@skyhook-io/radar-app 0.2.2 → 0.3.1

package/src/api/client.ts

@@ -1,3 +1,11 @@
+import { useEffect, useRef } from 'react'
+import type {
+  AppHistory,
+  AppRow,
+  ArgoSyncOpts,
+  YamlDocumentIdentity,
+  YamlSchemaLoadResult,
+} from '@skyhook-io/k8s-ui'
 import { useQuery, useMutation, useQueryClient, skipToken } from '@tanstack/react-query'
 import { showApiError, showApiSuccess } from '../components/ui/Toast'
 import { useCanHelmWrite } from '../contexts/CapabilitiesContext'
@@ -14,8 +22,12 @@ import type {
   HelmReleaseDetail,
   HelmValues,
   ManifestDiff,
+  NotesDiff,
+  HooksDiff,
+  ResourceDiff,
   UpgradeInfo,
   BatchUpgradeInfo,
+  ValuesDiff,
   ValuesPreviewResponse,
   HelmRepository,
   ChartSearchResult,
@@ -23,26 +35,54 @@ import type {
   InstallChartRequest,
   ArtifactHubSearchResult,
   ArtifactHubChartDetail,
+  GitOpsResourceTree,
+  GitOpsInsight,
+  GitOpsInsightRef,
+  GitOpsResourceDiff,
+  ArgoRevisionMetadata,
 } from '../types'
 import type { GitOpsOperationResponse } from '../types/gitops'
 import { getApiBase, getAuthHeaders, getCredentialsMode, getBasename, routePath } from './config'
 import { pluralToKind } from '../utils/navigation'
 
+// Auto-refresh cadences (ms) — named constants for each polled hook's
+// refetchInterval below, so the poll rate reads clearly at each call site.
+const DASHBOARD_REFRESH_INTERVAL_MS = 30_000
+const AUDIT_REFRESH_INTERVAL_MS = 60_000
+const ISSUES_REFRESH_INTERVAL_MS = 30_000
+const COST_REFRESH_INTERVAL_MS = 60_000
+const COST_DISCOVERY_RETRY_INTERVAL_MS = 5_000
+export const COST_DISCOVERY_GRACE_MS = 30_000
+const COST_TREND_REFRESH_INTERVAL_MS = 120_000
+const CHANGES_REFRESH_INTERVAL_MS = 60_000
+const APPLICATIONS_REFRESH_INTERVAL_MS = 60_000
+
 // Wrapper around fetch that always includes credentials (for session cookies)
 // and handles 401 responses globally. Merges caller-provided headers with
 // auth headers from the config module so library consumers (Radar Hub) can
 // inject Authorization bearer tokens without each call site knowing.
-function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+export function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
   const headers = new Headers(init?.headers)
   for (const [k, v] of Object.entries(getAuthHeaders())) {
     if (!headers.has(k)) headers.set(k, v)
   }
-  return fetch(input, { credentials: getCredentialsMode(), ...init, headers }).then(async response => {
+  return fetch(input, {
+    credentials: getCredentialsMode(),
+    ...init,
+    headers,
+  }).then(async (response) => {
     const authPrefix = `${getBasename()}/auth`
     if (response.status === 401 && !window.location.pathname.startsWith(authPrefix)) {
       // Save current location so user returns to where they were after re-auth.
       // Editor draft is auto-saved by EditableYamlView via sessionStorage.
-      try { sessionStorage.setItem('radar_return_path', window.location.pathname + window.location.search) } catch { /* best-effort */ }
+      try {
+        sessionStorage.setItem(
+          'radar_return_path',
+          window.location.pathname + window.location.search,
+        )
+      } catch {
+        /* best-effort */
+      }
 
       let authMode: string | undefined
       try {
@@ -61,7 +101,11 @@ function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Respons
         const lastReload = sessionStorage.getItem('radar_proxy_reload')
         const now = Date.now()
         if (!lastReload || now - parseInt(lastReload) > 5000) {
-          try { sessionStorage.setItem('radar_proxy_reload', String(now)) } catch { /* best-effort */ }
+          try {
+            sessionStorage.setItem('radar_proxy_reload', String(now))
+          } catch {
+            /* best-effort */
+          }
           window.location.reload()
         }
       }
@@ -86,8 +130,50 @@ export function isForbiddenError(error: unknown): boolean {
   return error instanceof ApiError && error.status === 403
 }
 
-export async function fetchJSON<T>(path: string): Promise<T> {
-  const response = await apiFetch(`${getApiBase()}${path}`)
+const METRICS_API_GROUP_TOKENS = ['metrics', 'k8s', 'io'] as const
+
+function mentionsMetricsAPIGroup(message: string): boolean {
+  const tokens = message.split(/[^a-z0-9]+/).filter(Boolean)
+  return tokens.some(
+    (token, index) =>
+      token === METRICS_API_GROUP_TOKENS[0] &&
+      tokens[index + 1] === METRICS_API_GROUP_TOKENS[1] &&
+      tokens[index + 2] === METRICS_API_GROUP_TOKENS[2],
+  )
+}
+
+function hasMetricsUnavailablePhrase(message: string): boolean {
+  return (
+    message.includes('may not be installed') ||
+    message.includes('not found') ||
+    message.includes('could not find the requested resource') ||
+    message.includes('no matches for kind') ||
+    message.includes('no resource matches') ||
+    message.includes('no metrics known') ||
+    message.includes('not available') ||
+    message.includes('unable to fetch metrics') ||
+    message.includes('currently unable to handle the request')
+  )
+}
+
+export function isMetricsUnavailableError(error: unknown): boolean {
+  if (!(error instanceof ApiError)) return false
+  if (error.status !== 404 && error.status !== 500) return false
+  return [error.message, error.data?.error].some((message) => {
+    if (typeof message !== 'string') return false
+    const normalized = message.toLowerCase()
+    const hasMetricsSignal =
+      normalized.includes('metrics-server') ||
+      mentionsMetricsAPIGroup(normalized) ||
+      normalized.includes('pod metrics') ||
+      normalized.includes('node metrics')
+    return hasMetricsSignal && hasMetricsUnavailablePhrase(normalized)
+  })
+}
+
+export async function fetchJSON<T>(path: string, init?: RequestInit | AbortSignal): Promise<T> {
+  const requestInit = init instanceof AbortSignal ? { signal: init } : init
+  const response = await apiFetch(`${getApiBase()}${path}`, requestInit)
   if (!response.ok) {
     const errorData = await response.json().catch(() => ({ error: 'Unknown error' }))
     throw new ApiError(errorData.error || `HTTP ${response.status}`, response.status, errorData)
@@ -118,7 +204,7 @@ export interface DashboardProblem {
   namespace: string
   name: string
   group?: string
-  severity: 'critical' | 'high' | 'medium'
+  severity: 'critical' | 'high' | 'medium' | 'warning' | 'info'
   reason: string
   message: string
   age: string
@@ -137,6 +223,9 @@ export interface WorkloadCount {
 export interface DashboardMetrics {
   cpu?: MetricSummary
   memory?: MetricSummary
+  // When false, only requests/capacity are meaningful — live usage (from
+  // metrics-server) is unavailable and usage fields are zero.
+  usageAvailable: boolean
 }
 
 export interface MetricSummary {
@@ -148,7 +237,13 @@ export interface MetricSummary {
 }
 
 export interface DashboardResourceCounts {
-  pods: { total: number; running: number; pending: number; failed: number; succeeded: number }
+  pods: {
+    total: number
+    running: number
+    pending: number
+    failed: number
+    succeeded: number
+  }
   deployments: { total: number; available: number; unavailable: number }
   statefulSets: WorkloadCount
   daemonSets: WorkloadCount
@@ -166,15 +261,6 @@ export interface DashboardResourceCounts {
   restricted?: string[] // Resource kinds the user cannot list due to RBAC
 }
 
-export interface DashboardEvent {
-  type: string
-  reason: string
-  message: string
-  involvedObject: string
-  namespace: string
-  timestamp: string
-}
-
 export interface DashboardChange {
   kind: string
   namespace: string
@@ -231,15 +317,27 @@ export interface DashboardCRDCount {
 }
 
 // Re-export shared types from k8s-ui — single source of truth
-import type { AuditCardData, AuditFinding, ResourceGroup, CheckMeta } from '@skyhook-io/k8s-ui'
+import type {
+  AuditCardData,
+  AuditFinding,
+  ResourceGroup,
+  CheckMeta,
+  Check,
+  Issue,
+  IssueRecentChange,
+} from '@skyhook-io/k8s-ui'
 export type DashboardAudit = AuditCardData
-export type { AuditFinding, ResourceGroup, CheckMeta }
+export type { AuditFinding, ResourceGroup, CheckMeta, Check }
 
 export interface AuditResponse {
   summary: DashboardAudit
   findings: AuditFinding[]
   groups: ResourceGroup[]
   checks: Record<string, CheckMeta>
+  // Remediation-queue rollup: findings grouped by check, prioritized. Present
+  // on the non-raw scan (standalone + embedded per-cluster views); the Checks
+  // queue renders this.
+  groupedChecks?: Check[]
 }
 
 export interface DashboardCertificateHealth {
@@ -256,12 +354,36 @@ export interface DashboardNetworkPolicyCoverage {
   totalWorkloads: number
 }
 
+export interface DashboardGitOpsControllers {
+  // Aggregate roll-up across all detected controllers.
+  status: 'healthy' | 'degraded' | 'crashing'
+  controllers: DashboardGitOpsController[]
+}
+
+export interface DashboardGitOpsController {
+  name: string
+  // Tool vocabulary aligns with the backend `ctrlTool*` constants in
+  // internal/server/dashboard_gitops.go and the GitOps tree-builder
+  // tags in pkg/gitops/tree/graph.go (`gitopsTool`). Keep these three
+  // surfaces in sync — diverging vocabulary across surfaces was a real
+  // source of confusion until consolidated.
+  tool: 'argocd' | 'fluxcd'
+  namespace: string
+  ready: number
+  total: number
+  // Per-controller status (aggregate is in the parent and excludes
+  // 'pending' — it normalizes into 'degraded' there).
+  status: 'healthy' | 'degraded' | 'crashing' | 'pending'
+  // Reason for the crash when status === 'crashing'. Common values:
+  // "CrashLoopBackOff", "Error". Empty for non-crashing states.
+  crashReason?: string
+}
+
 export interface DashboardResponse {
   cluster: DashboardCluster
   health: DashboardHealth
   problems: DashboardProblem[]
   resourceCounts: DashboardResourceCounts
-  recentEvents: DashboardEvent[]
   recentChanges: DashboardChange[]
   topologySummary: DashboardTopologySummary
   trafficSummary: DashboardTrafficSummary | null
@@ -270,9 +392,14 @@ export interface DashboardResponse {
   certificateHealth: DashboardCertificateHealth | null
   networkPolicyCoverage: DashboardNetworkPolicyCoverage | null
   audit: DashboardAudit | null
-  nodeVersionSkew: { versions: Record<string, string[]>; minVersion: string; maxVersion: string } | null
+  gitopsControllers: DashboardGitOpsControllers | null
+  nodeVersionSkew: {
+    versions: Record<string, string[]>
+    minVersion: string
+    maxVersion: string
+  } | null
   deferredLoading?: boolean // True while deferred informers (secrets, events, etc.) are still syncing
-  partialData?: string[] // Resource kinds still loading after first paint (slow-cluster fallback)
+  partialData?: string[] // Critical kinds promoted at first paint that haven't yet finished syncing (live-filtered)
   accessRestricted?: boolean // True when user has no namespace access (RBAC)
 }
 
@@ -280,13 +407,14 @@ export interface DashboardCRDsResponse {
   topCRDs: DashboardCRDCount[]
 }
 
-export function useDashboard(namespaces: string[] = []) {
+export function useDashboard(namespaces: string[] = [], options?: { enabled?: boolean }) {
   const params = namespaces.length > 0 ? `?namespaces=${namespaces.join(',')}` : ''
   return useQuery<DashboardResponse>({
     queryKey: ['dashboard', namespaces],
     queryFn: () => fetchJSON(`/dashboard${params}`),
+    enabled: options?.enabled ?? true,
     staleTime: 15000, // 15 seconds
-    refetchInterval: 30000, // Refresh every 30 seconds
+    refetchInterval: DASHBOARD_REFRESH_INTERVAL_MS,
   })
 }
 
@@ -297,7 +425,40 @@ export function useAudit(namespaces: string[] = []) {
     queryKey: ['audit', namespaces],
     queryFn: () => fetchJSON(`/audit${params}`),
     staleTime: 30000,
-    refetchInterval: 60000,
+    refetchInterval: AUDIT_REFRESH_INTERVAL_MS,
+    placeholderData: (prev) => prev,
+  })
+}
+
+// Live cluster Issues — the grouped triage queue (radar's /api/issues =
+// internal/issues.Compose+Classify+Group). Single-cluster here; the Hub fleet
+// view fans the same shape across clusters. Do not carry old data across query
+// keys: issues are scope-sensitive, so namespace changes must not show the
+// previous scope's rows while the new scope fetches.
+// total = rows returned (after the cap); total_matched = rows that matched
+// before the cap. total_matched > total means the queue was truncated — surface
+// that honestly rather than presenting a capped list as if it were complete.
+export interface IssuesResponse {
+  issues: Issue[]
+  total?: number
+  total_matched?: number
+  recent_changes?: IssueRecentChange[]
+  recent_changes_reason?: string
+  recent_changes_guidance?: string
+  recent_changes_truncated?: boolean
+  // Present only when RBAC visibility is incomplete (absent = full access).
+  // state 'degraded' means core workload reads are denied, so an empty list may
+  // mean "can't see" rather than "nothing broken" — the UI must say so.
+  visibility?: { state?: string; impact?: string }
+}
+
+export function useIssues(namespaces: string[] = []) {
+  const params = namespaces.length > 0 ? `?namespaces=${namespaces.join(',')}` : ''
+  return useQuery<IssuesResponse>({
+    queryKey: ['issues', namespaces],
+    queryFn: () => fetchJSON(`/issues${params}`),
+    staleTime: 30000,
+    refetchInterval: ISSUES_REFRESH_INTERVAL_MS,
   })
 }
 
@@ -309,6 +470,34 @@ export function useResourceAudit(kind: string, namespace: string, name: string)
   })
 }
 
+// Live Issues that touch ONE resource — its own issues plus, for a workload, its
+// owned pods' issues (server-side owner rollup via issues.RelatedIssues). Backs
+// the "Operational Issues" section in the resource detail. Cluster-scoped
+// resources pass "_" for namespace; namespaced ones also scope the scan via
+// ?namespaces= for a cheap, bounded Compose.
+export function useResourceIssues(
+  kind: string,
+  group: string | undefined,
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
+  const clusterScoped = !namespace
+  const pathNs = clusterScoped ? '_' : encodeURIComponent(namespace)
+  const params = new URLSearchParams()
+  if (group) params.set('group', group)
+  const path = `/issues/resource/${encodeURIComponent(kind)}/${pathNs}/${encodeURIComponent(name)}`
+  const qs = params.toString()
+  return useQuery<Issue[]>({
+    queryKey: ['issues', 'resource', kind, group ?? '', namespace, name],
+    queryFn: () => fetchJSON(`${path}${qs ? `?${qs}` : ''}`),
+    // No refetchInterval: a drawer doesn't need to poll; staleTime keeps it fresh
+    // on reopen without re-running an uncapped Compose every 30s.
+    staleTime: 30000,
+    enabled: enabled && !!kind && !!name,
+  })
+}
+
 // Audit settings
 export interface AuditSettings {
   ignoredNamespaces: string[]
@@ -405,7 +594,8 @@ export interface OpenCostNamespaceCost {
   idleCost?: number
 }
 
-export type CostUnavailableReason = 'no_prometheus' | 'no_metrics' | 'query_error'
+export type CostUnavailableReason =
+  'no_prometheus' | 'no_metrics' | 'query_error' | 'access_denied' | 'not_found'
 
 export interface OpenCostSummary {
   available: boolean
@@ -419,11 +609,41 @@ export interface OpenCostSummary {
   namespaces?: OpenCostNamespaceCost[]
 }
 
+const noPrometheusFirstSeenAt = new Map<string, number>()
+
+function costRefetchInterval(
+  defaultInterval: number | false = COST_REFRESH_INTERVAL_MS,
+  contextName?: string,
+) {
+  return (query: {
+    queryHash?: string
+    queryKey?: unknown
+    state: {
+      data?: { available?: boolean; reason?: CostUnavailableReason }
+      dataUpdatedAt?: number
+    }
+  }) => {
+    const data = query.state.data
+    const queryID = `${contextName ?? 'unknown'}:${query.queryHash ?? JSON.stringify(query.queryKey ?? 'opencost')}`
+    if (data?.available === false && data.reason === 'no_prometheus') {
+      const now = Date.now()
+      const firstSeenAt = noPrometheusFirstSeenAt.get(queryID) ?? now
+      noPrometheusFirstSeenAt.set(queryID, firstSeenAt)
+      return now - firstSeenAt < COST_DISCOVERY_GRACE_MS
+        ? COST_DISCOVERY_RETRY_INTERVAL_MS
+        : defaultInterval
+    }
+    noPrometheusFirstSeenAt.delete(queryID)
+    return defaultInterval
+  }
+}
+
 export function useOpenCostSummary() {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostSummary>({
     queryKey: ['opencost-summary'],
     queryFn: () => fetchJSON('/opencost/summary'),
-    refetchInterval: 60000, // Refresh every minute
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
     staleTime: 30000,
     placeholderData: (prev) => prev, // Keep previous data visible during refetch
   })
@@ -439,6 +659,10 @@ export interface OpenCostWorkloadCost {
   replicas: number
   cpuUsageCost?: number
   memoryUsageCost?: number
+  cpuUsageAvailable: boolean
+  memoryUsageAvailable: boolean
+  cpuAllocationUse: number
+  memoryAllocationUse: number
   efficiency?: number
   idleCost?: number
 }
@@ -451,11 +675,41 @@ export interface OpenCostWorkloadResponse {
 }
 
 export function useOpenCostWorkloads(namespace: string, options?: { enabled?: boolean }) {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostWorkloadResponse>({
     queryKey: ['opencost-workloads', namespace],
     queryFn: () => fetchJSON(`/opencost/workloads?namespace=${encodeURIComponent(namespace)}`),
     enabled: (options?.enabled ?? true) && Boolean(namespace),
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+    staleTime: 30000,
+  })
+}
+
+export interface OpenCostWorkloadDetailResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  namespace: string
+  kind: string
+  name: string
+  current?: OpenCostWorkloadCost
+}
+
+export function useOpenCostWorkload(
+  kind: string,
+  namespace: string,
+  name: string,
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  return useQuery<OpenCostWorkloadDetailResponse>({
+    queryKey: ['opencost-workload', kind, namespace, name],
+    queryFn: () =>
+      fetchJSON(
+        `/opencost/workload/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}`,
+      ),
+    enabled: (options?.enabled ?? true) && Boolean(kind && namespace && name),
     staleTime: 30000,
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
   })
 }
 
