@skyhook-io/k8s-ui 1.10.5 → 1.12.0

package/src/components/trace/reachInspector.ts

@@ -1,8 +1,8 @@
 import type { Trace, RouteResult, ResourceRef } from './types'
 import type { Mark, SevTone } from './reachMarks'
-import { routeMark, routeChip, routeTone, routeAsSeenFrom, originRouteEvidence, routeForOrigin, traceInClusterRunnable } from './reachMarks'
+import { routeMark, routeChip, routeTone, routeAsSeenFrom, originRouteEvidence, routeForOrigin, traceInClusterRunnable, markHelp } from './reachMarks'
 import type { Origin, OriginId } from './reachOrigins'
-import { strongestGap, actionableGap, originSkipReason } from './reachOrigins'
+import { strongestGap, actionableGap, originSkipReason, originInformationalReason } from './reachOrigins'
 import { hopEvidenceFor, originProducedEvidence, type GraphNode } from './reachGraphModel'
 
 // 'run-probes' re-runs the reachability probes. It is deliberately NOT
@@ -45,7 +45,7 @@ export interface Sidebar {
     scope: { k: string; v: string }[]
     evidence: { mark: Mark; text: string }[]
     notProve: string[]
-    next: { header: string; body: string; blocked?: string; ctas: InspectorCTA[]; quiet?: boolean }
+    next: { header: string; body: string; blocked?: string; ctas: InspectorCTA[] }
   }
   /** Every hop on the selected path, in order - the whole story for this path
    *  seen from this vantage, rather than a summary plus whichever node was last
@@ -74,7 +74,7 @@ export interface HopDetail {
 /** Configured-but-bypassed resources, grouped under one label naming WHY they
  *  are outside this vantage's journey. Their config sections stay readable;
  *  their journey-state words do not apply. */
-function contextGroup(ctx: Ctx, byId: Map<string, GraphNode>): Sidebar['context'] {
+function contextGroup(ctx: Ctx, byId: Map<string, GraphNode>, sel: Selection): Sidebar['context'] {
   const nodes = (ctx.contextNodeIds ?? []).map((id) => byId.get(id)).filter((n): n is GraphNode => !!n)
   if (nodes.length === 0) return undefined
   const label =
@@ -85,12 +85,16 @@ function contextGroup(ctx: Ctx, byId: Map<string, GraphNode>): Sidebar['context'
         : 'PARALLEL ENTRY — NOT ON THIS ROUTE\u2019S PATH'
   return {
     label,
+    // Context hops are collapsed by default - they are not the journey. But the
+    // SELECTED one opens: the entry-problem row's whole purpose is "show me the
+    // cause", and landing on a still-collapsed section makes the reader spend a
+    // second click on the thing they just asked for.
     hops: nodes.map((n) => ({
       ...resourceSection(n),
       id: n.id,
       state: 'plain' as const,
       chipText: '',
-      expanded: false,
+      expanded: sel === n.id,
     })),
   }
 }
@@ -120,7 +124,7 @@ const NOT_DATAPLANE = 'Nothing about the normal network path. Kubernetes relayed
 const SYNTHETIC_IDENTITY =
   'That your app can reach it. This test ran from a throwaway Pod under the namespace’s default account with no token mounted — not as your application — so anything that checks who is calling may answer differently.'
 
-function originScope(o: Origin, trace: Trace): { k: string; v: string }[] {
+function originScope(o: Origin, trace: Trace, request?: string): { k: string; v: string }[] {
   const runsIn: Record<OriginId, string> = {
     incluster: `a throwaway Pod in ${trace.subject.namespace || 'the cluster'}`,
     'radar-incluster': 'Radar\u2019s own Pod',
@@ -137,6 +141,9 @@ function originScope(o: Origin, trace: Trace): { k: string; v: string }[] {
     // different facts and must not share a label.
     { k: o.id === 'local' ? 'NETWORK POSITION' : 'IDENTITY', v: o.identity },
     { k: 'MECHANISM', v: o.mech },
+    // A status code cannot be read without knowing what was asked for - "404"
+    // means nothing until you know the request was GET /.
+    ...(request ? [{ k: 'REQUEST', v: request }] : []),
   ]
 }
 
