@skyhook-io/k8s-ui 1.14.1 → 1.14.3

package/src/components/resources/ResourcesView.tsx

@@ -110,6 +110,7 @@ import {
   getGatewayClassController,
   getGatewayClassDescription,
   getRouteStatus,
+  getRouteStatusReason,
   getRouteParents,
   getRouteHostnames,
   getRouteBackends,
@@ -566,7 +567,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-40' },
-    { key: 'desired', label: 'Desired', width: 'w-20', tooltip: 'Number of nodes that should run the daemon pod (based on node selector)' },
+    { key: 'desired', label: 'Desired', width: 'w-20', tooltip: 'Nodes eligible for this daemon after node selectors, required node affinity and taints/tolerations are applied' },
     { key: 'ready', label: 'Ready', width: 'w-20', tooltip: 'Number of pods that are ready (passing readiness probes)' },
     { key: 'upToDate', label: 'Up-to-date', width: 'w-32', tooltip: 'Number of pods running the current pod template spec' },
     { key: 'available', label: 'Available', width: 'w-28', tooltip: 'Number of pods available (ready for minReadySeconds duration)' },
@@ -578,7 +579,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-40' },
     { key: 'ready', label: 'Ready', width: 'w-24', tooltip: 'Ready pods / Desired replicas' },
-    { key: 'upToDate', label: 'Up-to-date', width: 'w-32', tooltip: 'Number of pods running the current pod template' },
+    { key: 'upToDate', label: 'Up-to-date', width: 'w-32', tooltip: 'Pods running the current pod template; a rolling-update partition or OnDelete strategy can intentionally leave pods on an older template' },
     { key: 'images', label: 'Images', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -587,7 +588,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'ready', label: 'Ready', width: 'w-24' },
     { key: 'owner', label: 'Owner', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: 'Active means desired replicas are greater than zero; Old means desired replicas are zero, regardless of Deployment revision' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   services: [
@@ -623,7 +624,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   nodes: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-44' },
-    { key: 'roles', label: 'Roles', width: 'w-28' },
+    { key: 'roles', label: 'Roles', width: 'w-28', tooltip: 'Node roles from node-role.kubernetes.io/* labels. A node with no role label shows as worker.' },
     { key: 'cpu', label: 'CPU', width: 'w-40', tooltip: 'Current CPU usage / allocatable' },
     { key: 'memory', label: 'Memory', width: 'w-40', tooltip: 'Current memory usage / allocatable' },
     { key: 'pods', label: 'Pods', width: 'w-28', tooltip: 'Pods running / allocatable' },
@@ -637,7 +638,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'keys', label: 'Keys', width: 'w-48' },
-    { key: 'size', label: 'Size', width: 'w-24' },
+    { key: 'size', label: 'Size', width: 'w-24', tooltip: 'Estimated size of data values, including decoded binary data. Kubernetes rejects ConfigMaps whose combined data exceeds 1 MiB.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   secrets: [
@@ -645,7 +646,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'type', label: 'Type', width: 'w-28' },
     { key: 'keys', label: 'Keys', width: 'w-20' },
-    { key: 'expires', label: 'Expires', width: 'w-24', tooltip: 'Certificate expiry for TLS secrets' },
+    { key: 'expires', label: 'Expires', width: 'w-24', tooltip: "Days until the certificate in a TLS Secret expires. Blank for Secrets carrying no readable TLS certificate; ! means the expiry lookup itself failed." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   jobs: [
@@ -659,7 +660,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   cronjobs: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'schedule', label: 'Schedule', width: 'w-40' },
+    { key: 'schedule', label: 'Schedule', width: 'w-40', tooltip: "Cron schedule; fires in spec.timeZone when set, otherwise the controller's zone" },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'lastRun', label: 'Last Run', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -685,10 +686,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   persistentvolumeclaims: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: 'With WaitForFirstConsumer, Pending can mean no pod has triggered binding yet. If a pod is waiting, check PVC events.' },
     { key: 'capacity', label: 'Capacity', width: 'w-24' },
     { key: 'storageClass', label: 'Storage Class', width: 'w-40' },
-    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'Access modes: RWO=ReadWriteOnce, RWX=ReadWriteMany, ROX=ReadOnlyMany' },
+    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'RWO=ReadWriteOnce (one node, possibly several pods), ROX=ReadOnlyMany (read-only on many nodes), RWX=ReadWriteMany (read-write on many nodes), RWOP=ReadWriteOncePod (one pod only)' },
     { key: 'volume', label: 'Volume', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -715,7 +716,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Phase', width: 'w-28' },
     { key: 'duration', label: 'Duration', width: 'w-24' },
-    { key: 'progress', label: 'Progress', width: 'w-24', tooltip: 'Succeeded steps / Total steps' },
+    { key: 'progress', label: 'Progress', width: 'w-24', tooltip: 'Completed tasks / currently known total; the total can grow during execution, and completion does not imply success' },
     { key: 'template', label: 'Template', width: 'w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -733,16 +734,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Ready', width: 'w-24' },
     { key: 'domains', label: 'Domains', width: 'w-56' },
-    { key: 'issuer', label: 'Issuer', width: 'w-36' },
+    { key: 'issuer', label: 'Issuer', width: 'w-36', tooltip: "Issuer name alone may be ambiguous. Check the certificate's issuer reference for its kind and API group." },
     { key: 'expires', label: 'Expires', width: 'w-24', tooltip: 'Days until certificate expires' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   persistentvolumes: [
     { key: 'name', label: 'Name' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: "Released means the claim is gone but the volume still holds the previous claimant's data, so it will not be re-bound — check Reclaim before reusing it." },
     { key: 'capacity', label: 'Capacity', width: 'w-24' },
-    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'RWO=ReadWriteOnce, ROX=ReadOnlyMany, RWX=ReadWriteMany' },
-    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20' },
+    { key: 'accessModes', label: 'Access', width: 'w-20', tooltip: 'RWO=ReadWriteOnce (one node, possibly several pods), ROX=ReadOnlyMany (read-only on many nodes), RWX=ReadWriteMany (read-write on many nodes), RWOP=ReadWriteOncePod (one pod only)' },
+    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20', tooltip: 'When the claim is deleted, Delete removes the backing storage and its data; Retain leaves it for manual reclamation.' },
     { key: 'storageClass', label: 'Storage Class', width: 'w-40' },
     { key: 'claim', label: 'Claim', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -750,8 +751,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   storageclasses: [
     { key: 'name', label: 'Name' },
     { key: 'provisioner', label: 'Provisioner', width: 'w-48' },
-    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20' },
-    { key: 'bindingMode', label: 'Binding Mode', width: 'w-36' },
+    { key: 'reclaimPolicy', label: 'Reclaim', width: 'w-20', tooltip: 'Default policy for volumes this class provisions — Delete removes the backing storage when the claim goes away; Retain leaves it for manual reclamation.' },
+    { key: 'bindingMode', label: 'Binding Mode', width: 'w-36', tooltip: "When the volume is provisioned — WaitForFirstConsumer waits for a pod so the disk lands in the right zone; Immediate provisions before the pod's placement is known, which can leave the pod unschedulable." },
     { key: 'expansion', label: 'Expansion', width: 'w-24', tooltip: 'Whether volumes can be expanded after creation' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -779,7 +780,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   orders: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'state', label: 'State', width: 'w-24' },
+    { key: 'state', label: 'State', width: 'w-24', tooltip: 'Valid means ACME issuance finished; it does not confirm the TLS Secret is ready. If Pending persists, inspect the challenges and the order reason.' },
     { key: 'domains', label: 'Domains', width: 'w-48' },
     { key: 'issuer', label: 'Issuer', width: 'w-36' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -788,25 +789,27 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'challengeType', label: 'Type', width: 'w-20' },
-    { key: 'state', label: 'State', width: 'w-24' },
+    { key: 'state', label: 'State', width: 'w-24', tooltip: 'Valid means domain authorization succeeded. If Pending persists, inspect the reason for scheduling, solver, or propagation problems.' },
     { key: 'domain', label: 'Domain', width: 'w-48' },
-    { key: 'presented', label: 'Presented', width: 'w-24' },
+    { key: 'presented', label: 'Presented', width: 'w-24', tooltip: 'While Pending, Yes means the solver presented the token, not that it is reachable. Check the reason for propagation failures; No can also mean queued.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   gateways: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: "Programmed = the controller reports configuration should take effect soon; traffic has not been tested. Accepted = the controller accepted this Gateway but has not reported Programmed. If it stays Accepted, check the Gateway's conditions and addresses." },
     { key: 'class', label: 'Class', width: 'w-36' },
     { key: 'listeners', label: 'Listeners', width: 'w-40', tooltip: 'Protocol:Port for each listener' },
-    { key: 'routes', label: 'Routes', width: 'w-20', tooltip: 'Total attached routes across all listeners' },
+    // attachedRoutes is reported per listener, so a route attached to several
+    // listeners is counted once for each — the total is not a route count.
