@skyhook-io/k8s-ui 1.13.3 → 1.14.0

package/src/components/resources/renderers/CNPGClusterRenderer.test.tsx

@@ -39,9 +39,33 @@ describe('CNPGClusterRenderer — the drawer must not contradict the badge', ()
     expect(html(settled)).toContain('Degraded Cluster')
   })
 
-  it('still raises Cluster Down at zero ready, whatever the phase', () => {
-    // No phase excuses a database with nothing serving.
-    expect(html(cluster('Upgrading cluster', 0))).toContain('Cluster Down')
+  it('still raises Cluster Down for a was-up cluster at zero ready, whatever the phase', () => {
+    // No phase excuses a database that was serving and now has nothing ready.
+    // readyInstances is OMITTED — the shape CNPG actually emits for zero ready —
+    // and currentPrimary is the "was up" signal that tells this apart from a
+    // first bootstrap.
+    const wasUpDown = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      kind: 'Cluster',
+      metadata: { name: 'pg', namespace: 'db' },
+      spec: { instances: 3 },
+      status: { phase: 'Upgrading cluster', currentPrimary: 'pg-1' },
+    }
+    expect(html(wasUpDown)).toContain('Cluster Down')
+  })
+
+  it('does not raise Cluster Down for a bootstrapping cluster with no primary yet', () => {
+    // Reported (phase) but no primary elected and readyInstances omitted — the
+    // shape a fresh cluster emits. A red banner here is the false alarm the
+    // availability verdict exists to prevent.
+    const bootstrapping = {
+      apiVersion: 'postgresql.cnpg.io/v1',
+      kind: 'Cluster',
+      metadata: { name: 'pg', namespace: 'db' },
+      spec: { instances: 3 },
+      status: { phase: 'Setting up primary' },
+    }
+    expect(html(bootstrapping)).not.toContain('Cluster Down')
   })
 
   it('renders a failed last backup at the same tier as the badge and detector', () => {
@@ -116,3 +140,45 @@ describe('recovery points must be readable as ages, not raw machine timestamps',
     expect(html).toContain('2026-01-30 09:40:37 UTC')
   })
 })
+
+describe('CNPGClusterRenderer — the replica-cluster role tracks live state, not stanza presence', () => {
+  const withReplica = (replica: any, name = 'pg-eu') => ({
+    apiVersion: 'postgresql.cnpg.io/v1',
+    kind: 'Cluster',
+    metadata: { name, namespace: 'db' },
+    spec: { instances: 3, replica },
+    status: { phase: 'Cluster in healthy state', readyInstances: 3 },
+  })
+
+  it('shows the Replica Cluster section for a genuine replica (replica mode enabled)', () => {
+    const out = renderToString(<CNPGClusterRenderer data={withReplica({ source: 'pg-us', enabled: true })} />)
+    expect(out).toContain('Replica Cluster')
+    expect(out).toContain('Role')
+    expect(out).toContain('pg-us')
+  })
+
+  it('shows Replica for a distributed-topology cluster whose primary is elsewhere', () => {
+    const out = renderToString(
+      <CNPGClusterRenderer data={withReplica({ source: 'pg-us', primary: 'pg-us', self: 'pg-eu' })} />,
+    )
+    expect(out).toContain('Replica Cluster')
+  })
+
+  it('drops the Replica label once a distributed replica is promoted, though the stanza remains', () => {
+    // Promotion sets replica.primary to this cluster; the stanza is not removed.
+    const out = renderToString(
+      <CNPGClusterRenderer data={withReplica({ source: 'pg-us', primary: 'pg-eu', self: 'pg-eu' })} />,
+    )
+    expect(out).not.toContain('Replica Cluster')
+  })
+
+  it('drops the Replica label once a standalone replica is promoted (replica.enabled off)', () => {
+    const out = renderToString(<CNPGClusterRenderer data={withReplica({ source: 'pg-us', enabled: false })} />)
+    expect(out).not.toContain('Replica Cluster')
+  })
+
+  it('a normal standalone cluster shows no Replica Cluster section', () => {
+    const out = renderToString(<CNPGClusterRenderer data={cluster('Cluster in healthy state', 3)} />)
+    expect(out).not.toContain('Replica Cluster')
+  })
+})

