@skyhook-io/radar-app 1.13.3 → 1.13.5

package/src/components/diagnose/investigationEvidence.test.ts

@@ -6,9 +6,11 @@ import {
   investigationEvidenceSourceDomId,
   investigationEvidenceSourceId,
   investigationEvidenceSubjectRef,
+  metricsScope,
   projectInvestigationEvidence,
   resolveInvestigationRootCauseEvidence,
   type InvestigationEvidenceGroup,
+  type InvestigationEvidenceTarget,
   type InvestigationEvidenceTimelineItem,
   type InvestigationEvidenceTurn,
 } from "./investigationEvidence";
@@ -559,7 +561,7 @@ describe("root-cause evidence resolution", () => {
     const projection = project([
       tool(
         "metrics-1",
-        "query_prometheus",
+        "discover_metrics",
         { result: [1] },
         { evidenceRef: ref },
       ),
@@ -857,10 +859,10 @@ describe("semantic diagnose evidence projection", () => {
     expect(limitationText).toContain("selected 2 of 5");
     expect(limitationText).toContain("includes 2 of 8 selected log lines");
     expect(limitationText).toContain("not the container's full log history");
-    expect(limitationText).toContain("Additional crash-cause");
+    expect(limitationText).toContain("part of the crash-cause candidates");
     expect(limitationText).toContain("received 1 of 3 event groups");
     expect(limitationText).toContain("rbac denied");
-    expect(limitationText).toContain("Referenced-by relationships");
+    expect(limitationText).toContain("referenced-by relationships");
     expect(limitationText).toContain("recent-change result limit");
     expect(result.coverage).toEqual({
       attempted: 1,
@@ -943,7 +945,9 @@ describe("strict evidence adapters", () => {
     ]);
     const events = groupsOf(result.groups, "events")[0].latest;
 
-    expect(events.summary).toBe("1 event group · Deployment shop/api");
+    expect(events.summary).toBe(
+      "BackOff: Back-off restarting failed container · Deployment shop/api",
+    );
     expect(events.data).toMatchObject({
       type: "events",
       scope: "Deployment shop/api",
@@ -2592,7 +2596,7 @@ describe("strict evidence adapters", () => {
 
   it("keeps unknown tools in Activity and limits invalid known contracts", () => {
     const result = project([
-      tool("other", "query_prometheus", { data: "ignored" }),
+      tool("other", "discover_metrics", { data: "ignored" }),
       tool("bad-events", "get_events", { events: [{ nope: true }] }),
     ]);
     expect(result.sources.map((source) => source.stepId)).toEqual([
@@ -2815,7 +2819,8 @@ describe("honest zero and partial-result states", () => {
     );
     // list_resources uses [] for some RBAC-filtered reads, so its emptiness is
     // never a positive receipt even when the transport itself succeeded. The
-    // narrow event/change producers have the same ambiguity today; the targeted
+    // events producer marks a denied namespace explicitly, so its empty result
+    // is a receipt; the changes producer still has the ambiguity. The targeted
     // semantic diagnose bundle is authoritative because access is checked before
     // that workload path runs.
     expect(
@@ -2826,16 +2831,15 @@ describe("honest zero and partial-result states", () => {
       ),
     ).toBe(false);
     expect(result.limitations.map((item) => item.source)).toEqual(
-      expect.arrayContaining([
-        "Events",
-        "Recent changes",
-        "Resource inventory",
-      ]),
+      expect.arrayContaining(["Recent changes", "Resource inventory"]),
+    );
+    expect(result.limitations.map((item) => item.source)).not.toContain(
+      "Events",
     );
     expect(result.coverage).toEqual({
       attempted: 5,
-      projected: 2,
-      limited: 3,
+      projected: 3,
+      limited: 2,
       checked: 1,
     });
     expect(
@@ -2845,10 +2849,10 @@ describe("honest zero and partial-result states", () => {
           group.latest.data.checked === "events",
       )?.latest,
     ).toMatchObject({
-      title: "No matching warning events",
-      data: {
-        message: "The warning-event query completed and returned no groups.",
-      },
+      // The title and the scope beside it are the whole answer here; a body
+      // would only restate them.
+      title: "No warning events",
+      data: { message: undefined },
     });
   });
 
@@ -3107,3 +3111,3507 @@ describe("honest zero and partial-result states", () => {
     ]);
   });
 });
+
+// The get_workload_logs response shape, with the stream rows fetchPodLogs
+// emits per pod and container.
+const workloadLogsPayload = {
+  workload: "deployments/shop/api",
+  pods: 2,
+  logs: [
+    {
+      pod: "api-68c7b766dc-fmphn",
+      container: "api",
+      logs: {
+        lines: [
+          "2026-09-07T08:00:20.234687659Z [Nest] 1  - 09/07/2026, 8:00:20 AM   ERROR [MongooseModule] Unable to connect to the database. Retrying (9)...",
+          "2026-09-07T08:00:20.234756499Z MongoServerError: Authentication failed.",
+        ],
+        totalLines: 50,
+        matchedLines: 4,
+        fallback: false,
+      },
+    },
+    {
+      pod: "api-68c7b766dc-fmphn",
+      container: "istio-proxy",
+      logs: {
+        lines: ["2026-09-07T08:00:19Z info Envoy proxy is ready"],
+        totalLines: 12,
+        matchedLines: 0,
+        fallback: true,
+      },
+    },
+    {
+      pod: "api-68c7b766dc-q2zxr",
+      container: "api",
+      logs: {
+        lines: [
+          "2026-09-07T08:00:21Z MongoServerError: Authentication failed.",
+        ],
+        totalLines: 50,
+        matchedLines: 1,
+        fallback: false,
+      },
+    },
+  ],
+  narrowHint:
+    "at least one pod's log stream tailed to 50 lines (cap reached) — narrow with since= (e.g. 10m), grep= regex, container=, or raise tail_lines",
+  warnings: [
+    "1 of 2 pod(s) have container restarts on record; the error(s) that killed prior containers are in the previous instance's logs — call again with `previous: true` to see them.",
+  ],
+};
+
+const workloadLogsArgs = JSON.stringify({
+  namespace: "shop",
+  name: "api",
+  kind: "deployment",
+  tail_lines: 50,
+});
+
+describe("workload logs adapter", () => {
+  it("keeps one multi-container result as one source with several observations", () => {
+    const ref = evidenceRef("a", "b");
+    const projection = project([
+      tool("wl-logs", "get_workload_logs", workloadLogsPayload, {
+        summary: workloadLogsArgs,
+        evidenceRef: ref,
+      }),
+    ]);
+    const logs = groupsOf(projection.groups, "logs");
+    expect(logs.map((group) => group.identity)).toEqual([
+      "logs:current:api-68c7b766dc-fmphn:api",
+      "logs:current:api-68c7b766dc-fmphn:istio-proxy",
+      "logs:current:api-68c7b766dc-q2zxr:api",
+    ]);
+    expect(projection.sources).toHaveLength(1);
+    expect(projection.coverage).toMatchObject({
+      attempted: 1,
+      projected: 1,
+      limited: 1,
+    });
+    expect(new Set(logs.map((group) => group.latest.source.id)).size).toBe(1);
+    // Diagnose relates a target workload to its pods the same way.
+    expect(logs.map((group) => group.latest.relevance)).toEqual([
+      "producer-related",
+      "producer-related",
+      "producer-related",
+    ]);
+    expect(logs[0].latest.tier).toBe("supporting");
+    expect(logs[0].latest.tone).toBe("warning");
+    expect(logs[0].latest.data).toMatchObject({
+      type: "logs",
+      namespace: "shop",
+      previous: false,
+      warnings: workloadLogsPayload.warnings,
+    });
+    expect(
+      (logs[0].latest.data as { logs?: { lines: string[] } }).logs?.lines[0],
+    ).not.toContain("[");
+    expect(logs[1].latest.tier).toBe("context");
+    expect(investigationEvidenceSubjectRef(logs[2].latest.data)).toEqual({
+      kind: "Pod",
+      namespace: "shop",
+      name: "api-68c7b766dc-q2zxr",
+    });
+
+    const resolution = resolveInvestigationRootCauseEvidence(
+      projection,
+      { status: "linked", refs: [ref] },
+      0,
+    );
+    expect(resolution.status).toBe("linked");
+    expect(resolution.links[0].source.stepId).toBe("wl-logs");
+    expect(resolution.links[0].originalGroupId).toBe(logs[0].id);
+    expect(projection.sources[0].primaryGroupId).toBe(logs[0].id);
+    expect(
+      projection.limitations.map((limitation) => limitation.source),
+    ).toEqual(["Workload logs"]);
+    expect(projection.limitations[0].kind).toBe("truncated");
+  });
+
+  it("accepts every workload kind the producer resolves, including Rollouts", () => {
+    const rollout = projectInvestigationEvidence(
+      [
+        {
+          timeline: [
+            tool(
+              "wl-rollout",
+              "get_workload_logs",
+              { ...workloadLogsPayload, workload: "rollouts/shop/api" },
+              {
+                summary: JSON.stringify({
+                  namespace: "shop",
+                  name: "api",
+                  kind: "rollout",
+                }),
+              },
+            ),
+          ],
+        },
+      ],
+      { kind: "Rollout", group: "argoproj.io", namespace: "shop", name: "api" },
+    );
+    expect(
+      groupsOf(rollout.groups, "logs").map((group) => group.latest.relevance),
+    ).toEqual(["producer-related", "producer-related", "producer-related"]);
+    expect(rollout.limitations.map((limitation) => limitation.kind)).toEqual([
+      "truncated",
+    ]);
+  });
+
+  it("scopes a sibling workload's logs as broader and a Pod target's own row as target", () => {
+    const sibling = project([
+      tool(
+        "wl-sibling",
+        "get_workload_logs",
+        { ...workloadLogsPayload, workload: "deployments/shop/api-worker" },
+        {
+          summary: JSON.stringify({
+            namespace: "shop",
+            name: "api-worker",
+            kind: "deployment",
+          }),
+        },
+      ),
+    ]);
+    expect(
+      groupsOf(sibling.groups, "logs").map((group) => group.latest.relevance),
+    ).toEqual(["broader", "broader", "broader"]);
+    expect(
+      groupsOf(sibling.groups, "logs").map((group) => group.latest.tier),
+    ).toEqual(["context", "context", "context"]);
+
+    const podTarget = projectInvestigationEvidence(
+      [
+        {
+          timeline: [
+            tool("wl-pod", "get_workload_logs", workloadLogsPayload, {
+              summary: workloadLogsArgs,
+            }),
+          ],
+        },
+      ],
+      {
+        kind: "Pod",
+        group: "",
+        namespace: "shop",
+        name: "api-68c7b766dc-q2zxr",
+      },
+    );
+    expect(
+      groupsOf(podTarget.groups, "logs").map((group) => group.latest.relevance),
+    ).toEqual(["broader", "broader", "target"]);
+  });
+
+  it("reports a failed read as a limitation and no pods as a scoped receipt", () => {
+    const failed = project([
+      tool(
+        "wl-error",
+        "get_workload_logs",
+        {
+          workload: "deployments/shop/api",
+          pods: 2,
+          logsError: "no kube client in request context",
+        },
+        { summary: workloadLogsArgs },
+      ),
+    ]);
+    expect(failed.groups).toHaveLength(0);
+    expect(failed.limitations).toEqual([
+      expect.objectContaining({
+        source: "Workload logs",
+        message: "no kube client in request context",
+        kind: "error",
+      }),
+    ]);
+
+    const empty = project([
+      tool(
+        "wl-empty",
+        "get_workload_logs",
+        {
+          workload: "jobs/shop/api",
+          pods: 0,
+          logs: "No pods found for this Job yet. Check scheduling, admission, or controller events.",
+          emptyReason: "no-pods",
+          emptyMessage:
+            "No pods found for this Job yet. Check scheduling, admission, or controller events.",
+          command: "kubectl logs job/api -n shop",
+        },
+        {
+          summary: JSON.stringify({
+            namespace: "shop",
+            name: "api",
+            kind: "job",
+          }),
+        },
+      ),
+    ]);
+    const receipt = groupsOf(empty.groups, "receipt")[0].latest;
+    expect(receipt.tier).toBe("context");
+    expect(receipt.relevance).toBe("broader");
+    expect(receipt.data).toMatchObject({
+      type: "receipt",
+      checked: "logs",
+      scope: "Job shop/api",
+      message:
+        "No pods found for this Job yet. Check scheduling, admission, or controller events.",
+    });
+    expect(empty.limitations).toHaveLength(0);
+
+    const unconfirmed = project([
+      tool(
+        "wl-unconfirmed",
+        "get_workload_logs",
+        { workload: "deployments/shop/api", pods: 0, logs: "no pods" },
+        { summary: workloadLogsArgs, isError: undefined },
+      ),
+    ]);