@@ -480,18 +734,175 @@ export interface OpenCostTrendResponse {
 }
 
 export function useOpenCostTrend(range_: CostTimeRange = '24h') {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostTrendResponse>({
     queryKey: ['opencost-trend', range_],
     queryFn: () => fetchJSON(`/opencost/trend?range=${range_}`),
     staleTime: 60000,
-    refetchInterval: 120000, // Refresh every 2 minutes
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
     placeholderData: (prev) => prev,
   })
 }
 
+export interface OpenCostWorkloadTrendResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  namespace: string
+  kind: string
+  name: string
+  range: string
+  windowTotalCost?: number
+  dataPoints?: OpenCostTrendDataPoint[]
+}
+
+export function useOpenCostWorkloadTrend(
+  kind: string,
+  namespace: string,
+  name: string,
+  range_: CostTimeRange = '24h',
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  return useQuery<OpenCostWorkloadTrendResponse>({
+    queryKey: ['opencost-workload-trend', kind, namespace, name, range_],
+    queryFn: () =>
+      fetchJSON(
+        `/opencost/workload/${encodeURIComponent(kind)}/${encodeURIComponent(namespace)}/${encodeURIComponent(name)}/trend?range=${range_}`,
+      ),
+    enabled: (options?.enabled ?? true) && Boolean(kind && namespace && name),
+    staleTime: 60000,
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+  })
+}
+
+export interface OpenCostApplicationWorkloadRef {
+  kind: string
+  namespace: string
+  name: string
+}
+
+export interface OpenCostApplicationWorkloadStatus extends OpenCostApplicationWorkloadRef {
+  reason: CostUnavailableReason
+  scaledToZero?: boolean
+}
+
+export interface OpenCostApplicationCostCoverage {
+  total: number
+  included: number
+  unavailable?: OpenCostApplicationWorkloadStatus[]
+  unsupported?: OpenCostApplicationWorkloadRef[]
+}
+
+export interface OpenCostApplicationCostTotals {
+  hourlyCost: number
+  cpuCost: number
+  memoryCost: number
+  replicas: number
+  cpuUsageCost?: number
+  memoryUsageCost?: number
+  cpuUsageAvailable: boolean
+  memoryUsageAvailable: boolean
+  cpuAllocationUse: number
+  memoryAllocationUse: number
+}
+
+export interface OpenCostApplicationWorkloadCost extends OpenCostApplicationWorkloadRef {
+  available: boolean
+  reason?: CostUnavailableReason
+  scaledToZero?: boolean
+  current?: OpenCostWorkloadCost
+}
+
+export interface OpenCostApplicationCostResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  partial?: boolean
+  totals: OpenCostApplicationCostTotals
+  coverage: OpenCostApplicationCostCoverage
+  workloads?: OpenCostApplicationWorkloadCost[]
+}
+
+export interface OpenCostApplicationCostTrendSeries extends OpenCostApplicationWorkloadRef {
+  windowTotalCost?: number
+  dataPoints?: OpenCostTrendDataPoint[]
+}
+
+export interface OpenCostApplicationCostTrendResponse {
+  available: boolean
+  reason?: CostUnavailableReason
+  range: string
+  partial?: boolean
+  windowTotalCost?: number
+  dataPoints?: OpenCostTrendDataPoint[]
+  series?: OpenCostApplicationCostTrendSeries[]
+  coverage: OpenCostApplicationCostCoverage
+}
+
+function stableOpenCostWorkloadRefs(
+  workloads: OpenCostApplicationWorkloadRef[],
+): OpenCostApplicationWorkloadRef[] {
+  const byKey = new Map<string, OpenCostApplicationWorkloadRef>()
+  for (const workload of workloads) {
+    if (!workload.kind || !workload.namespace || !workload.name) continue
+    const ref = {
+      kind: workload.kind,
+      namespace: workload.namespace,
+      name: workload.name,
+    }
+    byKey.set(`${ref.namespace}/${ref.kind}/${ref.name}`, ref)
+  }
+  return [...byKey.values()].sort((a, b) =>
+    `${a.namespace}/${a.kind}/${a.name}`.localeCompare(`${b.namespace}/${b.kind}/${b.name}`),
+  )
+}
+
+export function useOpenCostApplicationCost(
+  workloads: OpenCostApplicationWorkloadRef[],
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  const refs = stableOpenCostWorkloadRefs(workloads)
+  return useQuery<OpenCostApplicationCostResponse>({
+    queryKey: ['opencost-application', refs],
+    queryFn: ({ signal }) =>
+      fetchJSON('/opencost/application', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ workloads: refs }),
+        signal,
+      }),
+    enabled: (options?.enabled ?? true) && refs.length > 0,
+    staleTime: 30000,
+    refetchInterval: costRefetchInterval(COST_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+  })
+}
+
+export function useOpenCostApplicationCostTrend(
+  workloads: OpenCostApplicationWorkloadRef[],
+  range_: CostTimeRange = '24h',
+  options?: { enabled?: boolean },
+) {
+  const clusterInfo = useClusterInfo()
+  const refs = stableOpenCostWorkloadRefs(workloads)
+  return useQuery<OpenCostApplicationCostTrendResponse>({
+    queryKey: ['opencost-application-trend', refs, range_],
+    queryFn: ({ signal }) =>
+      fetchJSON('/opencost/application/trend', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ workloads: refs, range: range_ }),
+        signal,
+      }),
+    enabled: (options?.enabled ?? true) && refs.length > 0,
+    staleTime: 60000,
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
+  })
+}
+
 // Node cost breakdown
 export interface OpenCostNodeCost {
   name: string
+  providerID?: string
   instanceType?: string
   region?: string
   hourlyCost: number
@@ -506,11 +917,12 @@ export interface OpenCostNodeResponse {
 }
 
 export function useOpenCostNodes() {
+  const clusterInfo = useClusterInfo()
   return useQuery<OpenCostNodeResponse>({
     queryKey: ['opencost-nodes'],
     queryFn: () => fetchJSON('/opencost/nodes'),
     staleTime: 60000,
-    refetchInterval: 120000,
+    refetchInterval: costRefetchInterval(COST_TREND_REFRESH_INTERVAL_MS, clusterInfo.data?.context),
     placeholderData: (prev) => prev,
   })
 }
@@ -623,6 +1035,84 @@ export interface RuntimeStats {
   dynamicInformers?: number
 }
 
+// ============================================================================
+// Resource search (GET /api/search) — the existing search engine, RBAC-filtered
+// and ranked server-side. Mirrors internal/search.Hit / .Result.
+// ============================================================================
+
+export interface SearchMatchedField {
+  token: string
+  /** "name" | "namespace" | "label:k" | "annotation:k" | "image" | "kind" | "content:path" */
+  site: string
+  score: number
+}
+
+export interface SearchSummaryContext {
+  health?: string
+  issueCount?: number
+  managedBy?: { kind?: string; name?: string } | null
+}
+
+export interface SearchHit {
+  score: number
+  kind: string
+  group?: string
+  namespace?: string
+  name: string
+  matched?: SearchMatchedField[]
+  summaryContext?: SearchSummaryContext
+  /** Embedder (Radar Hub) only: the cluster this hit belongs to, for
+   *  cross-cluster fleet search. Standalone Radar (single-cluster) leaves these
+   *  unset — the omnibar keys + displays the cluster only when present. */
+  cluster?: string
+  clusterName?: string
+}
+
+export interface SearchResult {
+  hits: SearchHit[]
+  total: number
+  searched: number
+  total_matched: number
+}
+
+const SEARCH_MIN_QUERY = 2
+
+// useSearch hits the resource-search engine. The caller supplies the (already
+// debounced) query; the hook is enabled only past the min length. include=none
+// keeps the per-hit payload identity-only; context=summary attaches
+// health/issueCount per hit (rich rows). React Query's AbortSignal cancels
+// overlapping scans on a new query. keepPreviousData avoids flicker while the
+// next query resolves.
+export function useSearch(
+  query: string,
+  opts?: {
+    limit?: number
+    context?: 'summary' | 'none'
+    enabled?: boolean
+    globalNs?: boolean
+  },
+) {
+  const trimmed = query.trim()
+  const enabled = (opts?.enabled ?? true) && trimmed.length >= SEARCH_MIN_QUERY
+  const limit = opts?.limit ?? 20
+  const context = opts?.context ?? 'summary'
+  // globalNs makes search ignore the per-user namespace-switcher pick and scan
+  // the user's full RBAC ceiling (scope then comes only from the query's `ns:`
+  // tokens). The omnibar opts in so ⌘K is a genuinely global lookup.
+  const globalNs = opts?.globalNs ?? false
+  return useQuery<SearchResult>({
+    queryKey: ['search', trimmed, limit, context, globalNs],
+    queryFn: ({ signal }) =>
+      fetchJSON<SearchResult>(
+        `/search?q=${encodeURIComponent(trimmed)}&limit=${limit}&include=none&context=${context}${globalNs ? '&globalNs=1' : ''}`,
+        signal,
+      ),
+    enabled,
+    staleTime: 2000,
+    placeholderData: (prev) => prev, // keepPreviousData
+  })
+}
+
 export interface HealthResponse {
   status: string
   resourceCount: number
@@ -649,11 +1139,13 @@ export function useCapabilities() {
   })
 }
 
-// Namespace-scoped capabilities: lazy re-check for exec/logs/portForward when
-// global RBAC checks denied them. Users with namespace-scoped RoleBindings may
+// Namespace-scoped capabilities. Users with namespace-scoped RoleBindings may
 // have these permissions in specific namespaces.
-export function useNamespaceCapabilities(namespace: string | undefined, globalCaps: Capabilities) {
-  const needsCheck = namespace && (!globalCaps.exec || !globalCaps.logs || !globalCaps.portForward)
+export function useNamespaceCapabilities(
+  namespace: string | undefined,
+  globalCaps: Capabilities | undefined,
+) {
+  const needsCheck = namespace && globalCaps
   return useQuery<Capabilities>({
     queryKey: ['capabilities', namespace],
     queryFn: () => fetchJSON(`/capabilities?namespace=${encodeURIComponent(namespace!)}`),
@@ -673,6 +1165,10 @@ export interface AuthMe {
   /** Pre-computed Cloud tier from `cloud:<tier>` group prefix.
    *  Absent when not running under Cloud (OSS, OIDC, no role group). */
   cloudRole?: CloudRole
+  /** Proxy mode only: whether an upstream sign-out URL is configured.
+   *  When false, logout clears Radar's cookie but the proxy may re-auth
+   *  the same user on the next request. */
+  proxyLogoutConfigured?: boolean
 }
 
 export function useAuthMe() {
@@ -684,10 +1180,14 @@ export function useAuthMe() {
 }
 
 // Tier ordering for Cloud-role gates. Mirrors radar OSS pkg/auth
-// CloudRole.AtLeast — the SPA must agree with the backend on what
+// CloudRole.AtLeast — the frontend must agree with the backend on what
 // "member-or-higher" means; otherwise we'd hide a button the
 // backend would happily honor (or vice versa).
-const CLOUD_ROLE_RANK: Record<string, number> = { viewer: 1, member: 2, owner: 3 }
+const CLOUD_ROLE_RANK: Record<string, number> = {
+  viewer: 1,
+  member: 2,
+  owner: 3,
+}
 
 /**
  * useCloudRole returns the caller's Cloud tier (`owner` / `member` /
@@ -768,23 +1268,175 @@ export function useNamespaces() {
 }
 
 // Topology (for manual refresh)
-export function useTopology(namespaces: string[], viewMode: string = 'resources', options?: { enabled?: boolean }) {
+export function useTopology(
+  namespaces: string[],
+  viewMode: string = 'resources',
+  options?: {
+    enabled?: boolean
+    includeReplicaSets?: boolean
+    refetchInterval?: number | false
+  },
+) {
   const params = new URLSearchParams()
   if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
   if (viewMode) params.set('view', viewMode)
+  if (options?.includeReplicaSets) params.set('includeReplicaSets', 'true')
   const queryString = params.toString()
 
   return useQuery<Topology>({
-    queryKey: ['topology', namespaces, viewMode],
+    queryKey: ['topology', namespaces, viewMode, options?.includeReplicaSets ?? false],
     queryFn: () => fetchJSON(`/topology${queryString ? `?${queryString}` : ''}`),
     staleTime: 5000, // 5 seconds
     enabled: options?.enabled !== false,
+    refetchInterval: options?.refetchInterval,
+  })
+}
+
+export function useApplications(namespaces: string[], options?: { enabled?: boolean }) {
+  const params = new URLSearchParams()
+  if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
+  const queryString = params.toString()
+
+  const enabled = options?.enabled !== false
+  return useQuery<{ applications: AppRow[] }>({
+    queryKey: ['applications', namespaces],
+    queryFn: () => fetchJSON(`/applications${queryString ? `?${queryString}` : ''}`),
+    staleTime: 30_000,
+    // Only poll while a consumer needs the index; gated off it must not keep the
+    // background refetch alive.
+    enabled,
+    refetchInterval: enabled ? APPLICATIONS_REFRESH_INTERVAL_MS : false,
+  })
+}
+
+export function useApplicationHistory(
+  appKey: string | undefined,
+  namespaces: string[],
+  options?: { enabled?: boolean },
+) {
+  const params = new URLSearchParams()
+  if (appKey) params.set('app', appKey)
+  if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
+  const queryString = params.toString()
+
+  return useQuery<AppHistory>({
+    queryKey: ['application-history', appKey, namespaces],
+    queryFn: appKey ? () => fetchJSON(`/applications/history?${queryString}`) : skipToken,
+    enabled: Boolean(appKey) && (options?.enabled ?? true),
+    staleTime: 15_000,
+    refetchInterval: APPLICATIONS_REFRESH_INTERVAL_MS,
+  })
+}
+
+export function useGitOpsTree(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  namespaces: string[] = [],
+  options?: { enabled?: boolean },
+) {
+  const ns = namespace || '_'
+  const params = new URLSearchParams()
+  if (group) params.set('group', group)
+  if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
+  const queryString = params.toString()
+
+  return useQuery<GitOpsResourceTree>({
+    queryKey: ['gitops-tree', kind, namespace, name, group, namespaces],
+    queryFn: () =>
+      fetchJSON(`/gitops/tree/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    enabled: Boolean(kind && name) && (options?.enabled ?? true),
+    staleTime: 5000,
+  })
+}
+
+// Poll fast (2s) while a sync/rollback is in flight so the user sees the
+// outcome quickly; otherwise rely on staleTime + manual refetch. Argo flips
+// operationState.phase from Running/Terminating to a terminal phase, so this
+// auto-quiesces on completion.
+const INSIGHTS_RUNNING_POLL_MS = 2000
+
+export function useGitOpsInsights(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  namespaces: string[] = [],
+) {
+  const ns = namespace || '_'
+  const params = new URLSearchParams()
+  if (group) params.set('group', group)
+  if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
+  const queryString = params.toString()
+
+  return useQuery<GitOpsInsight>({
+    queryKey: ['gitops-insights', kind, namespace, name, group, namespaces],
+    queryFn: () =>
+      fetchJSON(`/gitops/insights/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    enabled: Boolean(kind && name),
+    staleTime: 5000,
+    refetchInterval: (query) => {
+      const phase = query.state.data?.summary?.operationPhase
+      return phase === 'Running' || phase === 'Terminating' ? INSIGHTS_RUNNING_POLL_MS : false
+    },
+  })
+}
+
+// Full Git-rendered desired-vs-live diff for one Argo CD managed resource.
+// ns/name identify the Application; the ref identifies the managed resource.
+// Fetched on demand — the caller mounts this only when the user opens "Full
+// diff", so it's enabled whenever the ref is resolvable. Errors surface via
+// fetchJSON's ApiError (server {"error"} string as .message).
+export function useArgoResourceDiff(appNamespace: string, appName: string, ref: GitOpsInsightRef) {
+  const ns = appNamespace || '_'
+  const params = new URLSearchParams()
+  if (ref.group) params.set('group', ref.group)
+  params.set('kind', ref.kind)
+  if (ref.namespace) params.set('resourceNamespace', ref.namespace)
+  params.set('resourceName', ref.name)
+
+  return useQuery<GitOpsResourceDiff>({
+    queryKey: ['argo-resource-diff', appNamespace, appName, ref.group, ref.kind, ref.namespace, ref.name],
+    queryFn: () => fetchJSON(`/argo/applications/${ns}/${appName}/resource-diff?${params.toString()}`),
+    enabled: Boolean(appName && ref.kind && ref.name),
+    staleTime: 15_000,
+  })
+}
+
+// Git commit metadata for one deployed revision of an Argo CD Application.
+// Enabled only when a revision is known and the caller passes `enabled` (gated
+// on capabilities.revisionMetadataAvailable). Cached long — a resolved SHA's
+// metadata is effectively immutable.
+export function useArgoRevisionMetadata(
+  appNamespace: string,
+  appName: string,
+  revision: string | undefined,
+  opts?: { sourceIndex?: number; project?: string; enabled?: boolean },
+) {
+  const ns = appNamespace || '_'
+  const params = new URLSearchParams()
+  if (revision) params.set('revision', revision)
+  if (opts?.sourceIndex != null) params.set('sourceIndex', String(opts.sourceIndex))
+  if (opts?.project) params.set('project', opts.project)
+
+  return useQuery<ArgoRevisionMetadata>({
+    queryKey: ['argo-revision-metadata', appNamespace, appName, revision, opts?.sourceIndex, opts?.project],
+    queryFn: () => fetchJSON(`/argo/applications/${ns}/${appName}/revision-metadata?${params.toString()}`),
+    enabled: Boolean(appName && revision) && (opts?.enabled ?? true),
+    staleTime: 5 * 60_000,
   })
 }
 