package/src/components/resources/renderers/CNPGClusterRenderer.tsx

@@ -23,6 +23,7 @@ import {
   getCNPGWALArchivingFailure,
   getCNPGLastBackupFailure,
   classifyCNPGClusterPhase,
+  getCNPGClusterAvailability,
   CNPG_BARMAN_OBJECTSTORE_GROUP,
 } from '../resource-utils-cnpg'
 import { formatAge } from '../resource-utils'
@@ -79,8 +80,11 @@ export function CNPGClusterRenderer({ data, onNavigate, declared}: CNPGClusterRe
   const lastBackupFailure = getCNPGLastBackupFailure(data)
   const phaseBucket = classifyCNPGClusterPhase(phase)
 
-  // Problem detection
-  const isDown = countsKnown && readyInstances === 0
+  // Problem detection. isDown reuses the badge's availability verdict so the
+  // three surfaces agree: a fully-down cluster CNPG reports by omitting
+  // readyInstances (countsKnown false) is unreachable through the raw counts,
+  // and hibernation / all-fenced are deliberate not-serving states, not outages.
+  const isDown = getCNPGClusterAvailability(data) === 'down'
   // A shortfall the PHASE already explains is not a separate problem. Mirrors
   // source_cnpg.go's phaseExplained gate and the badge's ordering, both of
   // which check the phase before the instance counts: mid-switchover or waiting

package/src/components/resources/renderers/EventRenderer.test.tsx

@@ -1,7 +1,23 @@
 import { renderToString } from 'react-dom/server'
-import { describe, expect, it } from 'vitest'
+import type { ReactElement, ReactNode } from 'react'
+import { afterEach, describe, expect, it, vi } from 'vitest'
 
 import { EventRenderer } from './EventRenderer'
+import { initNavigationMap, resetNavigationMap } from '../../../utils/navigation'
+
+afterEach(resetNavigationMap)
+
+function findButton(node: ReactNode): ReactElement<{ onClick: () => void }> | undefined {
+  if (!node || typeof node !== 'object' || !('props' in node)) return undefined
+  const element = node as ReactElement<{ children?: ReactNode; onClick?: () => void }>
+  if (element.type === 'button') return element as ReactElement<{ onClick: () => void }>
+  const children = element.props.children
+  for (const child of Array.isArray(children) ? children : [children]) {
+    const button = findButton(child)
+    if (button) return button
+  }
+  return undefined
+}
 
 describe('EventRenderer', () => {
   it.each([
@@ -20,4 +36,37 @@ describe('EventRenderer', () => {
     expect(html).not.toMatch(/text-(?:amber|blue)-(?:200|300|400)/)
     expect(html).not.toContain('opacity-')
   })
+
+  it('navigates to the group-qualified native PodGroup resource', () => {
+    initNavigationMap([{
+      group: 'scheduling.k8s.io',
+      version: 'v1beta1',
+      kind: 'PodGroup',
+      name: 'podgroups',
+      namespaced: true,
+      isCrd: false,
+      verbs: ['get', 'list'],
+    }])
+    const onNavigate = vi.fn()
+    const tree = EventRenderer({
+      data: {
+        involvedObject: {
+          apiVersion: 'scheduling.k8s.io/v1beta1',
+          kind: 'PodGroup',
+          namespace: 'default',
+          name: 'batch',
+        },
+      },
+      onNavigate,
+    })
+
+    findButton(tree)?.props.onClick()
+
+    expect(onNavigate).toHaveBeenCalledWith({
+      kind: 'podgroups',
+      namespace: 'default',
+      name: 'batch',
+      group: 'scheduling.k8s.io',
+    })
+  })
 })

package/src/components/resources/renderers/EventRenderer.tsx

@@ -4,7 +4,7 @@ import { Badge } from '../../ui/Badge'
 import { Section, PropertyList, Property } from '../../ui/drawer-components'
 import { formatAge } from '../resource-utils'
 import type { NavigateToResource } from '../../../utils/navigation'
-import { kindToPlural } from '../../../utils/navigation'
+import { apiVersionToGroup, kindToPluralWithGroup } from '../../../utils/navigation'
 
