@skyhook-io/k8s-ui 1.17.0 → 1.17.1

package/src/components/cnpg/relations.ts

@@ -1,9 +1,9 @@
+import { normalizeURLForComparison } from '../../utils/url-path'
+import { cnpgBackupDeclaration, cnpgBackupDestinationBlocker, cnpgBackupBlockerText } from '../../utils/cnpg-backup'
 // Pure relationship lookups between CloudNativePG objects in the workspace
 // payload. Each helper answers only from what the objects record; a relation
 // that cannot be established returns null or an empty list, never a guess.
 
-import type { BadgeSeverity } from '../ui/Badge'
-import type { HealthLevel } from '../resources/resource-utils'
 import {
   CNPG_BARMAN_PLUGIN_NAME,
   CNPG_GROUP,
@@ -12,15 +12,8 @@ import {
   isApiGroup,
   type CNPGObjectStoreRecoveryWindow,
 } from '../resources/resource-utils-cnpg'
-import {
-  cnpgIssueCategory,
-  coverageReadable,
-  type CNPGFact,
-  type CNPGProblem,
-  type CNPGWorkspaceIssue,
-  type CNPGWorkspaceKey,
-  type CNPGWorkspaceResponse,
-} from './workspace'
+import { cnpgIssueCategory, cnpgIssueOrigin, cnpgIssueText, cnpgCoverageGap, coverageReadable, type CNPGProblem, type CNPGWorkspaceIssue, type CNPGWorkspaceKey, type CNPGWorkspaceResponse } from './workspace'
+import { type Fact } from '../facts'
 
 export interface CNPGObjectRef {
   kind: string
@@ -58,21 +51,6 @@ export function refOf(obj: any, kind: string, group: string = CNPG_GROUP): CNPGO
   return { kind, group, namespace: nsOf(obj), name: nameOf(obj) }
 }
 
-export function healthSeverity(level: HealthLevel): BadgeSeverity {
-  switch (level) {
-    case 'healthy':
-      return 'success'
-    case 'unhealthy':
-      return 'error'
-    case 'alert':
-      return 'alert'
-    case 'degraded':
-      return 'warning'
-    default:
-      return 'neutral'
-  }
-}
-
 // ---------------------------------------------------------------------------
 // Workspace access
 // ---------------------------------------------------------------------------
@@ -94,17 +72,7 @@ export function relationUnavailable(
   if (!ws) return `${what} could not be read`
   const cov = ws.coverage?.[key] ?? { state: 'notInstalled' as const }
   if (coverageReadable(cov, namespace)) return null
-  switch (cov.state) {
-    case 'denied':
-    case 'partial':
-      return `No access to ${what}`
-    case 'syncing':
-      return 'Loading…'
-    case 'error':
-      return `Could not read ${what}`
-    default:
-      return `${what} are not installed`
-  }
+  return cnpgCoverageGap(cov, what, namespace, `${what} are not installed`)
 }
 
 export function clustersIn(ws: CNPGWorkspaceResponse | null | undefined): any[] {
@@ -115,7 +83,8 @@ export function clustersIn(ws: CNPGWorkspaceResponse | null | undefined): any[]
 export function targetCluster(obj: any, clusters: any[]): any | null {
   const name = specCluster(obj)
   if (!name) return null
-  return clusters.find((c) => isCNPGKind(c, 'Cluster') && nsOf(c) === nsOf(obj) && nameOf(c) === name) ?? null
+  const cluster = clusters.find((c) => isCNPGKind(c, 'Cluster') && nsOf(c) === nsOf(obj) && nameOf(c) === name) ?? null
+  return isCNPGKind(obj, 'Backup') && !cnpgBackupMatchesCluster(obj, cluster) ? null : cluster
 }
 
 // ---------------------------------------------------------------------------
@@ -140,10 +109,10 @@ export function problemsForObject(issues: CNPGWorkspaceIssue[] | undefined, ref:
     id: `${issue.id}:${issue.kind}/${issue.name}`,
     severity: issue.severity,
     category: cnpgIssueCategory(issue),
-    title: issue.message || issue.reason,
-    detail: issue.cause || undefined,
+    ...cnpgIssueText(issue),
     subject: { kind: issue.kind, group: issue.group ?? '', namespace: issue.namespace ?? '', name: issue.name },
     source: 'issue',
+    origin: cnpgIssueOrigin(issue),
   }))
 }
 
