@skyhook-io/k8s-ui 1.14.9 → 1.14.11

package/src/components/resources/KueueAdmissionSection.test.tsx

@@ -0,0 +1,95 @@
+import { renderToStaticMarkup } from 'react-dom/server'
+import { describe, expect, it } from 'vitest'
+import { KueueAdmissionSection } from './KueueAdmissionSection'
+import type { KueueAdmissionResponse, SchedulingObservation } from '../../types/scheduling'
+
+const ref = { kind: 'Workload', group: 'kueue.x-k8s.io', namespace: 'ml', name: 'training-abc' }
+function response(observation: Partial<SchedulingObservation> = {}): KueueAdmissionResponse {
+  return { uid: 'root-uid', installed: true, total: 1, truncated: false, workloads: [{
+    apiVersion: 'kueue.x-k8s.io/v1beta2', name: ref.name, namespace: 'ml', uid: 'uid', generation: 2, createdAt: null, deleting: false, ref, projection: 'available', linksLimited: false,
+    scheduling: { observations: [{ source: 'kueue', domain: 'admission', subject: ref, subjectGeneration: 2, decision: 'unsatisfied', kueue: { phase: 'pending' }, ...observation }] },
+  }] }
+}
+function render(data?: KueueAdmissionResponse, props: Partial<React.ComponentProps<typeof KueueAdmissionSection>> = {}) {
+  return renderToStaticMarkup(<KueueAdmissionSection data={data} loading={false} hinted={false} externalExecution={false} onNavigate={() => {}} {...props} />)
+}
+
+describe('Kueue admission investigation', () => {
+  it('hides confirmed empty unhinted roots but preserves unavailable and in-flight evidence', () => {
+    const empty = { uid: 'root-uid', installed: true, total: 0, truncated: false, workloads: [] }
+    expect(render(empty)).toBe('')
+    expect(render(empty, { hinted: true })).toContain('No controller-owned Kueue Workload observed')
+    expect(render(undefined, { loading: true })).toContain('Looking for controller-owned Workloads')
+    expect(render(empty, { error: 'Forbidden', onRetry: () => {} })).toContain('Admission evidence unavailable')
+    expect(render(empty, { error: 'Cache not ready' })).not.toContain('No controller-owned')
+    expect(render(empty, { error: 'Workload list denied', forbidden: true, onRetry: () => {} })).not.toContain('Retry admission lookup')
+    expect(render({ ...empty, installed: false }, { hinted: true })).toContain('not served by this cluster')
+  })
+
+  it('does not claim that local absence proves remote execution failed', () => {
+    expect(render({ uid: 'root-uid', installed: true, total: 0, truncated: false, workloads: [] }, { hinted: true, externalExecution: true })).toContain('local absence does not establish remote admission or execution state')
+  })
+
+  it('shows reported queue reasons and stale generation without inferring causality', () => {
+    const html = render(response({ primaryCondition: { type: 'QuotaReserved', status: 'False', reason: 'Inadmissible', message: 'ClusterQueue training is inactive', observedGeneration: 1 }, queues: [{ name: 'ready', roles: ['submission'] }] }))
+    expect(html).toContain('Inadmissible')
+    expect(html).toContain('ClusterQueue training is inactive')
+    expect(html).toContain('stale evidence')
+    expect(html).toContain('submission queue: ready')
+    expect(html).not.toContain('suspended because')
+  })
+
+  it.each([
+    ['pending', 'Pending admission'], ['quota_reserved', 'Quota reserved'], ['admitted', 'Admitted'], ['finished', 'Finished'],
+  ] as const)('preserves native phase %s', (phase, label) => {
+    const html = render(response({ decision: 'satisfied', kueue: { phase } }))
+    expect(html).toContain(label)
+    expect(html).toContain('does not prove that Jobs or Pods are running')
+  })
+
+  it('keeps disruptions, inactive state, check retries and requeues distinct', () => {
+    const html = render(response({ decision: 'held', kueue: { phase: 'pending', active: false, requeueState: { count: 0, requeueAt: '2026-09-22T00:00:00Z' } }, disruptions: [{ type: 'Evicted', status: 'True', reason: 'Preempted' }], gates: [{ kind: 'preemption_gate', name: 'gate', decision: 'unsatisfied', retryCount: 0, requeueAfterSeconds: 0 }] }))
+    expect(html).toContain('Workload inactive')
+    expect(html).toContain('Preempted')
+    expect(html).toContain('alone does not establish an admission blocker')
+    expect(html).toContain('Retries: 0')
+    expect(html).toContain('Requeues: 0')
+  })
+
+  it('does not turn unsupported or unreadable Workloads into an absent association', () => {
+    const data = response()
+    data.workloads[0].projection = 'unsupported'
+    data.workloads[0].apiVersion = 'kueue.x-k8s.io/v1beta1'
+    expect(render(data)).toContain('Scheduling projection is unavailable for kueue.x-k8s.io/v1beta1')
+    data.workloads[0].projection = 'forbidden'
+    data.workloads[0].ref = undefined
+    const html = render(data)
+    expect(html).toContain('permission to get this Workload is required')
+    expect(html).not.toContain('<button')
+  })
+
+  it('does not present an unrecognized finish reason as a successful outcome', () => {
+    const html = render(response({ decision: 'unknown', primaryCondition: { type: 'Finished', status: 'True', reason: 'CustomFinish' }, kueue: { phase: 'finished' } }))
+    expect(html).toContain('CustomFinish')
+    expect(html).toContain('lucide-minus')
+    expect(html).not.toContain('lucide-check')
+  })
+
+  it('shows a deactivation condition once when it is also the primary evidence', () => {
+    const condition = { type: 'DeactivationTarget', status: 'True', reason: 'AdmissionCheck' }
+    const html = render(response({ decision: 'held', primaryCondition: condition, disruptions: [condition], kueue: { phase: 'pending', active: false } }))
+    expect(html).toContain('Primary condition: DeactivationTarget')
+    expect(html.match(/AdmissionCheck/g)).toHaveLength(1)
+  })
+
+  it('keeps bounded records separate and never names the newest as current', () => {
+    const data = response()
+    data.total = 9
+    data.truncated = true
+    data.workloads.push({ ...data.workloads[0], uid: 'second', name: 'older', deleting: true })
+    const html = render(data)
+    expect(html).toContain('2 of 9 Workloads shown')
+    expect(html).toContain('order does not identify a current attempt')
+    expect(html).toContain('Deleting')
+  })
+})