 interface EventRendererProps {
   data: any
@@ -75,11 +75,9 @@ export function EventRenderer({ data, onNavigate }: EventRendererProps) {
               {onNavigate ? (
                 <button
                   onClick={() => {
-                    // Parse API group from apiVersion (format: "group/version" or "v1" for core)
-                    const apiVersion = involvedObject.apiVersion || ''
-                    const group = apiVersion.includes('/') ? apiVersion.split('/')[0] : undefined
+                    const group = apiVersionToGroup(involvedObject.apiVersion) || undefined
                     onNavigate({
-                      kind: kindToPlural(involvedObject.kind),
+                      kind: kindToPluralWithGroup(involvedObject.kind, group ?? ''),
                       namespace: involvedObject.namespace || '',
                       name: involvedObject.name,
                       group,

package/src/components/resources/renderers/GenericRenderer.tsx

@@ -2,6 +2,8 @@ import { useState } from 'react'
 import { Info, CheckCircle, XCircle, AlertCircle, ChevronRight, ChevronDown, FileCode, AlertTriangle, Layers } from 'lucide-react'
 import { clsx } from 'clsx'
 import { Section, PropertyList, Property } from '../../ui/drawer-components'
+import { getGenericResourceStatus } from '../generic-status'
+import type { HealthLevel } from '../resource-utils'
 
 interface GenericRendererProps {
   data: any
@@ -13,7 +15,7 @@ export function GenericRenderer({ data }: GenericRendererProps) {
   const conditions = status.conditions
 
   // Determine health status from conditions or status fields
-  const healthStatus = getHealthStatus(status, conditions)
+  const healthStatus = getHealthStatus(data)
 
   // Extract important fields from spec and status
   const statusFields = getImportantFields(status, 'status')
@@ -138,89 +140,22 @@ interface HealthStatusResult {
   message?: string
 }
 
-function getHealthStatus(status: any, conditions?: any[]): HealthStatusResult | null {
-  if (!status) return null
-
-  // Check phase first (common pattern)
-  if (status.phase) {
-    const phase = String(status.phase)
-    const healthyPhases = ['Running', 'Active', 'Succeeded', 'Ready', 'Healthy', 'Available', 'Bound', 'Complete']
-    const degradedPhases = ['Pending', 'Progressing', 'Unknown', 'Terminating', 'Waiting']
-    const unhealthyPhases = ['Failed', 'Error', 'CrashLoopBackOff', 'ImagePullBackOff', 'ErrImagePull']
-
-    if (healthyPhases.includes(phase)) {
-      return { type: 'healthy', label: phase }
-    }
-    if (degradedPhases.includes(phase)) {
-      return { type: 'degraded', label: phase, message: status.message || status.reason }
-    }
-    if (unhealthyPhases.includes(phase)) {
-      return { type: 'unhealthy', label: phase, message: status.message || status.reason }
-    }
-  }
-
-  // Check conditions
-  if (conditions && Array.isArray(conditions) && conditions.length > 0) {
-    // Look for Ready or Available condition
-    const readyCondition = conditions.find((c: any) =>
-      c.type === 'Ready' || c.type === 'Available' || c.type === 'Healthy'
-    )
-    if (readyCondition) {
-      if (readyCondition.status === 'True') {
-        return { type: 'healthy', label: 'Ready' }
-      }
-      if (readyCondition.status === 'False') {
-        return {
-          type: 'unhealthy',
-          label: 'Not Ready',
-          message: readyCondition.message || readyCondition.reason
-        }
-      }
-    }
-
-    // Check for any False conditions that indicate problems
-    const problemConditions = conditions.filter((c: any) =>
-      c.status === 'False' && ['Ready', 'Available', 'Healthy', 'Initialized'].includes(c.type)
-    )
-    if (problemConditions.length > 0) {
-      const problem = problemConditions[0]
-      return {
-        type: 'unhealthy',
-        label: `${problem.type}: False`,
-        message: problem.message || problem.reason
-      }
-    }
-
-    // Check for warning conditions
-    const warningConditions = conditions.filter((c: any) =>
-      c.status === 'True' && ['Degraded', 'Warning', 'ScalingLimited'].includes(c.type)
-    )
-    if (warningConditions.length > 0) {
-      const warning = warningConditions[0]
-      return {
-        type: 'degraded',
-        label: warning.type,
-        message: warning.message || warning.reason
-      }
-    }
-  }
-
-  // Check replica-based status
-  if (status.replicas !== undefined) {
-    const desired = status.replicas
-    const ready = status.readyReplicas || status.availableReplicas || 0
-    if (desired > 0 && ready >= desired) {
-      return { type: 'healthy', label: `${ready}/${desired} Ready` }
-    }
-    if (desired > 0 && ready > 0) {
-      return { type: 'degraded', label: `${ready}/${desired} Ready` }
-    }
-    if (desired > 0 && ready === 0) {
-      return { type: 'unhealthy', label: `0/${desired} Ready` }
-    }
-  }
+// This renderer's banner has four tones, while the shared derivation speaks the
+// full HealthLevel vocabulary. `alert` folds into unhealthy and `neutral` into
+// unknown — the banner has no distinct treatment for either.
+const BANNER_TYPE: Record<HealthLevel, HealthType> = {
+  healthy: 'healthy',
+  degraded: 'degraded',
+  alert: 'unhealthy',
+  unhealthy: 'unhealthy',
+  neutral: 'unknown',
+  unknown: 'unknown',
+}
 
