-outage-start>

Two synthesis policies matter to an integrator.

Severity is graded by impact, not by source. radius_auth_unreachable is
critical, because new subscribers cannot authenticate. radius_acct_unreachable
is warning — accounting is lost, which is a billing problem, but authentication
and forwarding continue.

Standalone deployments do not alarm. RADIUS events fire only when RADIUS
servers are actually configured. A deliberately RADIUS-less deployment would
otherwise alarm continuously, because a reachability check against nothing
returns unreachable.

If the controller cannot be reached at all, synthesis short-circuits: it emits
service:controller_unreachable and stops, because nothing further can be
truthfully said about the node.