+    { key: 'routes', label: 'Routes', width: 'w-20', tooltip: "Sum of route counts reported by listeners; one route can count more than once. If 0 is unexpected, check the routes' Gateway names, listener permissions, and controller status." },
     { key: 'addresses', label: 'Addresses', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   httproutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
     { key: 'hostnames', label: 'Hostnames', width: 'w-48' },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
@@ -818,7 +821,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'servers', label: 'Servers', width: 'w-24' },
-    { key: 'selector', label: 'Selector', width: 'w-56' },
+    { key: 'selector', label: 'Selector', width: 'w-56', tooltip: "Selects gateway workloads that receive this configuration. An omitted selector applies to all workloads in Istio's selection scope; it does not mean none." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   gatewayclasses: [
@@ -832,14 +835,13 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'nodeClass', label: 'Node Class', width: 'w-36' },
-    { key: 'limits', label: 'Limits', width: 'w-36', tooltip: 'CPU and memory limits' },
-    { key: 'disruption', label: 'Disruption', width: 'w-40' },
+    { key: 'limits', label: 'Limits', width: 'w-36', tooltip: 'Configured provisioning ceilings — not what the pool has provisioned. Concurrent provisioning can exceed them during rapid scale-out, and a limit does not remove nodes already running.' },
+    { key: 'disruption', label: 'Disruption', width: 'w-40', tooltip: 'Which nodes Karpenter may consolidate; budgets and timing controls can still prevent removal or replacement' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nodeclaims: [
     { key: 'name', label: 'Name' },
-    { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-24', tooltip: 'Launched means a cloud instance exists; Registered means it has joined Kubernetes; Ready means the node is fully initialized' },
     { key: 'instanceType', label: 'Instance Type', width: 'w-32' },
     { key: 'capacityType', label: 'Capacity', width: 'w-24', tooltip: 'Spot or On-Demand' },
     { key: 'zone', label: 'Zone', width: 'w-28' },
@@ -868,7 +870,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Allocated + reserved, allocated-but-unreserved, or pending' },
-    { key: 'deviceClass', label: 'Device Class', width: 'w-44' },
+    { key: 'deviceClass', label: 'Device Class', width: 'w-44', tooltip: 'DeviceClasses whose selectors constrain eligible devices. A request may list alternative classes; this column does not show which alternative was allocated.' },
     { key: 'allocated', label: 'Allocated Driver', width: 'w-44' },
     { key: 'reservedFor', label: 'Reserved For', width: 'w-44' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -881,37 +883,39 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ],
   deviceclasses: [
     { key: 'name', label: 'Name' },
-    { key: 'selectors', label: 'Selectors', width: 'w-28', tooltip: 'CEL device selector count' },
+    // Selectors are ANDed, so an empty list restricts nothing rather than
+    // matching nothing — the reading most people reach for first.
+    { key: 'selectors', label: 'Selectors', width: 'w-28', tooltip: 'Devices must satisfy every selector. Zero selectors means this class imposes no selector restriction; claim selectors and other allocation requirements still apply.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   resourceslices: [
     { key: 'name', label: 'Name' },
     { key: 'driver', label: 'Driver', width: 'w-44' },
-    { key: 'pool', label: 'Pool', width: 'w-36' },
-    { key: 'node', label: 'Node', width: 'w-44' },
-    { key: 'devices', label: 'Devices', width: 'w-24' },
+    { key: 'pool', label: 'Pool', width: 'w-36', tooltip: "Pools are identified by driver and pool name. The scheduler needs a complete set of slices at the pool's highest generation before allocating from it." },
+    { key: 'node', label: 'Node', width: 'w-44', tooltip: "Node providing this slice's devices. A dash means node access is described by a node selector, all-nodes access, or per-device node selection." },
+    { key: 'devices', label: 'Devices', width: 'w-24', tooltip: 'Devices published in this slice, including devices already allocated. This is not a count of free devices or the whole pool.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nvidiaclusterpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'components', label: 'Components', width: 'w-64', tooltip: 'Enabled GPU Operator components' },
-    { key: 'mig', label: 'MIG', width: 'w-24' },
+    { key: 'components', label: 'Components', width: 'w-64', tooltip: 'Enabled GPU Operator components" with "GPU Operator components enabled in spec — not whether they are running' },
+    { key: 'mig', label: 'MIG', width: 'w-24', tooltip: 'Multi-Instance GPU exposure: single advertises uniform partitions as nvidia.com/gpu; mixed advertises separate partition profiles; none disables MIG-aware exposure' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nvidiadrivers: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'driverType', label: 'Type', width: 'w-28' },
-    { key: 'version', label: 'Version', width: 'w-32' },
+    { key: 'driverType', label: 'Type', width: 'w-28', tooltip: 'Driver role: gpu for standard GPU workloads, vgpu for virtual GPU guests, or vgpu-host-manager for virtualization hosts' },
+    { key: 'version', label: 'Version', width: 'w-32', tooltip: 'Driver version requested in spec — nodes may still be running the previous one' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterqueues: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'cohort', label: 'Cohort', width: 'w-32' },
-    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24', tooltip: 'Pending workloads' },
-    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24', tooltip: 'Admitted workloads' },
+    { key: 'cohort', label: 'Cohort', width: 'w-32', tooltip: 'Queues in this cohort can share unused quota, subject to borrowing and lending limits' },
+    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24', tooltip: 'Workloads in this ClusterQueue waiting for admission, across namespaces; inspect workload status for the blocker' },
+    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24', tooltip: 'Unfinished workloads admitted through this ClusterQueue, across namespaces; admission does not mean their pods are running' },
     { key: 'flavors', label: 'Flavors', width: 'w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -920,8 +924,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'clusterQueue', label: 'Cluster Queue', width: 'w-40' },
-    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24' },
-    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24' },
+    { key: 'pendingWorkloads', label: 'Pending', width: 'w-24', tooltip: 'Workloads submitted to this LocalQueue that are waiting for ClusterQueue admission' },
+    { key: 'admittedWorkloads', label: 'Admitted', width: 'w-24', tooltip: 'Unfinished workloads from this LocalQueue admitted to its ClusterQueue; their pods may still be waiting to run' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   workloads: [
@@ -935,7 +939,6 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ],
   resourceflavors: [
     { key: 'name', label: 'Name' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'nodeLabels', label: 'Node Labels', width: 'w-28', tooltip: 'Node label selector count' },
     { key: 'taints', label: 'Taints', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -943,14 +946,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   admissionchecks: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'controllerName', label: 'Controller', width: 'w-64' },
+    { key: 'controllerName', label: 'Controller', width: 'w-64', tooltip: 'Controller responsible for this check; workloads requiring it cannot be admitted until the check passes' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   provisioningrequests: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'provisioningClassName', label: 'Class', width: 'w-56' },
+    { key: 'provisioningClassName', label: 'Class', width: 'w-56', tooltip: 'Provisioning mode: check-capacity checks existing capacity without reserving it; best-effort-atomic-scale-up creates capacity atomically' },
     { key: 'podSets', label: 'Pod Sets', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -976,7 +979,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'serviceStatus', label: 'Service Status', width: 'w-28' },
+    { key: 'serviceStatus', label: 'Service Status', width: 'w-28', tooltip: "KubeRay's serving-readiness flag; this does not describe the active rollout phase." },
     { key: 'clusters', label: 'Clusters', width: 'w-56', tooltip: 'Active and pending RayCluster names' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -985,8 +988,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
-    { key: 'suspend', label: 'Suspend', width: 'w-20' },
-    { key: 'lastSchedule', label: 'Last Schedule', width: 'w-28' },
+    { key: 'timeZone', label: 'Time Zone', width: 'w-36', tooltip: 'IANA zone the schedule is read in; unset follows the local zone of the KubeRay operator pod' },
+    { key: 'lastSchedule', label: 'Last Schedule', width: 'w-28', tooltip: 'Time since the last recorded schedule; this does not confirm the job started or succeeded.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   leaderworkersets: [
@@ -1007,7 +1010,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'ready', label: 'Ready', width: 'w-20' },
     { key: 'succeeded', label: 'Succeeded', width: 'w-24' },
     { key: 'failed', label: 'Failed', width: 'w-20' },
-    { key: 'restarts', label: 'Restarts', width: 'w-24' },
+    { key: 'restarts', label: 'Restarts', width: 'w-24', tooltip: 'Whole-JobSet restarts by the failure policy — every child Job is recreated' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   inferenceservices: [