@@ -151,6 +158,7 @@ function gapNext(
   namespace?: string,
   multiPath?: boolean,
   inClusterRunnable = true,
+  canRun = true,
 ): Sidebar['path']['next'] {
   // The server can only test a route that carries a concrete in-cluster request.
   // When none does, the run fails with "not supported for this subject" - so the
@@ -161,7 +169,14 @@ function gapNext(
   // graph, which is the thing that would produce the missing evidence - and a
   // third copy of the same control (header, panel, capsule) was one too many.
   // The panel keeps the REASONING, which is what it is good at.
-  const inClusterCTA = (): InspectorCTA[] => []
+  const inClusterCTA = (): InspectorCTA[] => {
+    // No handler wired (a library consumer that omits it) means the click would
+    // do nothing at all - offer nothing rather than a button that lies.
+    if (!canRun) return []
+    return inClusterRunnable
+      ? [{ text: '⚗ Run the in-cluster test', action: 'run-in-cluster', primary: true }]
+      : [{ text: '⚗ Run the in-cluster test', action: 'run-in-cluster', disabledReason: notRunnable }]
+  }
   const actionable = actionableGap(origins)
   const ceiling = strongestGap(origins)
   const ceilingNote = ceiling?.unsupported ? `Even then, ${ceiling.name.toLowerCase()} stays untested — ${ceiling.unavailable}` : undefined
@@ -194,28 +209,23 @@ function gapNext(
     }
   }
   if (actionable && actionable.id === current.id) {
-    // You are looking at the vantage that is itself the gap.
+    // You are looking at the vantage that is itself the gap. The section body
+    // already said nothing ran from here, and the caveats section already
+    // carries the ceiling - so this is the ACTION and nothing else.
     return {
-      header: 'RUN THIS NEXT',
-      body: inClusterRunnable
-        ? `Nothing has been tested from ${actionable.name} yet, and it is the strongest evidence Radar can still collect.${allPaths}`
-        : `${notRunnable} Every declared path here was skipped before a request could be formed.`,
-      blocked: ceilingNote,
+      header: '',
+      body: inClusterRunnable ? '' : `${notRunnable} Every declared path here was skipped before a request could be formed.`,
       ctas: actionable.id === 'incluster' ? inClusterCTA() : [{ text: '⟳ Re-run', action: 'run-probes' }],
     }
   }
   if (!actionable) {
-    // Terminal state: there is nothing to do, and a call-to-action box whose
-    // message is "no action" shouts its own irrelevance. One quiet line of
-    // closure; no Re-run (the header already owns that control - the same
-    // one-copy rule as inClusterCTA), and no ceiling caveat (WHAT THIS
-    // DOESN'T PROVE states it on this same pane).
-    return {
-      header: 'NO STRONGER TEST AVAILABLE',
-      body: `This is the strongest evidence Radar can collect for this path.${allPaths}`,
-      ctas: [],
-      quiet: true,
-    }
+    // Nothing to offer: say nothing. This was a resource-level statement living
+    // in the selection-scoped panel, identical on every vantage - the scope
+    // mixing this redesign exists to remove - and the ceiling it gestured at is
+    // already stated, with specifics, in WHAT THIS DOESN'T PROVE and in the
+    // footer's coverage ledger. An empty section is the honest render of
+    // "there is no next step".
+    return { header: '', body: '', ctas: [] }
   }
   return {
     header: 'RUN THIS NEXT',
@@ -259,6 +269,9 @@ interface Ctx {
   multiPath?: boolean
   /** The HTTP path the run requests, as chosen in "what to test". */
   httpPath?: string
+  /** False when the host wired no in-cluster handler, or permission is denied:
+   *  the run must not be offered at all then. */
+  canRunInCluster?: boolean
 }
 
 /**
@@ -280,7 +293,73 @@ function restatesTitle(summary: string | undefined, title: string): boolean {
   return !!summary && !!title && norm(summary) === norm(title)
 }
 