package/src/components/resources/KueueAdmissionSection.tsx

@@ -0,0 +1,87 @@
+import { isKueueConditionStale } from './resource-utils-kueue'
+import { Badge } from '../ui/Badge'
+import { AlertBanner, ConditionsSection, ResourceLink } from '../ui/drawer-components'
+import { kindToPluralWithGroup } from '../../utils/navigation'
+import type { KueueAdmissionResponse, SchedulingObservation, SchedulingRef } from '../../types/scheduling'
+
+interface KueueAdmissionSectionProps {
+  data?: KueueAdmissionResponse
+  loading: boolean
+  error?: string
+  forbidden?: boolean
+  hinted: boolean
+  externalExecution: boolean
+  onRetry?: () => void
+  onNavigate?: (ref: { kind: string; namespace: string; name: string; group?: string }) => void
+}
+
+const phases = { pending: 'Pending admission', quota_reserved: 'Quota reserved', admitted: 'Admitted', finished: 'Finished' }
+
+export function KueueAdmissionSection({ data, loading, error, forbidden, hinted, externalExecution, onRetry, onNavigate }: KueueAdmissionSectionProps) {
+  if (!loading && !error && data && data.workloads.length === 0 && !hinted) return null
+  const link = (name: string, ref?: SchedulingRef) => ref
+    ? <ResourceLink {...ref} kind={kindToPluralWithGroup(ref.kind, ref.group ?? '')} label={name} onNavigate={onNavigate} />
+    : name
+  return (
+    <section className="rounded-lg border border-theme-border bg-theme-surface p-4" aria-label="Kueue admission">
+      <h3 className="text-sm font-semibold text-theme-text-primary">Kueue admission</h3>
+      <p className="mt-1 text-xs text-theme-text-secondary">Admission and execution are separate observations. An admitted Workload does not prove that Jobs or Pods are running.</p>
+      {loading ? <p className="mt-3 text-sm text-theme-text-secondary">Looking for controller-owned Workloads…</p>
+        : error ? <div className="mt-3 [&>div]:mb-0"><AlertBanner variant={forbidden ? 'info' : 'warning'} title={forbidden ? 'Admission lookup requires permission' : 'Admission evidence unavailable'} message={error}>{!forbidden && onRetry && <button type="button" className="mt-2 text-accent-text hover:underline" onClick={onRetry}>Retry admission lookup</button>}</AlertBanner></div>
+          : data && !data.installed ? <p className="mt-3 text-sm text-theme-text-secondary">Kueue Workloads are not served by this cluster.</p>
+            : data && data.workloads.length === 0 ? <p className="mt-3 text-sm text-theme-text-secondary">No controller-owned Kueue Workload observed in this namespace.{externalExecution ? ' This JobSet uses an external controller; local absence does not establish remote admission or execution state.' : ' Queue metadata alone does not establish an admission decision.'}</p>
+              : data && <div className="mt-3 space-y-3">
+                {data.total > 1 && <p className="text-xs text-theme-text-secondary">{data.truncated ? `${data.workloads.length} of ${data.total}` : data.total} Workloads shown, newest first. Each is a separate controller-owned record; order does not identify a current attempt.</p>}
+                {data.workloads.map((workload) => <article key={workload.uid} className="card-inner space-y-2 text-sm">
+                  <div className="flex flex-wrap items-center gap-2"><span className="font-medium">{link(workload.name, workload.ref)}</span>{workload.deleting && <Badge severity="alert">Deleting</Badge>}<span className="text-xs text-theme-text-tertiary">Generation {workload.generation}</span></div>
+                  {workload.projection === 'unsupported' ? <p className="text-theme-text-secondary">Associated Workload found. Scheduling projection is unavailable for {workload.apiVersion}; inspect the resource for native evidence.</p>
+                    : workload.projection === 'forbidden' ? <p className="text-theme-text-secondary">Associated Workload found, but permission to get this Workload is required for its scheduling detail.</p>
+                      : workload.scheduling?.observations?.map((observation, index) => <AdmissionObservation key={index} observation={observation} link={link} />)}