@@ -1062,7 +1065,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   inferencepools: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-36', tooltip: 'Gateway acceptance and EPP resolution' },
+    { key: 'status', label: 'Status', width: 'w-36', tooltip: 'Gateway acceptance and reference errors across reported parents; Accepted does not prove backend Pods are ready.' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
     { key: 'targetPorts', label: 'Target Ports', width: 'w-28' },
     { key: 'extensionRef', label: 'Endpoint Picker', width: 'w-40', tooltip: 'EPP extension service' },
@@ -1073,7 +1076,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'poolRef', label: 'Pool', width: 'w-40', tooltip: 'Target InferencePool' },
-    { key: 'priority', label: 'Priority', width: 'w-24' },
+    { key: 'priority', label: 'Priority', width: 'w-24', tooltip: 'Higher values are served first when pool resources are scarce; an unset priority is treated as 0.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   volcanojobs: [
@@ -1081,7 +1084,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'queue', label: 'Queue', width: 'w-32' },
-    { key: 'minAvailable', label: 'Min Available', width: 'w-28' },
+    { key: 'minAvailable', label: 'Min Available', width: 'w-28', tooltip: 'Minimum pods that must be schedulable together for gang scheduling to start the job' },
     { key: 'pods', label: 'Pods', width: 'w-44', tooltip: 'Running / succeeded / failed pod counts' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1089,8 +1092,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'weight', label: 'Weight', width: 'w-20' },
-    { key: 'capability', label: 'Capability', width: 'w-48' },
-    { key: 'allocated', label: 'Allocated', width: 'w-48' },
+    { key: 'capability', label: 'Capability', width: 'w-48', tooltip: 'Configured resource limits for this queue; actual allocation also depends on available resources and scheduler policy' },
+    { key: 'allocated', label: 'Allocated', width: 'w-48', tooltip: 'Resources the scheduler reports as allocated to this queue; these are allocations, not measured CPU or memory use' },
     { key: 'podGroups', label: 'PodGroups', width: 'w-44', tooltip: 'PodGroup counts by state' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1106,23 +1109,22 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'flows', label: 'Flows', width: 'w-20' },
+    { key: 'flows', label: 'Flows', width: 'w-20', tooltip: 'Declared job stages; dependencies control when each stage can start' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   jobtemplates: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'tasks', label: 'Tasks', width: 'w-20' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   kaiqueues: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'parentQueue', label: 'Parent', width: 'w-32' },
-    { key: 'priority', label: 'Priority', width: 'w-20' },
-    { key: 'quota', label: 'Quota', width: 'w-52', tooltip: 'GPU fractions, CPU millicpus, memory MB; -1 = unlimited' },
-    { key: 'allocated', label: 'Allocated', width: 'w-48' },
+    { key: 'parentQueue', label: 'Parent', width: 'w-32', tooltip: 'Parent queue whose resources are shared among its children; ancestor limits constrain allocations' },
+    { key: 'priority', label: 'Priority', width: 'w-20', tooltip: "Higher priority favors allocation of resources above quota and delays reclaim; it does not increase the queue's guaranteed quota" },
+    { key: 'quota', label: 'Quota', width: 'w-52', tooltip: 'Guaranteed resource allocation; the queue may exceed it when spare resources and configured limits allow' },
+    { key: 'allocated', label: 'Allocated', width: 'w-48', tooltip: 'Resources allocated to this queue and its descendants, including scheduled pods still starting; this is not measured utilization' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   kaipodgroups: [
@@ -1137,9 +1139,9 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'instanceType', label: 'Instance Type', width: 'w-40', tooltip: 'GPU node SKU provisioned for the workspace' },
+    { key: 'instanceType', label: 'Instance Type', width: 'w-40', tooltip: 'Requested node instance type; actual node hardware is not checked.' },
     { key: 'preset', label: 'Model', width: 'w-44', tooltip: 'Preset model (inference or tuning)' },
-    { key: 'nodes', label: 'Nodes', width: 'w-20', tooltip: 'Worker nodes ready / target' },
+    { key: 'nodes', label: 'Nodes', width: 'w-20', tooltip: 'Worker nodes listed by KAITO, with the target count when available; listing does not confirm readiness.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   ragengines: [
@@ -1147,7 +1149,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'embedding', label: 'Embedding Model', width: 'w-56', tooltip: 'Local model ID/image or remote endpoint' },
-    { key: 'instanceType', label: 'Instance Type', width: 'w-40' },
+    { key: 'instanceType', label: 'Instance Type', width: 'w-40', tooltip: 'Requested node instance type; actual node hardware is not checked.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   nimservices: [
@@ -1210,7 +1212,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'runtime', label: 'Runtime', width: 'w-44', tooltip: 'Training runtime reference' },
+    { key: 'runtime', label: 'Runtime', width: 'w-44', tooltip: 'Runtime template supplying training defaults; TrainJob settings can override its image and node count.' },
     { key: 'suspended', label: 'Suspended', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1219,7 +1221,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'target', label: 'Job Target', width: 'w-48' },
-    { key: 'strategy', label: 'Strategy', width: 'w-28' },
+    { key: 'strategy', label: 'Strategy', width: 'w-28', tooltip: 'Controls how queue length and running or pending Jobs determine how many new Jobs KEDA creates' },
     { key: 'triggerTypes', label: 'Trigger Types', width: 'w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1241,7 +1243,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   servicemonitors: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'endpoints', label: 'Endpoints', width: 'w-20', tooltip: 'Number of scrape endpoints' },
     { key: 'jobLabel', label: 'Job Label', width: 'w-32' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
@@ -1250,7 +1252,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   prometheusrules: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'groups', label: 'Groups', width: 'w-20' },
     { key: 'rules', label: 'Rules', width: 'w-20', tooltip: 'Total alert + recording rules' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1258,7 +1260,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   podmonitors: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
+    { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'endpoints', label: 'Endpoints', width: 'w-20', tooltip: 'Number of pod metrics endpoints' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1269,18 +1271,18 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   policyreports: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'scope', label: 'Subject', width: 'w-56' },
+    { key: 'scope', label: 'Subject', width: 'w-56', tooltip: "The resource this report is about. Kyverno names the report after the resource's UID; use Subject to identify it." },
     { key: 'status', label: 'Status', width: 'w-32' },
     { key: 'pass', label: 'Pass', width: 'w-16' },
     { key: 'fail', label: 'Fail', width: 'w-16' },
     { key: 'warn', label: 'Warn', width: 'w-20' },
-    { key: 'error', label: 'Err', width: 'w-16' },
+    { key: 'error', label: 'Err', width: 'w-16', tooltip: 'Checks that could not be evaluated, for example because of missing context or a broken expression. Errors are not violations, but zero failures does not establish compliance while checks remain unevaluated.' },
     { key: 'skip', label: 'Skip', width: 'w-16' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterpolicyreports: [
     { key: 'name', label: 'Name' },
-    { key: 'scope', label: 'Subject', width: 'w-56' },
+    { key: 'scope', label: 'Subject', width: 'w-56', tooltip: "The resource this report is about. Kyverno names the report after the resource's UID; use Subject to identify it." },
     { key: 'status', label: 'Status', width: 'w-32' },
     { key: 'pass', label: 'Pass', width: 'w-16' },
     { key: 'fail', label: 'Fail', width: 'w-16' },
@@ -1294,14 +1296,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'action', label: 'Action', width: 'w-36', tooltip: 'Enforcement at admission — Enforce blocks, Audit reports; Background only or Inactive when admission is disabled' },
-    { key: 'rules', label: 'Rules', width: 'w-20' },
+    { key: 'ruleTypes', label: 'Types', width: 'w-40', tooltip: 'Rule kinds this policy declares. A policy can carry several, and the mix decides what it can do to a request.' },
+    { key: 'rules', label: 'Rules', width: 'w-20', defaultVisible: false },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clusterpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'action', label: 'Action', width: 'w-36', tooltip: 'Enforcement at admission — Enforce blocks, Audit reports; Background only or Inactive when admission is disabled' },
-    { key: 'rules', label: 'Rules', width: 'w-20' },
+    { key: 'ruleTypes', label: 'Types', width: 'w-40', tooltip: 'Rule kinds this policy declares. A policy can carry several, and the mix decides what it can do to a request.' },
+    { key: 'rules', label: 'Rules', width: 'w-20', defaultVisible: false },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // Kyverno modern CEL family (policies.kyverno.io). "Enforcement" is the
@@ -1382,7 +1386,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   // getModernKyvernoPolicyStatus), so a second one would be redundant.