+/** The request this route would send, in one line - "GET /healthz", or "TCP
+ *  connect" where there is no application request to make. */
+function requestLabel(route: RouteResult | undefined, httpPath?: string): string | undefined {
+  const r = route?.inClusterRequest
+  if (!r) return undefined
+  if (r.protocol === 'tcp') return 'TCP connect'
+  const path = httpPath || r.path || '/'
+  return `GET ${path}`
+}
+
+/**
+ * What an ANSWER means for this page's question.
+ *
+ * "reached" plus an HTTP status is the single most-misread result on the tab:
+ * a reader sees amber and 404 and cannot tell whether that is a problem. It is
+ * not - for the question this page asks. The network path is proven the moment
+ * the app answers at all; the status code is a statement about the app's own
+ * routing, auth or health, which reachability does not judge. Say that, and say
+ * what would turn it into a verified pass.
+ */
+/**
+ * What an answer MEANS, and whether that answer is evidence the path works.
+ *
+ * `pathWorks` is the load-bearing half: an app answering 404 proves the journey
+ * reached it, while a gateway answering 502 proves the opposite. Both are
+ * "answers", so a caller that prefixes every meaning with "the path works"
+ * states the reverse of the truth on exactly the cases that matter most.
+ */
+function statusMeaning(evidence?: string, httpPath?: string, failedLayer?: string): { text: string; pathWorks: boolean } | undefined {
+  // A cert failure never gets an HTTP status - the handshake stops before a
+  // request is sent - so this must be decided before looking for a code.
+  if (failedLayer === 'tls') {
+    return { text: 'the TLS handshake did not verify - a certificate problem, not an application one.', pathWorks: false }
+  }
+  const m = /HTTP\s+(\d{3})/i.exec(evidence ?? '')
+  if (!m) return undefined
+  const code = Number(m[1])
+  const asked = httpPath && httpPath !== '/' ? httpPath : '/'
+  // 502/504 are NOT the app: a gateway answering that it could not reach its
+  // upstream. The producer says so with failedLayer 'upstream'; blaming app
+  // health here contradicted the chip beside it.
+  if (failedLayer === 'upstream' || code === 502 || code === 504) {
+    return {
+      text: `the front door answered, but only to say it could not reach the backend (HTTP ${code}) - the break is between the entry and the app, not inside the app.`,
+      pathWorks: false,
+    }
+  }
+  if (code >= 500) {
+    return { text: `the request reached the app and the app itself returned an error (HTTP ${code}) - application health, which this page does not judge.`, pathWorks: true }
+  }
+  if (code === 401 || code === 403 || code === 407) {
+    return { text: `the app answered by demanding credentials (HTTP ${code}) - it is enforcing auth, which is a different thing from reachability.`, pathWorks: true }
+  }
+  if (code >= 300 && code < 400) {
+    return { text: `the app answered with a redirect (HTTP ${code}), which Radar does not follow - so whatever it points at is untested from here.`, pathWorks: true }
+  }
+  if (code >= 400) {
+    return { text: `the app answered (HTTP ${code}) - that is it saying it serves no route for ${asked}, not a reachability problem. To verify a real route, re-run with a path your app serves.`, pathWorks: true }
+  }
+  return undefined
+}
+
 /** The persistent diagnosis: did traffic get through, from where, and what next. */
+/** The suffix the localization lines carry; stripped when deduping so one
+ *  observation cannot appear twice at two lengths. */
+const LOCALIZED_SUFFIX_RE = / [-\u2014] checked directly, past the entry point$/
+
 function pathSection(ctx: Ctx): Sidebar['path'] {
   const { trace, route, origin, origins } = ctx
   // The route outcome is merged across origins. Without this gate the panel
@@ -330,14 +409,29 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
   }
 
   const evidence: { mark: Mark; text: string }[] = []
-  const seen = new Set<string>()
+  const seen = new Map<string, number>()
+  // Two lines can be the SAME observation worded at different lengths: a route's
+  // rollup evidence and the localization fact from that same dial differ only by
+  // the " - checked directly..." suffix, so exact-string dedupe let both through
+  // and the reader saw "HTTP 404 - reached" twice. Key on the observation and
+  // keep the more specific wording.
   const add = (m: Mark, text: string) => {
-    const key = text.trim().toLowerCase()
-    if (!key || seen.has(key)) return
-    seen.add(key)
-    evidence.push({ mark: m, text })
+    const t = text.trim()
+    const key = t.toLowerCase().replace(LOCALIZED_SUFFIX_RE, '').trim()
+    if (!key) return
+    const at = seen.get(key)
+    if (at !== undefined) {
+      if (t.length > evidence[at].text.length) evidence[at] = { mark: evidence[at].mark, text: t }
+      return
+    }
+    seen.set(key, evidence.length)
+    evidence.push({ mark: m, text: t })
   }
   if ((hasEvidence || fromConfig) && asSeen?.evidence) add(mark, asSeen.evidence)
+  // A result with no evidence STRING is still a result: show what the mark
+  // means rather than leaving the section empty, which would read as "nothing
+  // ran" for a vantage that did.
+  else if (hasEvidence && asSeen) add(mark, markHelp(mark))
   // What this vantage saw at each HOP. The route is built from the backend's
   // probes, so a laptop that dialled the front door and got an answer had all
   // of it discarded and read as "no test has been run from here" - beside a
@@ -374,12 +468,16 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
     // has been run" - the capsule preserves the attempt and this row must not
     // erase it. The error itself is the observation.
     const attemptError = origin.id === 'incluster' && origin.mark === 'blocked' ? origin.unavailable : undefined
+    // A demoted run produced a real observation; "no test has been run from
+    // here" erased it.
+    const informational = origin.mark === 'inconclusive' ? originInformationalReason(trace, origin.id) : undefined
     add(
       mark,
       // The attempt error outranks skip rows: a prior Job's leftover skips
       // would otherwise paint a fresh failed run (image pull, quota) with last
       // run's reason, one pane from a capsule saying "test couldn't run".
-      attemptError ||
+      informational ||
+        attemptError ||
         skipReason ||
         (origin.unsupported
           ? 'Radar cannot test from here, so nothing has been learned this way'
@@ -388,7 +486,7 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
             : // A vantage that CANNOT be used states why (nothing dialable from
               // the laptop, a skipped mechanism) - "no test has been run" reads
               // as a test someone forgot, which is a different claim.
-              origin.unavailable || 'no test has been run from here'),
+              origin.unavailable || ''),
     )
   }
 