+    expect(groupsOf(unconfirmed.groups, "receipt")).toHaveLength(0);
+  });
+
+  it("rejects malformed payloads and per-stream errors honestly", () => {
+    const malformed = project([
+      tool(
+        "wl-bad",
+        "get_workload_logs",
+        { workload: "pods/shop/api", pods: 1, logs: [] },
+        { summary: workloadLogsArgs },
+      ),
+      tool(
+        "wl-stream-error",
+        "get_workload_logs",
+        {
+          workload: "deployments/shop/api",
+          pods: 1,
+          logs: [
+            {
+              pod: "api-68c7b766dc-fmphn",
+              container: "api",
+              error: "failed to get logs: container is waiting to start",
+            },
+          ],
+        },
+        { summary: workloadLogsArgs },
+      ),
+      tool(
+        "wl-null",
+        "get_workload_logs",
+        { workload: "deployments/shop/api", pods: 3, logs: null },
+        { summary: workloadLogsArgs },
+      ),
+      tool(
+        "wl-zero-with-streams",
+        "get_workload_logs",
+        {
+          workload: "deployments/shop/api",
+          pods: 0,
+          logs: workloadLogsPayload.logs,
+        },
+        { summary: workloadLogsArgs },
+      ),
+    ]);
+    expect(malformed.groups).toHaveLength(0);
+    expect(
+      malformed.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([
+      ["Workload logs", "unknown"],
+      ["api-68c7b766dc-fmphn / api", "error"],
+      ["Workload logs", "unknown"],
+    ]);
+    expect(malformed.limitations[0].sources.map((item) => item.stepId)).toEqual(
+      ["wl-bad", "wl-zero-with-streams"],
+    );
+    expect(malformed.limitations[0].message).toContain(
+      "couldn't summarize this investigation step",
+    );
+    expect(malformed.limitations[2].message).toContain(
+      "Radar found 3 pods but got no logs from them",
+    );
+  });
+});
+
+const firingInstance = {
+  state: "firing",
+  activeAt: "2026-09-07T07:58:00Z",
+  value: "1e+00",
+  labels: {
+    alertname: "KubePodCrashLooping",
+    namespace: "shop",
+    pod: "api-68c7b766dc-fmphn",
+    container: "api",
+    severity: "warning",
+  },
+};
+
+function alertingRule(
+  patch: Record<string, unknown> = {},
+): Record<string, unknown> {
+  return {
+    group: "kubernetes-apps",
+    type: "alerting",
+    name: "KubePodCrashLooping",
+    query:
+      'max_over_time(kube_pod_container_status_waiting_reason{reason="CrashLoopBackOff"}[5m]) >= 1',
+    state: "firing",
+    health: "ok",
+    labels: { severity: "warning" },
+    annotations: {
+      summary: "Pod is crash looping.",
+      description:
+        "Pod {{ $labels.namespace }}/{{ $labels.pod }} ({{ $labels.container }}) is in waiting state (reason: CrashLoopBackOff).",
+    },
+    alerts: [firingInstance],
+    ...patch,
+  };
+}
+
+const rulesArgs = JSON.stringify({ state: "firing" });
+
+/** A diagnose read that ties the given pods to the target as its log streams. */
+function diagnoseWithPods(...pods: string[]) {
+  return tool("diagnose-pods", "diagnose", {
+    resource: deployment,
+    resourceContext: { tier: "basic" },
+    logsCurrent: pods.map((pod) => ({
+      pod,
+      container: "api",
+      logs: {
+        lines: ["ready"],
+        totalLines: 1,
+        matchedLines: 0,
+        fallback: true,
+      },
+    })),
+  });
+}
+
+describe("prometheus rules adapter", () => {
+  it("relates a rule to the target through its instances, never the rule alone", () => {
+    const projection = project([
+      diagnoseWithPods("api-68c7b766dc-fmphn"),
+      tool(
+        "rules",
+        "get_prometheus_rules",
+        {
+          count: 4,
+          rules: [
+            alertingRule(),
+            alertingRule({
+              name: "KubeDeploymentReplicasMismatch",
+              labels: { severity: "warning", namespace: "shop" },
+              alerts: [
+                {
+                  state: "firing",
+                  labels: {
+                    namespace: "shop",
+                    deployment: "api-worker",
+                  },
+                },
+              ],
+            }),
+            alertingRule({
+              name: "TargetDown",
+              group: "general",
+              labels: { severity: "critical" },
+              alerts: [
+                {
+                  state: "firing",
+                  labels: { namespace: "monitoring", job: "node-exporter" },
+                },
+              ],
+            }),
+            alertingRule({
+              name: "SiblingCrash",
+              alerts: [
+                {
+                  state: "firing",
+                  labels: {
+                    namespace: "shop",
+                    pod: "api-worker-5d8f7c9b6-x2k9p",
+                  },
+                },
+              ],
+            }),
+          ],
+        },
+        { summary: rulesArgs },
+      ),
+    ]);
+    const alerts = groupsOf(projection.groups, "alerts");
+    expect(alerts.map((group) => group.latest.relevance)).toEqual([
+      "target",
+      "broader",
+      "broader",
+      "broader",
+    ]);
+    expect(alerts.map((group) => group.latest.tier)).toEqual([
+      "supporting",
+      "context",
+      "context",
+      "context",
+    ]);
+    expect(alerts[0].latest.tone).toBe("alert");
+    expect(alerts[2].latest.tone).toBe("error");
+    expect(alerts[0].latest.title).toBe("KubePodCrashLooping firing");
+    expect(alerts[0].latest.summary).toBe(
+      "1 active instance, 1 naming Deployment shop/api · kubernetes-apps",
+    );
+    expect(alerts[0].latest.data).toMatchObject({
+      type: "alerts",
+      rule: { group: "kubernetes-apps", state: "firing", health: "ok" },
+      instances: [{ namesTarget: true, value: "1e+00" }],
+      annotations: { summary: "Pod is crash looping." },
+    });
+    expect(alerts[3].latest.data).toMatchObject({
+      instances: [{ namesTarget: false }],
+    });
+    expect(
+      groupsOf(projection.groups, "receipt").filter((group) =>
+        group.identity.startsWith("alerts:"),
+      ),
+    ).toHaveLength(0);
+    expect(
+      projection.limitations.filter((limitation) =>
+        limitation.source.startsWith("Alert"),
+      ),
+    ).toHaveLength(0);
+  });
+
+  it("uses rule-level labels only as producer-related context", () => {
+    const projection = project([
+      tool(
+        "rules",
+        "get_prometheus_rules",
+        {
+          count: 1,
+          rules: [
+            alertingRule({
+              name: "ApiDown",
+              labels: {
+                severity: "warning",
+                namespace: "shop",
+                deployment: "api",
+              },
+              alerts: [
+                {
+                  state: "firing",
+                  labels: { namespace: "shop", instance: "10.0.0.4:8080" },
+                },
+              ],
+            }),
+          ],
+        },
+        { summary: rulesArgs },
+      ),
+    ]);
+    const alert = groupsOf(projection.groups, "alerts")[0].latest;
+    expect(alert.relevance).toBe("producer-related");
+    expect(alert.tier).toBe("supporting");
+    expect(alert.summary).toBe("1 active instance · kubernetes-apps");
+    expect(groupsOf(projection.groups, "receipt")).toHaveLength(0);
+  });
+
+  it("matches workload labels per kind and pod labels only through producer-established pods", () => {
+    const run = (
+      target: InvestigationEvidenceTarget,
+      labels: object,
+      capturedPods: string[] = [],
+    ) =>
+      groupsOf(
+        projectInvestigationEvidence(
+          [
+            {
+              timeline: [
+                ...(capturedPods.length > 0
+                  ? [
+                      tool("diagnose-pods", "diagnose", {
+                        resource: {
+                          ...deployment,
+                          kind: target.kind,
+                          metadata: {
+                            namespace: target.namespace,
+                            name: target.name,
+                          },
+                        },
+                        resourceContext: { tier: "basic" },
+                        logsCurrent: capturedPods.map((pod) => ({
+                          pod,
+                          container: "app",
+                          logs: {
+                            lines: ["ready"],
+                            totalLines: 1,
+                            matchedLines: 0,
+                            fallback: true,
+                          },
+                        })),
+                      }),
+                    ]
+                  : []),
+                tool(
+                  "rules",
+                  "get_prometheus_rules",
+                  {
+                    count: 1,
+                    rules: [
+                      alertingRule({ alerts: [{ state: "firing", labels }] }),
+                    ],
+                  },
+                  { summary: rulesArgs },
+                ),
+              ],
+            },
+          ],
+          target,
+        ).groups,
+        "alerts",
+      )[0].latest.relevance;
+    const statefulSet = { ...target, kind: "StatefulSet", name: "db" };
+    expect(run(target, { namespace: "shop", deployment: "api" })).toBe(
+      "target",
+    );
+    expect(run(target, { namespace: "other", deployment: "api" })).toBe(
+      "broader",
+    );
+    expect(run(target, { namespace: "shop", statefulset: "api" })).toBe(
+      "broader",
+    );
+    expect(
+      run(target, {
+        namespace: "shop",
+        workload: "api",
+        workload_type: "deployment",
+      }),
+    ).toBe("target");
+    expect(
+      run(target, {
+        namespace: "shop",
+        workload: "api",
+        workload_type: "statefulset",
+      }),
+    ).toBe("broader");
+    // A controller-shaped pod name proves nothing on its own: a sibling
+    // ReplicaSet `api-worker` produces `api-worker-abcde` too.
+    expect(
+      run(target, { namespace: "shop", pod: "api-68c7b766dc-fmphn" }),
+    ).toBe("broader");
+    expect(
+      run(target, { namespace: "shop", pod: "api-68c7b766dc-fmphn" }, [
+        "api-68c7b766dc-fmphn",
+      ]),
+    ).toBe("target");
+    expect(
+      run(target, { namespace: "shop", pod: "api-worker-abcde" }, [
+        "api-68c7b766dc-fmphn",
+      ]),
+    ).toBe("broader");
+    expect(run(statefulSet, { namespace: "shop", pod: "db-0" }, ["db-0"])).toBe(
+      "target",
+    );
+    expect(
+      run(statefulSet, { namespace: "other", pod: "db-0" }, ["db-0"]),
+    ).toBe("broader");
+    expect(
+      run(target, { pod: "api-68c7b766dc-fmphn" }, ["api-68c7b766dc-fmphn"]),
+    ).toBe("broader");
+  });
+
+  it("issues a scoped receipt only for a complete, unfiltered, evaluated active-state query", () => {
+    const unrelated = alertingRule({
+      name: "TargetDown",
+      alerts: [{ state: "firing", labels: { namespace: "monitoring" } }],
+    });
+    const receipt = (
+      payload: Record<string, unknown>,
+      args: Record<string, unknown>,
+    ) =>
+      groupsOf(
+        project([
+          tool("rules", "get_prometheus_rules", payload, {
+            summary: JSON.stringify(args),
+          }),
+        ]).groups,
+        "receipt",
+      );
+
+    const firing = receipt(
+      { count: 1, rules: [unrelated] },
+      { state: "firing" },
+    );
+    expect(firing).toHaveLength(1);
+    expect(firing[0].latest).toMatchObject({
+      tier: "checked",
+      relevance: "target",
+      title: "No firing alerts matched this Deployment",
+      summary: "Deployment shop/api",
+      data: {
+        type: "receipt",
+        checked: "alerts",
+        scope: "Deployment shop/api",
+        message:
+          "1 alerting rule returned (filter: state=firing), every instance in another namespace; none names Deployment shop/api.",
+      },
+    });
+
+    expect(
+      receipt(
+        {
+          count: 0,
+          rules: [],
+          note: "no rules matched — drop filters to see what exists, or the backend may have no rules configured",
+        },
+        { state: "pending" },
+      )[0].latest.data,
+    ).toMatchObject({
+      message: "0 alerting rules returned (filter: state=pending).",
+    });
+
+    // A name or group filter never looked at the other rules.
+    expect(
+      receipt(
+        { count: 1, rules: [unrelated] },
+        { state: "firing", name: "Target" },
+      ),
+    ).toHaveLength(0);
+    expect(
+      receipt({ count: 0, rules: [] }, { state: "firing", group: "general" }),
+    ).toHaveLength(0);
+    // An instance this projection cannot place is not evidence of absence.