@@ -195,20 +164,50 @@ export function backupTime(backup: any): number {
   return parseTime(backup?.status?.startedAt) || parseTime(backup?.metadata?.creationTimestamp)
 }
 
+export function cnpgBackupMatchesCluster(backup: any, cluster: any): boolean {
+  if (!cluster || backup?.spec?.cluster?.name !== cluster.metadata?.name || backup.metadata?.namespace !== cluster.metadata?.namespace) return false
+  const owner = backup.metadata?.ownerReferences?.find((ref: any) => ref.kind === 'Cluster' && isApiGroup(ref.apiVersion, CNPG_GROUP))
+  const recordedUID = backup.status?.pluginMetadata?.clusterUID || owner?.uid
+  if (recordedUID && recordedUID !== cluster.metadata?.uid) return false
+  const began = Date.parse(backup.status?.startedAt ?? backup.metadata?.creationTimestamp ?? '')
+  const created = Date.parse(cluster.metadata?.creationTimestamp ?? '')
+  return !(Number.isFinite(began) && Number.isFinite(created) && began < created)
+}
+
+export type CNPGArchiveSource =
+  | { kind: 'objectStore'; objectStore: string; serverName: string }
+  | { kind: 'inTree'; barmanObjectStore: Record<string, unknown>; serverName: string }
+
+export function cnpgArchiveMatchesCluster(cluster: any, source: CNPGArchiveSource): boolean {
+  if (source.kind === 'objectStore') {
+    const plugin = getCNPGClusterBarmanPlugin(cluster)
+    return plugin?.barmanObjectName === source.objectStore &&
+      (plugin?.serverName || cluster.metadata?.name) === source.serverName
+  }
+  const archive = cluster.spec?.backup?.barmanObjectStore
+  const path = source.barmanObjectStore.destinationPath
+  const endpoint = source.barmanObjectStore.endpointURL
+  const destination = typeof path === 'string' ? normalizeURLForComparison(path) : null
+  const endpointKey = normalizeURLForComparison(typeof endpoint === 'string' ? endpoint : '')
+  return !!archive?.destinationPath && typeof path === 'string' && !!path &&
+    destination !== null && endpointKey !== null &&
+    (archive.serverName || cluster.metadata?.name) === source.serverName &&
+    normalizeURLForComparison(archive.destinationPath) === destination &&
+    normalizeURLForComparison(archive.endpointURL || '') === endpointKey
+}
+
 /**
- * The ObjectStore a barman-cloud plugin Backup wrote to. The Backup's own
- * plugin parameters are a record of that run; the target Cluster's plugin
- * configuration is only what it is configured with now, so a store taken from
- * there is marked inferred.
+ * Barman-cloud ignores Backup and ScheduledBackup parameters. The current
+ * Cluster plugin chooses the ObjectStore; it may have changed since a Backup
+ * ran, so the historical destination remains inferred.
  */
 export function objectStoreForBackup(backup: any, clusters: any[]): { name: string; inferred: boolean } | null {
   const method = backup?.status?.method || backup?.spec?.method
   if (method !== 'plugin') return null
   const cfg = backup?.spec?.pluginConfiguration
   if (cfg?.name !== CNPG_BARMAN_PLUGIN_NAME) return null
-  const own = cfg?.parameters?.barmanObjectName
-  if (typeof own === 'string' && own) return { name: own, inferred: false }
   const cluster = targetCluster(backup, clusters)
+  if (backup.kind === 'Backup' && !cnpgBackupMatchesCluster(backup, cluster)) return null
   const current = cluster ? getCNPGClusterBarmanPlugin(cluster)?.barmanObjectName : undefined
   return current ? { name: current, inferred: true } : null
 }
@@ -229,6 +228,14 @@ export function backupDestination(backup: any, clusters: any[]): CNPGBackupDesti
   return { type: 'unknown' }
 }
 