+                  {workload.linksLimited && <p className="text-xs text-theme-text-tertiary">Some resource links are unavailable. Names already reported by the Workload remain visible.</p>}
+                </article>)}
+              </div>}
+    </section>
+  )
+}
+
+function AdmissionObservation({ observation, link }: { observation: SchedulingObservation; link: (name: string, ref?: SchedulingRef) => React.ReactNode }) {
+  const kueue = observation.kueue
+  const condition = observation.primaryCondition
+  const stale = isKueueConditionStale(condition, observation.subjectGeneration)
+  const conditions = [condition, ...(observation.disruptions ?? []), kueue?.podsReady, kueue?.waitingForReplacementPods]
+    .filter((entry) => entry != null)
+    .filter((entry, index, entries) => entries.findIndex((candidate) => candidate.type === entry.type) === index)
+  return <div className="space-y-2">
+    <div className="flex flex-wrap items-center gap-2">
+      <Badge severity={stale || observation.decision === 'unknown' ? 'neutral' : observation.decision === 'satisfied' ? 'success' : 'warning'}>{kueue ? phases[kueue.phase] : 'Admission'}</Badge>
+      <span className="text-theme-text-secondary">Decision: {observation.decision}</span>
+      {kueue?.outcome && <span>Outcome: {kueue.outcome}</span>}
+      {kueue?.active === false && <span>Workload inactive</span>}
+    </div>
+    {stale && <p className="text-sm text-theme-text-secondary">The primary condition describes generation {condition!.observedGeneration}; this Workload is now generation {observation.subjectGeneration}. Treat that condition as stale evidence.</p>}
+    {condition && <p className="text-xs text-theme-text-secondary">Selected admission evidence · Primary condition: {condition.type}</p>}
+    {!condition && <p className="text-theme-text-secondary">No primary admission condition reported.</p>}
+    <ConditionsSection
+      conditions={conditions}
+      defaultExpanded={true}
+      getConditionTone={(entry) => {
+        if (entry.status !== 'True' && entry.status !== 'False') return 'unknown'
+        if (isKueueConditionStale(entry, observation.subjectGeneration)) return 'unknown'
+        if (entry.type === 'Finished') return entry.status === 'False' ? 'unknown' : kueue?.outcome === 'failed' ? 'fail' : kueue?.outcome === 'succeeded' ? 'ok' : 'unknown'
+        if (entry.type === condition?.type) return observation.decision === 'satisfied' ? 'ok' : observation.decision === 'unknown' ? 'unknown' : 'warning'
+        if (entry.type === 'WaitingForReplacementPods' || observation.disruptions?.some((item) => item.type === entry.type)) return entry.status === 'True' ? 'warning' : 'ok'
+        return entry.status === 'True' ? 'ok' : 'warning'
+      }}
+    />
+    {!!observation.queues?.length && <div className="flex flex-wrap gap-x-5 gap-y-1 text-xs">{observation.queues.map((queue, index) => <span key={index}>{queue.roles.join(' + ')} queue: {link(queue.name, queue.ref)}</span>)}</div>}
+    {observation.gates?.map((gate, index) => <div key={index} className="border-l-2 border-theme-border pl-3 text-xs text-theme-text-secondary">
+      <p>{gate.kind === 'preemption_gate' ? 'Preemption gate' : 'Admission check'}: {link(gate.name, gate.ref)} · {gate.nativeState || gate.decision}</p>
+      {gate.message && <p className="whitespace-pre-wrap break-words">{gate.message}</p>}
+      {gate.kind === 'preemption_gate' && <p>This gate governs preemption; it alone does not establish an admission blocker.</p>}
+      {gate.retryCount != null && <p>Retries: {gate.retryCount}</p>}
+      {gate.requeueAfterSeconds != null && <p>Requeue delay: {gate.requeueAfterSeconds}s</p>}
+    </div>)}
+    {kueue?.requeueState && <p className="text-xs text-theme-text-secondary">Requeues: {kueue.requeueState.count ?? 'Not reported'}{kueue.requeueState.requeueAt && ` · Eligible again: ${kueue.requeueState.requeueAt}`}</p>}
+    {kueue?.concurrentAdmission && <p className="text-xs">Parent Workload: {link(kueue.concurrentAdmission.parentName, kueue.concurrentAdmission.parentRef)}</p>}
+  </div>
+}