@@ -399,12 +497,22 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
   const rawDiagnosis = trace.diagnosis
   const diagnosis = rawDiagnosis && (!rawDiagnosis.route || rawDiagnosis.route === route?.route) ? rawDiagnosis : undefined
   const reachedSomething = !hasEvidence && !fromConfig && hopSeen.some((x) => x.ev.mark !== 'failed')
+  const answer = statusMeaning(asSeen?.evidence, ctx.httpPath, asSeen?.failedLayer)
   const body = basis === 'cluster-state'
     ? 'Nothing is ready to serve this path right now, so it cannot work from any vantage. No request was sent to establish that — it is read off the current state of the cluster, and it changes when the workload does.'
     : fromConfig
     ? 'The configuration itself is broken, so this path cannot work from any vantage. No request was sent to establish that — it is read off what is declared.'
     : reachedSomething
     ? 'This vantage did reach part of the path — see what it saw below. It has no result for this route as a whole, so the end-to-end journey from here is still unproven.'
+    : origin.mark === 'inconclusive' || mark === 'inconclusive'
+    // A demoted run RAN and answered - it is only kept out of the verdict. The
+    // "nothing has been tested" branch below fired first and denied it happened.
+    // Both the origin's mark and the route's own can carry the demotion, and the
+    // sentence is the same either way; the reason comes from the informational
+    // skip that recorded it, never from the route-scoped skip lookup.
+    ? `The probe ran and got an answer, but it is kept as evidence rather than a verdict${
+        originInformationalReason(trace, origin.id) ? `: ${originInformationalReason(trace, origin.id)}` : ''
+      }. A throwaway identity cannot stand in for your application, so what it saw informs but never decides.`
     : !hasEvidence
     ? (origin.unavailable || 'Nothing has been tested from here, so this says nothing about whether traffic gets through.') +
       // When NOTHING was tested anywhere, the health dots are the only colour
@@ -416,11 +524,23 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
     : mark === 'proved'
       ? 'A real request went through and the target answered.'
       : mark === 'proxied'
-        ? 'Kubernetes relayed a request and the target answered — which shows something is serving, not that the normal path works.'
+        ? [
+            'Kubernetes relayed a request and the target answered — which shows something is serving, not that the normal path works.',
+            // The relay caveat alone leaves "404" unreadable: the reader still
+            // cannot tell whether the answer itself was a problem.
+            answer && `As for the answer itself: ${answer.text}`,
+          ]
+            .filter(Boolean)
+            .join(' ')
         : mark === 'untested'
           ? 'Nothing has been tried from here yet. Configuration may look right, but that is intent, not proof.'
           : mark === 'stale'
             ? 'This result predates a change to the cluster, so it is set aside rather than trusted.'
+            : mark === 'excluded'
+              // Benign by design (deliberately scaled to zero, a not-eligible
+              // endpoint). It fell through to the generic "answered" sentence,
+              // which described a request that was never sent.
+              ? `${asSeen?.evidence || 'Nothing is behind this path right now'} — that is deliberate, not a failure: nothing was sent, because there is nothing to reach.`
             : mark === 'running'
               ? 'A test is running. Earlier results stay until new ones replace them.'
               : // A proxy-only failure wears the same amber mark as a real answer,
@@ -428,7 +548,14 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
                 // the reader to debug an application response that never existed.
                 asSeen?.outcome === 'unreachable' && asSeen?.confidence === 'indirect'
                 ? 'The relayed dial failed. The proxy bypasses the real path, so this does not condemn it — but nothing answered, and the real path is still untested.'
-                : 'The target answered, but not with what was asked for.'
+                : // Only an answer that proves the journey completed earns "the
+                  // path works" - a 502 or a failed handshake is an answer that
+                  // says the opposite.
+                  (answer ? (answer.pathWorks ? `The path works: ${answer.text}` : `The path did not work: ${answer.text}`) : undefined) ??
+                // A transport-only reach: nothing was asked of the application.
+                (asSeen?.outcome === 'reached'
+                  ? 'The port accepted a connection, but nothing was asked of the application - the transport works and the application protocol is unverified.'
+                  : 'The target answered, but not with what was asked for.')
 