-  return null
+function getHealthStatus(resource: any): HealthStatusResult | null {
+  const derived = getGenericResourceStatus(resource)
+  if (!derived) return null
+  return { type: BANNER_TYPE[derived.tone], label: derived.text, message: derived.reason }
 }
 
 // ============================================================================

package/src/components/resources/renderers/HPARenderer.test.tsx

@@ -88,4 +88,32 @@ describe('HPARenderer', () => {
     expect(html).toContain('TooManyReplicas')
     expect(html).not.toContain('the desired replica count is more than the maximum replica count')
   })
+
+  it('preserves minReplicas zero and renders ScaledToZero as neutral evidence', () => {
+    const html = renderToString(
+      <HPARenderer
+        data={{
+          ...baseHPA,
+          spec: { ...baseHPA.spec, minReplicas: 0 },
+          status: {
+            currentReplicas: 0,
+            desiredReplicas: 0,
+            conditions: [
+              {
+                type: 'ScaledToZero',
+                status: 'True',
+                reason: 'SucceededRescale',
+                message: 'the HPA controller scaled the target to zero',
+              },
+            ],
+          },
+        }}
+      />,
+    )
+
+    expect(html).toMatch(/>Min<\/span><span[^>]*>0<\/span>/)
+    expect(html).toContain('ScaledToZero')
+    expect(html).toContain('bg-gray-400/20')
+    expect(html).not.toContain('failing')
+  })
 })

package/src/components/resources/renderers/HPARenderer.tsx

@@ -34,6 +34,11 @@ function hpaBadgeSeverity(state: HPADiagnosisState): BadgeSeverity {
 }
 
 function hpaConditionTone(condition: any): ConditionTone | undefined {
+  if (condition?.type === 'ScaledToZero') {
+    if (condition.status === 'False') return 'ok'
+    if (condition.status === 'True') return 'unknown'
+    return 'unknown'
+  }
   if (condition?.type !== 'ScalingLimited') return undefined
   if (condition.status === 'False') return 'ok'
   if (condition.status !== 'True') return 'unknown'
@@ -109,7 +114,7 @@ export function HPARenderer({ data, onNavigate, hpaDiagnosis, extraSections }: H
           } />
           <Property label="Current" value={status.currentReplicas} />
           <Property label="Desired" value={status.desiredReplicas} />
-          <Property label="Min" value={spec.minReplicas || 1} />
+          <Property label="Min" value={spec.minReplicas ?? 1} />
           <Property label="Max" value={spec.maxReplicas} />
           {status.lastScaleTime && <Property label="Last Scale" value={formatAge(status.lastScaleTime)} />}
         </PropertyList>