 // Generic resource fetching - returns resource with relationships
 // Uses '_' as placeholder for cluster-scoped resources (empty namespace)
-export function useResource<T>(kind: string, namespace: string, name: string, group?: string) {
+export function useResource<T>(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+  options?: { enabled?: boolean; refetchInterval?: number | false },
+) {
   // For cluster-scoped resources, use '_' as namespace placeholder
   const ns = namespace || '_'
   const params = new URLSearchParams()
@@ -793,8 +1445,10 @@ export function useResource<T>(kind: string, namespace: string, name: string, gr
 
   const query = useQuery<ResourceWithRelationships<T>>({
     queryKey: ['resource', kind, namespace, name, group],
-    queryFn: () => fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
-    enabled: Boolean(kind && name),  // namespace can be empty for cluster-scoped resources
+    queryFn: () =>
+      fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    enabled: (options?.enabled ?? true) && Boolean(kind && name), // namespace can be empty for cluster-scoped resources
+    refetchInterval: options?.refetchInterval,
   })
 
   // Extract resource and relationships from the response
@@ -803,11 +1457,17 @@ export function useResource<T>(kind: string, namespace: string, name: string, gr
     data: query.data?.resource,
     relationships: query.data?.relationships,
     certificateInfo: query.data?.certificateInfo,
+    hpaDiagnosis: query.data?.hpaDiagnosis,
   }
 }
 
 // Hook that returns full response with relationships explicitly
-export function useResourceWithRelationships<T>(kind: string, namespace: string, name: string, group?: string) {
+export function useResourceWithRelationships<T>(
+  kind: string,
+  namespace: string,
+  name: string,
+  group?: string,
+) {
   const ns = namespace || '_'
   const params = new URLSearchParams()
   if (group) params.set('group', group)
@@ -815,13 +1475,19 @@ export function useResourceWithRelationships<T>(kind: string, namespace: string,
 
   return useQuery<ResourceWithRelationships<T>>({
     queryKey: ['resource', kind, namespace, name, group],
-    queryFn: () => fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
+    queryFn: () =>
+      fetchJSON(`/resources/${kind}/${ns}/${name}${queryString ? `?${queryString}` : ''}`),
     enabled: Boolean(kind && name),
   })
 }
 
 // List resources - queryKey includes group for cache sharing with ResourcesView
-export function useResources<T>(kind: string, namespace?: string, group?: string) {
+export function useResources<T>(
+  kind: string,
+  namespace?: string,
+  group?: string,
+  options?: { enabled?: boolean; refetchInterval?: number | false },
+) {
   const params = new URLSearchParams()
   if (namespace) params.set('namespace', namespace)
   if (group) params.set('group', group)
@@ -830,20 +1496,153 @@ export function useResources<T>(kind: string, namespace?: string, group?: string
   return useQuery<T[]>({
     queryKey: ['resources', kind, group, namespace],
     queryFn: () => fetchJSON(`/resources/${kind}${queryString ? `?${queryString}` : ''}`),
+    enabled: (options?.enabled ?? true) && Boolean(kind),
     staleTime: 30000, // 30 seconds - matches refetchInterval in ResourcesView
+    refetchInterval: options?.refetchInterval,
   })
 }
 
 // Timeline changes (unified view of changes + K8s events)
 export interface UseChangesOptions {
   namespaces?: string[]
-  kind?: string
+  // Kind filter. The server narrows to a single kind (tighter result caps), so
+  // exactly one selected kind is pushed server-side; a multi-kind selection
+  // fetches unfiltered and is narrowed client-side by the caller.
+  kinds?: string[]
   timeRange?: TimeRange
   filter?: string // Filter preset name ('default', 'all', 'warnings-only', 'workloads')
   includeK8sEvents?: boolean
   includeManaged?: boolean
+  includeDeleted?: boolean
   limit?: number
   enabled?: boolean
+  // Cursor-aware refetches: after the first full load, refetches ask the
+  // server only for events that arrived after the highest seq already cached
+  // and merge them in, instead of re-pulling the whole ring. Intended for the
+  // timeline's full-ring (10k) query, where every SSE nudge would otherwise
+  // re-transfer megabytes for a handful of new events.
+  deltaSync?: boolean
+}
+
+// The store epoch guards delta cursors: a restarted store restarts seq
+// numbering, so an epoch change forces a full resync. A periodic full resync
+// also runs as anti-entropy for anything a dropped SSE connection or a
+// server-side eviction could leave behind in the cached copy.
+const FULL_RESYNC_MS = 5 * 60_000
+
+export interface ChangesDeltaMeta {
+  epoch: string
+  lastFullMs: number
+  // Highest seq observed in ANY response for this query — not just what
+  // survived the cap. A delta event older than everything cached gets capped
+  // out of the merge; deriving the cursor from cached rows alone would then
+  // re-request that same event on every refetch until the next full resync.
+  highWaterSeq: number
+}
+const changesDeltaMeta = new Map<string, ChangesDeltaMeta>()
+
+// The since_seq cursor for the next refetch, or 0 for a full fetch. Delta
+// requires an epoch-stamped prior full load, a cached page to merge into, and
+// the anti-entropy full resync not being due.
+export function deltaFetchCursor(
+  meta: ChangesDeltaMeta | undefined,
+  cached: TimelineEvent[] | undefined,
+  nowMs: number,
+): number {
+  if (!meta?.epoch || !cached) return 0
+  if (nowMs - meta.lastFullMs > FULL_RESYNC_MS) return 0
+  return Math.max(meta.highWaterSeq, maxEventSeq(cached))
+}
+
+async function fetchChangesPage(
+  path: string,
+  signal?: AbortSignal,
+): Promise<{ events: TimelineEvent[]; epoch: string; maxSeq: number }> {
+  const response = await apiFetch(`${getApiBase()}${path}`, signal ? { signal } : undefined)
+  if (!response.ok) {
+    const errorData = await response.json().catch(() => ({ error: 'Unknown error' }))
+    throw new ApiError(errorData.error || `HTTP ${response.status}`, response.status, errorData)
+  }
+  const events = (await response.json()) as TimelineEvent[]
+  // maxSeq is the page's frontier computed before the server's
+  // cluster-scoped-RBAC filter — rows dropped THERE still advance the cursor.
+  // (Rows dropped by content filters inside the store query do not; see the
+  // known limitation on the server's handleChanges.)
+  const maxSeq = Number(response.headers.get('X-Radar-Timeline-Max-Seq') ?? '0') || 0
+  return {
+    events,
+    epoch: response.headers.get('X-Radar-Timeline-Epoch') ?? '',
+    maxSeq,
+  }
+}
+
+// Highest store-assigned arrival number in the cached page — the delta cursor.
+export function maxEventSeq(events: TimelineEvent[]): number {
+  let max = 0
+  for (const event of events) {
+    if (event.seq && event.seq > max) max = event.seq
+  }
+  return max
+}
+
+// Merge a delta page into the cached page: a delta row replaces its cached id
+// (a K8s Event count bump re-arrives under the same id), new ids are added,
+// order stays newest-first (arrival number breaks timestamp ties), and the
+// result is capped to the query's limit by dropping the oldest.
+export function mergeDeltaEvents(
+  prev: TimelineEvent[],
+  delta: TimelineEvent[],
+  cap: number,
+): TimelineEvent[] {
+  if (delta.length === 0) return prev
+  const replaced = new Set(delta.map((event) => event.id))
+  const merged = [...delta, ...prev.filter((event) => !replaced.has(event.id))]
+  merged.sort((a, b) => {
+    const byTime = new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
+    if (byTime !== 0) return byTime
+    return (b.seq ?? 0) - (a.seq ?? 0)
+  })
+  return merged.length > cap ? merged.slice(0, cap) : merged
+}
+
+// Delta-sync orchestration for useChanges, extracted so the
+// full-fetch → delta-poll → epoch-mismatch-resync contract is exercisable
+// without a React render. State is passed in explicitly — the cached page and
+// the shared meta store — rather than closed over from module scope, so a
+// caller (and a test) drives it with fresh state each invocation.
+export async function runDeltaSyncFetch(deps: {
+  path: string
+  queryString: string
+  limit: number
+  metaKey: string
+  cached: TimelineEvent[] | undefined
+  metaStore: Map<string, ChangesDeltaMeta>
+  now: number
+  signal?: AbortSignal
+}): Promise<TimelineEvent[]> {
+  const { path, queryString, limit, metaKey, cached, metaStore, now, signal } = deps
+  const meta = metaStore.get(metaKey)
+  const cursor = deltaFetchCursor(meta, cached, now)
+  if (cursor > 0) {
+    const delta = await fetchChangesPage(
+      `${path}${queryString ? '&' : '?'}since_seq=${cursor}`,
+      signal,
+    )
+    if (delta.epoch && delta.epoch === meta!.epoch) {
+      meta!.highWaterSeq = Math.max(meta!.highWaterSeq, delta.maxSeq, maxEventSeq(delta.events))
+      // Returning the cached reference on an empty delta skips re-renders.
+      return delta.events.length ? mergeDeltaEvents(cached!, delta.events, limit) : cached!
+    }
+    // Epoch changed — the store restarted and seq numbering reset, so the
+    // cursor is meaningless. Fall through to a full resync.
+  }
+  const full = await fetchChangesPage(path, signal)
+  metaStore.set(metaKey, {
+    epoch: full.epoch,
+    lastFullMs: now,
+    highWaterSeq: Math.max(full.maxSeq, maxEventSeq(full.events)),
+  })
+  return full.events
 }
 
 function getTimeRangeDate(range: TimeRange): Date | null {
@@ -860,20 +1659,41 @@ function getTimeRangeDate(range: TimeRange): Date | null {
       return new Date(now.getTime() - 6 * 60 * 60 * 1000)
     case '24h':
       return new Date(now.getTime() - 24 * 60 * 60 * 1000)
+    case '7d':
+      return new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
+    case '30d':
+      return new Date(now.getTime() - 30 * 24 * 60 * 60 * 1000)
     default:
       return null
   }
 }
 
 export function useChanges(options: UseChangesOptions = {}) {
-  const { namespaces = [], kind, timeRange = '1h', filter = 'all', includeK8sEvents = true, includeManaged = false, limit = 200, enabled = true } = options
+  const {
+    namespaces = [],
+    kinds,
+    timeRange = '1h',
+    filter = 'all',
+    includeK8sEvents = true,
+    includeManaged = false,
+    includeDeleted = true,
+    limit = 200,
+    enabled = true,
+    deltaSync = false,
+  } = options
+  const queryClient = useQueryClient()
+
+  // Only a single-kind selection narrows the server query; a multi-kind
+  // selection is filtered client-side so the server cap isn't spent on one kind.
+  const serverKind = kinds && kinds.length === 1 ? kinds[0] : undefined
 
   const params = new URLSearchParams()
   if (namespaces.length > 0) params.set('namespaces', namespaces.join(','))
-  if (kind) params.set('kind', kind)
+  if (serverKind) params.set('kind', serverKind)
   if (filter) params.set('filter', filter)
   if (!includeK8sEvents) params.set('include_k8s_events', 'false')
   if (includeManaged) params.set('include_managed', 'true')
+  if (!includeDeleted) params.set('include_deleted', 'false')
   params.set('limit', String(limit))
 
   const sinceDate = getTimeRangeDate(timeRange)
@@ -882,18 +1702,50 @@ export function useChanges(options: UseChangesOptions = {}) {
   }
 
   const queryString = params.toString()
+  const path = `/changes${queryString ? `?${queryString}` : ''}`
+  const queryKey = [
+    'changes',
+    namespaces,
+    serverKind,
+    timeRange,
+    filter,
+    includeK8sEvents,
+    includeManaged,
+    includeDeleted,
+    limit,
+  ]
 
   return useQuery<TimelineEvent[]>({
-    queryKey: ['changes', namespaces, kind, timeRange, filter, includeK8sEvents, includeManaged, limit],
-    queryFn: () => fetchJSON(`/changes${queryString ? `?${queryString}` : ''}`),
-    staleTime: 5000, // Consider data stale after 5 seconds to ensure fresh data on navigation
-    refetchInterval: 60000, // SSE handles real-time updates; this is a fallback
+    queryKey,
+    queryFn: async ({ signal }) => {
+      if (!deltaSync) return fetchJSON(path, signal)
+
+      const metaKey = JSON.stringify(queryKey)
+      const cached = queryClient.getQueryData<TimelineEvent[]>(queryKey)
+      return runDeltaSyncFetch({
+        path,
+        queryString,
+        limit,
+        metaKey,
+        cached,
+        metaStore: changesDeltaMeta,
+        now: Date.now(),
+        signal,
+      })
+    },
+    staleTime: 5000, // Consider data stale after 5 seconds to ensure fresh data on navigation
+    refetchInterval: CHANGES_REFRESH_INTERVAL_MS, // SSE-driven invalidation handles real-time updates; this is the no-SSE fallback
     enabled,
   })
 }
 
 // Children changes for a parent workload (e.g., ReplicaSets and Pods under a Deployment)
-export function useResourceChildren(kind: string, namespace: string, name: string, timeRange: TimeRange = '1h') {
+export function useResourceChildren(
+  kind: string,
+  namespace: string,
+  name: string,
+  timeRange: TimeRange = '1h',
+) {
   const sinceDate = getTimeRangeDate(timeRange)
   const params = new URLSearchParams()
   if (sinceDate) {
@@ -922,7 +1774,11 @@ export interface ResourceEventsResult {
 // K8s events and resource updates are fetched separately so a high-frequency
 // informer update stream (e.g. a CrashLoop status field flapping every few
 // seconds) can never starve out user-meaningful K8s events under a shared limit.
-export function useResourceEvents(kind: string, namespace: string, name: string): ResourceEventsResult {
+export function useResourceEvents(
+  kind: string,
+  namespace: string,
+  name: string,
+): ResourceEventsResult {
   // The timeline store keys events by their K8s Kind (singular PascalCase, e.g. "Pod"),
   // but callers pass the URL-form kind ("pods").
   const singularKind = pluralToKind(kind)
@@ -935,6 +1791,7 @@ export function useResourceEvents(kind: string, namespace: string, name: string)
     const p = new URLSearchParams()
     p.set('namespace', namespace)
     p.set('kind', singularKind)
+    p.set('name', name)
     p.set('include_managed', 'true')
     p.set('since', since)
     return p
@@ -951,8 +1808,7 @@ export function useResourceEvents(kind: string, namespace: string, name: string)
       const params = baseParams()
       params.set('sources', 'k8s_event')
       params.set('limit', '500')
-      const events = await fetchJSON<TimelineEvent[]>(`/changes?${params.toString()}`)
-      return events.filter(e => e.name === name)
+      return fetchJSON<TimelineEvent[]>(`/changes?${params.toString()}`)
     },
     enabled,
     refetchInterval: 15000,
@@ -966,8 +1822,7 @@ export function useResourceEvents(kind: string, namespace: string, name: string)
       const params = baseParams()
       params.set('sources', 'informer,historical')
       params.set('limit', '50')
-      const events = await fetchJSON<TimelineEvent[]>(`/changes?${params.toString()}`)
-      return events.filter(e => e.name === name)
+      return fetchJSON<TimelineEvent[]>(`/changes?${params.toString()}`)
     },
     enabled,
     refetchInterval: 15000,
@@ -989,8 +1844,8 @@ export function useResourceEvents(kind: string, namespace: string, name: string)
 export interface ContainerMetrics {
   name: string
   usage: {
-    cpu: string      // e.g., "10m" (millicores)
-    memory: string   // e.g., "128Mi"
+    cpu: string // e.g., "10m" (millicores)
+    memory: string // e.g., "128Mi"
   }
 }
 
@@ -1018,25 +1873,44 @@ export interface NodeMetrics {
   }
 }
 
+async function fetchMetricsOrNull<T>(path: string): Promise<T | null> {
+  try {
+    return await fetchJSON<T>(path)
+  } catch (error) {
+    if (isMetricsUnavailableError(error)) return null
+    throw error
+  }
+}
+
+function retryMetricsQuery(failureCount: number, error: unknown): boolean {
+  return !isMetricsUnavailableError(error) && failureCount < 1
+}
+
 // Fetch metrics for a specific pod
-export function usePodMetrics(namespace: string, podName: string) {
-  return useQuery<PodMetrics>({
+export function usePodMetrics(namespace: string, podName: string, options?: { enabled?: boolean }) {
+  return useQuery<PodMetrics | null>({
     queryKey: ['pod-metrics', namespace, podName],
-    queryFn: () => fetchJSON(`/metrics/pods/${namespace}/${podName}`),
-    enabled: Boolean(namespace && podName),
-    staleTime: 15000, // Metrics are fresh for 15 seconds
-    refetchInterval: 30000, // Refresh every 30 seconds
+    queryFn: () => fetchMetricsOrNull<PodMetrics>(`/metrics/pods/${namespace}/${podName}`),
+    enabled: Boolean(namespace && podName) && (options?.enabled ?? true),
+    staleTime: 15000,
+    refetchInterval: 30000,
+    refetchOnMount: 'always',
+    refetchOnReconnect: 'always',
+    retry: retryMetricsQuery,
   })
 }
 
