@skyhook-io/radar-app 1.11.0 → 1.12.3

package/src/components/ConnectionErrorView.test.tsx

@@ -1,15 +1,25 @@
 import { renderToStaticMarkup } from 'react-dom/server'
 import type { ReactNode } from 'react'
-import { describe, expect, it, vi } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ContextInfo } from '../types'
 
 vi.stubGlobal('window', { location: { host: 'localhost:9280' } })
 
+const useContextsMock = vi.hoisted(() => vi.fn(
+  (): { data: ContextInfo[] | undefined } => ({ data: undefined }),
+))
+const capabilitiesMock = vi.hoisted(() => ({ localTerminal: true }))
+
 vi.mock('@skyhook-io/k8s-ui', () => ({
   ClusterName: ({ name }: { name: string }) => <span>{name}</span>,
   useOpenLocalTerminal: () => vi.fn(),
 }))
 vi.mock('../api/client', () => ({
   useAuthMe: () => ({ data: { authEnabled: false } }),
+  useContexts: useContextsMock,
+}))
+vi.mock('../contexts/CapabilitiesContext', () => ({
+  useCapabilitiesContext: () => capabilitiesMock,
 }))
 vi.mock('./ContextSwitcher', () => ({
   ContextSwitcher: () => <button>Switch context</button>,
@@ -35,6 +45,10 @@ function renderError(errorType: string, context: string): string {
   )
 }
 
+beforeEach(() => {
+  capabilitiesMock.localTerminal = true
+})
+
 describe('ConnectionErrorView authentication guidance', () => {
   it('builds an honest EKS diagnostic without presenting it as authentication', () => {
     const context = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
@@ -72,6 +86,34 @@ describe('ConnectionErrorView authentication guidance', () => {
     expect(markup).not.toContain('aws sso login')
   })
 
+  it('uses the original context for collision-qualified auth guidance', () => {
+    const original = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    const hints = selectConnectionHints('auth', `${original} (secondary)`, original)
+
+    expect(hints?.title).toBe('EKS Authentication Failed')
+    expect(hints?.fallbackCommand?.command).toBe(
+      'aws eks update-kubeconfig --name prod --region us-east-1',
+    )
+  })
+
+  it('wires the current context original name into auth guidance', () => {
+    const original = 'arn:aws:eks:us-east-1:123456789012:cluster/prod'
+    useContextsMock.mockReturnValueOnce({
+      data: [{
+        name: `${original} (secondary)`,
+        originalName: original,
+        cluster: original,
+        user: 'prod',
+        namespace: '',
+        isCurrent: true,
+      }],
+    })
+
+    const markup = renderError('auth', `${original} (secondary)`)
+    expect(markup).toContain('update-kubeconfig')
+    expect(markup).toContain('us-east-1')
+  })
+
   it('renders placeholder AKS commands without a run affordance', () => {
     const markup = renderError('auth-rejected', 'clusterUser_platform_prod')
 
@@ -85,4 +127,35 @@ describe('ConnectionErrorView authentication guidance', () => {
 
     expect(markup).not.toContain('aria-label="Run command in terminal"')
   })
+
+  it('keeps recovery commands copyable without offering an unavailable local terminal', () => {
+    capabilitiesMock.localTerminal = false
+
+    const markup = renderError('auth', 'gke_project_us-east1_prod')
+
+    expect(markup).toContain('Refresh Google Cloud credentials')
+    expect(markup).toContain('>gcloud</span>')
+    expect(markup).toContain('aria-label="Copy command to clipboard"')
+    expect(markup).not.toContain('aria-label="Run command in terminal"')
+    expect(markup).not.toContain('Authenticate in terminal')
+  })
+})
+
+describe('ConnectionErrorView kubeconfig guidance', () => {
+  it('keeps the actionable error and context switch visible for a broken context', () => {
+    const markup = renderError('config', 'prod')
+
+    expect(markup).toContain('Cannot Load Cluster Configuration')
+    expect(markup).toContain('Kubeconfig Problem')
+    expect(markup).toContain('aria-expanded="false"')
+    expect(markup).toContain('id="connection-raw-error"')
+    expect(markup).toContain('safe error')
+    expect(markup).toContain('Switch context')
+  })
+
+  it('does not offer context switching when no context was loaded', () => {
+    const markup = renderError('config', '')
+
+    expect(markup).not.toContain('Switch context')
+  })
 })