+/** Whether the Cluster declares a destination for this schedule's method; unread Clusters stay unknown. */
+export function cnpgScheduleDestinationBlocker(schedule: any, clusters: any[]): string | null {
+  const cluster = targetCluster(schedule, clusters)
+  if (!cluster) return null
+  const blocker = cnpgBackupDestinationBlocker(cnpgBackupDeclaration(cluster), schedule.spec?.method || 'barmanObjectStore', schedule.spec?.pluginConfiguration?.name)
+  return blocker ? cnpgBackupBlockerText(blocker) : null
+}
+
 // ---------------------------------------------------------------------------
 // ObjectStore
 // ---------------------------------------------------------------------------
@@ -256,16 +263,16 @@ export function usersOfObjectStore(store: any, clusters: any[]): CNPGObjectStore
 export interface CNPGObjectStoreEvidence {
   cluster: CNPGObjectRef
   serverName: string
-  archiving: CNPGFact
+  archiving: Fact
   window: CNPGObjectStoreRecoveryWindow | null
 }
 
 export interface CNPGObjectStoreHealth {
-  summary: CNPGFact
+  summary: Fact
   evidence: CNPGObjectStoreEvidence[]
 }
 
-function archivingFact(cluster: any): CNPGFact {
+function archivingFact(cluster: any): Fact {
   const conds = cluster?.status?.conditions
   const c = Array.isArray(conds) ? conds.find((x: any) => x?.type === 'ContinuousArchiving') : null
   if (!c) return { text: 'WAL archiving not reported', tone: 'unknown' }
@@ -319,14 +326,17 @@ export function inferredObjectStoreHealth(store: any, users: CNPGObjectStoreUser
 // Declarative objects
 // ---------------------------------------------------------------------------
 
-export function appliedFact(obj: any): CNPGFact {
+export function appliedFact(obj: any): Fact {
+  if (observedGenerationFact(obj).tone === 'degraded') {
+    return { text: 'Pending · awaiting the operator for the current spec', tone: 'unknown' }
+  }
   const applied = obj?.status?.applied
   if (applied === true) return { text: 'Applied', tone: 'healthy' }
   if (applied === false) return { text: 'Not applied', tone: 'unhealthy' }
   return { text: 'Pending · the operator has not reported a result yet', tone: 'unknown' }
 }
 
-export function observedGenerationFact(obj: any): CNPGFact {
+export function observedGenerationFact(obj: any): Fact {
   const observed = obj?.status?.observedGeneration
   const generation = obj?.metadata?.generation
   if (typeof observed !== 'number') return { text: 'Not reported', tone: 'unknown' }
@@ -351,7 +361,6 @@ export function missingManagedRole(obj: any, cluster: any | null): string | null
   return names.includes(m[1]) ? null : m[1]
 }
 
-export { cnpgGitOpsSource as gitopsSourceOf } from './workspace'
 
 /** Publications and Subscriptions on the same Cluster and PostgreSQL database. */
 export function replicationForDatabase(

package/src/components/cnpg/schedule.ts

@@ -0,0 +1,35 @@
+/**
+ * The server's reading of a ScheduledBackup schedule (see
+ * /api/cnpg/scheduledbackups/{ns}/{name}/schedule-preview): parsed as
+ * CloudNativePG parses it, with the next runs counted as the operator counts
+ * them. Times are RFC 3339 UTC.
+ */
+export interface CNPGSchedulePreview {
+  schedule: string
+  valid: boolean
+  error?: string
+  description?: string
+  nextRuns?: string[]
+  /** The first run is due already: the operator creates a backup as soon as it reconciles. */
+  runsImmediately?: boolean
+  basis: 'lastCheckTime' | 'now'
+  lastCheckTime?: string
+  suspended?: boolean
+  clock?: { zone: string; declared: boolean; source: string }
+}
+
+export function formatCNPGRunTime(iso: string): { utc: string; local: string } {
+  const d = new Date(iso)
+  const pad = (n: number) => String(n).padStart(2, '0')
+  const utc = `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())} ${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())} UTC`
+  return { utc, local: d.toLocaleString() }
+}
+
+/** One line for the runs list: why the first run is when it is. */
+export function cnpgScheduleBasisNote(p: CNPGSchedulePreview): string {
+  const clock = p.clock?.source ?? 'Operator clock is not established; upcoming times assume UTC.'
+  if (p.suspended) return `Suspended: nothing runs until it is resumed. ${clock}`
+  const basis = p.basis === 'lastCheckTime' ? "Counted from the operator's last check (status.lastCheckTime)." : 'Counted from now; the operator starts counting at its first check.'
+  const due = p.runsImmediately ? ` ${p.clock?.declared ? 'A run is due on the declared clock.' : 'A run is due in this UTC estimate.'} The operator takes at most one catch-up backup.` : ''
+  return `${basis} ${clock}${due}`
+}