 // Fetch metrics for a specific node
-export function useNodeMetrics(nodeName: string) {
-  return useQuery<NodeMetrics>({
+export function useNodeMetrics(nodeName: string, options?: { enabled?: boolean }) {
+  return useQuery<NodeMetrics | null>({
     queryKey: ['node-metrics', nodeName],
-    queryFn: () => fetchJSON(`/metrics/nodes/${nodeName}`),
-    enabled: Boolean(nodeName),
+    queryFn: () => fetchMetricsOrNull<NodeMetrics>(`/metrics/nodes/${nodeName}`),
+    enabled: Boolean(nodeName) && (options?.enabled ?? true),
     staleTime: 15000,
     refetchInterval: 30000,
+    refetchOnMount: 'always',
+    refetchOnReconnect: 'always',
+    retry: retryMetricsQuery,
   })
 }
 
@@ -1046,8 +1920,8 @@ export function useNodeMetrics(nodeName: string) {
 
 export interface MetricsDataPoint {
   timestamp: string
-  cpu: number      // CPU in nanocores
-  memory: number   // Memory in bytes
+  cpu: number // CPU in nanocores
+  memory: number // Memory in bytes
 }
 
 export interface ContainerMetricsHistory {
@@ -1060,19 +1934,77 @@ export interface PodMetricsHistory {
   name: string
   containers: ContainerMetricsHistory[]
   collectionError?: string
+  rawCollectionError?: string
+  metricsUnavailableDiagnosis?: string
+  metricsUnavailable?: boolean
+  metricsUnavailableReason?: string
 }
 
 export interface NodeMetricsHistory {
   name: string
   dataPoints: MetricsDataPoint[]
   collectionError?: string
+  rawCollectionError?: string
+  metricsUnavailableDiagnosis?: string
+  metricsUnavailable?: boolean
+  metricsUnavailableReason?: string
+}
+
+function withoutCollectionError<
+  T extends { collectionError?: string; rawCollectionError?: string },
+>(history: T): T {
+  const next = { ...history }
+  delete next.collectionError
+  delete next.rawCollectionError
+  return next
+}
+
+export function normalizePodMetricsHistory(history: PodMetricsHistory): PodMetricsHistory {
+  if (history.metricsUnavailable !== true) return history
+  return {
+    ...withoutCollectionError(history),
+    metricsUnavailable: true,
+    metricsUnavailableReason: history.rawCollectionError || history.collectionError,
+  }
+}
+
+export function normalizeNodeMetricsHistory(history: NodeMetricsHistory): NodeMetricsHistory {
+  if (history.metricsUnavailable !== true) return history
+  return {
+    ...withoutCollectionError(history),
+    metricsUnavailable: true,
+    metricsUnavailableReason: history.rawCollectionError || history.collectionError,
+  }
+}
+
+export function shouldFetchLiveMetrics(
+  historySettled: boolean,
+  metricsUnavailable: boolean,
+): boolean {
+  return historySettled && !metricsUnavailable
+}
+
+export function isLiveMetricsUnavailable(liveMetricsEnabled: boolean, metrics: unknown): boolean {
+  return liveMetricsEnabled && metrics === null
+}
+
+export function getVisibleLiveMetrics<T>(
+  liveMetricsEnabled: boolean,
+  metricsUnavailable: boolean,
+  metrics: T | null | undefined,
+): T | undefined {
+  if (!liveMetricsEnabled || metricsUnavailable) return undefined
+  return metrics ?? undefined
 }
 
 // Fetch historical metrics for a pod (last ~1 hour)
 export function usePodMetricsHistory(namespace: string, podName: string) {
   return useQuery<PodMetricsHistory>({
     queryKey: ['pod-metrics-history', namespace, podName],
-    queryFn: () => fetchJSON(`/metrics/pods/${namespace}/${podName}/history`),
+    queryFn: async () =>
+      normalizePodMetricsHistory(
+        await fetchJSON<PodMetricsHistory>(`/metrics/pods/${namespace}/${podName}/history`),
+      ),
     enabled: Boolean(namespace && podName),
     staleTime: 25000, // Slightly less than poll interval
     refetchInterval: 30000, // Match the backend poll interval
@@ -1083,7 +2015,10 @@ export function usePodMetricsHistory(namespace: string, podName: string) {
 export function useNodeMetricsHistory(nodeName: string) {
   return useQuery<NodeMetricsHistory>({
     queryKey: ['node-metrics-history', nodeName],
-    queryFn: () => fetchJSON(`/metrics/nodes/${nodeName}/history`),
+    queryFn: async () =>
+      normalizeNodeMetricsHistory(
+        await fetchJSON<NodeMetricsHistory>(`/metrics/nodes/${nodeName}/history`),
+      ),
     enabled: Boolean(nodeName),
     staleTime: 25000,
     refetchInterval: 30000,
@@ -1094,38 +2029,45 @@ export function useNodeMetricsHistory(nodeName: string) {
 export interface TopPodMetrics {
   namespace: string
   name: string
-  cpu: number           // nanocores (usage)
-  memory: number        // bytes (usage)
-  cpuRequest: number    // nanocores (sum across containers)
-  cpuLimit: number      // nanocores (sum across containers)
+  cpu: number // nanocores (usage)
+  memory: number // bytes (usage)
+  cpuRequest: number // nanocores (sum across containers)
+  cpuLimit: number // nanocores (sum across containers)
   memoryRequest: number // bytes (sum across containers)
-  memoryLimit: number   // bytes (sum across containers)
+  memoryLimit: number // bytes (sum across containers)
 }
 
 export interface TopNodeMetrics {
   name: string
-  cpu: number              // nanocores (usage)
-  memory: number           // bytes (usage)
-  podCount: number         // pods scheduled on this node
-  cpuAllocatable: number   // nanocores
+  cpu: number // nanocores (usage)
+  memory: number // bytes (usage)
+  podCount: number // pods scheduled on this node
+  cpuAllocatable: number // nanocores
   memoryAllocatable: number // bytes
 }
 
-// Fetch bulk metrics for all pods (for CPU/Memory columns in resource table)
-export function useTopPodMetrics() {
+// Fetch bulk metrics for pods (for CPU/Memory columns in resource table)
+export function useTopPodMetrics(options?: { enabled?: boolean; namespaces?: string[] }) {
+  const namespacesParam = options?.namespaces?.join(',') ?? ''
+  const params = new URLSearchParams()
+  if (namespacesParam) params.set('namespaces', namespacesParam)
+  const queryString = params.toString()
+
   return useQuery<TopPodMetrics[]>({
-    queryKey: ['top-pod-metrics'],
-    queryFn: () => fetchJSON('/metrics/top/pods'),
+    queryKey: ['top-pod-metrics', namespacesParam],
+    queryFn: () => fetchJSON(`/metrics/top/pods${queryString ? `?${queryString}` : ''}`),
+    enabled: options?.enabled ?? true,
     staleTime: 25000,
     refetchInterval: 30000,
   })
 }
 
 // Fetch bulk metrics for all nodes (for CPU/Memory columns in resource table)
-export function useTopNodeMetrics() {
+export function useTopNodeMetrics(options?: { enabled?: boolean }) {
   return useQuery<TopNodeMetrics[]>({
     queryKey: ['top-node-metrics'],
     queryFn: () => fetchJSON('/metrics/top/nodes'),
+    enabled: options?.enabled ?? true,
     staleTime: 25000,
     refetchInterval: 30000,
   })
@@ -1150,19 +2092,21 @@ export interface PrometheusStatus {
   error?: string
 }
 
-export interface PrometheusDataPoint {
-  timestamp: number
-  value: number
-}
+// Time-series sample types live in @skyhook-io/k8s-ui (shared with library
+// consumers). Re-export here so radar-app callers keep their existing import
+// paths; the Prom-prefixed names are deprecated aliases.
+export type {
+  TimeSeriesPoint,
+  TimeSeries,
+  PrometheusDataPoint,
+  PrometheusSeries,
+} from '@skyhook-io/k8s-ui/components/charts'
 
-export interface PrometheusSeries {
-  labels: Record<string, string>
-  dataPoints: PrometheusDataPoint[]
-}
+import type { TimeSeries as ChartTimeSeries } from '@skyhook-io/k8s-ui/components/charts'
 
 export interface PrometheusQueryResult {
   resultType: string
-  series: PrometheusSeries[]
+  series: ChartTimeSeries[]
 }
 
 export interface PrometheusResourceMetrics {
@@ -1174,11 +2118,115 @@ export interface PrometheusResourceMetrics {
   range: string
   result: PrometheusQueryResult
   query?: string // PromQL query (included when result is empty, for diagnostics)
-  hint?: string  // Contextual hint when results are empty (e.g. cri-docker label issues)
+  hint?: string // Contextual hint when results are empty (e.g. cri-docker label issues)
+}
+
+export type PrometheusMetricCategory =
+  'cpu' | 'memory' | 'network_rx' | 'network_tx' | 'filesystem' | 'restarts'
+export type PrometheusTimeRange =
+  '10m' | '30m' | '1h' | '3h' | '6h' | '12h' | '24h' | '48h' | '7d' | '14d'
+
+// PVC usage at a moment in time, derived from kubelet_volume_stats_*.
+// HasData=false silently indicates the CSI driver doesn't report or Prom
+// isn't scraping kubelet endpoints — UI should hide the gauge in that case.
+export interface PrometheusPVCUsage {
+  namespace: string
+  name: string
+  used: number
+  capacity: number
+  ratio: number
+  hasData: boolean
+}
+
+export type RightsizingFit =
+  'balanced' | 'oversized' | 'under_requested' | 'missing_request' | 'insufficient_history'
+export type RightsizingConfidence = 'low' | 'medium' | 'high'
+export type RightsizingOwnerCoverage = 'ksm_history' | 'current_pods'
+
+export interface RightsizingRow {
+  container: string
+  resource: 'cpu' | 'memory'
+  fit: RightsizingFit
+  confidence: RightsizingConfidence
+  currentRequest?: string
+  currentRequestValue?: number
+  currentLimit?: string
+  currentLimitValue?: number
+  observed?: {
+    name: 'P95' | 'P99' | 'Max'
+    value: number
+    formatted: string
+  }
+  peak?: {
+    name: 'P99'
+    value: number
+    formatted: string
+  }
+  calculatedRequest?: string
+  calculatedRequestValue?: number
+  recommendedRequest?: string
+  recommendedRequestValue?: number
+  reductionLimited?: boolean
+  bursty?: boolean
+  recommendationReason?: string
+  sampleCount: number
+  expectedSamples: number
+  coverage: number
+  hpaManaged: boolean
+  hpaEvidenceAvailable: boolean
+  throttleAvailable?: boolean
+  throttleRatio?: number
+  currentPodOOM?: boolean
+  windowOomEvidence?: boolean
+  oomEvidenceAvailable: boolean
+  limitConflict?: boolean
+  queryError?: string
+}
+
+export interface PrometheusRightsizing {
+  kind: string
+  namespace: string
+  name: string
+  window: string
+  source: 'radar'
+  ownerCoverage: RightsizingOwnerCoverage
+  scaledToZero: boolean
+  sampleAvailable: boolean
+  rows: RightsizingRow[]
+  reason?: string
+}
+
+export type RightsizingScanState = 'complete' | 'partial' | 'unavailable'
+
+export interface RightsizingScanWorkload {
+  kind: string
+  namespace: string
+  name: string
+  replicas: number
+  scaledToZero: boolean
+  rows: RightsizingRow[]
 }
 
-export type PrometheusMetricCategory = 'cpu' | 'memory' | 'network_rx' | 'network_tx' | 'filesystem'
-export type PrometheusTimeRange = '10m' | '30m' | '1h' | '3h' | '6h' | '12h' | '24h' | '48h' | '7d' | '14d'
+export interface RightsizingScanCoverage {
+  workloadsDiscovered: number
+  workloadsEvaluated: number
+  workloadsWithData: number
+  batches: number
+  completedBatches: number
+  restrictedKinds?: string[]
+  unavailableKinds?: string[]
+}
+
+export interface RightsizingScanResponse {
+  state: RightsizingScanState
+  scannedAt: string
+  window: string
+  source: 'radar'
+  coverage: RightsizingScanCoverage
+  workloads: RightsizingScanWorkload[]
+  warnings?: { code: string; message: string }[]
+  reason?: string
+}
 
 // Check Prometheus availability
 export function usePrometheusStatus() {
@@ -1190,12 +2238,32 @@ export function usePrometheusStatus() {
   })
 }
 
+export interface ArgoStatus {
+  // configured = a URL or token is set; connected = a probe has landed and the
+  // client is live. The two differ right after a restart (configured, reconnecting).
+  configured: boolean
+  connected: boolean
+  address?: string
+}
+
+export function useArgoStatus(enabled = true) {
+  return useQuery<ArgoStatus>({
+    queryKey: ['argocd-status'],
+    queryFn: () => fetchJSON('/integrations/argocd/status'),
+    enabled,
+    staleTime: 30000,
+    refetchInterval: 60000,
+  })
+}
+
 // Connect to Prometheus (trigger discovery)
 export function usePrometheusConnect() {
   const queryClient = useQueryClient()
   return useMutation({
     mutationFn: async () => {
-      const resp = await apiFetch(`${getApiBase()}/prometheus/connect`, { method: 'POST' })
+      const resp = await apiFetch(`${getApiBase()}/prometheus/connect`, {
+        method: 'POST',
+      })
       if (!resp.ok) {
         const body = await resp.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(body.error || `HTTP ${resp.status}`)
@@ -1212,6 +2280,97 @@ export function usePrometheusConnect() {
   })
 }
 
+// Auto-discover Prometheus on first mount of any Prom-backed view, and
+// auto-reconnect across radar restarts on subsequent mounts.
+//
+// Two paths through this hook, both running once per cluster context per
+// component-instance:
+//   1. Cached path — localStorage flag means "Prom was discovered before on
+//      this context". Probe fires immediately on mount; the user sees
+//      charts populate without manual interaction.
+//   2. First-time path — no flag yet. Probe fires after a small delay so the
+//      initial workload-view render lands before we hit the cluster network.
+//      Behavior matches Lens / Headlamp defaults; the trade-off is one
+//      cluster probe per session per fresh kubeconfig context.
+//
+// On success either way we set the flag, so subsequent mounts take path 1.
+// On failure we clear the flag (path 1) or leave it cleared (path 2) and
+// reset attemptedRef, so the existing "Discover Prometheus" CTA renders
+// once status refreshes. Manual interaction stays available as the fallback.
+//
+// localStorage is the right surface: connection intent is browser-local,
+// not a server-side preference, and we want it to persist across radar
+// restarts on the same port.
+const PROM_AUTOCONNECT_PREFIX = 'radar.prometheus.autoConnect:'
+// First-mount delay before probing the cluster. Chosen short enough that the
+// CTA → charts transition feels prompt, long enough that the probe doesn't
+// race the initial workload-view render.
+const PROM_FIRSTLAUNCH_PROBE_DELAY_MS = 500
+
+function promAutoConnectKey(contextName: string): string {
+  return `${PROM_AUTOCONNECT_PREFIX}${contextName}`
+}
+
+export function useAutoPromConnect(): void {
+  const queryClient = useQueryClient()
+  const { data: clusterInfo } = useClusterInfo()
+  const { data: status, isLoading: statusLoading } = usePrometheusStatus()
+  const attemptedRef = useRef<string | null>(null)
+
+  useEffect(() => {
+    if (typeof window === 'undefined') return
+    const context = clusterInfo?.context
+    if (!context || statusLoading) return
+
+    // Persist the "we've connected here before" signal once a connection lands.
+    if (status?.connected) {
+      try {
+        window.localStorage.setItem(promAutoConnectKey(context), '1')
+      } catch {
+        // localStorage can throw in some restricted browser modes — fail open.
+      }
+      return
+    }
+
+    if (attemptedRef.current === context) return
+    let cached: string | null = null
+    try {
+      cached = window.localStorage.getItem(promAutoConnectKey(context))
+    } catch {
+      // keep the null fallback
+    }
+
+    attemptedRef.current = context
+
+    // Cached path probes immediately; first-time path defers briefly so the
+    // initial UI render isn't competing with the cluster network call.
+    const delay = cached === '1' ? 0 : PROM_FIRSTLAUNCH_PROBE_DELAY_MS
+    const timeout = window.setTimeout(() => {
+      // Direct apiFetch (not via the usePrometheusConnect mutation) so the
+      // meta-driven toast handler stays silent — the user didn't click anything.
+      apiFetch(`${getApiBase()}/prometheus/connect?optional=true`, {
+        method: 'POST',
+      })
+        .then(async (resp) => {
+          if (!resp.ok) throw new Error(`HTTP ${resp.status}`)
+          const nextStatus = (await resp.json()) as PrometheusStatus
+          queryClient.setQueryData(['prometheus-status'], nextStatus)
+          if (!nextStatus.connected) throw new Error(nextStatus.error || 'Prometheus unavailable')
+          queryClient.invalidateQueries({ queryKey: ['prometheus-status'] })
+        })
+        .catch(() => {
+          try {
+            window.localStorage.removeItem(promAutoConnectKey(context))
+          } catch {
+            // ignore — manual CTA will render once status refreshes
+          }
+          attemptedRef.current = null
+        })
+    }, delay)
+    return () => window.clearTimeout(timeout)
+  }, [clusterInfo?.context, status?.connected, statusLoading, queryClient])
+}
+
 // Fetch Prometheus metrics for a resource
 export function usePrometheusResourceMetrics(
   kind: string,
@@ -1260,14 +2419,100 @@ export function usePrometheusClusterMetrics(
 ) {
   return useQuery<PrometheusResourceMetrics>({
     queryKey: ['prometheus-cluster-metrics', category, range],
-    queryFn: () =>
-      fetchJSON(`/prometheus/cluster?category=${category}&range=${range}`),
+    queryFn: () => fetchJSON(`/prometheus/cluster?category=${category}&range=${range}`),
     enabled,
     staleTime: 30000,
     refetchInterval: 60000,
   })
 }
 