package/src/components/ConnectionErrorView.tsx

@@ -4,10 +4,11 @@ import type { ConnectionState } from '../context/ConnectionContext'
 import { ContextSwitcher } from './ContextSwitcher'
 import { parseContextName } from '../utils/context-name'
 import { useOpenLocalTerminal, ClusterName } from '@skyhook-io/k8s-ui'
-import { useAuthMe } from '../api/client'
+import { useAuthMe, useContexts } from '../api/client'
 import { Tooltip } from './ui/Tooltip'
 import { allShellSafe } from '../utils/shell-safe'
 import { apiUrl } from '../api/config'
+import { useCapabilitiesContext } from '../contexts/CapabilitiesContext'
 
 interface ConnectionErrorViewProps {
   connection: ConnectionState
@@ -218,11 +219,11 @@ function getTimeoutHints(context: string): AuthHints | null {
 
 const errorHints: Record<string, { title: string; hints: string[] }> = {
   config: {
-    title: 'No Kubeconfig Found',
+    title: 'Kubeconfig Problem',
     hints: [
-      'Radar could not find a kubeconfig file at ~/.kube/config',
-      'If your kubeconfig is at a custom path, set the KUBECONFIG environment variable in your shell profile (~/.zshrc or ~/.bashrc)',
-      'You can also pass --kubeconfig <path> when launching from the terminal',
+      'Radar could not load a usable kubeconfig for this context',
+      'If the file exists, check the local Radar logs for the exact parse or load failure',
+      'If no kubeconfig is configured, Radar checks ~/.kube/config; set KUBECONFIG or pass --kubeconfig <path> for another location',
     ],
   },
   rbac: {
@@ -321,16 +322,17 @@ export function CopyableCommand({ command, onRunInTerminal }: { command: string;
   )
 }
 
-export function selectConnectionHints(errorType: string | undefined, context: string): AuthHints | null {
+export function selectConnectionHints(errorType: string | undefined, context: string, originalContext?: string): AuthHints | null {
+  const parsedContext = originalContext || context
   switch (errorType) {
     case 'auth':
-      return getAuthHints(context)
+      return getAuthHints(parsedContext)
     case 'auth-rejected':
-      return getAuthRejectedHints(context)
+      return getAuthRejectedHints(parsedContext)
     case 'auth-plugin-stuck':
       return getAuthPluginStuckHints()
     case 'timeout':
-      return getTimeoutHints(context)
+      return getTimeoutHints(parsedContext)
     default:
       return null
   }
@@ -342,10 +344,13 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
   const isAuthRejected = connection.errorType === 'auth-rejected'
   const isAuthPluginStuck = connection.errorType === 'auth-plugin-stuck'
   const isAuthError = isAuth || isAuthRejected || isAuthPluginStuck
-  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '')
+  const { data: contexts } = useContexts()
+  const originalContext = contexts?.find((context) => context.name === connection.context)?.originalName
+  const commandInfo = selectConnectionHints(connection.errorType, connection.context || '', originalContext)
   const errorInfo = commandInfo || errorHints[connection.errorType || 'unknown'] || errorHints.unknown
   const openLocalTerminal = useOpenLocalTerminal()
   const { data: authMe } = useAuthMe()
+  const { localTerminal } = useCapabilitiesContext()
   const rawErrorDefaultOpen = !connection.errorType || connection.errorType === 'unknown'
   const [showRawError, setShowRawError] = useState(rawErrorDefaultOpen)
 
@@ -353,11 +358,8 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
     setShowRawError(rawErrorDefaultOpen)
   }, [connection.error, rawErrorDefaultOpen])
 