   return {
     chipTone: asSeen ? routeTone(asSeen, { stale: ctx.stale, running: ctx.running }) : 'unknown',
@@ -436,7 +563,7 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
     title: `${origin.name} → ${route?.target || trace.subject.name}`,
     request: route ? `${route.route}${ctx.httpPath && ctx.httpPath !== '/' ? ` · HTTP path ${ctx.httpPath}` : ''}` : undefined,
     body,
-    scope: [...originScope(origin, trace), ...(route ? [{ k: 'PATH', v: route.route }] : [])],
+    scope: [...originScope(origin, trace, requestLabel(route, ctx.httpPath)), ...(route ? [{ k: 'PATH', v: route.route }] : [])],
     evidence,
     notProve,
     next:
@@ -449,7 +576,7 @@ function pathSection(ctx: Ctx): Sidebar['path'] {
               ...(diagnosis.command ? [{ text: 'Copy the command', action: 'copy-command' as InspectorAction, command: diagnosis.command }] : []),
             ],
           }
-        : gapNext(origins, origin, trace.subject.namespace, ctx.multiPath, traceInClusterRunnable(trace)),
+        : gapNext(origins, origin, trace.subject.namespace, ctx.multiPath, traceInClusterRunnable(trace), ctx.canRunInCluster !== false),
   }
 }
 
@@ -588,7 +715,7 @@ export function buildSidebar(sel: Selection, ctx: Ctx): Sidebar {
         expanded: sel ? n.id === sel : i === defaultOpen,
       }
     }),
-    context: contextGroup(ctx, byId),
+    context: contextGroup(ctx, byId, sel),
   }
 }
 
@@ -607,6 +734,8 @@ export function buildVerdict(
    *  route-scoped badge apart from the resource-wide headline beside it. */
   chipScope?: string
   scopeLabel?: string
+  /** The selected vantage's name - the viewing strip renders it. */
+  originName?: string
   title: string
   problem?: string
   body: string
@@ -643,6 +772,7 @@ export function buildVerdict(
       .filter(Boolean)
       .join(' · ') || undefined,
     scopeLabel: opts.pathLabel || opts.originName ? 'THIS RESOURCE' : undefined,
+    originName: opts.originName,
     // A stale screen previously led with the old headline ("Reachable...") and
     // then said underneath that the result was excluded. That is a contradiction,
     // not an exclusion.

package/src/components/trace/reachMarks.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from 'vitest'
-import { routeMark, routeTone, routeChip, orderRoutes, scenariosFor, groupRoutes, vantageSignature, routeIdentity, isSlow, formatLatency, hostMatches, declaredHosts, routeHostOf, routeForOrigin, routeAsSeenFrom, originRouteEvidence, MARKS } from './reachMarks'
+import { routeMark, routeTone, routeChip, orderRoutes, scenariosFor, groupRoutes, vantageSignature, routeIdentity, isSlow, formatLatency, hostMatches, declaredHosts, routeHostOf, routeForOrigin, routeAsSeenFrom, originRouteEvidence, MARKS, edgeHelp, markHelp, edgeHelpIsRedundant } from './reachMarks'
 import type { RouteResult, Hop } from './types'
 