+// Fetch PVC usage. hasData=false when no series — UI should hide the gauge.
+export function usePrometheusPVCUsage(namespace: string, name: string, enabled = true) {
+  return useQuery<PrometheusPVCUsage>({
+    queryKey: ['prometheus-pvc-usage', namespace, name],
+    queryFn: () => fetchJSON(`/prometheus/pvc/${namespace}/${name}`),
+    enabled: enabled && Boolean(namespace && name),
+    staleTime: 60000,
+    refetchInterval: 120000,
+  })
+}
+
+// Fetch rightsizing recommendations for a workload (Deployment / StatefulSet / DaemonSet).
+export function usePrometheusRightsizing(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
+  return useQuery<PrometheusRightsizing>({
+    queryKey: ['prometheus-rightsizing', kind, namespace, name],
+    queryFn: () => fetchJSON(`/prometheus/rightsizing/${kind}/${namespace}/${name}`),
+    enabled: enabled && Boolean(kind && namespace && name),
+    staleTime: 5 * 60 * 1000,
+    refetchInterval: 10 * 60 * 1000,
+  })
+}
+
+const RIGHTSIZING_SCAN_CACHE_TIME = 5 * 60 * 1000
+
+export function getRightsizingScanCacheConfig(
+  namespaces: string[],
+  context = '',
+): {
+  namespaceKey: string
+  queryKey: readonly ['prometheus-rightsizing-scan', string, string]
+  queryFn: typeof skipToken
+  gcTime: number
+} {
+  const namespaceKey = [...namespaces].sort().join(',')
+  return {
+    namespaceKey,
+    queryKey: ['prometheus-rightsizing-scan', context, namespaceKey] as const,
+    queryFn: skipToken,
+    gcTime: RIGHTSIZING_SCAN_CACHE_TIME,
+  }
+}
+
+// A fleet rightsizing scan is intentionally manual. It can query seven days of
+// Prometheus history for many containers, so navigation alone must never run it.
+export function useRightsizingScan(namespaces: string[], context = '') {
+  const queryClient = useQueryClient()
+  const { namespaceKey, ...snapshotOptions } = getRightsizingScanCacheConfig(namespaces, context)
+  const scanScope = { namespaceKey, queryKey: snapshotOptions.queryKey }
+  const snapshot = useQuery<RightsizingScanResponse>(snapshotOptions)
+  const mutation = useMutation({
+    mutationFn: async (startedScope: typeof scanScope) => {
+      const params = new URLSearchParams()
+      if (startedScope.namespaceKey) params.set('namespaces', startedScope.namespaceKey)
+      const query = params.toString()
+      return fetchJSON<RightsizingScanResponse>(
+        `/prometheus/rightsizing/scan${query ? `?${query}` : ''}`,
+        {
+          method: 'POST',
+        },
+      )
+    },
+    onSuccess: (result, startedScope) => queryClient.setQueryData(startedScope.queryKey, result),
+  })
+  return {
+    ...mutation,
+    data: snapshot.data,
+    mutate: () => mutation.mutate(scanScope),
+    mutateAsync: () => mutation.mutateAsync(scanScope),
+  }
+}
+
+// Raw PromQL query (range). Used by HPA charts for status_current_replicas etc.
+export function usePromQLRange(query: string, range: PrometheusTimeRange = '1h', enabled = true) {
+  return useQuery<PrometheusQueryResult>({
+    queryKey: ['promql-range', query, range],
+    queryFn: () => fetchJSON(`/prometheus/query?query=${encodeURIComponent(query)}&range=${range}`),
+    enabled: enabled && Boolean(query),
+    staleTime: 30000,
+    refetchInterval: 60000,
+  })
+}
+
 // ============================================================================
 // Pod Logs
 // ============================================================================
@@ -1294,12 +2539,16 @@ export interface LogStreamEvent {
 }
 
 // Fetch pod logs (non-streaming)
-export function usePodLogs(namespace: string, podName: string, options?: {
-  container?: string
-  tailLines?: number
-  previous?: boolean
-  sinceSeconds?: number
-}) {
+export function usePodLogs(
+  namespace: string,
+  podName: string,
+  options?: {
+    container?: string
+    tailLines?: number
+    previous?: boolean
+    sinceSeconds?: number
+  },
+) {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
   if (options?.tailLines) params.set('tailLines', String(options.tailLines))
@@ -1308,8 +2557,17 @@ export function usePodLogs(namespace: string, podName: string, options?: {
   const queryString = params.toString()
 
   return useQuery<LogsResponse>({
-    queryKey: ['pod-logs', namespace, podName, options?.container, options?.tailLines, options?.previous, options?.sinceSeconds],
-    queryFn: () => fetchJSON(`/pods/${namespace}/${podName}/logs${queryString ? `?${queryString}` : ''}`),
+    queryKey: [
+      'pod-logs',
+      namespace,
+      podName,
+      options?.container,
+      options?.tailLines,
+      options?.previous,
+      options?.sinceSeconds,
+    ],
+    queryFn: () =>
+      fetchJSON(`/pods/${namespace}/${podName}/logs${queryString ? `?${queryString}` : ''}`),
     enabled: Boolean(namespace && podName),
     staleTime: 5000, // Allow refetch after 5 seconds
   })
@@ -1324,7 +2582,7 @@ export function createLogStream(
     tailLines?: number
     previous?: boolean
     sinceSeconds?: number
-  }
+  },
 ): EventSource {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
@@ -1333,9 +2591,12 @@ export function createLogStream(
   if (options?.sinceSeconds) params.set('sinceSeconds', String(options.sinceSeconds))
   const queryString = params.toString()
 
-  return new EventSource(`${getApiBase()}/pods/${namespace}/${podName}/logs/stream${queryString ? `?${queryString}` : ''}`, {
-    withCredentials: getCredentialsMode() === 'include',
-  })
+  return new EventSource(
+    `${getApiBase()}/pods/${namespace}/${podName}/logs/stream${queryString ? `?${queryString}` : ''}`,
+    {
+      withCredentials: getCredentialsMode() === 'include',
+    },
+  )
 }
 
 // ============================================================================
@@ -1347,6 +2608,7 @@ export interface AvailablePort {
   protocol: string
   containerName?: string
   name?: string
+  scheme?: 'http' | 'https'
 }
 
 export function useAvailablePorts(type: 'pod' | 'service', namespace: string, name: string) {
@@ -1367,8 +2629,37 @@ export function useUpdateResource() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, yaml }: { kind: string; namespace: string; name: string; yaml: string }) => {
-      const response = await apiFetch(`${getApiBase()}/resources/${kind}/${namespace}/${name}`, {
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+      yaml,
+      force = true,
+      reviewedResourceVersion,
+      reviewedContext,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+      yaml: string
+      force?: boolean
+      reviewedResourceVersion?: string
+      reviewedContext?: string
+    }) => {
+      const url = new URL(
+        `${getApiBase()}/resources/${kind}/${namespace}/${name}`,
+        window.location.origin,
+      )
+      if (!force) {
+        url.searchParams.set('force', 'false')
+      }
+      if (reviewedResourceVersion) {
+        url.searchParams.set('resourceVersion', reviewedResourceVersion)
+      }
+      if (reviewedContext) {
+        url.searchParams.set('reviewedContext', reviewedContext)
+      }
+      const response = await apiFetch(url.toString(), {
         method: 'PUT',
         headers: { 'Content-Type': 'text/plain' },
         body: yaml,
@@ -1383,9 +2674,31 @@ export function useUpdateResource() {
       errorMessage: 'Failed to update resource',
       successMessage: 'Resource updated',
     },
-    onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resource', variables.kind, variables.namespace, variables.name] })
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
+    onSuccess: (updated: any, variables) => {
+      // The PUT goes straight to the apiserver and returns the authoritative
+      // object, but the GET behind this query reads Radar's informer cache,
+      // which lags a write by one watch round-trip. Seed the detail cache with
+      // the PUT response so the edit shows immediately. Invalidating here
+      // instead would trigger a refetch that races the seed and re-reads the
+      // lagging cache — the change appears not to have taken effect.
+      if (updated && typeof updated === 'object' && updated.metadata) {
+        queryClient.setQueriesData(
+          {
+            queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+          },
+          (old: any) =>
+            old && typeof old === 'object' && 'resource' in old
+              ? { ...old, resource: updated }
+              : { resource: updated },
+        )
+      } else {
+        queryClient.invalidateQueries({
+          queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+        })
+      }
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1394,13 +2707,24 @@ export function useUpdateResource() {
 // Cascade delete preview — shows resources that will be garbage-collected
 export interface CascadeDeletePreview {
   root: { kind: string; namespace: string; name: string; group?: string }
-  dependents: { kind: string; namespace: string; name: string; group?: string }[]
+  dependents: {
+    kind: string
+    namespace: string
+    name: string
+    group?: string
+  }[]
 }
 
-export function useCascadeDeletePreview(kind: string, namespace: string, name: string, enabled: boolean) {
+export function useCascadeDeletePreview(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled: boolean,
+) {
   return useQuery<CascadeDeletePreview>({
     queryKey: ['cascade-preview', kind, namespace, name],
-    queryFn: () => fetchJSON<CascadeDeletePreview>(`/resources/${kind}/${namespace}/${name}/cascade-preview`),
+    queryFn: () =>
+      fetchJSON<CascadeDeletePreview>(`/resources/${kind}/${namespace}/${name}/cascade-preview`),
     enabled,
     staleTime: 30_000,
   })
@@ -1411,8 +2735,26 @@ export function useDeleteResource() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, force }: { kind: string; namespace: string; name: string; force?: boolean }) => {
-      const url = new URL(`${getApiBase()}/resources/${kind}/${namespace}/${name}`, window.location.origin)
+    mutationFn: async ({
+      kind,
+      group,
+      namespace,
+      name,
+      force,
+    }: {
+      kind: string
+      group?: string
+      namespace: string
+      name: string
+      force?: boolean
+    }) => {
+      const url = new URL(
+        `${getApiBase()}/resources/${kind}/${namespace}/${name}`,
+        window.location.origin,
+      )
+      if (group) {
+        url.searchParams.set('group', group)
+      }
       if (force) {
         url.searchParams.set('force', 'true')
       }
@@ -1431,7 +2773,217 @@ export function useDeleteResource() {
       successMessage: 'Resource deleted',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
+      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    },
+  })
+}
+
+export function useBulkDeleteResources() {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationFn: async ({
+      items,
+      force,
+    }: {
+      items: Array<{
+        kind: string
+        group?: string
+        namespace: string
+        name: string
+      }>
+      force?: boolean
+    }) => {
+      const results = await Promise.allSettled(
+        items.map(async ({ kind, group, namespace, name }) => {
+          const url = new URL(
+            `${getApiBase()}/resources/${kind}/${namespace}/${name}`,
+            window.location.origin,
+          )
+          if (group) url.searchParams.set('group', group)
+          if (force) url.searchParams.set('force', 'true')
+          const response = await apiFetch(url.toString(), { method: 'DELETE' })
+          if (!response.ok) {
+            const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+            throw new Error(error.error || `Failed to delete ${namespace}/${name}`)
+          }
+          return { kind, namespace, name }
+        }),
+      )
+      const failed = results.filter((r) => r.status === 'rejected')
+      if (failed.length > 0) {
+        throw new Error(`Failed to delete ${failed.length} of ${items.length} resources`)
+      }
+      return { deleted: items.length }
+    },
+    meta: {
+      errorMessage: 'Failed to delete some resources',
+      successMessage: 'Resources deleted',
+    },
+    // onSettled, not onSuccess — a partial failure still deleted some
+    // resources, and the table must refetch to drop them.
+    onSettled: () => {
+      queryClient.invalidateQueries({ queryKey: ['resources'] })
+      queryClient.invalidateQueries({ queryKey: ['resource-counts'] })
+      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    },
+  })
+}
+
+interface BulkWorkloadItem {
+  kind: string
+  namespace: string
+  name: string
+}
+
+interface BulkWorkloadMutationResult {
+  requested: number
+  succeeded: number
+  failedMessages: string[]
+}
+
+function failedBulkWorkloadMessages(results: PromiseSettledResult<unknown>[]): string[] {
+  return results.flatMap((r) =>
+    r.status === 'rejected'
+      ? [r.reason instanceof Error ? r.reason.message : String(r.reason)]
+      : [],
+  )
+}
+
+function bulkWorkloadFailureMessage(
+  action: string,
+  failed: number,
+  total: number,
+  messages: string[],
+): string {
+  return `Failed to ${action} ${failed} of ${total} workloads:\n${messages.join('\n')}`
+}
+
+export function useBulkRestartWorkloads() {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationFn: async ({
+      items,
+    }: {
+      items: BulkWorkloadItem[]
+    }): Promise<BulkWorkloadMutationResult> => {
+      if (items.length === 0) {
+        return { requested: 0, succeeded: 0, failedMessages: [] }
+      }
+      const results = await Promise.allSettled(
+        items.map(async ({ kind, namespace, name }) => {
+          const response = await apiFetch(
+            `${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`,
+            {
+              method: 'POST',
+            },
+          )
+          if (!response.ok) {
+            const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+            throw new Error(`${namespace}/${name}: ${error.error || `HTTP ${response.status}`}`)
+          }
+          return { kind, namespace, name }
+        }),
+      )
+      const failedMessages = failedBulkWorkloadMessages(results)
+      if (failedMessages.length === items.length) {
+        throw new Error(
+          bulkWorkloadFailureMessage(
+            'restart',
+            failedMessages.length,
+            items.length,
+            failedMessages,
+          ),
+        )
+      }
+      return {
+        requested: items.length,
+        succeeded: items.length - failedMessages.length,
+        failedMessages,
+      }
+    },
+    meta: {
+      errorMessage: 'Failed to restart some workloads',
+    },
+    onSuccess: (result) => {
+      if (result.failedMessages.length > 0) {
+        showApiError(
+          `Restarted ${result.succeeded} of ${result.requested} workloads`,
+          result.failedMessages.join('\n'),
+        )
+      } else {
+        showApiSuccess('Workloads restarting')
+      }
+    },
+    onSettled: () => {
+      queryClient.invalidateQueries({ queryKey: ['resources'] })
+      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    },
+  })
+}
+
+export function useBulkScaleWorkloads() {
+  const queryClient = useQueryClient()
+
+  return useMutation({
+    mutationFn: async ({
+      items,
+      replicas,
+    }: {
+      items: BulkWorkloadItem[]
+      replicas: number
+    }): Promise<BulkWorkloadMutationResult> => {
+      if (items.length === 0) {
+        return { requested: 0, succeeded: 0, failedMessages: [] }
+      }
+      const results = await Promise.allSettled(
+        items.map(async ({ kind, namespace, name }) => {
+          const response = await apiFetch(
+            `${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`,
+            {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json' },
+              body: JSON.stringify({ replicas }),
+            },
+          )
+          if (!response.ok) {
+            const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+            throw new Error(`${namespace}/${name}: ${error.error || `HTTP ${response.status}`}`)
+          }
+          return { kind, namespace, name }
+        }),
+      )
+      const failedMessages = failedBulkWorkloadMessages(results)
+      if (failedMessages.length === items.length) {
+        throw new Error(
+          bulkWorkloadFailureMessage('scale', failedMessages.length, items.length, failedMessages),
+        )
+      }
+      return {
+        requested: items.length,
+        succeeded: items.length - failedMessages.length,
+        failedMessages,
+      }
+    },
+    meta: {
+      errorMessage: 'Failed to scale some workloads',
+    },
+    onSuccess: (result) => {
+      if (result.failedMessages.length > 0) {
+        showApiError(
+          `Scaled ${result.succeeded} of ${result.requested} workloads`,
+          result.failedMessages.join('\n'),
+        )
+      } else {
+        showApiSuccess('Workloads scaled')
+      }
+    },
+    onSettled: () => {
+      queryClient.invalidateQueries({ queryKey: ['resources'] })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1445,30 +2997,193 @@ export interface ApplyResourceResult {
   created: boolean
 }
 