package/src/components/resources/ResourcesView.default-sort.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from 'vitest'
+import { sanitizeSavedSort } from './ResourcesView'
+
+// The per-kind column record crosses the localStorage boundary, so a saved sort
+// can be anything a hand edit or an older build left there.
+describe('sanitizeSavedSort', () => {
+  it('accepts a column with a known direction', () => {
+    expect(sanitizeSavedSort({ column: 'age', direction: 'desc' })).toEqual({ column: 'age', direction: 'desc' })
+    expect(sanitizeSavedSort({ column: 'label:app', direction: 'asc' })).toEqual({ column: 'label:app', direction: 'asc' })
+  })
+
+  it('reads a missing or malformed record as no saved sort', () => {
+    expect(sanitizeSavedSort(undefined)).toBeNull()
+    expect(sanitizeSavedSort(null)).toBeNull()
+    expect(sanitizeSavedSort('age')).toBeNull()
+    expect(sanitizeSavedSort({})).toBeNull()
+    expect(sanitizeSavedSort({ column: '', direction: 'asc' })).toBeNull()
+    expect(sanitizeSavedSort({ column: 'age' })).toBeNull()
+    expect(sanitizeSavedSort({ column: 'age', direction: 'sideways' })).toBeNull()
+    expect(sanitizeSavedSort({ column: 42, direction: 'asc' })).toBeNull()
+  })
+
+  it('drops fields it does not know rather than carrying them into state', () => {
+    expect(sanitizeSavedSort({ column: 'name', direction: 'asc', extra: true })).toEqual({ column: 'name', direction: 'asc' })
+  })
+})

package/src/components/resources/ResourcesView.tsx

@@ -980,7 +980,7 @@ const KNOWN_COLUMNS: Record<string, Column[]> = {
     { key: 'namespace', label: 'Namespace', width: 'w-36' },
     { key: 'status', label: 'Status', width: 'w-28' },
     { key: 'rayVersion', label: 'Ray Version', width: 'w-28' },
-    { key: 'workers', label: 'Workers', width: 'w-24', tooltip: 'Available/desired worker replicas' },
+    { key: 'workers', label: 'Workers', width: 'w-24', tooltip: 'Ready/desired worker Pods' },
     { key: 'headService', label: 'Head Service', width: 'w-48' },
     { key: 'age', label: 'Age', width: 'w-24' },
   ],
@@ -3071,6 +3071,17 @@ export function getCellFilterKind(kind: string, group?: string): string {
   return `__generic_${normalized}`
 }
 
+// A sort read back from localStorage. Anything but a non-empty column and a
+// known direction reads as "no saved sort" rather than crashing the comparator
+// or driving the order with a direction it does not understand.
+export function sanitizeSavedSort(raw: unknown): { column: string; direction: 'asc' | 'desc' } | null {
+  if (!raw || typeof raw !== 'object') return null
+  const { column, direction } = raw as { column?: unknown; direction?: unknown }
+  if (typeof column !== 'string' || !column) return null
+  if (direction !== 'asc' && direction !== 'desc') return null
+  return { column, direction }
+}
+
 // Get the default visible columns for a kind
 function getDefaultVisibleColumns(columns: Column[]): Set<string> {
   return new Set(columns.filter(c => c.defaultVisible !== false).map(c => c.key))
@@ -3272,6 +3283,26 @@ function saveColumnSettings(kind: string, group: string | undefined, settings: C
   } catch { /* ignore */ }
 }
 