+    expect(
+      receipt(
+        {
+          count: 1,
+          rules: [
+            alertingRule({
+              name: "Vague",
+              alerts: [
+                { state: "firing", labels: { instance: "10.0.0.4:9100" } },
+              ],
+            }),
+          ],
+        },
+        { state: "firing" },
+      ),
+    ).toHaveLength(0);
+    expect(
+      receipt(
+        {
+          count: 1,
+          rules: [
+            alertingRule({
+              name: "SameNamespace",
+              alerts: [
+                {
+                  state: "firing",
+                  labels: { namespace: "shop", pod: "other-abc" },
+                },
+              ],
+            }),
+          ],
+        },
+        { state: "firing" },
+      ),
+    ).toHaveLength(0);
+    expect(receipt({ count: 1, rules: [unrelated] }, {})).toHaveLength(0);
+    expect(
+      receipt({ count: 1, rules: [unrelated] }, { state: "inactive" }),
+    ).toHaveLength(0);
+    expect(
+      receipt(
+        { count: 1, rules: [alertingRule({ type: "recording", name: "x" })] },
+        { type: "record", state: "firing" },
+      ),
+    ).toHaveLength(0);
+    expect(
+      receipt(
+        {
+          count: 1,
+          rules: [unrelated],
+          truncated: true,
+          note: "narrow with name, group, state, or type filters",
+        },
+        { state: "firing" },
+      ),
+    ).toHaveLength(0);
+    expect(
+      receipt(
+        { count: 1, rules: [{ ...unrelated, health: "err" }] },
+        { state: "firing" },
+      ),
+    ).toHaveLength(0);
+    expect(
+      receipt(
+        { count: 1, rules: [{ ...unrelated, health: "degraded" }] },
+        { state: "firing" },
+      ),
+    ).toHaveLength(0);
+    expect(
+      receipt(
+        { count: 1, rules: [{ ...unrelated, health: undefined }] },
+        { state: "firing" },
+      ),
+    ).toHaveLength(0);
+  });
+
+  it("advances the card through alert state transitions and keeps distinct rules apart", () => {
+    const firingForTarget = alertingRule();
+    const resolved = alertingRule({ state: "inactive", alerts: [] });
+    const firingElsewhere = alertingRule({
+      alerts: [
+        {
+          state: "firing",
+          labels: { namespace: "shop", pod: "api-worker-5d8f7c9b6-x2k9p" },
+        },
+      ],
+    });
+    const run = (...later: Record<string, unknown>[]) =>
+      groupsOf(
+        project(
+          [
+            diagnoseWithPods("api-68c7b766dc-fmphn"),
+            tool(
+              "rules-1",
+              "get_prometheus_rules",
+              { count: 1, rules: [firingForTarget] },
+              { summary: rulesArgs },
+            ),
+          ],
+          [
+            tool(
+              "rules-2",
+              "get_prometheus_rules",
+              { count: later.length, rules: later },
+              { summary: JSON.stringify({}) },
+            ),
+          ],
+        ).groups,
+        "alerts",
+      );
+
+    const [resolvedGroup] = run(resolved);
+    expect(resolvedGroup.observations).toHaveLength(2);
+    expect(resolvedGroup.latest).toMatchObject({
+      title: "KubePodCrashLooping inactive",
+      relevance: "target",
+      tier: "context",
+      tone: "neutral",
+      summary: "No active instances · kubernetes-apps",
+    });
+    expect(resolvedGroup.latest).toBe(resolvedGroup.chronologicalLatest);
+    expect(resolvedGroup.historical).toBe(false);
+
+    const [movedGroup] = run(firingElsewhere);
+    expect(movedGroup.observations).toHaveLength(2);
+    expect(movedGroup.latest.relevance).toBe("broader");
+    expect(movedGroup.latest.summary).toBe(
+      "1 active instance · kubernetes-apps",
+    );
+
+    const distinct = groupsOf(
+      project([
+        tool(
+          "rules",
+          "get_prometheus_rules",
+          {
+            count: 2,
+            rules: [
+              alertingRule({ labels: { severity: "warning", team: "a" } }),
+              alertingRule({
+                query: "vector(1)",
+                labels: { severity: "critical", team: "b" },
+              }),
+            ],
+          },
+          { summary: rulesArgs },
+        ),
+      ]).groups,
+      "alerts",
+    );
+    expect(distinct).toHaveLength(2);
+    expect(distinct.every((group) => group.observations.length === 1)).toBe(
+      true,
+    );
+
+    // Identical definitions from different rule files arrive as identical
+    // rows: two rules this read cannot tell apart, so neither inherits the
+    // other's history on a later read.
+    const twin = () => alertingRule({ alerts: [], state: "inactive" });
+    const twins = groupsOf(
+      project(
+        [
+          diagnoseWithPods("api-68c7b766dc-fmphn"),
+          tool(
+            "rules-1",
+            "get_prometheus_rules",
+            { count: 2, rules: [alertingRule(), twin()] },
+            { summary: rulesArgs },
+          ),
+        ],
+        [
+          tool(
+            "rules-2",
+            "get_prometheus_rules",
+            { count: 2, rules: [alertingRule(), twin()] },
+            { summary: rulesArgs },
+          ),
+        ],
+      ).groups,
+      "alerts",
+    );
+    expect(twins).toHaveLength(4);
+    expect(twins.every((group) => group.observations.length === 1)).toBe(true);
+    expect(twins.map((group) => group.latest.relevance)).toEqual([
+      "target",
+      "broader",
+      "target",
+      "broader",
+    ]);
+    expect(twins.map((group) => group.latest.title)).toEqual([
+      "KubePodCrashLooping firing",
+      "KubePodCrashLooping inactive",
+      "KubePodCrashLooping firing",
+      "KubePodCrashLooping inactive",
+    ]);
+  });
+
+  it("never proves absence by namespace for a cluster-scoped target", () => {
+    const node = { kind: "Node", group: "", name: "worker-1" };
+    const run = (rules: Record<string, unknown>[]) =>
+      groupsOf(
+        projectInvestigationEvidence(
+          [
+            {
+              timeline: [
+                tool(
+                  "rules",
+                  "get_prometheus_rules",
+                  { count: rules.length, rules },
+                  { summary: rulesArgs },
+                ),
+              ],
+            },
+          ],
+          node,
+        ).groups,
+        "receipt",
+      );
+    expect(
+      run([
+        alertingRule({
+          name: "KubeNodeNotReady",
+          alerts: [
+            {
+              state: "firing",
+              labels: { node: "worker-1", namespace: "kube-system" },
+            },
+          ],
+        }),
+      ]),
+    ).toHaveLength(0);
+    expect(run([])).toHaveLength(1);
+    expect(run([])[0].latest.title).toBe("No firing alerts matched this Node");
+  });
+
+  it("keeps recording rules off the card list and flags truncation and evaluation health", () => {
+    const projection = project([
+      tool(
+        "rules",
+        "get_prometheus_rules",
+        {
+          count: 3,
+          rules: [
+            alertingRule({
+              type: "recording",
+              name: "namespace:container_cpu_usage_seconds_total:sum_rate",
+              alerts: undefined,
+              state: undefined,
+            }),
+            alertingRule({ health: "err", alerts: [] }),
+            alertingRule({
+              name: "KubeContainerWaiting",
+              state: "inactive",
+              health: "unknown",
+              alerts: [],
+            }),
+          ],
+          truncated: true,
+          note: "narrow with name, group, state, or type filters",
+        },
+        { summary: rulesArgs },
+      ),
+    ]);
+    const alerts = groupsOf(projection.groups, "alerts");
+    expect(alerts.map((group) => group.latest.title)).toEqual([
+      "KubePodCrashLooping firing",
+      "KubeContainerWaiting inactive",
+    ]);
+    expect(alerts[1].latest).toMatchObject({
+      tier: "context",
+      tone: "neutral",
+      relevance: "broader",
+      summary: "No active instances · kubernetes-apps",
+    });
+    expect(
+      projection.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([
+      ["Alert rules", "truncated"],
+      ["Alert rule KubePodCrashLooping", "error"],
+      ["Alert rule KubeContainerWaiting", "unknown"],
+    ]);
+    expect(projection.limitations[0].message).toContain(
+      "narrow with name, group, state, or type filters",
+    );
+    expect(groupsOf(projection.groups, "receipt")).toHaveLength(0);
+  });
+
+  it("does not let sampled values churn revision history, and rejects malformed rules", () => {
+    const later = {
+      ...firingInstance,
+      value: "2e+00",
+      activeAt: "2026-09-07T08:10:00Z",
+    };
+    const projection = project(
+      [
+        tool(
+          "rules-1",
+          "get_prometheus_rules",
+          { count: 1, rules: [alertingRule()] },
+          { summary: rulesArgs },
+        ),
+      ],
+      [
+        tool(
+          "rules-2",
+          "get_prometheus_rules",
+          { count: 1, rules: [alertingRule({ alerts: [later] })] },
+          { summary: rulesArgs },
+        ),
+      ],
+    );
+    const group = groupsOf(projection.groups, "alerts")[0];
+    expect(group.observations).toHaveLength(2);
+    expect(group.observations[1].changedFromPrevious).toBe(false);
+
+    const malformed = project([
+      tool(
+        "rules-bad",
+        "get_prometheus_rules",
+        { count: 1, rules: [{ name: "NoGroup", type: "alerting" }] },
+        { summary: rulesArgs },
+      ),
+      tool(
+        "rules-bad-instance",
+        "get_prometheus_rules",
+        { count: 1, rules: [alertingRule({ alerts: [{ labels: {} }] })] },
+        { summary: rulesArgs },
+      ),
+    ]);
+    expect(malformed.groups).toHaveLength(0);
+    expect(malformed.limitations).toHaveLength(1);
+    expect(malformed.limitations[0].sources).toHaveLength(2);
+    expect(malformed.limitations[0].source).toBe("Alert rules");
+
+    const envelope = project([
+      tool(
+        "rules-count",
+        "get_prometheus_rules",
+        { count: 2, rules: [alertingRule()] },
+        { summary: rulesArgs },
+      ),
+      tool(
+        "rules-truncated",
+        "get_prometheus_rules",
+        { count: 0, rules: [], truncated: "true" },
+        { summary: rulesArgs },
+      ),
+      tool(
+        "rules-no-query",
+        "get_prometheus_rules",
+        { count: 1, rules: [alertingRule({ query: undefined })] },
+        { summary: rulesArgs },
+      ),
+    ]);
+    expect(envelope.groups).toHaveLength(0);
+    expect(envelope.limitations[0].sources).toHaveLength(3);
+  });
+});
+
+const helmRelease = {
+  name: "shop",
+  namespace: "shop",
+  chart: "shop",
+  chartVersion: "1.4.2",
+  appVersion: "2.0.0",
+  status: "deployed",
+  revision: 7,
+  updated: "2026-09-07T07:00:00Z",
+  description: "Upgrade complete",
+  resources: [
+    {
+      kind: "Deployment",
+      apiVersion: "apps/v1",
+      name: "api",
+      namespace: "shop",
+      status: "Running",
+      ready: "0/1",
+    },
+    {
+      kind: "Service",
+      apiVersion: "v1",
+      name: "api",
+      namespace: "shop",
+      status: "Active",
+    },
+  ],
+};
+
+describe("helm release adapter", () => {
+  it("relates a release through the resources it manages", () => {
+    const projection = project([
+      tool("helm", "get_helm_release", helmRelease, {
+        summary: JSON.stringify({ namespace: "shop", name: "shop" }),
+      }),
+      tool(
+        "helm-other",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "ingress",
+          resources: [
+            {
+              kind: "Deployment",
+              apiVersion: "apps/v1",
+              name: "api",
+              namespace: "ingress",
+            },
+          ],
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "ingress" }) },
+      ),
+    ]);
+    const releases = groupsOf(projection.groups, "helm");
+    expect(releases.map((group) => group.latest.relevance)).toEqual([
+      "producer-related",
+      "broader",
+    ]);
+    expect(releases[0].latest).toMatchObject({
+      tier: "context",
+      tone: "info",
+      title: "Helm release shop/shop",
+      summary: "shop 1.4.2 · deployed · revision 7",
+    });
+    expect(investigationEvidenceSubjectRef(releases[0].latest.data)).toEqual({
+      kind: "HelmRelease",
+      group: "helm.sh",
+      namespace: "shop",
+      name: "shop",
+    });
+  });
+
+  it("never fills a missing owned-resource API version from the target", () => {
+    const projection = project([
+      tool(
+        "helm-no-version",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          resources: [{ kind: "Deployment", name: "api", namespace: "shop" }],
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-other-group",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "shop-x",
+          resources: [
+            {
+              kind: "Deployment",
+              apiVersion: "example.io/v1",
+              name: "api",
+              namespace: "shop",
+            },
+          ],
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop-x" }) },
+      ),
+    ]);
+    expect(
+      groupsOf(projection.groups, "helm").map(
+        (group) => group.latest.relevance,
+      ),
+    ).toEqual(["broader", "broader"]);
+  });
+
+  it("keys a release by its storage namespace and withholds a link it cannot express", () => {
+    const projection = project([
+      tool(
+        "helm-a",
+        "get_helm_release",
+        { ...helmRelease, storageNamespace: "flux-a" },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-b",
+        "get_helm_release",
+        { ...helmRelease, storageNamespace: "flux-b", revision: 9 },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+    ]);
+    const releases = groupsOf(projection.groups, "helm");
+    expect(releases.map((group) => group.identity)).toEqual([
+      "helm:flux-a:shop:shop",
+      "helm:flux-b:shop:shop",
+    ]);
+    expect(releases[0].latest.data).toMatchObject({
+      release: { storageNamespace: "flux-a" },
+    });
+    expect(investigationEvidenceSubjectRef(releases[0].latest.data)).toBe(
+      undefined,
+    );
+  });
+
+  it("treats a non-deployed status, a health issue, or a failed operation as adverse", () => {
+    const projection = project([
+      tool(
+        "helm-failed",
+        "get_helm_release",
+        { ...helmRelease, status: "failed", description: "Upgrade failed" },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-issue",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "shop-cache",
+          resourceHealth: "unhealthy",
+          healthIssue: "Deployment shop/cache has 0/1 ready replicas",
+          healthSummary: "1 of 2 resources unhealthy",
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop-cache" }) },
+      ),
+      tool(
+        "helm-stuck",
+        "get_helm_release",
+        {
+          ...helmRelease,
+          name: "shop-jobs",
+          status: "pending-upgrade",
+          lastOperation: {
+            kind: "pending",
+            status: "stuck_pending",
+            source: "helm_status",
+            confidence: "high",
+            message: "Revision 8 has been pending-upgrade for 42m",
+            revision: 8,
+          },
+          valuesError:
+            'Radar Cloud role "viewer" cannot view Helm release values (requires member or higher)',
+          diffError:
+            'Radar Cloud role "viewer" cannot view Helm release diffs (requires member or higher)',
+          valuesDiffError: "values diff failed",
+          notesDiffError: "notes diff failed",
+          resourceDiffError: "resource diff failed",
+        },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop-jobs" }) },
+      ),
+    ]);
+    const releases = groupsOf(projection.groups, "helm");
+    expect(
+      releases.map((group) => [group.latest.tier, group.latest.tone]),
+    ).toEqual([
+      ["supporting", "error"],
+      ["supporting", "warning"],
+      ["supporting", "warning"],
+    ]);
+    expect(releases[1].latest.summary).toBe(
+      "deployed · Deployment shop/cache has 0/1 ready replicas",
+    );
+    expect(releases[2].latest.data).toMatchObject({
+      type: "helm",
+      release: {
+        lastOperation: { kind: "pending", status: "stuck_pending" },
+      },
+    });
+    // Every comparison the producer could not finish has to reach the reader:
+    // three of these are role denials, and a release card that omits a withheld
+    // diff without saying so reads as a complete one.