-  // Auto-retry after successful auth. The terminal shell runs on the server
-  // host, so the auth command itself fixes the server's credentials in every
-  // mode — but the chained retry curl carries no session cookie, so it 401s
-  // once /api/connection is auth-gated. Only chain it when auth is *known*
-  // disabled (authMe still loading → don't chain a doomed call).
+  // The local terminal is only available in unauthenticated local mode, but
+  // authMe may still be loading when the capability response arrives.
   const retryCmd = `curl -s -X POST http://${window.location.host}${apiUrl('/connection/retry')} > /dev/null`
 
   const handleAuthInTerminal = () => {
@@ -384,7 +386,7 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
           </div>
 
           <h2 className="text-xl font-semibold text-theme-text-primary mb-2">
-            {connection.errorType === 'config' ? 'No Cluster Configuration' : 'Cannot Connect to Cluster'}
+            {connection.errorType === 'config' ? 'Cannot Load Cluster Configuration' : 'Cannot Connect to Cluster'}
           </h2>
 
           <div className="mb-6 space-y-1">
@@ -418,8 +420,8 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {commandInfo?.authCommand && (
               <div className="mt-3">
                 <p className="text-xs text-theme-text-tertiary">{commandInfo.authCommand.label}</p>
-                <CopyableCommand command={commandInfo.authCommand.command} onRunInTerminal={commandInfo.authCommand.runnable === false ? undefined : handleRunInTerminal} />
-                {isAuthError && !commandInfo?.hideAuthButton && commandInfo.authCommand.runnable !== false && (
+                <CopyableCommand command={commandInfo.authCommand.command} onRunInTerminal={!localTerminal || commandInfo.authCommand.runnable === false ? undefined : handleRunInTerminal} />
+                {localTerminal && isAuthError && !commandInfo?.hideAuthButton && commandInfo.authCommand.runnable !== false && (
                   <button
                     onClick={handleAuthInTerminal}
                     className="mt-3 w-full inline-flex items-center justify-center gap-2 px-3 py-2 text-xs font-medium btn-brand rounded-md"
@@ -433,7 +435,7 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
             {commandInfo?.fallbackCommand && (
               <div className="mt-4 pt-3 border-t border-theme-border/50">
                 <p className="text-xs text-theme-text-tertiary">{commandInfo.fallbackCommand.label}</p>
-                <CopyableCommand command={commandInfo.fallbackCommand.command} onRunInTerminal={commandInfo.fallbackCommand.runnable === false ? undefined : handleRunInTerminal} />
+                <CopyableCommand command={commandInfo.fallbackCommand.command} onRunInTerminal={!localTerminal || commandInfo.fallbackCommand.runnable === false ? undefined : handleRunInTerminal} />
               </div>
             )}
             {connection.error && (
@@ -480,7 +482,7 @@ export function ConnectionErrorView({ connection, onRetry, isRetrying }: Connect
               )}
             </button>
 
-            {connection.errorType !== 'config' && <ContextSwitcher triggerName="Switch context" />}
+            {connection.context && <ContextSwitcher triggerName="Switch context" />}
           </div>
 
           {isAuthError && (

package/src/components/ContextSwitcher.tsx

@@ -10,7 +10,7 @@ import { useContextSwitch } from '../context/ContextSwitchContext'
 import { useToast } from '../components/ui/Toast'
 import { useDock } from '../components/dock'
 import type { ContextInfo } from '../types'
-import { parseContextName, type ParsedContextName } from '../utils/context-name'
+import { parseContextForSwitcher, visibleContextQualifier, type ParsedContextName } from '../utils/context-name'
 
 interface ContextSwitcherProps {
   className?: string
@@ -25,6 +25,7 @@ export interface ContextSwitcherHandle {
 
 interface ParsedContext extends ParsedContextName {
   context: ContextInfo
+  nameQualifier?: string
 }
 