+const SORT_SETTINGS_PREFIX = 'radar-sort-'
+
+// Kept apart from the column record on purpose: a column record's existence
+// is read as "the user chose columns" (GPU auto-show stands down, the
+// stale-defaults migration is skipped), and a sort alone is not that choice.
+function loadSavedSort(kind: string, group?: string): { column: string; direction: 'asc' | 'desc' } | null {
+  try {
+    const raw = localStorage.getItem(SORT_SETTINGS_PREFIX + columnSettingsKey(kind, group))
+    return raw ? sanitizeSavedSort(JSON.parse(raw)) : null
+  } catch { return null }
+}
+
+function saveSavedSort(kind: string, group: string | undefined, sort: { column: string; direction: 'asc' | 'desc' } | null) {
+  try {
+    const key = SORT_SETTINGS_PREFIX + columnSettingsKey(kind, group)
+    if (sort) localStorage.setItem(key, JSON.stringify(sort))
+    else localStorage.removeItem(key)
+  } catch { /* ignore */ }
+}
+
 function clearColumnSettings(kind: string, group?: string) {
   try {
     const key = COLUMN_SETTINGS_PREFIX + columnSettingsKey(kind, group)
@@ -3859,6 +3890,30 @@ export function ResourcesView({
     return m
   }, [extraLeadingColumns, builtCustomColumns, builtPrinterColumns])
 
+  // Sortable columns outside KNOWN_COLUMNS, as a value-stable key list. Keyed
+  // on the joined keys rather than the map itself: a host that rebuilds
+  // extraLeadingColumns on every render would otherwise re-run the sort-apply
+  // effect every render and wipe whatever the user just sorted by.
+  // Keys this table renders with a sort control, joined rather than kept as an
+  // array: a host that rebuilds extraLeadingColumns every render would give an
+  // identity-keyed dependency a new value each time, and the apply effect below
+  // would wipe whatever the user just sorted by on every render.
+  const sortableColumnKeys = useMemo(
+    () => allColumns.filter(c => isColumnSortable(c, extraColumnsByKey)).map(c => c.key).sort().join('\n'),
+    [allColumns, extraColumnsByKey],
+  )
+
+  const canSortBy = useCallback(
+    (column: string) => (sortableColumnKeys ? sortableColumnKeys.split('\n') : []).includes(column),
+    [sortableColumnKeys],
+  )
+  // A restored sort can name a column this table does not render right now: a
+  // custom column that was removed, a CRD whose printer columns changed, or one
+  // that simply has not loaded yet. Applying it would order rows by an absent
+  // value with no header arrow to undo it from, so it applies only while the
+  // column is actually sortable here, and springs back the moment it is.
+  const effectiveSortColumn = sortColumn && canSortBy(sortColumn) ? sortColumn : null
+
   // Guards the save effect from persisting on the initial load of each kind
   // (set false by the load effect, flipped true on its first skipped save).
   const isColumnSettingsLoaded = useRef(false)
@@ -3894,6 +3949,12 @@ export function ResourcesView({
     // (non-array, blank path, bad source) must not crash the later .map or add dead columns.
     const savedCustom = sanitizeCustomColumnDefs(saved?.custom)
     setCustomColumns(savedCustom)
+    // Restored as saved. Whether this table can sort by it right now is decided
+    // at render time (effectiveSortColumn), because the rendered column set is
+    // not settled here: printer columns and custom columns land later.
+    const savedSort = loadSavedSort(selectedKind.name, selectedKind.group)
+    setSortColumn(savedSort?.column ?? null)
+    setSortDirection(savedSort?.direction ?? null)
     // Reset on a kind change only. This effect also re-runs when the printer
     // columns arrive, and that is the moment the offered set shrinks — clearing
     // here would drop the evidence for the column they replaced just before the
@@ -4083,6 +4144,9 @@ export function ResourcesView({
     const customKeys = new Set(builtCustomColumns.map(c => c.key))
     setVisibleColumns(getDefaultVisibleColumns(allColumns.filter(c => !customKeys.has(c.key))))
     setColumnWidths({})
+    setSortColumn(null)
+    setSortDirection(null)
+    saveSavedSort(selectedKind.name, selectedKind.group, null)
     isColumnSettingsLoaded.current = false
     // Back to data-driven defaults: re-arm GPU auto-show for this kind.
     hadSavedColumnSettings.current = false
@@ -5016,7 +5080,7 @@ export function ResourcesView({
     isForbiddenError(selectedQueryError) ||
     (!selectedHasRows && !selectedQueryError && forbiddenKinds.has(selectedKindCountKey))
 