+    expect(projection.limitations).toEqual([
+      expect.objectContaining({ source: "Helm values", kind: "error" }),
+      expect.objectContaining({ source: "Helm values diff", kind: "error" }),
+      expect.objectContaining({ source: "Helm manifest diff", kind: "error" }),
+      expect.objectContaining({ source: "Helm notes diff", kind: "error" }),
+      expect.objectContaining({ source: "Helm resource diff", kind: "error" }),
+    ]);
+  });
+
+  it("rejects malformed release payloads", () => {
+    const projection = project([
+      tool(
+        "helm-bad",
+        "get_helm_release",
+        { ...helmRelease, revision: "7" },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-bad-resource",
+        "get_helm_release",
+        { ...helmRelease, resources: [{ kind: "Deployment" }] },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+      tool(
+        "helm-bad-operation",
+        "get_helm_release",
+        { ...helmRelease, lastOperation: { kind: "rollback" } },
+        { summary: JSON.stringify({ namespace: "shop", name: "shop" }) },
+      ),
+    ]);
+    expect(projection.groups).toHaveLength(0);
+    expect(
+      projection.limitations.map((limitation) => limitation.source),
+    ).toEqual(["Helm release", "Helm resources", "Helm operation"]);
+  });
+});
+
+const deploymentWithServiceAccount = {
+  ...deployment,
+  spec: { template: { spec: { serviceAccountName: "api-sa" } } },
+};
+
+const permissionsArgs = JSON.stringify({
+  kind: "ServiceAccount",
+  namespace: "shop",
+  name: "api-sa",
+  verb: "get",
+  resource: "secrets",
+});
+
+describe("subject permissions adapter", () => {
+  it("does not turn an unevaluated access check into a denial", () => {
+    // A webhook authorizer returning partial data has established neither
+    // answer. Reading it as "cannot" sends an operator after an RBAC grant
+    // that may already exist.
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: deploymentWithServiceAccount,
+        resourceContext: { tier: "basic" },
+      }),
+      tool(
+        "perm",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
+          accessCheck: {
+            verb: "get",
+            resource: "secrets",
+            namespace: "shop",
+            allowed: false,
+            denied: false,
+            reason: "",
+            evaluationError: "webhook authorizer returned partial data",
+          },
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    const [group] = groupsOf(projection.groups, "permissions");
+    expect(group.latest.title).toContain("Could not check whether");
+    expect(group.latest.title).not.toContain("cannot get");
+    expect(group.latest.summary).toContain(
+      "webhook authorizer returned partial data",
+    );
+    expect(group.latest.summary).not.toContain("No RBAC rule allows it");
+    // The gap still reaches the coverage strip as well.
+    expect(projection.limitations).toContainEqual(
+      expect.objectContaining({ source: "Permissions", kind: "error" }),
+    );
+  });
+
+  it("keeps a decided verdict that arrived with an evaluation error", () => {
+    // Kubernetes returns the error alongside a real answer too — one webhook
+    // failing while another allows. That answer is still the answer.
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: deploymentWithServiceAccount,
+        resourceContext: { tier: "basic" },
+      }),
+      tool(
+        "perm",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
+          accessCheck: {
+            verb: "get",
+            resource: "secrets",
+            namespace: "shop",
+            allowed: true,
+            denied: false,
+            reason: "allowed by one authorizer",
+            evaluationError: "a second webhook did not answer",
+          },
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    const [group] = groupsOf(projection.groups, "permissions");
+    expect(group.latest.title).toContain("can get");
+    expect(group.latest.title).not.toContain("Could not check");
+    expect(group.latest.tone).toBe("info");
+    // And the error is still reported, just not as the verdict.
+    expect(projection.limitations).toContainEqual(
+      expect.objectContaining({ source: "Permissions", kind: "error" }),
+    );
+  });
+
+  it("binds an access check to the target's ServiceAccount seen in the same turn", () => {
+    const check = {
+      subject: { kind: "ServiceAccount", namespace: "shop", name: "api-sa" },
+      accessCheck: {
+        verb: "get",
+        resource: "secrets",
+        namespace: "shop",
+        allowed: false,
+        reason: "",
+      },
+    };
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: deploymentWithServiceAccount,
+        resourceContext: { tier: "basic" },
+      }),
+      tool("perm", "get_subject_permissions", check, {
+        summary: permissionsArgs,
+      }),
+      tool(
+        "perm-other",
+        "get_subject_permissions",
+        {
+          subject: { kind: "ServiceAccount", namespace: "shop", name: "other" },
+          accessCheck: {
+            verb: "list",
+            group: "apps",
+            resource: "deployments",
+            subresource: "scale",
+            namespace: "",
+            allowed: true,
+            reason: 'RBAC: allowed by ClusterRoleBinding "admin"',
+          },
+        },
+        {
+          summary: JSON.stringify({
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "other",
+          }),
+        },
+      ),
+    ]);
+    const permissions = groupsOf(projection.groups, "permissions");
+    expect(permissions.map((group) => group.latest.relevance)).toEqual([
+      "target",
+      "broader",
+    ]);
+    expect(permissions[0].latest).toMatchObject({
+      tier: "supporting",
+      tone: "warning",
+      title: "Service Account shop/api-sa cannot get secrets",
+      summary: "No RBAC rule allows it · namespace shop",
+    });
+    expect(permissions[0].latest.data).toMatchObject({
+      type: "permissions",
+      accessCheck: { allowed: false, denied: false },
+    });
+    expect(permissions[1].latest).toMatchObject({
+      tier: "context",
+      tone: "info",
+      title: "Service Account shop/other can list deployments/scale.apps",
+      summary: 'RBAC: allowed by ClusterRoleBinding "admin" · cluster-wide',
+    });
+    expect(investigationEvidenceSubjectRef(permissions[0].latest.data)).toEqual(
+      { kind: "ServiceAccount", namespace: "shop", name: "api-sa" },
+    );
+  });
+
+  it("uses the producer's serviceAccount reference and the default account when the template omits one", () => {
+    const withContext = project([
+      tool("diagnose", "diagnose", {
+        resource: deployment,
+        resourceContext: {
+          tier: "diagnostic",
+          uses: {
+            serviceAccount: {
+              kind: "ServiceAccount",
+              namespace: "shop",
+              name: "ctx-sa",
+            },
+          },
+        },
+      }),
+      tool(
+        "perm",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "ctx-sa",
+          },
+          bindings: [],
+          flatRules: [],
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    expect(
+      groupsOf(withContext.groups, "permissions")[0].latest.relevance,
+    ).toBe("target");
+
+    const withDefault = project([
+      tool("resource", "get_resource", {
+        ...deployment,
+        spec: { template: { spec: {} } },
+      }),
+      tool(
+        "perm",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "default",
+          },
+          bindings: [],
+          flatRules: [],
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    expect(
+      groupsOf(withDefault.groups, "permissions")[0].latest.relevance,
+    ).toBe("target");
+
+    const priorTurn = project(
+      [
+        tool("diagnose", "diagnose", {
+          resource: deploymentWithServiceAccount,
+          resourceContext: { tier: "basic" },
+        }),
+      ],
+      [
+        tool(
+          "perm",
+          "get_subject_permissions",
+          {
+            subject: {
+              kind: "ServiceAccount",
+              namespace: "shop",
+              name: "api-sa",
+            },
+            bindings: [],
+            flatRules: [],
+          },
+          { summary: permissionsArgs },
+        ),
+      ],
+    );
+    expect(groupsOf(priorTurn.groups, "permissions")[0].latest.relevance).toBe(
+      "broader",
+    );
+
+    // The newest captured read of the target decides which account it runs as.