   deletingpolicies: [
     { key: 'name', label: 'Name' },
-    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'When the schedule last fired. A scheduled policy that has never run is the failure worth catching — Kyverno rejects uncompilable policies at admission, so a broken one never exists to flag.' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Last execution time reported by Kyverno. A timestamp does not prove every matching resource was deleted.' },
     { key: 'schedule', label: 'Schedule', width: 'w-32', tooltip: 'Cron schedule on which matched resources are deleted' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'rules', label: 'Conditions', width: 'w-28', tooltip: 'CEL conditions narrowing what is deleted; none means every matched resource' },
@@ -1391,7 +1395,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   namespaceddeletingpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'When the schedule last fired. A scheduled policy that has never run is the failure worth catching — Kyverno rejects uncompilable policies at admission, so a broken one never exists to flag.' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Last execution time reported by Kyverno. A timestamp does not prove every matching resource was deleted.' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'rules', label: 'Conditions', width: 'w-28' },
@@ -1408,20 +1412,22 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Time since the controller last recorded an execution. A dash means it has not recorded one.' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   clustercleanuppolicies: [
     { key: 'name', label: 'Name' },
     { key: 'schedule', label: 'Schedule', width: 'w-32' },
+    { key: 'lastRun', label: 'Last Run', width: 'w-28', tooltip: 'Time since the controller last recorded an execution. A dash means it has not recorded one.' },
     { key: 'appliesTo', label: 'Deletes', width: 'min-w-40' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   grpcroutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'hostnames', label: 'Hostnames', width: 'w-48' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
+    { key: 'hostnames', label: 'Hostnames', width: 'w-48', tooltip: "gRPC hostnames this route matches. Any means the route adds no hostname restriction; the Gateway listener and the route's other matching rules still apply." },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
     { key: 'rules', label: 'Rules', width: 'w-20' },
@@ -1430,7 +1436,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   tcproutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
     { key: 'rules', label: 'Rules', width: 'w-20' },
@@ -1439,8 +1445,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   tlsroutes: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'hostnames', label: 'Hostnames', width: 'w-48', tooltip: 'SNI hostnames for TLS routing' },
+    { key: 'status', label: 'Status', width: 'w-28', tooltip: 'Accepted = controllers accepted this route and confirmed it can use the backends and other objects it names. Traffic has not been tested. Degraded or Not Accepted: open the route to see which Gateway or backend failed. Pending or Unknown: check the named Gateways or Services and their controllers.' },
+    { key: 'hostnames', label: 'Hostnames', width: 'w-48', tooltip: 'TLS SNI names requested by this route. Any means no route-level hostname restriction; the Gateway listener still applies.' },
     { key: 'parents', label: 'Gateways', width: 'w-36' },
     { key: 'backends', label: 'Backends', width: 'w-48', tooltip: 'Backend services receiving traffic' },
     { key: 'rules', label: 'Rules', width: 'w-20' },
@@ -1457,7 +1463,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   workflowtemplates: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'entrypoint', label: 'Entrypoint', width: 'w-36' },
+    { key: 'entrypoint', label: 'Entrypoint', width: 'w-36', tooltip: 'Default template invoked when submitted as a workflow; submission may override it' },
     { key: 'templates', label: 'Templates', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1472,29 +1478,28 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'policyTypes', label: 'Types', width: 'w-28' },
     { key: 'selector', label: 'Pod Selector', width: 'w-48' },
-    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
+    { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress allow-rule counts. For a direction listed in Types, 0 means this policy allows none; other policies can still allow traffic.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   caliconetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicoglobalnetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false, tooltip: 'Adds a namespace restriction to the endpoint Selector. Unset adds no namespace restriction; the other selectors still apply.' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1502,58 +1507,57 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32', tooltip: 'Staged policies do not enforce traffic. Set and Learn preview rules; Delete stages removal of the matching enforced policy; Ignore is skipped. Omitted means Set.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicostagedglobalnetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'selector', label: 'Selector', width: 'w-48' },
-    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false },
-    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false },
-    { key: 'tier', label: 'Tier', width: 'w-28' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'namespaceSelector', label: 'Namespace Selector', width: 'w-48', defaultVisible: false, tooltip: 'Adds a namespace restriction to the endpoint Selector. Unset adds no namespace restriction; the other selectors still apply.' },
+    { key: 'serviceAccountSelector', label: 'Service Account Selector', width: 'w-48', defaultVisible: false, tooltip: 'Endpoints must match both this service-account selector and the endpoint Selector; matching either one alone is insufficient.' },
+    { key: 'tier', label: 'Tier', width: 'w-28', tooltip: 'Tier precedence applies before policy Order. An earlier tier can allow or deny traffic before this policy is reached.' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Evaluation order within the tier — lowest runs first. Unset runs after every ordered policy.' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32', tooltip: 'Staged policies do not enforce traffic. Set and Learn preview rules; Delete stages removal of the matching enforced policy; Ignore is skipped. Omitted means Set.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: "Traffic directions this policy governs. If no applicable policy in the tier takes action, the tier's default action applies (Deny unless configured as Pass)." },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicoippools: [
     { key: 'name', label: 'Name' },
     { key: 'cidr', label: 'CIDR', width: 'w-44' },
-    { key: 'blockSize', label: 'Block Size', width: 'w-28' },
-    { key: 'encapsulation', label: 'Encapsulation', width: 'w-36' },
-    { key: 'natOutgoing', label: 'NAT Outgoing', width: 'w-32' },
+    { key: 'blockSize', label: 'Block Size', width: 'w-28', tooltip: 'CIDR prefix of each allocation block. A node can hold several blocks, so this is not a per-node pod cap. Unset means /26 for IPv4, /122 for IPv6.' },
+    { key: 'encapsulation', label: 'Encapsulation', width: 'w-36', tooltip: 'Overlay used for pod traffic between nodes. None routes pod addresses directly; CrossSubnet tunnels only between nodes on different subnets.' },
+    { key: 'natOutgoing', label: 'NAT Outgoing', width: 'w-32', tooltip: 'When enabled, outgoing traffic from this pool is masqueraded for destinations outside all Calico IP pools.' },
     { key: 'disabled', label: 'Disabled', width: 'w-28' },
-    { key: 'allowedUses', label: 'Allowed Uses', width: 'w-40', defaultVisible: false },
+    { key: 'allowedUses', label: 'Allowed Uses', width: 'w-40', defaultVisible: false, tooltip: 'Pools without Workload are skipped for automatic pod IP allocation. Omitted or empty allows Workload and Tunnel; existing allocations are unchanged.' },
     { key: 'nodeSelector', label: 'Node Selector', width: 'w-48', defaultVisible: false },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicohostendpoints: [
     { key: 'name', label: 'Name' },
     { key: 'node', label: 'Node', width: 'w-48' },
-    { key: 'interfaceName', label: 'Interface', width: 'w-32' },
+    { key: 'interfaceName', label: 'Interface', width: 'w-32', tooltip: '* applies policy to all host interfaces. When unset, Calico identifies the interface using Expected IPs.' },
     { key: 'expectedIPs', label: 'Expected IPs', width: 'w-48' },
-    { key: 'profiles', label: 'Profiles', width: 'w-48', defaultVisible: false },
+    { key: 'profiles', label: 'Profiles', width: 'w-48', defaultVisible: false, tooltip: "Profiles apply only if policy evaluation reaches them. A tier's implicit deny stops traffic before profiles, even when no rule matched." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicotiers: [
     { key: 'name', label: 'Name' },
-    { key: 'order', label: 'Order', width: 'w-24' },
-    { key: 'defaultAction', label: 'Default Action', width: 'w-36' },
+    { key: 'order', label: 'Order', width: 'w-24', tooltip: 'Order this tier is evaluated in — lowest first. Unset runs after every ordered tier.' },
+    { key: 'defaultAction', label: 'Default Action', width: 'w-36', tooltip: 'If this tier selects the endpoint and traffic direction but no rule decides the packet, Deny drops it and Pass continues evaluation. Tiers with no applicable policy are skipped.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   calicostagedkubernetesnetworkpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'selector', label: 'Pod Selector', width: 'w-48' },
-    { key: 'stagedAction', label: 'Staged Action', width: 'w-32' },
-    { key: 'types', label: 'Types', width: 'w-28' },
+    { key: 'stagedAction', label: 'Staged Action', width: 'w-32', tooltip: 'Staged policies do not enforce traffic. Set and Learn preview rules; Delete stages removal of the matching enforced policy; Ignore is skipped. Omitted means Set.' },
+    { key: 'types', label: 'Types', width: 'w-28', tooltip: 'An explicitly listed direction can have zero rules. When policyTypes is omitted, Ingress is included and Egress is added when egress rules exist.' },