-  // Reset sort and filters when kind changes (but not when syncing from URL navigation)
+  // Reset filters when kind changes (but not when syncing from URL navigation)
   // Track previous kind to skip on mount (where the effect fires but kind hasn't actually changed)
   // Keyed on group as well as plural: two CRDs can share a plural across API
   // groups, and their printer columns are unrelated. Resetting on the plural
@@ -5029,8 +5093,6 @@ export function ResourcesView({
       return
     }
     prevKindRef.current = selectedKindIdentity
-    setSortColumn(null)
-    setSortDirection(null)
     setOpenColumnFilter(null)
     if (!isSyncingFromURL.current) {
       setColumnFilters({})
@@ -5041,21 +5103,34 @@ export function ResourcesView({
 
   // Toggle sort for a column
   const handleSort = useCallback((column: string) => {
+    // The N/A/S shortcuts fire on every kind, including ones with no such
+    // column. Sorting is a no-op there, but it would still be saved for this
+    // kind and come back as an invisible sort next visit.
+    if (!canSortBy(column)) return
+    let newColumn: string | null
+    let newDirection: SortDirection
+
     if (sortColumn === column) {
       // Cycle: asc -> desc -> null
       if (sortDirection === 'asc') {
-        setSortDirection('desc')
+        newColumn = column
+        newDirection = 'desc'
       } else if (sortDirection === 'desc') {
-        setSortColumn(null)
-        setSortDirection(null)
+        newColumn = null
+        newDirection = null
       } else {
-        setSortDirection('asc')
+        newColumn = column
+        newDirection = 'asc'
       }
     } else {
-      setSortColumn(column)
-      setSortDirection('asc')
+      newColumn = column
+      newDirection = 'asc'
     }
-  }, [sortColumn, sortDirection])
+
+    setSortColumn(newColumn)
+    setSortDirection(newDirection)
+    saveSavedSort(selectedKind.name, selectedKind.group, newColumn && newDirection ? { column: newColumn, direction: newDirection } : null)
+  }, [sortColumn, sortDirection, canSortBy, selectedKind.name, selectedKind.group])
 
   // Get sortable value from a resource for a given column
   const getSortValue = useCallback((resource: any, column: string, kind?: string): string | number => {
@@ -5292,15 +5367,15 @@ export function ResourcesView({
 
     // Apply custom sorting if set. Extra columns override
     // the built-in getSortValue for their key.
-    if (sortColumn && sortDirection) {
-      const extra = extraColumnsByKey.get(sortColumn)
+    if (effectiveSortColumn && sortDirection) {
+      const extra = extraColumnsByKey.get(effectiveSortColumn)
       // Normalized, matching the filter call sites: a group-qualified kind
       // (istiogateways, cnpgclusters) otherwise arrives here as its bare plural
       // and misses its own sort readers. Hoisted out of the comparator.
       // The ownership-aware wrapper also keeps a foreign CRD that reuses a
       // curated plural on the generic reader used by its cells and filters.
       const sortKind = getCellFilterKind(selectedKind.name, selectedKind.group)
-      const keyOf = extra?.getSortValue ?? ((r: any) => getSortValue(r, sortColumn, sortKind))
+      const keyOf = extra?.getSortValue ?? ((r: any) => getSortValue(r, effectiveSortColumn, sortKind))
       // Derived once per row, not once per comparison: a sort visits O(n log n)
       // pairs, and the status key now runs a per-kind status derivation.
       const decorated = result.map((r: any) => ({ r, k: keyOf(r) }))
@@ -5386,7 +5461,7 @@ export function ResourcesView({
     }
 
     return result
-  }, [resources, deferredSearchTerm, regexMode, searchRegex, columnFilters, columnFilterExcludes, problemFilters, showInactiveReplicaSets, labelSelector, ownerKind, ownerName, selectedKind.name, sortColumn, sortDirection, getSortValue, extraColumnsByKey, podMatchesProblemFilter])
+  }, [resources, deferredSearchTerm, regexMode, searchRegex, columnFilters, columnFilterExcludes, problemFilters, showInactiveReplicaSets, labelSelector, ownerKind, ownerName, selectedKind.name, effectiveSortColumn, sortDirection, getSortValue, extraColumnsByKey, podMatchesProblemFilter])
 