package/src/components/cnpg/workspace-disk.test.ts

@@ -0,0 +1,97 @@
+import { describe, it, expect } from 'vitest'
+import { applyCNPGDisk, buildCNPGFleet, cnpgDiskFact, CNPG_WORKSPACE_KEYS, type CNPGDiskReading, type CNPGWorkspaceResponse } from './workspace'
+
+function cluster(name: string): any {
+  return {
+    apiVersion: 'postgresql.cnpg.io/v1',
+    kind: 'Cluster',
+    metadata: { name, namespace: 'db' },
+    spec: { instances: 1 },
+    status: { phase: 'Cluster in healthy state', readyInstances: 1, currentPrimary: `${name}-1` },
+  }
+}
+
+function fleetOf(...names: string[]) {
+  const coverage: CNPGWorkspaceResponse['coverage'] = {}
+  for (const k of CNPG_WORKSPACE_KEYS) coverage[k] = { state: 'full' }
+  return buildCNPGFleet({
+    installed: true,
+    context: 'test',
+    namespaces: null,
+    coverage,
+    objects: { clusters: names.map(cluster) },
+    issues: [],
+    audit: [],
+    backupsOmitted: 0,
+  })
+}
+
+function reading(name: string, over: Partial<CNPGDiskReading> = {}): CNPGDiskReading {
+  return { namespace: 'db', name, state: 'ok', claims: 1, measured: 1, ...over }
+}
+
+const max = (ratio: number) => ({ claim: 'pg-1', instance: 'pg-1', role: 'PG_DATA', usedBytes: ratio * 10 * 1024 ** 3, capacityBytes: 10 * 1024 ** 3, ratio })
+
+describe('cnpgDiskFact', () => {
+  it('never reads an unmeasured cluster as zero or healthy', () => {
+    for (const state of ['noSeries', 'noPrometheus', 'denied', 'error', 'notRead']) {
+      const f = cnpgDiskFact(reading('pg', { state, measured: 0 }))
+      expect(f.tone).toBe('unknown')
+      expect(f.text).not.toMatch(/\d/)
+    }
+    expect(cnpgDiskFact(undefined).tone).toBe('unknown')
+  })
+
+  it('names the fullest volume and its source, and labels partial coverage', () => {
+    const f = cnpgDiskFact(reading('pg', { state: 'partial', claims: 2, measured: 1, max: max(0.5) }))
+    expect(f.text).toBe('50% used')
+    expect(f.tone).toBe('healthy')
+    expect(f.source).toContain('data volume of pg-1')
+    expect(f.source).toContain('kubelet volume stats')
+    expect(f.source).toContain('1 of 2 volumes measured')
+  })
+
+  it('names the missing grant when denied', () => {
+    expect(cnpgDiskFact(reading('pg', { state: 'denied', grant: { verb: 'list', resource: 'persistentvolumeclaims', namespace: 'db' }, measured: 0 })).source).toBe('Needs list persistentvolumeclaims in namespace db')
+  })
+})
+
+describe('applyCNPGDisk', () => {
+  it('says when the volume stats were matched to the cluster by claim name only', () => {
+    const note = "Matched by namespace and claim names. Radar couldn't confirm these volume stats belong to this exact cluster (no cluster label it could check)"
+    const fleet = applyCNPGDisk(fleetOf('pg-a'), [reading('pg-a', { max: max(0.95), isolation: { mode: 'unverified', note } })])
+    const p = fleet.rows[0].problems[0]
+    expect(p).toMatchObject({ measuredBy: 'kubelet, matched by claim name', unverifiedMatch: true })
+    expect(p.detail).toContain(note)
+    expect(fleet.rows[0].disk?.source).toContain(note)
+  })
+
+  it('puts low-disk clusters into Needs attention by severity', () => {
+    const fleet = applyCNPGDisk(fleetOf('pg-a', 'pg-b', 'pg-c'), [
+      reading('pg-a', { max: max(0.85) }),
+      reading('pg-b', { max: max(0.95) }),
+      reading('pg-c', { max: max(0.4) }),
+    ])
+    expect(fleet.attentionCount).toBe(2)
+    const a = fleet.rows.find((r) => r.name === 'pg-a')!
+    const b = fleet.rows.find((r) => r.name === 'pg-b')!
+    const c = fleet.rows.find((r) => r.name === 'pg-c')!
+    expect(a.problems[0].severity).toBe('warning')
+    expect(b.problems[0].severity).toBe('critical')
+    expect(b.problems[0].source).toBe('measurement')
+    expect(b.problems[0].title).toBe('The data volume of pg-1 is 95% full')
+    expect(c.attention).toBe(false)
+    expect(fleet.categoryCounts.availability).toBe(2)
+  })
+
+  it('raises nothing without a measurement', () => {
+    const fleet = applyCNPGDisk(fleetOf('pg-a'), [reading('pg-a', { state: 'noPrometheus', measured: 0, reason: 'Radar is not connected to Prometheus: x' })])
+    expect(fleet.attentionCount).toBe(0)
+    expect(fleet.rows[0].disk).toMatchObject({ text: 'No usage metrics', source: 'Prometheus not connected', detail: 'Radar is not connected to Prometheus: x' })
+  })
+
+  it('leaves the fleet as built when no reading was requested', () => {
+    const base = fleetOf('pg-a')
+    expect(applyCNPGDisk(base, undefined)).toBe(base)
+  })
+})