+interface ApplyResourceErrorResponse {
+  error?: string
+  results?: ApplyResourceResult[]
+  failedIndex?: number
+  total?: number
+}
+
+export class ApplyResourceError extends Error {
+  readonly appliedResults: ApplyResourceResult[]
+  readonly failedIndex?: number
+  readonly total?: number
+
+  constructor(payload: ApplyResourceErrorResponse, status: number) {
+    super(formatApplyResourceError(payload, status))
+    this.name = 'ApplyResourceError'
+    this.appliedResults = payload.results ?? []
+    this.failedIndex = payload.failedIndex
+    this.total = payload.total
+  }
+}
+
+export function formatApplyResourceError(
+  payload: ApplyResourceErrorResponse,
+  status: number,
+): string {
+  const message = payload.error || `HTTP ${status}`
+  const applied = payload.results ?? []
+  if (applied.length === 0 || payload.failedIndex === undefined) return message
+
+  const total = payload.total ?? applied.length + 1
+  const appliedLabel = applied.length === 1 ? 'resource was' : 'resources were'
+  const names = applied
+    .slice(0, 3)
+    .map(({ kind, namespace, name }) => `${kind} ${namespace ? `${namespace}/` : ''}${name}`)
+    .join(', ')
+  const more = applied.length > 3 ? ` and ${applied.length - 3} more` : ''
+  const cause = message.replace(/^document \d+:\s*/i, '')
+  return `${applied.length} of ${total} ${appliedLabel} applied before document ${payload.failedIndex + 1} failed. Applied: ${names}${more}. ${cause}`
+}
+
+interface YamlSchemaResponse {
+  documents: Array<{
+    index: number
+    status: 'available' | 'unavailable'
+    bundleKey?: string
+    schemaRef?: string
+    error?: string
+  }>
+  bundles: Record<string, { definitions: Record<string, unknown> }>
+}
+
+export async function fetchYamlSchemas(
+  documents: YamlDocumentIdentity[],
+): Promise<YamlSchemaLoadResult> {
+  const response = await apiFetch(`${getApiBase()}/resources/schemas`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({
+      documents: documents.map(({ index, apiVersion, kind }) => ({
+        index,
+        apiVersion,
+        kind,
+      })),
+    }),
+  })
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({ error: 'Cluster schemas are unavailable' }))
+    throw new Error(error.error || `HTTP ${response.status}`)
+  }
+  const result = (await response.json()) as YamlSchemaResponse
+  const schemas: Array<Record<string, unknown> | null> = documents.map(() => null)
+  const unavailable: Array<{ index: number; reason: string }> = []
+  for (const document of result.documents) {
+    const position = documents.findIndex(({ index }) => index === document.index)
+    if (position < 0) continue
+    const bundle = document.bundleKey ? result.bundles[document.bundleKey] : undefined
+    if (document.status === 'available' && document.schemaRef && bundle) {
+      schemas[position] = {
+        $ref: document.schemaRef,
+        definitions: bundle.definitions,
+      }
+    } else {
+      unavailable.push({
+        index: document.index,
+        reason: document.error || 'Schema unavailable',
+      })
+    }
+  }
+  return { schemas, unavailable }
+}
+
+export interface YamlPreviewDocument {
+  index: number
+  status: 'accepted' | 'rejected' | 'unavailable'
+  apiVersion?: string
+  kind?: string
+  namespace?: string
+  name?: string
+  action?: 'create' | 'update' | 'unknown'
+  submittedYaml?: string
+  baselineYaml?: string
+  predictedYaml?: string
+  warnings?: string[]
+  error?: string
+  reviewedResourceVersion?: string
+  redacted?: boolean
+}
+
+export interface YamlPreviewResponse {
+  documents: YamlPreviewDocument[]
+  nonAtomic: boolean
+  context: string
+}
+
+export interface YamlPreviewRequest {
+  yaml: string
+  mode: 'apply' | 'create' | 'update'
+  force: boolean
+  target?: { kind: string; namespace: string; name: string }
+}
+
+export function usePreviewResources() {
+  return useMutation({
+    mutationFn: async (request: YamlPreviewRequest) => {
+      const response = await apiFetch(`${getApiBase()}/resources/preview`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(request),
+      })
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({ error: 'Preview failed' }))
+        throw new Error(error.error || `HTTP ${response.status}`)
+      }
+      return response.json() as Promise<YamlPreviewResponse>
+    },
+  })
+}
+
 export function useApplyResource() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ yaml, mode = 'apply', dryRun = false }: { yaml: string; mode?: 'apply' | 'create'; dryRun?: boolean }) => {
+    mutationFn: async ({
+      yaml,
+      mode = 'apply',
+      dryRun = false,
+      force = false,
+      reviewedResourceVersions,
+      reviewedContext,
+    }: {
+      yaml: string
+      mode?: 'apply' | 'create'
+      dryRun?: boolean
+      force?: boolean
+      reviewedResourceVersions?: Record<number, string>
+      reviewedContext?: string
+    }) => {
       const url = new URL(`${getApiBase()}/resources/apply`, window.location.origin)
       url.searchParams.set('mode', mode)
       if (dryRun) {
         url.searchParams.set('dryRun', 'true')
       }
+      if (force) {
+        url.searchParams.set('force', 'true')
+      }
+      if (reviewedResourceVersions && Object.keys(reviewedResourceVersions).length > 0) {
+        url.searchParams.set('reviewedVersions', JSON.stringify(reviewedResourceVersions))
+      }
+      if (reviewedContext) {
+        url.searchParams.set('reviewedContext', reviewedContext)
+      }
       const response = await apiFetch(url.toString(), {
         method: 'POST',
         headers: { 'Content-Type': 'text/plain' },
         body: yaml,
       })
       if (!response.ok) {
-        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
-        throw new Error(error.error || `HTTP ${response.status}`)
+        const error = (await response
+          .json()
+          .catch(() => ({ error: 'Unknown error' }))) as ApplyResourceErrorResponse
+        throw new ApplyResourceError(error, response.status)
       }
       return response.json() as Promise<ApplyResourceResult[]>
     },
     // No meta errorMessage/successMessage — the CreateResourceDialog
     // handles all feedback inline to avoid duplicate toasts.
-    onSuccess: () => {
+    onSettled: () => {
       queryClient.invalidateQueries({ queryKey: ['resources'] })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
@@ -1479,6 +3194,25 @@ export function useApplyResource() {
 // CronJob operations
 // ============================================================================
 
+function invalidateCronJobOperationQueries(
+  queryClient: ReturnType<typeof useQueryClient>,
+  namespace: string,
+  name: string,
+) {
+  queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
+  queryClient.invalidateQueries({ queryKey: ['resources', 'jobs'] })
+  queryClient.invalidateQueries({
+    queryKey: ['resource', 'cronjobs', namespace, name],
+  })
+  queryClient.invalidateQueries({
+    queryKey: ['workload-runs', 'cronjobs', namespace, name],
+  })
+  queryClient.invalidateQueries({ queryKey: ['applications'] })
+  queryClient.invalidateQueries({ queryKey: ['dashboard'] })
+  queryClient.invalidateQueries({ queryKey: ['resource-counts'] })
+  queryClient.invalidateQueries({ queryKey: ['topology'] })
+}
+
 // Trigger a CronJob (create a Job from it)
 export function useTriggerCronJob() {
   const queryClient = useQueryClient()
@@ -1498,10 +3232,8 @@ export function useTriggerCronJob() {
       errorMessage: 'Failed to trigger CronJob',
       successMessage: 'CronJob triggered',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
-      queryClient.invalidateQueries({ queryKey: ['resources', 'jobs'] })
-      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    onSuccess: (_, variables) => {
+      invalidateCronJobOperationQueries(queryClient, variables.namespace, variables.name)
     },
   })
 }
@@ -1525,9 +3257,8 @@ export function useSuspendCronJob() {
       errorMessage: 'Failed to suspend CronJob',
       successMessage: 'CronJob suspended',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
-      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    onSuccess: (_, variables) => {
+      invalidateCronJobOperationQueries(queryClient, variables.namespace, variables.name)
     },
   })
 }
@@ -1551,9 +3282,8 @@ export function useResumeCronJob() {
       errorMessage: 'Failed to resume CronJob',
       successMessage: 'CronJob resumed',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'cronjobs'] })
-      queryClient.invalidateQueries({ queryKey: ['topology'] })
+    onSuccess: (_, variables) => {
+      invalidateCronJobOperationQueries(queryClient, variables.namespace, variables.name)
     },
   })
 }
@@ -1567,10 +3297,21 @@ export function useRestartWorkload() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name }: { kind: string; namespace: string; name: string }) => {
-      const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`, {
-        method: 'POST',
-      })
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/workloads/${kind}/${namespace}/${name}/restart`,
+        {
+          method: 'POST',
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -1582,7 +3323,9 @@ export function useRestartWorkload() {
       successMessage: 'Workload restarting',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1593,12 +3336,25 @@ export function useScaleWorkload() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, replicas }: { kind: string; namespace: string; name: string; replicas: number }) => {
-      const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ replicas }),
-      })
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+      replicas,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+      replicas: number
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/workloads/${kind}/${namespace}/${name}/scale`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ replicas }),
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -1610,8 +3366,12 @@ export function useScaleWorkload() {
       successMessage: 'Workload scaled',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
-      queryClient.invalidateQueries({ queryKey: ['resource', variables.kind, variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1631,7 +3391,12 @@ export interface WorkloadRevision {
   template?: string // Pod template spec as YAML (for revision diff)
 }
 
-export function useWorkloadRevisions(kind: string, namespace: string, name: string, enabled = true) {
+export function useWorkloadRevisions(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled = true,
+) {
   return useQuery<WorkloadRevision[]>({
     queryKey: ['workload-revisions', kind, namespace, name],
     queryFn: () => fetchJSON(`/workloads/${kind}/${namespace}/${name}/revisions`),
@@ -1642,12 +3407,25 @@ export function useWorkloadRevisions(kind: string, namespace: string, name: stri
 export function useRollbackWorkload() {
   const queryClient = useQueryClient()
   return useMutation({
-    mutationFn: async ({ kind, namespace, name, revision }: { kind: string; namespace: string; name: string; revision: number }) => {
-      const response = await apiFetch(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/rollback`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ revision }),
-      })
+    mutationFn: async ({
+      kind,
+      namespace,
+      name,
+      revision,
+    }: {
+      kind: string
+      namespace: string
+      name: string
+      revision: number
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/workloads/${kind}/${namespace}/${name}/rollback`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ revision }),
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -1659,9 +3437,15 @@ export function useRollbackWorkload() {
       successMessage: 'Rollback initiated',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', variables.kind] })
-      queryClient.invalidateQueries({ queryKey: ['resource', variables.kind, variables.namespace, variables.name] })
-      queryClient.invalidateQueries({ queryKey: ['workload-revisions', variables.kind, variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resources', variables.kind],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', variables.kind, variables.namespace, variables.name],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['workload-revisions', variables.kind, variables.namespace, variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1691,7 +3475,9 @@ export function useCordonNode() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['resources', 'nodes'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'nodes', '', variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', 'nodes', '', variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1717,7 +3503,9 @@ export function useUncordonNode() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['resources', 'nodes'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'nodes', '', variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', 'nodes', '', variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
     },
   })
@@ -1750,7 +3538,9 @@ export function useDrainNode() {
     },
     onSuccess: (data: { evictedPods?: string[]; errors?: string[] }, variables) => {
       queryClient.invalidateQueries({ queryKey: ['resources', 'nodes'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'nodes', '', variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['resource', 'nodes', '', variables.name],
+      })
       queryClient.invalidateQueries({ queryKey: ['topology'] })
 
       const evicted = data?.evictedPods?.length ?? 0
@@ -1771,72 +3561,181 @@ export function useDrainNode() {
 // Helm API hooks
 // ============================================================================
 
+function helmNamespaceParams(namespaces: string[] = []) {
+  return namespaces.length > 0 ? `?namespaces=${namespaces.join(',')}` : ''
+}
+
 // List all Helm releases
-export function useHelmReleases(namespace?: string) {
-  const params = namespace ? `?namespace=${namespace}` : ''
+export function useHelmReleases(namespaces: string[] = []) {
+  const params = helmNamespaceParams(namespaces)
   return useQuery<HelmRelease[]>({
-    queryKey: ['helm-releases', namespace],
+    queryKey: ['helm-releases', namespaces],
     queryFn: () => fetchJSON(`/helm/releases${params}`),
     staleTime: 30000, // 30 seconds
   })
 }
 
 // Get details for a specific Helm release
-export function useHelmRelease(namespace: string, name: string) {
+export function useHelmRelease(namespace: string, name: string, options?: { enabled?: boolean }) {
   return useQuery<HelmReleaseDetail>({
     queryKey: ['helm-release', namespace, name],
     queryFn: () => fetchJSON(`/helm/releases/${namespace}/${name}`),
-    enabled: Boolean(namespace && name),
+    enabled: Boolean(namespace && name) && (options?.enabled ?? true),
     staleTime: 5000,
     refetchInterval: 10000, // Poll for live resource status updates (post-upgrade/rollback)
   })
 }
 
-// Get manifest for a Helm release (optionally at a specific revision).
-// `enabled` lets callers skip the query when the user's Cloud role
-// would 403 the read — saves a round-trip and avoids a transient
-// "error" state that the role-gated empty panel doesn't need.
-export function useHelmManifest(namespace: string, name: string, revision?: number, enabled = true) {
-  const params = revision ? `?revision=${revision}` : ''
-  return useQuery<string>({
-    queryKey: ['helm-manifest', namespace, name, revision],
-    queryFn: async () => {
-      const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/manifest${params}`)
-      if (!response.ok) {
-        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
-        throw new Error(error.error || `HTTP ${response.status}`)
-      }
-      return response.text()
-    },
-    enabled: Boolean(namespace && name && enabled),
-    staleTime: 60000, // 1 minute
+// Get manifest for a Helm release (optionally at a specific revision).
+// `enabled` lets callers skip the query when the user's Cloud role
+// would 403 the read — saves a round-trip and avoids a transient
+// "error" state that the role-gated empty panel doesn't need.
+export function useHelmManifest(
+  namespace: string,
+  name: string,
+  revision?: number,
+  enabled = true,
+) {
+  const params = revision ? `?revision=${revision}` : ''
+  return useQuery<string>({
+    queryKey: ['helm-manifest', namespace, name, revision],
+    queryFn: async () => {
+      const response = await apiFetch(
+        `${getApiBase()}/helm/releases/${namespace}/${name}/manifest${params}`,
+      )
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+        throw new Error(error.error || `HTTP ${response.status}`)
+      }
+      return response.text()
+    },
+    enabled: Boolean(namespace && name && enabled),
+    staleTime: 60000, // 1 minute
+  })
+}
+
+// Get values for a Helm release. `enabled` see useHelmManifest.
+export function useHelmValues(
+  namespace: string,
+  name: string,
+  allValues?: boolean,
+  enabled = true,
+  revision?: number,
+) {
+  const params = new URLSearchParams()
+  if (allValues) params.set('all', 'true')
+  if (revision && revision > 0) params.set('revision', String(revision))
+  const query = params.toString() ? `?${params.toString()}` : ''
+  return useQuery<HelmValues>({
+    queryKey: ['helm-values', namespace, name, allValues, revision],
+    queryFn: () => fetchJSON(`/helm/releases/${namespace}/${name}/values${query}`),
+    enabled: Boolean(namespace && name && enabled),
+    staleTime: 60000,
+  })
+}
+
+// Get diff between two revisions. `enabled` see useHelmManifest.
+export function useHelmManifestDiff(
+  namespace: string,
+  name: string,
+  revision1: number,
+  revision2: number,
+  enabled = true,
+) {
+  return useQuery<ManifestDiff>({
+    queryKey: ['helm-diff', namespace, name, revision1, revision2],
+    queryFn: () =>
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
+    staleTime: 60000,
+  })
+}
+
+export function useHelmValuesDiff(
+  namespace: string,
+  name: string,
+  revision1: number,
+  revision2: number,
+  allValues = false,
+  enabled = true,
+) {
+  return useQuery<ValuesDiff>({
+    queryKey: ['helm-values-diff', namespace, name, revision1, revision2, allValues],
+    queryFn: () => {
+      const params = new URLSearchParams({
+        revision1: String(revision1),
+        revision2: String(revision2),
+      })
+      if (allValues) params.set('all', 'true')
+      return fetchJSON(`/helm/releases/${namespace}/${name}/values/diff?${params.toString()}`)
+    },
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
+    staleTime: 60000,
+  })
+}
+
+export function useHelmNotesDiff(
+  namespace: string,
+  name: string,
+  revision1: number,
+  revision2: number,
+  enabled = true,
+) {
+  return useQuery<NotesDiff>({
+    queryKey: ['helm-notes-diff', namespace, name, revision1, revision2],
+    queryFn: () =>
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/notes/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
+    staleTime: 60000,
   })
 }
 
-// Get values for a Helm release. `enabled` see useHelmManifest.
-export function useHelmValues(namespace: string, name: string, allValues?: boolean, enabled = true) {
-  const params = allValues ? '?all=true' : ''
-  return useQuery<HelmValues>({
-    queryKey: ['helm-values', namespace, name, allValues],
-    queryFn: () => fetchJSON(`/helm/releases/${namespace}/${name}/values${params}`),
-    enabled: Boolean(namespace && name && enabled),
+export function useHelmHooksDiff(
+  namespace: string,
+  name: string,
+  revision1: number,
+  revision2: number,
+  enabled = true,
+) {
+  return useQuery<HooksDiff>({
+    queryKey: ['helm-hooks-diff', namespace, name, revision1, revision2],
+    queryFn: () =>
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/hooks/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
 
-// Get diff between two revisions. `enabled` see useHelmManifest.
-export function useHelmManifestDiff(
+export function useHelmResourceDiff(
   namespace: string,
   name: string,
   revision1: number,
   revision2: number,
   enabled = true,
 ) {
-  return useQuery<ManifestDiff>({
-    queryKey: ['helm-diff', namespace, name, revision1, revision2],
+  return useQuery<ResourceDiff>({
+    queryKey: ['helm-resource-diff', namespace, name, revision1, revision2],
     queryFn: () =>
-      fetchJSON(`/helm/releases/${namespace}/${name}/diff?revision1=${revision1}&revision2=${revision2}`),
-    enabled: Boolean(namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled),
+      fetchJSON(
+        `/helm/releases/${namespace}/${name}/resources/diff?revision1=${revision1}&revision2=${revision2}`,
+      ),
+    enabled: Boolean(
+      namespace && name && revision1 > 0 && revision2 > 0 && revision1 !== revision2 && enabled,
+    ),
     staleTime: 60000,
   })
 }
@@ -1852,11 +3751,24 @@ export function useHelmUpgradeInfo(namespace: string, name: string, enabled = tr
   })
 }
 