package/src/components/resources/renderers/KyvernoPolicyReportRenderer.tsx

@@ -8,7 +8,8 @@ import {
   getPolicyReportResults,
   getPolicyReportScope,
   getPolicyReportSource,
-  getKyvernoPolicyAction,
+  getKyvernoEnforcement,
+  getKyvernoPolicyAdmission,
   getKyvernoPolicyRuleCount,
   getKyvernoPolicyBackground,
   getKyvernoPolicyRules,
@@ -246,15 +247,14 @@ export function KyvernoPolicyRenderer({ data, coverage, queued }: KyvernoPolicyR
   const spec = data.spec || {}
   const status = data.status || {}
   const conditions = status.conditions || []
-  const action = getKyvernoPolicyAction(data)
+  const enforcement = getKyvernoEnforcement(data)
+  const admission = getKyvernoPolicyAdmission(data)
   const ruleCount = getKyvernoPolicyRuleCount(data)
   const background = getKyvernoPolicyBackground(data)
   const rules = getKyvernoPolicyRules(data)
   const ruleCountByType = getKyvernoPolicyRuleCountByType(data)
   const autogenRules = getKyvernoPolicyAutogenRules(data)
 
-  const isEnforce = action === 'Enforce'
-
   return (
     <>
       {coverage}
@@ -269,15 +269,20 @@ export function KyvernoPolicyRenderer({ data, coverage, queued }: KyvernoPolicyR
               writing to the cluster. status.rulecount is Kyverno's own count,
               so this is checkable rather than guessed. */}
           {(ruleCountByType.validate > 0 || ruleCountByType.verifyImages > 0) && (
-          <Property label="Failure Action" value={
+          <Property label="Enforcement" value={
             <span className={clsx(
               'badge',
-              isEnforce ? 'bg-red-500/20 text-red-400' : 'bg-yellow-500/20 text-yellow-400',
+              enforcement.blocks
+                ? 'bg-red-500/20 text-red-400'
+                : enforcement.discrepancy
+                  ? 'bg-orange-500/20 text-orange-400'
+                  : 'bg-yellow-500/20 text-yellow-400',
             )}>
-              {action}
+              {enforcement.label}
             </span>
           } />
           )}
+          <Property label="Admission" value={admission ? 'Enabled' : 'Disabled'} />
           <Property label="Background" value={background ? 'Enabled' : 'Disabled'} />
           {spec.webhookTimeoutSeconds && (
             <Property label="Webhook Timeout" value={`${spec.webhookTimeoutSeconds}s`} />

package/src/components/resources/renderers/MetricsUnavailableNotice.tsx

@@ -21,7 +21,8 @@ export function MetricsUnavailableNotice({ rawError, diagnosis }: MetricsUnavail
                   This panel uses Kubernetes metrics.k8s.io for live CPU and memory; Prometheus data does not fill it.
                 </span>
                 <span className="block">
-                  {diagnosis || 'Check that metrics-server is installed and healthy, and that the v1beta1.metrics.k8s.io APIService is Available.'}
+                  {diagnosis ||
+                    "Check that metrics-server is installed and healthy, and that its metrics.k8s.io APIService is Available."}
                 </span>
                 <span className="block">
                   Raw error: <span className="font-mono break-words">{rawError}</span>