package/src/components/cnpg/workspace-fleet-metrics.test.ts

@@ -0,0 +1,250 @@
+import { describe, it, expect } from 'vitest'
+import { applyCNPGFleetMetrics, buildCNPGFleet, CNPG_WORKSPACE_KEYS, type CNPGFleetMetricsReading, type CNPGWorkspaceResponse } from './workspace'
+
+function pod(cluster: string, n: number, role: 'primary' | 'replica'): any {
+  return {
+    metadata: { name: `${cluster}-${n}`, namespace: 'db', labels: { 'cnpg.io/cluster': cluster, 'cnpg.io/instanceRole': role } },
+    status: { conditions: [{ type: 'Ready', status: 'True' }] },
+  }
+}
+
+function fleet() {
+  const coverage: CNPGWorkspaceResponse['coverage'] = {}
+  for (const k of CNPG_WORKSPACE_KEYS) coverage[k] = { state: 'full' }
+  const cluster = (name: string, instances: number) => ({
+    apiVersion: 'postgresql.cnpg.io/v1',
+    kind: 'Cluster',
+    metadata: { name, namespace: 'db' },
+    spec: { instances },
+    status: { phase: 'Cluster in healthy state', readyInstances: instances, currentPrimary: `${name}-1` },
+  })
+  return buildCNPGFleet({
+    installed: true,
+    context: 'test',
+    namespaces: null,
+    coverage,
+    objects: {
+      clusters: [cluster('ha', 2), cluster('solo', 1), cluster('dark', 2)],
+      pods: [pod('ha', 1, 'primary'), pod('ha', 2, 'replica'), pod('solo', 1, 'primary'), pod('dark', 1, 'primary'), pod('dark', 2, 'replica')],
+    },
+    issues: [],
+    audit: [],
+    backupsOmitted: 0,
+  })
+}
+
+const reading = (name: string, lag: CNPGFleetMetricsReading['lag'], growth: CNPGFleetMetricsReading['growth'] = { state: 'noSeries' }): CNPGFleetMetricsReading => ({
+  namespace: 'db',
+  name,
+  lag,
+  growth,
+})
+
+const row = (f: ReturnType<typeof fleet>, name: string) => f.rows.find((r) => r.name === name)!
+
+describe('applyCNPGFleetMetrics', () => {
+  it('replaces "lag unknown" with the measured standby lag and names its source', () => {
+    const f = applyCNPGFleetMetrics(fleet(), [reading('ha', { state: 'ok', seconds: 7.2, pod: 'ha-2' })], { source: 'prometheus', lagSource: 'Prometheus cnpg_pg_replication_lag' })
+    const r = row(f, 'ha')
+    expect(r.replication.text).toBe('1/1 Pods ready · lag 7.2 s')
+    expect(r.replication.tone).toBe('degraded')
+    expect(r.replication.source).toContain('ha-2')
+    expect(r.replication.source).toContain('cnpg_pg_replication_lag')
+  })
+
+  it('says why lag is unknown instead of zero, and leaves non-replica facts alone', () => {
+    const f = applyCNPGFleetMetrics(fleet(), [reading('dark', { state: 'noSeries', reason: 'no exporter series' })], { source: 'prometheus' })
+    expect(row(f, 'dark').replication.text).toBe('1/1 Pods ready · lag unknown')
+    expect(row(f, 'dark').replication.source).toBeTruthy()
+    expect(row(f, 'dark').replication.tone).toBe('unknown')
+    expect(row(f, 'solo').replication.text).toBe('Single instance')
+
+    const denied = applyCNPGFleetMetrics(fleet(), [reading('ha', { state: 'denied', grant: { verb: 'get', resource: 'pods', namespace: 'db' } })], { source: 'prometheus' })
+    expect(row(denied, 'ha').replication.text).toBe('1/1 Pods ready · lag unknown')
+    expect(row(denied, 'ha').replication.source).toBe('Needs get pods in namespace db')
+
+    const none = applyCNPGFleetMetrics(fleet(), undefined, { source: 'none', reason: 'Radar is not connected to Prometheus' })
+    expect(row(none, 'ha').replication.text).toBe('1/1 Pods ready · lag unknown')
+    expect(row(none, 'ha').replication.source).toBe('Prometheus not connected')
+    expect(row(none, 'ha').replication.detail).toBe('Radar is not connected to Prometheus')