+// Available chart versions for a release (newest-first), for the upgrade dialog's
+// version picker. Empty when the source can't be resolved — the dialog then falls
+// back to the latest version from upgrade-info.
+export function useHelmReleaseVersions(namespace: string, name: string, enabled = true) {
+  return useQuery<string[]>({
+    queryKey: ['helm-release-versions', namespace, name],
+    queryFn: () => fetchJSON(`/helm/releases/${namespace}/${name}/versions`),
+    enabled: Boolean(namespace && name && enabled),
+    staleTime: 30000,
+    retry: false,
+  })
+}
+
 // Batch check for upgrade availability (for list view)
-export function useHelmBatchUpgradeInfo(namespace?: string, enabled = true) {
-  const params = namespace ? `?namespace=${namespace}` : ''
+export function useHelmBatchUpgradeInfo(namespaces: string[] = [], enabled = true) {
+  const params = helmNamespaceParams(namespaces)
   return useQuery<BatchUpgradeInfo>({
-    queryKey: ['helm-batch-upgrade-info', namespace],
+    queryKey: ['helm-batch-upgrade-info', namespaces],
     queryFn: () => fetchJSON(`/helm/upgrade-check${params}`),
     enabled,
     staleTime: 30000, // 30 seconds - keep in sync with release list
@@ -1873,10 +3785,21 @@ export function useHelmRollback() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ namespace, name, revision }: { namespace: string; name: string; revision: number }) => {
-      const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/rollback?revision=${revision}`, {
-        method: 'POST',
-      })
+    mutationFn: async ({
+      namespace,
+      name,
+      revision,
+    }: {
+      namespace: string
+      name: string
+      revision: number
+    }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/helm/releases/${namespace}/${name}/rollback?revision=${revision}`,
+        {
+          method: 'POST',
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -1889,7 +3812,9 @@ export function useHelmRollback() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['helm-releases'] })
-      queryClient.invalidateQueries({ queryKey: ['helm-release', variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['helm-release', variables.namespace, variables.name],
+      })
     },
   })
 }
@@ -1967,30 +3892,49 @@ function streamHelmProgress(
 
                 if (data.type === 'complete') {
                   resolve(data)
+                  return
                 } else if (data.type === 'error') {
                   reject(new Error(data.message || failureLabel))
+                  return
                 }
-              } catch {
-                // Ignore parse errors
+              } catch (err) {
+                reject(
+                  err instanceof Error ? err : new Error(`${failureLabel}: invalid progress event`),
+                )
+                return
               }
             }
           }
         }
+
+        reject(new Error(`${failureLabel}: stream ended before completion`))
       })
       .catch(reject)
   })
 }
 
-// Upgrade a release with progress streaming via SSE
+// When `values` is provided, the upgrade applies exactly those edited values
+// instead of carrying the release's prior values over blindly.
 export function upgradeWithProgress(
   namespace: string,
   name: string,
   version: string,
-  onProgress: (event: InstallProgressEvent) => void
+  repositoryName: string | undefined,
+  onProgress: (event: InstallProgressEvent) => void,
+  values?: Record<string, unknown>,
 ): Promise<void> {
+  const params = new URLSearchParams({ version })
+  if (repositoryName) params.set('repository', repositoryName)
+  const options: RequestInit = values
+    ? {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ values }),
+      }
+    : { method: 'POST' }
   return streamHelmProgress(
-    `${getApiBase()}/helm/releases/${namespace}/${name}/upgrade-stream?version=${encodeURIComponent(version)}`,
-    { method: 'POST' },
+    `${getApiBase()}/helm/releases/${namespace}/${name}/upgrade-stream?${params.toString()}`,
+    options,
     onProgress,
     'Upgrade failed',
   ).then(() => {})
@@ -2001,7 +3945,7 @@ export function rollbackWithProgress(
   namespace: string,
   name: string,
   revision: number,
-  onProgress: (event: InstallProgressEvent) => void
+  onProgress: (event: InstallProgressEvent) => void,
 ): Promise<void> {
   return streamHelmProgress(
     `${getApiBase()}/helm/releases/${namespace}/${name}/rollback-stream?revision=${revision}`,
@@ -2011,15 +3955,29 @@ export function rollbackWithProgress(
   ).then(() => {})
 }
 
-// Preview values change (dry-run upgrade)
+// When `version` is supplied, preview renders against that target chart version
+// instead of the release's current chart.
 export function useHelmPreviewValues() {
-  return useMutation<ValuesPreviewResponse, Error, { namespace: string; name: string; values: Record<string, unknown> }>({
-    mutationFn: async ({ namespace, name, values }) => {
-      const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/values/preview`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ values }),
-      })
+  return useMutation<
+    ValuesPreviewResponse,
+    Error,
+    {
+      namespace: string
+      name: string
+      values: Record<string, unknown>
+      version?: string
+      repository?: string
+    }
+  >({
+    mutationFn: async ({ namespace, name, values, version, repository }) => {
+      const response = await apiFetch(
+        `${getApiBase()}/helm/releases/${namespace}/${name}/values/preview`,
+        {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ values, version, repository }),
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2034,7 +3992,15 @@ export function useHelmApplyValues() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ namespace, name, values }: { namespace: string; name: string; values: Record<string, unknown> }) => {
+    mutationFn: async ({
+      namespace,
+      name,
+      values,
+    }: {
+      namespace: string
+      name: string
+      values: Record<string, unknown>
+    }) => {
       const response = await apiFetch(`${getApiBase()}/helm/releases/${namespace}/${name}/values`, {
         method: 'PUT',
         headers: { 'Content-Type': 'application/json' },
@@ -2052,8 +4018,12 @@ export function useHelmApplyValues() {
     },
     onSuccess: (_, variables) => {
       queryClient.invalidateQueries({ queryKey: ['helm-releases'] })
-      queryClient.invalidateQueries({ queryKey: ['helm-release', variables.namespace, variables.name] })
-      queryClient.invalidateQueries({ queryKey: ['helm-values', variables.namespace, variables.name] })
+      queryClient.invalidateQueries({
+        queryKey: ['helm-release', variables.namespace, variables.name],
+      })
+      queryClient.invalidateQueries({
+        queryKey: ['helm-values', variables.namespace, variables.name],
+      })
     },
   })
 }
@@ -2070,29 +4040,103 @@ export function useHelmRepositories() {
   })
 }
 
+// Shared mutation fn + cache invalidation for the helm-repo
+// update endpoint. Hoisted so useUpdateRepository and
+// useUpdateRepositorySilent can't drift on URL, error parsing, or
+// invalidation keys — only the toast meta differs.
+async function updateRepositoryFn(repoName: string): Promise<unknown> {
+  const response = await apiFetch(`${getApiBase()}/helm/repositories/${repoName}/update`, {
+    method: 'POST',
+  })
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+    throw new Error(error.error || `HTTP ${response.status}`)
+  }
+  return response.json()
+}
+
+function invalidateHelmAfterRepoUpdate(queryClient: ReturnType<typeof useQueryClient>) {
+  queryClient.invalidateQueries({ queryKey: ['helm-repositories'] })
+  queryClient.invalidateQueries({ queryKey: ['helm-charts'] })
+}
+
 // Update a repository index
 export function useUpdateRepository() {
   const queryClient = useQueryClient()
-
   return useMutation({
-    mutationFn: async (repoName: string) => {
-      const response = await apiFetch(`${getApiBase()}/helm/repositories/${repoName}/update`, {
-        method: 'POST',
-      })
-      if (!response.ok) {
-        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
-        throw new Error(error.error || `HTTP ${response.status}`)
-      }
-      return response.json()
-    },
+    mutationFn: updateRepositoryFn,
     meta: {
       errorMessage: 'Failed to update repository',
       successMessage: 'Repository updated',
     },
-    onSuccess: () => {
-      queryClient.invalidateQueries({ queryKey: ['helm-repositories'] })
-      queryClient.invalidateQueries({ queryKey: ['helm-charts'] })
+    onSuccess: () => invalidateHelmAfterRepoUpdate(queryClient),
+  })
+}
+
+// Same endpoint as useUpdateRepository but without meta — the
+// caller surfaces ONE aggregate toast for the whole batch, so the
+// global MutationCache must NOT fire a per-call toast (otherwise
+// N failures = N identical "Failed to update repository" toasts
+// with no repo name).
+export function useUpdateRepositorySilent() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: updateRepositoryFn,
+    onSuccess: () => invalidateHelmAfterRepoUpdate(queryClient),
+  })
+}
+
+// Registered OCI chart sources (the OCI analog of `helm repo add`). Used to
+// track upgrades for the user's own OCI-published charts.
+export function useHelmOCISources() {
+  return useQuery<string[]>({
+    queryKey: ['helm-oci-sources'],
+    queryFn: () => fetchJSON('/helm/oci-sources'),
+  })
+}
+
+async function mutateOCISource(method: 'POST' | 'DELETE', source: string): Promise<string[]> {
+  const response = await apiFetch(`${getApiBase()}/helm/oci-sources`, {
+    method,
+    headers: { 'Content-Type': 'application/json' },
+    body: JSON.stringify({ source }),
+  })
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+    throw new Error(error.error || `HTTP ${response.status}`)
+  }
+  return response.json()
+}
+
+// Invalidate the upgrade-info queries so a newly-registered source is probed
+// immediately and "source not tracked" re-resolves.
+function invalidateHelmAfterSourceChange(queryClient: ReturnType<typeof useQueryClient>) {
+  queryClient.invalidateQueries({ queryKey: ['helm-oci-sources'] })
+  queryClient.invalidateQueries({ queryKey: ['helm-upgrade-info'] })
+  queryClient.invalidateQueries({ queryKey: ['helm-batch-upgrade-info'] })
+}
+
+export function useAddOCISource() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (source: string) => mutateOCISource('POST', source),
+    meta: {
+      errorMessage: 'Failed to add chart source',
+      successMessage: 'Chart source added',
+    },
+    onSuccess: () => invalidateHelmAfterSourceChange(queryClient),
+  })
+}
+
+export function useRemoveOCISource() {
+  const queryClient = useQueryClient()
+  return useMutation({
+    mutationFn: (source: string) => mutateOCISource('DELETE', source),
+    meta: {
+      errorMessage: 'Failed to remove chart source',
+      successMessage: 'Chart source removed',
     },
+    onSuccess: () => invalidateHelmAfterSourceChange(queryClient),
   })
 }
 
@@ -2163,11 +4207,15 @@ export interface InstallProgressEvent {
 // Install a chart with progress streaming via SSE
 export function installChartWithProgress(
   req: InstallChartRequest,
-  onProgress: (event: InstallProgressEvent) => void
+  onProgress: (event: InstallProgressEvent) => void,
 ): Promise<HelmRelease> {
   return streamHelmProgress(
     `${getApiBase()}/helm/releases/install-stream`,
-    { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(req) },
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(req),
+    },
     onProgress,
     'Install failed',
   ).then((event) => event.release as HelmRelease)
@@ -2183,8 +4231,14 @@ export type ArtifactHubSortOption = 'relevance' | 'stars' | 'last_updated'
 // Search charts on ArtifactHub
 export function useArtifactHubSearch(
   query: string,
-  options?: { offset?: number; limit?: number; official?: boolean; verified?: boolean; sort?: ArtifactHubSortOption },
-  enabled = true
+  options?: {
+    offset?: number
+    limit?: number
+    official?: boolean
+    verified?: boolean
+    sort?: ArtifactHubSortOption
+  },
+  enabled = true,
 ) {
   const params = new URLSearchParams()
   if (query) params.set('query', query)
@@ -2195,7 +4249,15 @@ export function useArtifactHubSearch(
   if (options?.sort && options.sort !== 'relevance') params.set('sort', options.sort)
 
   return useQuery<ArtifactHubSearchResult>({
-    queryKey: ['artifacthub-search', query, options?.offset, options?.limit, options?.official, options?.verified, options?.sort],
+    queryKey: [
+      'artifacthub-search',
+      query,
+      options?.offset,
+      options?.limit,
+      options?.official,
+      options?.verified,
+      options?.sort,
+    ],
     queryFn: () => fetchJSON(`/helm/artifacthub/search?${params.toString()}`),
     enabled: enabled && query.length > 0,
     staleTime: 60000, // 1 minute
@@ -2203,7 +4265,12 @@ export function useArtifactHubSearch(
 }
 
 // Get chart detail from ArtifactHub
-export function useArtifactHubChart(repoName: string, chartName: string, version?: string, enabled = true) {
+export function useArtifactHubChart(
+  repoName: string,
+  chartName: string,
+  version?: string,
+  enabled = true,
+) {
   const path = version
     ? `/helm/artifacthub/charts/${repoName}/${chartName}/${version}`
     : `/helm/artifacthub/charts/${repoName}/${chartName}`
@@ -2222,8 +4289,10 @@ export function useArtifactHubChart(repoName: string, chartName: string, version
 
 interface GitOpsMutationConfig<TVariables> {
   getPath: (variables: TVariables) => string
+  getBody?: (variables: TVariables) => unknown
   errorMessage: string
-  successMessage: string
+  successMessage?: string
+  getSuccessMessage?: (data: GitOpsOperationResponse) => string
   getInvalidateKeys: (variables: TVariables) => (string | undefined)[][]
 }
 
@@ -2238,6 +4307,8 @@ function createGitOpsMutation<TVariables>(config: GitOpsMutationConfig<TVariable
       mutationFn: async (variables: TVariables): Promise<GitOpsOperationResponse> => {
         const response = await apiFetch(`${getApiBase()}${config.getPath(variables)}`, {
           method: 'POST',
+          headers: config.getBody ? { 'Content-Type': 'application/json' } : undefined,
+          body: config.getBody ? JSON.stringify(config.getBody(variables)) : undefined,
         })
         if (!response.ok) {
           const error = await response.json().catch(() => ({ error: 'Unknown error' }))
@@ -2249,9 +4320,10 @@ function createGitOpsMutation<TVariables>(config: GitOpsMutationConfig<TVariable
         errorMessage: config.errorMessage,
         successMessage: config.successMessage,
       },
-      onSuccess: (_, variables) => {
-        config.getInvalidateKeys(variables).forEach(key =>
-          queryClient.invalidateQueries({ queryKey: key })
+      onSuccess: (data, variables) => {
+        if (config.getSuccessMessage) showApiSuccess(config.getSuccessMessage(data))
+        config.getInvalidateKeys(variables).forEach((key) =>
+          queryClient.invalidateQueries({ queryKey: key }),
         )
       },
     })
@@ -2260,16 +4332,76 @@ function createGitOpsMutation<TVariables>(config: GitOpsMutationConfig<TVariable
 
 // Common variable types
 type FluxResourceVars = { kind: string; namespace: string; name: string }
+// ArgoAppVars identifies the target Application. Used by mutations that don't
+// take a body (terminate, suspend, resume, refresh).
 type ArgoAppVars = { namespace: string; name: string }
+// ArgoSyncVars extends ArgoAppVars with the sync request body fields. Only
+// useArgoSync sends these — splitting the type prevents callers from passing
+// resources/revision/prune to mutations that would silently drop them.
+export type ArgoSyncVars = ArgoAppVars & {
+  resources?: Array<{
+    group?: string
+    kind: string
+    namespace?: string
+    name: string
+  }>
+  revision?: string
+  prune?: boolean
+  dryRun?: boolean
+  force?: boolean
+  applyOnly?: boolean
+  // Free-form Argo SyncOption strings, e.g. "Replace=true",
+  // "ServerSideApply=true", "PruneLast=true". Caller is responsible for
+  // spelling.
+  syncOptions?: string[]
+}
+
+export interface ArgoResourceValidationResult {
+  outcome: 'succeeded' | 'failed' | 'inconclusive'
+  message: string
+  resource?: {
+    group?: string
+    kind: string
+    namespace?: string
+    name: string
+    status?: string
+    message?: string
+  }
+}
+
+export function buildArgoResourceSyncVars(namespace: string, name: string, resource: GitOpsInsightRef, opts: ArgoSyncOpts): ArgoSyncVars {
+  return {
+    namespace,
+    name,
+    ...opts,
+    resources: [{ group: resource.group, kind: resource.kind, namespace: resource.namespace, name: resource.name }],
+    revision: undefined,
+    prune: false,
+    applyOnly: false,
+  }
+}
+
+// ArgoRollbackVars targets a specific Argo history entry by ID. Prune and
+// DryRun mirror the sync flags so the rollback dialog can offer the same
+// safety net.
+type ArgoRollbackVars = ArgoAppVars & {
+  id: number
+  prune?: boolean
+  dryRun?: boolean
+}
 
 // Standard invalidation patterns
 const fluxInvalidateKeys = (v: FluxResourceVars) => [
   ['resources', v.kind],
   ['resource', v.kind, v.namespace, v.name],
+  ['gitops-tree', v.kind, v.namespace, v.name],
+  ['gitops-insights', v.kind, v.namespace, v.name],
 ]
 const argoInvalidateKeys = (v: ArgoAppVars) => [
   ['resources', 'applications'],
   ['resource', 'applications', v.namespace, v.name],
+  ['gitops-tree', 'applications', v.namespace, v.name],
+  ['gitops-insights', 'applications', v.namespace, v.name],
 ]
 
 // ============================================================================
@@ -2314,17 +4446,59 @@ export const useFluxSyncWithSource = createGitOpsMutation<FluxResourceVars>({
 // ArgoCD API hooks
 // ============================================================================
 