+    const rotated = project([
+      tool("resource-old", "get_resource", deploymentWithServiceAccount),
+      tool("resource-new", "get_resource", {
+        ...deployment,
+        spec: { template: { spec: { serviceAccountName: "api-sa-v2" } } },
+      }),
+      tool(
+        "perm-old",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
+          bindings: [],
+          flatRules: [],
+        },
+        { summary: permissionsArgs },
+      ),
+      tool(
+        "perm-new",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa-v2",
+          },
+          bindings: [],
+          flatRules: [],
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    expect(
+      groupsOf(rotated.groups, "permissions").map(
+        (group) => group.latest.relevance,
+      ),
+    ).toEqual(["broader", "target"]);
+  });
+
+  it("reads a PodSpec only from kinds that carry one", () => {
+    const check = (name: string) => ({
+      subject: { kind: "ServiceAccount", namespace: "shop", name },
+      accessCheck: {
+        verb: "get",
+        resource: "secrets",
+        namespace: "shop",
+        allowed: false,
+      },
+    });
+    const applicationSet = project([
+      tool("resource", "get_resource", {
+        apiVersion: "argoproj.io/v1alpha1",
+        kind: "ApplicationSet",
+        metadata: { namespace: "shop", name: "api" },
+        spec: { template: { spec: { project: "default" } } },
+      }),
+      tool("perm", "get_subject_permissions", check("default"), {
+        summary: permissionsArgs,
+      }),
+    ]);
+    expect(
+      groupsOf(applicationSet.groups, "permissions")[0].latest.relevance,
+    ).toBe("broader");
+
+    const cronJob = projectInvestigationEvidence(
+      [
+        {
+          timeline: [
+            tool("resource", "get_resource", {
+              apiVersion: "batch/v1",
+              kind: "CronJob",
+              metadata: { namespace: "shop", name: "api" },
+              spec: {
+                jobTemplate: {
+                  spec: {
+                    template: { spec: { serviceAccountName: "cron-sa" } },
+                  },
+                },
+              },
+            }),
+            tool("perm", "get_subject_permissions", check("cron-sa"), {
+              summary: permissionsArgs,
+            }),
+          ],
+        },
+      ],
+      { kind: "CronJob", group: "batch", namespace: "shop", name: "api" },
+    );
+    expect(groupsOf(cronJob.groups, "permissions")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("keeps a denial for an unrelated principal out of the lead evidence", () => {
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: deploymentWithServiceAccount,
+        resourceContext: { tier: "basic" },
+      }),
+      tool(
+        "perm-cross",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "unrelated",
+            name: "other",
+          },
+          accessCheck: {
+            verb: "get",
+            resource: "secrets",
+            namespace: "unrelated",
+            allowed: false,
+          },
+        },
+        {
+          summary: JSON.stringify({
+            kind: "ServiceAccount",
+            namespace: "unrelated",
+            name: "other",
+          }),
+        },
+      ),
+    ]);
+    const denial = groupsOf(projection.groups, "permissions")[0].latest;
+    expect(denial.relevance).toBe("broader");
+    expect(denial.tier).toBe("context");
+    expect(denial.tone).toBe("warning");
+  });
+
+  it("renders the subject response as counts and keeps every coverage caveat", () => {
+    const projection = project([
+      tool(
+        "perm",
+        "get_subject_permissions",
+        {
+          subject: {
+            kind: "ServiceAccount",
+            namespace: "shop",
+            name: "api-sa",
+          },
+          bindings: [
+            {
+              bindingKind: "RoleBinding",
+              bindingNamespace: "shop",
+              bindingName: "api-reader",
+              roleKind: "Role",
+              roleNamespace: "shop",
+              roleName: "reader",
+              rulesCount: 3,
+            },
+            {
+              bindingKind: "ClusterRoleBinding",
+              bindingName: "system:basic-user",
+              roleKind: "ClusterRole",
+              roleName: "system:basic-user",
+              rulesCount: 1,
+              inheritedFromGroup: "system:authenticated",
+            },
+          ],
+          flatRules: [
+            { verbs: ["get"], resources: ["pods"] },
+            { verbs: ["list"], resources: ["pods"] },
+          ],
+          truncated: true,
+          usedByPods: ["shop/api-68c7b766dc-fmphn"],
+          podsTotal: 3,
+          narrowHint:
+            "rule list truncated — the subject has more rules than shown; do not treat this list as the subject's complete permissions",
+        },
+        { summary: permissionsArgs },
+      ),
+      tool(
+        "perm-missing",
+        "get_subject_permissions",
+        {
+          subject: { kind: "ServiceAccount", namespace: "shop", name: "ghost" },
+          bindings: [],
+          flatRules: [],
+          subjectWarning:
+            'no ServiceAccount "ghost" exists in namespace "shop" — this empty result reflects a subject that was never found, not an account without permissions. Check the name and namespace.',
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    const permissions = groupsOf(projection.groups, "permissions");
+    expect(permissions[0].latest).toMatchObject({
+      tier: "context",
+      tone: "info",
+      relevance: "broader",
+      title: "Permissions of Service Account shop/api-sa",
+      summary: "2 bindings · 2+ effective rules",
+    });
+    expect(permissions[0].latest.data).toMatchObject({
+      type: "permissions",
+      flatRulesCount: 2,
+      truncated: true,
+      usedByPods: ["shop/api-68c7b766dc-fmphn"],
+      podsTotal: 3,
+    });
+    expect(permissions[1].latest.summary).toBe(
+      "0 bindings · 0 effective rules",
+    );
+    expect(
+      projection.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([
+      ["Permissions", "truncated"],
+      ["Permissions", "truncated"],
+      ["Permissions", "unknown"],
+    ]);
+    expect(projection.limitations[0].message).toContain("rule list truncated");
+    expect(projection.limitations[1].message).toBe(
+      "Only 1 of 3 pods running as this subject were listed.",
+    );
+  });
+
+  it("rejects malformed permission payloads", () => {
+    const projection = project([
+      tool(
+        "perm-bad",
+        "get_subject_permissions",
+        { subject: { kind: "ServiceAccount" }, bindings: [], flatRules: [] },
+        { summary: permissionsArgs },
+      ),
+      tool(
+        "perm-bad-check",
+        "get_subject_permissions",
+        {
+          subject: { kind: "ServiceAccount", namespace: "shop", name: "x" },
+          accessCheck: { verb: "get", resource: "secrets", namespace: "shop" },
+        },
+        { summary: permissionsArgs },
+      ),
+      tool(
+        "perm-bad-binding",
+        "get_subject_permissions",
+        {
+          subject: { kind: "ServiceAccount", namespace: "shop", name: "x" },
+          bindings: [{ bindingKind: "RoleBinding" }],
+          flatRules: [],
+        },
+        { summary: permissionsArgs },
+      ),
+      tool(
+        "perm-bad-rule",
+        "get_subject_permissions",
+        {
+          subject: { kind: "ServiceAccount", namespace: "shop", name: "x" },
+          bindings: [],
+          flatRules: [{ resources: ["pods"] }],
+        },
+        { summary: permissionsArgs },
+      ),
+    ]);
+    expect(projection.groups).toHaveLength(0);
+    expect(
+      projection.limitations.map((limitation) => limitation.source),
+    ).toEqual(["Permissions", "Access check"]);
+    expect(projection.limitations[0].sources).toHaveLength(3);
+  });
+});
+
+describe("card leads and deep-link subjects", () => {
+  it("leads an events card with the newest warning's reason and message", () => {
+    const projection = project([
+      tool(
+        "events",
+        "get_events",
+        {
+          events: [
+            {
+              reason: "Scheduled",
+              message: "Successfully assigned shop/api-abc to node-1",
+              type: "Normal",
+              count: 1,
+              lastTimestamp: "2026-09-02T11:00:00Z",
+            },
+            warningEvent,
+            {
+              reason: "Unhealthy",
+              message: "Readiness probe failed: connection refused",
+              type: "Warning",
+              count: 12,
+              lastTimestamp: "2026-09-02T10:30:00Z",
+            },
+          ],
+        },
+        {
+          summary: JSON.stringify({
+            kind: "Deployment",
+            namespace: "shop",
+            name: "api",
+          }),
+        },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "events")[0].latest.summary).toBe(
+      "Unhealthy: Readiness probe failed: connection refused · 3 event groups · Deployment shop/api",
+    );
+  });
+
+  it("carries the producer's change subject so a card can open its Timeline", () => {
+    const change = {
+      kind: "Deployment",
+      apiVersion: "apps/v1",
+      namespace: "shop",
+      name: "api",
+      changeType: "update",
+      timestamp: "2026-09-02T09:00:00Z",
+    };
+    const projection = project([
+      tool(
+        "changes",
+        "get_changes",
+        { changes: [change] },
+        {
+          summary: JSON.stringify({
+            kind: "Deployment",
+            namespace: "shop",
+            name: "api",
+          }),
+        },
+      ),
+      tool(
+        "changes-ns",
+        "get_changes",
+        { changes: [change] },
+        { summary: JSON.stringify({ namespace: "shop" }) },
+      ),
+      tool("diagnose", "diagnose", {
+        resource: deployment,
+        resourceContext: { tier: "basic" },
+        recentChanges: [change],
+      }),
+      tool("resource", "get_resource", {
+        resource: {
+          ...deployment,
+          metadata: { namespace: "shop", name: "web" },
+        },
+        resourceContext: { tier: "basic" },
+        recentChanges: [change],
+        recentChangesSaturated: false,
+        recentChangesCoverageLimited: false,
+      }),
+    ]);
+    const changes = groupsOf(projection.groups, "changes").map(
+      (group) => (group.latest.data as { subject?: unknown }).subject,
+    );
+    expect(changes).toEqual([
+      { kind: "Deployment", namespace: "shop", name: "api" },
+      undefined,
+      { kind: "Deployment", namespace: "shop", name: "api" },
+      { kind: "Deployment", namespace: "shop", name: "web" },
+    ]);
+  });
+});
+
+describe("query_prometheus evidence", () => {
+  const rangeSeries = [
+    {
+      labels: { pod: "api-7f6-abc" },
+      dataPoints: [
+        { timestamp: 1_788_679_043, value: 169_377_792 },
+        { timestamp: 1_788_679_068, value: 171_401_216 },
+      ],
+    },
+  ];
+  // The pods a diagnose bundle established as the target's own, so an agent
+  // query naming exactly them is target evidence. A prefix over the same
+  // namespace is not: "api-.*" also selects api-worker's pods.
+  const establishedPods = ["api-7f6-abc", "api-7f6-def"];
+  const podSetPattern = `^(${establishedPods.join("|")})$`;
+  const targetSelectors = [
+    {
+      metric: "container_memory_working_set_bytes",
+      matchers: [
+        { label: "namespace", op: "=", value: "shop" },
+        { label: "pod", op: "=~", value: podSetPattern },
+      ],
+    },
+  ];
+  const prefixSelectors = [
+    {
+      metric: "container_memory_working_set_bytes",
+      matchers: [
+        { label: "namespace", op: "=", value: "shop" },
+        { label: "pod", op: "=~", value: "api-.*" },
+      ],
+    },
+  ];
+  // A diagnose of the target that lists its pods, so a later query can be
+  // proved to be about them.
+  function podsBundle() {
+    return tool(
+      "diag-pods",
+      "diagnose",
+      { resource: deployment, pods: 2, podNames: establishedPods },
+      {
+        summary: JSON.stringify({
+          kind: "Deployment",
+          namespace: "shop",
+          name: "api",
+        }),
+      },
+    );
+  }
+  function promResult(patch: Record<string, unknown> = {}) {
+    return {
+      query: `sum(container_memory_working_set_bytes{namespace="shop",pod=~"${podSetPattern}"})`,
+      type: "range",
+      start: "2026-09-06T07:17:23Z",
+      end: "2026-09-06T09:17:23Z",
+      step: "25s",
+      resultType: "matrix",
+      seriesCount: 1,
+      series: rangeSeries,
+      selectors: targetSelectors,
+      ...patch,
+    };
+  }
+
+  it("keeps an unrecognised metric's own name as the title", () => {
+    const projection = project([
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          query: 'sum(acme_widget_queue_depth{namespace="shop"})',
+          selectors: [
+            {
+              metric: "acme_widget_queue_depth",
+              matchers: [{ label: "namespace", op: "=", value: "shop" }],
+            },
+          ],
+        }),
+      ),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.title).toBe("acme_widget_queue_depth");
+    // No family label means the summary keeps its generic lead-in rather than
+    // repeating the name already in the title.
+    expect(group.latest.summary).toContain("Prometheus · 1 series");
+  });
+
+  it("keeps the generic title when the selectors name no metric", () => {
+    const projection = project([
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          query: 'sum({namespace="shop"})',
+          selectors: [
+            {
+              metric: "",
+              matchers: [{ label: "namespace", op: "=", value: "shop" }],
+            },
+          ],
+        }),
+      ),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.title).toBe("Prometheus metrics");
+    expect(group.latest.summary).toBe("1 series · 2h window · 25s step");
+  });
+
+  it("charts a range query scoped to the target as target evidence", () => {
+    const projection = project([
+      podsBundle(),
+      tool("prom", "query_prometheus", promResult(), {
+        summary: JSON.stringify({ query: "sum(...)", type: "range" }),
+      }),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group).toBeDefined();
+    expect(group.latest.relevance).toBe("target");
+    expect(group.latest.tier).toBe("supporting");
+    expect(group.latest.tone).toBe("neutral");
+    expect(group.latest.title).toBe("Memory working set · Deployment shop/api");
+    expect(group.latest.summary).toBe(
+      "container_memory_working_set_bytes · 1 series · 2h window · 25s step",
+    );
+    const data = group.latest.data;
+    if (data.type !== "metrics") throw new Error("expected metrics");
+    expect(data.mode).toBe("range");
+    expect(data.origin).toBe("query");
+    expect(data.subject).toEqual({
+      kind: "Deployment",
+      group: "apps",
+      namespace: "shop",
+      name: "api",
+    });
+    expect(data.unit).toBe("bytes");
+    expect(data.series).toEqual(rangeSeries);
+    expect(investigationEvidenceSubjectRef(data)).toEqual(data.subject);
+    // The chart and the diagnose bundle that established its pods.