+    expect(row(none, 'ha').diskGrowth).toBeUndefined()
+  })
+
+  it('keeps the fleet untouched when no reading was requested', () => {
+    const base = fleet()
+    expect(applyCNPGFleetMetrics(base, undefined, undefined)).toBe(base)
+    expect(row(base, 'ha').replication.text).toBe('1/1 Pods ready · lag unknown')
+  })
+
+  it('reports disk growth only when measured', () => {
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [reading('ha', { state: 'ok', seconds: 0.2, pod: 'ha-2' }, { state: 'ok', bytesPerHour: 1024 ** 3 / 24, claim: 'ha-1', instance: 'ha-1' })],
+      { source: 'prometheus', growthSource: 'deriv' },
+    )
+    expect(row(f, 'ha').diskGrowth?.text).toBe('+1.0 GiB/day')
+    expect(row(f, 'ha').replication.tone).toBe('healthy')
+    expect(row(f, 'dark').diskGrowth).toBeUndefined()
+  })
+})
+
+describe('sustained replication lag', () => {
+  const src = { source: 'prometheus' as const, lagSource: 'Prometheus cnpg_pg_replication_lag' }
+
+  it('puts a cluster into Needs attention only when lag stayed high for the whole window', () => {
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [
+        reading('ha', { state: 'ok', seconds: 95, pod: 'ha-2', sustainedSeconds: 40, sustainedPod: 'ha-2', sustainedWindow: '10m0s' }),
+        reading('dark', { state: 'ok', seconds: 120, pod: 'dark-2' }),
+      ],
+      src,
+    )
+    const ha = row(f, 'ha')
+    expect(ha.attention).toBe(true)
+    expect(ha.problems[0]).toMatchObject({ severity: 'warning', category: 'availability', source: 'measurement' })
+    expect(ha.problems[0].title).toBe('ha-2 ≥ 40 s behind in every sample for 10 min')
+    expect(ha.problems[0]).toMatchObject({ measuredBy: 'Prometheus' })
+    expect(ha.problems[0].detail).not.toMatch(/cnpg_/)
+    expect(ha.problems[0].detail).toContain("If Prometheus missed some scrapes, those moments aren't included")
+    expect(ha.problems[0].shortTitle).toBe('ha-2: all samples ≥ 40 s behind (10 min)')
+    expect(ha.problems[0].detail).not.toContain('whole window')
+    expect(row(f, 'dark').attention).toBe(false)
+    expect(f.attentionCount).toBe(1)
+  })
+
+  it('says when the series were matched to the cluster by Pod name only', () => {
+    const note = "Matched by namespace and Pod names. Radar couldn't confirm these series belong to this exact cluster (no cluster label it could check)"
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [reading('ha', { state: 'ok', seconds: 95, pod: 'ha-2', sustainedSeconds: 40, sustainedPod: 'ha-2', sustainedWindow: '10m0s', isolation: { mode: 'unverified', note } })],
+      src,
+    )
+    const p = row(f, 'ha').problems[0]
+    expect(p.measuredBy).toBe('Prometheus, matched by Pod name')
+    expect(p.unverifiedMatch).toBe(true)
+    expect(p.detail).toContain(note)
+    const verified = applyCNPGFleetMetrics(
+      fleet(),
+      [reading('ha', { state: 'ok', seconds: 95, pod: 'ha-2', sustainedSeconds: 40, sustainedPod: 'ha-2', sustainedWindow: '10m0s', isolation: { mode: 'verified', note: 'x' } })],
+      src,
+    )
+    expect(row(verified, 'ha').problems[0].measuredBy).toBe('Prometheus')
+  })
+
+  it('escalates to critical past five minutes and ignores a floor under 30 s', () => {
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [
+        reading('ha', { state: 'ok', seconds: 400, pod: 'ha-2', sustainedSeconds: 360, sustainedPod: 'ha-2', sustainedWindow: '10m0s' }),
+        reading('dark', { state: 'ok', seconds: 20, pod: 'dark-2', sustainedSeconds: 12, sustainedPod: 'dark-2', sustainedWindow: '10m0s' }),