 function shouldSuppressSwitchErrorToast(error: unknown): boolean {
@@ -54,18 +55,9 @@ export const ContextSwitcher = forwardRef<ContextSwitcherHandle, ContextSwitcher
       hasMultipleAccounts: false,
       hasMultipleSources: false,
     }
-    // Strip the disambiguation suffix (" (<source>)" or " (<source> #N)")
-    // before parsing — qualified names won't match the GKE/EKS/AKS regexes
-    // otherwise, and the suffix is redundant with the source chip we
-    // render separately.
-    const stripSourceSuffix = (name: string, source?: string): string => {
-      if (!source) return name
-      const escaped = source.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-      return name.replace(new RegExp(`\\s+\\(${escaped}(?:\\s+#\\d+)?\\)$`), '')
-    }
     const parsed: ParsedContext[] = contexts.map(ctx => ({
       context: ctx,
-      ...parseContextName(stripSourceSuffix(ctx.name, ctx.source)),
+      ...parseContextForSwitcher(ctx),
     }))
     const accounts = new Set(parsed.map(p => `${p.provider}:${p.account}`))
     const sources = new Set(contexts.map(c => c.source).filter(Boolean))
@@ -100,6 +92,7 @@ export const ContextSwitcher = forwardRef<ContextSwitcherHandle, ContextSwitcher
       return {
         id: p.context.name,
         name: p.raw,
+        nameQualifier: visibleContextQualifier(p.nameQualifier, p.context.source, hasMultipleSources),
         secondary: p.provider ? p.raw : undefined,
         badge: p.region || undefined,
         sourceLabel: hasMultipleSources ? p.context.source : undefined,
@@ -188,12 +181,15 @@ export const ContextSwitcher = forwardRef<ContextSwitcherHandle, ContextSwitcher
 
   const currentCtx = contexts?.find(c => c.isCurrent)
   const currentId = currentCtx?.name
-  // Use parsed.raw (the source-stripped form) for the trigger so the
-  // disambiguation suffix doesn't double up with the source chip.
+  // Keep the trigger name parseable and render any collision qualifier as a
+  // separate suffix so cloud-provider metadata remains intact.
   // Fall back to clusterInfo.context for the very-early window before
   // /api/contexts has resolved.
   const currentParsed = currentId ? parsedById.get(currentId) : undefined
   const currentRaw = triggerName || currentParsed?.raw || clusterInfo?.context || currentCtx?.name || 'Unknown'
+  const currentNameQualifier = triggerName
+    ? undefined
+    : visibleContextQualifier(currentParsed?.nameQualifier, currentCtx?.source, hasMultipleSources)
   const currentSourceLabel = triggerName ? undefined : hasMultipleSources ? currentCtx?.source || undefined : undefined
 
   return (
@@ -205,6 +201,7 @@ export const ContextSwitcher = forwardRef<ContextSwitcherHandle, ContextSwitcher
         label={label}
         currentId={currentId}
         currentName={currentRaw}
+        currentNameQualifier={currentNameQualifier}
         currentSourceLabel={currentSourceLabel}
         items={items}
         onSelect={handleSelect}

package/src/components/applications/ApplicationsView.tsx

@@ -22,6 +22,7 @@ import {
   eventsForApplication,
   memberRef,
   subjectRef,
+  compareIssueSortAnchors,
   type AppRow,
   type AppWorkload,
   type AppIdentityInstance,
@@ -46,7 +47,7 @@ import {
 } from "../../api/client";
 import { useConnection } from "../../context/ConnectionContext";
 import { useTimelineSource } from "../../context/TimelineSource";
-import { buildWorkloadPath, kindToPlural } from "../../utils/navigation";
+import { apiVersionToGroup, buildWorkloadPath, kindToPluralWithGroup } from "../../utils/navigation";
 import { WorkloadView } from "../workload/WorkloadView";
 import { ApplicationCostTab } from "../cost/ApplicationCostTab";
 import { isOpenCostWorkloadKind } from "../cost/kinds";
@@ -457,7 +458,7 @@ function AppDetailRoute({
       params.set("workload", workloadKey(workload));
       params.set(
         "run",
-        `${kindToPlural(run.kind)}/${runNamespace}/${run.name}`,
+        `${kindToPluralWithGroup(run.kind, apiVersionToGroup(run.data?.apiVersion as string | undefined))}/${runNamespace}/${run.name}`,
       );
       setSearchParams(params);
     },
@@ -465,14 +466,15 @@ function AppDetailRoute({
   );
   const openWorkloadResource = useCallback(
     (resource: SelectedResource) => {
-      if (kindToPlural(resource.kind).toLowerCase() !== "pods") {
+      const pluralKind = kindToPluralWithGroup(resource.kind, resource.group ?? "")
+      if (pluralKind.toLowerCase() !== "pods") {
         onOpenResource(resource);
         return;
       }
 