+    expect(projection.coverage.projected).toBe(2);
+  });
+
+  it("claims a unit only for a single bare metric that states one", () => {
+    const projection = project([
+      tool(
+        "bare",
+        "query_prometheus",
+        promResult({
+          query:
+            'container_memory_working_set_bytes{namespace="shop",pod=~"api-.*"}',
+        }),
+      ),
+      tool(
+        "rate",
+        "query_prometheus",
+        promResult({
+          query:
+            'rate(container_cpu_usage_seconds_total{namespace="shop",pod=~"api-.*"}[5m])',
+          selectors: [
+            {
+              metric: "container_cpu_usage_seconds_total",
+              matchers: targetSelectors[0].matchers,
+            },
+          ],
+        }),
+      ),
+    ]);
+    const units = groupsOf(projection.groups, "metrics").map((group) =>
+      group.latest.data.type === "metrics" ? group.latest.data.unit : "?",
+    );
+    expect(units).toEqual(["bytes", ""]);
+  });
+
+  it("renders an instant query as values, not a chart", () => {
+    const projection = project([
+      tool(
+        "instant",
+        "query_prometheus",
+        promResult({
+          type: "instant",
+          start: undefined,
+          end: undefined,
+          step: undefined,
+          resultType: "vector",
+          series: [
+            {
+              labels: { pod: "api-7f6-abc" },
+              dataPoints: [{ timestamp: 1_788_679_068, value: 3 }],
+            },
+          ],
+        }),
+      ),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.title).toBe("Memory working set");
+    expect(group.latest.summary).toBe(
+      "container_memory_working_set_bytes · 1 series",
+    );
+    expect(group.latest.data.type === "metrics" && group.latest.data.mode).toBe(
+      "instant",
+    );
+  });
+
+  it("reports a truncated result as a limitation with its cardinality, never as a chart", () => {
+    const projection = project([
+      tool(
+        "big",
+        "query_prometheus",
+        promResult({
+          series: [],
+          truncated: true,
+          summary: {
+            seriesCount: 812,
+            totalDataPoints: 194_880,
+            labelCardinality: { pod: 812, container: 3 },
+            suggestion: "topk(5, ...)",
+          },
+          note: "Result exceeded the 96 KiB cap.",
+        }),
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    expect(projection.limitations).toHaveLength(1);
+    expect(projection.limitations[0].kind).toBe("truncated");
+    expect(projection.limitations[0].message).toContain("812 series");
+    expect(projection.limitations[0].message).toContain(
+      "812 distinct pod values",
+    );
+    expect(projection.limitations[0].message).toContain("Result exceeded");
+    expect(projection.coverage.limited).toBe(1);
+  });
+
+  it("keeps a query that matched nothing as a fact about the window", () => {
+    const projection = project([
+      tool("none", "query_prometheus", promResult({ series: [] })),
+    ]);
+    const [group] = groupsOf(projection.groups, "metrics");
+    expect(group.latest.summary).toBe(
+      "container_memory_working_set_bytes · No series matched · 2h window · 25s step",
+    );
+  });
+
+  it("classifies scope from the producer's selectors, never from the expression text", () => {
+    const withNamespace = (
+      metric: string,
+      extra: Array<{ label: string; op: string; value: string }> = [],
+    ) => ({
+      metric,
+      matchers: [{ label: "namespace", op: "=", value: "shop" }, ...extra],
+    });
+    const cases: Array<[string, Record<string, unknown>, string]> = [
+      ["namespace only", { selectors: [withNamespace("up")] }, "broader"],
+      [
+        "workload label",
+        {
+          selectors: [
+            withNamespace("kube_deployment_status_replicas_available", [
+              { label: "deployment", op: "=", value: "api" },
+            ]),
+          ],
+        },
+        "target",
+      ],
+      [
+        "pod named by the workload's prefix, never established",
+        {
+          selectors: [
+            withNamespace("kube_pod_container_status_restarts_total", [
+              { label: "pod", op: "=", value: "api-7f6-abc" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "owner join over the namespace",
+        {
+          selectors: [
+            withNamespace("kube_pod_owner", [
+              { label: "owner_kind", op: "=", value: "ReplicaSet" },
+              { label: "owner_name", op: "=~", value: "^(api-7f6)$" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "container alone",
+        {
+          selectors: [
+            withNamespace("container_memory_working_set_bytes", [
+              { label: "container", op: "=", value: "api" },
+            ]),
+          ],
+        },
+        "broader",
+      ],
+      [
+        "sibling workload",
+        {
+          selectors: [
+            withNamespace("kube_deployment_status_replicas_available", [
+              { label: "deployment", op: "=", value: "worker" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "pod regex with an optional dash",
+        {
+          selectors: [
+            withNamespace("kube_pod_container_status_restarts_total", [
+              { label: "pod", op: "=~", value: "api-?.*" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "pod regex alternation behind the target prefix",
+        {
+          selectors: [
+            withNamespace("kube_pod_container_status_restarts_total", [
+              { label: "pod", op: "=~", value: "api-.*|worker-.*" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "workload alternation",
+        {
+          selectors: [
+            withNamespace("kube_deployment_status_replicas_available", [
+              { label: "deployment", op: "=~", value: "api|worker" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "statefulset label on a deployment target",
+        {
+          selectors: [
+            withNamespace("kube_statefulset_status_replicas_ready", [
+              { label: "statefulset", op: "=", value: "api" },
+            ]),
+          ],
+        },
+        "producer-related",
+      ],
+      [
+        "braced target numerator over a bare cluster denominator",
+        {
+          query:
+            'sum(container_memory_working_set_bytes{namespace="shop",pod=~"api-.*"}) / scalar(sum(machine_memory_bytes))',
+          selectors: [
+            ...targetSelectors,
+            { metric: "machine_memory_bytes", matchers: [] },
+          ],
+        },
+        "broader",
+      ],
+      [
+        "other namespace",
+        {
+          selectors: [
+            {
+              metric: "up",
+              matchers: [
+                { label: "namespace", op: "=", value: "other" },
+                { label: "pod", op: "=~", value: "api-.*" },
+              ],
+            },
+          ],
+        },
+        "broader",
+      ],
+      ["empty selectors", { selectors: [] }, "broader"],
+      [
+        "unknown selectors",
+        { selectors: targetSelectors, selectorsUnknown: true },
+        "broader",
+      ],
+    ];
+    for (const [name, patch, expected] of cases) {
+      const projection = project([
+        tool(`case-${name}`, "query_prometheus", promResult(patch)),
+      ]);
+      const [group] = groupsOf(projection.groups, "metrics");
+      expect(group?.latest.relevance, name).toBe(expected);
+      expect(
+        group?.latest.data.type === "metrics"
+          ? group.latest.data.subject
+          : "missing",
+        name,
+      ).toEqual(
+        expected === "target"
+          ? {
+              kind: "Deployment",
+              group: "apps",
+              namespace: "shop",
+              name: "api",
+            }
+          : undefined,
+      );
+      expect(group?.latest.tier, name).toBe(
+        expected === "broader" ? "context" : "supporting",
+      );
+    }
+  });
+
+  // The diagnose prompt tells the agent to scope a query as `pod=~'^(a|b)$'`.
+  // A Pod target has to recognise its own name written that way, or following
+  // our own instruction demotes the target's own series.
+  it("accepts the anchored set form the prompt asks for on a Pod target", () => {
+    const podTarget = {
+      kind: "Pod",
+      group: "",
+      namespace: "shop",
+      name: "api-7f6-abc",
+    };
+    const podSelector = (value: string) => [
+      {
+        metric: "container_cpu_usage_seconds_total",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "pod", op: "=~", value },
+        ],
+      },
+    ];
+    expect(metricsScope(podTarget, podSelector("api-7f6-abc"), false)).toBe(
+      "target",
+    );
+    expect(metricsScope(podTarget, podSelector("^(api-7f6-abc)$"), false)).toBe(
+      "target",
+    );
+    // A set that also names a neighbour is not evidence about this pod alone,
+    // and a prefix still selects pods this one does not stand for.
+    expect(
+      metricsScope(
+        podTarget,
+        podSelector("^(api-7f6-abc|api-7f6-def)$"),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(metricsScope(podTarget, podSelector("api-7f6-.*"), false)).toBe(
+      "producer-related",
+    );
+  });
+
+  it("treats an unescaped dot in a workload regex as naming more than the target", () => {
+    const dotted = { ...target, name: "api.v2" };
+    const selector = (value: string) => [
+      {
+        metric: "kube_deployment_status_replicas_available",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "deployment", op: "=~", value },
+        ],
+      },
+    ];
+    expect(metricsScope(dotted, selector("api.v2"), false)).toBe(
+      "producer-related",
+    );
+    expect(metricsScope(dotted, selector("api\\.v2"), false)).toBe("target");
+    expect(
+      metricsScope(
+        dotted,
+        [
+          {
+            metric: "up",
+            matchers: [
+              { label: "namespace", op: "=", value: "shop" },
+              { label: "pod", op: "=~", value: "api\\.v2-.*" },
+            ],
+          },
+        ],
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        dotted,
+        [
+          {
+            metric: "up",
+            matchers: [
+              { label: "namespace", op: "=", value: "shop" },
+              { label: "pod", op: "=~", value: "api.v2-.*" },
+            ],
+          },
+        ],
+        false,
+      ),
+    ).toBe("producer-related");
+  });
+
+  it("names a Pod target only by its exact name and accepts an anchored namespace regex", () => {
+    const pod = { ...target, kind: "Pod", group: "", name: "api-7f6-abc" };
+    const selector = (
+      namespace: { op: string; value: string },
+      podMatcher: { op: string; value: string },
+    ) => [
+      {
+        metric: "container_memory_working_set_bytes",
+        matchers: [
+          { label: "namespace", ...namespace },
+          { label: "pod", ...podMatcher },
+        ],
+      },
+    ];
+    const exactNs = { op: "=", value: "shop" };
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=~", value: "api-7f6-abc-.*" }),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=", value: "api-7f6-abc" }),
+        false,
+      ),
+    ).toBe("target");
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=~", value: "api-7f6-abc" }),
+        false,
+      ),
+    ).toBe("target");
+    expect(
+      metricsScope(
+        pod,
+        selector(exactNs, { op: "=", value: "api-7f6-abc-extra" }),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        target,
+        selector({ op: "=~", value: "shop" }, { op: "=~", value: "api-.*" }),
+        false,
+      ),
+    ).toBe("producer-related");
+    expect(
+      metricsScope(
+        target,
+        selector(
+          { op: "=~", value: "shop" },
+          {
+            op: "=~",
+            value: "^(api-7f6-abc)$",
+          },
+        ),
+        false,
+        new Set(["api-7f6-abc"]),
+      ),
+    ).toBe("target");
+    expect(
+      metricsScope(
+        target,
+        selector(
+          { op: "=~", value: "shop|other" },
+          { op: "=~", value: "api-.*" },
+        ),
+        false,
+      ),
+    ).toBe("broader");
+    expect(
+      metricsScope(
+        target,
+        selector(
+          { op: "!=", value: "kube-system" },
+          { op: "=~", value: "api-.*" },
+        ),
+        false,
+      ),
+    ).toBe("broader");
+  });
+
+  // Membership can also be established by a workload-logs read, which the
+  // main pass adapts into groups as it goes. Classifying a metrics query
+  // against those groups while they are still being built made the verdict
+  // depend on which tool the agent happened to call first: the same facts,
+  // read in the other order, demoted the same chart.
+  it("classifies a metrics query the same whichever order the agent worked in", () => {
+    const loggedPod = "api-68c7b766dc-fmphn";
+    const exactLoggedPod = {
+      metric: "container_memory_working_set_bytes",
+      matchers: [
+        { label: "namespace", op: "=", value: "shop" },
+        { label: "pod", op: "=~", value: `^(${loggedPod})$` },
+      ],
+    };
+    const logs = () =>
+      tool("wl-logs", "get_workload_logs", workloadLogsPayload, {
+        summary: workloadLogsArgs,
+      });
+    const metrics = () =>
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          selectors: [exactLoggedPod],
+          query: `sum(container_memory_working_set_bytes{namespace="shop",pod=~"^(${loggedPod})$"})`,
+        }),
+      );
+
+    const logsFirst = groupsOf(project([logs(), metrics()]).groups, "metrics");
+    const metricsFirst = groupsOf(
+      project([metrics(), logs()]).groups,
+      "metrics",
+    );
+    expect(logsFirst[0].latest.relevance).toBe("target");
+    expect(metricsFirst[0].latest.relevance).toBe(
+      logsFirst[0].latest.relevance,
+    );
+
+    // Across turns too: the read that names the pod may arrive in a later one.
+    const acrossTurns = groupsOf(
+      project([metrics()], [logs()]).groups,
+      "metrics",
+    );
+    expect(acrossTurns[0].latest.relevance).toBe("target");
+  });
+
+  it("proves pod membership from the bundle instead of the workload's name", () => {
+    const withBundle = project([
+      podsBundle(),
+      tool("prom", "query_prometheus", promResult()),
+    ]);
+    expect(groupsOf(withBundle.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+
+    // The same exact set with no bundle to establish it, and the prefix that
+    // would also select a sibling workload's pods: kept, never promoted.
+    const unproven = project([tool("prom", "query_prometheus", promResult())]);
+    expect(groupsOf(unproven.groups, "metrics")[0].latest.relevance).toBe(
+      "producer-related",
+    );
+    const prefixed = project([
+      podsBundle(),
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: prefixSelectors }),
+      ),
+    ]);
+    const prefixGroup = groupsOf(prefixed.groups, "metrics")[0];
+    expect(prefixGroup.latest.relevance).toBe("producer-related");
+    expect(
+      prefixGroup.latest.data.type === "metrics" &&
+        prefixGroup.latest.data.subject,
+    ).toBeUndefined();
+
+    // A subset of the established pods is still about the target.
+    const subset = project([
+      podsBundle(),
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          selectors: [
+            {
+              metric: "container_memory_working_set_bytes",
+              matchers: [
+                { label: "namespace", op: "=", value: "shop" },
+                { label: "pod", op: "=", value: "api-7f6-abc" },
+              ],
+            },
+          ],
+        }),
+      ),
+    ]);
+    expect(groupsOf(subset.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("proves membership whatever order the agent ran its tools in", () => {
+    // The agent may know the pod names from an earlier turn and chart them
+    // before it calls diagnose. The same facts must read the same way.
+    const queryFirst = project([
+      tool("prom", "query_prometheus", promResult()),
+      podsBundle(),
+    ]);
+    expect(groupsOf(queryFirst.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("will not establish target pods from a diagnose that never confirmed success", () => {
+    // This set is what proves a Prometheus selector is about the target, so it
+    // takes confirmed success — the same test the sources use — rather than
+    // merely the absence of an error.