   // For nodes table: compute the majority minor version so outliers can be highlighted
   const majorityNodeMinorVersion = useMemo(() => {
@@ -6439,7 +6514,7 @@ export function ResourcesView({
                   {columns.map((col, colIdx) => {
                     // Built-in sortable keys, plus any extra/custom column that carries its own getSortValue.
                     const isSortable = isColumnSortable(col, extraColumnsByKey)
-                    const isSorted = sortColumn === col.key
+                    const isSorted = effectiveSortColumn === col.key
                     const isLastCol = colIdx === columns.length - 1
                     const filterCol = filterableColumnMap.get(col.key)
                     const activeFilterValues = columnFilters[col.key] || []

package/src/components/resources/curated-column-ownership.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { readFileSync } from 'fs'
 import { join } from 'path'
+import { parse } from 'yaml'
 import { hasCuratedColumns } from './ResourcesView'
 
 // Parsed from the source rather than exported: this asserts a property of the
@@ -28,6 +29,50 @@ function objectKeys(declName: string): string[] {
 const CURATED = objectKeys('const KNOWN_COLUMNS')
 const OWNED = new Set(objectKeys('const CURATED_COLUMN_GROUPS'))
 
+describe('Radar Cloud integration read baseline coverage', () => {
+  const root = join(__dirname, '../../../../..')
+  const policy = parse(readFileSync(join(root, 'deploy/helm/radar/files/integration-read-baseline.yaml'), 'utf8')) as {
+    entries: { group: string; resources: string[]; scope: string; decision: string }[]
+  }
+
+  it('requires an explicit permission decision for every curated API identity', () => {
+    const aliases = new Map<string, Set<string>>()
+    for (const [, resource, body] of objectBody('const GROUP_QUALIFIED_COLUMN_KEYS').matchAll(/^ {2}([a-z0-9_]+):\s*\{([^}]+)\}/gm)) {
+      for (const [, group, key] of body.matchAll(/'([^']+)':\s*'([^']+)'/g)) {
+        const identity = `${group}/${key}`
+        const plurals = aliases.get(identity) ?? new Set<string>()
+        plurals.add(resource)
+        aliases.set(identity, plurals)
+      }
+    }
+    const missing: string[] = []
+    let checked = 0
+    for (const [, key, groups] of objectBody('const CURATED_COLUMN_GROUPS').matchAll(/^ {2}([a-z0-9_]+):\s*\[([^\]]+)\]/gm)) {
+      checked++
+      for (const [, group] of groups.matchAll(/'([^']+)'/g)) {
+        const candidates = aliases.get(`${group}/${key}`) ?? new Set([key])
+        if (!policy.entries.some(e => e.group === group && e.resources.some(r => candidates.has(r)))) {
+          missing.push(`${group}/${key}`)
+        }
+      }
+    }
+    expect(missing).toEqual([])
+    expect(checked).toBe(OWNED.size)
+    expect(policy.entries.length).toBeGreaterThan(0)
+  })
+
+  it('matches the exact plural and scope of pinned GPU ecosystem CRDs', () => {
+    const rows = readFileSync(join(root, 'scripts/gpu-ecosystem-demo/resources.tsv'), 'utf8')
+      .split('\n').filter(line => line && !line.startsWith('#'))
+    for (const row of rows) {
+      const [, group, resource, , scope] = row.split('\t')
+      const entry = policy.entries.find(e => e.group === group && e.resources.includes(resource))
+      expect(entry, `${group}/${resource}`).toBeDefined()
+      expect(entry?.scope, `${group}/${resource}`).toBe(scope)
+    }
+  })
+})
+
 // Curated sets keyed on a kind the API server reserves. A CRD cannot be created
 // in a core group, so these can never be claimed by a foreign resource.
 const CORE_KEYS = new Set([

package/src/components/resources/renderers/CAPIClusterRenderer.tsx

@@ -9,9 +9,10 @@ interface Props {
   data: any
   onNavigate?: (ref: { kind: string; namespace: string; name: string; group?: string }) => void
   apiBase?: string
+  canConnect?: boolean
 }
 
-export function CAPIClusterRenderer({ data, onNavigate, apiBase = '' }: Props) {
+export function CAPIClusterRenderer({ data, onNavigate, apiBase = '', canConnect = true }: Props) {
   const status = data.status || {}
   const spec = data.spec || {}
   const conditions = status.v1beta2?.conditions || status.conditions || []
@@ -125,7 +126,7 @@ export function CAPIClusterRenderer({ data, onNavigate, apiBase = '' }: Props) {
 