       const [pathname, rawSearch = ""] = buildWorkloadPath({
         ...resource,
-        kind: kindToPlural(resource.kind),
+        kind: pluralKind,
       }).split("?");
       const params = new URLSearchParams(rawSearch);
       const activeNamespaces = searchParams.get("namespaces");
@@ -682,7 +684,7 @@ function AppDetailRoute({
         renderWorkload={(workload: SelectedAppWorkload) => (
           <div className="h-full overflow-hidden">
             <WorkloadView
-              kind={kindToPlural(workload.kind)}
+              kind={kindToPluralWithGroup(workload.kind, workload.group ?? "")}
               group={workload.group}
               namespace={workload.namespace}
               name={workload.name}
@@ -837,7 +839,7 @@ function AppOverviewIssueRows({
 }) {
   const navigate = (ref: IssueResourceRef) => {
     onOpenResource({
-      kind: kindToPlural(ref.kind),
+      kind: kindToPluralWithGroup(ref.kind, ref.group ?? ""),
       namespace: ref.namespace ?? "",
       name: ref.name,
       group: ref.group ?? "",
@@ -888,9 +890,8 @@ function compareAppOverviewIssues(a: Issue, b: Issue): number {
   const severity =
     ISSUE_SEVERITY_RANK[b.severity] - ISSUE_SEVERITY_RANK[a.severity];
   if (severity !== 0) return severity;
-  const fa = a.first_seen ?? "";
-  const fb = b.first_seen ?? "";
-  if (fa !== fb) return fb.localeCompare(fa);
+  const onset = compareIssueSortAnchors(a, b);
+  if (onset !== 0) return onset;
   const ns = (a.namespace ?? "").localeCompare(b.namespace ?? "");
   if (ns !== 0) return ns;
   const name = a.name.localeCompare(b.name);

package/src/components/audit/AuditView.tsx

@@ -88,9 +88,14 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
 
   return (
     <div className="flex-1 flex flex-col min-h-0 p-4 gap-4 overflow-auto">
+      {/* Tabs above the header: the header describes best practices only, so
+          tabs rendered below it read as part of that page rather than as the
+          switch between the two Checks surfaces. */}
+      <ChecksViewTabs />
+
       <PageHeader
         icon={ShieldCheck}
-        title="Checks"
+        title="Best practices"
         description="Security, reliability, and efficiency best practices (NSA/CISA, CIS, Polaris, Kubescape), grouped into a remediation queue."
         actions={
           <>
@@ -115,8 +120,6 @@ function BestPracticesView({ namespaces, onNavigateToResource }: AuditViewProps)
         }
       />
 
-      <ChecksViewTabs />
-
       <ChecksView
         checks={data.groupedChecks ?? []}
         catalog={data.checks ?? {}}

package/src/components/audit/UpgradeReadinessView.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import { renderToStaticMarkup } from 'react-dom/server'
 import { ApiError } from '../../api/client'
-import { UPGRADE_IMPACT_DOCS_URL, UPGRADE_IMPACT_MIN_RADAR_VERSION, UpgradeReadinessError, groupFindings, incompleteUpgradeCheckCount, issueSpecificReferences, summaryMeta, upgradeEvaluationSummary } from './UpgradeReadinessView'
+import { UPGRADE_IMPACT_DOCS_URL, UPGRADE_IMPACT_MIN_RADAR_VERSION, UpgradeReadinessError, groupFindings, incompleteUpgradeCheckCount, issueSpecificReferences, summaryMeta, upgradeEvaluationSummary, upgradeEvidenceCoverageLabel, upgradeUnavailableKindsMessage } from './UpgradeReadinessView'
 
 describe('UpgradeReadinessError', () => {
   it('maps an unmatched endpoint 404 to the v1.9 upgrade message', () => {
@@ -40,7 +40,7 @@ describe('upgradeEvaluationSummary', () => {
       unknown: 1,
       notApplicable: 2,
       findings: 1,
-    })).toBe('18 evaluated · 16 applicable · 1 with partial evidence · 2 not applicable')
+    })).toBe('18 evaluated · 16 applicable · 1 with incomplete evidence · 2 not applicable')
   })
 
   it('does not imply incomplete coverage when every applicable check completed', () => {
@@ -68,6 +68,30 @@ describe('upgradeEvaluationSummary', () => {
   })
 })
 