+    const unconfirmed = {
+      ...podsBundle(),
+      isError: undefined as unknown as boolean,
+    };
+    const projection = project([
+      unconfirmed,
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({
+          query: `sum(container_memory_working_set_bytes{namespace="shop",pod=~"${podSetPattern}"})`,
+          selectors: [
+            {
+              metric: "container_memory_working_set_bytes",
+              matchers: [
+                { label: "namespace", op: "=", value: "shop" },
+                { label: "pod", op: "=~", value: podSetPattern },
+              ],
+            },
+          ],
+        }),
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")[0].latest.relevance).not.toBe(
+      "target",
+    );
+  });
+
+  it("does not let a generic workload label claim another kind's series", () => {
+    const workloadSelectors = (type?: string) => [
+      {
+        metric: "container_cpu_usage_seconds_total",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "workload", op: "=", value: "api" },
+          ...(type ? [{ label: "workload_type", op: "=", value: type }] : []),
+        ],
+      },
+    ];
+    const asDeployment = project([
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: workloadSelectors("deployment") }),
+      ),
+    ]);
+    expect(groupsOf(asDeployment.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+    // A StatefulSet also called api in the same namespace is a different
+    // workload, and the series says so.
+    const asStatefulSet = project([
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: workloadSelectors("statefulset") }),
+      ),
+    ]);
+    expect(groupsOf(asStatefulSet.groups, "metrics")[0].latest.relevance).toBe(
+      "producer-related",
+    );
+
+    // The same exclusion written as a regex. Reading only `=` let a sibling's
+    // chart take the target's identity and its change markers.
+    const regexSelectors = (value: string) => [
+      {
+        metric: "container_cpu_usage_seconds_total",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "workload", op: "=", value: "api" },
+          { label: "workload_type", op: "=~", value },
+        ],
+      },
+    ];
+    for (const [value, relevance] of [
+      ["statefulset", "producer-related"],
+      ["^(statefulset)$", "producer-related"],
+      // A set that includes the target kind could be the target, so it is no
+      // conflict; an inexact regex proves nothing either way.
+      ["^(deployment|statefulset)$", "target"],
+      [".*", "target"],
+    ] as const) {
+      const projection = project([
+        tool(
+          "prom",
+          "query_prometheus",
+          promResult({ selectors: regexSelectors(value) }),
+        ),
+      ]);
+      expect(groupsOf(projection.groups, "metrics")[0].latest.relevance).toBe(
+        relevance,
+      );
+    }
+  });
+
+  it("refuses an unescaped dot as proof that a pod set names the target", () => {
+    const dotted = ["api.v2-0"];
+    const bundle = tool(
+      "diag-dotted",
+      "diagnose",
+      { resource: deployment, pods: 1, podNames: dotted },
+      {
+        summary: JSON.stringify({
+          kind: "Deployment",
+          namespace: "shop",
+          name: "api",
+        }),
+      },
+    );
+    const podSelector = (value: string) => [
+      {
+        metric: "container_memory_working_set_bytes",
+        matchers: [
+          { label: "namespace", op: "=", value: "shop" },
+          { label: "pod", op: "=~", value },
+        ],
+      },
+    ];
+    // `^(api.v2-0)$` also selects api-v2-0, so it names more than the pod it
+    // appears to and cannot prove membership.
+    const wildcard = project([
+      bundle,
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: podSelector("^(api.v2-0)$") }),
+      ),
+    ]);
+    expect(groupsOf(wildcard.groups, "metrics")[0].latest.relevance).toBe(
+      "producer-related",
+    );
+    const escaped = project([
+      bundle,
+      tool(
+        "prom",
+        "query_prometheus",
+        promResult({ selectors: podSelector("^(api\\.v2-0)$") }),
+      ),
+    ]);
+    expect(groupsOf(escaped.groups, "metrics")[0].latest.relevance).toBe(
+      "target",
+    );
+  });
+
+  it("rejects a result without the producer's selector inventory", () => {
+    const projection = project([
+      tool("old", "query_prometheus", promResult({ selectors: undefined })),
+      tool(
+        "bad-series",
+        "query_prometheus",
+        promResult({
+          series: [{ labels: {}, dataPoints: [{ timestamp: "x", value: 1 }] }],
+        }),
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    expect(projection.limitations.map((item) => item.kind)).toEqual([
+      "unknown",
+    ]);
+    expect(projection.limitations[0].source).toBe("Prometheus query");
+    expect(projection.limitations[0].sources).toHaveLength(2);
+  });
+
+  it("merges the same query into one card with revisions", () => {
+    const projection = project(
+      [tool("first", "query_prometheus", promResult())],
+      [
+        tool(
+          "second",
+          "query_prometheus",
+          promResult({
+            series: [
+              {
+                labels: { pod: "api-7f6-abc" },
+                dataPoints: [{ timestamp: 1_788_679_043, value: 1 }],
+              },
+            ],
+          }),
+        ),
+      ],
+    );
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(1);
+    expect(groups[0].observations).toHaveLength(2);
+    expect(groups[0].observations[1].changedFromPrevious).toBe(true);
+  });
+});
+
+describe("resource cards scaled by an HPA", () => {
+  const scaled = (state: string) =>
+    tool("workload", "diagnose", {
+      resource: {
+        apiVersion: "apps/v1",
+        kind: "Deployment",
+        metadata: { namespace: "shop", name: "api" },
+      },
+      resourceContext: {
+        tier: "basic",
+        workloadSummary: { replicas: { desired: 5, ready: 5, available: 5 } },
+        scaledBy: [
+          {
+            kind: "HorizontalPodAutoscaler",
+            namespace: "shop",
+            name: "api-hpa",
+            hpaSummary: {
+              state,
+              summary: "summary from Radar",
+              bounds: { min: 1, max: 5, current: 5, desired: 5 },
+            },
+          },
+        ],
+      },
+    });
+
+  it("lifts a healthy workload whose autoscaler cannot act", () => {
+    const result = project([scaled("metrics_unavailable")]);
+    const card = groupsOf(result.groups, "resource")[0].latest;
+    expect(card.tier).toBe("supporting");
+    expect(card.tone).toBe("warning");
+    expect(card.summary).toBe("5/5 replicas ready · HPA: Metrics unavailable");
+  });
+
+  it("treats a maxed-out autoscaler as adverse", () => {
+    const card = groupsOf(
+      project([scaled("limited_max")]).groups,
+      "resource",
+    )[0].latest;
+    expect(card.tone).toBe("warning");
+    expect(card.summary).toBe("5/5 replicas ready · HPA: Maxed");
+  });
+
+  it("leaves an autoscaler that is simply scaling as context", () => {
+    const card = groupsOf(project([scaled("scaling_up")]).groups, "resource")[0]
+      .latest;
+    expect(card.tier).toBe("context");
+    expect(card.tone).toBe("neutral");
+    expect(card.summary).toBe("5/5 replicas ready");
+  });
+});
+
+describe("diagnose metrics evidence", () => {
+  const window = {
+    start: "2026-09-06T07:00:00Z",
+    end: "2026-09-06T08:00:00Z",
+    step: "1m2s",
+  };
+  const samples = [
+    { timestamp: Date.parse(window.start) / 1000, value: 0.003457 },
+    { timestamp: Date.parse(window.end) / 1000, value: 0.004 },
+  ];
+  function vitals(patch: Record<string, unknown> = {}) {
+    return {
+      window,
+      pods: 2,
+      series: [
+        {
+          category: "cpu",
+          unit: "cores",
+          query:
+            "sum(rate(container_cpu_usage_seconds_total{container!='',namespace='shop',pod=~'^(api-a|api-b)$'}[5m]))",
+          series: [{ labels: {}, dataPoints: samples }],
+        },
+        {
+          category: "memory",
+          unit: "bytes",
+          query:
+            "sum(max by (pod,namespace,container) (container_memory_working_set_bytes{container!='',namespace='shop',pod=~'^(api-a|api-b)$'}))",
+          series: [{ labels: {}, dataPoints: samples }],
+        },
+        {
+          category: "restarts",
+          unit: "count",
+          query:
+            "sum(round(increase(kube_pod_container_status_restarts_total{namespace='shop',pod=~'^(api-a|api-b)$'}[1h])))",
+          series: [],
+        },
+      ],
+      ...patch,
+    };
+  }
+  const args = { kind: "Deployment", namespace: "shop", name: "api" };
+
+  it("charts each captured category as target evidence with the diagnosed resource as subject", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        { resource: deployment, pods: 2, metrics: vitals() },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups.map((group) => group.latest.title)).toEqual([
+      "CPU usage · Deployment shop/api",
+      "Memory working set · Deployment shop/api",
+      "Restarts · Deployment shop/api",
+    ]);
+    for (const group of groups) {
+      expect(group.latest.relevance).toBe("target");
+      expect(group.latest.tier).toBe("supporting");
+      expect(group.latest.tone).toBe("neutral");
+      const data = group.latest.data;
+      if (data.type !== "metrics") throw new Error("expected metrics");
+      expect(data.origin).toBe("diagnose");
+      expect(data.mode).toBe("range");
+      expect(data.start).toBe(window.start);
+      expect(data.end).toBe(window.end);
+      expect(data.step).toBe(window.step);
+      expect(data.pods).toBe(2);
+      expect(data.partial).toBe(false);
+      expect(data.truncated).toBe(false);
+      expect(data.subject).toEqual({
+        kind: "Deployment",
+        group: "apps",
+        namespace: "shop",
+        name: "api",
+      });
+      expect(investigationEvidenceSubjectRef(data)).toEqual(data.subject);
+    }
+    const [cpu, , restarts] = groups;
+    expect(cpu.latest.summary).toBe("2 current pods · 60m window · 1m2s step");
+    const cpuData = cpu.latest.data;
+    if (cpuData.type !== "metrics") throw new Error("expected metrics");
+    expect(cpuData.unit).toBe("cores");
+    expect(cpuData.label).toBe("CPU usage");
+    expect(cpuData.query).toContain("pod=~'^(api-a|api-b)$'");
+    expect(cpuData.series).toEqual([{ labels: {}, dataPoints: samples }]);
+    expect(restarts.latest.summary).toBe(
+      "No samples in the window · 60m window · 1m2s step",
+    );
+    expect(
+      projection.limitations.filter(
+        (item) => item.source === "Workload metrics",
+      ),
+    ).toHaveLength(0);
+  });
+
+  it("merges a re-diagnose of the same workload into the same chart per category", () => {
+    const later = vitals({
+      window: { ...window, end: "2026-09-06T08:30:00Z" },
+    });
+    const projection = project(
+      [
+        tool(
+          "diag-1",
+          "diagnose",
+          { resource: deployment, pods: 2, metrics: vitals() },
+          { summary: JSON.stringify(args) },
+        ),
+      ],
+      [
+        tool(
+          "diag-2",
+          "diagnose",
+          { resource: deployment, pods: 2, metrics: later },
+          { summary: JSON.stringify(args) },
+        ),
+      ],
+    );
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(3);
+    expect(groups.every((group) => group.observations.length === 2)).toBe(true);
+    const data = groups[0].latest.data;
+    if (data.type !== "metrics") throw new Error("expected metrics");
+    expect(data.end).toBe("2026-09-06T08:30:00Z");
+  });
+
+  it("reports a producer error as a limitation and still charts what answered", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 2,
+          metrics: vitals({
+            series: [vitals().series[1]],
+            error:
+              "cpu: prom: query error from prometheus: cpu exploded (execution)",
+          }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(1);
+    const limitation = projection.limitations.find(
+      (item) => item.source === "Workload metrics",
+    );
+    expect(limitation?.kind).toBe("error");
+    expect(limitation?.message).toContain("cpu exploded");
+  });
+
+  it("reports an unreachable Prometheus without inventing a chart", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 2,
+          metrics: vitals({
+            series: [],
+            error:
+              "prometheus unreachable: dial tcp 10.0.0.9:9090: connection refused",
+          }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    const limitation = projection.limitations.find(
+      (item) => item.source === "Workload metrics",
+    );
+    expect(limitation?.kind).toBe("error");
+    expect(limitation?.message).toBe(
+      "prometheus unreachable: dial tcp 10.0.0.9:9090: connection refused",
+    );
+  });
+
+  it("says nothing when diagnose carried no metrics field", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        { resource: deployment, pods: 2 },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+    expect(
+      projection.limitations.some((item) => item.source === "Workload metrics"),
+    ).toBe(false);
+  });
+
+  it("notes a partial pod set in the summary and keeps the cap on the card", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 55,
+          metrics: vitals({ pods: 50, partial: true, omittedPods: 5 }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const [cpu] = groupsOf(projection.groups, "metrics");
+    expect(cpu.latest.summary).toBe(
+      "first 50 of 55 current pods · 60m window · 1m2s step · partial pod set",
+    );
+    const data = cpu.latest.data;
+    if (data.type !== "metrics") throw new Error("expected metrics");
+    expect(data.pods).toBe(50);
+    expect(data.partial).toBe(true);
+  });
+
+  it("keeps a neighbour's vitals broader with the neighbour as subject", () => {
+    const worker = {
+      ...deployment,
+      metadata: { namespace: "shop", name: "worker" },
+    };
+    const projection = project([
+      tool(