     { key: 'rules', label: 'Rules', width: 'w-24', tooltip: 'Ingress / Egress rule count' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1561,7 +1565,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'budget', label: 'Budget', width: 'w-36' },
+    { key: 'budget', label: 'Budget', width: 'w-36', tooltip: 'min keeps at least this many pods available; max unavail permits at most this many unavailable during voluntary evictions; percentages use the expected pod count' },
     { key: 'healthy', label: 'Healthy', width: 'w-24' },
     { key: 'allowed', label: 'Allowed', width: 'w-24', tooltip: 'Number of disruptions currently allowed' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1569,7 +1573,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   serviceaccounts: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
-    { key: 'automount', label: 'Automount', width: 'w-32', tooltip: 'Whether token is automatically mounted in pods' },
+    { key: 'automount', label: 'Automount', width: 'w-32', tooltip: 'Default automatic API-token mounting for pods using this ServiceAccount. A pod can override this setting. Disable it for workloads that do not need Kubernetes API credentials.' },
     { key: 'secrets', label: 'Secrets', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1607,12 +1611,12 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-48' },
     { key: 'holder', label: 'Holder', width: 'w-48' },
-    { key: 'renewTime', label: 'Last Renewed', width: 'w-32' },
+    { key: 'renewTime', label: 'Last Renewed', width: 'w-32', tooltip: 'Time since the recorded renewal; red means it exceeds leaseDurationSeconds. Check holder health and API connectivity' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   priorityclasses: [
     { key: 'name', label: 'Name' },
-    { key: 'value', label: 'Value', width: 'w-24' },
+    { key: 'value', label: 'Value', width: 'w-24', tooltip: 'Higher values receive scheduling preference; Pods can still be preempted by Pods with higher priority' },
     { key: 'globalDefault', label: 'Global Default', width: 'w-36' },
     { key: 'preemptionPolicy', label: 'Preemption', width: 'w-32' },
     { key: 'description', label: 'Description', width: 'w-64' },
@@ -1626,7 +1630,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   mutatingwebhookconfigurations: [
     { key: 'name', label: 'Name' },
     { key: 'webhooks', label: 'Webhooks', width: 'w-28' },
-    { key: 'failurePolicy', label: 'Failure Policy', width: 'w-36' },
+    { key: 'failurePolicy', label: 'Failure Policy', width: 'w-36', tooltip: 'If a matching webhook call errors or times out, Fail rejects the API request; Ignore continues without that webhook. This describes failure handling, not current webhook health.' },
     { key: 'target', label: 'Target', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1672,7 +1676,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'url', label: 'URL', width: 'w-64' },
-    { key: 'type', label: 'Type', width: 'w-20', tooltip: 'default (Helm) or oci' },
+    { key: 'type', label: 'Type', width: 'w-20', tooltip: 'default: Flux fetches a Helm repository index. oci: a registry reference with no reconciliation status of its own' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1684,7 +1688,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'revision', label: 'Revision', width: 'w-48', tooltip: 'Applied git revision' },
     { key: 'inventory', label: 'Resources', width: 'w-24', tooltip: 'Number of managed resources' },
-    { key: 'lastUpdated', label: 'Last Updated', width: 'w-28', tooltip: 'Time since last successful reconciliation' },
+    { key: 'lastUpdated', label: 'Last Updated', width: 'w-28', tooltip: 'Time since the last recorded reconciliation attempt; falls back to the last Ready transition. Neither guarantees success.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   helmreleases: [
@@ -1712,8 +1716,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   applications: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'project', label: 'Project', width: 'w-28' },
-    { key: 'sync', label: 'Sync', width: 'w-24' },
+    { key: 'project', label: 'Project', width: 'w-28', tooltip: 'AppProject the app belongs to — bounds which repos and clusters it may deploy to' },
+    { key: 'sync', label: 'Sync', width: 'w-24', tooltip: "Whether live resources match Argo's desired manifests; Synced does not mean Healthy" },
     { key: 'health', label: 'Health', width: 'w-24' },
     { key: 'repo', label: 'Repository', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
@@ -1740,7 +1744,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'container', label: 'Container', width: 'w-28' },
     { key: 'image', label: 'Image', width: 'w-48' },
-    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical vulnerabilities' },
+    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical-severity vulnerabilities. C/H/M/L = Critical, High, Medium, Low.' },
     { key: 'high', label: 'H', width: 'w-12', tooltip: 'High vulnerabilities' },
     { key: 'medium', label: 'M', width: 'w-12', tooltip: 'Medium vulnerabilities' },
     { key: 'low', label: 'L', width: 'w-12', tooltip: 'Low vulnerabilities' },
@@ -1750,7 +1754,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical findings' },
+    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical-severity failed checks. C/H/M/L = Critical, High, Medium, Low.' },
     { key: 'high', label: 'H', width: 'w-12', tooltip: 'High findings' },
     { key: 'medium', label: 'M', width: 'w-12', tooltip: 'Medium findings' },
     { key: 'low', label: 'L', width: 'w-12', tooltip: 'Low findings' },
@@ -1761,7 +1765,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'container', label: 'Container', width: 'w-28' },
     { key: 'image', label: 'Image', width: 'w-48' },
-    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical secrets' },
+    { key: 'critical', label: 'C', width: 'w-12', tooltip: 'Critical-severity exposed secrets. C/H/M/L = Critical, High, Medium, Low.' },
     { key: 'high', label: 'H', width: 'w-12', tooltip: 'High secrets' },
     { key: 'medium', label: 'M', width: 'w-12', tooltip: 'Medium secrets' },
     { key: 'low', label: 'L', width: 'w-12', tooltip: 'Low secrets' },
@@ -1797,13 +1801,15 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   sbomreports: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
+    { key: 'image', label: 'Image', width: 'w-48', tooltip: 'Image the SBOM describes. The container name alone does not identify what was scanned.' },
     { key: 'container', label: 'Container', width: 'w-28' },
-    { key: 'components', label: 'Components', width: 'w-24' },
+    { key: 'components', label: 'Components', width: 'w-24', tooltip: 'Packages and libraries found in the image' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-16' },
   ],
   clustersbomreports: [
     { key: 'name', label: 'Name' },
+    { key: 'image', label: 'Image', width: 'w-48', tooltip: 'Image the SBOM describes. The container name alone does not identify what was scanned.' },
     { key: 'components', label: 'Components', width: 'w-24' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-16' },
@@ -1833,8 +1839,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'store', label: 'Store', width: 'w-36' },
-    { key: 'provider', label: 'Provider', width: 'w-28' },
-    { key: 'refreshInterval', label: 'Refresh', width: 'w-24' },
+    { key: 'refreshInterval', label: 'Refresh', width: 'w-24', tooltip: 'How often the value is re-pulled from the provider. A zero interval means it is fetched once and not updated afterward.' },
     { key: 'lastSync', label: 'Last Sync', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1865,10 +1870,10 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-36' },
-    { key: 'storageLocation', label: 'Storage', width: 'w-36' },
+    { key: 'storageLocation', label: 'Storage', width: 'w-36', tooltip: "The backup's storage location. A completed backup still needs this location reachable to restore from." },
     { key: 'namespaces', label: 'Scope', width: 'w-24', tooltip: 'Included namespaces (* = all)' },
     { key: 'duration', label: 'Duration', width: 'w-24' },
-    { key: 'expiry', label: 'Expires', width: 'w-24' },
+    { key: 'expiry', label: 'Expires', width: 'w-24', tooltip: "When Velero's retention makes this backup eligible for cleanup. Expired means Velero intends to delete it, not that it is gone — and not that a restore will work." },
     { key: 'errors', label: 'Errors', width: 'w-28' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1912,7 +1917,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-36' },
-    { key: 'repositoryType', label: 'Type', width: 'w-24' },
+    { key: 'repositoryType', label: 'Type', width: 'w-24', tooltip: 'kopia or restic. Restic is deprecated — Velero 1.17 stopped creating restic backups and 1.19 drops restic restore.' },
+    { key: 'volumeNamespace', label: 'Volume NS', width: 'w-36', tooltip: 'Namespace whose volumes this repository stores. Distinct from the namespace the repository object lives in.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   backupstoragelocations: [
@@ -1921,8 +1927,8 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-36' },
     { key: 'provider', label: 'Provider', width: 'w-24' },
     { key: 'bucket', label: 'Bucket', width: 'w-40' },
-    { key: 'default', label: 'Default', width: 'w-24' },
-    { key: 'lastValidation', label: 'Validated', width: 'w-28' },
+    { key: 'default', label: 'Default', width: 'w-24', tooltip: 'Whether this location is marked default. A backup naming no storage location is written to the default one.' },
+    { key: 'lastValidation', label: 'Validated', width: 'w-28', tooltip: 'Time since Velero last validated this location. An old value means availability has not been checked recently; validation may be disabled or configured to run less often.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // ============================================================================
@@ -1942,7 +1948,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-44' },
     { key: 'instances', label: 'Instances', width: 'w-28', tooltip: 'Ready/Total' },
     { key: 'primary', label: 'Primary', width: 'w-36' },
-    { key: 'image', label: 'Image', width: 'w-28' },
+    { key: 'image', label: 'Image', width: 'w-28', tooltip: 'Configured image tag, or the operator-resolved image for a catalog-backed cluster. This does not confirm that every instance has finished updating.' },
     // No Storage column: it rendered spec.storage.size, the configured REQUEST.