+      ],
+      src,
+    )
+    expect(row(f, 'ha').problems[0]).toMatchObject({ severity: 'critical', title: 'ha-2 ≥ 6 min behind in every sample for 10 min' })
+    expect(row(f, 'dark').problems).toHaveLength(0)
+  })
+})
+
+describe('standbys that receive nothing, and the WAL slots hold', () => {
+  const src = { source: 'prometheus' as const, lagSource: 'Prometheus cnpg_pg_replication_lag' }
+  it('a standby whose WAL receiver is down is a problem, never "lag 0 s"', () => {
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', standbys: 1, receiving: 0, receiverDown: ['ha-2'], receiverDownSustained: ['ha-2'], receiverDownWindow: '5m0s' })],
+      src,
+    )
+    const r = row(f, 'ha')
+    expect(r.replication.text).toBe('1/1 Pods ready · ha-2 not receiving WAL')
+    expect(r.replication.tone).toBe('unhealthy')
+    expect(r.attention).toBe(true)
+    const p = r.problems.find((x) => x.id === 'standby:db/ha:ha-2')!
+    expect(p).toMatchObject({ severity: 'critical', title: 'ha-2 is not receiving WAL from the primary', subject: { kind: 'Pod', name: 'ha-2' }, measuredBy: 'Prometheus' })
+    expect(p.detail).toContain('Its WAL receiver was down in every sample Prometheus recorded over the last 5 minutes')
+  })
+  it('a receiver down for less than the window is shown, not raised: a restarting standby reconnects on its own', () => {
+    const f = applyCNPGFleetMetrics(fleet(), [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', standbys: 1, receiving: 0, receiverDown: ['ha-2'], receiverDownSustained: [], receiverDownWindow: '5m0s' })], src)
+    expect(row(f, 'ha').replication.text).toBe('1/1 Pods ready · ha-2 not receiving WAL')
+    expect(row(f, 'ha').problems.some((p) => p.id.startsWith('standby:'))).toBe(false)
+  })
+  it('lag alone does not establish streaming when the exporter reports no receiver state', () => {
+    const f = applyCNPGFleetMetrics(fleet(), [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', standbys: 1, receiverUnknown: true })], src)
+    expect(row(f, 'ha').replication).toMatchObject({ text: '1/1 Pods ready · lag 0 s · streaming unverified', tone: 'unknown' })
+    expect(row(f, 'ha').attention).toBe(false)
+  })
+  it('raises an inactive slot only from the primary, at 1 GiB or more, naming the standby it serves', () => {
+    const big = 4.9e9
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [
+        {
+          ...reading('ha', { state: 'ok', seconds: 0.1, pod: 'ha-2', standbys: 1, receiving: 1 }),
+          slots: {
+            state: 'ok',
+            inactive: [
+              { slot: '_cnpg_ha_2', pod: 'ha-1', role: 'primary', bytes: big },
+              { slot: '_cnpg_ha_2', pod: 'ha-2', role: 'standby', bytes: big },
+            ],
+          },
+        },
+        { ...reading('dark', { state: 'ok', seconds: 0.1, pod: 'dark-2', standbys: 1, receiving: 1 }), slots: { state: 'ok', inactive: [{ slot: '_cnpg_dark_9', pod: 'dark-2', role: 'standby', bytes: big }] } },
+      ],
+      src,
+    )
+    const slots = row(f, 'ha').problems.filter((p) => p.id.startsWith('slot:'))
+    expect(slots).toHaveLength(1)
+    expect(slots[0].title).toBe('Inactive slot _cnpg_ha_2 holds 4.6 GiB of WAL on ha-1 for ha-2')
+    expect(row(f, 'dark').problems.some((p) => p.id.startsWith('slot:'))).toBe(false)
+    const small = applyCNPGFleetMetrics(fleet(), [{ ...reading('ha', { state: 'ok', seconds: 0.1, pod: 'ha-2' }), slots: { state: 'ok', inactive: [{ slot: '_cnpg_ha_2', pod: 'ha-1', role: 'primary', bytes: 5e8 }] } }], src)