+        "diag-worker",
+        "diagnose",
+        { resource: worker, pods: 2, metrics: vitals() },
+        {
+          summary: JSON.stringify({
+            kind: "Deployment",
+            namespace: "shop",
+            name: "worker",
+          }),
+        },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(3);
+    for (const group of groups) {
+      expect(group.latest.relevance).toBe("broader");
+      expect(group.latest.tier).toBe("context");
+      const data = group.latest.data;
+      if (data.type !== "metrics") throw new Error("expected metrics");
+      expect(data.subject).toEqual({
+        kind: "Deployment",
+        group: "apps",
+        namespace: "shop",
+        name: "worker",
+      });
+    }
+  });
+
+  it("rejects a malformed metrics field instead of charting it", () => {
+    const malformed: Record<string, unknown>[] = [
+      { window: { start: window.start }, pods: "two", series: [] },
+      { window: { ...window, end: "not a date" }, pods: 2, series: [] },
+      { window: { ...window, end: window.start }, pods: 2, series: [] },
+      { window, pods: -1, series: [] },
+      { window, pods: 1.5, series: [] },
+      { window, pods: 2, omittedPods: -3, series: [] },
+    ];
+    for (const metrics of malformed) {
+      const projection = project([
+        tool(
+          "diag",
+          "diagnose",
+          { resource: deployment, pods: 2, metrics },
+          { summary: JSON.stringify(args) },
+        ),
+      ]);
+      expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+      expect(
+        projection.limitations.some(
+          (item) =>
+            item.source === "Workload metrics" && item.kind === "unknown",
+        ),
+      ).toBe(true);
+    }
+  });
+
+  it("keeps same-named workloads in different API groups on separate charts", () => {
+    const rollout = {
+      ...deployment,
+      apiVersion: "argoproj.io/v1alpha1",
+      kind: "Rollout",
+    };
+    const projection = project([
+      tool(
+        "diag-deployment",
+        "diagnose",
+        { resource: deployment, pods: 2, metrics: vitals() },
+        { summary: JSON.stringify(args) },
+      ),
+      tool(
+        "diag-rollout",
+        "diagnose",
+        { resource: rollout, pods: 2, metrics: vitals() },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups).toHaveLength(6);
+    expect(groups.every((group) => group.observations.length === 1)).toBe(true);
+    expect(new Set(groups.map((group) => group.identity)).size).toBe(6);
+  });
+
+  it("rejects inherited object keys posing as categories", () => {
+    for (const category of ["__proto__", "constructor", "toString"]) {
+      const projection = project([
+        tool(
+          "diag",
+          "diagnose",
+          {
+            resource: deployment,
+            pods: 2,
+            metrics: vitals({
+              series: [{ ...vitals().series[0], category }],
+            }),
+          },
+          { summary: JSON.stringify(args) },
+        ),
+      ]);
+      expect(groupsOf(projection.groups, "metrics")).toHaveLength(0);
+      expect(
+        projection.limitations.some(
+          (item) =>
+            item.source === "Workload metrics" && item.kind === "unknown",
+        ),
+      ).toBe(true);
+    }
+  });
+
+  it("rejects a category outside the contract or a series without a unit", () => {
+    const projection = project([
+      tool(
+        "diag",
+        "diagnose",
+        {
+          resource: deployment,
+          pods: 2,
+          metrics: vitals({
+            series: [
+              { ...vitals().series[0], category: "latency" },
+              { ...vitals().series[1], unit: undefined },
+              vitals().series[2],
+            ],
+          }),
+        },
+        { summary: JSON.stringify(args) },
+      ),
+    ]);
+    const groups = groupsOf(projection.groups, "metrics");
+    expect(groups.map((group) => group.latest.title)).toEqual([
+      "Restarts · Deployment shop/api",
+    ]);
+    expect(
+      projection.limitations.some(
+        (item) => item.source === "Workload metrics" && item.kind === "unknown",
+      ),
+    ).toBe(true);
+  });
+});
+
+describe("live-run follow-ups", () => {
+  it("reads the producer's nil-slice null as an empty events or changes result", () => {
+    const projection = project([
+      tool(
+        "events-none",
+        "get_events",
+        { events: null },
+        {
+          summary: JSON.stringify({
+            kind: "Pod",
+            namespace: "shop",
+            name: "api",
+          }),
+        },
+      ),
+      tool(
+        "changes-none",
+        "get_changes",
+        { changes: null },
+        {
+          summary: JSON.stringify({
+            kind: "Deployment",
+            namespace: "shop",
+            name: "api",
+            since: "24h",
+          }),
+        },
+      ),
+    ]);
+    // A complete, successful events query that returned nothing is a checked
+    // receipt for its scope; the producer marks a denied namespace separately.
+    expect(
+      projection.groups.map((group) => [
+        group.latest.data.type,
+        group.latest.title,
+      ]),
+    ).toEqual([["receipt", "No events in this window"]]);
+    expect(
+      projection.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([["Recent changes", "unknown"]]);
+  });
+
+  it("keeps one identity for a blocker whether one pod holds it or several", () => {
+    const blocker = (name: string) => ({
+      kind: "Pod",
+      name,
+      reason: "Unschedulable",
+      severity: "critical",
+      message: "1 node(s) no free host ports",
+    });
+    const bundle = (pods: string[]) => ({
+      resource: {
+        apiVersion: "apps/v1",
+        kind: "DaemonSet",
+        metadata: { namespace: "opencost", name: "node-exporter" },
+      },
+      resourceContext: { tier: "basic" },
+      pods: pods.length,
+      startupBlockers: pods.map(blocker),
+    });
+    // Two pods recover to one between diagnoses. The blocker is the same
+    // finding, so it must update its card rather than open a second one
+    // beside it saying the same thing.
+    const projection = projectInvestigationEvidence(
+      [
+        {
+          status: "done",
+          timeline: [tool("first", "diagnose", bundle(["a", "b"]))],
+        },
+        {
+          status: "done",
+          verify: true,
+          timeline: [tool("second", "diagnose", bundle(["a"]))],
+        },
+      ],
+      {
+        kind: "DaemonSet",
+        group: "apps",
+        namespace: "opencost",
+        name: "node-exporter",
+      },
+    );
+    const startup = projection.groups.filter(
+      (group) => group.latest.data.type === "startup",
+    );
+    expect(startup).toHaveLength(1);
+    expect(startup[0].observations).toHaveLength(2);
+    expect(startup[0].latest.summary).toBe("1 node(s) no free host ports");
+  });
+
+  it("merges identical startup blockers across pods into one card with the pod list", () => {
+    const blocker = (
+      name: string,
+      message = "1 node(s) no free host ports",
+    ) => ({
+      kind: "Pod",
+      name,
+      reason: "Unschedulable",
+      severity: "critical",
+      message,
+    });
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: {
+          apiVersion: "apps/v1",
+          kind: "DaemonSet",
+          metadata: { namespace: "opencost", name: "node-exporter" },
+        },
+        resourceContext: { tier: "basic" },
+        pods: 3,
+        startupBlockers: [
+          blocker("node-exporter-a"),
+          blocker("node-exporter-b"),
+          blocker("node-exporter-c", "0/10 nodes: insufficient memory"),
+        ],
+      }),
+    ]);
+    const startup = projection.groups.filter(
+      (group) => group.latest.data.type === "startup",
+    );
+    expect(
+      startup.map((group) => [
+        group.latest.summary,
+        group.latest.data.type === "startup" ? group.latest.data.pods : null,
+      ]),
+    ).toEqual([
+      [
+        "2 pods · 1 node(s) no free host ports",
+        ["node-exporter-a", "node-exporter-b"],
+      ],
+      // A blocker only one pod holds still carries that pod, so the pods a
+      // later Prometheus query is proved against do not depend on how many
+      // happened to share a reason.
+      ["0/10 nodes: insufficient memory", ["node-exporter-c"]],
+    ]);
+    expect(startup[1].id).not.toBe(startup[0].id);
+  });
+
+  it("folds pods' startup blocker into the classified issue that repeats it", () => {
+    const blocker = (name: string) => ({
+      kind: "Pod",
+      name,
+      reason: "Unschedulable",
+      severity: "critical",
+      message: "1 node(s) no free host ports",
+    });
+    const projection = project([
+      tool("diagnose", "diagnose", {
+        resource: {
+          apiVersion: "apps/v1",
+          kind: "DaemonSet",
+          metadata: { namespace: "opencost", name: "node-exporter" },
+        },
+        resourceContext: { tier: "basic" },
+        pods: 2,
+        relatedIssues: [
+          {
+            id: "issue-unsched",
+            severity: "critical",
+            source: "scheduling",
+            category: "unschedulable",
+            category_group: "startup",
+            grouping_scope: "workload",
+            kind: "DaemonSet",
+            namespace: "opencost",
+            name: "node-exporter",
+            reason: "Unschedulable",
+            message: "1 node(s) no free host ports",
+          },
+        ],
+        startupBlockers: [
+          blocker("node-exporter-a"),
+          blocker("node-exporter-b"),
+        ],
+      }),
+    ]);
+    expect(
+      projection.groups.filter((group) => group.latest.data.type === "startup"),
+    ).toHaveLength(0);
+    const [issue] = projection.groups.filter(
+      (group) => group.latest.data.type === "issue",
+    );
+    expect(
+      issue.latest.data.type === "issue" && issue.latest.data.pods,
+    ).toEqual(["node-exporter-a", "node-exporter-b"]);
+  });
+
+  it("files a denied events namespace as an access limitation, not a receipt", () => {
+    const projection = project([
+      tool(
+        "events-denied",
+        "get_events",
+        { events: [], accessDenied: true },
+        {
+          summary: JSON.stringify({ namespace: "locked", kind: "Pod" }),
+        },
+      ),
+    ]);
+    expect(projection.groups).toHaveLength(0);
+    expect(
+      projection.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([["Events", "error"]]);
+    expect(projection.limitations[0].message).toContain(
+      "not readable with your permissions",
+    );
+  });
+
+  it("keeps a cluster-wide events read that was narrowed to readable namespaces from reading as a clean cluster", () => {
+    const empty = project([
+      tool(
+        "events-partial-empty",
+        "get_events",
+        { events: [], partialScope: true, scopeNamespaces: ["alpha", "beta"] },
+        { summary: JSON.stringify({}) },
+      ),
+    ]);
+    const [receipt] = groupsOf(empty.groups, "receipt");
+    expect(receipt.latest.title).toBe(
+      "No events in the namespaces you can read",
+    );
+    const narrowedBody =
+      receipt.latest.data.type === "receipt" ? receipt.latest.data.message : "";
+    expect(narrowedBody).toContain("alpha, beta");
+    // The load-bearing half: an empty answer from the namespaces a reader can
+    // see must never read as an answer about the cluster.
+    expect(narrowedBody).toContain("does not clear the cluster");
+    expect(empty.limitations).toHaveLength(0);
+
+    const found = project([
+      tool(
+        "events-partial",
+        "get_events",
+        {
+          events: [
+            {
+              type: "Warning",
+              reason: "BackOff",
+              message: "back-off restarting",
+              count: 3,
+              lastTimestamp: "2026-09-02T09:00:00Z",
+              involvedObject: { kind: "Pod", namespace: "alpha", name: "api" },
+            },
+          ],
+          partialScope: true,
+          scopeNamespaces: ["alpha", "beta"],
+        },
+        { summary: JSON.stringify({}) },
+      ),
+    ]);
+    expect(
+      found.limitations.map((limitation) => [
+        limitation.source,
+        limitation.kind,
+      ]),
+    ).toEqual([["Events", "unknown"]]);
+    expect(found.limitations[0].message).toContain("alpha, beta");
+  });
+
+  it("keeps repeated change reads of one resource on one card and names the window", () => {
+    const change = {
+      kind: "Deployment",
+      apiVersion: "apps/v1",
+      namespace: "shop",
+      name: "api",
+      changeType: "update",
+      timestamp: "2026-09-02T09:00:00Z",
+    };
+    const older = { ...change, timestamp: "2026-09-01T09:00:00Z" };
+    const read = (
+      id: string,
+      args: Record<string, unknown>,
+      changes: unknown[],
+    ) =>
+      tool(id, "get_changes", { changes }, { summary: JSON.stringify(args) });
+    const projection = project([
+      read(
+        "changes-24h",
+        { namespace: "shop", name: "api", since: "24h", kind: "Deployment" },
+        [change],
+      ),
+      read(
+        "changes-48h",
+        {
+          kind: "Deployment",
+          namespace: "shop",
+          name: "api",
+          since: "48h",
+          limit: 30,
+        },
+        [change, older],
+      ),
+      read("changes-ns", { namespace: "shop", since: "24h" }, [change]),
+    ]);
+    const changes = groupsOf(projection.groups, "changes");
+    expect(changes.map((group) => group.identity)).toEqual([
+      "changes:Deployment shop/api",
+      "changes:namespace shop",
+    ]);
+    expect(changes[0].observations).toHaveLength(2);
+    expect(changes[0].observations.map((o) => o.title)).toEqual([
+      "Recent changes · last 24h",
+      "Recent changes · last 48h",
+    ]);
+    expect(changes[0].latest.title).toBe("Recent changes · last 48h");
+    expect(changes[0].latest.summary).toBe("2 changes · Deployment shop/api");
+    expect(changes[1].latest.title).toBe("Recent changes · last 24h");
+  });
+});