-export const useArgoSync = createGitOpsMutation<ArgoAppVars>({
+export const useArgoSync = createGitOpsMutation<ArgoSyncVars>({
   getPath: (v) => `/argo/applications/${v.namespace}/${v.name}/sync`,
+  getBody: (v) => ({
+    resources: v.resources,
+    revision: v.revision,
+    prune: v.prune,
+    dryRun: v.dryRun,
+    force: v.force,
+    applyOnly: v.applyOnly,
+    syncOptions: v.syncOptions,
+  }),
   errorMessage: 'Failed to trigger sync',
   successMessage: 'Sync initiated',
   getInvalidateKeys: argoInvalidateKeys,
 })
 
+export function useArgoResourceValidation() {
+  const queryClient = useQueryClient()
+  return useMutation<ArgoResourceValidationResult, Error, ArgoSyncVars>({
+    mutationFn: async (variables) => {
+      const response = await apiFetch(`${getApiBase()}/argo/applications/${variables.namespace}/${variables.name}/validate-resource`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          resources: variables.resources,
+          force: variables.force,
+          syncOptions: variables.syncOptions,
+        }),
+      })
+      if (!response.ok) {
+        const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+        throw new Error(error.error || `HTTP ${response.status}`)
+      }
+      return response.json() as Promise<ArgoResourceValidationResult>
+    },
+    onSettled: (_, __, variables) => {
+      argoInvalidateKeys(variables).forEach(key => queryClient.invalidateQueries({ queryKey: key }))
+    },
+  })
+}
+
+export const useArgoRollback = createGitOpsMutation<ArgoRollbackVars>({
+  getPath: (v) => `/argo/applications/${v.namespace}/${v.name}/rollback`,
+  getBody: (v) => ({ id: v.id, prune: v.prune, dryRun: v.dryRun }),
+  errorMessage: 'Failed to roll back application',
+  successMessage: 'Rollback initiated',
+  getInvalidateKeys: argoInvalidateKeys,
+})
+
 export const useArgoTerminate = createGitOpsMutation<ArgoAppVars>({
   getPath: (v) => `/argo/applications/${v.namespace}/${v.name}/terminate`,
   errorMessage: 'Failed to terminate sync',
-  successMessage: 'Sync terminated',
+  getSuccessMessage: (data) => data.message,
   getInvalidateKeys: argoInvalidateKeys,
 })
 
@@ -2347,11 +4521,22 @@ export function useArgoRefresh() {
   const queryClient = useQueryClient()
 
   return useMutation({
-    mutationFn: async ({ namespace, name, hard = false }: { namespace: string; name: string; hard?: boolean }) => {
+    mutationFn: async ({
+      namespace,
+      name,
+      hard = false,
+    }: {
+      namespace: string
+      name: string
+      hard?: boolean
+    }) => {
       const params = hard ? '?type=hard' : ''
-      const response = await apiFetch(`${getApiBase()}/argo/applications/${namespace}/${name}/refresh${params}`, {
-        method: 'POST',
-      })
+      const response = await apiFetch(
+        `${getApiBase()}/argo/applications/${namespace}/${name}/refresh${params}`,
+        {
+          method: 'POST',
+        },
+      )
       if (!response.ok) {
         const error = await response.json().catch(() => ({ error: 'Unknown error' }))
         throw new Error(error.error || `HTTP ${response.status}`)
@@ -2363,8 +4548,13 @@ export function useArgoRefresh() {
       successMessage: 'Application refreshed',
     },
     onSuccess: (_, variables) => {
-      queryClient.invalidateQueries({ queryKey: ['resources', 'applications'] })
-      queryClient.invalidateQueries({ queryKey: ['resource', 'applications', variables.namespace, variables.name] })
+      // Match the standard Argo invalidation set so the GitOps detail page
+      // (insights strip, resource tree) refetches after Refresh / Hard
+      // Refresh — without these two extra keys the user clicks Refresh and
+      // sees stale insight/tree data until the next staleTime tick.
+      argoInvalidateKeys(variables).forEach((key) =>
+        queryClient.invalidateQueries({ queryKey: key }),
+      )
     },
   })
 }
@@ -2421,7 +4611,9 @@ export function useSwitchContext() {
       } catch (error) {
         clearTimeout(timeoutId)
         if (error instanceof Error && error.name === 'AbortError') {
-          throw new Error('Context switch timed out. The cluster may be unreachable.')
+          throw new Error('Context switch timed out. The cluster may be unreachable.', {
+            cause: error,
+          })
         }
         throw error
       }
@@ -2441,6 +4633,142 @@ export function useSwitchContext() {
   })
 }
 
+// ============================================================================
+// Active namespace switcher
+// ============================================================================
+
+export interface NamespaceScope {
+  actives: string[]
+  kubeconfigNamespace: string
+  /**
+   * 'cluster-wide' — no per-user pick; user can list across namespaces.
+   * 'namespace'    — per-user view filter pinned to one or more namespaces.
+   * 'restricted'   — user can't list namespaces and isn't pinned to any.
+   */
+  mode: 'cluster-wide' | 'namespace' | 'restricted'
+  accessibleNamespaces: string[]
+  /** false when accessibleNamespaces is a best-effort short list (no list perm). */
+  authoritative: boolean
+  /** false when clearing would leave no usable namespace fallback. */
+  canClearNamespace: boolean
+  /** true when the backend informer cache is pinned to a namespace. */
+  cacheScoped: boolean
+  cacheScopeNamespace?: string
+  /** true when this client may rebuild the local cache for another namespace. */
+  namespaceRescope: boolean
+}
+
+export function useNamespaceScope() {
+  return useQuery<NamespaceScope>({
+    queryKey: ['namespace-scope'],
+    queryFn: () => fetchJSON('/cluster/namespace-scope'),
+    staleTime: 30000,
+  })
+}
+
+const NAMESPACE_SWITCH_TIMEOUT = 5000
+const NAMESPACE_RESCOPE_TIMEOUT = 120000
+
+export function debugNamespaceLog(label: string, payload?: Record<string, unknown>) {
+  if (typeof window === 'undefined') return
+  const enabled = window.localStorage.getItem('radar:debug:namespaces')
+  if (enabled !== '1' && enabled !== 'true') return
+  console.log(`[namespace-debug] ${label}`, {
+    t: Math.round(performance.now()),
+    href: window.location.href,
+    ...payload,
+  })
+}
+
+export function useSetActiveNamespace() {
+  const queryClient = useQueryClient()
+  return useMutation<NamespaceScope, Error, { namespaces: string[] }>({
+    meta: {
+      // Surface 403s (RBAC drift, denied bookmark) and network errors via the
+      // global toast. Without this, App.tsx call sites that mutate without
+      // their own onError (bookmark reconciliation, back-nav, topology
+      // maximize/clear, command palette) silently revert when the scope
+      // refetches and the mirror effect overwrites local state.
+      errorMessage: 'Failed to update namespace selection',
+    },
+    mutationFn: async ({ namespaces }) => {
+      debugNamespaceLog('mutation:start', { namespaces })
+      const controller = new AbortController()
+      const currentScope = queryClient.getQueryData<NamespaceScope>(['namespace-scope'])
+      // cacheScoped is a stable per-process property (the server's --namespace-scope
+      // flag). If the scope query is missing/stale we can't yet tell a cheap
+      // view-filter change from a cache-rebuilding rescope, so bias to the long
+      // timeout — only a confirmed non-scoped session gets the fast switch timeout.
+      // Aborting a real rebuild at 5s surfaces a spurious failure while the server
+      // keeps going.
+      const isRescope = currentScope?.cacheScoped !== false
+      const timeoutMs = isRescope ? NAMESPACE_RESCOPE_TIMEOUT : NAMESPACE_SWITCH_TIMEOUT
+      const timeoutId = setTimeout(() => controller.abort(), timeoutMs)
+      const startedAt = performance.now()
+      try {
+        const response = await apiFetch(`${getApiBase()}/cluster/namespace`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ namespaces }),
+          signal: controller.signal,
+        })
+        clearTimeout(timeoutId)
+        debugNamespaceLog('mutation:response', {
+          namespaces,
+          status: response.status,
+          durationMs: Math.round(performance.now() - startedAt),
+        })
+        if (!response.ok) {
+          const error = await response.json().catch(() => ({ error: 'Unknown error' }))
+          throw new Error(error.error || `HTTP ${response.status}`)
+        }
+        return response.json()
+      } catch (error) {
+        clearTimeout(timeoutId)
+        debugNamespaceLog('mutation:error', {
+          namespaces,
+          durationMs: Math.round(performance.now() - startedAt),
+          error: error instanceof Error ? error.message : String(error),
+        })
+        if (error instanceof Error && error.name === 'AbortError') {
+          throw new Error(
+            isRescope
+              ? 'Namespace rescope timed out. The cluster may still be loading.'
+              : 'Namespace switch timed out. The cluster may be unreachable.',
+            { cause: error },
+          )
+        }
+        throw error
+      }
+    },
+    onSuccess: (scope) => {
+      debugNamespaceLog('mutation:success-before-scope-cache-write', {
+        actives: scope.actives,
+        mode: scope.mode,
+        accessibleCount: scope.accessibleNamespaces.length,
+      })
+      if (scope.cacheScoped) {
+        queryClient.removeQueries({
+          predicate: (query) => query.queryKey[0] !== 'namespace-scope',
+        })
+      }
+      queryClient.setQueryData<NamespaceScope>(['namespace-scope'], scope)
+      if (scope.cacheScoped) {
+        queryClient.invalidateQueries()
+      }
+      debugNamespaceLog('mutation:success-after-scope-cache-write')
+    },
+    onError: () => {
+      // A failed switch can leave the server's stored pick out of sync
+      // with the cached scope (network timeout after the server wrote;
+      // partial mutation). Refetch so the displayed picker matches what
+      // the server actually persisted instead of what we assumed.
+      debugNamespaceLog('mutation:on-error-invalidate-scope')
+      queryClient.invalidateQueries({ queryKey: ['namespace-scope'] })
+    },
+  })
+}
+
 // ============================================================================
 // Image Filesystem Inspection
 // ============================================================================
@@ -2453,7 +4781,7 @@ export function useImageMetadata(
   namespace: string,
   podName: string,
   pullSecrets: string[],
-  enabled = true
+  enabled = true,
 ) {
   const params = new URLSearchParams()
   params.set('image', image)
@@ -2476,7 +4804,7 @@ export function useImageFilesystem(
   namespace: string,
   podName: string,
   pullSecrets: string[],
-  enabled = true
+  enabled = true,
 ) {
   const params = new URLSearchParams()
   params.set('image', image)
@@ -2489,9 +4817,7 @@ export function useImageFilesystem(
   return useQuery<ImageFilesystem>({
     queryKey: ['image-filesystem', image, namespace, podName, pullSecrets.join(',')],
     // Use skipToken to completely prevent the query from running when disabled
-    queryFn: shouldFetch
-      ? () => fetchJSON(`/images/inspect?${params.toString()}`)
-      : skipToken,
+    queryFn: shouldFetch ? () => fetchJSON(`/images/inspect?${params.toString()}`) : skipToken,
     staleTime: 300000, // 5 minutes - image content doesn't change
     retry: false, // Don't retry on auth errors
   })
@@ -2515,6 +4841,44 @@ export interface WorkloadLogsResponse {
     timestamp: string
     content: string
   }[]
+  emptyReason?: string
+  emptyMessage?: string
+  command?: string
+}
+
+export interface WorkloadRun {
+  kind: string
+  namespace: string
+  name: string
+  phase: string
+  active: boolean
+  startedAt?: string
+  finishedAt?: string
+  scheduledAt?: string
+  trigger?: 'manual' | 'schedule' | string
+  message?: string
+  succeeded?: number
+  failed?: number
+  running?: number
+  desired?: number
+  parallelism?: number
+  progress?: string
+  template?: string
+  launcher?: {
+    kind: string
+    namespace?: string
+    name: string
+    group?: string
+  }
+  podTotal?: number
+  podSucceeded?: number
+  podFailed?: number
+  podRunning?: number
+  podPending?: number
+}
+
+export interface WorkloadRunsResponse {
+  runs: WorkloadRun[]
 }
 
 // Fetch pods for a workload
@@ -2527,6 +4891,31 @@ export function useWorkloadPods(kind: string, namespace: string, name: string) {
   })
 }
 
+export function useWorkloadRuns(
+  kind: string,
+  namespace: string,
+  name: string,
+  enabled = true,
+  options?: { refetchActive?: boolean; clusterScoped?: boolean },
+) {
+  const clusterScoped = options?.clusterScoped ?? false
+  const ns = clusterScoped ? '_' : namespace
+  const params = new URLSearchParams()
+  if (clusterScoped) params.set('clusterScoped', 'true')
+  const queryString = params.toString()
+
+  return useQuery<WorkloadRunsResponse>({
+    queryKey: ['workload-runs', kind, namespace, name, clusterScoped],
+    queryFn: () =>
+      fetchJSON(`/workloads/${kind}/${ns}/${name}/runs${queryString ? `?${queryString}` : ''}`),
+    enabled: enabled && Boolean(kind && name && (namespace || clusterScoped)),
+    staleTime: 10000,
+    refetchInterval: options?.refetchActive
+      ? (query) => (query.state.data?.runs?.some((run) => run.active) ? 5000 : 30000)
+      : false,
+  })
+}
+
 // Fetch logs for a workload (non-streaming)
 export function useWorkloadLogs(
   kind: string,
@@ -2536,7 +4925,7 @@ export function useWorkloadLogs(
     container?: string
     tailLines?: number
     sinceSeconds?: number
-  }
+  },
 ) {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
@@ -2545,8 +4934,19 @@ export function useWorkloadLogs(
   const queryString = params.toString()
 
   return useQuery<WorkloadLogsResponse>({
-    queryKey: ['workload-logs', kind, namespace, name, options?.container, options?.tailLines, options?.sinceSeconds],
-    queryFn: () => fetchJSON(`/workloads/${kind}/${namespace}/${name}/logs${queryString ? `?${queryString}` : ''}`),
+    queryKey: [
+      'workload-logs',
+      kind,
+      namespace,
+      name,
+      options?.container,
+      options?.tailLines,
+      options?.sinceSeconds,
+    ],
+    queryFn: () =>
+      fetchJSON(
+        `/workloads/${kind}/${namespace}/${name}/logs${queryString ? `?${queryString}` : ''}`,
+      ),
     enabled: Boolean(kind && namespace && name),
     staleTime: 5000,
   })
@@ -2561,7 +4961,7 @@ export function createWorkloadLogStream(
     container?: string
     tailLines?: number
     sinceSeconds?: number
-  }
+  },
 ): EventSource {
   const params = new URLSearchParams()
   if (options?.container) params.set('container', options.container)
@@ -2569,9 +4969,12 @@ export function createWorkloadLogStream(
   if (options?.sinceSeconds) params.set('sinceSeconds', String(options.sinceSeconds))
   const queryString = params.toString()
 
-  return new EventSource(`${getApiBase()}/workloads/${kind}/${namespace}/${name}/logs/stream${queryString ? `?${queryString}` : ''}`, {
-    withCredentials: getCredentialsMode() === 'include',
-  })
+  return new EventSource(
+    `${getApiBase()}/workloads/${kind}/${namespace}/${name}/logs/stream${queryString ? `?${queryString}` : ''}`,
+    {
+      withCredentials: getCredentialsMode() === 'include',
+    },
+  )
 }
 
 // ============================================================================
@@ -2603,6 +5006,59 @@ export interface DiagErrorEntry {
   level: string
 }
 
+export type DiagSyncPhase = 'not_started' | 'syncing_critical' | 'syncing_deferred' | 'complete'
+
+export interface DiagInformerSyncStatus {
+  kind: string
+  key: string
+  deferred: boolean
+  synced: boolean
+  syncedAt?: string
+  items: number
+  lastError?: string
+  lastErrorAt?: string
+  forbiddenSeen?: boolean
+}
+
+export interface DiagCacheSyncStatus {
+  phase: DiagSyncPhase
+  syncStarted?: string
+  elapsedSec: number
+  criticalTotal: number
+  criticalSynced: number
+  deferredTotal: number
+  deferredSynced: number
+  informers: DiagInformerSyncStatus[]
+  pendingCritical?: string[]
+  pendingDeferred?: string[]
+  promotedKinds?: string[]
+}
+
+export interface DiagSampleWindow {
+  count: number
+  last: number
+  min: number
+  p50: number
+  p95: number
+  p99: number
+  max: number
+}
+
+export interface DiagPerfSnapshot {
+  topology: {
+    totalBuilds: number
+    durationUs: DiagSampleWindow
+    nodeCount: DiagSampleWindow
+    edgeCount: DiagSampleWindow
+    payloadBytes: DiagSampleWindow
+    estimatedNodes: DiagSampleWindow
+  }
+  sse: {
+    totalBroadcasts: number
+    totalDrops: number
+  }
+}
+
 export interface DiagnosticsSnapshot {
   timestamp: string
   radarVersion: string
@@ -2666,6 +5122,7 @@ export interface DiagnosticsSnapshot {
     typedCount: number
     dynamicCount: number
     watchedCRDs: string[]
+    syncStatus?: DiagCacheSyncStatus
   }
   prometheus?: {
     connected: boolean
@@ -2696,6 +5153,7 @@ export interface DiagnosticsSnapshot {
   sse?: {
     connectedClients: number
   }
+  perf?: DiagPerfSnapshot
   runtime?: {
     heapMB: number
     heapObjectsK: number
@@ -2711,6 +5169,7 @@ export interface DiagnosticsSnapshot {
     debugEvents: boolean
     mcpEnabled: boolean
     hasPrometheusURL: boolean
+    hasPrometheusHeaders: boolean
   }
   recentErrors?: DiagErrorEntry[]
   totalErrorsRecorded?: number