 const r = (o: Partial<RouteResult>): RouteResult => ({ route: 'GET /', outcome: 'verified', ...o })
@@ -665,3 +665,34 @@ describe('a preserved candidate is one gap, not two scenarios', () => {
     expect(s).toHaveLength(2)
   })
 })
+
+describe('a structural line explains itself, not a test that never existed', () => {
+  it('ownership and selection never claim they were "not tested"', () => {
+    expect(edgeHelp('runs', 'config')).toContain('ownership')
+    expect(edgeHelp('runs', 'config')).not.toContain('not tested')
+    expect(edgeHelp('selects', 'config')).toContain('read from the cluster')
+    expect(edgeHelp('selects', 'config')).not.toContain('not tested')
+  })
+  it('declared routing says what WOULD exercise it', () => {
+    for (const l of ['routes to', 'sends to']) {
+      expect(edgeHelp(l, 'config')).toContain('request through this entry')
+    }
+  })
+  it('anything actually observed keeps the mark vocabulary', () => {
+    expect(edgeHelp('selects', 'proved')).toBe(markHelp('proved'))
+    expect(edgeHelp('routes to', 'failed')).toBe(markHelp('failed'))
+  })
+})
+
+describe('the rest of the edge vocabulary', () => {
+  it('a collapsed sibling and an off-path backend say why, not "not tested"', () => {
+    expect(edgeHelp('also serves', 'config')).toContain('collapsed')
+    expect(edgeHelp('also serves', 'config')).not.toContain('not tested')
+    expect(edgeHelp('other host', 'excluded')).toContain('different host')
+  })
+  it("a line whose own label already says it does not say it twice", () => {
+    // origin edges are labelled with their evidence
+    expect(edgeHelpIsRedundant('not tested', '', 'untested')).toBe(true)
+    expect(edgeHelpIsRedundant('HTTP 404 · reached', '', 'proxied')).toBe(false)
+  })
+})

package/src/components/trace/reachMarks.ts

@@ -107,6 +107,50 @@ export function markHelp(m: Mark): string {
   return MARK_LEGEND.find((l) => l.mark === m)?.text ?? m
 }
 
+/**
+ * What a LINE means, when the generic mark help would mislead.
+ *
+ * Structural edges are drawn `config` because nothing was dialled along them -
+ * but "not tested" then invites the reader to ask why we didn't, and the honest
+ * answer differs per edge: ownership is not a traffic hop at all, a selector is
+ * read from the cluster rather than proven by a request, and declared routing
+ * can only be exercised by a request that actually goes through that entry.
+ * Saying "not tested" for all three trains the reader to expect a test that in
+ * two of the cases does not exist.
+ */
+export function edgeHelp(label: string, mark: Mark): string {
+  if (mark === 'config') {
+    switch (label.trim().toLowerCase()) {
+      case 'runs':
+        return 'ownership, not a traffic hop - the workload owns these Pods'
+      case 'selects':
+        return 'read from the cluster - which Pods this Service selects'
+      case 'routes to':
+      case 'sends to':
+        return 'declared routing - only a request through this entry exercises it'
+      case 'also serves':
+        return 'other backends this entry declares, collapsed here'
+    }
+  }
+  // Excluded-by-design, not a gap: this backend serves a different host, so no
+  // request for THIS path would ever go down it. "not sent any traffic" read as
+  // something we skipped.
+  if (mark === 'excluded' && label.trim().toLowerCase() === 'other host') {
+    return 'not part of this path - this backend serves a different host'
+  }
+  return markHelp(mark)
+}
+
+/** Whether a line's own words already say what its mark would say. An origin
+ *  edge is labelled with its evidence ("not tested"), so appending the mark help
+ *  ("not tested from here") repeated it back at the reader. */
+export function edgeHelpIsRedundant(title: string, label: string, mark: Mark): boolean {
+  const t = title.trim().toLowerCase()
+  if (!t) return false
+  const help = edgeHelp(label, mark).toLowerCase()
+  return help.startsWith(t) || t.startsWith(help)
+}
+
 /** Inline style for a mark glyph. */
 export function glyphStyle(m: Mark): React.CSSProperties {
   return { color: markStyle(m).color, fontWeight: 700, fontSize: '12px', lineHeight: 1.1, flex: 'none' }

package/src/components/trace/reachOrigins.ts

@@ -193,6 +193,18 @@ export function originSkipReason(trace: Trace | undefined, originId: OriginId, r
   return pick(allProbes(trace))
 }
 