     // The useful number is actual usage (kubectl cnpg status shows "Size: 158M")
     // and that isn't in the CR. A plausible-but-wrong-meaning number is worse
@@ -1960,7 +1966,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   updaterequests: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-32' },
-    { key: 'status', label: 'State', width: 'w-28' },
+    { key: 'status', label: 'State', width: 'w-28', tooltip: 'Pending work Kyverno has queued but not yet applied; Failed is work it tried and could not.' },
     { key: 'type', label: 'Type', width: 'w-24' },
     { key: 'policy', label: 'Policy', width: 'w-52' },
     { key: 'triggers', label: 'Triggered By', width: 'w-56' },
@@ -1971,7 +1977,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-32' },
     { key: 'status', label: 'Outcome', width: 'w-28' },
     { key: 'subject', label: 'About', width: 'w-56' },
-    { key: 'source', label: 'Produced By', width: 'w-36' },
+    { key: 'source', label: 'Produced By', width: 'w-36', tooltip: 'Admission: evaluated during an API admission request. Background scan: evaluated against existing resources.' },
     { key: 'results', label: 'Results', width: 'w-24' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -1986,7 +1992,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   cnpgdatabases: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Applied', width: 'w-32' },
+    { key: 'status', label: 'Applied', width: 'w-32', tooltip: 'Whether the operator has applied this to PostgreSQL. Pending means it has not reconciled it yet — not that it failed.' },
     { key: 'cluster', label: 'Cluster', width: 'w-36' },
     { key: 'target', label: 'Database', width: 'w-40' },
     { key: 'message', label: 'Message', width: 'w-64' },
@@ -2082,24 +2088,24 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'hosts', label: 'Hosts', width: 'w-48' },
-    { key: 'gateways', label: 'Gateways', width: 'w-40' },
+    { key: 'hosts', label: 'Hosts', width: 'w-48', tooltip: 'Request hostnames this VirtualService matches — not the backends it routes to' },
+    { key: 'gateways', label: 'Gateways', width: 'w-40', tooltip: "Where these routing rules apply. '-' means the default mesh gateway — sidecar traffic; individual route matches can override this." },
     { key: 'routes', label: 'Routes', width: 'w-20', tooltip: 'HTTP + TCP + TLS routes' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   destinationrules: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'host', label: 'Host', width: 'w-48' },
-    { key: 'subsets', label: 'Subsets', width: 'w-20' },
-    { key: 'loadBalancer', label: 'LB Policy', width: 'w-28' },
+    { key: 'status', label: 'Status', width: 'w-24', defaultVisible: false },
+    { key: 'host', label: 'Host', width: 'w-48', tooltip: "The service this rule's traffic policy applies to" },
+    { key: 'subsets', label: 'Subsets', width: 'w-20', tooltip: 'Named backend groups that routes can select, often for canary releases. Defining subsets does not send traffic to them.' },
+    { key: 'tlsMode', label: 'Client TLS', width: 'w-28', tooltip: 'Declared client-side TLS mode for this host at the rule level. Subset and port policies can override it; this does not establish the effective mTLS posture.' },
+    { key: 'loadBalancer', label: 'LB Policy', width: 'w-28', tooltip: "Load balancing algorithm for this host. A dash means Istio's mesh default applies (LEAST_REQUEST since Istio 1.14). Subset and port policies can differ." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   serviceentries: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
     { key: 'hosts', label: 'Hosts', width: 'w-48' },
     { key: 'location', label: 'Location', width: 'w-28' },
     { key: 'ports', label: 'Ports', width: 'w-32' },
@@ -2108,18 +2114,17 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   peerauthentications: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'mode', label: 'mTLS Mode', width: 'w-28' },
-    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'mode', label: 'mTLS Mode', width: 'w-28', tooltip: 'Incoming connection policy: STRICT requires mTLS; PERMISSIVE also accepts plaintext; DISABLE turns mTLS off (unsupported in ambient). UNSET inherits the broader policy, defaulting to PERMISSIVE. Port-level overrides can differ.' },
+    { key: 'selector', label: 'Selector', width: 'w-48', tooltip: 'Selects workloads in this namespace. No selector defines a namespace default, or a mesh default in the root namespace; more specific policies can override it.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   authorizationpolicies: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
-    { key: 'status', label: 'Status', width: 'w-24' },
-    { key: 'action', label: 'Action', width: 'w-24' },
-    { key: 'rules', label: 'Rules', width: 'w-20' },
-    { key: 'selector', label: 'Selector', width: 'w-48' },
+    { key: 'status', label: 'Status', width: 'w-24', defaultVisible: false },
+    { key: 'action', label: 'Action', width: 'w-24', tooltip: 'ALLOW contributes permitted matches; DENY blocks matches; AUDIT marks matches for a configured audit plugin; CUSTOM adds an external check. Other policies also affect the decision.' },
+    { key: 'rules', label: 'Rules', width: 'w-20', tooltip: 'Rules are alternatives — zero rules match nothing, an empty rule matches everything. An ALLOW policy with zero rules permits nothing on its own.' },
+    { key: 'selector', label: 'Applies to', width: 'w-48', tooltip: 'Declared workload labels or resource attachments. With neither, scope is inherited — the namespace, or the whole mesh when the policy sits in the mesh root namespace.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // Knative Serving
@@ -2128,7 +2133,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'url', label: 'URL', width: 'w-56' },
-    { key: 'latestRevision', label: 'Latest Revision', width: 'w-44' },
+    { key: 'latestRevision', label: 'Latest Revision', width: 'w-44', tooltip: 'Newest revision that has reported Ready. A newer revision may still be starting or may have failed; this revision need not receive traffic.' },
     { key: 'traffic', label: 'Traffic', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -2137,16 +2142,16 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'latestCreated', label: 'Latest Created', width: 'w-48' },
-    { key: 'latestReady', label: 'Latest Ready', width: 'w-48' },
+    { key: 'latestReady', label: 'Latest Ready', width: 'w-48', tooltip: 'Newest revision that has reported Ready. If it differs from Latest Created, the newer revision may still be starting or may have failed; inspect Status.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   knativerevisions: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'routing', label: 'Traffic', width: 'w-20', tooltip: 'Whether this revision is receiving traffic' },
+    { key: 'routing', label: 'Traffic', width: 'w-20', tooltip: 'Active: marked for Route traffic, even if scaled to zero. Reserve: not currently marked for Route traffic. Neither value measures incoming requests.' },
     { key: 'image', label: 'Image', width: 'w-48' },
-    { key: 'concurrency', label: 'Concurrency', width: 'w-32' },
+    { key: 'concurrency', label: 'Concurrency', width: 'w-32', tooltip: "Hard limit on simultaneous requests handled by each pod; excess requests are buffered. Unlimited removes this cap, not autoscaling's target." },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   knativeroutes: [
@@ -2171,7 +2176,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'broker', label: 'Broker', width: 'w-36' },
     { key: 'subscriber', label: 'Subscriber', width: 'w-48' },
-    { key: 'filter', label: 'Filter', width: 'w-48' },
+    { key: 'filter', label: 'Filter', width: 'w-48', tooltip: 'Selects which broker events are eligible for delivery. No filtering admits every event; it does not guarantee successful delivery. Expression filters override attribute filters.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   eventtypes: [
@@ -2188,7 +2193,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'schedule', label: 'Schedule', width: 'w-36' },
-    { key: 'sink', label: 'Sink', width: 'w-48' },
+    { key: 'sink', label: 'Sink', width: 'w-48', tooltip: 'Requested event destination. A displayed reference does not prove it resolved or received events; inspect conditions when delivery fails.' },
     { key: 'data', label: 'Data', width: 'w-36' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -2245,14 +2250,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'steps', label: 'Steps', width: 'w-16' },
+    { key: 'steps', label: 'Steps', width: 'w-16', tooltip: "Stages events pass through in order; each stage's reply feeds the next" },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   parallels: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'branches', label: 'Branches', width: 'w-20' },
+    { key: 'branches', label: 'Branches', width: 'w-20', tooltip: 'Independent filter-and-subscriber pairs; every event is offered to all of them' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   // Knative Networking
@@ -2262,7 +2267,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'ingressClass', label: 'Class', width: 'w-24' },
     { key: 'hosts', label: 'Hosts', width: 'w-56' },
-    { key: 'visibility', label: 'Visibility', width: 'w-28' },
+    { key: 'visibility', label: 'Visibility', width: 'w-28', tooltip: 'Requested exposure across all rules. ExternalIP means at least one rule requests external exposure; ClusterLocal means all rules request cluster-only exposure. This does not verify connectivity.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   knativecertificates: [
@@ -2271,13 +2276,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'dnsNames', label: 'DNS Names', width: 'w-56' },
     { key: 'secretName', label: 'Secret', width: 'w-44' },
+    { key: 'expires', label: 'Expires', width: 'w-28', tooltip: 'Expiry of the certificate in the named Secret, as the controller reported it.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   serverlessservices: [
     { key: 'name', label: 'Name' },
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
-    { key: 'mode', label: 'Mode', width: 'w-20' },