+describe('upgradeUnavailableKindsMessage', () => {
+  it('does not guess why webhook evidence is unavailable', () => {
+    const message = upgradeUnavailableKindsMessage(['mutatingwebhookconfigurations', 'validatingwebhookconfigurations'])
+
+    expect(message).toContain('Affected checks are marked incomplete')
+    expect(message).not.toContain('rbac.viewWebhooks')
+    expect(message).not.toContain('grant')
+  })
+
+  it('does not suggest webhook access for unrelated evidence gaps', () => {
+    expect(upgradeUnavailableKindsMessage(['apiservices'])).not.toContain('rbac.viewWebhooks')
+  })
+})
+
+describe('upgradeEvidenceCoverageLabel', () => {
+  it('distinguishes absent evidence from partial evidence', () => {
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', caveat: 'unavailable' })).toBe('No evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', inspected: 0, caveat: 'unavailable' })).toBe('No evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'unknown', inspected: 1, caveat: 'one object malformed' })).toBe('Partial evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'blocked', inspected: 1, caveat: 'some nodes unavailable' })).toBe('Partial evidence')
+    expect(upgradeEvidenceCoverageLabel({ status: 'passed', inspected: 1 })).toBe('')
+  })
+})
+
 describe('groupFindings', () => {
   it('groups repeated remediation inside a check without merging distinct action levels', () => {
     const base = {

package/src/components/audit/UpgradeReadinessView.tsx

@@ -76,7 +76,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
   const location = useLocation()
   const navigate = useNavigate()
   const requestedTarget = new URLSearchParams(location.search).get('target') ?? undefined
-  const { data, isLoading, isFetching, isPlaceholderData, error, dataUpdatedAt, refetch } = useUpgradeReadiness(requestedTarget)
+  const { data, isLoading, isFetching, isPlaceholderData, error, dataUpdatedAt, refreshScan } = useUpgradeReadiness(requestedTarget)
   const { connection } = useConnection()
   const targetOptions = useMemo(
     () => buildTargetOptions(data?.currentVersion, data?.reviewedThrough, requestedTarget ?? data?.targetVersion),
@@ -127,6 +127,8 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
 
   return (
     <div aria-busy={isFetching} className="flex-1 flex flex-col min-h-0 p-4 gap-4 overflow-auto">
+      <ChecksViewTabs />
+
       <PageHeader
         icon={ShieldAlert}
         title="Upgrade impact"
@@ -153,8 +155,8 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
             )}
             <FreshnessControl
               mode="snapshot"
-              dataUpdatedAt={dataUpdatedAt}
-              onRefresh={() => refetch()}
+              dataUpdatedAt={data.observedAt ? Date.parse(data.observedAt) : dataUpdatedAt}
+              onRefresh={() => refreshScan()}
               connectionState={connection.state}
               isFetching={isFetching}
             />
@@ -162,8 +164,6 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
         }
       />
 