+/**
+ * Why this origin's run was kept informational. A demotion applies to the RUN,
+ * not to one backend, so this is origin-scoped rather than route-scoped: the
+ * route-scoped lookup asks which declared path a skip speaks for, which is the
+ * wrong question when the whole run was demoted.
+ */
+export function originInformationalReason(trace: Trace | undefined, originId: OriginId): string | undefined {
+  return allProbes(trace).find(
+    (p) => p.skipped && p.skipClass === 'informational' && !!p.reason && originOf(p, trace?.runVantage) === originId,
+  )?.reason
+}
+
 /**
  * Builds the origin rail for a trace.
  *

package/src/components/trace/types.ts

@@ -254,6 +254,25 @@ export interface Trace {
    *  walking the hop chain. Absent when there is nothing to diagnose (every
    *  route verified over real traffic). */
   diagnosis?: Diagnosis
+  /** Faults on the DECLARED ENTRY POINTS (an Ingress or route that will never
+   *  receive traffic). Deliberately separate from `diagnosis`: entries are
+   *  parallel, so a dead front door must not condemn a Service that another
+   *  entry still serves - but a verdict scoped to the tested path cannot see it
+   *  either. Vantage-invariant; deduped against `diagnosis` by the producer. */
+  entryProblems?: EntryProblem[]
+}
+
+/** One declared entry point that cannot carry traffic, mirrors
+ *  internal/trace/trace.go EntryProblem. */
+export interface EntryProblem {
+  resource: ResourceRef
+  /** The human line; `detail` carries the raw controller cause for the hover. */
+  summary: string
+  detail?: string
+  severity: string
+  code?: string
+  action?: string
+  command?: string
 }
 
 /** Hoisted lead diagnosis, mirrors internal/trace/coverage.go Diagnosis. Every
@@ -262,6 +281,12 @@ export interface Trace {
  *  fingerprints (missing-ref / svc:*); a pod-state code is omitted and summary
  *  carries the honest prose instead. */
 export interface Diagnosis {
+  /** "fault" (something wrong, promoted from a finding) or "coverage" (a
+   *  statement about what could be tested). The problem list renders faults
+   *  only - a coverage sentence there restates the headline. */
+  class?: string
+  /** Severity of the finding this was promoted from. */
+  severity?: string
   causeCode?: string
   /** Which route this diagnosis explains, when attributable to exactly one.
    *  Absent means it describes the resource as a whole. The selected-path panel

package/src/components/ui/Badge.tsx

@@ -106,6 +106,25 @@ const KIND: Record<string, string> = {
   CiliumClusterwideNetworkPolicy:     'bg-indigo-100 text-indigo-800 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-300 dark:border-indigo-700/40',
   ClusterNetworkPolicy:               'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
 
+  // Kyverno. Policy kinds share the indigo family used by the other
+  // policy-shaped kinds above; the destructive ones (Deleting/Cleanup) and
+  // PolicyException take amber so they read as "changes or bypasses things".
+  Policy:                             'bg-indigo-100 text-indigo-800 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-300 dark:border-indigo-700/40',
+  ClusterPolicy:                      'bg-indigo-100 text-indigo-800 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-300 dark:border-indigo-700/40',
+  ValidatingPolicy:                   'bg-indigo-100 text-indigo-800 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-300 dark:border-indigo-700/40',
+  NamespacedValidatingPolicy:         'bg-indigo-100 text-indigo-800 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-300 dark:border-indigo-700/40',
+  ImageValidatingPolicy:              'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
+  NamespacedImageValidatingPolicy:    'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
+  MutatingPolicy:                     'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
+  NamespacedMutatingPolicy:           'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
+  GeneratingPolicy:                   'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
+  NamespacedGeneratingPolicy:         'bg-violet-100 text-violet-800 border-violet-300 dark:bg-violet-950/50 dark:text-violet-300 dark:border-violet-700/40',
+  DeletingPolicy:                     'bg-amber-100 text-amber-800 border-amber-300 dark:bg-amber-950/50 dark:text-amber-300 dark:border-amber-700/40',
+  NamespacedDeletingPolicy:           'bg-amber-100 text-amber-800 border-amber-300 dark:bg-amber-950/50 dark:text-amber-300 dark:border-amber-700/40',
+  PolicyException:                    'bg-amber-100 text-amber-800 border-amber-300 dark:bg-amber-950/50 dark:text-amber-300 dark:border-amber-700/40',
+  CleanupPolicy:                      'bg-amber-100 text-amber-800 border-amber-300 dark:bg-amber-950/50 dark:text-amber-300 dark:border-amber-700/40',
+  ClusterCleanupPolicy:               'bg-amber-100 text-amber-800 border-amber-300 dark:bg-amber-950/50 dark:text-amber-300 dark:border-amber-700/40',
+
   // Cluster-scoped
   Node:          'bg-sky-100 text-sky-700 border-sky-300 dark:bg-sky-950/50 dark:text-sky-400 dark:border-sky-700/40',
   Namespace:     'bg-gray-100 text-gray-700 border-gray-300 dark:bg-gray-950/50 dark:text-gray-400 dark:border-gray-700/40',
@@ -144,6 +163,14 @@ const KIND: Record<string, string> = {
   // Contour
   HTTPProxy:            'bg-violet-100 text-violet-700 border-violet-300 dark:bg-violet-950/50 dark:text-violet-400 dark:border-violet-700/40',
 