package/src/components/resources/renderers/PVCRenderer.test.tsx

@@ -20,4 +20,48 @@ describe('PVCRenderer', () => {
     expect(html).not.toContain('This is normal')
     expect(html).not.toContain('expected indefinitely')
   })
+
+  it('surfaces an unused claim as informational cleanup evidence', () => {
+    const html = renderToString(
+      <PVCRenderer
+        data={{
+          metadata: { name: 'archive', namespace: 'demo' },
+          status: {
+            phase: 'Bound',
+            conditions: [
+              {
+                type: 'Unused',
+                status: 'True',
+                lastTransitionTime: '2026-08-28T12:00:00Z',
+              },
+            ],
+          },
+        }}
+      />,
+    )
+
+    expect(html).toContain('Unused for about')
+    expect(html).toContain('No non-terminal Pod currently references this claim')
+    expect(html).toContain('Verify its retention policy and data ownership')
+    expect(html).toContain('bg-gray-400/20')
+    expect(html).not.toContain('failing')
+    expect(html).not.toContain('bg-emerald-500/20')
+  })
+
+  it('does not show cleanup guidance while Unused is false or absent', () => {
+    for (const conditions of [
+      [{ type: 'Unused', status: 'False' }],
+      undefined,
+    ]) {
+      const html = renderToString(
+        <PVCRenderer
+          data={{
+            metadata: { name: 'active', namespace: 'demo' },
+            status: { phase: 'Bound', conditions },
+          }}
+        />,
+      )
+      expect(html).not.toContain('No non-terminal Pod currently references this claim')
+    }
+  })
 })

package/src/components/resources/renderers/PVCRenderer.tsx

@@ -1,7 +1,8 @@
 import type { ReactNode } from 'react'
 import { HardDrive } from 'lucide-react'
 import { clsx } from 'clsx'
-import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink, useOperationalIssuesShown} from '../../ui/drawer-components'
+import { Section, PropertyList, Property, ConditionsSection, AlertBanner, ResourceLink, useOperationalIssuesShown, type ConditionTone } from '../../ui/drawer-components'
+import { formatAge } from '../resource-utils'
 
 interface PVCRendererProps {
   data: any
@@ -22,6 +23,11 @@ function formatAccessModes(modes: string[] | undefined): string | undefined {
   return modes.map(m => accessModeShorthand[m] || m).join(', ')
 }
 
+function pvcConditionTone(condition: any): ConditionTone | undefined {
+  if (condition?.type !== 'Unused') return undefined
+  return condition.status === 'True' ? 'unknown' : condition.status === 'False' ? 'ok' : 'unknown'
+}
+
 export function PVCRenderer({ data, onNavigate, extraSections }: PVCRendererProps) {
   const status = data.status || {}
   const spec = data.spec || {}
@@ -39,6 +45,9 @@ export function PVCRenderer({ data, onNavigate, extraSections }: PVCRendererProp
   const bindCompleted = annotations['pv.kubernetes.io/bind-completed']
   const hasProvisionerInfo = provisioner || selectedNode || bindCompleted
   const operationalIssuesShown = useOperationalIssuesShown()
+  const unused = Array.isArray(status.conditions)
+    ? status.conditions.find((condition: any) => condition?.type === 'Unused' && condition.status === 'True')
+    : undefined
 
   return (
     <>
@@ -59,6 +68,14 @@ export function PVCRenderer({ data, onNavigate, extraSections }: PVCRendererProp
         />
       )}
 
+      {unused && (
+        <AlertBanner
+          variant="info"
+          title={unused.lastTransitionTime ? `Unused for about ${formatAge(unused.lastTransitionTime)}` : 'Unused'}
+          message="No non-terminal Pod currently references this claim. Verify its retention policy and data ownership before deleting it."
+        />
+      )}
+
       <Section title="Status" icon={HardDrive}>
         <PropertyList>
           <Property
@@ -98,7 +115,7 @@ export function PVCRenderer({ data, onNavigate, extraSections }: PVCRendererProp
 
       {extraSections}
 
-      <ConditionsSection conditions={status.conditions} />
+      <ConditionsSection conditions={status.conditions} getConditionTone={pvcConditionTone} />
     </>
   )
 }

package/src/components/resources/renderers/PolicyCoverageSection.test.tsx

@@ -4,7 +4,7 @@ import { PolicyCoverageSection } from './PolicyCoverageSection'
 import type { PolicyCoverageResponse, PolicyCoverageRule, PolicyCoverageSubject } from '../../../types/policy'
 
 const vpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'ValidatingPolicy', spec })
-const mpol = () => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec: {} })
+const mpol = (spec: any = {}) => ({ apiVersion: 'policies.kyverno.io/v1', kind: 'MutatingPolicy', spec })
 const legacy = (spec: any) => ({ apiVersion: 'kyverno.io/v1', kind: 'ClusterPolicy', spec })
 
 const counts = (c: Partial<PolicyCoverageResponse['counts']> = {}) =>
@@ -82,6 +82,97 @@ describe('what the section says a policy did', () => {
     expect(html).not.toContain('Generated')
   })
 