+    { key: 'mode', label: 'Mode', width: 'w-20', tooltip: 'Requested backend mode: Serve selects revision pods; Proxy selects activators. Activators may remain involved with healthy pods for burst handling, so Proxy does not prove a cold start.' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
   domainmappings: [
@@ -2291,7 +2297,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ingressroutes: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0' },
+    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0', tooltip: 'Entry points this route binds to. When unset, Traefik uses the default entry points from its static configuration.' },
     { key: 'hosts', label: 'Hosts', width: 'min-w-44' },
     { key: 'routes', label: 'Routes', width: 'min-w-48' },
     { key: 'tls', label: 'TLS', width: 'w-14 shrink-0' },
@@ -2301,7 +2307,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ingressroutetcps: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0' },
+    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0', tooltip: 'Entry points this route binds to. When unset, Traefik uses the default entry points from its static configuration.' },
     { key: 'hosts', label: 'Hosts', width: 'min-w-44' },
     { key: 'routes', label: 'Routes', width: 'min-w-48' },
     { key: 'tls', label: 'TLS', width: 'w-14 shrink-0' },
@@ -2311,7 +2317,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   ingressrouteudps: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0' },
+    { key: 'entrypoints', label: 'Entry Points', width: 'w-32 shrink-0', tooltip: 'Entry points this route binds to. When unset it is attached to every available UDP entry point; asDefault has no effect on UDP.' },
     { key: 'routes', label: 'Routes', width: 'min-w-48' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2351,7 +2357,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   tlsoptions: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'minVersion', label: 'Min TLS', width: 'w-24 shrink-0' },
+    { key: 'minVersion', label: 'Min TLS', width: 'w-24 shrink-0', tooltip: "Lowest TLS version accepted; connections below it are rejected. A dash means the resource sets no minimum, so Traefik's own default applies." },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   tlsstores: [
@@ -2367,7 +2373,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'class', label: 'Class', width: 'w-32 shrink-0' },
     { key: 'cpReplicas', label: 'CP Ready', width: 'w-24 shrink-0', tooltip: 'Control plane replicas (ready/desired)' },
     { key: 'workerReplicas', label: 'Workers', width: 'w-20 shrink-0', tooltip: 'Worker replicas (ready/desired)' },
-    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0' },
+    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0', tooltip: 'Lifecycle phase while the cluster is still provisioning or deleting; the Available/Ready condition once it has landed.' },
     { key: 'version', label: 'Version', width: 'w-24 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2376,6 +2382,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'cluster', label: 'Cluster', width: 'w-32 shrink-0' },
     { key: 'ready', label: 'Ready', width: 'w-20 shrink-0', tooltip: 'Ready replicas / desired' },
+    { key: 'upToDate', label: 'Up-to-date', width: 'w-24', tooltip: 'Machines already running the current spec. Fewer than Ready means a rollout is still in progress.' },
     { key: 'phase', label: 'Phase', width: 'w-28 shrink-0' },
     { key: 'version', label: 'Version', width: 'w-24 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
@@ -2385,7 +2392,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'cluster', label: 'Cluster', width: 'w-32 shrink-0' },
     { key: 'role', label: 'Role', width: 'w-28 shrink-0' },
-    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0' },
+    { key: 'phase', label: 'Phase', width: 'w-28 shrink-0', tooltip: 'Lifecycle milestone; Running does not guarantee that the node is currently Ready.' },
     { key: 'node', label: 'Node', width: 'w-32 shrink-0' },
     { key: 'version', label: 'Version', width: 'w-24 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
@@ -2443,7 +2450,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'instanceType', label: 'Instance', width: 'w-28 shrink-0' },
-    { key: 'replicas', label: 'Ready', width: 'w-20 shrink-0', tooltip: 'Ready replicas' },
+    { key: 'replicas', label: 'Ready', width: 'w-20 shrink-0', tooltip: "Replicas the provider reports, over the autoscaling maximum when one is set. The second number is a ceiling, not a target, so this is not a ready/desired ratio." },
     { key: 'capacityType', label: 'Capacity', width: 'w-28 shrink-0' },
     { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
@@ -2461,7 +2468,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'instanceType', label: 'Instance', width: 'w-28 shrink-0' },
-    { key: 'capacity', label: 'Capacity', width: 'w-32 shrink-0', tooltip: 'Computed CPU/memory' },
+    { key: 'capacity', label: 'Capacity', width: 'w-32 shrink-0', tooltip: 'Per-node CPU and memory reported by the provider for scale-from-zero estimation.' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   awsmanagedclusters: [
@@ -2486,7 +2493,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'machineType', label: 'Machine Type', width: 'w-32 shrink-0' },
-    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0' },
+    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0', tooltip: "Replicas the provider reports as observed. Not a ready/desired ratio, and the pool's autoscaling bounds are not shown here." },
     { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2525,9 +2532,9 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
     { key: 'sku', label: 'VM Size', width: 'w-32 shrink-0' },
-    { key: 'mode', label: 'Mode', width: 'w-20 shrink-0' },
-    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0' },
-    { key: 'priority', label: 'Priority', width: 'w-24 shrink-0' },
+    { key: 'mode', label: 'Mode', width: 'w-20 shrink-0', tooltip: 'System pools are preferred for critical AKS system pods; User pools are intended for applications. Mode does not enforce workload isolation.' },
+    { key: 'replicas', label: 'Replicas', width: 'w-20 shrink-0', tooltip: "Replicas the provider reports as observed. Not a ready/desired ratio, and the pool's autoscaling bounds are not shown here." },
+    { key: 'priority', label: 'Priority', width: 'w-24 shrink-0', tooltip: 'Spot VMs may be evicted for capacity or price; Regular VMs are not Spot. This is unrelated to Kubernetes scheduling priority.' },
     { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2554,11 +2561,11 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   httpproxies: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'namespace', label: 'Namespace', width: 'w-36 shrink-0' },
-    { key: 'fqdn', label: 'FQDN', width: 'min-w-44' },
+    { key: 'fqdn', label: 'FQDN', width: 'min-w-44', tooltip: 'Virtual-host hostname this proxy declares. A dash means it declares none, which is normal for an included proxy — its routes are served under the roots that include it.' },
     { key: 'routes', label: 'Routes', width: 'w-20 shrink-0' },
-    { key: 'includes', label: 'Includes', width: 'w-24 shrink-0' },
+    { key: 'includes', label: 'Includes', width: 'w-24 shrink-0', tooltip: "Child HTTPProxies this one directly includes. They contribute routing configuration, so a proxy can serve traffic even when its own Routes count is zero." },
     { key: 'tls', label: 'TLS', width: 'w-14 shrink-0' },
-    { key: 'status', label: 'Status', width: 'w-28 shrink-0' },
+    { key: 'status', label: 'Status', width: 'w-28 shrink-0', tooltip: "Contour's verdict on this proxy. Orphaned means no root proxy includes it, so it serves no traffic." },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   // Crossplane — Managed Resources are unbounded (one kind per provider CRD);
@@ -2568,7 +2575,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-32 shrink-0' },
     { key: 'kind', label: 'Kind', width: 'w-32 shrink-0' },
     { key: 'external', label: 'External Name', width: 'min-w-48' },
-    { key: 'provider', label: 'Provider Config', width: 'w-40 shrink-0' },
+    { key: 'provider', label: 'Provider Config', width: 'w-40 shrink-0', tooltip: 'Provider configuration selecting the credentials and connection settings used to manage this external resource.' },
     { key: 'status', label: 'Status', width: 'w-32 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
@@ -2588,14 +2595,14 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
   compositions: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'composite', label: 'Composite Kind', width: 'w-44 shrink-0' },
-    { key: 'mode', label: 'Mode', width: 'w-24 shrink-0' },
+    { key: 'mode', label: 'Mode', width: 'w-24 shrink-0', tooltip: 'Pipeline runs composition functions. Resources uses native patch-and-transform composition and must be migrated before upgrading to Crossplane v2.' },
     { key: 'functions', label: 'Functions', width: 'w-28 shrink-0' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
   compositeresourcedefinitions: [
     { key: 'name', label: 'Name', width: 'min-w-40' },
     { key: 'kind', label: 'Kind', width: 'w-40 shrink-0' },
-    { key: 'claim', label: 'Claim Kind', width: 'w-40 shrink-0' },
+    { key: 'claim', label: 'Claim Kind', width: 'w-40 shrink-0', tooltip: 'Optional namespaced claim kind. Crossplane v2 supports claims only for XRDs using LegacyCluster scope.' },
     { key: 'age', label: 'Age', width: 'w-24 shrink-0' },
   ],
 }
@@ -3138,6 +3145,8 @@ export function mergeSavedVisibleColumns(
   savedVisible: string[],
   extraKeys: string[],
   printerColumns: ExtraColumn[],
+  effective?: Column[],
+  known?: string[],
 ): Set<string> {
   const merged = new Set(savedVisible)
   for (const k of extraKeys) merged.add(k)
@@ -3146,6 +3155,24 @@ export function mergeSavedVisibleColumns(
       if (c.defaultVisible !== false) merged.add(c.key)
     }
   }
+  // Curated columns the blob predates. Same principle as the two above, but it
+  // needs a record of what the user was actually offered: the blob stores only
+  // what is visible, so a curated key's absence is ambiguous between "hidden on
+  // purpose" and "not offered yet". `known` is that record. Without one the two
+  // cases are indistinguishable, so nothing is inferred and visibility is left
+  // to the saved set alone.