-      <ChecksViewTabs />
-
       {showingPreviousTarget && (
         <CoverageNotice
           headline={`Analyzing Kubernetes ${requestedTarget}`}
@@ -202,7 +202,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
       {data.coverage.state !== 'no_access' && (data.coverage.unavailableKinds?.length ?? 0) > 0 && (
         <CoverageNotice
           headline="Some live resources were unavailable"
-          body={`Radar could not inspect: ${(data.coverage.unavailableKinds ?? []).join(', ')}. Affected checks are marked incomplete.`}
+          body={upgradeUnavailableKindsMessage(data.coverage.unavailableKinds ?? [])}
         />
       )}
       {data.coverage.state !== 'no_access' && scopedKinds.length > 0 && (
@@ -212,7 +212,7 @@ export function UpgradeReadinessView({ namespaces, onNavigateToResource }: Upgra
         />
       )}
       {data.coverage.state === 'partial' && !data.coverage.scopedNamespaces?.length && !data.coverage.unavailableKinds?.length && scopedKinds.length === 0 && (
-        <CoverageNotice headline="Some evidence is incomplete" body="Rows marked Partial evidence explain what Radar could not verify." />
+        <CoverageNotice headline="Some evidence is incomplete" body="Evidence labels on affected rows explain what Radar could not verify." />
       )}
       {data.coverage.state === 'no_access' ? (
         <section className="shrink-0">
@@ -291,8 +291,17 @@ export function incompleteUpgradeCheckCount(checks: Pick<UpgradeReadinessCheck,
 
 export function upgradeEvaluationSummary(total: number, summary: UpgradeReadinessResponse['summary'], incomplete = summary.unknown) {
   const applicable = Math.max(0, total - summary.notApplicable)
-  const partialEvidenceLabel = incomplete > 0 ? ` · ${incomplete} with partial evidence` : ''
-  return `${total} evaluated · ${applicable} applicable${partialEvidenceLabel} · ${summary.notApplicable} not applicable`
+  const incompleteEvidenceLabel = incomplete > 0 ? ` · ${incomplete} with incomplete evidence` : ''
+  return `${total} evaluated · ${applicable} applicable${incompleteEvidenceLabel} · ${summary.notApplicable} not applicable`
+}
+
+export function upgradeUnavailableKindsMessage(unavailableKinds: string[]) {
+  return `Radar could not inspect: ${unavailableKinds.join(', ')}. Affected checks are marked incomplete.`
+}
+
+export function upgradeEvidenceCoverageLabel(check: Pick<UpgradeReadinessCheck, 'status' | 'inspected' | 'caveat'>) {
+  if (!check.caveat) return ''
+  return check.status === 'unknown' && (check.inspected ?? 0) === 0 ? 'No evidence' : 'Partial evidence'
 }
 
 function CoverageMethodology({ data }: { data: UpgradeReadinessResponse }) {
@@ -323,7 +332,7 @@ function CoverageMethodology({ data }: { data: UpgradeReadinessResponse }) {
           </p>
           <p>
             Results use live cluster resources and the row-specific evidence scope shown below. {unavailable.length > 0
-              ? `Radar could not inspect ${unavailable.join(', ')}; affected checks are marked incomplete.`
+              ? upgradeUnavailableKindsMessage(unavailable)
               : scopedKinds.length > 0
                 ? `Cached evidence has per-kind namespace ceilings for ${formatScopedKinds(scopedKinds)}.`
               : data.coverage.state === 'complete'
@@ -433,6 +442,7 @@ function CheckRow({ check, onNavigateToResource }: { check: UpgradeReadinessChec
   const detailID = `upgrade-check-${check.id}`
   const findingGroups = groupFindings(check.findings)
   const label = evidenceLabel(check)
+  const coverageLabel = upgradeEvidenceCoverageLabel(check)
   const checkReferences = check.references ?? []
   return (
     <div>
@@ -456,10 +466,10 @@ function CheckRow({ check, onNavigateToResource }: { check: UpgradeReadinessChec
           <div className="min-w-0">
             <Badge severity={meta.badgeSeverity}>{meta.label}</Badge>
             {label && <div className="mt-1 text-[11px] text-theme-text-tertiary">{label}</div>}
-            {check.caveat && (
+            {coverageLabel && (
               <div className="mt-1 inline-flex items-center gap-1 text-[11px] font-medium text-amber-700 dark:text-amber-300">
                 <AlertTriangle className="h-3 w-3 shrink-0" />
-                Partial evidence
+                {coverageLabel}
               </div>
             )}
           </div>