       {/* Kubeconfig Actions */}
       <div className="px-3 py-2 flex items-center gap-2">
-        <button
+        {canConnect && <button
           onClick={handleConnectToCluster}
           disabled={connectState === 'loading' || connectState === 'success'}
           className="btn-brand flex items-center gap-1.5 text-xs px-3 py-1.5 rounded-md"
@@ -135,7 +136,7 @@ export function CAPIClusterRenderer({ data, onNavigate, apiBase = '' }: Props) {
           {connectState === 'error' && <AlertCircle className="w-3.5 h-3.5" />}
           {connectState === 'idle' && <Globe className="w-3.5 h-3.5" />}
           {connectState === 'loading' ? 'Connecting...' : connectState === 'success' ? 'Connected — reloading...' : 'Connect to Cluster'}
-        </button>
+        </button>}
         <button
           onClick={handleDownloadKubeconfig}
           disabled={downloadState === 'loading'}

package/src/components/resources/renderers/ContainerEnvironmentSection.tsx

@@ -20,10 +20,12 @@ import {
 import { clsx } from 'clsx'
 import type {
   PodEnvironmentResponse,
+  PodEnvironmentEvidence,
   PodEnvironmentRevealResponse,
   PodEnvironmentRow,
   PodEnvironmentSource,
 } from '../../../types'
+import { formatLogTimestamp } from '../../../utils/log-format'
 import { Badge, type BadgeSeverity } from '../../ui/Badge'
 import { Section, type CopyHandler } from '../../ui/drawer-components'
 import { Tooltip } from '../../ui/Tooltip'
@@ -501,7 +503,7 @@ function CompactStatusCell({ row }: { row: PodEnvironmentRow }) {
       : row.evidence.kind === 'removed'
         ? 'Removed after start'
         : 'Changed after start'
-    return <CompactStatusBadge label={label} explanation={row.evidence.message} severity="warning" icon={<History className="h-3.5 w-3.5" aria-hidden />} />
+    return <CompactStatusBadge label={label} explanation={changeEvidenceExplanation(row.evidence)} severity="warning" icon={<History className="h-3.5 w-3.5" aria-hidden />} />
   }
   if (row.state === 'denied') return <CompactStatusBadge label="Access needed" explanation={row.message} severity="info" icon={<LockKeyhole className="h-3.5 w-3.5" aria-hidden />} />
   if (row.runtimeDependent) return <CompactStatusBadge label="At startup" explanation={row.message} severity="neutral" icon={<Minus className="h-3.5 w-3.5" aria-hidden />} />
@@ -545,7 +547,7 @@ function StatusCell({ row }: { row: PodEnvironmentRow }) {
       : row.evidence.kind === 'removed'
         ? 'Removed after start'
         : 'Changed after start'
-    return <StatusBadge explanation={row.evidence.message}><Badge severity="warning" size="sm">{label}</Badge></StatusBadge>
+    return <StatusBadge explanation={changeEvidenceExplanation(row.evidence)}><Badge severity="warning" size="sm">{label}</Badge></StatusBadge>
   }
   if (row.state === 'denied') return <StatusBadge explanation={row.message}><Badge severity="info" size="sm">Access needed</Badge></StatusBadge>
   if (row.runtimeDependent) return <StatusBadge explanation={row.message}><Badge severity="neutral" size="sm">At startup</Badge></StatusBadge>
@@ -556,10 +558,15 @@ function StatusCell({ row }: { row: PodEnvironmentRow }) {
 
 function missingStatus(row: PodEnvironmentRow) {
   const label = row.missingImpact === 'restartBlocked' ? 'Restart blocked' : 'Prevents start'
-  const explanation = [row.message, row.evidence?.message].filter(Boolean).join(' ')
+  const explanation = [row.message, changeEvidenceExplanation(row.evidence)].filter(Boolean).join(' ')
   return { label, explanation }
 }
 
+function changeEvidenceExplanation(evidence?: PodEnvironmentEvidence) {
+  if (!evidence) return undefined
+  return [evidence.message, `Change observed at ${formatLogTimestamp(evidence.changedAt, 'iso-utc')}.`].filter(Boolean).join(' ')
+}
+
 function hasEnvironmentStatus(row: PodEnvironmentRow) {
   return Boolean(row.evidence)
     || row.state === 'denied'