+    expect(row(small, 'ha').problems.some((p) => p.id.startsWith('slot:'))).toBe(false)
+  })
+})
+
+describe('none receiving needs every expected standby accounted for', () => {
+  it('one standby down with another unreported is a warning, not "none receive"', () => {
+    const f = applyCNPGFleetMetrics(
+      fleet(),
+      [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', standbys: 1, receiving: 0, receiverDown: ['ha-2'], receiverDownSustained: ['ha-2'], receiverDownWindow: '5m0s' })],
+      { source: 'prometheus' },
+    )
+    expect(row(f, 'ha').problems.find((p) => p.id === 'standby:db/ha:ha-2')?.severity).toBe('critical')
+    const three = applyCNPGFleetMetrics(
+      fleet(),
+      [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', standbys: 2, receiving: 0, receiverDown: ['ha-2'], receiverDownSustained: ['ha-2'], receiverDownWindow: '5m0s' })],
+      { source: 'prometheus' },
+    )
+    // spec.instances 2 expects one standby; two reporting with one down is not "all down".
+    expect(row(three, 'ha').problems.find((p) => p.id === 'standby:db/ha:ha-2')?.severity).toBe('warning')
+  })
+})
+
+describe('fleet lag covers the standbys that report', () => {
+  it('says how many standbys the lag covers, and is not healthy while one is unreported', () => {
+    const three = fleet()
+    three.rows.find((r) => r.name === 'ha')!.instances.desired = 3
+    const f = applyCNPGFleetMetrics(three, [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', lagStandbys: 1, standbys: 1, receiving: 1 })], { source: 'prometheus' })
+    expect(row(f, 'ha').replication).toMatchObject({ text: expect.stringContaining('lag 0 s (1 of 2 standbys reporting)'), tone: 'unknown' })
+  })
+
+  it('counts the standbys whose lag was read, not those whose receiver was', () => {
+    const three = fleet()
+    three.rows.find((r) => r.name === 'ha')!.instances.desired = 3
+    const f = applyCNPGFleetMetrics(three, [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-2', lagStandbys: 1, standbys: 2, receiving: 2 })], { source: 'prometheus' })
+    expect(row(f, 'ha').replication).toMatchObject({ text: expect.stringContaining('(1 of 2 standbys reporting)'), tone: 'unknown' })
+  })
+
+  it('expects every instance of a replica cluster to report, its designated primary included', () => {
+    const replica = fleet()
+    const r = replica.rows.find((x) => x.name === 'ha')!
+    r.instances.desired = 3
+    r.replicaCluster = { source: 'pg-origin' }
+    const f = applyCNPGFleetMetrics(replica, [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-1', lagStandbys: 2, standbys: 2, receiving: 2 })], { source: 'prometheus' })
+    expect(row(f, 'ha').replication).toMatchObject({ text: expect.stringContaining('(2 of 3 instances reporting)'), tone: 'unknown' })
+    const all = applyCNPGFleetMetrics(replica, [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-1', lagStandbys: 3, standbys: 3, receiving: 3 })], { source: 'prometheus' })
+    expect(row(all, 'ha').replication.text).not.toContain('reporting')
+    expect(row(all, 'ha').replication).toMatchObject({ text: expect.stringContaining('upstream feed not assessed'), tone: 'unknown' })
+    r.cluster = { ...r.cluster, status: { ...r.cluster?.status, currentPrimary: undefined } }
+    const unnamed = applyCNPGFleetMetrics(replica, [reading('ha', { state: 'ok', seconds: 0, pod: 'ha-1', lagStandbys: 3, standbys: 3, receiving: 3 })], { source: 'prometheus' })
+    expect(row(unnamed, 'ha').replication).toMatchObject({ text: expect.stringContaining('upstream feed not assessed'), tone: 'unknown' })
+  })
+})