+  // A legacy Enforce policy with `spec.admission: false` is left out of the
+  // admission webhook, so it rejects nothing — the consequence sentence must not
+  // promise a rejection it cannot make.
+  it('does not promise rejection when admission evaluation is disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ validationFailureAction: 'Enforce', admission: false,
+        rules: [{ name: 'r', validate: { pattern: {} } }] }),
+    )
+    expect(html).toContain('Nothing is rejected today')
+    expect(html).not.toContain('will be rejected')
+  })
+
+  // The policy already declares Enforce, so the remediation is to re-enable
+  // admission — not to "switch this policy to block", which would point at the
+  // wrong knob.
+  it('names admission, not the action, as the reason nothing is rejected', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      legacy({ validationFailureAction: 'Enforce', admission: false,
+        rules: [{ name: 'r', validate: { pattern: {} } }] }),
+    )
+    expect(html).toContain('admission is disabled for this policy')
+    expect(html).toContain('Enabling admission would reject the next update')
+    expect(html).not.toContain('Switching this policy to block')
+  })
+
+  // The modern CEL family reaches the same non-blocking state via
+  // `spec.evaluation.admission.enabled: false`, and the shared sentence must be
+  // honest there too.
+  it('names admission for a modern Deny policy with admission disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      vpol({ validationActions: ['Deny'], evaluation: { admission: { enabled: false } } }),
+    )
+    expect(html).toContain('admission is disabled for this policy')
+    expect(html).not.toContain('Switching this policy to block')
+  })
+
+  // A JSON-mode policy is evaluated against payloads outside the cluster and
+  // never joins admission. Both phrasings would be false: it rejects nothing
+  // today, and neither switching the action nor enabling admission changes
+  // that. The sentence is withheld rather than guessed at.
+  it('states no admission consequence for a JSON-mode policy', () => {
+    const failing = coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+      rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] })
+
+    const admissionOff = render(failing, vpol({
+      validationActions: ['Deny'],
+      evaluation: { mode: 'JSON', admission: { enabled: false } },
+    }))
+    expect(admissionOff).not.toContain('admission is disabled for this policy')
+    expect(admissionOff).not.toContain('Switching this policy to block')
+
+    // Same for JSON mode with admission left at its default.
+    const admissionDefault = render(failing, vpol({
+      validationActions: ['Deny'],
+      evaluation: { mode: 'JSON' },
+    }))
+    expect(admissionDefault).not.toContain('Switching this policy to block')
+    expect(admissionDefault).not.toContain('will be rejected')
+  })
+
+  // `getKyvernoValidationActions` applies Kyverno's absent-means-Deny default,
+  // which is right for the validating families and wrong for every other kind.
+  // A mutating policy with admission off must not be described as a policy that
+  // would reject once admission is re-enabled.
+  it('does not read a Deny default off a mutating policy with admission disabled', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      mpol({ evaluation: { admission: { enabled: false } } }),
+    )
+    expect(html).not.toContain('admission is disabled for this policy')
+  })
+
+  // An Audit policy genuinely never blocks, so its remediation IS to switch the
+  // action — the admission-off wording must not leak onto it.
+  it('still offers to switch the action for an audit policy', () => {
+    const html = render(
+      coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),
+        rules: [rule({ counts: counts({ fail: 2 }), subjects: [subject('a', 'fail')], total: 2 })] }),
+      vpol({ validationActions: ['Audit'] }),
+    )
+    expect(html).toContain('Switching this policy to block')
+    expect(html).not.toContain('admission is disabled')
+  })
+
   it('withholds the consequence when the policy’s rules disagree on blocking', () => {
     const html = render(
       coverage({ examined: 2, subjects: 2, subjectsFailing: 2, counts: counts({ fail: 2 }),