+  // CloudNativePG. Only Pooler is keyed here. getKindColorClass takes the kind
+  // string alone, and CNPG's other kinds arrive as bare `Cluster` / `Backup` /
+  // `ScheduledBackup`, which collide with CAPI and Velero — keying those would
+  // paint another operator's resource in Postgres colors, the exact collision
+  // class this integration fixes elsewhere. Coloring them needs the API group
+  // threaded through Badge; until then they take the default.
+  Pooler:               'bg-sky-100 text-sky-700 border-sky-300 dark:bg-sky-950/50 dark:text-sky-400 dark:border-sky-700/40',
+
   // Cluster API
   CAPICluster:          'bg-indigo-100 text-indigo-700 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-400 dark:border-indigo-700/40',
   MachineDeployment:    'bg-indigo-100 text-indigo-700 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-400 dark:border-indigo-700/40',
@@ -154,6 +181,15 @@ const KIND: Record<string, string> = {
   ClusterClass:         'bg-indigo-100 text-indigo-700 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-400 dark:border-indigo-700/40',
   MachineHealthCheck:   'bg-indigo-100 text-indigo-700 border-indigo-300 dark:bg-indigo-950/50 dark:text-indigo-400 dark:border-indigo-700/40',
 
+  // Velero. Only kinds whose names no other operator claims are mapped: this
+  // table is keyed on kind alone with no group awareness, so a shared name would
+  // paint a foreign resource in Velero's colour. That rules out `Backup` (CNPG),
+  // `Restore` (rancher/backup-restore-operator) and `Schedule` (several
+  // operators) — the same collisions the renderers guard on velero.io.
+  BackupStorageLocation:  'bg-teal-100 text-teal-800 border-teal-300 dark:bg-teal-950/50 dark:text-teal-400 dark:border-teal-700/40',
+  VolumeSnapshotLocation: 'bg-teal-100 text-teal-800 border-teal-300 dark:bg-teal-950/50 dark:text-teal-400 dark:border-teal-700/40',
+  BackupRepository:       'bg-teal-100 text-teal-800 border-teal-300 dark:bg-teal-950/50 dark:text-teal-400 dark:border-teal-700/40',
+
   // Events
   Event:                'bg-slate-100 text-slate-700 border-slate-300 dark:bg-slate-950/50 dark:text-slate-400 dark:border-slate-700/40',
 }

package/src/components/ui/ForceDeleteConfirmDialog.tsx

@@ -1,5 +1,5 @@
 import { useState, useMemo } from 'react'
-import { ChevronDown, ChevronRight, Loader2 } from 'lucide-react'
+import { AlertTriangle, ChevronDown, ChevronRight, Loader2 } from 'lucide-react'
 import { ConfirmDialog } from './ConfirmDialog'
 import { pluralize } from '../../utils/pluralize'
 
@@ -20,6 +20,7 @@ interface ForceDeleteConfirmDialogProps {
   isLoading: boolean
   cascadeDependents?: CascadeDependent[]
   cascadeLoading?: boolean
+  cascadeRootResolved?: boolean
 }
 
 export function ForceDeleteConfirmDialog({
@@ -32,6 +33,7 @@ export function ForceDeleteConfirmDialog({
   isLoading,
   cascadeDependents,
   cascadeLoading,
+  cascadeRootResolved,
 }: ForceDeleteConfirmDialogProps) {
   const [forceDelete, setForceDelete] = useState(false)
 
@@ -68,6 +70,15 @@ export function ForceDeleteConfirmDialog({
           <CascadeDependentsList dependents={cascadeDependents} />
         )}
 
+        {!cascadeLoading && cascadeRootResolved === false && (
+          <div className="flex items-start gap-2 rounded border border-theme-border bg-theme-elevated px-3 py-2 text-xs text-warning-text">
+            <AlertTriangle className="mt-0.5 h-3.5 w-3.5 shrink-0" />
+            <span>
+              Radar couldn&apos;t verify which dependent resources Kubernetes will also delete. Additional resources may be deleted but aren&apos;t shown here.
+            </span>
+          </div>
+        )}
+
         <label className="flex items-center gap-2 text-sm text-theme-text-secondary">
           <input
             type="checkbox"