package/src/components/capacity/ClusterSchedulingCard.tsx

@@ -7,7 +7,7 @@ import {
 import { Badge } from "@skyhook-io/k8s-ui/components/ui/Badge";
 import {
   parseCPUToNanocores,
-  parseMemoryToBytes,
+  parseQuantityToNumber,
 } from "@skyhook-io/k8s-ui/utils/format";
 import {
   CertaintyGlyph,
@@ -96,16 +96,15 @@ export function quantityToNumber(
     }
     return null;
   }
-  // Milli quantities before the byte parser — it ignores the `m` suffix and
-  // would read 3000m as 3000, a 1000× distortion.
-  const milli = /^(-?\d+(?:\.\d+)?)m$/.exec(value);
-  if (milli) return Number(milli[1]) / 1000;
-  const parsed = parseMemoryToBytes(value);
-  if (Number.isFinite(parsed) && (parsed !== 0 || /^[0.]+\D*$/.test(value))) {
+  // The shared parser knows the full suffix table — the byte parser stops at
+  // Ti, so a 1PiB aggregate would read as 1 byte. It returns 0 for input it
+  // cannot parse, so distinguish a real zero to preserve the null (= unknown,
+  // not zero) contract of this card.
+  const parsed = parseQuantityToNumber(value);
+  if (parsed !== 0 || /^[+-]?[0.]+\D*$/.test(value)) {
     return parsed;
   }
-  const plain = Number(value);
-  return Number.isFinite(plain) ? plain : null;
+  return null;
 }
 
 function worstCertainty(

package/src/components/capacity/schedulingBar.test.ts

@@ -202,6 +202,16 @@ describe("quantityToNumber", () => {
     expect(quantityToNumber("example.com/widget", "3000m")).toBe(3);
     expect(quantityToNumber("cpu", "1500m")).toBe(1.5e9);
   });
+
+  // Aggregate memory on a large cluster reaches suffixes the byte parser
+  // never knew (its table stops at Ti) — "1Pi" must not read as 1 byte.
+  it("parses the large suffixes an aggregate capacity can carry", () => {
+    expect(quantityToNumber("memory", "1Pi")).toBe(1024 ** 5);
+    expect(quantityToNumber("memory", "1Ei")).toBe(1024 ** 6);
+    expect(quantityToNumber("pods", "1k")).toBe(1000);
+    expect(quantityToNumber("pods", "1e3")).toBe(1000);
+    expect(quantityToNumber("memory", "0Gi")).toBe(0);
+  });
 });
 
 describe("claimStagesDetail", () => {

package/src/components/cost/ApplicationCostTab.test.ts

@@ -11,6 +11,7 @@ describe('getApplicationCostState', () => {
   it('keeps current app cost visible when historical owner metrics are missing', () => {
     const current: OpenCostApplicationCostResponse = {
       available: true,
+      currency: 'USD',
       partial: true,
       totals: {
         hourlyCost: 0.4,
@@ -38,6 +39,7 @@ describe('getApplicationCostState', () => {
     }
     const trend: OpenCostApplicationCostTrendResponse = {
       available: false,
+      currency: 'USD',
       reason: 'no_metrics',
       range: '24h',
       coverage: { total: 3, included: 0 },
@@ -54,6 +56,7 @@ describe('getApplicationCostState', () => {
   it('uses historical data when current app metrics are absent but history exists', () => {
     const current: OpenCostApplicationCostResponse = {
       available: false,
+      currency: 'USD',
       reason: 'no_metrics',
       totals: {
         hourlyCost: 0,
@@ -69,6 +72,7 @@ describe('getApplicationCostState', () => {
     }
     const trend: OpenCostApplicationCostTrendResponse = {
       available: true,
+      currency: 'USD',
       range: '7d',
       windowTotalCost: 2,
       dataPoints: [
@@ -89,6 +93,7 @@ describe('getApplicationCostState', () => {
   it('treats all tracked workloads scaled to zero as valid zero state', () => {
     const current: OpenCostApplicationCostResponse = {
       available: true,
+      currency: 'USD',
       totals: {
         hourlyCost: 0,
         cpuCost: 0,
@@ -168,6 +173,7 @@ describe('getApplicationCostState', () => {
   it('surfaces app workload access and existence failures', () => {
     const current: OpenCostApplicationCostResponse = {
       available: false,
+      currency: 'USD',
       reason: 'access_denied',
       totals: {
         hourlyCost: 0,