+  //
+  // Printer columns are excluded even when `known` lists none of them. They are
+  // fetched, so `known` can be written during the window before the printer
+  // table arrives; treating their absence as "new" would re-show ones the user
+  // hid. Their own rule above already covers them.
+  if (effective && Array.isArray(known)) {
+    const seen = new Set(known)
+    for (const c of effective) {
+      if (c.key.startsWith(PRINTER_COLUMN_PREFIX)) continue
+      if (!seen.has(c.key) && c.defaultVisible !== false) merged.add(c.key)
+    }
+  }
   return merged
 }
 
@@ -3201,6 +3228,10 @@ interface ColumnSettings {
   visible: string[]
   widths: Record<string, number>
   custom?: CustomColumnDef[]
+  /** Every column key the user was offered when this was written. Lets a later
+   *  load tell a column they hid from one that did not exist yet. Absent on
+   *  blobs written before this field. */
+  known?: string[]
 }
 
 function loadColumnSettings(kind: string, group?: string): ColumnSettings | null {
@@ -3778,6 +3809,12 @@ export function ResourcesView({
     return [...filteredExtras, ...kindColumns, ...builtCustomColumns]
   }, [selectedKind.name, selectedKind.group, extraLeadingColumns, builtCustomColumns, builtPrinterColumns])
 
+  // The offered key set, and a stable signature for it. allColumns is a new
+  // identity on every printer-column refetch; depending on the array itself
+  // would rewrite the settings blob on each poll.
+  const allColumnKeys = useMemo(() => allColumns.map(c => c.key), [allColumns])
+  const allColumnKeysSig = allColumnKeys.join('\u0000')
+
   // Map of extra column keys for fast O(1) lookup on each render path
   // (cell render, sort, column-filter unique-values).
   // Recompute header-derived widths once the web font swaps in (see watchHeaderFont).
@@ -3794,6 +3831,13 @@ export function ResourcesView({
   // Guards the save effect from persisting on the initial load of each kind
   // (set false by the load effect, flipped true on its first skipped save).
   const isColumnSettingsLoaded = useRef(false)
+  // Every column key this kind has ever offered, accumulated. A single save
+  // cannot stand in for it: the offered set shrinks as well as grows — an
+  // uncurated kind's generic Status disappears once its printer columns arrive
+  // — and a shrunk snapshot would forget that a column absent from `visible`
+  // was one the user hid rather than one never shown.
+  const knownColumnKeys = useRef<Set<string>>(new Set())
+  const knownColumnKeysKind = useRef('')
   // Whether the user has a persisted column blob for this kind — data-driven
   // column defaults (GPU auto-show) must never override explicit user choices.
   const hadSavedColumnSettings = useRef(false)
@@ -3819,6 +3863,15 @@ export function ResourcesView({
     // (non-array, blank path, bad source) must not crash the later .map or add dead columns.
     const savedCustom = sanitizeCustomColumnDefs(saved?.custom)
     setCustomColumns(savedCustom)
+    // Reset on a kind change only. This effect also re-runs when the printer
+    // columns arrive, and that is the moment the offered set shrinks — clearing
+    // here would drop the evidence for the column they replaced just before the
+    // next save persists the record without it.
+    const knownKeysIdentity = selectedKindIdentityOf(selectedKind)
+    if (knownColumnKeysKind.current !== knownKeysIdentity) {
+      knownColumnKeys.current = new Set()
+      knownColumnKeysKind.current = knownKeysIdentity
+    }
     const kindColumns = columnsForKindWithPrinter(selectedKind.name, selectedKind.group, builtPrinterColumns)
     const builtinKeys = new Set(kindColumns.map(c => c.key))
     const extras = filterHostExtras(extraLeadingColumns, builtinKeys, selectedKind.name)
@@ -3835,18 +3888,32 @@ export function ResourcesView({
       // discard the stale save and use the specialized columns instead. User-added
       // custom columns mean the blob isn't a stale pure-defaults save — keep it, or
       // the migration would clear them from storage (and un-hide hidden ones).
+      // Persisted JSON: only an array of keys is usable, anything else reads as
+      // no record at all.
+      const savedKnown = Array.isArray(saved.known)
+        ? saved.known.filter((k): k is string => typeof k === 'string')
+        : undefined
+      for (const k of savedKnown ?? []) knownColumnKeys.current.add(k)
+
       const defaultKeys = DEFAULT_COLUMNS.map(c => c.key)
+      // A blob carrying an offered-key record is not a pre-curation leftover:
+      // its visible set matching the generic defaults means the user hid their
+      // way down to them, and clearing it would undo exactly that.
       const isStaleDefaults = kindColumns !== DEFAULT_COLUMNS &&
+        !savedKnown &&
         !savedCustom.length &&
         saved.visible.length === defaultKeys.length &&
         saved.visible.every(v => defaultKeys.includes(v))
       if (isStaleDefaults) {
         clearColumnSettings(selectedKind.name, selectedKind.group)
+        knownColumnKeys.current = new Set()
         hadSavedColumnSettings.current = false
         setVisibleColumns(getDefaultVisibleColumns(effective))
         setColumnWidths({})
       } else {
-        setVisibleColumns(mergeSavedVisibleColumns(saved.visible, extraKeys, builtPrinterColumns))
+        setVisibleColumns(mergeSavedVisibleColumns(
+          saved.visible, extraKeys, builtPrinterColumns, effective, savedKnown,
+        ))
         setColumnWidths(saved.widths || {})
       }
     } else {
@@ -3862,6 +3929,7 @@ export function ResourcesView({
   // Save column settings when they change (skip the initial load of each kind)
   useEffect(() => {
     if (visibleColumns.size === 0) return // not loaded yet
+    for (const k of allColumnKeys) knownColumnKeys.current.add(k)
     if (!isColumnSettingsLoaded.current) {
       isColumnSettingsLoaded.current = true
       return
@@ -3870,11 +3938,13 @@ export function ResourcesView({
       visible: Array.from(visibleColumns),
       widths: columnWidths,
       custom: customColumns,
+      known: Array.from(knownColumnKeys.current),
     })
     // A persisted blob blocks GPU auto-show from here on — same rule in-session
     // as across sessions, so a later data refresh can't override user choices.
     hadSavedColumnSettings.current = true
-  }, [visibleColumns, columnWidths, customColumns, selectedKind.name, selectedKind.group])
+    // allColumnKeysSig, not allColumnKeys: see the memo above.
+  }, [visibleColumns, columnWidths, customColumns, selectedKind.name, selectedKind.group, allColumnKeysSig])
 
   // Close column picker on outside click or Escape
   useEffect(() => {
@@ -3977,6 +4047,7 @@ export function ResourcesView({
   // Reset column settings to defaults (also drops user-added custom columns)
   const resetColumnSettings = useCallback(() => {
     clearColumnSettings(selectedKind.name, selectedKind.group)
+    knownColumnKeys.current = new Set()
     setCustomColumns([])
     const customKeys = new Set(builtCustomColumns.map(c => c.key))
     setVisibleColumns(getDefaultVisibleColumns(allColumns.filter(c => !customKeys.has(c.key))))
@@ -5016,8 +5087,10 @@ export function ResourcesView({
         // DaemonSet: numberAvailable, others: availableReplicas
         return status.numberAvailable ?? status.availableReplicas ?? 0
       case 'upToDate':
-        // DaemonSet: updatedNumberScheduled, others: updatedReplicas
-        return status.updatedNumberScheduled ?? status.updatedReplicas ?? 0
+        // DaemonSet: updatedNumberScheduled; CAPI v1beta2: upToDateReplicas;
+        // others: updatedReplicas. Same precedence the cells display, or a row
+        // sorts as zero while showing a real count.
+        return status.updatedNumberScheduled ?? status.upToDateReplicas ?? status.updatedReplicas ?? 0
       case 'restarts':
         if (kindLower === 'jobsets') return getJobSetRestarts(resource)
         return getPodRestarts(resource)
@@ -8899,11 +8972,11 @@ function RouteCell({ resource, column }: { resource: any; column: string }) {
   switch (column) {
     case 'status': {
       const status = getRouteStatus(resource)
-      return (
-        <span className={clsx('badge', status.color)}>
-          {status.text}
-        </span>
-      )
+      const reason = getRouteStatusReason(resource)
+      const badge = <span className={clsx('badge', status.color)}>{status.text}</span>
+      // "Degraded" on its own says something is wrong and not what. The
+      // controller's own reason is usually "the backend you named is missing".
+      return reason ? <Tooltip content={reason}>{badge}</Tooltip> : badge
     }
     case 'hostnames': {
       const hostnames = getRouteHostnames(resource)